@cleocode/runtime 2026.6.13 → 2026.6.15

package/dist/chunk-U2ESNIJ5.js

@@ -0,0 +1,1107 @@
+import {
+  inferGateway,
+  resolveStreamRoute
+} from "./chunk-L5BLVQDA.js";
+
+// src/gateway/http/listen.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { createServer } from "http";
+import { getLogger as getLogger2 } from "@cleocode/core";
+
+// src/gateway/http/server.ts
+import { randomUUID } from "crypto";
+function statusForResponse(response) {
+  if (response.success) return 200;
+  const code = response.error?.code ?? "";
+  if (code === "E_NOT_FOUND" || code.endsWith("_NOT_FOUND")) return 404;
+  if (code === "E_UNAUTHORIZED" || code === "E_AUTH_REQUIRED") return 401;
+  if (code === "E_FORBIDDEN") return 403;
+  if (code === "E_RATE_LIMITED" || code === "E_RATE_LIMIT_EXCEEDED") return 429;
+  if (code === "E_VALIDATION" || code.startsWith("E_VALIDATION") || code === "E_INVALID_INPUT" || code === "E_BAD_REQUEST") {
+    return 400;
+  }
+  if (code === "E_NOT_IMPLEMENTED" || code === "E_UNSUPPORTED") return 501;
+  return 500;
+}
+async function routeUnary(handler, req) {
+  const requestId = req.requestId ?? randomUUID();
+  const request = {
+    gateway: req.gateway,
+    domain: req.domain,
+    operation: req.operation,
+    params: req.params,
+    // Force the transport of origin — a client cannot impersonate cli/mcp/rpc.
+    source: "http",
+    requestId,
+    sessionId: req.sessionId
+  };
+  try {
+    const body = await handler.handle(request);
+    return { status: statusForResponse(body), body };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const body = {
+      meta: {
+        gateway: req.gateway,
+        domain: req.domain,
+        operation: req.operation,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        duration_ms: 0,
+        source: "http",
+        requestId
+      },
+      success: false,
+      error: { code: "E_HTTP_INTERNAL", message }
+    };
+    return { status: 500, body };
+  }
+}
+
+// src/gateway/http/sse.ts
+var LF = "\n";
+var RECORD_END = "\n\n";
+function encodeSseFrame(frame) {
+  let out = "";
+  if (frame.event !== void 0) out += `event: ${frame.event}${LF}`;
+  if (frame.id !== void 0) out += `id: ${frame.id}${LF}`;
+  out += `data: ${JSON.stringify(frame.data)}${RECORD_END}`;
+  return out;
+}
+function encodeStreamEvent(frame) {
+  return encodeSseFrame({ id: String(frame.seq), data: frame });
+}
+var SSE_HEADERS = Object.freeze({
+  "Content-Type": "text/event-stream",
+  "Cache-Control": "no-cache",
+  Connection: "keep-alive",
+  "X-Accel-Buffering": "no"
+});
+function createSseStream(source, signal) {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      let closed = false;
+      let teardown;
+      let teardownDone = false;
+      let sourceRunning = false;
+      const onAbort = () => emitter.close();
+      const runTeardown = () => {
+        if (teardownDone) return;
+        teardownDone = true;
+        if (typeof teardown === "function") teardown();
+      };
+      const emitter = {
+        get closed() {
+          return closed;
+        },
+        send(frame) {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(encodeSseFrame(frame)));
+          } catch {
+            emitter.close();
+          }
+        },
+        sendStreamEvent(frame) {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(encodeStreamEvent(frame)));
+          } catch {
+            emitter.close();
+          }
+        },
+        sendRaw(record) {
+          if (closed) return;
+          try {
+            controller.enqueue(encoder.encode(record));
+          } catch {
+            emitter.close();
+          }
+        },
+        close() {
+          if (closed) return;
+          closed = true;
+          if (signal) signal.removeEventListener("abort", onAbort);
+          if (!sourceRunning) runTeardown();
+          try {
+            controller.close();
+          } catch {
+          }
+        }
+      };
+      if (signal) {
+        if (signal.aborted) {
+          closed = true;
+          teardownDone = true;
+          try {
+            controller.close();
+          } catch {
+          }
+          return;
+        }
+        signal.addEventListener("abort", onAbort);
