@spinabot/brigade 1.3.2 → 1.4.0

package/dist/agents/channels/channel-security-registry.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Channel-security registry — the process-wide lookup behind "does channel
+ * <id> ship a SUPPLEMENTARY DM-policy / audit opinion?".
+ *
+ * Mirrors `channel-messaging-registry.ts` exactly: a dynamic registration seam
+ * keyed by lowercased channel id, resolved through one process-global singleton
+ * so a hot reload (or CLI + gateway in one process) shares a single slot.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ *  WHAT THIS IS — and what it is NOT
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * The AUTHORITATIVE access-control engine lives in `access-control/*` +
+ * `inbound-pipeline.ts` (store+config allow-from merge, owner bootstrap,
+ * `/start`/`/pending`/`/approve`/`/deny`, the per-message `evaluateAccess`
+ * decision). That engine is NOT replaced by anything here.
+ *
+ * This registry adds the OPTIONAL author-facing `ChannelSecurityAdapter`
+ * surface on TOP of that engine:
+ *
+ *   1. `security.resolveDmPolicy` — a channel plugin MAY register a
+ *      supplementary DM-policy opinion. The pipeline consults it right AFTER
+ *      its own local `resolveDmPolicy(cfg, adapter.id)` read. PRECEDENCE is
+ *      strict: the central config stays authoritative, and a registered
+ *      adapter may only ever TIGHTEN the effective policy (owner-only > allow-
+ *      list > open), NEVER loosen it. See {@link reconcileDmPolicy}.
+ *   2. `security.collectWarnings` / `security.collectAuditFindings` — surfaced
+ *      by {@link collectChannelSecurityAudit} for `brigade doctor`.
+ *
+ * A channel with NO `security` adapter simply never registers; the pipeline's
+ * local policy then stands UNCHANGED, so back-compat is preserved by
+ * construction.
+ */
+import type { DmPolicy } from "./access-control/types.js";
+import type { ChannelSecurityAdapter, ChannelSecurityAuditFinding, ChannelSecurityContext, ChannelSecurityDmPolicy } from "./types.adapters.js";
+/**
+ * Register (or replace) a channel's SUPPLEMENTARY security adapter. The plugin
+ * engine calls this when a channel module that declares `plugin.security`
+ * registers, so the inbound pipeline can consult it as an optional consult on
+ * top of the central access-control engine. Last registration per id wins.
+ * No-ops on an empty/unusable id.
+ */
+export declare function registerChannelSecurityAdapter(channelId: string | null | undefined, adapter: ChannelSecurityAdapter): void;
+/**
+ * Bulk-register every security adapter declared on a plugin list (skipping
+ * plugins that omit the slot). The gateway bootstrap calls this once with its
+ * `bundledChannelPlugins` — parallel to `syncChannelMessagingAdaptersFromPlugins`
+ * — so the pipeline can consult a per-channel security opinion. Plugins WITHOUT
+ * a `security` adapter are simply skipped, leaving the central policy unchanged.
+ */
+export declare function syncChannelSecurityAdaptersFromPlugins(plugins: ReadonlyArray<{
+    id: string;
+    security?: ChannelSecurityAdapter;
+}>): void;
+/**
+ * Drop every dynamically-registered security adapter. PUBLIC — the gateway's
+ * `stopExtensions()` calls this during a `system.reload` teardown so the
+ * registry starts clean and `startExtensions()` re-syncs ONLY the currently-
+ * loaded channels (the sync seam is `.set()`-only and never removes a slot, so
+ * without this a removed/edited channel's security adapter would leak across the
+ * reload and keep TIGHTENING DM policy — a security-relevant stale state).
+ * Idempotent.
+ */
+export declare function clearChannelSecurityRegistry(): void;
+/** Test-only alias of {@link clearChannelSecurityRegistry}. Kept so existing tests don't break. */
+export declare function resetChannelSecurityRegistryForTests(): void;
