@agimon-ai/po-core 0.0.0-alpha.0

package/dist/apiContracts.cjs

@@ -0,0 +1,2094 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let typebox = require("typebox");
+let typebox_value = require("typebox/value");
+let _earendil_works_pi_protocol = require("@earendil-works/pi-protocol");
+let _earendil_works_chord = require("@earendil-works/chord");
+//#region src/schemas/apiContracts.ts
+const DOOM_API_CONTRACT_VERSION = 1;
+const DOOM_API_CONTRACT_FILE = "contracts.json";
+const Schema = typebox.Type.Unsafe(typebox.Type.Union([typebox.Type.Boolean(), typebox.Type.Record(typebox.Type.String(), typebox.Type.Unknown())]));
+const Scope = typebox.Type.Union([
+	typebox.Type.Literal("global"),
+	typebox.Type.Literal("workspace"),
+	typebox.Type.Literal("session")
+]);
+const Named = typebox.Type.String({ minLength: 1 });
+const ResponseSchema = typebox.Type.Object({
+	description: Named,
+	contentType: typebox.Type.Optional(Named),
+	schema: typebox.Type.Optional(Schema),
+	events: typebox.Type.Optional(typebox.Type.Record(Named, Schema))
+});
+/** Data-only package entry. Schemas use JSON Schema draft-07, including TypeBox output; OpenAPI export translates tuple keywords. */
+const DoomApiContractSchema = typebox.Type.Object({
+	version: typebox.Type.Literal(1),
+	protocols: typebox.Type.Optional(typebox.Type.Record(Named, Named)),
+	schemas: typebox.Type.Optional(typebox.Type.Record(Named, Schema)),
+	http: typebox.Type.Array(typebox.Type.Object({
+		id: Named,
+		scope: Scope,
+		/** Omit for host-owned absolute routes. */
+		basePath: typebox.Type.Optional(typebox.Type.String({ pattern: "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$" })),
+		path: typebox.Type.String({ pattern: "^/" }),
+		method: typebox.Type.Union([
+			typebox.Type.Literal("GET"),
+			typebox.Type.Literal("POST"),
+			typebox.Type.Literal("PUT"),
+			typebox.Type.Literal("PATCH"),
+			typebox.Type.Literal("DELETE"),
+			typebox.Type.Literal("HEAD"),
+			typebox.Type.Literal("OPTIONS")
+		]),
+		description: Named,
+		availability: typebox.Type.Optional(Named),
+		authentication: typebox.Type.Union([
+			typebox.Type.Literal("none"),
+			typebox.Type.Literal("owner"),
+			typebox.Type.Literal("device")
+		]),
+		parameters: typebox.Type.Optional(typebox.Type.Array(typebox.Type.Object({
+			name: Named,
+			in: typebox.Type.Union([
+				typebox.Type.Literal("path"),
+				typebox.Type.Literal("query"),
+				typebox.Type.Literal("header")
+			]),
+			required: typebox.Type.Boolean(),
+			schema: Schema
+		}))),
+		body: typebox.Type.Optional(typebox.Type.Object({
+			contentType: Named,
+			contentTypes: typebox.Type.Optional(typebox.Type.Array(Named, { minItems: 1 })),
+			required: typebox.Type.Boolean(),
+			schema: Schema
+		})),
+		responses: typebox.Type.Record(typebox.Type.String({ pattern: "^(?:[1-5][0-9]{2}|default)$" }), ResponseSchema, { minProperties: 1 })
+	})),
+	sockets: typebox.Type.Array(typebox.Type.Object({
+		id: Named,
+		scope: Scope,
+		description: Named,
+		availability: typebox.Type.Optional(Named),
+		service: Named,
+		member: Named,
+		direction: typebox.Type.Union([typebox.Type.Literal("client-to-server"), typebox.Type.Literal("server-to-client")]),
+		kind: typebox.Type.Union([
+			typebox.Type.Literal("method"),
+			typebox.Type.Literal("state"),
+			typebox.Type.Literal("channel")
+		]),
+		input: Schema,
+		output: typebox.Type.Optional(Schema),
+		errors: typebox.Type.Optional(Schema)
+	})),
+	/** Explicitly enumerate dynamic values whose shape is supplied at runtime. */
+	dynamic: typebox.Type.Array(typebox.Type.String({ minLength: 1 })),
+	gaps: typebox.Type.Optional(typebox.Type.Array(Named))
+});
+function defineApiContract(contract) {
+	return contract;
+}
+function parseApiContract(value) {
+	if (!(0, typebox_value.Check)(DoomApiContractSchema, value)) throw new Error("Invalid Po API contract");
+	const contract = value;
+	const ids = /* @__PURE__ */ new Set();
+	for (const entry of [...contract.http, ...contract.sockets]) {
+		const key = `${entry.scope}:${entry.id}`;
+		if (ids.has(key)) throw new Error(`Duplicate API contract operation: ${key}`);
+		ids.add(key);
+	}
+	const visit = (item, ancestors) => {
+		if (item === null || typeof item === "string" || typeof item === "boolean") return;
+		if (typeof item === "number" && Number.isFinite(item)) return;
+		if (typeof item !== "object" || ancestors.has(item)) throw new Error("API contracts must contain finite JSON data");
+		ancestors.add(item);
+		for (const child of Object.values(item)) visit(child, ancestors);
+		ancestors.delete(item);
+	};
+	visit(contract, /* @__PURE__ */ new Set());
+	return contract;
+}
+function parseCompiledContracts(value) {
+	const PackageSchema = typebox.Type.Object({
+		packageName: Named,
+		packageVersion: Named,
+		scopes: typebox.Type.Array(Scope, { uniqueItems: true }),
+		owners: typebox.Type.Array(typebox.Type.Object({
+			majorMode: Named,
+			layer: Named
+		}), { minItems: 1 }),
+		contract: typebox.Type.Optional(DoomApiContractSchema),
+		problem: typebox.Type.Optional(Named),
+		module: typebox.Type.Optional(typebox.Type.String({ pattern: "^\\./[^\\\\%?#]+$" }))
+	});
+	const CompiledSchema = typebox.Type.Object({
+		version: typebox.Type.Literal(1),
+		generation: Named,
+		fingerprint: typebox.Type.String({ pattern: "^[a-f0-9]{64}$" }),
+		packages: typebox.Type.Array(PackageSchema)
+	});
+	if (!(0, typebox_value.Check)(CompiledSchema, value)) throw new Error("Invalid compiled API contracts");
+	const data = value;
+	const names = /* @__PURE__ */ new Set();
+	for (const entry of data.packages) {
+		if (names.has(entry.packageName) || entry.module?.split("/").includes("..")) throw new Error("Invalid compiled package contract");
+		names.add(entry.packageName);
+		if (entry.contract !== void 0) parseApiContract(entry.contract);
+	}
+	return data;
+}
+//#endregion
+//#region src/services/apiContracts/index.ts
+/** Stable bytes for diffs and hashes, independent of object insertion order. */
+function canonicalContractJson(value) {
+	const ordered = (item) => {
+		if (Array.isArray(item)) return item.map(ordered);
+		if (item !== null && typeof item === "object") return Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b, "en")).map(([key, child]) => [key, ordered(child)]));
+		return item;
+	};
+	return `${JSON.stringify(ordered(value), null, 2)}\n`;
+}
+const componentName = (value) => value.replace(/[^a-zA-Z0-9.-]/gu, (character) => `_${character.codePointAt(0).toString(16)}_`);
+const pluginPrefix = (scope) => scope === "global" ? "/api/plugins" : scope === "workspace" ? "/api/workspaces/{workspaceId}/plugins" : "/api/workspaces/{workspaceId}/sessions/{sessionId}/plugins";
+/** Compose declarations only. No handlers, lifecycle hooks, or platform resources are loaded. */
+function createApiDocuments(selections) {
+	const paths = {};
+	const schemas = {};
+	const messages = {};
+	const operations = {};
+	const channelMessages = {
+		global: {},
+		workspace: {},
+		session: {}
+	};
+	const manifest = {
+		version: 1,
+		complete: true,
+		protocols: {},
+		selections: [],
+		packages: [],
+		gaps: [],
+		dynamic: []
+	};
+	const socketAddresses = /* @__PURE__ */ new Set();
+	const schema = (id, value) => {
+		const name = componentName(id);
+		if (schemas[name] !== void 0) throw new Error(`Conflicting schema: ${id}`);
+		const relocate = (child) => {
+			if (Array.isArray(child)) return child.map(relocate);
+			if (child === null || typeof child !== "object") return child;
+			return Object.fromEntries(Object.entries(child).map(([key, entry]) => {
+				if (key === "$id") throw new Error(`Schema ${id} must use local references, not $id`);
+				if (key === "$ref" && typeof entry === "string") {
+					if (!entry.startsWith("#/")) throw new Error(`Unresolved schema reference in ${id}: ${entry}`);
+					return [key, `#/components/schemas/${name}${entry.slice(1)}`];
+				}
+				return [key, relocate(entry)];
+			}));
+		};
+		schemas[name] = relocate(value);
+		return { $ref: `#/components/schemas/${name}` };
+	};
+	for (const selected of [...selections].sort((a, b) => a.scope.localeCompare(b.scope))) {
+		manifest.selections.push({
+			scope: selected.scope,
+			majorMode: selected.majorMode,
+			activeLayers: [...selected.activeLayers].sort(),
+			generation: selected.compiled.generation,
+			fingerprint: selected.compiled.fingerprint
+		});
+		for (const entry of [...selected.compiled.packages].sort((a, b) => a.packageName.localeCompare(b.packageName))) {
+			if (!entry.scopes.includes(selected.scope) || !entry.owners.some((owner) => owner.majorMode === selected.majorMode && (owner.layer === "default" || selected.activeLayers.includes(owner.layer)))) continue;
+			manifest.packages.push({
+				name: entry.packageName,
+				version: entry.packageVersion,
+				scope: selected.scope
+			});
+			if (!entry.contract || entry.problem) {
+				manifest.gaps.push({
+					packageName: entry.packageName,
+					scope: selected.scope,
+					reason: entry.problem ?? "No contract declaration"
+				});
+				continue;
+			}
+			const contract = parseApiContract(entry.contract);
+			for (const [name, value] of Object.entries(contract.schemas ?? {})) schema(`${entry.packageName}.${selected.scope}.${name}`, value);
+			for (const [name, version] of Object.entries(contract.protocols ?? {})) {
