@qodeca/xezar 0.13.0 → 0.14.0

package/dist/mcp/tools/leader-events.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+import type { EventJournal } from '../event-journal.ts';
+import { type LeaderCursors, type StateReader } from '../reconnect.ts';
+/**
+ * `leader_events` (#251): the leader's PULL read of its project's significant events (F-21, A-15,
+ * A-21). A thin door over `reconnect.ts`, which owns every rule — this file only chooses the call
+ * and shapes the answer:
+ *
+ *  - `read` is `reconnect()`: the outstanding rows strictly after the leader's acknowledged cursor
+ *    (or after an explicit `cursor`, a rewind that never moves the ack), in `journalSeq` order, THEN
+ *    the current state of the tasks they name. A cursor whose rows are gone is the journal's own
+ *    `cursor_too_old` answer — stated as a gap with the current state beside it, never a partial
+ *    replay that would read as "nothing happened in between".
+ *  - `ack` is `LeaderCursors.ack()`: monotonic and idempotent, so a duplicate or an older cursor is
+ *    a successful no-op, never a rewind.
+ *
+ * At-least-once, no repeated effect (N-10): a read before the ack returns the same rows again, each
+ * with its stable `eventId`, which is how the leader drops a duplicate.
+ *
+ * What this is NOT: push. One read when the leader connects, and a next page only because an answer
+ * said `hasMore` — no timer, no status poll, no subscription (N-06). Live delivery to a connected
+ * client (F-20, `LeaderFeed`) and a model reaction to an event (A-19) are Phase 6.
+ *
+ * F-15: rows are scrubbed with this host's secret list on the way out (the journal already scrubs a
+ * summary; a subject id is prose a writer chose too). Cursors are never touched: they are the
+ * journal's own opaque tokens. F-12 / N-01: a row and a task state carry no account identity, and
+ * the journal is the bound project's — a cursor from another project is refused outright.
+ */
+/** The composed parts the tool reads — built once per project by `startMcpService`. */
+export interface LeaderEventsPort {
+    readonly journal: EventJournal;
+    readonly cursors: LeaderCursors;
+    readonly readState: StateReader;
+    readonly secretValues: readonly string[];
+}
+export declare const leaderEventsInputSchema: z.ZodObject<{
+    action: z.ZodEnum<{
+        ack: "ack";
+        read: "read";
+    }>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    operationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type LeaderEventsInput = z.output<typeof leaderEventsInputSchema>;
+export declare const leaderEventsTool: import("../tool.ts").McpTool<z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>>;

package/dist/mcp/tools/leader-events.js

@@ -0,0 +1,126 @@
+import { z } from 'zod';
+import { MCP_JOURNAL_PAGE_ROWS, mcpJournalCursorSchema, operationIdSchema } from '../../contract/index.js';
+import { redactDeep } from '../../core/secret-redaction.js';
+import { McpJournalCursorError } from '../event-journal.js';
+import { reconnect } from '../reconnect.js';
+import { defineTool, errorResult, textResult } from '../tool.js';
+export const leaderEventsInputSchema = z
+    .object({
+    action: z
+        .enum(['read', 'ack'])
+        .describe('read: the events outstanding since your last acknowledged position, then the current state of the tasks they name. ' +
+        'ack: record that you have taken every event up to cursor into account.'),
+    cursor: mcpJournalCursorSchema
+        .optional()
+        .describe('read: replay after this cursor instead of your acknowledged position (optional; it never moves the acknowledgement). ' +
+        'ack: required — the nextCursor of a page, or the resumeCursor of a gap.'),
+    limit: z.number().int().min(1).max(MCP_JOURNAL_PAGE_ROWS).optional().describe(`read: events per page, at most ${MCP_JOURNAL_PAGE_ROWS}.`),
+    operationId: operationIdSchema
+        .optional()
+        .describe('ack: required — a client-generated key for this acknowledgement (8–128 chars). Reuse it only to repeat the same acknowledgement. read: not accepted, because a read is meant to return the same events again until you ack them.'),
+})
+    .strict()
+    .superRefine((args, ctx) => {
+    if (args.action === 'ack' && args.cursor === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['cursor'], message: 'ack needs cursor' });
+    }
+    if (args.action === 'ack' && args.limit !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['limit'], message: 'limit does not apply to ack' });
+    }
+    // D-06 § 5.2 (#264). `ack` writes the leader's position, so it carries an operation id. `read`
+    // must NOT: at-least-once delivery means a repeated read deliberately returns the same rows
+    // again, and a receipt over it would answer the second read with the receipt instead.