+/**
+ * Look up a channel's registered security adapter by id (or alias the caller
+ * already normalized). Returns `undefined` when the channel registered none —
+ * the caller then leaves its local policy untouched. Case-insensitive.
+ */
+export declare function getChannelSecurityAdapter(channelId: string | null | undefined): ChannelSecurityAdapter | undefined;
+/** Snapshot the registered (channelId) keys — diagnostics only. */
+export declare function listChannelSecurityAdapters(): string[];
+/**
+ * Tightness rank of a pipeline {@link DmPolicy}: higher = more restrictive.
+ * The ladder the precedence rule compares on.
+ */
+export declare function dmPolicyTightness(policy: DmPolicy): number;
+/**
+ * Translate an author-facing {@link ChannelSecurityDmPolicy} into the pipeline's
+ * {@link DmPolicy} vocabulary. Total over the enum; the mapping is the single
+ * source of truth documented above.
+ */
+export declare function securityDmPolicyToDmPolicy(policy: ChannelSecurityDmPolicy): DmPolicy;
+/**
+ * Reconcile a channel's supplementary security verdict with the central policy.
+ *
+ * PRECEDENCE (the whole point): the central `base` policy is AUTHORITATIVE. A
+ * registered security adapter may only ever TIGHTEN — it returns the more-
+ * restrictive of (base, adapter-opinion) on the tightness ladder. It can NEVER
+ * loosen: an adapter that says "open" while the config says "pairing" is
+ * ignored (the config wins). A `null`/absent opinion ("channel takes no
+ * opinion; defer to the gateway default") leaves `base` exactly as-is.
+ *
+ * @returns the effective `DmPolicy` (always === `base` or strictly tighter).
+ */
+export declare function reconcileDmPolicy(base: DmPolicy, opinion: ChannelSecurityDmPolicy | null | undefined): DmPolicy;
+/**
+ * Consult the channel's registered security adapter (if any) for a DM-policy
+ * opinion and reconcile it with the central `base` policy under the strict
+ * TIGHTEN-ONLY precedence rule. Returns `base` UNCHANGED when no adapter is
+ * registered, the adapter omits `resolveDmPolicy`, it returns `null`, or it
+ * throws — so a channel that doesn't opt in (or a buggy one) leaves the
+ * authoritative policy byte-identical to today. NEVER throws.
+ */
+export declare function consultChannelDmPolicy(params: {
+    channelId: string;
+    base: DmPolicy;
+    ctx: ChannelSecurityContext;
+}): DmPolicy;
+/** One channel's findings, grouped under its id, from {@link collectChannelSecurityAudit}. */
+export interface ChannelSecurityAuditGroup {
+    channelId: string;
+    findings: ChannelSecurityAuditFinding[];
+}
+/**
+ * Iterate every registered security adapter and collect its structured audit
+ * findings (`checkId`/`severity`/`title`/`detail`/`remediation`) plus its
+ * free-text warnings (folded into `info` findings so a single rendering path
+ * covers both). Used by `brigade doctor`'s per-channel security section.
+ *
+ * Total + defensive: an adapter that omits both methods contributes nothing; an
+ * adapter that throws is skipped (its failure can never break `doctor`). The
+ * per-call {@link ChannelSecurityContext} is built from the supplied config +
+ * the ordered account ids the caller resolved.
+ */
+export declare function collectChannelSecurityAudit(params: {
+    /** The Brigade super-config the audit reads (passed through verbatim). */
+    cfg: ChannelSecurityContext["cfg"];
+    /**
+     * Resolve the ordered account ids to audit for a channel. When omitted, the
+     * audit runs once per channel with an empty account scope (`accountId: ""`)
+     * — enough for channels whose findings are config-global.
+     */
+    resolveAccountIds?: (channelId: string) => string[];
+}): Promise<ChannelSecurityAuditGroup[]>;
+//# sourceMappingURL=channel-security-registry.d.ts.map

