aismemory 0.8.0 → 0.8.3

package/dist/run-pass-mode.js

@@ -0,0 +1,312 @@
+/**
+ * Run-pass auth mode for the aismemory MCP client (CORBOT-662A4B3A).
+ *
+ * A launcher writes the current short-lived pass to AIS_RUN_PASS_FILE and may
+ * rotate that file while this process is running. Every request re-reads the
+ * file and sends exactly one credential header: x-run-pass.
+ */
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { AisHttpError, duplicateMemoryResult } from './ais-http-error.js';
+import { getAisRequestTimeoutMs, toAisRequestError } from './request-timeout.js';
+import { emitTelemetry } from './telemetry.js';
+import { OutOfScopeToolError } from './agent-key-mode.js';
+import { readInboxAndMaybeAck } from './inbox-client.js';
+import { orient } from './cli/orientation.js';
+import { AGENT_ARCHIVE_KEY_MODE_DETAIL } from './agent-archive.js';
+import { fetchCredentialWhoami } from './credential-whoami.js';
+import { parseEmptyToolArgs, parseRecallArgs, parseFullContextArgs, parseRememberArgs, parseGoalCreateArgs, parseGoalListArgs, parseGoalUpdateProgressArgs, parseGoalCompleteArgs, parseInboxSendArgs, parseInboxReadArgs, parseInboxAckArgs, parseHandoffArgs, } from './tool-args.js';
+const AGENT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A valid pass is 50 bytes; anything past this cap is refused unread. */
+const MAX_RUN_PASS_FILE_BYTES = 256;
+const RUN_PASS_PATTERN = /^ais_rp_[A-Za-z0-9_-]{43}$/;
+export class RunPassConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RunPassConfigError';
+    }
+}
+async function readJson(res) {
+    return res.json().catch(() => null);
+}
+export function loadRunPassConfig(env = process.env) {
+    const rawPath = env['AIS_RUN_PASS_FILE'];
+    if (rawPath === undefined)
+        return null;
+    const runPassFile = rawPath.trim();
+    if (runPassFile === '') {
+        throw new RunPassConfigError('AIS_RUN_PASS_FILE is set but empty. Refusing to start run-pass mode.');
+    }
+    const agentId = env['AIS_AGENT_ID']?.trim();
+    if (!agentId) {
+        throw new RunPassConfigError('AIS_RUN_PASS_FILE is set but AIS_AGENT_ID is missing. ' +
+            'Run-pass mode needs the one agent this pass is scoped to.');
+    }
+    if (!AGENT_ID_PATTERN.test(agentId)) {
+        throw new RunPassConfigError('AIS_AGENT_ID is not a UUID. Refusing to start run-pass mode.');
+    }
+    return { runPassFile, agentId };
+}
+function assertSafeRunPassFile(runPassFile, st) {
+    if (!st.isFile()) {
+        throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} is not a regular file.`);
+    }
+    if (typeof process.getuid === 'function' && st.uid !== process.getuid()) {
+        throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} is not owned by the current user.`);
+    }
+    if ((st.mode & 0o077) !== 0) {
+        throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} is accessible to group or others (chmod 600).`);
+    }
+}
+async function readBoundedRunPassFile(runPassFile) {
+    // lstat first so a symlink, FIFO, or device is refused before it is opened.
+    assertSafeRunPassFile(runPassFile, await lstat(runPassFile));
+    // O_NOFOLLOW/O_NONBLOCK close the swap-after-lstat race; fstat re-checks the opened inode.