+    if (args.action === 'ack' && args.operationId === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['operationId'], message: 'ack needs operationId' });
+    }
+    if (args.action === 'read' && args.operationId !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['operationId'], message: 'operationId does not apply to read' });
+    }
+});
+const NOT_CONNECTED = "leader_events is not connected to this project's event journal; nothing was read or acknowledged.";
+export const leaderEventsTool = defineTool({
+    name: 'leader_events',
+    title: 'Read and acknowledge project events',
+    description: [
+        "Read this project's significant events (task outcomes, questions, quality gates, human changes, executor availability) since you last acknowledged them, and acknowledge them.",
+        'Call read when you connect or reconnect. It returns the outstanding events in order, each with a stable eventId and a standing (current, superseded or unjudged), then the current state of the tasks they name — the state is the authority, an event is history.',
+        'When hasMore is true, read again at once; otherwise do not poll — call read again on your next connection.',
+        'After you have taken a page into account, ack its nextCursor. Until you do, read returns the same events again, so drop any eventId you already handled. Acknowledging an older cursor changes nothing.',
+        'status "gap" means events after your position are no longer retained: nothing is replayed, the current state is included, and you continue by acking resumeCursor.',
+    ].join('\n'),
+    inputSchema: leaderEventsInputSchema,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    async call(args, ctx) {
+        const port = ctx.leaderEvents;
+        if (!port)
+            return errorResult(NOT_CONNECTED);
+        try {
+            return args.action === 'ack' ? ack(port, args.cursor) : read(port, args);
+        }
+        catch (err) {
+            if (err instanceof McpJournalCursorError) {
+                return errorResult(`${err.rejection.message}. Nothing was ${args.action === 'ack' ? 'acknowledged' : 'read'}.`, {
+                    ...err.rejection,
+                });
+            }
+            throw err;
+        }
+    },
+});
+function read(port, args) {
+    const answer = reconnect({
+        journal: port.journal,
+        cursors: port.cursors,
+        readState: port.readState,
+        ...(args.cursor === undefined ? {} : { cursor: args.cursor }),
+        ...(args.limit === undefined ? {} : { limit: args.limit }),
+    });
+    // D-05 § 6.6: the rows are handed to the client now, so they count as delivered — not acked.
+    const last = answer.status === 'ok' ? answer.events.at(-1)?.row.journalSeq : undefined;
+    if (last !== undefined)
+        port.cursors.markDelivered(last);
+    const position = port.cursors.position();
+    const structured = shape(answer, position, port.secretValues);
+    return textResult(`${headline(answer)}\n${JSON.stringify(structured)}`, structured);
+}
+function ack(port, cursor) {
+    const result = port.cursors.ack(cursor);
+    const structured = { status: result.status, ackedSeq: result.ackedSeq, position: port.cursors.position() };
+    const text = result.status === 'acked'
+        ? `Acknowledged every event through #${result.ackedSeq}.`
+        : `Nothing changed: events through #${result.ackedSeq} were already acknowledged.`;
+    return textResult(`${text}\n${JSON.stringify(structured)}`, structured);
+}
+function shape(answer, position, secretValues) {
+    const common = { state: answer.state, position, fresh: answer.fresh, journalEpoch: answer.journalEpoch };
+    if (answer.status === 'cursor_too_old') {
+        const { gap } = answer;
+        return {
+            status: 'gap',
+            gap: { oldestSeq: gap.oldestSeq, latestSeq: gap.latestSeq, resumeCursor: gap.resumeCursor, recovery: gap.recovery },
+            ...common,
+        };
+    }
+    return {
+        status: 'ok',
+        events: answer.events.map(({ row, standing }) => ({ ...redactDeep(row, secretValues), standing })),
+        nextCursor: answer.nextCursor,
+        hasMore: answer.hasMore,
+        ...common,
+    };
+}
+/** The authoritative first line (D-05: the text block is what a client must be able to act on). */
+function headline(answer) {
+    if (answer.status === 'cursor_too_old') {
+        const { oldestSeq, latestSeq } = answer.gap;
+        const retained = oldestSeq === null ? 'the journal holds no events' : `the journal holds #${oldestSeq}–#${latestSeq}`;
+        return `GAP: events after your position are no longer retained (${retained}). Nothing was replayed. Read the current state below, then ack resumeCursor.`;
+    }
+    if (answer.events.length === 0)
+        return 'No outstanding events.';
+    const first = answer.events[0].row.journalSeq;
+    const last = answer.events.at(-1).row.journalSeq;
+    const more = answer.hasMore ? ' More are retained: read again now.' : '';
+    return `${answer.events.length} outstanding event(s), #${first}–#${last}.${more} Ack nextCursor once you have taken them into account.`;