+      }
+      sourceRunning = true;
+      const returned = source(emitter);
+      teardown = typeof returned === "function" ? returned : void 0;
+      sourceRunning = false;
+      if (closed) runTeardown();
+    }
+  });
+}
+
+// src/gateway/http/stream-sources.ts
+var DEFAULT_TICK_INTERVAL_MS = 1e3;
+var MAX_TICKS = 86400;
+function resolveTickBudget(raw) {
+  if (typeof raw !== "number" || !Number.isFinite(raw)) return MAX_TICKS;
+  if (raw <= 0) return 0;
+  return Math.min(Math.floor(raw), MAX_TICKS);
+}
+var tickStreamSource = (emitter, context) => {
+  const budget = resolveTickBudget(context.params.ticks);
+  let seq = 0;
+  const emitData = () => {
+    const frame = {
+      kind: "data",
+      seq,
+      data: { tick: seq, ts: (/* @__PURE__ */ new Date()).toISOString() },
+      requestId: context.requestId
+    };
+    emitter.sendStreamEvent(frame);
+    seq += 1;
+  };
+  const emitDone = () => {
+    const frame = {
+      kind: "done",
+      seq,
+      data: { ticks: seq, ts: (/* @__PURE__ */ new Date()).toISOString() },
+      requestId: context.requestId
+    };
+    emitter.sendStreamEvent(frame);
+    emitter.close();
+  };
+  if (budget <= 0) {
+    emitDone();
+    return void 0;
+  }
+  emitData();
+  const interval = setInterval(() => {
+    if (emitter.closed) {
+      clearInterval(interval);
+      return;
+    }
+    if (seq >= budget) {
+      clearInterval(interval);
+      emitDone();
+      return;
+    }
+    emitData();
+  }, DEFAULT_TICK_INTERVAL_MS);
+  return () => clearInterval(interval);
+};
+var taskBoardStreamSource = (emitter, context) => {
+  const budget = resolveTickBudget(context.params.ticks);
+  const root = typeof context.params.root === "string" ? context.params.root : null;
+  let seq = 0;
+  const emitData = () => {
+    const frame = {
+      kind: "data",
+      seq,
+      data: { scope: "tasks.board", root, event: "heartbeat", ts: (/* @__PURE__ */ new Date()).toISOString() },
+      requestId: context.requestId
+    };
+    emitter.sendStreamEvent(frame);
+    seq += 1;
+  };
+  const emitDone = () => {
+    const frame = {
+      kind: "done",
+      seq,
+      data: { scope: "tasks.board", root, frames: seq, ts: (/* @__PURE__ */ new Date()).toISOString() },
+      requestId: context.requestId
+    };
+    emitter.sendStreamEvent(frame);
+    emitter.close();
+  };
+  if (budget <= 0) {
+    emitDone();
+    return void 0;
+  }
+  emitData();
+  const interval = setInterval(() => {
+    if (emitter.closed) {
+      clearInterval(interval);
+      return;
+    }
+    if (seq >= budget) {
+      clearInterval(interval);
+      emitDone();
+      return;
+    }
+    emitData();
+  }, DEFAULT_TICK_INTERVAL_MS);
+  return () => clearInterval(interval);
+};
+var STREAM_SOURCES = /* @__PURE__ */ new Map([
+  ["orchestrate.events", tickStreamSource],
+  // T11785 (epic T11556) — the FIRST streaming task op; default board heartbeat.
+  ["tasks.subscribe", taskBoardStreamSource]
+]);
+function streamSourceKey(domain, operation) {
+  return `${domain}.${operation}`;
+}
+function registerStreamSource(domain, operation, source) {
+  STREAM_SOURCES.set(streamSourceKey(domain, operation), source);
+}
+function resolveStreamSource(domain, operation) {
+  return STREAM_SOURCES.get(streamSourceKey(domain, operation));
+}
+
+// src/gateway/http/studio-static.ts
+import { createReadStream, existsSync } from "fs";
+import { stat } from "fs/promises";
+import { extname, join, resolve } from "path";
+var log = {
+  info: (obj, msg) => {
+    if (process.env["CLEO_DEBUG_STUDIO"]) console.info("[studio-static]", msg, obj);
+  },
+  warn: (obj, msg) => {
+    if (process.env["NODE_ENV"] !== "test") {
+      console.warn("[studio-static]", msg, obj);
+    }
+  },
+  debug: (_obj, _msg) => {
+    if (process.env["CLEO_DEBUG_STUDIO"]) console.debug("[studio-static]", _msg, _obj);
+  }
+};
+var MIME_TYPES = /* @__PURE__ */ new Map([
+  [".html", "text/html; charset=utf-8"],
+  [".js", "application/javascript; charset=utf-8"],
+  [".mjs", "application/javascript; charset=utf-8"],
+  [".css", "text/css; charset=utf-8"],
+  [".json", "application/json; charset=utf-8"],
+  [".png", "image/png"],
