@pstdio/pocketcoder-sdk 0.3.0

package/dist/index.js

@@ -0,0 +1,2335 @@
+import { z } from "zod";
+import { isIP } from "node:net";
+//#region ../contracts/src/pagination.ts
+const CursorSchema = z.string().min(1).max(2048);
+function CursorPageSchema(item) {
+	return z.object({
+		items: z.array(item),
+		next_cursor: CursorSchema.nullable()
+	});
+}
+function CursorQuerySchema(maxLimit, defaultLimit) {
+	return z.object({
+		cursor: CursorSchema.optional(),
+		limit: z.coerce.number().int().positive().max(maxLimit).default(defaultLimit)
+	});
+}
+//#endregion
+//#region ../contracts/src/conversation.ts
+const CONVERSATION_ROLES = [
+	"user",
+	"assistant",
+	"system",
+	"tool"
+];
+const ConversationMetadataSchema = z.record(z.string().min(1).max(64), z.string().max(512)).refine((value) => Object.keys(value).length <= 32, "conversation metadata has at most 32 keys");
+const ConversationMessageInputSchema = z.object({
+	message_id: z.string().min(1).max(256),
+	role: z.enum(CONVERSATION_ROLES),
+	content: z.string().max(262144),
+	occurred_at: z.iso.datetime(),
+	metadata: ConversationMetadataSchema.default({})
+});
+const ConversationMessageResourceSchema = ConversationMessageInputSchema.extend({ seq: z.number().int().positive() });
+CursorQuerySchema(200, 100);
+const ConversationPageSchema = CursorPageSchema(ConversationMessageResourceSchema).extend({ retention: z.object({
+	status: z.literal("retained"),
+	expires_at: z.iso.datetime().nullable()
+}) });
+const ConversationResumeOutcomeSchema = z.object({
+	status: z.literal("supported"),
+	reason: z.null(),
+	source_workspace_id: z.uuid(),
+	checkpoint_id: z.uuid()
+});
+//#endregion
+//#region ../contracts/src/duration.ts
+const DURATION_RE = /^(\d+)(ms|s|m|h)$/;
+function isDuration(value) {
+	return DURATION_RE.test(value);
+}
+//#endregion
+//#region ../contracts/src/persistence.ts
+const DurationValueSchema = z.string().refine(isDuration, { message: "expected a duration like 15s, 20m, or 2h" });
+const LAUNCH_MODES = ["create", "restore"];
+const CONVERSATION_RESTORE_CAPABILITIES = [
+	"supported",
+	"filesystem_only",
+	"unknown"
+];
+const SourceDescriptorSchema = z.object({
+	kind: z.literal("git"),
+	repository: z.string().min(1).max(64).regex(/^[a-z0-9]([a-z0-9._-]{0,62}[a-z0-9])?$/),
+	revision: z.string().min(1).max(256).refine((value) => !value.startsWith("-") && !value.startsWith("/") && !value.endsWith("/") && !value.endsWith(".") && !value.endsWith(".lock") && value !== "@" && !value.includes("..") && !value.includes("//") && !value.includes("@{") && !/[~^:?*[\]\\\s]/u.test(value) && [...value].every((character) => {
+		const code = character.codePointAt(0) ?? 0;
+		return code >= 32 && code !== 127;
+	}), { message: "revision is not a safe branch, tag, or commit name" })
+});
+const ResolvedSourceSchema = z.object({
+	kind: z.literal("git"),
+	repository: z.string().min(1).max(64),
+	requested_revision: z.string().min(1).max(256),
+	resolved_commit: z.string().regex(/^[0-9a-f]{40,64}$/)
+});
+const PersistenceMountSchema = z.object({
+	name: z.string().min(1).max(64).regex(/^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/),
+	target: z.string().min(1),
+	maxBytes: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+	maxFiles: z.number().int().positive().max(1e7)
+});
+const CheckpointPolicySchema = z.object({
+	onIdle: z.enum(["preserve", "destroy"]).default("destroy"),
+	onDeadline: z.enum(["preserve", "destroy"]).default("destroy"),
+	onCleanExit: z.enum(["preserve", "destroy"]).default("destroy"),
+	onFailure: z.enum([
+		"preserve",
+		"retain-for-recovery",
+		"destroy"
+	]).default("destroy"),
+	retention: DurationValueSchema.default("168h")
+});
+const PersistenceSpecSchema = z.object({
+	mounts: z.array(PersistenceMountSchema).max(16).default([]),
+	conversationRestore: z.enum(CONVERSATION_RESTORE_CAPABILITIES).default("filesystem_only"),
+	conversationRetention: DurationValueSchema.default("168h"),
+	sessionCompatibility: z.string().min(1).max(128).optional(),
+	checkpoint: CheckpointPolicySchema.prefault({})
+});
+const OutputDeclarationSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("gitSha") }),
+	z.object({
+		type: z.literal("string"),
+		maxLength: z.number().int().positive().max(4096).default(512)
+	}),
+	z.object({
+		type: z.literal("httpsUrl"),
+		maxLength: z.number().int().positive().max(4096).default(2048)
+	})
+]);
+const CHECKPOINT_STATES = [
+	"creating",
+	"ready",
+	"failed",
+	"deleting",
+	"deleted"
+];
+const OPERATION_KINDS = [
+	"preserve",
+	"restore",
+	"verify",
+	"delete"
+];
+const OPERATION_STATES = [
+	"pending",
+	"running",
+	"succeeded",
+	"failed"
+];
+const CheckpointResourceSchema = z.object({
+	id: z.uuid(),
+	workspace_id: z.uuid(),
+	state: z.enum(CHECKPOINT_STATES),
+	reason_code: z.string().nullable(),
+	template: z.object({
+		name: z.string(),
+		version: z.string(),
+		digest: z.string()
+	}),
+	manifest_digest: z.string().nullable(),
+	logical_bytes: z.number().int().nonnegative().nullable(),
+	stored_bytes: z.number().int().nonnegative().nullable(),
+	file_count: z.number().int().nonnegative().nullable(),
+	mounts: z.array(z.string()),
+	conversation_restore: z.enum(CONVERSATION_RESTORE_CAPABILITIES),
+	label: z.string().nullable(),
+	created_at: z.iso.datetime(),
+	ready_at: z.iso.datetime().nullable(),
+	expires_at: z.iso.datetime().nullable()
+});
+const OperationResourceSchema = z.object({
+	id: z.uuid(),
+	kind: z.enum(OPERATION_KINDS),
+	state: z.enum(OPERATION_STATES),
+	workspace_id: z.uuid().nullable(),
+	checkpoint_id: z.uuid().nullable(),
+	result_workspace_id: z.uuid().nullable(),
+	reason_code: z.string().nullable(),
+	created_at: z.iso.datetime(),
+	updated_at: z.iso.datetime(),
+	completed_at: z.iso.datetime().nullable()
+});
+z.object({
+	retention: DurationValueSchema.optional(),
+	label: z.string().min(1).max(128).optional()
+});
+z.object({
+	external_id: z.string().min(1).max(256),
+	metadata: z.record(z.string().max(64), z.string().max(512)).optional(),
+	launch_input: z.record(z.string(), z.unknown()).optional()
+});
+const CheckpointManifestEntrySchema = z.object({
+	path: z.string(),
+	kind: z.enum([
+		"directory",
+		"file",
+		"symlink"
+	]),
+	mode: z.number().int().nonnegative(),
+	uid: z.number().int().nonnegative(),
+	gid: z.number().int().nonnegative(),
+	mtime_ns: z.string().regex(/^\d+$/),
+	size: z.number().int().nonnegative(),
+	digest: z.string().optional(),
+	link_target: z.string().optional()
+});
+z.object({
+	format: z.literal("pocketcoder-checkpoint/v1"),
+	checkpoint_id: z.uuid(),
+	template_digest: z.string(),
+	mounts: z.array(z.object({
+		name: z.string(),
+		entries: z.array(CheckpointManifestEntrySchema)
+	})),
+	logical_bytes: z.number().int().nonnegative(),
+	file_count: z.number().int().nonnegative()
+});
+//#endregion
+//#region ../contracts/src/network.ts
+const DOMAIN_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isDomain(value) {
+	const domain = value.startsWith("*.") ? value.slice(2) : value;
+	return domain.length <= 253 && !domain.endsWith(".") && isIP(domain) === 0 && domain.split(".").length >= 2 && domain.split(".").every((label) => DOMAIN_LABEL.test(label));
+}
+const NetworkRuleSchema = z.object({
+	domain: z.string().refine(isDomain, "expected a lowercase ASCII domain or leading *. wildcard"),
+	ports: z.array(z.number().int().min(1).max(65535)).min(1).max(32).default([80, 443]),
+	allowPrivate: z.boolean().default(false)
+}).superRefine((rule, ctx) => {
+	if (new Set(rule.ports).size !== rule.ports.length) ctx.addIssue({
+		code: "custom",
+		path: ["ports"],
+		message: "ports must be unique"
+	});
+});
+const UnrestrictedNetworkPolicySchema = z.object({ mode: z.literal("unrestricted") });
+const RestrictedNetworkPolicySchema = z.object({
+	mode: z.literal("restricted"),
+	allow: z.array(NetworkRuleSchema).max(256).default([])
+});
+const NetworkPolicySchema = z.preprocess((value) => value ?? { mode: "unrestricted" }, z.discriminatedUnion("mode", [UnrestrictedNetworkPolicySchema, RestrictedNetworkPolicySchema]));
+const NETWORK_STATES = [
+	"disabled",
+	"starting",
+	"ready",
+	"degraded"