+				if (manifest.protocols[name] !== void 0 && manifest.protocols[name] !== version) throw new Error(`Conflicting ${name} protocol versions`);
+				manifest.protocols[name] = version;
+			}
+			manifest.gaps.push(...(contract.gaps ?? []).map((reason) => ({
+				packageName: entry.packageName,
+				scope: selected.scope,
+				reason
+			})));
+			manifest.dynamic.push(...contract.dynamic.map((value) => `${entry.packageName}: ${value}`));
+			for (const route of contract.http.filter((route) => route.scope === selected.scope)) {
+				const id = `${entry.packageName}.${route.scope}.${route.id}`;
+				const pathname = `${route.basePath === void 0 ? "" : route.basePath === "settings" ? `${route.scope === "global" ? "/api" : "/api/workspaces/{workspaceId}"}/settings` : `${pluginPrefix(route.scope)}/${route.basePath}`}${route.path === "/" ? "" : route.path}`;
+				const method = route.method.toLowerCase();
+				const path = paths[pathname] ??= {};
+				if (path[method]) throw new Error(`Conflicting HTTP contract: ${route.method} ${pathname}`);
+				const parameters = (route.parameters ?? []).map((parameter) => ({
+					...parameter,
+					schema: schema(`${id}.${parameter.in}.${parameter.name}`, parameter.schema)
+				}));
+				for (const match of pathname.matchAll(/\{([^}]+)\}/gu)) if (!parameters.some((parameter) => parameter.in === "path" && parameter.name === match[1])) parameters.push({
+					name: match[1],
+					in: "path",
+					required: true,
+					schema: schema(`${id}.path.${match[1]}`, {
+						type: "string",
+						minLength: 1
+					})
+				});
+				path[method] = {
+					operationId: componentName(id),
+					description: route.description,
+					parameters,
+					security: route.authentication === "none" ? [] : [{ [route.authentication]: [] }],
+					"x-po": {
+						packageName: entry.packageName,
+						scope: route.scope,
+						...route.availability ? { availability: route.availability } : {}
+					},
+					...route.body ? { requestBody: {
+						required: route.body.required,
+						content: Object.fromEntries((route.body.contentTypes ?? [route.body.contentType]).map((mediaType) => [mediaType, { schema: schema(`${id}.body.${mediaType}`, route.body.schema) }]))
+					} } : {},
+					responses: Object.fromEntries(Object.entries(route.responses).map(([status, response]) => [status, {
+						description: response.description,
+						...response.events ? { "x-sse-events": Object.fromEntries(Object.entries(response.events).map(([name, payload]) => [name, schema(`${id}.event.${name}`, payload)])) } : {},
+						...response.schema === void 0 ? {} : { content: { [response.contentType ?? "application/json"]: { schema: schema(`${id}.response.${status}`, response.schema) } } }
+					}]))
+				};
+			}
+			for (const socket of contract.sockets.filter((socket) => socket.scope === selected.scope)) {
+				const address = `${socket.scope}:${socket.direction}:${socket.kind}:${socket.service}:${socket.member}`;
+				if (socketAddresses.has(address)) throw new Error(`Conflicting socket contract: ${address}`);
+				socketAddresses.add(address);
+				for (const channel of socket.scope === "global" ? ["global"] : [socket.scope, "global"]) {
+					const id = componentName(`${entry.packageName}.${socket.scope}.${socket.id}${channel === socket.scope ? "" : ".aggregate"}`);
+					const addMessage = (suffix, payload) => {
+						const name = `${id}.${suffix}`;
+						messages[name] = {
+							name,
+							payload: schema(name, payload)
+						};
+						channelMessages[channel][name] = { $ref: `#/components/messages/${name}` };
+						return `#/channels/${channel}/messages/${name}`;
+					};
+					const request = addMessage("input", socket.input);
+					const replies = socket.output === void 0 ? [] : [{ $ref: addMessage("output", socket.output) }];
+					if (socket.errors !== void 0) replies.push({ $ref: addMessage("error", socket.errors) });
+					operations[id] = {
+						action: socket.direction === "client-to-server" ? "receive" : "send",
+						channel: { $ref: `#/channels/${channel}` },
+						messages: [{ $ref: request }],
+						description: socket.description,
+						...replies.length ? { reply: {
+							channel: { $ref: `#/channels/${channel}` },
+							messages: replies
+						} } : {},
+						"x-po": {
+							service: socket.service,
+							member: socket.member,
+							scope: socket.scope,
+							kind: socket.kind,
+							transportScope: channel,
+							...socket.availability ? { availability: socket.availability } : {}
+						}
+					};
+				}
+			}
+		}
+	}
+	manifest.complete = manifest.gaps.length === 0;
+	manifest.dynamic = [...new Set(manifest.dynamic)].sort();
+	const info = {
+		title: "Po compiled client API",
+		version: "1"
+	};
+	const openapi = {
+		openapi: "3.1.1",
+		info,
+		paths,
+		components: {
+			schemas: openApiSchemas(schemas),
+			securitySchemes: {
+				owner: {
+					type: "apiKey",
+					in: "header",
+					name: "x-po-token"
+				},
+				device: {
+					type: "apiKey",
+					in: "cookie",
+					name: "__Host-po_device",
+					description: "Admitted device credentials and purpose-bound sealed channel; see remote authentication operations."
+				}
+			}
+		}
+	};
+	const asyncapi = {
+		asyncapi: "3.0.0",
+		info,
+		channels: Object.fromEntries(Object.entries(channelMessages).map(([scope, messages]) => [scope, {
+			address: scope === "global" ? "/api/ws" : scope === "workspace" ? "/api/workspaces/{workspaceId}/ws" : "/api/workspaces/{workspaceId}/sessions/{sessionId}/ws",
+			...scope === "global" ? {} : { parameters: {
+				workspaceId: { description: "Admitted workspace identity." },
+				...scope === "session" ? { sessionId: { description: "Session owned by this workspace." } } : {}
+			} },
+			messages,
+			description: "Decoded Pi/Chord values over framed CBOR. The global hub socket aggregates all scopes; workspace and session sockets restrict session access and package calls to their addressed scope. Remote paired-device sockets seal the same bytes."
+		}])),
+		operations,
+		components: {
+			schemas: asyncApiSchemas(schemas),
+			messages
+		}
+	};
+	for (const document of [openapi, asyncapi]) {
+		const visit = (value) => {
+			if (value === null || typeof value !== "object") return;
+			for (const [key, child] of Object.entries(value)) if (key === "$ref" && typeof child === "string") {
+				let target = document;
+				for (const segment of child.slice(2).split("/")) {
+					if (target === null || typeof target !== "object") throw new Error(`Unresolved API reference: ${child}`);
+					target = Reflect.get(target, segment.replace(/~1/gu, "/").replace(/~0/gu, "~"));
+				}
+				if (target === void 0) throw new Error(`Unresolved API reference: ${child}`);
+			} else visit(child);
+		};
+		visit(document);
+	}
+	return {
+		openapi,
+		asyncapi,
+		manifest
+	};
+}
+/** TypeBox uses draft-07 tuple keywords; OpenAPI 3.1 evaluates the 2020-12 vocabulary. */
+function openApiSchemas(value) {
+	if (Array.isArray(value)) return value.map(openApiSchemas);
+	if (value === null || typeof value !== "object") return value;
+	const source = value;
+	const result = {};
+	for (const [key, child] of Object.entries(source)) if (key === "items" && Array.isArray(child)) {
+		if (child.length) result.prefixItems = child.map(openApiSchemas);
+		else {
+			result.items = false;
+			result.maxItems = 0;
+		}
+	} else if (key === "additionalItems" && Array.isArray(source.items)) result.items = openApiSchemas(child);
+	else if (key === "dependencies" && child !== null && typeof child === "object") {
+		const required = {};
+		const schemas = {};
+		for (const [name, dependency] of Object.entries(child)) if (Array.isArray(dependency)) required[name] = dependency;
+		else schemas[name] = openApiSchemas(dependency);
+		if (Object.keys(required).length) result.dependentRequired = required;
+		if (Object.keys(schemas).length) result.dependentSchemas = schemas;
+	} else if (key === "$schema") result.$schema = "https://json-schema.org/draft/2020-12/schema";
+	else result[key] = openApiSchemas(child);
+	return result;
+}
+function asyncApiSchemas(schemas) {
+	const convert = (value) => {
+		if (Array.isArray(value)) return value.map(convert);
+		if (value === null || typeof value !== "object") return value;
+		const result = {};
+		for (const [key, child] of Object.entries(value)) if (key === "$ref" && typeof child === "string") result[key] = child.replace(/^(#\/components\/schemas\/[^/]+)(.*)$/u, "$1/schema$2");
+		else if (key === "items" && Array.isArray(child) && child.length === 0) {
+			result.items = false;
+			result.maxItems = 0;
+		} else result[key] = convert(child);
+		return result;
+	};
+	return Object.fromEntries(Object.entries(schemas).map(([name, schema]) => [name, {
+		schemaFormat: "application/schema+json;version=draft-07",
+		schema: convert(schema)
+	}]));
+}
+//#endregion
+//#region src/constants/contextApi.ts
+/**
+* What one entry in the composition actually is, for a reader who clicked it.
+*
+* The projection prices the composition and stops there: names, owners, and
+* integer counts, small enough to republish whenever the composition changes.
+* The prose and the schema behind a figure are an order of magnitude larger and
+* are wanted one row at a time, so they travel on request instead. This module
+* is the contract both ends of that request share, and it is deliberately free
+* of Node imports so a browser can hold it too.
