memeloop 0.1.3 → 0.2.1

package/dist/chunk-E5R24U4I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sync/attachmentRpcCodec.ts","../src/device-network/deviceSyncStateStore.ts","../src/sync/chatSyncEngine.ts","../src/sync/peerNodeAdapter.ts","../src/device-network/deviceCloudConnectionCoordinator.ts","../src/device-network/jsonFrame.ts","../src/device-network/deviceOrchestrationTransport.ts","../src/device-network/libp2pSyncProtocol.ts","../src/device-network/libp2pDeviceSyncTransport.ts","../src/device-network/libp2pRpcProtocol.ts","../src/device-network/localTrustDeviceAuthorizer.ts","../src/device-network/pairingInvite.ts","../src/sync/protocol.ts"],"sourcesContent":["/**\n * 将节点 RPC `memeloop.storage.getAttachmentBlob` 的返回值解码为同步引擎可用的 BLOB。\n */\n\nexport function decodeAttachmentBlobRpc(\n  result: unknown,\n): { data: Uint8Array; filename: string; mimeType: string; size: number } | null {\n  if (result == null || typeof result !== 'object') return null;\n  const r = result as {\n    found?: boolean;\n    error?: string;\n    dataBase64?: string;\n    filename?: string;\n    mimeType?: string;\n    size?: number;\n  };\n  if (r.error || !r.found || typeof r.dataBase64 !== 'string') return null;\n  let data: Uint8Array;\n  try {\n    const binary = atob(r.dataBase64);\n    if (!binary.length) return null;\n    data = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n  } catch {\n    return null;\n  }\n  return {\n    data,\n    filename: typeof r.filename === 'string' ? r.filename : 'attachment',\n    mimeType: typeof r.mimeType === 'string' ? r.mimeType : 'application/octet-stream',\n    size: typeof r.size === 'number' && r.size > 0 ? r.size : data.byteLength,\n  };\n}\n","import type { VersionVector } from '../sync/protocol.js';\n\nexport interface DeviceSyncStateStore {\n  loadVersionVector(): Promise<VersionVector>;\n  saveVersionVector(versionVector: VersionVector): Promise<void>;\n}\n\nexport class MemoryDeviceSyncStateStore implements DeviceSyncStateStore {\n  private versionVector: VersionVector;\n\n  constructor(initial: VersionVector = {}) {\n    this.versionVector = { ...initial };\n  }\n\n  public async loadVersionVector(): Promise<VersionVector> {\n    return { ...this.versionVector };\n  }\n\n  public async saveVersionVector(versionVector: VersionVector): Promise<void> {\n    this.versionVector = { ...versionVector };\n  }\n}\n","import type { AttachmentReference, ChatMessage } from '../conversation/index.js';\nimport { type DeviceSyncStateStore, MemoryDeviceSyncStateStore } from '../device-network/deviceSyncStateStore.js';\nimport type { ConversationMetadataPage, VersionRange, VersionVector } from './protocol.js';\n\nimport type { IAgentStorage } from '../types.js';\n\nexport interface ChatSyncPeer {\n  nodeId: string;\n  /**\n   * 取远端当前的 versionVector，并返回对方缺失的会话元数据。\n   */\n  exchangeVersionVector(localVersion: Record<string, number>): Promise<{\n    remoteVersion: Record<string, number>;\n    missingForRemote: VersionRange[];\n    missingForLocal: VersionRange[];\n  }>;\n\n  /**\n   * 将本地缺失的 metadata 从该 peer 拉回来。\n   */\n  pullMissingMetadata(\n    sinceVersion: Record<string, number>,\n    cursor?: string,\n  ): Promise<ConversationMetadataPage>;\n\n  /**\n   * 按需拉取消息正文（TidGi / 审查单 Phase 4：消息级同步）。\n   * 返回远端有而本地 unknownMessageIds 之外的新消息。\n   */\n  pullMissingMessages?(conversationId: string, knownMessageIds: string[]): Promise<ChatMessage[]>;\n\n  /**\n   * 按 contentHash 拉取附件二进制（与 `ChatMessage.attachments` / `AttachmentRef` 对齐）。\n   * 典型实现：对 peer 发 `memeloop.storage.getAttachmentBlob` RPC。\n   */\n  pullAttachmentBlob?(\n    contentHash: string,\n  ): Promise<{ data: Uint8Array; filename: string; mimeType: string; size: number } | null>;\n}\n\nexport interface ChatSyncEngineOptions {\n  nodeId: string;\n  storage: IAgentStorage;\n  peers: () => ChatSyncPeer[];\n  stateStore?: DeviceSyncStateStore;\n}\n\nexport class ChatSyncEngine {\n  private readonly nodeId: string;\n  private readonly storage: IAgentStorage;\n  private readonly getPeers: () => ChatSyncPeer[];\n  private readonly stateStore: DeviceSyncStateStore;\n  private versionVector: VersionVector = {};\n  private loadStatePromise?: Promise<void>;\n  private stateMutation: Promise<void> = Promise.resolve();\n\n  constructor(options: ChatSyncEngineOptions) {\n    this.nodeId = options.nodeId;\n    this.storage = options.storage;\n    this.getPeers = options.peers;\n    this.stateStore = options.stateStore ?? new MemoryDeviceSyncStateStore();\n  }\n\n  /**\n   * 在本节点新产生一条消息时调用，增加本节点的 lamportClock。\n   */\n  public bumpLocalVersion(): Promise<number> {\n    let nextClock = 0;\n    const mutation = this.stateMutation.then(async () => {\n      await this.ensureStateLoaded();\n      nextClock = (this.versionVector[this.nodeId] ?? 0) + 1;\n      this.versionVector[this.nodeId] = nextClock;\n      await this.stateStore.saveVersionVector(this.versionVector);\n    });\n    this.stateMutation = mutation.catch(() => undefined);\n    return mutation.then(() => nextClock);\n  }\n\n  /**\n   * 执行一次与所有 peer 的增量同步（metadata 级别），并尽力拉取缺失消息。\n   */\n  public async syncOnce(): Promise<void> {\n    await this.ensureStateLoaded();\n    await this.stateMutation;\n    await this.reconcileVersionVectorFromStorage();\n    const peers = this.getPeers();\n    if (peers.length === 0) return;\n\n    const pulledConversations = new Set<string>();\n\n    for (const peer of peers) {\n      const { remoteVersion } = await peer.exchangeVersionVector({ ...this.versionVector });\n\n      let cursor: string | undefined;\n      do {\n        const page = await peer.pullMissingMetadata(this.versionVector, cursor);\n        for (const meta of page.items) {\n          await this.storage.upsertConversationMetadata(meta);\n          pulledConversations.add(meta.conversationId);\n        }\n        cursor = page.nextCursor;\n      } while (cursor !== undefined);\n\n      for (const [nodeId, clock] of Object.entries(remoteVersion)) {\n        const current = this.versionVector[nodeId] ?? 0;\n        if (clock > current) this.versionVector[nodeId] = clock;\n      }\n      await this.stateStore.saveVersionVector(this.versionVector);\n    }\n\n    const pageSize = 100;\n    let offset = 0;\n    for (;;) {\n      const conversations = await this.storage.listConversations({ limit: pageSize, offset });\n      for (const conversation of conversations) {\n        pulledConversations.add(conversation.conversationId);\n      }\n      if (conversations.length < pageSize) break;\n      offset += conversations.length;\n    }\n\n    for (const conversationId of pulledConversations) {\n      await this.pullMessagesForConversationFromPeers(conversationId, peers);\n    }\n  }\n\n  /**\n   * Anti-entropy：先 syncOnce，再对已知会话逐个向各 peer 拉取缺失消息（参考审查单「定期对账」）。\n   */\n  public async antiEntropyOnce(): Promise<void> {\n    await this.syncOnce();\n  }\n\n  private async pullMessagesForConversationFromPeers(\n    conversationId: string,\n    peers: ChatSyncPeer[],\n  ): Promise<void> {\n    const localMsgs = await this.storage.getMessages(conversationId, { mode: 'full-content' });\n    const knownIds = localMsgs.map((m) => m.messageId);\n\n    for (const peer of peers) {\n      if (!peer.pullMissingMessages) continue;\n      try {\n        const incoming = await peer.pullMissingMessages(conversationId, knownIds);\n        if (incoming.length > 0) {\n          await this.storage.insertMessagesIfAbsent(incoming);\n          await this.ensureAttachmentsFromMessages(incoming, peers);\n        }\n      } catch {\n        /* 单 peer 失败不阻塞 */\n      }\n    }\n  }\n\n  /** 从消息元数据收集 `attachments[].contentHash`，对本地缺失 BLOB 的哈希向各 peer 拉取并 `saveAttachment`。 */\n  private async ensureAttachmentsFromMessages(\n    messages: ChatMessage[],\n    peers: ChatSyncPeer[],\n  ): Promise<void> {\n    const hashes = new Set<string>();\n    for (const m of messages) {\n      for (const a of m.attachments ?? []) {\n        if (a.contentHash) hashes.add(a.contentHash);\n      }\n    }\n    for (const h of hashes) {\n      const reference = await this.storage.getAttachment(h);\n      if (reference) {\n        const reader = this.storage.readAttachmentData?.bind(this.storage);\n        if (!reader) continue;\n        const bytes = await reader(h);\n        if (bytes && bytes.length > 0) continue;\n      }\n\n      for (const peer of peers) {\n        const pull = peer.pullAttachmentBlob?.bind(peer);\n        if (!pull) continue;\n        try {\n          const blob = await pull(h);\n          if (blob?.data?.length) {\n            const ar: AttachmentReference = {\n              contentHash: h,\n              filename: blob.filename,\n              mimeType: blob.mimeType,\n              size: blob.size > 0 ? blob.size : blob.data.length,\n            };\n            await this.storage.saveAttachment(ar, blob.data);\n            break;\n          }\n        } catch {\n          /* try next peer */\n        }\n      }\n    }\n  }\n\n  public async getVersionVector(): Promise<Record<string, number>> {\n    await this.ensureStateLoaded();\n    await this.stateMutation;\n    return { ...this.versionVector };\n  }\n\n  public getStorage(): IAgentStorage {\n    return this.storage;\n  }\n\n  private ensureStateLoaded(): Promise<void> {\n    this.loadStatePromise ??= (async () => {\n      const stored = await this.stateStore.loadVersionVector();\n      this.versionVector = { ...stored, [this.nodeId]: stored[this.nodeId] ?? 0 };\n    })();\n    return this.loadStatePromise;\n  }\n\n  private async reconcileVersionVectorFromStorage(): Promise<void> {\n    const pageSize = 100;\n    let offset = 0;\n    let changed = false;\n    for (;;) {\n      const conversations = await this.storage.listConversations({ limit: pageSize, offset });\n      for (const conversation of conversations) {\n        const current = this.versionVector[conversation.originNodeId] ?? 0;\n        if (conversation.originClock > current) {\n          this.versionVector[conversation.originNodeId] = conversation.originClock;\n          changed = true;\n        }\n      }\n      if (conversations.length < pageSize) break;\n      offset += conversations.length;\n    }\n    if (changed) await this.stateStore.saveVersionVector(this.versionVector);\n  }\n}\n","import type { ChatMessage } from '../conversation/index.js';\nimport type { ConversationMetadataPage, VersionRange } from './protocol.js';\n\nimport type { ChatSyncPeer } from './chatSyncEngine.js';\n\nexport interface PeerNodeTransport {\n  nodeId: string;\n  exchangeVersionVector(\n    targetNodeId: string,\n    localVersion: Record<string, number>,\n  ): Promise<{\n    remoteVersion: Record<string, number>;\n    missingForRemote: VersionRange[];\n    missingForLocal: VersionRange[];\n  }>;\n  pullMissingMetadata(\n    targetNodeId: string,\n    sinceVersion: Record<string, number>,\n    cursor?: string,\n  ): Promise<ConversationMetadataPage>;\n  pullMissingMessages?(\n    targetNodeId: string,\n    conversationId: string,\n    knownMessageIds: string[],\n  ): Promise<ChatMessage[]>;\n\n  /** 从指定节点拉取附件 BLOB（如 `memeloop.storage.getAttachmentBlob`）。 */\n  pullAttachmentBlob?(\n    targetNodeId: string,\n    contentHash: string,\n  ): Promise<{ data: Uint8Array; filename: string; mimeType: string; size: number } | null>;\n}\n\nexport class PeerNodeSyncAdapter implements ChatSyncPeer {\n  public readonly nodeId: string;\n  private readonly transport: PeerNodeTransport;\n\n  constructor(nodeId: string, transport: PeerNodeTransport) {\n    this.nodeId = nodeId;\n    this.transport = transport;\n  }\n\n  exchangeVersionVector(localVersion: Record<string, number>) {\n    return this.transport.exchangeVersionVector(this.nodeId, localVersion);\n  }\n\n  pullMissingMetadata(sinceVersion: Record<string, number>, cursor?: string) {\n    return this.transport.pullMissingMetadata(this.nodeId, sinceVersion, cursor);\n  }\n\n  pullMissingMessages(conversationId: string, knownMessageIds: string[]): Promise<ChatMessage[]> {\n    const function_ = this.transport.pullMissingMessages?.bind(this.transport);\n    if (!function_) {\n      return Promise.resolve([]);\n    }\n    return function_(this.nodeId, conversationId, knownMessageIds);\n  }\n\n  pullAttachmentBlob(contentHash: string) {\n    const function_ = this.transport.pullAttachmentBlob?.bind(this.transport);\n    if (!function_) {\n      return Promise.resolve(null);\n    }\n    return function_(this.nodeId, contentHash);\n  }\n}\n","export type DeviceCloudConnectionStatus =\n  | 'not-configured'\n  | 'connecting'\n  | 'online'\n  | 'degraded'\n  | 'offline'\n  | 'error';\n\nexport type DeviceCloudConnectionComponent =\n  | 'authorizer'\n  | 'registration'\n  | 'relay'\n  | 'heartbeat'\n  | 'directory';\n\nexport type DeviceCloudComponentStatus = 'pending' | 'ready' | 'failed' | 'not-run';\n\nexport interface DeviceCloudConnectionSnapshot {\n  status: DeviceCloudConnectionStatus;\n  generation: number;\n  components: Record<DeviceCloudConnectionComponent, DeviceCloudComponentStatus>;\n  lastError?: unknown;\n  nextRetryAt?: number;\n}\n\n/**\n * A step performs remote or otherwise reversible work first. Durable host\n * state must only be changed by commit(), which the coordinator invokes after\n * confirming that the configuration generation is still current.\n */\nexport interface DeviceCloudStepResult {\n  commit?: () => Promise<unknown>;\n}\n\nexport interface DeviceCloudConnectionAdapter<Configuration> {\n  isConfigured(configuration: Configuration | undefined): configuration is Configuration;\n  relayRequiredForOnline(configuration: Configuration): boolean;\n  ensureAuthorizer(\n    configuration: Configuration,\n    signal: AbortSignal,\n  ): Promise<DeviceCloudStepResult | undefined>;\n  registerDevice(\n    configuration: Configuration,\n    signal: AbortSignal,\n  ): Promise<DeviceCloudStepResult | undefined>;\n  ensureRelay(\n    configuration: Configuration,\n    signal: AbortSignal,\n  ): Promise<DeviceCloudStepResult | undefined>;\n  heartbeat(\n    configuration: Configuration,\n    signal: AbortSignal,\n  ): Promise<DeviceCloudStepResult | undefined>;\n  syncDirectory(\n    configuration: Configuration,\n    signal: AbortSignal,\n  ): Promise<DeviceCloudStepResult | undefined>;\n  classifyError?(error: unknown): 'offline' | 'error';\n}\n\nexport interface DeviceCloudConnectionCoordinatorOptions<Configuration> {\n  adapter: DeviceCloudConnectionAdapter<Configuration>;\n  configuration?: Configuration;\n  heartbeatIntervalMs?: number;\n  initialBackoffMs?: number;\n  maxBackoffMs?: number;\n  jitterRatio?: number;\n  now?: () => number;\n  random?: () => number;\n  onStatus?: (snapshot: DeviceCloudConnectionSnapshot) => void | Promise<void>;\n  logWarning?: (message: string, error: unknown) => void;\n}\n\nconst DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;\nconst DEFAULT_INITIAL_BACKOFF_MS = 1_000;\nconst DEFAULT_MAX_BACKOFF_MS = 60_000;\nconst DEFAULT_JITTER_RATIO = 0.2;\n\nfunction emptyComponents(): DeviceCloudConnectionSnapshot['components'] {\n  return {\n    authorizer: 'not-run',\n    registration: 'not-run',\n    relay: 'not-run',\n    heartbeat: 'not-run',\n    directory: 'not-run',\n  };\n}\n\nfunction assertNonNegativeFinite(value: number, name: string): void {\n  if (!Number.isFinite(value) || value < 0) {\n    throw new TypeError(`${name} must be a finite non-negative number`);\n  }\n}\n\n/** Portable, generation-safe Cloud lifecycle shared by every MemeLoop host. */\nexport class DeviceCloudConnectionCoordinator<Configuration> {\n  private configuration: Configuration | undefined;\n  private generation = 0;\n  private controller = new AbortController();\n  private timer?: ReturnType<typeof setTimeout>;\n  private inFlight?: Promise<void>;\n  private started = false;\n  private consecutiveFailures = 0;\n  private snapshotValue: DeviceCloudConnectionSnapshot = {\n    status: 'not-configured',\n    generation: 0,\n    components: emptyComponents(),\n  };\n  private readonly heartbeatIntervalMs: number;\n  private readonly initialBackoffMs: number;\n  private readonly maxBackoffMs: number;\n  private readonly jitterRatio: number;\n  private readonly now: () => number;\n  private readonly random: () => number;\n\n  constructor(private readonly options: DeviceCloudConnectionCoordinatorOptions<Configuration>) {\n    this.configuration = options.configuration;\n    this.heartbeatIntervalMs = options.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS;\n    this.initialBackoffMs = options.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS;\n    this.maxBackoffMs = options.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS;\n    this.jitterRatio = options.jitterRatio ?? DEFAULT_JITTER_RATIO;\n    this.now = options.now ?? Date.now;\n    this.random = options.random ?? Math.random;\n    assertNonNegativeFinite(this.heartbeatIntervalMs, 'heartbeatIntervalMs');\n    assertNonNegativeFinite(this.initialBackoffMs, 'initialBackoffMs');\n    assertNonNegativeFinite(this.maxBackoffMs, 'maxBackoffMs');\n    assertNonNegativeFinite(this.jitterRatio, 'jitterRatio');\n    if (this.jitterRatio > 1) throw new TypeError('jitterRatio must not exceed 1');\n    this.resetSnapshot();\n  }\n\n  public get snapshot(): DeviceCloudConnectionSnapshot {\n    return {\n      ...this.snapshotValue,\n      components: { ...this.snapshotValue.components },\n    };\n  }\n\n  public async start(): Promise<void> {\n    if (this.started) return this.runNow();\n    this.started = true;\n    await this.runNow();\n  }\n\n  public async stop(): Promise<void> {\n    this.started = false;\n    this.clearTimer();\n    const stoppedController = this.controller;\n    stoppedController.abort(new Error('device cloud coordinator stopped'));\n    await this.inFlight?.catch(() => undefined);\n    if (this.controller === stoppedController) {\n      this.controller = new AbortController();\n    }\n  }\n\n  public async setConfiguration(configuration: Configuration | undefined): Promise<void> {\n    this.configuration = configuration;\n    this.generation += 1;\n    this.consecutiveFailures = 0;\n    this.clearTimer();\n    this.controller.abort(new Error('device cloud configuration changed'));\n    this.controller = new AbortController();\n    this.inFlight = undefined;\n    this.resetSnapshot();\n    if (this.started && this.options.adapter.isConfigured(configuration)) await this.runNow();\n  }\n\n  public runNow(): Promise<void> {\n    if (this.inFlight) return this.inFlight;\n    if (!this.options.adapter.isConfigured(this.configuration)) {\n      this.resetSnapshot();\n      return Promise.resolve();\n    }\n    const generation = this.generation;\n    const configuration = this.configuration;\n    const signal = this.controller.signal;\n    const run = this.maintain(configuration, generation, signal);\n    const tracked = run.finally(() => {\n      if (this.inFlight === tracked) this.inFlight = undefined;\n    });\n    this.inFlight = tracked;\n    return tracked;\n  }\n\n  private async maintain(\n    configuration: Configuration,\n    generation: number,\n    signal: AbortSignal,\n  ): Promise<void> {\n    if (!this.isCurrent(generation, signal)) return;\n    await this.updateSnapshot(generation, {\n      status: 'connecting',\n      lastError: undefined,\n      nextRetryAt: undefined,\n    });\n\n    try {\n      if (this.snapshotValue.components.authorizer !== 'ready') {\n        await this.runStep('authorizer', generation, signal, () => this.options.adapter.ensureAuthorizer(configuration, signal));\n      }\n      if (this.snapshotValue.components.registration !== 'ready') {\n        await this.runStep('registration', generation, signal, () => this.options.adapter.registerDevice(configuration, signal));\n      }\n\n      let relayError: unknown;\n      try {\n        await this.runStep('relay', generation, signal, () => this.options.adapter.ensureRelay(configuration, signal));\n      } catch (error) {\n        relayError = error;\n        this.options.logWarning?.('Cloud relay maintenance failed', error);\n      }\n\n      await this.runStep('heartbeat', generation, signal, () => this.options.adapter.heartbeat(configuration, signal));\n\n      let directoryError: unknown;\n      try {\n        await this.runStep('directory', generation, signal, () => this.options.adapter.syncDirectory(configuration, signal));\n      } catch (error) {\n        directoryError = error;\n        this.options.logWarning?.('Cloud directory synchronization failed', error);\n      }\n\n      if (!this.isCurrent(generation, signal)) return;\n      this.consecutiveFailures = 0;\n      const relayRequired = this.options.adapter.relayRequiredForOnline(configuration);\n      await this.updateSnapshot(generation, {\n        status: directoryError || (relayRequired && relayError) ? 'degraded' : 'online',\n        lastError: directoryError ?? relayError,\n        nextRetryAt: this.now() + this.heartbeatIntervalMs,\n      });\n      this.schedule(this.heartbeatIntervalMs, generation);\n    } catch (error) {\n      if (!this.isCurrent(generation, signal)) return;\n      this.consecutiveFailures += 1;\n      if (this.snapshotValue.components.heartbeat === 'failed') {\n        this.snapshotValue.components.registration = 'not-run';\n      }\n      const status = this.options.adapter.classifyError?.(error) ?? 'offline';\n      const delay = this.backoffDelay();\n      await this.updateSnapshot(generation, {\n        status,\n        lastError: error,\n        nextRetryAt: this.now() + delay,\n      });\n      this.schedule(delay, generation);\n      throw error;\n    }\n  }\n\n  private async runStep(\n    component: DeviceCloudConnectionComponent,\n    generation: number,\n    signal: AbortSignal,\n    operation: () => Promise<DeviceCloudStepResult | undefined>,\n  ): Promise<void> {\n    if (!this.isCurrent(generation, signal)) return;\n    await this.setComponent(component, 'pending', generation);\n    try {\n      const result = await operation();\n      if (!this.isCurrent(generation, signal)) return;\n      await result?.commit?.();\n      if (!this.isCurrent(generation, signal)) return;\n      await this.setComponent(component, 'ready', generation);\n    } catch (error) {\n      if (this.isCurrent(generation, signal)) await this.setComponent(component, 'failed', generation);\n      throw error;\n    }\n  }\n\n  private backoffDelay(): number {\n    const exponential = Math.min(\n      this.maxBackoffMs,\n      this.initialBackoffMs * 2 ** Math.max(0, this.consecutiveFailures - 1),\n    );\n    const jitter = exponential * this.jitterRatio * (this.random() * 2 - 1);\n    return Math.max(0, Math.round(exponential + jitter));\n  }\n\n  private schedule(delayMs: number, generation: number): void {\n    if (!this.started || generation !== this.generation) return;\n    this.clearTimer();\n    this.timer = setTimeout(() => {\n      if (generation !== this.generation) return;\n      void this.runNow().catch((error: unknown) => {\n        this.options.logWarning?.('Cloud maintenance failed', error);\n      });\n    }, delayMs);\n  }\n\n  private clearTimer(): void {\n    if (this.timer) clearTimeout(this.timer);\n    this.timer = undefined;\n  }\n\n  private isCurrent(generation: number, signal: AbortSignal): boolean {\n    return generation === this.generation && !signal.aborted;\n  }\n\n  private async setComponent(\n    component: DeviceCloudConnectionComponent,\n    status: DeviceCloudComponentStatus,\n    generation: number,\n  ): Promise<void> {\n    if (generation !== this.generation) return;\n    this.snapshotValue = {\n      ...this.snapshotValue,\n      components: { ...this.snapshotValue.components, [component]: status },\n    };\n    await this.emit();\n  }\n\n  private async updateSnapshot(\n    generation: number,\n    update: Partial<Omit<DeviceCloudConnectionSnapshot, 'generation' | 'components'>>,\n  ): Promise<void> {\n    if (generation !