@rivus/agent 0.1.0

package/dist/rivus-daemon-cli.js

@@ -0,0 +1,2599 @@
+import { i as MEMORY_SCOPES, n as resolveRivusAgentDefinition, r as deepFreeze, t as createRivusPluginCatalog } from "./rivus-plugin-registry.js";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { Effect } from "effect";
+import { open, readFile, realpath, stat } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+//#region src/infrastructure/config/rivus-daemon-config.ts
+var RivusDaemonConfigError = class {
+	variable;
+	message;
+	_tag = "RivusDaemonConfigError";
+	constructor(variable, message) {
+		this.variable = variable;
+		this.message = message;
+	}
+};
+const DEFAULT_AGENT_ID$1 = "main";
+const DEFAULT_FEISHU_BASE_URL$1 = "https://open.feishu.cn";
+const DEFAULT_STREAM_MIN_INTERVAL_MS$1 = 200;
+const THINKING_LEVELS$1 = /* @__PURE__ */ new Set([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+function loadRivusDaemonConfig(env, options = {}) {
+	return Effect.gen(function* () {
+		const appId = yield* required(env, "FEISHU_APP_ID");
+		const appSecret = yield* required(env, "FEISHU_APP_SECRET");
+		const streamMinIntervalMs = yield* optionalPositiveInteger(env.FEISHU_STREAM_MIN_INTERVAL_MS, "FEISHU_STREAM_MIN_INTERVAL_MS", DEFAULT_STREAM_MIN_INTERVAL_MS$1);
+		const thinkingLevel = yield* optionalThinkingLevel(env.PI_THINKING_LEVEL);
+		const apiKey = yield* optionalPiApiKey(env, options.readTextFile ?? readUtf8File);
+		const baseUrl = optional(env.PI_BASE_URL);
+		const model = optional(env.PI_MODEL);
+		return {
+			agentId: optional(env.RIVUS_AGENT_ID) ?? DEFAULT_AGENT_ID$1,
+			feishu: {
+				appId,
+				appSecret,
+				baseUrl: optional(env.FEISHU_BASE_URL) ?? DEFAULT_FEISHU_BASE_URL$1,
+				streamMinIntervalMs
+			},
+			pi: {
+				...apiKey ? { apiKey } : {},
+				...baseUrl ? { baseUrl } : {},
+				...model ? { model } : {},
+				...thinkingLevel ? { thinkingLevel } : {}
+			}
+		};
+	});
+}
+function optional(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function readUtf8File(path) {
+	return readFile(path, "utf8");
+}
+function optionalPiApiKey(env, readTextFile) {
+	const inlineApiKey = optional(env.PI_API_KEY);
+	const apiKeyFile = optional(env.PI_API_KEY_FILE);
+	if (inlineApiKey && apiKeyFile) return Effect.fail(new RivusDaemonConfigError("PI_API_KEY", "PI_API_KEY and PI_API_KEY_FILE cannot both be set"));
+	if (inlineApiKey) return Effect.succeed(inlineApiKey);
+	if (!apiKeyFile) return Effect.succeed(void 0);
+	return Effect.tryPromise({
+		try: async () => readTextFile(apiKeyFile),
+		catch: (error) => new RivusDaemonConfigError("PI_API_KEY_FILE", `PI_API_KEY_FILE could not be read: ${formatConfigError(error)}`)
+	}).pipe(Effect.flatMap((contents) => {
+		const apiKey = optional(contents);
+		return apiKey ? Effect.succeed(apiKey) : Effect.fail(new RivusDaemonConfigError("PI_API_KEY_FILE", "PI_API_KEY_FILE must not be empty"));
+	}));
+}
+function formatConfigError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function optionalPositiveInteger(value, variable, fallback) {
+	const normalized = optional(value);
+	if (!normalized) return Effect.succeed(fallback);
+	if (/^[1-9]\d*$/.test(normalized)) return Effect.succeed(Number(normalized));
+	return Effect.fail(new RivusDaemonConfigError(variable, `${variable} must be a positive integer`));
+}
+function required(env, variable) {
+	const value = optional(env[variable]);
+	if (value) return Effect.succeed(value);
+	return Effect.fail(new RivusDaemonConfigError(variable, `${variable} is required`));
+}
+function optionalThinkingLevel(value) {
+	const normalized = optional(value);
+	if (!normalized) return Effect.succeed(void 0);
+	if (THINKING_LEVELS$1.has(normalized)) return Effect.succeed(normalized);
+	return Effect.fail(new RivusDaemonConfigError("PI_THINKING_LEVEL", "PI_THINKING_LEVEL must be one of off, minimal, low, medium, high, xhigh"));
+}
+//#endregion
+//#region src/infrastructure/config/local-env-file.ts
+var LocalEnvFileError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LocalEnvFileError";
+	}
+};
+async function loadMergedLocalEnvFile(filePath, overrideEnv) {
+	return mergeRivusDaemonEnv(await loadLocalEnvFile(filePath), overrideEnv);
+}
+async function loadLocalEnvFile(filePath) {
+	return parseLocalEnvFile(await readFile(filePath, "utf8"));
+}
+function parseLocalEnvFile(contents) {
+	const env = {};
+	const lines = contents.split(/\r?\n/);
+	for (let index = 0; index < lines.length; index += 1) {
+		const trimmed = lines[index].trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const match = (trimmed.startsWith("export ") ? trimmed.slice(7).trimStart() : trimmed).match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+		if (!match) throw new LocalEnvFileError(`Invalid env file line ${index + 1}`);
+		const key = match[1];
+		const rawValue = match[2];
+		env[key] = parseEnvValue(rawValue, index + 1);
+	}
+	return env;
+}
+function mergeRivusDaemonEnv(fileEnv, overrideEnv) {
+	const merged = { ...fileEnv };
+	for (const [key, value] of Object.entries(overrideEnv)) if (value !== void 0) merged[key] = value;
+	return merged;
+}
+function parseEnvValue(rawValue, lineNumber) {
+	const value = rawValue.trim();
+	if (!value) return "";
+	if (value.startsWith("'")) {
+		if (!value.endsWith("'")) throw new LocalEnvFileError(`Invalid single-quoted env value on line ${lineNumber}`);
+		return value.slice(1, -1).replaceAll("'\\''", "'");
+	}
+	if (value.startsWith("\"")) {
+		if (!value.endsWith("\"")) throw new LocalEnvFileError(`Invalid double-quoted env value on line ${lineNumber}`);
+		return unescapeDoubleQuotedValue(value.slice(1, -1));
+	}
+	return value;
+}
+function unescapeDoubleQuotedValue(value) {
+	return value.replace(/\\(["\\nrt])/g, (_match, escaped) => {
+		switch (escaped) {
+			case "n": return "\n";
+			case "r": return "\r";
+			case "t": return "	";
+			default: return escaped;
+		}
+	});
+}
+//#endregion
+//#region src/infrastructure/config/openclaw-env-import.ts
+var OpenClawEnvImportError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OpenClawEnvImportError";
+	}
+};
+const DEFAULT_AGENT_ID = "main";
+const DEFAULT_FEISHU_BASE_URL = "https://open.feishu.cn";
+const DEFAULT_LARK_BASE_URL = "https://open.larksuite.com";
+const DEFAULT_STREAM_MIN_INTERVAL_MS = 200;
+const THINKING_LEVELS = /* @__PURE__ */ new Set([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+const ENV_FILE_ORDER = [
+	"FEISHU_APP_ID",
+	"FEISHU_APP_SECRET",
+	"FEISHU_BASE_URL",
+	"FEISHU_STREAM_MIN_INTERVAL_MS",
+	"RIVUS_AGENT_ID",
+	"PI_API_KEY_FILE",
+	"PI_BASE_URL",
+	"PI_MODEL",
+	"PI_THINKING_LEVEL"
+];
+function createRivusEnvFromOpenClawConfig(openClawConfig, options = {}) {
+	const config = asRecord(openClawConfig, "OpenClaw config");
+	const feishu = asRecord(readPath(config, ["channels", "feishu"]), "channels.feishu");
+	const appId = requiredString(feishu, "appId", "channels.feishu.appId");
+	const appSecret = requiredString(feishu, "appSecret", "channels.feishu.appSecret");
+	const modelReference = findPrimaryModelReference(config);
+	const providerId = modelReference ? parseProviderId(modelReference) : void 0;
+	const provider = providerId ? optionalRecord(readPath(config, [
+		"models",
+		"providers",
+		providerId
+	])) : void 0;
+	const providerBaseUrl = provider ? optionalString(provider.baseUrl) : void 0;
+	const thinkingLevel = modelReference ? findThinkingLevel(config, modelReference) : void 0;
+	const warnings = thinkingLevel?.warning ? [thinkingLevel.warning] : [];
+	return {
+		env: {
+			FEISHU_APP_ID: appId,
+			FEISHU_APP_SECRET: appSecret,
+			FEISHU_BASE_URL: options.feishuBaseUrl ?? inferFeishuBaseUrl(optionalString(feishu.domain)),
+			FEISHU_STREAM_MIN_INTERVAL_MS: String(options.streamMinIntervalMs ?? DEFAULT_STREAM_MIN_INTERVAL_MS),
+			RIVUS_AGENT_ID: findAgentId(config),
+			...options.piApiKeyFile ? { PI_API_KEY_FILE: options.piApiKeyFile } : {},
+			...providerBaseUrl ? { PI_BASE_URL: providerBaseUrl } : {},
+			...modelReference ? { PI_MODEL: modelReference } : {},
+			...thinkingLevel?.level ? { PI_THINKING_LEVEL: thinkingLevel.level } : {}
+		},
+		warnings
+	};
+}
+function formatRivusEnvFile(env) {
+	return `${[...ENV_FILE_ORDER.filter((key) => Object.hasOwn(env, key)), ...Object.keys(env).filter((key) => !ENV_FILE_ORDER.includes(key)).sort()].map((key) => `${key}=${quoteEnvValue(env[key] ?? "")}`).join("\n")}\n`;
+}
+function findAgentId(config) {
+	const agents = optionalRecord(config.agents);
+	return optionalString(optionalRecord((Array.isArray(agents?.list) ? agents.list : [])[0])?.id) ?? DEFAULT_AGENT_ID;
+}
+function findPrimaryModelReference(config) {
+	const primary = optionalString(readPath(config, [
+		"agents",
+		"defaults",
+		"model",
+		"primary"
+	]));
+	if (primary) return primary;
+	const providers = optionalRecord(readPath(config, ["models", "providers"]));
+	if (!providers) return;
+	for (const [providerId, provider] of Object.entries(providers)) {
+		const model = firstModelId(optionalRecord(provider));
+		if (model) return `${providerId}/${model}`;
+	}
+}
+function firstModelId(provider) {
+	return optionalString(optionalRecord((Array.isArray(provider?.models) ? provider.models : [])[0])?.id);
+}
+function parseProviderId(modelReference) {
+	const separator = modelReference.indexOf("/");
+	return separator > 0 ? modelReference.slice(0, separator) : void 0;
+}
+function findThinkingLevel(config, modelReference) {
+	const providerId = parseProviderId(modelReference);
+	const modelId = readModelId(modelReference);
+	const rawLevel = [
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"thinkingLevel"
+		]),
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"thinkLevel"
+		]),
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"reasoningLevel"
+		]),
+		...providerId && modelId ? readProviderModelThinkingCandidates(config, providerId, modelId) : []
+	].map(optionalString).find(Boolean);
+	if (!rawLevel) return;
+	if (THINKING_LEVELS.has(rawLevel)) return { level: rawLevel };
+	return { warning: `Unsupported OpenClaw thinking level '${rawLevel}' was ignored` };
+}
+function readProviderModelThinkingCandidates(config, providerId, modelId) {
+	const providerModels = readPath(config, [
+		"models",
+		"providers",
+		providerId,
+		"models"
+	]);
+	if (!Array.isArray(providerModels)) return [];
+	const model = providerModels.map(optionalRecord).find((candidate) => optionalString(candidate?.id) === modelId);
+	if (!model) return [];
+	return [
+		model.thinkingLevel,
+		model.thinkLevel,
+		model.reasoningLevel,
+		readPath(model, ["reasoning", "level"]),
+		readPath(model, ["reasoning", "thinkingLevel"]),
+		readPath(model, ["reasoning", "thinkLevel"])
+	];
+}
+function readModelId(modelReference) {
+	const separator = modelReference.indexOf("/");
+	return separator >= 0 && separator < modelReference.length - 1 ? modelReference.slice(separator + 1) : void 0;
+}
+function inferFeishuBaseUrl(domain) {
+	return domain === "lark" ? DEFAULT_LARK_BASE_URL : DEFAULT_FEISHU_BASE_URL;
+}
+function quoteEnvValue(value) {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function requiredString(record, key, path) {
+	const value = optionalString(record[key]);
+	if (!value) throw new OpenClawEnvImportError(`${path} is required`);
+	return value;
+}
+function optionalString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function asRecord(value, path) {
+	const record = optionalRecord(value);
+	if (!record) throw new OpenClawEnvImportError(`${path} must be an object`);
+	return record;
+}
+function optionalRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function readPath(record, path) {
+	let value = record;
+	for (const segment of path) {
+		const current = optionalRecord(value);
+		if (!current) return;
+		value = current[segment];
+	}
+	return value;
+}
+//#endregion
+//#region src/application/daemon/rivus-daemon-shutdown-controller.ts
+const DEFAULT_SIGNALS = ["SIGINT", "SIGTERM"];
+function createRivusDaemonShutdownController(options) {
+	let shutdown;
+	const handle = (signal) => {
+		shutdown ??= Effect.runPromise(options.daemon.stop()).then(() => options.onStopped?.(signal)).catch(async (error) => {
+			await options.onError?.(error, signal);