+*/
+/** Where a host mounts this package's API; the segment after /api/plugins/. */
+const API_BASE_PATH = "context";
+const ITEM_ROUTE = "/item";
+//#endregion
+//#region src/schemas/httpApiContracts.ts
+const Text$2 = typebox.Type.String();
+const Optional$2 = typebox.Type.Optional;
+const Strings$1 = typebox.Type.Array(Text$2);
+const Flag$2 = typebox.Type.Boolean();
+const NumberValue$2 = typebox.Type.Number();
+const ApiErrorSchema = typebox.Type.Object({
+	error: Text$2,
+	hash: Optional$2(Text$2)
+});
+const ApiOkSchema = typebox.Type.Object({ ok: typebox.Type.Literal(true) });
+const Json$2 = typebox.Type.Unknown({ description: "Value whose schema is supplied by the selected runtime contribution." });
+/** Common JSON response construction; status and payload remain explicit at the declaration. */
+function jsonApiResponses(schema, status = 200) {
+	return {
+		[status]: {
+			description: "Successful response",
+			contentType: "application/json",
+			schema
+		},
+		"400": {
+			description: "Invalid request",
+			schema: ApiErrorSchema
+		},
+		"401": {
+			description: "Authentication required",
+			schema: ApiErrorSchema
+		},
+		"403": {
+			description: "Request is not authorized",
+			schema: ApiErrorSchema
+		},
+		"404": {
+			description: "Resource or capability unavailable",
+			schema: ApiErrorSchema
+		},
+		"409": {
+			description: "Conflicting state",
+			schema: ApiErrorSchema
+		},
+		"422": {
+			description: "Invalid operation",
+			schema: ApiErrorSchema
+		},
+		"500": {
+			description: "Host operation failed",
+			schema: ApiErrorSchema
+		},
+		"502": {
+			description: "Provider failed",
+			schema: ApiErrorSchema
+		},
+		"503": {
+			description: "Service unavailable",
+			schema: ApiErrorSchema
+		}
+	};
+}
+const WebCompositionSchema = typebox.Type.Object({
+	id: Text$2,
+	scope: typebox.Type.Union([
+		typebox.Type.Literal("global"),
+		typebox.Type.Literal("workspace"),
+		typebox.Type.Literal("session")
+	]),
+	revision: NumberValue$2,
+	manifestUrl: Text$2,
+	rawAssetBaseUrl: Text$2,
+	verifiedAssetBaseUrl: Text$2,
+	pluginEntries: typebox.Type.Array(typebox.Type.Tuple([Text$2, Text$2])),
+	assetPaths: Strings$1,
+	stylePaths: Strings$1,
+	channels: Strings$1
+});
+const NativeCompositionSchema = typebox.Type.Object({
+	id: Text$2,
+	scope: typebox.Type.Union([
+		typebox.Type.Literal("global"),
+		typebox.Type.Literal("workspace"),
+		typebox.Type.Literal("session")
+	]),
+	revision: NumberValue$2,
+	manifestUrl: Text$2,
+	rawAssetBaseUrl: Text$2,
+	entryPath: Text$2,
+	channels: Strings$1,
+	plugins: Strings$1
+});
+/** A configured template id and the mount whose compositions offer it. */
+const TemplateDecisionSchema = typebox.Type.Object({
+	id: Optional$2(Text$2),
+	mount: typebox.Type.Union([typebox.Type.Object({ scope: typebox.Type.Literal("global") }), typebox.Type.Object({
+		scope: typebox.Type.Literal("workspace"),
+		workspaceId: Text$2
+	})])
+});
+const SessionSummarySchema = typebox.Type.Object({
+	id: Text$2,
+	workspaceId: Optional$2(Text$2),
+	webComposition: Optional$2(WebCompositionSchema),
+	nativeComposition: Optional$2(NativeCompositionSchema),
+	name: Text$2,
+	cwd: Text$2,
+	createdAt: Text$2,
+	updatedAt: Text$2,
+	phase: typebox.Type.Union([
+		typebox.Type.Literal("idle"),
+		typebox.Type.Literal("turn"),
+		typebox.Type.Literal("compaction"),
+		typebox.Type.Literal("retry")
+	]),
+	phaseSince: Text$2,
+	attach: typebox.Type.Literal("attached"),
+	pendingMessageCount: NumberValue$2,
+	everPrompted: Flag$2,
+	awaitingInput: Flag$2,
+	lastSettledAt: Optional$2(Text$2),
+	git: Optional$2(typebox.Type.Object({
+		branch: Text$2,
+		dirty: Flag$2
+	})),
+	profile: Optional$2(typebox.Type.Object({
+		name: Text$2,
+		displayName: Optional$2(Text$2),
+		iconVersion: Optional$2(Text$2)
+	})),
+	parentSessionId: Optional$2(Text$2),
+	sessionProvenance: Optional$2(Text$2),
+	/** The line the session's extension published about background work it runs. */
+	activity: Optional$2(typebox.Type.Object({
+		label: Text$2,
+		attention: Optional$2(Flag$2),
+		since: Optional$2(Text$2)
+	})),
+	pendingSetups: Optional$2(typebox.Type.Array(typebox.Type.Object({
+		id: Text$2,
+		name: Text$2,
+		createdAt: Text$2,
+		cwd: Optional$2(Text$2),
+		setupKind: Optional$2(typebox.Type.Union([typebox.Type.Literal("managed-worktree"), typebox.Type.Literal("existing-directory")])),
+		status: Optional$2(typebox.Type.Union([
+			typebox.Type.Literal("provisioning"),
+			typebox.Type.Literal("failed"),
+			typebox.Type.Literal("interrupted")
+		])),
+		errorCode: Optional$2(typebox.Type.Union([typebox.Type.Literal("SESSION_WORKTREE_PROVISION_FAILED"), typebox.Type.Literal("SESSION_UNAVAILABLE")]))
+	}))),
+	/** Present and true for a recorded session the server has not reopened yet. */
+	dormant: Optional$2(Flag$2)
+});
+const HubSnapshotFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("sessions_snapshot"),
+	sessions: typebox.Type.Array(SessionSummarySchema)
+});
+const HubUpsertFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("session_upsert"),
+	session: SessionSummarySchema
+});
+const HubRemovedFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("session_removed"),
+	sessionId: Text$2
+});
+const Workspace = typebox.Type.Object({
+	id: Text$2,
+	root: Text$2,
+	name: Optional$2(Text$2),
+	available: Optional$2(Flag$2)
+});
+const WorkspaceSnapshotFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("workspaces_snapshot"),
+	workspaces: typebox.Type.Array(Workspace)
+});
+const WorkspaceUpsertFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("workspace_upsert"),
+	workspace: Workspace
+});
+const WorkspaceRemovedFrameSchema = typebox.Type.Object({
+	type: typebox.Type.Literal("workspace_removed"),
+	workspaceId: Text$2
+});
+const SavedSession = typebox.Type.Object({
+	id: Text$2,
+	name: Optional$2(Text$2),
+	firstMessage: Text$2,
+	createdAt: Text$2,
+	updatedAt: Text$2,
+	messageCount: NumberValue$2
+});
+const query = (name, schema = Text$2, required = false) => ({
+	name,
+	in: "query",
+	required,
+	schema
+});
+const body = (schema) => ({
+	contentType: "application/json",
+	required: true,
+	schema
+});
+const host = (id, path, method, result, extra = {}) => ({
+	id,
+	path,
+	method,
+	scope: "global",
+	authentication: "owner",
+	description: id,
+	responses: jsonApiResponses(result),
+	...extra
+});
+const Binary = typebox.Type.String({ contentEncoding: "binary" });
+const headlessHttpContracts = [
+	host("health", "/api/health", "GET", typebox.Type.Object({
+		ok: typebox.Type.Literal(true),
+		role: typebox.Type.Literal("hub"),
+		protocol: typebox.Type.Literal(1),
+		sessions: NumberValue$2
+	}), { authentication: "none" }),
+	host("telemetry.browser", "/api/telemetry/browser", "POST", ApiOkSchema, { body: body(typebox.Type.Object({
+		v: typebox.Type.Literal(1),
+		events: typebox.Type.Array(typebox.Type.Object({
+			name: typebox.Type.String({ pattern: "^web\\.browser\\.[a-z_]{1,40}$" }),
+			duration_ms: Optional$2(NumberValue$2),
+			count: Optional$2(NumberValue$2)
+		}), { maxItems: 10 })
+	})) }),
+	host("compositions", "/api/compositions", "GET", typebox.Type.Object({
+		global: Optional$2(WebCompositionSchema),
+		nativeGlobal: Optional$2(NativeCompositionSchema),
+		publicKey: Optional$2(Text$2),
+		shell: Optional$2(typebox.Type.Object({
+			publicKey: Text$2,
+			revision: NumberValue$2
+		})),
+		template: Optional$2(TemplateDecisionSchema),
+		/** The phone app's `native.template` choice, resolved the same way. */
+		nativeTemplate: Optional$2(TemplateDecisionSchema),
+		workspaces: typebox.Type.Array(typebox.Type.Object({
+			id: Text$2,
+			root: Text$2,
+			webComposition: Optional$2(WebCompositionSchema),
+			nativeComposition: Optional$2(NativeCompositionSchema)
+		}))
+	})),
+	host("directories", "/api/directories", "GET", typebox.Type.Object({ directories: Strings$1 }), { parameters: [query("q")] }),
+	host("directories.children", "/api/directories/children", "GET", typebox.Type.Object({
+		path: Text$2,
+		parent: Optional$2(Text$2),
+		directories: Strings$1
+	}), { parameters: [query("path")] }),
+	host("sessions.list", "/api/workspaces/{workspaceId}/sessions", "GET", typebox.Type.Object({ sessions: typebox.Type.Array(SessionSummarySchema) })),
+	host("sessions.create", "/api/workspaces/{workspaceId}/sessions", "POST", typebox.Type.Object({ sessionId: Text$2 }), {
+		body: body(typebox.Type.Object({ name: Optional$2(Text$2) })),
+		responses: jsonApiResponses(typebox.Type.Object({ sessionId: Text$2 }), 201)
+	}),
+	host("sessions.get", "/api/workspaces/{workspaceId}/sessions/{sessionId}", "GET", SessionSummarySchema),
+	host("sessions.delete", "/api/workspaces/{workspaceId}/sessions/{sessionId}", "DELETE", ApiOkSchema),
+	host("sessions.history", "/api/workspaces/{workspaceId}/sessions/{sessionId}/history", "GET", typebox.Type.Object({ sessions: typebox.Type.Array(SavedSession) }), { availability: "Host provides sessionHistory" }),
+	host("sessions.restart", "/api/workspaces/{workspaceId}/sessions/{sessionId}/restart", "POST", ApiOkSchema, { availability: "Host provides restartSession" }),
+	host("sessions.revive", "/api/workspaces/{workspaceId}/sessions/{sessionId}/revive", "POST", ApiOkSchema, { availability: "Host provides reviveSession" }),
+	host("sessions.resume", "/api/workspaces/{workspaceId}/sessions/{sessionId}/resume", "POST", typebox.Type.Object({ sessionId: Text$2 }), {
+		availability: "Host provides resumeSession",
+		body: body(typebox.Type.Object({ targetSessionId: typebox.Type.String({ pattern: "^[A-Za-z0-9_-]+$" }) }))
+	}),
+	host("sessions.file", "/api/workspaces/{workspaceId}/sessions/{sessionId}/file", "GET", Binary, {
+		parameters: [query("path", Text$2, true)],
+		responses: {
+			...jsonApiResponses(Binary),
+			"200": {
+				description: "File bytes, MIME type follows the file extension",
+				contentType: "*/*",
+				schema: Binary
+			}
+		}
+	}),
+	host("sessions.channels", "/api/workspaces/{workspaceId}/sessions/{sessionId}/channels", "GET", typebox.Type.Object({ channels: typebox.Type.Array(typebox.Type.Object({
+		type: Text$2,
+		sessionId: Text$2,
+		payload: Json$2
+	})) })),
+	host("sessions.channel.send", "/api/workspaces/{workspaceId}/sessions/{sessionId}/channel/{frameType}", "POST", ApiOkSchema, {
+		body: body(Json$2),
+		responses: jsonApiResponses(ApiOkSchema, 202),
+		description: "Deliver a payload to the selected channel contract identified by frameType."
