@rivus/gateway 0.16.2

package/dist/chunks/rivus-node-entrypoint.js

@@ -0,0 +1,4464 @@
+import { l as narrowBackgroundSessionDefinition, o as createBackgroundSessionToolContracts } from "./background-session-authority.js";
+import { C as parseRivusModelCliArguments, D as deepFreeze, E as runDeploymentProcessEffect, M as disposeRuntimeCacheEntries, N as invokeRuntimeControl, O as toEffectAgentRuntime, S as createRivusModelManagementWireRequest, T as renderRivusModelCliHelp, a as InvalidRivusProjectSpace, c as RIVUS_RELEASE_DESCRIPTOR, f as gatewayTemplateDirectory, i as resolveFeishuEndpointCredentials, j as createRuntimeCache, k as toEffectAgentRuntimeInput, m as loadRivusDaemonConfig, n as loadRivusDeploymentManifest, o as validateRivusDeploymentManifest, s as validateRivusProjectSpaceDeployment, u as gatewayPackageManifestPath, w as renderRivusModelCliArgumentError, y as loadMergedLocalEnvFile } from "./node-rivus-deployment-manifest.js";
+import { createRequire } from "node:module";
+import { Cause, Effect, Either, Exit } from "effect";
+import { RIVUS_MEMORY_TOOL_PLUGIN_ID, RIVUS_RUNTIME_TOOL_IDS, createRivusMemoryToolContract, isRivusRuntimeToolId } from "@rivus/runtime";
+import { createSha256Digest, createStableId } from "@rivus/platform/identity";
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, open, readFile, readdir, realpath, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { createConnection } from "node:net";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertPathWithin, isPathWithin } from "@rivus/platform/filesystem";
+import { constants as constants$1 } from "node:fs";
+//#region src/core/application/agent-host/registry/agent-instance-registry.ts
+var AgentInstanceConflict = class extends Error {
+	name = "AgentInstanceConflict";
+};
+function createEffectAgentInstanceRegistry(identity, options = {}) {
+	const records = /* @__PURE__ */ new Map();
+	for (const record of options.initialRecords ?? []) {
+		if (bindingKey(record.binding, record.agentId) !== record.bindingKey) throw new AgentInstanceConflict(`invalid binding key: ${record.bindingKey}`);
+		if (records.has(record.bindingKey)) throw new AgentInstanceConflict(`duplicate binding: ${record.bindingKey}`);
+		records.set(record.bindingKey, freezeRecord(record));
+	}
+	const resolveBinding = (instanceBinding, definition) => Effect.try({
+		try: () => {
+			const runtimeGenerationId = identity.createRuntimeGenerationId({
+				agentId: definition.agentId,
+				profileRevision: definition.profileRevision,
+				projectSpaceId: definition.projectSpaceId ?? null,
+				projectSpaceRevision: definition.projectSpaceRevision ?? null,
+				runtimeToolGrantRevision: definition.runtimeToolGrantSet.revision,
+				skillGrantRevision: definition.skillGrantSet.revision,
+				toolGrantRevision: definition.toolGrantSet.revision
+			});
+			const key = bindingKey(instanceBinding, definition.agentId);
+			const existing = records.get(key);
+			if (existing) {
+				if (existing.runtimeGenerationId !== runtimeGenerationId) throw new AgentInstanceConflict(`binding ${key} belongs to a different runtime generation`);
+				return existing;
+			}
+			const record = freezeRecord({
+				agentId: definition.agentId,
+				binding: instanceBinding,
+				bindingKey: key,
+				instanceId: identity.createInstanceId({
+					bindingKey: key,
+					runtimeGenerationId
+				}),
+				runtimeGenerationId
+			});
+			records.set(key, record);
+			return record;
+		},
+		catch: (error) => error instanceof AgentInstanceConflict ? error : new AgentInstanceConflict(String(error))
+	});
+	return {
+		resolveAutomation: (automationId, definition) => resolveBinding({
+			automationId,
+			kind: "automation"
+		}, definition),
+		resolveBackgroundSession: (agentId, definition) => resolveBinding({
+			agentId,
+			kind: "background-session"
+		}, definition),
+		resolveEndpoint: (endpointId, definition) => resolveBinding({
+			endpointId,
+			kind: "endpoint"
+		}, definition),
+		snapshot: () => Effect.sync(() => Object.freeze([...records.values()]))
+	};
+}
+function bindingKey(binding, agentId) {
+	const bindingId = binding.kind === "endpoint" ? binding.endpointId : binding.kind === "automation" ? binding.automationId : binding.agentId;
+	return `${binding.kind}:${bindingId}:${agentId}`;
+}
+function freezeRecord(record) {
+	return Object.freeze({
+		...record,
+		binding: Object.freeze({ ...record.binding })
+	});
+}
+//#endregion
+//#region src/core/application/agent-host/routing/agent-host.ts
+var InvalidAgentHostBinding = class extends Error {
+	name = "InvalidAgentHostBinding";
+};
+function createEffectAgentHost(options) {
+	return Effect.gen(function* () {
+		const definitions = new Map(options.definitions.map((definition) => [definition.agentId, definition]));
+		const endpoints = /* @__PURE__ */ new Map();
+		const automations = /* @__PURE__ */ new Map();
+		const backgroundSessions = /* @__PURE__ */ new Map();
+		for (const endpoint of options.endpoints) {
+			if (endpoints.has(endpoint.id)) return yield* Effect.fail(new InvalidAgentHostBinding(`duplicate endpoint: ${endpoint.id}`));
+			const definition = definitions.get(endpoint.agentId);
+			if (!definition) return yield* Effect.fail(new InvalidAgentHostBinding(`unknown endpoint agent: ${endpoint.agentId}`));
+			if (!definition.endpointIds.includes(endpoint.id)) return yield* Effect.fail(new InvalidAgentHostBinding(`endpoint ${endpoint.id} is not declared by ${endpoint.agentId}`));
+			endpoints.set(endpoint.id, yield* options.registry.resolveEndpoint(endpoint.id, definition));
+		}
+		for (const automation of options.automations ?? []) {
+			if (automations.has(automation.id)) return yield* Effect.fail(new InvalidAgentHostBinding(`duplicate automation: ${automation.id}`));
+			if (!definitions.has(automation.definition.agentId)) return yield* Effect.fail(new InvalidAgentHostBinding(`unknown automation agent: ${automation.definition.agentId}`));
+			automations.set(automation.id, yield* options.registry.resolveAutomation(automation.id, automation.definition));
+		}
+		for (const backgroundSession of options.backgroundSessions ?? []) {
+			if (backgroundSession.definition.agentId !== backgroundSession.agentId) return yield* Effect.fail(new InvalidAgentHostBinding(`background session ${backgroundSession.agentId} cannot bind definition ${backgroundSession.definition.agentId}`));
+			if (backgroundSessions.has(backgroundSession.agentId)) return yield* Effect.fail(new InvalidAgentHostBinding(`duplicate background session agent: ${backgroundSession.agentId}`));
+			if (!definitions.has(backgroundSession.agentId)) return yield* Effect.fail(new InvalidAgentHostBinding(`unknown background session agent: ${backgroundSession.agentId}`));
+			backgroundSessions.set(backgroundSession.agentId, yield* options.registry.resolveBackgroundSession(backgroundSession.agentId, backgroundSession.definition));
+		}
+		const resolve = (records, id, message) => {
+			const instance = records.get(id);
+			return instance ? Effect.succeed(instance) : Effect.fail(new InvalidAgentHostBinding(message));
+		};
+		const resolveEndpoint = (endpointId) => resolve(endpoints, endpointId, `unknown endpoint: ${endpointId}`);
+		const resolveAutomation = (automationId) => resolve(automations, automationId, `unknown automation: ${automationId}`);
+		const resolveBackgroundSession = (agentId) => resolve(backgroundSessions, agentId, `unknown background session agent: ${agentId}`);
+		return {
+			cancelBackgroundSession: (agentId, input) => resolveBackgroundSession(agentId).pipe(Effect.flatMap((instance) => options.runtime.cancel(instance, input))),
+			cancelEndpoint: (endpointId, input) => resolveEndpoint(endpointId).pipe(Effect.flatMap((instance) => options.runtime.cancel(instance, input))),
+			dispose: () => options.runtime.disposeAll(),
+			handleAutomation: (automationId, input) => resolveAutomation(automationId).pipe(Effect.flatMap((instance) => options.runtime.run(instance, input))),
+			handleBackgroundSession: (agentId, input) => resolveBackgroundSession(agentId).pipe(Effect.flatMap((instance) => options.runtime.run(instance, input))),
+			handleEndpoint: (endpointId, input) => resolveEndpoint(endpointId).pipe(Effect.flatMap((instance) => options.runtime.run(instance, input))),
+			resolveAutomation,
+			resolveBackgroundSession,
+			resolveEndpoint,
+			steerEndpoint: (endpointId, input) => resolveEndpoint(endpointId).pipe(Effect.flatMap((instance) => options.runtime.steer(instance, input)))
+		};
+	});
+}
+//#endregion
+//#region src/platform/runtime-pool/runtime-pool.ts
+var RuntimeResourceBusy = class extends Error {
+	name = "RuntimeResourceBusy";
+};
+var RuntimeResourceDisposed = class extends Error {
+	name = "RuntimeResourceDisposed";
+};
+var RuntimePoolDisposalTimedOut = class extends Error {
+	name = "RuntimePoolDisposalTimedOut";
+};
+const DEFAULT_RUNTIME_DISPOSE_TIMEOUT_MS = 1e4;
+function createEffectRuntimePool(options) {
+	const runtimes = createRuntimeCache();
+	const active = /* @__PURE__ */ new Map();
+	const lifecycle = Effect.unsafeMakeSemaphore(1);
+	const existingRuntime = (instance) => Effect.gen(function* () {
+		const selected = yield* runtimes.getExisting(instance.instanceId);
+		if (!selected || !(yield* runtimes.isCurrent(instance.instanceId, selected.entry))) return void 0;
+		return selected.runtime;
+	});
+	return {
+		cancel: (instance, input) => invokeRuntimeControl(existingRuntime(instance), (runtime) => runtime.cancel?.(input)),
+		disposeAll: () => Effect.gen(function* () {
+			const entries = yield* runtimes.drain();
+			yield* lifecycle.withPermits(1)(Effect.sync(() => active.clear()));
+			yield* disposeRuntimeCacheEntries({
+				dispose: (runtime) => runtime.dispose?.() ?? Effect.void,
+				entries,
+				failureMessage: "runtime pool disposal failed",
+				timeout: {
+					milliseconds: options.disposeTimeoutMs ?? DEFAULT_RUNTIME_DISPOSE_TIMEOUT_MS,
+					onTimeout: () => new RuntimePoolDisposalTimedOut(`runtime pool disposal timed out after ${options.disposeTimeoutMs ?? DEFAULT_RUNTIME_DISPOSE_TIMEOUT_MS}ms`)
+				}
+			});
+		}),
+		run: (instance, input) => Effect.gen(function* () {
+			const selected = yield* runtimes.getOrCreate(instance.instanceId, () => options.createRuntime(instance));
+			if (!(yield* runtimes.isCurrent(instance.instanceId, selected.entry))) return yield* Effect.fail(new RuntimeResourceDisposed(`runtime was disposed before run start: ${instance.instanceId}`));
+			if (selected.runtime.concurrency === "managed") return yield* selected.runtime.run(input);
+			const token = yield* lifecycle.withPermits(1)(Effect.gen(function* () {
+				if (!(yield* runtimes.isCurrent(instance.instanceId, selected.entry))) return yield* Effect.fail(new RuntimeResourceDisposed(`runtime was disposed before run start: ${instance.instanceId}`));
+				if (active.has(instance.instanceId)) return yield* Effect.fail(new RuntimeResourceBusy(`runtime already has an active run: ${instance.instanceId}`));
+				const activeToken = Symbol(instance.instanceId);
+				active.set(instance.instanceId, activeToken);
+				return activeToken;
+			}));
+			return yield* selected.runtime.run(input).pipe(Effect.ensuring(lifecycle.withPermits(1)(Effect.sync(() => {
+				if (active.get(instance.instanceId) === token) active.delete(instance.instanceId);
+			}))));
+		}),
+		steer: (instance, input) => invokeRuntimeControl(existingRuntime(instance), (runtime) => runtime.steer?.(input))
+	};
+}
+//#endregion
+//#region src/adapters/agent/runtime/effect-agent-runtime-pool.ts
+var AgentInstanceBusy = class extends Error {
+	name = "AgentInstanceBusy";
+};
+var AgentRuntimeDisposed = class extends Error {
+	name = "AgentRuntimeDisposed";
+};
+function createAgentHostRuntimePool(factory, disposeTimeoutMs) {
+	const pool = createEffectRuntimePool({
+		createRuntime: (instance) => factory.create(instance),
+		...disposeTimeoutMs === void 0 ? {} : { disposeTimeoutMs }
+	});
+	return {
+		cancel: (instance, input) => pool.cancel(instance, input),
+		disposeAll: () => pool.disposeAll().pipe(Effect.mapError(mapRuntimePoolError)),
+		run: (instance, input) => pool.run(instance, input).pipe(Effect.mapError(mapRuntimePoolError)),
+		steer: (instance, steering) => pool.steer(instance, steering)
+	};
+}
+function mapRuntimePoolError(error) {
+	if (error instanceof RuntimeResourceBusy) return new AgentInstanceBusy(error.message.replace(/^runtime /, "agent instance "));
+	if (error instanceof RuntimeResourceDisposed) return new AgentRuntimeDisposed(error.message.replace(/^runtime /, "agent runtime "));
+	if (error instanceof RuntimePoolDisposalTimedOut) return new AgentRuntimeDisposed(error.message.replace(/^runtime pool /, "agent runtime "));
+	return error;
+}
+//#endregion
+//#region src/core/application/agent-catalog/contracts/rivus-plugin.ts
+const RIVUS_PLUGIN_API_VERSION = "1";
+var InvalidRivusPlugin = class extends Error {
+	name = "InvalidRivusPlugin";
+};
+//#endregion
+//#region src/core/application/agent-catalog/catalog/rivus-catalog-validation.ts
+const MEMORY_SCOPES = [
+	"conversation",
+	"agent-private",
+	"project",
+	"shared-user-profile"
+];
+function validateRivusPluginManifest(manifest) {
+	validateRivusCatalogIdentifier(manifest.id, "plugin");
+	if (manifest.apiVersion !== "1") throw new InvalidRivusPlugin(`unsupported plugin API version ${manifest.apiVersion}; expected 1`);
+	if (manifest.version.trim() === "") throw new InvalidRivusPlugin("plugin version must not be empty");
+}
+function validateRivusCatalogRegistration(item, existing, pending) {
+	validateRivusCatalogIdentifier(item.id, item.kind);
+	if (item.namespaced && !item.id.startsWith(`${item.pluginId}/`)) throw new InvalidRivusPlugin(`${item.kind} id ${item.id} must use plugin namespace ${item.pluginId}/`);
+	const key = `${item.kind}:${item.id}`;
+	if (pending.has(key) || existing.has(item.id)) throw new InvalidRivusPlugin(`duplicate ${item.kind} id: ${item.id}`);
+}
+function validateRivusCatalogIdentifier(id, kind) {
+	if (!/^[a-z0-9][a-z0-9._/-]*$/.test(id) || id.includes("*") || id.includes("//")) throw new InvalidRivusPlugin(`invalid ${kind} id: ${id}`);
+}
+function uniqueRivusCatalogIds(ids, label) {
+	const result = /* @__PURE__ */ new Set();
+	for (const id of ids) {
+		if (id.includes("*")) throw new InvalidRivusPlugin(`${label} does not support wildcard id: ${id}`);
+		validateRivusCatalogIdentifier(id, label);
+		if (result.has(id)) throw new InvalidRivusPlugin(`duplicate id in ${label}: ${id}`);
+		result.add(id);
+	}
+	return [...result];
+}
+function validateRivusCatalogReferences(ids, available, owner, kind) {
+	for (const id of uniqueRivusCatalogIds(ids, `${owner} ${kind} references`)) validateRivusCatalogReference(id, available, owner, kind);
+}
+function validateRivusCatalogReference(id, available, owner, kind) {
+	if (!available.has(id)) throw new InvalidRivusPlugin(`${owner} references unknown ${kind}: ${id}`);
+}
+function validateRivusMemoryScopes(scopes, owner) {
+	const result = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		if (!MEMORY_SCOPES.includes(scope)) throw new InvalidRivusPlugin(`${owner} references unsupported Memory scope: ${String(scope)}`);
+		if (result.has(scope)) throw new InvalidRivusPlugin(`${owner} contains duplicate Memory scope: ${scope}`);
+		result.add(scope);
+	}
+	return [...result];
+}
+function uniqueRivusRuntimeToolIds(ids, owner) {
+	const result = /* @__PURE__ */ new Set();
+	for (const id of ids) {
+		if (typeof id === "string" && id.includes("*")) throw new InvalidRivusPlugin(`${owner} does not support wildcard Runtime Tool: ${id}`);
+		if (typeof id !== "string" || !isRivusRuntimeToolId(id)) throw new InvalidRivusPlugin(`${owner} references unknown Runtime Tool: ${String(id)}`);
+		if (result.has(id)) throw new InvalidRivusPlugin(`${owner} contains duplicate Runtime Tool: ${id}`);
+		result.add(id);
+	}
+	return [...result];
+}
+//#endregion
+//#region src/core/application/agent-catalog/catalog/rivus-plugin-catalog.ts
+function createRivusPluginCatalog(runtime) {
+	const plugins = /* @__PURE__ */ new Map();
+	const profiles = /* @__PURE__ */ new Map();
+	const tools = /* @__PURE__ */ new Map();
+	const skills = /* @__PURE__ */ new Map();
+	const automations = /* @__PURE__ */ new Map();
+	return {
+		registerPlugin: (plugin) => {
+			validateRivusPluginManifest(plugin.manifest);
+			if (plugins.has(plugin.manifest.id)) throw new InvalidRivusPlugin(`duplicate plugin id: ${plugin.manifest.id}`);
+			const pendingProfiles = [];
+			const pendingTools = [];
+			const pendingSkills = [];
+			const pendingAutomations = [];
+			const pendingIds = /* @__PURE__ */ new Set();
+			const register = (kind, definition, catalog, destination, namespaced) => {
+				validateRivusCatalogRegistration({
+					id: definition.id,
+					kind,
+					namespaced,
+					pluginId: plugin.manifest.id
+				}, catalog, pendingIds);
+				const key = `${kind}:${definition.id}`;
+				pendingIds.add(key);
+				destination.push(runtime.deepFreeze({
+					...definition,
+					pluginId: plugin.manifest.id
+				}));
+			};
+			plugin.register({
+				registerAgentProfile: (profile) => register("profile", profile, profiles, pendingProfiles, false),
+				registerAutomation: (automation) => register("automation", automation, automations, pendingAutomations, true),
+				registerSkill: (skill) => register("skill", skill, skills, pendingSkills, true),
+				registerTool: (tool) => register("tool", tool, tools, pendingTools, true)
+			});
+			const availableToolIds = /* @__PURE__ */ new Set([...tools.keys(), ...pendingTools.map(({ id }) => id)]);
+			const availableSkillIds = /* @__PURE__ */ new Set([...skills.keys(), ...pendingSkills.map(({ id }) => id)]);
+			const availableProfileIds = /* @__PURE__ */ new Set([...profiles.keys(), ...pendingProfiles.map(({ id }) => id)]);
+			for (const profile of pendingProfiles) {
+				validateRivusMemoryScopes(profile.memory.scopes, `profile ${profile.id}`);
+				uniqueRivusRuntimeToolIds(profile.runtimeTools?.allow ?? [], `profile ${profile.id}`);
+				validateRivusCatalogReferences(profile.tools.allow, availableToolIds, `profile ${profile.id}`, "tool");
+				validateRivusCatalogReferences(profile.skills.allow, availableSkillIds, `profile ${profile.id}`, "skill");
+			}
+			for (const automation of pendingAutomations) {
+				validateRivusCatalogReference(automation.profileId, availableProfileIds, `automation ${automation.id}`, "profile");
+				validateRivusCatalogReferences(automation.requestedToolIds, availableToolIds, `automation ${automation.id}`, "tool");
+				validateRivusCatalogReferences(automation.requestedSkillIds, availableSkillIds, `automation ${automation.id}`, "skill");
+			}
+			plugins.set(plugin.manifest.id, runtime.deepFreeze({ ...plugin.manifest }));
+			for (const profile of pendingProfiles) profiles.set(profile.id, profile);
+			for (const tool of pendingTools) tools.set(tool.id, tool);
+			for (const skill of pendingSkills) skills.set(skill.id, skill);
+			for (const automation of pendingAutomations) automations.set(automation.id, automation);
+		},
+		snapshot: () => runtime.deepFreeze({
+			automations: [...automations.values()],
+			plugins: [...plugins.values()],
+			profiles: [...profiles.values()],
+			skills: [...skills.values()],
+			tools: [...tools.values()]
+		})
+	};
+}
+//#endregion
+//#region src/core/application/agent-catalog/resolution/rivus-tool-grant-set.ts
+function narrowRivusToolGrantSet(parent, restrictions, runtime) {
+	const toolIds = intersectToolIds([parent.toolIds, ...restrictions]);
+	return runtime.deepFreeze({
+		revision: runtime.digest(JSON.stringify({
+			parentRevision: parent.revision,
+			toolIds
+		})),
+		toolIds
+	});
+}
+function intersectRivusToolIds(sets, runtime) {
+	const toolIds = intersectToolIds(sets);
+	return runtime.deepFreeze({
+		revision: runtime.digest(JSON.stringify(toolIds)),
+		toolIds
+	});
+}
+function createRivusToolGrantSetOperations(runtime) {
+	return Object.freeze({
+		intersect: (sets) => intersectRivusToolIds(sets, runtime),
+		narrow: (parent, restrictions) => narrowRivusToolGrantSet(parent, restrictions, runtime)
+	});
+}
+function intersectToolIds(sets) {
+	const [first = [], ...rest] = sets;
+	return [...new Set(first)].filter((id) => rest.every((set) => set.includes(id))).sort();
+}
+//#endregion
+//#region src/core/application/agent-catalog/resolution/rivus-agent-grant-restriction.ts
+function restrictRivusAgentDefinitionGrants(definition, restriction, runtime) {
+	const toolIds = uniqueIds(restriction.toolIds);
+	const skillIds = uniqueIds(restriction.skillIds);
+	const runtimeToolIds = uniqueRuntimeToolIds(restriction.runtimeToolIds);
+	const memoryScopes = uniqueScopes(restriction.memory.scopes);
+	const toolsById = new Map(definition.tools.map((tool) => [tool.id, tool]));
