memeloop 0.2.0 → 0.2.2

package/dist/{chunk-CCEFAOSH.js.map → chunk-WHXFUMDE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/orchestration/remoteClient.ts"],"sourcesContent":["import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport { OrchestrationError } from './errors.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const REMOTE_ORCHESTRATION_PROTOCOL = 'memeloop.resource.v1' as const;\nexport type RemoteOrchestrationOperation =\n  | 'capabilities'\n  | 'apply'\n  | 'get'\n  | 'list'\n  | 'watch'\n  | 'delete';\n\nexport interface RemoteOrchestrationRequest {\n  protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n  requestId: string;\n  operation: RemoteOrchestrationOperation;\n  payload: Record<string, unknown>;\n}\n\nexport type RemoteOrchestrationResponse =\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n  };\n\nexport interface RemoteOrchestrationTransportOptions {\n  signal?: AbortSignal;\n}\n\n/**\n * Portable host boundary. Browser, Electron renderer, React Native, and Tauri\n * WebView clients implement this interface; trusted hosts bind identity and\n * policy behind the server-side AgentOrchestrationClient.\n */\nexport interface RemoteOrchestrationTransport {\n  request(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n}\n\nexport interface RemoteOrchestrationClientOptions {\n  createRequestId?: () => string;\n}\n\nexport interface ReadOnlyOrchestrationClientOptions {\n  /** Resource kinds visible to the remote client. Omit to retain every kind exposed by the source client. */\n  allowedResourceKinds?: readonly string[];\n}\n\nexport interface NamespacedOrchestrationClientOptions {\n  /** Host-bound namespace. Callers may omit it, but cannot select another namespace. */\n  namespace: string;\n  /** Resource kinds the caller may access. An empty list denies every resource kind. */\n  allowedResourceKinds: readonly string[];\n  /**\n   * Resource kinds the caller may apply or delete. Defaults to every allowed\n   * kind for compatibility; hosts should narrow this when status resources are\n   * controller-owned.\n   */\n  mutableResourceKinds?: readonly string[];\n}\n\nconst REMOTE_OPERATIONS = new Set<RemoteOrchestrationOperation>([\n  'capabilities',\n  'apply',\n  'get',\n  'list',\n  'watch',\n  'delete',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction errorData(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n      ...(error.reason !== undefined ? { reason: error.reason } : {}),\n      ...(error.details !== undefined ? { details: error.details } : {}),\n    };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\nfunction throwResponseError(response: Extract<RemoteOrchestrationResponse, { ok: false }>): never {\n  throw new OrchestrationError(response.error);\n}\n\nfunction assertResponse(\n  request: RemoteOrchestrationRequest,\n  response: RemoteOrchestrationResponse,\n): void {\n  if (\n    !isRecord(response) ||\n    response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n    response.requestId !== request.requestId ||\n    typeof response.ok !== 'boolean' ||\n    (response.ok && !('result' in response)) ||\n    (!response.ok &&\n      (!isRecord(response.error) ||\n        typeof response.error.code !== 'string' ||\n        typeof response.error.message !== 'string' ||\n        typeof response.error.retryable !== 'boolean'))\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'remote orchestration response correlation or protocol mismatch',\n      retryable: false,\n    });\n  }\n}\n\nlet requestSequence = 0;\n\n/** Build the policy-scoped Agent facade over a browser-safe remote transport. */\nexport function createRemoteOrchestrationClient(\n  transport: RemoteOrchestrationTransport,\n  options: RemoteOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const createRequestId = options.createRequestId ??\n    (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);\n\n  function makeRequest(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n  ): RemoteOrchestrationRequest {\n    return {\n      protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n      requestId: createRequestId(),\n      operation,\n      payload,\n    };\n  }\n\n  async function request<T>(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const envelope = makeRequest(operation, payload);\n    const response = await transport.request(envelope, { signal });\n    assertResponse(envelope, response);\n    if (!response.ok) throwResponseError(response);\n    return response.result as T;\n  }\n\n  return {\n    getCapabilities() {\n      return request<AgentOrchestrationCapabilities>('capabilities', {});\n    },\n    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus>>('apply', {\n        resource,\n        ...(applyOptions ? { options: applyOptions } : {}),\n      });\n    },\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      getOptions?: OrchestrationGetOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus> | null>('get', {\n        reference,\n        ...(getOptions ? { options: getOptions } : {}),\n      });\n    },\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      listOptions?: OrchestrationListOptions,\n    ) {\n      return request<OrchestrationResourceList<TSpec, TStatus>>('list', {\n        query,\n        ...(listOptions ? { options: listOptions } : {}),\n      });\n    },\n    async *watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      const envelope = makeRequest('watch', {\n        query,\n        ...(watchOptions\n          ? {\n            options: {\n              ...watchOptions,\n              signal: undefined,\n            },\n          }\n          : {}),\n      });\n      for await (\n        const response of transport.watch(envelope, {\n          signal: watchOptions?.signal,\n        })\n      ) {\n        assertResponse(envelope, response);\n        if (!response.ok) throwResponseError(response);\n        yield response.result as OrchestrationWatchEvent<TSpec, TStatus>;\n      }\n    },\n    delete(reference: OrchestrationResourceReference, deleteOptions?: OrchestrationDeleteOptions) {\n      return request<OrchestrationDeleteResult>('delete', {\n        reference,\n        ...(deleteOptions ? { options: deleteOptions } : {}),\n      });\n    },\n  };\n}\n\n/**\n * Bind a remote/mobile caller to a read-only view of an existing policy-scoped\n * client. This is an enforcement boundary, not only capability advertising:\n * mutations and out-of-scope kinds fail before reaching the source client.\n */\nexport function createReadOnlyOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: ReadOnlyOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const allowedKinds = options.allowedResourceKinds\n    ? new Set(options.allowedResourceKinds)\n    : undefined;\n\n  function assertAllowedKind(kind: string): void {\n    if (!allowedKinds || allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function forbidden(operation: 'apply' | 'delete'): never {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration operation '${operation}' is read-only`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      return {\n        operations: ['get', 'list', 'watch'],\n        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply() {\n      forbidden('apply');\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(reference, getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(query, listOptions);\n    },\n    async *watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      yield* client.watch(query, watchOptions);\n    },\n    async delete() {\n      forbidden('delete');\n    },\n  };\n}\n\n/**\n * Bind a mutable remote caller to one host-selected namespace and an explicit\n * resource-kind allowlist. The wrapper is an authorization boundary: it\n * rejects cross-namespace references before they reach the source client and\n * fills an omitted namespace with the host-bound value.