+	}),
+	host("workspaces.list", "/api/workspaces", "GET", typebox.Type.Object({ workspaces: typebox.Type.Array(Workspace) })),
+	host("workspaces.admit", "/api/workspaces", "POST", typebox.Type.Object({ workspace: Workspace }), {
+		body: body(typebox.Type.Object({
+			root: Optional$2(Text$2),
+			name: Optional$2(Text$2)
+		})),
+		responses: jsonApiResponses(typebox.Type.Object({ workspace: Workspace }), 201)
+	}),
+	host("workspaces.get", "/api/workspaces/{workspaceId}", "GET", typebox.Type.Object({ workspace: Workspace })),
+	host("workspaces.history", "/api/workspaces/{workspaceId}/history", "GET", typebox.Type.Object({ sessions: typebox.Type.Array(SavedSession) }), { availability: "Host provides workspaceHistory" }),
+	host("workspaces.resume", "/api/workspaces/{workspaceId}/resume", "POST", typebox.Type.Object({ sessionId: Text$2 }), {
+		availability: "Host provides resumeWorkspaceSession",
+		body: body(typebox.Type.Object({ targetSessionId: typebox.Type.String({ pattern: "^[A-Za-z0-9_-]+$" }) }))
+	}),
+	host("workspaces.remove", "/api/workspaces/{workspaceId}", "DELETE", ApiOkSchema),
+	host("events", "/api/events", "GET", Text$2, { responses: {
+		"200": {
+			description: "SSE session and workspace snapshots, membership changes, and selected channel frames. Selected extension channel payloads are defined by the corresponding AsyncAPI channel operations.",
+			events: {
+				sessions_snapshot: HubSnapshotFrameSchema,
+				session_upsert: HubUpsertFrameSchema,
+				session_removed: HubRemovedFrameSchema,
+				workspaces_snapshot: WorkspaceSnapshotFrameSchema,
+				workspace_upsert: WorkspaceUpsertFrameSchema,
+				workspace_removed: WorkspaceRemovedFrameSchema
+			},
+			contentType: "text/event-stream",
+			schema: Text$2
+		},
+		"401": {
+			description: "Authentication required",
+			schema: ApiErrorSchema
+		}
+	} })
+];
+const AuthType = typebox.Type.Union([typebox.Type.Literal("api_key"), typebox.Type.Literal("oauth")]);
+const Provider = typebox.Type.Object({
+	id: Text$2,
+	name: Text$2,
+	methods: typebox.Type.Array(typebox.Type.Object({
+		type: AuthType,
+		label: Text$2
+	})),
+	authenticated: Optional$2(typebox.Type.Object({
+		type: AuthType,
+		source: Optional$2(Text$2)
+	}))
+});
+const LoginEvent = typebox.Type.Union([
+	typebox.Type.Object({
+		type: typebox.Type.Literal("info"),
+		message: Text$2,
+		links: Optional$2(typebox.Type.Array(typebox.Type.Object({
+			url: Text$2,
+			label: Optional$2(Text$2)
+		})))
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("auth_url"),
+		url: Text$2,
+		instructions: Optional$2(Text$2)
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("device_code"),
+		userCode: Text$2,
+		verificationUri: Text$2,
+		intervalSeconds: Optional$2(NumberValue$2),
+		expiresInSeconds: Optional$2(NumberValue$2)
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("progress"),
+		message: Text$2
+	})
+]);
+const LoginFlowSchema = typebox.Type.Object({
+	id: Text$2,
+	providerId: Text$2,
+	providerName: Text$2,
+	type: AuthType,
+	status: typebox.Type.Union([
+		typebox.Type.Literal("running"),
+		typebox.Type.Literal("succeeded"),
+		typebox.Type.Literal("failed"),
+		typebox.Type.Literal("cancelled")
+	]),
+	events: typebox.Type.Array(LoginEvent),
+	prompt: Optional$2(typebox.Type.Object({
+		id: Text$2,
+		type: typebox.Type.Union([
+			typebox.Type.Literal("text"),
+			typebox.Type.Literal("secret"),
+			typebox.Type.Literal("select"),
+			typebox.Type.Literal("manual_code")
+		]),
+		message: Text$2,
+		placeholder: Optional$2(Text$2),
+		options: Optional$2(typebox.Type.Array(typebox.Type.Object({
+			id: Text$2,
+			label: Text$2,
+			description: Optional$2(Text$2)
+		})))
+	})),
+	remote: Optional$2(Flag$2),
+	error: Optional$2(Text$2)
+});
+const Flow = typebox.Type.Object({ flow: LoginFlowSchema });
+const machineHttpContracts = [
+	host("providers.list", "/providers", "GET", typebox.Type.Object({ providers: typebox.Type.Array(Provider) })),
+	host("models.list", "/models", "GET", typebox.Type.Object({ models: typebox.Type.Array(typebox.Type.Object({
+		value: Text$2,
+		label: Text$2,
+		group: Text$2
+	})) })),
+	host("providers.logout", "/providers/{providerId}", "DELETE", ApiOkSchema),
+	host("logins.create", "/logins", "POST", Flow, {
+		body: body(typebox.Type.Object({
+			providerId: Text$2,
+			type: AuthType
+		})),
+		responses: jsonApiResponses(Flow, 201)
+	}),
+	host("logins.get", "/logins/{flowId}", "GET", Flow),
+	host("logins.cancel", "/logins/{flowId}", "DELETE", Flow),
+	host("logins.answer", "/logins/{flowId}/answer", "POST", Flow, { body: body(typebox.Type.Object({
+		promptId: Text$2,
+		value: Text$2
+	})) })
+].map((route) => ({
+	...route,
+	basePath: "po"
+}));
+const Source = typebox.Type.Union([
+	typebox.Type.Literal("extension"),
+	typebox.Type.Literal("mcp"),
+	typebox.Type.Literal("plugin"),
+	typebox.Type.Literal("core")
+]);
+const Detail = typebox.Type.Union([
+	typebox.Type.Object({
+		itemKind: typebox.Type.Literal("tool"),
+		name: Text$2,
+		owner: Text$2,
+		source: Source,
+		active: Flag$2,
+		tokens: typebox.Type.Object({
+			schemaTokens: NumberValue$2,
+			promptTokens: NumberValue$2,
+			totalTokens: NumberValue$2
+		}),
+		description: Optional$2(Text$2),
+		promptSnippet: Optional$2(Text$2),
+		promptGuidelines: Optional$2(Strings$1),
+		parameters: Optional$2(Json$2)
+	}),
+	typebox.Type.Object({
+		itemKind: typebox.Type.Literal("skill"),
+		name: Text$2,
+		owner: Text$2,
+		source: Source,
+		active: typebox.Type.Literal(true),
+		tokens: NumberValue$2,
+		description: Text$2,
+		filePath: Optional$2(Text$2),
+		modelInvocable: Flag$2
+	}),
+	typebox.Type.Object({
+		itemKind: typebox.Type.Literal("prompt"),
+		name: typebox.Type.Literal("system"),
+		tokens: NumberValue$2,
+		stage: typebox.Type.Union([typebox.Type.Literal("base"), typebox.Type.Literal("effective")]),
+		text: Text$2
+	})
+]);
+const sessionHttpContracts = [{
+	...host("context.item", ITEM_ROUTE, "GET", typebox.Type.Object({
+		revision: NumberValue$2,
+		item: Detail
+	}), { parameters: [query("kind", typebox.Type.Union([
+		typebox.Type.Literal("tool"),
+		typebox.Type.Literal("skill"),
+		typebox.Type.Literal("prompt")
+	]), true), query("name", Text$2, true)] }),
+	scope: "session",
+	basePath: API_BASE_PATH
+}, {
+	...host("files.complete", "/", "GET", typebox.Type.Object({ files: Strings$1 }), { parameters: [query("q", typebox.Type.String({ maxLength: 256 }))] }),
+	scope: "session",
+	basePath: "files"
+}];
+//#endregion
+//#region src/schemas/remoteApiContracts.ts
+const Text$1 = typebox.Type.String();
+const NumberValue$1 = typebox.Type.Number();
+const Optional$1 = typebox.Type.Optional;
+const Flag$1 = typebox.Type.Boolean();
+const JsonObject = typebox.Type.Record(Text$1, typebox.Type.Unknown({ description: "WebAuthn ceremony fields supplied and verified by the installed WebAuthn implementation." }));
+const Tunnel = typebox.Type.Union([typebox.Type.Object({ kind: typebox.Type.Literal("quick") }), typebox.Type.Object({
+	kind: typebox.Type.Literal("named"),
+	hostname: Text$1,
+	name: Optional$1(Text$1),
+	tokenFile: Optional$1(Text$1),
+	configFile: Optional$1(Text$1)
+})]);
+const Settings = typebox.Type.Object({
+	autoCloseEnabled: Flag$1,
+	autoCloseMinutes: NumberValue$1,
+	sessionExpiryEnabled: Flag$1,
+	idleMinutes: NumberValue$1,
+	absoluteHours: NumberValue$1,
+	tunnel: Tunnel,
+	sandbox: typebox.Type.Object({
+		enabled: Flag$1,
+		workspaces: typebox.Type.Array(Text$1)
+	})
+});
+const State = typebox.Type.Object({
+	status: typebox.Type.Union([
+		typebox.Type.Literal("off"),
+		typebox.Type.Literal("starting"),
+		typebox.Type.Literal("on"),
+		typebox.Type.Literal("failed")
+	]),
+	publicUrl: Optional$1(Text$1),
+	startedAt: Optional$1(Text$1),
+	closesAt: Optional$1(Text$1),
+	error: Optional$1(Text$1),
+	devices: typebox.Type.Array(typebox.Type.Object({
+		id: Text$1,
+		label: Text$1,
+		userAgent: Text$1,
+		createdAt: Text$1,
+		lastSeenAt: Text$1,
+		self: Flag$1
+	})),
+	pending: typebox.Type.Array(typebox.Type.Object({
