@harperfast/harper 5.3.0 → 5.3.1

package/server/DESIGN.md

@@ -16,7 +16,7 @@ This layer accepts inbound traffic on every supported protocol (HTTP/1.1, HTTP/2
 | **Operations API**            | `operationsServer.ts` | Fastify-based JSON operations API (`{operation: 'create_table', ...}`). Internal/admin surface — not on the hot path for application data.                                                      |
 | **Custom Functions (legacy)** | `fastifyRoutes.ts`    | Legacy custom functions only. Wraps Fastify with autoload. Don't add new code here.                                                                                                             |
 
-A request entering `http.ts` does **not** go through Fastify. The two `handleApplication(scope)` functions (one in each Fastify file) load independently from component config.
+A request entering `http.ts` does **not** go through Fastify unless no Harper handler answers it (status `-1` cascades to a registered Fastify instance). Of the two Fastify files only `fastifyRoutes.ts` has a `handleApplication(scope)`; `operationsServer.ts` is the `operationsApi` component, started once on the main thread through `startOnMainThread`.
 
 ---
 
@@ -57,7 +57,7 @@ A request entering `http.ts` does **not** go through Fastify. The two `handleApp
 | `throttle.ts`                              | Event-loop backpressure: runs a caller's calls one per `setImmediate` cycle and hands a call to the caller's limit handler (HTTP request queues, cache-source resolution) once queue depth × average cycle time passes the limit.                                                                                                                                                                                                                      |
 | `storageReclamation.ts`                    | Disk-pressure signals to downstream consumers; `getStorageSpaceStats()` is the shared quota-aware (falls back to `statfs`) source of available/free/size storage numbers — used by `Table.getStorageStats()` (#1976). NOT used for blob storage path weighting (`resources/blob.ts`): quota-status.json is a single instance-wide figure, so it can't distinguish between multiple `STORAGE_BLOBPATHS` disks — that still needs raw per-path `statfs`. |
 | `serverRegistry.ts`                        | Trivial registry export.                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `status/`                                  | Server status reporting (cluster status, per-port info).                                                                                                                                                                                                                                                                                                                                                                                               |
+| `status/`                                  | `get_status`/`set_status`/`clear_status` over `system.hdb_status`, aggregated with component status and (opt-in) the resolved middleware chains (#1573).                                                                                                                                                                                                                                                                                               |
 
 > **Subscription message identity contract.** `sharedMessageEncoding.ts` encodes a message once and
 > reuses the bytes for every subscriber of the topic, keyed on the message object's identity. That is
@@ -75,13 +75,13 @@ A request entering `http.ts` does **not** go through Fastify. The two `handleApp
 
 ### Threads
 
-| File                       | Purpose                                                  |
-| -------------------------- | -------------------------------------------------------- |
-| `threads/socketRouter.ts`  | Routes accepted sockets to worker threads based on port. |
-| `threads/manageThreads.js` | Thread pool lifecycle.                                   |
-| `threads/threadServer.js`  | Worker entry point — receives sockets via IPC.           |
-| `threads/itc.js`           | Inter-thread comms primitives.                           |
-| `transactionLogCooling.ts` | Main-thread timer that cools transaction-log mmaps.      |
+| File                       | Purpose                                                                                                                                                                           |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `threads/socketRouter.ts`  | Starts the HTTP worker pool (`startHTTPThreads`) and isolated applications' dedicated workers (`reconcileIsolatedWorkers`); workers bind their own ports, so no socket is routed. |
+| `threads/manageThreads.js` | Thread pool lifecycle.                                                                                                                                                            |
+| `threads/threadServer.js`  | Worker entry point — loads components (`startServers`) and binds each registered server itself (`listenOnPorts`, `reusePort` where the OS has it).                                |
+| `threads/itc.js`           | Inter-thread comms primitives.                                                                                                                                                    |
+| `transactionLogCooling.ts` | Main-thread timer that cools transaction-log mmaps.                                                                                                                               |
 
 Process-wide shutdown begins by calling `beginProcessShutdown()` in `threads/manageThreads.js`.
 Once set, this terminal state prevents every worker replacement path and makes new `startWorker()`
@@ -100,7 +100,7 @@ replacement without being awaited. Each wait is bounded by a per-worker startup
 resolution means "the restart finished", not "every worker is new". A caller that treats its own success as
 "the component is live" must await it (see `deployComponent` in `components/operations.js`).
 
-> Workers receive `workerData.noServerStart = true` — never start the server inside a worker.
+> `index.ts` sets `workerData.noServerStart = true` when Harper is imported from a thread it did not spawn, so `threadServer.js` skips `startServers()` there; Harper's own HTTP workers start their servers.
 >
 > `threadServer.listenOnDomainSocket()` skips a listener only when its path exceeds the platform's
 > `sockaddr_un.sun_path` byte limit (some Node versions reject it; others silently truncate it).
@@ -111,7 +111,7 @@ resolution means "the restart finished", not "every worker is new". A caller tha
 
 Single-instance background tasks pick their thread by what state they touch:
 
-- **Last worker** (`getWorkerIndex() === getWorkerCount() - 1`) — for tasks that operate on **worker-resident JS state**: audit cleanup (`resources/auditStore.ts`) and disk reclamation (`storageReclamation.ts`) walk per-store objects that only exist in a worker.
+- **Last worker** (`ownsStoreMaintenance(storePath)` in `threads/manageThreads.js`: the last pool worker for shared stores; a dedicated isolated-application worker maintains only its own branch stores) — for tasks that operate on **worker-resident JS state**: audit cleanup (`resources/auditStore.ts`), TTL scans (`resources/Table.ts`) and disk reclamation (`storageReclamation.ts`) walk per-store objects that only exist in a worker.
 - **Main thread** (`isMainThread`) — for tasks that drive a **process-global native singleton** and need no JS state. `transactionLogCooling.ts` is the example: rocksdb-js's transaction-log registry is one C++ static shared across all worker threads, so any thread cools every log. The main thread is chosen because it is the only thread that lives for the whole process — a worker-driven timer would stall whenever that worker is recycled.
 
 ---
@@ -125,8 +125,8 @@ Every entry is a top-level function or named const. Jump via go-to-symbol or `gr
 | `registerUdsCleanupPaths`, `recordUdsBindSuccess`, `cleanupUdsFiles`, `markUdsBindFailed`, `writeUdsMetadata`, `cleanupSocketsDirectory` | UDS socket / metadata file lifecycle. Ownership-aware: `recordUdsBindSuccess` captures the inode a worker's own bind confirmed; `cleanupUdsFiles`/`markUdsBindFailed` only unlink a path when the inode on disk still matches, so an overlapping restart's outgoing worker can never delete the replacement that already rebound the same path (see restartWorkers() in manageThreads.js). `cleanupSocketsDirectory` is the separate crash-path sweep, run once from `socketRouter.ts`'s `startHTTPThreads` on main-thread startup, before any worker can bind.                                                                                                                                                                                                                                     |
 | `handleApplication(scope)`                                                                                                               | Component entry point — captures `httpOptions` for the scope.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `getHttpOptions()`                                                                                                                       | Returns the current scope's `HttpOptions`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `deliverSocket()`                                                                                                                        | IPC-delivered socket handoff from `socketRouter`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `proxyRequest()`                                                                                                                         | Cross-port request routing.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `deliverSocket()`                                                                                                                        | Exported but called nowhere in core or harper-pro (`proxyRequest` is its only caller); workers bind their own ports.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `proxyRequest()`                                                                                                                         | Exported but called nowhere in core or harper-pro.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `registerServer()`                                                                                                                       | Records a server for a port in the `SERVERS` map.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `getPorts()`                                                                                                                             | Resolves listener options → list of `{port, secure}`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `httpServer()`                                                                                                                           | Main listener registration entry point.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
@@ -185,7 +185,7 @@ Consequences worth knowing:
 