+}
+//# sourceMappingURL=leader-events.js.map

package/dist/mcp/tools/leader-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leader-events.js","sourceRoot":"","sources":["../../../src/mcp/tools/leader-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE1G,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAA8D,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAA2C,MAAM,YAAY,CAAC;AAsC1G,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SACrB,QAAQ,CACP,qHAAqH;QACnH,wEAAwE,CAC3E;IACH,MAAM,EAAE,sBAAsB;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,uHAAuH;QACrH,yEAAyE,CAC5E;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,qBAAqB,GAAG,CAAC;IACzI,WAAW,EAAE,iBAAiB;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,kOAAkO,CACnO;CACJ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,+FAA+F;IAC/F,4FAA4F;IAC5F,sFAAsF;IACtF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACzG,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,aAAa,GACjB,mGAAmG,CAAC;AAEtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;IACzC,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EAAE;QACX,gLAAgL;QAChL,oQAAoQ;QACpQ,4GAA4G;QAC5G,yMAAyM;QACzM,oKAAoK;KACrK,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,WAAW,EAAE,uBAAuB;IACpC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IACxG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG;QAClB,MAAM,IAAI,GAAI,GAA2B,CAAC,YAAY,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,WAAW,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;oBAC9G,GAAG,GAAG,CAAC,SAAS;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,IAAI,CAAC,IAAsB,EAAE,IAAuB;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,6FAA6F;IAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,GAAG,CAAC,IAAsB,EAAE,MAAc;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3G,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,KAAK,OAAO;QACvB,CAAC,CAAC,qCAAqC,MAAM,CAAC,QAAQ,GAAG;QACzD,CAAC,CAAC,oCAAoC,MAAM,CAAC,QAAQ,6BAA6B,CAAC;IACvF,OAAO,UAAU,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,MAAuB,EAAE,QAA+C,EAAE,YAA+B;IACtH,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACzG,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,KAAc;YACtB,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnH,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClG,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,QAAQ,CAAC,MAAuB;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,sBAAsB,SAAS,KAAK,SAAS,EAAE,CAAC;QACtH,OAAO,2DAA2D,QAAQ,+EAA+E,CAAC;IAC5J,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,UAAU,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,2BAA2B,KAAK,KAAK,IAAI,IAAI,IAAI,wDAAwD,CAAC;AAC1I,CAAC"}

package/dist/mcp/tools/local-handoff.d.ts

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+import { type ServiceDispatch } from '../service-adapter.ts';
+import { type McpToolContext } from '../tool.ts';
+/**
+ * `local_handoff` (#98): the cockpit's "Open in…" family — a task in a terminal, a task's
+ * worktree in a local app, the project folder in a local app, and the list of apps that can do it
+ * (I-044, I-114). Opening one image file by path is left out: see `Field` below.
+ *
+ * M-19 is the trap this module exists for. Every one of these routes launches an application on
+ * the machine that runs the xezar SERVICE. An MCP client is a separate process, possibly on
+ * another machine and possibly with no display at all, so nothing here may promise a window on
+ * the client's screen. Two rules follow, and the tests pin both:
+ *
+ *  - With `capabilities.localHandoff` false (hosted mode: `XEZ_REMOTE=1` or a non-loopback bind),
+ *    every action answers `unavailable` WITH A REASON and dispatches nothing — the same gate that
+ *    hides the menu in the cockpit. The routes 409 on their own as well; this tool does not rely
+ *    on that, because "the route refused" and "we never asked" must not read the same.
+ *  - With it true, every answer names the machine it affects: the xezar host, not the client's.
+ *
+ * The capability is read from the service's own `GET /health`, through the same in-process entry
+ * every other call uses, so this tool and the cockpit read ONE answer (N-02) — including the
+ * `--bind-host` half, which this process cannot see from anywhere else.
+ *
+ * `open-in-cli` answers 409 with `error.command` when the host has no terminal emulator. The
+ * cockpit copies that command to the clipboard; a leader has no clipboard on the host, so the
+ * command is RETURNED as data (`fallbackCommand`), labelled as something to run on the host.
+ *
+ * D-08 / F-09 / F-22: opening an app is a project operation inside the approved goal, so there is
+ * no per-operation confirmation parameter. Goal and definition-of-done decisions stay with the
+ * human and are not offered here, and no parameter can waive a quality gate or an acceptance
+ * criterion — the strict schema turns an invented key into an argument error. The registry-wide
+ * test in `local-handoff.test.ts` asserts the last point for EVERY registered tool (A-22).