+	const skillsById = new Map(definition.skills.map((skill) => [skill.id, skill]));
+	const tools = toolIds.map((toolId) => {
+		const tool = toolsById.get(toolId);
+		if (!tool) throw new Error(`Agent grant restriction requests ungranted Tool: ${toolId}`);
+		return tool;
+	});
+	const skills = skillIds.map((skillId) => {
+		const skill = skillsById.get(skillId);
+		if (!skill) throw new Error(`Agent grant restriction requests ungranted Skill: ${skillId}`);
+		return skill;
+	});
+	for (const scope of memoryScopes) if (!definition.memory.scopes.includes(scope)) throw new Error(`Agent grant restriction requests ungranted Memory scope: ${scope}`);
+	for (const runtimeToolId of runtimeToolIds) if (!definition.runtimeToolGrantSet.toolIds.includes(runtimeToolId)) throw new Error(`Agent grant restriction requests ungranted Runtime Tool: ${runtimeToolId}`);
+	if (restriction.memory.tool && !definition.memory.tool) throw new Error("Agent grant restriction cannot enable an ungranted Memory Tool");
+	const skillGrantSet = runtime.deepFreeze({
+		revision: runtime.digest(JSON.stringify({
+			parentRevision: definition.skillGrantSet.revision,
+			skillIds
+		})),
+		skillIds
+	});
+	const runtimeToolGrantSet = runtime.deepFreeze({
+		revision: runtime.digest(JSON.stringify({
+			parentRevision: definition.runtimeToolGrantSet.revision,
+			toolIds: runtimeToolIds
+		})),
+		toolIds: runtimeToolIds
+	});
+	return runtime.deepFreeze({
+		...definition,
+		memory: {
+			scopes: memoryScopes,
+			tool: restriction.memory.tool
+		},
+		runtimeToolGrantSet,
+		skillGrantSet,
+		skills,
+		toolGrantSet: narrowRivusToolGrantSet(definition.toolGrantSet, [toolIds], runtime),
+		tools
+	});
+}
+function uniqueRuntimeToolIds(ids) {
+	const requested = /* @__PURE__ */ new Set();
+	for (const id of ids) {
+		if (!isRivusRuntimeToolId(id)) throw new Error(`Agent grant restriction requests unknown Runtime Tool: ${id}`);
+		requested.add(id);
+	}
+	return RIVUS_RUNTIME_TOOL_IDS.filter((id) => requested.has(id));
+}
+function uniqueIds(ids) {
+	return [...new Set(ids)].sort();
+}
+function uniqueScopes(scopes) {
+	return [...new Set(scopes)].sort();
+}
+//#endregion
+//#region src/core/application/agent-catalog/resolution/rivus-agent-definition-resolver.ts
+function createRivusAgentDefinitionResolver(providers, runtime) {
+	return Object.freeze({ resolve: (catalog, deployment) => resolveRivusAgentDefinition(catalog, deployment, providers, runtime) });
+}
+function createRivusAgentCatalog(providers, runtime) {
+	const resolver = createRivusAgentDefinitionResolver(providers, runtime);
+	return Object.freeze({
+		createPluginCatalog: () => createRivusPluginCatalog(runtime),
+		resolve: (catalog, deployment) => resolver.resolve(catalog, deployment),
+		restrictGrants: (definition, restriction) => restrictRivusAgentDefinitionGrants(definition, restriction, runtime)
+	});
+}
+function resolveRivusAgentDefinition(catalog, deployment, providers, runtime) {
+	const snapshot = catalog.snapshot();
+	const plugin = snapshot.plugins.find((candidate) => candidate.id === deployment.pluginId);
+	if (!plugin) throw new InvalidRivusPlugin(`unknown deployment plugin: ${deployment.pluginId}`);
+	const profile = snapshot.profiles.find((candidate) => candidate.id === deployment.profileId && candidate.pluginId === deployment.pluginId);
+	if (!profile) throw new InvalidRivusPlugin(`unknown profile ${deployment.profileId} for plugin ${deployment.pluginId}`);
+	const memoryScopes = resolveMemoryScopes(profile, deployment);
+	const runtimeToolIds = resolveRuntimeTools(profile, deployment);
+	const memoryTool = deployment.memory?.tool === true;
+	if (memoryTool && memoryScopes.length === 0) throw new InvalidRivusPlugin(`deployment ${deployment.agentId} Memory Tool requires at least one granted scope`);
+	const contributions = providers.flatMap((provider) => provider.provide({
+		deployment,
+		memoryScopes,
+		profile
+	}));
+	const profileContributions = contributions.filter(({ scope }) => scope === "profile");
+	const runtimeContributions = contributions.filter(({ scope }) => scope === "runtime");
+	validateToolContributions(snapshot.tools, contributions);
+	if (memoryTool && !profileContributions.some(({ tool }) => tool.id === "memory")) throw new InvalidRivusPlugin(`deployment ${deployment.agentId} Memory Tool descriptor is unavailable`);
+	const pluginTools = resolvePluginTools(snapshot.tools, profile, deployment);
+	const profileToolsById = new Map(profileContributions.map(({ tool }) => [tool.id, runtime.deepFreeze({ ...tool })]));
+	const resolvedProfileToolIds = [...pluginTools.keys(), ...profileToolsById.keys()].sort();
+	const tools = resolvedProfileToolIds.map((id) => pluginTools.get(id) ?? profileToolsById.get(id));
+	const skills = resolveSkills(snapshot.skills, profile, deployment);
+	const skillIds = skills.map(({ id }) => id);
+	const profileRevision = digest(runtime, {
+		memory: {
+			scopes: memoryScopes,
+			tool: memoryTool
+		},
+		model: profile.model,
+		plugin,
+		profileId: profile.id,
+		runtimeTools: runtimeToolIds,
+		skills: skills.map(({ content, digest: skillDigest, id, pluginId, title, version }) => ({
+			content,
+			digest: skillDigest,
+			id,
+			pluginId,
+			title,
+			version
+		})),
+		systemPrompt: profile.systemPrompt,
+		tools
+	});
+	const toolGrantSet = runtime.deepFreeze({
+		revision: digest(runtime, {
+			profileRevision,
+			toolIds: resolvedProfileToolIds
+		}),
+		toolIds: resolvedProfileToolIds
+	});
+	const skillGrantSet = runtime.deepFreeze({
+		revision: digest(runtime, {
+			profileRevision,
+			skillIds
+		}),
+		skillIds
+	});
+	const runtimeToolGrantSet = runtime.deepFreeze({
+		revision: digest(runtime, {
+			profileRevision,
+			toolIds: runtimeToolIds
+		}),
+		toolIds: runtimeToolIds
+	});
+	return extendRuntimeTools(runtime.deepFreeze({
+		agentId: deployment.agentId,
+		endpointIds: [...deployment.endpointIds],
+		memory: {
+			scopes: memoryScopes,
+			tool: memoryTool
+		},
+		model: profile.model,
+		pluginId: deployment.pluginId,
+		profileId: deployment.profileId,
+		...deployment.projectSpaceId ? { projectSpaceId: deployment.projectSpaceId } : {},
+		profileRevision,
+		runtimeToolGrantSet,
+		skillGrantSet,
+		skills,
+		systemPrompt: profile.systemPrompt,
+		toolGrantSet,
+		tools
+	}), runtimeContributions, runtime);
+}
+function resolveRuntimeTools(profile, deployment) {
+	const profileToolIds = uniqueRivusRuntimeToolIds(profile.runtimeTools?.allow ?? [], `profile ${profile.id}`);
+	const requestedToolIds = uniqueRivusRuntimeToolIds(deployment.runtimeTools?.allow ?? [], `deployment ${deployment.agentId}`);
+	const profileToolIdSet = new Set(profileToolIds);
+	const requestedToolIdSet = new Set(requestedToolIds);
+	return RIVUS_RUNTIME_TOOL_IDS.filter((id) => profileToolIdSet.has(id) && requestedToolIdSet.has(id));
+}
+function resolveMemoryScopes(profile, deployment) {
+	const profileScopes = validateRivusMemoryScopes(profile.memory.scopes, `profile ${profile.id}`);
+	const requestedScopes = validateRivusMemoryScopes(deployment.memory?.scopes ?? [], `deployment ${deployment.agentId}`);
+	return profileScopes.filter((scope) => requestedScopes.includes(scope));
+}
+function resolvePluginTools(registeredTools, profile, deployment) {
+	const requestedTools = uniqueRivusCatalogIds(deployment.tools.allow, "deployment tool allowlist");
+	const catalogTools = new Map(registeredTools.map((tool) => [tool.id, tool]));
+	for (const id of requestedTools) if (!catalogTools.has(id)) throw new InvalidRivusPlugin(`unknown deployment tool: ${id}`);
+	const profileToolIds = uniqueRivusCatalogIds(profile.tools.allow, "profile tool allowlist");
+	for (const id of profileToolIds) if (!catalogTools.has(id)) throw new InvalidRivusPlugin(`profile ${profile.id} references unknown tool: ${id}`);
+	const grantedIds = profileToolIds.filter((id) => requestedTools.includes(id)).sort();
+	return new Map(grantedIds.map((id) => [id, toResolvedTool(catalogTools.get(id))]));
+}
+function resolveSkills(registeredSkills, profile, deployment) {
+	const requestedSkills = uniqueRivusCatalogIds(deployment.skills.allow, "deployment skill allowlist");
+	const catalogSkills = new Map(registeredSkills.map((skill) => [skill.id, skill]));
+	for (const id of requestedSkills) if (!catalogSkills.has(id)) throw new InvalidRivusPlugin(`unknown deployment skill: ${id}`);
+	return uniqueRivusCatalogIds(profile.skills.allow, "profile skill allowlist").filter((id) => requestedSkills.includes(id)).sort().map((id) => {
+		const skill = catalogSkills.get(id);
+		if (!skill) throw new InvalidRivusPlugin(`profile ${profile.id} references unknown skill: ${id}`);
+		return skill;
+	});
+}
+function validateToolContributions(registeredTools, contributions) {
+	const knownIds = new Set(registeredTools.map(({ id }) => id));
+	for (const { tool } of contributions) {
+		validateRivusCatalogIdentifier(tool.id, "contributed tool");
+		validateRivusCatalogIdentifier(tool.pluginId, "contributed tool plugin");
+		if (knownIds.has(tool.id)) throw new InvalidRivusPlugin(`duplicate contributed tool id: ${tool.id}`);
+		if (tool.version.trim() === "" || tool.digest.trim() === "") throw new InvalidRivusPlugin(`contributed tool ${tool.id} requires a version and digest`);
+		knownIds.add(tool.id);
+	}
+}
+function extendRuntimeTools(definition, contributions, runtime) {
+	if (contributions.length === 0) return definition;
+	const additions = contributions.map(({ tool }) => runtime.deepFreeze({ ...tool }));
+	const additionIds = additions.map(({ id }) => id).sort();
+	return runtime.deepFreeze({
+		...definition,
+		toolGrantSet: {
+			revision: digest(runtime, {
+				parentRevision: definition.toolGrantSet.revision,
+				toolIds: additionIds
+			}),
+			toolIds: [...definition.toolGrantSet.toolIds, ...additionIds].sort()
+		},
+		tools: [...definition.tools, ...additions]
+	});
+}
+function toResolvedTool(tool) {
+	const { createExecutor: _createExecutor, description, digest: toolDigest, id, idempotency, inputSchema, pluginId, risk, version } = tool;
+	return {
+		description,
+		digest: toolDigest,
+		id,
+		idempotency,
+		inputSchema,
+		pluginId,
+		risk,
+		version
+	};
+}
+function digest(runtime, value) {
+	return runtime.digest(stableJson(value));
+}
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+//#endregion
+//#region src/adapters/agent/catalog/rivus-host-tool-descriptor-provider.ts
+function createRivusHostToolDescriptorProvider(options) {
+	return Object.freeze({ provide: ({ deployment, memoryScopes }) => {
+		const contributions = [];
+		if (deployment.memory?.tool === true) contributions.push({
+			scope: "profile",
+			tool: Object.freeze({
+				...createRivusMemoryToolContract(memoryScopes),
+				pluginId: RIVUS_MEMORY_TOOL_PLUGIN_ID
+			})
+		});
+		if (options.backgroundSessions) contributions.push(...createBackgroundSessionToolContracts().map(toRuntimeContribution));
+		return Object.freeze(contributions);
+	} });
+}
+function toRuntimeContribution(tool) {
+	return Object.freeze({
+		scope: "runtime",
+		tool: Object.freeze({ ...tool })
+	});
+}
+//#endregion
+//#region src/platform/project/setup/rivus-project-initializer.ts
+const TEMPLATE_FILES = Object.freeze({
+	"current-weather.mjs": "current-weather.mjs",
+	"https-response-reader.mjs": "https-response-reader.mjs",
+	"rivus-agents.plugin.mjs": "rivus-starter.plugin.mjs",
+	"rivus.bootstrap.ts": "pi-feishu-deployment.bootstrap.ts"
+});
+async function initializeRivusProject(options) {
+	const directory = resolve(options.directory);
+	const descriptor = options.releaseDescriptor ?? RIVUS_RELEASE_DESCRIPTOR;
+	const files = /* @__PURE__ */ new Map([
+		[".env.example", environmentTemplate$1()],
+		[".gitignore", ".env.local\n.rivus/\nnode_modules/\n"],
+		["deploy/launchd/com.rivus.agent.plist", launchdService(directory, options.nodeExecutable)],
+		["deploy/systemd/rivus.service", systemdService(directory, options.nodeExecutable)],
+		["package.json", projectPackageJson(directory, descriptor)],
+		["rivus.config.json", deploymentManifest$1()]
+	]);
+	for (const [target, source] of Object.entries(TEMPLATE_FILES)) files.set(target, await readFile(join(options.templateDirectory, source), "utf8"));
+	const paths = [...files.keys()].sort();
+	await assertSafeProjectAncestors(directory, paths);
+	const conflicts = await findConflicts(directory, paths);
+	if (conflicts.length > 0) throw new Error(`Rivus project initialization refused; refusing to overwrite: ${conflicts.join(", ")}`);
+	const createdDirectories = [];
+	const createdFiles = [];
+	const writeProjectFile = options.writeProjectFile ?? writeExclusiveProjectFile;
+	try {
+		for (const path of paths) {
+			const destination = join(directory, path);
+			await ensureDirectory(dirname(destination), directory, createdDirectories);
+			await assertSafeProjectAncestors(directory, [path]);
+			await writeProjectFile(destination, files.get(path));
+			createdFiles.push(destination);
+		}
+	} catch (error) {
+		const rollbackErrors = await rollbackCreatedPaths(createdFiles, createdDirectories);
+		if (rollbackErrors.length > 0) throw new AggregateError([error, ...rollbackErrors], "Rivus project initialization failed and rollback was incomplete");
+		throw error;
+	}
+	return {
+		directory,
+		files: Object.freeze(paths)
+	};
+}
+async function writeExclusiveProjectFile(path, contents) {
+	await writeFile(path, contents, {
+		encoding: "utf8",
+		flag: "wx"
+	});
+}
+async function assertSafeProjectAncestors(directory, paths) {
+	const rootState = await lstatOrUndefined(directory);
+	if (rootState?.isSymbolicLink()) throw new Error("Rivus project initialization refused; symbolic link ancestor: .");
+	if (rootState && !rootState.isDirectory()) throw new Error("Rivus project initialization refused; project path is not a directory");
+	if (!rootState) return;
+	for (const path of paths) {
+		let current = directory;
+		for (const segment of path.split("/").slice(0, -1)) {
+			current = join(current, segment);
+			const state = await lstatOrUndefined(current);
+			if (!state) break;
+			if (state.isSymbolicLink()) throw new Error(`Rivus project initialization refused; symbolic link ancestor: ${relative(directory, current)}`);
+			if (!state.isDirectory()) throw new Error(`Rivus project initialization refused; non-directory ancestor: ${relative(directory, current)}`);
+		}
+	}
+}
+async function ensureDirectory(path, projectRoot, createdDirectories) {
+	try {
+		await mkdir(path);
+		createdDirectories.push(path);
+	} catch (error) {
+		if (isMissingPath$1(error)) {
+			const parent = dirname(path);
+			if (parent === path) throw error;
+			await ensureDirectory(parent, projectRoot, createdDirectories);
+			await ensureDirectory(path, projectRoot, createdDirectories);
+			return;
+		}
+		if (!isAlreadyExists(error)) throw error;
+		const state = await lstat(path);
+		if (state.isSymbolicLink()) {
+			if (isPathWithin(projectRoot, path)) throw new Error(`Rivus project initialization refused; symbolic link ancestor: ${relative(projectRoot, path) || "."}`);
+			if ((await stat(path)).isDirectory()) return;
+		}
+		if (!state.isDirectory()) throw new Error(`Rivus project initialization refused; non-directory ancestor: ${path}`);
+	}
+}
+async function rollbackCreatedPaths(files, directories) {
+	const errors = [];
+	for (const path of files.reverse()) try {
+		await unlink(path);
+	} catch (error) {
+		if (!isMissingPath$1(error)) errors.push(asError$1(error));
+	}
+	for (const path of directories.reverse()) try {
+		await rmdir(path);
+	} catch (error) {
+		if (!isMissingPath$1(error) && !isDirectoryNotEmpty(error)) errors.push(asError$1(error));
+	}
+	return errors;
+}
+async function lstatOrUndefined(path) {
+	try {
+		return await lstat(path);
+	} catch (error) {
+		if (isMissingPath$1(error)) return void 0;
+		throw error;
+	}
+}
+function isAlreadyExists(error) {
+	return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+function isDirectoryNotEmpty(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOTEMPTY";
+}
+function asError$1(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+async function findConflicts(directory, paths) {
+	const conflicts = [];
+	for (const path of paths) try {
+		await lstat(join(directory, path));
+		conflicts.push(path);
+	} catch (error) {
+		if (!isMissingPath$1(error)) throw error;
+	}
+	return conflicts;
+}
+function isMissingPath$1(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function projectPackageJson(directory, descriptor) {
+	const { dependencies, version } = descriptor;
+	const projectName = sanitizePackageName(basename(directory));
+	return `${JSON.stringify({
+		name: projectName,
+		private: true,
+		type: "module",
+		scripts: {
+			"check-config": "rivus --manifest ./rivus.config.json --check-config",
+			doctor: "rivus doctor .",
+			start: "rivus --env-file .env.local --bootstrap ./rivus.bootstrap.ts --manifest ./rivus.config.json"
+		},
+		dependencies: {
+			"@earendil-works/pi-coding-agent": dependencies["@earendil-works/pi-coding-agent"],
+			"@larksuiteoapi/node-sdk": dependencies["@larksuiteoapi/node-sdk"],
+			"@rivus/agent": `^${version}`,
+			effect: dependencies.effect
+		}
+	}, null, 2)}\n`;
+}
+function sanitizePackageName(value) {
+	return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "") || "rivus-app";
+}
+function deploymentManifest$1() {
+	return `${JSON.stringify({
+		plugins: [{
+			id: "rivus-starter",
+			module: "./rivus-agents.plugin.mjs",
+			required: true
+		}],
+		agents: [{
+			agentId: "agent-a",
+			endpointIds: ["feishu-agent-a"],
+			pluginId: "rivus-starter",
+			profileId: "agent-a",
+			skills: { allow: [] },
+			tools: { allow: ["rivus-starter/current-weather"] }
+		}],
+		defaultAgentId: "agent-a",
+		defaultEndpointId: "feishu-agent-a",
+		endpoints: [{
+			agentId: "agent-a",
+			baseUrl: "https://open.feishu.cn",
+			cardStreamLeaseMs: 51e4,
+			credentialRef: "env:RIVUS_FEISHU",
+			enabled: true,
+			experimental: { cotMessages: false },
+			groupPolicy: "mention-only",
+			id: "feishu-agent-a",
+			progressDisplay: "collapsed",
+			required: true,
+			sessionNamespace: "rivus-starter",
+			streamMinIntervalMs: 200
+		}]
+	}, null, 2)}\n`;
+}
+function environmentTemplate$1() {
+	return [
+		"# Copy this file to .env.local and keep the real values untracked.",
+		"RIVUS_FEISHU_APP_ID=",
+		"RIVUS_FEISHU_APP_SECRET=",
+		"PI_MODEL=",
+		"PI_API_KEY=",
+		"# PI_BASE_URL=",
+		"RIVUS_WEATHER_DEFAULT_LOCATION=上海",
+		"# LANGFUSE_BASE_URL=https://jp.cloud.langfuse.com",
+		"# LANGFUSE_PUBLIC_KEY=",
+		"# LANGFUSE_SECRET_KEY=",
+		"# RIVUS_TELEMETRY_CONTENT=redacted",
+		""
+	].join("\n");
+}
+function systemdService(directory, nodeExecutable) {
+	const cli = join(directory, "node_modules", "@rivus", "agent", "dist", "cli.js");
+	return `[Unit]\nDescription=Rivus Agent\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nWorkingDirectory=${systemdPath(directory)}\nExecStart=${systemdQuote(nodeExecutable)} ${systemdQuote(cli)} --env-file .env.local --bootstrap ./rivus.bootstrap.ts --manifest ./rivus.config.json\nRestart=on-failure\nRestartSec=5\nEnvironment=NODE_ENV=production\n\n[Install]\nWantedBy=default.target\n`;
+}
+function systemdPath(value) {
+	return value.replaceAll("%", "%%");
+}
+function systemdQuote(value) {
+	return `"${value.replace(/%/g, "%%").replace(/\$/g, () => "$$").replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function launchdService(directory, nodeExecutable) {
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key>\n  <string>com.rivus.agent</string>\n  <key>ProgramArguments</key>\n  <array>\n${[
+		nodeExecutable,
+		join(directory, "node_modules", "@rivus", "agent", "dist", "cli.js"),
+		"--env-file",
+		".env.local",
+		"--bootstrap",
+		"./rivus.bootstrap.ts",
+		"--manifest",
+		"./rivus.config.json"
+	].map((value) => `    <string>${xmlEscape(value)}</string>`).join("\n")}\n  </array>\n  <key>WorkingDirectory</key>\n  <string>${xmlEscape(directory)}</string>\n  <key>RunAtLoad</key>\n  <true/>\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n  <key>ThrottleInterval</key>\n  <integer>5</integer>\n</dict>\n</plist>\n`;
+}
+function xmlEscape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
+//#region src/adapters/deployment/plugin/rivus-builtin-specifiers.ts
+const RIVUS_BUILTIN_SPECIFIERS = /* @__PURE__ */ new Map([["@rivus/agent/bootstrap/pi-feishu", "@rivus/gateway/bootstrap/pi-feishu"], ["@rivus/agent/plugin/starter", "@rivus/gateway/plugin/starter"]]);
+function resolveRivusBuiltinSpecifier(specifier) {
+	return RIVUS_BUILTIN_SPECIFIERS.get(specifier) ?? specifier;
+}
+//#endregion
+//#region src/adapters/deployment/plugin/rivus-plugin-module.ts
+function resolveRivusPluginModule(module) {
+	const candidate = "default" in module ? module.default : module;