 ## Operations authorization boundary
 
-Operations request bodies are untrusted data. `serverHandlers.js → handlePostRequest()` rejects
+Operations request bodies are untrusted data. `serverHelpers/serverHandlers.js → handlePostRequest()` rejects
 prototype-mutating property names and strips the legacy `bypass_auth` property before dispatch.
 `serverUtilities.ts → chooseOperation()` never reads authorization control from the body: trusted
 internal callers pass bypass state as a separate argument and expose it to operation handlers only
@@ -250,12 +250,13 @@ user resolution touches system-table searches (`listUsers()`) that raise a defau
 storage outage as an unknown credential and hand it to application authorization. The tag is set at
 exactly these points:
 
-| Tagged rejection                                                   | Where                                      |
-| ------------------------------------------------------------------ | ------------------------------------------ |
-| unknown user, inactive user, bad password                          | `security/user.ts → findAndValidateUser()` |
-| JWT syntax, signature, expiry, not-before, subject/claim rejection | `tokenAuthentication.ts → validateToken()` |
-| refresh-token hash mismatch, malformed scoped-token claims         | `tokenAuthentication.ts`                   |
-| an `Authorization` scheme Harper does not implement                | `security/auth.ts`                         |
+| Tagged rejection                                                   | Where                                                                                        |
+| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- |
+| unknown user, inactive user, bad password                          | `security/user.ts → findAndValidateUser()`                                                   |
+| JWT syntax, signature, expiry, not-before, subject/claim rejection | `security/tokenAuthentication.ts → validateToken()`                                          |
+| refresh-token hash mismatch, malformed scoped-token claims         | `security/tokenAuthentication.ts`                                                            |
+| an `Authorization` scheme Harper does not implement                | `security/auth.ts`                                                                           |
+| a component's `server.getUser` override that tags its own error    | `markCredentialRejection` / `credentialRejectionError`, exported from `harper` (harper#2703) |
 
 `validateToken()` separates the two in the same catch: `jsonwebtoken` reports unusable key material
 through the very same `JsonWebTokenError` type it uses for a forged token, so the public key is
@@ -271,14 +272,14 @@ internal detail never reaches an unauthenticated client.
 
 Any layer that establishes Harper owns the route then settles the deferred state before doing work:
 
-| Layer                                   | Where                                                              |
-| --------------------------------------- | ------------------------------------------------------------------ |
-| `REST.ts → http()`                      | after `resources.getMatch` succeeds (and for the OpenAPI document) |
-| `REST.ts` WebSocket handler             | after `resources.getMatch(url, 'ws')` succeeds                     |
-| `graphqlQuerying.ts`                    | after the `/graphql` prefix match, ahead of its error mapping      |
-| `static.ts`                             | after a static file entry matches                                  |
-| `mqtt.ts` WebSocket handler             | once the pending HTTP chain settles, before the first packet       |
-| `components/mcp/adapters/harperHttp.ts` | after the WebSocket hand-off, before the body is read              |
+| Layer                                   | Where                                                                                                                                                                      |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `REST.ts → http()`                      | after `resources.getMatch` succeeds (and for the OpenAPI document)                                                                                                         |
+| `REST.ts` WebSocket handler             | once the HTTP chain settles, _before_ `resources.getMatch(url, 'ws')` (`assertNoDeferredCredentialRejection`), so the close code cannot reveal whether the resource exists |
+| `graphqlQuerying.ts`                    | after the `/graphql` prefix match, ahead of its error mapping                                                                                                              |
+| `static.ts`                             | after a static file entry matches                                                                                                                                          |
+| `mqtt.ts` WebSocket handler             | once the pending HTTP chain settles, before the first packet                                                                                                               |
+| `components/mcp/adapters/harperHttp.ts` | after the WebSocket hand-off, before the body is read                                                                                                                      |
 
 **Every Harper-owned handler registered `after: 'authentication'` owes this settlement**, because
 declining to call `nextHandler` is precisely the moment ownership is settled. A handler that skips
@@ -363,7 +364,7 @@ The `@table(cacheControl:)` value is persisted on the primary-key attribute (lik
 | How are content types (de)serialized?                                      | `serverHelpers/contentTypes.ts`                                                                                                                                                                                                                                                                                                                                                                                        |
 | Why doesn't every MQTT subscriber re-serialize the message it receives?    | `serverHelpers/sharedMessageEncoding.ts` (memoized on the message object the fan-out shares); consumed by the outbound listener in `mqtt.ts`                                                                                                                                                                                                                                                                           |
 | Where do durable subscriptions live?                                       | `DurableSubscriptionsSession.ts`                                                                                                                                                                                                                                                                                                                                                                                       |
-| How are sockets dispatched to worker threads?                              | `threads/socketRouter.ts`                                                                                                                                                                                                                                                                                                                                                                                              |
+| How do worker threads get their connections?                               | Each binds its ports itself after the main thread's first bind (`threads/threadServer.js → listenOnPorts`, `reusePort` where the OS has it); `threads/socketRouter.ts → startHTTPThreads` starts them                                                                                                                                                                                                                  |
 | Where is the Operations API wired into Fastify?                            | `operationsServer.ts → buildServer`                                                                                                                                                                                                                                                                                                                                                                                    |
 
 ---
@@ -371,7 +372,7 @@ The `@table(cacheControl:)` value is persisted on the primary-key attribute (lik
 ## Conventions
 
 - Don't add new code to `fastifyRoutes.ts` — it's the legacy custom-functions path.
-- New protocol plugins implement the `Server` interface (in `Server.ts`) and register via `onRequest`/`onUpgrade`/`onWebSocket`.
+- New protocol plugins register through the `Server` interface (`Server.ts`): `server.http()`/`request()`/`ws()`/`upgrade()` (bound to `http.ts`'s `httpServer`/`onRequest`/`onWebSocket`/`onUpgrade`) and `server.socket()` (`threadServer.js → onSocket`).
 - Always pass `name` when registering a listener with `before`/`after` — anonymous entries can't be ordered against.
 - Tests live in `../unitTests/server/`.
 
@@ -384,13 +385,13 @@ invoked, because the scope is written in that namespace (`sql`, `export_local`,
 make that awkward:
 
 1. On the **direct-SQL** path, the object handed to `checkASTPermissions` _is_ the client's request
-   body, and this check is the only gate there (`chooseOperation`'s `sql` branch is mutually
-   exclusive with its `verifyPerms` call). Any field read off that object is therefore a way to
+   body, and this check is the only table and token-scope gate there (`chooseOperation`'s `sql` branch
+   is mutually exclusive with its `verifyPerms` call; only `verifyOperationsAllowlist` also runs). Any field read off that object is therefore a way to
    name whichever operation the caller's scope happens to allow and run arbitrary SQL under it.
    `jsonMessage.operation` is safe only because dispatch already routed on that same field, so it
    cannot disagree with the operation running. Never add another.
 2. A **job** re-parses its SQL from the nested `search_operation` in a _different_ async context —
-   `executeJob` persists the request and hands off to the job runner, and `jobProcess.ts` re-enters
+   `executeJob` persists the request and hands off to the job runner, and `jobs/jobProcess.ts` re-enters
    from the `hdb_job` record. So a store established around the originating request cannot reach
    it, and the re-parse would be judged as `sql` rather than as the job's own operation.
 
@@ -485,7 +486,7 @@ on `scope.options.on('change', ...)`. Three invariants to preserve:
   response. CI first caught this on the uWS shard (the integration suite's only unauthenticated
   404 case landed there); the same bug existed unnoticed on Bun's parallel `status === -1`
   branches (`getBunHTTPServer`'s bare-404 return and `bunDelegateToNodeServer`'s two `Response`s)
-  and is fixed alongside it in `harper-1568-fix2`.
+  and is fixed alongside it in #1568.
 