+];
+const NetworkEventInputSchema = z.object({
+	source_seq: z.number().int().positive(),
+	occurred_at: z.iso.datetime(),
+	decision: z.enum(["allow", "deny"]),
+	transport: z.enum(["http", "https"]),
+	host: z.string().min(1).max(253),
+	port: z.number().int().min(1).max(65535),
+	method: z.string().max(32).nullable().default(null),
+	path: z.string().max(2048).refine((path) => !path.includes("?") && !path.includes("#"), "path cannot contain query or fragment").nullable().default(null),
+	matched_rule: z.string().max(512).nullable().default(null),
+	reason: z.string().min(1).max(128)
+});
+z.object({
+	source_session_id: z.uuid(),
+	events: z.array(NetworkEventInputSchema).min(1).max(100)
+});
+const NetworkEventSchema = NetworkEventInputSchema.omit({ source_seq: true }).extend({
+	seq: z.number().int().positive(),
+	workspace_id: z.uuid(),
+	source_session_id: z.uuid(),
+	source_seq: z.number().int().positive()
+});
+CursorQuerySchema(200, 100);
+const NetworkEventPageSchema = CursorPageSchema(NetworkEventSchema);
+//#endregion
+//#region ../contracts/src/workspace.ts
+const WORKSPACE_STATES = [
+	"queued",
+	"provisioning",
+	"connected",
+	"ready",
+	"preserving",
+	"terminating",
+	"succeeded",
+	"failed",
+	"canceled",
+	"expired",
+	"preserved"
+];
+const TERMINAL_STATES = [
+	"succeeded",
+	"failed",
+	"canceled",
+	"expired",
+	"preserved"
+];
+const REASON_CODES = [
+	"child_exit_success",
+	"child_exit_failure",
+	"setup_failed",
+	"bootstrap_failed",
+	"registration_timeout",
+	"health_failed",
+	"child_crash",
+	"provider_lost",
+	"disconnect_timeout",
+	"canceled_by_caller",
+	"deadline_expired",
+	"idle_expired",
+	"queue_timeout",
+	"launch_failed",
+	"preserve_requested",
+	"preserved_by_policy",
+	"checkpoint_created",
+	"checkpoint_failed",
+	"checkpoint_corrupt",
+	"checkpoint_quota_exceeded",
+	"checkpoint_storage_lost",
+	"restore_requested",
+	"restore_failed",
+	"image_unavailable",
+	"source_resolution_failed",
+	"secret_resolution_failed",
+	"operation_conflict",
+	"network_policy_failed"
+];
+const AGENT_STATES = [
+	"unknown",
+	"running",
+	"stable"
+];
+z.object({
+	external_id: z.string().min(1).max(256),
+	template: z.object({
+		name: z.string().min(1).max(64),
+		version: z.string().max(64).optional()
+	}),
+	launch_input: z.record(z.string(), z.unknown()).optional(),
+	source: SourceDescriptorSchema.optional(),
+	metadata: z.record(z.string().max(64), z.string().max(512)).optional()
+});
+const TemplateRefSchema = z.object({
+	name: z.string(),
+	version: z.string(),
+	digest: z.string()
+});
+const WorkspaceResourceSchema = z.object({
+	id: z.uuid(),
+	external_id: z.string(),
+	template: TemplateRefSchema,
+	state: z.enum(WORKSPACE_STATES),
+	reason_code: z.enum(REASON_CODES).nullable(),
+	agent_state: z.enum(AGENT_STATES),
+	change_cursor: z.number().int().nonnegative(),
+	provider_kind: z.string().nullable(),
+	provisioning_mode: z.enum(["cold", "warm"]).nullable(),
+	network: z.object({ state: z.enum(NETWORK_STATES) }),
+	health: z.record(z.string(), z.string()),
+	created_at: z.iso.datetime(),
+	updated_at: z.iso.datetime(),
+	connected_at: z.iso.datetime().nullable(),
+	ready_at: z.iso.datetime().nullable(),
+	deadline_at: z.iso.datetime(),
+	terminal_at: z.iso.datetime().nullable(),
+	metadata: z.record(z.string(), z.string()),
+	origin_workspace_id: z.uuid().nullable(),
+	restored_from_checkpoint_id: z.uuid().nullable(),
+	source: SourceDescriptorSchema.extend({
+		requested_revision: z.string(),
+		resolved_commit: ResolvedSourceSchema.shape.resolved_commit.nullable()
+	}).omit({ revision: true }).nullable(),
+	persistence: z.object({
+		enabled: z.boolean(),
+		conversation_restore: z.enum(CONVERSATION_RESTORE_CAPABILITIES),
+		conversation_resume: z.object({
+			status: z.enum([
+				"supported",
+				"unsupported",
+				"unknown"
+			]),
+			reason: z.enum(["filesystem_only", "capability_unknown"]).nullable()
+		}),
+		latest_checkpoint_id: z.uuid().nullable()
+	}),
+	outputs: z.record(z.string(), z.unknown()),
+	failure: z.object({
+		reason_code: z.enum(REASON_CODES),
+		log_tail: z.string(),
+		log_tail_truncated: z.boolean(),
+		last_log_seq: z.number().int().nonnegative().nullable()
+	}).nullable()
+});
+const WorkspacePageSchema = CursorPageSchema(WorkspaceResourceSchema);
+z.object({
+	external_id: z.string().optional(),
+	state: z.enum(WORKSPACE_STATES).optional(),
+	template: z.string().optional(),
+	metadata: z.string().max(4096).optional(),
+	created_after: z.iso.datetime().optional(),
+	created_before: z.iso.datetime().optional(),
+	limit: z.coerce.number().int().positive().max(200).default(50),
+	cursor: z.string().optional()
+});
+//#endregion
+//#region ../contracts/src/api.ts
+const TemplatePageSchema = CursorPageSchema(z.object({
+	name: z.string(),
+	version: z.string(),
+	digest: z.string(),
+	description: z.string().optional(),
+	status: z.enum([
+		"active",
+		"available",
+		"retired"
+	])
+}));
+CursorQuerySchema(200, 100);
+const CheckpointPageSchema = CursorPageSchema(CheckpointResourceSchema);
+CursorQuerySchema(200, 50).extend({ state: z.enum(CHECKPOINT_STATES).optional() });
+const WorkspaceChangeSchema = z.object({
+	cursor: z.number().int().nonnegative(),
+	changed: z.boolean(),
+	workspace: WorkspaceResourceSchema
+});
+const PreserveResponseSchema = z.object({
+	workspace: WorkspaceResourceSchema,
+	checkpoint: CheckpointResourceSchema,
+	operation: OperationResourceSchema
+});
+const RestoreResponseSchema = z.object({
+	workspace: WorkspaceResourceSchema,
+	operation: OperationResourceSchema
+});
+const ResumeResponseSchema = RestoreResponseSchema.extend({ resume: ConversationResumeOutcomeSchema });
+const OutputPageSchema = CursorPageSchema(z.object({
+	seq: z.number().int().positive(),
+	name: z.string(),
+	value: z.unknown(),
+	occurred_at: z.iso.datetime()
+}));
+CursorQuerySchema(1e3, 200);
+const WarmPoolInventorySchema = z.object({
+	items: z.array(z.object({
+		template: z.string(),
+		version: z.string(),
+		template_digest: z.string(),
+		driver: z.string(),
+		desired: z.number().int().nonnegative(),
+		counts: z.record(z.string(), z.number().int().nonnegative()),
+		oldest_ready_age_ms: z.number().nonnegative().nullable()
+	})),
+	metrics: z.record(z.string(), z.number())
+});
+const StorageInventorySchema = z.object({
+	backend: z.string(),
+	storage_count: z.number().int().nonnegative(),
+	checkpoint_count: z.number().int().nonnegative(),
+	unknown_storage: z.array(z.string()),
+	unknown_checkpoints: z.array(z.string())
+});
+const StoragePruneResultSchema = z.object({
+	deleted: z.number().int().nonnegative(),
+	skipped: z.number().int().nonnegative(),
+	transcripts_deleted: z.number().int().nonnegative()
+});
+//#endregion
+//#region ../contracts/src/attachment.ts
+const ATTACHMENT_MAX_FILE_BYTES = 26214400;
+const ATTACHMENT_CHUNK_BYTES = 524288;
+const AttachmentMediaTypeSchema = z.string().regex(/^[\w.+-]+\/[\w.+-]+$/).max(255);
+const AttachmentDescriptorSchema = z.object({
+	id: z.uuid(),
+	name: z.string().min(1).max(255),
+	path: z.string().min(1),
+	media_type: AttachmentMediaTypeSchema,
+	size_bytes: z.number().int().min(0).max(ATTACHMENT_MAX_FILE_BYTES),
+	sha256: z.string().regex(/^[0-9a-f]{64}$/)
+});
+z.looseObject({
+	type: z.literal("user"),
+	content: z.string(),
+	attachment_ids: z.array(z.uuid()).min(1).max(10).refine((ids) => new Set(ids).size === ids.length, "attachment_ids must be unique").optional()
+});
+const MANIFEST_OPEN = "<pocketcoder-attachments>";
+const MANIFEST_CLOSE = "</pocketcoder-attachments>";
+function splitAttachmentManifest(content) {
+	const open = content.lastIndexOf(MANIFEST_OPEN);
+	if (open < 0 || !content.trimEnd().endsWith(MANIFEST_CLOSE)) return {
+		text: content,
+		attachments: null
+	};
+	const close = content.lastIndexOf(MANIFEST_CLOSE);
+	const parsed = z.array(AttachmentDescriptorSchema).safeParse(safeJson(content.slice(open + 25, close)));
+	if (!parsed.success) return {
+		text: content,
+		attachments: null
+	};
+	return {
+		text: content.slice(0, open).trimEnd(),
+		attachments: parsed.data
+	};
+}