package/dist/agents/channels/channel-security-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-security-registry.d.ts","sourceRoot":"","sources":["../../../src/agents/channels/channel-security-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,MAAM,qBAAqB,CAAC;AAkB7B;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,sBAAsB,GAC7B,IAAI,CAIN;AAED;;;;;;GAMG;AACH,wBAAgB,sCAAsC,CACrD,OAAO,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAC,GACvE,IAAI,CAIN;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED,mGAAmG;AACnG,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,sBAAsB,GAAG,SAAS,CAIpC;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AA0BD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAW1D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,uBAAuB,GAAG,QAAQ,CAWpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,GACjD,QAAQ,CAKV;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,sBAAsB,CAAC;CAC5B,GAAG,QAAQ,CAYX;AAMD,8FAA8F;AAC9F,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,2BAA2B,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACzD,0EAA0E;IAC1E,GAAG,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACpD,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAiDvC"}

package/dist/agents/channels/channel-security-registry.js

@@ -0,0 +1,265 @@
+/**
+ * Channel-security registry — the process-wide lookup behind "does channel
+ * <id> ship a SUPPLEMENTARY DM-policy / audit opinion?".
+ *
+ * Mirrors `channel-messaging-registry.ts` exactly: a dynamic registration seam
+ * keyed by lowercased channel id, resolved through one process-global singleton
+ * so a hot reload (or CLI + gateway in one process) shares a single slot.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ *  WHAT THIS IS — and what it is NOT
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * The AUTHORITATIVE access-control engine lives in `access-control/*` +
+ * `inbound-pipeline.ts` (store+config allow-from merge, owner bootstrap,
+ * `/start`/`/pending`/`/approve`/`/deny`, the per-message `evaluateAccess`
+ * decision). That engine is NOT replaced by anything here.
+ *
+ * This registry adds the OPTIONAL author-facing `ChannelSecurityAdapter`
+ * surface on TOP of that engine:
+ *
+ *   1. `security.resolveDmPolicy` — a channel plugin MAY register a
+ *      supplementary DM-policy opinion. The pipeline consults it right AFTER
+ *      its own local `resolveDmPolicy(cfg, adapter.id)` read. PRECEDENCE is
+ *      strict: the central config stays authoritative, and a registered
+ *      adapter may only ever TIGHTEN the effective policy (owner-only > allow-
+ *      list > open), NEVER loosen it. See {@link reconcileDmPolicy}.
+ *   2. `security.collectWarnings` / `security.collectAuditFindings` — surfaced
+ *      by {@link collectChannelSecurityAudit} for `brigade doctor`.
+ *
+ * A channel with NO `security` adapter simply never registers; the pipeline's
+ * local policy then stands UNCHANGED, so back-compat is preserved by
+ * construction.
+ */
+import { resolveGlobalSingleton } from "../../shared/global-singleton.js";
+import { normalizeOptionalLowercaseString } from "../../shared/string-coerce.js";
+/** Process-global slot so a hot reload (or CLI+gateway in one process) shares one registry. */
+const REGISTRY_STATE_KEY = Symbol.for("brigade.channelSecurityRegistry.state");
+function createState() {
+    return { byChannelId: new Map() };
+}
+function getState() {
+    return resolveGlobalSingleton(REGISTRY_STATE_KEY, createState);
+}
+/**
+ * Register (or replace) a channel's SUPPLEMENTARY security adapter. The plugin
+ * engine calls this when a channel module that declares `plugin.security`
+ * registers, so the inbound pipeline can consult it as an optional consult on
+ * top of the central access-control engine. Last registration per id wins.
+ * No-ops on an empty/unusable id.
+ */
+export function registerChannelSecurityAdapter(channelId, adapter) {
+    const id = normalizeOptionalLowercaseString(channelId);
+    if (!id)
+        return;
+    getState().byChannelId.set(id, adapter);
+}
+/**
+ * Bulk-register every security adapter declared on a plugin list (skipping
+ * plugins that omit the slot). The gateway bootstrap calls this once with its
+ * `bundledChannelPlugins` — parallel to `syncChannelMessagingAdaptersFromPlugins`
+ * — so the pipeline can consult a per-channel security opinion. Plugins WITHOUT
+ * a `security` adapter are simply skipped, leaving the central policy unchanged.
+ */
