@oh-hai/cli 0.2.3 → 0.3.0

package/dist/commands/self-test.js

@@ -0,0 +1,472 @@
+// The END-TO-END SETUP SELF-TEST (docs/specs/cli.md §4.6; issue #660) — the acceptance bar for the
+// inter-agent leg's enablement story: **no green, no done.**
+//
+// WHY THIS EXISTS AT ALL. Every other check in `doctor` proves a PRECONDITION — a token is stored, a
+// URL parses, the Hub answers. None of them proves the thing a human actually depends on: that a
+// message addressed to this agent's running session reaches it. A human who falsely believes their
+// agent got an important message is worse off than one who knows it cannot be reached, so the
+// enablement layer has to be able to demonstrate the loop rather than assert it.
+//
+// WHAT IT ACTUALLY DOES, in order — the same sequence `oh-hai bridge` performs, minus the
+// subprocess:
+//
+//   1. §8.0 capability gates, both directions (addressed send + session-scoped drain).
+//   2. Register a §16.1 session — a real address, minted by the Hub.
+//   3. Send a self-addressed `notify` to `agent:<self>#<sess_…>` carrying a nonce.
+//   4. Drain that session (§8.7.1) and run the FULL §13.4 consuming-agent duties over each entry via
+//      `verifyEntry` — the same module the bridge uses, so a green here is evidence about the code
+//      that runs in production, not about a parallel test-only path.
+//   5. Ack it (§8.7.2: an unacked entry advances no delivery track — the ack is what makes it
+//      *delivered*, so a self-test that skipped it would be testing less than it claims).
+//   6. Re-read the session and report the Hub's OWN reachability conclusion (§15.1) — the same
+//      snapshot behind `fleet ls`, the §8.1 submit ack and the web UI.
+//   7. Close the session, always, so the test does not leak a §16.1 live-session slot.
+//
+// WHY A `notify` AND NOT AN `ask`. The §13.4 v0.5 amendment requires an explicit, deployment-declared
+// `--allow-from` policy before ACTING on an addressed ask/task — deliberately with no permissive
+// default. A self-test that needed one would either force a policy decision the operator has not made
+// yet or, worse, model a permissive default and teach the wrong habit. A `notify` exercises the whole
+// transport, verification, ack and reachability path without touching that gate.
+//
+// HONESTY RULES BAKED INTO THE COPY (they are the product here, not decoration):
+//   • `queued` is ACCEPTANCE, not delivery. Only the ack makes it delivered.
+//   • `unknown` reachability means the Hub has NO SIGNAL — never that the peer is offline.
+//   • This client CANNOT verify the `v1=` MAC: it is keyed with the Hub's key, which an agent bearer
+//     does not hold. The self-test says what it checked (header shape, freshness, replay, entry
+//     shape, addressee) and refuses to imply more.
+import { randomUUID } from "node:crypto";
+import { CliError } from "../envelope.js";
+import { ExitCode } from "../exit-codes.js";
+import { sanitizeForTerminal } from "../terminal.js";
+import { buildNotify } from "./messaging/build.js";
+import { assertHubSpeaksAddressing, assertHubSpeaksSessionDrain, fetchCapability } from "./messaging/capability.js";
+import { submitEnvelope } from "./messaging/http.js";
+import { resolveSubmitIdentity } from "./messaging/identity.js";
+import { DEFAULT_REPLAY_WINDOW_SECONDS, ReplayGuard, ackKeyOf, verifyEntry, } from "./messaging/inbox-entries.js";
+import { ackInboxSession, drainInboxSession } from "./messaging/session-drain.js";
+import { closeSession, getSession, registerSession } from "./messaging/sessions-http.js";
+import { resolveRunId } from "./messaging/shared.js";
+/** How many times the drain is retried before the receive step fails. The Hub files an addressed
+ *  entry synchronously at submit, so the first drain normally finds it; the retries exist for a
+ *  replica that has not yet observed its own write, not as a hope-based wait. Bounded, because a
+ *  diagnostic that hangs is worse than one that fails. */
+const RECEIVE_ATTEMPTS = 5;
+/** Pause between drain attempts. Short: this is a local round-trip, not a poll loop. */
+const RECEIVE_INTERVAL_MS = 750;
+/** The label the throwaway session carries, so a human who sees it in `fleet ls` (or in the web UI,
+ *  mid-run) knows immediately what created it. */
+const SESSION_LABEL = "oh-hai doctor --self-test";
+function fail(name, detail, exitCode = ExitCode.ERROR) {
+    return { name, status: "fail", detail, exitCode };
+}
+function pass(name, detail) {
+    return { name, status: "pass", detail };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** A CliError already carries the §7 exit code that describes WHY this failed (auth / usage /
+ *  network / …). Preserving it means `doctor --self-test` exits with the same code the equivalent
+ *  standalone command would, so a supervisor branching on the code learns the same thing either way. */
+function exitCodeOf(error) {
+    return error instanceof CliError ? error.exitCode : ExitCode.ERROR;
+}
+/**
+ * Run the end-to-end self-test and return its ordered steps.