== this.generation) return;\n    this.snapshotValue = { ...this.snapshotValue, ...update };\n    await this.emit();\n  }\n\n  private resetSnapshot(): void {\n    this.snapshotValue = {\n      status: this.options.adapter.isConfigured(this.configuration)\n        ? 'offline'\n        : 'not-configured',\n      generation: this.generation,\n      components: emptyComponents(),\n    };\n    void this.emit();\n  }\n\n  private async emit(): Promise<void> {\n    await this.options.onStatus?.(this.snapshot);\n  }\n}\n","export type JsonFrameErrorCode =\n  | 'FRAME_TOO_LARGE'\n  | 'TRUNCATED_FRAME'\n  | 'INVALID_UTF8'\n  | 'INVALID_JSON'\n  | 'IDLE_TIMEOUT'\n  | 'TOTAL_TIMEOUT'\n  | 'ABORTED';\n\nexport class JsonFrameError extends Error {\n  public readonly code: JsonFrameErrorCode;\n\n  constructor(code: JsonFrameErrorCode, message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'JsonFrameError';\n    this.code = code;\n  }\n}\n\nexport interface JsonFrameReaderOptions {\n  maxPayloadBytes: number;\n  idleTimeoutMs: number;\n  totalTimeoutMs: number;\n  signal?: AbortSignal;\n  abort?: (error: JsonFrameError) => void | Promise<void>;\n}\n\nconst HEADER_BYTES = 4;\nconst MAX_UINT32 = 0xffff_ffff;\n\nfunction assertPositiveInteger(value: number, name: string): void {\n  if (!Number.isSafeInteger(value) || value <= 0) {\n    throw new TypeError(`${name} must be a positive safe integer`);\n  }\n}\n\nfunction validateMaxPayloadBytes(maxPayloadBytes: number): void {\n  assertPositiveInteger(maxPayloadBytes, 'maxPayloadBytes');\n  if (maxPayloadBytes > MAX_UINT32) {\n    throw new TypeError('maxPayloadBytes must fit in an unsigned 32-bit frame length');\n  }\n}\n\nexport function encodeJsonFrame(value: unknown, maxPayloadBytes = MAX_UINT32): Uint8Array {\n  validateMaxPayloadBytes(maxPayloadBytes);\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(value);\n  } catch (error) {\n    throw new JsonFrameError('INVALID_JSON', 'JSON frame value cannot be serialized', {\n      cause: error,\n    });\n  }\n  if (serialized === undefined) {\n    throw new JsonFrameError('INVALID_JSON', 'JSON frame value cannot be serialized');\n  }\n  const payload = new TextEncoder().encode(serialized);\n  if (payload.byteLength > maxPayloadBytes) {\n    throw new JsonFrameError(\n      'FRAME_TOO_LARGE',\n      `JSON frame payload exceeds ${maxPayloadBytes} bytes`,\n    );\n  }\n  const frame = new Uint8Array(HEADER_BYTES + payload.byteLength);\n  new DataView(frame.buffer, frame.byteOffset, HEADER_BYTES).setUint32(0, payload.byteLength, false);\n  frame.set(payload, HEADER_BYTES);\n  return frame;\n}\n\nexport async function* encodeJsonFrames(\n  values: AsyncIterable<unknown> | Iterable<unknown>,\n  maxPayloadBytes = MAX_UINT32,\n): AsyncIterable<Uint8Array> {\n  for await (const value of values) {\n    yield encodeJsonFrame(value, maxPayloadBytes);\n  }\n}\n\nfunction concatBytes(left: Uint8Array, right: Uint8Array): Uint8Array {\n  if (left.byteLength === 0) return right.slice();\n  if (right.byteLength === 0) return left;\n  const combined = new Uint8Array(left.byteLength + right.byteLength);\n  combined.set(left);\n  combined.set(right, left.byteLength);\n  return combined;\n}\n\nfunction abortedError(signal?: AbortSignal): JsonFrameError {\n  return new JsonFrameError('ABORTED', 'JSON frame reading was aborted', {\n    cause: signal?.reason,\n  });\n}\n\nasync function readNextChunk(\n  iterator: AsyncIterator<Uint8Array>,\n  idleDeadline: number,\n  totalDeadline: number | undefined,\n  signal: AbortSignal | undefined,\n): Promise<IteratorResult<Uint8Array>> {\n  if (signal?.aborted) throw abortedError(signal);\n  const now = Date.now();\n  const deadline = totalDeadline === undefined\n    ? idleDeadline\n    : Math.min(idleDeadline, totalDeadline);\n  if (deadline <= now) {\n    throw new JsonFrameError(\n      totalDeadline !== undefined && totalDeadline <= idleDeadline ? 'TOTAL_TIMEOUT' : 'IDLE_TIMEOUT',\n      totalDeadline !== undefined && totalDeadline <= idleDeadline\n        ? 'JSON frame total timeout expired'\n        : 'JSON frame idle timeout expired',\n    );\n  }\n\n  return new Promise<IteratorResult<Uint8Array>>((resolve, reject) => {\n    let settled = false;\n    const finish = (callback: () => void) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timer);\n      signal?.removeEventListener('abort', onAbort);\n      callback();\n    };\n    const onAbort = () => {\n      finish(() => {\n        reject(abortedError(signal));\n      });\n    };\n    const timer = setTimeout(() => {\n      const currentTime = Date.now();\n      const totalExpired = totalDeadline !== undefined && currentTime >= totalDeadline;\n      finish(() => {\n        reject(\n          new JsonFrameError(\n            totalExpired ? 'TOTAL_TIMEOUT' : 'IDLE_TIMEOUT',\n            totalExpired ? 'JSON frame total timeout expired' : 'JSON frame idle timeout expired',\n          ),\n        );\n      });\n    }, Math.max(1, deadline - now));\n    signal?.addEventListener('abort', onAbort, { once: true });\n    void iterator.next().then(\n      (result) => {\n        finish(() => {\n          resolve(result);\n        });\n      },\n      (error: unknown) => {\n        finish(() => {\n          reject(\n            error instanceof Error ? error : new Error('JSON frame source failed', {\n              cause: error,\n            }),\n          );\n        });\n      },\n    );\n  });\n}\n\n/**\n * Decode uint32be-length-prefixed, strict UTF-8 JSON frames from an arbitrary\n * chunked byte stream. Buffered remainder is retained so one chunk may contain\n * any number of complete or partial frames.\n */\nexport function createJsonFrameReader(\n  source: AsyncIterable<Uint8Array>,\n  options: JsonFrameReaderOptions,\n): AsyncIterable<unknown> {\n  validateMaxPayloadBytes(options.maxPayloadBytes);\n  assertPositiveInteger(options.idleTimeoutMs, 'idleTimeoutMs');\n  assertPositiveInteger(options.totalTimeoutMs, 'totalTimeoutMs');\n\n  return (async function* readFrames(): AsyncIterable<unknown> {\n    const iterator = source[Symbol.asyncIterator]();\n    let buffered: Uint8Array = new Uint8Array(0);\n    let expectedPayloadBytes: number | undefined;\n    let idleDeadline = Date.now() + options.idleTimeoutMs;\n    let totalDeadline: number | undefined;\n    let abortCalled = false;\n\n    const abortOnce = async (error: JsonFrameError): Promise<void> => {\n      if (abortCalled) return;\n      abortCalled = true;\n      await Promise.resolve(options.abort?.(error)).catch(() => undefined);\n    };\n\n    try {\n      for (;;) {\n        if (expectedPayloadBytes === undefined && buffered.byteLength >= HEADER_BYTES) {\n          expectedPayloadBytes = new DataView(\n            buffered.buffer,\n            buffered.byteOffset,\n            HEADER_BYTES,\n          ).getUint32(0, false);\n          buffered = buffered.slice(HEADER_BYTES);\n          totalDeadline ??= Date.now() + options.totalTimeoutMs;\n          if (expectedPayloadBytes > options.maxPayloadBytes) {\n            throw new JsonFrameError(\n              'FRAME_TOO_LARGE',\n              `JSON frame payload exceeds ${options.maxPayloadBytes} bytes`,\n            );\n          }\n        }\n\n        if (\n          expectedPayloadBytes !== undefined &&\n          buffered.byteLength >= expectedPayloadBytes\n        ) {\n          const payload = buffered.slice(0, expectedPayloadBytes);\n          buffered = buffered.slice(expectedPayloadBytes);\n          expectedPayloadBytes = undefined;\n          totalDeadline = buffered.byteLength > 0\n            ? Date.now() + options.totalTimeoutMs\n            : undefined;\n          let text: string;\n          try {\n            text = new TextDecoder('utf-8', { fatal: true }).decode(payload);\n          } catch (error) {\n            throw new JsonFrameError('INVALID_UTF8', 'JSON frame payload is not valid UTF-8', {\n              cause: error,\n            });\n          }\n          let value: unknown;\n          try {\n            value = JSON.parse(text) as unknown;\n          } catch (error) {\n            throw new JsonFrameError('INVALID_JSON', 'JSON frame payload is not valid JSON', {\n              cause: error,\n            });\n          }\n          yield value;\n          idleDeadline = Date.now() + options.idleTimeoutMs;\n          continue;\n        }\n\n        const result = await readNextChunk(\n          iterator,\n          idleDeadline,\n          totalDeadline,\n          options.signal,\n        );\n        if (result.done) {\n          if (buffered.byteLength > 0 || expectedPayloadBytes !== undefined) {\n            throw new JsonFrameError('TRUNCATED_FRAME', 'JSON frame stream ended mid-frame');\n          }\n          return;\n        }\n        if (!(result.value instanceof Uint8Array)) {\n          throw new TypeError('JSON frame source must yield Uint8Array chunks');\n        }\n        if (result.value.byteLength === 0) continue;\n        const now = Date.now();\n        idleDeadline = now + options.idleTimeoutMs;\n        totalDeadline ??= now + options.totalTimeoutMs;\n        buffered = concatBytes(buffered, result.value);\n      }\n    } catch (error) {\n      const frameError = error instanceof JsonFrameError\n        ? error\n        : new JsonFrameError('ABORTED', 'JSON frame source failed', { cause: error });\n      await abortOnce(frameError);\n      throw frameError;\n    } finally {\n      // An async generator can be blocked in an uncooperative await. The\n      // underlying stream abort above is the cancellation boundary; waiting\n      // for iterator.return() here would let that source deadlock the caller.\n      void iterator.return?.().catch(() => undefined);\n    }\n  })();\n}\n","import { OrchestrationError } from '../orchestration/errors.js';\nimport type { RemoteOrchestrationRequest, RemoteOrchestrationResponse, RemoteOrchestrationTransport, RemoteOrchestrationTransportOptions } from '../orchestration/remoteClient.js';\nimport { createJsonFrameReader, encodeJsonFrames, JsonFrameError } from './jsonFrame.js';\nimport type { DeviceConnectionGrant, DeviceNetworkService, MemeLoopDuplexStream } from './types.js';\n\nexport const DEVICE_ORCHESTRATION_PROTOCOL = '/memeloop/orchestration/2.0.0' as const;\nconst DEFAULT_MAX_FRAME_BYTES = 1024 * 1024;\nconst REQUEST_IDLE_TIMEOUT_MS = 10_000;\nconst REQUEST_TOTAL_TIMEOUT_MS = 30_000;\nconst WATCH_IDLE_TIMEOUT_MS = 90_000;\nconst WATCH_BOOKMARK_INTERVAL_MS = 30_000;\n\nexport interface DeviceOrchestrationTransportOptions {\n  deviceNetwork: Pick<DeviceNetworkService, 'openStream'>;\n  peerId: string;\n  grantProvider?: (\n    peerId: string,\n  ) => DeviceConnectionGrant | undefined | Promise<DeviceConnectionGrant | undefined>;\n  maxFrameBytes?: number;\n}\n\nexport interface DeviceOrchestrationStreamHandlerInput {\n  remotePeerId: string;\n  stream: MemeLoopDuplexStream;\n  authorize?: (presentedGrant: DeviceConnectionGrant | undefined) => boolean | Promise<boolean>;\n}\n\nexport type RemoteOrchestrationHandler = {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n};\n\nexport interface DeviceOrchestrationStreamHandlerOptions {\n  resolveHandler: (\n    remotePeerId: string,\n  ) => RemoteOrchestrationHandler | Promise<RemoteOrchestrationHandler>;\n  maxFrameBytes?: number;\n}\n\nexport type DeviceOrchestrationStreamHandler = (\n  input: DeviceOrchestrationStreamHandlerInput,\n) => Promise<void>;\n\ninterface DeviceOrchestrationRequestEnvelope {\n  type: 'memeloop-device-orchestration-request-v2';\n  request: RemoteOrchestrationRequest;\n  grant?: DeviceConnectionGrant;\n}\n\nfunction orchestrationTransportError(\n  code: 'CANCELLED' | 'EXHAUSTED' | 'INVALID' | 'UNAVAILABLE',\n  message: string,\n): OrchestrationError {\n  return new OrchestrationError({\n    code,\n    message,\n    retryable: code === 'UNAVAILABLE',\n  });\n}\n\nfunction assertFrameLimit(limit: number): void {\n  if (!Number.isSafeInteger(limit) || limit < 256) {\n    throw new TypeError('maxFrameBytes must be a safe integer of at least 256');\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw orchestrationTransportError('CANCELLED', 'device orchestration request was cancelled');\n  }\n}\n\nasync function openAuthenticatedStream(options: DeviceOrchestrationTransportOptions): Promise<{\n  stream: MemeLoopDuplexStream;\n  grant: DeviceConnectionGrant | undefined;\n}> {\n  const grant = await options.grantProvider?.(options.peerId);\n  return {\n    stream: await options.deviceNetwork.openStream(\n      options.peerId,\n      DEVICE_ORCHESTRATION_PROTOCOL,\n      grant,\n    ),\n    grant,\n  };\n}\n\nasync function writeRequest(\n  stream: MemeLoopDuplexStream,\n  request: RemoteOrchestrationRequest,\n  grant: DeviceConnectionGrant | undefined,\n  maxFrameBytes: number,\n): Promise<void> {\n  const envelope: DeviceOrchestrationRequestEnvelope = {\n    type: 'memeloop-device-orchestration-request-v2',\n    request,\n    ...(grant ? { grant } : {}),\n  };\n  await stream.sink(encodeJsonFrames([envelope], maxFrameBytes));\n}\n\nfunction abortStreamOnce(stream: MemeLoopDuplexStream): (error: Error) => Promise<void> {\n  let aborted = false;\n  return async (error) => {\n    if (aborted) return;\n    aborted = true;\n    await stream.abort(error);\n  };\n}\n\nfunction frameReader(\n  stream: MemeLoopDuplexStream,\n  maxFrameBytes: number,\n  idleTimeoutMs: number,\n  signal: AbortSignal | undefined,\n  abort: (error: Error) => Promise<void>,\n): AsyncIterable<unknown> {\n  return createJsonFrameReader(stream.source, {\n    maxPayloadBytes: maxFrameBytes,\n    idleTimeoutMs,\n    totalTimeoutMs: REQUEST_TOTAL_TIMEOUT_MS,\n    signal,\n    abort,\n  });\n}\n\nfunction mapFrameError(error: unknown): never {\n  if (!(error instanceof JsonFrameError)) throw error;\n  if (error.code === 'ABORTED') {\n    throw orchestrationTransportError('CANCELLED', error.message);\n  }\n  if (error.code === 'FRAME_TOO_LARGE') {\n    throw orchestrationTransportError('EXHAUSTED', error.message);\n  }\n  if (error.code === 'IDLE_TIMEOUT' || error.code === 'TOTAL_TIMEOUT') {\n    throw orchestrationTransportError('UNAVAILABLE', error.message);\n  }\n  throw orchestrationTransportError('INVALID', error.message);\n}\n\n/**\n * Carry the portable resource protocol over an already authenticated and\n * encrypted device-network stream. No bearer credential crosses the link:\n * authorization is bound to the paired peer identity opening the protocol.\n */\nexport function createDeviceOrchestrationTransport(\n  options: DeviceOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;\n  assertFrameLimit(maxFrameBytes);\n\n  return {\n    async request(request, transportOptions = {}) {\n      throwIfAborted(transportOptions.signal);\n      const { stream, grant } = await openAuthenticatedStream(options);\n      const abort = abortStreamOnce(stream);\n      const closeOnAbort = () => {\n        void abort(orchestrationTransportError('CANCELLED', 'device orchestration request was cancelled'));\n      };\n      transportOptions.signal?.addEventListener('abort', closeOnAbort, {\n        once: true,\n      });\n      try {\n        await writeRequest(stream, request, grant, maxFrameBytes);\n        let response: RemoteOrchestrationResponse | undefined;\n        for await (\n          const value of frameReader(\n            stream,\n            maxFrameBytes,\n            REQUEST_IDLE_TIMEOUT_MS,\n            transportOptions.signal,\n            abort,\n          )\n        ) {\n          if (response) {\n            throw orchestrationTransportError(\n              'INVALID',\n              'device orchestration request returned multiple responses',\n            );\n          }\n          response = value as RemoteOrchestrationResponse;\n        }\n        throwIfAborted(transportOptions.signal);\n        if (!response) {\n          throw orchestrationTransportError(\n            'UNAVAILABLE',\n            'device orchestration request returned no response',\n          );\n        }\n        return response;\n      } catch (error) {\n        if (error instanceof JsonFrameError) await abort(error);\n        mapFrameError(error);\n      } finally {\n        transportOptions.signal?.removeEventListener('abort', closeOnAbort);\n        await stream.close().catch(() => undefined);\n      }\n    },\n    async *watch(request, transportOptions = {}) {\n      throwIfAborted(transportOptions.signal);\n      const { stream, grant } = await openAuthenticatedStream(options);\n      const abort = abortStreamOnce(stream);\n      const closeOnAbort = () => {\n        void abort(orchestrationTransportError('CANCELLED', 'device orchestration watch was cancelled'));\n      };\n      transportOptions.signal?.addEventListener('abort', closeOnAbort, {\n        once: true,\n      });\n      try {\n        await writeRequest(stream, request, grant, maxFrameBytes);\n        for await (\n          const value of frameReader(\n            stream,\n            maxFrameBytes,\n            WATCH_IDLE_TIMEOUT_MS,\n            transportOptions.signal,\n            abort,\n          )\n        ) {\n          throwIfAborted(transportOptions.signal);\n          yield value as RemoteOrchestrationResponse;\n        }\n        throwIfAborted(transportOptions.signal);\n      } catch (error) {\n        if (error instanceof JsonFrameError) await abort(error);\n        mapFrameError(error);\n      } finally {\n        transportOptions.signal?.removeEventListener('abort', closeOnAbort);\n        await stream.close().catch(() => undefined);\n      }\n    },\n  };\n}\n\nasync function readSingleRequest(\n  stream: MemeLoopDuplexStream,\n  maxFrameBytes: number,\n): Promise<DeviceOrchestrationRequestEnvelope> {\n  const abort = abortStreamOnce(stream);\n  let envelope: DeviceOrchestrationRequestEnvelope | undefined;\n  for await (\n    const value of frameReader(\n      stream,\n      maxFrameBytes,\n      REQUEST_IDLE_TIMEOUT_MS,\n      undefined,\n      abort,\n    )\n  ) {\n    if (envelope) {\n      throw orchestrationTransportError(\n        'INVALID',\n        'device orchestration stream accepts exactly one request',\n      );\n    }\n    if (\n      value === null ||\n      typeof value !== 'object' ||\n      Array.isArray(value) ||\n      (value as Record<string, unknown>).type !== 'memeloop-device-orchestration-request-v2' ||\n      (value as Record<string, unknown>).request === null ||\n      typeof (value as Record<string, unknown>).request !== 'object'\n    ) {\n      throw orchestrationTransportError(\n        'INVALID',\n        'device orchestration request envelope is invalid',\n      );\n    }\n    envelope = value as DeviceOrchestrationRequestEnvelope;\n  }\n  if (!envelope) {\n    throw orchestrationTransportError('INVALID', 'device orchestration request is missing');\n  }\n  return envelope;\n}\n\nasync function* withWatchBookmarks(\n  source: AsyncIterable<RemoteOrchestrationResponse>,\n  request: RemoteOrchestrationRequest,\n  signal: AbortSignal,\n): AsyncIterable<RemoteOrchestrationResponse> {\n  const iterator = source[Symbol.asyncIterator]();\n  type WatchActivity =\n    | { kind: 'value'; value: IteratorResult<RemoteOrchestrationResponse> }\n    | { kind: 'error'; error: unknown }\n    | { kind: 'aborted' };\n\n  let activity: WatchActivity | undefined;\n  let activityWaiter: ((value: WatchActivity | { kind: 'bookmark' }) => void) | undefined;\n  let bookmarkTimer: ReturnType<typeof setTimeout> | undefined;\n  let readInFlight = false;\n  let lastResourceVersion = watchResourceVersion(request.payload.options) ?? '0';\n\n  const clearBookmarkTimer = () => {\n    if (bookmarkTimer !== undefined) clearTimeout(bookmarkTimer);\n    bookmarkTimer = undefined;\n  };\n  const publishActivity = (value: WatchActivity) => {\n    if (activityWaiter) {\n      const resolve = activityWaiter;\n      activityWaiter = undefined;\n      clearBookmarkTimer();\n      resolve(value);\n      return;\n    }\n    activity = value;\n  };\n  const readNext = () => {\n    if (readInFlight) return;\n    readInFlight = true;\n    void iterator.next().then(\n      (value) => {\n        readInFlight = false;\n        publishActivity({ kind: 'value', value });\n      },\n      (error: unknown) => {\n        readInFlight = false;\n        publishActivity({ kind: 'error', error });\n      },\n    );\n  };\n  const waitForActivity = (): Promise<WatchActivity | { kind: 'bookmark' }> => {\n    if (activity) {\n      const value = activity;\n      activity = undefined;\n      return Promise.resolve(value);\n    }\n    if (signal.aborted) return Promise.resolve({ kind: 'aborted' });\n    return new Promise((resolve) => {\n      activityWaiter = resolve;\n      bookmarkTimer = setTimeout(() => {\n        bookmarkTimer = undefined;\n        activityWaiter = undefined;\n        resolve({ kind: 'bookmark' });\n      }, WATCH_BOOKMARK_INTERVAL_MS);\n    });\n  };\n  const onAbort = () => {\n    publishActivity({ kind: 'aborted' });\n  };\n\n  signal.addEventListener('abort', onAbort, { once: true });\n  readNext();\n  try {\n    for (;;) {\n      const result = await waitForActivity();\n      if (result.kind === 'aborted') return;\n      if (result.kind === 'bookmark') {\n        yield {\n          protocol: request.protocol,\n          requestId: request.requestId,\n          ok: true,\n          result: { type: 'BOOKMARK', resourceVersion: lastResourceVersion },\n        };\n        continue;\n      }\n      if (result.kind === 'error') throw result.error;\n      if (result.value.done) return;\n      const response = result.value.value;\n      lastResourceVersion = response.ok\n        ? watchResourceVersion(response.result) ?? lastResourceVersion\n        : lastResourceVersion;\n      yield response;\n      readNext();\n    }\n  } finally {\n    clearBookmarkTimer();\n    activityWaiter = undefined;\n    signal.removeEventListener('abort', onAbort);\n    void iterator.return?.();\n  }\n}\n\nfunction watchResourceVersion(value: unknown): string | undefined {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined;\n  const resourceVersion = (value as Record<string, unknown>).resourceVersion;\n  return typeof resourceVersion === 'string' && resourceVersion.length > 0\n    ? resourceVersion\n    : undefined;\n}\n\n/** Bind a trusted peer identity to a policy-scoped orchestration handler. */\nexport function createDeviceOrchestrationStreamHandler(\n  options: DeviceOrchestrationStreamHandlerOptions,\n): DeviceOrchestrationStreamHandler {\n  const maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;\n  assertFrameLimit(maxFrameBytes);\n  return async ({ remotePeerId, stream, authorize }) => {\n    const abort = new AbortController();\n    try {\n      const envelope = await readSingleRequest(stream, maxFrameBytes);\n      if (authorize && !