\n */\nexport function createNamespacedOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: NamespacedOrchestrationClientOptions,\n): AgentOrchestrationClient {\n  const namespace = options.namespace.trim();\n  if (!namespace || namespace.length > 253) {\n    throw new TypeError('namespace must contain between 1 and 253 characters');\n  }\n  const allowedKinds = new Set(options.allowedResourceKinds);\n  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);\n  for (const kind of mutableKinds) {\n    if (!allowedKinds.has(kind)) {\n      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);\n    }\n  }\n\n  function assertAllowedKind(kind: string): void {\n    if (allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function bindNamespace<T extends { namespace?: string }>(metadata: T): T & { namespace: string } {\n    if (metadata.namespace !== undefined && metadata.namespace !== namespace) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,\n        retryable: false,\n      });\n    }\n    return { ...metadata, namespace };\n  }\n\n  function assertMutableKind(kind: string): void {\n    assertAllowedKind(kind);\n    if (mutableKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));\n      const resourceOperations = Object.fromEntries(\n        resourceKinds.map((kind) => {\n          const sourceOperations = capabilities.resourceOperations?.[kind] ??\n            capabilities.operations;\n          return [\n            kind,\n            sourceOperations.filter((operation) => mutableKinds.has(kind) || (operation !== 'apply' && operation !== 'delete')),\n          ];\n        }),\n      );\n      return {\n        operations: capabilities.operations,\n        resourceKinds,\n        resourceOperations,\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply(resource, applyOptions) {\n      assertMutableKind(resource.kind);\n      return await client.apply(\n        {\n          ...resource,\n          metadata: bindNamespace(resource.metadata),\n        },\n        applyOptions,\n      );\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(bindNamespace(reference), getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(bindNamespace(query), listOptions);\n    },\n    watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      return client.watch(bindNamespace(query), watchOptions);\n    },\n    async delete(reference, deleteOptions) {\n      assertMutableKind(reference.kind);\n      return await client.delete(bindNamespace(reference), deleteOptions);\n    },\n  };\n}\n\nfunction requirePayload(payload: Record<string, unknown>, key: string): unknown {\n  if (!(key in payload)) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: `remote orchestration request is missing payload.${key}`,\n      retryable: false,\n    });\n  }\n  return payload[key];\n}\n\nfunction success(\n  request: RemoteOrchestrationRequest,\n  result: unknown,\n): RemoteOrchestrationResponse {\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: request.requestId,\n    ok: true,\n    result,\n  };\n}\n\nfunction failure(request: unknown, error: unknown): RemoteOrchestrationResponse {\n  const requestRecord = isRecord(request) ? request : undefined;\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: typeof requestRecord?.requestId === 'string' ? requestRecord.requestId : 'invalid',\n    ok: false,\n    error: errorData(error),\n  };\n}\n\n/**\n * Trusted-side protocol adapter. The injected client has already bound actor,\n * admission, quotas, and resource scope; wire callers cannot select an actor.\n */\nexport function createRemoteOrchestrationHandler(client: AgentOrchestrationClient): {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n} {\n  function validate(request: RemoteOrchestrationRequest): void {\n    if (\n      !isRecord(request) ||\n      request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n      typeof request.requestId !== 'string' ||\n      !request.requestId ||\n      request.requestId.length > 256 ||\n      !REMOTE_OPERATIONS.has(request.operation) ||\n      !isRecord(request.payload)\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'invalid remote orchestration request envelope',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    async request(request) {\n      try {\n        validate(request);\n        const payload = request.payload;\n        switch (request.operation) {\n          case 'capabilities':\n            return success(request, await client.getCapabilities());\n          case 'apply':\n            return success(\n              request,\n              await client.apply(\n                requirePayload(payload, 'resource') as OrchestrationResourceManifest,\n                payload.options as OrchestrationApplyOptions | undefined,\n              ),\n            );\n          case 'get':\n            return success(\n              request,\n              await client.get(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationGetOptions | undefined,\n              ),\n            );\n          case 'list':\n            return success(\n              request,\n              await client.list(\n                requirePayload(payload, 'query') as OrchestrationResourceQuery,\n                payload.options as OrchestrationListOptions | undefined,\n              ),\n            );\n          case 'delete':\n            return success(\n              request,\n              await client.delete(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationDeleteOptions | undefined,\n              ),\n            );\n          case 'watch':\n            throw new OrchestrationError({\n              code: 'INVALID',\n              message: 'watch requests require the streaming protocol method',\n              retryable: false,\n            });\n          default:\n            throw new OrchestrationError({\n              code: 'UNSUPPORTED',\n              message: `unsupported remote orchestration operation '${String(request.operation)}'`,\n              retryable: false,\n            });\n        }\n      } catch (error) {\n        return failure(request, error);\n      }\n    },\n    async *watch(request, options = {}) {\n      try {\n        validate(request);\n        if (request.operation !== 'watch') {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: 'streaming protocol accepts only watch operations',\n            retryable: false,\n          });\n        }\n        const watchOptions = request.payload.options as OrchestrationWatchOptions | undefined;\n        for await (\n          const event of client.watch(\n            requirePayload(request.payload, 'query') as OrchestrationResourceQuery,\n            {\n              ...watchOptions,\n              signal: options.signal,\n            },\n          )\n        ) {\n          yield success(request, event);\n        }\n      } catch (error) {\n        yield failure(request, error);\n      }\n    },\n  };\n}\n\nexport interface FetchOrchestrationTransportOptions {\n  endpoint: string;\n  fetch?: typeof globalThis.fetch;\n  headers?: Record<string, string> | (() => Promise<Record<string, string>>);\n  credentials?: RequestCredentials;\n  maxResponseBytes?: number;\n  maxWatchLineBytes?: number;\n}\n\n/** Browser/Tauri/React-Native fetch transport with bounded NDJSON watch. */\nexport function createFetchOrchestrationTransport(\n  options: FetchOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const fetch_ = options.fetch ?? globalThis.fetch;\n  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;\n  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;\n\n  function assertWatchLineSize(line: string): void {\n    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function headers(accept: string): Promise<Record<string, string>> {\n    const additional = typeof options.headers === 'function' ? await options.headers() : (options.headers ?? {});\n    return {\n      Accept: accept,\n      'Content-Type': 'application/json',\n      ...additional,\n    };\n  }\n\n  async function post(\n    request: RemoteOrchestrationRequest,\n    accept: string,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const response = await fetch_(options.endpoint, {\n      method: 'POST',\n      headers: await headers(accept),\n      body: JSON.stringify(request),\n      signal,\n      ...(options.credentials ? { credentials: options.credentials } : {}),\n    });\n    if (!response.ok) {\n      throw new OrchestrationError({\n        code: response.status === 401 || response.status === 403 ? 