+ *
+ * NEVER THROWS for a diagnosable failure: a self-test that threw would lose the steps that already
+ * passed, which are exactly what tells a human *where* the loop breaks. Every failure becomes a
+ * `fail` step carrying its exit code; the caller decides the process exit.
+ */
+export async function runSelfTest(ctx) {
+    const steps = [];
+    // 0. Identity. Everything downstream needs a bearer + a resolved agent id, and without one there
+    //    is nothing to test — so this short-circuits rather than producing five confusing failures.
+    let token;
+    let agentId;
+    try {
+        ({ token, agentId } = await resolveSubmitIdentity(ctx));
+    }
+    catch (error) {
+        steps.push(fail("self-test", `cannot run — ${messageOf(error)}`, exitCodeOf(error)));
+        return steps;
+    }
+    // 1. The §8.0 gates, BOTH directions. A pre-v0.5 Hub does not refuse `to` or `?session=`; it
+    //    ignores them (§10), which would mean this test "passed" against a Hub that cannot do the
+    //    thing being tested — or, worse, destructively drained the whole principal mailbox. Both gates
+    //    fail closed on an unreadable capability document.
+    try {
+        await assertHubSpeaksSessionDrain(ctx);
+        await assertHubSpeaksAddressing(ctx, `agent:${agentId}`);
+    }
+    catch (error) {
+        steps.push(fail("self-test hub", messageOf(error), exitCodeOf(error)));
+        return steps;
+    }
+    const capability = await fetchCapability(ctx);
+    steps.push(pass("self-test hub", `MA2H ${capability?.ma2h_version ?? "0.5+"} · session-scoped drain and addressed sends are both supported`));
+    // 2. Register the throwaway session. From here on there is durable Hub state, so every exit path
+    //    runs the cleanup below.
+    let session;
+    try {
+        session = await registerSession(ctx, token, { run_id: resolveRunId(), kind: "cli", label: SESSION_LABEL });
+    }
+    catch (error) {
+        steps.push(fail("self-test session", `could not register a session — ${messageOf(error)}`, exitCodeOf(error)));
+        return steps;
+    }
+    steps.push(pass("self-test session", `registered ${session.id} · addressable at agent:${agentId}#${session.id}`));
+    try {
+        await runAddressedLoop(ctx, {
+            token,
+            agentId,
+            session,
+            steps,
+            // The Hub's advertised §9.7 window when it states one, so the freshness check the bridge would
+            // apply is the one applied here. Comes from the already-cached capability document — no extra
+            // round trip.
+            replayWindowSeconds: typeof capability?.replay_window_seconds === "number" && capability.replay_window_seconds > 0
+                ? capability.replay_window_seconds
+                : DEFAULT_REPLAY_WINDOW_SECONDS,
+        });
+    }
+    finally {
+        // ALWAYS close it — including after a failure. A leaked session holds a §16.1 live-session slot
+        // for the whole lease and, worse, would keep reading `active` to anyone inspecting the fleet
+        // while nothing is draining it: a diagnostic must not manufacture the exact false-belief it
+        // exists to detect. Reported as a step so a failed cleanup is visible rather than swallowed.
+        steps.push(await closeTestSession(ctx, token, session.id));
+    }
+    return steps;
+}
+/** The send → receive → ack → reachability half, with the session already registered. Appends its
+ *  steps in place and returns early on the first failure (each step depends on the previous one). */
+async function runAddressedLoop(ctx, args) {
+    const { token, agentId, session, steps, replayWindowSeconds } = args;
+    const address = `agent:${agentId}#${session.id}`;
+    // A nonce in the body, so the receive step can prove it matched THIS run's message rather than a
+    // stale entry that happened to be sitting in the mailbox.
+    const nonce = randomUUID();
+    // 3. Send.
+    let ack;
+    try {
+        ack = await submitEnvelope(ctx, token, buildNotify({
+            agent: { id: agentId, run_id: resolveRunId(), session: session.id },
+            title: "oh-hai setup self-test",
+            body: `Sent by \`oh-hai doctor --self-test\` to prove this agent's session mailbox works. nonce=${nonce}`,
+            priority: "low",
+            tags: ["self-test"],
+            to: address,
+        }), { addressedTo: address });
+    }
+    catch (error) {
+        steps.push(fail("self-test send", `could not post a self-addressed message — ${messageOf(error)}`, exitCodeOf(error)));
+        return;
+    }
+    // Report the ack verbatim and say what it does NOT mean. `queued` is the §14.2 accept state: the
+    // Hub has the message, nobody has seen it. The destination snapshot is the §15.1 reading at send
+    // time, and `unknown` there means the Hub has no presence signal — never that the peer is down.