+			throw error;
+		});
+		return shutdown;
+	};
+	return {
+		handle,
+		install: () => {
+			for (const signal of options.signals ?? DEFAULT_SIGNALS) options.signalSource.on(signal, () => {
+				handle(signal);
+			});
+		},
+		stopping: () => shutdown !== void 0
+	};
+}
+//#endregion
+//#region src/application/plugin/rivus-automation-runtime-definition.ts
+function resolveRivusAutomationRuntimeDefinition(definition, requestedToolIds, requestedSkillIds) {
+	const toolIds = Object.freeze([...new Set(requestedToolIds)].sort());
+	const toolsById = new Map(definition.tools.map((tool) => [tool.id, tool]));
+	const tools = Object.freeze(toolIds.map((toolId) => {
+		const tool = toolsById.get(toolId);
+		if (!tool) throw new Error(`Automation Runtime requests ungranted tool: ${toolId}`);
+		return tool;
+	}));
+	const skillIds = Object.freeze([...new Set(requestedSkillIds)].sort());
+	const skillsById = new Map(definition.skills.map((skill) => [skill.id, skill]));
+	const skills = Object.freeze(skillIds.map((skillId) => {
+		const skill = skillsById.get(skillId);
+		if (!skill) throw new Error(`Automation Runtime requests ungranted skill: ${skillId}`);
+		return skill;
+	}));
+	return deepFreeze({
+		...definition,
+		memory: {
+			scopes: [],
+			tool: false
+		},
+		skillGrantSet: {
+			revision: createHash("sha256").update(JSON.stringify({
+				parentRevision: definition.skillGrantSet.revision,
+				skillIds
+			})).digest("hex"),
+			skillIds
+		},
+		skills,
+		toolGrantSet: {
+			revision: createHash("sha256").update(JSON.stringify({
+				parentRevision: definition.toolGrantSet.revision,
+				toolIds
+			})).digest("hex"),
+			toolIds
+		},
+		tools
+	});
+}
+//#endregion
+//#region src/application/plugin/rivus-plugin-loader.ts
+var RivusPluginLoadError = class extends Error {
+	pluginId;
+	moduleSpecifier;
+	name = "RivusPluginLoadError";
+	constructor(pluginId, moduleSpecifier, message, options) {
+		super(message, options);
+		this.pluginId = pluginId;
+		this.moduleSpecifier = moduleSpecifier;
+	}
+};
+async function loadRivusDeployment(options) {
+	validateRivusDeploymentManifest(options.manifest);
+	const catalog = createRivusPluginCatalog();
+	const pluginStatuses = [];
+	const statusByPlugin = /* @__PURE__ */ new Map();
+	for (const declaration of options.manifest.plugins) try {
+		const plugin = await resolvePluginExport(await options.loadModule({
+			deploymentRoot: options.deploymentRoot,
+			module: declaration.module,
+			pluginId: declaration.id
+		}));
+		if (plugin.manifest.id !== declaration.id) throw new Error(`plugin manifest id ${plugin.manifest.id} does not match declaration ${declaration.id}`);
+		catalog.registerPlugin(plugin);
+		const status = Object.freeze({
+			id: declaration.id,
+			module: declaration.module,
+			required: declaration.required,
+			status: "loaded",
+			version: plugin.manifest.version
+		});
+		pluginStatuses.push(status);
+		statusByPlugin.set(declaration.id, status);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : String(cause);
+		if (declaration.required) throw new RivusPluginLoadError(declaration.id, declaration.module, `required plugin ${declaration.id} failed to load: ${message}`, { cause });
+		const status = Object.freeze({
+			error: message,
+			id: declaration.id,
+			module: declaration.module,
+			required: false,
+			status: "failed"
+		});
+		pluginStatuses.push(status);
+		statusByPlugin.set(declaration.id, status);
+	}
+	const agentStatuses = [];
+	const definitions = [];
+	for (const agent of options.manifest.agents) {
+		const pluginStatus = statusByPlugin.get(agent.pluginId);
+		if (pluginStatus.status === "failed") {
+			agentStatuses.push(Object.freeze({
+				agentId: agent.agentId,
+				pluginId: agent.pluginId,
+				profileId: agent.profileId,
+				reason: `plugin ${agent.pluginId} is unavailable: ${pluginStatus.error}`,
+				status: "disabled"
+			}));
+			continue;
+		}
+		try {
+			const definition = resolveRivusAgentDefinition(catalog, agent);
+			definitions.push(definition);
+			agentStatuses.push(Object.freeze({
+				agentId: agent.agentId,
+				definition,
+				pluginId: agent.pluginId,
+				profileId: agent.profileId,
+				status: "enabled"
+			}));
+		} catch (cause) {
+			const declaration = options.manifest.plugins.find(({ id }) => id === agent.pluginId);
+			const message = cause instanceof Error ? cause.message : String(cause);
+			if (declaration.required) throw new RivusPluginLoadError(declaration.id, declaration.module, `deployment ${agent.agentId} failed to resolve: ${message}`, { cause });
+			agentStatuses.push(Object.freeze({
+				agentId: agent.agentId,
+				pluginId: agent.pluginId,
+				profileId: agent.profileId,
+				reason: message,
+				status: "disabled"
+			}));
+		}
+	}
+	const agentStatusById = new Map(agentStatuses.map((agent) => [agent.agentId, agent]));
+	const automationTemplates = new Map(catalog.snapshot().automations.map((template) => [template.id, template]));
+	const automationDefinitions = [];
+	for (const automation of options.manifest.automations ?? []) {
+		const agent = agentStatusById.get(automation.agentId);
+		if (!agent || agent.status === "disabled" || !agent.definition) continue;
+		const template = automationTemplates.get(automation.templateId);
+		if (!template) throw new Error(`automation ${automation.id} references unknown template: ${automation.templateId}`);
+		if (template.pluginId !== agent.pluginId || template.profileId !== agent.profileId) throw new Error(`automation ${automation.id} template is not owned by agent profile ${agent.profileId}`);
+		automationDefinitions.push(deepFreeze({
+			...automation,
+			runtimeDefinition: resolveRivusAutomationRuntimeDefinition(agent.definition, template.requestedToolIds, template.requestedSkillIds),
+			template
+		}));
+	}
+	return Object.freeze({
+		agents: Object.freeze(agentStatuses),
+		automationDefinitions: Object.freeze(automationDefinitions),
+		catalog,
+		definitions: Object.freeze(definitions),
+		manifest: options.manifest,
+		plugins: Object.freeze(pluginStatuses)
+	});
+}
+function validateRivusDeploymentManifest(manifest) {
+	const pluginIds = /* @__PURE__ */ new Set();
+	for (const plugin of manifest.plugins) {
+		if (pluginIds.has(plugin.id)) throw new Error(`duplicate plugin declaration: ${plugin.id}`);
+		validateModuleSpecifier(plugin.module);
+		pluginIds.add(plugin.id);
+	}
+	const agentIds = /* @__PURE__ */ new Set();
+	const agentById = /* @__PURE__ */ new Map();
+	for (const agent of manifest.agents) {
+		if (agentIds.has(agent.agentId)) throw new Error(`duplicate agent deployment: ${agent.agentId}`);
+		agentIds.add(agent.agentId);
+		if (!pluginIds.has(agent.pluginId)) throw new Error(`agent ${agent.agentId} references undeclared plugin: ${agent.pluginId}`);
+		agentById.set(agent.agentId, agent);
+	}
+	const automationIds = /* @__PURE__ */ new Set();
+	for (const automation of manifest.automations ?? []) {
+		if (automationIds.has(automation.id)) throw new Error(`duplicate automation binding: ${automation.id}`);
+		automationIds.add(automation.id);
+		const agent = agentById.get(automation.agentId);
+		if (!agent) throw new Error(`automation ${automation.id} references unknown agent: ${automation.agentId}`);
+		const endpoint = manifest.endpoints.find(({ id }) => id === automation.delivery.endpointId);
+		if (!endpoint) throw new Error(`automation ${automation.id} references unknown delivery endpoint: ${automation.delivery.endpointId}`);
+		if (endpoint.agentId !== agent.agentId) throw new Error(`automation ${automation.id} delivery endpoint is bound to a different agent`);
+	}
+	const endpointIds = /* @__PURE__ */ new Set();
+	const sessionNamespaces = /* @__PURE__ */ new Set();
+	for (const endpoint of manifest.endpoints) {
+		if (endpointIds.has(endpoint.id)) throw new Error(`duplicate endpoint binding: ${endpoint.id}`);
+		endpointIds.add(endpoint.id);
+		if (sessionNamespaces.has(endpoint.sessionNamespace)) throw new Error(`duplicate endpoint session namespace: ${endpoint.sessionNamespace}`);
+		sessionNamespaces.add(endpoint.sessionNamespace);
+		const agent = agentById.get(endpoint.agentId);
+		if (!agent) throw new Error(`endpoint ${endpoint.id} references unknown agent: ${endpoint.agentId}`);
+		if (!agent.endpointIds.includes(endpoint.id)) throw new Error(`endpoint ${endpoint.id} is not declared by agent ${endpoint.agentId}`);
+	}
+	for (const agent of manifest.agents) for (const endpointId of agent.endpointIds) {
+		const endpoint = manifest.endpoints.find(({ id }) => id === endpointId);
+		if (!endpoint) throw new Error(`agent ${agent.agentId} references unknown endpoint: ${endpointId}`);
+		if (endpoint.agentId !== agent.agentId) throw new Error(`endpoint ${endpointId} is bound to a different agent`);
+	}
+	const defaultAgent = agentById.get(manifest.defaultAgentId);
+	if (!defaultAgent) throw new Error(`default agent does not exist: ${manifest.defaultAgentId}`);
+	const defaultEndpoint = manifest.endpoints.find(({ id }) => id === manifest.defaultEndpointId);
+	if (!defaultEndpoint) throw new Error(`default endpoint does not exist: ${manifest.defaultEndpointId}`);
+	if (defaultEndpoint.agentId !== defaultAgent.agentId) throw new Error("default endpoint is not bound to the default agent");
+	if (!defaultEndpoint.enabled) throw new Error("default endpoint must be enabled");
+}
+function validateModuleSpecifier(moduleSpecifier) {
+	if (moduleSpecifier.trim() === "" || isAbsolute(moduleSpecifier) || /^[a-z][a-z+.-]*:/i.test(moduleSpecifier) || moduleSpecifier.includes("\0")) throw new Error(`invalid plugin module specifier: ${moduleSpecifier}`);
+	if ((moduleSpecifier.startsWith("./") || moduleSpecifier.startsWith("../")) && moduleSpecifier.split(/[\\/]/).includes("..")) throw new Error(`plugin module escapes deployment root: ${moduleSpecifier}`);
+}
+async function resolvePluginExport(module) {
+	const candidate = "default" in module ? module.default : module;
+	const plugin = typeof candidate === "function" ? await candidate() : candidate;
+	if (plugin === null || typeof plugin !== "object" || !("manifest" in plugin) || !("register" in plugin) || typeof plugin.register !== "function") throw new Error("plugin module default export is not a RivusPlugin or factory");
+	return plugin;
+}
+//#endregion
+//#region src/application/support/stable-id.ts
+function createStableId(prefix, value) {
+	return `${prefix}:${createHash("sha256").update(JSON.stringify(value)).digest("hex")}`;
+}
+//#endregion
+//#region src/application/host/agent-instance-registry.ts
+var AgentInstanceConflict = class extends Error {
+	name = "AgentInstanceConflict";
+};
+function createAgentInstanceRegistry(options = {}) {
+	const records = /* @__PURE__ */ new Map();
+	for (const record of options.initialRecords ?? []) {
+		if (records.has(record.bindingKey)) throw new AgentInstanceConflict(`duplicate binding: ${record.bindingKey}`);
+		records.set(record.bindingKey, Object.freeze({ ...record }));
+	}
+	const resolveBinding = (binding, definition) => {
+		const runtimeGenerationId = createStableId("generation", {
+			agentId: definition.agentId,
+			profileRevision: definition.profileRevision,
+			toolGrantRevision: definition.toolGrantSet.revision
+		});
+		const bindingId = binding.kind === "endpoint" ? binding.endpointId : binding.automationId;
+		const bindingKey = `${binding.kind}:${bindingId}:${definition.agentId}`;
+		const existing = records.get(bindingKey);
+		if (existing) {
+			if (existing.runtimeGenerationId !== runtimeGenerationId) throw new AgentInstanceConflict(`binding ${bindingKey} belongs to a different runtime generation`);
+			return existing;
+		}
+		const record = Object.freeze({
+			agentId: definition.agentId,
+			binding: Object.freeze({ ...binding }),
+			bindingKey,
+			instanceId: createStableId("instance", {
+				bindingKey,
+				runtimeGenerationId
+			}),
+			runtimeGenerationId
+		});
+		records.set(bindingKey, record);
+		return record;
+	};
+	return {
+		resolveAutomation: (automationId, definition) => resolveBinding({
+			automationId,
+			kind: "automation"
+		}, definition),
+		resolveEndpoint: (endpointId, definition) => resolveBinding({
+			endpointId,
+			kind: "endpoint"
+		}, definition),