+ */
+export declare const LOCAL_HANDOFF_ACTIONS: readonly ['list_apps', 'open_task_in_terminal', 'open_task_in_app', 'open_project_in_app'];
+export type LocalHandoffAction = (typeof LOCAL_HANDOFF_ACTIONS)[number];
+/** Where an answer's effect lands. There is deliberately no value for the client's machine. */
+export declare const HANDOFF_MACHINE: 'xezar-host';
+/** Said on every answer from a host that can hand off — the M-19 sentence. */
+export declare const XEZAR_HOST_NOTICE = "This acts on the xezar host machine \u2013 the computer running the xezar service \u2013 not on the machine your MCP client runs on. Nothing opens on the client\u2019s screen.";
+/** Said on every answer from a host that cannot. */
+export declare const HOSTED_MODE_REASON = "desktop handoff is unavailable: this xezar runs in hosted mode (XEZ_REMOTE=1 or a non-loopback bind), so there is no desktop on the xezar host to open anything on, and xezar never opens anything on the MCP client\u2019s machine";
+/** D-08 in the tool's own words, so a leader reads the boundary before it calls. */
+export declare const DECISION_BOUNDARY = "No per-operation confirmation is needed: opening an app is a project operation inside the approved goal. Goal and definition-of-done decisions stay with the human and are not offered here, and no parameter can waive a quality gate or an acceptance criterion.";
+/** The context this tool reads beyond `McpToolContext`: the running service's in-process entry. */
+export type LocalHandoffContext = McpToolContext & {
+    readonly service?: ServiceDispatch;
+};
+export declare const localHandoffInputSchema: z.ZodObject<{
+    action: z.ZodEnum<{
+        list_apps: "list_apps";
+        open_project_in_app: "open_project_in_app";
+        open_task_in_app: "open_task_in_app";
+        open_task_in_terminal: "open_task_in_terminal";
+    }>;
+    runId: z.ZodOptional<z.ZodString>;
+    target: z.ZodOptional<z.ZodString>;
+    operationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type LocalHandoffInput = z.output<typeof localHandoffInputSchema>;
+/** The result, text block and `structuredContent` alike (D-05: the text is authoritative). */
+export declare const localHandoffResultSchema: z.ZodObject<{
+    action: z.ZodEnum<{
+        list_apps: "list_apps";
+        open_project_in_app: "open_project_in_app";
+        open_task_in_app: "open_task_in_app";
+        open_task_in_terminal: "open_task_in_terminal";
+    }>;
+    status: z.ZodEnum<{
+        conflict: "conflict";
+        done: "done";
+        failed: "failed";
+    }>;
+    outcome: z.ZodEnum<{
+        fallback: "fallback";
+        listed: "listed";
+        opened: "opened";
+        refused: "refused";
+        unavailable: "unavailable";
+    }>;
+    performed: z.ZodBoolean;
+    affects: z.ZodEnum<{
+        nothing: "nothing";
+        "xezar-host": "xezar-host";
+    }>;
+    notice: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    nextAction: z.ZodOptional<z.ZodString>;
+    targets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        icon: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    path: z.ZodOptional<z.ZodString>;
+    command: z.ZodOptional<z.ZodString>;
+    fallbackCommand: z.ZodOptional<z.ZodString>;
+    httpStatus: z.ZodOptional<z.ZodNumber>;
+    origin: z.ZodLiteral<"mcp">;
+}, z.core.$strip>;
+export type LocalHandoffResult = z.infer<typeof localHandoffResultSchema>;
+export declare const localHandoffTool: import("../tool.ts").McpTool<z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>>;
+/** One action against the bound project. Exported for tests; the tool is the only production caller. */
+export declare function runLocalHandoff(args: LocalHandoffInput, projectId: string, service: ServiceDispatch): Promise<LocalHandoffResult>;

package/dist/mcp/tools/local-handoff.js

@@ -0,0 +1,306 @@
+import { operationIdSchema, runIdParamSchema, openTargetSchema } from '../../contract/index.js';
+import { hc } from 'hono/client';
+import { z } from 'zod';
+import { collectSecretValues, redactDeep } from '../../core/secret-redaction.js';
+import { MCP_ORIGIN } from '../service-adapter.js';
+import { defineTool, errorResult, textResult } from '../tool.js';
+/**
+ * `local_handoff` (#98): the cockpit's "Open in…" family — a task in a terminal, a task's
+ * worktree in a local app, the project folder in a local app, and the list of apps that can do it
+ * (I-044, I-114). Opening one image file by path is left out: see `Field` below.
+ *
+ * M-19 is the trap this module exists for. Every one of these routes launches an application on
+ * the machine that runs the xezar SERVICE. An MCP client is a separate process, possibly on
+ * another machine and possibly with no display at all, so nothing here may promise a window on
+ * the client's screen. Two rules follow, and the tests pin both:
+ *
+ *  - With `capabilities.localHandoff` false (hosted mode: `XEZ_REMOTE=1` or a non-loopback bind),
+ *    every action answers `unavailable` WITH A REASON and dispatches nothing — the same gate that
+ *    hides the menu in the cockpit. The routes 409 on their own as well; this tool does not rely
+ *    on that, because "the route refused" and "we never asked" must not read the same.
+ *  - With it true, every answer names the machine it affects: the xezar host, not the client's.
+ *
+ * The capability is read from the service's own `GET /health`, through the same in-process entry
+ * every other call uses, so this tool and the cockpit read ONE answer (N-02) — including the
+ * `--bind-host` half, which this process cannot see from anywhere else.