+    steps.push(pass("self-test send", `posted ${ack.id} to ${address} · status ${ack.status} (accepted, NOT yet delivered) · ` +
+        `destination ${describeSnapshot(ack.destination)}`));
+    // 4. Receive — through the same §8.7.1 drain and the same §13.4 duties `oh-hai bridge` runs.
+    const policy = {
+        agentId,
+        sessionId: session.id,
+        // A `notify` never reaches the declared-policy gate (it asks nothing of the recipient), so this
+        // stays empty on purpose: the self-test must not model a permissive default it would then teach.
+        allowFrom: [],
+        replayWindowSeconds,
+    };
+    const guard = new ReplayGuard();
+    let received;
+    let drainError;
+    // Ids of entries this drain claimed that are NOT the probe. A §8.7.1 session drain returns
+    // session-addressed entries PLUS the principal's own mail, first-claim-wins — so on a busy agent
+    // this diagnostic can lease production mail it has no business consuming (see `foreignClaimStep`).
+    // Tracked so the operator is told, never silently.
+    const foreign = [];
+    for (let attempt = 0; attempt < RECEIVE_ATTEMPTS && received === undefined; attempt += 1) {
+        if (attempt > 0)
+            await ctx.runtime.sleep(RECEIVE_INTERVAL_MS);
+        let entries;
+        try {
+            entries = await drainInboxSession(ctx, token, session.id);
+        }
+        catch (error) {
+            drainError = error;
+            break;
+        }
+        // SCAN THE WHOLE BATCH, even after the probe is found. The lease is taken by the drain call
+        // above, on every row it returned — so an entry sitting AFTER the probe in FIFO order is already
+        // claimed and already stamped whether this loop looks at it or not. Stopping early would leave it
+        // out of the disclosure below while its sender saw a delivery stamp: the silent case this whole
+        // step exists to prevent. What stops early is the outer loop — no FURTHER drain is issued.
+        for (const entry of entries) {
+            if (!("message" in entry) || entry.message.id !== ack.id) {
+                // Somebody else's mail, already claimed. Do NOT verify it (a §13.4 failure on an unrelated
+                // entry is the real bridge's business, not this probe's, and throwing here would fail a
+                // self-test for a fault it merely walked past), and above all do NOT ack it — an unacked
+                // entry reverts to queued-visible when the lease lapses.
+                foreign.push(foreignIdOf(entry));
+                continue;
+            }
+            // THE ID IS NOT ENOUGH. `verifyEntry` cannot close this gap: the `v1=` MAC is keyed with the
+            // Hub's key, which this process does not hold, and `body` is optional — so a broken Hub or an
+            // on-path proxy could return a structurally valid entry carrying the right id and substituted
+            // content, and the probe would report a green round trip for a payload it never sent. The nonce
+            // is the only content binding available to a client, so it is checked, and a mismatch is a
+            // failure rather than "keep looking" — the right id with the wrong body is a contract fault.
+            if (entry.message.body === undefined || !entry.message.body.includes(nonce)) {
+                // RECORD, do not break. Same reason the success path scans on: the lease was taken by the
+                // drain call over the whole batch, so anything after this entry is already claimed and
+                // already stamped whether the loop looks at it or not. Bailing here would fail the probe AND
+                // silently swallow the disclosure for mail this run delayed — the worst of both.
+                drainError ??= new CliError("server", `the Hub returned an entry with this probe's id (${ack.id}) but without the nonce this run put in its body. ` +
+                    "The content was substituted or corrupted in transit. This client cannot verify the `v1=` MAC (it is keyed " +
+                    "with the Hub's key), so the nonce is the only content binding available — and it does not match.");
+                continue;
+            }
+            try {
+                // Throws on the §13.4 verification classes (exit 12 territory) — a self-test must surface
+                // that loudly rather than retry past it, because it means tampering or a broken Hub.
+                const verdict = verifyEntry(entry, policy, guard, Date.now());
+                if (verdict.kind === "accept")
+                    received = entry;
+            }
+            catch (error) {
+                // Also record-and-continue, for the same reason: the failure is preserved (first one wins,
+                // so the report names what actually went wrong) while the rest of the already-claimed batch
+                // is still accounted for.
+                drainError ??= error;
+            }
+        }
+        if (drainError !== undefined)
+            break;
+    }
+    // Report a foreign claim BEFORE the receive verdict, so it is visible whether the probe succeeded
+    // or not — the side effect happened either way, and it is the operator's to know about.