(await authorize(envelope.grant))) {\n        throw orchestrationTransportError('UNAVAILABLE', 'device_not_trusted');\n      }\n      const request = envelope.request;\n      const handler = await options.resolveHandler(remotePeerId);\n      if (request.operation === 'watch') {\n        await stream.sink(\n          encodeJsonFrames(\n            withWatchBookmarks(handler.watch(request, { signal: abort.signal }), request, abort.signal),\n            maxFrameBytes,\n          ),\n        );\n      } else {\n        await stream.sink(encodeJsonFrames([await handler.request(request)], maxFrameBytes));\n      }\n    } finally {\n      abort.abort();\n      await stream.close().catch(() => undefined);\n    }\n  };\n}\n","import type { DeviceConnectionGrant } from './types.js';\n\nexport const LIBP2P_SYNC_REQUEST_TYPE = 'memeloop-sync-request-v2';\nexport const LIBP2P_SYNC_RESPONSE_TYPE = 'memeloop-sync-response-v2';\n\nexport type Libp2pSyncMethod =\n  | 'exchangeVersionVector'\n  | 'pullMissingMetadata'\n  | 'pullMissingMessages'\n  | 'pullAttachmentBlob';\n\nexport interface Libp2pSyncRequest {\n  type: typeof LIBP2P_SYNC_REQUEST_TYPE;\n  id: string;\n  method: Libp2pSyncMethod;\n  params: unknown;\n  grant?: DeviceConnectionGrant;\n}\n\nexport type Libp2pSyncResponse =\n  | {\n    type: typeof LIBP2P_SYNC_RESPONSE_TYPE;\n    id: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    type: typeof LIBP2P_SYNC_RESPONSE_TYPE;\n    id: string;\n    ok: false;\n    error: string;\n  };\n\nexport interface AttachmentBlobWire {\n  dataBase64Url: string;\n  filename: string;\n  mimeType: string;\n  size: number;\n}\n\nconst syncMethods = new Set<Libp2pSyncMethod>([\n  'exchangeVersionVector',\n  'pullMissingMetadata',\n  'pullMissingMessages',\n  'pullAttachmentBlob',\n]);\n\nexport function isLibp2pSyncRequest(value: unknown): value is Libp2pSyncRequest {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    record.type === LIBP2P_SYNC_REQUEST_TYPE &&\n    typeof record.id === 'string' &&\n    typeof record.method === 'string' &&\n    syncMethods.has(record.method as Libp2pSyncMethod)\n  );\n}\n\nexport function isLibp2pSyncResponse(value: unknown): value is Libp2pSyncResponse {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  if (record.type !== LIBP2P_SYNC_RESPONSE_TYPE || typeof record.id !== 'string' || typeof record.ok !== 'boolean') return false;\n  if (record.ok) return 'result' in record;\n  return typeof record.error === 'string';\n}\n\nfunction isAttachmentBlobWire(value: unknown): value is AttachmentBlobWire {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.dataBase64Url === 'string' &&\n    typeof record.filename === 'string' &&\n    typeof record.mimeType === 'string' &&\n    typeof record.size === 'number'\n  );\n}\n\nexport async function attachmentBlobFromWire(value: unknown): Promise<\n  {\n    data: Uint8Array;\n    filename: string;\n    mimeType: string;\n    size: number;\n  } | null\n> {\n  if (value === null) return null;\n  if (!isAttachmentBlobWire(value)) throw new Error('invalid_sync_response');\n  let data: Uint8Array;\n  try {\n    const base64 = value.dataBase64Url.replace(/-/g, '+').replace(/_/g, '/');\n    const paddedBase64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const binary = atob(paddedBase64);\n    data = Uint8Array.from(binary, (character) => character.charCodeAt(0));\n  } catch {\n    throw new Error('invalid_sync_response');\n  }\n  return {\n    data,\n    filename: value.filename,\n    mimeType: value.mimeType,\n    size: value.size,\n  };\n}\n","import type { ChatMessage } from '../conversation/index.js';\nimport type { ConversationMetadataPage, VersionVector } from '../sync/protocol.js';\nimport { createJsonFrameReader, encodeJsonFrames, JsonFrameError } from './jsonFrame.js';\nimport { attachmentBlobFromWire, isLibp2pSyncResponse, LIBP2P_SYNC_REQUEST_TYPE, type Libp2pSyncMethod, type Libp2pSyncRequest } from './libp2pSyncProtocol.js';\nimport type { AttachmentBlob, Device, DeviceConnectionGrant, DeviceNetworkService, DeviceSyncTransport, ExchangeVersionVectorResult } from './types.js';\n\nexport interface Libp2pDeviceSyncTransportOptions {\n  nodeId: string;\n  deviceNetwork: Pick<DeviceNetworkService, 'listDevices' | 'openStream'>;\n  grantProvider?: (peerId: string) => Promise<DeviceConnectionGrant | undefined>;\n}\n\nexport class Libp2pDeviceSyncTransport implements DeviceSyncTransport {\n  public readonly nodeId: string;\n  private readonly deviceNetwork: Pick<DeviceNetworkService, 'listDevices' | 'openStream'>;\n  private readonly grantProvider?: (peerId: string) => Promise<DeviceConnectionGrant | undefined>;\n\n  constructor(options: Libp2pDeviceSyncTransportOptions) {\n    this.nodeId = options.nodeId;\n    this.deviceNetwork = options.deviceNetwork;\n    this.grantProvider = options.grantProvider;\n  }\n\n  public listPeers(): Promise<Device[]> {\n    return this.deviceNetwork.listDevices();\n  }\n\n  public exchangeVersionVector(peerId: string, localVersion: VersionVector): Promise<ExchangeVersionVectorResult> {\n    return this.request(peerId, 'exchangeVersionVector', { localVersion }) as Promise<ExchangeVersionVectorResult>;\n  }\n\n  public pullMissingMetadata(\n    peerId: string,\n    sinceVersion: VersionVector,\n    cursor?: string,\n  ): Promise<ConversationMetadataPage> {\n    return this.request(peerId, 'pullMissingMetadata', {\n      sinceVersion,\n      cursor,\n    }) as Promise<ConversationMetadataPage>;\n  }\n\n  public pullMissingMessages(peerId: string, conversationId: string, knownMessageIds: string[]): Promise<ChatMessage[]> {\n    return this.request(peerId, 'pullMissingMessages', { conversationId, knownMessageIds }) as Promise<ChatMessage[]>;\n  }\n\n  public async pullAttachmentBlob(peerId: string, contentHash: string): Promise<AttachmentBlob | null> {\n    const result = await this.request(peerId, 'pullAttachmentBlob', { contentHash });\n    return attachmentBlobFromWire(result);\n  }\n\n  private async request(peerId: string, method: Libp2pSyncMethod, parameters: unknown): Promise<unknown> {\n    const grant = await this.grantProvider?.(peerId);\n    const stream = await this.deviceNetwork.openStream(peerId, '/memeloop/sync/2.0.0', grant);\n    const request: Libp2pSyncRequest = {\n      type: LIBP2P_SYNC_REQUEST_TYPE,\n      id: crypto.randomUUID(),\n      method,\n      params: parameters,\n      grant,\n    };\n    try {\n      await stream.sink(encodeJsonFrames([request], 16 * 1024 * 1024));\n      let response: unknown;\n      for await (\n        const value of createJsonFrameReader(stream.source, {\n          maxPayloadBytes: 16 * 1024 * 1024,\n          idleTimeoutMs: 15_000,\n          totalTimeoutMs: 120_000,\n          abort: async (error) => stream.abort(error),\n        })\n      ) {\n        if (response !== undefined) throw new Error('sync_response_multiple');\n        response = value;\n      }\n      if (!isLibp2pSyncResponse(response)) throw new Error('invalid_sync_response');\n      if (response.id !== request.id) throw new Error('sync_response_id_mismatch');\n      if (!response.ok) throw new Error(response.error);\n      return response.result;\n    } catch (error) {\n      if (error instanceof JsonFrameError) await stream.abort(error);\n      throw error;\n    } finally {\n      await stream.close().catch(() => undefined);\n    }\n  }\n}\n","import type { DeviceConnectionGrant } from './types.js';\n\nexport const LIBP2P_RPC_REQUEST_TYPE = 'memeloop-rpc-request-v2';\nexport const LIBP2P_RPC_RESPONSE_TYPE = 'memeloop-rpc-response-v2';\n\nexport interface Libp2pRpcRequest {\n  type: typeof LIBP2P_RPC_REQUEST_TYPE;\n  id: string;\n  method: string;\n  params: unknown;\n  grant?: DeviceConnectionGrant;\n}\n\nexport type Libp2pRpcResponse =\n  | {\n    type: typeof LIBP2P_RPC_RESPONSE_TYPE;\n    id: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    type: typeof LIBP2P_RPC_RESPONSE_TYPE;\n    id: string;\n    ok: false;\n    error: string;\n  };\n\nexport function isLibp2pRpcRequest(value: unknown): value is Libp2pRpcRequest {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    record.type === LIBP2P_RPC_REQUEST_TYPE &&\n    typeof record.id === 'string' &&\n    typeof record.method === 'string'\n  );\n}\n\nexport function isLibp2pRpcResponse(value: unknown): value is Libp2pRpcResponse {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  if (record.type !== LIBP2P_RPC_RESPONSE_TYPE || typeof record.id !== 'string' || typeof record.ok !== 'boolean') return false;\n  if (record.ok) return 'result' in record;\n  return typeof record.error === 'string';\n}\n","import type { DeviceAuthorizer, MemeLoopProtocol, TrustedDeviceRecord } from './types.js';\n\nexport interface LocalTrustDeviceAuthorizerOptions {\n  trustedDevices?: Iterable<TrustedDeviceRecord>;\n  getTrustedDevice?: (peerId: string) => TrustedDeviceRecord | undefined;\n  allowPairingProtocol?: boolean;\n}\n\nconst PAIRING_PROTOCOL: MemeLoopProtocol = '/memeloop/pairing/2.0.0';\n\nexport class LocalTrustDeviceAuthorizer implements DeviceAuthorizer {\n  private readonly trustedDevices = new Map<string, TrustedDeviceRecord>();\n  private readonly allowPairingProtocol: boolean;\n\n  constructor(private readonly options: LocalTrustDeviceAuthorizerOptions = {}) {\n    this.allowPairingProtocol = options.allowPairingProtocol ?? true;\n    for (const record of options.trustedDevices ?? []) {\n      this.trustedDevices.set(record.peerId, record);\n    }\n  }\n\n  public setTrustedDevice(record: TrustedDeviceRecord): void {\n    this.trustedDevices.set(record.peerId, record);\n  }\n\n  public removeTrustedDevice(peerId: string): void {\n    this.trustedDevices.delete(peerId);\n  }\n\n  public async canOpenProtocol(input: {\n    remotePeerId: string;\n    protocol: MemeLoopProtocol;\n  }): Promise<boolean> {\n    const record = this.options.getTrustedDevice?.(input.remotePeerId) ?? this.trustedDevices.get(input.remotePeerId);\n    if (record?.revokedAt) return false;\n    if (input.protocol === PAIRING_PROTOCOL) return this.allowPairingProtocol;\n    return record !== undefined;\n  }\n}\n","import type { Device } from './types.js';\n\nexport const DEVICE_PAIRING_INVITE_PROTOCOL = 'memeloop-device-pairing-v2';\nexport const DEVICE_PAIRING_INVITE_TTL_MS = 5 * 60_000;\nconst MAX_INVITE_LENGTH = 16 * 1024;\nconst MAX_ADDRESSES = 8;\n\nexport interface DevicePairingInvite {\n  protocol: typeof DEVICE_PAIRING_INVITE_PROTOCOL;\n  peerId: string;\n  publicKeyMultibase: string;\n  deviceName: string;\n  multiaddrs: string[];\n  createdAt: number;\n  expiresAt: number;\n  signature: string;\n}\n\nexport type DevicePairingInviteUnsignedPayload = Omit<DevicePairingInvite, 'signature'>;\n\nexport interface DevicePairingInviteIdentityVerifierInput {\n  invite: DevicePairingInvite;\n  payload: Uint8Array;\n}\n\nexport type DevicePairingInviteIdentityVerifier = (\n  input: DevicePairingInviteIdentityVerifierInput,\n) => boolean | Promise<boolean>;\n\nexport interface CreateDevicePairingInviteOptions {\n  now?: number;\n  ttlMs?: number;\n  sign(payload: Uint8Array): Promise<string>;\n}\n\nexport interface ParseDevicePairingInviteOptions {\n  now?: number;\n  verifyIdentity: DevicePairingInviteIdentityVerifier;\n}\n\nfunction requireText(value: string, name: string, maxLength: number): string {\n  const trimmed = value.trim();\n  if (!trimmed || trimmed.length > maxLength) {\n    throw new Error(`invalid device pairing invite ${name}`);\n  }\n  return trimmed;\n}\n\nfunction finalPeerId(address: string): string | undefined {\n  const parts = address.split('/');\n  for (let index = parts.length - 2; index >= 0; index -= 1) {\n    if (parts[index] === 'p2p') return parts[index + 1];\n  }\n  return undefined;\n}\n\nfunction validateAddresses(addresses: readonly string[], peerId: string): string[] {\n  const unique = [...new Set(addresses.map((address) => address.trim()))].filter(Boolean);\n  if (\n    unique.length === 0 ||\n    unique.length > MAX_ADDRESSES ||\n    unique.some((address) =>\n      address.length > 2048 ||\n      !address.startsWith('/') ||\n      (!address.includes('/ws') && !address.includes('/wss')) ||\n      finalPeerId(address) !== peerId\n    )\n  ) {\n    throw new Error('device pairing invite requires PeerId-bound WebSocket multiaddrs');\n  }\n  return unique;\n}\n\nfunction validateLifetime(createdAt: number, expiresAt: number, now: number): void {\n  if (\n    !Number.isSafeInteger(createdAt) ||\n    !Number.isSafeInteger(expiresAt) ||\n    expiresAt <= createdAt ||\n    expiresAt - createdAt > DEVICE_PAIRING_INVITE_TTL_MS\n  ) {\n    throw new Error('invalid device pairing invite lifetime');\n  }\n  if (expiresAt <= now) throw new Error('device pairing invite has expired');\n}\n\nfunction unsignedPayload(invite: DevicePairingInviteUnsignedPayload): DevicePairingInviteUnsignedPayload {\n  const peerId = requireText(invite.peerId, 'peerId', 256);\n  return {\n    protocol: DEVICE_PAIRING_INVITE_PROTOCOL,\n    peerId,\n    publicKeyMultibase: requireText(invite.publicKeyMultibase, 'publicKeyMultibase', 4096),\n    deviceName: requireText(invite.deviceName, 'deviceName', 256),\n    multiaddrs: [...validateAddresses(invite.multiaddrs, peerId)].sort(),\n    createdAt: invite.createdAt,\n    expiresAt: invite.expiresAt,\n  };\n}\n\nexport function canonicalDevicePairingInviteBytes(\n  invite: DevicePairingInviteUnsignedPayload,\n): Uint8Array {\n  const payload = unsignedPayload(invite);\n  const canonical = [\n    DEVICE_PAIRING_INVITE_PROTOCOL,\n    `peerId=${payload.peerId}`,\n    `publicKey=${payload.publicKeyMultibase}`,\n    `deviceName=${payload.deviceName}`,\n    `multiaddrs=${payload.multiaddrs.join(',')}`,\n    `createdAt=${payload.createdAt}`,\n    `expiresAt=${payload.expiresAt}`,\n  ].join('\\n');\n  return new TextEncoder().encode(canonical);\n}\n\nexport async function createDevicePairingInvite(\n  device: Pick<Device, 'peerId' | 'displayName' | 'multiaddrs'> & {\n    publicKeyMultibase: string;\n  },\n  options: CreateDevicePairingInviteOptions,\n): Promise<DevicePairingInvite> {\n  const createdAt = options.now ?? Date.now();\n  const ttlMs = options.ttlMs ?? DEVICE_PAIRING_INVITE_TTL_MS;\n  if (!Number.isSafeInteger(createdAt) || !Number.isSafeInteger(ttlMs) || ttlMs <= 0) {\n    throw new Error('invalid device pairing invite lifetime');\n  }\n  const payload = unsignedPayload({\n    protocol: DEVICE_PAIRING_INVITE_PROTOCOL,\n    peerId: device.peerId,\n    publicKeyMultibase: device.publicKeyMultibase,\n    deviceName: device.displayName,\n    multiaddrs: device.multiaddrs ?? [],\n    createdAt,\n    expiresAt: createdAt + ttlMs,\n  });\n  validateLifetime(payload.createdAt, payload.expiresAt, createdAt - 1);\n  const signature = requireText(\n    await options.sign(canonicalDevicePairingInviteBytes(payload)),\n    'signature',\n    4096,\n  );\n  return { ...payload, signature };\n}\n\nexport function encodeDevicePairingInvite(invite: DevicePairingInvite): string {\n  const payload = unsignedPayload(invite);\n  const signature = requireText(invite.signature, 'signature', 4096);\n  return JSON.stringify({ ...payload, signature });\n}\n\nexport async function parseDevicePairingInvite(\n  serialized: string,\n  options: ParseDevicePairingInviteOptions,\n): Promise<DevicePairingInvite> {\n  if (!serialized || serialized.length > MAX_INVITE_LENGTH) {\n    throw new Error('invalid device pairing invite length');\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(serialized);\n  } catch {\n    throw new Error('device pairing invite is not valid JSON');\n  }\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('invalid device pairing invite');\n  }\n  const record = parsed as Record<string, unknown>;\n  if (\n    record.protocol !== DEVICE_PAIRING_INVITE_PROTOCOL ||\n    typeof record.peerId !== 'string' ||\n    typeof record.publicKeyMultibase !== 'string' ||\n    typeof record.deviceName !== 'string' ||\n    !Array.isArray(record.multiaddrs) ||\n    record.multiaddrs.some((address) => typeof address !== 'string') ||\n    typeof record.createdAt !== 'number' ||\n    typeof record.expiresAt !== 'number' ||\n    typeof record.signature !== 'string'\n  ) {\n    throw new Error('invalid device pairing invite');\n  }\n  validateLifetime(record.createdAt, record.expiresAt, options.now ?? Date.now());\n  const payload = unsignedPayload({\n    protocol: DEVICE_PAIRING_INVITE_PROTOCOL,\n    peerId: record.peerId,\n    publicKeyMultibase: record.publicKeyMultibase,\n    deviceName: record.deviceName,\n    multiaddrs: record.multiaddrs as string[],\n    createdAt: record.createdAt,\n    expiresAt: record.expiresAt,\n  });\n  const invite: DevicePairingInvite = {\n    ...payload,\n    signature: requireText(record.signature, 'signature', 4096),\n  };\n  if (\n    !await options.verifyIdentity({\n      invite,\n      payload: canonicalDevicePairingInviteBytes(payload),\n    })\n  ) {\n    throw new Error('device pairing invite identity verification failed');\n  }\n  return invite;\n}\n","export type VersionVector = Record<string, number>;\n\nexport interface ConversationMeta {\n  conversationId: string;\n  title: string;\n  lastMessagePreview: string;\n  lastMessageTimestamp: number;\n  messageCount: number;\n  originNodeId: string;\n  /** Lamport clock of the origin metadata event; never substitute messageCount. */\n  originClock: number;\n  definitionId: string;\n  instanceDelta?: Record<string, unknown>;\n  isUserInitiated: boolean;\n  sourceChannel?: {\n    channelId: string;\n    platform: string;\n    imUserId: string;\n  };\n}\n\nexport function isConversationMeta(value: unknown): value is ConversationMeta {\n  if (value === null || typeof value !== 'object') return false;\n  const o = value as Record<string, unknown>;\n  return (\n    typeof o.conversationId === 'string' &&\n    typeof o.title === 'string' &&\n    typeof o.originNodeId === 'string' &&\n    typeof o.originClock === 'number' &&\n    typeof o.definitionId === 'string' &&\n    typeof o.messageCount === 'number' &&\n    typeof o.lastMessageTimestamp === 'number' &&\n    typeof o.isUserInitiated === 'boolean'\n  );\n}\n\nexport interface VersionRange {\n  originNodeId: string;\n  fromExclusive: number;\n  toInclusive: number;\n}\n\nexport function computeMissingVersionRanges(\n  currentVersion: VersionVector,\n  availableVersion: VersionVector,\n): VersionRange[] {\n  const ranges: VersionRange[] = [];\n  for (const [originNodeId, availableClock] of Object.entries(availableVersion)) {\n    const currentClock = currentVersion[originNodeId] ?? 0;\n    if (availableClock > currentClock) {\n      ranges.push({ originNodeId, fromExclusive: currentClock, toInclusive: availableClock });\n    }\n  }\n  return ranges.sort((left, right) => left.originNodeId.localeCompare(right.originNodeId));\n}\n\nexport interface ConversationMetadataPage {\n  items: ConversationMeta[];\n  nextCursor?: string;\n}\n"],"mappings":";;;;;AAIO,SAAS,wBACd,QAC+E;AAC/E,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,QAAM,IAAI;AAQV,MAAI,EAAE,SAAS,CAAC,EAAE,SAAS,OAAO,EAAE,eAAe,SAAU,QAAO;AACpE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,KAAK,EAAE,UAAU;AAChC,QAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,WAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACxD,UAAU,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACxD,MAAM,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAAA,EACjE;AACF;;;ACxBO,IAAM,6BAAN,MAAiE;AAAA,EAC9D;AAAA,EAER,YAAY,UAAyB,CAAC,GAAG;AACvC,SAAK,gBAAgB,EAAE,GAAG,QAAQ;AAAA,EACpC;AAAA,EAEA,MAAa,oBAA4C;AACvD,WAAO,EAAE,GAAG,KAAK,cAAc;AAAA,EACjC;AAAA,EAEA,MAAa,kBAAkB,eAA6C;AAC1E,SAAK,gBAAgB,EAAE,GAAG,cAAc;AAAA,EAC1C;AACF;;;AC0BO,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,gBAA+B,CAAC;AAAA,EAChC;AAAA,EACA,gBAA+B,QAAQ,QAAQ;AAAA,EAEvD,YAAY,SAAgC;AAC1C,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ;AACvB,SAAK,WAAW,QAAQ;AACxB,SAAK,aAAa,QAAQ,cAAc,IAAI,2BAA2B;AAAA,EACzE;AAAA;AAAA;AAAA;AAAA,EAKO,mBAAoC;AACzC,QAAI,YAAY;AAChB,UAAM,WAAW,KAAK,cAAc,KAAK,YAAY;AACnD,YAAM,KAAK,kBAAkB;AAC7B,mBAAa,KAAK,cAAc,KAAK,MAAM,KAAK,KAAK;AACrD,WAAK,cAAc,KAAK,MAAM,IAAI;AAClC,YAAM,KAAK,WAAW,kBAAkB,KAAK,aAAa;AAAA,IAC5D,CAAC;AACD,SAAK,gBAAgB,SAAS,MAAM,MAAM,MAAS;AACnD,WAAO,SAAS,KAAK,MAAM,SAAS;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,WAA0B;AACrC,UAAM,KAAK,kBAAkB;AAC7B,UAAM,KAAK;AACX,UAAM,KAAK,kCAAkC;AAC7C,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,MAAM,WAAW,EAAG;AAExB,UAAM,sBAAsB,oBAAI,IAAY;AAE5C,eAAW,QAAQ,OAAO;AACxB,YAAM,EAAE,cAAc,IAAI,MAAM,KAAK,sBAAsB,EAAE,GAAG,KAAK,cAAc,CAAC;AAEpF,UAAI;AACJ,SAAG;AACD,cAAM,OAAO,MAAM,KAAK,oBAAoB,KAAK,eAAe,MAAM;AACtE,mBAAW,QAAQ,KAAK,OAAO;AAC7B,gBAAM,KAAK,QAAQ,2BAA2B,IAAI;AAClD,8BAAoB,IAAI,KAAK,cAAc;AAAA,QAC7C;AACA,iBAAS,KAAK;AAAA,MAChB,SAAS,WAAW;AAEpB,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC3D,cAAM,UAAU,KAAK,cAAc,MAAM,KAAK;AAC9C,YAAI,QAAQ,QAAS,MAAK,cAAc,MAAM,IAAI;AAAA,MACpD;AACA,YAAM,KAAK,WAAW,kBAAkB,KAAK,aAAa;AAAA,IAC5D;AAEA,UAAM,WAAW;AACjB,QAAI,SAAS;AACb,eAAS;AACP,YAAM,gBAAgB,MAAM,KAAK,QAAQ,kBAAkB,EAAE,OAAO,UAAU,OAAO,CAAC;AACtF,iBAAW,gBAAgB,eAAe;AACxC,4BAAoB,IAAI,aAAa,cAAc;AAAA,MACrD;AACA,UAAI,cAAc,SAAS,SAAU;AACrC,gBAAU,cAAc;AAAA,IAC1B;AAEA,eAAW,kBAAkB,qBAAqB;AAChD,YAAM,KAAK,qCAAqC,gBAAgB,KAAK;AAAA,IACvE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,kBAAiC;AAC5C,UAAM,KAAK,SAAS;AAAA,EACtB;AAAA,EAEA,MAAc,qCACZ,gBACA,OACe;AACf,UAAM,YAAY,MAAM,KAAK,QAAQ,YAAY,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzF,UAAM,WAAW,UAAU,IAAI,CAAC,MAAM,EAAE,SAAS;AAEjD,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,KAAK,oBAAqB;AAC/B,UAAI;AACF,cAAM,WAAW,MAAM,KAAK,oBAAoB,gBAAgB,QAAQ;AACxE,YAAI,SAAS,SAAS,GAAG;AACvB,gBAAM,KAAK,QAAQ,uBAAuB,QAAQ;AAClD,gBAAM,KAAK,8BAA8B,UAAU,KAAK;AAAA,QAC1D;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,8BACZ,UACA,OACe;AACf,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,KAAK,UAAU;AACxB,iBAAW,KAAK,EAAE,eAAe,CAAC,GAAG;AACnC,YAAI,EAAE,YAAa,QAAO,IAAI,EAAE,WAAW;AAAA,MAC7C;AAAA,IACF;AACA,eAAW,KAAK,QAAQ;AACtB,YAAM,YAAY,MAAM,KAAK,QAAQ,cAAc,CAAC;AACpD,UAAI,WAAW;AACb,cAAM,SAAS,KAAK,QAAQ,oBAAoB,KAAK,KAAK,OAAO;AACjE,YAAI,CAAC,OAAQ;AACb,cAAM,QAAQ,MAAM,OAAO,CAAC;AAC5B,YAAI,SAAS,MAAM,SAAS,EAAG;AAAA,MACjC;AAEA,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,KAAK,oBAAoB,KAAK,IAAI;AAC/C,YAAI,CAAC,KAAM;AACX,YAAI;AACF,gBAAM,OAAO,MAAM,KAAK,CAAC;AACzB,cAAI,MAAM,MAAM,QAAQ;AACtB,kBAAM,KAA0B;AAAA,cAC9B,aAAa;AAAA,cACb,UAAU,KAAK;AAAA,cACf,UAAU,KAAK;AAAA,cACf,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,KAAK,KAAK;AAAA,YAC9C;AACA,kBAAM,KAAK,QAAQ,eAAe,IAAI,KAAK,IAAI;AAC/C;AAAA,UACF;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,mBAAoD;AAC/D,UAAM,KAAK,kBAAkB;AAC7B,UAAM,KAAK;AACX,WAAO,EAAE,GAAG,KAAK,cAAc;AAAA,EACjC;AAAA,EAEO,aAA4B;AACjC,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,oBAAmC;AACzC,SAAK,sBAAsB,YAAY;AACrC,YAAM,SAAS,MAAM,KAAK,WAAW,kBAAkB;AACvD,WAAK,gBAAgB,EAAE,GAAG,QAAQ,CAAC,KAAK,MAAM,GAAG,OAAO,KAAK,MAAM,KAAK,EAAE;AAAA,IAC5E,GAAG;AACH,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,WAAW;AACjB,QAAI,SAAS;AACb,QAAI,UAAU;AACd,eAAS;AACP,YAAM,gBAAgB,MAAM,KAAK,QAAQ,kBAAkB,EAAE,OAAO,UAAU,OAAO,CAAC;AACtF,iBAAW,gBAAgB,eAAe;AACxC,cAAM,UAAU,KAAK,cAAc,aAAa,YAAY,KAAK;AACjE,YAAI,aAAa,cAAc,SAAS;AACtC,eAAK,cAAc,aAAa,YAAY,IAAI,aAAa;AAC7D,oBAAU;AAAA,QACZ;AAAA,MACF;AACA,UAAI,cAAc,SAAS,SAAU;AACrC,gBAAU,cAAc;AAAA,IAC1B;AACA,QAAI,QAAS,OAAM,KAAK,WAAW,kBAAkB,KAAK,aAAa;AAAA,EACzE;AACF;;;ACvMO,IAAM,sBAAN,MAAkD;AAAA,EACvC;AAAA,EACC;AAAA,EAEjB,YAAY,QAAgB,WAA8B;AACxD,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,sBAAsB,cAAsC;AAC1D,WAAO,KAAK,UAAU,sBAAsB,KAAK,QAAQ,YAAY;AAAA,EACvE;AAAA,EAEA,oBAAoB,cAAsC,QAAiB;AACzE,WAAO,KAAK,UAAU,oBAAoB,KAAK,QAAQ,cAAc,MAAM;AAAA,EAC7E;AAAA,EAEA,oBAAoB,gBAAwB,iBAAmD;AAC7F,UAAM,YAAY,KAAK,UAAU,qBAAqB,KAAK,KAAK,SAAS;AACzE,QAAI,CAAC,WAAW;AACd,aAAO,QAAQ,QAAQ,CAAC,CAAC;AAAA,IAC3B;AACA,WAAO,UAAU,KAAK,QAAQ,gBAAgB,eAAe;AAAA,EAC/D;AAAA,EAEA,mBAAmB,aAAqB;AACtC,UAAM,YAAY,KAAK,UAAU,oBAAoB,KAAK,KAAK,SAAS;AACxE,QAAI,CAAC,WAAW;AACd,aAAO,QAAQ,QAAQ,IAAI;AAAA,IAC7B;AACA,WAAO,UAAU,KAAK,QAAQ,WAAW;AAAA,EAC3C;AACF;;;ACQA,IAAM,gCAAgC;AACtC,IAAM,6BAA6B;AACnC,IAAM,yBAAyB;AAC/B,IAAM,uBAAuB;AAE7B,SAAS,kBAA+D;AACtE,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,OAAO;AAAA,IACP,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACF;AAEA,SAAS,wBAAwB,OAAe,MAAoB;AAClE,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACxC,UAAM,IAAI,UAAU,GAAG,IAAI,uCAAuC;AAAA,EACpE;AACF;AAGO,IAAM,mCAAN,MAAsD;AAAA,EAoB3D,YAA6B,SAAiE;AAAjE;AAC3B,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,sBAAsB,QAAQ,uBAAuB;AAC1D,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,eAAe,QAAQ,gBAAgB;AAC5C,SAAK,cAAc,QAAQ,eAAe;AAC1C,SAAK,MAAM,QAAQ,OAAO,KAAK;AAC/B,SAAK,SAAS,QAAQ,UAAU,KAAK;AACrC,