+ *
+ * `open-in-cli` answers 409 with `error.command` when the host has no terminal emulator. The
+ * cockpit copies that command to the clipboard; a leader has no clipboard on the host, so the
+ * command is RETURNED as data (`fallbackCommand`), labelled as something to run on the host.
+ *
+ * D-08 / F-09 / F-22: opening an app is a project operation inside the approved goal, so there is
+ * no per-operation confirmation parameter. Goal and definition-of-done decisions stay with the
+ * human and are not offered here, and no parameter can waive a quality gate or an acceptance
+ * criterion — the strict schema turns an invented key into an argument error. The registry-wide
+ * test in `local-handoff.test.ts` asserts the last point for EVERY registered tool (A-22).
+ */
+export const LOCAL_HANDOFF_ACTIONS = ['list_apps', 'open_task_in_terminal', 'open_task_in_app', 'open_project_in_app'];
+/** Where an answer's effect lands. There is deliberately no value for the client's machine. */
+export const HANDOFF_MACHINE = 'xezar-host';
+/** Said on every answer from a host that can hand off — the M-19 sentence. */
+export const XEZAR_HOST_NOTICE = 'This acts on the xezar host machine – the computer running the xezar service – not on the machine your MCP client runs on. Nothing opens on the client’s screen.';
+/** Said on every answer from a host that cannot. */
+export const HOSTED_MODE_REASON = 'desktop handoff is unavailable: this xezar runs in hosted mode (XEZ_REMOTE=1 or a non-loopback bind), so there is no desktop on the xezar host to open anything on, and xezar never opens anything on the MCP client’s machine';
+/** The next legitimate action when the capability is missing (UX-M05). */
+const UNAVAILABLE_NEXT_ACTION = 'Ask the human to open it from a machine that has the checkout, or read the task, its diff and its files through the tools that return data.';
+/** D-08 in the tool's own words, so a leader reads the boundary before it calls. */
+export const DECISION_BOUNDARY = 'No per-operation confirmation is needed: opening an app is a project operation inside the approved goal. Goal and definition-of-done decisions stay with the human and are not offered here, and no parameter can waive a quality gate or an acceptance criterion.';
+const NOT_CONNECTED = 'local_handoff is not connected to the xezar service in this process yet; nothing was opened.';
+const FIELDS = ['runId', 'target', 'operationId'];
+/** Which arguments each action takes. Anything else is refused rather than silently dropped.
+ *  `operationId` (D-06 § 5.2, #264) is required by the three actions that open something on the
+ *  host: launching an app twice is exactly the repeated effect a lost answer causes. `list_apps`
+ *  reads the installed apps and takes none. */
+const ACTION_FIELDS = {
+    list_apps: { required: [], optional: [] },
+    open_task_in_terminal: { required: ['runId', 'operationId'], optional: [] },
+    open_task_in_app: { required: ['runId', 'target', 'operationId'], optional: [] },
+    open_project_in_app: { required: ['target', 'operationId'], optional: [] },
+};
+export const localHandoffInputSchema = z
+    .object({
+    action: z
+        .enum(LOCAL_HANDOFF_ACTIONS)
+        .describe('list_apps: the apps installed on the xezar host. open_task_in_terminal: resume the task’s agent session in a terminal on the xezar host. ' +
+        'open_task_in_app: open the task’s worktree in an app on the xezar host. ' +
+        'open_project_in_app: open the project folder in an app on the xezar host.'),
+    runId: z.string().min(1).max(128).optional().describe("The task's run id, in the project this connection is bound to."),
+    target: z
+        .string()
+        .trim()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe('An app id from list_apps (for example "finder", "terminal", "vscode", "cli:claude").'),
+    operationId: operationIdSchema
+        .optional()
+        .describe('Client-generated key for this operation (8–128 chars). Required by every open_ action; list_apps reads and takes none. Reuse it only to repeat the same operation: a repeat returns the first answer and opens nothing a second time.'),
+})
+    .strict()
+    .superRefine((args, ctx) => {
+    const allowed = ACTION_FIELDS[args.action];
+    for (const field of FIELDS) {
+        const present = args[field] !== undefined;
+        if (allowed.required.includes(field) && !present) {
+            ctx.addIssue({ code: 'custom', path: [field], message: `${args.action} needs ${field}` });
+        }
+        if (present && !allowed.required.includes(field) && !allowed.optional.includes(field)) {
+            ctx.addIssue({ code: 'custom', path: [field], message: `${field} does not apply to ${args.action}` });
+        }
+    }
+});
+/** The result, text block and `structuredContent` alike (D-05: the text is authoritative). */
+export const localHandoffResultSchema = z.object({
+    action: z.enum(LOCAL_HANDOFF_ACTIONS),
+    /** D-05's closed set (§ 6.8), narrowed to what a handoff can report. A 409 is a `conflict`. */
+    status: z.enum(['done', 'failed', 'conflict']),
+    /** What happened, in handoff terms. `unavailable`: the capability is missing and nothing was
+     *  dispatched. `fallback`: nothing opened — run `fallbackCommand` on the xezar host instead. */
+    outcome: z.enum(['opened', 'listed', 'unavailable', 'fallback', 'refused']),
+    /** True only when the service reports it launched something. */