+    const foreignStep = foreignClaimStep(foreign);
+    if (foreignStep !== undefined)
+        steps.push(foreignStep);
+    if (drainError !== undefined) {
+        steps.push(fail("self-test receive", `the session drain failed — ${messageOf(drainError)}`, exitCodeOf(drainError)));
+        return;
+    }
+    if (received === undefined) {
+        steps.push(fail("self-test receive", `the message posted to ${address} did not come back on this session's mailbox after ${RECEIVE_ATTEMPTS} drains. ` +
+            "The Hub accepted it, so it is queued and un-received — which is exactly the state a running bridge would be " +
+            "failing to clear. Check `oh-hai bridge status` and the Hub before trusting this agent to be reachable."));
+        return;
+    }
+    steps.push(pass("self-test receive", `drained ${ack.id} from ${session.id} and passed §13.4 (signature header shape + freshness + replay, entry shape, ` +
+        "addressee incl. the session qualifier). The `v1=` MAC is keyed with the Hub's key, which no client holds — it was " +
+        "forwarded, not verified."));
+    // 5. Ack. This is the step that turns "the Hub handed it over" into "delivered" (§8.7.2), and it
+    //    is also what stops the Hub redelivering the self-test's own message to the next real bridge.
+    try {
+        const acked = await ackInboxSession(ctx, token, session.id, [ackKeyOf(received)]);
+        if (!acked.includes(ackKeyOf(received))) {
+            steps.push(fail("self-test ack", `the Hub did not confirm the ack for ${ackKeyOf(received)} — it will be redelivered.`));
+            return;
+        }
+    }
+    catch (error) {
+        steps.push(fail("self-test ack", `could not ack the received entry — ${messageOf(error)}`, exitCodeOf(error)));
+        return;
+    }
+    steps.push(pass("self-test ack", `acked ${ackKeyOf(received)} — the round trip is complete and the entry counts as delivered`));
+    // 6. Reachability — the Hub's own conclusion, repeated verbatim. This is the number the human sees
+    //    in `oh-hai fleet ls` and in the web inbox, so quoting it (rather than re-deriving it from
+    //    `last_seen`) is what keeps every surface agreeing.
+    //
+    //    REQUIRED, not advisory. `--self-test` promises to report the reachability a human will see; a
+    //    run that never obtained it has not kept that promise, and reporting green anyway would be the
+    //    same class of overstatement the whole command exists to prevent.
+    try {
+        const after = await getSession(ctx, token, session.id);
+        // An ABSENT snapshot is a contract failure HERE, and only here, which is worth being precise
+        // about because this repo's standing rule is the opposite: an absent capability field must never
+        // be read as "disabled" (messaging/capability.ts). That rule protects a Hub that never claimed to
+        // speak v0.5. This code is past the §8.0 gate, so the Hub HAS declared >= 0.5, and §15.1/#654 put
+        // `reachability` on the session resource unconditionally. So absence is not "this Hub is older",
+        // it is "the resource is missing a field it must carry" — and passing it through as
+        // "not reported" would report green for a run that never obtained the one conclusion the step
+        // exists to report.
+        const snapshot = after.reachability;
+        const snapshotProblem = invalidSnapshot(snapshot);
+        // The `snapshot === undefined` arm is redundant with `snapshotProblem` (absence IS one of the
+        // reasons) and is present only so the compiler narrows `snapshot` for the state check below.
+        if (snapshotProblem !== undefined || snapshot === undefined) {
+            steps.push(fail("self-test reachability", `the round trip completed, but the Hub's §15.1 reachability snapshot for session ${after.id} ${snapshotProblem ?? "is absent"}. ` +
+                "The reachability a human is about to act on was never validly obtained, so this is not a pass — check the " +
+                "Hub (or anything proxying it)."));
+            return;
+        }
+        // A NON-`online` conclusion FAILS — and the reason is worth stating carefully, because this is
+        // the one place where the rule "`unknown` is not `offline`" could be mistaken for a licence to
+        // pass anything. Nothing here re-interprets `unknown` as down. The point is narrower and harder
+        // to argue with: this session was used SECONDS ago — registered, drained and acked, all
+        // session-presenting calls that renew the lease and refresh presence — so a conformant Hub reading
+        // its own freshly-used session has full visibility and derives `online`. Anything else means the
+        // Hub's conclusion CONTRADICTS a round trip that demonstrably just worked, and that conclusion is
+        // exactly what `fleet ls` and the web inbox will show the human. Passing would hand them a green
+        // result that their own dashboard disagrees with — which is the disagreement this step exists to
+        // catch, not an acceptable variation of it.
+        // A STALE `online` is still a failure. The server derives `online` from `last_seen` being inside
+        // the presence freshness window (services/presence.ts), so a schema-shaped
+        // `{state:"online", last_seen:"2000-01-01T…"}` is self-contradicting: the very timestamp that is
+        // supposed to anchor the claim disproves it. Anchoring against the session's own `created_at` —
+        // both Hub-issued, so no client clock is involved and no skew can false-fail — is the tightest
+        // check available: this session was minted THIS run, and the drain and ack that followed are what
+        // refreshed presence, so `last_seen` cannot legitimately predate its creation.