 **Why the operations API doesn't get these headers in normal mode**: ops requests _do_ flow
 through the Harper-native `requestHandler` (`httpServer()` calls `getServer()` for every
@@ -525,7 +526,7 @@ without asking to close at all, since 1.0 persistence needs both an explicit `ke
 to read to — so a 1.0 response that got no `Content-Length` is close-delimited, the same line Node
 draws (Node closes it at ~7ms; Bun never does). An explicit `close` token wins over `keep-alive` on
 both versions. A 1.0 `keep-alive` request whose response _did_ get a
-`Content-Length` (`body.size` on a blob, `server/http.ts:698-709`) is left open, which is again what
+`Content-Length` (`body.size` on a blob — the `body instanceof Blob` branch of `getHTTPServer`'s request handler) is left open, which is again what
 Node does and what Bun then handles correctly.
 
 `pipeBodyToResponse()` therefore ends `request.socket` itself for those shapes
@@ -571,6 +572,35 @@ matching Node's upgrade-then-authorize order). No core component registers custo
 middleware; `onUpgrade()`/`installUwsWsHandler()` warn when one is registered for a uWS-served
 port so the gap is visible instead of silent.
 
+## A per-thread UDS mirror is bound at a temp name and renamed over its published path (`server/threads/threadServer.js`)
+
+libuv unlinks a pipe server's bound path when the handle closes (`uv__pipe_close` → `unlink`), with
+no check of who owns the path now. On Linux `restartWorkers()` pre-starts the replacement worker
+while the outgoing one still runs (#1417), and both publish the same `<worker>-<port>.sock`. Bound
+directly at that path, the replacement rebinds it and the outgoing worker's `closeServers()` then
+deletes the replacement's socket — Harper's own `cleanupUdsFiles()` is inode-ownership-aware
+(#2035) and skips it, but libuv's unlink ran after that and removed every mirror on every rolling
+restart (#2961). So `listenOnDomainSocket()` binds a mirror (`server.isPerThreadSocket`) at
+`.<threadId>.<seq>` in the sockets directory and `renameSync()`s it over the published path:
+`rename()` keeps the listening inode, so the close-time unlink only ever targets a temp name that
+no longer exists, and the published path is never absent between an unlink and a bind.
+
+- `recordUdsBindSuccess(publishedPath)` runs after the rename, so the identity it records is the
+  inode that is listening; `cleanupUdsFiles()`'s ownership guard is unchanged and is now the only
+  thing that removes a mirror's published file. The regression and the shutdown sequence are
+  covered by `unitTests/server/threads/threadServerListenOnPorts.test.js`; the real rolling restart
+  by `integrationTests/server/uds-mirror-overlapping-restart.test.ts`.
+- The temp name is unique per process (`threadId` never repeats; `seq` is per thread); both it and
+  the published path are checked with `isDomainSocketPathTooLong`, and an overlong one takes the
+  existing fail-soft branch rather than falling back to a direct bind; it never matches a proxy's
+  `*-<port>.yaml`/`.sock` discovery; a leftover from a crash is swept by `cleanupSocketsDirectory()`
+  before any worker binds.
+- The operations API's primary domain socket keeps the direct bind on purpose: `bin/cliOperations.ts`
+  reads that file's presence as "Harper is running", so its unlink on close is load-bearing.
+- The uWS mirror (`HARPER_UWS_UDS`) keeps its direct bind: measured on uWebSockets.js 20.68.0,
+  `app.close()` never unlinks a `listen_unix` path, so it is not exposed. Bun restarts are
+  non-overlapping, so the Bun mirror is not exposed either.
+
 ## A worker that misses an ITC ack gets its OS thread state logged (`server/threads/manageThreads.js`)
 
 `broadcastWithAcknowledgement` already times out (30 s) on a worker whose port stays open but never acks, and that shape is almost always a blocked event loop — a native lock, a runaway synchronous call — which nothing inside the worker can report (harper-pro#788: a restarted node's single http worker went byte-silent while main kept serving `cluster_status`, and the app log only said "not acknowledged by worker thread(s) 2"). So each worker posts its Linux thread id (`readlink /proc/thread-self`) to main once at startup, before anything else runs on it, and the timeout branch reads that thread's kernel state from `/proc/self/task/<tid>`: state, `wchan`, the syscall number (the first token only — the rest of that file is argument registers and stack/instruction pointers), CPU ticks, and context-switch counts, plus two cross-platform signals main already has, `worker.performance.eventLoopUtilization()` and the age of the last 1 s resource report. It samples again a second later and logs the deltas: no CPU ticks, no context switches and `event loop active +1000ms` is "parked on a lock"; ticks climbing with state `R` is "spinning". It is deliberately main-thread-only and best-effort: `workers` and the tid live on the main thread's `Worker` objects, every `/proc` field is reported individually (a hardened container may deny `wchan`/`syscall` while `stat` stays readable), a follow-up sample whose `starttime` differs from the first is discarded (the tid may have been recycled), one diagnostic runs per worker with a 30 s cooldown so concurrent timeouts on the same worker don't multiply reads, and nothing here runs when acks arrive on time. It does not name the lock owner; that still needs a native stack from the next occurrence.
@@ -599,7 +629,7 @@ The SQL and job paths are additive rather than exclusive: `verifyPermsAST` valid
 
 ## `withNodeAdapter()`'s response is the body `PassThrough` it resolves with (`server/serverHelpers/NodeAdapterResponse.ts`)
 
-`Request.withNodeAdapter(handler)` gives third-party Node middleware an `IncomingMessage`/`ServerResponse` pair and resolves `{ status, headers, body }` once headers are committed. The response is `NodeAdapterResponse extends PassThrough`, and that same stream is the resolved `body`: `write()`'s return value, `'drain'`, `'finish'`, `'close'`, `writableEnded`/`writableFinished` and destroy propagation are Node's own rather than events forwarded from a second stream, which is what `Readable.pipe`, `compression`'s buffered `res.on('drain')` and Next.js's response writer depend on past the high-water mark (#2527). Invariants that middleware exercises and the unit test `unitTests/server/serverHelpers/nodeAdapterMiddleware.test.js` pins against the real `compression` (1.8 and the 1.7.4 Next.js vendors), `send`, `on-finished` and `on-headers`:
+`Request.withNodeAdapter(handler)` gives third-party Node middleware an `IncomingMessage`/`ServerResponse` pair and resolves `{ status, headers, body }` once headers are committed. The response is `NodeAdapterResponse extends PassThrough`, and that same stream is the resolved `body`: `write()`'s return value, `'drain'`, `'finish'`, `'close'`, `writableEnded`/`writableFinished` and destroy propagation are Node's own rather than events forwarded from a second stream, which is what `Readable.pipe`, `compression`'s buffered `res.on('drain')` and Next.js's response writer depend on past the high-water mark (#2527). Invariants that middleware exercises and the unit test `unitTests/server/serverHelpers/nodeAdapterMiddleware.test.js` pins against the real `compression` 1.8 (its `compression-1.7` arm, meant for the 1.7.4 that Next.js vendors, has resolved to 1.8.2 since #2877, so 1.7.4 is currently untested), `send`, `on-finished` and `on-headers`:
 
 - **Headers commit exactly once, through `this.writeHead`.** `write()`, `end()`, `flushHeaders()` and `_implicitHeader()` all reach `this.writeHead(this.statusCode)` by property lookup, so a `writeHead` that `on-headers` replaced on the instance runs its listeners (the ones that set `Content-Encoding` and remove `Content-Length`) before the promise resolves. After commit, `setHeader`/`appendHeader`/`removeHeader` and a second `writeHead` throw `ERR_HTTP_HEADERS_SENT` as Node's do; `_header` (which `compression` ≤ 1.7 tests instead of `headersSent`) and `finished` (which `on-finished` tests) derive from that state.
 - **The adapter owns the `'error'` listener.** A `destroy(err)` right after `writeHead()` emits before the awaiting caller can attach one; the error stays in the stream's `errored` state for `pipeline()`, `finished()` or async iteration. Client disconnect (`Request.signal`) destroys the response without an error after headers (a plain premature close, which `pipeBodyToResponse` treats as routine) and rejects the promise with the abort reason before them; a handler that throws or rejects before ending the response destroys it, and one that fails after `end()` is logged at warn.
@@ -680,3 +710,7 @@ A response stream that fails after its first byte has no status left to report t
 Node gets this from `stream.pipeline` in `pipeBodyToResponse`. uWS has no Writable to pipe into, so `streamResponse` wires the events itself and calls `res.close()`, which also runs `onAborted` and aborts the request signal. It also checks `source.destroyed`: the uWS handler resolves asynchronously, so a source can be destroyed, and its `'close'` already emitted, before the sink listens for it — the response would stay open forever. The `'error'` listener goes on before that check, because `destroy(error)` emits on a later tick and an `'error'` with no listener is thrown. Under Bun the main port is a `node:http` server and takes the `pipeBodyToResponse` path; the `Bun.serve` fetch handler buffers a stream body before it responds, so a failed source there is an ordinary error response.
 