'FORBIDDEN' : 'UNAVAILABLE',\n        message: `remote orchestration endpoint returned HTTP ${response.status}`,\n        retryable: response.status >= 500,\n      });\n    }\n    return response;\n  }\n\n  async function readBoundedText(response: Response, limit: number): Promise<string> {\n    if (!response.body) return '';\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let size = 0;\n    let text = '';\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > limit) {\n          await reader.cancel();\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: `remote orchestration response exceeds ${limit} bytes`,\n            retryable: false,\n          });\n        }\n        text += decoder.decode(value, { stream: true });\n      }\n      return text + decoder.decode();\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  return {\n    async request(request, transportOptions = {}) {\n      const response = await post(request, 'application/json', transportOptions.signal);\n      const text = await readBoundedText(response, maxResponseBytes);\n      return JSON.parse(text) as RemoteOrchestrationResponse;\n    },\n    async *watch(request, transportOptions = {}) {\n      const response = await post(request, 'application/x-ndjson', transportOptions.signal);\n      if (!response.body) {\n        throw new OrchestrationError({\n          code: 'UNAVAILABLE',\n          message: 'remote orchestration watch response has no body',\n          retryable: true,\n        });\n      }\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder();\n      let pending = '';\n      let streamCompleted = false;\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) {\n            streamCompleted = true;\n            break;\n          }\n          pending += decoder.decode(value, { stream: true });\n          let newline = pending.indexOf('\\n');\n          while (newline >= 0) {\n            const line = pending.slice(0, newline).trim();\n            pending = pending.slice(newline + 1);\n            assertWatchLineSize(line);\n            if (line) yield JSON.parse(line) as RemoteOrchestrationResponse;\n            newline = pending.indexOf('\\n');\n          }\n          // UTF-8 is never smaller than the JS code-unit count. This cheap\n          // guard avoids repeatedly re-encoding an attacker-controlled partial\n          // line; the exact byte check runs once when the line is complete.\n          if (pending.length > maxWatchLineBytes) {\n            throw new OrchestrationError({\n              code: 'EXHAUSTED',\n              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n              retryable: false,\n            });\n          }\n        }\n        pending += decoder.decode();\n        if (pending.trim()) {\n          assertWatchLineSize(pending.trim());\n          yield JSON.parse(pending) as RemoteOrchestrationResponse;\n        }\n      } finally {\n        if (!streamCompleted) {\n          await reader.cancel().catch(() => undefined);\n        }\n        reader.releaseLock();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAoBO,IAAM,gCAAgC;AAwE7C,IAAM,oBAAoB,oBAAI,IAAkC;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAEA,SAAS,mBAAmB,UAAsE;AAChG,QAAM,IAAI,mBAAmB,SAAS,KAAK;AAC7C;AAEA,SAAS,eACP,SACA,UACM;AACN,MACE,CAAC,SAAS,QAAQ,KAClB,SAAS,aAAa,iCACtB,SAAS,cAAc,QAAQ,aAC/B,OAAO,SAAS,OAAO,aACtB,SAAS,MAAM,EAAE,YAAY,aAC7B,CAAC,SAAS,OACR,CAAC,SAAS,SAAS,KAAK,KACvB,OAAO,SAAS,MAAM,SAAS,YAC/B,OAAO,SAAS,MAAM,YAAY,YAClC,OAAO,SAAS,MAAM,cAAc,YACxC;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,IAAI,kBAAkB;AAGf,SAAS,gCACd,WACA,UAA4C,CAAC,GACnB;AAC1B,QAAM,kBAAkB,QAAQ,oBAC7B,MAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,SAAS,EAAE,CAAC;AAEhF,WAAS,YACP,WACA,SAC4B;AAC5B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,gBAAgB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,QACb,WACA,SACA,QACY;AACZ,UAAM,WAAW,YAAY,WAAW,OAAO;AAC/C,UAAM,WAAW,MAAM,UAAU,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC7D,mBAAe,UAAU,QAAQ;AACjC,QAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,kBAAkB;AAChB,aAAO,QAAwC,gBAAgB,CAAC,CAAC;AAAA,IACnE;AAAA,IACA,MACE,UACA,cACA;AACA,aAAO,QAA+C,SAAS;AAAA,QAC7D;AAAA,QACA,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,IACE,WACA,YACA;AACA,aAAO,QAAsD,OAAO;AAAA,QAClE;AAAA,QACA,GAAI,aAAa,EAAE,SAAS,WAAW,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,IACA,KACE,OACA,aACA;AACA,aAAO,QAAmD,QAAQ;AAAA,QAChE;AAAA,QACA,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,IACA,OAAO,MACL,OACA,cACwD;AACxD,YAAM,WAAW,YAAY,SAAS;AAAA,QACpC;AAAA,QACA,GAAI,eACA;AAAA,UACA,SAAS;AAAA,YACP,GAAG;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF,IACE,CAAC;AAAA,MACP,CAAC;AACD,uBACQ,YAAY,UAAU,MAAM,UAAU;AAAA,QAC1C,QAAQ,cAAc;AAAA,MACxB,CAAC,GACD;AACA,uBAAe,UAAU,QAAQ;AACjC,YAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,WAA2C,eAA4C;AAC5F,aAAO,QAAmC,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,kCACd,QACA,UAA8C,CAAC,GACrB;AAC1B,QAAM,eAAe,QAAQ,uBACzB,IAAI,IAAI,QAAQ,oBAAoB,IACpC;AAEJ,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,CAAC,gBAAgB,aAAa,IAAI,IAAI,EAAG;AAC7C,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,UAAU,WAAsC;AACvD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mCAAmC,SAAS;AAAA,MACrD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,YAAY,CAAC,OAAO,QAAQ,OAAO;AAAA,QACnC,eAAe,aAAa,cAAc,OAAO,CAAC,SAAS,eAAe,aAAa,IAAI,IAAI,IAAI,IAAI;AAAA,QACvG,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU,OAAO;AAAA,IACnB;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,WAAW,UAAU;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,OAAO,WAAW;AAAA,IAC7C;AAAA,IACA,OAAO,MAAM,OAAO,cAAc;AAChC,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,OAAO,YAAY;AAAA,IACzC;AAAA,IACA,MAAM,SAAS;AACb,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAQO,SAAS,oCACd,QACA,SAC0B;AAC1B,QAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK;AACxC,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,eAAe,IAAI,IAAI,QAAQ,oBAAoB;AACzD,QAAM,eAAe,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,oBAAoB;AACzF,aAAW,QAAQ,cAAc;AAC/B,QAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,UAAU,0BAA0B,IAAI,wBAAwB;AAAA,IAC5E;AAAA,EACF;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,cAAgD,UAAwC;AAC/F,QAAI,SAAS,cAAc,UAAa,SAAS,cAAc,WAAW;AACxE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kDAAkD,SAAS;AAAA,QACpE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,EAAE,GAAG,UAAU,UAAU;AAAA,EAClC;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,sBAAkB,IAAI;AACtB,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,IAAI;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,gBAAgB,aAAa,cAAc,OAAO,CAAC,SAAS,aAAa,IAAI,IAAI,CAAC;AACxF,YAAM,qBAAqB,OAAO;AAAA,QAChC,cAAc,IAAI,CAAC,SAAS;AAC1B,gBAAM,mBAAmB,aAAa,qBAAqB,IAAI,KAC7D,aAAa;AACf,iBAAO;AAAA,YACL;AAAA,YACA,iBAAiB,OAAO,CAAC,cAAc,aAAa,IAAI,IAAI,KAAM,cAAc,WAAW,cAAc,QAAS;AAAA,UACpH;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,aAAa;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,MAAM,UAAU,cAAc;AAClC,wBAAkB,SAAS,IAAI;AAC/B,aAAO,MAAM,OAAO;AAAA,QAClB;AAAA,UACE,GAAG;AAAA,UACH,UAAU,cAAc,SAAS,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,cAAc,SAAS,GAAG,UAAU;AAAA,IAC9D;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,MAAM,OAAO,cAAc;AACzB,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,cAAc,KAAK,GAAG,YAAY;AAAA,IACxD;AAAA,IACA,MAAM,OAAO,WAAW,eAAe;AACrC,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,cAAc,SAAS,GAAG,aAAa;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAkC,KAAsB;AAC9E,MAAI,EAAE,OAAO,UAAU;AACrB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,GAAG;AAAA,MAC/D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,GAAG;AACpB;AAEA,SAAS,QACP,SACA,QAC6B;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,IAAI;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,SAAkB,OAA6C;AAC9E,QAAM,gBAAgB,SAAS,OAAO,IAAI,UAAU;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,OAAO,eAAe,cAAc,WAAW,cAAc,YAAY;AAAA,IACpF,IAAI;AAAA,IACJ,OAAO,UAAU,KAAK;AAAA,EACxB;AACF;AAMO,SAAS,iCAAiC,QAM/C;AACA,WAAS,SAAS,SAA2C;AAC3D,QACE,CAAC,SAAS,OAAO,KACjB,QAAQ,aAAa,iCACrB,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,aACT,QAAQ,UAAU,SAAS,OAC3B,CAAC,kBAAkB,IAAI,QAAQ,SAAS,KACxC,CAAC,SAAS,QAAQ,OAAO,GACzB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS;AACrB,UAAI;AACF,iBAAS,OAAO;AAChB,cAAM,UAAU,QAAQ;AACxB,gBAAQ,QAAQ,WAAW;AAAA,UACzB,KAAK;AACH,mBAAO,QAAQ,SAAS,MAAM,OAAO,gBAAgB,CAAC;AAAA,UACxD,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,UAAU;AAAA,gBAClC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,OAAO;AAAA,gBAC/B,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACE,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,+CAA+C,OAAO,QAAQ,SAAS,CAAC;AAAA,cACjF,WAAW;AAAA,YACb,CAAC;AAAA,QACL;AAAA,MACF,SAAS,OAAO;AACd,eAAO,QAAQ,SAAS,KAAK;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,UAAU,CAAC,GAAG;AAClC,UAAI;AACF,iBAAS,OAAO;AAChB,YAAI,QAAQ,cAAc,SAAS;AACjC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,eAAe,QAAQ,QAAQ;AACrC,yBACQ,SAAS,OAAO;AAAA,UACpB,eAAe,QAAQ,SAAS,OAAO;AAAA,UACvC;AAAA,YACE,GAAG;AAAA,YACH,QAAQ,QAAQ;AAAA,UAClB;AAAA,QACF,GACA;AACA,gBAAM,QAAQ,SAAS,KAAK;AAAA,QAC9B;AAAA,MACF,SAAS,OAAO;AACd,cAAM,QAAQ,SAAS,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,kCACd,SAC8B;AAC9B,QAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,OAAO;AAC5D,QAAM,oBAAoB,QAAQ,qBAAqB,OAAO;AAE9D,WAAS,oBAAoB,MAAoB;AAC/C,QAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,mBAAmB;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2CAA2C,iBAAiB;AAAA,QACrE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QAAQ,QAAiD;AACtE,UAAM,aAAa,OAAO,QAAQ,YAAY,aAAa,MAAM,QAAQ,QAAQ,IAAK,QAAQ,WAAW,CAAC;AAC1G,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,GAAG;AAAA,IACL;AAAA,EACF;AAEA,iBAAe,KACb,SACA,QACA,QACmB;AACnB,UAAM,WAAW,MAAM,OAAO,QAAQ,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,MAAM,QAAQ,MAAM;AAAA,MAC7B,MAAM,KAAK,UAAU,OAAO;AAAA,MAC5B;AAAA,MACA,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,cAAc;AAAA,QACzE,SAAS,+CAA+C,SAAS,MAAM;AAAA,QACvE,WAAW,SAAS,UAAU;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,UAAoB,OAAgC;AACjF,QAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,UAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAM,UAAU,IAAI,YAAY;AAChC,QAAI,OAAO;AACX,QAAI,OAAO;AACX,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,YAAI,KAAM;AACV,gBAAQ,MAAM;AACd,YAAI,OAAO,OAAO;AAChB,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yCAAyC,KAAK;AAAA,YACvD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAChD;AACA,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,YAAM,WAAW,MAAM,KAAK,SAAS,oBAAoB,iBAAiB,MAAM;AAChF,YAAM,OAAO,MAAM,gBAAgB,UAAU,gBAAgB;AAC7D,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,YAAM,WAAW,MAAM,KAAK,SAAS,wBAAwB,iBAAiB,MAAM;AACpF,UAAI,CAAC,SAAS,MAAM;AAClB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,YAAM,UAAU,IAAI,YAAY;AAChC,UAAI,UAAU;AACd,UAAI,kBAAkB;AACtB,UAAI;AACF,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,MAAM;AACR,8BAAkB;AAClB;AAAA,UACF;AACA,qBAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AACjD,cAAI,UAAU,QAAQ,QAAQ,IAAI;AAClC,iBAAO,WAAW,GAAG;AACnB,kBAAM,OAAO,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC5C,sBAAU,QAAQ,MAAM,UAAU,CAAC;AACnC,gCAAoB,IAAI;AACxB,gBAAI,KAAM,OAAM,KAAK,MAAM,IAAI;AAC/B,sBAAU,QAAQ,QAAQ,IAAI;AAAA,UAChC;AAIA,cAAI,QAAQ,SAAS,mBAAmB;AACtC,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,2CAA2C,iBAAiB;AAAA,cACrE,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AAAA,QACF;AACA,mBAAW,QAAQ,OAAO;AAC1B,YAAI,QAAQ,KAAK,GAAG;AAClB,8BAAoB,QAAQ,KAAK,CAAC;AAClC,gBAAM,KAAK,MAAM,OAAO;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AACA,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/orchestration/remoteClient.ts"],"sourcesContent":["import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport { OrchestrationError } from './errors.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const REMOTE_ORCHESTRATION_PROTOCOL = 'memeloop.resource.v2' as const;\nexport type RemoteOrchestrationOperation =\n  | 'capabilities'\n  | 'apply'\n  | 'get'\n  | 'list'\n  | 'watch'\n  | 'delete';\n\nexport interface RemoteOrchestrationRequest {\n  protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n  requestId: string;\n  operation: RemoteOrchestrationOperation;\n  payload: Record<string, unknown>;\n}\n\nexport type RemoteOrchestrationResponse =\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n  };\n\nexport interface RemoteOrchestrationTransportOptions {\n  signal?: AbortSignal;\n}\n\n/**\n * Portable host boundary. Browser, Electron renderer, React Native, and Tauri\n * WebView clients implement this interface; trusted hosts bind identity and\n * policy behind the server-side AgentOrchestrationClient.\n */\nexport interface RemoteOrchestrationTransport {\n  request(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n}\n\nexport interface RemoteOrchestrationClientOptions {\n  createRequestId?: () => string;\n}\n\nexport interface ReadOnlyOrchestrationClientOptions {\n  /** Resource kinds visible to the remote client. Omit to retain every kind exposed by the source client. */\n  allowedResourceKinds?: readonly string[];\n}\n\nexport interface NamespacedOrchestrationClientOptions {\n  /** Host-bound namespace. Callers may omit it, but cannot select another namespace. */\n  namespace: string;\n  /** Resource kinds the caller may access. An empty list denies every resource kind. */\n  allowedResourceKinds: readonly string[];\n  /**\n   * Resource kinds the caller may apply or delete. Defaults to every allowed\n   * kind for compatibility; hosts should narrow this when status resources are\n   * controller-owned.\n   */\n  mutableResourceKinds?: readonly string[];\n}\n\nconst REMOTE_OPERATIONS = new Set<RemoteOrchestrationOperation>([\n  'capabilities',\n  'apply',\n  'get',\n  'list',\n  'watch',\n  'delete',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction errorData(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n      ...(error.reason !== undefined ? { reason: error.reason } : {}),\n      ...(error.details !== undefined ? { details: error.details } : {}),\n    };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\nfunction throwResponseError(response: Extract<RemoteOrchestrationResponse, { ok: false }>): never {\n  throw new OrchestrationError(response.error);\n}\n\nfunction assertResponse(\n  request: RemoteOrchestrationRequest,\n  response: RemoteOrchestrationResponse,\n): void {\n  if (\n    !isRecord(response) ||\n    response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n    response.requestId !== request.requestId ||\n    typeof response.ok !== 'boolean' ||\n    (response.ok && !('result' in response)) ||\n    (!response.ok &&\n      (!isRecord(response.error) ||\n        typeof response.error.code !== 'string' ||\n        typeof response.error.message !== 'string' ||\n        typeof response.error.retryable !== 'boolean'))\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'remote orchestration response correlation or protocol mismatch',\n      retryable: false,\n    });\n  }\n}\n\nlet requestSequence = 0;\n\n/** Build the policy-scoped Agent facade over a browser-safe remote transport. */\nexport function createRemoteOrchestrationClient(\n  transport: RemoteOrchestrationTransport,\n  options: RemoteOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const createRequestId = options.createRequestId ??\n    (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);\n\n  function makeRequest(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n  ): RemoteOrchestrationRequest {\n    return {\n      protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n      requestId: createRequestId(),\n      operation,\n      payload,\n    };\n  }\n\n  async function request<T>(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const envelope = makeRequest(operation, payload);\n    const response = await transport.request(envelope, { signal });\n    assertResponse(envelope, response);\n    if (!response.ok) throwResponseError(response);\n    return response.result as T;\n  }\n\n  return {\n    getCapabilities() {\n      return request<AgentOrchestrationCapabilities>('capabilities', {});\n    },\n    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus>>('apply', {\n        resource,\n        ...