@agent-vm/agent-portal-sdk 0.0.120 → 0.0.122

package/dist/gateway-runtime-client/index.js

@@ -0,0 +1,1439 @@
+import { d as PortalListResultSchema, i as PortalCallResultSchema, m as PortalSearchResultSchema, s as PortalDescribeResultSchema } from "../portal-call-result-schema-ByxHRCEN.js";
+import { a as PortalArtifactReadRequestSchema, o as PortalArtifactReadResultSchema } from "../artifact-surface-BstQxq6b.js";
+import { $ as SandboxExecStartResultSchema, A as SandboxProcessStartResultSchema, B as SandboxFsReadResultSchema, C as SandboxProcessCancelRequestSchema, D as SandboxProcessLogsRequestSchema, F as SandboxFsListRequestSchema, G as SandboxFsStatRequestSchema, H as SandboxFsRemoveResultSchema, I as SandboxFsListResultSchema, J as SandboxFsWriteResultSchema, K as SandboxFsStatResultSchema, L as SandboxFsMkdirRequestSchema, M as SandboxProcessWaitRequestSchema, N as SandboxProcessWaitResultSchema, O as SandboxProcessLogsResultSchema, Q as SandboxExecStartRequestSchema, R as SandboxFsMkdirResultSchema, S as SandboxStreamWriteResultSchema, T as SandboxProcessHandleRequestSchema, U as SandboxFsRenameRequestSchema, V as SandboxFsRemoveRequestSchema, W as SandboxFsRenameResultSchema, X as SandboxExecCancelResultSchema, Y as SandboxExecCancelRequestSchema, _ as SandboxStreamCloseRequestSchema, at as SandboxEnvironmentOpenRequestSchema, b as SandboxStreamReadResultSchema, c as GatewayRuntimeTrustedInvocationCorrelationSchema, et as SandboxExecWaitRequestSchema, ft as SandboxRetainedResultLookupRequestSchema, g as SandboxTerminalResizeResultSchema, h as SandboxTerminalResizeRequestSchema, it as SandboxEnvironmentHandleRequestSchema, j as SandboxProcessStatusResultSchema, k as SandboxProcessStartRequestSchema, l as GatewayRuntimeTrustedInvocationPrincipalSchema, m as SandboxTerminalAttachResultSchema, n as GatewayRuntimeAttachmentMetadataSchema, ot as SandboxEnvironmentOpenResultSchema, p as SandboxTerminalAttachRequestSchema, pt as SandboxRetainedResultLookupResultSchema, q as SandboxFsWriteRequestSchema, rt as SandboxEnvironmentCloseResultSchema, s as GatewayRuntimeTrustedInvocationContextSchema, st as SandboxEnvironmentStatusResultSchema, tt as SandboxExecWaitResultSchema, u as GatewayRuntimeTrustedInvocationRequesterSchema, v as SandboxStreamCloseResultSchema, w as SandboxProcessCancelResultSchema, x as SandboxStreamWriteRequestSchema, y as SandboxStreamReadRequestSchema, z as SandboxFsReadRequestSchema } from "../contracts-RgGW0RX2.js";
+import { r as PortalCallRequestSchema } from "../portal-call-request-schema-Cp6CMGs9.js";
+import { a as PortalListRequestSchema, r as PortalSearchRequestSchema, s as PortalDescribeRequestSchema } from "../portal-call-surface-DjZVquFt.js";
+import { z } from "zod/v4";
+import net from "node:net";
+//#region src/gateway-runtime-client/gateway-runtime-sandbox-operations.ts
+async function requestSandboxOperation(props) {
+	const publicRequest = props.requestSchema.parse(props.request);
+	const trustedContext = GatewayRuntimeTrustedInvocationContextSchema.parse(props.options.trustedContext);
+	const result = await props.client.request(props.method, {
+		publicRequest,
+		trustedContext
+	}, {
+		...props.options.signal === void 0 ? {} : { signal: props.options.signal },
+		...props.options.traceContext === void 0 ? {} : { traceContext: props.options.traceContext }
+	});
+	return props.resultSchema.parse(result);
+}
+var GatewayRuntimeSandboxEnvironmentOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async open(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.environment.open",
+			options,
+			request,
+			requestSchema: SandboxEnvironmentOpenRequestSchema,
+			resultSchema: SandboxEnvironmentOpenResultSchema
+		});
+	}
+	async close(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.environment.close",
+			options,
+			request,
+			requestSchema: SandboxEnvironmentHandleRequestSchema,
+			resultSchema: SandboxEnvironmentCloseResultSchema
+		});
+	}
+	async status(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.environment.status",
+			options,
+			request,
+			requestSchema: SandboxEnvironmentHandleRequestSchema,
+			resultSchema: SandboxEnvironmentStatusResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxExecutionOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async start(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.exec.start",
+			options,
+			request,
+			requestSchema: SandboxExecStartRequestSchema,
+			resultSchema: SandboxExecStartResultSchema
+		});
+	}
+	async wait(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.exec.wait",
+			options,
+			request,
+			requestSchema: SandboxExecWaitRequestSchema,
+			resultSchema: SandboxExecWaitResultSchema
+		});
+	}
+	async cancel(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.exec.cancel",
+			options,
+			request,
+			requestSchema: SandboxExecCancelRequestSchema,
+			resultSchema: SandboxExecCancelResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxRetainedResultOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async lookup(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.retained-result.lookup",
+			options,
+			request,
+			requestSchema: SandboxRetainedResultLookupRequestSchema,
+			resultSchema: SandboxRetainedResultLookupResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxFilesystemOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async stat(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.stat",
+			options,
+			request,
+			requestSchema: SandboxFsStatRequestSchema,
+			resultSchema: SandboxFsStatResultSchema
+		});
+	}
+	async list(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.list",
+			options,
+			request,
+			requestSchema: SandboxFsListRequestSchema,
+			resultSchema: SandboxFsListResultSchema
+		});
+	}
+	async read(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.read",
+			options,
+			request,
+			requestSchema: SandboxFsReadRequestSchema,
+			resultSchema: SandboxFsReadResultSchema
+		});
+	}
+	async write(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.write",
+			options,
+			request,
+			requestSchema: SandboxFsWriteRequestSchema,
+			resultSchema: SandboxFsWriteResultSchema
+		});
+	}
+	async mkdir(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.mkdir",
+			options,
+			request,
+			requestSchema: SandboxFsMkdirRequestSchema,
+			resultSchema: SandboxFsMkdirResultSchema
+		});
+	}
+	async rename(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.rename",
+			options,
+			request,
+			requestSchema: SandboxFsRenameRequestSchema,
+			resultSchema: SandboxFsRenameResultSchema
+		});
+	}
+	async remove(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.fs.remove",
+			options,
+			request,
+			requestSchema: SandboxFsRemoveRequestSchema,
+			resultSchema: SandboxFsRemoveResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxProcessOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async start(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.process.start",
+			options,
+			request,
+			requestSchema: SandboxProcessStartRequestSchema,
+			resultSchema: SandboxProcessStartResultSchema
+		});
+	}
+	async status(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.process.status",
+			options,
+			request,
+			requestSchema: SandboxProcessHandleRequestSchema,
+			resultSchema: SandboxProcessStatusResultSchema
+		});
+	}
+	async wait(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.process.wait",
+			options,
+			request,