+		id: Text$1,
+		userAgent: Text$1,
+		edgeIp: Text$1,
+		createdAt: Text$1,
+		expiresAt: Text$1
+	})),
+	trustedDevices: typebox.Type.Array(typebox.Type.Object({
+		id: Text$1,
+		label: Text$1,
+		platform: typebox.Type.Union([typebox.Type.Literal("ios"), typebox.Type.Literal("android")]),
+		createdAt: Text$1,
+		lastSeenAt: Text$1,
+		self: Flag$1
+	})),
+	settings: Settings
+});
+const StateResponse = typebox.Type.Object({
+	state: State,
+	handingOver: Optional$1(Flag$1)
+});
+const Trust = typebox.Type.Object({
+	publicKey: Text$1,
+	fingerprint: Text$1,
+	revision: NumberValue$1
+});
+const Begun = typebox.Type.Object({
+	ceremonyId: Text$1,
+	options: JsonObject
+});
+const DeviceKeyBegun = typebox.Type.Object({
+	ceremonyId: Text$1,
+	challenge: Text$1,
+	kind: typebox.Type.Literal("device-key")
+});
+const ChannelKeys = typebox.Type.Object({
+	session: Text$1,
+	protocol: Text$1,
+	http: Text$1
+});
+const Finish = typebox.Type.Object({
+	ceremonyId: Text$1,
+	response: JsonObject
+});
+const SealedEnvelopeSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	n: Text$1,
+	c: Text$1
+});
+const SealedHttpRequestSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	method: Text$1,
+	target: Text$1,
+	headers: typebox.Type.Array(typebox.Type.Tuple([Text$1, Text$1])),
+	body: Optional$1(Text$1)
+});
+const SealedHttpResponseSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	status: NumberValue$1,
+	headers: typebox.Type.Array(typebox.Type.Tuple([Text$1, Text$1])),
+	body: Text$1
+});
+const route = (id, path, method, result, input, extra = {}) => ({
+	id: `remote.${id}`,
+	path: `/api/remote${path}`,
+	method,
+	scope: "global",
+	authentication: "owner",
+	description: `Remote Control ${id}.`,
+	availability: "Global host provides Remote Control. Tunnel routes additionally enforce device, origin and step-up policy.",
+	responses: {
+		...jsonApiResponses(result),
+		"429": {
+			description: "Rate limit exceeded",
+			schema: ApiErrorSchema
+		}
+	},
+	...input ? { body: {
+		contentType: "application/json",
+		required: true,
+		schema: input
+	} } : {},
+	...extra
+});
+const direct = [
+	route("state", "", "GET", StateResponse),
+	route("enable", "/enable", "POST", StateResponse, void 0, { responses: {
+		...jsonApiResponses(StateResponse),
+		"202": {
+			description: "Container handover started",
+			schema: StateResponse
+		}
+	} }),
+	route("disable", "/disable", "POST", StateResponse, void 0, { responses: {
+		...jsonApiResponses(StateResponse),
+		"202": {
+			description: "Tunnel closing",
+			schema: typebox.Type.Object({ status: typebox.Type.Literal("closing") })
+		}
+	} }),
+	route("codes", "/codes", "POST", typebox.Type.Object({
+		...Trust.properties,
+		code: Text$1,
+		manualCode: Text$1,
+		pairUrl: Text$1,
+		expiresAt: Text$1
+	}), void 0, { responses: jsonApiResponses(typebox.Type.Object({
+		...Trust.properties,
+		code: Text$1,
+		manualCode: Text$1,
+		pairUrl: Text$1,
+		expiresAt: Text$1
+	}), 201) }),
+	route("approve", "/pairing/{id}/approve", "POST", StateResponse),
+	route("deny", "/pairing/{id}/deny", "POST", StateResponse),
+	route("revoke", "/devices/{id}", "DELETE", StateResponse),
+	route("settings", "/settings", "PUT", typebox.Type.Object({ settings: Settings }), typebox.Type.Partial(Settings)),
+	route("passkeys", "/passkeys", "GET", typebox.Type.Object({
+		support: typebox.Type.Union([typebox.Type.Object({
+			supported: typebox.Type.Literal(true),
+			rpId: Text$1
+		}), typebox.Type.Object({
+			supported: typebox.Type.Literal(false),
+			reason: Text$1
+		})]),
+		credentials: typebox.Type.Array(typebox.Type.Object({
+			id: Text$1,
+			label: Text$1,
+			createdAt: Text$1,
+			lastUsedAt: Text$1
+		}))
+	})),
+	route("passkeys.remove", "/passkeys/{id}", "DELETE", ApiOkSchema),
+	route("register.begin", "/passkeys/register/begin", "POST", Begun, void 0, { authentication: "device" }),
+	route("register.finish", "/passkeys/register/finish", "POST", typebox.Type.Object({ id: Text$1 }), Finish, { authentication: "device" }),
+	route("authenticate.begin", "/passkeys/authenticate/begin", "POST", Begun, void 0, { authentication: "none" }),
+	route("authenticate.finish", "/passkeys/authenticate/finish", "POST", typebox.Type.Object({
+		ok: typebox.Type.Literal(true),
+		hostPublicKey: Text$1
+	}), Finish, { authentication: "none" }),
+	route("challenge", "/challenge", "POST", typebox.Type.Union([Begun, DeviceKeyBegun]), typebox.Type.Object({ action: Text$1 }), { authentication: "device" }),
+	route("trusted-devices.register", "/trusted-devices", "POST", typebox.Type.Object({ trustedDeviceId: Text$1 }), typebox.Type.Object({
+		identityPublicKey: Text$1,
+		stepUpPublicKey: Text$1,
+		label: Text$1,
+		platform: typebox.Type.Union([typebox.Type.Literal("ios"), typebox.Type.Literal("android")]),
+		identityProof: Text$1,
+		stepUpProof: Text$1
+	}), {
+		authentication: "device",
+		description: "Registers a native device from a sealed, QR-approved pairing session.",
+		responses: jsonApiResponses(typebox.Type.Object({ trustedDeviceId: Text$1 }), 201)
+	}),
+	route("trusted-devices.revoke", "/trusted-devices/{id}", "DELETE", StateResponse, void 0, { description: "Revokes a trusted native device. Local callers, or sealed callers with verified step-up." }),
+	route("device-auth.challenge", "/device-auth/challenge", "POST", typebox.Type.Object({
+		challengeId: Text$1,
+		challenge: Text$1,
+		hostPublicKey: Text$1,
+		attestation: Text$1
+	}), typebox.Type.Object({
+		trustedDeviceId: Text$1,
+		nonce: Text$1
+	}), { authentication: "none" }),
+	route("device-auth.authenticate", "/device-auth/authenticate", "POST", typebox.Type.Object({ ok: typebox.Type.Literal(true) }), typebox.Type.Object({
+		challengeId: Text$1,
+		trustedDeviceId: Text$1,
+		signature: Text$1,
+		channels: ChannelKeys
+	}), { authentication: "none" }),
+	route("channel", "/channel", "POST", ApiOkSchema, typebox.Type.Object({
+		clientPublicKey: Text$1,
+		scope: typebox.Type.Union([
+			typebox.Type.Literal("session"),
+			typebox.Type.Literal("protocol"),
+			typebox.Type.Literal("http")
+		])
+	}), { authentication: "device" }),
+	route("request", "/request", "POST", SealedEnvelopeSchema, SealedEnvelopeSchema, {
+		authentication: "device",
+		description: "Sealed HTTP gateway. Decrypted requests/responses use the SealedHttpRequest and SealedHttpResponse envelopes."
+	}),
+	route("pair", "/pair", "POST", typebox.Type.Object({
+		requestId: Text$1,
+		status: typebox.Type.Literal("pending")
+	}), typebox.Type.Object({ code: typebox.Type.String({ minLength: 1 }) }), {
+		authentication: "none",
+		responses: {
+			...jsonApiResponses(typebox.Type.Object({
+				requestId: Text$1,
+				status: typebox.Type.Literal("pending")
+			}), 202),
+			"410": {
+				description: "Pairing code is no longer valid",
+				schema: ApiErrorSchema
+			}
+		}
+	}),
+	route("pair.status", "/pair/status", "GET", typebox.Type.Object({
+		status: typebox.Type.Union([
+			typebox.Type.Literal("pending"),
+			typebox.Type.Literal("approved"),
+			typebox.Type.Literal("denied"),
+			typebox.Type.Literal("expired"),
+			typebox.Type.Literal("consumed")
+		]),
+		bundleTrust: Optional$1(Trust),
+		hostPublicKey: Optional$1(Text$1)
+	}), void 0, {
+		authentication: "none",
+		parameters: [{
+			name: "request",
+			in: "query",
+			required: true,
+			schema: Text$1
+		}]
+	})
+];
+const remoteHttpContracts = [
+	route("frontend", "/frontend", "POST", ApiOkSchema, typebox.Type.Object({ origin: Text$1 }), {
+		authentication: "owner",
+		availability: "Internal loopback frontend registration; blocked by the browser proxy.",
+		parameters: [{
+			name: "x-po-web-registration",
+			in: "header",
+			required: true,
+			schema: Text$1
+		}]
+	}),
+	...direct,
+	...direct.map((operation) => ({
+		...operation,
+		id: `${operation.id}.plugin`,
+		basePath: "remote",
+		path: operation.path.slice(11) || "/",
+		authentication: "owner",
+		availability: "Global Remote Control plugin mount, reached through the authenticated headless listener."