+		snapshot: () => Object.freeze([...records.values()])
+	};
+}
+//#endregion
+//#region src/application/host/agent-runtime-pool.ts
+var AgentInstanceBusy = class extends Error {
+	name = "AgentInstanceBusy";
+};
+var AgentRuntimeDisposed = class extends Error {
+	name = "AgentRuntimeDisposed";
+};
+const DEFAULT_RUNTIME_DISPOSE_TIMEOUT_MS = 1e4;
+function createAgentRuntimePool(options) {
+	const runtimes = /* @__PURE__ */ new Map();
+	const active = /* @__PURE__ */ new Map();
+	const resolveRuntime = (instance) => {
+		const current = runtimes.get(instance.instanceId);
+		if (current) return current;
+		let created;
+		created = Promise.resolve(options.createRuntime(instance)).catch((error) => {
+			if (runtimes.get(instance.instanceId) === created) runtimes.delete(instance.instanceId);
+			throw error;
+		});
+		runtimes.set(instance.instanceId, created);
+		return created;
+	};
+	return {
+		registry: options.registry,
+		cancel: async (instance, input) => {
+			const runtime = runtimes.get(instance.instanceId);
+			return runtime ? (await runtime).cancel?.(input) ?? false : false;
+		},
+		disposeAll: async () => {
+			const pendingRuntimes = [...runtimes.values()];
+			runtimes.clear();
+			active.clear();
+			await withTimeout(Promise.all(pendingRuntimes.map(async (runtime) => {
+				await (await runtime).dispose?.();
+			})), options.disposeTimeoutMs ?? DEFAULT_RUNTIME_DISPOSE_TIMEOUT_MS, "Agent runtime disposal timed out");
+		},
+		run: async (instance, input) => {
+			const pendingRuntime = resolveRuntime(instance);
+			const runtime = await pendingRuntime;
+			if (runtimes.get(instance.instanceId) !== pendingRuntime) throw new AgentRuntimeDisposed(`agent runtime was disposed before run start: ${instance.instanceId}`);
+			if (runtime.concurrency === "managed") return runtime.run(input);
+			if (active.has(instance.instanceId)) throw new AgentInstanceBusy(`agent instance already has an active run: ${instance.instanceId}`);
+			const activeToken = Symbol(instance.instanceId);
+			active.set(instance.instanceId, activeToken);
+			try {
+				return await runtime.run(input);
+			} finally {
+				if (active.get(instance.instanceId) === activeToken) active.delete(instance.instanceId);
+			}
+		}
+	};
+}
+async function withTimeout(promise, timeoutMs, message) {
+	let timeout;
+	try {
+		return await Promise.race([promise, new Promise((_resolve, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error(`${message} after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+//#endregion
+//#region src/application/host/rivus-agent-host.ts
+var InvalidRivusEndpointBinding = class extends Error {
+	name = "InvalidRivusEndpointBinding";
+};
+function createRivusAgentHost(options) {
+	const definitions = new Map(options.definitions.map((definition) => [definition.agentId, definition]));
+	const endpoints = /* @__PURE__ */ new Map();
+	const automations = /* @__PURE__ */ new Map();
+	for (const endpoint of options.endpoints) {
+		if (endpoints.has(endpoint.id)) throw new InvalidRivusEndpointBinding(`duplicate endpoint: ${endpoint.id}`);
+		const definition = definitions.get(endpoint.agentId);
+		if (!definition) throw new InvalidRivusEndpointBinding(`unknown endpoint agent: ${endpoint.agentId}`);
+		if (!definition.endpointIds.includes(endpoint.id)) throw new InvalidRivusEndpointBinding(`endpoint ${endpoint.id} is not declared by ${endpoint.agentId}`);
+		endpoints.set(endpoint.id, options.runtimePool.registry.resolveEndpoint(endpoint.id, definition));
+	}
+	for (const automation of options.automations ?? []) {
+		if (automations.has(automation.id)) throw new InvalidRivusEndpointBinding(`duplicate automation: ${automation.id}`);
+		if (!definitions.has(automation.definition.agentId)) throw new InvalidRivusEndpointBinding(`unknown automation agent: ${automation.definition.agentId}`);
+		automations.set(automation.id, options.runtimePool.registry.resolveAutomation(automation.id, automation.definition));
+	}
+	const resolveEndpoint = (endpointId) => {
+		const instance = endpoints.get(endpointId);
+		if (!instance) throw new InvalidRivusEndpointBinding(`unknown endpoint: ${endpointId}`);
+		return instance;
+	};
+	const resolveAutomation = (automationId) => {
+		const instance = automations.get(automationId);
+		if (!instance) throw new InvalidRivusEndpointBinding(`unknown automation: ${automationId}`);
+		return instance;
+	};
+	return {
+		cancelEndpoint: (endpointId, input) => options.runtimePool.cancel(resolveEndpoint(endpointId), input),
+		handleAutomation: (automationId, input) => options.runtimePool.run(resolveAutomation(automationId), input),
+		handleEndpoint: (endpointId, input) => options.runtimePool.run(resolveEndpoint(endpointId), input),
+		resolveAutomation,
+		resolveEndpoint
+	};
+}
+//#endregion
+//#region src/application/deployment/rivus-deployment-daemon.ts
+var RivusDeploymentDaemonLifecycleError = class extends Error {
+	name = "RivusDeploymentDaemonLifecycleError";
+};
+var RivusDeploymentReadinessError = class extends Error {
+	endpointIds;
+	name = "RivusDeploymentReadinessError";
+	constructor(endpointIds) {
+		super(`required endpoint startup failed: ${endpointIds.join(", ")}`);
+		this.endpointIds = endpointIds;
+	}
+};
+var RivusDeploymentAutomationReadinessError = class extends Error {
+	automationIds;
+	name = "RivusDeploymentAutomationReadinessError";
+	constructor(automationIds) {
+		super(`required automation startup failed: ${automationIds.join(", ")}`);
+		this.automationIds = automationIds;
+	}
+};
+async function createRivusDeploymentDaemon(options) {
+	const deployment = await loadRivusDeployment(options);
+	const definitions = new Map(deployment.definitions.map((definition) => [definition.agentId, definition]));
+	const automationDefinitions = new Map(deployment.automationDefinitions.map((definition) => [definition.id, definition]));
+	const runtimePool = createAgentRuntimePool({
+		createRuntime: (instance) => {
+			const definition = instance.binding.kind === "automation" ? automationDefinitions.get(instance.binding.automationId)?.runtimeDefinition : definitions.get(instance.agentId);
+			if (!definition) throw new RivusDeploymentDaemonLifecycleError(`runtime instance references unknown agent: ${instance.agentId}`);
+			return options.createRuntime({
+				...instance,
+				catalog: deployment.catalog,
+				definition
+			});
+		},
+		registry: createAgentInstanceRegistry(options.initialInstanceRecords ? { initialRecords: options.initialInstanceRecords } : {})
+	});
+	const agentStatuses = new Map(deployment.agents.map((agent) => [agent.agentId, agent]));
+	const slots = deployment.manifest.endpoints.map((definition) => {
+		const agentEnabled = agentStatuses.get(definition.agentId)?.status === "enabled";
+		return {
+			agentEnabled,
+			definition,
+			lifecycle: definition.enabled && agentEnabled ? "stopped" : "disabled"
+		};
+	});
+	const automationSlots = (deployment.manifest.automations ?? []).map((definition) => {
+		const agentEnabled = agentStatuses.get(definition.agentId)?.status === "enabled";
+		const resolvedDefinition = automationDefinitions.get(definition.id);
+		return {
+			agentEnabled,
+			definition,
+			...resolvedDefinition ? { resolvedDefinition } : {},
+			lifecycle: definition.enabled && agentEnabled ? "stopped" : "disabled"
+		};
+	});
+	const host = createRivusAgentHost({
+		automations: automationSlots.filter((slot) => slot.definition.enabled && slot.agentEnabled && slot.resolvedDefinition !== void 0).map((slot) => ({
+			definition: slot.resolvedDefinition.runtimeDefinition,
+			id: slot.definition.id
+		})),
+		definitions: deployment.definitions,
+		endpoints: slots.filter((slot) => slot.definition.enabled && slot.agentEnabled).map((slot) => ({
+			agentId: slot.definition.agentId,
+			id: slot.definition.id
+		})),
+		runtimePool
+	});
+	const slotById = new Map(slots.map((slot) => [slot.definition.id, slot]));
+	let lifecycle = "stopped";
+	const canRunIntake = () => lifecycle === "running" || lifecycle === "degraded";
+	const handleEndpoint = async (endpointId, input) => {
+		const slot = slotById.get(endpointId);
+		if (!slot) throw new RivusDeploymentDaemonLifecycleError(`unknown endpoint: ${endpointId}`);
+		if (!canRunIntake() || slot.lifecycle !== "running" || !(slot.adapter?.running() ?? false)) throw new RivusDeploymentDaemonLifecycleError(`endpoint ${endpointId} cannot accept intake while ${slot.lifecycle}`);
+		return host.handleEndpoint(endpointId, input);
+	};
+	const endpointStatus = (slot) => Object.freeze({
+		...componentStatus(slot),
+		agentId: slot.definition.agentId,
+		endpointId: slot.definition.id
+	});
+	const automationStatus = (slot) => Object.freeze({
+		...componentStatus(slot),
+		agentId: slot.definition.agentId,
+		automationId: slot.definition.id
+	});
+	const allSlots = [...slots, ...automationSlots];
+	const isReady = () => allSlots.every(isSlotReady);
+	const failedRequiredEndpointIds = () => slots.filter((slot) => slot.definition.enabled && slot.definition.required && slot.lifecycle !== "running").map((slot) => slot.definition.id);
+	const failedRequiredAutomationIds = () => automationSlots.filter((slot) => slot.definition.enabled && slot.definition.required && slot.lifecycle !== "running").map((slot) => slot.definition.id);
+	const assertRequiredReadiness = () => {
+		const endpointIds = failedRequiredEndpointIds();
+		if (endpointIds.length > 0) throw new RivusDeploymentReadinessError(Object.freeze(endpointIds));
+		const automationIds = failedRequiredAutomationIds();
+		if (automationIds.length > 0) throw new RivusDeploymentAutomationReadinessError(Object.freeze(automationIds));
+	};
+	const status = () => Object.freeze({
+		agents: deployment.agents,
+		automations: Object.freeze(automationSlots.map(automationStatus)),
+		defaultAgentId: deployment.manifest.defaultAgentId,
+		defaultEndpointId: deployment.manifest.defaultEndpointId,
+		endpoints: Object.freeze(slots.map(endpointStatus)),
+		lifecycle,
+		plugins: deployment.plugins,
+		ready: isReady(),
+		running: canRunIntake()
+	});
+	return {
+		deployment,
+		handleDefault: (input) => handleEndpoint(deployment.manifest.defaultEndpointId, input),
+		handleEndpoint,
+		runDefaultAgent: (input) => host.handleEndpoint(deployment.manifest.defaultEndpointId, input),
+		running: canRunIntake,
+		start: async () => {
+			if (lifecycle === "running") return;
+			if (lifecycle === "degraded") {
+				assertRequiredReadiness();
+				return;
+			}
+			if (lifecycle !== "stopped") throw new RivusDeploymentDaemonLifecycleError(`cannot start deployment daemon while ${lifecycle}`);
+			lifecycle = "starting";
+			let degraded = false;
+			for (const slot of slots) {
+				const slotDegraded = await startSlot(slot, slot.agentEnabled, () => options.createEndpoint({
+					agentId: slot.definition.agentId,
+					cancel: (input) => host.cancelEndpoint(slot.definition.id, input),
+					definition: slot.definition,
+					endpointId: slot.definition.id,
+					handle: (input) => handleEndpoint(slot.definition.id, input),
+					instanceId: host.resolveEndpoint(slot.definition.id).instanceId
+				}));
+				degraded ||= slotDegraded;
+			}
+			for (const slot of automationSlots) {
+				const resolvedDefinition = slot.resolvedDefinition;
+				const slotDegraded = await startSlot(slot, slot.agentEnabled && resolvedDefinition !== void 0, async () => {
+					if (!options.createAutomation) throw new RivusDeploymentDaemonLifecycleError("deployment bootstrap does not provide Automation adapters");
+					if (!resolvedDefinition) throw new RivusDeploymentDaemonLifecycleError(`automation definition not resolved: ${slot.definition.id}`);
+					return options.createAutomation({
+						automationId: slot.definition.id,
+						definition: resolvedDefinition,
+						deliveryEndpoint: slotById.get(slot.definition.delivery.endpointId).definition,
+						instanceId: host.resolveAutomation(slot.definition.id).instanceId,
+						run: (input) => host.handleAutomation(slot.definition.id, {
+							invocation: {
+								allowedActorOpenIds: [],
+								automationId: slot.definition.id,
+								endpointId: slot.definition.delivery.endpointId,
+								kind: "automation",
+								sourceMessageId: input.tickId,
