@knpkv/control-center 0.1.0

package/dist/server/server/index.js

@@ -0,0 +1,583 @@
+import { Wr as SessionId } from "../assets/domainEvent-x7yeq-gU.js";
+import { $ as PluginOutageFailure, $n as SecretReferenceScopeConflictError, $t as BlobUnexpectedEofError, A as PluginAdministration, At as AgentAttemptSequence, B as ReadinessDigestError, Bn as PersistenceConfig, Bt as AppendAgentEventInput, C as ApplicationRateLimited, Cn as ReleaseSnapshotRecord, D as DeliveryGraphInspection, Dn as WorkspaceName, E as AuthorizedShares, En as VendorResourceId, Ft as AgentJobState, G as hasPluginCapability, Gn as PersistenceConfigError, Gt as MAXIMUM_AGENT_JOB_PROMPT_LENGTH, H as digestReadinessRule, Hn as ContentMetadataMismatchError, Ht as ClaimedAgentJob, It as AgentLeaseOwner, J as PluginAuthorizationFailure, Jn as QuarantineWriteError, Jt as BlobIntegrityError, K as negotiatePluginDescriptorV1, Kn as PersistenceOperationError, Kt as MAXIMUM_AGENT_THREAD_EVENT_PAGE_SIZE, L as Persistence, Lt as AgentLeaseToken, M as RelationshipRepairProposals, Mt as AgentEventCursor, N as ReleaseAgentJobs, Nt as AgentJobInputError, O as LiveEvents, On as WorkspaceRecord, Pt as AgentJobPrompt, Q as PluginMalformedResponseFailure, Qn as RevisionConflictError, Qt as BlobTooLargeError, R as persistenceLayer, Rn as BlobRoot, Rt as AgentThreadEvent, Sn as RecordRevision, T as ApplicationServiceUnavailable, Tn as VendorAccountId, U as digestReleaseReadinessCandidate, Un as DatabaseInitializationError, Ut as EnqueueAgentJobInput, V as digestEnvironmentReadinessCandidate, Vn as decodePersistenceConfig, Vt as ClaimAgentJobInput, W as HOST_PLUGIN_CAPABILITY_VERSIONS, Wn as PersistedRecordError, Wt as MAXIMUM_AGENT_ATTEMPT_OUTPUT_BYTES, X as PluginConfigurationFailure, Xn as RecordNotFoundError, Xt as BlobStoreInputError, Y as PluginCancellationFailure, Yn as RecordAlreadyExistsError, Yt as BlobNotFoundError, Z as PluginConflictFailure, Zn as ReproducibleContentUnavailableError, Zt as BlobStoreIoError, _ as retryPluginStream, _n as ProviderFamilyMatchesProvider, a as JiraReadPluginConfiguration, an as ContentBlobMetadata, ar as BackupSqlError, bn as QuarantineRecordKind, c as makeJiraReadPluginRuntimeFromProvider, cn as EntityRecord, dn as PersonRecord, er as SourceIdentityMismatchError, et as PluginRateLimitFailure, f as PLUGIN_OPERATION_MAX_ATTEMPTS, fn as PluginConnectionDisplayName, g as retryPluginOperation, gn as ProviderFamily, h as isPluginFailureRetryable, hn as ProviderAccountRecord, in as ContentBlobDigest, ir as BackupManifestError, it as pluginFailureClass, j as PortfolioSnapshots, jt as AgentContextSnapshotRecord, k as MediaReads, kn as providerFamilyForProvider, kt as AgentJobRepository, ln as FollowedResourceDisplayName, m as PLUGIN_RETRY_MAX_DELAY_MILLIS, mn as ProviderAccountDisplayName, n as DomainEventWakeups, nr as BackupIntegrityError, nt as PluginUnknownOutcomeFailure, o as jiraReadPluginDescriptor, on as ContentBlobStorageClass, or as BackupStorageError, p as PLUGIN_RETRY_BASE_DELAY_MILLIS, pn as PluginConnectionRecord, q as PluginAuthenticationFailure, qn as PluginConnectionLimitError, qt as BlobContainmentError, rr as BackupLimitError, rt as PluginUnsupportedCapabilityFailure, s as makeJiraReadPluginRuntime, sn as EntityKind, sr as SchemaWriteBarrierError, tn as SecretRef, tr as BackupInputError, tt as PluginTimeoutFailure, un as FollowedResourceRecord, v as PluginConnection, vn as QuarantineDiagnosticSummary, w as ApplicationResourceNotFound, wn as RoleAssignmentRecord, xn as QuarantinedRecordMetadata, yn as QuarantineReasonCode, zn as LocalDatabaseUrl, zt as AgentThreadEventPageSize } from "../assets/portfolioInvalidation-Ds9Xm4_P.js";
+import { $ as RequestLimitPolicy, $n as AuthPersistenceError, $t as ServerDraining, A as synchronizeFakeReleaseFromMap, At as clockifyReadPluginDescriptor, B as makePortfolioSnapshots, Bn as secretStoreIoError, Bt as CsrfDigest, C as makeStaticAssetStore, Ct as pluginAdministrationOAuthLayer, D as reconcileFakeReleaseSyncAttempts, Dt as CodePipelinePluginDefinition, E as reconcileFakeReleaseProjection, Et as mapPersistenceWriteError, F as makeReleaseAgentTurns, Fn as SecretNotFoundError, Ft as sessionCookieAuthLayer, G as makeLiveEvents, Gn as PairingCodeId, Gt as authorizeAuthenticatedMutation, H as makeMediaReads, Hn as TerminalRecovery, Ht as InsecureLanCapability, I as releaseAgentTurnsLayer, In as SecretProtectionError, It as CurrentRequestContext, J as makeTimelineReads, Jn as SESSION_ABSOLUTE_LIFETIME_DAYS, Jt as authorizeRequest, K as deliveryGraphInspectionLayer, Kn as PairingCodeSummary, Kt as authorizeAuthenticatedRead, L as releaseAgentUnavailableLayer, Ln as SecretStoreInputError, Lt as makeCurrentRequestContext, M as makeReleaseAgentJobs, Mn as SecretRoot, Mt as makeClockifyReadPluginRuntimeFromProvider, N as releaseAgentJobsLayer, Nn as SecretStore, Nt as authorizePairingRequest, O as recoverFakeReleaseProjection, Ot as CodeCommitPluginDefinition, P as releaseAgentJobsUnavailableLayer, Pn as makeSecretStore, Pt as mutationCsrfLayer, Q