+	return (typeof candidate === "function" ? Effect.tryPromise({
+		try: () => Promise.resolve(candidate()),
+		catch: toError$5
+	}) : Effect.succeed(candidate)).pipe(Effect.flatMap((plugin) => isRivusPlugin(plugin) ? Effect.succeed(plugin) : Effect.fail(/* @__PURE__ */ new Error("plugin module default export is not a RivusPlugin or factory"))));
+}
+function isRivusPlugin(value) {
+	return value !== null && typeof value === "object" && "manifest" in value && "register" in value && typeof value.register === "function";
+}
+function toError$5(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/adapters/deployment/plugin/trusted-package-root.ts
+function findTrustedPackageRoot(packageManifestPath) {
+	return Effect.tryPromise({
+		try: async () => {
+			const packageRoot = dirname(await realpath(packageManifestPath));
+			let current = packageRoot;
+			for (;;) {
+				if (basename(current) === "node_modules") return current;
+				const parent = dirname(current);
+				if (parent === current) return packageRoot;
+				current = parent;
+			}
+		},
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+}
+//#endregion
+//#region src/adapters/deployment/plugin/trusted-module-path.ts
+function validateTrustedModulePath(trustedRoot, resolvedPath, subject) {
+	return Effect.try({
+		try: () => {
+			assertPathWithin(trustedRoot, resolvedPath, `${subject} resolves outside trusted module root: ${resolvedPath}`);
+			return resolvedPath;
+		},
+		catch: (failure) => failure instanceof Error ? failure : new Error(String(failure))
+	});
+}
+//#endregion
+//#region src/adapters/deployment/plugin/node-rivus-plugin-module-loader.ts
+function createNodeRivusPluginModuleLoader(options = {}) {
+	return { load: (request) => loadNodeRivusPluginModule(request, options).pipe(Effect.flatMap(resolveRivusPluginModule)) };
+}
+function loadNodeRivusPluginModule(request, options = {}) {
+	return resolveNodeRivusPluginModulePath(request, options).pipe(Effect.flatMap((resolvedRealpath) => Effect.tryPromise({
+		try: () => import(pathToFileURL(resolvedRealpath).href),
+		catch: toError$4
+	})));
+}
+function resolveNodeRivusPluginModulePath(request, options = {}) {
+	return Effect.gen(function* () {
+		const deploymentRoot = yield* Effect.tryPromise({
+			try: () => realpath(request.deploymentRoot),
+			catch: toError$4
+		});
+		const moduleSpecifier = resolveRivusBuiltinSpecifier(request.module);
+		const relativeModule = moduleSpecifier.startsWith("./") || moduleSpecifier.startsWith("../");
+		const resolutionManifest = relativeModule ? join(deploymentRoot, "package.json") : options.packageManifestPath ?? join(deploymentRoot, "package.json");
+		const resolved = yield* Effect.try({
+			try: () => createRequire(resolutionManifest).resolve(moduleSpecifier),
+			catch: toError$4
+		});
+		const resolvedRealpath = yield* Effect.tryPromise({
+			try: () => realpath(resolved),
+			catch: toError$4
+		});
+		return yield* validateTrustedModulePath(relativeModule ? deploymentRoot : options.packageManifestPath ? yield* findTrustedPackageRoot(options.packageManifestPath) : deploymentRoot, resolvedRealpath, `plugin module ${request.module}`);
+	});
+}
+function toError$4(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/adapters/deployment/inspection/rivus-project-doctor.ts
+const REQUIRED_FILES = Object.freeze([
+	"package.json",
+	"rivus.bootstrap.ts",
+	"rivus.config.json"
+]);
+const REQUIRED_DEPENDENCIES = Object.freeze([
+	"@rivus/agent",
+	"@earendil-works/pi-coding-agent",
+	"@larksuiteoapi/node-sdk",
+	"effect"
+]);
+function diagnoseRivusProject(options) {
+	return Effect.gen(function* () {
+		const directory = resolve(options.directory);
+		const checks = [checkNode$1(options.nodeVersion)];
+		checks.push(yield* Effect.tryPromise({
+			try: () => checkFiles(directory),
+			catch: toError$3
+		}));
+		checks.push(yield* Effect.tryPromise({
+			try: () => checkDependencies(directory),
+			catch: toError$3
+		}));
+		const manifestResult = yield* checkManifest$1(directory);
+		checks.push(manifestResult.check);
+		const envFilePath = resolve(directory, options.envFilePath ?? ".env.local");
+		checks.push(yield* Effect.tryPromise({
+			try: () => checkCredentials$1(manifestResult.manifest, envFilePath, options.env),
+			catch: toError$3
+		}));
+		return Object.freeze({
+			checks: Object.freeze(checks),
+			directory,
+			ready: checks.every(({ status }) => status === "pass")
+		});
+	});
+}
+function checkNode$1(version) {
+	const [major, minor] = version.split(".").map(Number);
+	if (major === 24 && Number.isInteger(minor) && minor >= 11) return {
+		message: `Node.js ${version} satisfies the supported ^24.11 runtime`,
+		name: "node",
+		status: "pass"
+	};
+	return {
+		message: `Node.js 24.11 or newer on major 24 is required; current version is ${version}`,
+		name: "node",
+		status: "fail"
+	};
+}
+async function checkFiles(directory) {
+	const missing = await missingRegularFiles(directory, REQUIRED_FILES);
+	return missing.length === 0 ? {
+		message: "required project files are present",
+		name: "files",
+		status: "pass"
+	} : {
+		message: `required project files are missing: ${missing.join(", ")}`,
+		name: "files",
+		status: "fail"
+	};
+}
+async function checkDependencies(directory) {
+	const packageFiles = REQUIRED_DEPENDENCIES.map((name) => join("node_modules", ...name.split("/"), "package.json"));
+	const missingIndexes = new Set((await missingRegularFiles(directory, packageFiles)).map((path) => packageFiles.indexOf(path)));
+	const missing = REQUIRED_DEPENDENCIES.filter((_, index) => missingIndexes.has(index));
+	return missing.length === 0 ? {
+		message: "Rivus, Pi, Feishu, and Effect dependencies are installed",
+		name: "dependencies",
+		status: "pass"
+	} : {
+		message: `run npm install; missing local dependencies: ${missing.join(", ")}`,
+		name: "dependencies",
+		status: "fail"
+	};
+}
+function checkManifest$1(directory) {
+	return loadRivusDeploymentManifest(join(directory, "rivus.config.json")).pipe(Effect.flatMap((manifest) => Effect.gen(function* () {
+		validateRivusDeploymentManifest(manifest);
+		const missingModules = [];
+		for (const plugin of manifest.plugins) {
+			const result = yield* resolveNodeRivusPluginModulePath({
+				deploymentRoot: directory,
+				module: plugin.module,
+				pluginId: plugin.id
+			}).pipe(Effect.either);
+			if (Either.isLeft(result)) missingModules.push(plugin.module);
+		}
+		if (missingModules.length > 0) return { check: {
+			message: `manifest Plugin modules are missing: ${missingModules.join(", ")}`,
+			name: "manifest",
+			status: "fail"
+		} };
+		return {
+			check: {
+				message: "deployment manifest is valid",
+				name: "manifest",
+				status: "pass"
+			},
+			manifest
+		};
+	})), Effect.catchAll((error) => Effect.succeed({ check: {
+		message: `deployment manifest is invalid: ${error.message}`,
+		name: "manifest",
+		status: "fail"
+	} })));
+}
+async function checkCredentials$1(manifest, envFilePath, env) {
+	let mergedEnv;
+	try {
+		mergedEnv = await loadMergedLocalEnvFile(envFilePath, env);
+	} catch (error) {
+		return {
+			message: `required env file is unavailable at ${envFilePath}: ${error instanceof Error ? error.message : String(error)}`,
+			name: "credentials",
+			status: "fail"
+		};
+	}
+	if (!manifest) return {
+		message: "enabled Endpoint credentials cannot be checked until the deployment manifest is valid",
+		name: "credentials",
+		status: "fail"
+	};
+	try {
+		for (const endpoint of manifest.endpoints.filter(({ enabled }) => enabled)) resolveFeishuEndpointCredentials(endpoint.credentialRef, mergedEnv);
+		return {
+			message: "enabled Endpoint credential references resolve",
+			name: "credentials",
+			status: "pass"
+		};
+	} catch (error) {
+		return {
+			message: `enabled Endpoint credentials are incomplete: ${error instanceof Error ? error.message : String(error)}`,
+			name: "credentials",
+			status: "fail"
+		};
+	}
+}
+async function missingRegularFiles(directory, paths) {
+	const missing = [];
+	for (const path of paths) try {
+		if (!(await stat(resolve(directory, path))).isFile()) missing.push(path);
+	} catch (error) {
+		if (!isMissingPath(error)) throw error;
+		missing.push(path);
+	}
+	return missing;
+}
+function isMissingPath(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function toError$3(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/adapters/deployment/inspection/rivus-home-deployment-inspector.ts
+const DEFAULT_BOOTSTRAP_PEERS = Object.freeze(["@earendil-works/pi-coding-agent", "@larksuiteoapi/node-sdk"]);
+function createRivusHomeDeploymentInspector(options = {}) {
+	const resolveModule = options.resolveModule ?? ((specifier) => defaultResolveModule(specifier, options.packageManifestPath));
+	const resolvePluginModule = options.resolvePluginModule ?? ((request) => resolveNodeRivusPluginModulePath(request, options.packageManifestPath ? { packageManifestPath: options.packageManifestPath } : {}));
+	return { inspect: (input) => Effect.gen(function* () {
+		const manifestResult = yield* checkManifest(input.home);
+		const credentials = yield* checkCredentials(input.home, manifestResult.manifest, input.env, input.envFilePath);
+		const modules = yield* checkModules(input.home, manifestResult.manifest, resolveModule, resolvePluginModule);
+		return {
+			credentials,
+			manifest: manifestResult.check,
+			modules
+		};
+	}) };
+}
+function checkManifest(home) {
+	return loadRivusDeploymentManifest(home.manifestPath).pipe(Effect.map((manifest) => {
+		validateRivusDeploymentManifest(manifest);
+		return {
+			check: {
+				message: "deployment manifest is valid",
+				name: "manifest",
+				status: "pass"
+			},
+			manifest
+		};
+	}), Effect.catchAll((error) => Effect.succeed({ check: {
+		message: `deployment manifest is invalid: ${formatError(error)}`,
+		name: "manifest",
+		status: "fail"
+	} })));
+}
+function checkModules(home, manifest, resolveModule, resolvePluginModule) {
+	if (!manifest) return Effect.succeed({
+		message: "modules cannot be checked until manifest is valid",
+		name: "modules",
+		status: "fail"
+	});
+	const specifiers = [resolveRivusBuiltinSpecifier(home.bootstrap), ...home.bootstrap === "@rivus/agent/bootstrap/pi-feishu" || home.bootstrap === "@rivus/gateway/bootstrap/pi-feishu" ? DEFAULT_BOOTSTRAP_PEERS : []];
+	return Effect.gen(function* () {
+		const missing = [];
+		for (const specifier of specifiers) {
+			const result = yield* toEffect(() => resolveModule(specifier)).pipe(Effect.either);
+			if (result._tag === "Left") missing.push(`${specifier} (${formatError(result.left)})`);
+		}
+		for (const plugin of manifest.plugins) {
+			const result = yield* toEffect(() => resolvePluginModule({
+				deploymentRoot: home.directory,
+				module: resolveRivusBuiltinSpecifier(plugin.module),
+				pluginId: plugin.id
+			})).pipe(Effect.either);
+			if (result._tag === "Left") missing.push(`${plugin.module} (${formatError(result.left)})`);
+		}
+		return missing.length === 0 ? {
+			message: "Bootstrap, Plugin, Pi, and Feishu modules resolve from the global installation",
+			name: "modules",
+			status: "pass"
+		} : {
+			message: `global npm modules are unavailable: ${missing.join(", ")}`,
+			name: "modules",
+			status: "fail"
+		};
+	});
+}
+function toEffect(read) {
+	return Effect.suspend(() => {
+		try {
+			const value = read();
+			if (Effect.isEffect(value)) return value;
+			return Effect.tryPromise({
+				try: () => Promise.resolve(value),
+				catch: toError$2
+			});
+		} catch (error) {
+			return Effect.fail(toError$2(error));
+		}
+	});
+}
+function checkCredentials(home, manifest, env, envFilePath) {
+	if (!manifest) return Effect.succeed({
+		message: "credentials cannot be checked until manifest is valid",
+		name: "credentials",
+		status: "fail"
+	});
+	return Effect.tryPromise({
+		try: async () => {
+			const merged = await loadMergedLocalEnvFile(envFilePath ? resolve(home.directory, envFilePath) : home.envFilePath, env);
+			for (const endpoint of manifest.endpoints.filter(({ enabled }) => enabled)) resolveFeishuEndpointCredentials(endpoint.credentialRef, merged);
+			return {
+				message: "enabled Endpoint credential references resolve",
+				name: "credentials",
+				status: "pass"
+			};
+		},
+		catch: toError$2
+	}).pipe(Effect.catchAll((error) => Effect.succeed({
+		message: `enabled Endpoint credentials are incomplete: ${formatError(error)}`,
+		name: "credentials",
+		status: "fail"
+	})));
+}
+function defaultResolveModule(specifier, packageManifestPath) {
+	if (!packageManifestPath) return Effect.fail(/* @__PURE__ */ new Error("Rivus package manifest path is required for trusted module resolution"));
+	return Effect.gen(function* () {
+		const resolvedRealpath = yield* Effect.tryPromise({
+			try: () => realpath(fileURLToPath(import.meta.resolve(specifier))),
+			catch: toError$2
+		});
+		return yield* validateTrustedModulePath(yield* findTrustedPackageRoot(packageManifestPath), resolvedRealpath, `module ${specifier}`);
+	});
+}
+function toError$2(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function formatError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/platform/home/config/rivus-home-config.ts
+/** Loads and validates the operator-owned Home config file. */
+function loadRivusHome(directoryPath) {
+	const directory = resolve(directoryPath);
+	const configPath = resolve(directory, "config.json");
+	return Effect.tryPromise({
+		try: async () => {
+			const config = parseRivusHomeConfig(JSON.parse(await readFile(configPath, "utf8")));
+			return {
+				bootstrap: resolveBootstrap(directory, config.bootstrap),
+				config,
+				configPath,
+				directory,
+				envFilePath: resolveHomePath(directory, config.envFile, "envFile"),
+				logsDirectory: resolveHomePath(directory, config.logs, "logs"),
+				manifestPath: resolveHomePath(directory, config.manifest, "manifest"),
+				stateDirectory: resolveHomePath(directory, config.state, "state"),
+				workspaceDirectory: resolveHomePath(directory, config.workspace, "workspace")
+			};
+		},
+		catch: asError
+	});
+}
+function parseRivusHomeConfig(value) {
+	const config = record(value, "Rivus Home config");
+	if (config.version !== 1) throw new Error("Rivus Home config version must be 1");
+	return {
+		bootstrap: nonEmptyString(config.bootstrap, "bootstrap"),
+		envFile: relativePath(config.envFile, "envFile"),
+		logs: relativePath(config.logs, "logs"),
+		manifest: relativePath(config.manifest, "manifest"),
+		state: relativePath(config.state, "state"),
+		version: 1,
+		workspace: relativePath(config.workspace, "workspace")
+	};
+}
+function resolveBootstrap(directory, value) {
+	if (value.startsWith("./") || value.startsWith("../")) return resolveHomePath(directory, value, "bootstrap");
+	if (isAbsolute(value)) throw new Error("Rivus Home bootstrap must be a package specifier or a relative path inside Rivus Home");
+	return value;
+}
+function resolveHomePath(directory, value, owner) {
+	const candidate = resolve(directory, value);
+	const relation = relative(directory, candidate);
+	if (relation === "" || !relation.startsWith(`..${sep}`) && relation !== ".." && !isAbsolute(relation)) return candidate;
+	throw new Error(`Rivus Home ${owner} escapes the Home directory`);
+}
+function relativePath(value, owner) {
+	const path = nonEmptyString(value, owner);
+	if (isAbsolute(path)) throw new Error(`Rivus Home ${owner} must be a relative path`);
+	return path;
+}
+function nonEmptyString(value, owner) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`Rivus Home ${owner} must be a non-empty string`);
+	return value;
+}
+function record(value, owner) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${owner} must be an object`);
+	return value;
+}
+function asError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/platform/home/doctor/rivus-home-doctor.ts
+function diagnoseRivusHome(input, options) {
+	return Effect.gen(function* () {
+		const checks = [checkNode(input.nodeVersion)];
+		const loaded = yield* options.load(input.directory).pipe(Effect.either);
+		if (Either.isLeft(loaded)) {
+			checks.push({
+				message: `Rivus Home is invalid: ${loaded.left.message}`,
+				name: "home",
+				status: "fail"
+			}, blockedCheck("workspace", "Workspace"), blockedCheck("manifest", "manifest"), blockedCheck("modules", "modules"), blockedCheck("credentials", "credentials"));
+			return report(input.directory, checks);
+		}
+		const home = loaded.right;
+		checks.push({
+			message: "config.json is valid and contained in Rivus Home",
+			name: "home",
+			status: "pass"
+		});
+		checks.push(yield* checkWorkspace(home, options.findMissingWorkspacePaths));
+		const deployment = yield* options.deploymentInspector.inspect({
+			env: input.env,
+			...input.envFilePath ? { envFilePath: input.envFilePath } : {},
+			home
+		});
+		checks.push(deployment.manifest, deployment.modules, deployment.credentials);
+		return report(input.directory, checks);
+	});
+}
+function checkNode(version) {
+	const [major, minor] = version.split(".").map(Number);
+	return major === 24 && Number.isInteger(minor) && minor >= 11 ? {
+		message: `Node.js ${version} satisfies the supported ^24.11 runtime`,
+		name: "node",
+		status: "pass"
+	} : {
+		message: `Node.js 24.11 or newer on major 24 is required; current version is ${version}`,
+		name: "node",
+		status: "fail"
+	};
+}
+function checkWorkspace(home, findMissingWorkspacePaths) {
+	return findMissingWorkspacePaths(home).pipe(Effect.map((missing) => missing.length === 0 ? {
+		message: "Workspace instructions, Memory, Skills, and work directories are present",
+		name: "workspace",
+		status: "pass"
+	} : {
+		message: `Workspace paths are missing: ${missing.join(", ")}`,
+		name: "workspace",
+		status: "fail"
+	}));
+}
+function blockedCheck(name, owner) {
+	return {
+		message: `${owner} cannot be checked until config.json is valid`,
+		name,
+		status: "fail"
+	};
+}
+function report(directory, checks) {
+	return {
+		checks,
+		directory,
+		ready: checks.every(({ status }) => status === "pass")
+	};
+}
+//#endregion
+//#region src/platform/home/setup/rivus-home-layout.ts
+const HOME_DIRECTORIES = Object.freeze([
+	"logs",
+	"plugins",
+	"state",
+	"workspace/memory",
+	"workspace/skills",
+	"workspace/work/artifacts",
+	"workspace/work/drafts",
+	"workspace/work/inbox",
+	"workspace/work/tmp"
+]);
+function createRivusHomeLayout() {
+	return {
+		directories: HOME_DIRECTORIES,
+		files: /* @__PURE__ */ new Map([
+			[".env.example", environmentTemplate()],
+			[".gitignore", ".DS_Store\n.env\nlogs/\nstate/\nworkspace/work/tmp/\n"],
+			["config.json", homeConfig()],
+			["rivus.config.json", deploymentManifest()],
+			["workspace/AGENTS.md", agentsTemplate()],
+			["workspace/IDENTITY.md", "# Identity\n\nName: Rivus\n\nRole: Personal agent\n"],
+			["workspace/MEMORY.md", "# Curated Memory\n\nStore confirmed, durable facts and decisions here.\n"],
+			["workspace/SOUL.md", "# Character\n\nBe direct, thoughtful, and evidence-led.\n"],
+			["workspace/USER.md", "# User\n\nRecord stable user preferences here.\n"],
+			["plugins/.gitkeep", ""],
+			["workspace/memory/.gitkeep", ""],
+			["workspace/skills/.gitkeep", ""],
+			["workspace/work/artifacts/.gitkeep", ""],
+			["workspace/work/drafts/.gitkeep", ""],
+			["workspace/work/inbox/.gitkeep", ""]
+		])
+	};
+}
+function homeConfig() {
+	return `${JSON.stringify({
+		bootstrap: "@rivus/gateway/bootstrap/pi-feishu",
+		envFile: ".env",
+		logs: "logs",
+		manifest: "rivus.config.json",
+		state: "state",
+		version: 1,
+		workspace: "workspace"
+	}, null, 2)}\n`;
+}
+function deploymentManifest() {
+	return `${JSON.stringify({
+		agents: [{
+			agentId: "personal",
+			endpointIds: ["personal-feishu"],
+			memory: {
+				scopes: ["agent-private"],
+				tool: true
+			},
+			pluginId: "rivus-starter",
+			profileId: "agent-a",
+			projectSpaceId: "personal-home",
+			runtimeTools: { allow: [
+				"read",
+				"bash",
+				"edit",
+				"write",
+				"grep",
+				"find",
+				"ls"
+			] },
+			skills: { allow: [] },
+			tools: { allow: ["rivus-starter/current-weather"] }
+		}],
+		defaultAgentId: "personal",
+		defaultEndpointId: "personal-feishu",
+		endpoints: [{
+			agentId: "personal",
+			baseUrl: "https://open.feishu.cn",
+			cardStreamLeaseMs: 51e4,
+			credentialRef: "env:RIVUS_FEISHU",
+			enabled: true,
+			experimental: { cotMessages: false },
+			groupPolicy: "mention-only",
+			id: "personal-feishu",
+			progressDisplay: "collapsed",
+			required: true,
+			sessionNamespace: "rivus-home-v1",
+			streamMinIntervalMs: 200
+		}],
+		plugins: [{
+			id: "rivus-starter",
+			module: "@rivus/gateway/plugin/starter",
+			required: true
+		}],
+		projectSpaces: [{
+			id: "personal-home",
+			root: "workspace",
+			skills: { sources: ["skills"] },
+			workingDirectory: "."