+export function syncChannelSecurityAdaptersFromPlugins(plugins) {
+    for (const plugin of plugins) {
+        if (plugin.security)
+            registerChannelSecurityAdapter(plugin.id, plugin.security);
+    }
+}
+/**
+ * Drop every dynamically-registered security adapter. PUBLIC — the gateway's
+ * `stopExtensions()` calls this during a `system.reload` teardown so the
+ * registry starts clean and `startExtensions()` re-syncs ONLY the currently-
+ * loaded channels (the sync seam is `.set()`-only and never removes a slot, so
+ * without this a removed/edited channel's security adapter would leak across the
+ * reload and keep TIGHTENING DM policy — a security-relevant stale state).
+ * Idempotent.
+ */
+export function clearChannelSecurityRegistry() {
+    getState().byChannelId.clear();
+}
+/** Test-only alias of {@link clearChannelSecurityRegistry}. Kept so existing tests don't break. */
+export function resetChannelSecurityRegistryForTests() {
+    clearChannelSecurityRegistry();
+}
+/**
+ * Look up a channel's registered security adapter by id (or alias the caller
+ * already normalized). Returns `undefined` when the channel registered none —
+ * the caller then leaves its local policy untouched. Case-insensitive.
+ */
+export function getChannelSecurityAdapter(channelId) {
+    const key = normalizeOptionalLowercaseString(channelId);
+    if (!key)
+        return undefined;
+    return getState().byChannelId.get(key);
+}
+/** Snapshot the registered (channelId) keys — diagnostics only. */
+export function listChannelSecurityAdapters() {
+    return [...getState().byChannelId.keys()].sort();
+}
+/* -------------------------------------------------------------------------
+ * DM-policy vocabulary reconciliation (the adapter enum ⇄ the pipeline enum)
+ *
+ * The adapter's `ChannelSecurityDmPolicy` is the AUTHOR-FACING vocabulary
+ * ("who may DM this account"); the pipeline's `DmPolicy` is the engine's
+ * vocabulary. They are DIFFERENT alphabets on purpose — a channel author thinks
+ * in "owner / allow-from / all", the engine thinks in "pairing / allowlist /
+ * open / disabled". This module owns the ONE total, documented mapping between
+ * them so neither side has to know the other's words.
+ *
+ * The mapping rides a single TIGHTNESS LADDER (0 = loosest, 3 = tightest):
+ *
+ *   adapter "all"        ⇄ pipeline "open"       — rank 0  (anyone may DM)
+ *   adapter "allow-from" ⇄ pipeline "allowlist"  — rank 1  (only listed senders)
+ *   adapter "owner"      ⇄ pipeline "pairing"    — rank 2  (owner + approved; strangers must pair)
+ *   adapter "disabled"   ⇄ pipeline "disabled"   — rank 3  (every DM dropped)
+ *
+ * `"owner"` maps to `"pairing"` because pairing IS the owner-bootstrap state:
+ * the owner (and anyone they approve) gets in, every stranger is challenged —
+ * i.e. "owner-gated". It is strictly TIGHTER than a static `allowlist` (an
+ * un-approved stranger is challenged, not silently let in by a pre-seeded list)
+ * yet looser than a full `disabled` lockdown.
+ * --------------------------------------------------------------------- */
+/**
+ * Tightness rank of a pipeline {@link DmPolicy}: higher = more restrictive.
+ * The ladder the precedence rule compares on.
+ */
+export function dmPolicyTightness(policy) {
+    switch (policy) {
+        case "open":
+            return 0;
+        case "allowlist":
+            return 1;
+        case "pairing":
+            return 2;
+        case "disabled":
+            return 3;
+    }
+}
+/**
+ * Translate an author-facing {@link ChannelSecurityDmPolicy} into the pipeline's
+ * {@link DmPolicy} vocabulary. Total over the enum; the mapping is the single
+ * source of truth documented above.
+ */
+export function securityDmPolicyToDmPolicy(policy) {
+    switch (policy) {
+        case "all":
+            return "open";
+        case "allow-from":
+            return "allowlist";
+        case "owner":
+            return "pairing";
+        case "disabled":
+            return "disabled";
+    }
+}
+/**
+ * Reconcile a channel's supplementary security verdict with the central policy.
+ *
+ * PRECEDENCE (the whole point): the central `base` policy is AUTHORITATIVE. A
+ * registered security adapter may only ever TIGHTEN — it returns the more-
+ * restrictive of (base, adapter-opinion) on the tightness ladder. It can NEVER
+ * loosen: an adapter that says "open" while the config says "pairing" is
+ * ignored (the config wins). A `null`/absent opinion ("channel takes no