+    const handle = await open(runPassFile, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        assertSafeRunPassFile(runPassFile, await handle.stat());
+        const buffer = Buffer.alloc(MAX_RUN_PASS_FILE_BYTES + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        if (bytesRead > MAX_RUN_PASS_FILE_BYTES) {
+            throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} exceeds ${MAX_RUN_PASS_FILE_BYTES} bytes.`);
+        }
+        return buffer.toString('utf8', 0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readRunPassFile(runPassFile) {
+    let raw;
+    try {
+        raw = await readBoundedRunPassFile(runPassFile);
+    }
+    catch (error) {
+        if (error instanceof RunPassConfigError)
+            throw error;
+        const reason = error instanceof Error ? error.message : 'unknown read error';
+        throw new RunPassConfigError(`Refusing AIS request: cannot read AIS_RUN_PASS_FILE at ${runPassFile}: ${reason}`);
+    }
+    const runPass = raw.trim();
+    if (runPass.length === 0) {
+        throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} is empty.`);
+    }
+    if (!RUN_PASS_PATTERN.test(runPass)) {
+        throw new RunPassConfigError(`Refusing AIS request: AIS_RUN_PASS_FILE at ${runPassFile} does not contain a valid ais_rp_ run pass.`);
+    }
+    return runPass;
+}
+async function runPassHeaders(runPassFile, includeContentType) {
+    const runPass = await readRunPassFile(runPassFile);
+    return {
+        ...(includeContentType ? { 'Content-Type': 'application/json' } : {}),
+        'x-run-pass': runPass,
+    };
+}
+export async function runPassPost(aisUrl, path, runPassFile, body, fetchImpl = globalThis.fetch) {
+    const headers = await runPassHeaders(runPassFile, true);
+    const timeoutMs = getAisRequestTimeoutMs();
+    let res;
+    try {
+        res = await fetchImpl(`${aisUrl}${path}`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (err) {
+        const wrapped = toAisRequestError(err, path, timeoutMs);
+        emitTelemetry({ event: 'ais.http.failure', path, error: wrapped instanceof Error ? wrapped.message : String(wrapped) });
+        throw wrapped;
+    }
+    const data = await readJson(res);
+    if (!res.ok) {
+        emitTelemetry({ event: 'ais.http.failure', path, httpStatus: res.status, error: `HTTP ${res.status}` });
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+export async function runPassGet(aisUrl, path, runPassFile, fetchImpl = globalThis.fetch) {
+    const headers = await runPassHeaders(runPassFile, false);
+    const timeoutMs = getAisRequestTimeoutMs();
+    let res;
+    try {
+        res = await fetchImpl(`${aisUrl}${path}`, {
+            headers,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (err) {
+        const wrapped = toAisRequestError(err, path, timeoutMs);
+        emitTelemetry({ event: 'ais.http.failure', path, error: wrapped instanceof Error ? wrapped.message : String(wrapped) });
+        throw wrapped;
+    }
+    const data = await readJson(res);
+    if (!res.ok) {
+        emitTelemetry({ event: 'ais.http.failure', path, httpStatus: res.status, error: `HTTP ${res.status}` });
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+export async function runPassPatch(aisUrl, path, runPassFile, body, fetchImpl = globalThis.fetch) {
+    const headers = await runPassHeaders(runPassFile, true);
+    const timeoutMs = getAisRequestTimeoutMs();
+    let res;
+    try {
+        res = await fetchImpl(`${aisUrl}${path}`, {
+            method: 'PATCH',
+            headers,
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (err) {
+        const wrapped = toAisRequestError(err, path, timeoutMs);
+        emitTelemetry({ event: 'ais.http.failure', path, error: wrapped instanceof Error ? wrapped.message : String(wrapped) });
+        throw wrapped;
+    }
+    const data = await readJson(res);
+    if (!res.ok) {
+        emitTelemetry({ event: 'ais.http.failure', path, httpStatus: res.status, error: `HTTP ${res.status}` });
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+export const UNKNOWN_TOOL_RUN_PASS_MODE = Symbol('unknown-tool-run-pass-mode');
+export async function dispatchToolRunPassMode(aisUrl, config, name, rawArgs, fetchImpl = globalThis.fetch) {
+    const { agentId, runPassFile } = config;
+    switch (name) {
+        case 'remember': {
+            const args = parseRememberArgs(rawArgs);
+            try {
+                return await runPassPost(aisUrl, `/v1/agents/${agentId}/memory`, runPassFile, {