4BAAwB,KAAK,qBAAqB,qBAAqB;AACvE,4BAAwB,KAAK,kBAAkB,kBAAkB;AACjE,4BAAwB,KAAK,cAAc,cAAc;AACzD,4BAAwB,KAAK,aAAa,aAAa;AACvD,QAAI,KAAK,cAAc,EAAG,OAAM,IAAI,UAAU,+BAA+B;AAC7E,SAAK,cAAc;AAAA,EACrB;AAAA,EAjCQ;AAAA,EACA,aAAa;AAAA,EACb,aAAa,IAAI,gBAAgB;AAAA,EACjC;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV,sBAAsB;AAAA,EACtB,gBAA+C;AAAA,IACrD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY,gBAAgB;AAAA,EAC9B;AAAA,EACiB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAkBjB,IAAW,WAA0C;AACnD,WAAO;AAAA,MACL,GAAG,KAAK;AAAA,MACR,YAAY,EAAE,GAAG,KAAK,cAAc,WAAW;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAa,QAAuB;AAClC,QAAI,KAAK,QAAS,QAAO,KAAK,OAAO;AACrC,SAAK,UAAU;AACf,UAAM,KAAK,OAAO;AAAA,EACpB;AAAA,EAEA,MAAa,OAAsB;AACjC,SAAK,UAAU;AACf,SAAK,WAAW;AAChB,UAAM,oBAAoB,KAAK;AAC/B,sBAAkB,MAAM,IAAI,MAAM,kCAAkC,CAAC;AACrE,UAAM,KAAK,UAAU,MAAM,MAAM,MAAS;AAC1C,QAAI,KAAK,eAAe,mBAAmB;AACzC,WAAK,aAAa,IAAI,gBAAgB;AAAA,IACxC;AAAA,EACF;AAAA,EAEA,MAAa,iBAAiB,eAAyD;AACrF,SAAK,gBAAgB;AACrB,SAAK,cAAc;AACnB,SAAK,sBAAsB;AAC3B,SAAK,WAAW;AAChB,SAAK,WAAW,MAAM,IAAI,MAAM,oCAAoC,CAAC;AACrE,SAAK,aAAa,IAAI,gBAAgB;AACtC,SAAK,WAAW;AAChB,SAAK,cAAc;AACnB,QAAI,KAAK,WAAW,KAAK,QAAQ,QAAQ,aAAa,aAAa,EAAG,OAAM,KAAK,OAAO;AAAA,EAC1F;AAAA,EAEO,SAAwB;AAC7B,QAAI,KAAK,SAAU,QAAO,KAAK;AAC/B,QAAI,CAAC,KAAK,QAAQ,QAAQ,aAAa,KAAK,aAAa,GAAG;AAC1D,WAAK,cAAc;AACnB,aAAO,QAAQ,QAAQ;AAAA,IACzB;AACA,UAAM,aAAa,KAAK;AACxB,UAAM,gBAAgB,KAAK;AAC3B,UAAM,SAAS,KAAK,WAAW;AAC/B,UAAM,MAAM,KAAK,SAAS,eAAe,YAAY,MAAM;AAC3D,UAAM,UAAU,IAAI,QAAQ,MAAM;AAChC,UAAI,KAAK,aAAa,QAAS,MAAK,WAAW;AAAA,IACjD,CAAC;AACD,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SACZ,eACA,YACA,QACe;AACf,QAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,UAAM,KAAK,eAAe,YAAY;AAAA,MACpC,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAED,QAAI;AACF,UAAI,KAAK,cAAc,WAAW,eAAe,SAAS;AACxD,cAAM,KAAK,QAAQ,cAAc,YAAY,QAAQ,MAAM,KAAK,QAAQ,QAAQ,iBAAiB,eAAe,MAAM,CAAC;AAAA,MACzH;AACA,UAAI,KAAK,cAAc,WAAW,iBAAiB,SAAS;AAC1D,cAAM,KAAK,QAAQ,gBAAgB,YAAY,QAAQ,MAAM,KAAK,QAAQ,QAAQ,eAAe,eAAe,MAAM,CAAC;AAAA,MACzH;AAEA,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,QAAQ,SAAS,YAAY,QAAQ,MAAM,KAAK,QAAQ,QAAQ,YAAY,eAAe,MAAM,CAAC;AAAA,MAC/G,SAAS,OAAO;AACd,qBAAa;AACb,aAAK,QAAQ,aAAa,kCAAkC,KAAK;AAAA,MACnE;AAEA,YAAM,KAAK,QAAQ,aAAa,YAAY,QAAQ,MAAM,KAAK,QAAQ,QAAQ,UAAU,eAAe,MAAM,CAAC;AAE/G,UAAI;AACJ,UAAI;AACF,cAAM,KAAK,QAAQ,aAAa,YAAY,QAAQ,MAAM,KAAK,QAAQ,QAAQ,cAAc,eAAe,MAAM,CAAC;AAAA,MACrH,SAAS,OAAO;AACd,yBAAiB;AACjB,aAAK,QAAQ,aAAa,0CAA0C,KAAK;AAAA,MAC3E;AAEA,UAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,WAAK,sBAAsB;AAC3B,YAAM,gBAAgB,KAAK,QAAQ,QAAQ,uBAAuB,aAAa;AAC/E,YAAM,KAAK,eAAe,YAAY;AAAA,QACpC,QAAQ,kBAAmB,iBAAiB,aAAc,aAAa;AAAA,QACvE,WAAW,kBAAkB;AAAA,QAC7B,aAAa,KAAK,IAAI,IAAI,KAAK;AAAA,MACjC,CAAC;AACD,WAAK,SAAS,KAAK,qBAAqB,UAAU;AAAA,IACpD,SAAS,OAAO;AACd,UAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,WAAK,uBAAuB;AAC5B,UAAI,KAAK,cAAc,WAAW,cAAc,UAAU;AACxD,aAAK,cAAc,WAAW,eAAe;AAAA,MAC/C;AACA,YAAM,SAAS,KAAK,QAAQ,QAAQ,gBAAgB,KAAK,KAAK;AAC9D,YAAM,QAAQ,KAAK,aAAa;AAChC,YAAM,KAAK,eAAe,YAAY;AAAA,QACpC;AAAA,QACA,WAAW;AAAA,QACX,aAAa,KAAK,IAAI,IAAI;AAAA,MAC5B,CAAC;AACD,WAAK,SAAS,OAAO,UAAU;AAC/B,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,WACA,YACA,QACA,WACe;AACf,QAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,UAAM,KAAK,aAAa,WAAW,WAAW,UAAU;AACxD,QAAI;AACF,YAAM,SAAS,MAAM,UAAU;AAC/B,UAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,YAAM,QAAQ,SAAS;AACvB,UAAI,CAAC,KAAK,UAAU,YAAY,MAAM,EAAG;AACzC,YAAM,KAAK,aAAa,WAAW,SAAS,UAAU;AAAA,IACxD,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,YAAY,MAAM,EAAG,OAAM,KAAK,aAAa,WAAW,UAAU,UAAU;AAC/F,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,eAAuB;AAC7B,UAAM,cAAc,KAAK;AAAA,MACvB,KAAK;AAAA,MACL,KAAK,mBAAmB,KAAK,KAAK,IAAI,GAAG,KAAK,sBAAsB,CAAC;AAAA,IACvE;AACA,UAAM,SAAS,cAAc,KAAK,eAAe,KAAK,OAAO,IAAI,IAAI;AACrE,WAAO,KAAK,IAAI,GAAG,KAAK,MAAM,cAAc,MAAM,CAAC;AAAA,EACrD;AAAA,EAEQ,SAAS,SAAiB,YAA0B;AAC1D,QAAI,CAAC,KAAK,WAAW,eAAe,KAAK,WAAY;AACrD,SAAK,WAAW;AAChB,SAAK,QAAQ,WAAW,MAAM;AAC5B,UAAI,eAAe,KAAK,WAAY;AACpC,WAAK,KAAK,OAAO,EAAE,MAAM,CAAC,UAAmB;AAC3C,aAAK,QAAQ,aAAa,4BAA4B,KAAK;AAAA,MAC7D,CAAC;AAAA,IACH,GAAG,OAAO;AAAA,EACZ;AAAA,EAEQ,aAAmB;AACzB,QAAI,KAAK,MAAO,cAAa,KAAK,KAAK;AACvC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEQ,UAAU,YAAoB,QAA8B;AAClE,WAAO,eAAe,KAAK,cAAc,CAAC,OAAO;AAAA,EACnD;AAAA,EAEA,MAAc,aACZ,WACA,QACA,YACe;AACf,QAAI,eAAe,KAAK,WAAY;AACpC,SAAK,gBAAgB;AAAA,MACnB,GAAG,KAAK;AAAA,MACR,YAAY,EAAE,GAAG,KAAK,cAAc,YAAY,CAAC,SAAS,GAAG,OAAO;AAAA,IACtE;AACA,UAAM,KAAK,KAAK;AAAA,EAClB;AAAA,EAEA,MAAc,eACZ,YACA,QACe;AACf,QAAI,eAAe,KAAK,WAAY;AACpC,SAAK,gBAAgB,EAAE,GAAG,KAAK,eAAe,GAAG,OAAO;AACxD,UAAM,KAAK,KAAK;AAAA,EAClB;AAAA,EAEQ,gBAAsB;AAC5B,SAAK,gBAAgB;AAAA,MACnB,QAAQ,KAAK,QAAQ,QAAQ,aAAa,KAAK,aAAa,IACxD,YACA;AAAA,MACJ,YAAY,KAAK;AAAA,MACjB,YAAY,gBAAgB;AAAA,IAC9B;AACA,SAAK,KAAK,KAAK;AAAA,EACjB;AAAA,EAEA,MAAc,OAAsB;AAClC,UAAM,KAAK,QAAQ,WAAW,KAAK,QAAQ;AAAA,EAC7C;AACF;;;ACrUO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxB;AAAA,EAEhB,YAAY,MAA0B,SAAiB,SAAwB;AAC7E,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAUA,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,SAAS,sBAAsB,OAAe,MAAoB;AAChE,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,GAAG,IAAI,kCAAkC;AAAA,EAC/D;AACF;AAEA,SAAS,wBAAwB,iBAA+B;AAC9D,wBAAsB,iBAAiB,iBAAiB;AACxD,MAAI,kBAAkB,YAAY;AAChC,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACF;AAEO,SAAS,gBAAgB,OAAgB,kBAAkB,YAAwB;AACxF,0BAAwB,eAAe;AACvC,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,KAAK;AAAA,EACnC,SAAS,OAAO;AACd,UAAM,IAAI,eAAe,gBAAgB,yCAAyC;AAAA,MAChF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,eAAe,QAAW;AAC5B,UAAM,IAAI,eAAe,gBAAgB,uCAAuC;AAAA,EAClF;AACA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,UAAU;AACnD,MAAI,QAAQ,aAAa,iBAAiB;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,eAAe;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,WAAW,eAAe,QAAQ,UAAU;AAC9D,MAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,YAAY,EAAE,UAAU,GAAG,QAAQ,YAAY,KAAK;AACjG,QAAM,IAAI,SAAS,YAAY;AAC/B,SAAO;AACT;AAEA,gBAAuB,iBACrB,QACA,kBAAkB,YACS;AAC3B,mBAAiB,SAAS,QAAQ;AAChC,UAAM,gBAAgB,OAAO,eAAe;AAAA,EAC9C;AACF;AAEA,SAAS,YAAY,MAAkB,OAA+B;AACpE,MAAI,KAAK,eAAe,EAAG,QAAO,MAAM,MAAM;AAC9C,MAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAM,WAAW,IAAI,WAAW,KAAK,aAAa,MAAM,UAAU;AAClE,WAAS,IAAI,IAAI;AACjB,WAAS,IAAI,OAAO,KAAK,UAAU;AACnC,SAAO;AACT;AAEA,SAAS,aAAa,QAAsC;AAC1D,SAAO,IAAI,eAAe,WAAW,kCAAkC;AAAA,IACrE,OAAO,QAAQ;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,cACb,UACA,cACA,eACA,QACqC;AACrC,MAAI,QAAQ,QAAS,OAAM,aAAa,MAAM;AAC9C,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,WAAW,kBAAkB,SAC/B,eACA,KAAK,IAAI,cAAc,aAAa;AACxC,MAAI,YAAY,KAAK;AACnB,UAAM,IAAI;AAAA,MACR,kBAAkB,UAAa,iBAAiB,eAAe,kBAAkB;AAAA,MACjF,kBAAkB,UAAa,iBAAiB,eAC5C,qCACA;AAAA,IACN;AAAA,EACF;AAEA,SAAO,IAAI,QAAoC,CAAC,SAAS,WAAW;AAClE,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,aAAyB;AACvC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,KAAK;AAClB,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,eAAS;AAAA,IACX;AACA,UAAM,UAAU,MAAM;AACpB,aAAO,MAAM;AACX,eAAO,aAAa,MAAM,CAAC;AAAA,MAC7B,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,cAAc,KAAK,IAAI;AAC7B,YAAM,eAAe,kBAAkB,UAAa,eAAe;AACnE,aAAO,MAAM;AACX;AAAA,UACE,IAAI;AAAA,YACF,eAAe,kBAAkB;AAAA,YACjC,eAAe,qCAAqC;AAAA,UACtD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,GAAG,KAAK,IAAI,GAAG,WAAW,GAAG,CAAC;AAC9B,YAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACzD,SAAK,SAAS,KAAK,EAAE;AAAA,MACnB,CAAC,WAAW;AACV,eAAO,MAAM;AACX,kBAAQ,MAAM;AAAA,QAChB,CAAC;AAAA,MACH;AAAA,MACA,CAAC,UAAmB;AAClB,eAAO,MAAM;AACX;AAAA,YACE,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,4BAA4B;AAAA,cACrE,OAAO;AAAA,YACT,CAAC;AAAA,UACH;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAOO,SAAS,sBACd,QACA,SACwB;AACxB,0BAAwB,QAAQ,eAAe;AAC/C,wBAAsB,QAAQ,eAAe,eAAe;AAC5D,wBAAsB,QAAQ,gBAAgB,gBAAgB;AAE9D,UAAQ,gBAAgB,aAAqC;AAC3D,UAAM,WAAW,OAAO,OAAO,aAAa,EAAE;AAC9C,QAAI,WAAuB,IAAI,WAAW,CAAC;AAC3C,QAAI;AACJ,QAAI,eAAe,KAAK,IAAI,IAAI,QAAQ;AACxC,QAAI;AACJ,QAAI,cAAc;AAElB,UAAM,YAAY,OAAO,UAAyC;AAChE,UAAI,YAAa;AACjB,oBAAc;AACd,YAAM,QAAQ,QAAQ,QAAQ,QAAQ,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IACrE;AAEA,QAAI;AACF,iBAAS;AACP,YAAI,yBAAyB,UAAa,SAAS,cAAc,cAAc;AAC7E,iCAAuB,IAAI;AAAA,YACzB,SAAS;AAAA,YACT,SAAS;AAAA,YACT;AAAA,UACF,EAAE,UAAU,GAAG,KAAK;AACpB,qBAAW,SAAS,MAAM,YAAY;AACtC,4BAAkB,KAAK,IAAI,IAAI,QAAQ;AACvC,cAAI,uBAAuB,QAAQ,iBAAiB;AAClD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,8BAA8B,QAAQ,eAAe;AAAA,YACvD;AAAA,UACF;AAAA,QACF;AAEA,YACE,yBAAyB,UACzB,SAAS,cAAc,sBACvB;AACA,gBAAM,UAAU,SAAS,MAAM,GAAG,oBAAoB;AACtD,qBAAW,SAAS,MAAM,oBAAoB;AAC9C,iCAAuB;AACvB,0BAAgB,SAAS,aAAa,IAClC,KAAK,IAAI,IAAI,QAAQ,iBACrB;AACJ,cAAI;AACJ,cAAI;AACF,mBAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO;AAAA,UACjE,SAAS,OAAO;AACd,kBAAM,IAAI,eAAe,gBAAgB,yCAAyC;AAAA,cAChF,OAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,cAAI;AACJ,cAAI;AACF,oBAAQ,KAAK,MAAM,IAAI;AAAA,UACzB,SAAS,OAAO;AACd,kBAAM,IAAI,eAAe,gBAAgB,wCAAwC;AAAA,cAC/E,OAAO;AAAA,YACT,CAAC;AAAA,UACH;AACA,gBAAM;AACN,yBAAe,KAAK,IAAI,IAAI,QAAQ;AACpC;AAAA,QACF;AAEA,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,QACV;AACA,YAAI,OAAO,MAAM;AACf,cAAI,SAAS,aAAa,KAAK,yBAAyB,QAAW;AACjE,kBAAM,IAAI,eAAe,mBAAmB,mCAAmC;AAAA,UACjF;AACA;AAAA,QACF;AACA,YAAI,EAAE,OAAO,iBAAiB,aAAa;AACzC,gBAAM,IAAI,UAAU,gDAAgD;AAAA,QACtE;AACA,YAAI,OAAO,MAAM,eAAe,EAAG;AACnC,cAAM,MAAM,KAAK,IAAI;AACrB,uBAAe,MAAM,QAAQ;AAC7B,0BAAkB,MAAM,QAAQ;AAChC,mBAAW,YAAY,UAAU,OAAO,KAAK;AAAA,MAC/C;AAAA,IACF,SAAS,OAAO;AACd,YAAM,aAAa,iBAAiB,iBAChC,QACA,IAAI,eAAe,WAAW,4BAA4B,EAAE,OAAO,MAAM,CAAC;AAC9E,YAAM,UAAU,UAAU;AAC1B,YAAM;AAAA,IACR,UAAE;AAIA,WAAK,SAAS,SAAS,EAAE,MAAM,MAAM,MAAS;AAAA,IAChD;AAAA,EACF,GAAG;AACL;;;ACxQO,IAAM,gCAAgC;AAC7C,IAAM,0BAA0B,OAAO;AACvC,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AA0CnC,SAAS,4BACP,MACA,SACoB;AACpB,SAAO,IAAI,mBAAmB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAqB;AAC7C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK;AAC/C,UAAM,IAAI,UAAU,sDAAsD;AAAA,EAC5E;AACF;AAEA,SAAS,eAAe,QAAuC;AAC7D,MAAI,QAAQ,SAAS;AACnB,UAAM,4BAA4B,aAAa,4CAA4C;AAAA,EAC7F;AACF;AAEA,eAAe,wBAAwB,SAGpC;AACD,QAAM,QAAQ,MAAM,QAAQ,gBAAgB,QAAQ,MAAM;AAC1D,SAAO;AAAA,IACL,QAAQ,MAAM,QAAQ,cAAc;AAAA,MAClC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,aACb,QACA,SACA,OACA,eACe;AACf,QAAM,WAA+C;AAAA,IACnD,MAAM;AAAA,IACN;AAAA,IACA,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,EAC3B;AACA,QAAM,OAAO,KAAK,iBAAiB,CAAC,QAAQ,GAAG,aAAa,CAAC;AAC/D;AAEA,SAAS,gBAAgB,QAA+D;AACtF,MAAI,UAAU;AACd,SAAO,OAAO,UAAU;AACtB,QAAI,QAAS;AACb,cAAU;AACV,UAAM,OAAO,MAAM,KAAK;AAAA,EAC1B;AACF;AAEA,SAAS,YACP,QACA,eACA,eACA,QACA,OACwB;AACxB,SAAO,sBAAsB,OAAO,QAAQ;AAAA,IAC1C,iBAAiB;AAAA,IACjB;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,EAAE,iBAAiB,gBAAiB,OAAM;AAC9C,MAAI,MAAM,SAAS,WAAW;AAC5B,UAAM,4BAA4B,aAAa,MAAM,OAAO;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,mBAAmB;AACpC,UAAM,4BAA4B,aAAa,MAAM,OAAO;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,iBAAiB;AACnE,UAAM,4BAA4B,eAAe,MAAM,OAAO;AAAA,EAChE;AACA,QAAM,4BAA4B,WAAW,MAAM,OAAO;AAC5D;AAOO,SAAS,mCACd,SAC8B;AAC9B,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,mBAAiB,aAAa;AAE9B,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,qBAAe,iBAAiB,MAAM;AACtC,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,wBAAwB,OAAO;AAC/D,YAAM,QAAQ,gBAAgB,MAAM;AACpC,YAAM,eAAe,MAAM;AACzB,aAAK,MAAM,4BAA4B,aAAa,4CAA4C,CAAC;AAAA,MACnG;AACA,uBAAiB,QAAQ,iBAAiB,SAAS,cAAc;AAAA,QAC/D,MAAM;AAAA,MACR,CAAC;AACD,UAAI;AACF,cAAM,aAAa,QAAQ,SAAS,OAAO,aAAa;AACxD,YAAI;AACJ,yBACQ,SAAS;AAAA,UACb;AAAA,UACA;AAAA,UACA;AAAA,UACA,iBAAiB;AAAA,UACjB;AAAA,QACF,GACA;AACA,cAAI,UAAU;AACZ,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,qBAAW;AAAA,QACb;AACA,uBAAe,iBAAiB,MAAM;AACtC,YAAI,CAAC,UAAU;AACb,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,eAAgB,OAAM,MAAM,KAAK;AACtD,sBAAc,KAAK;AAAA,MACrB,UAAE;AACA,yBAAiB,QAAQ,oBAAoB,SAAS,YAAY;AAClE,cAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,MAC5C;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,qBAAe,iBAAiB,MAAM;AACtC,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,wBAAwB,OAAO;AAC/D,YAAM,QAAQ,gBAAgB,MAAM;AACpC,YAAM,eAAe,MAAM;AACzB,aAAK,MAAM,4BAA4B,aAAa,0CAA0C,CAAC;AAAA,MACjG;AACA,uBAAiB,QAAQ,iBAAiB,SAAS,cAAc;AAAA,QAC/D,MAAM;AAAA,MACR,CAAC;AACD,UAAI;AACF,cAAM,aAAa,QAAQ,SAAS,OAAO,aAAa;AACxD,yBACQ,SAAS;AAAA,UACb;AAAA,UACA;AAAA,UACA;AAAA,UACA,iBAAiB;AAAA,UACjB;AAAA,QACF,GACA;AACA,yBAAe,iBAAiB,MAAM;AACtC,gBAAM;AAAA,QACR;AACA,uBAAe,iBAAiB,MAAM;AAAA,MACxC,SAAS,OAAO;AACd,YAAI,iBAAiB,eAAgB,OAAM,MAAM,KAAK;AACtD,sBAAc,KAAK;AAAA,MACrB,UAAE;AACA,yBAAiB,QAAQ,oBAAoB,SAAS,YAAY;AAClE,cAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,kBACb,QACA,eAC6C;AAC7C,QAAM,QAAQ,gBAAgB,MAAM;AACpC,MAAI;AACJ,mBACQ,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GACA;AACA,QAAI,UAAU;AACZ,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QACE,UAAU,QACV,OAAO,UAAU,YACjB,MAAM,QAAQ,KAAK,KAClB,MAAkC,SAAS,8CAC3C,MAAkC,YAAY,QAC/C,OAAQ,MAAkC,YAAY,UACtD;AACA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,MAAI,CAAC,UAAU;AACb,UAAM,4BAA4B,WAAW,yCAAyC;AAAA,EACxF;AACA,SAAO;AACT;AAEA,gBAAgB,mBACd,QACA,SACA,QAC4C;AAC5C,QAAM,WAAW,OAAO,OAAO,aAAa,EAAE;AAM9C,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,eAAe;AACnB,MAAI,sBAAsB,qBAAqB,QAAQ,QAAQ,OAAO,KAAK;AAE3E,QAAM,qBAAqB,MAAM;AAC/B,QAAI,kBAAkB,OAAW,cAAa,aAAa;AAC3D,oBAAgB;AAAA,EAClB;AACA,QAAM,kBAAkB,CAAC,UAAyB;AAChD,QAAI,gBAAgB;AAClB,YAAM,UAAU;AAChB,uBAAiB;AACjB,yBAAmB;AACnB,cAAQ,KAAK;AACb;AAAA,IACF;AACA,eAAW;AAAA,EACb;AACA,QAAM,WAAW,MAAM;AACrB,QAAI,aAAc;AAClB,mBAAe;AACf,SAAK,SAAS,KAAK,EAAE;AAAA,MACnB,CAAC,UAAU;AACT,uBAAe;AACf,wBAAgB,EAAE,MAAM,SAAS,MAAM,CAAC;AAAA,MAC1C;AAAA,MACA,CAAC,UAAmB;AAClB,uBAAe;AACf,wBAAgB,EAAE,MAAM,SAAS,MAAM,CAAC;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACA,QAAM,kBAAkB,MAAqD;AAC3E,QAAI,UAAU;AACZ,YAAM,QAAQ;AACd,iBAAW;AACX,aAAO,QAAQ,QAAQ,KAAK;AAAA,IAC9B;AACA,QAAI,OAAO,QAAS,QAAO,QAAQ,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC9D,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,uBAAiB;AACjB,sBAAgB,WAAW,MAAM;AAC/B,wBAAgB;AAChB,yBAAiB;AACjB,gBAAQ,EAAE,MAAM,WAAW,CAAC;AAAA,MAC9B,GAAG,0BAA0B;AAAA,IAC/B,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM;AACpB,oBAAgB,EAAE,MAAM,UAAU,CAAC;AAAA,EACrC;AAEA,SAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,WAAS;AACT,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,gBAAgB;AACrC,UAAI,OAAO,SAAS,UAAW;AAC/B,UAAI,OAAO,SAAS,YAAY;AAC9B,cAAM;AAAA,UACJ,UAAU,QAAQ;AAAA,UAClB,WAAW,QAAQ;AAAA,UACnB,IAAI;AAAA,UACJ,QAAQ,EAAE,MAAM,YAAY,iBAAiB,oBAAoB;AAAA,QACnE;AACA;AAAA,MACF;AACA,UAAI,OAAO,SAAS,QAAS,OAAM,OAAO;AAC1C,UAAI,OAAO,MAAM,KAAM;AACvB,YAAM,WAAW,OAAO,MAAM;AAC9B,4BAAsB,SAAS,KAC3B,qBAAqB,SAAS,MAAM,KAAK,sBACzC;AACJ,YAAM;AACN,eAAS;AAAA,IACX;AAAA,EACF,UAAE;AACA,uBAAmB;AACnB,qBAAiB;AACjB,WAAO,oBAAoB,SAAS,OAAO;AAC3C,SAAK,SAAS,SAAS;AAAA,EACzB;AACF;AAEA,SAAS,qBAAqB,OAAoC;AAChE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,kBAAmB,MAAkC;AAC3D,SAAO,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,IACnE,kBACA;AACN;AAGO,SAAS,uCACd,SACkC;AAClC,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,mBAAiB,aAAa;AAC9B,SAAO,OAAO,EAAE,cAAc,QAAQ,UAAU,MAAM;AACpD,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI;AACF,YAAM,WAAW,MAAM,kBAAkB,QAAQ,aAAa;AAC9D,UAAI,aAAa,CAAE,MAAM,UAAU,SAAS,KAAK,GAAI;AACnD,cAAM,4BAA4B,eAAe,oBAAoB;AAAA,MACvE;AACA,YAAM,UAAU,SAAS;AACzB,YAAM,UAAU,MAAM,QAAQ,eAAe,YAAY;AACzD,UAAI,QAAQ,cAAc,SAAS;AACjC,cAAM,OAAO;AAAA,UACX;AAAA,YACE,mBAAmB,QAAQ,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,CAAC,GAAG,SAAS,MAAM,MAAM;AAAA,YAC1F;AAAA,UACF;AAAA,QACF;AAAA,MACF,OAAO;AACL,cAAM,OAAO,KAAK,iBAAiB,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,GAAG,aAAa,CAAC;AAAA,MACrF;AAAA,IACF,UAAE;AACA,YAAM,MAAM;AACZ,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IAC5C;AAAA,EACF;AACF;;;AC5ZO,IAAM,2BAA2B;AACjC,IAAM,4BAA4B;AAqCzC,IAAM,cAAc,oBAAI,IAAsB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,oBAAoB,OAA4C;AAC9E,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,SAAS,4BAChB,OAAO,OAAO,OAAO,YACrB,OAAO,OAAO,WAAW,YACzB,YAAY,IAAI,OAAO,MAA0B;AAErD;AAEO,SAAS,qBAAqB,OAA6C;AAChF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,MAAI,OAAO,SAAS,6BAA6B,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,OAAO,UAAW,QAAO;AACzH,MAAI,OAAO,GAAI,QAAO,YAAY;AAClC,SAAO,OAAO,OAAO,UAAU;AACjC;AAEA,SAAS,qBAAqB,OAA6C;AACzE,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,OAAO,kBAAkB,YAChC,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,SAAS;AAE3B;AAEA,eAAsB,uBAAuB,OAO3C;AACA,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,CAAC,qBAAqB,KAAK,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACzE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,cAAc,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvE,UAAM,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AACxE,UAAM,SAAS,KAAK,YAAY;AAChC,WAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AAAA,EACvE,QAAQ;AACN,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACA,SAAO;AAAA,IACL;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,EACd;AACF;;;AC1FO,IAAM,4BAAN,MAA+D;AAAA,EACpD;AAAA,EACC;AAAA,EACA;AAAA,EAEjB,YAAY,SAA2C;AACrD,SAAK,SAAS,QAAQ;AACtB,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,gBAAgB,QAAQ;AAAA,EAC/B;AAAA,EAEO,YAA+B;AACpC,WAAO,KAAK,cAAc,YAAY;AAAA,EACxC;AAAA,EAEO,sBAAsB,QAAgB,cAAmE;AAC9G,WAAO,KAAK,QAAQ,QAAQ,yBAAyB,EAAE,aAAa,CAAC;AAAA,EACvE;AAAA,EAEO,oBACL,QACA,cACA,QACmC;AACnC,WAAO,KAAK,QAAQ,QAAQ,uBAAuB;AAAA,MACjD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEO,oBAAoB,QAAgB,gBAAwB,iBAAmD;AACpH,WAAO,KAAK,QAAQ,QAAQ,uBAAuB,EAAE,gBAAgB,gBAAgB,CAAC;AAAA,EACxF;AAAA,EAEA,MAAa,mBAAmB,QAAgB,aAAqD;AACnG,UAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ,sBAAsB,EAAE,YAAY,CAAC;AAC/E,WAAO,uBAAuB,MAAM;AAAA,EACtC;AAAA,EAEA,MAAc,QAAQ,QAAgB,QAA0B,YAAuC;AACrG,UAAM,QAAQ,MAAM,KAAK,gBAAgB,MAAM;AAC/C,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,wBAAwB,KAAK;AACxF,UAAM,UAA6B;AAAA,MACjC,MAAM;AAAA,MACN,IAAI,OAAO,WAAW;AAAA,MACtB;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF;AACA,QAAI;AACF,YAAM,OAAO,KAAK,iBAAiB,CAAC,OAAO,GAAG,KAAK,OAAO,IAAI,CAAC;AAC/D,UAAI;AACJ,uBACQ,SAAS,sBAAsB,OAAO,QAAQ;AAAA,QAClD,iBAAiB,KAAK,OAAO;AAAA,QAC7B,eAAe;AAAA,QACf,gBAAgB;AAAA,QAChB,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,MAC5C,CAAC,GACD;AACA,YAAI,aAAa,OAAW,OAAM,IAAI,MAAM,wBAAwB;AACpE,mBAAW;AAAA,MACb;AACA,UAAI,CAAC,qBAAqB,QAAQ,EAAG,OAAM,IAAI,MAAM,uBAAuB;AAC5E,UAAI,SAAS,OAAO,QAAQ,GAAI,OAAM,IAAI,MAAM,2BAA2B;AAC3E,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,SAAS,KAAK;AAChD,aAAO,SAAS;AAAA,IAClB,SAAS,OAAO;AACd,UAAI,iBAAiB,eAAgB,OAAM,OAAO,MAAM,KAAK;AAC7D,YAAM;AAAA,IACR,UAAE;AACA,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IAC5C;AAAA,EACF;AACF;;;ACpFO,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AAwBjC,SAAS,mBAAmB,OAA2C;AAC5E,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,SACE,OAAO,SAAS,2BAChB,OAAO,OAAO,OAAO,YACrB,OAAO,OAAO,WAAW;AAE7B;AAEO,SAAS,oBAAoB,OAA4C;AAC9E,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,MAAI,OAAO,SAAS,4BAA4B,OAAO,OAAO,OAAO,YAAY,OAAO,OAAO,OAAO,UAAW,QAAO;AACxH,MAAI,OAAO,GAAI,QAAO,YAAY;AAClC,SAAO,OAAO,OAAO,UAAU;AACjC;;;ACnCA,IAAM,mBAAqC;AAEpC,IAAM,6BAAN,MAA6D;AAAA,EAIlE,YAA6B,UAA6C,CAAC,GAAG;AAAjD;AAC3B,SAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,eAAW,UAAU,QAAQ,kBAAkB,CAAC,GAAG;AACjD,WAAK,eAAe,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC/C;AAAA,EACF;AAAA,EARiB,iBAAiB,oBAAI,IAAiC;AAAA,EACtD;AAAA,EASV,iBAAiB,QAAmC;AACzD,SAAK,eAAe,IAAI,OAAO,QAAQ,MAAM;AAAA,EAC/C;AAAA,EAEO,oBAAoB,QAAsB;AAC/C,SAAK,eAAe,OAAO,MAAM;AAAA,EACnC;AAAA,EAEA,MAAa,gBAAgB,OAGR;AACnB,UAAM,SAAS,KAAK,QAAQ,mBAAmB,MAAM,YAAY,KAAK,KAAK,eAAe,IAAI,MAAM,YAAY;AAChH,QAAI,QAAQ,UAAW,QAAO;AAC9B,QAAI,MAAM,aAAa,iBAAkB,QAAO,KAAK;AACrD,WAAO,WAAW;AAAA,EACpB;AACF;;;ACpCO,IAAM,iCAAiC;AACvC,IAAM,+BAA+B,IAAI;AAChD,IAAM,oBAAoB,KAAK;AAC/B,IAAM,gBAAgB;AAmCtB,SAAS,YAAY,OAAe,MAAc,WAA2B;AAC3E,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,QAAQ,SAAS,WAAW;AAC1C,UAAM,IAAI,MAAM,iCAAiC,IAAI,EAAE;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,YAAY,SAAqC;AACxD,QAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,WAAS,QAAQ,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AACzD,QAAI,MAAM,KAAK,MAAM,MAAO,QAAO,MAAM,QAAQ,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,WAA8B,QAA0B;AACjF,QAAM,SAAS,CAAC,GAAG,IAAI,IAAI,UAAU,IAAI,CAAC,YAAY,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,OAAO;AACtF,MACE,OAAO,WAAW,KAClB,OAAO,SAAS,iBAChB,OAAO;AAAA,IAAK,CAAC,YACX,QAAQ,SAAS,QACjB,CAAC,QAAQ,WAAW,GAAG,KACtB,CAAC,QAAQ,SAAS,KAAK,KAAK,CAAC,QAAQ,SAAS,MAAM,KACrD,YAAY,OAAO,MAAM;AAAA,EAC3B,GACA;AACA,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAmB,WAAmB,KAAmB;AACjF,MACE,CAAC,OAAO,cAAc,SAAS,KAC/B,CAAC,OAAO,cAAc,SAAS,KAC/B,aAAa,aACb,YAAY,YAAY,8BACxB;AACA,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,MAAI,aAAa,IAAK,OAAM,IAAI,MAAM,mCAAmC;AAC3E;AAEA,SAAS,gBAAgB,QAAgF;AACvG,QAAM,SAAS,YAAY,OAAO,QAAQ,UAAU,GAAG;AACvD,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA,oBAAoB,YAAY,OAAO,oBAAoB,sBAAsB,IAAI;AAAA,IACrF,YAAY,YAAY,OAAO,YAAY,cAAc,GAAG;AAAA,IAC5D,YAAY,CAAC,GAAG,kBAAkB,OAAO,YAAY,MAAM,CAAC,EAAE,KAAK;AAAA,IACnE,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACpB;AACF;AAEO,SAAS,kCACd,QACY;AACZ,QAAM,UAAU,gBAAgB,MAAM;AACtC,QAAM,YAAY;AAAA,IAChB;AAAA,IACA,UAAU,QAAQ,MAAM;AAAA,IACxB,aAAa,QAAQ,kBAAkB;AAAA,IACvC,cAAc,QAAQ,UAAU;AAAA,IAChC,cAAc,QAAQ,WAAW,KAAK,GAAG,CAAC;AAAA,IAC1C,aAAa,QAAQ,SAAS;AAAA,IAC9B,aAAa,QAAQ,SAAS;AAAA,EAChC,EAAE,KAAK,IAAI;AACX,SAAO,IAAI,YAAY,EAAE,OAAO,SAAS;AAC3C;AAEA,eAAsB,0BACpB,QAGA,SAC8B;AAC9B,QAAM,YAAY,QAAQ,OAAO,KAAK,IAAI;AAC1C,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,CAAC,OAAO,cAAc,SAAS,KAAK,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAClF,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,QAAM,UAAU,gBAAgB;AAAA,IAC9B,UAAU;AAAA,IACV,QAAQ,OAAO;AAAA,IACf,oBAAoB,OAAO;AAAA,IAC3B,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO,cAAc,CAAC;AAAA,IAClC;AAAA,IACA,WAAW,YAAY;AAAA,EACzB,CAAC;AACD,mBAAiB,QAAQ,WAAW,QAAQ,WAAW,YAAY,CAAC;AACpE,QAAM,YAAY;AAAA,IAChB,MAAM,QAAQ,KAAK,kCAAkC,OAAO,CAAC;AAAA,IAC7D;AAAA,IACA;AAAA,EACF;AACA,SAAO,EAAE,GAAG,SAAS,UAAU;AACjC;AAEO,SAAS,0BAA0B,QAAqC;AAC7E,QAAM,UAAU,gBAAgB,MAAM;AACtC,QAAM,YAAY,YAAY,OAAO,WAAW,aAAa,IAAI;AACjE,SAAO,KAAK,UAAU,EAAE,GAAG,SAAS,UAAU,CAAC;AACjD;AAEA,eAAsB,yBACpB,YACA,SAC8B;AAC9B,MAAI,CAAC,cAAc,WAAW,SAAS,mBAAmB;AACxD,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,UAAU;AAAA,EAChC,QAAQ;AACN,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,QAAM,SAAS;AACf,MACE,OAAO,aAAa,kCACpB,OAAO,OAAO,WAAW,YACzB,OAAO,OAAO,uBAAuB,YACrC,OAAO,OAAO,eAAe,YAC7B,CAAC,MAAM,QAAQ,OAAO,UAAU,KAChC,OAAO,WAAW,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,KAC/D,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,cAAc,UAC5B;AACA,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,mBAAiB,OAAO,WAAW,OAAO,WAAW,QAAQ,OAAO,KAAK,IAAI,CAAC;AAC9E,QAAM,UAAU,gBAAgB;AAAA,IAC9B,UAAU;AAAA,IACV,QAAQ,OAAO;AAAA,IACf,oBAAoB,OAAO;AAAA,IAC3B,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACpB,CAAC;AACD,QAAM,SAA8B;AAAA,IAClC,GAAG;AAAA,IACH,WAAW,YAAY,OAAO,WAAW,aAAa,IAAI;AAAA,EAC5D;AACA,MACE,CAAC,MAAM,QAAQ,eAAe;AAAA,IAC5B;AAAA,IACA,SAAS,kCAAkC,OAAO;AAAA,EACpD,CAAC,GACD;AACA,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;;;ACrLO,SAAS,mBAAmB,OAA2C;AAC5E,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,mBAAmB,YAC5B,OAAO,EAAE,UAAU,YACnB,OAAO,EAAE,iBAAiB,YAC1B,OAAO,EAAE,gBAAgB,YACzB,OAAO,EAAE,iBAAiB,YAC1B,OAAO,EAAE,iBAAiB,YAC1B,OAAO,EAAE,yBAAyB,YAClC,OAAO,EAAE,oBAAoB;AAEjC;AAQO,SAAS,4BACd,gBACA,kBACgB;AAChB,QAAM,SAAyB,CAAC;AAChC,aAAW,CAAC,cAAc,cAAc,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAC7E,UAAM,eAAe,eAAe,YAAY,KAAK;AACrD,QAAI,iBAAiB,cAAc;AACjC,aAAO,KAAK,EAAE,cAAc,eAAe,cAAc,aAAa,eAAe,CAAC;AAAA,IACxF;AAAA,EACF;AACA,SAAO,OAAO,KAAK,CAAC,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CAAC;AACzF;","names":[]}