+function safeJson(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+const AttachmentStartPayload = z.object({
+	operation_id: z.uuid(),
+	attachment_id: z.uuid(),
+	name: z.string().min(1).max(255),
+	media_type: AttachmentMediaTypeSchema,
+	size_bytes: z.number().int().min(0).max(ATTACHMENT_MAX_FILE_BYTES)
+});
+const AttachmentChunkPayload = z.object({
+	operation_id: z.uuid(),
+	seq: z.number().int().nonnegative(),
+	content_b64: z.string().max(Math.ceil(ATTACHMENT_CHUNK_BYTES / 3) * 4 + 4)
+});
+const AttachmentFinishPayload = z.object({ operation_id: z.uuid() });
+const AttachmentAbortPayload = z.object({
+	operation_id: z.uuid(),
+	reason: z.string().max(512)
+});
+const AttachmentResolvePayload = z.object({
+	operation_id: z.uuid(),
+	attachment_ids: z.array(z.uuid()).min(1).max(10)
+});
+const AttachmentAckPayload = z.object({
+	operation_id: z.uuid(),
+	seq: z.number().int().nonnegative(),
+	received_bytes: z.number().int().nonnegative()
+});
+const AttachmentResultPayload = z.object({
+	operation_id: z.uuid(),
+	status: z.enum([
+		"created",
+		"existing",
+		"conflict",
+		"failed"
+	]),
+	descriptor: AttachmentDescriptorSchema.optional(),
+	failure_code: z.enum([
+		"invalid",
+		"too_large",
+		"sequence",
+		"io",
+		"interrupted"
+	]).optional(),
+	detail: z.string().max(512).optional()
+});
+const AttachmentResolvedPayload = z.object({
+	operation_id: z.uuid(),
+	descriptors: z.array(AttachmentDescriptorSchema).optional(),
+	missing_id: z.uuid().optional()
+});
+const errorCodes = Object.keys({
+	"auth.invalid_key": 401,
+	"auth.missing_scope": 403,
+	"auth.disabled_principal": 403,
+	"validation.invalid": 400,
+	"idempotency.conflict": 409,
+	"capacity.queue_full": 429,
+	"capacity.waiters_full": 429,
+	"template.not_found": 404,
+	"template.version_not_found": 404,
+	"template.not_authorized": 403,
+	"workspace.not_found": 404,
+	"workspace.external_id_conflict": 409,
+	"workspace.not_ready": 409,
+	"workspace.terminal": 410,
+	"workspace.disconnected": 503,
+	"terminal.not_declared": 422,
+	"terminal.session_limit": 409,
+	"terminal.session_not_found": 404,
+	"terminal.session_closed": 409,
+	"terminal.protocol_unsupported": 426,
+	"workspace.persistence_not_enabled": 409,
+	"workspace.preserving": 409,
+	"checkpoint.not_found": 404,
+	"checkpoint.not_ready": 409,
+	"checkpoint.none_ready": 409,
+	"checkpoint.corrupt": 409,
+	"checkpoint.quota_exceeded": 413,
+	"checkpoint.in_use": 409,
+	"restore.template_not_authorized": 403,
+	"restore.image_unavailable": 409,
+	"restore.incompatible": 409,
+	"resume.unsupported": 409,
+	"conversation.expired": 410,
+	"conversation.deleted": 410,
+	"operation.conflict": 409,
+	"source.not_allowed": 422,
+	"source.invalid_revision": 422,
+	"secret.unavailable": 503,
+	"storage.capacity_exhausted": 507,
+	"relay.body_too_large": 413,
+	"relay.route_not_allowed": 422,
+	"relay.streaming_unsupported": 409,
+	"relay.deadline_exceeded": 504,
+	"relay.upstream_error": 502,
+	"attachment.invalid": 400,
+	"attachment.too_large": 413,
+	"attachment.not_found": 404,
+	"attachment.conflict": 409,
+	"attachment.unsupported": 409,
+	"attachment.interrupted": 503,
+	"internal.error": 500
+});
+const ErrorEnvelopeSchema = z.object({ error: z.object({
+	code: z.enum(errorCodes),
+	message: z.string().min(1),
+	request_id: z.string().min(1),
+	details: z.record(z.string(), z.unknown()).optional()
+}) });
+WORKSPACE_STATES.map((s) => `workspace.${s}`);
+z.object({
+	id: z.uuid(),
+	type: z.string(),
+	occurred_at: z.iso.datetime(),
+	workspace: z.object({
+		id: z.uuid(),
+		external_id: z.string(),
+		state: z.enum(WORKSPACE_STATES),
+		reason_code: z.string().nullable(),
+		agent_state: z.enum(AGENT_STATES),
+		provisioning_mode: z.enum(["cold", "warm"]).nullable().default(null),
+		change_cursor: z.number().int().nonnegative(),
+		failure: z.object({
+			reason_code: z.enum(REASON_CODES),
+			log_tail: z.string(),
+			log_tail_truncated: z.boolean(),
+			last_log_seq: z.number().int().nonnegative().nullable()
+		}).nullable(),
+		template: z.object({
+			name: z.string(),
+			version: z.string(),
+			digest: z.string()
+		}),
+		origin_workspace_id: z.uuid().nullable(),
+		restored_from_checkpoint_id: z.uuid().nullable(),
+		latest_checkpoint_id: z.uuid().nullable(),
+		outputs: z.record(z.string(), z.unknown())
+	})
+});
+//#endregion
+//#region ../contracts/src/logs.ts
+const LogChunkSchema = z.object({
+	seq: z.number().int().positive(),
+	stream: z.string(),
+	occurred_at: z.iso.datetime(),
+	content: z.string()
+});
+CursorQuerySchema(1e3, 200);
+const LogPageSchema = CursorPageSchema(LogChunkSchema);
+//#endregion
+//#region ../contracts/src/protocol-stream.ts
+const ProxyStreamStartPayload = z.object({
+	request_id: z.uuid(),
+	status: z.number().int().min(100).max(599),
+	headers: z.record(z.string(), z.string())
+});
+const ProxyStreamChunkPayload = z.object({
+	request_id: z.uuid(),
+	seq: z.number().int().nonnegative(),
+	content_b64: z.string().max(87400)
+});
+const ProxyStreamEndPayload = z.object({
+	request_id: z.uuid(),
+	error_code: z.enum([
+		"unreachable",
+		"deadline",
+		"too_large"
+	]).optional()
+});
+const ProxyStreamAckPayload = z.object({
+	request_id: z.uuid(),
+	seq: z.number().int().nonnegative()
+});
+const ProxyStreamCancelPayload = z.object({
+	request_id: z.uuid(),
+	reason: z.enum([
+		"downstream_closed",
+		"deadline",
+		"too_large",
+		"workspace_disconnected"
+	])
+});
+//#endregion
+//#region ../contracts/src/template-constants.ts
+function isAbsolutePath(value) {
+	return value.startsWith("/") && ![...value].some((character) => character.codePointAt(0) === 0);
+}
+const SECRET_ENV_PATTERN = /(SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|PRIVATE_?KEY|CREDENTIAL)/i;
+const SECRET_REFERENCE_PREFIX = "secretRef:";
+//#endregion
+//#region ../contracts/src/template-schema.ts
+const NAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const SEMVER_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+const IMAGE_DIGEST_RE = /^[^\s@]+@sha256:[0-9a-f]{64}$/;
+function secretMountPath(reference) {
+	if (!reference.startsWith("secretRef:")) throw new Error("secret reference must start with secretRef:");
+	const name = reference.slice(10);
+	if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(name) || name.includes("..")) throw new Error("invalid secret reference");
+	return `/run/pocketcoder/secrets/${name.replaceAll("/", "%2F")}`;
+}
+const DurationSchema = z.string().refine(isDuration, { message: "expected a duration like 15s, 20m, or 2h" });
+const CommandSchema = z.array(z.string().min(1)).min(1);
+const EnvSchema = z.record(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), z.string());
+const SetupStepSchema = z.object({
+	name: z.string().regex(NAME_RE),
+	command: CommandSchema,
+	timeoutSeconds: z.number().int().positive().max(3600).default(300),
+	env: EnvSchema.default({}),
+	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional(),
+	runOn: z.array(z.enum(LAUNCH_MODES)).min(1).default(["create"])
+});
+const HarnessSchema = z.object({
+	command: CommandSchema,
+	env: EnvSchema.default({}),
+	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional()
+});
+const AgentSchema = HarnessSchema.extend({
+	type: z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/).default("custom"),
+	transport: z.enum(["pty", "acp"]).default("pty"),
+	termWidth: z.number().int().min(10).max(65535).optional()
+});
+const TerminalSchema = z.object({
+	command: CommandSchema,
+	env: EnvSchema.default({}),
+	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional(),
+	maxSessions: z.number().int().min(1).max(8).default(2),
+	idleTimeout: DurationSchema.default("10m")
+});
+const ServiceRouteSchema = z.object({
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE"
+	]),
+	path: z.string(),
+	query: z.array(z.string().min(1)).default([]),
+	responseMode: z.enum(["buffered", "stream"]).default("buffered"),
+	maxRequestBytes: z.number().int().positive().max(16777216).default(65536),
+	maxResponseBytes: z.number().int().positive().max(16777216).default(1048576),
+	deadlineSeconds: z.number().int().positive().max(300).default(60)
+});
+const ServiceSchema = z.object({