+                    content: args.content,
+                    type: args.type,
+                    importance: args.importance,
+                    ...(args.tags !== undefined && { tags: args.tags }),
+                }, fetchImpl);
+            }
+            catch (err) {
+                const duplicate = duplicateMemoryResult(err);
+                if (duplicate)
+                    return duplicate;
+                throw err;
+            }
+        }
+        case 'recall': {
+            const args = parseRecallArgs(rawArgs);
+            const params = new URLSearchParams();
+            params.set('query', args.query);
+            if (args.limit !== undefined)
+                params.set('limit', String(args.limit));
+            if (args.type !== undefined)
+                params.set('types', args.type);
+            if (args.tags !== undefined && args.tags.length > 0)
+                params.set('tags', args.tags.join(','));
+            if (args.principalAgentId !== undefined)
+                params.set('principalAgentId', args.principalAgentId);
+            return runPassGet(aisUrl, `/v1/agents/${agentId}/memory?${params}`, runPassFile, fetchImpl);
+        }
+        case 'full_context': {
+            const fcArgs = parseFullContextArgs(rawArgs);
+            const fcParams = new URLSearchParams();
+            if (fcArgs.principalAgentId !== undefined)
+                fcParams.set('principalAgentId', fcArgs.principalAgentId);
+            if (fcArgs.memoriesLimit !== undefined)
+                fcParams.set('memoriesLimit', String(fcArgs.memoriesLimit));
+            if (fcArgs.view !== undefined)
+                fcParams.set('view', fcArgs.view);
+            if (fcArgs.maxTokens !== undefined)
+                fcParams.set('maxTokens', String(fcArgs.maxTokens));
+            const fcQs = fcParams.toString();
+            return runPassGet(aisUrl, `/v1/agents/${agentId}/full-context${fcQs ? `?${fcQs}` : ''}`, runPassFile, fetchImpl);
+        }
+        case 'dream':
+            parseEmptyToolArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/dream`, runPassFile, {}, fetchImpl);
+        case 'whoami':
+            parseEmptyToolArgs(rawArgs);
+            return fetchCredentialWhoami(agentId, 'run-pass', () => runPassGet(aisUrl, `/v1/agents/${agentId}/whoami`, runPassFile, fetchImpl), () => runPassGet(aisUrl, `/v1/agents/${agentId}/memory?limit=1`, runPassFile, fetchImpl));
+        case 'orientation_check':
+            return orient(rawArgs);
+        case 'agent_load':
+            throw new OutOfScopeToolError(name, 'Run passes are scoped to one agent for one run; start a new run pass for another agent.');
+        case 'goal_create': {
+            const args = parseGoalCreateArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/goals`, runPassFile, {
+                title: args.title,
+                description: args.description,
+                ...(args.successCriteria !== undefined ? { successCriteria: args.successCriteria } : {}),
+                ...(args.parentGoalId !== undefined ? { parentGoalId: args.parentGoalId } : {}),
+            }, fetchImpl);
+        }
+        case 'goal_list': {
+            const args = parseGoalListArgs(rawArgs);
+            const params = new URLSearchParams();
+            if (args.status !== undefined)
+                params.set('status', args.status);
+            if (args.page !== undefined)
+                params.set('page', String(args.page));
+            params.set('limit', String(args.limit));
+            if (args.parentGoalId !== undefined)
+                params.set('parentGoalId', args.parentGoalId);
+            return runPassGet(aisUrl, `/v1/agents/${agentId}/goals?${params}`, runPassFile, fetchImpl);
+        }
+        case 'goal_update_progress': {
+            const args = parseGoalUpdateProgressArgs(rawArgs);
+            return runPassPatch(aisUrl, `/v1/agents/${agentId}/goals/${args.goalId}`, runPassFile, {
+                progress: args.progress,
+            }, fetchImpl);
+        }
+        case 'goal_complete': {
+            const args = parseGoalCompleteArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/goals/${args.goalId}/complete`, runPassFile, {
+                success: args.success,
+                ...(args.notes !== undefined ? { notes: args.notes } : {}),
+                ...(args.lessonsLearned !== undefined ? { lessonsLearned: args.lessonsLearned } : {}),
+            }, fetchImpl);
+        }
+        case 'inbox_send': {