+		}]
+	}, null, 2)}\n`;
+}
+function environmentTemplate() {
+	return [
+		"# Copy this file to .env and keep the real values untracked.",
+		"RIVUS_FEISHU_APP_ID=",
+		"RIVUS_FEISHU_APP_SECRET=",
+		"PI_MODEL=",
+		"PI_API_KEY=",
+		"# PI_BASE_URL=",
+		"RIVUS_WEATHER_DEFAULT_LOCATION=上海",
+		""
+	].join("\n");
+}
+function agentsTemplate() {
+	return [
+		"# Personal Workspace",
+		"",
+		"Use this directory as the default home for personal work.",
+		"",
+		"- Read `SOUL.md` and `IDENTITY.md` when identity or tone matters.",
+		"- Read `USER.md` when stable user preferences affect the task.",
+		"- Search `MEMORY.md` and dated files under `memory/` when prior facts or decisions matter.",
+		"- Read the selected `skills/<name>/SKILL.md` before following a Workspace Skill.",
+		"- Put incoming material in `work/inbox/`, drafts in `work/drafts/`, and durable general outputs in `work/artifacts/`.",
+		"- Put disposable files in `work/tmp/`.",
+		"- Store only confirmed durable facts in Memory; keep credentials and raw private transcripts out of tracked files.",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/platform/home/setup/rivus-home-initializer.ts
+function initializeRivusHome(directoryPath) {
+	const directory = resolve(directoryPath);
+	const { directories, files } = createRivusHomeLayout();
+	const paths = [...files.keys()].sort();
+	return Effect.tryPromise({
+		try: async () => {
+			for (const path of [...directories].sort()) await mkdir(join(directory, path), { recursive: true });
+			for (const path of paths) {
+				const destination = join(directory, path);
+				await mkdir(dirname(destination), { recursive: true });
+				await writeFile(destination, files.get(path), {
+					encoding: "utf8",
+					flag: "wx"
+				});
+			}
+			return {
+				directory,
+				files: paths
+			};
+		},
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+}
+//#endregion
+//#region src/platform/home/workspace/rivus-home-workspace.ts
+function findMissingRivusHomeWorkspacePaths(home) {
+	const required = [
+		home.workspaceDirectory,
+		resolve(home.workspaceDirectory, "AGENTS.md"),
+		resolve(home.workspaceDirectory, "MEMORY.md"),
+		resolve(home.workspaceDirectory, "memory"),
+		resolve(home.workspaceDirectory, "skills"),
+		resolve(home.workspaceDirectory, "work")
+	];
+	return Effect.tryPromise({
+		try: async () => {
+			const missing = [];
+			for (const path of required) try {
+				await stat(path);
+			} catch (error) {
+				if (error instanceof Error && "code" in error && error.code === "ENOENT") missing.push(path);
+				else throw error;
+			}
+			return missing;
+		},
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+}
+//#endregion
+//#region src/platform/home/node/node-rivus-home.ts
+function createNodeRivusHome(options) {
+	return {
+		diagnose: (input) => diagnoseRivusHome(input, {
+			deploymentInspector: options.deploymentInspector,
+			findMissingWorkspacePaths: findMissingRivusHomeWorkspacePaths,
+			load: loadRivusHome
+		}),
+		load: loadRivusHome,
+		setup: initializeRivusHome
+	};
+}
+//#endregion
+//#region src/adapters/cli/command/rivus-cli-protocol.ts
+const RIVUS_CLI_USAGE = `Usage:
+  rivus setup [directory]
+  rivus start
+  rivus status
+  rivus check-config
+  rivus init [directory]
+  rivus doctor [directory] [--env-file <path>]
+  rivus model <status|set|rollback> ...
+  rivus --bootstrap <module> [--manifest <rivus.config.json>] [options]
+
+Commands:
+  setup     Create Rivus Home (default ~/.rivus-agent) without overwriting files
+  start     Start the Rivus Home deployment in the foreground
+  status    Print Rivus Home deployment status without activating Endpoints
+  check-config
+            Validate and print the redacted Rivus Home manifest
+  init      Create a standalone local Rivus project without overwriting files
+  doctor    Check Rivus Home by default, or an explicit standalone project directory
+  model     Query or change the managed default model through the current Home
+
+Run rivus --help for the complete daemon option list.
+`;
+function renderRivusCliError(error) {
+	return `${error instanceof Error ? error.message : String(error)}\n`;
+}
+function renderRivusCliUnknownCommand(command) {
+	return `Unknown command: ${command}\n\n${RIVUS_CLI_USAGE}`;
+}
+function renderRivusDirectoryCommandUsage(command) {
+	return `Usage: rivus ${command} [directory]\n`;
+}
+function renderRivusHomeCommandUsage(command) {
+	return `Usage: rivus ${command}\n`;
+}
+function renderRivusDoctorUsage() {
+	return "Usage: rivus doctor [directory] [--env-file <path>]\n";
+}
+function renderRivusDoctorArgumentError(error) {
+	return `${error}\n${renderRivusDoctorUsage()}`;
+}
+function renderRivusSetupSuccess(directory) {
+	return `Initialized Rivus Home in ${directory}\n\nNext:\n  cp ${shellQuote(`${directory}/.env.example`)} ${shellQuote(`${directory}/.env`)}\n  rivus doctor\n  rivus start\n`;
+}
+function renderRivusProjectInitializationSuccess(directory) {
+	return `Initialized Rivus project in ${directory}\n\nNext:\n  cd ${shellQuote(directory)}\n  npm install\n  cp .env.example .env.local\n  npm run doctor\n  npm start\n`;
+}
+function* renderRivusDoctorReport(report, owner) {
+	yield `Rivus doctor: ${report.directory}\n`;
+	for (const check of report.checks) yield `${check.status === "pass" ? "PASS" : "FAIL"} ${check.name}: ${check.message}\n`;
+	yield report.ready ? `Rivus ${owner} is ready\n` : `Rivus ${owner} is not ready\n`;
+}
+function parseRivusDirectoryArguments(argv) {
+	if (argv.includes("--help") || argv.includes("-h")) return { help: true };
+	if (argv.length > 1 || argv[0]?.startsWith("-")) return { error: "invalid directory arguments" };
+	return argv[0] === void 0 ? {} : { directory: argv[0] };
+}
+function hasRivusHomeCommandArguments(argv) {
+	return argv.length > 0;
+}
+function parseRivusDoctorArguments(argv) {
+	let directory;
+	let envFilePath;
+	for (let index = 0; index < argv.length; index += 1) {
+		const argument = argv[index];
+		if (argument === "--help" || argument === "-h") return { help: true };
+		if (argument === "--env-file") {
+			const value = argv[index + 1];
+			if (!value) return { error: "--env-file requires a path" };
+			envFilePath = value;
+			index += 1;
+			continue;
+		}
+		if (argument.startsWith("--env-file=")) {
+			envFilePath = argument.slice(11);
+			if (!envFilePath) return { error: "--env-file requires a path" };
+			continue;
+		}
+		if (argument.startsWith("-")) return { error: `Unknown doctor option: ${argument}` };
+		if (directory !== void 0) return { error: "doctor accepts at most one directory" };
+		directory = argument;
+	}
+	return {
+		...directory !== void 0 ? { directory } : {},
+		...envFilePath !== void 0 ? { envFilePath } : {}
+	};
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+//#endregion
+//#region src/adapters/cli/model/rivus-model-management-socket-client.ts
+const MAX_FRAME_BYTES = 64 * 1024;
+const DEFAULT_TIMEOUT_MS = 1e4;
+var RivusModelManagementTransportError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "RivusModelManagementTransportError";
+		this.code = code;
+	}
+};
+function createRivusModelManagementSocketClient(options) {
+	if (!isAbsolute(options.socketPath)) throw new Error("model socket path must be absolute");
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	return { execute: (command) => request(options.socketPath, options.env, command, timeoutMs) };
+}
+async function request(socketPath, env, command, timeoutMs) {
+	const payload = createRivusModelManagementWireRequest(command, env);
+	return new Promise((resolve, reject) => {
+		const socket = createConnection(socketPath);
+		let response = "";
+		let settled = false;
+		const finish = (callback) => {
+			if (settled) return;
+			settled = true;
+			callback();
+		};
+		socket.setEncoding("utf8");
+		socket.setTimeout(timeoutMs, () => {
+			finish(() => reject(new RivusModelManagementTransportError("timeout", "model management socket timed out")));
+			socket.destroy();
+		});
+		socket.on("connect", () => socket.write(`${JSON.stringify(payload)}\n`));
+		socket.on("data", (chunk) => {
+			response += chunk;
+			if (Buffer.byteLength(response, "utf8") > MAX_FRAME_BYTES) {
+				finish(() => reject(new RivusModelManagementTransportError("invalid_response", "model response is too large")));
+				socket.destroy();
+			}
+		});
+		socket.on("error", (error) => {
+			finish(() => reject(new RivusModelManagementTransportError("socket_error", "model management socket is unavailable", { cause: error })));
+		});
+		socket.on("end", () => {
+			const line = response.split("\n", 1)[0]?.trim();
+			if (!line) {
+				finish(() => reject(new RivusModelManagementTransportError("invalid_response", "model response was empty")));
+				return;
+			}
+			try {
+				const parsed = JSON.parse(line);
+				if (!isResponse(parsed)) throw new Error("model response must be a JSON object");
+				finish(() => resolve(parsed));
+			} catch (error) {
+				finish(() => reject(new RivusModelManagementTransportError("invalid_response", "model response was not valid JSON", { cause: error })));
+			}
+		});
+	});
+}
+function isResponse(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/adapters/cli/model/rivus-model-socket.ts
+const RIVUS_MODEL_SOCKET_ENV = "RIVUS_MODEL_SOCKET";
+const RIVUS_MODEL_MANAGEMENT_ENABLED_ENV = "RIVUS_MODEL_MANAGEMENT_ENABLED";
+const RIVUS_MODEL_SOCKET_RELATIVE_PATH = "state/model-management/control.sock";
+function resolveRivusModelSocketPath(options) {
+	const configured = optional(options.env[RIVUS_MODEL_SOCKET_ENV]);
+	if (configured) {
+		if (!isAbsolute(configured)) throw new Error(`${RIVUS_MODEL_SOCKET_ENV} must be an absolute path`);
+		return resolve(configured);
+	}
+	const configuredHome = optional(options.env.RIVUS_HOME);
+	return join(configuredHome ? resolveAbsoluteHome(configuredHome) : resolve(options.homeDirectory, ".rivus-agent"), RIVUS_MODEL_SOCKET_RELATIVE_PATH);
+}
+function isRivusModelManagementEnabled(env) {
+	const value = optional(env[RIVUS_MODEL_MANAGEMENT_ENABLED_ENV]);
+	return value === "1" || value === "true";
+}
+function resolveAbsoluteHome(value) {
+	if (!isAbsolute(value)) throw new Error("RIVUS_HOME must be an absolute path");
+	return resolve(value);
+}
+function optional(value) {
+	return value?.trim() || void 0;
+}
+//#endregion
+//#region src/adapters/openclaw/config/openclaw-env-import.ts
+var OpenClawEnvImportError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OpenClawEnvImportError";
+	}
+};
+const DEFAULT_AGENT_ID = "main";
+const DEFAULT_FEISHU_BASE_URL = "https://open.feishu.cn";
+const DEFAULT_LARK_BASE_URL = "https://open.larksuite.com";
+const DEFAULT_STREAM_MIN_INTERVAL_MS = 200;
+const THINKING_LEVELS = /* @__PURE__ */ new Set([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+const ENV_FILE_ORDER = [
+	"FEISHU_APP_ID",
+	"FEISHU_APP_SECRET",
+	"FEISHU_BASE_URL",
+	"FEISHU_STREAM_MIN_INTERVAL_MS",
+	"RIVUS_AGENT_ID",
+	"PI_API_KEY_FILE",
+	"PI_BASE_URL",
+	"PI_MODEL",
+	"PI_THINKING_LEVEL"
+];
+function createRivusEnvFromOpenClawConfig(openClawConfig, options = {}) {
+	const config = asRecord(openClawConfig, "OpenClaw config");
+	const feishu = asRecord(readPath(config, ["channels", "feishu"]), "channels.feishu");
+	const appId = requiredString(feishu, "appId", "channels.feishu.appId");
+	const appSecret = requiredString(feishu, "appSecret", "channels.feishu.appSecret");
+	const modelReference = findPrimaryModelReference(config);
+	const providerId = modelReference ? parseProviderId(modelReference) : void 0;
+	const provider = providerId ? optionalRecord(readPath(config, [
+		"models",
+		"providers",
+		providerId
+	])) : void 0;
+	const providerBaseUrl = provider ? optionalString(provider.baseUrl) : void 0;
+	const thinkingLevel = modelReference ? findThinkingLevel(config, modelReference) : void 0;
+	const warnings = thinkingLevel?.warning ? [thinkingLevel.warning] : [];
+	return {
+		env: {
+			FEISHU_APP_ID: appId,
+			FEISHU_APP_SECRET: appSecret,
+			FEISHU_BASE_URL: options.feishuBaseUrl ?? inferFeishuBaseUrl(optionalString(feishu.domain)),
+			FEISHU_STREAM_MIN_INTERVAL_MS: String(options.streamMinIntervalMs ?? DEFAULT_STREAM_MIN_INTERVAL_MS),
+			RIVUS_AGENT_ID: findAgentId(config),
+			...options.piApiKeyFile ? { PI_API_KEY_FILE: options.piApiKeyFile } : {},
+			...providerBaseUrl ? { PI_BASE_URL: providerBaseUrl } : {},
+			...modelReference ? { PI_MODEL: modelReference } : {},
+			...thinkingLevel?.level ? { PI_THINKING_LEVEL: thinkingLevel.level } : {}
+		},
+		warnings
+	};
+}
+function formatRivusEnvFile(env) {
+	return `${[...ENV_FILE_ORDER.filter((key) => Object.hasOwn(env, key)), ...Object.keys(env).filter((key) => !ENV_FILE_ORDER.includes(key)).sort()].map((key) => `${key}=${quoteEnvValue(env[key] ?? "")}`).join("\n")}\n`;
+}
+function findAgentId(config) {
+	const agents = optionalRecord(config.agents);
+	return optionalString(optionalRecord((Array.isArray(agents?.list) ? agents.list : [])[0])?.id) ?? DEFAULT_AGENT_ID;
+}
+function findPrimaryModelReference(config) {
+	const primary = optionalString(readPath(config, [
+		"agents",
+		"defaults",
+		"model",
+		"primary"
+	]));
+	if (primary) return primary;
+	const providers = optionalRecord(readPath(config, ["models", "providers"]));
+	if (!providers) return;
+	for (const [providerId, provider] of Object.entries(providers)) {
+		const model = firstModelId(optionalRecord(provider));
+		if (model) return `${providerId}/${model}`;
+	}
+}
+function firstModelId(provider) {
+	return optionalString(optionalRecord((Array.isArray(provider?.models) ? provider.models : [])[0])?.id);
+}
+function parseProviderId(modelReference) {
+	const separator = modelReference.indexOf("/");
+	return separator > 0 ? modelReference.slice(0, separator) : void 0;
+}
+function findThinkingLevel(config, modelReference) {
+	const providerId = parseProviderId(modelReference);
+	const modelId = readModelId(modelReference);
+	const rawLevel = [
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"thinkingLevel"
+		]),
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"thinkLevel"
+		]),
+		readPath(config, [
+			"agents",
+			"defaults",
+			"models",
+			modelReference,
+			"reasoningLevel"
+		]),
+		...providerId && modelId ? readProviderModelThinkingCandidates(config, providerId, modelId) : []
+	].map(optionalString).find(Boolean);
+	if (!rawLevel) return;
+	if (THINKING_LEVELS.has(rawLevel)) return { level: rawLevel };
+	return { warning: `Unsupported OpenClaw thinking level '${rawLevel}' was ignored` };
+}
+function readProviderModelThinkingCandidates(config, providerId, modelId) {
+	const providerModels = readPath(config, [
+		"models",
+		"providers",
+		providerId,
+		"models"
+	]);
+	if (!Array.isArray(providerModels)) return [];
+	const model = providerModels.map(optionalRecord).find((candidate) => optionalString(candidate?.id) === modelId);
+	if (!model) return [];
+	return [
+		model.thinkingLevel,
+		model.thinkLevel,
+		model.reasoningLevel,
+		readPath(model, ["reasoning", "level"]),
+		readPath(model, ["reasoning", "thinkingLevel"]),
+		readPath(model, ["reasoning", "thinkLevel"])
+	];
+}
+function readModelId(modelReference) {
+	const separator = modelReference.indexOf("/");
+	return separator >= 0 && separator < modelReference.length - 1 ? modelReference.slice(separator + 1) : void 0;
+}
+function inferFeishuBaseUrl(domain) {
+	return domain === "lark" ? DEFAULT_LARK_BASE_URL : DEFAULT_FEISHU_BASE_URL;
+}
+function quoteEnvValue(value) {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function requiredString(record, key, path) {
+	const value = optionalString(record[key]);
+	if (!value) throw new OpenClawEnvImportError(`${path} is required`);
+	return value;
+}
+function optionalString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function asRecord(value, path) {
+	const record = optionalRecord(value);
+	if (!record) throw new OpenClawEnvImportError(`${path} must be an object`);
+	return record;
+}
+function optionalRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function readPath(record, path) {
+	let value = record;
+	for (const segment of path) {
+		const current = optionalRecord(value);
+		if (!current) return;
+		value = current[segment];
+	}
+	return value;
+}
+//#endregion
+//#region src/adapters/cli/config/rivus-daemon-config.ts
+async function loadRivusEnvFromOpenClawConfig(filePath, piApiKeyFile) {
+	return createRivusEnvFromOpenClawConfig(JSON.parse(await readFile(filePath, "utf8")), piApiKeyFile ? { piApiKeyFile } : {});
+}
+function toRedactedConfig(config) {
+	return {
+		agentId: config.agentId,
+		feishu: {
+			appIdPresent: Boolean(config.feishu.appId),
+			appSecretPresent: Boolean(config.feishu.appSecret),
+			baseUrl: config.feishu.baseUrl,
+			cardStreamLeaseMs: config.feishu.cardStreamLeaseMs,
+			streamMinIntervalMs: config.feishu.streamMinIntervalMs
+		},
+		pi: {
+			apiKeyPresent: Boolean(config.pi.apiKey),
+			...config.pi.baseUrl ? { baseUrl: config.pi.baseUrl } : {},
+			...config.pi.model ? { model: config.pi.model } : {},
+			...config.pi.thinkingLevel ? { thinkingLevel: config.pi.thinkingLevel } : {}
+		}
+	};
+}
+function toRedactedDeploymentManifest(manifest) {
+	return {
+		agents: manifest.agents.map(({ agentId, endpointIds, pluginId, profileId }) => ({
+			agentId,
+			endpointIds,
+			pluginId,
+			profileId
+		})),
+		automations: (manifest.automations ?? []).map(({ agentId, delivery, enabled, id, required, schedule, templateId, timeZone }) => ({
+			agentId,
+			delivery: {
+				endpointId: delivery.endpointId,
+				targetRef: delivery.targetRef,
+				targetType: delivery.targetType
+			},
+			enabled,
+			id,
+			required,
+			schedule,
+			templateId,
+			timeZone
+		})),
+		...manifest.backgroundSessions ? { backgroundSessions: {
+			enabled: manifest.backgroundSessions.enabled,
+			leaseMs: manifest.backgroundSessions.leaseMs,
+			leaseRenewalIntervalMs: manifest.backgroundSessions.leaseRenewalIntervalMs,
+			maxConsecutiveFailures: manifest.backgroundSessions.maxConsecutiveFailures,
+			maxConcurrentSessions: manifest.backgroundSessions.maxConcurrentSessions,
+			required: manifest.backgroundSessions.required,
+			retryBackoffMs: manifest.backgroundSessions.retryBackoffMs,
+			sessionLifetimeMs: manifest.backgroundSessions.sessionLifetimeMs,
+			stepTimeoutMs: manifest.backgroundSessions.stepTimeoutMs
+		} } : {},
+		defaultAgentId: manifest.defaultAgentId,
+		defaultEndpointId: manifest.defaultEndpointId,
+		endpoints: manifest.endpoints.map(({ agentId, credentialRef, enabled, id, required, sessionNamespace }) => ({
+			agentId,
+			credentialRef,
+			enabled,
+			id,
+			required,
+			sessionNamespace
+		})),
+		plugins: manifest.plugins.map(({ id, module, required }) => ({
+			id,
+			module,
+			required
+		}))
+	};
+}
+async function loadCliEnv(envFilePath, overrideEnv) {
+	if (!envFilePath) return overrideEnv;
+	return loadMergedLocalEnvFile(envFilePath, overrideEnv);
+}
+//#endregion
+//#region src/adapters/cli/recovery/rivus-recovery-cli.ts
+function createRivusRecoveryCliParser() {
+	const input = { recoveryList: false };
+	return {
+		build: () => buildCommand(input),
+		consume: (argument, next) => consumeArgument(input, argument, next)
+	};
+}
+async function runRivusRecoveryCliCommand(control, command) {
+	switch (command.type) {
+		case "inspect": return Effect.runPromise(control.inspect());
+		case "requeue-dead-letter": return Effect.runPromise(control.requeueDeadLetter({
+			actorId: "local-cli",
+			deliveryId: command.deliveryId,
+			endpointId: command.endpointId,
+			expectedRevision: command.expectedRevision,
+			note: await readPrivateTextFile(command.noteFilePath, "Recovery note", 16 * 1024)
+		}));
+		case "resolve-tool-operation": {
+			const note = await readPrivateTextFile(command.noteFilePath, "Recovery note", 16 * 1024);
+			const outcome = command.outcome.status === "applied" ? {
+				result: parseToolResult(await readPrivateTextFile(command.outcome.resultFilePath, "Tool result", 1024 * 1024)),
+				status: "applied"
+			} : command.outcome;
+			return Effect.runPromise(control.resolveToolOperation({
+				actorId: "local-cli",
+				expectedRevision: command.expectedRevision,
+				instanceId: command.instanceId,
+				note,
+				operationId: command.operationId,
+				outcome
+			}));
+		}
+	}
+}
+function consumeArgument(input, argument, next) {
+	if (argument === "--recovery-list") {
+		input.recoveryList = true;
+		return {
+			consumed: 0,
+			handled: true
+		};
+	}
+	for (const [flag, key] of [
+		["--requeue-dead-letter", "requeueDeadLetterId"],
+		["--resolve-tool-operation", "resolveToolOperationId"],
+		["--endpoint-id", "endpointId"],
+		["--instance-id", "instanceId"],
+		["--expected-revision", "expectedRevision"],
+		["--recovery-note-file", "recoveryNoteFile"],
+		["--tool-outcome", "toolOutcome"],
+		["--tool-result-file", "toolResultFile"]
+	]) {
+		if (argument === flag) {
+			if (!next) return {
+				consumed: 0,
+				error: `${flag} requires a value`,
+				handled: true
+			};
+			input[key] = next;
+			return {
+				consumed: 1,
+				handled: true
+			};
+		}
+		if (argument?.startsWith(`${flag}=`)) {
+			const value = argument.slice(flag.length + 1);
+			if (!value) return {
+				consumed: 0,
+				error: `${flag} requires a value`,
+				handled: true
+			};
+			input[key] = value;
+			return {
+				consumed: 0,
+				handled: true
+			};
+		}
+	}
+	return {
+		consumed: 0,
+		handled: false
+	};
+}
+function buildCommand(input) {
+	const actionCount = Number(input.recoveryList) + Number(input.requeueDeadLetterId !== void 0) + Number(input.resolveToolOperationId !== void 0);
+	const hasOptions = input.endpointId !== void 0 || input.expectedRevision !== void 0 || input.instanceId !== void 0 || input.recoveryNoteFile !== void 0 || input.toolOutcome !== void 0 || input.toolResultFile !== void 0;
+	if (actionCount === 0) return hasOptions ? { error: "Recovery options require --recovery-list, --requeue-dead-letter, or --resolve-tool-operation" } : {};
+	if (actionCount > 1) return { error: "Choose only one recovery command" };
+	if (input.recoveryList) return hasOptions ? { error: "--recovery-list does not accept mutation options" } : { command: { type: "inspect" } };
+	const expectedRevision = parsePositiveInteger(input.expectedRevision);
+	if (expectedRevision === void 0) return { error: "Recovery mutations require --expected-revision with a positive integer" };
+	const noteFilePath = input.recoveryNoteFile?.trim();
+	if (!noteFilePath) return { error: "Recovery mutations require --recovery-note-file" };
+	if (input.requeueDeadLetterId !== void 0) return buildDeadLetterCommand(input, expectedRevision, noteFilePath);
+	return buildToolOperationCommand(input, expectedRevision, noteFilePath);
+}
+function buildDeadLetterCommand(input, expectedRevision, noteFilePath) {
+	const endpointId = input.endpointId?.trim();
+	if (!endpointId) return { error: "--requeue-dead-letter requires --endpoint-id" };
+	if (input.instanceId !== void 0 || input.toolOutcome !== void 0 || input.toolResultFile !== void 0) return { error: "--requeue-dead-letter cannot use Tool reconciliation options" };
+	return { command: {
+		deliveryId: input.requeueDeadLetterId,
+		endpointId,
+		expectedRevision,
+		noteFilePath,
+		type: "requeue-dead-letter"
+	} };
+}
+function buildToolOperationCommand(input, expectedRevision, noteFilePath) {
+	const instanceId = input.instanceId?.trim();
+	if (!instanceId) return { error: "--resolve-tool-operation requires --instance-id" };
+	if (input.endpointId !== void 0) return { error: "--resolve-tool-operation cannot use --endpoint-id" };
+	if (input.toolOutcome !== "applied" && input.toolOutcome !== "not-applied") return { error: "--resolve-tool-operation requires --tool-outcome applied or not-applied" };
+	if (input.toolOutcome === "not-applied") {
+		if (input.toolResultFile !== void 0) return { error: "--tool-result-file is only valid when --tool-outcome is applied" };
+		return { command: {
+			expectedRevision,
+			instanceId,
+			noteFilePath,
+			operationId: input.resolveToolOperationId,
+			outcome: { status: "not-applied" },
+			type: "resolve-tool-operation"
+		} };
+	}
+	const resultFilePath = input.toolResultFile?.trim();
+	if (!resultFilePath) return { error: "--tool-outcome applied requires --tool-result-file" };
+	return { command: {
+		expectedRevision,
+		instanceId,
+		noteFilePath,
+		operationId: input.resolveToolOperationId,
+		outcome: {
+			resultFilePath,
+			status: "applied"
+		},
+		type: "resolve-tool-operation"
+	} };
+}
+function parsePositiveInteger(value) {
+	return value && /^[1-9]\d*$/.test(value) ? Number(value) : void 0;
+}
+async function readPrivateTextFile(filePath, label, maxBytes) {
+	const handle = await open(filePath, constants$1.O_RDONLY | constants$1.O_NOFOLLOW);
+	try {
+		const metadata = await handle.stat();
+		if (!metadata.isFile()) throw new Error(`${label} must be a regular file`);
+		if ((metadata.mode & 63) !== 0) throw new Error(`${label} file permissions must be 0600 or stricter`);
+		if (metadata.size > maxBytes) throw new Error(`${label} file exceeds ${maxBytes} bytes`);
+		return (await handle.readFile("utf8")).trim();
+	} finally {
+		await handle.close();
+	}
+}
+function parseToolResult(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		throw new Error("Tool result file must contain valid JSON");
+	}
+}
+//#endregion
+//#region src/adapters/cli/command/rivus-daemon-arguments.ts
+const RIVUS_DAEMON_USAGE = `Usage: rivus --bootstrap <module> [--manifest <rivus.config.json>]
+
+Starts a local Rivus Agent daemon from an injected bootstrap module.