as requestBoundaryLayer, Qn as AuthPermissionDeniedError, Qt as verifyCsrfToken, R as makeRelationshipRepairProposals, Rn as SecretStoreIoError, Rt as provideCurrentRequest, S as StaticAssetStoreError, St as pluginAdministrationLayerWithConnections, T as timelineExportAuditsLayer, Tt as mapPersistenceReadError, U as mediaReadsLayer, Un as terminalRecoveryLayer, Ut as RequestAccess, V as portfolioSnapshotsLayer, Vn as TERMINAL_RECOVERY_CONFIRMATION, Vt as CsrfToken, W as liveEventsLayer, Wn as PAIRING_CODE_LIFETIME_MINUTES, Wt as RequestSecurityError, X as authorizedSharesLayer, Xn as SessionSummary, Xt as hashCsrfToken, Y as timelineReadsLayer, Yn as SESSION_IDLE_LIFETIME_HOURS, Yt as effectiveRequestAuthority, Z as makeAuthorizedShares, Zn as AuthCryptoError, Zt as sessionCookiePolicy, _ as makeNodeTransportLayer, _n as BackupManifestV1, _t as listPluginConnectionSummaries, a as decodeBindConfig, an as Auth, at as DEFAULT_HTTP_SECURITY_LIMITS, b as StaticAssetMimeType, bt as makePluginAdministrationWithOAuth, c as makeControlCenterServer, cn as createVerifiedBackup, ct as controlCenterApiHandlersLayer, d as ReleaseSynchronizationStartupConfigurationError, dn as BackupBlobCountsV1, dt as controlCenterApiMiddlewareLayer, en as ServerLifecycle, er as CredentialRejectedError, et as requestRateLimiterLayer, f as releaseIdFromStartupState, fn as BackupBlobEntryV1, ft as DEFAULT_MAXIMUM_LIVE_STREAMS, g as controlCenterTransportProtocol, gn as BackupManifestJsonV1, gt as listFirstPartyServiceMetadata, h as NODE_LISTENER_SECURITY_POLICY, hn as BackupId, ht as LiveStreamAdmissionExceeded, i as TransportPolicy, in as makeControlCenterBootstrap, it as limitRequestBodyStream, j as PluginConnectionMap, jt as makeClockifyReadPluginRuntime, k as synchronizeFakeRelease, kt as ClockifyReadPluginConfiguration, l as requestUrlBoundaryLayer, ln as restoreBackup, lt as controlCenterApiLayer, m as DirectTlsServerError, mn as BackupDatabaseArtifactV1, mt as LiveStreamAdmission, n as BindConfigError, nn as ControlCenterBootstrap, nr as TerminalRecoveryRefusedError, nt as RequestBodyPolicyError, o as effectiveReachableUrls, on as authLayer, ot as HttpByteLimit, p as releaseSynchronizationStartupLayer, pn as BackupBoundaryV1, pt as DEFAULT_MAXIMUM_LIVE_STREAMS_PER_SESSION, q as makeDeliveryGraphInspection, qn as PairingPurpose, qt as authorizeInsecureLanCapability, r as DirectTlsMaterial, rn as controlCenterBootstrapLayer, rt as authorizeRequestBody, s as makeControlCenterApplication, sn as createOfflineVerifiedBackup, st as HttpSecurityLimits, t as BindConfig, tn as ApiBindConfiguration, tr as FirstRunPairingAlreadyIssuedError, tt as securityHeaders, u as ReleaseSynchronizationStartup, un as verifyBackup, ut as controlCenterApiLayerWithLifecycle, v as staticApplicationLayer, vn as ReproducibleBlobGap, vt as makePluginAdministration, w as makeTimelineExportAudits, wt as pluginAdministrationOAuthLayerWithConnections, x as StaticAssetStore, xt as pluginAdministrationLayer, y as staticApplicationWithAssetsLayer, yt as makePluginAdministrationWithConnections, z as relationshipRepairProposalsLayer, zn as SecretTooLargeError, zt as withCorrelationResponse } from "../assets/BindConfig-BjK10BEb.js";
+import { AgentContextMismatchError, AgentProviderError, AgentRunId, AgentRuntimeProtocolError } from "@knpkv/ai-runtime";
+import * as Schema$1 from "effect/Schema";
+import { Effect, Predicate, Result, Schema, SchemaTransformation } from "effect";
+import * as DateTime$1 from "effect/DateTime";
+import * as Effect$1 from "effect/Effect";
+import * as Result$1 from "effect/Result";
+import * as Context$1 from "effect/Context";
+import * as Encoding$1 from "effect/Encoding";
+import * as Layer$1 from "effect/Layer";
+import * as Option$1 from "effect/Option";
+import * as Stream$1 from "effect/Stream";
+import * as Crypto$1 from "effect/Crypto";
+import * as Ref$1 from "effect/Ref";
+//#region src/server/agent/AgentRuntimeRegistry.ts
+/** Server-owned registry for Codex, Claude, and deterministic runtime adapters. */
+var AgentRuntimeRegistry = class extends Context$1.Service()("@knpkv/control-center/server/agent/AgentRuntimeRegistry") {};
+/** Provides a selector implementation behind the runtime registry seam. */
+var agentRuntimeRegistryLayer = (select) => Layer$1.succeed(AgentRuntimeRegistry, AgentRuntimeRegistry.of({ select }));
+//#endregion
+//#region src/server/agent/AgentJobWorker.ts
+/** Run-once durable agent job execution behind one small server-owned interface. @module */
+var AgentRuntimeFailure = Schema$1.Union([
+	AgentContextMismatchError,
+	AgentProviderError,
+	AgentRuntimeProtocolError
+]);
+var isAgentRuntimeFailure = Schema$1.is(AgentRuntimeFailure);
+var isAgentJobInputError = Schema$1.is(AgentJobInputError);
+var MAXIMUM_DURABLE_OUTPUT_CHUNK_CODE_POINTS = 5e3;
+var chunkOutputEvent = (event) => {
+	if (event._tag !== "output") return [event];
+	const events = new Array();
+	let chunk = "";
+	let chunkCodePoints = 0;
+	for (const codePoint of event.text) {
+		chunk += codePoint;