+			requestSchema: SandboxProcessWaitRequestSchema,
+			resultSchema: SandboxProcessWaitResultSchema
+		});
+	}
+	async logs(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.process.logs",
+			options,
+			request,
+			requestSchema: SandboxProcessLogsRequestSchema,
+			resultSchema: SandboxProcessLogsResultSchema
+		});
+	}
+	async cancel(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.process.cancel",
+			options,
+			request,
+			requestSchema: SandboxProcessCancelRequestSchema,
+			resultSchema: SandboxProcessCancelResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxStreamOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async read(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.stream.read",
+			options,
+			request,
+			requestSchema: SandboxStreamReadRequestSchema,
+			resultSchema: SandboxStreamReadResultSchema
+		});
+	}
+	async write(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.stream.write",
+			options,
+			request,
+			requestSchema: SandboxStreamWriteRequestSchema,
+			resultSchema: SandboxStreamWriteResultSchema
+		});
+	}
+	async close(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.stream.close",
+			options,
+			request,
+			requestSchema: SandboxStreamCloseRequestSchema,
+			resultSchema: SandboxStreamCloseResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxTerminalOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async attach(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.terminal.attach",
+			options,
+			request,
+			requestSchema: SandboxTerminalAttachRequestSchema,
+			resultSchema: SandboxTerminalAttachResultSchema
+		});
+	}
+	async resize(request, options) {
+		return await requestSandboxOperation({
+			client: this.#client,
+			method: "sandbox.terminal.resize",
+			options,
+			request,
+			requestSchema: SandboxTerminalResizeRequestSchema,
+			resultSchema: SandboxTerminalResizeResultSchema
+		});
+	}
+};
+var GatewayRuntimeSandboxOperations = class {
+	environment;
+	execution;
+	filesystem;
+	process;
+	retainedResults;
+	stream;
+	terminal;
+	constructor(client) {
+		this.environment = new GatewayRuntimeSandboxEnvironmentOperations(client);
+		this.execution = new GatewayRuntimeSandboxExecutionOperations(client);
+		this.filesystem = new GatewayRuntimeSandboxFilesystemOperations(client);
+		this.process = new GatewayRuntimeSandboxProcessOperations(client);
+		this.retainedResults = new GatewayRuntimeSandboxRetainedResultOperations(client);
+		this.stream = new GatewayRuntimeSandboxStreamOperations(client);
+		this.terminal = new GatewayRuntimeSandboxTerminalOperations(client);
+		Object.freeze(this.environment);
+		Object.freeze(this.execution);
+		Object.freeze(this.filesystem);
+		Object.freeze(this.process);
+		Object.freeze(this.retainedResults);
+		Object.freeze(this.stream);
+		Object.freeze(this.terminal);
+	}
+};
+//#endregion
+//#region src/gateway-runtime-client/gateway-runtime-startup-retry.ts
+const DEFAULT_GATEWAY_RUNTIME_STARTUP_RETRY_POLICY = Object.freeze({
+	deadlineMs: 5e3,
+	intervalMs: 100,
+	maxAttempts: 50
+});
+/** A pre-handshake socket publication race that is safe to retry within the startup budget. */
+var GatewayRuntimeStartupUnavailableError = class extends Error {
+	code = "startup-unavailable";
+	kind;
+	constructor(kind, options = {}) {
+		super(`Gateway runtime startup socket is unavailable: ${kind}.`, options);
+		this.name = "GatewayRuntimeStartupUnavailableError";
+		this.kind = kind;
+	}
+};
+const defaultGatewayRuntimeStartupRetryScheduler = {
+	now: () => performance.now(),
+	wait: async (delayMs, signal) => {
+		if (signal.aborted) throw signal.reason;
+		await new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				cleanup();
+				resolve();
+			}, delayMs);
+			const onAbort = () => {
+				cleanup();
+				reject(signal.reason);
+			};
+			const cleanup = () => {
+				clearTimeout(timeout);
+				signal.removeEventListener("abort", onAbort);
+			};
+			signal.addEventListener("abort", onAbort, { once: true });
+		});
+	}
+};
+//#endregion
+//#region src/gateway-runtime-client/gateway-runtime-trace-context.ts
+const GATEWAY_RUNTIME_TRACEPARENT_MAX_LENGTH = 512;
+const GATEWAY_RUNTIME_TRACESTATE_MAX_LENGTH = 512;
+const GATEWAY_RUNTIME_TRACESTATE_MAX_MEMBERS = 32;
+const lowercaseHexPattern = /^[0-9a-f]+$/u;
+const tracestateSimpleKeyPattern = /^[a-z][a-z0-9_*/-]{0,255}$/u;
+const tracestateMultiTenantKeyPattern = /^[a-z0-9][a-z0-9_*/-]{0,240}@[a-z][a-z0-9_*/-]{0,13}$/u;
+const tracestateValuePattern = /^[\x20-\x2b\x2d-\x3c\x3e-\x7e]{0,255}[\x21-\x2b\x2d-\x3c\x3e-\x7e]$/u;
+const futureTraceparentSuffixPattern = /^[\x21-\x7e]+$/u;
+function traceparentIsValid(traceparent) {
+	if (traceparent.length < 55 || traceparent.length > 512) return false;
+	if (traceparent[2] !== "-" || traceparent[35] !== "-" || traceparent[52] !== "-") return false;
+	const version = traceparent.slice(0, 2);
+	const traceId = traceparent.slice(3, 35);
+	const parentId = traceparent.slice(36, 52);
+	const traceFlags = traceparent.slice(53, 55);
+	if (!lowercaseHexPattern.test(version) || version === "ff" || !lowercaseHexPattern.test(traceId) || traceId === "0".repeat(32) || !lowercaseHexPattern.test(parentId) || parentId === "0".repeat(16) || !lowercaseHexPattern.test(traceFlags)) return false;
+	if (traceparent.length === 55) return true;
+	if (version === "00" || traceparent[55] !== "-") return false;
+	return futureTraceparentSuffixPattern.test(traceparent.slice(56));
+}
+function tracestateIsValid(tracestate) {
+	if (tracestate.length > 512) return false;
+	const rawMembers = tracestate.split(",");
+	if (rawMembers.length > 32) return false;
+	const seenKeys = /* @__PURE__ */ new Set();
+	for (const rawMember of rawMembers) {
+		const member = rawMember.replace(/^[ \t]+|[ \t]+$/gu, "");
+		if (member.length === 0) continue;
+		const equalsIndex = member.indexOf("=");
+		if (equalsIndex <= 0 || equalsIndex !== member.lastIndexOf("=")) return false;
+		const key = member.slice(0, equalsIndex);
+		const value = member.slice(equalsIndex + 1);
+		if (!tracestateSimpleKeyPattern.test(key) && !tracestateMultiTenantKeyPattern.test(key) || !tracestateValuePattern.test(value)) return false;
+		if (seenKeys.has(key)) return false;
+		seenKeys.add(key);
+	}
+	return true;
+}
+const GatewayRuntimeTraceparentSchema = z.string().max(512).refine(traceparentIsValid, "traceparent must follow the bounded W3C Trace Context grammar.");
+const GatewayRuntimeTracestateSchema = z.string().max(512).refine(tracestateIsValid, "tracestate must follow the bounded W3C Trace Context grammar.");
+const GatewayRuntimeTraceContextSchema = z.object({
+	traceparent: GatewayRuntimeTraceparentSchema,
+	tracestate: GatewayRuntimeTracestateSchema.optional()
+}).strict();
+//#endregion
+//#region src/gateway-runtime-client/gateway-runtime-protocol.ts
+const DEFAULT_GATEWAY_RUNTIME_FRAME_LIMITS = Object.freeze({
+	maxBufferedBytes: 1056768,
+	maxContentBytes: 1048576,
+	maxFramesPerChunk: 32,
+	maxHeaderBytes: 8192
+});
+const headerDelimiter = new Uint8Array([
+	13,
+	10,
+	13,
+	10
+]);
+const strictUtf8Decoder = new TextDecoder("utf-8", { fatal: true });
+const utf8Encoder = new TextEncoder();
+var GatewayRuntimeProtocolError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "GatewayRuntimeProtocolError";
+		this.code = code;
+	}
+};
+function protocolError(code, message) {
+	return new GatewayRuntimeProtocolError(code, message);
+}