package/dist/{chunk-MRKY4HGF.js → chunk-EPHRIRAL.js}

@@ -135,6 +135,8 @@ var MemoryDeviceNetworkService = class {
       async sink() {
       },
       async close() {
+      },
+      abort() {
       }
     };
   }
@@ -169,11 +171,21 @@ var MemoryDeviceNetworkService = class {
 // src/device-network/syncCloudDevices.ts
 async function syncCloudDevices(input) {
   const cloudDevices = await input.cloudClient.listDevices();
-  if (cloudDevices.length === 0) return [];
   const existingRecords = await input.trustStore.loadTrustedDevices();
   const existingByPeerId = new Map(existingRecords.map((r) => [r.peerId, r]));
-  for (const cloudDevice of cloudDevices) {
+  const excludedPeerIds = new Set(input.excludePeerIds ?? []);
+  const activeCloudDevices = cloudDevices.filter(
+    (device) => device.revokedAt === void 0 && !excludedPeerIds.has(device.peerId)
+  );
+  const visibleCloudPeerIds = new Set(activeCloudDevices.map((device) => device.peerId));
+  for (const existing of existingRecords) {
+    if (existing.trustMode === "cloud-account" && !visibleCloudPeerIds.has(existing.peerId)) {
+      await input.trustStore.removeTrustedDevice(existing.peerId);
+    }
+  }
+  for (const cloudDevice of activeCloudDevices) {
     const existing = existingByPeerId.get(cloudDevice.peerId);
+    if (existing?.trustMode === "local-pairing") continue;
     const record = {
       peerId: cloudDevice.peerId,
       publicKeyMultibase: cloudDevice.publicKeyMultibase,
@@ -185,21 +197,18 @@ async function syncCloudDevices(input) {
       lastSeen: cloudDevice.lastSeen,
       revokedAt: cloudDevice.revokedAt
     };
-    if (existing) {
-      existing.lastSeen = cloudDevice.lastSeen;
-      existing.revokedAt = cloudDevice.revokedAt;
-      if (existing.publicKeyMultibase !== record.publicKeyMultibase || existing.deviceName !== record.deviceName || existing.platform !== record.platform) {
-        await input.trustStore.saveTrustedDevice(record);
-      }
-    } else {
+    if (!existing || !sameTrustedDevice(existing, record)) {
       await input.trustStore.saveTrustedDevice(record);
     }
   }
-  return cloudDevices;
+  return activeCloudDevices;
+}
+function sameTrustedDevice(left, right) {
+  return left.peerId === right.peerId && left.publicKeyMultibase === right.publicKeyMultibase && left.deviceName === right.deviceName && left.platform === right.platform && left.trustMode === right.trustMode && left.accountId === right.accountId && left.createdAt === right.createdAt && left.lastSeen === right.lastSeen && left.revokedAt === right.revokedAt;
 }
 
 export {
   MemoryDeviceNetworkService,
   syncCloudDevices
 };
-//# sourceMappingURL=chunk-MRKY4HGF.js.map
+//# sourceMappingURL=chunk-EPHRIRAL.js.map

