evolcore 0.0.20 → 0.0.22

package/dist/core/message/{inbound-admission.js → message-admission.js}

@@ -1,5 +1,55 @@
 import { AccessPolicyError, readAccessPolicy, } from '../../config/access-policy.js';
-import { isAcceptedContact, resolveContactView, resolvePrincipal, } from '../../config/contact-book.js';
+import { getContactSnapshot, isAcceptedContact, resolveContactView, resolvePrincipal, } from '../../config/contact-book.js';
+import { isValidAid } from '../../aun/aid/validation.js';
+import { expirePendingContactRequests } from '../../config/contact-request-service.js';
+/** Validate managed private AUN sends against the sender's local contact policy. */
+export async function evaluateOutboundContactAdmission(input) {
+    const selfAid = String(input.selfAid || '').trim();
+    const targetAid = String(input.targetAid || '').trim();
+    if (!isValidAid(selfAid) || !isValidAid(targetAid)) {
+        return { allow: false, code: 'CONTACT_POLICY_INVALID', status: 'absent', error: 'A valid Agent AID is required for outbound contact admission' };
+    }
+    let policy;
+    try {
+        policy = readAccessPolicy(selfAid);
+    }
+    catch (error) {
+        return { allow: false, code: 'CONTACT_POLICY_INVALID', status: 'absent', error: error instanceof Error ? error.message : String(error) };
+    }
+    if (policy.policyMode !== 'contacts') {
+        try {
+            if (getContactSnapshot(selfAid).contacts.get(targetAid)?.status === 'blocked') {
+                return { allow: false, code: 'CONTACT_BLOCKED', status: 'blocked', error: `目标联系人 ${targetAid} 已被拉黑。请先解除拉黑：ec contact unblock ${targetAid} --self ${selfAid}` };
+            }
+        }
+        catch (error) {
+            return { allow: false, code: 'CONTACT_POLICY_INVALID', status: 'absent', error: error instanceof Error ? error.message : String(error) };
+        }
+        return { allow: true, status: policy.policyMode };
+    }
+    try {
+        await expirePendingContactRequests(selfAid);
+        const snapshot = getContactSnapshot(selfAid);
+        const entry = snapshot.contacts.get(targetAid);
+        const view = resolveContactView(selfAid, targetAid);
+        if (view.isOwner)
+            return { allow: true, status: 'owner' };
+        if (entry && (entry.status === undefined || entry.status === 'active'))
+            return { allow: true, status: 'active' };
+        const status = entry?.status ?? 'absent';
+        if (status === 'blocked')
+            return { allow: false, code: 'CONTACT_BLOCKED', status, error: `目标联系人 ${targetAid} 已被拉黑。请先解除拉黑：ec contact unblock ${targetAid} --self ${selfAid}` };
+        const addCommand = `ec contact add ${targetAid} --self ${selfAid}`;
+        if (status === 'pending')
+            return { allow: false, code: 'CONTACT_PENDING', status, error: `目标联系人 ${targetAid} 的联系人申请正在审核中，请等待 Owner 通过；如需重新提交，执行：${addCommand}` };
+        if (status === 'declined')
+            return { allow: false, code: 'CONTACT_DECLINED', status, error: `目标联系人 ${targetAid} 的联系人申请已拒绝或过期，请重新申请：${addCommand}` };
+        return { allow: false, code: 'CONTACT_NOT_ACTIVE', status: 'absent', error: `目标 ${targetAid} 不是联系人，请先申请添加：${addCommand}` };
+    }
+    catch (error) {
+        return { allow: false, code: 'CONTACT_POLICY_INVALID', status: 'absent', error: error instanceof Error ? error.message : String(error) };
+    }
+}
 export function evaluateInboundAdmissionPreflight(input) {
     const selfAid = String(input.selfAid || '').trim();
     const channelType = String(input.channelType || '').trim().toLowerCase();

package/dist/core/message/message-bridge.js

@@ -2,7 +2,7 @@ import { createHash, randomBytes } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { StreamDebouncer } from './stream-debouncer.js';