+	baseUrl: z.string(),
+	required: z.boolean().default(true),
+	healthPath: z.string().default("/status"),
+	routes: z.array(ServiceRouteSchema).min(1)
+});
+const SecuritySchema = z.object({
+	uid: z.number().int().min(1e3).default(10001),
+	gid: z.number().int().min(1e3).default(10001),
+	readOnlyRoot: z.boolean().default(true),
+	writableMemoryPaths: z.array(z.string().refine(isAbsolutePath, "expected an absolute path")).default(["/tmp"]),
+	dropCapabilities: z.array(z.string()).default(["ALL"]),
+	allowPrivilegeEscalation: z.literal(false).default(false),
+	seccomp: z.literal("RuntimeDefault").default("RuntimeDefault")
+});
+const TimeoutsSchema = z.object({
+	start: DurationSchema.default("2m"),
+	maxAge: DurationSchema.default("2h"),
+	idle: DurationSchema.default("20m"),
+	disconnectGrace: DurationSchema.default("5m"),
+	terminateGrace: DurationSchema.default("15s")
+});
+const ResourcesSchema = z.object({
+	cpu: z.string().regex(/^\d+(\.\d+)?m?$/),
+	memory: z.string().regex(/^\d+(Mi|Gi)$/)
+});
+const RepositorySchema = z.object({
+	url: z.url().refine((value) => {
+		try {
+			return new URL(value).username === "" && new URL(value).password === "";
+		} catch {
+			return false;
+		}
+	}, "repository URLs must not contain userinfo"),
+	credential: z.string().startsWith(SECRET_REFERENCE_PREFIX).max(256).refine((value) => {
+		try {
+			secretMountPath(value);
+			return true;
+		} catch {
+			return false;
+		}
+	}, "credential must be a normalized secret reference").optional()
+});
+const SourceSpecSchema = z.object({
+	kind: z.literal("git"),
+	destinationMount: z.string().regex(NAME_RE),
+	repositories: z.record(z.string().regex(NAME_RE), RepositorySchema),
+	allowedRevision: z.literal("branch-tag-or-commit").default("branch-tag-or-commit")
+});
+const CheckpointHookSchema = z.object({
+	command: CommandSchema,
+	timeoutSeconds: z.number().int().positive().max(300).default(30),
+	env: EnvSchema.default({}),
+	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional()
+});
+const TemplateSpecSchema = z.object({
+	version: z.string().regex(SEMVER_RE),
+	image: z.string().regex(IMAGE_DIGEST_RE, { message: "image must be digest-pinned (repo@sha256:<64 hex>)" }),
+	command: CommandSchema.default([
+		"/usr/local/bin/pocketcoder-agent",
+		"supervise",
+		"--launch-input",
+		"/run/pocketcoder/input"
+	]),
+	setup: z.array(SetupStepSchema).max(32).default([]),
+	agent: AgentSchema.optional(),
+	harness: HarnessSchema.optional(),
+	terminal: TerminalSchema.optional(),
+	env: EnvSchema.default({}),
+	resources: ResourcesSchema,
+	timeouts: TimeoutsSchema.prefault({}),
+	services: z.record(z.string().regex(NAME_RE), ServiceSchema).optional(),
+	security: SecuritySchema.prefault({}),
+	network: NetworkPolicySchema,
+	maxLaunchInputBytes: z.number().int().positive().max(1048576).default(65536),
+	compat: z.object({
+		agent: z.string().optional(),
+		agentapi: z.string().optional()
+	}).default({}),
+	persistence: PersistenceSpecSchema.prefault({}),
+	source: SourceSpecSchema.nullable().default(null),
+	checkpointHook: CheckpointHookSchema.optional(),
+	outputs: z.record(z.string().regex(NAME_RE), OutputDeclarationSchema).default({})
+}).superRefine((spec, ctx) => {
+	if (!spec.agent && !spec.harness) ctx.addIssue({
+		code: "custom",
+		path: ["harness"],
+		message: "either agent or harness is required"
+	});
+	if (!spec.agent) return;
+	if (spec.agent.transport === "acp" && spec.agent.termWidth !== void 0) ctx.addIssue({
+		code: "custom",
+		path: ["agent", "termWidth"],
+		message: "termWidth is only valid for PTY transport"
+	});
+	for (const field of [
+		"harness",
+		"services",
+		"checkpointHook"
+	]) {
+		if (spec[field] === void 0) continue;
+		ctx.addIssue({
+			code: "custom",
+			path: [field],
+			message: `agent cannot be combined with ${field}`
+		});
+	}
+}).transform((spec) => {
+	if (spec.agent) {
+		const { harness: _harness, services: _services, checkpointHook: _hook, ...native } = spec;
+		return {
+			...native,
+			agent: spec.agent
+		};
+	}
+	const { agent: _agent, ...legacy } = spec;
+	return {
+		...legacy,
+		harness: spec.harness,
+		services: spec.services ?? {}
+	};
+});
+const TemplateManifestBaseSchema = z.object({
+	apiVersion: z.literal("pocketcoder.dev/v1alpha1"),
+	kind: z.literal("Template"),
+	metadata: z.object({
+		name: z.string().regex(NAME_RE),
+		description: z.string().max(512).optional()
+	}),
+	spec: TemplateSpecSchema
+});
+//#endregion
+//#region ../contracts/src/template-runtime.ts
+const LEGACY_AGENTAPI_SERVICE = ServiceSchema.parse({
+	baseUrl: "http://127.0.0.1:3284",
+	routes: [
+		{
+			method: "GET",
+			path: "/status"
+		},
+		{
+			method: "GET",
+			path: "/messages",
+			query: ["after"]
+		},
+		{
+			method: "POST",
+			path: "/message"
+		}
+	]
+});
+const AGENTAPI_SERVICE = ServiceSchema.parse({
+	...LEGACY_AGENTAPI_SERVICE,
+	routes: [...LEGACY_AGENTAPI_SERVICE.routes, {
+		method: "GET",
+		path: "/events",
+		responseMode: "stream",
+		maxResponseBytes: 4194304,
+		deadlineSeconds: 300
+	}]
+});
+function isAgentApiNative(spec) {
+	return "agent" in spec && spec.agent !== void 0;
+}
+function agentApiHarness(spec) {
+	if (!isAgentApiNative(spec)) return spec.harness;
+	return {
+		command: [
+			"/usr/local/bin/agentapi",
+			"server",
+			"--type",
+			spec.agent.type,
+			...spec.agent.transport === "acp" ? ["--experimental-acp"] : [],
+			...spec.agent.termWidth === void 0 ? [] : ["--term-width", String(spec.agent.termWidth)],
+			"--port",
+			"3284",
+			"--",
+			...spec.agent.command
+		],
+		env: spec.agent.env,
+		...spec.agent.cwd ? { cwd: spec.agent.cwd } : {}
+	};
+}
+function templateServices(spec) {
+	return isAgentApiNative(spec) ? { agent: AGENTAPI_SERVICE } : spec.services;
+}
+//#endregion
+//#region ../contracts/src/template-validation.ts
+function envSources(spec) {
+	const sources = [[["spec", "env"], spec.env], [isAgentApiNative(spec) ? [
+		"spec",
+		"agent",
+		"env"
+	] : [
+		"spec",
+		"harness",
+		"env"
+	], agentApiHarness(spec).env]];
+	for (const [i, step] of spec.setup.entries()) sources.push([[
+		"spec",
+		"setup",
+		i,
+		"env"
+	], step.env]);
+	if (!isAgentApiNative(spec) && spec.checkpointHook) sources.push([[
+		"spec",
+		"checkpointHook",
+		"env"
+	], spec.checkpointHook.env]);
+	if (spec.terminal) sources.push([[
+		"spec",
+		"terminal",
+		"env"
+	], spec.terminal.env]);
+	return sources;
+}
+const NETWORK_ENV = /* @__PURE__ */ new Set([
+	"http_proxy",
+	"https_proxy",
+	"all_proxy",
+	"no_proxy"
+]);
+function validateNetworkEnvironment(spec, ctx) {
+	if (spec.network.mode !== "restricted") return;
+	for (const [path, env] of envSources(spec)) for (const key of Object.keys(env)) {
+		if (!NETWORK_ENV.has(key.toLowerCase())) continue;
+		ctx.addIssue({
+			code: "custom",
+			path: [...path, key],
+			message: "proxy variables are reserved by restricted networking"
+		});
+	}
+}
+function validateServices(spec, ctx) {
+	for (const [serviceName, service] of Object.entries(templateServices(spec))) {
+		if (!isLoopbackBaseUrl(service.baseUrl)) ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"services",
+				serviceName,
+				"baseUrl"
+			],
+			message: "service baseUrl must be a loopback http URL"
+		});
+		if (!isNormalizedPath(service.healthPath)) ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"services",
+				serviceName,
+				"healthPath"
+			],
+			message: "healthPath must be a normalized absolute path"
+		});
+		validateServiceRoutes(serviceName, service.routes, ctx);
+	}
+}
+function validateServiceRoutes(serviceName, routes, ctx) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, route] of routes.entries()) {
+		if (!isNormalizedPath(route.path)) ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"services",
+				serviceName,
+				"routes",
+				index,
+				"path"
+			],
+			message: "route path must be normalized, absolute, and exact"
+		});
+		const key = `${route.method} ${route.path}`;
+		if (seen.has(key)) ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"services",
+				serviceName,
+				"routes",
+				index
+			],
+			message: `duplicate route: ${key}`