package/dist/chunk-EPHRIRAL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/device-network/memoryDeviceNetworkService.ts","../src/device-network/syncCloudDevices.ts"],"sourcesContent":["import type {\n  Device,\n  DeviceCapabilities,\n  DeviceConnectionGrant,\n  DeviceNetworkService,\n  LocalDeviceIdentity,\n  LocalPairingRequestOptions,\n  MemeLoopDuplexStream,\n  MemeLoopProtocol,\n  PairingSession,\n  SyncResult,\n  TrustedDeviceRecord,\n} from './types.js';\n\nexport interface MemoryDeviceNetworkServiceOptions {\n  identity: LocalDeviceIdentity;\n  capabilities?: DeviceCapabilities;\n  trustedDevices?: TrustedDeviceRecord[];\n}\n\nconst emptyCapabilities: DeviceCapabilities = {\n  tools: [],\n  mcpServers: [],\n  hasWiki: false,\n  agentLoop: false,\n  imChannels: [],\n  wikis: [],\n};\n\nfunction toDevice(record: TrustedDeviceRecord, capabilities: DeviceCapabilities): Device {\n  return {\n    peerId: record.peerId,\n    displayName: record.deviceName,\n    platform: record.platform,\n    trustMode: record.trustMode,\n    trusted: !record.revokedAt,\n    reachability: {\n      state: record.revokedAt ? 'offline' : 'nearby',\n      paths: record.revokedAt ? [] : ['lan'],\n    },\n    capabilities,\n    lastSeen: record.lastSeen,\n  };\n}\n\nexport class MemoryDeviceNetworkService implements DeviceNetworkService {\n  private started = false;\n  private readonly capabilities: DeviceCapabilities;\n  private readonly trustedDevices = new Map<string, TrustedDeviceRecord>();\n  private readonly pairingSessions = new Map<string, PairingSession>();\n  private readonly listeners = new Set<(devices: Device[]) => void>();\n  private readonly pairingListeners = new Set<(sessions: PairingSession[]) => void>();\n\n  constructor(private readonly options: MemoryDeviceNetworkServiceOptions) {\n    this.capabilities = options.capabilities ?? emptyCapabilities;\n    for (const record of options.trustedDevices ?? []) {\n      this.trustedDevices.set(record.peerId, record);\n    }\n  }\n\n  public async start(): Promise<void> {\n    this.started = true;\n    this.emitDevices();\n  }\n\n  public async stop(): Promise<void> {\n    this.started = false;\n    this.emitDevices();\n  }\n\n  public async getLocalDevice(): Promise<Device> {\n    return {\n      peerId: this.options.identity.peerId,\n      displayName: this.options.identity.deviceName,\n      platform: this.options.identity.platform,\n      trustMode: 'local-pairing',\n      reachability: {\n        state: this.started ? 'online' : 'offline',\n        paths: this.started ? ['lan'] : [],\n      },\n      capabilities: this.capabilities,\n      lastSeen: Date.now(),\n    };\n  }\n\n  public async listDevices(): Promise<Device[]> {\n    return [...this.trustedDevices.values()].map((record) => toDevice(record, emptyCapabilities));\n  }\n\n  public observeDevices(listener: (devices: Device[]) => void): () => void {\n    this.listeners.add(listener);\n    void this.listDevices().then(listener);\n    return () => {\n      this.listeners.delete(listener);\n    };\n  }\n\n  public async listPairingSessions(): Promise<PairingSession[]> {\n    return [...this.pairingSessions.values()];\n  }\n\n  public observePairingSessions(listener: (sessions: PairingSession[]) => void): () => void {\n    this.pairingListeners.add(listener);\n    void this.listPairingSessions().then(listener);\n    return () => {\n      this.pairingListeners.delete(listener);\n    };\n  }\n\n  public async requestLocalPairing(peerId: string, _options: LocalPairingRequestOptions = {}): Promise<PairingSession> {\n    const createdAt = Date.now();\n    const session: PairingSession = {\n      sessionId: `pairing-${this.options.identity.peerId}-${peerId}-${createdAt}`,\n      localPeerId: this.options.identity.peerId,\n      remotePeerId: peerId,\n      remotePublicKeyMultibase: '',\n      remoteDeviceName: peerId,\n      remotePlatform: 'cli',\n      remoteCapabilities: emptyCapabilities,\n      remoteMultiaddrs: [],\n      direction: 'outbound',\n      status: 'pending',\n      confirmCode: this.confirmCode(peerId),\n      createdAt,\n      expiresAt: createdAt + 5 * 60_000,\n    };\n    this.pairingSessions.set(session.sessionId, session);\n    this.emitPairingSessions();\n    return session;\n  }\n\n  public async acceptPairing(sessionId: string): Promise<void> {\n    const session = this.pairingSessions.get(sessionId);\n    if (!session) throw new Error('pairing_session_not_found');\n    if (session.expiresAt < Date.now()) throw new Error('pairing_session_expired');\n    if (session.status !== 'pending') throw new Error('pairing_session_not_pending');\n    this.trustedDevices.set(session.remotePeerId, {\n      peerId: session.remotePeerId,\n      publicKeyMultibase: session.remotePublicKeyMultibase,\n      deviceName: session.remoteDeviceName,\n      platform: session.remotePlatform,\n      trustMode: 'local-pairing',\n      createdAt: Date.now(),\n      lastSeen: Date.now(),\n    });\n    session.status = 'accepted';\n    this.emitPairingSessions();\n    this.emitDevices();\n  }\n\n  public async rejectPairing(sessionId: string): Promise<void> {\n    const session = this.pairingSessions.get(sessionId);\n    if (!session) return;\n    session.status = 'rejected';\n    this.emitPairingSessions();\n  }\n\n  public async removeTrustedDevice(peerId: string): Promise<void> {\n    this.trustedDevices.delete(peerId);\n    this.emitDevices();\n  }\n\n  public async openStream(\n    peerId: string,\n    _protocol: MemeLoopProtocol,\n    _presentedGrant?: DeviceConnectionGrant,\n  ): Promise<MemeLoopDuplexStream> {\n    if (!this.trustedDevices.has(peerId)) throw new Error('device_not_trusted');\n    return {\n      source: (async function* emptySource() {})(),\n      async sink() {},\n      async close() {},\n      abort() {},\n    };\n  }\n\n  public async sendRpc<T>(\n    peerId: string,\n    _method: string,\n    _parameters: unknown,\n    _presentedGrant?: DeviceConnectionGrant,\n  ): Promise<T> {\n    if (!this.trustedDevices.has(peerId)) throw new Error('device_not_trusted');\n    throw new Error('rpc_handler_not_registered');\n  }\n\n  public async syncWithDevice(peerId: string, _presentedGrant?: DeviceConnectionGrant): Promise<SyncResult> {\n    if (!this.trustedDevices.has(peerId)) throw new Error('device_not_trusted');\n    return { ok: true, peerId, syncedAt: Date.now() };\n  }\n\n  private confirmCode(peerId: string): string {\n    const input = `${this.options.identity.peerId}:${peerId}`;\n    let hash = 0;\n    for (let index = 0; index < input.length; index += 1) {\n      hash = (hash * 31 + input.charCodeAt(index)) >>> 0;\n    }\n    return (hash % 1_000_000).toString().padStart(6, '0');\n  }\n\n  private emitDevices(): void {\n    void this.listDevices().then((devices) => {\n      for (const listener of this.listeners) listener(devices);\n    });\n  }\n\n  private emitPairingSessions(): void {\n    void this.listPairingSessions().then((sessions) => {\n      for (const listener of this.pairingListeners) listener(sessions);\n    });\n  }\n}\n","import type { CloudDeviceClient, CloudDeviceRecord, DeviceTrustStore, TrustedDeviceRecord } from './types.js';\n\n/**\n * Fetch visible cloud devices and merge them into the local trust store.\n * - Cloud devices become trusted with trustMode = \"cloud-account\".\n * - Explicit local-pairing trust is never replaced by Cloud directory data.\n * - Cloud-account records that are revoked or disappear from the visible\n *   directory are removed so stale discovery metadata cannot bypass revocation.\n * - Returns only active Cloud records for callers to emit as discovered devices.\n */\nexport async function syncCloudDevices(input: {\n  cloudClient: CloudDeviceClient;\n  excludePeerIds?: Iterable<string>;\n  trustStore: DeviceTrustStore;\n}): Promise<CloudDeviceRecord[]> {\n  const cloudDevices = await input.cloudClient.listDevices();\n  const existingRecords = await input.trustStore.loadTrustedDevices();\n  const existingByPeerId = new Map(existingRecords.map((r) => [r.peerId, r]));\n  const excludedPeerIds = new Set(input.excludePeerIds ?? []);\n  const activeCloudDevices = cloudDevices.filter(\n    device => device.revokedAt === undefined && !excludedPeerIds.has(device.peerId),\n  );\n  const visibleCloudPeerIds = new Set(activeCloudDevices.map((device) => device.peerId));\n\n  for (const existing of existingRecords) {\n    if (\n      existing.trustMode === 'cloud-account' &&\n      !visibleCloudPeerIds.has(existing.peerId)\n    ) {\n      await input.trustStore.removeTrustedDevice(existing.peerId);\n    }\n  }\n\n  for (const cloudDevice of activeCloudDevices) {\n    const existing = existingByPeerId.get(cloudDevice.peerId);\n\n    // Local pairing is a separate, explicit trust source. Cloud discovery may\n    // describe the same peer but must not rotate its key or downgrade its trust\n    // provenance behind the user's back.\n    if (existing?.trustMode === 'local-pairing') continue;\n\n    const record: TrustedDeviceRecord = {\n      peerId: cloudDevice.peerId,\n      publicKeyMultibase: cloudDevice.publicKeyMultibase,\n      deviceName: cloudDevice.deviceName,\n      platform: cloudDevice.platform,\n      trustMode: 'cloud-account',\n      accountId: cloudDevice.accountId,\n      createdAt: existing?.createdAt ?? Date.now(),\n      lastSeen: cloudDevice.lastSeen,\n      revokedAt: cloudDevice.revokedAt,\n    };\n\n    if (!existing || !sameTrustedDevice(existing, record)) {\n      await input.trustStore.saveTrustedDevice(record);\n    }\n  }\n\n  return activeCloudDevices;\n}\n\nfunction sameTrustedDevice(left: TrustedDeviceRecord, right: TrustedDeviceRecord): boolean {\n  return left.peerId === right.peerId &&\n    left.publicKeyMultibase === right.publicKeyMultibase &&\n    left.deviceName === right.deviceName &&\n    left.platform === right.platform &&\n    left.trustMode === right.trustMode &&\n    left.accountId === right.accountId &&\n    left.createdAt === right.createdAt &&\n    left.lastSeen === right.lastSeen &&\n    left.revokedAt === right.revokedAt;\n}\n"],"mappings":";AAoBA,IAAM,oBAAwC;AAAA,EAC5C,OAAO,CAAC;AAAA,EACR,YAAY,CAAC;AAAA,EACb,SAAS;AAAA,EACT,WAAW;AAAA,EACX,YAAY,CAAC;AAAA,EACb,OAAO,CAAC;AACV;AAEA,SAAS,SAAS,QAA6B,cAA0C;AACvF,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,IACpB,UAAU,OAAO;AAAA,IACjB,WAAW,OAAO;AAAA,IAClB,SAAS,CAAC,OAAO;AAAA,IACjB,cAAc;AAAA,MACZ,OAAO,OAAO,YAAY,YAAY;AAAA,MACtC,OAAO,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK;AAAA,IACvC;AAAA,IACA;AAAA,IACA,UAAU,OAAO;AAAA,EACnB;AACF;AAEO,IAAM,6BAAN,MAAiE;AAAA,EAQtE,YAA6B,SAA4C;AAA5C;AAC3B,SAAK,eAAe,QAAQ,gBAAgB;AAC5C,eAAW,UAAU,QAAQ,kBAAkB,CAAC,GAAG;AACjD,WAAK,eAAe,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC/C;AAAA,EACF;AAAA,EAZQ,UAAU;AAAA,EACD;AAAA,EACA,iBAAiB,oBAAI,IAAiC;AAAA,EACtD,kBAAkB,oBAAI,IAA4B;AAAA,EAClD,YAAY,oBAAI,IAAiC;AAAA,EACjD,mBAAmB,oBAAI,IAA0C;AAAA,EASlF,MAAa,QAAuB;AAClC,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAa,OAAsB;AACjC,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAa,iBAAkC;AAC7C,WAAO;AAAA,MACL,QAAQ,KAAK,QAAQ,SAAS;AAAA,MAC9B,aAAa,KAAK,QAAQ,SAAS;AAAA,MACnC,UAAU,KAAK,QAAQ,SAAS;AAAA,MAChC,WAAW;AAAA,MACX,cAAc;AAAA,QACZ,OAAO,KAAK,UAAU,WAAW;AAAA,QACjC,OAAO,KAAK,UAAU,CAAC,KAAK,IAAI,CAAC;AAAA,MACnC;AAAA,MACA,cAAc,KAAK;AAAA,MACnB,UAAU,KAAK,IAAI;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAa,cAAiC;AAC5C,WAAO,CAAC,GAAG,KAAK,eAAe,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,SAAS,QAAQ,iBAAiB,CAAC;AAAA,EAC9F;AAAA,EAEO,eAAe,UAAmD;AACvE,SAAK,UAAU,IAAI,QAAQ;AAC3B,SAAK,KAAK,YAAY,EAAE,KAAK,QAAQ;AACrC,WAAO,MAAM;AACX,WAAK,UAAU,OAAO,QAAQ;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,MAAa,sBAAiD;AAC5D,WAAO,CAAC,GAAG,KAAK,gBAAgB,OAAO,CAAC;AAAA,EAC1C;AAAA,EAEO,uBAAuB,UAA4D;AACxF,SAAK,iBAAiB,IAAI,QAAQ;AAClC,SAAK,KAAK,oBAAoB,EAAE,KAAK,QAAQ;AAC7C,WAAO,MAAM;AACX,WAAK,iBAAiB,OAAO,QAAQ;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAa,oBAAoB,QAAgB,WAAuC,CAAC,GAA4B;AACnH,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,UAA0B;AAAA,MAC9B,WAAW,WAAW,KAAK,QAAQ,SAAS,MAAM,IAAI,MAAM,IAAI,SAAS;AAAA,MACzE,aAAa,KAAK,QAAQ,SAAS;AAAA,MACnC,cAAc;AAAA,MACd,0BAA0B;AAAA,MAC1B,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,MACpB,kBAAkB,CAAC;AAAA,MACnB,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,aAAa,KAAK,YAAY,MAAM;AAAA,MACpC;AAAA,MACA,WAAW,YAAY,IAAI;AAAA,IAC7B;AACA,SAAK,gBAAgB,IAAI,QAAQ,WAAW,OAAO;AACnD,SAAK,oBAAoB;AACzB,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,cAAc,WAAkC;AAC3D,UAAM,UAAU,KAAK,gBAAgB,IAAI,SAAS;AAClD,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,2BAA2B;AACzD,QAAI,QAAQ,YAAY,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAC7E,QAAI,QAAQ,WAAW,UAAW,OAAM,IAAI,MAAM,6BAA6B;AAC/E,SAAK,eAAe,IAAI,QAAQ,cAAc;AAAA,MAC5C,QAAQ,QAAQ;AAAA,MAChB,oBAAoB,QAAQ;AAAA,MAC5B,YAAY,QAAQ;AAAA,MACpB,UAAU,QAAQ;AAAA,MAClB,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,MACpB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AACD,YAAQ,SAAS;AACjB,SAAK,oBAAoB;AACzB,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAa,cAAc,WAAkC;AAC3D,UAAM,UAAU,KAAK,gBAAgB,IAAI,SAAS;AAClD,QAAI,CAAC,QAAS;AACd,YAAQ,SAAS;AACjB,SAAK,oBAAoB;AAAA,EAC3B;AAAA,EAEA,MAAa,oBAAoB,QAA+B;AAC9D,SAAK,eAAe,OAAO,MAAM;AACjC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAa,WACX,QACA,WACA,iBAC+B;AAC/B,QAAI,CAAC,KAAK,eAAe,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC1E,WAAO;AAAA,MACL,SAAS,gBAAgB,cAAc;AAAA,MAAC,GAAG;AAAA,MAC3C,MAAM,OAAO;AAAA,MAAC;AAAA,MACd,MAAM,QAAQ;AAAA,MAAC;AAAA,MACf,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AAAA,EAEA,MAAa,QACX,QACA,SACA,aACA,iBACY;AACZ,QAAI,CAAC,KAAK,eAAe,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC1E,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EAEA,MAAa,eAAe,QAAgB,iBAA8D;AACxG,QAAI,CAAC,KAAK,eAAe,IAAI,MAAM,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAC1E,WAAO,EAAE,IAAI,MAAM,QAAQ,UAAU,KAAK,IAAI,EAAE;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,UAAM,QAAQ,GAAG,KAAK,QAAQ,SAAS,MAAM,IAAI,MAAM;AACvD,QAAI,OAAO;AACX,aAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,aAAQ,OAAO,KAAK,MAAM,WAAW,KAAK,MAAO;AAAA,IACnD;AACA,YAAQ,OAAO,KAAW,SAAS,EAAE,SAAS,GAAG,GAAG;AAAA,EACtD;AAAA,EAEQ,cAAoB;AAC1B,SAAK,KAAK,YAAY,EAAE,KAAK,CAAC,YAAY;AACxC,iBAAW,YAAY,KAAK,UAAW,UAAS,OAAO;AAAA,IACzD,CAAC;AAAA,EACH;AAAA,EAEQ,sBAA4B;AAClC,SAAK,KAAK,oBAAoB,EAAE,KAAK,CAAC,aAAa;AACjD,iBAAW,YAAY,KAAK,iBAAkB,UAAS,QAAQ;AAAA,IACjE,CAAC;AAAA,EACH;AACF;;;ACzMA,eAAsB,iBAAiB,OAIN;AAC/B,QAAM,eAAe,MAAM,MAAM,YAAY,YAAY;AACzD,QAAM,kBAAkB,MAAM,MAAM,WAAW,mBAAmB;AAClE,QAAM,mBAAmB,IAAI,IAAI,gBAAgB,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1E,QAAM,kBAAkB,IAAI,IAAI,MAAM,kBAAkB,CAAC,CAAC;AAC1D,QAAM,qBAAqB,aAAa;AAAA,IACtC,YAAU,OAAO,cAAc,UAAa,CAAC,gBAAgB,IAAI,OAAO,MAAM;AAAA,EAChF;AACA,QAAM,sBAAsB,IAAI,IAAI,mBAAmB,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC;AAErF,aAAW,YAAY,iBAAiB;AACtC,QACE,SAAS,cAAc,mBACvB,CAAC,oBAAoB,IAAI,SAAS,MAAM,GACxC;AACA,YAAM,MAAM,WAAW,oBAAoB,SAAS,MAAM;AAAA,IAC5D;AAAA,EACF;AAEA,aAAW,eAAe,oBAAoB;AAC5C,UAAM,WAAW,iBAAiB,IAAI,YAAY,MAAM;AAKxD,QAAI,UAAU,cAAc,gBAAiB;AAE7C,UAAM,SAA8B;AAAA,MAClC,QAAQ,YAAY;AAAA,MACpB,oBAAoB,YAAY;AAAA,MAChC,YAAY,YAAY;AAAA,MACxB,UAAU,YAAY;AAAA,MACtB,WAAW;AAAA,MACX,WAAW,YAAY;AAAA,MACvB,WAAW,UAAU,aAAa,KAAK,IAAI;AAAA,MAC3C,UAAU,YAAY;AAAA,MACtB,WAAW,YAAY;AAAA,IACzB;AAEA,QAAI,CAAC,YAAY,CAAC,kBAAkB,UAAU,MAAM,GAAG;AACrD,YAAM,MAAM,WAAW,kBAAkB,MAAM;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,MAA2B,OAAqC;AACzF,SAAO,KAAK,WAAW,MAAM,UAC3B,KAAK,uBAAuB,MAAM,sBAClC,KAAK,eAAe,MAAM,cAC1B,KAAK,aAAa,MAAM,YACxB,KAAK,cAAc,MAAM,aACzB,KAAK,cAAc,MAAM,aACzB,KAAK,cAAc,MAAM,aACzB,KAAK,aAAa,MAAM,YACxB,KAAK,cAAc,MAAM;AAC7B;","names":[]}

package/dist/{chunk-P6L3444O.js → chunk-KV6TC5UJ.js}

@@ -1,6 +1,6 @@
 import {
   registerToolParameterSchema
-} from "./chunk-5JEV7632.js";
+} from "./chunk-5VYZV33O.js";
 import {
   registerHook
 } from "./chunk-LGUGYRR4.js";
@@ -379,4 +379,4 @@ export {
   getPluginRegistrations,
   clearPluginRegistrations
 };
-//# sourceMappingURL=chunk-P6L3444O.js.map
+//# sourceMappingURL=chunk-KV6TC5UJ.js.map

package/dist/chunk-MXRXYGWW.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-MXRXYGWW.js.map

package/dist/{chunk-CCEFAOSH.js → chunk-WHXFUMDE.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-FWSY5HOA.js";
 
 // src/orchestration/remoteClient.ts
-var REMOTE_ORCHESTRATION_PROTOCOL = "memeloop.resource.v1";
+var REMOTE_ORCHESTRATION_PROTOCOL = "memeloop.resource.v2";
 var REMOTE_OPERATIONS = /* @__PURE__ */ new Set([
   "capabilities",
   "apply",
@@ -493,4 +493,4 @@ export {
   createRemoteOrchestrationHandler,
   createFetchOrchestrationTransport
 };
-//# sourceMappingURL=chunk-CCEFAOSH.js.map
+//# sourceMappingURL=chunk-WHXFUMDE.js.map