(applyOptions ? { options: applyOptions } : {}),\n      });\n    },\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      getOptions?: OrchestrationGetOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus> | null>('get', {\n        reference,\n        ...(getOptions ? { options: getOptions } : {}),\n      });\n    },\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      listOptions?: OrchestrationListOptions,\n    ) {\n      return request<OrchestrationResourceList<TSpec, TStatus>>('list', {\n        query,\n        ...(listOptions ? { options: listOptions } : {}),\n      });\n    },\n    async *watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      const envelope = makeRequest('watch', {\n        query,\n        ...(watchOptions\n          ? {\n            options: {\n              ...watchOptions,\n              signal: undefined,\n            },\n          }\n          : {}),\n      });\n      for await (\n        const response of transport.watch(envelope, {\n          signal: watchOptions?.signal,\n        })\n      ) {\n        assertResponse(envelope, response);\n        if (!response.ok) throwResponseError(response);\n        yield response.result as OrchestrationWatchEvent<TSpec, TStatus>;\n      }\n    },\n    delete(reference: OrchestrationResourceReference, deleteOptions?: OrchestrationDeleteOptions) {\n      return request<OrchestrationDeleteResult>('delete', {\n        reference,\n        ...(deleteOptions ? { options: deleteOptions } : {}),\n      });\n    },\n  };\n}\n\n/**\n * Bind a remote/mobile caller to a read-only view of an existing policy-scoped\n * client. This is an enforcement boundary, not only capability advertising:\n * mutations and out-of-scope kinds fail before reaching the source client.\n */\nexport function createReadOnlyOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: ReadOnlyOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const allowedKinds = options.allowedResourceKinds\n    ? new Set(options.allowedResourceKinds)\n    : undefined;\n\n  function assertAllowedKind(kind: string): void {\n    if (!allowedKinds || allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function forbidden(operation: 'apply' | 'delete'): never {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration operation '${operation}' is read-only`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      return {\n        operations: ['get', 'list', 'watch'],\n        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply() {\n      forbidden('apply');\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(reference, getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(query, listOptions);\n    },\n    async *watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      yield* client.watch(query, watchOptions);\n    },\n    async delete() {\n      forbidden('delete');\n    },\n  };\n}\n\n/**\n * Bind a mutable remote caller to one host-selected namespace and an explicit\n * resource-kind allowlist. The wrapper is an authorization boundary: it\n * rejects cross-namespace references before they reach the source client and\n * fills an omitted namespace with the host-bound value.\n */\nexport function createNamespacedOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: NamespacedOrchestrationClientOptions,\n): AgentOrchestrationClient {\n  const namespace = options.namespace.trim();\n  if (!namespace || namespace.length > 253) {\n    throw new TypeError('namespace must contain between 1 and 253 characters');\n  }\n  const allowedKinds = new Set(options.allowedResourceKinds);\n  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);\n  for (const kind of mutableKinds) {\n    if (!allowedKinds.has(kind)) {\n      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);\n    }\n  }\n\n  function assertAllowedKind(kind: string): void {\n    if (allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function bindNamespace<T extends { namespace?: string }>(metadata: T): T & { namespace: string } {\n    if (metadata.namespace !== undefined && metadata.namespace !== namespace) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,\n        retryable: false,\n      });\n    }\n    return { ...metadata, namespace };\n  }\n\n  function assertMutableKind(kind: string): void {\n    assertAllowedKind(kind);\n    if (mutableKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));\n      const resourceOperations = Object.fromEntries(\n        resourceKinds.map((kind) => {\n          const sourceOperations = capabilities.resourceOperations?.[kind] ??\n            capabilities.operations;\n          return [\n            kind,\n            sourceOperations.filter((operation) => mutableKinds.has(kind) || (operation !== 'apply' && operation !== 'delete')),\n          ];\n        }),\n      );\n      return {\n        operations: capabilities.operations,\n        resourceKinds,\n        resourceOperations,\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply(resource, applyOptions) {\n      assertMutableKind(resource.kind);\n      return await client.apply(\n        {\n          ...resource,\n          metadata: bindNamespace(resource.metadata),\n        },\n        applyOptions,\n      );\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(bindNamespace(reference), getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(bindNamespace(query), listOptions);\n    },\n    watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      return client.watch(bindNamespace(query), watchOptions);\n    },\n    async delete(reference, deleteOptions) {\n      assertMutableKind(reference.kind);\n      return await client.delete(bindNamespace(reference), deleteOptions);\n    },\n  };\n}\n\nfunction requirePayload(payload: Record<string, unknown>, key: string): unknown {\n  if (!(key in payload)) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: `remote orchestration request is missing payload.${key}`,\n      retryable: false,\n    });\n  }\n  return payload[key];\n}\n\nfunction success(\n  request: RemoteOrchestrationRequest,\n  result: unknown,\n): RemoteOrchestrationResponse {\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: request.requestId,\n    ok: true,\n    result,\n  };\n}\n\nfunction failure(request: unknown, error: unknown): RemoteOrchestrationResponse {\n  const requestRecord = isRecord(request) ? request : undefined;\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: typeof requestRecord?.requestId === 'string' ? requestRecord.requestId : 'invalid',\n    ok: false,\n    error: errorData(error),\n  };\n}\n\n/**\n * Trusted-side protocol adapter. The injected client has already bound actor,\n * admission, quotas, and resource scope; wire callers cannot select an actor.\n */\nexport function createRemoteOrchestrationHandler(client: AgentOrchestrationClient): {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n} {\n  function validate(request: RemoteOrchestrationRequest): void {\n    if (\n      !isRecord(request) ||\n      request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n      typeof request.requestId !== 'string' ||\n      !request.requestId ||\n      request.requestId.length > 256 ||\n      !REMOTE_OPERATIONS.has(request.operation) ||\n      !isRecord(request.payload)\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'invalid remote orchestration request envelope',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    async request(request) {\n      try {\n        validate(request);\n        const payload = request.payload;\n        switch (request.operation) {\n          case 'capabilities':\n            return success(request, await client.getCapabilities());\n          case 'apply':\n            return success(\n              request,\n              await client.apply(\n                requirePayload(payload, 'resource') as OrchestrationResourceManifest,\n                payload.options as OrchestrationApplyOptions | undefined,\n              ),\n            );\n          case 'get':\n            return success(\n              request,\n              await client.get(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationGetOptions | undefined,\n              ),\n            );\n          case 'list':\n            return success(\n              request,\n              await client.list(\n                requirePayload(payload, 'query') as OrchestrationResourceQuery,\n                payload.options as OrchestrationListOptions | undefined,\n              ),\n            );\n          case 'delete':\n            return success(\n              request,\n              await client.delete(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationDeleteOptions | undefined,\n              ),\n            );\n          case 'watch':\n            throw new OrchestrationError({\n              code: 'INVALID',\n              message: 'watch requests require the streaming protocol method',\n              retryable: false,\n            });\n          default:\n            throw new OrchestrationError({\n              code: 'UNSUPPORTED',\n              message: `unsupported remote orchestration operation '${String(request.operation)}'`,\n              retryable: false,\n            });\n        }\n      } catch (error) {\n        return failure(request, error);\n      }\n    },\n    async *watch(request, options = {}) {\n      try {\n        validate(request);\n        if (request.operation !