+		});
+		seen.add(key);
+	}
+}
+function validateEnvironment(spec, ctx) {
+	for (const [where, env] of envSources(spec)) for (const [key, value] of Object.entries(env)) {
+		if (SECRET_ENV_PATTERN.test(key) && !value.startsWith("secretRef:") && value !== "") ctx.addIssue({
+			code: "custom",
+			path: where,
+			message: `env ${key} looks like a secret literal; use a "${SECRET_REFERENCE_PREFIX}" reference resolved by the deployment`
+		});
+		if (value.startsWith("secretRef:") && !validSecretReference(value)) ctx.addIssue({
+			code: "custom",
+			path: where,
+			message: `env ${key} has an invalid secret reference`
+		});
+	}
+}
+function validateTerminal(spec, ctx) {
+	if (!spec.terminal?.cwd || spec.terminal.cwd === "/" || isNormalizedFilesystemPath(spec.terminal.cwd)) return;
+	ctx.addIssue({
+		code: "custom",
+		path: [
+			"spec",
+			"terminal",
+			"cwd"
+		],
+		message: "cwd must be a normalized absolute filesystem path"
+	});
+}
+function validSecretReference(value) {
+	try {
+		secretMountPath(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function validateOutputs(spec, ctx) {
+	for (const name of Object.keys(spec.outputs)) {
+		if (!SECRET_ENV_PATTERN.test(name)) continue;
+		ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"outputs",
+				name
+			],
+			message: "secret-like names are not allowed as durable outputs"
+		});
+	}
+}
+function validateWritableMemoryPaths(spec, ctx) {
+	for (const path of spec.security.writableMemoryPaths) {
+		if (!path.includes("..")) continue;
+		ctx.addIssue({
+			code: "custom",
+			path: [
+				"spec",
+				"security",
+				"writableMemoryPaths"
+			],
+			message: "writable paths must not contain .."
+		});
+	}
+}
+function isLoopbackBaseUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:") return false;
+	if (url.pathname !== "/" || url.search !== "" || url.hash !== "") return false;
+	return [
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	].includes(url.hostname) || url.hostname === "::1";
+}
+const FORBIDDEN_PERSISTENCE_ROOTS = [
+	"/",
+	"/run/pocketcoder",
+	"/run/pocketcoder/secrets",
+	"/proc",
+	"/sys",
+	"/dev"
+];
+function pathContains(parent, child) {
+	return child === parent || child.startsWith(`${parent}/`);
+}
+function validatePersistence(spec, ctx) {
+	const seenNames = /* @__PURE__ */ new Set();
+	const mounts = spec.persistence.mounts;
+	for (const [index, mount] of mounts.entries()) validatePersistenceMount(spec, mounts, mount, index, seenNames, ctx);
+	validateSourceMount(spec, mounts, ctx);
+	if (spec.persistence.conversationRestore === "supported" && (!spec.persistence.sessionCompatibility || mounts.length < 2)) ctx.addIssue({
+		code: "custom",
+		path: [
+			"spec",
+			"persistence",
+			"conversationRestore"
+		],
+		message: "supported conversation restore requires sessionCompatibility and a separate harness-state mount"
+	});
+}
+function validatePersistenceMount(spec, mounts, mount, index, seenNames, ctx) {
+	const path = [
+		"spec",
+		"persistence",
+		"mounts",
+		index,
+		"target"
+	];
+	if (!isNormalizedFilesystemPath(mount.target)) ctx.addIssue({
+		code: "custom",
+		path,
+		message: "target must be a normalized absolute filesystem path"
+	});
+	if (FORBIDDEN_PERSISTENCE_ROOTS.some((root) => pathContains(root, mount.target))) ctx.addIssue({
+		code: "custom",
+		path,
+		message: "target overlaps a protected runtime or kernel path"
+	});
+	if (seenNames.has(mount.name)) ctx.addIssue({
+		code: "custom",
+		path: [
+			"spec",
+			"persistence",
+			"mounts",
+			index,
+			"name"
+		],
+		message: "persistence mount names must be unique"
+	});
+	seenNames.add(mount.name);
+	validateMountOverlap(mounts, mount, index, path, ctx);
+	validateMemoryPathOverlap(spec, mount, path, ctx);
+}
+function validateMountOverlap(mounts, mount, index, path, ctx) {
+	for (const [otherIndex, other] of mounts.entries()) {
+		if (otherIndex >= index) continue;
+		if (!pathContains(other.target, mount.target) && !pathContains(mount.target, other.target)) continue;
+		ctx.addIssue({
+			code: "custom",
+			path,
+			message: `target overlaps persistence mount ${other.name}`
+		});
+	}
+}
+function validateMemoryPathOverlap(spec, mount, path, ctx) {
+	for (const memoryPath of spec.security.writableMemoryPaths) {
+		if (!pathContains(memoryPath, mount.target) && !pathContains(mount.target, memoryPath)) continue;
+		ctx.addIssue({
+			code: "custom",
+			path,
+			message: `target overlaps writableMemoryPath ${memoryPath}`
+		});
+	}
+}
+function validateSourceMount(spec, mounts, ctx) {
+	if (!spec.source) return;
+	if (mounts.find((mount) => mount.name === spec.source?.destinationMount)) return;
+	ctx.addIssue({
+		code: "custom",
+		path: [
+			"spec",
+			"source",
+			"destinationMount"
+		],
+		message: "source destinationMount must name a persistence mount"
+	});
+}
+function isNormalizedFilesystemPath(path) {
+	if (!isAbsolutePath(path) || path === "/") return false;
+	if (path.endsWith("/") || path.includes("//") || path.includes("\\") || path.includes(",")) return false;
+	if ([...path].some((character) => {
+		const code = character.codePointAt(0) ?? 0;
+		return code < 32 || code === 127;
+	})) return false;
+	return !path.split("/").some((part) => part === "." || part === "..");
+}
+function isNormalizedPath(path) {
+	if (!path.startsWith("/")) return false;
+	if (path.includes("..") || path.includes("//")) return false;
+	if (/[?#\s]/.test(path)) return false;
+	if (/%2e|%2f|%5c/i.test(path)) return false;
+	if ([...path].some((character) => character.charCodeAt(0) <= 31)) return false;
+	return true;
+}
+function validateTemplateSpec(spec, ctx) {
+	validateServices(spec, ctx);
+	validateEnvironment(spec, ctx);
+	validateOutputs(spec, ctx);
+	validateWritableMemoryPaths(spec, ctx);
+	validatePersistence(spec, ctx);
+	validateNetworkEnvironment(spec, ctx);
+	validateTerminal(spec, ctx);
+}
+TemplateManifestBaseSchema.superRefine((manifest, ctx) => {
+	validateTemplateSpec(manifest.spec, ctx);
+});
+//#endregion
+//#region ../contracts/src/terminal.ts
+const TERMINAL_CHUNK_BYTES = 32768;
+const TERMINAL_REPLAY_BUFFER_BYTES = 65536;
+function base64Schema(maxBytes) {
+	return z.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((value) => {
+		const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+		return value.length / 4 * 3 - padding <= maxBytes;
+	}, `decoded payload must not exceed ${maxBytes} bytes`);
+}
+const TerminalChunkSchema = base64Schema(TERMINAL_CHUNK_BYTES);
+const TerminalReplaySchema = base64Schema(TERMINAL_REPLAY_BUFFER_BYTES);
+const TerminalSizeSchema = z.number().int().min(1).max(1e3);
+const TerminalOpenPayload = z.object({
+	session_id: z.uuid(),
+	rows: TerminalSizeSchema,
+	cols: TerminalSizeSchema,
+	reattach: z.boolean()
+});
+const TerminalInputPayload = z.object({
+	session_id: z.uuid(),
+	data_b64: TerminalChunkSchema
+});
+const TerminalResizePayload = z.object({
+	session_id: z.uuid(),
+	rows: TerminalSizeSchema,
+	cols: TerminalSizeSchema
+});
+const TerminalClosePayload = z.object({
+	session_id: z.uuid(),
+	reason: z.enum([
+		"checkpoint",
+		"workspace_ended",
+		"closed"
+	])
+});
+const TerminalOpenedPayload = z.object({
+	session_id: z.uuid(),
+	replay_b64: TerminalReplaySchema.optional()
+});
+const TerminalOutputPayload = z.object({
+	session_id: z.uuid(),
+	data_b64: TerminalChunkSchema
+});
+const TerminalClosedPayload = z.object({
+	session_id: z.uuid(),
+	reason: z.enum([
+		"exit",
+		"idle",
+		"checkpoint",
+		"workspace_ended",
+		"error",
+		"closed"
+	]),
+	exit_code: z.number().int().nullable().optional(),
+	detail: z.string().max(512).optional()
+});
+z.discriminatedUnion("type", [z.object({
+	type: z.literal("input"),
+	data_b64: TerminalChunkSchema
+}), z.object({
+	type: z.literal("resize"),
+	rows: TerminalSizeSchema,
+	cols: TerminalSizeSchema
+})]);
+const ServerTerminalMessageSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("opened"),
+		session_id: z.uuid(),
+		replay_b64: TerminalReplaySchema.optional()
+	}),
+	z.object({
+		type: z.literal("output"),
+		data_b64: TerminalChunkSchema
+	}),
+	z.object({
+		type: z.literal("closed"),