+  [".jpg", "image/jpeg"],
+  [".jpeg", "image/jpeg"],
+  [".svg", "image/svg+xml"],
+  [".ico", "image/x-icon"],
+  [".woff", "font/woff"],
+  [".woff2", "font/woff2"],
+  [".ttf", "font/ttf"],
+  [".map", "application/json; charset=utf-8"],
+  [".txt", "text/plain; charset=utf-8"],
+  [".webmanifest", "application/manifest+json; charset=utf-8"]
+]);
+var MIME_FALLBACK = "application/octet-stream";
+var STUDIO_PREFIX = "/studio";
+function isStudioPath(pathname) {
+  return pathname === STUDIO_PREFIX || pathname.startsWith(`${STUDIO_PREFIX}/`);
+}
+function resolveStudioAssetPath(staticDir, pathname) {
+  const base = resolve(staticDir);
+  const stripped = pathname.slice(STUDIO_PREFIX.length) || "/";
+  const relative = stripped.replace(/^[\\/]+/, "") || ".";
+  const candidate = resolve(base, relative);
+  const safeBase = base.endsWith("/") ? base : `${base}/`;
+  if (candidate !== base && !candidate.startsWith(safeBase)) {
+    return void 0;
+  }
+  return candidate;
+}
+function mimeType(filePath) {
+  return MIME_TYPES.get(extname(filePath).toLowerCase()) ?? MIME_FALLBACK;
+}
+function writeBundleAbsentError(res, hint) {
+  const body = JSON.stringify({
+    success: false,
+    error: {
+      code: "E_STUDIO_BUNDLE_ABSENT",
+      message: "CLEO Studio assets are not available. Run `pnpm --filter @cleocode/studio run build` to build them, or install from npm (npm i -g @cleocode/cleo) for a batteries-included release.",
+      hint: hint ?? null
+    }
+  });
+  res.writeHead(503, { "Content-Type": "application/json; charset=utf-8" });
+  res.end(body);
+}
+async function serveStudioStatic(req, res, opts) {
+  const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    res.writeHead(405, {
+      "Content-Type": "application/json; charset=utf-8",
+      Allow: "GET, HEAD"
+    });
+    res.end(
+      JSON.stringify({
+        success: false,
+        error: {
+          code: "E_METHOD_NOT_ALLOWED",
+          message: `Method ${req.method ?? "<none>"} not allowed for /studio routes`
+        }
+      })
+    );
+    return;
+  }
+  if (pathname === STUDIO_PREFIX) {
+    res.writeHead(302, { Location: `${STUDIO_PREFIX}/` });
+    res.end();
+    return;
+  }
+  const staticDir = opts.staticDir;
+  if (staticDir === void 0 || !existsSync(staticDir)) {
+    log.warn({ staticDir }, "studio static dir absent");
+    writeBundleAbsentError(res, staticDir);
+    return;
+  }
+  const assetPath = resolveStudioAssetPath(staticDir, pathname);
+  if (assetPath === void 0) {
+    res.writeHead(400, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(
+      JSON.stringify({
+        success: false,
+        error: { code: "E_BAD_REQUEST", message: "Invalid path" }
+      })
+    );
+    return;
+  }
+  let targetPath = assetPath;
+  let isSpaFallback = false;
+  try {
+    const st = await stat(targetPath);
+    if (st.isDirectory()) {
+      const dirIndex = join(targetPath, "index.html");
+      if (existsSync(dirIndex)) {
+        targetPath = dirIndex;
+      } else {
+        targetPath = join(staticDir, "index.html");
+        isSpaFallback = true;
+      }
+    }
+  } catch {
+    targetPath = join(staticDir, "index.html");
+    isSpaFallback = true;
+  }
+  if (!existsSync(targetPath)) {
+    res.writeHead(503, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(
+      JSON.stringify({
+        success: false,
+        error: {
+          code: "E_STUDIO_BUNDLE_CORRUPT",
+          message: "Studio index.html not found in the static bundle."
+        }
+      })
+    );
+    return;
+  }
+  const ct = mimeType(targetPath);
+  if (req.method === "HEAD") {
+    try {
+      const st = await stat(targetPath);
+      res.writeHead(200, {
+        "Content-Type": ct,
+        "Content-Length": String(st.size),
+        ...isSpaFallback ? {} : { "Cache-Control": "public, max-age=31536000, immutable" }
+      });
+      res.end();
+    } catch {
+      res.writeHead(404);
+      res.end();
+    }
+    return;
+  }
+  try {
+    const st = await stat(targetPath);
+    res.writeHead(200, {
+      "Content-Type": ct,
+      "Content-Length": String(st.size),
+      // Immutable cache for fingerprinted assets; no cache for SPA fallback.