 import { appendMessageLog, appendMessageLogStrict, buildInboundEntry, isTransientProtocolMessage } from './message-log.js';
-import { buildEnvelope, sendInteractionPayload } from './message-utils.js';
+import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from './message-utils.js';
 import { chatDirPath } from '../session/session-fs-store.js';
 import { formatChannelKey, tryParseChannelKey } from '../channel-loader.js';
 import { agentDir, resolvePaths } from '../../paths.js';
@@ -25,7 +25,10 @@ import { createRootCausation, deriveCausation, normalizeCausation } from '../cau
 import { recordCausationSpan } from '../causation/audit.js';
 import { renderActionAsText } from '../interaction-router.js';
 import { planApprovalRoute } from '../permission/approval-gateway.js';
-import { consumeAdmissionReplyBudget, clearAdmissionReplyBudgets, evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission, } from './inbound-admission.js';
+import { parseFullAccessCommand } from '../command/slash-gate.js';
+import { isFullAccessEnabled } from '../../config-store.js';
+import { auditFullAccessEvent } from '../auth/authorization-audit.js';
+import { consumeAdmissionReplyBudget, clearAdmissionReplyBudgets, evaluateInboundAdmissionPreflight, evaluateOrdinaryInboundAdmission, } from './message-admission.js';
 const CONTACT_REJECTION_NOTICE = '[rejection] Not accepting messages from you.';
 const REJECTABLE_PEER_TYPES = new Set(['ai', 'bot', 'agent', 'service']);
 const REJECTION_MAX = 3;
@@ -98,6 +101,8 @@ export class MessageBridge {
     processOwnersProvider;
     debouncers = new Map();
     defaultDebounce;
+    /** Serializes session selection/renewal with inbound log admission per route. */
+    admissionLocks = new Map();
     agentRegistry;
     bootstrapService;
     menuDeduper = new MenuRequestDeduper();
@@ -431,6 +436,27 @@ export class MessageBridge {
         await this.sendContactRequestProtocolResponse(adapter, msg, result, owningAgent?.name);
         return true;
     }
+    /**
+     * Agent self-service contact add: create/update a pending request and send
+     * the same Owner action card used by inbound `/request`.
+     */
+    async submitAgentContactRequest(input) {
+        const owningAgent = this.agentRegistry?.get(input.selfAid) ?? null;
+        const submission = await submitContactRequest({
+            selfAid: input.selfAid,
+            applicantAid: input.applicantAid,
+            sourceChannelKey: input.sourceChannelKey,
+            note: '通过 ec contact add 发起的联系人申请',
+        });
+        if ((submission.code !== 'submitted' && submission.code !== 'resubmitted') || !submission.requestId) {
+            return { ...submission, reviewCardSent: false };
+        }
+        const reviewCardSent = await this.deliverContactReviewCard(input.selfAid, input.applicantAid, submission, owningAgent);
+        if (!reviewCardSent) {
+            logger.warn(`[MessageBridge] Agent contact add request persisted without review card: self=${input.selfAid} applicant=${input.applicantAid} request=${submission.requestId}`);
+        }
+        return { ...submission, reviewCardSent };
+    }
     contactRequestReply(result) {
         switch (result.code) {
             case 'submitted': return '联系人申请已提交，等待管理员审核。';
@@ -507,14 +533,17 @@ export class MessageBridge {
             toolInput: { applicantAid, requestId: submission.requestId },
             summary: `Review contact request from ${applicantAid}`,
             grantable: true,
-            approverPolicy: 'agent_manager',
+            // Contact membership is an Agent-owner decision. Do not use the broader
+            // agent_manager policy here: that policy intentionally prefers an Admin,
+            // which made request cards invisible to the configured Owner.