package/dist/{chunk-CCEFAOSH.js.map → chunk-WHXFUMDE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/orchestration/remoteClient.ts"],"sourcesContent":["import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport { OrchestrationError } from './errors.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const REMOTE_ORCHESTRATION_PROTOCOL = 'memeloop.resource.v1' as const;\nexport type RemoteOrchestrationOperation =\n  | 'capabilities'\n  | 'apply'\n  | 'get'\n  | 'list'\n  | 'watch'\n  | 'delete';\n\nexport interface RemoteOrchestrationRequest {\n  protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n  requestId: string;\n  operation: RemoteOrchestrationOperation;\n  payload: Record<string, unknown>;\n}\n\nexport type RemoteOrchestrationResponse =\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n  };\n\nexport interface RemoteOrchestrationTransportOptions {\n  signal?: AbortSignal;\n}\n\n/**\n * Portable host boundary. Browser, Electron renderer, React Native, and Tauri\n * WebView clients implement this interface; trusted hosts bind identity and\n * policy behind the server-side AgentOrchestrationClient.\n */\nexport interface RemoteOrchestrationTransport {\n  request(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n}\n\nexport interface RemoteOrchestrationClientOptions {\n  createRequestId?: () => string;\n}\n\nexport interface ReadOnlyOrchestrationClientOptions {\n  /** Resource kinds visible to the remote client. Omit to retain every kind exposed by the source client. */\n  allowedResourceKinds?: readonly string[];\n}\n\nexport interface NamespacedOrchestrationClientOptions {\n  /** Host-bound namespace. Callers may omit it, but cannot select another namespace. */\n  namespace: string;\n  /** Resource kinds the caller may access. An empty list denies every resource kind. */\n  allowedResourceKinds: readonly string[];\n  /**\n   * Resource kinds the caller may apply or delete. Defaults to every allowed\n   * kind for compatibility; hosts should narrow this when status resources are\n   * controller-owned.\n   */\n  mutableResourceKinds?: readonly string[];\n}\n\nconst REMOTE_OPERATIONS = new Set<RemoteOrchestrationOperation>([\n  'capabilities',\n  'apply',\n  'get',\n  'list',\n  'watch',\n  'delete',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction errorData(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n      ...(error.reason !== undefined ? { reason: error.reason } : {}),\n      ...(error.details !== undefined ? { details: error.details } : {}),\n    };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\nfunction throwResponseError(response: Extract<RemoteOrchestrationResponse, { ok: false }>): never {\n  throw new OrchestrationError(response.error);\n}\n\nfunction assertResponse(\n  request: RemoteOrchestrationRequest,\n  response: RemoteOrchestrationResponse,\n): void {\n  if (\n    !isRecord(response) ||\n    response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n    response.requestId !== request.requestId ||\n    typeof response.ok !== 'boolean' ||\n    (response.ok && !('result' in response)) ||\n    (!response.ok &&\n      (!isRecord(response.error) ||\n        typeof response.error.code !== 'string' ||\n        typeof response.error.message !== 'string' ||\n        typeof response.error.retryable !== 'boolean'))\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'remote orchestration response correlation or protocol mismatch',\n      retryable: false,\n    });\n  }\n}\n\nlet requestSequence = 0;\n\n/** Build the policy-scoped Agent facade over a browser-safe remote transport. */\nexport function createRemoteOrchestrationClient(\n  transport: RemoteOrchestrationTransport,\n  options: RemoteOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const createRequestId = options.createRequestId ??\n    (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);\n\n  function makeRequest(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n  ): RemoteOrchestrationRequest {\n    return {\n      protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n      requestId: createRequestId(),\n      operation,\n      payload,\n    };\n  }\n\n  async function request<T>(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const envelope = makeRequest(operation, payload);\n    const response = await transport.request(envelope, { signal });\n    assertResponse(envelope, response);\n    if (!response.ok) throwResponseError(response);\n    return response.result as T;\n  }\n\n  return {\n    getCapabilities() {\n      return request<AgentOrchestrationCapabilities>('capabilities', {});\n    },\n    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus>>('apply', {\n        resource,\n        ...(applyOptions ? { options: applyOptions } : {}),\n      });\n    },\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      getOptions?: OrchestrationGetOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus> | null>('get', {\n        reference,\n        ...(getOptions ? { options: getOptions } : {}),\n      });\n    },\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      listOptions?: OrchestrationListOptions,\n    ) {\n      return request<OrchestrationResourceList<TSpec, TStatus>>('list', {\n        query,\n        ...(listOptions ? { options: listOptions } : {}),\n      });\n    },\n    async *watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      const envelope = makeRequest('watch', {\n        query,\n        ...(watchOptions\n          ? {\n            options: {\n              ...watchOptions,\n              signal: undefined,\n            },\n          }\n          : {}),\n      });\n      for await (\n        const response of transport.watch(envelope, {\n          signal: watchOptions?.signal,\n        })\n      ) {\n        assertResponse(envelope, response);\n        if (!response.ok) throwResponseError(response);\n        yield response.result as OrchestrationWatchEvent<TSpec, TStatus>;\n      }\n    },\n    delete(reference: OrchestrationResourceReference, deleteOptions?: OrchestrationDeleteOptions) {\n      return request<OrchestrationDeleteResult>('delete', {\n        reference,\n        ...(deleteOptions ? { options: deleteOptions } : {}),\n      });\n    },\n  };\n}\n\n/**\n * Bind a remote/mobile caller to a read-only view of an existing policy-scoped\n * client. This is an enforcement boundary, not only capability advertising:\n * mutations and out-of-scope kinds fail before reaching the source client.\n */\nexport function createReadOnlyOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: ReadOnlyOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const allowedKinds = options.allowedResourceKinds\n    ? new Set(options.allowedResourceKinds)\n    : undefined;\n\n  function assertAllowedKind(kind: string): void {\n    if (!allowedKinds || allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function forbidden(operation: 'apply' | 'delete'): never {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration operation '${operation}' is read-only`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      return {\n        operations: ['get', 'list', 'watch'],\n        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply() {\n      forbidden('apply');\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(reference, getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(query, listOptions);\n    },\n    async *watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      yield* client.watch(query, watchOptions);\n    },\n    async delete() {\n      forbidden('delete');\n    },\n  };\n}\n\n/**\n * Bind a mutable remote caller to one host-selected namespace and an explicit\n * resource-kind allowlist. The wrapper is an authorization boundary: it\n * rejects cross-namespace references before they reach the source client and\n * fills an omitted namespace with the host-bound value.\n */\nexport function createNamespacedOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: NamespacedOrchestrationClientOptions,\n): AgentOrchestrationClient {\n  const namespace = options.namespace.trim();\n  if (!namespace || namespace.length > 253) {\n    throw new TypeError('namespace must contain between 1 and 253 characters');\n  }\n  const allowedKinds = new Set(options.allowedResourceKinds);\n  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);\n  for (const kind of mutableKinds) {\n    if (!allowedKinds.has(kind)) {\n      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);\n    }\n  }\n\n  function assertAllowedKind(kind: string): void {\n    if (allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function bindNamespace<T extends { namespace?: string }>(metadata: T): T & { namespace: string } {\n    if (metadata.namespace !== undefined && metadata.namespace !== namespace) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,\n        retryable: false,\n      });\n    }\n    return { ...metadata, namespace };\n  }\n\n  function assertMutableKind(kind: string): void {\n    assertAllowedKind(kind);\n    if (mutableKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));\n      const resourceOperations = Object.fromEntries(\n        resourceKinds.map((kind) => {\n          const sourceOperations = capabilities.resourceOperations?.[kind] ??\n            capabilities.operations;\n          return [\n            kind,\n            sourceOperations.filter((operation) => mutableKinds.has(kind) || (operation !== 'apply' && operation !== 'delete')),\n          ];\n        }),\n      );\n      return {\n        operations: capabilities.operations,\n        resourceKinds,\n        resourceOperations,\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply(resource, applyOptions) {\n      assertMutableKind(resource.kind);\n      return await client.apply(\n        {\n          ...resource,\n          metadata: bindNamespace(resource.metadata),\n        },\n        applyOptions,\n      );\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(bindNamespace(reference), getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(bindNamespace(query), listOptions);\n    },\n    watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      return client.watch(bindNamespace(query), watchOptions);\n    },\n    async delete(reference, deleteOptions) {\n      assertMutableKind(reference.kind);\n      return await client.delete(bindNamespace(reference), deleteOptions);\n    },\n  };\n}\n\nfunction requirePayload(payload: Record<string, unknown>, key: string): unknown {\n  if (!(key in payload)) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: `remote orchestration request is missing payload.${key}`,\n      retryable: false,\n    });\n  }\n  return payload[key];\n}\n\nfunction success(\n  request: RemoteOrchestrationRequest,\n  result: unknown,\n): RemoteOrchestrationResponse {\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: request.requestId,\n    ok: true,\n    result,\n  };\n}\n\nfunction failure(request: unknown, error: unknown): RemoteOrchestrationResponse {\n  const requestRecord = isRecord(request) ? request : undefined;\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: typeof requestRecord?.requestId === 'string' ? requestRecord.requestId : 'invalid',\n    ok: false,\n    error: errorData(error),\n  };\n}\n\n/**\n * Trusted-side protocol adapter. The injected client has already bound actor,\n * admission, quotas, and resource scope; wire callers cannot select an actor.\n */\nexport function createRemoteOrchestrationHandler(client: AgentOrchestrationClient): {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n} {\n  function validate(request: RemoteOrchestrationRequest): void {\n    if (\n      !isRecord(request) ||\n      request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n      typeof request.requestId !== 'string' ||\n      !request.requestId ||\n      request.requestId.length > 256 ||\n      !REMOTE_OPERATIONS.has(request.operation) ||\n      !isRecord(request.payload)\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'invalid remote orchestration request envelope',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    async request(request) {\n      try {\n        validate(request);\n        const payload = request.payload;\n        switch (request.operation) {\n          case 'capabilities':\n            return success(request, await client.getCapabilities());\n          case 'apply':\n            return success(\n              request,\n              await client.apply(\n                requirePayload(payload, 'resource') as OrchestrationResourceManifest,\n                payload.options as OrchestrationApplyOptions | undefined,\n              ),\n            );\n          case 'get':\n            return success(\n              request,\n              await client.get(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationGetOptions | undefined,\n              ),\n            );\n          case 'list':\n            return success(\n              request,\n              await client.list(\n                requirePayload(payload, 'query') as OrchestrationResourceQuery,\n                payload.options as OrchestrationListOptions | undefined,\n              ),\n            );\n          case 'delete':\n            return success(\n              request,\n              await client.delete(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationDeleteOptions | undefined,\n              ),\n            );\n          case 'watch':\n            throw new OrchestrationError({\n              code: 'INVALID',\n              message: 'watch requests require the streaming protocol method',\n              retryable: false,\n            });\n          default:\n            throw new OrchestrationError({\n              code: 'UNSUPPORTED',\n              message: `unsupported remote orchestration operation '${String(request.operation)}'`,\n              retryable: false,\n            });\n        }\n      } catch (error) {\n        return failure(request, error);\n      }\n    },\n    async *watch(request, options = {}) {\n      try {\n        validate(request);\n        if (request.operation !== 'watch') {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: 'streaming protocol accepts only watch operations',\n            retryable: false,\n          });\n        }\n        const watchOptions = request.payload.options as OrchestrationWatchOptions | undefined;\n        for await (\n          const event of client.watch(\n            requirePayload(request.payload, 'query') as OrchestrationResourceQuery,\n            {\n              ...watchOptions,\n              signal: options.signal,\n            },\n          )\n        ) {\n          yield success(request, event);\n        }\n      } catch (error) {\n        yield failure(request, error);\n      }\n    },\n  };\n}\n\nexport interface FetchOrchestrationTransportOptions {\n  endpoint: string;\n  fetch?: typeof globalThis.fetch;\n  headers?: Record<string, string> | (() => Promise<Record<string, string>>);\n  credentials?: RequestCredentials;\n  maxResponseBytes?: number;\n  maxWatchLineBytes?: number;\n}\n\n/** Browser/Tauri/React-Native fetch transport with bounded NDJSON watch. */\nexport function createFetchOrchestrationTransport(\n  options: FetchOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const fetch_ = options.fetch ?? globalThis.fetch;\n  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;\n  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;\n\n  function assertWatchLineSize(line: string): void {\n    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function headers(accept: string): Promise<Record<string, string>> {\n    const additional = typeof options.headers === 'function' ? await options.headers() : (options.headers ?? {});\n    return {\n      Accept: accept,\n      'Content-Type': 'application/json',\n      ...additional,\n    };\n  }\n\n  async function post(\n    request: RemoteOrchestrationRequest,\n    accept: string,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const response = await fetch_(options.endpoint, {\n      method: 'POST',\n      headers: await headers(accept),\n      body: JSON.stringify(request),\n      signal,\n      ...(options.credentials ? { credentials: options.credentials } : {}),\n    });\n    if (!response.ok) {\n      throw new OrchestrationError({\n        code: response.status === 401 || response.status === 403 ? 'FORBIDDEN' : 'UNAVAILABLE',\n        message: `remote orchestration endpoint returned HTTP ${response.status}`,\n        retryable: response.status >= 500,\n      });\n    }\n    return response;\n  }\n\n  async function readBoundedText(response: Response, limit: number): Promise<string> {\n    if (!response.body) return '';\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let size = 0;\n    let text = '';\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > limit) {\n          await reader.cancel();\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: `remote orchestration response exceeds ${limit} bytes`,\n            retryable: false,\n          });\n        }\n        text += decoder.decode(value, { stream: true });\n      }\n      return text + decoder.decode();\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  return {\n    async request(request, transportOptions = {}) {\n      const response = await post(request, 'application/json', transportOptions.signal);\n      const text = await readBoundedText(response, maxResponseBytes);\n      return JSON.parse(text) as RemoteOrchestrationResponse;\n    },\n    async *watch(request, transportOptions = {}) {\n      const response = await post(request, 'application/x-ndjson', transportOptions.signal);\n      if (!response.body) {\n        throw new OrchestrationError({\n          code: 'UNAVAILABLE',\n          message: 'remote orchestration watch response has no body',\n          retryable: true,\n        });\n      }\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder();\n      let pending = '';\n      let streamCompleted = false;\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) {\n            streamCompleted = true;\n            break;\n          }\n          pending += decoder.decode(value, { stream: true });\n          let newline = pending.indexOf('\\n');\n          while (newline >= 0) {\n            const line = pending.slice(0, newline).trim();\n            pending = pending.slice(newline + 1);\n            assertWatchLineSize(line);\n            if (line) yield JSON.parse(line) as RemoteOrchestrationResponse;\n            newline = pending.indexOf('\\n');\n          }\n          // UTF-8 is never smaller than the JS code-unit count. This cheap\n          // guard avoids repeatedly re-encoding an attacker-controlled partial\n          // line; the exact byte check runs once when the line is complete.\n          if (pending.length > maxWatchLineBytes) {\n            throw new OrchestrationError({\n              code: 'EXHAUSTED',\n              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n              retryable: false,\n            });\n          }\n        }\n        pending += decoder.decode();\n        if (pending.trim()) {\n          assertWatchLineSize(pending.trim());\n          yield JSON.parse(pending) as RemoteOrchestrationResponse;\n        }\n      } finally {\n        if (!streamCompleted) {\n          await reader.cancel().catch(() => undefined);\n        }\n        reader.releaseLock();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAoBO,IAAM,gCAAgC;AAwE7C,IAAM,oBAAoB,oBAAI,IAAkC;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAEA,SAAS,mBAAmB,UAAsE;AAChG,QAAM,IAAI,mBAAmB,SAAS,KAAK;AAC7C;AAEA,SAAS,eACP,SACA,UACM;AACN,MACE,CAAC,SAAS,QAAQ,KAClB,SAAS,aAAa,iCACtB,SAAS,cAAc,QAAQ,aAC/B,OAAO,SAAS,OAAO,aACtB,SAAS,MAAM,EAAE,YAAY,aAC7B,CAAC,SAAS,OACR,CAAC,SAAS,SAAS,KAAK,KACvB,OAAO,SAAS,MAAM,SAAS,YAC/B,OAAO,SAAS,MAAM,YAAY,YAClC,OAAO,SAAS,MAAM,cAAc,YACxC;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,IAAI,kBAAkB;AAGf,SAAS,gCACd,WACA,UAA4C,CAAC,GACnB;AAC1B,QAAM,kBAAkB,QAAQ,oBAC7B,MAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,SAAS,EAAE,CAAC;AAEhF,WAAS,YACP,WACA,SAC4B;AAC5B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,gBAAgB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,QACb,WACA,SACA,QACY;AACZ,UAAM,WAAW,YAAY,WAAW,OAAO;AAC/C,UAAM,WAAW,MAAM,UAAU,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC7D,mBAAe,UAAU,QAAQ;AACjC,QAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,kBAAkB;AAChB,aAAO,QAAwC,gBAAgB,CAAC,CAAC;AAAA,IACnE;AAAA,IACA,MACE,UACA,cACA;AACA,aAAO,QAA+C,SAAS;AAAA,QAC7D;AAAA,QACA,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,IACE,WACA,YACA;AACA,aAAO,QAAsD,OAAO;AAAA,QAClE;AAAA,QACA,GAAI,aAAa,EAAE,SAAS,WAAW,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,IACA,KACE,OACA,aACA;AACA,aAAO,QAAmD,QAAQ;AAAA,QAChE;AAAA,QACA,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,IACA,OAAO,MACL,OACA,cACwD;AACxD,YAAM,WAAW,YAAY,SAAS;AAAA,QACpC;AAAA,QACA,GAAI,eACA;AAAA,UACA,SAAS;AAAA,YACP,GAAG;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF,IACE,CAAC;AAAA,MACP,CAAC;AACD,uBACQ,YAAY,UAAU,MAAM,UAAU;AAAA,QAC1C,QAAQ,cAAc;AAAA,MACxB,CAAC,GACD;AACA,uBAAe,UAAU,QAAQ;AACjC,YAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,WAA2C,eAA4C;AAC5F,aAAO,QAAmC,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,kCACd,QACA,UAA8C,CAAC,GACrB;AAC1B,QAAM,eAAe,QAAQ,uBACzB,IAAI,IAAI,QAAQ,oBAAoB,IACpC;AAEJ,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,CAAC,gBAAgB,aAAa,IAAI,IAAI,EAAG;AAC7C,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,UAAU,WAAsC;AACvD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mCAAmC,SAAS;AAAA,MACrD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,YAAY,CAAC,OAAO,QAAQ,OAAO;AAAA,QACnC,eAAe,aAAa,cAAc,OAAO,CAAC,SAAS,eAAe,aAAa,IAAI,IAAI,IAAI,IAAI;AAAA,QACvG,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU,OAAO;AAAA,IACnB;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,WAAW,UAAU;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,OAAO,WAAW;AAAA,IAC7C;AAAA,IACA,OAAO,MAAM,OAAO,cAAc;AAChC,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,OAAO,YAAY;AAAA,IACzC;AAAA,IACA,MAAM,SAAS;AACb,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAQO,SAAS,oCACd,QACA,SAC0B;AAC1B,QAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK;AACxC,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,eAAe,IAAI,IAAI,QAAQ,oBAAoB;AACzD,QAAM,eAAe,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,oBAAoB;AACzF,aAAW,QAAQ,cAAc;AAC/B,QAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,UAAU,0BAA0B,IAAI,wBAAwB;AAAA,IAC5E;AAAA,EACF;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,cAAgD,UAAwC;AAC/F,QAAI,SAAS,cAAc,UAAa,SAAS,cAAc,WAAW;AACxE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kDAAkD,SAAS;AAAA,QACpE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,EAAE,GAAG,UAAU,UAAU;AAAA,EAClC;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,sBAAkB,IAAI;AACtB,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,IAAI;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,gBAAgB,aAAa,cAAc,OAAO,CAAC,SAAS,aAAa,IAAI,IAAI,CAAC;AACxF,YAAM,qBAAqB,OAAO;AAAA,QAChC,cAAc,IAAI,CAAC,SAAS;AAC1B,gBAAM,mBAAmB,aAAa,qBAAqB,IAAI,KAC7D,aAAa;AACf,iBAAO;AAAA,YACL;AAAA,YACA,iBAAiB,OAAO,CAAC,cAAc,aAAa,IAAI,IAAI,KAAM,cAAc,WAAW,cAAc,QAAS;AAAA,UACpH;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,aAAa;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,MAAM,UAAU,cAAc;AAClC,wBAAkB,SAAS,IAAI;AAC/B,aAAO,MAAM,OAAO;AAAA,QAClB;AAAA,UACE,GAAG;AAAA,UACH,UAAU,cAAc,SAAS,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,cAAc,SAAS,GAAG,UAAU;AAAA,IAC9D;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,MAAM,OAAO,cAAc;AACzB,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,cAAc,KAAK,GAAG,YAAY;AAAA,IACxD;AAAA,IACA,MAAM,OAAO,WAAW,eAAe;AACrC,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,cAAc,SAAS,GAAG,aAAa;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAkC,KAAsB;AAC9E,MAAI,EAAE,OAAO,UAAU;AACrB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,GAAG;AAAA,MAC/D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,GAAG;AACpB;AAEA,SAAS,QACP,SACA,QAC6B;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,IAAI;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,SAAkB,OAA6C;AAC9E,QAAM,gBAAgB,SAAS,OAAO,IAAI,UAAU;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,OAAO,eAAe,cAAc,WAAW,cAAc,YAAY;AAAA,IACpF,IAAI;AAAA,IACJ,OAAO,UAAU,KAAK;AAAA,EACxB;AACF;AAMO,SAAS,iCAAiC,QAM/C;AACA,WAAS,SAAS,SAA2C;AAC3D,QACE,CAAC,SAAS,OAAO,KACjB,QAAQ,aAAa,iCACrB,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,aACT,QAAQ,UAAU,SAAS,OAC3B,CAAC,kBAAkB,IAAI,QAAQ,SAAS,KACxC,CAAC,SAAS,QAAQ,OAAO,GACzB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS;AACrB,UAAI;AACF,iBAAS,OAAO;AAChB,cAAM,UAAU,QAAQ;AACxB,gBAAQ,QAAQ,WAAW;AAAA,UACzB,KAAK;AACH,mBAAO,QAAQ,SAAS,MAAM,OAAO,gBAAgB,CAAC;AAAA,UACxD,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,UAAU;AAAA,gBAClC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,OAAO;AAAA,gBAC/B,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACE,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,+CAA+C,OAAO,QAAQ,SAAS,CAAC;AAAA,cACjF,WAAW;AAAA,YACb,CAAC;AAAA,QACL;AAAA,MACF,SAAS,OAAO;AACd,eAAO,QAAQ,SAAS,KAAK;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,UAAU,CAAC,GAAG;AAClC,UAAI;AACF,iBAAS,OAAO;AAChB,YAAI,QAAQ,cAAc,SAAS;AACjC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,eAAe,QAAQ,QAAQ;AACrC,yBACQ,SAAS,OAAO;AAAA,UACpB,eAAe,QAAQ,SAAS,OAAO;AAAA,UACvC;AAAA,YACE,GAAG;AAAA,YACH,QAAQ,QAAQ;AAAA,UAClB;AAAA,QACF,GACA;AACA,gBAAM,QAAQ,SAAS,KAAK;AAAA,QAC9B;AAAA,MACF,SAAS,OAAO;AACd,cAAM,QAAQ,SAAS,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,kCACd,SAC8B;AAC9B,QAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,OAAO;AAC5D,QAAM,oBAAoB,QAAQ,qBAAqB,OAAO;AAE9D,WAAS,oBAAoB,MAAoB;AAC/C,QAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,mBAAmB;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2CAA2C,iBAAiB;AAAA,QACrE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QAAQ,QAAiD;AACtE,UAAM,aAAa,OAAO,QAAQ,YAAY,aAAa,MAAM,QAAQ,QAAQ,IAAK,QAAQ,WAAW,CAAC;AAC1G,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,GAAG;AAAA,IACL;AAAA,EACF;AAEA,iBAAe,KACb,SACA,QACA,QACmB;AACnB,UAAM,WAAW,MAAM,OAAO,QAAQ,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,MAAM,QAAQ,MAAM;AAAA,MAC7B,MAAM,KAAK,UAAU,OAAO;AAAA,MAC5B;AAAA,MACA,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,cAAc;AAAA,QACzE,SAAS,+CAA+C,SAAS,MAAM;AAAA,QACvE,WAAW,SAAS,UAAU;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,UAAoB,OAAgC;AACjF,QAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,UAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAM,UAAU,IAAI,YAAY;AAChC,QAAI,OAAO;AACX,QAAI,OAAO;AACX,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,YAAI,KAAM;AACV,gBAAQ,MAAM;AACd,YAAI,OAAO,OAAO;AAChB,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yCAAyC,KAAK;AAAA,YACvD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAChD;AACA,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,YAAM,WAAW,MAAM,KAAK,SAAS,oBAAoB,iBAAiB,MAAM;AAChF,YAAM,OAAO,MAAM,gBAAgB,UAAU,gBAAgB;AAC7D,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,YAAM,WAAW,MAAM,KAAK,SAAS,wBAAwB,iBAAiB,MAAM;AACpF,UAAI,CAAC,SAAS,MAAM;AAClB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,YAAM,UAAU,IAAI,YAAY;AAChC,UAAI,UAAU;AACd,UAAI,kBAAkB;AACtB,UAAI;AACF,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,MAAM;AACR,8BAAkB;AAClB;AAAA,UACF;AACA,qBAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AACjD,cAAI,UAAU,QAAQ,QAAQ,IAAI;AAClC,iBAAO,WAAW,GAAG;AACnB,kBAAM,OAAO,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC5C,sBAAU,QAAQ,MAAM,UAAU,CAAC;AACnC,gCAAoB,IAAI;AACxB,gBAAI,KAAM,OAAM,KAAK,MAAM,IAAI;AAC/B,sBAAU,QAAQ,QAAQ,IAAI;AAAA,UAChC;AAIA,cAAI,QAAQ,SAAS,mBAAmB;AACtC,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,2CAA2C,iBAAiB;AAAA,cACrE,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AAAA,QACF;AACA,mBAAW,QAAQ,OAAO;AAC1B,YAAI,QAAQ,KAAK,GAAG;AAClB,8BAAoB,QAAQ,KAAK,CAAC;AAClC,gBAAM,KAAK,MAAM,OAAO;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AACA,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/orchestration/remoteClient.ts"],"sourcesContent":["import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport { OrchestrationError } from './errors.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const REMOTE_ORCHESTRATION_PROTOCOL = 'memeloop.resource.v2' as const;\nexport type RemoteOrchestrationOperation =\n  | 'capabilities'\n  | 'apply'\n  | 'get'\n  | 'list'\n  | 'watch'\n  | 'delete';\n\nexport interface RemoteOrchestrationRequest {\n  protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n  requestId: string;\n  operation: RemoteOrchestrationOperation;\n  payload: Record<string, unknown>;\n}\n\nexport type RemoteOrchestrationResponse =\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n  };\n\nexport interface RemoteOrchestrationTransportOptions {\n  signal?: AbortSignal;\n}\n\n/**\n * Portable host boundary. Browser, Electron renderer, React Native, and Tauri\n * WebView clients implement this interface; trusted hosts bind identity and\n * policy behind the server-side AgentOrchestrationClient.\n */\nexport interface RemoteOrchestrationTransport {\n  request(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n}\n\nexport interface RemoteOrchestrationClientOptions {\n  createRequestId?: () => string;\n}\n\nexport interface ReadOnlyOrchestrationClientOptions {\n  /** Resource kinds visible to the remote client. Omit to retain every kind exposed by the source client. */\n  allowedResourceKinds?: readonly string[];\n}\n\nexport interface NamespacedOrchestrationClientOptions {\n  /** Host-bound namespace. Callers may omit it, but cannot select another namespace. */\n  namespace: string;\n  /** Resource kinds the caller may access. An empty list denies every resource kind. */\n  allowedResourceKinds: readonly string[];\n  /**\n   * Resource kinds the caller may apply or delete. Defaults to every allowed\n   * kind for compatibility; hosts should narrow this when status resources are\n   * controller-owned.\n   */\n  mutableResourceKinds?: readonly string[];\n}\n\nconst REMOTE_OPERATIONS = new Set<RemoteOrchestrationOperation>([\n  'capabilities',\n  'apply',\n  'get',\n  'list',\n  'watch',\n  'delete',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction errorData(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n      ...(error.reason !== undefined ? { reason: error.reason } : {}),\n      ...(error.details !== undefined ? { details: error.details } : {}),\n    };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\nfunction throwResponseError(response: Extract<RemoteOrchestrationResponse, { ok: false }>): never {\n  throw new OrchestrationError(response.error);\n}\n\nfunction assertResponse(\n  request: RemoteOrchestrationRequest,\n  response: RemoteOrchestrationResponse,\n): void {\n  if (\n    !isRecord(response) ||\n    response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n    response.requestId !== request.requestId ||\n    typeof response.ok !== 'boolean' ||\n    (response.ok && !('result' in response)) ||\n    (!response.ok &&\n      (!isRecord(response.error) ||\n        typeof response.error.code !== 'string' ||\n        typeof response.error.message !== 'string' ||\n        typeof response.error.retryable !== 'boolean'))\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'remote orchestration response correlation or protocol mismatch',\n      retryable: false,\n    });\n  }\n}\n\nlet requestSequence = 0;\n\n/** Build the policy-scoped Agent facade over a browser-safe remote transport. */\nexport function createRemoteOrchestrationClient(\n  transport: RemoteOrchestrationTransport,\n  options: RemoteOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const createRequestId = options.createRequestId ??\n    (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);\n\n  function makeRequest(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n  ): RemoteOrchestrationRequest {\n    return {\n      protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n      requestId: createRequestId(),\n      operation,\n      payload,\n    };\n  }\n\n  async function request<T>(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const envelope = makeRequest(operation, payload);\n    const response = await transport.request(envelope, { signal });\n    assertResponse(envelope, response);\n    if (!response.ok) throwResponseError(response);\n    return response.result as T;\n  }\n\n  return {\n    getCapabilities() {\n      return request<AgentOrchestrationCapabilities>('capabilities', {});\n    },\n    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus>>('apply', {\n        resource,\n        ...(applyOptions ? { options: applyOptions } : {}),\n      });\n    },\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      getOptions?: OrchestrationGetOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus> | null>('get', {\n        reference,\n        ...(getOptions ? { options: getOptions } : {}),\n      });\n    },\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      listOptions?: OrchestrationListOptions,\n    ) {\n      return request<OrchestrationResourceList<TSpec, TStatus>>('list', {\n        query,\n        ...(listOptions ? { options: listOptions } : {}),\n      });\n    },\n    async *watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      const envelope = makeRequest('watch', {\n        query,\n        ...(watchOptions\n          ? {\n            options: {\n              ...watchOptions,\n              signal: undefined,\n            },\n          }\n          : {}),\n      });\n      for await (\n        const response of transport.watch(envelope, {\n          signal: watchOptions?.signal,\n        })\n      ) {\n        assertResponse(envelope, response);\n        if (!response.ok) throwResponseError(response);\n        yield response.result as OrchestrationWatchEvent<TSpec, TStatus>;\n      }\n    },\n    delete(reference: OrchestrationResourceReference, deleteOptions?: OrchestrationDeleteOptions) {\n      return request<OrchestrationDeleteResult>('delete', {\n        reference,\n        ...(deleteOptions ? { options: deleteOptions } : {}),\n      });\n    },\n  };\n}\n\n/**\n * Bind a remote/mobile caller to a read-only view of an existing policy-scoped\n * client. This is an enforcement boundary, not only capability advertising:\n * mutations and out-of-scope kinds fail before reaching the source client.\n */\nexport function createReadOnlyOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: ReadOnlyOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const allowedKinds = options.allowedResourceKinds\n    ? new Set(options.allowedResourceKinds)\n    : undefined;\n\n  function assertAllowedKind(kind: string): void {\n    if (!allowedKinds || allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function forbidden(operation: 'apply' | 'delete'): never {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration operation '${operation}' is read-only`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      return {\n        operations: ['get', 'list', 'watch'],\n        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply() {\n      forbidden('apply');\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(reference, getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(query, listOptions);\n    },\n    async *watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      yield* client.watch(query, watchOptions);\n    },\n    async delete() {\n      forbidden('delete');\n    },\n  };\n}\n\n/**\n * Bind a mutable remote caller to one host-selected namespace and an explicit\n * resource-kind allowlist. The wrapper is an authorization boundary: it\n * rejects cross-namespace references before they reach the source client and\n * fills an omitted namespace with the host-bound value.\n */\nexport function createNamespacedOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: NamespacedOrchestrationClientOptions,\n): AgentOrchestrationClient {\n  const namespace = options.namespace.trim();\n  if (!namespace || namespace.length > 253) {\n    throw new TypeError('namespace must contain between 1 and 253 characters');\n  }\n  const allowedKinds = new Set(options.allowedResourceKinds);\n  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);\n  for (const kind of mutableKinds) {\n    if (!allowedKinds.has(kind)) {\n      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);\n    }\n  }\n\n  function assertAllowedKind(kind: string): void {\n    if (allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function bindNamespace<T extends { namespace?: string }>(metadata: T): T & { namespace: string } {\n    if (metadata.namespace !== undefined && metadata.namespace !== namespace) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,\n        retryable: false,\n      });\n    }\n    return { ...metadata, namespace };\n  }\n\n  function assertMutableKind(kind: string): void {\n    assertAllowedKind(kind);\n    if (mutableKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));\n      const resourceOperations = Object.fromEntries(\n        resourceKinds.map((kind) => {\n          const sourceOperations = capabilities.resourceOperations?.[kind] ??\n            capabilities.operations;\n          return [\n            kind,\n            sourceOperations.filter((operation) => mutableKinds.has(kind) || (operation !== 'apply' && operation !== 'delete')),\n          ];\n        }),\n      );\n      return {\n        operations: capabilities.operations,\n        resourceKinds,\n        resourceOperations,\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply(resource, applyOptions) {\n      assertMutableKind(resource.kind);\n      return await client.apply(\n        {\n          ...resource,\n          metadata: bindNamespace(resource.metadata),\n        },\n        applyOptions,\n      );\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(bindNamespace(reference), getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(bindNamespace(query), listOptions);\n    },\n    watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      return client.watch(bindNamespace(query), watchOptions);\n    },\n    async delete(reference, deleteOptions) {\n      assertMutableKind(reference.kind);\n      return await client.delete(bindNamespace(reference), deleteOptions);\n    },\n  };\n}\n\nfunction requirePayload(payload: Record<string, unknown>, key: string): unknown {\n  if (!(key in payload)) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: `remote orchestration request is missing payload.${key}`,\n      retryable: false,\n    });\n  }\n  return payload[key];\n}\n\nfunction success(\n  request: RemoteOrchestrationRequest,\n  result: unknown,\n): RemoteOrchestrationResponse {\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: request.requestId,\n    ok: true,\n    result,\n  };\n}\n\nfunction failure(request: unknown, error: unknown): RemoteOrchestrationResponse {\n  const requestRecord = isRecord(request) ? request : undefined;\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: typeof requestRecord?.requestId === 'string' ? requestRecord.requestId : 'invalid',\n    ok: false,\n    error: errorData(error),\n  };\n}\n\n/**\n * Trusted-side protocol adapter. The injected client has already bound actor,\n * admission, quotas, and resource scope; wire callers cannot select an actor.\n */\nexport function createRemoteOrchestrationHandler(client: AgentOrchestrationClient): {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n} {\n  function validate(request: RemoteOrchestrationRequest): void {\n    if (\n      !isRecord(request) ||\n      request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n      typeof request.requestId !== 'string' ||\n      !request.requestId ||\n      request.requestId.length > 256 ||\n      !REMOTE_OPERATIONS.has(request.operation) ||\n      !isRecord(request.payload)\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'invalid remote orchestration request envelope',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    async request(request) {\n      try {\n        validate(request);\n        const payload = request.payload;\n        switch (request.operation) {\n          case 'capabilities':\n            return success(request, await client.getCapabilities());\n          case 'apply':\n            return success(\n              request,\n              await client.apply(\n                requirePayload(payload, 'resource') as OrchestrationResourceManifest,\n                payload.options as OrchestrationApplyOptions | undefined,\n              ),\n            );\n          case 'get':\n            return success(\n              request,\n              await client.get(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationGetOptions | undefined,\n              ),\n            );\n          case 'list':\n            return success(\n              request,\n              await client.list(\n                requirePayload(payload, 'query') as OrchestrationResourceQuery,\n                payload.options as OrchestrationListOptions | undefined,\n              ),\n            );\n          case 'delete':\n            return success(\n              request,\n              await client.delete(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationDeleteOptions | undefined,\n              ),\n            );\n          case 'watch':\n            throw new OrchestrationError({\n              code: 'INVALID',\n              message: 'watch requests require the streaming protocol method',\n              retryable: false,\n            });\n          default:\n            throw new OrchestrationError({\n              code: 'UNSUPPORTED',\n              message: `unsupported remote orchestration operation '${String(request.operation)}'`,\n              retryable: false,\n            });\n        }\n      } catch (error) {\n        return failure(request, error);\n      }\n    },\n    async *watch(request, options = {}) {\n      try {\n        validate(request);\n        if (request.operation !== 'watch') {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: 'streaming protocol accepts only watch operations',\n            retryable: false,\n          });\n        }\n        const watchOptions = request.payload.options as OrchestrationWatchOptions | undefined;\n        for await (\n          const event of client.watch(\n            requirePayload(request.payload, 'query') as OrchestrationResourceQuery,\n            {\n              ...watchOptions,\n              signal: options.signal,\n            },\n          )\n        ) {\n          yield success(request, event);\n        }\n      } catch (error) {\n        yield failure(request, error);\n      }\n    },\n  };\n}\n\nexport interface FetchOrchestrationTransportOptions {\n  endpoint: string;\n  fetch?: typeof globalThis.fetch;\n  headers?: Record<string, string> | (() => Promise<Record<string, string>>);\n  credentials?: RequestCredentials;\n  maxResponseBytes?: number;\n  maxWatchLineBytes?: number;\n}\n\n/** Browser/Tauri/React-Native fetch transport with bounded NDJSON watch. */\nexport function createFetchOrchestrationTransport(\n  options: FetchOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const fetch_ = options.fetch ?? globalThis.fetch;\n  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;\n  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;\n\n  function assertWatchLineSize(line: string): void {\n    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function headers(accept: string): Promise<Record<string, string>> {\n    const additional = typeof options.headers === 'function' ? await options.headers() : (options.headers ?? {});\n    return {\n      Accept: accept,\n      'Content-Type': 'application/json',\n      ...additional,\n    };\n  }\n\n  async function post(\n    request: RemoteOrchestrationRequest,\n    accept: string,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const response = await fetch_(options.endpoint, {\n      method: 'POST',\n      headers: await headers(accept),\n      body: JSON.stringify(request),\n      signal,\n      ...(options.credentials ? { credentials: options.credentials } : {}),\n    });\n    if (!response.ok) {\n      throw new OrchestrationError({\n        code: response.status === 401 || response.status === 403 ? 'FORBIDDEN' : 'UNAVAILABLE',\n        message: `remote orchestration endpoint returned HTTP ${response.status}`,\n        retryable: response.status >= 500,\n      });\n    }\n    return response;\n  }\n\n  async function readBoundedText(response: Response, limit: number): Promise<string> {\n    if (!response.body) return '';\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let size = 0;\n    let text = '';\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > limit) {\n          await reader.cancel();\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: `remote orchestration response exceeds ${limit} bytes`,\n            retryable: false,\n          });\n        }\n        text += decoder.decode(value, { stream: true });\n      }\n      return text + decoder.decode();\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  return {\n    async request(request, transportOptions = {}) {\n      const response = await post(request, 'application/json', transportOptions.signal);\n      const text = await readBoundedText(response, maxResponseBytes);\n      return JSON.parse(text) as RemoteOrchestrationResponse;\n    },\n    async *watch(request, transportOptions = {}) {\n      const response = await post(request, 'application/x-ndjson', transportOptions.signal);\n      if (!response.body) {\n        throw new OrchestrationError({\n          code: 'UNAVAILABLE',\n          message: 'remote orchestration watch response has no body',\n          retryable: true,\n        });\n      }\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder();\n      let pending = '';\n      let streamCompleted = false;\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) {\n            streamCompleted = true;\n            break;\n          }\n          pending += decoder.decode(value, { stream: true });\n          let newline = pending.indexOf('\\n');\n          while (newline >= 0) {\n            const line = pending.slice(0, newline).trim();\n            pending = pending.slice(newline + 1);\n            assertWatchLineSize(line);\n            if (line) yield JSON.parse(line) as RemoteOrchestrationResponse;\n            newline = pending.indexOf('\\n');\n          }\n          // UTF-8 is never smaller than the JS code-unit count. This cheap\n          // guard avoids repeatedly re-encoding an attacker-controlled partial\n          // line; the exact byte check runs once when the line is complete.\n          if (pending.length > maxWatchLineBytes) {\n            throw new OrchestrationError({\n              code: 'EXHAUSTED',\n              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n              retryable: false,\n            });\n          }\n        }\n        pending += decoder.decode();\n        if (pending.trim()) {\n          assertWatchLineSize(pending.trim());\n          yield JSON.parse(pending) as RemoteOrchestrationResponse;\n        }\n      } finally {\n        if (!streamCompleted) {\n          await reader.cancel().catch(() => undefined);\n        }\n        reader.releaseLock();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAoBO,IAAM,gCAAgC;AAwE7C,IAAM,oBAAoB,oBAAI,IAAkC;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAEA,SAAS,mBAAmB,UAAsE;AAChG,QAAM,IAAI,mBAAmB,SAAS,KAAK;AAC7C;AAEA,SAAS,eACP,SACA,UACM;AACN,MACE,CAAC,SAAS,QAAQ,KAClB,SAAS,aAAa,iCACtB,SAAS,cAAc,QAAQ,aAC/B,OAAO,SAAS,OAAO,aACtB,SAAS,MAAM,EAAE,YAAY,aAC7B,CAAC,SAAS,OACR,CAAC,SAAS,SAAS,KAAK,KACvB,OAAO,SAAS,MAAM,SAAS,YAC/B,OAAO,SAAS,MAAM,YAAY,YAClC,OAAO,SAAS,MAAM,cAAc,YACxC;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,IAAI,kBAAkB;AAGf,SAAS,gCACd,WACA,UAA4C,CAAC,GACnB;AAC1B,QAAM,kBAAkB,QAAQ,oBAC7B,MAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,SAAS,EAAE,CAAC;AAEhF,WAAS,YACP,WACA,SAC4B;AAC5B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,gBAAgB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,QACb,WACA,SACA,QACY;AACZ,UAAM,WAAW,YAAY,WAAW,OAAO;AAC/C,UAAM,WAAW,MAAM,UAAU,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC7D,mBAAe,UAAU,QAAQ;AACjC,QAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,kBAAkB;AAChB,aAAO,QAAwC,gBAAgB,CAAC,CAAC;AAAA,IACnE;AAAA,IACA,MACE,UACA,cACA;AACA,aAAO,QAA+C,SAAS;AAAA,QAC7D;AAAA,QACA,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,IACE,WACA,YACA;AACA,aAAO,QAAsD,OAAO;AAAA,QAClE;AAAA,QACA,GAAI,aAAa,EAAE,SAAS,WAAW,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,IACA,KACE,OACA,aACA;AACA,aAAO,QAAmD,QAAQ;AAAA,QAChE;AAAA,QACA,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,IACA,OAAO,MACL,OACA,cACwD;AACxD,YAAM,WAAW,YAAY,SAAS;AAAA,QACpC;AAAA,QACA,GAAI,eACA;AAAA,UACA,SAAS;AAAA,YACP,GAAG;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF,IACE,CAAC;AAAA,MACP,CAAC;AACD,uBACQ,YAAY,UAAU,MAAM,UAAU;AAAA,QAC1C,QAAQ,cAAc;AAAA,MACxB,CAAC,GACD;AACA,uBAAe,UAAU,QAAQ;AACjC,YAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,WAA2C,eAA4C;AAC5F,aAAO,QAAmC,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,kCACd,QACA,UAA8C,CAAC,GACrB;AAC1B,QAAM,eAAe,QAAQ,uBACzB,IAAI,IAAI,QAAQ,oBAAoB,IACpC;AAEJ,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,CAAC,gBAAgB,aAAa,IAAI,IAAI,EAAG;AAC7C,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,UAAU,WAAsC;AACvD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mCAAmC,SAAS;AAAA,MACrD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,YAAY,CAAC,OAAO,QAAQ,OAAO;AAAA,QACnC,eAAe,aAAa,cAAc,OAAO,CAAC,SAAS,eAAe,aAAa,IAAI,IAAI,IAAI,IAAI;AAAA,QACvG,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU,OAAO;AAAA,IACnB;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,WAAW,UAAU;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,OAAO,WAAW;AAAA,IAC7C;AAAA,IACA,OAAO,MAAM,OAAO,cAAc;AAChC,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,OAAO,YAAY;AAAA,IACzC;AAAA,IACA,MAAM,SAAS;AACb,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAQO,SAAS,oCACd,QACA,SAC0B;AAC1B,QAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK;AACxC,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,eAAe,IAAI,IAAI,QAAQ,oBAAoB;AACzD,QAAM,eAAe,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,oBAAoB;AACzF,aAAW,QAAQ,cAAc;AAC/B,QAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,UAAU,0BAA0B,IAAI,wBAAwB;AAAA,IAC5E;AAAA,EACF;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,cAAgD,UAAwC;AAC/F,QAAI,SAAS,cAAc,UAAa,SAAS,cAAc,WAAW;AACxE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kDAAkD,SAAS;AAAA,QACpE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,EAAE,GAAG,UAAU,UAAU;AAAA,EAClC;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,sBAAkB,IAAI;AACtB,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,IAAI;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,gBAAgB,aAAa,cAAc,OAAO,CAAC,SAAS,aAAa,IAAI,IAAI,CAAC;AACxF,YAAM,qBAAqB,OAAO;AAAA,QAChC,cAAc,IAAI,CAAC,SAAS;AAC1B,gBAAM,mBAAmB,aAAa,qBAAqB,IAAI,KAC7D,aAAa;AACf,iBAAO;AAAA,YACL;AAAA,YACA,iBAAiB,OAAO,CAAC,cAAc,aAAa,IAAI,IAAI,KAAM,cAAc,WAAW,cAAc,QAAS;AAAA,UACpH;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,aAAa;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,MAAM,UAAU,cAAc;AAClC,wBAAkB,SAAS,IAAI;AAC/B,aAAO,MAAM,OAAO;AAAA,QAClB;AAAA,UACE,GAAG;AAAA,UACH,UAAU,cAAc,SAAS,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,cAAc,SAAS,GAAG,UAAU;AAAA,IAC9D;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,MAAM,OAAO,cAAc;AACzB,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,cAAc,KAAK,GAAG,YAAY;AAAA,IACxD;AAAA,IACA,MAAM,OAAO,WAAW,eAAe;AACrC,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,cAAc,SAAS,GAAG,aAAa;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAkC,KAAsB;AAC9E,MAAI,EAAE,OAAO,UAAU;AACrB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,GAAG;AAAA,MAC/D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,GAAG;AACpB;AAEA,SAAS,QACP,SACA,QAC6B;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,IAAI;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,SAAkB,OAA6C;AAC9E,QAAM,gBAAgB,SAAS,OAAO,IAAI,UAAU;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,OAAO,eAAe,cAAc,WAAW,cAAc,YAAY;AAAA,IACpF,IAAI;AAAA,IACJ,OAAO,UAAU,KAAK;AAAA,EACxB;AACF;AAMO,SAAS,iCAAiC,QAM/C;AACA,WAAS,SAAS,SAA2C;AAC3D,QACE,CAAC,SAAS,OAAO,KACjB,QAAQ,aAAa,iCACrB,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,aACT,QAAQ,UAAU,SAAS,OAC3B,CAAC,kBAAkB,IAAI,QAAQ,SAAS,KACxC,CAAC,SAAS,QAAQ,OAAO,GACzB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS;AACrB,UAAI;AACF,iBAAS,OAAO;AAChB,cAAM,UAAU,QAAQ;AACxB,gBAAQ,QAAQ,WAAW;AAAA,UACzB,KAAK;AACH,mBAAO,QAAQ,SAAS,MAAM,OAAO,gBAAgB,CAAC;AAAA,UACxD,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,UAAU;AAAA,gBAClC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,OAAO;AAAA,gBAC/B,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACE,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,+CAA+C,OAAO,QAAQ,SAAS,CAAC;AAAA,cACjF,WAAW;AAAA,YACb,CAAC;AAAA,QACL;AAAA,MACF,SAAS,OAAO;AACd,eAAO,QAAQ,SAAS,KAAK;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,UAAU,CAAC,GAAG;AAClC,UAAI;AACF,iBAAS,OAAO;AAChB,YAAI,QAAQ,cAAc,SAAS;AACjC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,eAAe,QAAQ,QAAQ;AACrC,yBACQ,SAAS,OAAO;AAAA,UACpB,eAAe,QAAQ,SAAS,OAAO;AAAA,UACvC;AAAA,YACE,GAAG;AAAA,YACH,QAAQ,QAAQ;AAAA,UAClB;AAAA,QACF,GACA;AACA,gBAAM,QAAQ,SAAS,KAAK;AAAA,QAC9B;AAAA,MACF,SAAS,OAAO;AACd,cAAM,QAAQ,SAAS,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,kCACd,SAC8B;AAC9B,QAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,OAAO;AAC5D,QAAM,oBAAoB,QAAQ,qBAAqB,OAAO;AAE9D,WAAS,oBAAoB,MAAoB;AAC/C,QAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,mBAAmB;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2CAA2C,iBAAiB;AAAA,QACrE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QAAQ,QAAiD;AACtE,UAAM,aAAa,OAAO,QAAQ,YAAY,aAAa,MAAM,QAAQ,QAAQ,IAAK,QAAQ,WAAW,CAAC;AAC1G,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,GAAG;AAAA,IACL;AAAA,EACF;AAEA,iBAAe,KACb,SACA,QACA,QACmB;AACnB,UAAM,WAAW,MAAM,OAAO,QAAQ,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,MAAM,QAAQ,MAAM;AAAA,MAC7B,MAAM,KAAK,UAAU,OAAO;AAAA,MAC5B;AAAA,MACA,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,cAAc;AAAA,QACzE,SAAS,+CAA+C,SAAS,MAAM;AAAA,QACvE,WAAW,SAAS,UAAU;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,UAAoB,OAAgC;AACjF,QAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,UAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAM,UAAU,IAAI,YAAY;AAChC,QAAI,OAAO;AACX,QAAI,OAAO;AACX,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,YAAI,KAAM;AACV,gBAAQ,MAAM;AACd,YAAI,OAAO,OAAO;AAChB,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yCAAyC,KAAK;AAAA,YACvD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAChD;AACA,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,YAAM,WAAW,MAAM,KAAK,SAAS,oBAAoB,iBAAiB,MAAM;AAChF,YAAM,OAAO,MAAM,gBAAgB,UAAU,gBAAgB;AAC7D,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,YAAM,WAAW,MAAM,KAAK,SAAS,wBAAwB,iBAAiB,MAAM;AACpF,UAAI,CAAC,SAAS,MAAM;AAClB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,YAAM,UAAU,IAAI,YAAY;AAChC,UAAI,UAAU;AACd,UAAI,kBAAkB;AACtB,UAAI;AACF,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,MAAM;AACR,8BAAkB;AAClB;AAAA,UACF;AACA,qBAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AACjD,cAAI,UAAU,QAAQ,QAAQ,IAAI;AAClC,iBAAO,WAAW,GAAG;AACnB,kBAAM,OAAO,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC5C,sBAAU,QAAQ,MAAM,UAAU,CAAC;AACnC,gCAAoB,IAAI;AACxB,gBAAI,KAAM,OAAM,KAAK,MAAM,IAAI;AAC/B,sBAAU,QAAQ,QAAQ,IAAI;AAAA,UAChC;AAIA,cAAI,QAAQ,SAAS,mBAAmB;AACtC,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,2CAA2C,iBAAiB;AAAA,cACrE,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AAAA,QACF;AACA,mBAAW,QAAQ,OAAO;AAC1B,YAAI,QAAQ,KAAK,GAAG;AAClB,8BAAoB,QAAQ,KAAK,CAAC;AAClC,gBAAM,KAAK,MAAM,OAAO;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AACA,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/conversation.d.cts