+            const args = parseInboxSendArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/inbox`, runPassFile, {
+                recipientAgentId: args.recipientAgentId,
+                kind: args.kind,
+                body: args.body,
+                ...(args.threadId !== undefined ? { threadId: args.threadId } : {}),
+                ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                ...(args.inReplyTo !== undefined ? { inReplyTo: args.inReplyTo } : {}),
+                ...(args.messageId !== undefined ? { messageId: args.messageId } : {}),
+                ...(args.ttlSeconds !== undefined ? { ttlSeconds: args.ttlSeconds } : {}),
+            }, fetchImpl);
+        }
+        case 'inbox_read': {
+            const args = parseInboxReadArgs(rawArgs);
+            const params = new URLSearchParams();
+            if (args.cursor !== undefined)
+                params.set('cursor', args.cursor);
+            params.set('limit', String(args.limit));
+            params.set('unreadOnly', String(args.unreadOnly));
+            return readInboxAndMaybeAck(args, () => runPassGet(aisUrl, `/v1/agents/${agentId}/inbox?${params}`, runPassFile, fetchImpl), (messageIds) => runPassPost(aisUrl, `/v1/agents/${agentId}/inbox/ack`, runPassFile, { messageIds }, fetchImpl));
+        }
+        case 'inbox_ack': {
+            const args = parseInboxAckArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/inbox/ack`, runPassFile, { messageIds: args.messageIds }, fetchImpl);
+        }
+        case 'handoff': {
+            const args = parseHandoffArgs(rawArgs);
+            return runPassPost(aisUrl, `/v1/agents/${agentId}/handoff`, runPassFile, {
+                ...(args.summary !== undefined ? { summary: args.summary } : {}),
+                ...(args.keyLearnings !== undefined ? { keyLearnings: args.keyLearnings } : {}),
+                ...(args.docPath !== undefined ? { docPath: args.docPath } : {}),
+                ...(args.docPrUrl !== undefined ? { docPrUrl: args.docPrUrl } : {}),
+            }, fetchImpl);
+        }
+        case 'agent_archive':
+        case 'agent_delete':
+            throw new OutOfScopeToolError(name, AGENT_ARCHIVE_KEY_MODE_DETAIL);
+        default:
+            return UNKNOWN_TOOL_RUN_PASS_MODE;
+    }
+}
+//# sourceMappingURL=run-pass-mode.js.map

package/dist/run-pass-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-pass-mode.js","sourceRoot":"","sources":["../src/run-pass-mode.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,gBAAgB,GAAG,iEAAiE,CAAC;AAC3F,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAOtD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAID,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,sEAAsE,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,wDAAwD;YACtD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,8DAA8D,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAQD,SAAS,qBAAqB,CAAC,WAAmB,EAAE,EAAmB;IACrE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,WAAW,yBAAyB,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,WAAW,oCAAoC,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,WAAW,gDAAgD,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IACvD,4EAA4E;IAC5E,qBAAqB,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzG,IAAI,CAAC;QACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,SAAS,GAAG,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,WAAW,YAAY,uBAAuB,SAAS,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC7E,MAAM,IAAI,kBAAkB,CAAC,0DAA0D,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,WAAW,YAAY,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,WAAW,6CAA6C,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,kBAA2B;IAC5E,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAY,EACZ,WAAmB,EACnB,IAAa,EACb,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACxD,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxH,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,WAAmB,EACnB,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YACxC,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACxD,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxH,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAY,EACZ,WAAmB,EACnB,IAAa,EACb,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YACxC,MAAM,EAAE,OAAO;YACf,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACxD,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxH,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,MAAqB,EACrB,IAAY,EACZ,OAAgB,EAChB,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAExC,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,SAAS,EAAE,WAAW,EAAE;oBAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACpD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;gBAChC,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC/F,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,WAAW,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9F,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACrG,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YACpG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,gBAAgB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnH,CAAC;QAED,KAAK,OAAO;YACV,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAExF,KAAK,QAAQ;YACX,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,qBAAqB,CAC1B,OAAO,EACP,UAAU,EACV,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAChF,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,CACzF,CAAC;QAEJ,KAAK,mBAAmB;YACtB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzB,KAAK,YAAY;YACf,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,yFAAyF,CAAC,CAAC;QAEjI,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,WAAW,EAAE;gBACrE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACnF,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7F,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,YAAY,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE;gBACrF,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,IAAI,CAAC,MAAM,WAAW,EAAE,WAAW,EAAE;gBAC7F,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,WAAW,EAAE;gBACrE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,OAAO,oBAAoB,CACzB,IAAI,EACJ,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EACzF,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,YAAY,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,CAC/G,CAAC;QACJ,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,YAAY,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;QACzH,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,EAAE,WAAW,EAAE;gBACvE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAErE;YACE,OAAO,0BAA0B,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/session-identity.d.ts

@@ -9,6 +9,20 @@ declare const sessionIdentitySchema: z.ZodObject<{
 }, z.core.$strict>;
 export type SessionIdentity = z.infer<typeof sessionIdentitySchema>;
 export declare const IDENTITY_REPAIR = "Set AIS_AGENT_ID for THIS session only \u2014 export it in the shell that launches aismemory, or set it in the env block of this session's own MCP config \u2014 then restart the session and run aismemory doctor. Switch agents inside a session with agent_load. Never pin a machine, install or harness to one agent; other sessions on this machine run as other agents.";
+export declare const RECENT_IDENTITY_CONFIRMATION_TTL_MS: number;
+export declare const WHOAMI_RETRY_BACKOFF_MS: readonly [250, 500];
+type Clock = () => number;
+type Sleep = (ms: number) => Promise<void>;
+export interface VerifyPinnedIdentityOptions {
+    /** Identifies the credential without storing the secret itself. */
+    credentialKey: string;
+    /** Switch and doctor checks must ask AIS and may not accept cached proof. */
+    freshOnly?: boolean;
+    clock?: Clock;
+    sleep?: Sleep;
+}
+export declare function identityCredentialFingerprint(kind: string, credential: string): string;
+export declare function clearPinnedIdentityConfirmation(pin: SessionIdentity | null, credentialKey?: string): void;
 /**
  * Lists leftover per-harness manifest files from the removed machine-wide pin.
  * They are read by nothing; doctor only reports them so a human can delete
@@ -21,6 +35,6 @@ export declare function loadSessionIdentity(env?: NodeJS.ProcessEnv): SessionIde
 export declare function switchedTo(previous: SessionIdentity, agentId: string): SessionIdentity;
 export declare function assertPinnedAgent(pin: SessionIdentity | null, agentId: string): void;
 /** Verify the same whoami response exposed by the selected auth adapter, before every mutation. */
-export declare function verifyPinnedIdentity(pin: SessionIdentity | null, agentId: string, whoami: () => Promise<unknown>): Promise<void>;
+export declare function verifyPinnedIdentity(pin: SessionIdentity | null, agentId: string, whoami: () => Promise<unknown>, options: VerifyPinnedIdentityOptions): Promise<void>;
 export declare function requiresIdentityGate(name: string, args: Record<string, unknown>): boolean;
 export {};

package/dist/session-identity.js

@@ -13,9 +13,12 @@
  * never reads shared per-machine state.