+            approverPolicy: 'agent_owner',
             createdAt: Date.parse(submission.submittedAt),
         }, {
             userId: applicantAid,
             chatType: 'private',
             selfAid,
             approvalRouting: {
-                approverPolicy: 'agent_manager',
+                approverPolicy: 'agent_owner',
                 owners,
                 admins,
                 resolveApproverCandidates,
@@ -602,10 +631,11 @@ export class MessageBridge {
             chatmode: 'interactive',
             replyContext: { delivery: { chatType: 'private' }, metadata: { source: 'handoff', chatmode: 'interactive' } },
         });
-        const sent = await sendInteractionPayload(route.adapter, envelope, interaction, renderActionAsText(interaction), envelope.replyContext);
-        if (!sent)
+        const receipt = await sendInteractionPayload(route.adapter, envelope, interaction, renderActionAsText(interaction), envelope.replyContext);
+        const accepted = isInteractionSendAccepted(receipt);
+        if (!accepted)
             await this.interactionRouter.cancel(submission.requestId, 'delivery_failed');
-        return !!sent;
+        return accepted;
     }
     async sendContactReviewOutcome(adapter, ownerAid, applicantAid, code, agentName) {
         const text = code === 'approved' ? `已通过 ${applicantAid} 的联系人申请。`
@@ -666,12 +696,23 @@ export class MessageBridge {
         const available = this.availableBaseagentsFor(channelName);
         if (available.length === 0 || available.includes(session.baseagent))
             return session;
+        // A topic's backend binding is fenced by SessionManager and cannot be
+        // cleared as a side effect of routing alignment. Reassigning the
+        // baseagent while leaving the old provider's agentSessionId persisted
+        // would make the new runner resume an incompatible backend. Keep the
+        // binding intact and let normal baseagent-mismatch handling report it;
+        // an explicit boundary operation must perform any future migration.
+        if (session.threadId) {
+            logger.error(`[MessageBridge] Cannot align topic to another baseagent: `
+                + `session=${session.id} thread=${session.threadId} current=${session.baseagent} preferred=${owningAgent.baseagent}`);
+            return session;
+        }
         const preferred = available.includes(owningAgent.baseagent)
             ? owningAgent.baseagent
             : available[0];
         logger.warn(`[MessageBridge] Aligning unavailable session baseagent: session=${session.id} ${session.baseagent} -> ${preferred} agent=${owningAgent.name} available=${available.join(',')}`);
-        await this.sessionManager.updateSession(session.id, { baseagent: preferred, agentSessionId: null });
-        return { ...session, baseagent: preferred, agentSessionId: undefined };
+        await this.sessionManager.updateSession(session.id, { baseagent: preferred });
+        return { ...session, baseagent: preferred };
     }
     /**
      * 为渠道注册消息桥梁：入站处理管线 + 出站命令响应
@@ -685,8 +726,15 @@ export class MessageBridge {
     register(channelName, onMessage, sendReply, adapter, channelType) {
         const effectiveChannelType = channelType || channelName;
         onMessage(async (msg) => {
+            let releaseAdmission;
+            let releaseSessionIngress;
+            const releaseIngress = () => {
+                releaseSessionIngress?.();
+                releaseSessionIngress = undefined;
+            };
             try {
                 let content = msg.content.trim();
+                let executionPermissionOverride;
                 // Channels that expose adapter receive time (notably AUN) must keep
                 // that timestamp through session resolution and queue processing.
                 // The fallback is only for legacy adapters that do not provide it.
@@ -709,6 +757,12 @@ export class MessageBridge {
                 const conversationId = chatType === 'group' ? (msg.groupId || msg.channelId) : msg.peerId;
                 const selfAid = msg.selfAID || owningAgent?.aid || parsedChannelKey?.selfAID;
                 const resolvedChannelType = msg.channelType || parsedChannelKey?.type || effectiveChannelType;
+                const admissionRoute = [
+                    resolvedChannelType,
+                    selfAid || '',
+                    msg.channelId,
+                    msg.threadId || '',
+                ].join('#');
                 const trustedHandoffEcho = msg.source === 'handoff'
                     && resolvedChannelType === 'aun'
                     && !!selfAid
@@ -890,6 +944,61 @@ export class MessageBridge {
                     await this.sendAccessDenied(adapter, channelName, msg, sendReply);
                     return;
                 }
+                // /fa is an execution prefix, not a session-mode switch or a normal
+                // quick command. Only this trusted bridge path can construct the
+                // internal per-call authorization carried into ResponseEngine.