+function assertPositiveLimit(value, fieldName) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${fieldName} must be a positive safe integer.`);
+}
+function resolveFrameLimits(overrides) {
+	const limits = {
+		...DEFAULT_GATEWAY_RUNTIME_FRAME_LIMITS,
+		...overrides
+	};
+	assertPositiveLimit(limits.maxBufferedBytes, "maxBufferedBytes");
+	assertPositiveLimit(limits.maxContentBytes, "maxContentBytes");
+	assertPositiveLimit(limits.maxFramesPerChunk, "maxFramesPerChunk");
+	assertPositiveLimit(limits.maxHeaderBytes, "maxHeaderBytes");
+	return Object.freeze(limits);
+}
+function concatenateBytes(left, right) {
+	if (left.byteLength === 0) return new Uint8Array(right);
+	if (right.byteLength === 0) return new Uint8Array(left);
+	const combinedBytes = new Uint8Array(left.byteLength + right.byteLength);
+	combinedBytes.set(left, 0);
+	combinedBytes.set(right, left.byteLength);
+	return combinedBytes;
+}
+function findHeaderDelimiter(bytes) {
+	outer: for (let offset = 0; offset <= bytes.byteLength - headerDelimiter.byteLength; offset += 1) {
+		for (let delimiterOffset = 0; delimiterOffset < headerDelimiter.byteLength; delimiterOffset += 1) if (bytes[offset + delimiterOffset] !== headerDelimiter[delimiterOffset]) continue outer;
+		return offset;
+	}
+	return -1;
+}
+function decodeUtf8(bytes, code) {
+	try {
+		return strictUtf8Decoder.decode(bytes);
+	} catch {
+		throw protocolError(code, "Gateway runtime frame contains invalid UTF-8.");
+	}
+}
+function parseContentLength(headerBytes) {
+	const headerLines = decodeUtf8(headerBytes, "MALFORMED_HEADER").split("\r\n");
+	let contentLengthText;
+	for (const headerLine of headerLines) {
+		const delimiterIndex = headerLine.indexOf(":");
+		if (delimiterIndex <= 0) throw protocolError("MALFORMED_HEADER", "Gateway runtime frame header is malformed.");
+		const headerName = headerLine.slice(0, delimiterIndex).trim().toLowerCase();
+		if (headerName !== "content-length") throw protocolError("UNKNOWN_HEADER", `Gateway runtime frame header '${headerName}' is unknown.`);
+		if (contentLengthText !== void 0) throw protocolError("DUPLICATE_CONTENT_LENGTH", "Gateway runtime frame contains duplicate Content-Length headers.");
+		contentLengthText = headerLine.slice(delimiterIndex + 1).trim();
+	}
+	if (contentLengthText === void 0 || contentLengthText.length === 0) throw protocolError("MALFORMED_HEADER", "Gateway runtime frame is missing Content-Length.");
+	if (contentLengthText.startsWith("-")) throw protocolError("NEGATIVE_CONTENT_LENGTH", "Content-Length must not be negative.");
+	if (!/^\d+$/u.test(contentLengthText)) throw protocolError("NON_DECIMAL_CONTENT_LENGTH", "Content-Length must contain decimal digits.");
+	const contentLengthBigInt = BigInt(contentLengthText);
+	if (contentLengthBigInt > BigInt(Number.MAX_SAFE_INTEGER)) throw protocolError("UNSAFE_CONTENT_LENGTH", "Content-Length exceeds the safe integer range.");
+	return Number(contentLengthBigInt);
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasSupportedJsonRpcVersion(value) {
+	return value.jsonrpc === "2.0";
+}
+function jsonRpcIdIsValid(value) {
+	return typeof value === "string" || typeof value === "number" && Number.isSafeInteger(value) || value === null;
+}
+function jsonRpcParamsAreValid(value) {
+	return Array.isArray(value) || isJsonObject(value);
+}
+function hasOnlyKeys(record, allowedKeys) {
+	return Object.keys(record).every((key) => allowedKeys.has(key));
+}
+function validateJsonRpcErrorObject(value) {
+	if (!isJsonObject(value)) throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC error object is invalid.");
+	if (!hasOnlyKeys(value, new Set([
+		"code",
+		"data",
+		"message"
+	]))) throw protocolError("UNKNOWN_JSON_RPC_FIELD", "JSON-RPC error object has an unknown field.");
+	if (!Number.isSafeInteger(value.code) || typeof value.message !== "string") throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC error object is invalid.");
+}
+function validateJsonRpcEnvelope(value) {
+	if (Array.isArray(value)) throw protocolError("JSON_RPC_BATCH_UNSUPPORTED", "JSON-RPC batches are not supported.");
+	if (!isJsonObject(value)) throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC messages must be objects.");
+	if (!hasSupportedJsonRpcVersion(value)) throw protocolError("UNSUPPORTED_JSON_RPC_VERSION", "Gateway runtime requires JSON-RPC version 2.0.");
+	if (Object.hasOwn(value, "method")) {
+		if (!hasOnlyKeys(value, new Set([
+			"id",
+			"jsonrpc",
+			"method",
+			"params"
+		]))) throw protocolError("UNKNOWN_JSON_RPC_FIELD", "JSON-RPC request has an unknown field.");
+		if (typeof value.method !== "string" || value.method.length === 0 || Object.hasOwn(value, "id") && !jsonRpcIdIsValid(value.id) || Object.hasOwn(value, "params") && !jsonRpcParamsAreValid(value.params)) throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC request envelope is invalid.");
+		return value;
+	}
+	const hasResult = Object.hasOwn(value, "result");
+	const hasError = Object.hasOwn(value, "error");
+	if (!hasOnlyKeys(value, new Set([
+		"error",
+		"id",
+		"jsonrpc",
+		"result"
+	]))) throw protocolError("UNKNOWN_JSON_RPC_FIELD", "JSON-RPC response has an unknown field.");
+	if (!Object.hasOwn(value, "id") || !jsonRpcIdIsValid(value.id) || hasResult === hasError) throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC response envelope is invalid.");
+	if (hasError) validateJsonRpcErrorObject(value.error);
+	return value;
+}
+function parseFrameBody(bodyBytes) {
+	const bodyText = decodeUtf8(bodyBytes, "INVALID_UTF8");
+	let parsedBody;
+	try {
+		parsedBody = JSON.parse(bodyText);
+	} catch {
+		throw protocolError("INVALID_JSON", "Gateway runtime frame body is not valid JSON.");
+	}
+	return validateJsonRpcEnvelope(parsedBody);
+}
+var GatewayRuntimeFrameDecoder = class {
+	#limits;
+	#buffer = new Uint8Array(0);
+	#pendingFrameBody;
+	#terminalError;
+	constructor(limitOverrides = {}) {
+		this.#limits = resolveFrameLimits(limitOverrides);
+	}
+	get bufferedByteLength() {
+		return this.#buffer.byteLength;
+	}
+	#fail(error) {
+		this.#terminalError ??= error;
+		throw this.#terminalError;
+	}
+	push(chunk) {
+		if (this.#terminalError !== void 0) throw this.#terminalError;
+		if (chunk.byteLength > this.#limits.maxBufferedBytes - this.#buffer.byteLength) this.#fail(protocolError("BUFFER_LIMIT_EXCEEDED", "Gateway runtime decoder input exceeds its buffer limit."));
+		let workingBuffer = concatenateBytes(this.#buffer, chunk);
+		let pendingFrameBody = this.#pendingFrameBody;
+		const decodedMessages = [];
+		try {
+			while (workingBuffer.byteLength > 0) {
+				if (pendingFrameBody === void 0) {
+					const headerDelimiterOffset = findHeaderDelimiter(workingBuffer);
+					if (headerDelimiterOffset < 0) {
+						if (workingBuffer.byteLength > this.#limits.maxHeaderBytes) this.#fail(protocolError("HEADER_TOO_LARGE", "Gateway runtime frame header exceeds its limit."));
+						if (workingBuffer.byteLength > this.#limits.maxBufferedBytes) this.#fail(protocolError("BUFFER_LIMIT_EXCEEDED", "Gateway runtime decoder buffer is full."));
+						break;
+					}
+					if (headerDelimiterOffset > this.#limits.maxHeaderBytes) this.#fail(protocolError("HEADER_TOO_LARGE", "Gateway runtime frame header exceeds its limit."));
+					const bodyStartOffset = headerDelimiterOffset + headerDelimiter.byteLength;
+					const contentLength = parseContentLength(workingBuffer.subarray(0, headerDelimiterOffset));
+					if (contentLength > this.#limits.maxContentBytes) this.#fail(protocolError("CONTENT_TOO_LARGE", "Gateway runtime frame body exceeds its limit."));