+
+Project commands:
+  rivus setup [directory]
+  rivus start
+  rivus status
+  rivus check-config
+  rivus init [directory]
+  rivus doctor [directory] [--env-file <path>]
+  rivus model <status|set|rollback> ...
+
+Options:
+  --bootstrap <module>  Module exporting createRivusDaemonProcess(context)
+  --manifest <path>     Start the manifest-driven multi-agent deployment; bootstrap exports createRivusDeploymentAdapters(context)
+  --env-file <path>     Load local KEY=value config before reading environment
+  --check-config        Print redacted local config JSON and exit
+  --prompt <text>       Run one local prompt through bootstrap promptText() and exit
+  --replay-feishu-event <json>
+                         Replay one Feishu receive-message payload through bootstrap replayReceiveMessage() and exit
+  --replay-feishu-text <text>
+                         Replay one synthetic Feishu receive-message text payload without Feishu side effects and exit
+  --feishu-message-id <id>
+                         Message id for --replay-feishu-text (default om_cli_<timestamp>)
+  --feishu-chat-id <id> Chat id for --replay-feishu-text (default oc_cli)
+  --feishu-thread-id <id>
+                         Thread id for --replay-feishu-text (default omt_cli)
+  --feishu-tenant-key <key>
+                         Tenant key for --replay-feishu-text (default tenant_cli)
+  --print-openclaw-env <json>
+                         Print a Rivus env file from an OpenClaw config JSON and exit
+  --pi-api-key-file <path>
+                         Add PI_API_KEY_FILE when using --print-openclaw-env
+  --session-key <key>   Session key for --prompt (default local:<agent-id>:cli)
+  --status              Print bootstrap status JSON without starting the daemon
+  --recovery-list       List Dead Letters and Tool operations requiring reconciliation
+  --requeue-dead-letter <message-id>
+                         Requeue one Dead Letter; requires --endpoint-id, --expected-revision, and --recovery-note-file
+  --resolve-tool-operation <operation-id>
+                         Resolve one uncertain Tool operation; requires --instance-id, --expected-revision,
+                         --tool-outcome, and --recovery-note-file
+  --endpoint-id <id>    Endpoint owning the Dead Letter
+  --instance-id <id>    Agent Instance owning the Tool operation
+  --expected-revision <n>
+                         Exact record revision required by a recovery mutation
+  --recovery-note-file <path>
+                         Private (0600) file containing the required audit note
+  --tool-outcome <applied|not-applied>
+                         Confirm whether the external Tool effect occurred
+  --tool-result-file <path>
+                         Private (0600) JSON file required when --tool-outcome is applied
+  --status-url <url>    Print live daemon status JSON from a running daemon
+  --wait-receive <kind> Wait with --status-url or a started bootstrap daemon until receive.lastAccepted or receive.lastHandled exists
+  --wait-receive-text <text>
+                         With --wait-receive handled, wait until receive.lastHandled.intake.text contains text
+  --wait-receive-message-id <id>
+                         With --wait-receive, wait until the accepted or handled receive observation has this Feishu message id
+  --wait-receive-observed-after <iso>
+                         With --wait-receive, ignore receive observations at or before this ISO timestamp
+  --wait-timeout-ms <n> Timeout for --wait-receive (default 30000)
+  --wait-poll-ms <n>   Poll interval for --wait-receive (default 500)
+  --help               Show this help
+
+Environment:
+  RIVUS_HOME selects Rivus Home (default ~/.rivus-agent) for Home commands.
+  RIVUS_BOOTSTRAP_MODULE may be used instead of --bootstrap.
+  FEISHU_APP_ID and FEISHU_APP_SECRET are required by the default config loader.
+  FEISHU_CARD_STREAM_LEASE_MS shortens or extends the proactive CardKit rollover threshold.
+  PI_API_KEY_FILE may point to a local BYOK key file instead of PI_API_KEY.
+`;
+function parseRivusDaemonArguments(argv) {
+	let bootstrap;
+	let checkConfig = false;
+	let envFilePath;
+	let feishuReplayChatId;
+	let feishuReplayMessageId;
+	let feishuReplayTenantKey;
+	let feishuReplayThreadId;
+	let manifestPath;
+	let piApiKeyFile;
+	let prompt;
+	let printOpenClawEnvPath;
+	let replayFeishuEventPath;
+	let replayFeishuText;
+	const recoveryCli = createRivusRecoveryCliParser();
+	let sessionKey;
+	let status = false;
+	let statusUrl;
+	let waitPollMs;
+	let waitReceive;
+	let waitReceiveMessageId;
+	let waitReceiveObservedAfter;
+	let waitReceiveText;
+	let waitTimeoutMs;
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === "--help" || arg === "-h") return {
+			help: true,
+			status,
+			...statusUrl ? { statusUrl } : {}
+		};
+		if (arg === "--status") {
+			status = true;
+			continue;
+		}
+		const recoveryArgument = recoveryCli.consume(arg, argv[index + 1]);
+		if (recoveryArgument.handled) {
+			if (recoveryArgument.error) return {
+				error: recoveryArgument.error,
+				help: false,
+				status
+			};
+			index += recoveryArgument.consumed;
+			continue;
+		}
+		if (arg === "--check-config") {
+			checkConfig = true;
+			continue;
+		}
+		if (arg === "--env-file") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--env-file requires a path",
+				help: false,
+				status
+			};
+			envFilePath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--env-file=")) {
+			envFilePath = arg.slice(11);
+			if (!envFilePath) return {
+				error: "--env-file requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--prompt") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--prompt requires text",
+				help: false,
+				status
+			};
+			prompt = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--prompt=")) {
+			prompt = arg.slice(9);
+			if (!prompt) return {
+				error: "--prompt requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--session-key") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--session-key requires a value",
+				help: false,
+				status
+			};
+			sessionKey = value;
+			index += 1;
+			continue;
+		}
+		if (arg === "--print-openclaw-env") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--print-openclaw-env requires a JSON file path",
+				help: false,
+				status
+			};
+			printOpenClawEnvPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--print-openclaw-env=")) {
+			printOpenClawEnvPath = arg.slice(21);
+			if (!printOpenClawEnvPath) return {
+				error: "--print-openclaw-env requires a JSON file path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--pi-api-key-file") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--pi-api-key-file requires a path",
+				help: false,
+				status
+			};
+			piApiKeyFile = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--pi-api-key-file=")) {
+			piApiKeyFile = arg.slice(18);
+			if (!piApiKeyFile) return {
+				error: "--pi-api-key-file requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--replay-feishu-event") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--replay-feishu-event requires a JSON file path",
+				help: false,
+				status
+			};
+			replayFeishuEventPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--replay-feishu-event=")) {
+			replayFeishuEventPath = arg.slice(22);
+			if (!replayFeishuEventPath) return {
+				error: "--replay-feishu-event requires a JSON file path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--replay-feishu-text") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--replay-feishu-text requires text",
+				help: false,
+				status
+			};
+			replayFeishuText = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--replay-feishu-text=")) {
+			replayFeishuText = arg.slice(21);
+			if (!replayFeishuText) return {
+				error: "--replay-feishu-text requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-message-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-message-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayMessageId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-message-id=")) {
+			feishuReplayMessageId = arg.slice(20);
+			if (!feishuReplayMessageId) return {
+				error: "--feishu-message-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-chat-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-chat-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayChatId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-chat-id=")) {
+			feishuReplayChatId = arg.slice(17);
+			if (!feishuReplayChatId) return {
+				error: "--feishu-chat-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-thread-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-thread-id requires a value",
+				help: false,
+				status
+			};
+			feishuReplayThreadId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-thread-id=")) {
+			feishuReplayThreadId = arg.slice(19);
+			if (!feishuReplayThreadId) return {
+				error: "--feishu-thread-id requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--feishu-tenant-key") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--feishu-tenant-key requires a value",
+				help: false,
+				status
+			};
+			feishuReplayTenantKey = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--feishu-tenant-key=")) {
+			feishuReplayTenantKey = arg.slice(20);
+			if (!feishuReplayTenantKey) return {
+				error: "--feishu-tenant-key requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg?.startsWith("--session-key=")) {
+			sessionKey = arg.slice(14);
+			if (!sessionKey) return {
+				error: "--session-key requires a value",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--status-url") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--status-url requires a URL",
+				help: false,
+				status
+			};
+			statusUrl = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--status-url=")) {
+			statusUrl = arg.slice(13);
+			if (!statusUrl) return {
+				error: "--status-url requires a URL",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive") {
+			const parsedWait = parseWaitReceive(argv[index + 1]);
+			if (!parsedWait) return {
+				error: "--wait-receive requires accepted or handled",
+				help: false,
+				status
+			};
+			waitReceive = parsedWait;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive=")) {
+			const parsedWait = parseWaitReceive(arg.slice(15));
+			if (!parsedWait) return {
+				error: "--wait-receive requires accepted or handled",
+				help: false,
+				status
+			};
+			waitReceive = parsedWait;
+			continue;
+		}
+		if (arg === "--wait-receive-text") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--wait-receive-text requires text",
+				help: false,
+				status
+			};
+			waitReceiveText = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-text=")) {
+			waitReceiveText = arg.slice(20);
+			if (!waitReceiveText) return {
+				error: "--wait-receive-text requires text",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive-message-id") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--wait-receive-message-id requires a message id",
+				help: false,
+				status
+			};
+			waitReceiveMessageId = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-message-id=")) {
+			waitReceiveMessageId = arg.slice(26);
+			if (!waitReceiveMessageId) return {
+				error: "--wait-receive-message-id requires a message id",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg === "--wait-receive-observed-after") {
+			const value = parseIsoTimestampArgument(argv[index + 1]);
+			if (!value) return {
+				error: "--wait-receive-observed-after requires an ISO timestamp",
+				help: false,
+				status
+			};
+			waitReceiveObservedAfter = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-receive-observed-after=")) {
+			const value = parseIsoTimestampArgument(arg.slice(30));
+			if (!value) return {
+				error: "--wait-receive-observed-after requires an ISO timestamp",
+				help: false,
+				status
+			};
+			waitReceiveObservedAfter = value;
+			continue;
+		}
+		if (arg === "--wait-timeout-ms") {
+			const parsedMs = parsePositiveIntegerArgument(argv[index + 1]);
+			if (parsedMs === void 0) return {
+				error: "--wait-timeout-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitTimeoutMs = parsedMs;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-timeout-ms=")) {
+			const parsedMs = parsePositiveIntegerArgument(arg.slice(18));
+			if (parsedMs === void 0) return {
+				error: "--wait-timeout-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitTimeoutMs = parsedMs;
+			continue;
+		}
+		if (arg === "--wait-poll-ms") {
+			const parsedMs = parsePositiveIntegerArgument(argv[index + 1]);
+			if (parsedMs === void 0) return {
+				error: "--wait-poll-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitPollMs = parsedMs;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--wait-poll-ms=")) {
+			const parsedMs = parsePositiveIntegerArgument(arg.slice(15));
+			if (parsedMs === void 0) return {
+				error: "--wait-poll-ms requires a positive integer",
+				help: false,
+				status
+			};
+			waitPollMs = parsedMs;
+			continue;
+		}
+		if (arg === "--bootstrap") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--bootstrap requires a module specifier",
+				help: false,
+				status
+			};
+			bootstrap = value;
+			index += 1;
+			continue;
+		}
+		if (arg === "--manifest") {
+			const value = argv[index + 1];
+			if (!value) return {
+				error: "--manifest requires a path",
+				help: false,
+				status
+			};
+			manifestPath = value;
+			index += 1;
+			continue;
+		}
+		if (arg?.startsWith("--manifest=")) {
+			manifestPath = arg.slice(11);
+			if (!manifestPath) return {
+				error: "--manifest requires a path",
+				help: false,
+				status
+			};
+			continue;
+		}
+		if (arg?.startsWith("--bootstrap=")) {
+			bootstrap = arg.slice(12);
+			if (!bootstrap) return {
+				error: "--bootstrap requires a module specifier",
+				help: false,
+				status
+			};
+			continue;
+		}
+		return {
+			error: `Unknown argument: ${arg}`,
+			help: false,
+			status
+		};
+	}
+	if (prompt !== void 0 && status) return {
+		error: "--prompt cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (checkConfig && status) return {
+		error: "--check-config cannot be combined with --status",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && prompt !== void 0) return {
+		error: "--check-config cannot be combined with --prompt",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && replayFeishuEventPath !== void 0) return {
+		error: "--check-config cannot be combined with --replay-feishu-event",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && replayFeishuText !== void 0) return {
+		error: "--check-config cannot be combined with --replay-feishu-text",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && printOpenClawEnvPath !== void 0) return {
+		error: "--check-config cannot be combined with --print-openclaw-env",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (checkConfig && statusUrl) return {
+		error: "--check-config cannot be combined with --status-url",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (prompt !== void 0 && statusUrl) return {
+		error: "--prompt cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && prompt !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && replayFeishuEventPath !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --replay-feishu-event",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && replayFeishuText !== void 0) return {
+		error: "--print-openclaw-env cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && status) return {
+		error: "--print-openclaw-env cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (printOpenClawEnvPath !== void 0 && statusUrl) return {
+		error: "--print-openclaw-env cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (piApiKeyFile !== void 0 && printOpenClawEnvPath === void 0) return {
+		error: "--pi-api-key-file requires --print-openclaw-env",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && prompt !== void 0) return {
+		error: "--replay-feishu-event cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && replayFeishuText !== void 0) return {
+		error: "--replay-feishu-event cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && status) return {
+		error: "--replay-feishu-event cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (replayFeishuEventPath !== void 0 && statusUrl) return {
+		error: "--replay-feishu-event cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && prompt !== void 0) return {
+		error: "--replay-feishu-text cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && status) return {
+		error: "--replay-feishu-text cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (replayFeishuText !== void 0 && statusUrl) return {
+		error: "--replay-feishu-text cannot be combined with --status-url",
+		help: false,
+		status
+	};
+	if (feishuReplayMessageId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-message-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayChatId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-chat-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayThreadId !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-thread-id requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (feishuReplayTenantKey !== void 0 && replayFeishuText === void 0) return {
+		error: "--feishu-tenant-key requires --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (sessionKey !== void 0 && prompt === void 0) return {
+		error: "--session-key requires --prompt",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && status) return {
+		error: "--wait-receive cannot be combined with --status",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && checkConfig) return {
+		error: "--wait-receive cannot be combined with --check-config",
+		help: false,
+		status,
+		checkConfig
+	};
+	if (waitReceive !== void 0 && prompt !== void 0) return {
+		error: "--wait-receive cannot be combined with --prompt",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && replayFeishuEventPath !== void 0) return {
+		error: "--wait-receive cannot be combined with --replay-feishu-event",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && replayFeishuText !== void 0) return {
+		error: "--wait-receive cannot be combined with --replay-feishu-text",
+		help: false,
+		status
+	};
+	if (waitReceive !== void 0 && printOpenClawEnvPath !== void 0) return {
+		error: "--wait-receive cannot be combined with --print-openclaw-env",
+		help: false,
+		status
+	};
+	if (waitTimeoutMs !== void 0 && waitReceive === void 0) return {
+		error: "--wait-timeout-ms requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitPollMs !== void 0 && waitReceive === void 0) return {
+		error: "--wait-poll-ms requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitReceiveText !== void 0 && waitReceive !== "handled") return {
+		error: "--wait-receive-text requires --wait-receive handled",
+		help: false,
+		status
+	};
+	if (waitReceiveMessageId !== void 0 && waitReceive === void 0) return {
+		error: "--wait-receive-message-id requires --wait-receive",
+		help: false,
+		status
+	};
+	if (waitReceiveObservedAfter !== void 0 && waitReceive === void 0) return {
+		error: "--wait-receive-observed-after requires --wait-receive",
+		help: false,
+		status
+	};
+	const recovery = recoveryCli.build();
+	if (recovery.error) return {
+		error: recovery.error,
+		help: false,
+		status
+	};
+	if (recovery.command) {
+		if (!manifestPath) return {
+			error: "Recovery commands require --manifest",
+			help: false,
+			status
+		};
+		if (checkConfig || prompt !== void 0 || printOpenClawEnvPath !== void 0 || replayFeishuEventPath !== void 0 || replayFeishuText !== void 0 || status || statusUrl !== void 0 || waitReceive !== void 0) return {
+			error: "Recovery commands cannot be combined with another one-shot command",
+			help: false,
+			status
+		};
+	}
+	return {
+		...bootstrap ? { bootstrap } : {},
+		checkConfig,
+		...envFilePath ? { envFilePath } : {},
+		...feishuReplayChatId !== void 0 ? { feishuReplayChatId } : {},
+		...feishuReplayMessageId !== void 0 ? { feishuReplayMessageId } : {},
+		...feishuReplayTenantKey !== void 0 ? { feishuReplayTenantKey } : {},
+		...feishuReplayThreadId !== void 0 ? { feishuReplayThreadId } : {},
+		help: false,
+		...manifestPath ? { manifestPath } : {},
+		...piApiKeyFile !== void 0 ? { piApiKeyFile } : {},
+		...prompt !== void 0 ? { prompt } : {},
+		...printOpenClawEnvPath !== void 0 ? { printOpenClawEnvPath } : {},
+		...replayFeishuEventPath !== void 0 ? { replayFeishuEventPath } : {},
+		...replayFeishuText !== void 0 ? { replayFeishuText } : {},
+		...recovery.command ? { recoveryCommand: recovery.command } : {},
+		...sessionKey ? { sessionKey } : {},
+		status,
+		...statusUrl ? { statusUrl } : {},
+		...waitPollMs !== void 0 ? { waitPollMs } : {},
+		...waitReceive !== void 0 ? { waitReceive } : {},
+		...waitReceiveMessageId !== void 0 ? { waitReceiveMessageId } : {},
+		...waitReceiveObservedAfter !== void 0 ? { waitReceiveObservedAfter } : {},
+		...waitReceiveText !== void 0 ? { waitReceiveText } : {},
+		...waitTimeoutMs !== void 0 ? { waitTimeoutMs } : {}
+	};
+}
+function parseWaitReceive(value) {
+	return value === "accepted" || value === "handled" ? value : void 0;
+}
+function parsePositiveIntegerArgument(value) {
+	return value && /^[1-9]\d*$/.test(value) ? Number(value) : void 0;
+}
+function parseIsoTimestampArgument(value) {
+	if (!value) return;
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? void 0 : new Date(time).toISOString();
+}
+//#endregion
+//#region src/adapters/cli/command/rivus-daemon-output.ts
+const RIVUS_DAEMON_STARTED_MESSAGE = "Rivus Agent daemon started\n";
+function formatRivusDaemonUsageError(error) {
+	return `${error}\n\n${RIVUS_DAEMON_USAGE}`;
+}
+function formatRivusDaemonJson(value) {
+	return `${JSON.stringify(value, null, 2)}\n`;
+}
+function formatRivusDaemonLine(text) {
+	return `${text}\n`;
+}
+function formatRivusDaemonWarning(warning) {