+		chunkCodePoints += 1;
+		if (chunkCodePoints === MAXIMUM_DURABLE_OUTPUT_CHUNK_CODE_POINTS) {
+			events.push({
+				...event,
+				text: chunk
+			});
+			chunk = "";
+			chunkCodePoints = 0;
+		}
+	}
+	if (chunk.length > 0) events.push({
+		...event,
+		text: chunk
+	});
+	return events;
+};
+var isDurableBoundFailure = (failure) => isAgentJobInputError(failure) && (failure.reason === "event-limit-exceeded" || failure.reason === "output-limit-exceeded");
+var normalizeRuntimeFailure = (providerId, failure) => {
+	if (failure._tag === "AgentProviderError") return new AgentProviderError({
+		providerId,
+		phase: failure.phase,
+		message: failure.message,
+		retryable: failure.retryable
+	});
+	if (failure._tag === "AgentContextMismatchError") return new AgentProviderError({
+		providerId,
+		phase: "protocol",
+		message: "Agent continuation context did not match the claimed job.",
+		retryable: false
+	});
+	return new AgentProviderError({
+		providerId,
+		phase: "protocol",
+		message: `Agent runtime protocol failed (${failure.reason}).`,
+		retryable: false
+	});
+};
+var normalizeDurableBoundFailure = (providerId, failure) => new AgentProviderError({
+	providerId,
+	phase: "protocol",
+	message: failure.reason === "output-limit-exceeded" ? "Agent runtime output exceeded the durable attempt limit." : "Agent runtime event exceeded the durable event limit.",
+	retryable: false
+});
+var makeAgentJobWorker = Effect$1.gen(function* () {
+	const cryptoService = yield* Crypto$1.Crypto;
+	const jobs = yield* AgentJobRepository;
+	const runtimes = yield* AgentRuntimeRegistry;
+	const failClaim = Effect$1.fn("AgentJobWorker.failClaim")(function* (claim, error) {
+		const failedAt = yield* DateTime$1.now;
+		yield* jobs.failAttempt({
+			workspaceId: claim.workspaceId,
+			jobId: claim.jobId,
+			attemptSequence: claim.attemptSequence,
+			leaseToken: claim.leaseToken,
+			error,
+			failedAt
+		});
+		return {
+			_tag: "failed",
+			jobId: claim.jobId
+		};
+	});
+	const executeClaim = Effect$1.fn("AgentJobWorker.executeClaim")(function* (claim) {
+		if (claim.cancellationRequested) {
+			const occurredAt = yield* DateTime$1.now;
+			yield* jobs.appendEvent({
+				workspaceId: claim.workspaceId,
+				jobId: claim.jobId,
+				attemptSequence: claim.attemptSequence,
+				leaseToken: claim.leaseToken,
+				event: {
+					_tag: "completed",
+					outcome: "cancelled",
+					sessionRef: claim.sessionRef
+				},
+				occurredAt
+			});
+			return {
+				_tag: "completed",
+				jobId: claim.jobId,
+				outcome: "cancelled"
+			};
+		}
+		const selected = yield* runtimes.select(claim.providerId).pipe(Effect$1.result);
+		if (Result$1.isFailure(selected)) return yield* failClaim(claim, normalizeRuntimeFailure(claim.providerId, selected.failure));
+		const terminal = yield* Ref$1.make(null);
+		const continuation = claim.sessionRef === null ? { _tag: "fresh" } : {
+			_tag: "resume",
+			sessionRef: claim.sessionRef,
+			contextFingerprint: claim.context.fingerprint
+		};
+		const request = {
+			runId: AgentRunId.make(claim.jobId),
+			providerId: claim.providerId,
+			model: claim.model,
+			access: claim.access,
+			prompt: claim.prompt,
+			context: claim.context,
+			continuation
+		};
+		const execution = yield* selected.success.run(request).pipe(Stream$1.takeUntil((event) => event._tag === "completed"), Stream$1.flatMap((event) => Stream$1.fromIterable(chunkOutputEvent(event))), Stream$1.runForEach((event) => {
+			return DateTime$1.now.pipe(Effect$1.flatMap((occurredAt) => jobs.appendEvent({
+				workspaceId: claim.workspaceId,
+				jobId: claim.jobId,
+				attemptSequence: claim.attemptSequence,
+				leaseToken: claim.leaseToken,
+				event,
+				occurredAt
+			})), Effect$1.andThen(event._tag === "completed" ? Ref$1.set(terminal, event) : Effect$1.void));
+		}), Effect$1.result);
+		if (Result$1.isFailure(execution)) {
+			const failure = execution.failure;
+			if (isAgentRuntimeFailure(failure)) return yield* failClaim(claim, normalizeRuntimeFailure(claim.providerId, failure));
+			if (isDurableBoundFailure(failure)) return yield* failClaim(claim, normalizeDurableBoundFailure(claim.providerId, failure));
+			return yield* Effect$1.fail(failure);
+		}
+		const completed = yield* Ref$1.get(terminal);
+		if (completed === null) return yield* failClaim(claim, normalizeRuntimeFailure(claim.providerId, new AgentRuntimeProtocolError({ reason: "missing-terminal-event" })));
+		return {
+			_tag: "completed",
+			jobId: claim.jobId,
+			outcome: completed.outcome
+		};
+	});
+	return (options) => ({ runOnce: Effect$1.fn("AgentJobWorker.runOnce")(function* (workspaceId) {
+		const claimedAt = yield* DateTime$1.now;
+		const leaseToken = AgentLeaseToken.make(Encoding$1.encodeHex(yield* cryptoService.randomBytes(32)));
+		const claim = yield* jobs.claimNext({
+			workspaceId,
+			leaseOwner: options.leaseOwner,
+			leaseToken,
+			claimedAt,
+			leaseExpiresAt: DateTime$1.addDuration(claimedAt, options.leaseDuration)
+		});
+		return Option$1.isNone(claim) ? { _tag: "idle" } : yield* executeClaim(claim.value);