+                const fullAccessCommand = parseFullAccessCommand(content);
+                if (fullAccessCommand.matched) {
+                    const reject = async (text) => {
+                        logger.warn(`[MessageBridge] fullaccess command rejected: channel=${channelName} `
+                            + `actor=${authSubject.principalId ?? authSubject.actorId ?? '<none>'} reason=${text}`);
+                        auditFullAccessEvent({
+                            event: 'fullaccess.command.rejected',
+                            source: 'fullaccess-command',
+                            decision: 'deny',
+                            actorId: authSubject.principalId ?? authSubject.actorId,
+                            processRole: authSubject.processRole,
+                            messageId: msg.messageId,
+                            reason: text,
+                        });
+                        await sendReply(msg.channelId, `❌ ${text}`, msg.replyContext);
+                    };
+                    if (msg.source !== undefined && msg.source !== 'user') {
+                        await reject('fullaccess 只能由用户直接发送的 /fa 或 /fullaccess 命令发起');
+                        return;
+                    }
+                    if (!fullAccessCommand.prompt) {
+                        await reject('用法：/fa <提示词> 或 /fullaccess <提示词>');
+                        return;
+                    }
+                    if (!isFullAccessEnabled()) {
+                        await reject('fullaccess 功能未启用，请先设置 daemon.json.fullaccess.enabled=true');
+                        return;
+                    }
+                    if (!authSubject.isDaemonOwner || !authSubject.principalId) {
+                        await reject('仅可信 daemon-owner 可以使用 fullaccess');
+                        return;
+                    }
+                    if (!msg.messageLogContent)
+                        msg.messageLogContent = content;
+                    content = fullAccessCommand.prompt;
+                    executionPermissionOverride = {
+                        permissionMode: 'fullaccess',
+                        processRole: 'fullaccess-run',
+                        dataScope: 'daemon',
+                        source: 'fullaccess-command',
+                        authorizedBy: authSubject.principalId,
+                    };
+                    logger.warn(`[MessageBridge] fullaccess command accepted: channel=${channelName} `
+                        + `actor=${authSubject.principalId} message=${msg.messageId ?? '<none>'}`);
+                    auditFullAccessEvent({
+                        event: 'fullaccess.command.accepted',
+                        source: 'fullaccess-command',
+                        actorId: authSubject.principalId,
+                        processRole: authSubject.processRole,
+                        messageId: msg.messageId,
+                    });
+                }
                 // 0. 仅阻止协议遥测进入 session / model / messages.jsonl；协议本身已在
                 // channel/main/events/AUN/handoff 专用链路中处理和记录。
                 // 注：menu.* 自定义消息已由上方 handleMenuControl 快速路径处理。
@@ -928,7 +1037,18 @@ export class MessageBridge {
                 const contentForCmd = content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
                 const cmdContent = contentForCmd || content;
                 const isCmd = msg.source !== 'handoff'
+                    // Once /fa has been accepted, its remainder is always model input.
+                    // A prompt such as `/fa /status` must not be re-routed as the
+                    // ordinary `/status` quick command after the prefix is removed.
+                    && !executionPermissionOverride
+                    && !parseFullAccessCommand(cmdContent).matched
                     && this.cmdHandler.isCommand(cmdContent);
+                if (isCmd && /^\/new(?:\s|$)/i.test(cmdContent)) {
+                    // /new changes the active main-session boundary. Serialize it with
+                    // ordinary session admission so an in-flight renew cannot append or
+                    // enqueue against a superseded session after /new commits.
+                    releaseAdmission = await this.acquireAdmission(admissionRoute);
+                }
                 if (isCmd) {
                     logger.debug(`[MessageBridge] Command detected: "${cmdContent}", routing to handler`);
                     // 命令也要记录入方向 jsonl（不创建 session，直接用 chatDirPath 计算路径）
@@ -966,6 +1086,7 @@ export class MessageBridge {
                     }
                 }
                 if (msg.source !== 'handoff'
+                    && !executionPermissionOverride
                     && await this.handleCommand(cmdContent, channelName, msg.channelId, (text) => {
                         const taskId = `cmd-${msg.messageId || Date.now()}`;
                         logger.channelOut({ channel: channelName, channelId: msg.channelId, taskId, correlationId: taskId, sessionId: msg.replyContext?.sessionId, agentAid: msg.selfAID, payload: { kind: 'command.result', text } });
@@ -1009,8 +1130,16 @@ export class MessageBridge {
                 // 通道找不到归属时退回到 globalConfig（一般是测试场景）
                 const effectiveProjectPath = owningAgent?.projectPath
                     ?? this.defaultProjectPath;
+                // Session renewal and inbound history append form one admission
+                // transaction. Without this per-route single-flight, a second message
+                // can observe the just-renewed empty session before the first message
+                // has been appended and create another renewed session.