  */
 import { readdirSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
+import { AisHttpError } from './ais-http-error.js';
+import { AisRequestTimeoutError } from './request-timeout.js';
 const sessionIdentitySchema = z.object({
     version: z.literal(1),
     /** How this session's identity was selected. */
@@ -25,6 +28,78 @@ const sessionIdentitySchema = z.object({
 export const IDENTITY_REPAIR = 'Set AIS_AGENT_ID for THIS session only — export it in the shell that launches aismemory, or set it in the env block of this session\'s own MCP config — then restart the session and run aismemory doctor. Switch agents inside a session with agent_load. Never pin a machine, install or harness to one agent; other sessions on this machine run as other agents.';
 /** The directory the removed per-harness manifest pin used to write to. */
 const LEGACY_HARNESS_DIR = ['.aismemory', 'harnesses'];
+export const RECENT_IDENTITY_CONFIRMATION_TTL_MS = 5 * 60 * 1000;
+export const WHOAMI_RETRY_BACKOFF_MS = [250, 500];
+const confirmations = new Map();
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function confirmationKey(agentId, credentialKey) {
+    return `${agentId}\n${credentialKey}`;
+}
+function clearConfirmationsForAgent(agentId) {
+    for (const key of Array.from(confirmations.keys())) {
+        if (key.startsWith(`${agentId}\n`))
+            confirmations.delete(key);
+    }
+}
+function rememberConfirmation(agentId, credentialKey, confirmedAtMs) {
+    confirmations.set(confirmationKey(agentId, credentialKey), { confirmedAtMs });
+}
+function hasRecentConfirmation(agentId, credentialKey, nowMs) {
+    const confirmation = confirmations.get(confirmationKey(agentId, credentialKey));
+    if (confirmation === undefined)
+        return false;
+    const ageMs = nowMs - confirmation.confirmedAtMs;
+    return ageMs >= 0 && ageMs < RECENT_IDENTITY_CONFIRMATION_TTL_MS;
+}
+const NETWORK_ERROR_CODES = new Set([
+    'ECONNRESET', 'ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN', 'ETIMEDOUT', 'EPIPE',
+    'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT', 'UND_ERR_BODY_TIMEOUT',
+    'UND_ERR_SOCKET', 'UND_ERR_CLOSED', 'UND_ERR_DESTROYED',
+]);
+function hasNetworkErrorCode(error) {
+    if (!(error instanceof Error))
+        return false;
+    const code = error.code;
+    return typeof code === 'string' && NETWORK_ERROR_CODES.has(code);
+}
+function isFetchNetworkError(error) {
+    if (!(error instanceof TypeError))
+        return false;
+    const cause = error.cause;
+    // AggregateError extends Error, so test it before the generic cause check.
+    if (cause instanceof AggregateError) {
+        return hasNetworkErrorCode(cause) || cause.errors.some(hasNetworkErrorCode);
+    }
+    return hasNetworkErrorCode(cause);
+}
+function isWhoamiUnavailable(error) {
+    if (error instanceof AisHttpError) {
+        return error.status === 429 || error.status >= 500;
+    }
+    if (error instanceof AisRequestTimeoutError)
+        return true;
+    return isFetchNetworkError(error);
+}
+function parseConfirmedAgentId(result) {
+    const parsed = z.object({ success: z.literal(true), data: z.object({
+            id: z.string().optional(), agentId: z.string().optional(),
+        }) }).safeParse(result);
+    if (!parsed.success)
+        return null;
+    return parsed.data.data.id ?? parsed.data.data.agentId ?? null;
+}
+export function identityCredentialFingerprint(kind, credential) {
+    return `${kind}:${createHash('sha256').update(credential).digest('hex')}`;
+}
+export function clearPinnedIdentityConfirmation(pin, credentialKey) {
+    if (!pin)
+        return;
+    if (credentialKey === undefined) {
+        clearConfirmationsForAgent(pin.agentId);
+        return;
+    }
+    confirmations.delete(confirmationKey(pin.agentId, credentialKey));
+}
 /**
  * Lists leftover per-harness manifest files from the removed machine-wide pin.