+	}) });
+});
+/** Deep run-once module owning claim, selection, execution, and terminal persistence. */
+var AgentJobWorker = class extends Context$1.Service()("@knpkv/control-center/server/agent/AgentJobWorker") {};
+/** Captures worker policy while acquiring persistence, crypto, and runtime selection. */
+var agentJobWorkerLayer = (options) => Layer$1.effect(AgentJobWorker, makeAgentJobWorker.pipe(Effect$1.map((make) => AgentJobWorker.of(make(options)))));
+//#endregion
+//#region src/server/http/security/UrlPolicy.ts
+var hasNoInvisibleControls = (value) => Array.from(value).every((character) => {
+	const codePoint = character.codePointAt(0);
+	return codePoint !== void 0 && !(codePoint >= 0 && codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297);
+});
+var SafeUrlText = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(4096), Schema.makeFilter(hasNoInvisibleControls, { expected: "a URL without control or bidirectional override characters" }));
+/** HTTPS-only URL that may be placed in a browser navigation element. */
+var ExternalNavigationUrl = SafeUrlText.pipe(Schema.decodeTo(Schema.URL, SchemaTransformation.urlFromString), Schema.check(Schema.makeFilter(({ protocol }) => protocol === "https:", { expected: "an HTTPS navigation URL" }), Schema.makeFilter(({ password, username }) => password.length === 0 && username.length === 0, { expected: "a navigation URL without embedded credentials" })));
+/** HTTPS-only, credential-free URL eligible for explicit egress validation. */
+var EgressUrl = SafeUrlText.pipe(Schema.decodeTo(Schema.URL, SchemaTransformation.urlFromString), Schema.check(Schema.makeFilter(({ protocol }) => protocol === "https:", { expected: "an HTTPS egress URL" }), Schema.makeFilter(({ password, username }) => password.length === 0 && username.length === 0, { expected: "an egress URL without embedded credentials" }), Schema.makeFilter(({ hash }) => hash.length === 0, { expected: "an egress URL without a fragment" }), Schema.makeFilter(({ port }) => port.length === 0 || port === "443", { expected: "an egress URL using the default HTTPS port" }), Schema.makeFilter(({ hostname }) => hostname.length > 0 && !hostname.endsWith("."), { expected: "an egress URL with a canonical hostname" }), Schema.makeFilter(({ hostname }) => !/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/u.test(hostname), { expected: "an egress URL using a DNS hostname rather than an IP literal" })));
+/** Opaque same-origin reference used by media routes instead of accepting a URL. */
+var MediaRef = Schema.String.check(Schema.isPattern(/^media_[0-9a-f]{64}$/u, { expected: "a lowercase SHA-256 media reference" })).pipe(Schema.brand("MediaRef"));
+var parseIpv4 = (address) => {
+	const segments = address.split(".");
+	if (segments.length !== 4) return void 0;
+	const parsed = [];
+	for (const segment of segments) {
+		if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(segment)) return void 0;
+		const value = Number(segment);
+		if (!Number.isInteger(value) || value > 255) return void 0;
+		parsed.push(value);
+	}
+	return parsed;
+};
+var isBlockedIpv4 = (segments) => {
+	const first = segments[0];
+	const second = segments[1];
+	const third = segments[2];
+	if (first === void 0 || second === void 0 || third === void 0) return true;
+	return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 0 && third === 0 || first === 192 && second === 0 && third === 2 || first === 192 && second === 88 && third === 99 || first === 192 && second === 168 || first === 198 && (second === 18 || second === 19) || first === 198 && second === 51 && third === 100 || first === 203 && second === 0 && third === 113;
+};
+var parseIpv6 = (address) => {
+	if (address.includes("%") || address.includes(".")) return void 0;
+	const halves = address.toLowerCase().split("::");
+	if (halves.length > 2) return void 0;
+	const left = halves[0] === "" ? [] : halves[0]?.split(":") ?? [];
+	const right = halves.length === 1 || halves[1] === "" ? [] : halves[1]?.split(":") ?? [];
+	const isHexSegment = (segment) => /^[0-9a-f]{1,4}$/u.test(segment);
+	if (!left.every(isHexSegment) || !right.every(isHexSegment)) return void 0;
+	const missing = 8 - left.length - right.length;
+	if (halves.length === 1 && missing !== 0 || halves.length === 2 && missing < 1) return void 0;
+	return [
+		...left.map((segment) => Number.parseInt(segment, 16)),
+		...Array(missing).fill(0),
+		...right.map((segment) => Number.parseInt(segment, 16))
+	];
+};
+var isPublicIpv6 = (segments) => {
+	const first = segments[0];
+	const second = segments[1];
+	if (segments.length !== 8 || first === void 0 || second === void 0) return false;
+	if (first < 8192 || first > 16383) return false;
+	if (first === 8193 && second <= 511) return false;
+	if (first === 8193 && second === 3512) return false;
+	if (first === 8194) return false;
+	if (first === 16383) return false;
+	return true;
+};
+/** Return whether a canonical DNS address is globally routable under the egress policy. */
+var isPublicIpAddress = (address) => {