+								tenantKey: "automation",
+								tickId: input.tickId
+							},
+							sessionKey: input.sessionKey,
+							text: input.text
+						})
+					});
+				});
+				degraded ||= slotDegraded;
+			}
+			lifecycle = degraded ? "degraded" : "running";
+			assertRequiredReadiness();
+		},
+		status,
+		stop: async () => {
+			if (lifecycle === "stopped") {
+				await runtimePool.disposeAll();
+				return;
+			}
+			if (lifecycle !== "running" && lifecycle !== "degraded" && lifecycle !== "cleanup-required") throw new RivusDeploymentDaemonLifecycleError(`cannot stop deployment daemon while ${lifecycle}`);
+			lifecycle = "stopping";
+			const errors = [];
+			await stopSlots(automationSlots, errors);
+			await stopSlots(slots, errors);
+			try {
+				await runtimePool.disposeAll();
+			} catch (error) {
+				errors.push(error);
+			}
+			lifecycle = errors.length === 0 ? "stopped" : "cleanup-required";
+			if (errors.length === 1) throw errors[0];
+			if (errors.length > 1) throw new AggregateError(errors, "deployment daemon cleanup failed");
+		}
+	};
+}
+function componentStatus(slot) {
+	return {
+		enabled: slot.definition.enabled,
+		...slot.error ? { error: slot.error } : {},
+		lifecycle: slot.lifecycle,
+		required: slot.definition.required,
+		running: slot.lifecycle === "running" && (slot.adapter?.running() ?? false)
+	};
+}
+function isSlotReady(slot) {
+	return !slot.definition.enabled || !slot.definition.required || slot.lifecycle === "running" && (slot.adapter?.running() ?? false);
+}
+async function startSlot(slot, available, create) {
+	if (!slot.definition.enabled) {
+		slot.lifecycle = "disabled";
+		return false;
+	}
+	if (!available) {
+		slot.lifecycle = "disabled";
+		return slot.definition.required;
+	}
+	slot.lifecycle = "starting";
+	delete slot.error;
+	try {
+		slot.adapter ??= await create();
+		await slot.adapter.start();
+		slot.lifecycle = "running";
+		return false;
+	} catch (error) {
+		slot.error = error instanceof Error ? error.message : String(error);
+		slot.lifecycle = "degraded";
+		return true;
+	}
+}
+async function stopSlots(slots, errors) {
+	for (const slot of [...slots].reverse()) {
+		if (!slot.adapter || slot.lifecycle === "stopped" || slot.lifecycle === "disabled") continue;
+		slot.lifecycle = "stopping";
+		try {
+			await slot.adapter.stop();
+			slot.lifecycle = slot.definition.enabled && slot.agentEnabled ? "stopped" : "disabled";
+			delete slot.error;
+		} catch (error) {
+			errors.push(error);
+			slot.error = error instanceof Error ? error.message : String(error);
+			slot.lifecycle = "cleanup-required";
+		}
+	}
+}
+//#endregion
+//#region src/infrastructure/config/rivus-deployment-manifest.ts
+var RivusDeploymentManifestError = class extends Error {
+	manifestPath;
+	name = "RivusDeploymentManifestError";
+	constructor(manifestPath, message, options) {
+		super(message, options);
+		this.manifestPath = manifestPath;
+	}
+};
+async function loadRivusDeploymentManifest(manifestPath, options = {}) {
+	const maxBytes = options.maxBytes ?? 1024 * 1024;
+	try {
+		const metadata = await stat(manifestPath);
+		if (!metadata.isFile()) throw new Error("deployment manifest must be a regular file");
+		if (metadata.size > maxBytes) throw new Error(`deployment manifest exceeds ${maxBytes} byte limit`);
+		const bytes = await readFile(manifestPath);
+		const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		return parseManifest(JSON.parse(text));
+	} catch (cause) {
+		if (cause instanceof RivusDeploymentManifestError) throw cause;
+		throw new RivusDeploymentManifestError(manifestPath, `failed to load Rivus deployment manifest: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+}
+function parseManifest(value) {
+	const root = record(value, "manifest");
+	exactKeys(root, [
+		"agents",
+		"automations",
+		"defaultAgentId",
+		"defaultEndpointId",
+		"endpoints",
+		"plugins"
+	], "manifest", ["automations"]);
+	const plugins = array(root.plugins, "manifest.plugins").map((entry, index) => {
+		const plugin = record(entry, `manifest.plugins[${index}]`);
+		exactKeys(plugin, [
+			"id",
+			"module",
+			"required"
+		], `manifest.plugins[${index}]`);
+		return Object.freeze({
+			id: string(plugin.id, `manifest.plugins[${index}].id`),
+			module: string(plugin.module, `manifest.plugins[${index}].module`),
+			required: boolean(plugin.required, `manifest.plugins[${index}].required`)
+		});
+	});
+	const agents = array(root.agents, "manifest.agents").map((entry, index) => {
+		const agent = record(entry, `manifest.agents[${index}]`);
+		exactKeys(agent, [
+			"agentId",
+			"endpointIds",
+			"memory",
+			"pluginId",
+			"profileId",
+			"skills",
+			"tools"
+		], `manifest.agents[${index}]`, ["memory"]);
+		const memory = agent.memory === void 0 ? void 0 : record(agent.memory, `manifest.agents[${index}].memory`);
+		if (memory) exactKeys(memory, ["scopes", "tool"], `manifest.agents[${index}].memory`);
+		const skills = record(agent.skills, `manifest.agents[${index}].skills`);
+		exactKeys(skills, ["allow"], `manifest.agents[${index}].skills`);
+		const tools = record(agent.tools, `manifest.agents[${index}].tools`);
+		exactKeys(tools, ["allow"], `manifest.agents[${index}].tools`);
+		return Object.freeze({
+			agentId: string(agent.agentId, `manifest.agents[${index}].agentId`),
+			endpointIds: Object.freeze(array(agent.endpointIds, `manifest.agents[${index}].endpointIds`).map((item, itemIndex) => string(item, `manifest.agents[${index}].endpointIds[${itemIndex}]`))),
+			...memory ? { memory: Object.freeze({
+				scopes: Object.freeze(array(memory.scopes, `manifest.agents[${index}].memory.scopes`).map((item, itemIndex) => memoryScope(item, `manifest.agents[${index}].memory.scopes[${itemIndex}]`))),
+				tool: boolean(memory.tool, `manifest.agents[${index}].memory.tool`)
+			}) } : {},
+			pluginId: string(agent.pluginId, `manifest.agents[${index}].pluginId`),
+			profileId: string(agent.profileId, `manifest.agents[${index}].profileId`),
+			skills: Object.freeze({ allow: Object.freeze(array(skills.allow, `manifest.agents[${index}].skills.allow`).map((item, itemIndex) => string(item, `manifest.agents[${index}].skills.allow[${itemIndex}]`))) }),
+			tools: Object.freeze({ allow: Object.freeze(array(tools.allow, `manifest.agents[${index}].tools.allow`).map((item, itemIndex) => string(item, `manifest.agents[${index}].tools.allow[${itemIndex}]`))) })
+		});
+	});
+	const endpoints = array(root.endpoints, "manifest.endpoints").map((entry, index) => {
+		const endpoint = record(entry, `manifest.endpoints[${index}]`);
+		exactKeys(endpoint, [
+			"agentId",
+			"baseUrl",
+			"credentialRef",
+			"enabled",
+			"experimental",
+			"groupPolicy",
+			"id",
+			"required",
+			"sessionNamespace",
+			"streamMinIntervalMs"
+		], `manifest.endpoints[${index}]`, ["experimental"]);
+		const experimental = endpoint.experimental === void 0 ? void 0 : record(endpoint.experimental, `manifest.endpoints[${index}].experimental`);
+		if (experimental) exactKeys(experimental, ["cotMessages"], `manifest.endpoints[${index}].experimental`);
+		return Object.freeze({
+			agentId: string(endpoint.agentId, `manifest.endpoints[${index}].agentId`),
+			baseUrl: string(endpoint.baseUrl, `manifest.endpoints[${index}].baseUrl`),
+			credentialRef: string(endpoint.credentialRef, `manifest.endpoints[${index}].credentialRef`),
+			enabled: boolean(endpoint.enabled, `manifest.endpoints[${index}].enabled`),
+			...experimental ? { experimental: Object.freeze({ cotMessages: boolean(experimental.cotMessages, `manifest.endpoints[${index}].experimental.cotMessages`) }) } : {},
+			groupPolicy: groupPolicy(endpoint.groupPolicy, `manifest.endpoints[${index}].groupPolicy`),
+			id: string(endpoint.id, `manifest.endpoints[${index}].id`),
+			required: boolean(endpoint.required, `manifest.endpoints[${index}].required`),
+			sessionNamespace: string(endpoint.sessionNamespace, `manifest.endpoints[${index}].sessionNamespace`),
+			streamMinIntervalMs: positiveInteger(endpoint.streamMinIntervalMs, `manifest.endpoints[${index}].streamMinIntervalMs`)
+		});
+	});
+	const automations = array(root.automations ?? [], "manifest.automations").map((entry, index) => {
+		const automation = record(entry, `manifest.automations[${index}]`);
+		exactKeys(automation, [
+			"agentId",
+			"delivery",
+			"enabled",
+			"id",
+			"required",
+			"schedule",
+			"templateId",
+			"timeZone"
+		], `manifest.automations[${index}]`);
+		const delivery = record(automation.delivery, `manifest.automations[${index}].delivery`);
+		exactKeys(delivery, [
+			"endpointId",
+			"targetRef",
+			"targetType"
+		], `manifest.automations[${index}].delivery`);
+		return Object.freeze({
+			agentId: string(automation.agentId, `manifest.automations[${index}].agentId`),
+			delivery: Object.freeze({
+				endpointId: string(delivery.endpointId, `manifest.automations[${index}].delivery.endpointId`),
+				targetRef: string(delivery.targetRef, `manifest.automations[${index}].delivery.targetRef`),
+				targetType: automationTargetType(delivery.targetType, `manifest.automations[${index}].delivery.targetType`)
+			}),
+			enabled: boolean(automation.enabled, `manifest.automations[${index}].enabled`),
+			id: string(automation.id, `manifest.automations[${index}].id`),
+			required: boolean(automation.required, `manifest.automations[${index}].required`),
+			schedule: string(automation.schedule, `manifest.automations[${index}].schedule`),
+			templateId: string(automation.templateId, `manifest.automations[${index}].templateId`),
+			timeZone: string(automation.timeZone, `manifest.automations[${index}].timeZone`)
+		});
+	});
+	return Object.freeze({
+		agents: Object.freeze(agents),
+		automations: Object.freeze(automations),
+		defaultAgentId: string(root.defaultAgentId, "manifest.defaultAgentId"),
+		defaultEndpointId: string(root.defaultEndpointId, "manifest.defaultEndpointId"),
+		endpoints: Object.freeze(endpoints),
+		plugins: Object.freeze(plugins)
+	});
+}
+function record(value, path) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${path} must be an object`);
+	return value;
+}
+function array(value, path) {
+	if (!Array.isArray(value)) throw new Error(`${path} must be an array`);
+	return value;
+}
+function string(value, path) {
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${path} must be a non-empty string`);
+	return value;
+}
+function boolean(value, path) {
+	if (typeof value !== "boolean") throw new Error(`${path} must be a boolean`);
+	return value;
+}
+function positiveInteger(value, path) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${path} must be a positive integer`);
+	return value;
+}
+function memoryScope(value, path) {
+	if (typeof value !== "string" || !MEMORY_SCOPES.includes(value)) throw new Error(`${path} must be conversation, agent-private, or shared-user-profile`);
+	return value;
+}
+function groupPolicy(value, path) {
+	if (value !== "mention-only" && value !== "ignore-unmentioned" && value !== "default-responder") throw new Error(`${path} must be mention-only, ignore-unmentioned, or default-responder`);
+	return value;
+}
+function automationTargetType(value, path) {
+	if (value !== "chat_id" && value !== "open_id" && value !== "user_id" && value !== "union_id" && value !== "email") throw new Error(`${path} must be chat_id, open_id, user_id, union_id, or email`);
+	return value;
+}
+function exactKeys(value, allowed, path, optional = []) {
+	const unexpected = Object.keys(value).find((key) => !allowed.includes(key));
+	if (unexpected) throw new Error(`${path} contains unsupported field: ${unexpected}`);
+	const missing = allowed.find((key) => !optional.includes(key) && !Object.hasOwn(value, key));
+	if (missing) throw new Error(`${path} is missing required field: ${missing}`);
+}
+//#endregion
+//#region src/infrastructure/plugin/node-rivus-plugin-module-loader.ts
+async function loadNodeRivusPluginModule(request) {
+	const deploymentRoot = await realpath(request.deploymentRoot);
+	const resolvedRealpath = await realpath(createRequire(join(deploymentRoot, "package.json")).resolve(request.module));
+	if (!isWithin(deploymentRoot, resolvedRealpath)) throw new Error(`plugin module ${request.module} resolves outside deployment root: ${resolvedRealpath}`);