+	return `Warning: ${warning}\n`;
+}
+function formatRivusDaemonCapabilityError(capability) {
+	return `${{
+		recovery: "Bootstrap daemon does not expose openRecoveryControl()",
+		status: "Bootstrap daemon does not expose status()",
+		prompt: "Bootstrap daemon does not expose promptText(command)",
+		replay: "Bootstrap daemon does not expose replayReceiveMessage(payload)"
+	}[capability]}\n`;
+}
+function formatRivusDaemonShutdownFailure(signal, error) {
+	return `Failed to stop daemon after ${signal}: ${error}\n`;
+}
+//#endregion
+//#region src/adapters/cli/replay/rivus-daemon-replay.ts
+async function readFeishuReceiveMessagePayload(filePath) {
+	return JSON.parse(await readFile(filePath, "utf8"));
+}
+function createSyntheticFeishuTextReplayPayload(text, options) {
+	return { event: {
+		message: {
+			chat_id: options.chatId ?? "oc_cli",
+			content: JSON.stringify({ text }),
+			message_id: options.messageId ?? `om_cli_${Date.now()}`,
+			message_type: "text",
+			thread_id: options.threadId ?? "omt_cli"
+		},
+		sender: { tenant_key: options.tenantKey ?? "tenant_cli" }
+	} };
+}
+function formatRivusDaemonError(error) {
+	if (error instanceof ReceiveWaitTimeoutError) return `${error.message}\nLast status:\n${JSON.stringify(error.lastStatus, null, 2)}`;
+	return error instanceof Error ? error.message : String(error);
+}
+var ReceiveWaitTimeoutError = class extends Error {
+	target;
+	lastStatus;
+	messageId;
+	observedAfter;
+	text;
+	constructor(target, lastStatus, messageId, observedAfter, text) {
+		super(`Timed out waiting for ${target === "accepted" ? "receive.lastAccepted" : "receive.lastHandled"}${messageId ? ` with message id ${JSON.stringify(messageId)}` : ""}${observedAfter ? ` observed after ${JSON.stringify(observedAfter)}` : ""}${text ? ` containing text ${JSON.stringify(text)}` : ""}`);
+		this.target = target;
+		this.lastStatus = lastStatus;
+		this.messageId = messageId;
+		this.observedAfter = observedAfter;
+		this.text = text;
+		this.name = "ReceiveWaitTimeoutError";
+	}
+};
+async function fetchLiveStatus(url) {
+	const response = await fetch(url, { headers: { accept: "application/json" } });
+	if (!response.ok) throw new Error(`Status request failed with HTTP ${response.status}`);
+	return response.json();
+}
+function waitForReceiveStatus(readStatus, target, options) {
+	return Effect.suspend(() => {
+		const startedAt = Date.now();
+		let lastStatus;
+		const poll = () => readStatus().pipe(Effect.flatMap((status) => {
+			lastStatus = status;
+			if (hasReceiveObservation(status, target, {
+				...options.messageId ? { messageId: options.messageId } : {},
+				...options.observedAfter ? { observedAfter: options.observedAfter } : {},
+				...options.text ? { text: options.text } : {}
+			})) return Effect.succeed(status);
+			if (Date.now() - startedAt >= options.timeoutMs) return Effect.fail(new ReceiveWaitTimeoutError(target, lastStatus, options.messageId, options.observedAfter, options.text));
+			return Effect.sleep(options.pollMs).pipe(Effect.flatMap(poll));
+		}));
+		return poll();
+	});
+}
+function hasReceiveObservation(status, target, criteria) {
+	const receive = isStatusRecord(status) ? status.receive : void 0;
+	if (!isStatusRecord(receive)) return false;
+	if (target === "accepted") {
+		const lastAccepted = receive.lastAccepted;
+		if (!isStatusRecord(lastAccepted)) return false;
+		if (criteria.messageId === void 0) return observedAfterMatches(lastAccepted, criteria.observedAfter);
+		const message = lastAccepted.message;
+		return isStatusRecord(message) && message.messageId === criteria.messageId && observedAfterMatches(lastAccepted, criteria.observedAfter);
+	}
+	const lastHandled = receive.lastHandled;
+	if (!isStatusRecord(lastHandled)) return false;
+	if (criteria.messageId !== void 0 && lastHandled.messageId !== criteria.messageId) return false;
+	if (!observedAfterMatches(lastHandled, criteria.observedAfter)) return false;
+	if (criteria.text === void 0) return true;
+	const intake = lastHandled.intake;
+	return isStatusRecord(intake) && typeof intake.text === "string" && intake.text.includes(criteria.text);
+}
+function isStatusRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function observedAfterMatches(observation, observedAfter) {
+	if (observedAfter === void 0) return true;
+	const observedAtMs = readObservedAtMs(observation.observedAt);
+	return observedAtMs !== void 0 && observedAtMs > Date.parse(observedAfter);
+}
+function readObservedAtMs(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "string") {
+		const time = Date.parse(value);
+		return Number.isNaN(time) ? void 0 : time;
+	}
+}
+//#endregion
+//#region src/platform/daemon/process/rivus-daemon-shutdown-controller.ts
+const DEFAULT_SIGNALS = ["SIGINT", "SIGTERM"];
+function createRivusDaemonShutdownController(options) {
+	let shutdown;
+	const handle = (signal) => {
+		shutdown ??= Effect.runPromise(options.daemon.stop()).then(() => options.onStopped?.(signal)).catch(async (error) => {
+			await options.onError?.(error, signal);
+			throw error;
+		});
+		return shutdown;
+	};
+	return {
+		handle,
+		install: () => {
+			for (const signal of options.signals ?? DEFAULT_SIGNALS) options.signalSource.on(signal, () => {
+				handle(signal);
+			});
+		},
+		stopping: () => shutdown !== void 0
+	};
+}
+//#endregion
+//#region src/adapters/deployment/process/process-deployment-adapters.ts
+function createProcessDeploymentAdapterPorts(factories, runEffect) {
+	return {
+		...factories.createAutomation ? { automationFactory: { create: (input) => adaptAutomationFactory(factories.createAutomation, input, runEffect) } } : {},
+		...factories.createBackgroundSession ? { backgroundSessionFactory: { create: (input) => adaptBackgroundSessionFactory(factories.createBackgroundSession, input, runEffect) } } : {},
+		endpointFactory: { create: (input) => adaptEndpointFactory(factories.createEndpoint, input, runEffect) },
+		runtimeFactory: { create: (input) => Effect.tryPromise({
+			try: () => Promise.resolve(factories.createRuntime(input)),
+			catch: toError$1
+		}).pipe(Effect.map((runtime) => toEffectAgentRuntime(runtime, runEffect))) }
+	};
+}
+function adaptEndpointFactory(create, input, runEffect) {
+	return Effect.tryPromise({
+		try: async () => {
+			return toLifecycleAdapter(await create({
+				agentId: input.agentId,
+				cancel: (request) => runEffect(input.cancel(request)),
+				definition: input.definition,
+				endpointId: input.endpointId,
+				handle: (request) => runEffect(input.handle(toEffectAgentRuntimeInput(request))),
+				instanceId: input.instanceId,
+				...input.projectSpaceId ? { projectSpaceId: input.projectSpaceId } : {},
+				steer: (request) => runEffect(input.steer(request))
+			}));
+		},
+		catch: toError$1
+	});
+}
+function adaptAutomationFactory(create, input, runEffect) {
+	return Effect.tryPromise({
+		try: async () => toLifecycleAdapter(await create({
+			automationId: input.automationId,
+			definition: input.definition,
+			deliveryEndpoint: input.deliveryEndpoint,
+			instanceId: input.instanceId,
+			run: (request) => runEffect(input.run(request))
+		})),
+		catch: toError$1
+	});
+}
+function adaptBackgroundSessionFactory(create, input, runEffect) {
+	return Effect.tryPromise({
+		try: async () => {
+			const adapter = await create({
+				agentIds: input.agentIds,
+				cancel: (request) => runEffect(input.cancel(request)),
+				config: input.config,
+				run: (request) => runEffect(input.run({
+					agentId: request.agentId,
+					invocation: request.invocation,
+					...request.onUpdate ? { onUpdate: (update) => Effect.tryPromise({
+						try: async () => request.onUpdate(update),
+						catch: toError$1
+					}) } : {},
+					sessionKey: request.sessionKey,
+					text: request.text
+				}))
+			});
+			return {
+				...toLifecycleAdapter(adapter),
+				...adapter.status ? { status: () => adapter.status() } : {}
+			};
+		},
+		catch: toError$1
+	});
+}
+function toLifecycleAdapter(adapter) {
+	return {
+		running: () => adapter.running(),
+		start: () => Effect.tryPromise({
+			try: () => Promise.resolve(adapter.start()),
+			catch: toError$1
+		}),
+		stop: () => Effect.tryPromise({
+			try: () => Promise.resolve(adapter.stop()),
+			catch: toError$1
+		})
+	};
+}
+function toError$1(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/bootstrap/deployment/deployment-control-ports.ts
+const agentCatalogRuntime = Object.freeze({
+	digest: createSha256Digest,
+	deepFreeze
+});
+function createProcessDeploymentControlPorts(factories, backgroundSessions, runEffect) {
+	return {
+		agentCatalog: createRivusAgentCatalog([createRivusHostToolDescriptorProvider({ backgroundSessions })], agentCatalogRuntime),
+		agentHostFactory: { create: (input) => {
+			const registry = createEffectAgentInstanceRegistry({
+				createInstanceId: (identity) => createStableId("instance", identity),
+				createRuntimeGenerationId: (identity) => createStableId("generation", identity)
+			}, input.initialInstanceRecords ? { initialRecords: input.initialInstanceRecords } : {});
+			const runtime = createAgentHostRuntimePool(input.runtimeFactory);
+			return createEffectAgentHost({
+				automations: input.automations,
+				backgroundSessions: input.backgroundSessions,
+				definitions: input.definitions,
+				endpoints: input.endpoints,
+				registry,
+				runtime
+			});
+		} },
+		...createProcessDeploymentAdapterPorts(factories, runEffect)
+	};
+}
+//#endregion
+//#region src/core/application/deployment/failure/deployment-failure.ts
+function formatDeploymentFailure(failure) {
+	return failure instanceof Error ? failure.message : String(failure);
+}
+function toDeploymentFailure(failure) {
+	return failure instanceof Error ? failure : new Error(String(failure));
+}
+//#endregion
+//#region src/core/application/deployment/resolution/deployment-resolution.ts
+var RivusPluginLoadError = class extends Error {
+	pluginId;
+	moduleSpecifier;
+	name = "RivusPluginLoadError";
+	constructor(pluginId, moduleSpecifier, message, options) {
+		super(message, options);
+		this.pluginId = pluginId;
+		this.moduleSpecifier = moduleSpecifier;
+	}
+};
+function resolveRivusDeployment(input) {
+	return Effect.gen(function* () {
+		yield* Effect.try({
+			try: () => validateRivusDeploymentManifest(input.manifest),
+			catch: toDeploymentFailure
+		});
+		const catalog = input.agentCatalog.createPluginCatalog();
+		const pluginStatuses = [];
+		const statusByPlugin = /* @__PURE__ */ new Map();
+		for (const declaration of input.manifest.plugins) {
+			const loaded = yield* input.pluginLoader.load({
+				deploymentRoot: input.deploymentRoot,
+				module: declaration.module,
+				pluginId: declaration.id
+			}).pipe(Effect.flatMap((plugin) => Effect.try({
+				try: () => {
+					if (plugin.manifest.id !== declaration.id) throw new Error(`plugin manifest id ${plugin.manifest.id} does not match declaration ${declaration.id}`);
+					catalog.registerPlugin(plugin);
+					return plugin;
+				},
+				catch: toDeploymentFailure
+			})), Effect.either);
+			if (Either.isLeft(loaded)) {
+				const message = formatDeploymentFailure(loaded.left);
+				if (declaration.required) return yield* Effect.fail(new RivusPluginLoadError(declaration.id, declaration.module, `required plugin ${declaration.id} failed to load: ${message}`, { cause: loaded.left }));
+				const status = Object.freeze({
+					error: message,
+					id: declaration.id,
+					module: declaration.module,
+					required: false,
+					status: "failed"
+				});
+				pluginStatuses.push(status);
+				statusByPlugin.set(declaration.id, status);
+				continue;
+			}
+			const status = Object.freeze({
+				id: declaration.id,
+				module: declaration.module,
+				required: declaration.required,
+				status: "loaded",
+				version: loaded.right.manifest.version
+			});
+			pluginStatuses.push(status);
+			statusByPlugin.set(declaration.id, status);
+		}
+		const agentStatuses = [];
+		const definitions = [];
+		for (const agent of input.manifest.agents) {
+			const pluginStatus = statusByPlugin.get(agent.pluginId);
+			if (pluginStatus.status === "failed") {
+				agentStatuses.push(Object.freeze({
+					agentId: agent.agentId,
+					pluginId: agent.pluginId,
+					profileId: agent.profileId,
+					reason: `plugin ${agent.pluginId} is unavailable: ${pluginStatus.error}`,
+					status: "disabled"
+				}));
+				continue;
+			}
+			const resolved = yield* Effect.try({
+				try: () => {
+					const baseDefinition = input.agentCatalog.resolve(catalog, agent);
+					const projectSpace = agent.projectSpaceId ? input.manifest.projectSpaces?.find(({ id }) => id === agent.projectSpaceId) : void 0;
+					return projectSpace ? input.deepFreeze({
+						...baseDefinition,
+						projectSpaceRevision: input.createStableId("project-space-declaration", {
+							id: projectSpace.id,
+							root: projectSpace.root,
+							skills: { sources: projectSpace.skills.sources },
+							workingDirectory: projectSpace.workingDirectory
+						})
+					}) : baseDefinition;
+				},
+				catch: toDeploymentFailure
+			}).pipe(Effect.either);
+			if (Either.isLeft(resolved)) {
+				const declaration = input.manifest.plugins.find(({ id }) => id === agent.pluginId);
+				if (declaration.required) return yield* Effect.fail(new RivusPluginLoadError(declaration.id, declaration.module, `deployment ${agent.agentId} failed to resolve: ${resolved.left.message}`, { cause: resolved.left }));
+				agentStatuses.push(Object.freeze({
+					agentId: agent.agentId,
+					pluginId: agent.pluginId,
+					profileId: agent.profileId,
+					reason: resolved.left.message,
+					status: "disabled"
+				}));
+				continue;
+			}
+			definitions.push(resolved.right);
+			agentStatuses.push(Object.freeze({
+				agentId: agent.agentId,
+				definition: resolved.right,
+				pluginId: agent.pluginId,
+				profileId: agent.profileId,
+				status: "enabled"
+			}));
+		}
+		const agentStatusById = new Map(agentStatuses.map((agent) => [agent.agentId, agent]));
+		const automationTemplates = new Map(catalog.snapshot().automations.map((template) => [template.id, template]));
+		const automationDefinitions = [];
+		for (const automation of input.manifest.automations ?? []) {
+			const agent = agentStatusById.get(automation.agentId);
+			if (!agent || agent.status === "disabled" || !agent.definition) continue;
+			const deliveryEndpoint = input.manifest.endpoints.find(({ id }) => id === automation.delivery.endpointId);
+			const presentationAgent = agentStatusById.get(deliveryEndpoint.agentId);
+			if (!presentationAgent || presentationAgent.status === "disabled" || !presentationAgent.definition) continue;
+			const template = automationTemplates.get(automation.templateId);
+			if (!template) return yield* Effect.fail(/* @__PURE__ */ new Error(`automation ${automation.id} references unknown template: ${automation.templateId}`));
+			if (template.pluginId !== agent.pluginId || template.profileId !== agent.profileId) return yield* Effect.fail(/* @__PURE__ */ new Error(`automation ${automation.id} template is not owned by agent profile ${agent.profileId}`));
+			const definition = yield* Effect.try({
+				try: () => input.deepFreeze({
+					...automation,
+					runtimeDefinition: input.agentCatalog.restrictGrants(agent.definition, {
+						memory: {
+							scopes: [],
+							tool: false
+						},
+						runtimeToolIds: [],
+						skillIds: template.requestedSkillIds,
+						toolIds: template.requestedToolIds
+					}),
+					template
+				}),
+				catch: toDeploymentFailure
+			});
+			automationDefinitions.push(definition);
+		}
+		return Object.freeze({
+			agents: Object.freeze(agentStatuses),
+			automationDefinitions: Object.freeze(automationDefinitions),
+			catalog,
+			definitions: Object.freeze(definitions),
+			manifest: input.manifest,
+			plugins: Object.freeze(pluginStatuses)
+		});
+	});
+}
+//#endregion
+//#region src/core/application/deployment/lifecycle/deployment-lifecycle.ts
+var InvalidDeploymentLifecycleTransition = class extends Error {
+	name = "InvalidDeploymentLifecycleTransition";
+};
+var RivusDeploymentDaemonLifecycleError = class extends Error {
+	name = "RivusDeploymentDaemonLifecycleError";
+};
+const componentTransitions = Object.freeze({
+	"cleanup-required": ["cleanup-required", "stopping"],
+	degraded: ["degraded", "stopping"],
+	disabled: ["disabled"],
+	running: [
+		"degraded",
+		"running",
+		"stopping"
+	],
+	starting: ["degraded", "running"],
+	stopped: ["starting", "stopped"],
+	stopping: [
+		"cleanup-required",
+		"disabled",
+		"stopped"
+	]
+});
+const controlTransitions = Object.freeze({
+	"cleanup-required": ["cleanup-required", "stopping"],
+	degraded: ["degraded", "stopping"],
+	running: [
+		"degraded",
+		"running",
+		"stopping"
+	],
+	starting: ["degraded", "running"],
+	stopped: [
+		"starting",
+		"stopped",
+		"stopping"
+	],
+	stopping: ["cleanup-required", "stopped"]
+});
+function transitionDeploymentComponentLifecycle(current, next) {
+	if (!componentTransitions[current].includes(next)) throw new InvalidDeploymentLifecycleTransition(`cannot transition deployment component from ${current} to ${next}`);
+	return next;
+}
+function transitionDeploymentControlLifecycle(current, next) {
+	if (!controlTransitions[current].includes(next)) throw new InvalidDeploymentLifecycleTransition(`cannot transition Deployment Control from ${current} to ${next}`);
+	return next;
+}
+function isRequiredDeploymentComponentReady(input) {
+	return !input.enabled || !input.required || input.lifecycle === "running" && input.running;
+}
+//#endregion
+//#region src/core/application/deployment/lifecycle/deployment-preparation.ts
+function prepareDeployment(input) {
+	return Effect.gen(function* () {
+		const deployment = input.deployment;
+		if ((deployment.manifest.projectSpaces?.length ?? 0) > 0 && !input.projectSpaceResolver) return yield* Effect.fail(new RivusDeploymentDaemonLifecycleError("deployment bootstrap does not provide a Project Space resolver"));
+		const projectSpaces = /* @__PURE__ */ new Map();
+		for (const declaration of deployment.manifest.projectSpaces ?? []) {
+			const resolved = yield* input.projectSpaceResolver.resolve({
+				declaration,
+				deploymentRoot: input.deploymentRoot
+			}).pipe(Effect.mapError(toDeploymentFailure));
+			projectSpaces.set(resolved.id, resolved);
+		}
+		const definitions = yield* Effect.try({
+			try: () => new Map(deployment.definitions.map((definition) => {
+				const resolved = bindResolvedProjectSpaceRevision(definition, projectSpaces);
+				return [resolved.agentId, resolved];
+			})),
+			catch: toDeploymentFailure
+		});
+		const automationDefinitions = yield* Effect.try({
+			try: () => new Map(deployment.automationDefinitions.map((definition) => [definition.id, Object.freeze({
+				...definition,
+				runtimeDefinition: bindResolvedProjectSpaceRevision(definition.runtimeDefinition, projectSpaces)
+			})])),
+			catch: toDeploymentFailure
+		});
+		const effectiveDeployment = Object.freeze({
+			...deployment,
+			agents: Object.freeze(deployment.agents.map((agent) => {
+				if (!agent.definition) return agent;
+				const definition = definitions.get(agent.agentId);
+				return definition ? Object.freeze({
+					...agent,
+					definition
+				}) : agent;
+			})),
+			automationDefinitions: Object.freeze([...automationDefinitions.values()]),
+			definitions: Object.freeze([...definitions.values()])
+		});
+		const backgroundConfig = deployment.manifest.backgroundSessions;
+		const backgroundDefinitions = /* @__PURE__ */ new Map();
+		if (backgroundConfig?.enabled) for (const agent of effectiveDeployment.agents) {
+			if (agent.status !== "enabled" || !agent.definition) continue;
+			const narrowed = yield* Effect.try({
+				try: () => narrowBackgroundSessionDefinition(definitions.get(agent.agentId), input.digest),
+				catch: toDeploymentFailure
+			});
+			backgroundDefinitions.set(agent.agentId, narrowed);
+		}
+		const agentStatuses = new Map(effectiveDeployment.agents.map((agent) => [agent.agentId, agent]));
+		const endpointSlots = deployment.manifest.endpoints.map((definition) => {
+			return createSlot(definition, agentStatuses.get(definition.agentId)?.status === "enabled");
+		});
+		const automationSlots = (deployment.manifest.automations ?? []).map((definition) => {
+			const agentEnabled = agentStatuses.get(definition.agentId)?.status === "enabled";
+			const resolvedDefinition = automationDefinitions.get(definition.id);
+			return {
+				...createSlot(definition, agentEnabled && resolvedDefinition !== void 0),
+				agentEnabled,
+				...resolvedDefinition ? { resolvedDefinition } : {}
+			};
+		});
+		const backgroundSessionSlot = backgroundConfig ? createSlot(backgroundConfig, backgroundDefinitions.size > 0) : void 0;
+		const host = yield* input.agentHostFactory.create({
+			automations: automationSlots.filter((slot) => slot.definition.enabled && slot.agentEnabled && slot.resolvedDefinition !== void 0).map((slot) => ({
+				definition: slot.resolvedDefinition.runtimeDefinition,
+				id: slot.definition.id
+			})),
+			backgroundSessions: [...backgroundDefinitions].map(([agentId, definition]) => ({
+				agentId,
+				definition
+			})),
+			definitions: [...definitions.values()],
+			endpoints: endpointSlots.filter((slot) => slot.definition.enabled && slot.agentEnabled).map((slot) => ({
+				agentId: slot.definition.agentId,
+				id: slot.definition.id
+			})),
+			...input.initialInstanceRecords ? { initialInstanceRecords: input.initialInstanceRecords } : {},
+			runtimeFactory: { create: (instance) => {
+				const definition = instance.binding.kind === "automation" ? automationDefinitions.get(instance.binding.automationId)?.runtimeDefinition : instance.binding.kind === "background-session" ? backgroundDefinitions.get(instance.agentId) : definitions.get(instance.agentId);
+				if (!definition) return Effect.fail(new RivusDeploymentDaemonLifecycleError(`runtime instance references unknown agent: ${instance.agentId}`));