 This is the transport's fallback, not the error contract. SSE and NDJSON GETs hold their first step so an immediate failure is still an HTTP status, and they report later failures in-band ([Streaming startup errors](#streaming-startup-errors)). Every other format commits when the handler returns the stream, so a failure before its first chunk aborts the connection too. Pinned by `unitTests/server/serverHelpers/uwsServer.test.js` ("a response stream that does not end cleanly") and, end to end on every runtime leg, by `integrationTests/server/response-compression.test.ts`.
+
+## A coarse uWS 413 drains a closing upload before ending the response
+
+uWS force-closes a completed `Connection: close` response while an upload is still arriving, which can lose its status to EPIPE. `uwsServer.ts` flushes a non-empty coarse-limit 413 chunk before discarding bytes until body end or a one-second deadline; that absolute resource bound guarantees early status, not complete framing for a sender that ignores it. Destroying a paused Readable does not clear its queue, so teardown removes data listeners and reads out queued bytes in bounded chunks before retaining the response. Native abort disarms the finisher independently of handler cancellation. "uWS oversized TCP uploads" in `unitTests/server/serverHelpers/uwsServer.test.js` pins these paths and unchanged immediate keep-alive rejection. Other rejection sites, including downstream responses from `contentTypes.ts`'s default 10 MB limit, still end immediately and remain outside this coarse-cap correction.

package/server/http.ts

@@ -6,6 +6,7 @@
 import { currentThreadId } from '@harperfast/rocksdb-js';
 import { Scope } from '../components/Scope.ts';
 import { Socket } from 'node:net';
+import { setMaxListeners } from 'node:events';
 import harperLogger from '../utility/logging/harper_logger.ts';
 import { parentPort } from 'node:worker_threads';
 import * as env from '../utility/environment/environmentManager.ts';
@@ -1769,12 +1770,21 @@ function onWebSocket(listener: (ws: WebSocket) => void, options: OnWebSocketOpti
 			if (options.maxPayload != null) cfg.wsMaxPayload = options.maxPayload;
 			cfg.wsHandler = (ws: any, upgrade: any) => {
 				try {
+					// UwsRequest.signal falls back to a controller nothing can fire. Wire a real one, the
+					// same way uwsServer.ts's HTTP path wires res.onAborted.
+					const ac = new AbortController();
+					// One controller per connection, but one abort listener per in-flight message-handling
+					// transaction (resources/transaction.ts) — a busy connection can hold more than
+					// EventEmitter's default 10-listener warning threshold on perfectly normal traffic.
+					setMaxListeners(0, ac.signal);
+					ws.once('close', () => ac.abort());
 					const request: any = new UwsRequest({
 						method: 'GET',
 						url: upgrade.url,
 						headers: upgrade.headers,
 						secure,
 						ip: upgrade.ip,
+						signal: ac.signal,
 					});
 					request.isWebSocket = true;
 					const chainCompletion = httpChain[port](request);

package/server/serverHelpers/Request.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage as NodeIncomingMessage, ServerResponse as NodeServerResponse } from 'node:http';
 import type { Socket } from 'node:net';
 import { TLSSocket } from 'node:tls';
+import { setMaxListeners } from 'node:events';
 import { Readable } from 'node:stream';
 import { Headers as ResponseHeaders } from './Headers.ts';
 import { NodeAdapterResponse, type AdaptedResponse } from './NodeAdapterResponse.ts';
@@ -72,6 +73,7 @@ export class Request {
 		this.url = url;
 		this.headers = new RequestHeaders(nodeRequest.headers);
 		this.__harperRequestUpgraded = false;
+		setMaxListeners(0, this.#abortController.signal);
 		// Abort the request's signal on premature client disconnect. nodeResponse 'close'
 		// also fires on clean completion; the writableFinished guard restricts to disconnect.
 		if (typeof nodeResponse?.on === 'function') {
@@ -399,6 +401,7 @@ export class UwsRequest {
 		this.#ip = source.ip;
 		this.#body = source.body;
 		this.#signal = source.signal;
+		if (this.#signal) setMaxListeners(0, this.#signal);
 		this.__harperRequestUpgraded = false;
 	}
 	get absoluteURL() {
@@ -466,10 +469,15 @@ export class UwsRequest {
 		return this.#signal?.aborted ?? false;
 	}
 	get signal(): AbortSignal {
-		return this.#signal ?? new AbortController().signal;
+		if (!this.#signal) {
+			this.#signal = new AbortController().signal;
+			setMaxListeners(0, this.#signal);
+		}
+		return this.#signal;
 	}
 	_abort(): void {
-		// Abort is driven by the uWS res.onAborted handler wired into the provided signal.
+		// Abort is driven externally, wired into the provided signal (uWS res.onAborted for plain HTTP,
+		// the ws adapter's 'close' event for WebSocket upgrades — see server/http.ts's wsHandler).
 	}
 	get nodeRequest() {
 		return null;

package/server/serverHelpers/contentTypes.ts

@@ -216,11 +216,11 @@ mediaTypes.set('application/x-www-form-urlencoded', {
 		const stringData = Buffer.isBuffer(data) ? data.toString('utf8') : data;
 		const object: Record<string, string | string[]> = {};
 		for (const [key, value] of new URLSearchParams(stringData)) {
-			if (object.hasOwnProperty(key)) {
+			if (Object.hasOwn(object, key)) {
 				// in case there are multiple query params with the same name, convert them to an array
 				const last = object[key];
 				if (Array.isArray(last)) last.push(value);
-				else object.key = [last, value];
+				else object[key] = [last, value];
 			} else object[key] = value;
 		}
 		return object;
@@ -228,7 +228,9 @@ mediaTypes.set('application/x-www-form-urlencoded', {
 	serialize(data) {
 		const usp = new URLSearchParams();
 		for (const key in data) {
-			usp.set(key, data);
+			const value = data[key];
+			if (Array.isArray(value)) for (const item of value) usp.append(key, item);
+			else usp.set(key, value);
 		}
 		return usp.toString();
 	},

package/server/serverHelpers/uwsServer.ts

@@ -138,10 +138,15 @@ export async function createUwsServer(options: UwsServerOptions): Promise<{ app:
 		const ip = port != null ? normalizeAddress(Buffer.from(res.getRemoteAddressAsText()).toString()) : undefined;
 
 		const ac = new AbortController();
-		res.onAborted(() => ac.abort());
-		// Once a response has been committed (handler result, error, or a 413), writing again to the
-		// same uWS response is invalid and aborts the process — so every write site guards on this in
-		// addition to ac.signal.aborted (which only covers a client-side teardown, not our own writes).
+		let bodyDrainTimeout: ReturnType<typeof setTimeout> | undefined;
+		let finishRejectedResponse: (() => void) | undefined;
+		res.onAborted(() => {
+			clearTimeout(bodyDrainTimeout);
+			finishRejectedResponse = undefined;
+			ac.abort();
+		});
+		// A second handler response is invalid in uWS. The deferred 413 end instead uses its
+		// own finisher, which native onAborted invalidates independently of handler cancellation.
 		let responseCompleted = false;
 