+        const staleOnline = snapshot.state === "online" &&
+            typeof snapshot.last_seen === "string" &&
+            Date.parse(snapshot.last_seen) < Date.parse(after.created_at);
+        if (staleOnline) {
+            steps.push(fail("self-test reachability", `the Hub reported this session \`online\` with last_seen ${sanitizeForTerminal(snapshot.last_seen ?? "")}, which is ` +
+                `BEFORE the session itself was created (${sanitizeForTerminal(after.created_at)}). The timestamp that is meant to ` +
+                "anchor that conclusion disproves it, so the reachability shown in `oh-hai fleet ls` and the web inbox cannot be " +
+                "trusted for this agent. Check the Hub's presence derivation."));
+            return;
+        }
+        if (snapshot.state !== "online") {
+            steps.push(fail("self-test reachability", `the round trip worked, but the Hub then reported this session's reachability as ` +
+                `${describeSnapshot(snapshot)}. This session was registered, drained and acked seconds ago — all ` +
+                "lease-renewing, presence-refreshing calls — so a conformant Hub reading its own freshly-used session derives " +
+                "`online`. This is NOT a claim that the agent is down: it is that the Hub's own conclusion, the one " +
+                "`oh-hai fleet ls` and the web inbox will show, contradicts a loop that just demonstrably completed. Check the " +
+                "Hub's presence derivation before trusting either surface."));
+            return;
+        }
+        steps.push(pass("self-test reachability", `session ${after.state} · reachability ${describeSnapshot(snapshot)} · lease expires ${after.expires_at}. ` +
+            "This is what `oh-hai fleet ls` and the web inbox report; a bridge that stops running goes stale here within the " +
+            "Hub's freshness window."));
+    }
+    catch (error) {
+        steps.push(fail("self-test reachability", `the round trip completed, but the Hub's reachability snapshot could not be read — ${messageOf(error)}. ` +
+            "This check reports the reachability a human will act on, so an unread snapshot is not a pass.", exitCodeOf(error)));
+    }
+}
+/**
+ * Close the throwaway session, turning any failure into a reported step. Never throws: it runs in a
+ * `finally`, where a throw would replace the real result with the cleanup's error.
+ *
+ * A FAILED CLOSE FAILS THE SELF-TEST. That is not pedantry about tidiness. Until its lease lapses, a
+ * leaked session keeps reading `active` — and, having just been drained and acked, briefly reads
+ * *reachable* — to `fleet ls`, the §8.1 ack of anyone addressing it, and the web inbox, while nothing
+ * is draining it. A diagnostic whose own residue manufactures the exact false "something is
+ * listening" signal it exists to detect must not then report green.
+ */
+async function closeTestSession(ctx, token, id) {
+    try {
+        const closed = await closeSession(ctx, token, id);
+        // A 2xx is not the same as a CLOSED session. `closeSession` validates the resource's shape, not
+        // its terminality, so a Hub that answered 200 while leaving the session `active` would let this
+        // report "no session left behind" about a session that is still live and still advertising
+        // reachability. Assert the outcome, not the status code — §16.3 terminal states are `closed` and
+        // `expired`, and either is a genuine "nothing left listening".
+        if (closed.state === "active") {
+            return fail("self-test cleanup", `the Hub accepted the close of ${id} but still reports it \`active\`. It therefore keeps reading live to ` +
+                "`oh-hai fleet ls`, to the web inbox, and to anyone addressing it, with nothing draining it — the false " +
+                `"reachable" signal this run created. Re-run \`oh-hai session close --id ${id}\` and check the Hub.`);
+        }
+        return pass("self-test cleanup", `closed ${closed.id} (${closed.state}) — no session left behind`);
+    }
+    catch (error) {
+        return fail("self-test cleanup", `the self-test session ${id} could NOT be closed — ${messageOf(error)}. Until its lease lapses it still reads ` +
+            "live to `oh-hai fleet ls`, to the web inbox, and to anyone addressing it, with nothing draining it — a false " +
+            `"reachable" signal this run created. Close it now: \`oh-hai session close --id ${id}\`.`, exitCodeOf(error));
+    }
+}
+/**
+ * The id to DISCLOSE for a foreign entry, defensively.
+ *
+ * `isInboxEntryDelivery` (the drain's shape guard) only requires the kind key to be an object and
+ * `signature` to be a string, so a malformed unrelated payload — `{ directive: {}, signature: "…" }`
+ * from a broken Hub or proxy — reaches here with no `id`, and `ackKeyOf` returns `undefined` at
+ * runtime despite its `string` type. Feeding that to `sanitizeForTerminal` (which iterates its
+ * argument) throws a TypeError out of `runSelfTest`, destroying every step already collected — the
+ * exact opposite of this module's "never throws for a diagnosable failure" promise, and over an
+ * entry the probe was only ever going to mention. So: extract it as a string or say plainly that
+ * there wasn't one. The entry is still never verified and never acked.