+	return await import(pathToFileURL(resolvedRealpath).href);
+}
+function isWithin(root, candidate) {
+	const child = relative(root, candidate);
+	return child === "" || !child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute(child);
+}
+//#endregion
+//#region src/infrastructure/runtime/configured-rivus-deployment-daemon.ts
+async function createConfiguredRivusDeploymentDaemon(options) {
+	const manifest = await loadRivusDeploymentManifest(options.manifestPath, options.manifestOptions);
+	return createRivusDeploymentDaemon({
+		...options.createAutomation ? { createAutomation: options.createAutomation } : {},
+		createEndpoint: options.createEndpoint,
+		createRuntime: options.createRuntime,
+		deploymentRoot: dirname(options.manifestPath),
+		...options.initialInstanceRecords ? { initialInstanceRecords: options.initialInstanceRecords } : {},
+		loadModule: loadNodeRivusPluginModule,
+		manifest
+	});
+}
+//#endregion
+//#region src/composition/rivus-deployment-cli-process.ts
+async function createRivusDeploymentCliProcess(factory, context) {
+	const adapters = await factory(context);
+	let adaptersDisposed = false;
+	let recoveryControlPromise;
+	const disposeAdapters = async () => {
+		if (adaptersDisposed) return;
+		adaptersDisposed = true;
+		await adapters.dispose?.();
+	};
+	let daemon;
+	try {
+		daemon = await createConfiguredRivusDeploymentDaemon({
+			...adapters.createAutomation ? { createAutomation: adapters.createAutomation } : {},
+			createEndpoint: adapters.createEndpoint,
+			createRuntime: adapters.createRuntime,
+			...adapters.initialInstanceRecords ? { initialInstanceRecords: adapters.initialInstanceRecords } : {},
+			manifestPath: context.manifestPath
+		});
+	} catch (constructionError) {
+		try {
+			await disposeAdapters();
+		} catch (disposeError) {
+			throw new AggregateError([constructionError, disposeError], "deployment construction and cleanup failed");
+		}
+		throw constructionError;
+	}
+	const start = async () => {
+		if (adaptersDisposed) throw new Error("Rivus deployment process cannot restart after its adapters have been disposed");
+		try {
+			await daemon.start();
+		} catch (startError) {
+			const cleanupErrors = [];
+			try {
+				await daemon.stop();
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+			try {
+				await disposeAdapters();
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+			if (cleanupErrors.length > 0) throw new AggregateError([startError, ...cleanupErrors], "deployment startup and cleanup failed");
+			throw startError;
+		}
+	};
+	const stop = async () => {
+		const errors = [];
+		try {
+			await daemon.stop();
+		} catch (error) {
+			errors.push(error);
+		}
+		try {
+			await disposeAdapters();
+		} catch (error) {
+			errors.push(error);
+		}
+		if (errors.length === 1) throw errors[0];
+		if (errors.length > 1) throw new AggregateError(errors, "deployment and adapter cleanup failed");
+	};
+	const process = {
+		defaultSessionKey: `local:${daemon.deployment.manifest.defaultAgentId}:cli`,
+		openRecoveryControl: () => Effect.tryPromise({
+			try: async () => {
+				if (adaptersDisposed) throw new Error("Rivus deployment process cannot open Recovery Control after disposal");
+				if (!adapters.createRecoveryControl) throw new Error("Deployment bootstrap does not expose Recovery Control");
+				recoveryControlPromise ??= Promise.resolve().then(() => adapters.createRecoveryControl());
+				try {
+					return await recoveryControlPromise;
+				} catch (error) {
+					recoveryControlPromise = void 0;
+					throw error;
+				}
+			},
+			catch: (error) => error
+		}),
+		running: () => daemon.running(),
+		start: () => Effect.tryPromise({
+			try: start,
+			catch: (error) => error
+		}),
+		status: () => Effect.sync(() => daemon.status()),
+		stop: () => Effect.tryPromise({
+			try: stop,
+			catch: (error) => error
+		}),
+		promptText: (command) => Effect.tryPromise({
+			try: async () => {
+				if (adaptersDisposed) throw new Error("Rivus deployment process cannot restart after its adapters have been disposed");
+				return readPromptFinalText(await daemon.runDefaultAgent({
+					invocation: {
+						allowedActorOpenIds: [],
+						endpointId: daemon.deployment.manifest.defaultEndpointId,
+						kind: "local-cli",
+						memory: {
+							audience: "private",
+							...context.env.RIVUS_LOCAL_CONVERSATION_ID?.trim() ? { conversationId: context.env.RIVUS_LOCAL_CONVERSATION_ID.trim() } : {},
+							subjectId: context.env.RIVUS_LOCAL_SUBJECT_ID?.trim() || "local-operator",
+							tenantId: context.env.RIVUS_MEMORY_TENANT_ID?.trim() || "local"
+						},
+						sourceMessageId: `cli:${randomUUID()}`,
+						tenantKey: "local"
+					},
+					sessionKey: command.sessionKey,
+					text: command.text
+				}));
+			},
+			catch: (error) => error
+		})
+	};
+	const replayReceiveMessage = adapters.replayReceiveMessage;
+	if (replayReceiveMessage) process.replayReceiveMessage = (payload, options) => Effect.tryPromise({
+		try: async () => {
+			if (!daemon.running()) await start();
+		},
+		catch: (error) => error
+	}).pipe(Effect.flatMap(() => replayReceiveMessage((input) => daemon.handleDefault(input), payload, options)));
+	return process;
+}
+function readPromptFinalText(result) {
+	if (typeof result === "string") return result;
+	if (typeof result === "object" && result !== null && "finalText" in result && typeof result.finalText === "string") return result.finalText;
+	throw new Error("Default deployment prompt result must be a string or contain finalText");
+}
+//#endregion
+//#region src/composition/rivus-recovery-cli.ts
+function createRivusRecoveryCliParser() {
+	const input = { recoveryList: false };
+	return {
+		build: () => buildCommand(input),
+		consume: (argument, next) => consumeArgument(input, argument, next)
+	};
+}
+async function runRivusRecoveryCliCommand(control, command) {
+	switch (command.type) {
+		case "inspect": return Effect.runPromise(control.inspect());
+		case "requeue-dead-letter": return Effect.runPromise(control.requeueDeadLetter({
+			actorId: "local-cli",
+			deliveryId: command.deliveryId,
+			endpointId: command.endpointId,
+			expectedRevision: command.expectedRevision,
+			note: await readPrivateTextFile(command.noteFilePath, "Recovery note", 16 * 1024)
+		}));
+		case "resolve-tool-operation": {
+			const note = await readPrivateTextFile(command.noteFilePath, "Recovery note", 16 * 1024);
+			const outcome = command.outcome.status === "applied" ? {
+				result: parseToolResult(await readPrivateTextFile(command.outcome.resultFilePath, "Tool result", 1024 * 1024)),
+				status: "applied"
+			} : command.outcome;
+			return Effect.runPromise(control.resolveToolOperation({
+				actorId: "local-cli",
+				expectedRevision: command.expectedRevision,
+				instanceId: command.instanceId,
+				note,
+				operationId: command.operationId,
+				outcome
+			}));
+		}
+	}
+}
+function consumeArgument(input, argument, next) {
+	if (argument === "--recovery-list") {
+		input.recoveryList = true;
+		return {
+			consumed: 0,
+			handled: true
+		};
+	}
+	for (const [flag, key] of [
+		["--requeue-dead-letter", "requeueDeadLetterId"],
+		["--resolve-tool-operation", "resolveToolOperationId"],
+		["--endpoint-id", "endpointId"],
+		["--instance-id", "instanceId"],
+		["--expected-revision", "expectedRevision"],
+		["--recovery-note-file", "recoveryNoteFile"],
+		["--tool-outcome", "toolOutcome"],
+		["--tool-result-file", "toolResultFile"]
+	]) {
+		if (argument === flag) {
+			if (!next) return {
+				consumed: 0,
+				error: `${flag} requires a value`,
+				handled: true
+			};
+			input[key] = next;
+			return {
+				consumed: 1,
+				handled: true
+			};
+		}
+		if (argument?.startsWith(`${flag}=`)) {
+			const value = argument.slice(flag.length + 1);
+			if (!value) return {
+				consumed: 0,
+				error: `${flag} requires a value`,
+				handled: true
+			};
+			input[key] = value;
+			return {
+				consumed: 0,
+				handled: true
+			};
+		}
+	}
+	return {
+		consumed: 0,
+		handled: false
+	};
+}
+function buildCommand(input) {
+	const actionCount = Number(input.recoveryList) + Number(input.requeueDeadLetterId !== void 0) + Number(input.resolveToolOperationId !== void 0);
+	const hasOptions = input.endpointId !== void 0 || input.expectedRevision !== void 0 || input.instanceId !== void 0 || input.recoveryNoteFile !== void 0 || input.toolOutcome !== void 0 || input.toolResultFile !== void 0;
+	if (actionCount === 0) return hasOptions ? { error: "Recovery options require --recovery-list, --requeue-dead-letter, or --resolve-tool-operation" } : {};
+	if (actionCount > 1) return { error: "Choose only one recovery command" };
+	if (input.recoveryList) return hasOptions ? { error: "--recovery-list does not accept mutation options" } : { command: { type: "inspect" } };
+	const expectedRevision = parsePositiveInteger(input.expectedRevision);
+	if (expectedRevision === void 0) return { error: "Recovery mutations require --expected-revision with a positive integer" };
+	const noteFilePath = input.recoveryNoteFile?.trim();
+	if (!noteFilePath) return { error: "Recovery mutations require --recovery-note-file" };
+	if (input.requeueDeadLetterId !== void 0) return buildDeadLetterCommand(input, expectedRevision, noteFilePath);
+	return buildToolOperationCommand(input, expectedRevision, noteFilePath);
+}
+function buildDeadLetterCommand(input, expectedRevision, noteFilePath) {
+	const endpointId = input.endpointId?.trim();
+	if (!endpointId) return { error: "--requeue-dead-letter requires --endpoint-id" };
+	if (input.instanceId !== void 0 || input.toolOutcome !== void 0 || input.toolResultFile !== void 0) return { error: "--requeue-dead-letter cannot use Tool reconciliation options" };
+	return { command: {
+		deliveryId: input.requeueDeadLetterId,
+		endpointId,
+		expectedRevision,
+		noteFilePath,
+		type: "requeue-dead-letter"
+	} };
+}
+function buildToolOperationCommand(input, expectedRevision, noteFilePath) {
+	const instanceId = input.instanceId?.trim();
+	if (!instanceId) return { error: "--resolve-tool-operation requires --instance-id" };
+	if (input.endpointId !== void 0) return { error: "--resolve-tool-operation cannot use --endpoint-id" };
+	if (input.toolOutcome !== "applied" && input.toolOutcome !== "not-applied") return { error: "--resolve-tool-operation requires --tool-outcome applied or not-applied" };
+	if (input.toolOutcome === "not-applied") {
+		if (input.toolResultFile !== void 0) return { error: "--tool-result-file is only valid when --tool-outcome is applied" };
+		return { command: {
+			expectedRevision,
+			instanceId,
+			noteFilePath,
+			operationId: input.resolveToolOperationId,
+			outcome: { status: "not-applied" },
+			type: "resolve-tool-operation"
+		} };
+	}
+	const resultFilePath = input.toolResultFile?.trim();
+	if (!resultFilePath) return { error: "--tool-outcome applied requires --tool-result-file" };
+	return { command: {
+		expectedRevision,
+		instanceId,
+		noteFilePath,
+		operationId: input.resolveToolOperationId,
+		outcome: {
+			resultFilePath,
+			status: "applied"
+		},
+		type: "resolve-tool-operation"
+	} };
+}
+function parsePositiveInteger(value) {
+	return value && /^[1-9]\d*$/.test(value) ? Number(value) : void 0;
+}
+async function readPrivateTextFile(filePath, label, maxBytes) {
+	const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const metadata = await handle.stat();
+		if (!metadata.isFile()) throw new Error(`${label} must be a regular file`);
+		if ((metadata.mode & 63) !== 0) throw new Error(`${label} file permissions must be 0600 or stricter`);
+		if (metadata.size > maxBytes) throw new Error(`${label} file exceeds ${maxBytes} bytes`);
+		return (await handle.readFile("utf8")).trim();
+	} finally {
+		await handle.close();
+	}
+}
+function parseToolResult(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		throw new Error("Tool result file must contain valid JSON");
+	}
+}
+//#endregion
+//#region src/composition/rivus-daemon-cli.ts
+const USAGE = `Usage: rivus --bootstrap <module> [--manifest <rivus.config.json>]
+
+Starts a local Rivus Agent daemon from an injected bootstrap module.