+	const ipv4 = parseIpv4(address);
+	if (ipv4 !== void 0) return !isBlockedIpv4(ipv4);
+	const ipv6 = parseIpv6(address);
+	return ipv6 !== void 0 && isPublicIpv6(ipv6);
+};
+/** Canonical public IPv4 or IPv6 address accepted after DNS resolution. */
+var PublicIpAddress = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(45), Schema.makeFilter(isPublicIpAddress, { expected: "a canonical globally routable IP address" })).pipe(Schema.brand("PublicIpAddress"));
+var CanonicalHostname = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(253), Schema.isPattern(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/u, { expected: "a lowercase canonical DNS hostname" }));
+/** Socket target created only after URL, allowlist, and DNS validation. */
+var ResolvedTarget = Schema.Struct({
+	url: EgressUrl,
+	hostname: CanonicalHostname,
+	port: Schema.Literal(443),
+	address: PublicIpAddress,
+	family: Schema.Literals([4, 6])
+}).check(Schema.makeFilter(({ hostname, url }) => url.hostname === hostname, { expected: "the resolved hostname to match the original URL" }), Schema.makeFilter(({ address, family }) => address.includes(":") ? family === 6 : family === 4, { expected: "the address family to match the resolved address" }));
+//#endregion
+//#region src/server/http/security/RichDocument.ts
+var MAXIMUM_DEPTH = 20;
+var MAXIMUM_NODES = 1e4;
+var MAXIMUM_TEXT_BYTES = 16 * 1024;
+var MAXIMUM_LINKS = 500;
+var MAXIMUM_MEDIA = 500;
+var MAXIMUM_ENCODED_BYTES = 256 * 1024;
+/** Public hard limits applied to every canonical rich document. */
+var RICH_DOCUMENT_LIMITS = {
+	maximumDepth: MAXIMUM_DEPTH,
+	maximumNodes: MAXIMUM_NODES,
+	maximumTextBytes: MAXIMUM_TEXT_BYTES,
+	maximumLinks: MAXIMUM_LINKS,
+	maximumMedia: MAXIMUM_MEDIA,
+	maximumEncodedBytes: MAXIMUM_ENCODED_BYTES
+};
+var RichTextMark = Schema.Literals([
+	"bold",
+	"italic",
+	"strike",
+	"code"
+]);
+var RichTextMarks = Schema.Array(RichTextMark).check(Schema.isMaxLength(4), Schema.makeFilter((marks) => new Set(marks).size === marks.length, { expected: "unique text marks" }));
+var RichText = Schema.String.check(Schema.isMaxLength(MAXIMUM_TEXT_BYTES));
+var RichAltText = Schema.String.check(Schema.isMaxLength(500));
+var RichReference = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9:_-]*$/u));
+var RichTextNode = Schema.Struct({
+	_tag: Schema.Literal("text"),
+	text: RichText,
+	marks: RichTextMarks
+});
+var RichHardBreakNode = Schema.Struct({ _tag: Schema.Literal("hard-break") });
+var RichLinkNode = Schema.Struct({
+	_tag: Schema.Literal("link"),
+	href: ExternalNavigationUrl,
+	children: Schema.Array(Schema.Union([RichTextNode, RichHardBreakNode]))
+});
+var RichMentionNode = Schema.Struct({
+	_tag: Schema.Literal("mention"),
+	reference: RichReference,
+	label: RichAltText
+});
+var RichEmojiNode = Schema.Struct({
+	_tag: Schema.Literal("emoji"),
+	text: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(32))
+});
+var RichMediaNode = Schema.Struct({
+	_tag: Schema.Literal("media"),
+	mediaRef: MediaRef,
+	alt: RichAltText
+});
+var RichInlineNode = Schema.Union([
+	RichTextNode,
+	RichHardBreakNode,
+	RichLinkNode,
+	RichMentionNode,
+	RichEmojiNode,
+	RichMediaNode
+]);
+var RichParagraphNode = Schema.Struct({
+	_tag: Schema.Literal("paragraph"),
+	children: Schema.Array(RichInlineNode)
+});
+var RichHeadingNode = Schema.Struct({
+	_tag: Schema.Literal("heading"),
+	level: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: 6
+	})),
+	children: Schema.Array(RichInlineNode)
+});
+var RichCodeBlockNode = Schema.Struct({
+	_tag: Schema.Literal("code-block"),
+	language: Schema.NullOr(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(32))),
+	text: RichText
+});
+var RichRuleNode = Schema.Struct({ _tag: Schema.Literal("rule") });
+var RichListItemNode = Schema.Struct({
+	_tag: Schema.Literal("list-item"),
+	children: Schema.Array(Schema.suspend(() => RichBlockNode))
+});
+var RichBlockQuoteNode = Schema.Struct({
+	_tag: Schema.Literal("blockquote"),
+	children: Schema.Array(Schema.suspend(() => RichBlockNode))
+});
+var RichBulletListNode = Schema.Struct({
+	_tag: Schema.Literal("bullet-list"),
+	children: Schema.Array(RichListItemNode)
+});
+var RichOrderedListNode = Schema.Struct({
+	_tag: Schema.Literal("ordered-list"),
+	start: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: 1e6
+	})),
+	children: Schema.Array(RichListItemNode)
+});
+var RichBlockNode = Schema.Union([
+	RichParagraphNode,
+	RichHeadingNode,
+	RichCodeBlockNode,
+	RichRuleNode,
+	RichBlockQuoteNode,
+	RichBulletListNode,
+	RichOrderedListNode
+]);
+var RichDocumentV1 = Schema.Struct({
+	_tag: Schema.Literal("rich-document"),
+	version: Schema.Literal(1),
+	children: Schema.Array(RichBlockNode)
+});
+var RichDocumentJson = Schema.fromJsonString(RichDocumentV1);
+/** Canonical rich content failed schema or resource-limit validation. */
+var RichDocumentError = class extends Schema.TaggedErrorClass()("RichDocumentError", { reason: Schema.Literals([
+	"invalid-document",
+	"bounds-exceeded",
+	"encoded-size-exceeded"