== 'watch') {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: 'streaming protocol accepts only watch operations',\n            retryable: false,\n          });\n        }\n        const watchOptions = request.payload.options as OrchestrationWatchOptions | undefined;\n        for await (\n          const event of client.watch(\n            requirePayload(request.payload, 'query') as OrchestrationResourceQuery,\n            {\n              ...watchOptions,\n              signal: options.signal,\n            },\n          )\n        ) {\n          yield success(request, event);\n        }\n      } catch (error) {\n        yield failure(request, error);\n      }\n    },\n  };\n}\n\nexport interface FetchOrchestrationTransportOptions {\n  endpoint: string;\n  fetch?: typeof globalThis.fetch;\n  headers?: Record<string, string> | (() => Promise<Record<string, string>>);\n  credentials?: RequestCredentials;\n  maxResponseBytes?: number;\n  maxWatchLineBytes?: number;\n}\n\n/** Browser/Tauri/React-Native fetch transport with bounded NDJSON watch. */\nexport function createFetchOrchestrationTransport(\n  options: FetchOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const fetch_ = options.fetch ?? globalThis.fetch;\n  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;\n  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;\n\n  function assertWatchLineSize(line: string): void {\n    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function headers(accept: string): Promise<Record<string, string>> {\n    const additional = typeof options.headers === 'function' ? await options.headers() : (options.headers ?? {});\n    return {\n      Accept: accept,\n      'Content-Type': 'application/json',\n      ...additional,\n    };\n  }\n\n  async function post(\n    request: RemoteOrchestrationRequest,\n    accept: string,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const response = await fetch_(options.endpoint, {\n      method: 'POST',\n      headers: await headers(accept),\n      body: JSON.stringify(request),\n      signal,\n      ...(options.credentials ? { credentials: options.credentials } : {}),\n    });\n    if (!response.ok) {\n      throw new OrchestrationError({\n        code: response.status === 401 || response.status === 403 ? 'FORBIDDEN' : 'UNAVAILABLE',\n        message: `remote orchestration endpoint returned HTTP ${response.status}`,\n        retryable: response.status >= 500,\n      });\n    }\n    return response;\n  }\n\n  async function readBoundedText(response: Response, limit: number): Promise<string> {\n    if (!response.body) return '';\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let size = 0;\n    let text = '';\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > limit) {\n          await reader.cancel();\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: `remote orchestration response exceeds ${limit} bytes`,\n            retryable: false,\n          });\n        }\n        text += decoder.decode(value, { stream: true });\n      }\n      return text + decoder.decode();\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  return {\n    async request(request, transportOptions = {}) {\n      const response = await post(request, 'application/json', transportOptions.signal);\n      const text = await readBoundedText(response, maxResponseBytes);\n      return JSON.parse(text) as RemoteOrchestrationResponse;\n    },\n    async *watch(request, transportOptions = {}) {\n      const response = await post(request, 'application/x-ndjson', transportOptions.signal);\n      if (!response.body) {\n        throw new OrchestrationError({\n          code: 'UNAVAILABLE',\n          message: 'remote orchestration watch response has no body',\n          retryable: true,\n        });\n      }\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder();\n      let pending = '';\n      let streamCompleted = false;\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) {\n            streamCompleted = true;\n            break;\n          }\n          pending += decoder.decode(value, { stream: true });\n          let newline = pending.indexOf('\\n');\n          while (newline >= 0) {\n            const line = pending.slice(0, newline).trim();\n            pending = pending.slice(newline + 1);\n            assertWatchLineSize(line);\n            if (line) yield JSON.parse(line) as RemoteOrchestrationResponse;\n            newline = pending.indexOf('\\n');\n          }\n          // UTF-8 is never smaller than the JS code-unit count. This cheap\n          // guard avoids repeatedly re-encoding an attacker-controlled partial\n          // line; the exact byte check runs once when the line is complete.\n          if (pending.length > maxWatchLineBytes) {\n            throw new OrchestrationError({\n              code: 'EXHAUSTED',\n              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n              retryable: false,\n            });\n          }\n        }\n        pending += decoder.decode();\n        if (pending.trim()) {\n          assertWatchLineSize(pending.trim());\n          yield JSON.parse(pending) as RemoteOrchestrationResponse;\n        }\n      } finally {\n        if (!streamCompleted) {\n          await reader.cancel().catch(() => undefined);\n        }\n        reader.releaseLock();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAoBO,IAAM,gCAAgC;AAwE7C,IAAM,oBAAoB,oBAAI,IAAkC;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAEA,SAAS,mBAAmB,UAAsE;AAChG,QAAM,IAAI,mBAAmB,SAAS,KAAK;AAC7C;AAEA,SAAS,eACP,SACA,UACM;AACN,MACE,CAAC,SAAS,QAAQ,KAClB,SAAS,aAAa,iCACtB,SAAS,cAAc,QAAQ,aAC/B,OAAO,SAAS,OAAO,aACtB,SAAS,MAAM,EAAE,YAAY,aAC7B,CAAC,SAAS,OACR,CAAC,SAAS,SAAS,KAAK,KACvB,OAAO,SAAS,MAAM,SAAS,YAC/B,OAAO,SAAS,MAAM,YAAY,YAClC,OAAO,SAAS,MAAM,cAAc,YACxC;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,IAAI,kBAAkB;AAGf,SAAS,gCACd,WACA,UAA4C,CAAC,GACnB;AAC1B,QAAM,kBAAkB,QAAQ,oBAC7B,MAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,SAAS,EAAE,CAAC;AAEhF,WAAS,YACP,WACA,SAC4B;AAC5B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,gBAAgB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,QACb,WACA,SACA,QACY;AACZ,UAAM,WAAW,YAAY,WAAW,OAAO;AAC/C,UAAM,WAAW,MAAM,UAAU,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC7D,mBAAe,UAAU,QAAQ;AACjC,QAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,kBAAkB;AAChB,aAAO,QAAwC,gBAAgB,CAAC,CAAC;AAAA,IACnE;AAAA,IACA,MACE,UACA,cACA;AACA,aAAO,QAA+C,SAAS;AAAA,QAC7D;AAAA,QACA,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,IACE,WACA,YACA;AACA,aAAO,QAAsD,OAAO;AAAA,QAClE;AAAA,QACA,GAAI,aAAa,EAAE,SAAS,WAAW,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,IACA,KACE,OACA,aACA;AACA,aAAO,QAAmD,QAAQ;AAAA,QAChE;AAAA,QACA,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,IACA,OAAO,MACL,OACA,cACwD;AACxD,YAAM,WAAW,YAAY,SAAS;AAAA,QACpC;AAAA,QACA,GAAI,eACA;AAAA,UACA,SAAS;AAAA,YACP,GAAG;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF,IACE,CAAC;AAAA,MACP,CAAC;AACD,uBACQ,YAAY,UAAU,MAAM,UAAU;AAAA,QAC1C,QAAQ,cAAc;AAAA,MACxB,CAAC,GACD;AACA,uBAAe,UAAU,QAAQ;AACjC,YAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,WAA2C,eAA4C;AAC5F,aAAO,QAAmC,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,kCACd,QACA,UAA8C,CAAC,GACrB;AAC1B,QAAM,eAAe,QAAQ,uBACzB,IAAI,IAAI,QAAQ,oBAAoB,IACpC;AAEJ,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,CAAC,gBAAgB,aAAa,IAAI,IAAI,EAAG;AAC7C,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,UAAU,WAAsC;AACvD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mCAAmC,SAAS;AAAA,MACrD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,YAAY,CAAC,OAAO,QAAQ,OAAO;AAAA,QACnC,eAAe,aAAa,cAAc,OAAO,CAAC,SAAS,eAAe,aAAa,IAAI,IAAI,IAAI,IAAI;AAAA,QACvG,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU,OAAO;AAAA,IACnB;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,WAAW,UAAU;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,OAAO,WAAW;AAAA,IAC7C;AAAA,IACA,OAAO,MAAM,OAAO,cAAc;AAChC,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,OAAO,YAAY;AAAA,IACzC;AAAA,IACA,MAAM,SAAS;AACb,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAQO,SAAS,oCACd,QACA,SAC0B;AAC1B,QAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK;AACxC,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,eAAe,IAAI,IAAI,QAAQ,oBAAoB;AACzD,QAAM,eAAe,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,oBAAoB;AACzF,aAAW,QAAQ,cAAc;AAC/B,QAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,UAAU,0BAA0B,IAAI,wBAAwB;AAAA,IAC5E;AAAA,EACF;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,cAAgD,UAAwC;AAC/F,QAAI,SAAS,cAAc,UAAa,SAAS,cAAc,WAAW;AACxE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kDAAkD,SAAS;AAAA,QACpE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,EAAE,GAAG,UAAU,UAAU;AAAA,EAClC;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,sBAAkB,IAAI;AACtB,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,IAAI;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,gBAAgB,aAAa,cAAc,OAAO,CAAC,SAAS,aAAa,IAAI,IAAI,CAAC;AACxF,YAAM,qBAAqB,OAAO;AAAA,QAChC,cAAc,IAAI,CAAC,SAAS;AAC1B,gBAAM,mBAAmB,aAAa,qBAAqB,IAAI,KAC7D,aAAa;AACf,iBAAO;AAAA,YACL;AAAA,YACA,iBAAiB,OAAO,CAAC,cAAc,aAAa,IAAI,IAAI,KAAM,cAAc,WAAW,cAAc,QAAS;AAAA,UACpH;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,aAAa;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,MAAM,UAAU,cAAc;AAClC,wBAAkB,SAAS,IAAI;AAC/B,aAAO,MAAM,OAAO;AAAA,QAClB;AAAA,UACE,GAAG;AAAA,UACH,UAAU,cAAc,SAAS,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,cAAc,SAAS,GAAG,UAAU;AAAA,IAC9D;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,MAAM,OAAO,cAAc;AACzB,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,cAAc,KAAK,GAAG,YAAY;AAAA,IACxD;AAAA,IACA,MAAM,OAAO,WAAW,eAAe;AACrC,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,cAAc,SAAS,GAAG,aAAa;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAkC,KAAsB;AAC9E,MAAI,EAAE,OAAO,UAAU;AACrB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,GAAG;AAAA,MAC/D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,GAAG;AACpB;AAEA,SAAS,QACP,SACA,QAC6B;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,IAAI;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,SAAkB,OAA6C;AAC9E,QAAM,gBAAgB,SAAS,OAAO,IAAI,UAAU;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,OAAO,eAAe,cAAc,WAAW,cAAc,YAAY;AAAA,IACpF,IAAI;AAAA,IACJ,OAAO,UAAU,KAAK;AAAA,EACxB;AACF;AAMO,SAAS,iCAAiC,QAM/C;AACA,WAAS,SAAS,SAA2C;AAC3D,QACE,CAAC,SAAS,OAAO,KACjB,QAAQ,aAAa,iCACrB,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,aACT,QAAQ,UAAU,SAAS,OAC3B,CAAC,kBAAkB,IAAI,QAAQ,SAAS,KACxC,CAAC,SAAS,QAAQ,OAAO,GACzB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS;AACrB,UAAI;AACF,iBAAS,OAAO;AAChB,cAAM,UAAU,QAAQ;AACxB,gBAAQ,QAAQ,WAAW;AAAA,UACzB,KAAK;AACH,mBAAO,QAAQ,SAAS,MAAM,OAAO,gBAAgB,CAAC;AAAA,UACxD,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,UAAU;AAAA,gBAClC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,OAAO;AAAA,gBAC/B,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACE,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,+CAA+C,OAAO,QAAQ,SAAS,CAAC;AAAA,cACjF,WAAW;AAAA,YACb,CAAC;AAAA,QACL;AAAA,MACF,SAAS,OAAO;AACd,eAAO,QAAQ,SAAS,KAAK;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,UAAU,CAAC,GAAG;AAClC,UAAI;AACF,iBAAS,OAAO;AAChB,YAAI,QAAQ,cAAc,SAAS;AACjC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,eAAe,QAAQ,QAAQ;AACrC,yBACQ,SAAS,OAAO;AAAA,UACpB,eAAe,QAAQ,SAAS,OAAO;AAAA,UACvC;AAAA,YACE,GAAG;AAAA,YACH,QAAQ,QAAQ;AAAA,UAClB;AAAA,QACF,GACA;AACA,gBAAM,QAAQ,SAAS,KAAK;AAAA,QAC9B;AAAA,MACF,SAAS,OAAO;AACd,cAAM,QAAQ,SAAS,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,kCACd,SAC8B;AAC9B,QAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,OAAO;AAC5D,QAAM,oBAAoB,QAAQ,qBAAqB,OAAO;AAE9D,WAAS,oBAAoB,MAAoB;AAC/C,QAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,mBAAmB;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2CAA2C,iBAAiB;AAAA,QACrE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QAAQ,QAAiD;AACtE,UAAM,aAAa,OAAO,QAAQ,YAAY,aAAa,MAAM,QAAQ,QAAQ,IAAK,QAAQ,WAAW,CAAC;AAC1G,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,GAAG;AAAA,IACL;AAAA,EACF;AAEA,iBAAe,KACb,SACA,QACA,QACmB;AACnB,UAAM,WAAW,MAAM,OAAO,QAAQ,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,MAAM,QAAQ,MAAM;AAAA,MAC7B,MAAM,KAAK,UAAU,OAAO;AAAA,MAC5B;AAAA,MACA,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,cAAc;AAAA,QACzE,SAAS,+CAA+C,SAAS,MAAM;AAAA,QACvE,WAAW,SAAS,UAAU;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,UAAoB,OAAgC;AACjF,QAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,UAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAM,UAAU,IAAI,YAAY;AAChC,QAAI,OAAO;AACX,QAAI,OAAO;AACX,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,YAAI,KAAM;AACV,gBAAQ,MAAM;AACd,YAAI,OAAO,OAAO;AAChB,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yCAAyC,KAAK;AAAA,YACvD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAChD;AACA,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,YAAM,WAAW,MAAM,KAAK,SAAS,oBAAoB,iBAAiB,MAAM;AAChF,YAAM,OAAO,MAAM,gBAAgB,UAAU,gBAAgB;AAC7D,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,YAAM,WAAW,MAAM,KAAK,SAAS,wBAAwB,iBAAiB,MAAM;AACpF,UAAI,CAAC,SAAS,MAAM;AAClB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,YAAM,UAAU,IAAI,YAAY;AAChC,UAAI,UAAU;AACd,UAAI,kBAAkB;AACtB,UAAI;AACF,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,MAAM;AACR,8BAAkB;AAClB;AAAA,UACF;AACA,qBAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AACjD,cAAI,UAAU,QAAQ,QAAQ,IAAI;AAClC,iBAAO,WAAW,GAAG;AACnB,kBAAM,OAAO,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC5C,sBAAU,QAAQ,MAAM,UAAU,CAAC;AACnC,gCAAoB,IAAI;AACxB,gBAAI,KAAM,OAAM,KAAK,MAAM,IAAI;AAC/B,sBAAU,QAAQ,QAAQ,IAAI;AAAA,UAChC;AAIA,cAAI,QAAQ,SAAS,mBAAmB;AACtC,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,2CAA2C,iBAAiB;AAAA,cACrE,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AAAA,QACF;AACA,mBAAW,QAAQ,OAAO;AAC1B,YAAI,QAAQ,KAAK,GAAG;AAClB,8BAAoB,QAAQ,KAAK,CAAC;AAClC,gBAAM,KAAK,MAAM,OAAO;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AACA,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/device-network-portable.cjs

@@ -21,9 +21,12 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var device_network_portable_exports = {};
 __export(device_network_portable_exports, {
   ChatSyncEngine: () => ChatSyncEngine,
+  DEVICE_BINDING_SIGNATURE_DOMAIN: () => DEVICE_BINDING_SIGNATURE_DOMAIN,
+  DEVICE_CONNECTION_GRANT_SIGNATURE_DOMAIN: () => DEVICE_CONNECTION_GRANT_SIGNATURE_DOMAIN,
   DEVICE_ORCHESTRATION_PROTOCOL: () => DEVICE_ORCHESTRATION_PROTOCOL,
   DEVICE_PAIRING_INVITE_PROTOCOL: () => DEVICE_PAIRING_INVITE_PROTOCOL,
   DEVICE_PAIRING_INVITE_TTL_MS: () => DEVICE_PAIRING_INVITE_TTL_MS,
+  DEVICE_RELAY_ADMISSION_SIGNATURE_DOMAIN: () => DEVICE_RELAY_ADMISSION_SIGNATURE_DOMAIN,
   DeviceCloudConnectionCoordinator: () => DeviceCloudConnectionCoordinator,
   JsonFrameError: () => JsonFrameError,
   LIBP2P_RPC_REQUEST_TYPE: () => LIBP2P_RPC_REQUEST_TYPE,
@@ -35,6 +38,9 @@ __export(device_network_portable_exports, {
   MemoryDeviceSyncStateStore: () => MemoryDeviceSyncStateStore,
   PeerNodeSyncAdapter: () => PeerNodeSyncAdapter,
   attachmentBlobFromWire: () => attachmentBlobFromWire,
+  buildDeviceBindingMessage: () => buildDeviceBindingMessage,
+  buildDeviceConnectionGrantMessage: () => buildDeviceConnectionGrantMessage,
+  buildDeviceRelayReservationTokenMessage: () => buildDeviceRelayReservationTokenMessage,