+	})),
+	{
+		id: "remote.pair.page",
+		scope: "global",
+		path: "/pair",
+		method: "GET",
+		authentication: "none",
+		availability: "Remote listener only",
+		description: "Pairing and passkey bootstrap page.",
+		responses: { "200": {
+			description: "Pairing page",
+			contentType: "text/html",
+			schema: Text$1
+		} }
+	}
+];
+const Asset = typebox.Type.Object({
+	path: Text$1,
+	sha256: typebox.Type.String({ pattern: "^[a-f0-9]{64}$" }),
+	byteLength: typebox.Type.Integer({ minimum: 0 }),
+	contentType: Text$1
+});
+const Signed = typebox.Type.Object({
+	manifest: typebox.Type.Object({
+		version: typebox.Type.Literal(2),
+		revision: typebox.Type.Integer({ minimum: 1 }),
+		builtAt: NumberValue$1,
+		assets: typebox.Type.Array(Asset)
+	}),
+	signature: Text$1,
+	publicKey: Text$1
+});
+const bundleHttpContracts = [...["/bundle-manifest.json", "/api/web-plugins/{id}/{revision}/manifest"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `bundle.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an immutable signed browser bundle manifest.",
+	responses: method === "HEAD" ? {
+		"200": { description: "Manifest response headers" },
+		"404": { description: "Bundle not published" }
+	} : jsonApiResponses(Signed)
+}))), ...["/bundle-assets/{revision}/{assetPath}", "/api/web-plugins/{id}/{revision}/assets/{assetPath}"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `asset.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an asset from the signed manifest. assetPath may contain multiple path segments.",
+	responses: {
+		"200": {
+			description: "Manifest-listed asset, original MIME type",
+			...method === "GET" ? {
+				contentType: "*/*",
+				schema: typebox.Type.String({ contentEncoding: "binary" })
+			} : {}
+		},
+		"404": { description: "Asset not published" }
+	}
+})))];
+//#endregion
+//#region src/schemas/sessionProtocol.ts
+const DOOM_SESSION_SERVICE_ID = "po.session.v2";
+const DOOM_SESSION_MANAGEMENT_SERVICE_ID = "po.session-management.v1";
+(0, _earendil_works_chord.defineService)("po.hub.v1");
+(0, _earendil_works_chord.defineService)(DOOM_SESSION_SERVICE_ID);
+(0, _earendil_works_chord.defineService)(DOOM_SESSION_MANAGEMENT_SERVICE_ID);
+//#endregion
+//#region src/schemas/sessionApiContracts.ts
+const Text = typebox.Type.String();
+const NumberValue = typebox.Type.Number();
+const Flag = typebox.Type.Boolean();
+const Json$1 = typebox.Type.Unsafe(typebox.Type.Unknown({ description: "Strict JSON application value supplied by the active tool, journal entry, or extension; validated by the Pi codec." }));
+const Optional = typebox.Type.Optional;
+const Strings = typebox.Type.Array(Text);
+const Model = typebox.Type.Object({
+	provider: Text,
+	id: Text
+});
+const Thinking = typebox.Type.Union([
+	typebox.Type.Literal("off"),
+	typebox.Type.Literal("minimal"),
+	typebox.Type.Literal("low"),
+	typebox.Type.Literal("medium"),
+	typebox.Type.Literal("high"),
+	typebox.Type.Literal("max"),
+	typebox.Type.Literal("xhigh")
+]);
+const Phase = typebox.Type.Union([
+	typebox.Type.Literal("idle"),
+	typebox.Type.Literal("turn"),
+	typebox.Type.Literal("compaction"),
+	typebox.Type.Literal("retry")
+]);
+const Image = typebox.Type.Object({
+	type: typebox.Type.Literal("image"),
+	data: Text,
+	mimeType: Text
+});
+const TextPart = typebox.Type.Object({
+	type: typebox.Type.Literal("text"),
+	text: Text
+});
+const Content = typebox.Type.Union([Image, TextPart]);
+const User = typebox.Type.Object({
+	id: Text,
+	role: typebox.Type.Literal("user"),
+	content: typebox.Type.Array(Content),
+	timestamp: NumberValue
+});
+const Transcript = typebox.Type.Union([
+	User,
+	typebox.Type.Object({
+		id: Text,
+		role: typebox.Type.Literal("assistant"),
+		content: typebox.Type.Array(typebox.Type.Union([
+			TextPart,
+			typebox.Type.Object({
+				type: typebox.Type.Literal("thinking"),
+				thinking: Text,
+				redacted: Optional(typebox.Type.Literal(true))
+			}),
+			typebox.Type.Object({
+				type: typebox.Type.Literal("toolCall"),
+				toolCallId: Text,
+				toolName: Text,
+				input: Json$1
+			})
+		])),
+		model: Model,
+		status: typebox.Type.Union([
+			typebox.Type.Literal("streaming"),
+			typebox.Type.Literal("complete"),
+			typebox.Type.Literal("aborted"),
+			typebox.Type.Literal("error")
+		]),
+		stopReason: Optional(typebox.Type.Union([
+			typebox.Type.Literal("stop"),
+			typebox.Type.Literal("length"),
+			typebox.Type.Literal("toolUse"),
+			typebox.Type.Literal("aborted"),
+			typebox.Type.Literal("error")
+		])),
+		errorMessage: Optional(Text),
+		timestamp: NumberValue
+	}),
+	typebox.Type.Object({
+		id: Text,
+		role: typebox.Type.Literal("tool"),
+		toolCallId: Text,
+		toolName: Text,
+		input: Json$1,
+		content: typebox.Type.Array(Content),
+		details: Optional(Json$1),
+		status: typebox.Type.Union([
+			typebox.Type.Literal("running"),
+			typebox.Type.Literal("complete"),
+			typebox.Type.Literal("error")
+		]),
+		isError: Flag,
+		timestamp: NumberValue
+	})
+]);
+const Usage = typebox.Type.Object({
+	input: NumberValue,
+	output: NumberValue,
+	cacheRead: NumberValue,
+	cacheWrite: NumberValue,
+	total: NumberValue
+});
+const Message = typebox.Type.Object({
+	text: Text,
+	images: Optional(typebox.Type.Array(Image))
+});
+const Lifecycle = typebox.Type.Object({
+	revision: NumberValue,
+	operation: typebox.Type.Union([typebox.Type.Null(), typebox.Type.Object({
+		id: Text,
+		kind: typebox.Type.Union([
+			typebox.Type.Literal("run"),
+			typebox.Type.Literal("compaction"),
+			typebox.Type.Literal("navigation")
+		]),
+		status: typebox.Type.Union([typebox.Type.Literal("open"), typebox.Type.Literal("aborting")])
+	})]),
+	paused: Flag,
+	queue: typebox.Type.Array(typebox.Type.Object({
+		id: Text,
+		text: Text,
+		images: Optional(typebox.Type.Array(Image)),
+		delivery: typebox.Type.Union([
+			typebox.Type.Literal("steer"),
+			typebox.Type.Literal("followUp"),
+			typebox.Type.Literal("nextRun")
+		]),
+		scheduling: typebox.Type.Union([typebox.Type.Literal("automatic"), typebox.Type.Literal("held")]),
+		disposition: typebox.Type.Union([
+			typebox.Type.Literal("pending"),
+			typebox.Type.Literal("handoff"),
+			typebox.Type.Literal("uncertain")
+		])
+	}))
+});
+const Frame = typebox.Type.Intersect([typebox.Type.Object({ type: Text }), typebox.Type.Record(Text, Json$1)], { description: "Discriminated extension presentation frame; selected channel schemas describe package payloads." });
+const HubClientFrame = typebox.Type.Union([
+	typebox.Type.Object({
+		type: typebox.Type.Union([typebox.Type.Literal("subscribe"), typebox.Type.Literal("unsubscribe")]),
+		sessionId: Text
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Union([typebox.Type.Literal("subscribe_thread"), typebox.Type.Literal("unsubscribe_thread")]),
+		sessionId: Text,
+		threadId: Text
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.String({ not: { enum: [
+			"subscribe",
+			"unsubscribe",
+			"subscribe_thread",
+			"unsubscribe_thread"
+		] } }),
+		sessionId: Text,
+		payload: Json$1
+	})
+]);
+const HubServerFrame = typebox.Type.Union([
+	HubSnapshotFrameSchema,
+	HubUpsertFrameSchema,
+	HubRemovedFrameSchema,
+	typebox.Type.Object({
+		type: typebox.Type.Literal("thread_frame"),
+		sessionId: Text,
+		threadId: Text,
+		frame: Frame
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("thread_backlog"),
+		sessionId: Text,
+		threadId: Text,
+		frames: typebox.Type.Array(Frame)
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.String({ not: { enum: [
+			"sessions_snapshot",
+			"session_upsert",
+			"session_removed",
+			"workspaces_snapshot",
+			"workspace_upsert",
+			"workspace_removed",
+			"thread_frame",
+			"thread_backlog"
+		] } }),
+		sessionId: Text,
+		payload: Json$1
+	})
+]);
+const ProtocolEvent = typebox.Type.Object({
+	sequence: NumberValue,
+	frame: Frame
+});
+const Update = typebox.Type.Union([
+	typebox.Type.Object({
+		sessionUpdate: typebox.Type.Union([
+			typebox.Type.Literal("user_message"),
+			typebox.Type.Literal("agent_message"),
+			typebox.Type.Literal("agent_thought")
+		]),
+		messageId: Text,
+		content: typebox.Type.Array(Content)
+	}),
+	typebox.Type.Object({
+		sessionUpdate: typebox.Type.Literal("tool_call_update"),
+		toolCallId: Text,
+		title: Optional(Text),
+		kind: Optional(Text),
+		status: Optional(typebox.Type.Union([
+			typebox.Type.Literal("pending"),
+			typebox.Type.Literal("in_progress"),
+			typebox.Type.Literal("completed"),
+			typebox.Type.Literal("failed"),
+			typebox.Type.Literal("cancelled")
+		])),
+		content: Optional(typebox.Type.Array(typebox.Type.Object({
+			type: typebox.Type.Literal("content"),
+			content: Content
+		}))),
+		rawInput: Optional(Json$1),
+		rawOutput: Optional(Json$1)
+	}),
+	typebox.Type.Object({
+		sessionUpdate: typebox.Type.Literal("state_update"),
+		state: typebox.Type.Union([
+			typebox.Type.Literal("running"),
+			typebox.Type.Literal("idle"),
+			typebox.Type.Literal("requires_action")
+		]),
+		stopReason: Optional(typebox.Type.Union([
+			typebox.Type.Literal("end_turn"),
+			typebox.Type.Literal("max_tokens"),
+			typebox.Type.Literal("max_turn_requests"),
+			typebox.Type.Literal("refusal"),