+]) }) {};
+var textEncoder = new TextEncoder();
+var preflightUnknownTree = (input) => {
+	const stack = [{
+		value: input,
+		depth: 0
+	}];
+	let nodeCount = 0;
+	let linkCount = 0;
+	let mediaCount = 0;
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (current === void 0) break;
+		if (current.depth > MAXIMUM_DEPTH || !Predicate.isObject(current.value)) return false;
+		nodeCount += 1;
+		if (nodeCount > MAXIMUM_NODES) return false;
+		if (current.value._tag === "link") linkCount += 1;
+		if (current.value._tag === "media") mediaCount += 1;
+		if (linkCount > MAXIMUM_LINKS || mediaCount > MAXIMUM_MEDIA) return false;
+		const text = current.value.text;
+		if (typeof text === "string" && textEncoder.encode(text).byteLength > MAXIMUM_TEXT_BYTES) return false;
+		const children = current.value.children;
+		if (Array.isArray(children)) for (const child of children) stack.push({
+			value: child,
+			depth: current.depth + 1
+		});
+	}
+	return true;
+};
+/** Validate a canonical document and all structural, text, link, media, and encoded-size bounds. */
+var validateRichDocumentV1 = Effect.fn("RichDocument.validate")(function* (input) {
+	if (!preflightUnknownTree(input)) return yield* new RichDocumentError({ reason: "bounds-exceeded" });
+	const typedResult = Schema.decodeUnknownResult(Schema.toType(RichDocumentV1))(input);
+	const document = Result.isSuccess(typedResult) ? typedResult.success : yield* Schema.decodeUnknownEffect(RichDocumentV1)(input).pipe(Effect.mapError(() => new RichDocumentError({ reason: "invalid-document" })));
+	const encoded = yield* Schema.encodeUnknownEffect(RichDocumentJson)(document).pipe(Effect.mapError(() => new RichDocumentError({ reason: "invalid-document" })));
+	if (textEncoder.encode(encoded).byteLength > MAXIMUM_ENCODED_BYTES) return yield* new RichDocumentError({ reason: "encoded-size-exceeded" });
+	return document;
+});
+var decodeString = (schema, input) => {
+	const result = Schema.decodeUnknownResult(schema)(input);
+	return Result.isSuccess(result) ? result.success : void 0;
+};
+var rawChildren = (input) => Array.isArray(input.children) ? input.children : [];
+var addNode = (budget) => {
+	if (budget.nodeCount >= MAXIMUM_NODES) return false;
+	budget.nodeCount += 1;
+	return true;
+};
+var sanitizeLinkChildren = (inputs, budget, depth) => {
+	const children = [];
+	for (const input of inputs) {
+		if (!Predicate.isObject(input)) continue;
+		if (input._tag === "text") {
+			const text = decodeString(RichText, input.text);
+			if (text === void 0 || !addNode(budget)) continue;
+			const marksResult = Schema.decodeUnknownResult(RichTextMarks)(input.marks);
+			children.push({
+				_tag: "text",
+				text,
+				marks: Result.isSuccess(marksResult) ? marksResult.success : []
+			});
+		} else if (input._tag === "hard-break" && addNode(budget) && depth <= MAXIMUM_DEPTH) children.push({ _tag: "hard-break" });
+	}
+	return children;
+};
+var sanitizeInline = (input, budget, depth) => {
+	if (depth > MAXIMUM_DEPTH || !Predicate.isObject(input)) return [];
+	if (input._tag === "text") {
+		const text = decodeString(RichText, input.text);
+		if (text === void 0 || !addNode(budget)) return [];
+		const marksResult = Schema.decodeUnknownResult(RichTextMarks)(input.marks);
+		return [{
+			_tag: "text",
+			text,
+			marks: Result.isSuccess(marksResult) ? marksResult.success : []
+		}];
+	}
+	if (input._tag === "hard-break") return addNode(budget) ? [{ _tag: "hard-break" }] : [];
+	if (input._tag === "link") {
+		const children = sanitizeLinkChildren(rawChildren(input), budget, depth + 1);
+		const href = Schema.decodeUnknownResult(ExternalNavigationUrl)(input.href);
+		if (Result.isFailure(href) || budget.linkCount >= MAXIMUM_LINKS || !addNode(budget)) return children;
+		budget.linkCount += 1;
+		return [{
+			_tag: "link",
+			href: href.success,
+			children
+		}];
+	}
+	if (input._tag === "mention") {
+		const reference = decodeString(RichReference, input.reference);
+		const label = decodeString(RichAltText, input.label);
+		return reference !== void 0 && label !== void 0 && addNode(budget) ? [{
+			_tag: "mention",
+			reference,
+			label
+		}] : [];
+	}
+	if (input._tag === "emoji") {
+		const text = decodeString(Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(32)), input.text);
+		return text !== void 0 && addNode(budget) ? [{
+			_tag: "emoji",
+			text
+		}] : [];
+	}
+	if (input._tag === "media") {
+		const mediaRef = Schema.decodeUnknownResult(MediaRef)(input.mediaRef);
+		const alt = decodeString(RichAltText, input.alt);
+		if (Result.isFailure(mediaRef) || alt === void 0 || budget.mediaCount >= MAXIMUM_MEDIA || !addNode(budget)) return [];
+		budget.mediaCount += 1;
+		return [{
+			_tag: "media",
+			mediaRef: mediaRef.success,
+			alt
+		}];
+	}
+	return [];
+};
+var sanitizeInlines = (inputs, budget, depth) => inputs.flatMap((input) => sanitizeInline(input, budget, depth));
+var sanitizeListItem = (input, budget, depth) => {
+	if (depth > MAXIMUM_DEPTH || !Predicate.isObject(input) || input._tag !== "list-item" || !addNode(budget)) return;