+      ...isSpaFallback ? { "Cache-Control": "no-cache" } : {
+        "Cache-Control": "public, max-age=31536000, immutable"
+      }
+    });
+    const stream = createReadStream(targetPath);
+    stream.on("error", (err) => {
+      log.warn({ err, targetPath }, "studio static read error");
+      if (!res.writableEnded) res.end();
+    });
+    stream.pipe(res);
+    log.debug({ pathname, targetPath, isSpaFallback, ct }, "studio static served");
+  } catch (err) {
+    log.warn({ err, targetPath }, "studio static stat error");
+    if (!res.headersSent) {
+      res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
+      res.end(
+        JSON.stringify({
+          success: false,
+          error: { code: "E_INTERNAL", message: "Failed to read Studio asset" }
+        })
+      );
+    } else if (!res.writableEnded) {
+      res.end();
+    }
+  }
+}
+function resolveStudioStaticDir(cleoPackageDir) {
+  const candidate = join(cleoPackageDir, "studio-dist", "client");
+  return existsSync(candidate) ? candidate : void 0;
+}
+
+// src/gateway/http/ws-pty.ts
+import { createHash } from "crypto";
+import { delimiter } from "path";
+import { getLogger } from "@cleocode/core";
+var WS_PTY_PATH = "/v1/terminal/pty";
+var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var DEFAULT_COLS = 80;
+var DEFAULT_ROWS = 24;
+var OPCODE_TEXT = 1;
+var OPCODE_BINARY = 2;
+var OPCODE_CLOSE = 8;
+var OPCODE_PING = 9;
+var OPCODE_PONG = 10;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+var NODE_PTY_INSTALL_HINT = 'PTY backend unavailable: the optional "node-pty" package is not installed. Install it with `pnpm add node-pty` (a native build) to enable interactive terminal sessions.';
+var NODE_PTY_SPECIFIER = "node-pty";
+var realImporter = (specifier) => import(specifier);
+var importer = realImporter;
+function shapeCheckPty(candidate) {
+  if (candidate !== null && typeof candidate === "object" && typeof candidate.spawn === "function") {
+    return candidate;
+  }
+  return null;
+}
+async function loadNodePty() {
+  try {
+    const mod = await importer(NODE_PTY_SPECIFIER);
+    const candidate = mod.default ?? mod;
+    return shapeCheckPty(candidate);
+  } catch {
+    return null;
+  }
+}
+var TRUSTED_PATH = [
+  "/usr/local/sbin",
+  "/usr/local/bin",
+  "/usr/sbin",
+  "/usr/bin",
+  "/sbin",
+  "/bin"
+].join(delimiter);
+var PASSTHROUGH_KEYS = [
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "TMPDIR"
+];
+function scrubPtyEnv(parentEnv = process.env) {
+  const env = { PATH: TRUSTED_PATH, TERM: "xterm-256color" };
+  for (const key of PASSTHROUGH_KEYS) {
+    const value = parentEnv[key];
+    if (typeof value === "string" && value.length > 0) env[key] = value;
+  }
+  return env;
+}
+function computeAcceptKey(key) {
+  return createHash("sha1").update(key + WS_GUID).digest("base64");
+}
+function encodeWsFrame(opcode, payload) {
+  const len = payload.length;
+  let header;
+  if (len < 126) {
+    header = Buffer.alloc(2);
+    header[1] = len;
+  } else if (len < 65536) {
+    header = Buffer.alloc(4);
+    header[1] = 126;
+    header.writeUInt16BE(len, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[1] = 127;
+    header.writeUInt32BE(Math.floor(len / 4294967296), 2);
+    header.writeUInt32BE(len >>> 0, 6);
+  }
+  header[0] = 128 | opcode & 15;
+  return Buffer.concat([header, payload]);
+}
+function encodeCloseFrame(code, reason) {
+  const reasonBytes = Buffer.from(reason, "utf8").subarray(0, 123);
+  const payload = Buffer.alloc(2 + reasonBytes.length);
+  payload.writeUInt16BE(code, 0);
+  reasonBytes.copy(payload, 2);
+  return encodeWsFrame(OPCODE_CLOSE, payload);
+}
+function decodeWsFrame(buf) {
+  if (buf.length < 2) return null;
+  const opcode = buf[0] & 15;
+  const masked = (buf[1] & 128) !== 0;
+  let len = buf[1] & 127;
+  let offset = 2;
+  if (len === 126) {
+    if (buf.length < offset + 2) return null;
+    len = buf.readUInt16BE(offset);
+    offset += 2;
+  } else if (len === 127) {
+    if (buf.length < offset + 8) return null;
+    len = buf.readUInt32BE(offset + 4);
+    offset += 8;
+  }
+  let mask;
+  if (masked) {
+    if (buf.length < offset + 4) return null;
+    mask = buf.subarray(offset, offset + 4);