+			typebox.Type.Literal("cancelled"),
+			typebox.Type.Unsafe(typebox.Type.String({ pattern: "^_" }))
+		]))
+	})
+]);
+const SessionServiceStateSchema = typebox.Type.Object({
+	snapshot: typebox.Type.Object({
+		id: Text,
+		cwd: Text,
+		name: Optional(Text),
+		createdAt: NumberValue,
+		updatedAt: NumberValue,
+		phase: Phase,
+		model: Model,
+		thinkingLevel: Thinking,
+		fastMode: Flag,
+		attached: Flag,
+		locked: Flag,
+		revision: NumberValue,
+		queuedSteer: typebox.Type.Array(User),
+		queuedSteerCount: NumberValue,
+		lifecycle: Optional(Lifecycle)
+	}),
+	progress: typebox.Type.Union([typebox.Type.Null(), typebox.Type.Union([
+		typebox.Type.Object({
+			type: typebox.Type.Literal("item_started"),
+			item: Transcript
+		}),
+		typebox.Type.Object({
+			type: typebox.Type.Literal("item_updated"),
+			item: Transcript
+		}),
+		typebox.Type.Object({
+			type: typebox.Type.Literal("item_finished"),
+			item: Transcript
+		})
+	])]),
+	updates: Optional(typebox.Type.Array(typebox.Type.Object({
+		sequence: NumberValue,
+		update: Update
+	}))),
+	presentation: Optional(typebox.Type.Object({
+		revision: NumberValue,
+		dropped: NumberValue,
+		resetRevision: Optional(NumberValue),
+		events: typebox.Type.Array(ProtocolEvent),
+		projections: typebox.Type.Array(ProtocolEvent)
+	})),
+	inFlight: Optional(typebox.Type.Array(Transcript))
+});
+const SessionMethodSchemas = {
+	readTranscriptPage: {
+		input: typebox.Type.Tuple([typebox.Type.Object({
+			cursor: Optional(Text),
+			direction: Optional(typebox.Type.Union([typebox.Type.Literal("older"), typebox.Type.Literal("newer")])),
+			limit: Optional(NumberValue),
+			threadId: Optional(Text)
+		})]),
+		output: typebox.Type.Object({
+			entries: typebox.Type.Array(Json$1),
+			startCursor: typebox.Type.Union([Text, typebox.Type.Null()]),
+			endCursor: typebox.Type.Union([Text, typebox.Type.Null()]),
+			olderCursor: typebox.Type.Union([Text, typebox.Type.Null()]),
+			newerCursor: typebox.Type.Union([Text, typebox.Type.Null()]),
+			generation: NumberValue,
+			revision: NumberValue,
+			context: typebox.Type.Array(Json$1),
+			drafts: typebox.Type.Array(Transcript)
+		})
+	},
+	prompt: { input: typebox.Type.Tuple([typebox.Type.Union([Text, typebox.Type.Object({
+		...Message.properties,
+		waitFor: Optional(typebox.Type.Union([typebox.Type.Literal("accepted"), typebox.Type.Literal("settled")]))
+	})])]) },
+	steer: { input: typebox.Type.Tuple([typebox.Type.Union([Text, Message])]) },
+	abort: { input: typebox.Type.Tuple([]) },
+	abortOperation: { input: typebox.Type.Tuple([typebox.Type.Object({ operationId: Text })]) },
+	setModel: { input: typebox.Type.Tuple([Model]) },
+	setThinking: { input: typebox.Type.Tuple([Thinking]) },
+	setFastMode: { input: typebox.Type.Tuple([Flag]) },
+	setAgentLock: { input: typebox.Type.Tuple([Flag]) },
+	followUp: { input: typebox.Type.Tuple([Message]) },
+	enqueueAutomatic: {
+		input: typebox.Type.Tuple([Message]),
+		output: typebox.Type.Object({ id: Text })
+	},
+	removeQueued: {
+		input: typebox.Type.Tuple([typebox.Type.Object({ id: Text })]),
+		output: typebox.Type.Union([
+			typebox.Type.Literal("removed"),
+			typebox.Type.Literal("in_flight"),
+			typebox.Type.Literal("already_consumed"),
+			typebox.Type.Literal("not_found")
+		])
+	},
+	promoteQueued: {
+		input: typebox.Type.Tuple([typebox.Type.Object({
+			id: Text,
+			operationId: Optional(Text)
+		})]),
+		output: typebox.Type.Union([
+			typebox.Type.Literal("promoted"),
+			typebox.Type.Literal("in_flight"),
+			typebox.Type.Literal("target_changed"),
+			typebox.Type.Literal("not_found")
+		])
+	},
+	resumeQueue: { input: typebox.Type.Tuple([]) },
+	clearQueue: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Object({
+			steering: Strings,
+			followUp: Strings
+		})
+	},
+	rewind: {
+		input: typebox.Type.Tuple([typebox.Type.Object({
+			itemId: Text,
+			summarize: Optional(Flag),
+			customInstructions: Optional(Text),
+			replaceInstructions: Optional(Flag),
+			label: Optional(Text)
+		})]),
+		output: typebox.Type.Object({
+			editorText: Optional(Text),
+			cancelled: Flag,
+			aborted: Optional(Flag),
+			summaryEntry: Optional(typebox.Type.Object({
+				id: Text,
+				parentId: typebox.Type.Union([Text, typebox.Type.Null()]),
+				timestamp: Text,
+				fromId: Text,
+				summary: Text,
+				details: Optional(Json$1),
+				usage: Optional(Usage),
+				fromHook: Optional(Flag)
+			}))
+		})
+	},
+	extensionUiResponse: { input: typebox.Type.Tuple([typebox.Type.Union([
+		typebox.Type.Object({
+			id: Text,
+			value: Text
+		}),
+		typebox.Type.Object({
+			id: Text,
+			confirmed: Flag
+		}),
+		typebox.Type.Object({
+			id: Text,
+			cancelled: typebox.Type.Literal(true)
+		})
+	])]) },
+	getState: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Object({
+			model: Optional(Model),
+			thinkingLevel: Thinking,
+			fastMode: Flag,
+			isStreaming: Flag,
+			isCompacting: Flag,
+			steeringMode: typebox.Type.Union([typebox.Type.Literal("all"), typebox.Type.Literal("one-at-a-time")]),
+			followUpMode: typebox.Type.Union([typebox.Type.Literal("all"), typebox.Type.Literal("one-at-a-time")]),
+			sessionFile: Optional(Text),
+			sessionId: Text,
+			sessionName: Optional(Text),
+			autoCompactionEnabled: Flag,
+			messageCount: NumberValue,
+			pendingMessageCount: NumberValue,
+			operationId: Optional(Text),
+			executionStatus: Optional(typebox.Type.Union([typebox.Type.Literal("open"), typebox.Type.Literal("aborting")])),
+			queuePaused: Optional(Flag),
+			queueRevision: Optional(NumberValue)
+		})
+	},
+	getSessionStats: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Object({
+			sessionFile: Optional(Text),
+			sessionId: Text,
+			totalMessages: NumberValue,
+			tokens: Usage,
+			cost: NumberValue,
+			contextUsage: Optional(typebox.Type.Object({
+				tokens: typebox.Type.Union([NumberValue, typebox.Type.Null()]),
+				contextWindow: NumberValue,
+				percent: typebox.Type.Union([NumberValue, typebox.Type.Null()])
+			}))
+		})
+	},
+	getCommands: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Array(typebox.Type.Object({
+			name: Text,
+			description: Optional(Text),
+			source: typebox.Type.Union([
+				typebox.Type.Literal("extension"),
+				typebox.Type.Literal("prompt"),
+				typebox.Type.Literal("skill")
+			]),
+			sourceInfo: Optional(typebox.Type.Object({
+				path: Text,
+				source: Text,
+				scope: typebox.Type.Union([
+					typebox.Type.Literal("user"),
+					typebox.Type.Literal("project"),
+					typebox.Type.Literal("temporary")
+				]),
+				origin: typebox.Type.Union([typebox.Type.Literal("package"), typebox.Type.Literal("top-level")]),
+				baseDir: Optional(Text)
+			}))
+		}))
+	},
+	getAvailableModels: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Array(Model)
+	},
+	getAvailableThinkingLevels: {
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Array(Thinking)
+	},
+	compact: {
+		input: typebox.Type.Tuple([typebox.Type.Object({ customInstructions: Optional(Text) })]),
+		output: Json$1
+	},
+	setName: { input: typebox.Type.Tuple([Text]) }
+};
+const ErrorSchema = typebox.Type.Object({
+	code: Text,
+	message: Text
+});
+const sessionSocketContracts = [
+	...Object.entries(SessionMethodSchemas).map(([member, definition]) => ({
+		id: `session.${member}`,
+		scope: "session",
+		service: DOOM_SESSION_SERVICE_ID,
+		member,
+		direction: "client-to-server",
+		kind: "method",
+		description: `Session ${member}. Arguments exclude the process-local Chord Context. A void result is omitted from the successful Pi response.`,
+		...definition,
+		errors: ErrorSchema
+	})),
+	{
+		id: "session.state",
+		scope: "session",
+		service: DOOM_SESSION_SERVICE_ID,
+		member: "state",
+		direction: "server-to-client",
+		kind: "state",
+		input: SessionServiceStateSchema,
+		description: "Reconstructed session state after Chord snapshot/delta decoding."
+	},
+	{
+		id: "management.attach",
+		scope: "global",
+		service: DOOM_SESSION_MANAGEMENT_SERVICE_ID,
+		member: "attach",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([Text]),
+		errors: ErrorSchema,
+		description: "Attach this presentation to a session. Pi publishes an out-of-band attachment update."
+	},
+	{
+		id: "management.detach",
+		scope: "global",
+		service: DOOM_SESSION_MANAGEMENT_SERVICE_ID,
+		member: "detach",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([]),
+		errors: ErrorSchema,
+		description: "Detach this presentation from its selected session."
+	},
+	{
+		id: "hub.send",
+		scope: "global",
+		service: "po.hub.v1",
+		member: "send",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([HubClientFrame]),
+		errors: ErrorSchema,
+		description: "Send a hub subscription, thread, history, or selected extension channel frame."
+	},
+	{
+		id: "hub.state",
+		scope: "global",
+		service: "po.hub.v1",
+		member: "state",
+		direction: "server-to-client",
+		kind: "state",
+		input: typebox.Type.Object({ events: typebox.Type.Array(typebox.Type.Object({
+			sequence: NumberValue,
+			frame: HubServerFrame
+		})) }),
+		description: "Reconstructed hub event replay window. Frame discriminators identify session and selected extension updates."