 		const dispatch = (body?: UwsRequestBody) => {
@@ -183,19 +188,41 @@ export async function createUwsServer(options: UwsServerOptions): Promise<{ app:
 				if (ended || body.destroyed) return;
 				ended = true;
 				body.destroy(error && body.listenerCount('error') > 0 ? error : undefined);
+				body.removeAllListeners('data');
+				while (body.readableLength) body.read(Math.min(body.readableLength, body.readableHighWaterMark));
 			};
 			ac.signal.addEventListener('abort', () => tearDown(new Error('request aborted')), { once: true });
 			res.onData((chunk: ArrayBuffer, isLast: boolean) => {
-				if (ended || body.destroyed) return;
+				if (ended || body.destroyed) {
+					if (isLast) finishRejectedResponse?.();
+					return;
+				}
 				total += chunk.byteLength;
 				if (total > maxBodyBytes) {
+					const error = new ClientError(`Request body exceeds ${maxBodyBytes} bytes`, 413);
 					// Only send 413 if nothing has been written yet: the handler may have already responded
 					// (or streamed) without consuming the body, and writing to that completed response aborts.
 					if (!ac.signal.aborted && !responseCompleted) {
 						responseCompleted = true;
-						res.cork(() => res.writeStatus('413 Payload Too Large').end());
+						const connection = Array.isArray(headers.connection) ? headers.connection[0] : headers.connection;
+						res.cork(() => {
+							res.writeStatus('413 Payload Too Large');
+							if (!isLast && typeof connection === 'string' && connection.toLowerCase() === 'close') {
+								res.writeHeader('Connection', 'close');
+								res.writeHeader('content-type', 'text/plain');
+								res.write(errorToString(error));
+								finishRejectedResponse = () => {
+									if (!finishRejectedResponse) return;
+									finishRejectedResponse = undefined;
+									clearTimeout(bodyDrainTimeout);
+									res.cork(() => res.end());
+								};
+								bodyDrainTimeout = setTimeout(finishRejectedResponse, 1_000);
+								bodyDrainTimeout.unref();
+							} else res.end();
+						});
 					}
-					tearDown(new ClientError(`Request body exceeds ${maxBodyBytes} bytes`, 413));
+					tearDown(error);
 					ac.abort();
 					return;
 				}

package/server/threads/manageThreads.js

@@ -158,7 +158,16 @@ function notifyJobCleanupComplete() {
 
 const listenersByType = new Map();
 const messagesQueuedByType = new Map();
-
+const { promise: whenThreadsStarted, resolve: threadsHaveStarted } = Promise.withResolvers();
+const initialRestartNumber = workerData?.restartNumber || 1;
+// Identifies this process incarnation, where the PID cannot: a container reuses PID 1. Minted once
+// on the main thread and carried to workers, so live siblings agree on it — one derived per thread
+// would not. `undefined` on a worker started without it; consumers must fall back, not treat that
+// as a mismatch.
+const processIncarnation = workerData ? workerData.processIncarnation : randomBytes(8).toString('hex');
+
+// Every value in this literal is a bare identifier: Node's CommonJS export scan, which supplies the
+// named bindings an ES module import can use, stops reading the literal at the first value that is not.
 module.exports = {
 	startWorker,
 	restartWorkers,
@@ -206,17 +215,13 @@ module.exports = {
 	terminateProcessGroupsForThread,
 	isProcessGroupAlive,
 	isThreadRunning,
-	restartNumber: workerData?.restartNumber || 1,
-	// Identifies this process incarnation, where the PID cannot: a container reuses PID 1. Minted once
-	// on the main thread and carried to workers, so live siblings agree on it — one derived per thread
-	// would not. `undefined` on a worker started without it; consumers must fall back, not treat that
-	// as a mismatch.
-	processIncarnation: workerData ? workerData.processIncarnation : randomBytes(8).toString('hex'),
-	// Assigned further down once defined. Listed here because TypeScript 7 only treats keys of this
-	// literal as exports of the module, not later `module.exports.x =` assignments.
+	restartNumber: initialRestartNumber,
+	processIncarnation,
+	whenThreadsStarted,
+	threadsHaveStarted,
+	// Assigned further down once defined. TypeScript 7 only treats keys of this literal as exports and
+	// types them from it, so only a value that cannot be built before the literal belongs here.
 	sendToThread: undefined,
-	whenThreadsStarted: undefined,
-	threadsHaveStarted: undefined,
 	getThreadInfo: undefined,
 	getRunningIsolatedApplications: undefined,
 	watchDir: undefined,
@@ -241,9 +246,6 @@ connectedPorts.sendToThread = function (threadId, message) {
 // Direct thread-to-thread send, so a worker can reach a sibling (e.g. the record lock owner worker)
 // without a hop through main. Returns false when no port for the thread is connected.
 module.exports.sendToThread = connectedPorts.sendToThread;
-module.exports.whenThreadsStarted = new Promise((resolve) => {
-	module.exports.threadsHaveStarted = resolve;
-});
 
 // make sure this is set on all threads, including the main thread (this is no-op
 // if it was already with the execArgv below)

package/server/threads/threadServer.js

@@ -2,8 +2,8 @@
 
 const { isMainThread, parentPort, threadId, workerData } = require('node:worker_threads');
 const { createServer: createSocketServer } = require('node:net');
-const { unlinkSync, existsSync, mkdirSync } = require('fs');
-const { join } = require('path');
+const { unlinkSync, existsSync, mkdirSync, renameSync } = require('node:fs');
+const { join, dirname } = require('node:path');
 let componentsLoadedResolve;
 exports.whenComponentsLoaded = new Promise((resolve) => {
 	componentsLoadedResolve = resolve;
@@ -304,22 +304,35 @@ function startServers() {
  * An overlong path is the only condition that can skip a domain-socket listener. Check before
  * listen() because supported Node versions differ: some reject the path while others truncate and
  * bind it somewhere clients cannot reach using the configured path.
+ *
+ * A per-thread mirror binds at a temp name and is renamed over its published path: libuv unlinks a
+ * pipe server's bound path on close whoever owns it by then (server/DESIGN.md).
  */
 function listenOnDomainSocket(port, server) {
-	if (isDomainSocketPathTooLong(port)) {
+	const bindPath = server.isPerThreadSocket && !isWindows ? mirrorBindPath(port) : port;
+	const overlong = [port, bindPath].find((path) => isDomainSocketPathTooLong(path));
+	if (overlong) {
 		httpComponent.markUdsBindFailed(port);
 		harperLogger.error(
-			`Not binding domain socket listener${server.name ? ` for '${server.name}'` : ''} at ${port}: the ${Buffer.byteLength(port)}-byte path exceeds the platform limit of ${getDomainSocketPathMaxBytes()} bytes. Continuing without this domain socket.`
+			`Not binding domain socket listener${server.name ? ` for '${server.name}'` : ''} at ${port}: the ${Buffer.byteLength(overlong)}-byte path ${overlong} exceeds the platform limit of ${getDomainSocketPathMaxBytes()} bytes. Continuing without this domain socket.`
 		);
 		return Promise.resolve({ port, failed: true });
 	}
-	if (existsSync(port)) unlinkSync(port);
+	if (bindPath === port && existsSync(port)) unlinkSync(port);
 	return new Promise((resolve, reject) => {
 		function onError(error) {
 			reject(error);
 		}
 		function onListening() {
 			server.removeListener('error', onError);
+			if (bindPath !== port) {
+				try {
+					renameSync(bindPath, port);
+				} catch (error) {
+					server.close(); // libuv unlinks the temp name, which still exists
+					return reject(error);
+				}
+			}
 			// Record ownership of the inode we just bound, so cleanupUdsFiles()/markUdsBindFailed()
 			// (see http.ts) can tell this worker's own file apart from a replacement's later rebind
 			// at the same path (see registerUdsCleanupPaths). A no-op for domain sockets that aren't
@@ -330,7 +343,7 @@ function listenOnDomainSocket(port, server) {
 		}
 		try {
 			server.once('error', onError);
-			server.listen({ path: port }, onListening);
+			server.listen({ path: bindPath }, onListening);
 		} catch (error) {
 			server.removeListener('error', onError);
 			reject(error);
@@ -338,6 +351,11 @@ function listenOnDomainSocket(port, server) {
 	});
 }
 