+    offset += 4;
+  }
+  if (buf.length < offset + len) return null;
+  const raw = buf.subarray(offset, offset + len);
+  const payload = Buffer.allocUnsafe(len);
+  if (mask) {
+    for (let i = 0; i < len; i++) payload[i] = raw[i] ^ mask[i & 3];
+  } else {
+    raw.copy(payload);
+  }
+  return { opcode, payload, consumed: offset + len };
+}
+function authorizeUpgrade(req, remoteAddress, opts) {
+  if (remoteAddress === void 0 || !LOOPBACK_HOSTS.has(remoteAddress)) {
+    return { ok: false, status: 403, reason: "non-loopback connections are not permitted" };
+  }
+  if (opts.allowedOrigins !== void 0 && opts.allowedOrigins.length > 0) {
+    const origin = req.headers.origin;
+    if (typeof origin !== "string" || !opts.allowedOrigins.includes(origin)) {
+      return { ok: false, status: 403, reason: "origin not allowed" };
+    }
+  }
+  if (opts.token !== void 0 && opts.token.length > 0) {
+    const presented = extractToken(req);
+    if (presented === void 0 || !timingSafeEqualStr(presented, opts.token)) {
+      return { ok: false, status: 401, reason: "missing or invalid token" };
+    }
+  }
+  return { ok: true };
+}
+function extractToken(req) {
+  const auth = req.headers.authorization;
+  if (typeof auth === "string" && auth.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length).trim();
+  }
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const q = url.searchParams.get("token");
+  return q !== null && q.length > 0 ? q : void 0;
+}
+function timingSafeEqualStr(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function isWsPtyPath(url) {
+  const pathname = new URL(url ?? "/", "http://localhost").pathname;
+  return pathname === WS_PTY_PATH;
+}
+function rejectUpgrade(socket, status, reason) {
+  const statusText = status === 401 ? "Unauthorized" : status === 403 ? "Forbidden" : "Bad Request";
+  socket.write(
+    `HTTP/1.1 ${status} ${statusText}\r
+Connection: close\r
+Content-Type: text/plain\r
+Content-Length: ${Buffer.byteLength(reason)}\r
+\r
+` + reason
+  );
+  socket.destroy();
+}
+function swallowLateSocketError() {
+}
+async function bridgePty(req, socket, opts, log2, onTeardown) {
+  const key = req.headers["sec-websocket-key"];
+  socket.write(
+    `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${computeAcceptKey(typeof key === "string" ? key : "")}\r
+\r
+`
+  );
+  let tornDown = false;
+  let pty;
+  const disposables = [];
+  let inbound = Buffer.alloc(0);
+  const sendText = (data) => {
+    if (tornDown || socket.writableEnded) return;
+    const frame = encodeWsFrame(OPCODE_TEXT, Buffer.from(data, "utf8"));
+    if (!socket.write(frame)) {
+      socket.once("drain", () => void 0);
+    }
+  };
+  const teardown = (code = 1e3, reason = "") => {
+    if (tornDown) return;
+    tornDown = true;
+    for (const d of disposables.splice(0)) {
+      try {
+        d.dispose();
+      } catch {
+      }
+    }
+    if (pty !== void 0) {
+      try {
+        pty.kill();
+      } catch {
+      }
+      pty = void 0;
+    }
+    socket.removeListener("data", onData);
+    socket.removeListener("error", onError);
+    socket.removeListener("close", onSocketClose);
+    socket.on("error", swallowLateSocketError);
+    if (!socket.writableEnded) {
+      try {
+        socket.write(encodeCloseFrame(code, reason.slice(0, 120)));
+      } catch {
+      }
+      socket.end();
+    }
+    try {
+      onTeardown();
+    } catch {
+    }
+    log2.debug({ code, reason }, "ws-pty session torn down");
+  };
+  const onFrame = (frame) => {
+    switch (frame.opcode) {
+      case OPCODE_TEXT:
+      case OPCODE_BINARY: {
+        const text = frame.payload.toString("utf8");
+        const control = tryParseControl(text);
+        if (control !== void 0 && control.type === "resize") {
+          pty?.resize(control.cols, control.rows);
+        } else {
+          pty?.write(text);
+        }
+        break;
+      }
+      case OPCODE_PING:
+        if (!tornDown && !socket.writableEnded)
+          socket.write(encodeWsFrame(OPCODE_PONG, frame.payload));
+        break;
+      case OPCODE_CLOSE:
+        teardown(1e3, "client closed");
+        break;
+      // PONG and continuation frames are ignored.