+
+Options:
+  --bootstrap <module>  Module exporting createRivusDaemonProcess(context)
+  --manifest <path>     Start the manifest-driven multi-agent deployment; bootstrap exports createRivusDeploymentAdapters(context)
+  --env-file <path>     Load local KEY=value config before reading environment
+  --check-config        Print redacted local config JSON and exit
+  --prompt <text>       Run one local prompt through bootstrap promptText() and exit
+  --replay-feishu-event <json>
+                         Replay one Feishu receive-message payload through bootstrap replayReceiveMessage() and exit
+  --replay-feishu-text <text>
+                         Replay one synthetic Feishu receive-message text payload without Feishu side effects and exit
+  --feishu-message-id <id>
+                         Message id for --replay-feishu-text (default om_cli_<timestamp>)
+  --feishu-chat-id <id> Chat id for --replay-feishu-text (default oc_cli)
+  --feishu-thread-id <id>
+                         Thread id for --replay-feishu-text (default omt_cli)
+  --feishu-tenant-key <key>
+                         Tenant key for --replay-feishu-text (default tenant_cli)
+  --print-openclaw-env <json>
+                         Print a Rivus env file from an OpenClaw config JSON and exit
+  --pi-api-key-file <path>
+                         Add PI_API_KEY_FILE when using --print-openclaw-env
+  --session-key <key>   Session key for --prompt (default local:<agent-id>:cli)
+  --status              Print bootstrap status JSON without starting the daemon
+  --recovery-list       List Dead Letters and Tool operations requiring reconciliation
+  --requeue-dead-letter <message-id>
+                         Requeue one Dead Letter; requires --endpoint-id, --expected-revision, and --recovery-note-file
+  --resolve-tool-operation <operation-id>
+                         Resolve one uncertain Tool operation; requires --instance-id, --expected-revision,
+                         --tool-outcome, and --recovery-note-file
+  --endpoint-id <id>    Endpoint owning the Dead Letter
+  --instance-id <id>    Agent Instance owning the Tool operation
+  --expected-revision <n>
+                         Exact record revision required by a recovery mutation
+  --recovery-note-file <path>
+                         Private (0600) file containing the required audit note
+  --tool-outcome <applied|not-applied>
+                         Confirm whether the external Tool effect occurred
+  --tool-result-file <path>
+                         Private (0600) JSON file required when --tool-outcome is applied
+  --status-url <url>    Print live daemon status JSON from a running daemon
+  --wait-receive <kind> Wait with --status-url or a started bootstrap daemon until receive.lastAccepted or receive.lastHandled exists
+  --wait-receive-text <text>
+                         With --wait-receive handled, wait until receive.lastHandled.intake.text contains text
+  --wait-receive-message-id <id>
+                         With --wait-receive, wait until the accepted or handled receive observation has this Feishu message id
+  --wait-receive-observed-after <iso>
+                         With --wait-receive, ignore receive observations at or before this ISO timestamp
+  --wait-timeout-ms <n> Timeout for --wait-receive (default 30000)
+  --wait-poll-ms <n>   Poll interval for --wait-receive (default 500)
+  --help               Show this help
+
+Environment:
+  RIVUS_BOOTSTRAP_MODULE may be used instead of --bootstrap.
+  FEISHU_APP_ID and FEISHU_APP_SECRET are required by the default config loader.
+  PI_API_KEY_FILE may point to a local BYOK key file instead of PI_API_KEY.
+`;
+const DEFAULT_WAIT_RECEIVE_TIMEOUT_MS = 3e4;
+const DEFAULT_WAIT_RECEIVE_POLL_MS = 500;
+function runRivusDaemonCli(options) {
+	return Effect.promise(async () => {
+		const parsed = parseArgs(options.argv);
+		if (parsed.help) {
+			options.stdout.write(USAGE);
+			return 0;
+		}
+		if (parsed.error) {
+			options.stderr.write(`${parsed.error}\n\n${USAGE}`);
+			return 1;
+		}
+		if (parsed.statusUrl) try {
+			const status = parsed.waitReceive ? await waitForLiveReceiveStatus(parsed.statusUrl, parsed.waitReceive, {
+				...parsed.waitReceiveMessageId ? { messageId: parsed.waitReceiveMessageId } : {},
+				...parsed.waitReceiveObservedAfter ? { observedAfter: parsed.waitReceiveObservedAfter } : {},
+				pollMs: parsed.waitPollMs ?? DEFAULT_WAIT_RECEIVE_POLL_MS,
+				...parsed.waitReceiveText ? { text: parsed.waitReceiveText } : {},
+				timeoutMs: parsed.waitTimeoutMs ?? DEFAULT_WAIT_RECEIVE_TIMEOUT_MS
+			}) : await fetchLiveStatus(parsed.statusUrl);
+			options.stdout.write(`${JSON.stringify(status, null, 2)}\n`);
+			return 0;
+		} catch (error) {
+			options.stderr.write(`${formatCliError(error)}\n`);
+			return 1;
+		}
+		if (parsed.printOpenClawEnvPath) try {
+			const result = createRivusEnvFromOpenClawConfig(JSON.parse(await readFile(parsed.printOpenClawEnvPath, "utf8")), parsed.piApiKeyFile ? { piApiKeyFile: parsed.piApiKeyFile } : {});
+			for (const warning of result.warnings) options.stderr.write(`Warning: ${warning}\n`);
+			options.stdout.write(formatRivusEnvFile(result.env));
+			return 0;
+		} catch (error) {
+			options.stderr.write(`${formatCliError(error)}\n`);
+			return 1;
+		}
+		let env;
+		try {
+			env = await loadCliEnv(parsed.envFilePath, options.env);
+		} catch (error) {
+			options.stderr.write(`${formatCliError(error)}\n`);
+			return 1;
+		}
+		const bootstrapSpecifier = parsed.bootstrap ?? env.RIVUS_BOOTSTRAP_MODULE?.trim();
+		if (!parsed.checkConfig && !bootstrapSpecifier) {
+			options.stderr.write(`Missing --bootstrap <module> or RIVUS_BOOTSTRAP_MODULE\n\n${USAGE}`);
+			return 1;
+		}
+		let legacyConfig;
+		if (parsed.manifestPath) {
+			if (parsed.checkConfig) try {
+				const manifest = await loadRivusDeploymentManifest(parsed.manifestPath);
+				validateRivusDeploymentManifest(manifest);
+				options.stdout.write(`${JSON.stringify(toRedactedDeploymentManifest(manifest), null, 2)}\n`);
+				return 0;
+			} catch (error) {
+				options.stderr.write(`${formatCliError(error)}\n`);
+				return 1;
+			}
+		} else {
+			const configExit = await Effect.runPromiseExit(loadRivusDaemonConfig(env));
+			if (configExit._tag === "Failure") {
+				options.stderr.write(`${configExit.cause.toString()}\n`);
+				return 1;
+			}
+			legacyConfig = configExit.value;
+			if (parsed.checkConfig) {
+				options.stdout.write(`${JSON.stringify(toRedactedConfig(legacyConfig), null, 2)}\n`);
+				return 0;
+			}
+		}
+		if (!bootstrapSpecifier) {
+			options.stderr.write(`Missing --bootstrap <module> or RIVUS_BOOTSTRAP_MODULE\n\n${USAGE}`);
+			return 1;
+		}
+		try {
+			const module = await (options.loadBootstrap ?? ((specifier) => import(specifier)))(bootstrapSpecifier);
+			const daemon = parsed.manifestPath ? await createCliDeploymentDaemon(module.createRivusDeploymentAdapters, {
+				argv: options.argv,
+				env,
+				manifestPath: parsed.manifestPath
+			}) : await createCliLegacyDaemon(module, {
+				argv: options.argv,
+				config: legacyConfig,
+				env
+			});
+			if (parsed.recoveryCommand) {
+				const recoveryCommand = parsed.recoveryCommand;
+				return await runOneShotDaemon(daemon, async () => {
+					if (!hasRecoveryRunner(daemon)) {
+						options.stderr.write(`Bootstrap daemon does not expose openRecoveryControl()\n`);
+						return 1;
+					}
+					const result = await runRivusRecoveryCliCommand(await Effect.runPromise(daemon.openRecoveryControl()), recoveryCommand);
+					options.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+					return 0;
+				});
+			}
+			if (parsed.status) return await runOneShotDaemon(daemon, async () => {
+				if (!hasStatusReporter(daemon)) {
+					options.stderr.write(`Bootstrap daemon does not expose status()\n`);
+					return 1;
+				}
+				const status = await Effect.runPromise(daemon.status());
+				options.stdout.write(`${JSON.stringify(status, null, 2)}\n`);
+				return 0;
+			});
+			if (parsed.prompt !== void 0) {
+				const prompt = parsed.prompt;
+				return await runOneShotDaemon(daemon, async () => {
+					if (!hasPromptRunner(daemon)) {
+						options.stderr.write(`Bootstrap daemon does not expose promptText(command)\n`);
+						return 1;
+					}
+					const text = await Effect.runPromise(daemon.promptText({
+						sessionKey: parsed.sessionKey ?? daemon.defaultSessionKey ?? `local:${legacyConfig.agentId}:cli`,
+						text: prompt
+					}));
+					options.stdout.write(`${text}\n`);
+					return 0;
+				});
+			}
+			if (parsed.replayFeishuText !== void 0) {
+				const replayFeishuText = parsed.replayFeishuText;
+				return await runOneShotDaemon(daemon, async () => {
+					if (!hasFeishuReplayRunner(daemon)) {
+						options.stderr.write(`Bootstrap daemon does not expose replayReceiveMessage(payload)\n`);
+						return 1;
+					}
+					const payload = createSyntheticFeishuTextReplayPayload(replayFeishuText, {
+						...parsed.feishuReplayChatId !== void 0 ? { chatId: parsed.feishuReplayChatId } : {},
+						...parsed.feishuReplayMessageId !== void 0 ? { messageId: parsed.feishuReplayMessageId } : {},
+						...parsed.feishuReplayTenantKey !== void 0 ? { tenantKey: parsed.feishuReplayTenantKey } : {},
+						...parsed.feishuReplayThreadId !== void 0 ? { threadId: parsed.feishuReplayThreadId } : {}
+					});
+					const result = await Effect.runPromise(daemon.replayReceiveMessage(payload, { sideEffects: "disabled" }));
+					options.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+					return 0;
+				});
+			}
+			if (parsed.replayFeishuEventPath !== void 0) {
+				const replayFeishuEventPath = parsed.replayFeishuEventPath;
+				return await runOneShotDaemon(daemon, async () => {
+					if (!hasFeishuReplayRunner(daemon)) {
+						options.stderr.write(`Bootstrap daemon does not expose replayReceiveMessage(payload)\n`);
+						return 1;
+					}
+					const payload = await readFeishuReceiveMessagePayload(replayFeishuEventPath);
+					const result = await Effect.runPromise(daemon.replayReceiveMessage(payload));
+					options.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+					return 0;
+				});
+			}
+			if (parsed.waitReceive) {
+				const waitReceive = parsed.waitReceive;
+				return await runOneShotDaemon(daemon, async () => {
+					if (!hasStatusReporter(daemon)) {
+						options.stderr.write(`Bootstrap daemon does not expose status()\n`);
+						return 1;
+					}
+					installCliShutdownController(options, daemon);
+					await Effect.runPromise(daemon.start());
+					const status = await waitForReceiveStatus(() => Effect.runPromise(daemon.status()), waitReceive, {
+						...parsed.waitReceiveMessageId ? { messageId: parsed.waitReceiveMessageId } : {},
+						...parsed.waitReceiveObservedAfter ? { observedAfter: parsed.waitReceiveObservedAfter } : {},
+						pollMs: parsed.waitPollMs ?? DEFAULT_WAIT_RECEIVE_POLL_MS,
+						...parsed.waitReceiveText ? { text: parsed.waitReceiveText } : {},
+						timeoutMs: parsed.waitTimeoutMs ?? DEFAULT_WAIT_RECEIVE_TIMEOUT_MS
+					});
+					options.stdout.write(`${JSON.stringify(status, null, 2)}\n`);
+					return 0;
+				});
+			}
+			installCliShutdownController(options, daemon);
+			await Effect.runPromise(daemon.start());
+			options.stdout.write("Rivus Agent daemon started\n");
+			return 0;
+		} catch (error) {
+			options.stderr.write(`${formatCliError(error)}\n`);
+			return 1;
+		}
+	});
+}
+async function createCliLegacyDaemon(module, context) {
+	const factory = module.createRivusDaemonProcess ?? module.default;
+	if (!factory) throw new Error("Bootstrap module must export createRivusDaemonProcess(context) or a default factory");
+	return factory(context);
+}
+async function createCliDeploymentDaemon(factory, context) {
+	if (!factory) throw new Error("Manifest bootstrap module must export createRivusDeploymentAdapters(context)");
+	return createRivusDeploymentCliProcess(factory, context);
+}
+async function runOneShotDaemon(daemon, action) {
+	try {
+		return await action();
+	} finally {
+		await Effect.runPromise(daemon.stop());
+	}
+}
+function installCliShutdownController(options, daemon) {