@@ -1,6 +1,6 @@
-import { m as AgentDefinition, S as AgentFrameworkConfig, e as ChatRole, b as ChatMessage, T as ToolCall, A as AttachmentReference, h as ChatToolResultPart, c as ChatMessagePart } from './interface-IrKBFtL1.cjs';
-export { a as ChatAttachmentPart, d as ChatReasoningPart, f as ChatTextPart, g as ChatToolCallPart, D as DetailRefType, k as DetailReference } from './interface-IrKBFtL1.cjs';
-import { b as AgentInstanceLatestStatus, a as AgentInstanceModel } from './scriptDeploymentPipeline-yG1ZhVVI.cjs';
+import { p as AgentDefinition, X as AgentFrameworkConfig, h as ChatRole, e as ChatMessage, T as ToolCall, A as AttachmentReference, l as ChatToolResultPart, f as ChatMessagePart } from './interface-3C3eG8Hn.cjs';
+export { d as ChatAttachmentPart, g as ChatReasoningPart, j as ChatTextPart, k as ChatToolCallPart, D as DetailRefType, n as DetailReference } from './interface-3C3eG8Hn.cjs';
+import { b as AgentInstanceLatestStatus, a as AgentInstanceModel } from './scriptDeploymentPipeline-XJzQyYys.cjs';
 
 /**
  * Domain factories for creating canonical ChatMessage and AgentInstance objects.

package/dist/conversation.d.ts

@@ -1,6 +1,6 @@
-import { m as AgentDefinition, S as AgentFrameworkConfig, e as ChatRole, b as ChatMessage, T as ToolCall, A as AttachmentReference, h as ChatToolResultPart, c as ChatMessagePart } from './interface-IrKBFtL1.js';
-export { a as ChatAttachmentPart, d as ChatReasoningPart, f as ChatTextPart, g as ChatToolCallPart, D as DetailRefType, k as DetailReference } from './interface-IrKBFtL1.js';
-import { b as AgentInstanceLatestStatus, a as AgentInstanceModel } from './scriptDeploymentPipeline-CXJcC82H.js';
+import { p as AgentDefinition, X as AgentFrameworkConfig, h as ChatRole, e as ChatMessage, T as ToolCall, A as AttachmentReference, l as ChatToolResultPart, f as ChatMessagePart } from './interface-3C3eG8Hn.js';
+export { d as ChatAttachmentPart, g as ChatReasoningPart, j as ChatTextPart, k as ChatToolCallPart, D as DetailRefType, n as DetailReference } from './interface-3C3eG8Hn.js';
+import { b as AgentInstanceLatestStatus, a as AgentInstanceModel } from './scriptDeploymentPipeline-B1q-UhrO.js';
 
 /**
  * Domain factories for creating canonical ChatMessage and AgentInstance objects.