+					if (bodyStartOffset + contentLength > this.#limits.maxBufferedBytes) this.#fail(protocolError("CONTENT_LENGTH_OVERFLOW", "Gateway runtime frame cannot fit within the decoder buffer limit."));
+					pendingFrameBody = {
+						bodyStartOffset,
+						contentLength
+					};
+				}
+				const bodyEndOffset = pendingFrameBody.bodyStartOffset + pendingFrameBody.contentLength;
+				if (workingBuffer.byteLength < bodyEndOffset) break;
+				if (decodedMessages.length >= this.#limits.maxFramesPerChunk) this.#fail(protocolError("FRAME_LIMIT_EXCEEDED", "Gateway runtime chunk contains too many complete frames."));
+				decodedMessages.push(parseFrameBody(workingBuffer.subarray(pendingFrameBody.bodyStartOffset, bodyEndOffset)));
+				workingBuffer = workingBuffer.slice(bodyEndOffset);
+				pendingFrameBody = void 0;
+			}
+		} catch (error) {
+			if (error instanceof GatewayRuntimeProtocolError) this.#fail(error);
+			throw error;
+		}
+		this.#buffer = workingBuffer;
+		this.#pendingFrameBody = pendingFrameBody;
+		return decodedMessages;
+	}
+	finish() {
+		if (this.#terminalError !== void 0) throw this.#terminalError;
+		if (this.#buffer.byteLength === 0) return;
+		if (this.#pendingFrameBody !== void 0) this.#fail(protocolError("INCOMPLETE_FRAME_BODY", "Gateway runtime frame body ended early."));
+		const code = new TextDecoder().decode(this.#buffer).includes("\r\n") ? "MISSING_HEADER_DELIMITER" : "INCOMPLETE_FRAME_HEADER";
+		this.#fail(protocolError(code, "Gateway runtime frame header ended early."));
+	}
+};
+function encodeGatewayRuntimeFrame(message, limitOverrides = {}) {
+	validateJsonRpcEnvelope(message);
+	const limits = resolveFrameLimits(limitOverrides);
+	let serializedMessage;
+	try {
+		serializedMessage = JSON.stringify(message);
+	} catch {
+		throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC message is not serializable.");
+	}
+	if (serializedMessage === void 0) throw protocolError("INVALID_JSON_RPC_ENVELOPE", "JSON-RPC message is not serializable.");
+	validateJsonRpcEnvelope(JSON.parse(serializedMessage));
+	const bodyBytes = utf8Encoder.encode(serializedMessage);
+	if (bodyBytes.byteLength > limits.maxContentBytes) throw protocolError("CONTENT_TOO_LARGE", "Gateway runtime frame body exceeds its limit.");
+	const headerBytes = utf8Encoder.encode(`Content-Length: ${bodyBytes.byteLength}\r\n\r\n`);
+	if (headerBytes.byteLength - headerDelimiter.byteLength > limits.maxHeaderBytes) throw protocolError("HEADER_TOO_LARGE", "Gateway runtime frame header exceeds its limit.");
+	if (headerBytes.byteLength + bodyBytes.byteLength > limits.maxBufferedBytes) throw protocolError("CONTENT_LENGTH_OVERFLOW", "Gateway runtime frame cannot fit within the buffer limit.");
+	return concatenateBytes(headerBytes, bodyBytes);
+}
+//#endregion
+//#region src/gateway-runtime-client/node-gateway-runtime-transport.ts
+const GATEWAY_RUNTIME_REQUEST_CANCEL_NOTIFICATION_METHOD = "notifications/cancelled";
+var NodeGatewayRuntimeTransportError = class extends Error {
+	code;
+	constructor(code, message, options = {}) {
+		super(message, options);
+		this.name = "NodeGatewayRuntimeTransportError";
+		this.code = code;
+	}
+};
+var GatewayRuntimeRemoteError = class extends Error {
+	code;
+	data;
+	constructor(code, message, data) {
+		super(message);
+		this.name = "GatewayRuntimeRemoteError";
+		this.code = code;
+		this.data = data;
+	}
+};
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nodeErrorCode(error) {
+	return isRecord$1(error) && typeof error["code"] === "string" ? error["code"] : void 0;
+}
+function assertPositiveSafeInteger$1(value, fieldName) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${fieldName} must be a positive safe integer.`);
+}
+function createRemoteError(errorObject) {
+	if (!isRecord$1(errorObject) || !Number.isSafeInteger(errorObject["code"]) || typeof errorObject["message"] !== "string") return new GatewayRuntimeRemoteError("invalid-remote-error", "Gateway runtime returned an invalid JSON-RPC error.");
+	return new GatewayRuntimeRemoteError(String(errorObject["code"]), errorObject["message"], errorObject["data"]);
+}
+var NodeGatewayRuntimeConnection = class {
+	#decoder;
+	#frameLimits;
+	#maxPendingRequests;
+	#discardedRequestIds = /* @__PURE__ */ new Set();
+	#pendingRequests = /* @__PURE__ */ new Map();
+	#socket;
+	#closed = false;
+	#nextRequestId = 1;
+	#pendingWrite = Promise.resolve();
+	constructor(options) {
+		this.#decoder = new GatewayRuntimeFrameDecoder(options.frameLimits);
+		this.#frameLimits = options.frameLimits;
+		this.#maxPendingRequests = options.maxPendingRequests;
+		this.#socket = options.socket;
+		this.#socket.on("data", (chunk) => this.#receiveChunk(chunk));
+		this.#socket.once("close", () => {
+			this.#failConnection(new NodeGatewayRuntimeTransportError("connection-closed", "Gateway runtime connection closed."));
+		});
+		this.#socket.once("error", (error) => {
+			this.#failConnection(new NodeGatewayRuntimeTransportError("connection-failed", "Gateway runtime connection failed.", { cause: error }));
+		});
+	}
+	#failConnection(error) {
+		if (this.#closed) return;
+		this.#closed = true;
+		for (const pendingRequest of this.#pendingRequests.values()) pendingRequest.reject(error);
+		this.#pendingRequests.clear();
+		this.#discardedRequestIds.clear();
+		if (!this.#socket.destroyed) this.#socket.destroy();
+	}
+	#receiveChunk(chunk) {
+		if (this.#closed) return;
+		let messages;
+		try {
+			messages = this.#decoder.push(chunk);
+		} catch (error) {
+			this.#failConnection(new NodeGatewayRuntimeTransportError("protocol-failed", "Gateway runtime response framing failed.", { cause: error }));
+			return;
+		}
+		for (const message of messages) this.#receiveMessage(message);
+	}
+	#receiveMessage(message) {
+		if (!Object.hasOwn(message, "id") || Object.hasOwn(message, "method")) {
+			this.#failConnection(new NodeGatewayRuntimeTransportError("unexpected-message", "Gateway runtime client received an unexpected request or notification."));
+			return;
+		}
+		const requestId = message["id"];
+		if (typeof requestId !== "number" || !Number.isSafeInteger(requestId)) {
+			this.#failConnection(new NodeGatewayRuntimeTransportError("unexpected-message", "Gateway runtime response id is not a pending integer request id."));
+			return;
+		}
+		const pendingRequest = this.#pendingRequests.get(requestId);
+		if (pendingRequest === void 0) {
+			if (this.#discardedRequestIds.delete(requestId)) return;
+			this.#failConnection(new NodeGatewayRuntimeTransportError("unexpected-message", "Gateway runtime response does not match a pending request."));
+			return;
+		}
+		this.#pendingRequests.delete(requestId);
+		if (Object.hasOwn(message, "error")) {
+			pendingRequest.reject(createRemoteError(message["error"]));
+			return;
+		}
+		pendingRequest.resolve(message["result"]);
+	}
+	#allocateRequestId() {
+		if (!Number.isSafeInteger(this.#nextRequestId)) throw new NodeGatewayRuntimeTransportError("request-id-exhausted", "Gateway runtime request id space is exhausted.");
+		const requestId = this.#nextRequestId;
+		this.#nextRequestId += 1;
+		return requestId;
+	}
+	async #writeFrameImmediately(frame) {
+		if (this.#closed) throw new NodeGatewayRuntimeTransportError("connection-closed", "Gateway runtime connection is closed.");
+		await new Promise((resolve, reject) => {
+			const onError = (error) => {
+				cleanup();