+ * opinion; defer to the gateway default") leaves `base` exactly as-is.
+ *
+ * @returns the effective `DmPolicy` (always === `base` or strictly tighter).
+ */
+export function reconcileDmPolicy(base, opinion) {
+    if (opinion == null)
+        return base;
+    const adapterPolicy = securityDmPolicyToDmPolicy(opinion);
+    // Tighten-only: keep whichever sits higher on the tightness ladder.
+    return dmPolicyTightness(adapterPolicy) > dmPolicyTightness(base) ? adapterPolicy : base;
+}
+/**
+ * Consult the channel's registered security adapter (if any) for a DM-policy
+ * opinion and reconcile it with the central `base` policy under the strict
+ * TIGHTEN-ONLY precedence rule. Returns `base` UNCHANGED when no adapter is
+ * registered, the adapter omits `resolveDmPolicy`, it returns `null`, or it
+ * throws — so a channel that doesn't opt in (or a buggy one) leaves the
+ * authoritative policy byte-identical to today. NEVER throws.
+ */
+export function consultChannelDmPolicy(params) {
+    const { channelId, base, ctx } = params;
+    const adapter = getChannelSecurityAdapter(channelId);
+    if (!adapter || typeof adapter.resolveDmPolicy !== "function")
+        return base;
+    try {
+        const opinion = adapter.resolveDmPolicy(ctx);
+        return reconcileDmPolicy(base, opinion);
+    }
+    catch {
+        // A misbehaving adapter must never break inbound gating — keep the
+        // authoritative central policy.
+        return base;
+    }
+}
+/**
+ * Iterate every registered security adapter and collect its structured audit
+ * findings (`checkId`/`severity`/`title`/`detail`/`remediation`) plus its
+ * free-text warnings (folded into `info` findings so a single rendering path
+ * covers both). Used by `brigade doctor`'s per-channel security section.
+ *
+ * Total + defensive: an adapter that omits both methods contributes nothing; an
+ * adapter that throws is skipped (its failure can never break `doctor`). The
+ * per-call {@link ChannelSecurityContext} is built from the supplied config +
+ * the ordered account ids the caller resolved.
+ */
+export async function collectChannelSecurityAudit(params) {
+    const { cfg, resolveAccountIds } = params;
+    const out = [];
+    for (const channelId of listChannelSecurityAdapters()) {
+        const adapter = getChannelSecurityAdapter(channelId);
+        if (!adapter)
+            continue;
+        const findings = [];
+        const accountIds = resolveAccountIds?.(channelId) ?? [""];
+        const orderedAccountIds = accountIds.length > 0 ? accountIds : [""];
+        for (const accountId of orderedAccountIds) {
+            const ctx = { account: undefined, accountId, cfg };
+            // Structured findings.
+            if (typeof adapter.collectAuditFindings === "function") {
+                try {
+                    const got = await adapter.collectAuditFindings({
+                        ...ctx,
+                        sourceConfig: cfg,
+                        orderedAccountIds,
+                    });
+                    if (Array.isArray(got))
+                        findings.push(...got);
+                }
+                catch {
+                    /* a broken adapter never breaks the audit */
+                }
+            }
+            // Free-text warnings → folded into `info` findings so doctor renders
+            // one shape. Keyed by account so multi-account warnings don't collide.
+            if (typeof adapter.collectWarnings === "function") {
+                try {
+                    const warnings = await adapter.collectWarnings(ctx);
+                    if (Array.isArray(warnings)) {
+                        for (const w of warnings) {
+                            if (typeof w === "string" && w.trim()) {
+                                findings.push({
+                                    checkId: `${channelId}.warning`,
+                                    severity: "warn",
+                                    title: "Channel security warning",
+                                    detail: w.trim(),
+                                });
+                            }
+                        }
+                    }
+                }
+                catch {
+                    /* a broken adapter never breaks the audit */
+                }
+            }
+        }
+        if (findings.length > 0)
+            out.push({ channelId, findings });
+    }
+    return out;
+}
+//# sourceMappingURL=channel-security-registry.js.map