+                releaseAdmission = await this.acquireAdmission(admissionRoute);
                 const hadMainSession = msg.threadId ? true : this.sessionManager.hasMainSession(channelName, msg.channelId, msg.channelType || effectiveChannelType, msg.selfAID || selfAid);
                 let session = await this.sessionManager.getOrCreateSession(channelName, msg.channelId, effectiveProjectPath, msg.threadId, Object.keys(metadata).length ? metadata : undefined, this.extractTopicName(msg), msg.peerId, chatType, owningAgent?.baseagent, msg.selfAID, msg.channelType || effectiveChannelType, msg.peerType, identity);
+                if (session.threadId && typeof this.messageQueue.reserveSessionIngress === 'function') {
+                    releaseSessionIngress = this.messageQueue.reserveSessionIngress(session.id);
+                }
                 session = await this.alignSessionBaseagent(channelName, session);
                 const replyToMessageId = typeof msg.replyContext?.metadata?.refMessageId === 'string'
                     ? msg.replyContext.metadata.refMessageId
@@ -1065,6 +1194,7 @@ export class MessageBridge {
                     topicName: this.extractTopicName(msg),
                     replyContext: msg.replyContext,
                     source: msg.source,
+                    ...(executionPermissionOverride ? { executionPermissionOverride } : {}),
                     boundSessionId: session.id,
                     resolvedIdentity: identity,
                     mentionMode: msg.mentionMode,
@@ -1134,6 +1264,12 @@ export class MessageBridge {
                 }
                 if (!handoffCandidate)
                     appendMessageLog(inboundEntry.chatDir, inboundEntry.entry);
+                // The authoritative session choice is now paired with its first
+                // conversation record. Release before waiting for queue completion so
+                // later group messages can still exercise the normal interrupt/FIFO
+                // policy instead of being serialized behind the whole model turn.
+                releaseAdmission?.();
+                releaseAdmission = undefined;
                 // 6. ACK + debounce/enqueue
                 //    ACK 在到达时立即做（每条独立 ACK），不等合并
                 //    Interrupt 模式（单聊）→ 入队前 debounce 合并
@@ -1158,6 +1294,7 @@ export class MessageBridge {
                             role: !isInterrupt ? (session.identity?.role ?? 'none') : undefined,
                             sessionKeyField: session.sessionKey,
                             selfAID, // ← 传递 selfAID，用于队列隔离
+                            onPersisted: releaseIngress,
                         });
                     }
                     catch (error) {
@@ -1193,8 +1330,29 @@ export class MessageBridge {
             catch (error) {
                 logger.error(`[MessageBridge] Error in onMessage handler for ${channelName}:`, error);
             }
+            finally {
+                releaseAdmission?.();
+                releaseIngress();
+            }
         });
     }
+    async acquireAdmission(key) {
+        const previous = this.admissionLocks.get(key) ?? Promise.resolve();
+        let release;
+        const current = new Promise(resolve => { release = resolve; });
+        const tail = previous.then(() => current);
+        this.admissionLocks.set(key, tail);
+        await previous;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            release();
+            if (this.admissionLocks.get(key) === tail)
+                this.admissionLocks.delete(key);
+        };
+    }
     // ── Menu Protocol ──
     extractTopicName(msg) {
         const raw = msg.topicName
@@ -1541,7 +1699,7 @@ export class MessageBridge {
             return;
         logger.warn(`[MenuControl] category=${category} request=${parsed.id || '<missing>'}`
             + ` type=${parsed.type} name=${parsed.name || '<none>'} action=${parsed.action || '<none>'}`
-            + ` transport=${channel} scope=${this.shortHash(scope)} sender=${this.shortHash(msg.peerId)}`
+            + ` transport=${channel} scope=${scope || 'none'} sender=${msg.peerId || 'none'}`
             + (category === 'request-replay' ? ' replay=true' : '')
             + (category === 'request-retry' ? ' retry=true' : '')
             + `${code ? ` code=${code}` : ''}${decision.suppressed ? ` suppressed=${decision.suppressed}` : ''}`);
@@ -1603,7 +1761,22 @@ export class MessageBridge {