+    performed: z.boolean(),
+    /** Where the effect lands — the xezar host, or nowhere. Never the MCP client's machine. */
+    affects: z.enum([HANDOFF_MACHINE, 'nothing']),
+    notice: z.string(),
+    reason: z.string().optional(),
+    nextAction: z.string().optional(),
+    targets: z.array(openTargetSchema).optional(),
+    /** The host path that was opened. */
+    path: z.string().optional(),
+    /** The command the host terminal runs. */
+    command: z.string().optional(),
+    /** Run this in a terminal ON THE XEZAR HOST: the route found no terminal emulator to open. */
+    fallbackCommand: z.string().optional(),
+    httpStatus: z.number().int().optional(),
+    origin: z.literal(MCP_ORIGIN),
+});
+// ---- the service entry -------------------------------------------------------------------------
+const IN_PROCESS_BASE = 'http://127.0.0.1';
+const IN_PROCESS_HOST = '127.0.0.1';
+/** The same in-process client the adapter builds (`service-adapter.ts`): loopback host, no Origin. */
+const buildClient = (service) => hc(IN_PROCESS_BASE, {
+    fetch: async (input, init) => {
+        const headers = new Headers(init?.headers);
+        headers.set('host', IN_PROCESS_HOST);
+        headers.delete('origin');
+        const url = input instanceof Request ? input.url : String(input);
+        return service.request(url, { ...init, headers });
+    },
+});
+async function settle(pending) {
+    const res = await pending;
+    const body = await res.json().catch(() => undefined);
+    return { status: res.status, body: body && typeof body === 'object' ? body : undefined };
+}
+const str = (value) => (typeof value === 'string' ? value : undefined);
+// ---- identity and secrets ----------------------------------------------------------------------
+/** F-12: an account folder is user-named, and a folder named after an email address would put
+ *  that address in a terminal command. Such a command is withheld rather than altered, because
+ *  an edited command would resume the wrong account. */
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+const ACCOUNT_PLACEHOLDER = '[account]';
+const hasEmail = (text) => new RegExp(EMAIL_RE.source).test(text);
+const scrubEmail = (text) => text.replace(EMAIL_RE, ACCOUNT_PLACEHOLDER);
+// ---- the tool ----------------------------------------------------------------------------------
+export const localHandoffTool = defineTool({
+    name: 'local_handoff',
+    title: 'Open a task or the project in an app on the xezar host',
+    description: 'Hand a task or the project off to a desktop app — a terminal resuming the task’s agent session, an editor, the file manager. ' +
+        'Every app opens on the XEZAR HOST MACHINE (the computer running the xezar service), never on the machine your MCP client runs on. ' +
+        'When the xezar host has no desktop to hand off to (hosted mode), every action answers "unavailable" with the reason and opens nothing. ' +
+        'When no terminal emulator is found, the answer carries fallbackCommand to run in a terminal on the xezar host. ' +
+        DECISION_BOUNDARY,
+    inputSchema: localHandoffInputSchema,
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    async call(args, ctx) {
+        const service = ctx.service;
+        if (!service)
+            return errorResult(NOT_CONNECTED);
+        return render(await runLocalHandoff(args, ctx.project.id, service));
+    },
+});
+/** One action against the bound project. Exported for tests; the tool is the only production caller. */
+export async function runLocalHandoff(args, projectId, service) {
+    const client = buildClient(service);
+    // The capability first, and nothing else until it says yes. An unreadable answer fails CLOSED:
+    // "we could not tell" must never read as "go ahead".
+    const health = await settle(client.api.v1.health.$get()).catch(() => undefined);
+    const capabilities = health?.body?.capabilities;
+    const localHandoff = health?.status === 200 && capabilities && typeof capabilities === 'object'
+        ? capabilities.localHandoff
+        : undefined;
+    if (localHandoff !== true) {
+        return unavailable(args.action, localHandoff === false ? HOSTED_MODE_REASON : 'xezar could not confirm that its host has a desktop to hand off to, so nothing was opened');
+    }
+    const scoped = client.api.v1.p[':projectId'];
+    const scope = { projectId };
+    if (args.action === 'list_apps') {
+        const answer = await settle(scoped['open-targets'].$get({ param: scope }));
+        if (answer.status !== 200)
+            return failed(args.action, answer);
+        const parsed = z.array(openTargetSchema).safeParse(answer.body?.targets);
+        if (!parsed.success)
+            return failed(args.action, { status: 502, body: { error: 'the service answered without a target list' } });
+        return { ...hostBase(args.action), status: 'done', outcome: 'listed', performed: false, targets: parsed.data };
+    }
+    if (args.action === 'open_project_in_app') {
+        const answer = await settle(scoped['open-in'].$post({ param: scope, json: { target: args.target } }));
+        if (answer.status !== 200)
+            return failed(args.action, answer);
+        return opened(args.action, answer);
+    }
+    const runId = args.runId;
+    // A dot segment would be resolved by the URL parser onto another route; refuse it undispatched.