package/dist/agents/channels/channel-security-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-security-registry.js","sourceRoot":"","sources":["../../../src/agents/channels/channel-security-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AASjF,+FAA+F;AAC/F,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAO/E,SAAS,WAAW;IACnB,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ;IAChB,OAAO,sBAAsB,CAA+B,kBAAkB,EAAE,WAAW,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC7C,SAAoC,EACpC,OAA+B;IAE/B,MAAM,EAAE,GAAG,gCAAgC,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,QAAQ,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CACrD,OAAyE;IAEzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ;YAAE,8BAA8B,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjF,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B;IAC3C,QAAQ,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,oCAAoC;IACnD,4BAA4B,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,SAAoC;IAEpC,MAAM,GAAG,GAAG,gCAAgC,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,QAAQ,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,2BAA2B;IAC1C,OAAO,CAAC,GAAG,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;2EAsB2E;AAE3E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IACjD,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,CAAC,CAAC;QACV,KAAK,WAAW;YACf,OAAO,CAAC,CAAC;QACV,KAAK,SAAS;YACb,OAAO,CAAC,CAAC;QACV,KAAK,UAAU;YACd,OAAO,CAAC,CAAC;IACX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA+B;IACzE,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,KAAK;YACT,OAAO,MAAM,CAAC;QACf,KAAK,YAAY;YAChB,OAAO,WAAW,CAAC;QACpB,KAAK,OAAO;YACX,OAAO,SAAS,CAAC;QAClB,KAAK,UAAU;YACd,OAAO,UAAU,CAAC;IACpB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAChC,IAAc,EACd,OAAmD;IAEnD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1D,oEAAoE;IACpE,OAAO,iBAAiB,CAAC,aAAa,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAItC;IACA,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,mEAAmE;QACnE,gCAAgC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MASjD;IACA,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAgC,EAAE,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI,2BAA2B,EAAE,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,QAAQ,GAAkC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,GAAG,GAA2B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YAC3E,uBAAuB;YACvB,IAAI,OAAO,OAAO,CAAC,oBAAoB,KAAK,UAAU,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;wBAC9C,GAAG,GAAG;wBACN,YAAY,EAAE,GAAG;wBACjB,iBAAiB;qBACjB,CAAC,CAAC;oBACH,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACR,6CAA6C;gBAC9C,CAAC;YACF,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;gBACnD,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;oBACpD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;4BAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gCACvC,QAAQ,CAAC,IAAI,CAAC;oCACb,OAAO,EAAE,GAAG,SAAS,UAAU;oCAC/B,QAAQ,EAAE,MAAM;oCAChB,KAAK,EAAE,0BAA0B;oCACjC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;iCAChB,CAAC,CAAC;4BACJ,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;gBAAC,MAAM,CAAC;oBACR,6CAA6C;gBAC9C,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/agents/channels/exposure.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Channel-exposure resolver — turns a channel's `meta.exposure` (+ the legacy
+ * `meta.showConfigured` / `meta.showInSetup` booleans) into a concrete
+ * per-surface visibility verdict.
+ *
+ * Brand-scrubbed analogue of upstream's `src/channels/plugins/exposure.ts`.
+ *
+ * Three surfaces, each an independent boolean that DEFAULTS TO VISIBLE when the
+ * channel says nothing:
+ *
+ *   - `configured` — show in "configured channels" lists (`brigade status`,
+ *     account pickers). Precedence: `exposure.configured` → `showConfigured`
+ *     → `true`.
+ *   - `setup`      — offer in the onboarding / setup wizard. Precedence:
+ *     `exposure.setup` → `showInSetup` → `true`.
+ *   - `docs`       — surface in generated docs / help. Precedence:
+ *     `exposure.docs` → `true`.
+ *
+ * The default-true floor matters: a channel plugin authored without ANY
+ * exposure metadata stays fully visible, so adding this resolver never hides
+ * an existing channel.
+ */
+import type { ChannelMeta } from "./types.core.js";
+/** The subset of `ChannelMeta` the resolver reads. */
+export type ChannelExposureInput = Pick<ChannelMeta, "exposure" | "showConfigured" | "showInSetup">;
+/** Concrete per-surface visibility verdict (every key resolved to a boolean). */
+export interface ResolvedChannelExposure {
+    configured: boolean;
+    setup: boolean;
+    docs: boolean;
+}
+/**
+ * Resolve a channel's exposure to concrete booleans. Pure; safe to call with a
+ * bare `{}` (everything defaults to `true`). Accepts `undefined`/`null` meta
+ * as "all visible" so callers needn't null-guard.
+ */
+export declare function resolveChannelExposure(meta: ChannelExposureInput | undefined | null): ResolvedChannelExposure;
+/** True when the channel should appear in "configured channels" views. */
+export declare function isChannelVisibleInConfiguredLists(meta: ChannelExposureInput | undefined | null): boolean;
+/** True when the channel should be offered in the setup / onboarding wizard. */
+export declare function isChannelVisibleInSetup(meta: ChannelExposureInput | undefined | null): boolean;
+/** True when the channel should be surfaced in generated docs / help. */
+export declare function isChannelVisibleInDocs(meta: ChannelExposureInput | undefined | null): boolean;
+//# sourceMappingURL=exposure.d.ts.map