+				reject(new NodeGatewayRuntimeTransportError("request-write-failed", "Gateway runtime request write failed.", { cause: error }));
+			};
+			const cleanup = () => {
+				this.#socket.off("error", onError);
+			};
+			this.#socket.once("error", onError);
+			this.#socket.write(frame, (error) => {
+				if (error !== void 0 && error !== null) {
+					onError(error);
+					return;
+				}
+				cleanup();
+				resolve();
+			});
+		});
+		if (!this.#socket.writableNeedDrain) return;
+		await new Promise((resolve, reject) => {
+			const onDrain = () => {
+				cleanup();
+				resolve();
+			};
+			const onError = (error) => {
+				cleanup();
+				reject(error);
+			};
+			const cleanup = () => {
+				this.#socket.off("drain", onDrain);
+				this.#socket.off("error", onError);
+			};
+			this.#socket.once("drain", onDrain);
+			this.#socket.once("error", onError);
+		});
+	}
+	async #writeFrame(frame) {
+		const write = this.#pendingWrite.then(async () => await this.#writeFrameImmediately(frame));
+		this.#pendingWrite = write.catch(() => void 0);
+		await write;
+	}
+	async handshake(attachment, options = {}) {
+		const decision = await this.request("managed-plugin.handshake", attachment, options);
+		if (isRecord$1(decision) && decision["kind"] === "accepted") return;
+		const rejectionCode = isRecord$1(decision) ? decision["code"] : void 0;
+		throw new GatewayRuntimeRemoteError(typeof rejectionCode === "string" ? rejectionCode : "invalid-handshake", "Gateway runtime rejected the managed-plugin attachment.", decision);
+	}
+	async request(method, params, options = {}) {
+		if (options.signal?.aborted === true) throw new NodeGatewayRuntimeTransportError("request-aborted", "Gateway runtime request was aborted before dispatch.", { cause: options.signal.reason });
+		if (this.#pendingRequests.size >= this.#maxPendingRequests) throw new NodeGatewayRuntimeTransportError("pending-request-limit-exceeded", "Gateway runtime pending request limit was reached.");
+		const requestId = this.#allocateRequestId();
+		const frame = encodeGatewayRuntimeFrame({
+			id: requestId,
+			jsonrpc: "2.0",
+			method,
+			params
+		}, this.#frameLimits);
+		return await new Promise((resolve, reject) => {
+			let settled = false;
+			const settleRejected = (error) => {
+				if (settled) return;
+				settled = true;
+				options.signal?.removeEventListener("abort", onAbort);
+				this.#pendingRequests.delete(requestId);
+				reject(error);
+			};
+			const settleResolved = (result) => {
+				if (settled) return;
+				settled = true;
+				options.signal?.removeEventListener("abort", onAbort);
+				resolve(result);
+			};
+			const onAbort = () => {
+				if (settled) return;
+				if (this.#discardedRequestIds.size >= this.#maxPendingRequests) {
+					const capacityError = new NodeGatewayRuntimeTransportError("pending-request-limit-exceeded", "Gateway runtime discarded-request limit was reached.");
+					settleRejected(capacityError);
+					this.#failConnection(capacityError);
+					return;
+				}
+				this.#discardedRequestIds.add(requestId);
+				settleRejected(new NodeGatewayRuntimeTransportError("request-aborted", "Gateway runtime request was aborted locally.", { cause: options.signal?.reason }));
+				const cancellationFrame = encodeGatewayRuntimeFrame({
+					jsonrpc: "2.0",
+					method: GATEWAY_RUNTIME_REQUEST_CANCEL_NOTIFICATION_METHOD,
+					params: { requestId }
+				}, this.#frameLimits);
+				this.#writeFrame(cancellationFrame).catch((error) => {
+					this.#failConnection(error instanceof Error ? error : new NodeGatewayRuntimeTransportError("request-write-failed", "Gateway runtime cancellation write failed."));
+				});
+			};
+			this.#pendingRequests.set(requestId, {
+				reject: settleRejected,
+				resolve: settleResolved
+			});
+			options.signal?.addEventListener("abort", onAbort, { once: true });
+			this.#writeFrame(frame).catch(settleRejected);
+		});
+	}
+	async close() {
+		if (this.#closed) return;
+		this.#failConnection(new NodeGatewayRuntimeTransportError("connection-closed", "Gateway runtime connection closed locally."));
+	}
+};
+function createNodeGatewayRuntimeTransportFactory(options = {}) {
+	const frameLimits = options.frameLimits ?? {};
+	const maxPendingRequests = options.maxPendingRequests ?? 64;
+	assertPositiveSafeInteger$1(maxPendingRequests, "maxPendingRequests");
+	return { connect: async ({ signal, socketPath }) => {
+		const socket = net.createConnection({
+			path: socketPath,
+			signal
+		});
+		await new Promise((resolve, reject) => {
+			const onConnect = () => {
+				cleanup();
+				resolve();
+			};
+			const onError = (error) => {
+				cleanup();
+				const errorCode = nodeErrorCode(error);
+				if (errorCode === "ENOENT" || errorCode === "ECONNREFUSED") {
+					reject(new GatewayRuntimeStartupUnavailableError(errorCode === "ENOENT" ? "socket-absent" : "socket-refused", { cause: error }));
+					return;
+				}
+				reject(new NodeGatewayRuntimeTransportError("connection-failed", "Gateway runtime UDS connection failed.", { cause: error }));
+			};
+			const cleanup = () => {
+				socket.off("connect", onConnect);
+				socket.off("error", onError);
+			};
+			socket.once("connect", onConnect);
+			socket.once("error", onError);
+		});
+		return new NodeGatewayRuntimeConnection({
+			frameLimits,
+			maxPendingRequests,
+			socket
+		});
+	} };
+}
+//#endregion
+//#region src/gateway-runtime-client/gateway-runtime-flow-control.ts
+const ZERO_RETAINED_BYTES = Object.freeze({
+	kernelSendBufferedBytes: 0,
+	nodeWritableBufferedBytes: 0,
+	parserBufferedBytes: 0,
+	sourceOwnedApplicationChunkBytes: 0
+});
+function assertNonnegativeSafeInteger(value, fieldName) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${fieldName} must be a nonnegative safe integer.`);
+}
+function assertPositiveSafeInteger(value, fieldName) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${fieldName} must be a positive safe integer.`);
+}
+function assertUnreachable(value) {
+	throw new Error(`Unhandled Gateway runtime flow-control event: ${JSON.stringify(value)}`);
+}
+function assertWithinLimit(value, limit, measurementName) {
+	assertNonnegativeSafeInteger(value, measurementName);
+	if (value > limit) throw new Error(`${measurementName} exceeds its configured retained-byte limit.`);
+}
+function highWaterMeasurements(current, previousHighWater) {
+	return Object.freeze({
+		kernelSendBufferedBytes: Math.max(current.kernelSendBufferedBytes, previousHighWater.kernelSendBufferedBytes),
+		nodeWritableBufferedBytes: Math.max(current.nodeWritableBufferedBytes, previousHighWater.nodeWritableBufferedBytes),
+		parserBufferedBytes: Math.max(current.parserBufferedBytes, previousHighWater.parserBufferedBytes),
+		sourceOwnedApplicationChunkBytes: Math.max(current.sourceOwnedApplicationChunkBytes, previousHighWater.sourceOwnedApplicationChunkBytes)
+	});
+}
+function transitionChunkSender(state, effects = []) {
+	return {
+		effects,
+		state
+	};
+}
+function createGatewayRuntimeChunkSenderState(retainedByteLimits) {
+	assertPositiveSafeInteger(retainedByteLimits.maxKernelSendBufferedBytes, "maxKernelSendBufferedBytes");
+	assertPositiveSafeInteger(retainedByteLimits.maxNodeWritableBufferedBytes, "maxNodeWritableBufferedBytes");
+	assertPositiveSafeInteger(retainedByteLimits.maxParserBufferedBytes, "maxParserBufferedBytes");
+	assertPositiveSafeInteger(retainedByteLimits.maxSourceOwnedApplicationChunkBytes, "maxSourceOwnedApplicationChunkBytes");
+	return {