+let mirrorBindSequence = 0;
+function mirrorBindPath(socketPath) {
+	return join(dirname(socketPath), `.${threadId}.${++mirrorBindSequence}`);
+}
+
 let listening;
 function listenOnPorts() {
 	if (isBun) return listenOnPortsBun();

package/studio/web/assets/{Chat-CNEKMllJ.js → Chat-4LMxI0yB.js}

@@ -1,4 +1,4 @@
-import{i as e,t}from"./rolldown-runtime-Dd_uD5pT.js";import{C as n,S as r,_ as i,a,b as o,c as s,f as c,g as l,h as u,l as d,m as f,n as p,o as m,p as h,r as g,s as _,t as v,v as y,x as b,y as x}from"./vendor-core-6LhfJlRC.js";import{n as S}from"./cn-6T8VranJ.js";import{a as ee}from"./vendor-datadog-ozKf-pts.js";import{r as te}from"./vendor-react-BOliS0BL.js";import{B as ne,R as re,Y as ie,k as ae}from"./vendor-tanstack-Bntfka-M.js";import{n as oe}from"./setSessionStorage-B0bf71m4.js";import{t as se}from"./button-DWwfgGWI.js";import{Rt as ce}from"./vendor-ui-9EYYDgoN.js";import{t as C}from"./createLucideIcon-fO5dL7D5.js";import{n as le,r as ue,t as de}from"./chevron-up-CFxbMGv2.js";import{c as fe,f as pe,h as me,i as he,l as ge,m as _e,p as ve,r as ye,t as be,u as xe}from"./setComponentFile-DpjrRqeG.js";import{t as Se}from"./localStorageKeys-etzFY_xV.js";import{Ar as Ce,At as we,Bn as Te,Br as Ee,Er as De,Fr as Oe,H as ke,Hr as Ae,Ln as je,Nt as Me,Pr as Ne,Tn as Pe,Ur as Fe,V as Ie,Z as Le,c as Re,d as ze,f as Be,ft as Ve,gt as He,ir as Ue,jt as We,kt as Ge,m as Ke,nn as qe,qr as Je,ut as Ye,vr as Xe,wr as Ze,xr as Qe}from"./index-BuqFjN5K.js";import{t as $e}from"./useEntityRestURL-TNrh77-s.js";import{n as et,t as tt}from"./FloatingChat-CEnWhHeR.js";import{n as nt}from"./getAnalytics-C0FHjtdQ.js";var rt={name:`between-horizontal-start`,size:24,node:[[`rect`,{width:`13`,height:`7`,x:`8`,y:`3`,rx:`1`,key:`pkso9a`}],[`path`,{d:`m2 9 3 3-3 3`,key:`1agib5`}],[`rect`,{width:`13`,height:`7`,x:`8`,y:`14`,rx:`1`,key:`1q5fc1`}]],aliases:[`between-horizonal-start`]};rt.node;var it=C(rt),at={name:`book`,size:24,node:[[`path`,{d:`M4 19.5v-15A2.5 2.5 0 0 1 6.5 2H19a1 1 0 0 1 1 1v18a1 1 0 0 1-1 1H6.5a1 1 0 0 1 0-5H20`,key:`k3hazp`}]]};at.node;var ot=C(at),st={name:`chart-area`,size:24,node:[[`path`,{d:`M3 3v16a2 2 0 0 0 2 2h16`,key:`c24i48`}],[`path`,{d:`M7 11.207a.5.5 0 0 1 .146-.353l2-2a.5.5 0 0 1 .708 0l3.292 3.292a.5.5 0 0 0 .708 0l4.292-4.292a.5.5 0 0 1 .854.353V16a1 1 0 0 1-1 1H8a1 1 0 0 1-1-1z`,key:`q0gr47`}]],aliases:[`area-chart`]};st.node;var ct=C(st),lt={name:`circle-x`,size:24,node:[[`circle`,{cx:`12`,cy:`12`,r:`10`,key:`1mglay`}],[`path`,{d:`m15 9-6 6`,key:`1uzhvr`}],[`path`,{d:`m9 9 6 6`,key:`z0biqf`}]],aliases:[`x-circle`]};lt.node;var ut=C(lt),dt={name:`file-pen`,size:24,node:[[`path`,{d:`M12.659 22H18a2 2 0 0 0 2-2V8a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 14 2H6a2 2 0 0 0-2 2v9.34`,key:`o6klzx`}],[`path`,{d:`M14 2v5a1 1 0 0 0 1 1h5`,key:`wfsgrz`}],[`path`,{d:`M10.378 12.622a1 1 0 0 1 3 3.003L8.36 20.637a2 2 0 0 1-.854.506l-2.867.837a.5.5 0 0 1-.62-.62l.836-2.869a2 2 0 0 1 .506-.853z`,key:`zhnas1`}]],aliases:[`file-edit`]};dt.node;var ft=C(dt),pt={name:`logs`,size:24,node:[[`path`,{d:`M3 5h1`,key:`1mv5vm`}],[`path`,{d:`M3 12h1`,key:`lp3yf2`}],[`path`,{d:`M3 19h1`,key:`w6f3n9`}],[`path`,{d:`M8 5h1`,key:`1nxr5w`}],[`path`,{d:`M8 12h1`,key:`1con00`}],[`path`,{d:`M8 19h1`,key:`k7p10e`}],[`path`,{d:`M13 5h8`,key:`a7qcls`}],[`path`,{d:`M13 12h8`,key:`h98zly`}],[`path`,{d:`M13 19h8`,key:`c3s6r1`}]]};pt.node;var mt=C(pt),ht={name:`message-square-heart`,size:24,node:[[`path`,{d:`M22 17a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 21.286V5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2z`,key:`18887p`}],[`path`,{d:`M7.5 9.5c0 .687.265 1.383.697 1.844l3.009 3.264a1.14 1.14 0 0 0 .407.314 1 1 0 0 0 .783-.004 1.14 1.14 0 0 0 .398-.31l3.008-3.264A2.77 2.77 0 0 0 16.5 9.5 2.5 2.5 0 0 0 12 8a2.5 2.5 0 0 0-4.5 1.5`,key:`1faxuh`}]]};ht.node;var gt=C(ht),_t={name:`send`,size:24,node:[[`path`,{d:`M14.536 21.686a.5.5 0 0 0 .937-.024l6.5-19a.496.496 0 0 0-.635-.635l-19 6.5a.5.5 0 0 0-.024.937l7.93 3.18a2 2 0 0 1 1.112 1.11z`,key:`1ffxy3`}],[`path`,{d:`m21.854 2.147-10.94 10.939`,key:`12cjpa`}]]};_t.node;var vt=C(_t),yt={name:`user`,size:24,node:[[`path`,{d:`M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2`,key:`975kel`}],[`circle`,{cx:`12`,cy:`7`,r:`4`,key:`17ys0d`}]]};yt.node;var bt=C(yt),xt={name:`wrench`,size:24,node:[[`path`,{d:`M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z`,key:`1ngwbx`}]]};xt.node;var St=C(xt);async function Ct(){await S.delete(`/Chat/Messages/`)}var w=e(ee(),1),T=te();function wt({setMessages:e}){let[t,n]=(0,w.useState)(!1),r=(0,w.useCallback)(async()=>{if(!t){n(!0);try{await Ct(),e([])}catch(e){console.error(`Failed to clear chat:`,e)}finally{n(!1)}}},[t,e]);return(0,T.jsxs)(`button`,{type:`button`,className:`clear-chat-button gap-1`,onClick:r,disabled:t,title:`Clear chat`,children:[t?