+				const projectSpace = definition.projectSpaceId ? projectSpaces.get(definition.projectSpaceId) : void 0;
+				return input.runtimeFactory.create({
+					...instance,
+					catalog: effectiveDeployment.catalog,
+					definition,
+					...projectSpace ? { projectSpace } : {}
+				});
+			} }
+		}).pipe(Effect.mapError(toDeploymentFailure));
+		return {
+			automationSlots,
+			...backgroundSessionSlot ? { backgroundSessionSlot } : {},
+			definitions,
+			deployment: effectiveDeployment,
+			endpointSlots,
+			host
+		};
+	});
+}
+function createSlot(definition, agentEnabled) {
+	return {
+		agentEnabled,
+		definition,
+		...!definition.enabled ? { lifecycle: "disabled" } : agentEnabled ? { lifecycle: "stopped" } : {
+			error: "component is unavailable",
+			lifecycle: "degraded"
+		}
+	};
+}
+function bindResolvedProjectSpaceRevision(definition, projectSpaces) {
+	if (!definition.projectSpaceId) return definition;
+	const projectSpace = projectSpaces.get(definition.projectSpaceId);
+	if (!projectSpace) throw new RivusDeploymentDaemonLifecycleError(`agent ${definition.agentId} references unresolved Project Space: ${definition.projectSpaceId}`);
+	return Object.freeze({
+		...definition,
+		projectSpaceRevision: projectSpace.revision
+	});
+}
+//#endregion
+//#region src/core/application/deployment/lifecycle/deployment-control.ts
+var RivusDeploymentReadinessError = class extends Error {
+	endpointIds;
+	name = "RivusDeploymentReadinessError";
+	constructor(endpointIds) {
+		super(`required endpoint startup failed: ${endpointIds.join(", ")}`);
+		this.endpointIds = endpointIds;
+	}
+};
+var RivusDeploymentAutomationReadinessError = class extends Error {
+	automationIds;
+	name = "RivusDeploymentAutomationReadinessError";
+	constructor(automationIds) {
+		super(`required automation startup failed: ${automationIds.join(", ")}`);
+		this.automationIds = automationIds;
+	}
+};
+var RivusDeploymentBackgroundSessionReadinessError = class extends Error {
+	name = "RivusDeploymentBackgroundSessionReadinessError";
+	constructor() {
+		super("required Background Session startup failed");
+	}
+};
+function createRivusDeploymentControl(input) {
+	return Effect.gen(function* () {
+		return makeDeploymentControl({
+			...yield* prepareDeployment(input),
+			...input.automationFactory ? { automationFactory: input.automationFactory } : {},
+			...input.backgroundSessionFactory ? { backgroundSessionFactory: input.backgroundSessionFactory } : {},
+			endpointFactory: input.endpointFactory
+		});
+	});
+}
+function makeDeploymentControl(input) {
+	const endpointById = new Map(input.endpointSlots.map((slot) => [slot.definition.id, slot]));
+	const allSlots = [
+		...input.endpointSlots,
+		...input.automationSlots,
+		...input.backgroundSessionSlot ? [input.backgroundSessionSlot] : []
+	];
+	let lifecycle = "stopped";
+	const refreshObservedState = () => {
+		let degraded = false;
+		for (const slot of allSlots) {
+			if (slot.lifecycle !== "running") continue;
+			const observed = observeRunning(slot);
+			if (!observed.running) {
+				slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "degraded");
+				slot.error = observed.error ?? "component stopped running after startup";
+				degraded = true;
+			}
+		}
+		if (degraded && lifecycle === "running") lifecycle = transitionDeploymentControlLifecycle(lifecycle, "degraded");
+	};
+	const canRunIntake = () => {
+		refreshObservedState();
+		return lifecycle === "running" || lifecycle === "degraded";
+	};
+	const handleEndpoint = (endpointId, request) => Effect.suspend(() => {
+		const slot = endpointById.get(endpointId);
+		if (!slot) return Effect.fail(new RivusDeploymentDaemonLifecycleError(`unknown endpoint: ${endpointId}`));
+		const observed = observeRunning(slot);
+		if (!canRunIntake() || slot.lifecycle !== "running" || !observed.running) return Effect.fail(new RivusDeploymentDaemonLifecycleError(`endpoint ${endpointId} cannot accept intake while Deployment Control is ${lifecycle} and endpoint is ${slot.lifecycle}`));
+		return input.host.handleEndpoint(endpointId, request);
+	});
+	const isReady = () => allSlots.every((slot) => isSlotReady(slot));
+	const readinessFailure = () => {
+		const endpointIds = input.endpointSlots.filter((slot) => slot.definition.enabled && slot.definition.required && !isSlotReady(slot)).map((slot) => slot.definition.id);
+		if (endpointIds.length > 0) return new RivusDeploymentReadinessError(Object.freeze(endpointIds));
+		const automationIds = input.automationSlots.filter((slot) => slot.definition.enabled && slot.definition.required && !isSlotReady(slot)).map((slot) => slot.definition.id);
+		if (automationIds.length > 0) return new RivusDeploymentAutomationReadinessError(Object.freeze(automationIds));
+		if (input.backgroundSessionSlot?.definition.enabled && input.backgroundSessionSlot.definition.required && !isSlotReady(input.backgroundSessionSlot)) return new RivusDeploymentBackgroundSessionReadinessError();
+	};
+	const status = () => {
+		refreshObservedState();
+		return Object.freeze({
+			agents: input.deployment.agents,
+			automations: Object.freeze(input.automationSlots.map((slot) => ({
+				...componentStatus(slot),
+				agentId: slot.definition.agentId,
+				automationId: slot.definition.id
+			}))),
+			...input.backgroundSessionSlot ? { backgroundSessions: backgroundStatus(input.backgroundSessionSlot) } : {},
+			defaultAgentId: input.deployment.manifest.defaultAgentId,
+			defaultEndpointId: input.deployment.manifest.defaultEndpointId,
+			endpoints: Object.freeze(input.endpointSlots.map((slot) => ({
+				...componentStatus(slot),
+				agentId: slot.definition.agentId,
+				endpointId: slot.definition.id
+			}))),
+			lifecycle,
+			plugins: input.deployment.plugins,
+			ready: isReady(),
+			running: lifecycle === "running" || lifecycle === "degraded"
+		});
+	};
+	return {
+		deployment: input.deployment,
+		handleDefault: (request) => handleEndpoint(input.deployment.manifest.defaultEndpointId, request),
+		handleEndpoint,
+		runDefaultAgent: (request) => input.host.handleEndpoint(input.deployment.manifest.defaultEndpointId, request),
+		running: canRunIntake,
+		start: () => Effect.suspend(() => {
+			refreshObservedState();
+			if (lifecycle === "running") return Effect.void;
+			if (lifecycle === "degraded") {
+				const failure = readinessFailure();
+				return failure ? Effect.fail(failure) : Effect.void;
+			}
+			if (lifecycle !== "stopped") return Effect.fail(new RivusDeploymentDaemonLifecycleError(`cannot start deployment daemon while ${lifecycle}`));
+			lifecycle = transitionDeploymentControlLifecycle(lifecycle, "starting");
+			return Effect.gen(function* () {
+				let degraded = input.deployment.plugins.some(({ status: pluginStatus }) => pluginStatus === "failed");
+				for (const slot of input.endpointSlots) degraded = (yield* startSlot(slot, slot.agentEnabled, `endpoint ${slot.definition.id}`, () => Effect.gen(function* () {
+					const instance = yield* input.host.resolveEndpoint(slot.definition.id);
+					return yield* input.endpointFactory.create({
+						agentId: slot.definition.agentId,
+						cancel: (request) => input.host.cancelEndpoint(slot.definition.id, request),
+						definition: slot.definition,
+						endpointId: slot.definition.id,
+						handle: (request) => handleEndpoint(slot.definition.id, request),
+						instanceId: instance.instanceId,
+						...input.definitions.get(slot.definition.agentId)?.projectSpaceId ? { projectSpaceId: input.definitions.get(slot.definition.agentId).projectSpaceId } : {},
+						steer: (request) => input.host.steerEndpoint(slot.definition.id, request)
+					});
+				}))) || degraded;
+				for (const slot of input.automationSlots) {
+					const resolvedDefinition = slot.resolvedDefinition;
+					const deliverySlot = endpointById.get(slot.definition.delivery.endpointId);
+					const deliveryRunning = observeRunning(deliverySlot).running && deliverySlot.lifecycle === "running";
+					degraded = (yield* startSlot(slot, slot.agentEnabled && resolvedDefinition !== void 0 && deliveryRunning, `automation ${slot.definition.id}`, () => Effect.gen(function* () {
+						if (!input.automationFactory) return yield* Effect.fail(new RivusDeploymentDaemonLifecycleError("deployment bootstrap does not provide Automation adapters"));
+						if (!resolvedDefinition) return yield* Effect.fail(new RivusDeploymentDaemonLifecycleError(`automation definition not resolved: ${slot.definition.id}`));
+						const instance = yield* input.host.resolveAutomation(slot.definition.id);
+						return yield* input.automationFactory.create({
+							automationId: slot.definition.id,
+							definition: resolvedDefinition,
+							deliveryEndpoint: deliverySlot.definition,
+							instanceId: instance.instanceId,
+							run: (request) => input.host.handleAutomation(slot.definition.id, {
+								invocation: {
+									allowedActorOpenIds: [],
+									automationId: slot.definition.id,
+									endpointId: slot.definition.delivery.endpointId,
+									kind: "automation",
+									sourceMessageId: request.tickId,
+									tenantKey: "automation",
+									tickId: request.tickId
+								},
+								sessionKey: request.sessionKey,
+								text: request.text
+							})
+						});
+					}))) || degraded;
+				}
+				if (input.backgroundSessionSlot) {
+					const slot = input.backgroundSessionSlot;
+					degraded = (yield* startSlot(slot, slot.agentEnabled, "Background Session", () => Effect.gen(function* () {
+						if (!input.backgroundSessionFactory) return yield* Effect.fail(new RivusDeploymentDaemonLifecycleError("deployment bootstrap does not provide Background Session adapters"));
+						return yield* input.backgroundSessionFactory.create({
+							agentIds: [...input.definitions.keys()].filter((agentId) => input.deployment.agents.some((agent) => agent.agentId === agentId && agent.status === "enabled")),
+							cancel: (request) => input.host.cancelBackgroundSession(request.agentId, request),
+							config: slot.definition,
+							run: (request) => input.host.handleBackgroundSession(request.agentId, {
+								...request.invocation ? { invocation: request.invocation } : {},
+								...request.onUpdate ? { onUpdate: request.onUpdate } : {},
+								sessionKey: request.sessionKey,
+								text: request.text
+							})
+						});
+					}))) || degraded;
+				}
+				lifecycle = transitionDeploymentControlLifecycle(lifecycle, degraded ? "degraded" : "running");
+				const failure = readinessFailure();
+				if (failure) return yield* Effect.fail(failure);
+			});
+		}),
+		status,
+		stop: () => Effect.suspend(() => {
+			if (lifecycle !== "stopped" && lifecycle !== "running" && lifecycle !== "degraded" && lifecycle !== "cleanup-required") return Effect.fail(new RivusDeploymentDaemonLifecycleError(`cannot stop deployment daemon while ${lifecycle}`));
+			lifecycle = transitionDeploymentControlLifecycle(lifecycle, "stopping");
+			return Effect.gen(function* () {
+				const errors = [];
+				yield* stopSlots(input.automationSlots, errors);
+				if (input.backgroundSessionSlot) yield* stopSlots([input.backgroundSessionSlot], errors);
+				yield* stopSlots(input.endpointSlots, errors);
+				const hostExit = yield* Effect.exit(input.host.dispose());
+				if (Exit.isFailure(hostExit)) errors.push(Cause.squash(hostExit.cause));
+				lifecycle = transitionDeploymentControlLifecycle(lifecycle, errors.length === 0 ? "stopped" : "cleanup-required");
+				if (errors.length === 1) return yield* Effect.fail(errors[0]);
+				if (errors.length > 1) return yield* Effect.fail(new AggregateError(errors, "deployment daemon cleanup failed"));
+			});
+		})
+	};
+}
+function startSlot(slot, available, label, create) {
+	return Effect.gen(function* () {
+		if (!slot.definition.enabled) {
+			slot.lifecycle = "disabled";
+			return false;
+		}
+		if (!available) {
+			slot.lifecycle = "degraded";
+			slot.error = `${label} is unavailable`;
+			return true;
+		}
+		if (slot.lifecycle !== "stopped") return yield* Effect.fail(new RivusDeploymentDaemonLifecycleError(`cannot start ${label} while ${slot.lifecycle}`));
+		slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "starting");
+		delete slot.error;
+		const started = yield* Effect.gen(function* () {
+			slot.adapter ??= yield* create();
+			yield* slot.adapter.start();
+			if (!(yield* Effect.try({
+				try: () => slot.adapter.running(),
+				catch: toDeploymentFailure
+			}))) return yield* Effect.fail(/* @__PURE__ */ new Error(`${label} start completed but the adapter is not running`));
+		}).pipe(Effect.exit);
+		if (Exit.isFailure(started)) {
+			slot.error = formatDeploymentFailure(Cause.squash(started.cause));
+			slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "degraded");
+			return true;
+		}
+		slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "running");
+		return false;
+	});
+}
+function stopSlots(slots, errors) {
+	return Effect.gen(function* () {
+		for (const slot of [...slots].reverse()) {
+			if (slot.lifecycle === "stopped" || slot.lifecycle === "disabled") continue;
+			slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "stopping");
+			if (!slot.adapter) {
+				slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, slot.definition.enabled && slot.agentEnabled ? "stopped" : "disabled");
+				delete slot.error;
+				continue;
+			}
+			const stopped = yield* Effect.gen(function* () {
+				yield* slot.adapter.stop();
+				if (yield* Effect.try({
+					try: () => slot.adapter.running(),
+					catch: toDeploymentFailure
+				})) return yield* Effect.fail(/* @__PURE__ */ new Error("component stop completed but the adapter is still running"));
+			}).pipe(Effect.exit);
+			if (Exit.isFailure(stopped)) {
+				const error = Cause.squash(stopped.cause);
+				errors.push(error);
+				slot.error = formatDeploymentFailure(error);
+				slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, "cleanup-required");
+				continue;
+			}
+			slot.lifecycle = transitionDeploymentComponentLifecycle(slot.lifecycle, slot.definition.enabled && slot.agentEnabled ? "stopped" : "disabled");
+			delete slot.error;
+		}
+	});
+}
+function componentStatus(slot) {
+	const observed = observeRunning(slot);
+	return Object.freeze({
+		enabled: slot.definition.enabled,
+		...slot.error ? { error: slot.error } : {},
+		lifecycle: slot.lifecycle,
+		required: slot.definition.required,
+		running: slot.lifecycle === "running" && observed.running
+	});
+}
+function backgroundStatus(slot) {
+	let supervisor;
+	try {
+		supervisor = slot.adapter?.status?.();
+	} catch (error) {
+		slot.error = formatDeploymentFailure(error);
+	}
+	return Object.freeze({
+		...componentStatus(slot),
+		...supervisor ? { supervisor } : {}
+	});
+}
+function isSlotReady(slot) {
+	return isRequiredDeploymentComponentReady({
+		enabled: slot.definition.enabled,
+		lifecycle: slot.lifecycle,
+		required: slot.definition.required,
+		running: observeRunning(slot).running
+	});
+}
+function observeRunning(slot) {
+	if (!slot.adapter) return { running: false };
+	try {
+		return { running: slot.adapter.running() };
+	} catch (error) {
+		return {
+			error: formatDeploymentFailure(error),
+			running: false
+		};
+	}
+}
+//#endregion
+//#region src/adapters/deployment/project-space/node-project-space-resolver.ts
+async function resolveRivusProjectSpace(input) {
+	validateRivusProjectSpaceDeployment(input.declaration);
+	const root = await resolveContainedDirectory(await resolveExistingDirectory(input.deploymentRoot, "deployment root"), input.declaration.root, "Project Space root");
+	const workingDirectory = await resolveContainedDirectory(root, input.declaration.workingDirectory, "Project Space working directory");
+	const skillPaths = await Promise.all(input.declaration.skills.sources.map((source) => resolveContainedPath(root, source, "Project Space Skill source")));
+	await Promise.all(skillPaths.map((path) => assertTreeContainsNoSymbolicLinks(path)));
+	return Object.freeze({
+		id: input.declaration.id,
+		revision: createStableId("project-space", {
+			id: input.declaration.id,
+			root,
+			skillPaths,
+			workingDirectory
+		}),
+		root,
+		skillPaths: Object.freeze(skillPaths),
+		workingDirectory
+	});
+}
+async function assertTreeContainsNoSymbolicLinks(path) {
+	const metadata = await lstat(path);
+	if (metadata.isSymbolicLink()) throw new InvalidRivusProjectSpace(`Project Space Skill source contains a symbolic link: ${path}`);
+	if (!metadata.isDirectory()) return;
+	for (const entry of await readdir(path, { withFileTypes: true })) {
+		const child = resolve(path, entry.name);
+		if (entry.isSymbolicLink()) throw new InvalidRivusProjectSpace(`Project Space Skill source contains a symbolic link: ${child}`);
+		if (entry.isDirectory()) await assertTreeContainsNoSymbolicLinks(child);
+	}
+}
+async function resolveContainedDirectory(base, path, owner) {
+	const resolved = await resolveContainedPath(base, path, owner);
+	if (!(await stat(resolved)).isDirectory()) throw new InvalidRivusProjectSpace(`${owner} must be a directory: ${path}`);
+	return resolved;
+}
+async function resolveContainedPath(base, path, owner) {
+	validateRelativePath(path, owner);
+	const candidate = resolve(base, path);
+	assertContained(base, candidate, owner);
+	let resolved;
+	try {
+		resolved = await realpath(candidate);
+	} catch (cause) {
+		throw new InvalidRivusProjectSpace(`${owner} does not exist: ${path}`, { cause });
+	}
+	assertContained(base, resolved, owner);
+	const metadata = await stat(resolved);
+	if (!metadata.isDirectory() && !metadata.isFile()) throw new InvalidRivusProjectSpace(`${owner} must be a file or directory: ${path}`);
+	return resolved;
+}
+async function resolveExistingDirectory(path, owner) {
+	let resolved;
+	try {
+		resolved = await realpath(path);
+	} catch (cause) {
+		throw new InvalidRivusProjectSpace(`${owner} does not exist`, { cause });
+	}
+	if (!(await stat(resolved)).isDirectory()) throw new InvalidRivusProjectSpace(`${owner} must be a directory`);
+	return resolved;
+}
+function validateRelativePath(path, owner) {
+	if (!path.trim() || path.includes("\0") || isAbsolute(path)) throw new InvalidRivusProjectSpace(`${owner} must be a non-empty relative path`);
+}
+function assertContained(base, candidate, owner) {
+	if (isPathWithin(base, candidate)) return;
+	throw new InvalidRivusProjectSpace(`${owner} escapes its trusted root`);
+}
+//#endregion
+//#region src/adapters/cli/prompt/local-cli-invocation.ts
+function createLocalCliAgentInvocation(input) {
+	const conversationId = trimOptional(input.env.RIVUS_LOCAL_CONVERSATION_ID);
+	return {
+		allowedActorOpenIds: [],
+		endpointId: input.endpointId,
+		kind: "local-cli",
+		memory: {
+			audience: "private",
+			...conversationId ? { conversationId } : {},
+			...input.projectSpaceId ? { projectId: input.projectSpaceId } : {},
+			subjectId: trimOptional(input.env.RIVUS_LOCAL_SUBJECT_ID) ?? "local-operator",
+			tenantId: trimOptional(input.env.RIVUS_MEMORY_TENANT_ID) ?? "local"
+		},
+		sourceMessageId: `cli:${randomUUID()}`,
+		tenantKey: "local"
+	};
+}
+function trimOptional(value) {
+	return value?.trim() || void 0;
+}
+//#endregion
+//#region src/bootstrap/deployment/rivus-deployment-cli-process.ts
+async function createRivusDeploymentCliProcess(factory, context) {
+	const adapters = await factory(context);
+	let adaptersDisposed = false;
+	let recoveryControlPromise;
+	const disposeAdapters = async () => {
+		if (adaptersDisposed) return;
+		adaptersDisposed = true;
+		await adapters.dispose?.();
+	};
+	let daemon;
+	try {
+		daemon = await runDeploymentProcessEffect(loadRivusDeploymentManifest(context.manifestPath).pipe(Effect.flatMap((manifest) => {
+			const assemblyInput = {
+				...createProcessDeploymentControlPorts({
+					...adapters.createAutomation ? { createAutomation: adapters.createAutomation } : {},
+					...adapters.createBackgroundSession ? { createBackgroundSession: adapters.createBackgroundSession } : {},
+					createEndpoint: adapters.createEndpoint,
+					createRuntime: adapters.createRuntime
+				}, manifest.backgroundSessions?.enabled === true, runDeploymentProcessEffect),
+				deploymentRoot: dirname(context.manifestPath),
+				...adapters.initialInstanceRecords ? { initialInstanceRecords: adapters.initialInstanceRecords } : {},
+				manifest,
+				pluginLoader: createNodeRivusPluginModuleLoader(context.pluginPackageManifestPath ? { packageManifestPath: context.pluginPackageManifestPath } : {}),
+				projectSpaceResolver: { resolve: (input) => Effect.tryPromise({
+					try: () => resolveRivusProjectSpace(input),
+					catch: toError
+				}) }
+			};
+			return resolveRivusDeployment({
+				...assemblyInput,
+				createStableId,
+				deepFreeze
+			}).pipe(Effect.flatMap((deployment) => createRivusDeploymentControl({
+				...assemblyInput,
+				deployment,
+				digest: createSha256Digest
+			})));
+		})));
+	} catch (constructionError) {
+		try {
+			await disposeAdapters();
+		} catch (disposeError) {
+			throw new AggregateError([constructionError, disposeError], "deployment construction and cleanup failed");
+		}
+		throw constructionError;
+	}
+	const start = async () => {
+		if (adaptersDisposed) throw new Error("Rivus deployment process cannot restart after its adapters have been disposed");
+		try {
+			await runDeploymentProcessEffect(daemon.start());
+		} catch (startError) {
+			const cleanupErrors = [];
+			try {
+				await runDeploymentProcessEffect(daemon.stop());
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+			try {
+				await disposeAdapters();
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+			if (cleanupErrors.length > 0) throw new AggregateError([startError, ...cleanupErrors], "deployment startup and cleanup failed");
+			throw startError;
+		}
+	};
+	const stop = async () => {
+		const errors = [];
+		try {
+			await runDeploymentProcessEffect(daemon.stop());
+		} catch (error) {
+			errors.push(error);
+		}
+		try {
+			await disposeAdapters();
+		} catch (error) {
+			errors.push(error);
+		}