+		currentRetainedBytes: ZERO_RETAINED_BYTES,
+		highWaterRetainedBytes: ZERO_RETAINED_BYTES,
+		ownedApplicationChunkCount: 0,
+		phase: "idle",
+		retainedByteLimits: Object.freeze({ ...retainedByteLimits })
+	};
+}
+function reduceGatewayRuntimeChunkSenderState(state, event) {
+	if (event.kind === "disconnected") {
+		if (state.phase === "disconnected") return transitionChunkSender(state);
+		const currentRetainedBytes = Object.freeze({
+			...state.currentRetainedBytes,
+			sourceOwnedApplicationChunkBytes: 0
+		});
+		return transitionChunkSender({
+			...state,
+			currentRetainedBytes,
+			ownedApplicationChunkCount: 0,
+			phase: "disconnected"
+		});
+	}
+	if (state.phase === "disconnected") return transitionChunkSender(state);
+	switch (event.kind) {
+		case "start":
+			if (state.phase !== "idle") throw new Error("Gateway runtime chunk sender can only start from idle.");
+			return transitionChunkSender({
+				...state,
+				phase: "reading-source"
+			}, [{ kind: "read-source" }]);
+		case "source-chunk-read": {
+			if (state.phase !== "reading-source" || state.ownedApplicationChunkCount !== 0) throw new Error("Gateway runtime chunk sender already owns an application chunk.");
+			assertWithinLimit(event.chunk.byteLength, state.retainedByteLimits.maxSourceOwnedApplicationChunkBytes, "source-owned application chunk");
+			const currentRetainedBytes = Object.freeze({
+				...state.currentRetainedBytes,
+				sourceOwnedApplicationChunkBytes: event.chunk.byteLength
+			});
+			return transitionChunkSender({
+				...state,
+				currentRetainedBytes,
+				highWaterRetainedBytes: highWaterMeasurements(currentRetainedBytes, state.highWaterRetainedBytes),
+				ownedApplicationChunkCount: 1,
+				phase: "writing-chunk"
+			}, [{
+				chunk: event.chunk,
+				kind: "encode-and-write"
+			}]);
+		}
+		case "write-result": {
+			if (state.phase !== "writing-chunk" || state.ownedApplicationChunkCount !== 1) throw new Error("Gateway runtime chunk sender has no application chunk being written.");
+			const currentRetainedBytes = Object.freeze({
+				...state.currentRetainedBytes,
+				sourceOwnedApplicationChunkBytes: 0
+			});
+			return transitionChunkSender({
+				...state,
+				currentRetainedBytes,
+				ownedApplicationChunkCount: 0,
+				phase: event.writableWithoutDrain ? "reading-source" : "waiting-for-drain"
+			}, event.writableWithoutDrain ? [{ kind: "read-source" }] : []);
+		}
+		case "drain":
+			if (state.phase !== "waiting-for-drain") throw new Error("Gateway runtime chunk sender received drain while not waiting for drain.");
+			return transitionChunkSender({
+				...state,
+				phase: "reading-source"
+			}, [{ kind: "read-source" }]);
+		case "retained-bytes-observed": {
+			assertWithinLimit(event.kernelSendBufferedBytes, state.retainedByteLimits.maxKernelSendBufferedBytes, "kernel send buffer");
+			assertWithinLimit(event.nodeWritableBufferedBytes, state.retainedByteLimits.maxNodeWritableBufferedBytes, "Node writable buffer");
+			assertWithinLimit(event.parserBufferedBytes, state.retainedByteLimits.maxParserBufferedBytes, "parser buffer");
+			const currentRetainedBytes = Object.freeze({
+				kernelSendBufferedBytes: event.kernelSendBufferedBytes,
+				nodeWritableBufferedBytes: event.nodeWritableBufferedBytes,
+				parserBufferedBytes: event.parserBufferedBytes,
+				sourceOwnedApplicationChunkBytes: state.currentRetainedBytes.sourceOwnedApplicationChunkBytes
+			});
+			return transitionChunkSender({
+				...state,
+				currentRetainedBytes,
+				highWaterRetainedBytes: highWaterMeasurements(currentRetainedBytes, state.highWaterRetainedBytes)
+			});
+		}
+	}
+	return assertUnreachable(event);
+}
+function transitionClientRead(state, effects = []) {
+	return {
+		effects,
+		state
+	};
+}
+function enterDiscardDraining(state) {
+	return transitionClientRead({
+		...state,
+		phase: "discard-draining"
+	}, [{ kind: "cancel-pause-deadline" }, { kind: "resume-socket-read" }]);
+}
+function createGatewayRuntimeClientReadState(options) {
+	assertPositiveSafeInteger(options.pauseDeadlineMilliseconds, "pauseDeadlineMilliseconds");
+	if (options.streamId.length === 0) throw new Error("streamId must not be empty.");
+	return {
+		pauseDeadlineMilliseconds: options.pauseDeadlineMilliseconds,
+		phase: "flowing",
+		streamId: options.streamId
+	};
+}
+function reduceGatewayRuntimeClientReadState(state, event) {
+	switch (event.kind) {
+		case "downstream-pressure":
+			if (state.phase !== "flowing") throw new Error("Gateway runtime client read can only pause while flowing.");
+			return transitionClientRead({
+				...state,
+				phase: "downstream-paused"
+			}, [{ kind: "pause-socket-read" }, {
+				afterMilliseconds: state.pauseDeadlineMilliseconds,
+				kind: "schedule-pause-deadline"
+			}]);
+		case "downstream-resumed":
+			if (state.phase !== "downstream-paused") throw new Error("Gateway runtime client read can only resume from a downstream pause.");
+			return transitionClientRead({
+				...state,
+				phase: "flowing"
+			}, [{ kind: "cancel-pause-deadline" }, { kind: "resume-socket-read" }]);
+		case "pause-deadline-expired":
+			if (state.phase !== "downstream-paused") throw new Error("Gateway runtime pause deadline expired without a downstream pause.");
+			return enterDiscardDraining(state);
+		case "attachment-retired":
+		case "local-cancel":
+		case "local-close":
+			if (state.phase === "downstream-paused") return enterDiscardDraining(state);
+			if (state.phase === "completed") return transitionClientRead(state);
+			return transitionClientRead({
+				...state,
+				phase: "discard-draining"
+			});
+		case "frame-received": {
+			if (state.phase === "completed") return transitionClientRead(state);
+			const frame = event.frame;
+			if (state.phase === "discard-draining" && frame.kind === "stream-data" && frame.streamId === state.streamId) return transitionClientRead(state, [{
+				kind: "discard-stream-data",
+				streamId: state.streamId
+			}]);
+			if (state.phase === "discard-draining" && frame.kind === "authoritative-stream-terminal" && frame.streamId === state.streamId) return transitionClientRead({
+				...state,
+				phase: "completed"
+			}, [{
+				frame,
+				kind: "forward-frame"
+			}, {
+				kind: "complete-stream",
+				outcome: frame.outcome,
+				streamId: state.streamId
+			}]);
+			return transitionClientRead(state, [{
+				frame,
+				kind: "forward-frame"
+			}]);
+		}
+	}
+	return assertUnreachable(event);
+}
+//#endregion
+//#region src/gateway-runtime-client/gateway-runtime-socket-read-flow.ts
+const defaultPauseDeadlineScheduler = { schedule: ({ afterMilliseconds, onDeadline }) => {
+	const timeout = setTimeout(onDeadline, afterMilliseconds);
+	return { cancel: () => clearTimeout(timeout) };
+} };
+/** Apply bounded per-stream discard state to one globally paused UDS reader. */
+var GatewayRuntimeSocketReadFlow = class {
+	#deadlineScheduler;
+	#forwardFrame;
+	#onStreamCompleted;
+	#pauseDeadlineMilliseconds;
+	#socket;
+	#streamStates = /* @__PURE__ */ new Map();
+	#activePauseDeadline;
+	#pausedStreamId;
+	constructor(options) {
+		this.#deadlineScheduler = options.deadlineScheduler ?? defaultPauseDeadlineScheduler;
+		this.#forwardFrame = options.forwardFrame;
+		this.#onStreamCompleted = options.onStreamCompleted;
+		this.#pauseDeadlineMilliseconds = options.pauseDeadlineMilliseconds;
+		this.#socket = options.socket;
+	}
+	#createStreamState(streamId) {
+		return createGatewayRuntimeClientReadState({