+ */
+function foreignIdOf(entry) {
+    const key = ackKeyOf(entry);
+    return typeof key === "string" && key !== "" ? key : "(an entry the Hub returned with no id)";
+}
+/**
+ * Disclose any of the PRINCIPAL's own mail this probe's drain claimed. Undefined when it claimed none
+ * (the ordinary case: a fresh machine has an empty mailbox).
+ *
+ * THE SIDE EFFECT IS REAL AND CANNOT BE PREVENTED CLIENT-SIDE. A §8.7.1 session drain deliberately
+ * returns session-addressed entries PLUS the principal's own mail, first-claim-wins across every
+ * session of that agent — that is what lets several bridges share one credential. This diagnostic
+ * presents a session, so on a busy agent it can lease an entry meant for a real bridge, and the DRAIN
+ * (unlike the §8.7.2 stream claim, which is provisional by construction) is delivery evidence.
+ *
+ * What is done about it, in order of what actually helps:
+ *   • Nothing foreign is ever ACKED, so every such entry reverts to queued-visible when its lease
+ *     lapses. It is delayed, never consumed and never lost.
+ *   • The drain stops at the probe, so no further batch is claimed.
+ *   • And it is SAID — with ids — because the one outcome this whole command exists to prevent is a
+ *     human believing mail was delivered when nobody saw it. A diagnostic that quietly caused that,
+ *     of all things, would be indefensible.
+ *
+ * A `warn` rather than a `fail`: the reachability round trip itself is unaffected, and reporting "you
+ * are not reachable" would be the opposite lie. Preventing the claim outright needs a probe-scoped
+ * drain on the Hub (server lane, tracked separately).
+ */
+function foreignClaimStep(foreign) {
+    if (foreign.length === 0)
+        return undefined;
+    return {
+        name: "self-test mailbox",
+        status: "warn",
+        detail: `this probe's drain also claimed ${foreign.length} entr${foreign.length === 1 ? "y" : "ies"} already queued for this ` +
+            `agent (${foreign.map((id) => sanitizeForTerminal(id)).join(", ")}). A §8.7.1 session drain claims the principal's ` +
+            "mail first-claim-wins, so a diagnostic cannot avoid this on a busy agent. NONE of them were acked, so each returns " +
+            "to the queue when its visibility lease lapses and a real bridge receives it then — delayed, not lost. Prefer running " +
+            "`--self-test` when no bridge is mid-flight.",
+    };
+}
+/**
+ * Why a §15.1 snapshot is unusable, or undefined when it is well-formed.
+ *
+ * The SESSION-READ sibling of `destinationOf`'s validation in `messaging/http.ts`, and the reasoning
+ * carries over one-for-one: the v0.5 schema pins the enum AND the state/timestamp relationship in
+ * both directions, and each direction is load-bearing. An out-of-enum `state` ("reachable") is a
+ * claim the protocol cannot express; `unknown` carrying a `last_seen` contradicts itself (a timestamp
+ * IS visibility); and `online`/`offline` WITHOUT one is an unanchored assertion — online as of when?
+ * `isSession` (sessions-http.ts) deliberately guards only the fields it acts on, so nothing upstream
+ * checks this — and rendering an invalid snapshot verbatim would let `--self-test` report a green
+ * reachability reading that means nothing, which is the whole failure this command exists to prevent.
+ *
+ * Absence is included here rather than handled separately because, past the §8.0 gate, it is the same
+ * class of answer: the Hub has declared >= 0.5, and §15.1/#654 put the snapshot on the resource
+ * unconditionally.