+		if (errors.length === 1) throw errors[0];
+		if (errors.length > 1) throw new AggregateError(errors, "deployment and adapter cleanup failed");
+	};
+	const process = {
+		defaultSessionKey: `local:${daemon.deployment.manifest.defaultAgentId}:cli`,
+		openRecoveryControl: () => Effect.tryPromise({
+			try: async () => {
+				if (adaptersDisposed) throw new Error("Rivus deployment process cannot open Recovery Control after disposal");
+				if (!adapters.createRecoveryControl) throw new Error("Deployment bootstrap does not expose Recovery Control");
+				recoveryControlPromise ??= Promise.resolve().then(() => adapters.createRecoveryControl());
+				try {
+					return await recoveryControlPromise;
+				} catch (error) {
+					recoveryControlPromise = void 0;
+					throw error;
+				}
+			},
+			catch: (error) => error
+		}),
+		running: () => daemon.running(),
+		start: () => Effect.tryPromise({
+			try: start,
+			catch: (error) => error
+		}),
+		status: () => Effect.sync(() => daemon.status()),
+		stop: () => Effect.tryPromise({
+			try: stop,
+			catch: (error) => error
+		}),
+		promptText: (command) => Effect.tryPromise({
+			try: async () => {
+				if (adaptersDisposed) throw new Error("Rivus deployment process cannot restart after its adapters have been disposed");
+				const projectSpaceId = daemon.deployment.definitions.find(({ agentId }) => agentId === daemon.deployment.manifest.defaultAgentId)?.projectSpaceId;
+				return readPromptFinalText(await runDeploymentProcessEffect(daemon.runDefaultAgent({
+					invocation: createLocalCliAgentInvocation({
+						endpointId: daemon.deployment.manifest.defaultEndpointId,
+						env: context.env,
+						...projectSpaceId ? { projectSpaceId } : {}
+					}),
+					sessionKey: command.sessionKey,
+					text: command.text
+				})));
+			},
+			catch: (error) => error
+		})
+	};
+	const replayReceiveMessage = adapters.replayReceiveMessage;
+	if (replayReceiveMessage) process.replayReceiveMessage = (payload, options) => Effect.tryPromise({
+		try: async () => {
+			if (!daemon.running()) await start();
+		},
+		catch: (error) => error
+	}).pipe(Effect.flatMap(() => replayReceiveMessage((input) => runDeploymentProcessEffect(daemon.handleDefault(toEffectAgentRuntimeInput(input))), payload, options)));
+	return process;
+}
+function readPromptFinalText(result) {
+	if (typeof result === "string") return result;
+	if (typeof result === "object" && result !== null && "finalText" in result && typeof result.finalText === "string") return result.finalText;
+	throw new Error("Default deployment prompt result must be a string or contain finalText");
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/bootstrap/daemon/rivus-daemon-cli.ts
+function runRivusDaemonCli(options) {
+	return Effect.gen(function* () {
+		const parsed = parseRivusDaemonArguments(options.argv);
+		if (parsed.help) {
+			options.stdout.write(RIVUS_DAEMON_USAGE);
+			return 0;
+		}
+		if (parsed.error) {
+			options.stderr.write(formatRivusDaemonUsageError(parsed.error));
+			return 1;
+		}
+		if (parsed.statusUrl) {
+			const statusUrl = parsed.statusUrl;
+			const readStatus = () => Effect.tryPromise({
+				try: () => fetchLiveStatus(statusUrl),
+				catch: (error) => error
+			});
+			const status = parsed.waitReceive ? yield* waitForReceiveStatus(readStatus, parsed.waitReceive, createWaitReceiveOptions(parsed)) : yield* readStatus();
+			options.stdout.write(formatRivusDaemonJson(status));
+			return 0;
+		}
+		if (parsed.printOpenClawEnvPath) {
+			const openClawConfigPath = parsed.printOpenClawEnvPath;
+			const result = yield* Effect.tryPromise({
+				try: () => loadRivusEnvFromOpenClawConfig(openClawConfigPath, parsed.piApiKeyFile),
+				catch: (error) => error
+			});
+			for (const warning of result.warnings) options.stderr.write(formatRivusDaemonWarning(warning));
+			options.stdout.write(formatRivusEnvFile(result.env));
+			return 0;
+		}
+		const env = yield* Effect.tryPromise({
+			try: () => loadCliEnv(parsed.envFilePath, options.env),
+			catch: (error) => error
+		});
+		const configuredBootstrapSpecifier = parsed.bootstrap ?? env.RIVUS_BOOTSTRAP_MODULE?.trim();
+		const bootstrapSpecifier = configuredBootstrapSpecifier ? resolveRivusBuiltinSpecifier(configuredBootstrapSpecifier) : void 0;
+		if (!parsed.checkConfig && !bootstrapSpecifier) {
+			options.stderr.write(formatRivusDaemonUsageError("Missing --bootstrap <module> or RIVUS_BOOTSTRAP_MODULE"));
+			return 1;
+		}
+		let legacyConfig;
+		if (parsed.manifestPath) {
+			if (parsed.checkConfig) {
+				const manifestPath = parsed.manifestPath;
+				const manifest = yield* loadRivusDeploymentManifest(manifestPath);
+				yield* Effect.try({
+					try: () => validateRivusDeploymentManifest(manifest),
+					catch: (error) => error
+				});
+				options.stdout.write(formatRivusDaemonJson(toRedactedDeploymentManifest(manifest)));
+				return 0;
+			}
+		} else {
+			const configExit = yield* Effect.exit(loadRivusDaemonConfig(env));
+			if (configExit._tag === "Failure") {
+				options.stderr.write(formatRivusDaemonLine(configExit.cause.toString()));
+				return 1;
+			}
+			legacyConfig = configExit.value;
+			if (parsed.checkConfig) {
+				options.stdout.write(formatRivusDaemonJson(toRedactedConfig(legacyConfig)));
+				return 0;
+			}
+		}
+		if (!bootstrapSpecifier) {
+			options.stderr.write(formatRivusDaemonUsageError("Missing --bootstrap <module> or RIVUS_BOOTSTRAP_MODULE"));
+			return 1;
+		}
+		const loadBootstrap = options.loadBootstrap ?? ((specifier) => import(specifier));
+		const module = yield* Effect.tryPromise({
+			try: () => loadBootstrap(bootstrapSpecifier),
+			catch: (error) => error
+		});
+		const daemon = yield* Effect.tryPromise({
+			try: () => parsed.manifestPath ? createCliDeploymentDaemon(module.createRivusDeploymentAdapters, {
+				argv: options.argv,
+				env,
+				...parsed.envFilePath ? { envFilePath: parsed.envFilePath } : {},
+				environmentOverrides: options.env,
+				manifestPath: parsed.manifestPath,
+				...options.pluginPackageManifestPath ? { pluginPackageManifestPath: options.pluginPackageManifestPath } : {}
+			}) : createCliLegacyDaemon(module, {
+				argv: options.argv,
+				config: legacyConfig,
+				env
+			}),
+			catch: (error) => error
+		});
+		if (parsed.recoveryCommand) {
+			const recoveryCommand = parsed.recoveryCommand;
+			return yield* runOneShotDaemon(daemon, () => Effect.gen(function* () {
+				if (!hasRecoveryRunner(daemon)) {
+					options.stderr.write(formatRivusDaemonCapabilityError("recovery"));
+					return 1;
+				}
+				const control = yield* daemon.openRecoveryControl();
+				const result = yield* Effect.tryPromise({
+					try: () => runRivusRecoveryCliCommand(control, recoveryCommand),
+					catch: (error) => error
+				});
+				options.stdout.write(formatRivusDaemonJson(result));
+				return 0;
+			}));
+		}
+		if (parsed.status) return yield* runStatusOneShot(options, daemon, (statusDaemon) => Effect.gen(function* () {
+			const status = yield* statusDaemon.status();
+			options.stdout.write(formatRivusDaemonJson(status));
+			return 0;
+		}));
+		if (parsed.prompt !== void 0) {
+			const prompt = parsed.prompt;
+			return yield* runOneShotDaemon(daemon, () => Effect.gen(function* () {
+				if (!hasPromptRunner(daemon)) {
+					options.stderr.write(formatRivusDaemonCapabilityError("prompt"));
+					return 1;
+				}
+				const text = yield* daemon.promptText({
+					sessionKey: parsed.sessionKey ?? daemon.defaultSessionKey ?? `local:${legacyConfig.agentId}:cli`,
+					text: prompt
+				});
+				options.stdout.write(formatRivusDaemonLine(text));
+				return 0;
+			}));
+		}
+		if (parsed.replayFeishuText !== void 0) {
+			const replayFeishuText = parsed.replayFeishuText;
+			return yield* runReplayOneShot(options, daemon, () => Effect.sync(() => createSyntheticFeishuTextReplayPayload(replayFeishuText, {
+				...parsed.feishuReplayChatId !== void 0 ? { chatId: parsed.feishuReplayChatId } : {},
+				...parsed.feishuReplayMessageId !== void 0 ? { messageId: parsed.feishuReplayMessageId } : {},
+				...parsed.feishuReplayTenantKey !== void 0 ? { tenantKey: parsed.feishuReplayTenantKey } : {},
+				...parsed.feishuReplayThreadId !== void 0 ? { threadId: parsed.feishuReplayThreadId } : {}
+			})), { sideEffects: "disabled" });
+		}
+		if (parsed.replayFeishuEventPath !== void 0) {
+			const replayFeishuEventPath = parsed.replayFeishuEventPath;
+			return yield* runReplayOneShot(options, daemon, () => Effect.tryPromise({
+				try: () => readFeishuReceiveMessagePayload(replayFeishuEventPath),
+				catch: (error) => error
+			}));
+		}
+		if (parsed.waitReceive) {
+			const waitReceive = parsed.waitReceive;
+			return yield* runStatusOneShot(options, daemon, (statusDaemon) => Effect.gen(function* () {
+				yield* Effect.try({
+					try: () => installCliShutdownController(options, statusDaemon),
+					catch: (error) => error
+				});
+				yield* statusDaemon.start();
+				const status = yield* waitForReceiveStatus(() => statusDaemon.status(), waitReceive, createWaitReceiveOptions(parsed));
+				options.stdout.write(formatRivusDaemonJson(status));
+				return 0;
+			}));
+		}
+		yield* Effect.try({
+			try: () => installCliShutdownController(options, daemon),
+			catch: (error) => error
+		});
+		yield* daemon.start();
+		options.stdout.write(RIVUS_DAEMON_STARTED_MESSAGE);
+		return 0;
+	}).pipe(Effect.catchAll((error) => Effect.sync(() => {
+		options.stderr.write(formatRivusDaemonLine(formatRivusDaemonError(error)));
+		return 1;
+	})));
+}
+async function createCliLegacyDaemon(module, context) {
+	const factory = module.createRivusDaemonProcess ?? module.default;
+	if (!factory) throw new Error("Bootstrap module must export createRivusDaemonProcess(context) or a default factory");
+	return factory(context);
+}
+async function createCliDeploymentDaemon(factory, context) {
+	if (!factory) throw new Error("Manifest bootstrap module must export createRivusDeploymentAdapters(context)");
+	return createRivusDeploymentCliProcess(factory, context);
+}
+function runOneShotDaemon(daemon, action) {
+	return Effect.exit(Effect.suspend(action)).pipe(Effect.flatMap((exit) => daemon.stop().pipe(Effect.flatMap(() => exit._tag === "Success" ? Effect.succeed(exit.value) : Effect.failCause(exit.cause)))));
+}
+function runStatusOneShot(options, daemon, action) {
+	return runOneShotDaemon(daemon, () => Effect.gen(function* () {
+		if (!hasStatusReporter(daemon)) {
+			options.stderr.write(formatRivusDaemonCapabilityError("status"));
+			return 1;
+		}
+		return yield* action(daemon);
+	}));
+}
+function runReplayOneShot(options, daemon, createPayload, replayOptions) {
+	return runOneShotDaemon(daemon, () => Effect.gen(function* () {
+		if (!hasFeishuReplayRunner(daemon)) {
+			options.stderr.write(formatRivusDaemonCapabilityError("replay"));
+			return 1;
+		}
+		const payload = yield* createPayload();
+		const result = replayOptions === void 0 ? yield* daemon.replayReceiveMessage(payload) : yield* daemon.replayReceiveMessage(payload, replayOptions);
+		options.stdout.write(formatRivusDaemonJson(result));
+		return 0;
+	}));
+}
+function createWaitReceiveOptions(parsed) {
+	return {
+		...parsed.waitReceiveMessageId ? { messageId: parsed.waitReceiveMessageId } : {},
+		...parsed.waitReceiveObservedAfter ? { observedAfter: parsed.waitReceiveObservedAfter } : {},
+		pollMs: parsed.waitPollMs ?? 500,
+		...parsed.waitReceiveText ? { text: parsed.waitReceiveText } : {},
+		timeoutMs: parsed.waitTimeoutMs ?? 3e4
+	};
+}
+function installCliShutdownController(options, daemon) {
+	createRivusDaemonShutdownController({
+		daemon,
+		onError: (error, signal) => {
+			options.stderr.write(formatRivusDaemonShutdownFailure(signal, formatRivusDaemonError(error)));
+			options.exitAfterSignal?.(1);
+		},
+		onStopped: () => {
+			options.exitAfterSignal?.(0);
+		},
+		signalSource: options.signalSource
+	}).install();
+}
+function hasStatusReporter(daemon) {
+	return typeof daemon.status === "function";
+}
+function hasPromptRunner(daemon) {
+	return typeof daemon.promptText === "function";
+}
+function hasFeishuReplayRunner(daemon) {
+	return typeof daemon.replayReceiveMessage === "function";
+}
+function hasRecoveryRunner(daemon) {
+	return typeof daemon.openRecoveryControl === "function";
+}
+//#endregion
+//#region src/bootstrap/cli/rivus-cli.ts
+function runRivusCli(options) {
+	const command = options.argv[0];
+	if (command === "setup") return runSetupCommand(options);
+	if (command === "start") return runHomeDaemonCommand(options, "start", []);
+	if (command === "status") return runHomeDaemonCommand(options, "status", ["--status"]);
+	if (command === "check-config") return runHomeDaemonCommand(options, "check-config", ["--check-config"]);
+	if (command === "init") return runInitCommand(options);
+	if (command === "doctor") return runDoctorCommand(options);
+	if (command === "model") return runModelCommand(options);
+	if (command && !command.startsWith("-")) return Effect.sync(() => {
+		options.stderr.write(renderRivusCliUnknownCommand(command));
+		return 1;
+	});
+	return runRivusDaemonCli(options);
+}
+function runModelCommand(options) {
+	const parsed = parseRivusModelCliArguments(options.argv.slice(1));
+	if ("help" in parsed) return Effect.sync(() => {
+		options.stdout.write(renderRivusModelCliHelp());
+		return 0;
+	});
+	if ("error" in parsed) return Effect.sync(() => {
+		options.stderr.write(renderRivusModelCliArgumentError(parsed.error));
+		return 1;
+	});
+	if (parsed.operation !== "status" && !isRivusModelManagementEnabled(options.env)) return Effect.sync(() => {
+		writeModelResponse(options.stdout, {
+			error: {
+				code: "management_disabled",
+				message: "model management is not enabled for this Home"
+			},
+			schemaVersion: 1,
+			status: "failed"
+		});
+		return 1;
+	});
+	const client = options.modelManagementClient ?? createRivusModelManagementSocketClient({
+		env: options.env,
+		socketPath: resolveRivusModelSocketPath({
+			env: options.env,
+			homeDirectory: options.homeDirectory
+		})
+	});
+	return Effect.tryPromise({
+		try: () => client.execute(parsed),
+		catch: (error) => error
+	}).pipe(Effect.tap((response) => Effect.sync(() => writeModelResponse(options.stdout, response))), Effect.map((response) => modelManagementExitCode(response)), Effect.catchAll((error) => Effect.sync(() => {
+		writeModelResponse(options.stdout, modelTransportFailure(error));
+		return 1;
+	})));
+}
+function modelManagementExitCode(response) {
+	if (response.status !== "failed") return 0;
+	if (typeof response.requestId === "string" && response.requestId.trim()) return 0;
+	const request = response.request;
+	if (typeof request !== "object" || request === null || Array.isArray(request)) return 1;
+	const requestId = request.requestId;
+	return typeof requestId === "string" && requestId.trim() ? 0 : 1;
+}
+function writeModelResponse(stdout, response) {
+	stdout.write(`${JSON.stringify(response)}\n`);
+}
+function modelTransportFailure(error) {
+	const code = error instanceof RivusModelManagementTransportError ? error.code : "socket_error";
+	return {
+		error: {
+			code,
+			message: code === "timeout" ? "model management service timed out" : code === "invalid_response" ? "model management returned an invalid response" : "model management service is unavailable"
+		},
+		schemaVersion: 1,
+		status: "failed"
+	};
+}
+function runSetupCommand(options) {
+	return withOptionalDirectoryArgument(options, "setup", (argument) => resolveHomeDirectoryEffect(options, argument).pipe(Effect.flatMap((directory) => options.homeApi.setup(directory).pipe(Effect.tap(() => Effect.sync(() => options.stdout.write(renderRivusSetupSuccess(directory)))), Effect.as(0))), Effect.catchAll((error) => writeError(options, error))));
+}
+function runHomeDaemonCommand(options, command, daemonArgs) {
+	if (hasRivusHomeCommandArguments(options.argv.slice(1))) return Effect.sync(() => {
+		options.stderr.write(renderRivusHomeCommandUsage(command));
+		return 1;
+	});
+	return resolveHomeDirectoryEffect(options).pipe(Effect.flatMap((directory) => options.homeApi.load(directory)), Effect.tap((home) => Effect.sync(() => options.changeWorkingDirectory(home.workspaceDirectory))), Effect.flatMap((home) => runRivusDaemonCli({
+		...options,
+		argv: [
+			"--env-file",
+			home.envFilePath,
+			"--bootstrap",
+			home.bootstrap,
+			"--manifest",
+			home.manifestPath,
+			...daemonArgs
+		],
+		env: {
+			...options.env,
+			RIVUS_DEPLOYMENT_STATE_DIR: home.stateDirectory,
+			RIVUS_HOME: home.directory
+		},
+		pluginPackageManifestPath: options.pluginPackageManifestPath ?? gatewayPackageManifestPath
+	})), Effect.catchAll((error) => writeError(options, error)));
+}
+function runInitCommand(options) {
+	return withOptionalDirectoryArgument(options, "init", (argument) => {
+		const directory = resolve(options.cwd, argument ?? ".");
+		return Effect.tryPromise({
+			try: () => initializeRivusProject({
+				directory,
+				nodeExecutable: options.nodeExecutable,
+				templateDirectory: gatewayTemplateDirectory
+			}),
+			catch: (error) => error
+		}).pipe(Effect.tap((result) => Effect.sync(() => options.stdout.write(renderRivusProjectInitializationSuccess(result.directory)))), Effect.as(0), Effect.catchAll((error) => writeError(options, error)));
+	});
+}
+function withOptionalDirectoryArgument(options, command, run) {
+	const parsed = parseRivusDirectoryArguments(options.argv.slice(1));
+	if (parsed.help) return Effect.sync(() => {
+		options.stdout.write(renderRivusDirectoryCommandUsage(command));
+		return 0;
+	});
+	if (parsed.error) return Effect.sync(() => {
+		options.stderr.write(renderRivusDirectoryCommandUsage(command));
+		return 1;
+	});
+	return run(parsed.directory);
+}
+function runDoctorCommand(options) {
+	const parsed = parseRivusDoctorArguments(options.argv.slice(1));
+	if (parsed.help) return Effect.sync(() => {
+		options.stdout.write(renderRivusDoctorUsage());
+		return 0;
+	});
+	if (parsed.error) {
+		const error = parsed.error;
+		return Effect.sync(() => {
+			options.stderr.write(renderRivusDoctorArgumentError(error));
+			return 1;
+		});
+	}
+	if (parsed.directory === void 0) return resolveHomeDirectoryEffect(options).pipe(Effect.flatMap((directory) => options.homeApi.diagnose({
+		directory,
+		env: options.env,
+		...parsed.envFilePath ? { envFilePath: parsed.envFilePath } : {},
+		nodeVersion: options.nodeVersion
+	})), Effect.map((report) => writeDoctorReport(options.stdout, report, "Home")), Effect.catchAll((error) => writeError(options, error)));
+	const projectDirectory = parsed.directory;
+	return diagnoseRivusProject({
+		directory: resolve(options.cwd, projectDirectory),
+		env: options.env,
+		...parsed.envFilePath ? { envFilePath: parsed.envFilePath } : {},
+		nodeVersion: options.nodeVersion
+	}).pipe(Effect.map((report) => writeDoctorReport(options.stdout, report, "project")), Effect.catchAll((error) => writeError(options, error)));
+}
+function resolveHomeDirectoryEffect(options, argument) {
+	return Effect.try({
+		try: () => {
+			if (argument) return resolve(options.cwd, argument);
+			const configured = options.env.RIVUS_HOME?.trim();
+			if (!configured) return resolve(options.homeDirectory, ".rivus-agent");
+			if (!isAbsolute(configured)) throw new Error("RIVUS_HOME must be an absolute path");
+			return resolve(configured);
+		},
+		catch: (error) => error instanceof Error ? error : new Error(String(error))
+	});
+}
+function writeDoctorReport(stdout, report, owner) {
+	for (const chunk of renderRivusDoctorReport(report, owner)) stdout.write(chunk);
+	return report.ready ? 0 : 1;
+}
+function writeError(options, error) {
+	return Effect.sync(() => {
+		options.stderr.write(renderRivusCliError(error));
+		return 1;
+	});
+}
+//#endregion
+//#region src/bootstrap/cli/rivus-node-entrypoint.ts
+function runRivusNodeEntrypoint(options) {
+	return runRivusCli({
+		argv: options.argv,
+		changeWorkingDirectory: options.changeWorkingDirectory,
+		cwd: options.cwd,
+		env: options.env,
+		...options.exitAfterSignal !== void 0 ? { exitAfterSignal: options.exitAfterSignal } : {},
+		homeApi: createNodeRivusHome({ deploymentInspector: createRivusHomeDeploymentInspector({ packageManifestPath: gatewayPackageManifestPath }) }),
+		homeDirectory: homedir(),
+		loadBootstrap: (specifier) => import(toImportSpecifier(specifier)),
+		nodeExecutable: process.execPath,
+		nodeVersion: process.versions.node,
+		signalSource: options.signalSource,
+		stderr: options.stderr,
+		stdout: options.stdout
+	});
+}
+function toImportSpecifier(specifier) {
+	if (specifier.startsWith(".") || specifier.startsWith("/")) return pathToFileURL(resolve(specifier)).href;
+	return specifier;
+}
+//#endregion
+export { InvalidRivusPlugin as A, createRivusHostToolDescriptorProvider as C, validateRivusCatalogIdentifier as D, createRivusPluginCatalog as E, InvalidAgentHostBinding as F, createEffectAgentHost as I, AgentInstanceConflict as L, AgentInstanceBusy as M, AgentRuntimeDisposed as N, validateRivusCatalogRegistration as O, createAgentHostRuntimePool as P, createEffectAgentInstanceRegistry as R, initializeRivusProject as S, createRivusToolGrantSetOperations as T, formatRivusEnvFile as _, resolveRivusProjectSpace as a, loadNodeRivusPluginModule as b, RivusDeploymentReadinessError as c, RivusPluginLoadError as d, resolveRivusDeployment as f, createRivusEnvFromOpenClawConfig as g, OpenClawEnvImportError as h, createRivusDeploymentCliProcess as i, RIVUS_PLUGIN_API_VERSION as j, validateRivusPluginManifest as k, createRivusDeploymentControl as l, createRivusDaemonShutdownController as m, runRivusCli as n, RivusDeploymentAutomationReadinessError as o, createProcessDeploymentControlPorts as p, runRivusDaemonCli as r, RivusDeploymentBackgroundSessionReadinessError as s, runRivusNodeEntrypoint as t, RivusDeploymentDaemonLifecycleError as u, diagnoseRivusProject as v, createRivusAgentCatalog as w, resolveRivusPluginModule as x, createNodeRivusPluginModuleLoader as y };