+      default:
+        break;
+    }
+  };
+  const onData = (chunk) => {
+    inbound = inbound.length === 0 ? chunk : Buffer.concat([inbound, chunk]);
+    for (; ; ) {
+      const frame = decodeWsFrame(inbound);
+      if (frame === null) break;
+      inbound = inbound.subarray(frame.consumed);
+      onFrame(frame);
+      if (tornDown) break;
+    }
+  };
+  const onError = () => teardown(1011, "socket error");
+  const onSocketClose = () => teardown();
+  socket.on("data", onData);
+  socket.on("error", onError);
+  socket.on("close", onSocketClose);
+  const ptyModule = await loadNodePty();
+  if (tornDown) return { teardown };
+  if (ptyModule === null) {
+    teardown(1011, NODE_PTY_INSTALL_HINT);
+    return { teardown };
+  }
+  const shell = opts.shell ?? process.env.SHELL ?? "/bin/sh";
+  try {
+    pty = ptyModule.spawn(shell, [], {
+      name: "xterm-256color",
+      cols: DEFAULT_COLS,
+      rows: DEFAULT_ROWS,
+      cwd: opts.cwd ?? process.cwd(),
+      env: scrubPtyEnv()
+    });
+  } catch (err) {
+    log2.warn({ err }, "ws-pty spawn failed");
+    teardown(1011, "PTY spawn failed");
+    return { teardown };
+  }
+  const dataSub = pty.onData((d) => sendText(d));
+  if (dataSub && typeof dataSub.dispose === "function") disposables.push(dataSub);
+  const exitSub = pty.onExit(({ exitCode }) => teardown(1e3, `pty exited (${exitCode})`));
+  if (exitSub && typeof exitSub.dispose === "function") disposables.push(exitSub);
+  log2.debug({ shell }, "ws-pty session established");
+  return { teardown };
+}
+function tryParseControl(text) {
+  if (text.length === 0 || text[0] !== "{") return void 0;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed !== null && typeof parsed === "object" && parsed.type === "resize" && typeof parsed.cols === "number" && typeof parsed.rows === "number") {
+      const p = parsed;
+      return { type: "resize", cols: p.cols, rows: p.rows };
+    }
+  } catch {
+  }
+  return void 0;
+}
+function attachWsPtyEndpoint(server, opts = {}) {
+  const log2 = getLogger("gateway-ws-pty");
+  const sessions = /* @__PURE__ */ new Set();
+  const onUpgrade = (req, socket, _head) => {
+    if (!isWsPtyPath(req.url)) return;
+    const decision = authorizeUpgrade(req, req.socket.remoteAddress, opts);
+    if (!decision.ok) {
+      log2.debug({ status: decision.status, reason: decision.reason }, "ws-pty upgrade rejected");
+      rejectUpgrade(socket, decision.status, decision.reason);
+      return;
+    }
+    let session;
+    let deregistered = false;
+    const deregister = () => {
+      if (deregistered) return;
+      deregistered = true;
+      if (session !== void 0) sessions.delete(session);
+    };
+    bridgePty(req, socket, opts, log2, deregister).then((s) => {
+      session = s;
+      if (!deregistered) sessions.add(s);
+    }).catch((err) => {
+      log2.warn({ err }, "ws-pty bridge failed");
+      deregister();
+      if (!socket.destroyed) socket.destroy();
+    });
+  };
+  server.on("upgrade", onUpgrade);
+  let closed = false;
+  return {
+    get sessionCount() {
+      return sessions.size;
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      server.removeListener("upgrade", onUpgrade);
+      for (const session of [...sessions]) session.teardown(1001, "server closing");
+      sessions.clear();
+    }
+  };
+}
+
+// src/gateway/http/listen.ts
+var GATEWAYS = /* @__PURE__ */ new Set(["query", "mutate"]);
+var MAX_BODY_BYTES = 1048576;
+var V1_PREFIX = "v1";
+function parseHttpRoute(method, url) {
+  const pathname = new URL(url ?? "/", "http://localhost").pathname;
+  const segments = pathname.split("/").filter((s) => s.length > 0);
+  if (method === "GET") {
+    if (segments.length === 2 && segments[0] === V1_PREFIX && segments[1] === "health") {
+      return { ok: true, kind: "health" };
+    }
+    if (segments.length === 3 && segments[0] === V1_PREFIX) {
+      const [, domain2, operation2] = segments;
+      const stream = resolveStreamRoute(domain2, operation2);
+      if (stream !== void 0) {
+        return { ok: true, kind: "stream", gateway: stream.gateway, domain: domain2, operation: operation2 };
+      }
+    }
+    return {
+      ok: false,
+      status: 405,