+			pauseDeadlineMilliseconds: this.#pauseDeadlineMilliseconds,
+			streamId
+		});
+	}
+	#applyEffects(streamId, effects) {
+		for (const effect of effects) switch (effect.kind) {
+			case "pause-socket-read":
+				this.#socket.pause();
+				this.#pausedStreamId = streamId;
+				break;
+			case "resume-socket-read":
+				this.#socket.resume();
+				if (this.#pausedStreamId === streamId) this.#pausedStreamId = void 0;
+				break;
+			case "schedule-pause-deadline":
+				this.#activePauseDeadline = this.#deadlineScheduler.schedule({
+					afterMilliseconds: effect.afterMilliseconds,
+					onDeadline: () => this.#transitionStream(streamId, { kind: "pause-deadline-expired" })
+				});
+				break;
+			case "cancel-pause-deadline":
+				this.#activePauseDeadline?.cancel();
+				this.#activePauseDeadline = void 0;
+				break;
+			case "discard-stream-data": break;
+			case "forward-frame":
+				this.#forwardFrame(effect.frame);
+				break;
+			case "complete-stream":
+				this.#onStreamCompleted({
+					outcome: effect.outcome,
+					streamId: effect.streamId
+				});
+				break;
+		}
+	}
+	#transitionStream(streamId, event) {
+		const transition = reduceGatewayRuntimeClientReadState(this.#streamStates.get(streamId) ?? this.#createStreamState(streamId), event);
+		this.#streamStates.set(streamId, transition.state);
+		this.#applyEffects(streamId, transition.effects);
+		if (transition.state.phase === "completed") this.#streamStates.delete(streamId);
+	}
+	applyDownstreamPressure(streamId) {
+		if (this.#pausedStreamId !== void 0 && this.#pausedStreamId !== streamId) throw new Error(`Gateway runtime socket is already paused for stream '${this.#pausedStreamId}'.`);
+		this.#transitionStream(streamId, { kind: "downstream-pressure" });
+	}
+	resumeDownstream(streamId) {
+		this.#transitionStream(streamId, { kind: "downstream-resumed" });
+	}
+	cancelStream(streamId) {
+		this.#transitionStream(streamId, { kind: "local-cancel" });
+	}
+	closeStream(streamId) {
+		this.#transitionStream(streamId, { kind: "local-close" });
+	}
+	retireAttachment(streamId) {
+		this.#transitionStream(streamId, { kind: "attachment-retired" });
+	}
+	receiveFrame(frame) {
+		if (frame.kind === "control") {
+			this.#forwardFrame(frame);
+			return;
+		}
+		if (this.#streamStates.get(frame.streamId) === void 0) {
+			this.#forwardFrame(frame);
+			return;
+		}
+		this.#transitionStream(frame.streamId, {
+			frame,
+			kind: "frame-received"
+		});
+	}
+};
+//#endregion
+//#region src/gateway-runtime-client/index.ts
+const DEFAULT_GATEWAY_RUNTIME_SOCKET_PATH = "/run/agent-vm/gateway-runtime/managed-plugin.sock";
+var GatewayRuntimeClientError = class extends Error {
+	code;
+	constructor(code, message, options = {}) {
+		super(message, options);
+		this.name = "GatewayRuntimeClientError";
+		this.code = code;
+	}
+};
+function resolveStartupRetryPolicy(override) {
+	const policy = {
+		...DEFAULT_GATEWAY_RUNTIME_STARTUP_RETRY_POLICY,
+		...override
+	};
+	if (!Number.isSafeInteger(policy.deadlineMs) || policy.deadlineMs <= 0 || !Number.isSafeInteger(policy.intervalMs) || policy.intervalMs <= 0 || !Number.isSafeInteger(policy.maxAttempts) || policy.maxAttempts <= 0 || policy.deadlineMs > 6e4 || policy.maxAttempts > 1e3 || policy.intervalMs > policy.deadlineMs) throw new GatewayRuntimeClientError("invalid-startup-retry-policy", "Gateway runtime startup retry policy must contain positive bounded integers.");
+	return Object.freeze(policy);
+}
+function startupAbortedError(reason) {
+	return new GatewayRuntimeClientError("startup-aborted", "Gateway runtime startup was aborted.", reason instanceof Error ? { cause: reason } : {});
+}
+function startupRetryExhaustedError(props) {
+	return new GatewayRuntimeClientError("startup-retry-exhausted", `Gateway runtime startup retry was exhausted after ${props.attempts} attempts.`, props.cause === void 0 ? {} : { cause: props.cause });
+}
+const publicAuthorityFieldNames = [
+	"allowedOperationGroups",
+	"authority",
+	"operationGroups",
+	"principal",
+	"surface"
+];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateAttachmentMetadata(attachment) {
+	if (!isRecord(attachment)) throw new GatewayRuntimeClientError("invalid-attachment", "Gateway runtime attachment metadata must be an object.");
+	if (publicAuthorityFieldNames.some((fieldName) => Object.hasOwn(attachment, fieldName))) throw new GatewayRuntimeClientError("public-authority-injection", "Gateway runtime attachment metadata cannot carry server-derived authority.");
+	const parsedAttachment = GatewayRuntimeAttachmentMetadataSchema.safeParse(attachment);
+	if (!parsedAttachment.success) throw new GatewayRuntimeClientError("invalid-attachment", "Gateway runtime attachment metadata is invalid.", { cause: parsedAttachment.error });
+	Object.freeze(parsedAttachment.data.configuredAgentIds);
+	return Object.freeze(parsedAttachment.data);
+}
+function createGatewayRuntimeRequestParams(props) {
+	return {
+		publicRequest: props.publicRequest,
+		trustedContext: GatewayRuntimeTrustedInvocationContextSchema.parse(props.trustedContext)
+	};
+}
+function gatewayRuntimeRequestOptions(options) {
+	return {
+		...options.signal === void 0 ? {} : { signal: options.signal },
+		...options.traceContext === void 0 ? {} : { traceContext: options.traceContext }
+	};
+}
+var GatewayRuntimePortalOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async list(request, options) {
+		const validatedRequest = PortalListRequestSchema.parse(request);
+		const result = await this.#client.request("portal.list", createGatewayRuntimeRequestParams({
+			publicRequest: validatedRequest,
+			trustedContext: options.trustedContext
+		}), gatewayRuntimeRequestOptions(options));
+		return PortalListResultSchema.parse(result);
+	}
+	async search(request, options) {
+		const validatedRequest = PortalSearchRequestSchema.parse(request);
+		const result = await this.#client.request("portal.search", createGatewayRuntimeRequestParams({
+			publicRequest: validatedRequest,
+			trustedContext: options.trustedContext
+		}), gatewayRuntimeRequestOptions(options));
+		return PortalSearchResultSchema.parse(result);
+	}
+	async describe(request, options) {
+		const validatedRequest = PortalDescribeRequestSchema.parse(request);
+		const result = await this.#client.request("portal.describe", createGatewayRuntimeRequestParams({
+			publicRequest: validatedRequest,
+			trustedContext: options.trustedContext
+		}), gatewayRuntimeRequestOptions(options));
+		return PortalDescribeResultSchema.parse(result);
+	}
+	async call(request, options) {
+		const validatedRequest = PortalCallRequestSchema.parse(request);
+		const result = await this.#client.request("portal.call", createGatewayRuntimeRequestParams({
+			publicRequest: validatedRequest,
+			trustedContext: options.trustedContext
+		}), gatewayRuntimeRequestOptions(options));
+		return PortalCallResultSchema.parse(result);
+	}
+};
+var GatewayRuntimeArtifactOperations = class {
+	#client;
+	constructor(client) {
+		this.#client = client;
+	}
+	async read(request, options) {
+		const validatedRequest = PortalArtifactReadRequestSchema.parse(request);
+		const result = await this.#client.request("artifact.read", createGatewayRuntimeRequestParams({
+			publicRequest: validatedRequest,
+			trustedContext: options.trustedContext
+		}), gatewayRuntimeRequestOptions(options));
+		return PortalArtifactReadResultSchema.parse(result);
+	}
+};
+/** Rich private-UDS client for one current managed-framework attachment. */