+    if (runId === '.' || runId === '..' || !runIdParamSchema.safeParse({ id: runId }).success) {
+        return failed(args.action, { status: 400, body: { error: 'not a run id' } });
+    }
+    const param = { ...scope, id: runId };
+    if (args.action === 'open_task_in_terminal') {
+        const answer = await settle(scoped.runs[':id']['open-in-cli'].$post({ param }));
+        if (answer.status === 200)
+            return opened(args.action, answer);
+        return fallbackOrFailed(args.action, answer);
+    }
+    const answer = await settle(scoped.runs[':id']['open-in'].$post({ param, json: { target: args.target } }));
+    if (answer.status === 200)
+        return opened(args.action, answer);
+    return fallbackOrFailed(args.action, answer);
+}
+function hostBase(action) {
+    return { action, affects: HANDOFF_MACHINE, notice: XEZAR_HOST_NOTICE, origin: MCP_ORIGIN };
+}
+function unavailable(action, reason) {
+    return {
+        action,
+        status: 'failed',
+        outcome: 'unavailable',
+        performed: false,
+        affects: 'nothing',
+        notice: 'Nothing was opened – not on the xezar host and not on the machine your MCP client runs on.',
+        reason,
+        nextAction: UNAVAILABLE_NEXT_ACTION,
+        origin: MCP_ORIGIN,
+    };
+}
+function opened(action, answer) {
+    const path = str(answer.body?.path);
+    const command = str(answer.body?.command);
+    return {
+        ...hostBase(action),
+        status: 'done',
+        outcome: 'opened',
+        performed: true,
+        ...(path !== undefined ? { path } : {}),
+        ...(command !== undefined ? { command } : {}),
+    };
+}
+/** A 409 carrying `command` is the no-terminal fallback; every other refusal keeps the service's words. */
+function fallbackOrFailed(action, answer) {
+    const fallback = answer.status === 409 ? str(answer.body?.command) : undefined;
+    if (fallback === undefined)
+        return failed(action, answer);
+    if (hasEmail(fallback)) {
+        return {
+            ...hostBase(action),
+            status: 'conflict',
+            outcome: 'refused',
+            performed: false,
+            httpStatus: answer.status,
+            reason: 'no terminal emulator was found on the xezar host, and the manual command names an account folder that looks like an email address, so it is not returned here',
+            nextAction: 'Ask the human to open the task from the cockpit on the xezar host, which copies the command there.',
+        };
+    }
+    return {
+        ...hostBase(action),
+        status: 'failed',
+        outcome: 'fallback',
+        performed: false,
+        httpStatus: answer.status,
+        reason: scrubEmail(str(answer.body?.error) ?? 'no terminal emulator found'),
+        fallbackCommand: fallback,
+        nextAction: 'Run fallbackCommand in a terminal on the xezar host. It will not work on the MCP client’s machine.',
+    };
+}
+function failed(action, answer) {
+    // The route re-checks hosted mode per request, so a capability that flipped between the two
+    // calls still reads as unavailable rather than as an ordinary failure.
+    const error = str(answer.body?.error) ?? `service answered ${answer.status}`;
+    if (answer.status === 409 && error.startsWith('local handoff is disabled'))
+        return unavailable(action, HOSTED_MODE_REASON);
+    return {
+        ...hostBase(action),
+        // D-05: a refusal the task or host state caused (409) is a business conflict, not a failure.
+        status: answer.status === 409 ? 'conflict' : 'failed',
+        outcome: 'refused',
+        performed: false,
+        httpStatus: answer.status,
+        reason: scrubEmail(error),
+    };
+}
+/** The text block says everything `structuredContent` says (D-05); secrets never leave (F-15). */
+function render(result) {
+    const safe = redactDeep(result, collectSecretValues(process.env));
+    const lines = [`local_handoff ${safe.action}: ${safe.outcome} (status ${safe.status}).`, safe.notice];
+    if (safe.reason)
+        lines.push(`Reason: ${safe.reason}.`);
+    if (safe.targets) {
+        lines.push(safe.targets.length
+            ? `Apps on the xezar host: ${safe.targets.map((t) => `${t.id} (${t.label})`).join(', ')}.`
+            : 'No apps were detected on the xezar host.');
+    }
+    if (safe.path)
+        lines.push(`Opened on the xezar host: ${safe.path}`);
+    if (safe.command)
+        lines.push(`The xezar host terminal runs: ${safe.command}`);
+    if (safe.fallbackCommand)
+        lines.push(`Fallback command for a terminal on the xezar host: ${safe.fallbackCommand}`);
+    if (safe.nextAction)
+        lines.push(`Next: ${safe.nextAction}`);
+    const text = lines.join('\n');
+    const structured = safe;
+    // `unavailable` and `fallback` are degraded answers, not errors (AGENTS.md § Zero config), and a
+    // conflict is something to reason about (D-05). Only a refused call that failed outright is one.