+	}
+];
+//#endregion
+//#region src/schemas/pluginProtocol.ts
+/** The address is always exact. A workspace call never resolves to a global service. */
+const DoomPluginMountSchema = typebox.Type.Union([
+	typebox.Type.Object({ scope: typebox.Type.Literal("global") }, { additionalProperties: false }),
+	typebox.Type.Object({
+		scope: typebox.Type.Literal("workspace"),
+		workspaceId: typebox.Type.String({ minLength: 1 })
+	}, { additionalProperties: false }),
+	typebox.Type.Object({
+		scope: typebox.Type.Literal("session"),
+		sessionId: typebox.Type.String({ minLength: 1 })
+	}, { additionalProperties: false })
+]);
+const DoomPluginCallSchema = typebox.Type.Object({
+	mount: DoomPluginMountSchema,
+	service: typebox.Type.String({ minLength: 1 }),
+	method: typebox.Type.String({ minLength: 1 }),
+	input: typebox.Type.Unknown()
+}, { additionalProperties: false });
+(0, _earendil_works_chord.defineService)("po.plugin.v1");
+//#endregion
+//#region src/schemas/transportApiContracts.ts
+const S = typebox.Type.String({ minLength: 1 });
+const Json = typebox.Type.Unknown({ description: "JSON value; its application shape is defined by the addressed service member." });
+const E = typebox.Type.Object({
+	code: S,
+	message: typebox.Type.String()
+}, { additionalProperties: false });
+const ServerId = typebox.Type.String({ pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" });
+const Address = typebox.Type.Object({
+	key: S,
+	generation: typebox.Type.Integer({ minimum: 1 })
+}, { additionalProperties: false });
+const Mode = typebox.Type.Union([typebox.Type.Literal("singleton"), typebox.Type.Literal("keyed")]);
+const SessionTarget = typebox.Type.Object({
+	serverId: ServerId,
+	sessionId: S,
+	attachmentId: S
+}, { additionalProperties: false });
+const Target = typebox.Type.Union([typebox.Type.Object({ serverId: ServerId }, { additionalProperties: false }), SessionTarget]);
+const ChordCallSchema = typebox.Type.Object({
+	serviceId: S,
+	member: S,
+	args: typebox.Type.Array(Json),
+	instance: typebox.Type.Optional(Address)
+}, { additionalProperties: false });
+const Segment = typebox.Type.Union([typebox.Type.String(), typebox.Type.Integer({ minimum: 0 })]);
+const Path = typebox.Type.Array(Segment);
+const PathRef = typebox.Type.Union([Path, typebox.Type.Integer({ minimum: 0 })]);
+const NonemptyPathRef = typebox.Type.Union([typebox.Type.Array(Segment, { minItems: 1 }), typebox.Type.Integer({ minimum: 0 })]);
+const Index = typebox.Type.Integer({ minimum: 0 });
+const ChordWireOpSchema = typebox.Type.Union([
+	typebox.Type.Tuple([typebox.Type.Literal("r"), Json]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("s"),
+		NonemptyPathRef,
+		Json
+	]),
+	typebox.Type.Tuple([typebox.Type.Literal("s"), Json]),
+	typebox.Type.Tuple([typebox.Type.Literal("d"), NonemptyPathRef]),
+	typebox.Type.Tuple([typebox.Type.Literal("d")]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("a"),
+		NonemptyPathRef,
+		typebox.Type.String()
+	]),
+	typebox.Type.Tuple([typebox.Type.Literal("a"), typebox.Type.String()]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("t"),
+		NonemptyPathRef,
+		Index
+	]),
+	typebox.Type.Tuple([typebox.Type.Literal("t"), Index]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("p"),
+		PathRef,
+		Index,
+		Index,
+		typebox.Type.Array(Json)
+	]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("p"),
+		Index,
+		Index,
+		typebox.Type.Array(Json)
+	]),
+	typebox.Type.Tuple([
+		typebox.Type.Literal("#"),
+		Index,
+		Path
+	])
+], { description: "Chord delta tuples. Path dictionary references and omitted paths depend on earlier operations in this subscription; decode with the Chord delta decoder." });
+const Instance = typebox.Type.Object({
+	instance: typebox.Type.Optional(Address),
+	members: typebox.Type.Array(typebox.Type.Union([typebox.Type.Object({
+		name: S,
+		kind: typebox.Type.Literal("method")
+	}), typebox.Type.Object({
+		name: S,
+		kind: typebox.Type.Literal("state"),
+		sequence: typebox.Type.Integer({ minimum: 0 }),
+		ops: typebox.Type.Array(ChordWireOpSchema)
+	})]))
+});
+const ChordSnapshotSchema = typebox.Type.Object({
+	serviceId: S,
+	mode: Mode,
+	instances: typebox.Type.Array(Instance)
+});
+const ChordUpdateSchema = typebox.Type.Union([
+	typebox.Type.Object({
+		type: typebox.Type.Literal("state"),
+		instance: typebox.Type.Optional(Address),
+		member: S,
+		sequence: typebox.Type.Integer({ minimum: 1 }),
+		ops: typebox.Type.Array(ChordWireOpSchema)
+	}),
+	typebox.Type.Object({ type: typebox.Type.Literal("unavailable") }),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("replaced"),
+		snapshot: Instance
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("spawned"),
+		instance: Instance
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("closed"),
+		instance: Address
+	})
+]);
+const PiClientMessageSchema = typebox.Type.Union([
+	typebox.Type.Object({
+		type: typebox.Type.Literal("hello"),
+		version: typebox.Type.Integer({ minimum: 0 })
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("request"),
+		id: S,
+		target: Target,
+		call: ChordCallSchema
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("cancel"),
+		id: S,
+		target: Target
+	})
+]);
+const PiServerMessageSchema = typebox.Type.Union([
+	typebox.Type.Object({
+		type: typebox.Type.Literal("hello"),
+		version: typebox.Type.Literal(_earendil_works_pi_protocol.PROTOCOL_VERSION),
+		serverId: ServerId
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("hello_error"),
+		error: E
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("response"),
+		id: S,
+		ok: typebox.Type.Literal(true),
+		result: typebox.Type.Optional(Json)
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("response"),
+		id: S,
+		ok: typebox.Type.Literal(false),
+		error: E
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("service_update"),
+		subscriptionId: S,
+		update: ChordUpdateSchema
+	}),
+	typebox.Type.Object({
+		type: typebox.Type.Literal("attachment"),
+		attachment: typebox.Type.Union([SessionTarget, typebox.Type.Null()])
+	})
+]);
+const transportSocketContracts = [
+	{
+		id: "pi.client",
+		scope: "global",
+		service: "$pi",
+		member: "client",
+		direction: "client-to-server",
+		kind: "channel",
+		input: PiClientMessageSchema,
+		description: `Pi protocol ${_earendil_works_pi_protocol.PROTOCOL_VERSION} decoded client envelope. Encode with the public Pi codec and framing functions, then seal for WebSocket delivery.`
+	},
+	{
+		id: "pi.server",
+		scope: "global",
+		service: "$pi",
+		member: "server",
+		direction: "server-to-client",
+		kind: "channel",
+		input: PiServerMessageSchema,
+		description: "Pi decoded server envelope. Responses correlate by id; service updates correlate by subscriptionId."
+	},
+	{
+		id: "chord.catalogue",
+		scope: "global",
+		service: "$chord.service",
+		member: "catalogue",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([]),
+		output: typebox.Type.Array(typebox.Type.Object({
+			serviceId: S,
+			mode: Mode
+		})),
+		errors: E,
+		description: "Discover services at the selected Pi target."
+	},
+	{
+		id: "chord.subscribe",
+		scope: "global",
+		service: "$chord.service",
+		member: "subscribe",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([
+			S,
+			S,
+			Mode
+		]),
+		output: ChordSnapshotSchema,
+		errors: E,
+		description: "Subscribe with [subscriptionId, serviceId, mode]; subsequent Pi service_update messages contain Chord deltas."
+	},
+	{
+		id: "chord.unsubscribe",
+		scope: "global",
+		service: "$chord.service",
+		member: "unsubscribe",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([S]),
+		errors: E,
+		description: "Unsubscribe by subscriptionId."
+	},
+	{
+		id: "plugin.invoke",
+		scope: "global",
+		service: "po.plugin.v1",
+		member: "invoke",
+		direction: "client-to-server",
+		kind: "method",
+		input: typebox.Type.Tuple([DoomPluginCallSchema]),
+		output: Json,
+		errors: E,
+		description: "Invoke the selected scoped plugin method. Its declaration supplies input and output shapes."
+	}
+];
+//#endregion
+//#region src/schemas/builtinApiContracts.ts
+const builtinApiContract = defineApiContract({
+	version: 1,
+	schemas: {
+		SealedEnvelope: SealedEnvelopeSchema,
+		SealedHttpRequest: SealedHttpRequestSchema,
+		SealedHttpResponse: SealedHttpResponseSchema
+	},
+	protocols: {
+		pi: String(_earendil_works_pi_protocol.PROTOCOL_VERSION),
+		chord: "1.0.0",
+		sealed: "1"
+	},
+	http: [
+		...headlessHttpContracts,
+		...machineHttpContracts,
+		...sessionHttpContracts,
+		...remoteHttpContracts,
+		...bundleHttpContracts
+	],
+	sockets: [...sessionSocketContracts, ...transportSocketContracts],
+	dynamic: [
+		"WebAuthn options and credential responses follow the installed WebAuthn implementation.",
+		"Tool inputs/results and journal entries contain runtime-defined JSON.",
+		"Selected channel and presentation payload schemas are contributed by their owning package."
+	]
+});
+//#endregion
+exports.ApiErrorSchema = ApiErrorSchema;
+exports.ApiOkSchema = ApiOkSchema;
+exports.ChordCallSchema = ChordCallSchema;
+exports.ChordSnapshotSchema = ChordSnapshotSchema;
+exports.ChordUpdateSchema = ChordUpdateSchema;
+exports.ChordWireOpSchema = ChordWireOpSchema;
+exports.DOOM_API_CONTRACT_FILE = DOOM_API_CONTRACT_FILE;
+exports.DOOM_API_CONTRACT_VERSION = DOOM_API_CONTRACT_VERSION;
+exports.DoomApiContractSchema = DoomApiContractSchema;
+exports.PiClientMessageSchema = PiClientMessageSchema;
+exports.PiServerMessageSchema = PiServerMessageSchema;
+exports.SessionMethodSchemas = SessionMethodSchemas;
+exports.SessionServiceStateSchema = SessionServiceStateSchema;
+exports.builtinApiContract = builtinApiContract;
+exports.canonicalContractJson = canonicalContractJson;
+exports.createApiDocuments = createApiDocuments;
+exports.defineApiContract = defineApiContract;
+exports.jsonApiResponses = jsonApiResponses;
+exports.parseApiContract = parseApiContract;
+exports.parseCompiledContracts = parseCompiledContracts;
+
+//# sourceMappingURL=apiContracts.cjs.map