+		reason: z.enum([
+			"exit",
+			"idle",
+			"checkpoint",
+			"workspace_ended",
+			"agent_detached"
+		]),
+		exit_code: z.number().int().nullable().optional()
+	}),
+	z.object({
+		type: z.literal("status"),
+		state: z.enum(["reconnecting", "resumed"])
+	})
+]);
+const TerminalSessionSchema = z.object({
+	session_id: z.uuid(),
+	workspace_id: z.uuid(),
+	key_id: z.uuid(),
+	opened_at: z.iso.datetime(),
+	closed_at: z.iso.datetime().nullable(),
+	duration_ms: z.number().int().nonnegative().nullable(),
+	close_reason: z.enum([
+		"exit",
+		"idle",
+		"checkpoint",
+		"workspace_ended",
+		"agent_detached",
+		"client_closed"
+	]).nullable(),
+	exit_code: z.number().int().nullable(),
+	bytes_in: z.number().int().nonnegative(),
+	bytes_out: z.number().int().nonnegative()
+});
+CursorQuerySchema(200, 50);
+const TerminalSessionPageSchema = CursorPageSchema(TerminalSessionSchema);
+const ProviderInputSchema = z.object({
+	workspace_id: z.uuid(),
+	server_url: z.string(),
+	registration_secret: z.string(),
+	template_digest: z.string(),
+	template_name: z.string().default("unknown"),
+	template_version: z.string().default("unknown"),
+	launch_mode: z.enum(LAUNCH_MODES).default("create"),
+	source: SourceDescriptorSchema.optional(),
+	restore: z.object({
+		checkpoint_id: z.uuid(),
+		origin_workspace_id: z.uuid()
+	}).optional(),
+	launch_input: z.record(z.string(), z.unknown()).optional()
+});
+const PoolProviderInputSchema = z.object({
+	pool_runtime_id: z.uuid(),
+	server_url: z.string(),
+	enrollment_secret: z.string().min(1),
+	template_digest: z.string(),
+	template_name: z.string(),
+	template_version: z.string()
+});
+z.union([ProviderInputSchema, PoolProviderInputSchema]);
+z.object({
+	v: z.literal(3),
+	type: z.literal("pool_registered"),
+	pool_runtime_id: z.uuid(),
+	template: z.object({
+		name: z.string(),
+		version: z.string(),
+		digest: z.string()
+	}),
+	agent_version: z.string()
+});
+z.object({
+	v: z.literal(3),
+	type: z.literal("lease_assignment"),
+	input: ProviderInputSchema
+});
+const SOURCE_CREDENTIAL_MAX_BYTES = 65536;
+const EnvelopeBase = z.object({
+	v: z.union([
+		z.literal(1),
+		z.literal(2),
+		z.literal(3),
+		z.literal(4),
+		z.literal(5),
+		z.literal(6)
+	]),
+	workspace_id: z.uuid(),
+	connection_id: z.uuid(),
+	seq: z.number().int().nonnegative(),
+	sent_at: z.iso.datetime()
+});
+const RegisteredPayload = z.object({
+	agent_version: z.string(),
+	template: z.object({
+		name: z.string(),
+		version: z.string(),
+		digest: z.string()
+	}),
+	agentapi_version: z.string().optional(),
+	services: z.array(z.string()),
+	pid: z.number().int().positive()
+});
+const HeartbeatPayload = z.object({
+	child: z.enum([
+		"starting",
+		"setup",
+		"running",
+		"exited",
+		"terminating"
+	]),
+	agentapi_state: z.enum([
+		"unknown",
+		"stable",
+		"running"
+	]).optional()
+});
+const ProcessStatePayload = z.object({
+	phase: z.enum([
+		"starting",
+		"setup",
+		"running",
+		"exited",
+		"terminating"
+	]),
+	exit_code: z.number().int().nullable().optional(),
+	setup_step: z.string().optional(),
+	detail: z.string().max(512).optional()
+});
+const ServiceHealthPayload = z.object({
+	service: z.string(),
+	health: z.enum([
+		"unknown",
+		"starting",
+		"healthy",
+		"unhealthy"
+	]),
+	detail: z.string().max(512).optional()
+});
+const AgentStatePayload = z.object({ state: z.enum(["running", "stable"]) });
+const NetworkStatePayload = z.object({
+	state: z.enum([
+		"starting",
+		"ready",
+		"degraded"
+	]),
+	detail: z.string().max(512).optional()
+});
+const LogChunkPayload = z.object({
+	stream: z.enum([
+		"stdout",
+		"stderr",
+		"runtime"
+	]),
+	content_b64: z.string().max(87400),
+	occurred_at: z.iso.datetime()
+});
+const ProxyResponsePayload = z.object({
+	request_id: z.uuid(),
+	status: z.number().int().min(100).max(599).optional(),
+	headers: z.record(z.string(), z.string()).default({}),
+	body_b64: z.string().optional(),
+	error_code: z.enum([
+		"unreachable",
+		"deadline",
+		"too_large"
+	]).optional()
+});
+const TerminationAckPayload = z.object({ phase: z.enum([
+	"term_sent",
+	"killed",
+	"exited"
+]) });
+const SourceResolvedPayload = z.object({
+	repository: z.string().min(1).max(64),
+	requested_revision: z.string().min(1).max(256),
+	resolved_commit: z.string().regex(/^[0-9a-f]{40,64}$/)
+});
+const CheckpointStatusPayload = z.object({
+	operation_id: z.uuid(),
+	phase: z.enum([
+		"quiescing",
+		"quiesced",
+		"failed"
+	]),
+	detail: z.string().max(512).optional()
+});
+const OutputPublishedPayload = z.object({
+	name: z.string().min(1).max(64),
+	value: z.unknown()
+});
+const RestoreStatusPayload = z.object({
+	phase: z.enum([
+		"validating",
+		"ready",
+		"failed"
+	]),
+	capability: z.enum(CONVERSATION_RESTORE_CAPABILITIES),
+	detail: z.string().max(512).optional()
+});
+const ConversationMessagePayload = ConversationMessageInputSchema;
+z.discriminatedUnion("type", [
+	EnvelopeBase.extend({
+		type: z.literal("registered"),
+		payload: RegisteredPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("heartbeat"),
+		payload: HeartbeatPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("process_state"),
+		payload: ProcessStatePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("service_health"),
+		payload: ServiceHealthPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("agent_state"),
+		payload: AgentStatePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("network_state"),
+		payload: NetworkStatePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("log_chunk"),
+		payload: LogChunkPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_response"),
+		payload: ProxyResponsePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_stream_start"),
+		payload: ProxyStreamStartPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_stream_chunk"),
+		payload: ProxyStreamChunkPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_stream_end"),
+		payload: ProxyStreamEndPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_opened"),
+		payload: TerminalOpenedPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_output"),
+		payload: TerminalOutputPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_closed"),
+		payload: TerminalClosedPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("termination_ack"),
+		payload: TerminationAckPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("source_resolved"),
+		payload: SourceResolvedPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("checkpoint_status"),
+		payload: CheckpointStatusPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("output_published"),
+		payload: OutputPublishedPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("restore_status"),
+		payload: RestoreStatusPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("conversation_message"),
+		payload: ConversationMessagePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_ack"),
+		payload: AttachmentAckPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_result"),
+		payload: AttachmentResultPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_resolved"),
+		payload: AttachmentResolvedPayload
+	})
+]);
+const ExecSpecSchema = z.object({
+	agentapi_native: z.boolean().default(false),
+	setup: z.array(SetupStepSchema),
+	harness: HarnessSchema,
+	env: z.record(z.string(), z.string()),
+	services: z.record(z.string(), ServiceSchema),
+	terminal: z.object({
+		command: z.array(z.string().min(1)).min(1),
+		cwd: z.string().optional(),
+		env: z.record(z.string(), z.string()),
+		max_sessions: z.number().int().min(1).max(8),
+		idle_timeout_seconds: z.number().int().positive(),
+		replay_buffer_bytes: z.number().int().positive()
+	}).nullable().default(null),
+	timeouts: TimeoutsSchema,
+	security: z.object({ writable_memory_paths: z.array(z.string()) }).default({ writable_memory_paths: [] }),
+	network: z.discriminatedUnion("mode", [z.object({ mode: z.literal("unrestricted") }), z.object({
+		mode: z.literal("restricted"),
+		proxy_url: z.url(),
+		health_url: z.url()
+	})]).default({ mode: "unrestricted" }),
+	launch_mode: z.enum(LAUNCH_MODES).default("create"),