+      code: "E_HTTP_METHOD_NOT_ALLOWED",
+      message: `method GET not allowed for '${pathname}'; only GET /v1/health and registered streaming ops are served`
+    };
+  }
+  if (method !== "POST") {
+    return {
+      ok: false,
+      status: 405,
+      code: "E_HTTP_METHOD_NOT_ALLOWED",
+      message: `method ${method ?? "<none>"} not allowed; gateway accepts POST`
+    };
+  }
+  if (segments.length === 3 && segments[0] === V1_PREFIX) {
+    const [, domain2, operation2] = segments;
+    const gateway2 = inferGateway(domain2, operation2);
+    if (gateway2 === void 0) {
+      return {
+        ok: false,
+        status: 404,
+        code: "E_HTTP_NOT_FOUND",
+        message: `unknown operation '${domain2}/${operation2}'; no registered query/mutate matches`
+      };
+    }
+    return { ok: true, kind: "unary", gateway: gateway2, domain: domain2, operation: operation2 };
+  }
+  if (segments.length !== 3) {
+    return {
+      ok: false,
+      status: 404,
+      code: "E_HTTP_NOT_FOUND",
+      message: `expected POST /v1/<domain>/<operation> or /<gateway>/<domain>/<operation>, got '${pathname}'`
+    };
+  }
+  const [gateway, domain, operation] = segments;
+  if (!GATEWAYS.has(gateway)) {
+    return {
+      ok: false,
+      status: 404,
+      code: "E_HTTP_NOT_FOUND",
+      message: `unknown gateway '${gateway}'; expected one of query, mutate`
+    };
+  }
+  return { ok: true, kind: "unary", gateway, domain, operation };
+}
+function readBody(req) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error(`request body exceeds ${MAX_BODY_BYTES} bytes`));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+function writeEdgeError(res, status, code, message) {
+  const body = {
+    meta: {
+      gateway: "query",
+      domain: "",
+      operation: "",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      duration_ms: 0,
+      source: "http",
+      requestId: ""
+    },
+    success: false,
+    error: { code, message }
+  };
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function writeHealth(res) {
+  const body = {
+    meta: {
+      gateway: "query",
+      domain: "gateway",
+      operation: "health",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      duration_ms: 0,
+      source: "http",
+      requestId: ""
+    },
+    success: true,
+    data: { status: "ok", version: V1_PREFIX }
+  };
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function parseStreamParams(url) {
+  const parsed = new URL(url ?? "/", "http://localhost");
+  const params = {};
+  for (const [key, value] of parsed.searchParams.entries()) {
+    const asNumber = Number(value);
+    params[key] = value !== "" && Number.isFinite(asNumber) ? asNumber : value;
+  }
+  return params;
+}
+function writeStreamError(res, domain, operation, requestId) {
+  const frame = {
+    kind: "error",
+    seq: 0,
+    error: {
+      code: "E_HTTP_NO_STREAM_SOURCE",
+      message: `no streaming source registered for '${domain}/${operation}'`
+    },
+    requestId
+  };
+  res.writeHead(200, { ...SSE_HEADERS });
+  res.end(encodeStreamEvent(frame));
+}
+async function handleStreamRequest(req, res, domain, operation, log2) {
+  const requestId = randomUUID2();
+  const source = resolveStreamSource(domain, operation);
+  if (source === void 0) {
+    writeStreamError(res, domain, operation, requestId);
+    log2.warn({ domain, operation }, "sse stream has no registered source");
+    return;
+  }
+  const controller = new AbortController();
+  const onClose = () => controller.abort();
+  req.once("close", onClose);
+  const context = {
+    domain,
+    operation,
+    params: parseStreamParams(req.url),
+    requestId
+  };
+  res.writeHead(200, { ...SSE_HEADERS });
+  const webStream = createSseStream((emitter) => source(emitter, context), controller.signal);
+  const reader = webStream.getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (res.writableEnded) break;
+      if (!res.write(value)) {
+        await new Promise((resolve2) => res.once("drain", resolve2));
+      }
+    }
+  } catch (err) {
+    log2.warn({ err, domain, operation }, "sse stream pipe failed");
+  } finally {
+    reader.releaseLock();