+var GatewayRuntimeClient = class {
+	#attachment;
+	#socketPath;
+	#startupRetryPolicy;
+	#startupRetryScheduler;
+	#traceContextProvider;
+	#transportFactory;
+	#connection;
+	#connecting = false;
+	#handshakeComplete = false;
+	artifacts;
+	portal;
+	sandbox;
+	constructor(options) {
+		this.#attachment = validateAttachmentMetadata(options.attachment);
+		this.#socketPath = options.socketPath ?? "/run/agent-vm/gateway-runtime/managed-plugin.sock";
+		this.#startupRetryPolicy = resolveStartupRetryPolicy(options.startupRetryPolicy);
+		this.#startupRetryScheduler = options.startupRetryScheduler ?? defaultGatewayRuntimeStartupRetryScheduler;
+		this.#traceContextProvider = options.traceContextProvider;
+		this.#transportFactory = options.transportFactory ?? createNodeGatewayRuntimeTransportFactory();
+		this.artifacts = new GatewayRuntimeArtifactOperations(this);
+		this.portal = new GatewayRuntimePortalOperations(this);
+		this.sandbox = Object.freeze(new GatewayRuntimeSandboxOperations(this));
+	}
+	async #connectOnce(props) {
+		const remainingMs = Math.max(1, props.deadlineAtMs - this.#startupRetryScheduler.now());
+		const attemptCancellation = new AbortController();
+		let deadlineExpired = false;
+		const deadline = setTimeout(() => {
+			deadlineExpired = true;
+			attemptCancellation.abort(/* @__PURE__ */ new Error("Gateway runtime startup deadline expired."));
+		}, remainingMs);
+		const abortAttempt = () => attemptCancellation.abort(props.signal.reason);
+		props.signal.addEventListener("abort", abortAttempt, { once: true });
+		if (props.signal.aborted) abortAttempt();
+		let connection;
+		try {
+			connection = await this.#transportFactory.connect({
+				signal: attemptCancellation.signal,
+				socketPath: this.#socketPath
+			});
+			await connection.handshake(this.#attachment, { signal: attemptCancellation.signal });
+			return connection;
+		} catch (error) {
+			if (connection !== void 0) await connection.close();
+			if (props.signal.aborted) throw startupAbortedError(props.signal.reason);
+			if (deadlineExpired) throw startupRetryExhaustedError({
+				attempts: props.attemptNumber,
+				...error instanceof Error ? { cause: error } : {}
+			});
+			throw error;
+		} finally {
+			clearTimeout(deadline);
+			props.signal.removeEventListener("abort", abortAttempt);
+		}
+	}
+	async #connectWithStartupRetry(props) {
+		const attemptNumber = props.attemptsCompleted + 1;
+		let unavailableError;
+		try {
+			return await this.#connectOnce({
+				attemptNumber,
+				deadlineAtMs: props.deadlineAtMs,
+				signal: props.signal
+			});
+		} catch (error) {
+			if (error instanceof GatewayRuntimeClientError) throw error;
+			if (!(error instanceof GatewayRuntimeStartupUnavailableError)) throw error;
+			unavailableError = error;
+		}
+		const remainingMs = props.deadlineAtMs - this.#startupRetryScheduler.now();
+		if (attemptNumber >= this.#startupRetryPolicy.maxAttempts || remainingMs <= 0) throw startupRetryExhaustedError({
+			attempts: attemptNumber,
+			cause: unavailableError
+		});
+		try {
+			await this.#startupRetryScheduler.wait(Math.min(this.#startupRetryPolicy.intervalMs, remainingMs), props.signal);
+		} catch (error) {
+			if (props.signal.aborted) throw startupAbortedError(props.signal.reason);
+			throw error;
+		}
+		if (this.#startupRetryScheduler.now() >= props.deadlineAtMs) throw startupRetryExhaustedError({
+			attempts: attemptNumber,
+			cause: unavailableError
+		});
+		return await this.#connectWithStartupRetry({
+			attemptsCompleted: attemptNumber,
+			deadlineAtMs: props.deadlineAtMs,
+			signal: props.signal
+		});
+	}
+	async connect(options = {}) {
+		if (this.#connection !== void 0 || this.#connecting) throw new GatewayRuntimeClientError("already-connected", "Gateway runtime client already has a connection.");
+		const signal = options.signal ?? new AbortController().signal;
+		if (signal.aborted) throw startupAbortedError(signal.reason);
+		this.#connecting = true;
+		const deadlineAtMs = this.#startupRetryScheduler.now() + this.#startupRetryPolicy.deadlineMs;
+		try {
+			const connection = await this.#connectWithStartupRetry({
+				attemptsCompleted: 0,
+				deadlineAtMs,
+				signal
+			});
+			this.#connection = connection;
+			this.#handshakeComplete = true;
+		} finally {
+			this.#connecting = false;
+		}
+	}
+	async disconnect() {
+		const connection = this.#connection;
+		this.#connection = void 0;
+		this.#handshakeComplete = false;
+		if (connection !== void 0) await connection.close();
+	}
+	async reconnect(options = {}) {
+		if (this.#connecting) throw new GatewayRuntimeClientError("already-connected", "Gateway runtime client already has a connection attempt in progress.");
+		this.#connecting = true;
+		try {
+			await this.disconnect();
+			const signal = options.signal ?? new AbortController().signal;
+			if (signal.aborted) throw startupAbortedError(signal.reason);
+			const connection = await this.#connectOnce({
+				attemptNumber: 1,
+				deadlineAtMs: this.#startupRetryScheduler.now() + this.#startupRetryPolicy.deadlineMs,
+				signal
+			});
+			this.#connection = connection;
+			this.#handshakeComplete = true;
+		} finally {
+			this.#connecting = false;
+		}
+	}
+	async request(method, params, options = {}) {
+		if (!this.#handshakeComplete || this.#connection === void 0) throw new GatewayRuntimeClientError("handshake-required", "Gateway runtime attachment handshake must complete before method calls.");
+		const transportOptions = options.signal === void 0 ? {} : { signal: options.signal };
+		const providedTraceContext = options.traceContext ?? this.#traceContextProvider?.();
+		if (providedTraceContext === void 0) return await this.#connection.request(method, params, transportOptions);
+		if (!isRecord(params)) throw new GatewayRuntimeClientError("invalid-request-metadata", "Gateway runtime trace context requires object request parameters.");
+		const traceContext = GatewayRuntimeTraceContextSchema.parse(providedTraceContext);
+		return await this.#connection.request(method, {
+			...params,
+			traceContext
+		}, transportOptions);
+	}
+};
+//#endregion
+export { DEFAULT_GATEWAY_RUNTIME_FRAME_LIMITS, DEFAULT_GATEWAY_RUNTIME_SOCKET_PATH, DEFAULT_GATEWAY_RUNTIME_STARTUP_RETRY_POLICY, GATEWAY_RUNTIME_REQUEST_CANCEL_NOTIFICATION_METHOD, GATEWAY_RUNTIME_TRACEPARENT_MAX_LENGTH, GATEWAY_RUNTIME_TRACESTATE_MAX_LENGTH, GATEWAY_RUNTIME_TRACESTATE_MAX_MEMBERS, GatewayRuntimeClient, GatewayRuntimeClientError, GatewayRuntimeFrameDecoder, GatewayRuntimeProtocolError, GatewayRuntimeRemoteError, GatewayRuntimeSandboxEnvironmentOperations, GatewayRuntimeSandboxExecutionOperations, GatewayRuntimeSandboxFilesystemOperations, GatewayRuntimeSandboxOperations, GatewayRuntimeSandboxProcessOperations, GatewayRuntimeSandboxRetainedResultOperations, GatewayRuntimeSandboxStreamOperations, GatewayRuntimeSandboxTerminalOperations, GatewayRuntimeSocketReadFlow, GatewayRuntimeStartupUnavailableError, GatewayRuntimeTraceContextSchema, GatewayRuntimeTrustedInvocationContextSchema, GatewayRuntimeTrustedInvocationCorrelationSchema, GatewayRuntimeTrustedInvocationPrincipalSchema, GatewayRuntimeTrustedInvocationRequesterSchema, NodeGatewayRuntimeTransportError, createGatewayRuntimeChunkSenderState, createGatewayRuntimeClientReadState, createNodeGatewayRuntimeTransportFactory, encodeGatewayRuntimeFrame, reduceGatewayRuntimeChunkSenderState, reduceGatewayRuntimeClientReadState };
+
+//# sourceMappingURL=index.js.map