+ */
+function invalidSnapshot(snapshot) {
+    if (snapshot === undefined) {
+        return "is absent, though a Hub declaring MA2H 0.5 must carry it on the session resource";
+    }
+    const { state, last_seen: lastSeen } = snapshot;
+    if (state !== "online" && state !== "offline" && state !== "unknown") {
+        return `declares an unknown state ${JSON.stringify(sanitizeForTerminal(String(state)))} (expected online | offline | unknown)`;
+    }
+    if (state === "unknown" && lastSeen !== undefined) {
+        return "reports `unknown` while carrying a last_seen, which the v0.5 schema forbids — a timestamp IS visibility";
+    }
+    if (state !== "unknown" && !(typeof lastSeen === "string" && lastSeen.trim() !== "" && !Number.isNaN(Date.parse(lastSeen)))) {
+        return `reports \`${state}\` without the last_seen timestamp the v0.5 schema requires to anchor it`;
+    }
+    return undefined;
+}
+/** Render a §15 destination/reachability snapshot without ever dressing `unknown` up as liveness. */
+function describeSnapshot(snapshot) {
+    if (snapshot === undefined)
+        return "not reported by this Hub";
+    if (snapshot.state === "unknown")
+        return "unknown (the Hub has no presence signal — this is NOT 'offline')";
+    return snapshot.last_seen !== undefined ? `${snapshot.state} (last seen ${snapshot.last_seen})` : snapshot.state;
+}
+//# sourceMappingURL=self-test.js.map

package/dist/commands/self-test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-test.js","sourceRoot":"","sources":["../../src/commands/self-test.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,qGAAqG;AACrG,iGAAiG;AACjG,mGAAmG;AACnG,8FAA8F;AAC9F,iFAAiF;AACjF,EAAE;AACF,0FAA0F;AAC1F,cAAc;AACd,EAAE;AACF,uFAAuF;AACvF,qEAAqE;AACrE,mFAAmF;AACnF,qGAAqG;AACrG,mGAAmG;AACnG,qEAAqE;AACrE,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,uEAAuE;AACvE,uFAAuF;AACvF,EAAE;AACF,sGAAsG;AACtG,iGAAiG;AACjG,sGAAsG;AACtG,sGAAsG;AACtG,iFAAiF;AACjF,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,2FAA2F;AAC3F,qGAAqG;AACrG,gGAAgG;AAChG,mDAAmD;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,6BAA6B,EAC7B,WAAW,EACX,QAAQ,EACR,WAAW,GAEZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAYrD;;;0DAG0D;AAC1D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;kDACkD;AAClD,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB,QAAQ,CAAC,KAAK;IAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;wGAEwG;AACxG,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAmB;IACnD,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,iGAAiG;IACjG,gGAAgG;IAChG,IAAI,KAAa,CAAC;IAClB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,mGAAmG;IACnG,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CACR,IAAI,CACF,eAAe,EACf,QAAQ,UAAU,EAAE,YAAY,IAAI,MAAM,gEAAgE,CAC3G,CACF,CAAC;IAEF,iGAAiG;IACjG,6BAA6B;IAC7B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,kCAAkC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,OAAO,CAAC,EAAE,2BAA2B,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAElH,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,GAAG,EAAE;YAC1B,KAAK;YACL,OAAO;YACP,OAAO;YACP,KAAK;YACL,+FAA+F;YAC/F,8FAA8F;YAC9F,cAAc;YACd,mBAAmB,EACjB,OAAO,UAAU,EAAE,qBAAqB,KAAK,QAAQ,IAAI,UAAU,CAAC,qBAAqB,GAAG,CAAC;gBAC3F,CAAC,CAAC,UAAU,CAAC,qBAAqB;gBAClC,CAAC,CAAC,6BAA6B;SACpC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,gGAAgG;QAChG,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,KAAK,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;qGACqG;AACrG,KAAK,UAAU,gBAAgB,CAC7B,GAAmB,EACnB,IAA8G;IAE9G,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,SAAS,OAAO,IAAI,OAAO,CAAC,EAAE,EAAkB,CAAC;IACjE,iGAAiG;IACjG,0DAA0D;IAC1D,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAE3B,WAAW;IACX,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,cAAc,CACxB,GAAG,EACH,KAAK,EACL,WAAW,CAAC;YACV,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE;YACnE,KAAK,EAAE,wBAAwB;YAC/B,IAAI,EAAE,4FAA4F,KAAK,EAAE;YACzG,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,EAAE,EAAE,OAAO;SACZ,CAAC,EACF,EAAE,WAAW,EAAE,OAAO,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,6CAA6C,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvH,OAAO;IACT,CAAC;IACD,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,KAAK,CAAC,IAAI,CACR,IAAI,CACF,gBAAgB,EAChB,UAAU,GAAG,CAAC,EAAE,OAAO,OAAO,aAAa,GAAG,CAAC,MAAM,mCAAmC;QACtF,eAAe,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CACrD,CACF,CAAC;IAEF,6FAA6F;IAC7F,MAAM,MAAM,GAAgB;QAC1B,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,gGAAgG;QAChG,iGAAiG;QACjG,SAAS,EAAE,EAAE;QACb,mBAAmB;KACpB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,IAAI,QAAwC,CAAC;IAC7C,IAAI,UAAmB,CAAC;IACxB,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,mDAAmD;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,IAAI,QAAQ,KAAK,SAAS,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACzF,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9D,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,MAAM;QACR,CAAC;QACD,4FAA4F;QAC5F,iGAAiG;