+	source: SourceDescriptorSchema.extend({
+		url: z.url(),
+		destination: z.string(),
+		credential: z.string().min(1).max(SOURCE_CREDENTIAL_MAX_BYTES).refine((value) => !value.includes("\0"), "credential must not contain NUL bytes").nullable().default(null)
+	}).nullable().default(null),
+	restore: z.object({
+		checkpoint_id: z.uuid(),
+		origin_workspace_id: z.uuid()
+	}).nullable().default(null),
+	persistence: z.object({
+		mounts: z.array(z.object({
+			name: z.string(),
+			target: z.string()
+		})),
+		conversation_restore: z.enum(CONVERSATION_RESTORE_CAPABILITIES)
+	}),
+	checkpoint_hook: z.object({
+		command: z.array(z.string().min(1)).min(1),
+		timeout_seconds: z.number().int().positive(),
+		env: z.record(z.string(), z.string()),
+		cwd: z.string().optional()
+	}).nullable(),
+	outputs: z.record(z.string(), z.unknown())
+});
+const RegisteredAckPayload = z.object({
+	epoch: z.number().int().positive(),
+	reconnect_credential: z.string().optional(),
+	limits: z.object({
+		max_frame_bytes: z.number().int().positive(),
+		max_inflight_relay: z.number().int().positive(),
+		log_chunk_bytes: z.number().int().positive(),
+		heartbeat_seconds: z.number().int().positive()
+	}),
+	exec: ExecSpecSchema
+});
+const ProxyRequestPayload = z.object({
+	request_id: z.uuid(),
+	service: z.string(),
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE"
+	]),
+	path: z.string(),
+	query: z.record(z.string(), z.string()).default({}),
+	headers: z.record(z.string(), z.string()).default({}),
+	body_b64: z.string().optional(),
+	deadline_ms: z.number().int().positive()
+});
+const SignalPayload = z.object({ signal: z.enum(["TERM", "KILL"]) });
+const HealthProbePayload = z.object({ service: z.string() });
+const ShutdownPayload = z.object({ reason: z.string().max(512) });
+const PrepareCheckpointPayload = z.object({
+	operation_id: z.uuid(),
+	deadline_ms: z.number().int().positive()
+});
+z.discriminatedUnion("type", [
+	EnvelopeBase.extend({
+		type: z.literal("registered_ack"),
+		payload: RegisteredAckPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_request"),
+		payload: ProxyRequestPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_stream_ack"),
+		payload: ProxyStreamAckPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("proxy_stream_cancel"),
+		payload: ProxyStreamCancelPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_open"),
+		payload: TerminalOpenPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_input"),
+		payload: TerminalInputPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_resize"),
+		payload: TerminalResizePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("terminal_close"),
+		payload: TerminalClosePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("signal"),
+		payload: SignalPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("health_probe"),
+		payload: HealthProbePayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("shutdown"),
+		payload: ShutdownPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("prepare_checkpoint"),
+		payload: PrepareCheckpointPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_start"),
+		payload: AttachmentStartPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_chunk"),
+		payload: AttachmentChunkPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_finish"),
+		payload: AttachmentFinishPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_abort"),
+		payload: AttachmentAbortPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("attachment_resolve"),
+		payload: AttachmentResolvePayload
+	})
+]);
+//#endregion
+//#region src/admin.ts
+var AdministrationApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	warmPools(options = {}) {
+		return this.transport.request("/v1/warm-pools", WarmPoolInventorySchema, options);
+	}
+	storageInventory(options = {}) {
+		return this.transport.request("/v1/storage/inventory", StorageInventorySchema, options);
+	}
+	pruneStorage(options = {}) {
+		return this.transport.request("/v1/storage/prune", StoragePruneResultSchema, {
+			method: "POST",
+			signal: options.signal
+		});
+	}
+};
+//#endregion
+//#region src/errors.ts
+z.enum(["client.non_json_response", "client.invalid_response"]);
+var PocketCoderError = class extends Error {
+	code;
+	status;
+	requestId;
+	details;
+	constructor(input) {
+		super(input.message);
+		this.name = "PocketCoderError";
+		this.code = input.code;
+		this.status = input.status;
+		this.requestId = input.requestId;
+		this.details = input.details;
+	}
+};
+var ConversationGoneError = class extends PocketCoderError {};
+var WorkspaceTerminalError = class extends Error {
+	workspace;
+	constructor(workspace) {
+		const reason = workspace.reason_code ?? workspace.failure?.reason_code ?? "no reason";
+		const tail = workspace.failure?.log_tail.trim();
+		super([`workspace ${workspace.id} reached ${workspace.state} (${reason})`, ...tail ? [`failure log:\n${tail}`] : []].join("\n"));
+		this.name = "WorkspaceTerminalError";
+		this.workspace = workspace;
+	}
+};
+function responseError(response, body) {
+	const parsed = ErrorEnvelopeSchema.safeParse(body);
+	if (!parsed.success) return new PocketCoderError({
+		message: `PocketCoder returned an invalid error response (${response.status})`,
+		code: "client.invalid_response",
+		status: response.status
+	});
+	const { code, message, request_id: requestId, details } = parsed.data.error;
+	return new (code === "conversation.deleted" || code === "conversation.expired" ? ConversationGoneError : PocketCoderError)({
+		message,
+		code,
+		status: response.status,
+		requestId,
+		details
+	});
+}
+//#endregion
+//#region src/attachments.ts
+function contentDisposition(name) {
+	const clean = name.replace(/[\r\n]/g, "");
+	if (/^[ -~]*$/.test(clean)) return `attachment; filename="${clean.replace(/(["\\])/g, "\\$1")}"`;
+	return `attachment; filename*=UTF-8''${encodeURIComponent(clean)}`;
+}
+function progressStream(body, total, onProgress) {
+	const source = new Response(body).body ?? new ReadableStream({ start: (c) => c.close() });
+	let uploaded = 0;
+	return source.pipeThrough(new TransformStream({ transform(chunk, controller) {
+		uploaded += chunk.byteLength;
+		controller.enqueue(chunk);
+		onProgress(Math.min(uploaded, total), total);
+	} }));
+}
+var AttachmentsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async upload(workspaceId, input) {
+		const id = (input.id ?? crypto.randomUUID()).toLowerCase();
+		const body = input.onProgress ? progressStream(input.body, input.sizeBytes, input.onProgress) : input.body;
+		const init = {
+			method: "PUT",
+			...input.signal ? { signal: input.signal } : {},
+			headers: {
+				"content-type": input.mediaType ?? "application/octet-stream",
+				"content-disposition": contentDisposition(input.name),
+				"content-length": String(input.sizeBytes)
+			},
+			body,
+			...body instanceof ReadableStream ? { duplex: "half" } : {}
+		};
+		return await this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/attachments/${id}`, AttachmentDescriptorSchema, init);
+	}
+};
+var AgentApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async sendMessage(workspaceId, input) {
+		const response = await this.transport.raw(`/v1/workspaces/${encodeURIComponent(workspaceId)}/agent/message`, {
+			method: "POST",
+			...input.signal ? { signal: input.signal } : {},
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				type: "user",
+				content: input.content,
+				...input.attachmentIds?.length ? { attachment_ids: input.attachmentIds } : {}
+			})
+		});
+		if (response.ok) return;
+		const text = await response.text();
+		let body;
+		try {
+			body = JSON.parse(text);
+		} catch {
+			throw new PocketCoderError({
+				message: `PocketCoder returned a non-JSON response (${response.status})`,
+				code: "client.non_json_response",
+				status: response.status
+			});
+		}
+		throw responseError(response, body);
+	}
+};
+//#endregion
+//#region src/common.ts
+function queryString(values) {
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(values)) if (value !== void 0) params.set(key, String(value));
+	return params.toString();
+}
+function page(body) {
+	return {