+    const isError = safe.outcome === 'refused' && safe.status === 'failed';
+    return isError ? errorResult(text, structured) : textResult(text, structured);
+}
+//# sourceMappingURL=local-handoff.js.map

package/dist/mcp/tools/local-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-handoff.js","sourceRoot":"","sources":["../../../src/mcp/tools/local-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAA2C,MAAM,YAAY,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,qBAAqB,CAAU,CAAC;AAGhI,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,YAAqB,CAAC;AAErD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kKAAkK,CAAC;AAErK,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAC7B,gOAAgO,CAAC;AAEnO,0EAA0E;AAC1E,MAAM,uBAAuB,GAC3B,6IAA6I,CAAC;AAEhJ,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,oQAAoQ,CAAC;AAEvQ,MAAM,aAAa,GAAG,8FAA8F,CAAC;AASrH,MAAM,MAAM,GAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAEpE;;;+CAG+C;AAC/C,MAAM,aAAa,GAA2F;IAC5G,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACzC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC3E,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAChF,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;CAC3E,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,qBAAqB,CAAC;SAC3B,QAAQ,CACP,2IAA2I;QACzI,0EAA0E;QAC1E,2EAA2E,CAC9E;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IACvH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sFAAsF,CAAC;IACnG,WAAW,EAAE,iBAAiB;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,uOAAuO,CACxO;CACJ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACjD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,sBAAsB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACrC,+FAA+F;IAC/F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C;oGACgG;IAChG,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3E,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,2FAA2F;IAC3F,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC7C,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAC9B,CAAC,CAAC;AAGH,mGAAmG;AAEnG,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC,sGAAsG;AACtG,MAAM,WAAW,GAAG,CAAC,OAAwB,EAAE,EAAE,CAC/C,EAAE,CAAU,eAAe,EAAE;IAC3B,KAAK,EAAE,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAqB,EAAE;QACpF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC;AAOL,KAAK,UAAU,MAAM,CAAC,OAA0B;IAC9C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;IAC1B,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACxH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEpG,mGAAmG;AAEnG;;wDAEwD;AACxD,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAEzF,mGAAmG;AAEnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;IACzC,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,wDAAwD;IAC/D,WAAW,EACT,+HAA+H;QAC/H,oIAAoI;QACpI,yIAAyI;QACzI,iHAAiH;QACjH,iBAAiB;IACnB,WAAW,EAAE,uBAAuB;IACpC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;IACzG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG;QAClB,MAAM,OAAO,GAAI,GAA2B,CAAC,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;CACF,CAAC,CAAC;AAEH,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB,EACvB,SAAiB,EACjB,OAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,+FAA+F;IAC/F,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC;IAChD,MAAM,YAAY,GAChB,MAAM,EAAE,MAAM,KAAK,GAAG,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QACxE,CAAC,CAAE,YAA2C,CAAC,YAAY;QAC3D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,WAAW,CAChB,IAAI,CAAC,MAAM,EACX,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,2FAA2F,CAC1I,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAC;QAChI,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACjH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACvG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAM,CAAC;IAC1B,gGAAgG;IAChG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,MAA0B;IAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B,EAAE,MAAc;IAC7D,OAAO;QACL,MAAM;QACN,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,aAAa;QACtB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,4FAA4F;QACpG,MAAM;QACN,UAAU,EAAE,uBAAuB;QACnC,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAA0B,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,MAA0B,EAAE,MAAc;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,QAAQ,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,MAAM,EACJ,+JAA+J;YACjK,UAAU,EAAE,oGAAoG;SACjH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,4BAA4B,CAAC;QAC3E,eAAe,EAAE,QAAQ;QACzB,UAAU,EAAE,oGAAoG;KACjH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAA0B,EAAE,MAAc;IACxD,4FAA4F;IAC5F,uEAAuE;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC3H,OAAO;QACL,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnB,6FAA6F;QAC7F,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;QACrD,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,MAAM,CAAC,MAA0B;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,iBAAiB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,YAAY,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtG,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,OAAO,CAAC,MAAM;YACjB,CAAC,CAAC,2BAA2B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC1F,CAAC,CAAC,0CAA0C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,eAAe;QAAE,KAAK,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAA0C,CAAC;IAC9D,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;IACvE,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChF,CAAC"}