(0,T.jsx)(Ne,{className:`animate-spin`,size:18}):(0,T.jsx)(Ze,{size:18}),`Clear`]})}async function Tt(){let{data:e}=await S.get(`/Chat/Messages/`);return e}var Et=`vercel.ai.error`,Dt=Symbol.for(Et),Ot,kt,E=class e extends (kt=Error,Ot=Dt,kt){constructor({name:e,message:t,cause:n}){super(t),this[Ot]=!0,this.name=e,this.cause=n}static isInstance(t){return e.hasMarker(t,Et)}static hasMarker(e,t){let n=Symbol.for(t);return typeof e==`object`&&!!e&&n in e&&typeof e[n]==`boolean`&&e[n]===!0}},At=`AI_APICallError`,jt=`vercel.ai.error.${At}`,Mt=Symbol.for(jt),Nt,Pt,Ft=class extends (Pt=E,Nt=Mt,Pt){constructor({message:e,url:t,requestBodyValues:n,statusCode:r,responseHeaders:i,responseBody:a,cause:o,isRetryable:s=r!=null&&(r===408||r===409||r===429||r>=500),data:c}){super({name:At,message:e,cause:o}),this[Nt]=!0,this.url=t,this.requestBodyValues=n,this.statusCode=r,this.responseHeaders=i,this.responseBody=a,this.isRetryable=s,this.data=c}static isInstance(e){return E.hasMarker(e,jt)}},It=`AI_EmptyResponseBodyError`,Lt=`vercel.ai.error.${It}`,Rt=Symbol.for(Lt),zt,Bt,Vt=class extends (Bt=E,zt=Rt,Bt){constructor({message:e=`Empty response body`}={}){super({name:It,message:e}),this[zt]=!0}static isInstance(e){return E.hasMarker(e,Lt)}};function Ht(e){return e==null?`unknown error`:typeof e==`string`?e:e instanceof Error?e.toString():JSON.stringify(e)}var Ut=`AI_InvalidArgumentError`,Wt=`vercel.ai.error.${Ut}`,Gt=Symbol.for(Wt),Kt,qt,Jt=class extends (qt=E,Kt=Gt,qt){constructor({message:e,cause:t,argument:n}){super({name:Ut,message:e,cause:t}),this[Kt]=!0,this.argument=n}static isInstance(e){return E.hasMarker(e,Wt)}},Yt=`AI_JSONParseError`,Xt=`vercel.ai.error.${Yt}`,Zt=Symbol.for(Xt),Qt,$t,en=class extends ($t=E,Qt=Zt,$t){constructor({text:e,cause:t}){super({name:Yt,message:`JSON parsing failed: Text: ${e}.
+import{i as e,t}from"./rolldown-runtime-Dd_uD5pT.js";import{C as n,S as r,_ as i,a,b as o,c as s,f as c,g as l,h as u,l as d,m as f,n as p,o as m,p as h,r as g,s as _,t as v,v as y,x as b,y as x}from"./vendor-core-6LhfJlRC.js";import{n as S}from"./cn-6T8VranJ.js";import{a as ee}from"./vendor-datadog-ozKf-pts.js";import{r as te}from"./vendor-react-BOliS0BL.js";import{B as ne,R as re,Y as ie,k as ae}from"./vendor-tanstack-Bntfka-M.js";import{n as oe}from"./setSessionStorage-B0bf71m4.js";import{t as se}from"./button-DWwfgGWI.js";import{Rt as ce}from"./vendor-ui-9EYYDgoN.js";import{t as C}from"./createLucideIcon-fO5dL7D5.js";import{n as le,r as ue,t as de}from"./chevron-up-CFxbMGv2.js";import{c as fe,f as pe,h as me,i as he,l as ge,m as _e,p as ve,r as ye,t as be,u as xe}from"./setComponentFile-BkWx8AN3.js";import{t as Se}from"./localStorageKeys-etzFY_xV.js";import{Ar as Ce,At as we,Bn as Te,Br as Ee,Er as De,Fr as Oe,H as ke,Hr as Ae,Ln as je,Nt as Me,Pr as Ne,Tn as Pe,Ur as Fe,V as Ie,Z as Le,c as Re,d as ze,f as Be,ft as Ve,gt as He,ir as Ue,jt as We,kt as Ge,m as Ke,nn as qe,qr as Je,ut as Ye,vr as Xe,wr as Ze,xr as Qe}from"./index-FN4KC9va.js";import{t as $e}from"./useEntityRestURL-DNiz3aZ0.js";import{n as et,t as tt}from"./FloatingChat-kWHApEtF.js";import{n as nt}from"./getAnalytics-C0FHjtdQ.js";var rt={name:`between-horizontal-start`,size:24,node:[[`rect`,{width:`13`,height:`7`,x:`8`,y:`3`,rx:`1`,key:`pkso9a`}],[`path`,{d:`m2 9 3 3-3 3`,key:`1agib5`}],[`rect`,{width:`13`,height:`7`,x:`8`,y:`14`,rx:`1`,key:`1q5fc1`}]],aliases:[`between-horizonal-start`]};rt.node;var it=C(rt),at={name:`book`,size:24,node:[[`path`,{d:`M4 19.5v-15A2.5 2.5 0 0 1 6.5 2H19a1 1 0 0 1 1 1v18a1 1 0 0 1-1 1H6.5a1 1 0 0 1 0-5H20`,key:`k3hazp`}]]};at.node;var ot=C(at),st={name:`chart-area`,size:24,node:[[`path`,{d:`M3 3v16a2 2 0 0 0 2 2h16`,key:`c24i48`}],[`path`,{d:`M7 11.207a.5.5 0 0 1 .146-.353l2-2a.5.5 0 0 1 .708 0l3.292 3.292a.5.5 0 0 0 .708 0l4.292-4.292a.5.5 0 0 1 .854.353V16a1 1 0 0 1-1 1H8a1 1 0 0 1-1-1z`,key:`q0gr47`}]],aliases:[`area-chart`]};st.node;var ct=C(st),lt={name:`circle-x`,size:24,node:[[`circle`,{cx:`12`,cy:`12`,r:`10`,key:`1mglay`}],[`path`,{d:`m15 9-6 6`,key:`1uzhvr`}],[`path`,{d:`m9 9 6 6`,key:`z0biqf`}]],aliases:[`x-circle`]};lt.node;var ut=C(lt),dt={name:`file-pen`,size:24,node:[[`path`,{d:`M12.659 22H18a2 2 0 0 0 2-2V8a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 14 2H6a2 2 0 0 0-2 2v9.34`,key:`o6klzx`}],[`path`,{d:`M14 2v5a1 1 0 0 0 1 1h5`,key:`wfsgrz`}],[`path`,{d:`M10.378 12.622a1 1 0 0 1 3 3.003L8.36 20.637a2 2 0 0 1-.854.506l-2.867.837a.5.5 0 0 1-.62-.62l.836-2.869a2 2 0 0 1 .506-.853z`,key:`zhnas1`}]],aliases:[`file-edit`]};dt.node;var ft=C(dt),pt={name:`logs`,size:24,node:[[`path`,{d:`M3 5h1`,key:`1mv5vm`}],[`path`,{d:`M3 12h1`,key:`lp3yf2`}],[`path`,{d:`M3 19h1`,key:`w6f3n9`}],[`path`,{d:`M8 5h1`,key:`1nxr5w`}],[`path`,{d:`M8 12h1`,key:`1con00`}],[`path`,{d:`M8 19h1`,key:`k7p10e`}],[`path`,{d:`M13 5h8`,key:`a7qcls`}],[`path`,{d:`M13 12h8`,key:`h98zly`}],[`path`,{d:`M13 19h8`,key:`c3s6r1`}]]};pt.node;var mt=C(pt),ht={name:`message-square-heart`,size:24,node:[[`path`,{d:`M22 17a2 2 0 0 1-2 2H6.828a2 2 0 0 0-1.414.586l-2.202 2.202A.71.71 0 0 1 2 21.286V5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2z`,key:`18887p`}],[`path`,{d:`M7.5 9.5c0 .687.265 1.383.697 1.844l3.009 3.264a1.14 1.14 0 0 0 .407.314 1 1 0 0 0 .783-.004 1.14 1.14 0 0 0 .398-.31l3.008-3.264A2.77 2.77 0 0 0 16.5 9.5 2.5 2.5 0 0 0 12 8a2.5 2.5 0 0 0-4.5 1.5`,key:`1faxuh`}]]};ht.node;var