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;gBACzD,2FAA2F;gBAC3F,wFAAwF;gBACxF,yFAAyF;gBACzF,yDAAyD;gBACzD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,gGAAgG;YAChG,2FAA2F;YAC3F,6FAA6F;YAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5E,0FAA0F;gBAC1F,uFAAuF;gBACvF,6FAA6F;gBAC7F,iFAAiF;gBACjF,UAAU,KAAK,IAAI,QAAQ,CACzB,QAAQ,EACR,mDAAmD,GAAG,CAAC,EAAE,oDAAoD;oBAC3G,4GAA4G;oBAC5G,kGAAkG,CACrG,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,qFAAqF;gBACrF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;oBAAE,QAAQ,GAAG,KAAK,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2FAA2F;gBAC3F,4FAA4F;gBAC5F,0BAA0B;gBAC1B,UAAU,KAAK,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM;IACtC,CAAC;IAED,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,mBAAmB,EAAE,8BAA8B,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,IAAI,CACF,mBAAmB,EACnB,yBAAyB,OAAO,sDAAsD,gBAAgB,WAAW;YAC/G,8GAA8G;YAC9G,wGAAwG,CAC3G,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,CACR,IAAI,CACF,mBAAmB,EACnB,WAAW,GAAG,CAAC,EAAE,SAAS,OAAO,CAAC,EAAE,+EAA+E;QACjH,oHAAoH;QACpH,0BAA0B,CAC7B,CACF,CAAC;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,eAAe,EAAE,uCAAuC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAC7G,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,sCAAsC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO;IACT,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,QAAQ,CAAC,QAAQ,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAEhI,mGAAmG;IACnG,+FAA+F;IAC/F,wDAAwD;IACxD,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,6FAA6F;QAC7F,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,iGAAiG;QACjG,oFAAoF;QACpF,8FAA8F;QAC9F,oBAAoB;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC;QACpC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,eAAe,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CACR,IAAI,CACF,wBAAwB,EACxB,mFAAmF,KAAK,CAAC,EAAE,IAAI,eAAe,IAAI,WAAW,IAAI;gBAC/H,4GAA4G;gBAC5G,gCAAgC,CACnC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,wFAAwF;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,iGAAiG;QACjG,4CAA4C;QAC5C,iGAAiG;QACjG,2EAA2E;QAC3E,iGAAiG;QACjG,gGAAgG;QAChG,+FAA+F;QAC/F,kGAAkG;QAClG,+EAA+E;QAC/E,MAAM,WAAW,GACf,QAAQ,CAAC,KAAK,KAAK,QAAQ;YAC3B,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;YACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CACR,IAAI,CACF,wBAAwB,EACxB,2DAA2D,mBAAmB,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa;gBACnH,0CAA0C,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,oCAAoC;gBACnH,kHAAkH;gBAClH,8DAA8D,CACjE,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CACR,IAAI,CACF,wBAAwB,EACxB,kFAAkF;gBAChF,GAAG,gBAAgB,CAAC,QAAQ,CAAC,qEAAqE;gBAClG,+GAA+G;gBAC/G,qGAAqG;gBACrG,gHAAgH;gBAChH,2DAA2D,CAC9D,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CACR,IAAI,CACF,wBAAwB,EACxB,WAAW,KAAK,CAAC,KAAK,mBAAmB,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,KAAK,CAAC,UAAU,IAAI;YACzG,kHAAkH;YAClH,yBAAyB,CAC5B,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,IAAI,CACF,wBAAwB,EACxB,qFAAqF,SAAS,CAAC,KAAK,CAAC,IAAI;YACvG,+FAA+F,EACjG,UAAU,CAAC,KAAK,CAAC,CAClB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAa,EAAE,EAAU;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,gGAAgG;QAChG,gGAAgG;QAChG,2FAA2F;QAC3F,iGAAiG;QACjG,+DAA+D;QAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CACT,mBAAmB,EACnB,iCAAiC,EAAE,uEAAuE;gBACxG,yGAAyG;gBACzG,2EAA2E,EAAE,uBAAuB,CACvG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,UAAU,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,4BAA4B,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CACT,mBAAmB,EACnB,yBAAyB,EAAE,0BAA0B,SAAS,CAAC,KAAK,CAAC,0CAA0C;YAC7G,+GAA+G;YAC/G,kFAAkF,EAAE,KAAK,EAC3F,UAAU,CAAC,KAAK,CAAC,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,GAAG,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,wCAAwC,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,gBAAgB,CAAC,OAA0B;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,MAAM;QACd,MAAM,EACJ,mCAAmC,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,2BAA2B;YACtH,UAAU,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;YACpH,qHAAqH;YACrH,uHAAuH;YACvH,6CAA6C;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,QAA8D;IACrF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,kFAAkF,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAChD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,6BAA6B,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC;IACjI,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,yGAAyG,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5H,OAAO,aAAa,KAAK,0EAA0E,CAAC;IACtG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,QAA2D;IACnF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,kEAAkE,CAAC;IAC5G,OAAO,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,eAAe,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;AACnH,CAAC"}

package/dist/commands/session.d.ts

@@ -0,0 +1,2 @@
+import type { CommandContext } from "./context.js";
+export declare function sessionCommand(ctx: CommandContext): Promise<void>;