package/dist/agents/channels/exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.d.ts","sourceRoot":"","sources":["../../../src/agents/channels/exposure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,sDAAsD;AACtD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC,CAAC;AAEpG,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,GAC3C,uBAAuB,CAOzB;AAED,0EAA0E;AAC1E,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,GAC3C,OAAO,CAET;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,GAC3C,OAAO,CAET;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,GAC3C,OAAO,CAET"}

package/dist/agents/channels/exposure.js

@@ -0,0 +1,48 @@
+/**
+ * Channel-exposure resolver — turns a channel's `meta.exposure` (+ the legacy
+ * `meta.showConfigured` / `meta.showInSetup` booleans) into a concrete
+ * per-surface visibility verdict.
+ *
+ * Brand-scrubbed analogue of upstream's `src/channels/plugins/exposure.ts`.
+ *
+ * Three surfaces, each an independent boolean that DEFAULTS TO VISIBLE when the
+ * channel says nothing:
+ *
+ *   - `configured` — show in "configured channels" lists (`brigade status`,
+ *     account pickers). Precedence: `exposure.configured` → `showConfigured`
+ *     → `true`.
+ *   - `setup`      — offer in the onboarding / setup wizard. Precedence:
+ *     `exposure.setup` → `showInSetup` → `true`.
+ *   - `docs`       — surface in generated docs / help. Precedence:
+ *     `exposure.docs` → `true`.
+ *
+ * The default-true floor matters: a channel plugin authored without ANY
+ * exposure metadata stays fully visible, so adding this resolver never hides
+ * an existing channel.
+ */
+/**
+ * Resolve a channel's exposure to concrete booleans. Pure; safe to call with a
+ * bare `{}` (everything defaults to `true`). Accepts `undefined`/`null` meta
+ * as "all visible" so callers needn't null-guard.
+ */
+export function resolveChannelExposure(meta) {
+    const exposure = meta?.exposure;
+    return {
+        configured: exposure?.configured ?? meta?.showConfigured ?? true,
+        setup: exposure?.setup ?? meta?.showInSetup ?? true,
+        docs: exposure?.docs ?? true,
+    };
+}
+/** True when the channel should appear in "configured channels" views. */
+export function isChannelVisibleInConfiguredLists(meta) {
+    return resolveChannelExposure(meta).configured;
+}
+/** True when the channel should be offered in the setup / onboarding wizard. */
+export function isChannelVisibleInSetup(meta) {
+    return resolveChannelExposure(meta).setup;
+}
+/** True when the channel should be surfaced in generated docs / help. */
+export function isChannelVisibleInDocs(meta) {
+    return resolveChannelExposure(meta).docs;
+}
+//# sourceMappingURL=exposure.js.map

package/dist/agents/channels/exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.js","sourceRoot":"","sources":["../../../src/agents/channels/exposure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,IAA6C;IAE7C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,OAAO;QACN,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI;QAChE,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI,EAAE,WAAW,IAAI,IAAI;QACnD,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;KAC5B,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iCAAiC,CAChD,IAA6C;IAE7C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CACtC,IAA6C;IAE7C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CACrC,IAA6C;IAE7C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC"}

package/dist/agents/channels/general-callback.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared convention for GENERAL (agent-attached) inline-button callbacks.
+ *
+ * Approval buttons carry codec payloads the central approval bridge consumes.
+ * GENERAL buttons (attached by the agent via the `message_action` `buttons`
+ * kind) carry an app-defined token namespaced with {@link GENERAL_CALLBACK_PREFIX}
+ * so the inbound pipeline can tell the two apart: it tries the approval bridge
+ * first, and a callback that didn't match an approval but DOES carry the general
+ * prefix is routed through the pipeline as a synthetic turn instead of being
+ * dropped.
+ *
+ * Channel-agnostic on purpose — both the Telegram keyboard builder (which mints
+ * the prefixed `callback_data`) and the pipeline (which decodes it) import from
+ * here so the prefix lives in ONE place.
+ */
+/** Namespace prefix marking a callback as a general (agent-attached) button. */
+export declare const GENERAL_CALLBACK_PREFIX = "g:";
+/** True when a raw `callback_data` value is a general (agent-attached) button. */
+export declare function isGeneralCallbackData(data: string | undefined): boolean;
+/**
+ * Strip the general prefix, returning the app-defined token the agent set.
+ * Returns "" when the input is not a general callback.
+ */
+export declare function decodeGeneralCallbackData(data: string | undefined): string;
+//# sourceMappingURL=general-callback.d.ts.map