   canonicalDevicePairingInviteBytes: () => canonicalDevicePairingInviteBytes,
   computeMissingVersionRanges: () => computeMissingVersionRanges,
   createDeviceOrchestrationStreamHandler: () => createDeviceOrchestrationStreamHandler,
@@ -122,8 +128,12 @@ var DeviceCloudConnectionCoordinator = class {
   async stop() {
     this.started = false;
     this.clearTimer();
-    this.controller.abort(new Error("device cloud coordinator stopped"));
+    const stoppedController = this.controller;
+    stoppedController.abort(new Error("device cloud coordinator stopped"));
     await this.inFlight?.catch(() => void 0);
+    if (this.controller === stoppedController) {
+      this.controller = new AbortController();
+    }
   }
   async setConfiguration(configuration) {
     this.configuration = configuration;
@@ -272,6 +282,43 @@ var DeviceCloudConnectionCoordinator = class {
   }
 };
 
+// src/device-network/deviceGrantMessages.ts
+var DEVICE_BINDING_SIGNATURE_DOMAIN = "memeloop-device-binding-v2";
+var DEVICE_CONNECTION_GRANT_SIGNATURE_DOMAIN = "memeloop-device-connection-grant-v2";
+var DEVICE_RELAY_ADMISSION_SIGNATURE_DOMAIN = "memeloop-device-relay-admission-v2";
+function buildDeviceBindingMessage(input) {
+  return new TextEncoder().encode([
+    DEVICE_BINDING_SIGNATURE_DOMAIN,
+    `accountId=${input.accountId}`,
+    `peerId=${input.peerId}`,
+    `publicKey=${input.publicKeyMultibase}`,
+    `nonce=${input.nonce}`
+  ].join("\n"));
+}
+function buildDeviceConnectionGrantMessage(grant) {
+  return new TextEncoder().encode([
+    DEVICE_CONNECTION_GRANT_SIGNATURE_DOMAIN,
+    `issuer=${grant.issuer}`,
+    `accountId=${grant.accountId}`,
+    `subjectPeerId=${grant.subjectPeerId}`,
+    `allowedPeerIds=${grant.allowedPeerIds.join(",")}`,
+    `issuedAt=${grant.issuedAt}`,
+    `expiresAt=${grant.expiresAt}`
+  ].join("\n"));
+}
+function buildDeviceRelayReservationTokenMessage(token) {
+  return new TextEncoder().encode([
+    DEVICE_RELAY_ADMISSION_SIGNATURE_DOMAIN,
+    `issuer=${token.issuer}`,
+    `accountId=${token.accountId}`,
+    `peerId=${token.peerId}`,
+    `relayMultiaddrs=${token.relayMultiaddrs.join(",")}`,
+    `bootstrapMultiaddrs=${token.bootstrapMultiaddrs.join(",")}`,
+    `issuedAt=${token.issuedAt}`,
+    `expiresAt=${token.expiresAt}`
+  ].join("\n"));
+}
+
 // src/orchestration/errors.ts
 var OrchestrationError = class extends Error {
   code;
@@ -694,39 +741,92 @@ async function readSingleRequest(stream, maxFrameBytes) {
 }
 async function* withWatchBookmarks(source, request, signal) {
   const iterator = source[Symbol.asyncIterator]();
-  let pending = iterator.next();
+  let activity;
+  let activityWaiter;
+  let bookmarkTimer;
+  let readInFlight = false;
+  let lastResourceVersion = watchResourceVersion(request.payload.options) ?? "0";
+  const clearBookmarkTimer = () => {
+    if (bookmarkTimer !== void 0) clearTimeout(bookmarkTimer);
+    bookmarkTimer = void 0;
+  };
+  const publishActivity = (value) => {
+    if (activityWaiter) {
+      const resolve = activityWaiter;
+      activityWaiter = void 0;
+      clearBookmarkTimer();
+      resolve(value);
+      return;
+    }
+    activity = value;
+  };
+  const readNext = () => {
+    if (readInFlight) return;
+    readInFlight = true;
+    void iterator.next().then(
+      (value) => {
+        readInFlight = false;
+        publishActivity({ kind: "value", value });
+      },
+      (error) => {
+        readInFlight = false;
+        publishActivity({ kind: "error", error });
+      }
+    );
+  };
+  const waitForActivity = () => {
+    if (activity) {
+      const value = activity;
+      activity = void 0;
+      return Promise.resolve(value);
+    }
+    if (signal.aborted) return Promise.resolve({ kind: "aborted" });
+    return new Promise((resolve) => {
+      activityWaiter = resolve;
+      bookmarkTimer = setTimeout(() => {
+        bookmarkTimer = void 0;
+        activityWaiter = void 0;
+        resolve({ kind: "bookmark" });
+      }, WATCH_BOOKMARK_INTERVAL_MS);
+    });
+  };
+  const onAbort = () => {
+    publishActivity({ kind: "aborted" });
+  };
+  signal.addEventListener("abort", onAbort, { once: true });
+  readNext();
   try {
     for (; ; ) {
-      const result = await Promise.race([
-        pending.then((value) => ({ kind: "value", value })),
-        new Promise((resolve) => {
-          const timer = setTimeout(() => {
-            resolve({ kind: "bookmark" });
-          }, WATCH_BOOKMARK_INTERVAL_MS);
-          signal.addEventListener("abort", () => {
-            clearTimeout(timer);
-            resolve({ kind: "bookmark" });
-          }, { once: true });
-        })
-      ]);
-      if (signal.aborted) return;
+      const result = await waitForActivity();
+      if (result.kind === "aborted") return;
       if (result.kind === "bookmark") {
         yield {
           protocol: request.protocol,
           requestId: request.requestId,
           ok: true,
-          result: { type: "BOOKMARK", resourceVersion: String(Date.now()) }
+          result: { type: "BOOKMARK", resourceVersion: lastResourceVersion }
         };
         continue;
       }
+      if (result.kind === "error") throw result.error;
       if (result.value.done) return;
-      yield result.value.value;
-      pending = iterator.next();
+      const response = result.value.value;
+      lastResourceVersion = response.ok ? watchResourceVersion(response.result) ?? lastResourceVersion : lastResourceVersion;
+      yield response;
+      readNext();
     }
   } finally {
+    clearBookmarkTimer();
+    activityWaiter = void 0;
+    signal.removeEventListener("abort", onAbort);
     void iterator.return?.();
   }
 }
+function watchResourceVersion(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const resourceVersion = value.resourceVersion;
+  return typeof resourceVersion === "string" && resourceVersion.length > 0 ? resourceVersion : void 0;
+}
 function createDeviceOrchestrationStreamHandler(options) {
   const maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;
   assertFrameLimit(maxFrameBytes);
@@ -848,6 +948,12 @@ var Libp2pDeviceSyncTransport = class {
   async request(peerId, method, parameters) {
     const grant = await this.grantProvider?.(peerId);
     const stream = await this.deviceNetwork.openStream(peerId, "/memeloop/sync/2.0.0", grant);
+    let aborted = false;
+    const abort = async (error) => {
+      if (aborted) return;
+      aborted = true;
+      await stream.abort(error);
+    };
     const request = {
       type: LIBP2P_SYNC_REQUEST_TYPE,
       id: crypto.randomUUID(),
@@ -862,7 +968,7 @@ var Libp2pDeviceSyncTransport = class {
         maxPayloadBytes: 16 * 1024 * 1024,
         idleTimeoutMs: 15e3,
         totalTimeoutMs: 12e4,
-        abort: async (error) => stream.abort(error)
+        abort
       })) {
         if (response !== void 0) throw new Error("sync_response_multiple");
         response = value;
@@ -872,7 +978,7 @@ var Libp2pDeviceSyncTransport = class {
       if (!response.ok) throw new Error(response.error);
       return response.result;
     } catch (error) {
-      if (error instanceof JsonFrameError) await stream.abort(error);
+      if (error instanceof JsonFrameError) await abort(error);
       throw error;
     } finally {
       await stream.close().catch(() => void 0);
@@ -1281,9 +1387,12 @@ function computeMissingVersionRanges(currentVersion, availableVersion) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ChatSyncEngine,
+  DEVICE_BINDING_SIGNATURE_DOMAIN,
+  DEVICE_CONNECTION_GRANT_SIGNATURE_DOMAIN,
   DEVICE_ORCHESTRATION_PROTOCOL,
   DEVICE_PAIRING_INVITE_PROTOCOL,
   DEVICE_PAIRING_INVITE_TTL_MS,
+  DEVICE_RELAY_ADMISSION_SIGNATURE_DOMAIN,
   DeviceCloudConnectionCoordinator,
   JsonFrameError,
   LIBP2P_RPC_REQUEST_TYPE,
@@ -1295,6 +1404,9 @@ function computeMissingVersionRanges(currentVersion, availableVersion) {
   MemoryDeviceSyncStateStore,
   PeerNodeSyncAdapter,
   attachmentBlobFromWire,
+  buildDeviceBindingMessage,
+  buildDeviceConnectionGrantMessage,
+  buildDeviceRelayReservationTokenMessage,
   canonicalDevicePairingInviteBytes,
   computeMissingVersionRanges,
   createDeviceOrchestrationStreamHandler,