  * They are read by nothing; doctor only reports them so a human can delete
@@ -60,25 +135,42 @@ export function assertPinnedAgent(pin, agentId) {
     if (!pin)
         return;
     if (pin.agentId !== agentId) {
+        clearConfirmationsForAgent(pin.agentId);
         throw new Error(`Identity gate: expected ${pin.agentId}, received ${agentId}. Writes stopped. ${IDENTITY_REPAIR}`);
     }
 }
 /** Verify the same whoami response exposed by the selected auth adapter, before every mutation. */
-export async function verifyPinnedIdentity(pin, agentId, whoami) {
+export async function verifyPinnedIdentity(pin, agentId, whoami, options) {
     if (!pin)
         return;
     assertPinnedAgent(pin, agentId);
-    let result;
-    try {
-        result = await whoami();
-    }
-    catch {
-        throw new Error(`Identity gate: whoami unavailable for ${agentId}. Writes stopped. ${IDENTITY_REPAIR}`);
-    }
-    const parsed = z.object({ success: z.literal(true), data: z.object({
-            id: z.string().optional(), agentId: z.string().optional(),
-        }) }).safeParse(result);
-    if (!parsed.success || (parsed.data.data.id ?? parsed.data.data.agentId) !== agentId) {
+    const credentialKey = options.credentialKey;
+    const clock = options.clock ?? Date.now;
+    const sleep = options.sleep ?? defaultSleep;
+    for (let attempt = 0; attempt <= WHOAMI_RETRY_BACKOFF_MS.length; attempt += 1) {
+        let result;
+        try {
+            result = await whoami();
+        }
+        catch (error) {
+            if (!isWhoamiUnavailable(error)) {
+                clearConfirmationsForAgent(pin.agentId);
+                throw new Error(`Identity gate: whoami did not confirm ${agentId}. Writes stopped. ${IDENTITY_REPAIR}`);
+            }
+            const backoffMs = WHOAMI_RETRY_BACKOFF_MS[attempt];
+            if (backoffMs !== undefined) {
+                await sleep(backoffMs);
+                continue;
+            }
+            if (!options.freshOnly && hasRecentConfirmation(agentId, credentialKey, clock()))
+                return;
+            throw new Error(`Identity gate: whoami unavailable for ${agentId}. Writes stopped. ${IDENTITY_REPAIR}`);
+        }
+        if (parseConfirmedAgentId(result) === agentId) {
+            rememberConfirmation(agentId, credentialKey, clock());
+            return;
+        }
+        clearConfirmationsForAgent(pin.agentId);
         throw new Error(`Identity gate: whoami did not confirm ${agentId}. Writes stopped. ${IDENTITY_REPAIR}`);
     }
 }

package/dist/session-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-identity.js","sourceRoot":"","sources":["../src/session-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,gDAAgD;IAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC;CAC9D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,eAAe,GAAG,sWAAsW,CAAC;AAEtY,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,OAAO,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yCAAyC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,QAAyB,EAAE,OAAe;IACnE,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA2B,EAAE,OAAe;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,cAAc,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAA2B,EAC3B,OAAe,EACf,MAA8B;IAE9B,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACjE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC1D,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAA6B;IAC9E,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"session-identity.js","sourceRoot":"","sources":["../src/session-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,gDAAgD;IAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC;CAC9D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,eAAe,GAAG,sWAAsW,CAAC;AAEtY,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,CAAU,CAAC;AAkB3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC5D,MAAM,YAAY,GAAU,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7G,SAAS,eAAe,CAAC,OAAe,EAAE,aAAqB;IAC7D,OAAO,GAAG,OAAO,KAAK,aAAa,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,OAAO,IAAI,CAAC;YAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,aAAqB,EAAE,aAAqB;IACzF,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,aAAqB,EAAE,KAAa;IAClF,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAChF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC;IACjD,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,mCAAmC,CAAC;AACnE,CAAC;AAED,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO;IAC5E,yBAAyB,EAAE,yBAAyB,EAAE,sBAAsB;IAC5E,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB;CACxD,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,2EAA2E;IAC3E,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,YAAY,sBAAsB;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACjE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC1D,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAY,EAAE,UAAkB;IAC5E,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAA2B,EAAE,aAAsB;IACjG,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