gt=C(ht),_t={name:`send`,size:24,node:[[`path`,{d:`M14.536 21.686a.5.5 0 0 0 .937-.024l6.5-19a.496.496 0 0 0-.635-.635l-19 6.5a.5.5 0 0 0-.024.937l7.93 3.18a2 2 0 0 1 1.112 1.11z`,key:`1ffxy3`}],[`path`,{d:`m21.854 2.147-10.94 10.939`,key:`12cjpa`}]]};_t.node;var vt=C(_t),yt={name:`user`,size:24,node:[[`path`,{d:`M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2`,key:`975kel`}],[`circle`,{cx:`12`,cy:`7`,r:`4`,key:`17ys0d`}]]};yt.node;var bt=C(yt),xt={name:`wrench`,size:24,node:[[`path`,{d:`M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z`,key:`1ngwbx`}]]};xt.node;var St=C(xt);async function Ct(){await S.delete(`/Chat/Messages/`)}var w=e(ee(),1),T=te();function wt({setMessages:e}){let[t,n]=(0,w.useState)(!1),r=(0,w.useCallback)(async()=>{if(!t){n(!0);try{await Ct(),e([])}catch(e){console.error(`Failed to clear chat:`,e)}finally{n(!1)}}},[t,e]);return(0,T.jsxs)(`button`,{type:`button`,className:`clear-chat-button gap-1`,onClick:r,disabled:t,title:`Clear chat`,children:[t?(0,T.jsx)(Ne,{className:`animate-spin`,size:18}):(0,T.jsx)(Ze,{size:18}),`Clear`]})}async function Tt(){let{data:e}=await S.get(`/Chat/Messages/`);return e}var Et=`vercel.ai.error`,Dt=Symbol.for(Et),Ot,kt,E=class e extends (kt=Error,Ot=Dt,kt){constructor({name:e,message:t,cause:n}){super(t),this[Ot]=!0,this.name=e,this.cause=n}static isInstance(t){return e.hasMarker(t,Et)}static hasMarker(e,t){let n=Symbol.for(t);return typeof e==`object`&&!!e&&n in e&&typeof e[n]==`boolean`&&e[n]===!0}},At=`AI_APICallError`,jt=`vercel.ai.error.${At}`,Mt=Symbol.for(jt),Nt,Pt,Ft=class extends (Pt=E,Nt=Mt,Pt){constructor({message:e,url:t,requestBodyValues:n,statusCode:r,responseHeaders:i,responseBody:a,cause:o,isRetryable:s=r!=null&&(r===408||r===409||r===429||r>=500),data:c}){super({name:At,message:e,cause:o}),this[Nt]=!0,this.url=t,this.requestBodyValues=n,this.statusCode=r,this.responseHeaders=i,this.responseBody=a,this.isRetryable=s,this.data=c}static isInstance(e){return E.hasMarker(e,jt)}},It=`AI_EmptyResponseBodyError`,Lt=`vercel.ai.error.${It}`,Rt=Symbol.for(Lt),zt,Bt,Vt=class extends (Bt=E,zt=Rt,Bt){constructor({message:e=`Empty response body`}={}){super({name:It,message:e}),this[zt]=!0}static isInstance(e){return E.hasMarker(e,Lt)}};function Ht(e){return e==null?`unknown error`:typeof e==`string`?e:e instanceof Error?e.toString():JSON.stringify(e)}var Ut=`AI_InvalidArgumentError`,Wt=`vercel.ai.error.${Ut}`,Gt=Symbol.for(Wt),Kt,qt,Jt=class extends (qt=E,Kt=Gt,qt){constructor({message:e,cause:t,argument:n}){super({name:Ut,message:e,cause:t}),this[Kt]=!0,this.argument=n}static isInstance(e){return E.hasMarker(e,Wt)}},Yt=`AI_JSONParseError`,Xt=`vercel.ai.error.${Yt}`,Zt=Symbol.for(Xt),Qt,$t,en=class extends ($t=E,Qt=Zt,$t){constructor({text:e,cause:t}){super({name:Yt,message:`JSON parsing failed: Text: ${e}.
 Error message: ${Ht(t)}`,cause:t}),this[Qt]=!0,this.text=e}static isInstance(e){return E.hasMarker(e,Xt)}},tn=`AI_TypeValidationError`,nn=`vercel.ai.error.${tn}`,rn=Symbol.for(nn),an,on,D=class e extends (on=E,an=rn,on){constructor({value:e,cause:t,context:n}){let r=`Type validation failed`;if(n?.field&&(r+=` for ${n.field}`),n?.entityName||n?.entityId){r+=` (`;let e=[];n.entityName&&e.push(n.entityName),n.entityId&&e.push(`id: "${n.entityId}"`),r+=e.join(`, `),r+=`)`}super({name:tn,message:`${r}: Value: ${JSON.stringify(e)}.
 Error message: ${Ht(t)}`,cause:t}),this[an]=!0,this.value=e,this.context=n}static isInstance(e){return E.hasMarker(e,nn)}static wrap({value:t,cause:n,context:r}){return e.isInstance(n)&&n.value===t&&n.context?.field===r?.field&&n.context?.entityName===r?.entityName&&n.context?.entityId===r?.entityId?n:new e({value:t,cause:n,context:r})}},sn=`AI_UnsupportedFunctionalityError`,cn=`vercel.ai.error.${sn}`,ln=Symbol.for(cn),un,dn,fn=class extends (dn=E,un=ln,dn){constructor({functionality:e,message:t=`'${e}' functionality not supported.`}){super({name:sn,message:t}),this[un]=!0,this.functionality=e}static isInstance(e){return E.hasMarker(e,cn)}},pn=class extends Error{constructor(e,t){super(e),this.name=`ParseError`,this.type=t.type,this.field=t.field,this.value=t.value,this.line=t.line}},mn=10,hn=13,O=32;function gn(e){}function _n(e){if(typeof e==`function`)throw TypeError("`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?");let{onEvent:t=gn,onError:n=gn,onRetry:r=gn,onComment:i,maxBufferSize:a}=e,o=[],s=0,c=!0,l,u=``,d=0,f,p=!1;function m(e){if(p)throw Error("Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing.");if(c&&(c=!1,e.charCodeAt(0)===239&&e.charCodeAt(1)===187&&e.charCodeAt(2)===191&&(e=e.slice(3))),o.length===0){let t=g(e);t!==``&&(o.push(t),s=t.length),h();return}if(e.indexOf(`
 `)===-1&&e.indexOf(`\r`)===-1){o.push(e),s+=e.length,h();return}o.push(e);let t=o.join(``);o.length=0,s=0;let n=g(t);n!==``&&(o.push(n),s=n.length),h()}function h(){a!==void 0&&(s+u.length<=a||(p=!0,o.length=0,s=0,l=void 0,u=``,d=0,f=void 0,n(new pn(`Buffered data exceeded max buffer size of ${a} characters`,{type:`max-buffer-size-exceeded`}))))}function g(e){let n=0;if(e.indexOf(`\r`)===-1){let r=e.indexOf(`