+	createRivusDaemonShutdownController({
+		daemon,
+		onError: (error, signal) => {
+			options.stderr.write(`Failed to stop daemon after ${signal}: ${formatCliError(error)}\n`);
+			options.exitAfterSignal?.(1);
+		},
+		onStopped: () => {
+			options.exitAfterSignal?.(0);
+		},
+		signalSource: options.signalSource
+	}).install();
+}
+function parseArgs(argv) {
+	let bootstrap;
+	let checkConfig = false;
+	let envFilePath;
+	let feishuReplayChatId;
+	let feishuReplayMessageId;
+	let feishuReplayTenantKey;
+	let feishuReplayThreadId;
+	let manifestPath;
+	let piApiKeyFile;
+	let prompt;
+	let printOpenClawEnvPath;
+	let replayFeishuEventPath;
+	let replayFeishuText;
+	const recoveryCli = createRivusRecoveryCliParser();
+	let sessionKey;
+	let status = false;
+	let statusUrl;
+	let waitPollMs;
+	let waitReceive;
+	let waitReceiveMessageId;
+	let waitReceiveObservedAfter;
+	let waitReceiveText;
+	let waitTimeoutMs;
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === "--help" || arg === "-h") return {
+			help: true,
+			status,
+			...statusUrl ? { statusUrl } : {}
+		};
+		if (arg === "--status") {
+			status = true;
+			continue;
+		}
+		const recoveryArgument = recoveryCli.consume(arg, argv[index + 1]);
+		if (recoveryArgument.handled) {
+			if (recoveryArgument.error) return {
+				error: recoveryArgument.error,
+				help: false,
+				status
+			};
+			index += recoveryArgument.consumed;
+			continue;
+		}
+		if (arg === "--check-config") {
+			checkConfig = true;
+			continue;
+		}
+		if (arg === "--env-file") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--env-file requires a path",
+				help: false,
+				status
+			};
+			envFilePath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--env-file=")) {
+			envFilePath = arg.slice(11);
+			if (!envFilePath) return {
+				error: "--env-file requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--prompt") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--prompt requires text",
+				help: false,
+				status
+			};
+			prompt = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--prompt=")) {
+			prompt = arg.slice(9);
+			if (!prompt) return {
+				error: "--prompt requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--session-key") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--session-key requires a value",
+				help: false,
+				status
+			};
+			sessionKey = value;
+			index += 1;
+			continue;
+		}
+		if (arg === "--print-openclaw-env") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--print-openclaw-env requires a JSON file path",
+				help: false,
+				status
+			};
+			printOpenClawEnvPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--print-openclaw-env=")) {
+			printOpenClawEnvPath = arg.slice(21);
+			if (!printOpenClawEnvPath) return {
+				error: "--print-openclaw-env requires a JSON file path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--pi-api-key-file") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--pi-api-key-file requires a path",
+				help: false,
+				status
+			};
+			piApiKeyFile = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--pi-api-key-file=")) {
+			piApiKeyFile = arg.slice(18);
+			if (!piApiKeyFile) return {
+				error: "--pi-api-key-file requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--replay-feishu-event") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--replay-feishu-event requires a JSON file path",
+				help: false,
+				status
+			};
+			replayFeishuEventPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--replay-feishu-event=")) {
+			replayFeishuEventPath = arg.slice(22);
+			if (!replayFeishuEventPath) return {
+				error: "--replay-feishu-event requires a JSON file path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--replay-feishu-text") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--replay-feishu-text requires text",
+				help: false,
+				status
+			};
+			replayFeishuText = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--replay-feishu-text=")) {
+			replayFeishuText = arg.slice(21);
+			if (!replayFeishuText) return {
+				error: "--replay-feishu-text requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-message-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-message-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayMessageId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-message-id=")) {
+			feishuReplayMessageId = arg.slice(20);
+			if (!feishuReplayMessageId) return {
+				error: "--feishu-message-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-chat-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-chat-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayChatId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-chat-id=")) {
+			feishuReplayChatId = arg.slice(17);
+			if (!feishuReplayChatId) return {
+				error: "--feishu-chat-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-thread-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-thread-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayThreadId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-thread-id=")) {
+			feishuReplayThreadId = arg.slice(19);
+			if (!feishuReplayThreadId) return {
+				error: "--feishu-thread-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-tenant-key") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-tenant-key requires a value",
+				help: false,
+				status
+			};
+			feishuReplayTenantKey = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-tenant-key=")) {
+			feishuReplayTenantKey = arg.slice(20);
+			if (!feishuReplayTenantKey) return {
+				error: "--feishu-tenant-key requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg?.startsWith("--session-key=")) {
+			sessionKey = arg.slice(14);
+			if (!sessionKey) return {
+				error: "--session-key requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--status-url") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--status-url requires a URL",
+				help: false,
+				status
+			};
+			statusUrl = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--status-url=")) {
+			statusUrl = arg.slice(13);
+			if (!statusUrl) return {
+				error: "--status-url requires a URL",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive") {
+			const parsedWait = parseWaitReceive(argv[index + 1]);
+			if (!parsedWait) return {
+				error: "--wait-receive requires accepted or handled",
+				help: false,
+				status
+			};
+			waitReceive = parsedWait;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive=")) {
+			const parsedWait = parseWaitReceive(arg.slice(15));
+			if (!parsedWait) return {
+				error: "--wait-receive requires accepted or handled",
+				help: false,
+				status
+			};
+			waitReceive = parsedWait;
+			continue;
+		}
+		if (arg === "--wait-receive-text") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--wait-receive-text requires text",
+				help: false,
+				status
+			};
+			waitReceiveText = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-text=")) {
+			waitReceiveText = arg.slice(20);
+			if (!waitReceiveText) return {
+				error: "--wait-receive-text requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive-message-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--wait-receive-message-id requires a message id",
+				help: false,
+				status
+			};
+			waitReceiveMessageId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-message-id=")) {
+			waitReceiveMessageId = arg.slice(26);
+			if (!waitReceiveMessageId) return {
+				error: "--wait-receive-message-id requires a message id",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive-observed-after") {
+			const value = parseIsoTimestampArgument(argv[index + 1]);
+			if (!value) return {
+				error: "--wait-receive-observed-after requires an ISO timestamp",
+				help: false,
+				status
+			};
+			waitReceiveObservedAfter = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-observed-after=")) {
+			const value = parseIsoTimestampArgument(arg.slice(30));
+			if (!value) return {
+				error: "--wait-receive-observed-after requires an ISO timestamp",
+				help: false,
+				status
+			};
+			waitReceiveObservedAfter = value;
+			continue;
+		}
+		if (arg === "--wait-timeout-ms") {
+			const parsedMs = parsePositiveIntegerArgument(argv[index + 1]);
+			if (parsedMs === void 0) return {
+				error: "--wait-timeout-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitTimeoutMs = parsedMs;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-timeout-ms=")) {
+			const parsedMs = parsePositiveIntegerArgument(arg.slice(18));
+			if (parsedMs === void 0) return {
+				error: "--wait-timeout-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitTimeoutMs = parsedMs;
+			continue;
+		}
+		if (arg === "--wait-poll-ms") {
+			const parsedMs = parsePositiveIntegerArgument(argv[index + 1]);
+			if (parsedMs === void 0) return {
+				error: "--wait-poll-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitPollMs = parsedMs;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-poll-ms=")) {
+			const parsedMs = parsePositiveIntegerArgument(arg.slice(15));
+			if (parsedMs === void 0) return {
+				error: "--wait-poll-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitPollMs = parsedMs;
+			continue;
+		}
+		if (arg === "--bootstrap") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--bootstrap requires a module specifier",
+				help: false,
+				status
+			};
+			bootstrap = value;
+			index += 1;
+			continue;
+		}
+		if (arg === "--manifest") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--manifest requires a path",
+				help: false,
+				status
+			};
+			manifestPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--manifest=")) {
+			manifestPath = arg.slice(11);
+			if (!manifestPath) return {
+				error: "--manifest requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg?.startsWith("--bootstrap=")) {
+			bootstrap = arg.slice(12);
+			if (!bootstrap) return {
+				error: "--bootstrap requires a module specifier",
+				help: false,
+				status
+			};
+			continue;
+		}
+		return {
+			error: `Unknown argument: ${arg}`,
+			help: false,
+			status
+		};
+	}
+	if (prompt !== void 0 && status) return {
+		error: "--prompt cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (checkConfig && status) return {
+		error: "--check-config cannot be combined with --status",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && prompt !== void 0) return {
+		error: "--check-config cannot be combined with --prompt",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && replayFeishuEventPath !== void 0) return {
+		error: "--check-config cannot be combined with --replay-feishu-event",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && replayFeishuText !== void 0) return {
+		error: "--check-config cannot be combined with --replay-feishu-text",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && printOpenClawEnvPath !== void 0) return {
+		error: "--check-config cannot be combined with --print-openclaw-env",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && statusUrl) return {
+		error: "--check-config cannot be combined with --status-url",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (prompt !== void 0 && statusUrl) return {
+		error: "--prompt cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && prompt !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && replayFeishuEventPath !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --replay-feishu-event",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && replayFeishuText !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && status) return {
+		error: "--print-openclaw-env cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && statusUrl) return {
+		error: "--print-openclaw-env cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (piApiKeyFile !== void 0 && printOpenClawEnvPath === void 0) return {
+		error: "--pi-api-key-file requires --print-openclaw-env",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && prompt !== void 0) return {
+		error: "--replay-feishu-event cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && replayFeishuText !== void 0) return {