,OAAO,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yCAAyC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,QAAyB,EAAE,OAAe;IACnE,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA2B,EAAE,OAAe;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,cAAc,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAA2B,EAC3B,OAAe,EACf,MAA8B,EAC9B,OAAoC;IAEpC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAE5C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,uBAAuB,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO;YACzF,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;YAC9C,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,qBAAqB,eAAe,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAA6B;IAC9E,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/telemetry.d.ts

@@ -1,4 +1,4 @@
-export type TelemetryEventName = 'auth.device_flow.start' | 'auth.key.success' | 'auth.key.fallback' | 'auth.key.autoenroll' | 'auth.renew.success' | 'auth.renew.retry' | 'auth.renew.hard_expiry' | 'tool.call' | 'ais.http.failure' | 'ais.http.retry';
+export type TelemetryEventName = 'auth.device_flow.start' | 'auth.device_flow.resume' | 'auth.key.success' | 'auth.key.fallback' | 'auth.key.autoenroll' | 'auth.renew.success' | 'auth.renew.retry' | 'auth.renew.hard_expiry' | 'tool.call' | 'ais.http.failure' | 'ais.http.retry';
 export interface TelemetryEvent {
     event: TelemetryEventName;
     ts: string;

package/dist/telemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA4BzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAEnD,gEAAgE;AAChE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,KAAmD;IAC/E,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAClC,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACzC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+BzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAEnD,gEAAgE;AAChE,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,KAAmD;IAC/E,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAClC,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACzC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC"}

package/dist/tool-args.d.ts

@@ -46,7 +46,16 @@ export declare const agentLoadArgsSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Tools with no parameters — reject unexpected keys. */
 export declare const emptyArgsSchema: z.ZodObject<{}, z.core.$strict>;
-/** full_context: optional delegated-read principal + configurable memory limit (CORBOT-45FE6ECE). */
+/**
+ * full_context: optional delegated-read principal + configurable memory limit (CORBOT-45FE6ECE).
+ *
+ * `maxTokens` mirrors the server's own bounds — MIN_MAX_TOKENS/MAX_MAX_TOKENS in
+ * packages/agent-identity-service/src/api/routes/full-context.ts. This package ships
+ * standalone to npm and cannot import from agent-identity-service, so the range is
+ * duplicated here on purpose; keep it in sync by hand if the server side changes.
+ */
+export declare const FULL_CONTEXT_MIN_MAX_TOKENS = 500;
+export declare const FULL_CONTEXT_MAX_MAX_TOKENS = 20000;
 export declare const fullContextArgsSchema: z.ZodObject<{
     principalAgentId: z.ZodOptional<z.ZodString>;
     memoriesLimit: z.ZodOptional<z.ZodNumber>;
@@ -55,6 +64,7 @@ export declare const fullContextArgsSchema: z.ZodObject<{
         lean: "lean";
         bootstrap: "bootstrap";
     }>>;
+    maxTokens: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export declare const INBOX_MAX_BODY_CHARS = 8000;
 export declare const INBOX_MAX_TASK_ID_CHARS = 128;

package/dist/tool-args.js

@@ -73,13 +73,29 @@ export const agentLoadArgsSchema = z.object({
 });
 /** Tools with no parameters — reject unexpected keys. */
 export const emptyArgsSchema = z.object({}).strict();
-/** full_context: optional delegated-read principal + configurable memory limit (CORBOT-45FE6ECE). */
+/**
+ * full_context: optional delegated-read principal + configurable memory limit (CORBOT-45FE6ECE).
+ *
+ * `maxTokens` mirrors the server's own bounds — MIN_MAX_TOKENS/MAX_MAX_TOKENS in
+ * packages/agent-identity-service/src/api/routes/full-context.ts. This package ships
+ * standalone to npm and cannot import from agent-identity-service, so the range is
+ * duplicated here on purpose; keep it in sync by hand if the server side changes.
+ */
+export const FULL_CONTEXT_MIN_MAX_TOKENS = 500;
+export const FULL_CONTEXT_MAX_MAX_TOKENS = 20_000;
 export const fullContextArgsSchema = z
     .object({
     principalAgentId: principalAgentIdSchema.optional(),
     memoriesLimit: z.number().int().min(1).max(50).optional(),
     /** View mode: full (default), lean (bounded), bootstrap (cross-harness session start). */
     view: z.enum(['full', 'lean', 'bootstrap']).optional(),
+    /** Token ceiling for the bounded views (lean, bootstrap). */
+    maxTokens: z
+        .number()
+        .int()
+        .min(FULL_CONTEXT_MIN_MAX_TOKENS)
+        .max(FULL_CONTEXT_MAX_MAX_TOKENS)
+        .optional(),
 })
     .strict();
 // ── Agent inbox (CORBOT-7115B8AE) ───────────────────────────────────────