+    req.removeListener("close", onClose);
+    if (!controller.signal.aborted) controller.abort();
+    if (!res.writableEnded) res.end();
+    log2.debug({ domain, operation, requestId }, "sse stream closed");
+  }
+}
+async function handleHttpRequest(handler, req, res, log2, studioOpts) {
+  const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+  if (studioOpts !== void 0 && isStudioPath(pathname)) {
+    await serveStudioStatic(req, res, studioOpts);
+    return;
+  }
+  const route = parseHttpRoute(req.method, req.url);
+  if (!route.ok) {
+    writeEdgeError(res, route.status, route.code, route.message);
+    return;
+  }
+  if (route.kind === "health") {
+    writeHealth(res);
+    log2.debug({ route: "health" }, "http health probe served");
+    return;
+  }
+  if (route.kind === "stream") {
+    await handleStreamRequest(req, res, route.domain, route.operation, log2);
+    return;
+  }
+  let params;
+  try {
+    const raw = await readBody(req);
+    if (raw.trim().length > 0) {
+      const parsed = JSON.parse(raw);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        writeEdgeError(res, 400, "E_HTTP_BAD_REQUEST", "request body must be a JSON object");
+        return;
+      }
+      params = parsed;
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    writeEdgeError(res, 400, "E_HTTP_BAD_REQUEST", `invalid request body: ${message}`);
+    return;
+  }
+  const unary = {
+    gateway: route.gateway,
+    domain: route.domain,
+    operation: route.operation,
+    params
+  };
+  const result = await routeUnary(handler, unary);
+  res.writeHead(result.status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(result.body));
+  log2.debug(
+    {
+      gateway: route.gateway,
+      domain: route.domain,
+      operation: route.operation,
+      status: result.status
+    },
+    "http request routed"
+  );
+}
+function startHttpServer(handler, opts) {
+  const log2 = getLogger2("gateway-http");
+  const host = opts.host ?? "127.0.0.1";
+  const studioOpts = opts.studioStaticDir !== void 0 ? { staticDir: opts.studioStaticDir } : void 0;
+  if (studioOpts !== void 0) {
+    log2.info({ studioStaticDir: opts.studioStaticDir }, "studio static serving enabled at /studio");
+  }
+  const server = createServer((req, res) => {
+    handleHttpRequest(handler, req, res, log2, studioOpts).catch((err) => {
+      const message = err instanceof Error ? err.message : String(err);
+      log2.warn({ err }, "http request handling failed");
+      if (!res.headersSent) {
+        writeEdgeError(res, 500, "E_HTTP_INTERNAL", message);
+      } else if (!res.writableEnded) {
+        res.end();
+      }
+    });
+  });
+  const wsPty = opts.wsPty !== void 0 ? attachWsPtyEndpoint(server, opts.wsPty) : void 0;
+  return new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port, host, () => {
+      server.removeListener("error", reject);
+      const address = server.address();
+      const boundPort = typeof address === "object" && address !== null ? address.port : opts.port;
+      log2.info(
+        { host, port: boundPort, wsPty: wsPty !== void 0 },
+        "http gateway server listening"
+      );
+      let closed = false;
+      const handle = {
+        server,
+        port: boundPort,
+        host,
+        close() {
+          if (closed) return Promise.resolve();
+          closed = true;
+          wsPty?.close();
+          return new Promise((res) => {
+            server.close(() => res());
+            server.closeIdleConnections();
+          });
+        }
+      };
+      resolve2(handle);
+    });
+  });
+}
+
+export {
+  statusForResponse,
+  routeUnary,
+  encodeSseFrame,
+  encodeStreamEvent,
+  SSE_HEADERS,
+  createSseStream,
+  tickStreamSource,
+  registerStreamSource,
+  resolveStreamSource,
+  STUDIO_PREFIX,
+  isStudioPath,
+  resolveStudioAssetPath,
+  mimeType,
+  writeBundleAbsentError,
+  serveStudioStatic,
+  resolveStudioStaticDir,
+  WS_PTY_PATH,
+  NODE_PTY_INSTALL_HINT,
+  loadNodePty,
+  scrubPtyEnv,
+  computeAcceptKey,
+  encodeWsFrame,
+  decodeWsFrame,
+  authorizeUpgrade,
+  isWsPtyPath,
+  attachWsPtyEndpoint,
+  parseHttpRoute,
+  startHttpServer
+};
+//# sourceMappingURL=chunk-U2ESNIJ5.js.map