package/dist/agents/channels/general-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"general-callback.d.ts","sourceRoot":"","sources":["../../../src/agents/channels/general-callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG1E"}

package/dist/agents/channels/general-callback.js

@@ -0,0 +1,31 @@
+/**
+ * Shared convention for GENERAL (agent-attached) inline-button callbacks.
+ *
+ * Approval buttons carry codec payloads the central approval bridge consumes.
+ * GENERAL buttons (attached by the agent via the `message_action` `buttons`
+ * kind) carry an app-defined token namespaced with {@link GENERAL_CALLBACK_PREFIX}
+ * so the inbound pipeline can tell the two apart: it tries the approval bridge
+ * first, and a callback that didn't match an approval but DOES carry the general
+ * prefix is routed through the pipeline as a synthetic turn instead of being
+ * dropped.
+ *
+ * Channel-agnostic on purpose — both the Telegram keyboard builder (which mints
+ * the prefixed `callback_data`) and the pipeline (which decodes it) import from
+ * here so the prefix lives in ONE place.
+ */
+/** Namespace prefix marking a callback as a general (agent-attached) button. */
+export const GENERAL_CALLBACK_PREFIX = "g:";
+/** True when a raw `callback_data` value is a general (agent-attached) button. */
+export function isGeneralCallbackData(data) {
+    return typeof data === "string" && data.startsWith(GENERAL_CALLBACK_PREFIX);
+}
+/**
+ * Strip the general prefix, returning the app-defined token the agent set.
+ * Returns "" when the input is not a general callback.
+ */
+export function decodeGeneralCallbackData(data) {
+    if (!isGeneralCallbackData(data))
+        return "";
+    return data.slice(GENERAL_CALLBACK_PREFIX.length);
+}
+//# sourceMappingURL=general-callback.js.map

package/dist/agents/channels/general-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"general-callback.js","sourceRoot":"","sources":["../../../src/agents/channels/general-callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC7D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IACjE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAQ,IAAe,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC"}

package/dist/agents/channels/inbound-pipeline.d.ts

@@ -37,6 +37,15 @@ export type RunChannelTurnFn = (args: {
     signal?: AbortSignal;
     senderIsOwner?: boolean;
     channelApprovalRoute?: ChannelApprovalRoute;
+    /**
+     * OPTIONAL live-streaming delta sink. When the pipeline wants progressive
+     * delivery (the adapter advertises `beginReplyStream` AND the channel is
+     * configured to stream), it passes this; the gateway forwards the
+     * accumulating answer text on each model update. Undefined → final-only
+     * delivery (unchanged). The final reply is ALWAYS still returned, so the
+     * non-streaming fallback stays authoritative.
+     */
+    onReplyDelta?: (accumulatedText: string) => void;
 }) => Promise<ChannelTurnResult>;
 /** Pending debounce slot — accumulated text waiting to dispatch. */
 export interface PendingDispatch {

package/dist/agents/channels/inbound-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-pipeline.d.ts","sourceRoot":"","sources":["../../../src/agents/channels/inbound-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7F,OAAO,EACN,KAAK,oBAAoB,EAGzB,MAAM,sBAAsB,CAAC;AA4J9B,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC5C,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEjC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE,oBAAoB,CAAC;CAC3C;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,CA8E9E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAIT;AAED,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B;AA4BD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,GAAG,EAAE,sBAAsB,EAC3B,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,IAAI,CAAC,CA+gBf;AAED,kDAAkD;AAClD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B,GAAG,sBAAsB,CAWzB"}
+{"version":3,"file":"inbound-pipeline.d.ts","sourceRoot":"","sources":["../../../src/agents/channels/inbound-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAoB7F,OAAO,EACN,KAAK,oBAAoB,EAGzB,MAAM,sBAAsB,CAAC;AAsK9B,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEjC,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE,oBAAoB,CAAC;CAC3C;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,CA8J9E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAIT;AAED,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B;AAyCD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,GAAG,EAAE,sBAAsB,EAC3B,GAAG,EAAE,cAAc,GACjB,OAAO,CAAC,IAAI,CAAC,CAwzBf;AAED,kDAAkD;AAClD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B,GAAG,sBAAsB,CAWzB"}