+	return {
+		_tag: "list-item",
+		children: sanitizeBlocks(rawChildren(input), budget, depth + 1)
+	};
+};
+var sanitizeBlock = (input, budget, depth) => {
+	if (depth > MAXIMUM_DEPTH || !Predicate.isObject(input)) return void 0;
+	if (input._tag === "paragraph" && addNode(budget)) return {
+		_tag: "paragraph",
+		children: sanitizeInlines(rawChildren(input), budget, depth + 1)
+	};
+	if (input._tag === "heading") {
+		const level = Schema.decodeUnknownResult(Schema.Number.check(Schema.isInt(), Schema.isBetween({
+			minimum: 1,
+			maximum: 6
+		})))(input.level);
+		return Result.isSuccess(level) && addNode(budget) ? {
+			_tag: "heading",
+			level: level.success,
+			children: sanitizeInlines(rawChildren(input), budget, depth + 1)
+		} : void 0;
+	}
+	if (input._tag === "code-block") {
+		const text = decodeString(RichText, input.text);
+		const language = input.language === null ? null : decodeString(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(32)), input.language);
+		return text !== void 0 && language !== void 0 && addNode(budget) ? {
+			_tag: "code-block",
+			language,
+			text
+		} : void 0;
+	}
+	if (input._tag === "rule") return addNode(budget) ? { _tag: "rule" } : void 0;
+	if (input._tag === "blockquote" && addNode(budget)) return {
+		_tag: "blockquote",
+		children: sanitizeBlocks(rawChildren(input), budget, depth + 1)
+	};
+	if (input._tag === "bullet-list" || input._tag === "ordered-list") {
+		if (!addNode(budget)) return void 0;
+		const children = rawChildren(input).flatMap((child) => {
+			const sanitized = sanitizeListItem(child, budget, depth + 1);
+			return sanitized === void 0 ? [] : [sanitized];
+		});
+		if (input._tag === "bullet-list") return {
+			_tag: "bullet-list",
+			children
+		};
+		const start = Schema.decodeUnknownResult(Schema.Number.check(Schema.isInt(), Schema.isBetween({
+			minimum: 1,
+			maximum: 1e6
+		})))(input.start);
+		return Result.isSuccess(start) ? {
+			_tag: "ordered-list",
+			start: start.success,
+			children
+		} : void 0;
+	}
+};
+function sanitizeBlocks(inputs, budget, depth) {
+	const blocks = [];
+	for (const input of inputs) {
+		const block = sanitizeBlock(input, budget, depth);
+		if (block !== void 0) blocks.push(block);
+		if (budget.nodeCount >= MAXIMUM_NODES) break;
+	}
+	return blocks;
+}
+var RawRichDocument = Schema.Struct({
+	_tag: Schema.Literal("rich-document"),
+	version: Schema.Literal(1),
+	children: Schema.Array(Schema.Unknown)
+});
+/** Drop unsupported/provider-active nodes and return a validated canonical document. */
+var sanitizeRichDocumentV1 = Effect.fn("RichDocument.sanitize")(function* (input) {
+	return yield* validateRichDocumentV1({
+		_tag: "rich-document",
+		version: 1,
+		children: sanitizeBlocks((yield* Schema.decodeUnknownEffect(RawRichDocument)(input).pipe(Effect.mapError(() => new RichDocumentError({ reason: "invalid-document" })))).children, {
+			nodeCount: 1,
+			linkCount: 0,
+			mediaCount: 0
+		}, 1)
+	});
+});
+//#endregion
+export { AgentAttemptSequence, AgentContextSnapshotRecord, AgentEventCursor, AgentJobInputError, AgentJobPrompt, AgentJobState, AgentJobWorker, AgentLeaseOwner, AgentLeaseToken, AgentRuntimeRegistry, AgentThreadEvent, AgentThreadEventPageSize, ApiBindConfiguration, AppendAgentEventInput, ApplicationRateLimited, ApplicationResourceNotFound, ApplicationServiceUnavailable, Auth, AuthCryptoError, AuthPermissionDeniedError, AuthPersistenceError, AuthorizedShares, BackupBlobCountsV1, BackupBlobEntryV1, BackupBoundaryV1, BackupDatabaseArtifactV1, BackupId, BackupInputError, BackupIntegrityError, BackupLimitError, BackupManifestError, BackupManifestJsonV1, BackupManifestV1, BackupSqlError, BackupStorageError, BindConfig, BindConfigError, BlobContainmentError, BlobIntegrityError, BlobNotFoundError, BlobRoot, BlobStoreInputError, BlobStoreIoError, BlobTooLargeError, BlobUnexpectedEofError, ClaimAgentJobInput, ClaimedAgentJob, ClockifyReadPluginConfiguration, CodeCommitPluginDefinition, CodePipelinePluginDefinition, ContentBlobDigest, ContentBlobMetadata, ContentBlobStorageClass, ContentMetadataMismatchError, ControlCenterBootstrap, CredentialRejectedError, CsrfDigest, CsrfToken, CurrentRequestContext, DEFAULT_HTTP_SECURITY_LIMITS, DEFAULT_MAXIMUM_LIVE_STREAMS, DEFAULT_MAXIMUM_LIVE_STREAMS_PER_SESSION, DatabaseInitializationError, DeliveryGraphInspection, DirectTlsMaterial, DirectTlsServerError, DomainEventWakeups, EgressUrl, EnqueueAgentJobInput, EntityKind, EntityRecord, ExternalNavigationUrl, FirstRunPairingAlreadyIssuedError, FollowedResourceDisplayName, FollowedResourceRecord, HOST_PLUGIN_CAPABILITY_VERSIONS, HttpByteLimit, HttpSecurityLimits, InsecureLanCapability, JiraReadPluginConfiguration, LiveEvents, LiveStreamAdmission, LiveStreamAdmissionExceeded, LocalDatabaseUrl, MAXIMUM_AGENT_ATTEMPT_OUTPUT_BYTES, MAXIMUM_AGENT_JOB_PROMPT_LENGTH, MAXIMUM_AGENT_THREAD_EVENT_PAGE_SIZE, MediaReads, MediaRef, NODE_LISTENER_SECURITY_POLICY, PAIRING_CODE_LIFETIME_MINUTES, PLUGIN_OPERATION_MAX_ATTEMPTS, PLUGIN_RETRY_BASE_DELAY_MILLIS, PLUGIN_RETRY_MAX_DELAY_MILLIS, PairingCodeId, PairingCodeSummary, PairingPurpose, PersistedRecordError, Persistence, PersistenceConfig, PersistenceConfigError, PersistenceOperationError, PersonRecord, PluginAdministration, PluginAuthenticationFailure, PluginAuthorizationFailure, PluginCancellationFailure, PluginConfigurationFailure, PluginConflictFailure, PluginConnection, PluginConnectionDisplayName, PluginConnectionLimitError, PluginConnectionMap, PluginConnectionRecord, PluginMalformedResponseFailure, PluginOutageFailure, PluginRateLimitFailure, PluginTimeoutFailure, PluginUnknownOutcomeFailure, PluginUnsupportedCapabilityFailure, PortfolioSnapshots, ProviderAccountDisplayName, ProviderAccountRecord, ProviderFamily, ProviderFamilyMatchesProvider, PublicIpAddress, QuarantineDiagnosticSummary, QuarantineReasonCode, QuarantineRecordKind, QuarantineWriteError, QuarantinedRecordMetadata, RICH_DOCUMENT_LIMITS, ReadinessDigestError, RecordAlreadyExistsError, RecordNotFoundError, RecordRevision, RelationshipRepairProposals, ReleaseAgentJobs, ReleaseSnapshotRecord, ReleaseSynchronizationStartup, ReleaseSynchronizationStartupConfigurationError, ReproducibleBlobGap, ReproducibleContentUnavailableError, RequestAccess, RequestBodyPolicyError, RequestLimitPolicy, RequestSecurityError, ResolvedTarget, RevisionConflictError, RichBlockNode, RichBlockQuoteNode, RichBulletListNode, RichCodeBlockNode, RichDocumentError, RichDocumentV1, RichEmojiNode, RichHardBreakNode, RichHeadingNode, RichInlineNode, RichLinkNode, RichListItemNode, RichMediaNode, RichMentionNode, RichOrderedListNode, RichParagraphNode, RichRuleNode, RichTextNode, RoleAssignmentRecord, SESSION_ABSOLUTE_LIFETIME_DAYS, SESSION_IDLE_LIFETIME_HOURS, SchemaWriteBarrierError, SecretNotFoundError, SecretProtectionError, SecretRef, SecretReferenceScopeConflictError, SecretRoot, SecretStore, SecretStoreInputError, SecretStoreIoError, SecretTooLargeError, ServerDraining, ServerLifecycle, SessionId, SessionSummary, SourceIdentityMismatchError, StaticAssetMimeType, StaticAssetStore, StaticAssetStoreError, TERMINAL_RECOVERY_CONFIRMATION, TerminalRecovery, TerminalRecoveryRefusedError, TransportPolicy, VendorAccountId, VendorResourceId, WorkspaceName, WorkspaceRecord, agentJobWorkerLayer, agentRuntimeRegistryLayer, authLayer, authorizeAuthenticatedMutation, authorizeAuthenticatedRead, authorizeInsecureLanCapability, authorizePairingRequest, authorizeRequest, authorizeRequestBody, authorizedSharesLayer, clockifyReadPluginDescriptor, controlCenterApiHandlersLayer, controlCenterApiLayer, controlCenterApiLayerWithLifecycle, controlCenterApiMiddlewareLayer, controlCenterBootstrapLayer, controlCenterTransportProtocol, createOfflineVerifiedBackup, createVerifiedBackup, decodeBindConfig, decodePersistenceConfig, deliveryGraphInspectionLayer, digestEnvironmentReadinessCandidate, digestReadinessRule, digestReleaseReadinessCandidate, effectiveReachableUrls, effectiveRequestAuthority, hasPluginCapability, hashCsrfToken, isPluginFailureRetryable, isPublicIpAddress, jiraReadPluginDescriptor, limitRequestBodyStream, listFirstPartyServiceMetadata, listPluginConnectionSummaries, liveEventsLayer, makeAuthorizedShares, makeClockifyReadPluginRuntime, makeClockifyReadPluginRuntimeFromProvider, makeControlCenterApplication, makeControlCenterBootstrap, makeControlCenterServer, makeCurrentRequestContext, makeDeliveryGraphInspection, makeJiraReadPluginRuntime, makeJiraReadPluginRuntimeFromProvider, makeLiveEvents, makeMediaReads, makeNodeTransportLayer, makePluginAdministration, makePluginAdministrationWithConnections, makePluginAdministrationWithOAuth, makePortfolioSnapshots, makeRelationshipRepairProposals, makeReleaseAgentJobs, makeReleaseAgentTurns, makeSecretStore, makeStaticAssetStore, makeTimelineExportAudits, makeTimelineReads, mapPersistenceReadError, mapPersistenceWriteError, mediaReadsLayer, mutationCsrfLayer, negotiatePluginDescriptorV1, persistenceLayer, pluginAdministrationLayer, pluginAdministrationLayerWithConnections, pluginAdministrationOAuthLayer, pluginAdministrationOAuthLayerWithConnections, pluginFailureClass, portfolioSnapshotsLayer, provideCurrentRequest, providerFamilyForProvider, reconcileFakeReleaseProjection, reconcileFakeReleaseSyncAttempts, recoverFakeReleaseProjection, relationshipRepairProposalsLayer, releaseAgentJobsLayer, releaseAgentJobsUnavailableLayer, releaseAgentTurnsLayer, releaseAgentUnavailableLayer, releaseIdFromStartupState, releaseSynchronizationStartupLayer, requestBoundaryLayer, requestRateLimiterLayer, requestUrlBoundaryLayer, restoreBackup, retryPluginOperation, retryPluginStream, sanitizeRichDocumentV1, secretStoreIoError, securityHeaders, sessionCookieAuthLayer, sessionCookiePolicy, staticApplicationLayer, staticApplicationWithAssetsLayer, synchronizeFakeRelease, synchronizeFakeReleaseFromMap, terminalRecoveryLayer, timelineExportAuditsLayer, timelineReadsLayer, validateRichDocumentV1, verifyBackup, verifyCsrfToken, withCorrelationResponse };
+
+//# sourceMappingURL=index.js.map