         if (!this.cmdHandler.isCommand(content))
             return false;
         logger.info(`[${channel}] ${channelId}: ${content}${source === 'card-trigger' ? ' [card]' : ''}`);
-        const cmdResult = await this.cmdHandler.handle(content, channel, channelId, (_cid, text, opts) => sendReply(text), userId, threadId, chatType, source, messageId, selfAID, authSubject?.identity, authSubject, replyContext);
+        const adapter = this.processor.getChannelInfo?.(channel)?.adapter;
+        const cmdResult = await this.cmdHandler.handle(content, channel, channelId, async (_cid, text, opts, updatePayload) => {
+            if (updatePayload && adapter?.send) {
+                const envelope = buildEnvelope({
+                    taskId: `cmd-update-${randomBytes(5).toString('hex')}`,
+                    channel,
+                    channelId,
+                    agentName: this.agentRegistry?.resolveByChannel(channel)?.name ?? '<unknown>',
+                    chatmode: 'interactive',
+                    replyContext: opts ?? replyContext,
+                });
+                await adapter.send(envelope, updatePayload);
+                return;
+            }
+            await sendReply(text, opts, updatePayload);
+        }, userId, threadId, chatType, source, messageId, selfAID, authSubject?.identity, authSubject, replyContext);
         logger.debug(`[MessageBridge] handleCommand: result type=${typeof cmdResult}`);
         if (cmdResult === undefined)
             return false;
@@ -1621,7 +1794,6 @@ export class MessageBridge {
                 return true;
             }
             // 出站走 adapter.send 统一入口
-            const adapter = this.processor.getChannelInfo?.(channel)?.adapter;
             let responseSessionId;
             try {
                 const responseSession = threadId

package/dist/core/message/message-log.js

@@ -231,24 +231,64 @@ export function messageLogPath(chatDir) {
     return path.join(chatDir, MESSAGE_LOG_FILE);
 }
 export function hasMessageLogOperation(chatDir, operationId) {
+    return findMessageLogOperationMessageId(chatDir, operationId) !== undefined;
+}
+/** Find the newest completed outbound operation whose ID starts with prefix. */
+export function findLatestMessageLogOperation(chatDir, operationPrefix) {
     const file = messageLogPath(chatDir);
     if (!fs.existsSync(file))
-        return false;
+        return undefined;
+    let latest;
     try {
-        return fs.readFileSync(file, 'utf-8').split('\n').some(line => {
+        for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
             if (!line.trim())
-                return false;
+                continue;
             try {
                 const entry = JSON.parse(line);
-                return entry?.dir === 'out' && entry.operationId === operationId;
+                if (entry?.dir !== 'out'
+                    || typeof entry.operationId !== 'string'
+                    || (!entry.operationId.startsWith(operationPrefix))
+                    || typeof entry.msgId !== 'string'
+                    || !entry.msgId)
+                    continue;
+                const ts = typeof entry.ts === 'number' && Number.isFinite(entry.ts) ? entry.ts : 0;
+                if (!latest || ts >= latest.ts) {
+                    latest = { messageId: entry.msgId, operationId: entry.operationId, ts };
+                }
             }
             catch {
-                return false;
+                // skip malformed message log lines
             }
-        });
+        }
     }
     catch {
-        return false;
+        return undefined;
+    }
+    return latest;
+}
+export function findMessageLogOperationMessageId(chatDir, operationId) {
+    const file = messageLogPath(chatDir);
+    if (!fs.existsSync(file))
+        return undefined;
+    try {
+        for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
+            if (!line.trim())
+                continue;
+            try {
+                const entry = JSON.parse(line);
+                if (entry?.dir === 'out' && entry.operationId === operationId) {
+                    if (typeof entry.msgId === 'string' && entry.msgId)
+                        return entry.msgId;
+                }
+            }
+            catch {
+                // skip malformed message log lines
+            }
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
     }
 }
 export function resolveChatDir(sessionsDir, channelType, channelId, selfAID) {