+		error: "--replay-feishu-event cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && status) return {
+		error: "--replay-feishu-event cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && statusUrl) return {
+		error: "--replay-feishu-event cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && prompt !== void 0) return {
+		error: "--replay-feishu-text cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && status) return {
+		error: "--replay-feishu-text cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && statusUrl) return {
+		error: "--replay-feishu-text cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (feishuReplayMessageId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-message-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayChatId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-chat-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayThreadId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-thread-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayTenantKey !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-tenant-key requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (sessionKey !== void 0 && prompt === void 0) return {
+		error: "--session-key requires --prompt",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && status) return {
+		error: "--wait-receive cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && checkConfig) return {
+		error: "--wait-receive cannot be combined with --check-config",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (waitReceive !== void 0 && prompt !== void 0) return {
+		error: "--wait-receive cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && replayFeishuEventPath !== void 0) return {
+		error: "--wait-receive cannot be combined with --replay-feishu-event",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && replayFeishuText !== void 0) return {
+		error: "--wait-receive cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && printOpenClawEnvPath !== void 0) return {
+		error: "--wait-receive cannot be combined with --print-openclaw-env",
+		help: false,
+		status
+	};
+	if (waitTimeoutMs !== void 0 && waitReceive === void 0) return {
+		error: "--wait-timeout-ms requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitPollMs !== void 0 && waitReceive === void 0) return {
+		error: "--wait-poll-ms requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitReceiveText !== void 0 && waitReceive !== "handled") return {
+		error: "--wait-receive-text requires --wait-receive handled",
+		help: false,
+		status
+	};
+	if (waitReceiveMessageId !== void 0 && waitReceive === void 0) return {
+		error: "--wait-receive-message-id requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitReceiveObservedAfter !== void 0 && waitReceive === void 0) return {
+		error: "--wait-receive-observed-after requires --wait-receive",
+		help: false,
+		status
+	};
+	const recovery = recoveryCli.build();
+	if (recovery.error) return {
+		error: recovery.error,
+		help: false,
+		status
+	};
+	if (recovery.command) {
+		if (!manifestPath) return {
+			error: "Recovery commands require --manifest",
+			help: false,
+			status
+		};
+		if (checkConfig || prompt !== void 0 || printOpenClawEnvPath !== void 0 || replayFeishuEventPath !== void 0 || replayFeishuText !== void 0 || status || statusUrl !== void 0 || waitReceive !== void 0) return {
+			error: "Recovery commands cannot be combined with another one-shot command",
+			help: false,
+			status
+		};
+	}
+	return {
+		...bootstrap ? { bootstrap } : {},
+		checkConfig,
+		...envFilePath ? { envFilePath } : {},
+		...feishuReplayChatId !== void 0 ? { feishuReplayChatId } : {},
+		...feishuReplayMessageId !== void 0 ? { feishuReplayMessageId } : {},
+		...feishuReplayTenantKey !== void 0 ? { feishuReplayTenantKey } : {},
+		...feishuReplayThreadId !== void 0 ? { feishuReplayThreadId } : {},
+		help: false,
+		...manifestPath ? { manifestPath } : {},
+		...piApiKeyFile !== void 0 ? { piApiKeyFile } : {},
+		...prompt !== void 0 ? { prompt } : {},
+		...printOpenClawEnvPath !== void 0 ? { printOpenClawEnvPath } : {},
+		...replayFeishuEventPath !== void 0 ? { replayFeishuEventPath } : {},
+		...replayFeishuText !== void 0 ? { replayFeishuText } : {},
+		...recovery.command ? { recoveryCommand: recovery.command } : {},
+		...sessionKey ? { sessionKey } : {},
+		status,
+		...statusUrl ? { statusUrl } : {},
+		...waitPollMs !== void 0 ? { waitPollMs } : {},
+		...waitReceive !== void 0 ? { waitReceive } : {},
+		...waitReceiveMessageId !== void 0 ? { waitReceiveMessageId } : {},
+		...waitReceiveObservedAfter !== void 0 ? { waitReceiveObservedAfter } : {},
+		...waitReceiveText !== void 0 ? { waitReceiveText } : {},
+		...waitTimeoutMs !== void 0 ? { waitTimeoutMs } : {}
+	};
+}
+function toRedactedConfig(config) {
+	return {
+		agentId: config.agentId,
+		feishu: {
+			appIdPresent: Boolean(config.feishu.appId),
+			appSecretPresent: Boolean(config.feishu.appSecret),
+			baseUrl: config.feishu.baseUrl,
+			streamMinIntervalMs: config.feishu.streamMinIntervalMs
+		},
+		pi: {
+			apiKeyPresent: Boolean(config.pi.apiKey),
+			...config.pi.baseUrl ? { baseUrl: config.pi.baseUrl } : {},
+			...config.pi.model ? { model: config.pi.model } : {},
+			...config.pi.thinkingLevel ? { thinkingLevel: config.pi.thinkingLevel } : {}
+		}
+	};
+}
+function toRedactedDeploymentManifest(manifest) {
+	return {
+		agents: manifest.agents.map(({ agentId, endpointIds, pluginId, profileId }) => ({
+			agentId,
+			endpointIds,
+			pluginId,
+			profileId
+		})),
+		automations: (manifest.automations ?? []).map(({ agentId, delivery, enabled, id, required, schedule, templateId, timeZone }) => ({
+			agentId,
+			delivery: {
+				endpointId: delivery.endpointId,
+				targetRef: delivery.targetRef,
+				targetType: delivery.targetType
+			},
+			enabled,
+			id,
+			required,
+			schedule,
+			templateId,
+			timeZone
+		})),
+		defaultAgentId: manifest.defaultAgentId,
+		defaultEndpointId: manifest.defaultEndpointId,
+		endpoints: manifest.endpoints.map(({ agentId, credentialRef, enabled, id, required, sessionNamespace }) => ({
+			agentId,
+			credentialRef,
+			enabled,
+			id,
+			required,
+			sessionNamespace
+		})),
+		plugins: manifest.plugins.map(({ id, module, required }) => ({
+			id,
+			module,
+			required
+		}))
+	};
+}
+async function loadCliEnv(envFilePath, overrideEnv) {
+	if (!envFilePath) return overrideEnv;
+	return loadMergedLocalEnvFile(envFilePath, overrideEnv);
+}
+async function readFeishuReceiveMessagePayload(filePath) {
+	return JSON.parse(await readFile(filePath, "utf8"));
+}
+function createSyntheticFeishuTextReplayPayload(text, options) {
+	return { event: {
+		message: {
+			chat_id: options.chatId ?? "oc_cli",
+			content: JSON.stringify({ text }),
+			message_id: options.messageId ?? `om_cli_${Date.now()}`,
+			message_type: "text",
+			thread_id: options.threadId ?? "omt_cli"
+		},
+		sender: { tenant_key: options.tenantKey ?? "tenant_cli" }
+	} };
+}
+function formatCliError(error) {
+	if (error instanceof ReceiveWaitTimeoutError) return `${error.message}\nLast status:\n${JSON.stringify(error.lastStatus, null, 2)}`;
+	return error instanceof Error ? error.message : String(error);
+}
+var ReceiveWaitTimeoutError = class extends Error {
+	target;
+	lastStatus;
+	messageId;
+	observedAfter;
+	text;
+	constructor(target, lastStatus, messageId, observedAfter, text) {
+		super(`Timed out waiting for ${target === "accepted" ? "receive.lastAccepted" : "receive.lastHandled"}${messageId ? ` with message id ${JSON.stringify(messageId)}` : ""}${observedAfter ? ` observed after ${JSON.stringify(observedAfter)}` : ""}${text ? ` containing text ${JSON.stringify(text)}` : ""}`);
+		this.target = target;
+		this.lastStatus = lastStatus;
+		this.messageId = messageId;
+		this.observedAfter = observedAfter;
+		this.text = text;
+		this.name = "ReceiveWaitTimeoutError";
+	}
+};
+async function fetchLiveStatus(url) {
+	const response = await fetch(url, { headers: { accept: "application/json" } });
+	if (!response.ok) throw new Error(`Status request failed with HTTP ${response.status}`);
+	return response.json();
+}
+async function waitForLiveReceiveStatus(url, target, options) {
+	return waitForReceiveStatus(() => fetchLiveStatus(url), target, options);
+}
+async function waitForReceiveStatus(readStatus, target, options) {
+	const startedAt = Date.now();
+	let lastStatus;
+	while (true) {
+		const status = await readStatus();
+		lastStatus = status;
+		if (hasReceiveObservation(status, target, {
+			...options.messageId ? { messageId: options.messageId } : {},
+			...options.observedAfter ? { observedAfter: options.observedAfter } : {},
+			...options.text ? { text: options.text } : {}
+		})) return status;
+		if (Date.now() - startedAt >= options.timeoutMs) throw new ReceiveWaitTimeoutError(target, lastStatus, options.messageId, options.observedAfter, options.text);
+		await sleep(options.pollMs);
+	}
+}
+function hasReceiveObservation(status, target, criteria) {
+	const receive = readRecord(status)?.receive;
+	const receiveRecord = readRecord(receive);
+	if (target === "accepted") {
+		const lastAccepted = readRecord(receiveRecord?.lastAccepted);
+		if (!lastAccepted) return false;
+		if (criteria.messageId === void 0) return observedAfterMatches(lastAccepted, criteria.observedAfter);
+		return readRecord(lastAccepted.message)?.messageId === criteria.messageId && observedAfterMatches(lastAccepted, criteria.observedAfter);
+	}
+	const lastHandled = readRecord(receiveRecord?.lastHandled);
+	if (!lastHandled) return false;
+	if (criteria.messageId !== void 0 && lastHandled.messageId !== criteria.messageId) return false;
+	if (!observedAfterMatches(lastHandled, criteria.observedAfter)) return false;
+	if (criteria.text === void 0) return true;
+	const intake = readRecord(lastHandled.intake);
+	return typeof intake?.text === "string" && intake.text.includes(criteria.text);
+}
+function readRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function observedAfterMatches(observation, observedAfter) {
+	if (observedAfter === void 0) return true;
+	const observedAtMs = readObservedAtMs(observation.observedAt);
+	return observedAtMs !== void 0 && observedAtMs > Date.parse(observedAfter);
+}
+function readObservedAtMs(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "string") {
+		const time = Date.parse(value);
+		return Number.isNaN(time) ? void 0 : time;
+	}
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseWaitReceive(value) {
+	return value === "accepted" || value === "handled" ? value : void 0;
+}
+function parsePositiveIntegerArgument(value) {
+	return value && /^[1-9]\d*$/.test(value) ? Number(value) : void 0;
+}
+function parseIsoTimestampArgument(value) {
+	if (!value) return;
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? void 0 : new Date(time).toISOString();
+}
+function hasStatusReporter(daemon) {
+	return typeof daemon.status === "function";
+}
+function hasPromptRunner(daemon) {
+	return typeof daemon.promptText === "function";
+}
+function hasFeishuReplayRunner(daemon) {
+	return typeof daemon.replayReceiveMessage === "function";
+}
+function hasRecoveryRunner(daemon) {
+	return typeof daemon.openRecoveryControl === "function";
+}
+//#endregion
+export { OpenClawEnvImportError as C, loadRivusDaemonConfig as D, RivusDaemonConfigError as E, createRivusDaemonShutdownController as S, formatRivusEnvFile as T, createAgentInstanceRegistry as _, RivusDeploymentManifestError as a, loadRivusDeployment as b, RivusDeploymentDaemonLifecycleError as c, InvalidRivusEndpointBinding as d, createRivusAgentHost as f, AgentInstanceConflict as g, createAgentRuntimePool as h, loadNodeRivusPluginModule as i, RivusDeploymentReadinessError as l, AgentRuntimeDisposed as m, createRivusDeploymentCliProcess as n, loadRivusDeploymentManifest as o, AgentInstanceBusy as p, createConfiguredRivusDeploymentDaemon as r, RivusDeploymentAutomationReadinessError as s, runRivusDaemonCli as t, createRivusDeploymentDaemon as u, createStableId as v, createRivusEnvFromOpenClawConfig as w, validateRivusDeploymentManifest as x, RivusPluginLoadError as y };