+		items: body.items,
+		nextCursor: body.next_cursor
+	};
+}
+//#endregion
+//#region src/checkpoints.ts
+var CheckpointsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async list(workspaceId, query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/checkpoints?${queryString({
+			state: query.state,
+			cursor: query.cursor,
+			limit: query.limit ?? 50
+		})}`, CheckpointPageSchema, options));
+	}
+	get(id, options = {}) {
+		return this.transport.request(`/v1/checkpoints/${encodeURIComponent(id)}`, CheckpointResourceSchema, options);
+	}
+	verify(id, key, options = {}) {
+		return this.operationRequest(`/v1/checkpoints/${encodeURIComponent(id)}/verify`, "POST", key, options);
+	}
+	delete(id, key, options = {}) {
+		return this.operationRequest(`/v1/checkpoints/${encodeURIComponent(id)}`, "DELETE", key, options);
+	}
+	restore(id, input, key, options = {}) {
+		return this.transport.request(`/v1/checkpoints/${encodeURIComponent(id)}/restore`, RestoreResponseSchema, {
+			method: "POST",
+			signal: options.signal,
+			headers: { "Idempotency-Key": key },
+			body: JSON.stringify(input)
+		});
+	}
+	operationRequest(path, method, key, options) {
+		return this.transport.request(path, OperationResourceSchema, {
+			method,
+			signal: options.signal,
+			headers: { "Idempotency-Key": key }
+		});
+	}
+};
+var OperationsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	get(id, options = {}) {
+		return this.transport.request(`/v1/operations/${encodeURIComponent(id)}`, OperationResourceSchema, options);
+	}
+};
+//#endregion
+//#region src/conversations.ts
+var ConversationsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async list(id, query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/workspaces/${encodeURIComponent(id)}/conversation?${queryString({
+			cursor: query.cursor,
+			limit: query.limit ?? 100
+		})}`, ConversationPageSchema, options));
+	}
+};
+//#endregion
+//#region src/diagnostics.ts
+var WorkspaceCursorApi = class {
+	transport;
+	resource;
+	schema;
+	constructor(transport, resource, schema) {
+		this.transport = transport;
+		this.resource = resource;
+		this.schema = schema;
+	}
+	async list(workspaceId, query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/${this.resource}?${queryString({
+			cursor: query.cursor,
+			limit: query.limit ?? 100
+		})}`, this.schema, options));
+	}
+};
+var LogsApi = class extends WorkspaceCursorApi {
+	constructor(transport) {
+		super(transport, "logs", LogPageSchema);
+	}
+};
+var NetworkEventsApi = class extends WorkspaceCursorApi {
+	constructor(transport) {
+		super(transport, "network-events", NetworkEventPageSchema);
+	}
+};
+var OutputsApi = class extends WorkspaceCursorApi {
+	constructor(transport) {
+		super(transport, "outputs", OutputPageSchema);
+	}
+};
+//#endregion
+//#region src/templates.ts
+var TemplatesApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async page(query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/templates?${queryString({
+			limit: query.limit ?? 100,
+			cursor: query.cursor
+		})}`, TemplatePageSchema, options));
+	}
+	async list(options = {}) {
+		return (await this.page({}, options)).items;
+	}
+};
+//#endregion
+//#region src/terminals.ts
+var TerminalConnection = class {
+	socket;
+	messageListeners = /* @__PURE__ */ new Set();
+	openListeners = /* @__PURE__ */ new Set();
+	closeListeners = /* @__PURE__ */ new Set();
+	errorListeners = /* @__PURE__ */ new Set();
+	pendingMessages = [];
+	opened = false;
+	closedEvent = null;
+	errored = false;
+	constructor(socket) {
+		this.socket = socket;
+		this.opened = socket.readyState === WebSocket.OPEN;
+		socket.addEventListener("open", () => {
+			this.opened = true;
+			for (const listener of this.openListeners) listener();
+		});
+		socket.addEventListener("message", (event) => this.handleMessage(event));
+		socket.addEventListener("close", (event) => {
+			this.closedEvent = event;
+			for (const listener of this.closeListeners) listener(event);
+		});
+		socket.addEventListener("error", () => {
+			this.errored = true;
+			for (const listener of this.errorListeners) listener();
+		});
+	}
+	onMessage(listener) {
+		this.messageListeners.add(listener);
+		for (const message of this.pendingMessages.splice(0)) listener(message);
+		return () => this.messageListeners.delete(listener);
+	}
+	onOpen(listener) {
+		this.openListeners.add(listener);
+		if (this.opened) queueMicrotask(() => this.openListeners.has(listener) && listener());
+		return () => this.openListeners.delete(listener);
+	}
+	onClose(listener) {
+		this.closeListeners.add(listener);
+		if (this.closedEvent) {
+			const event = this.closedEvent;
+			queueMicrotask(() => this.closeListeners.has(listener) && listener(event));
+		}
+		return () => this.closeListeners.delete(listener);
+	}
+	onError(listener) {
+		this.errorListeners.add(listener);
+		if (this.errored) queueMicrotask(() => this.errorListeners.has(listener) && listener());
+		return () => this.errorListeners.delete(listener);
+	}
+	sendInput(value) {
+		const bytes = typeof value === "string" ? Buffer.from(value) : value;
+		for (let offset = 0; offset < bytes.byteLength; offset += TERMINAL_CHUNK_BYTES) this.socket.send(JSON.stringify({
+			type: "input",
+			data_b64: Buffer.from(bytes.subarray(offset, offset + TERMINAL_CHUNK_BYTES)).toString("base64")
+		}));
+	}
+	resize(rows, cols) {
+		this.socket.send(JSON.stringify({
+			type: "resize",
+			rows,
+			cols
+		}));
+	}
+	close(code = 1e3, reason = "client detached") {
+		this.socket.close(code, reason);
+	}
+	handleMessage(event) {
+		if (typeof event.data !== "string") return;
+		let value;
+		try {
+			value = JSON.parse(event.data);
+		} catch {
+			return;
+		}
+		const parsed = ServerTerminalMessageSchema.safeParse(value);
+		if (!parsed.success) return;
+		if (this.messageListeners.size === 0) {
+			this.pendingMessages.push(parsed.data);
+			return;
+		}
+		for (const listener of this.messageListeners) listener(parsed.data);
+	}
+};
+var TerminalsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	connect(workspaceId, options = {}) {
+		const query = options.sessionId ? `?${queryString({ session: options.sessionId })}` : "";
+		return new TerminalConnection(this.transport.webSocket(`/v1/workspaces/${encodeURIComponent(workspaceId)}/terminal${query}`));
+	}
+	async list(workspaceId, query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/terminal-sessions?${queryString({
+			cursor: query.cursor,
+			limit: query.limit ?? 50
+		})}`, TerminalSessionPageSchema, options));
+	}
+};
+//#endregion
+//#region src/transport.ts
+function baseUrlOf(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TypeError("PocketCoder baseUrl must be a valid HTTP(S) URL");
+	}
+	if (!["http:", "https:"].includes(url.protocol)) throw new TypeError("PocketCoder baseUrl must be a valid HTTP(S) URL");
+	url.pathname = url.pathname.replace(/\/$/, "");
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+var PocketCoderTransport = class {
+	baseUrl;
+	apiKey;
+	timeoutMs;
+	maxRetries;
+	fetchImpl;
+	webSocketFactory;
+	constructor(config, fetchImpl = fetch) {
+		this.baseUrl = baseUrlOf(config.baseUrl);
+		this.apiKey = config.apiKey;
+		this.timeoutMs = config.timeoutMs ?? 6e4;
+		this.maxRetries = config.maxRetries ?? 2;
+		this.fetchImpl = config.fetch ?? fetchImpl;
+		this.webSocketFactory = config.webSocket ?? ((url, headers) => new WebSocket(url, { headers }));
+	}
+	webSocket(path) {
+		const url = new URL(`${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`);
+		url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+		return this.webSocketFactory(url.toString(), { authorization: `Bearer ${this.apiKey}` });
+	}
+	async raw(path, init = {}) {
+		const timeout = AbortSignal.timeout(this.timeoutMs);
+		const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+		const request = {
+			...init,
+			signal,
+			headers: {
+				authorization: `Bearer ${this.apiKey}`,
+				...init.body ? { "content-type": "application/json" } : {},
+				...init.headers
+			}
+		};
+		const retryable = isIdempotent(request);
+		for (let attempt = 0;; attempt += 1) try {
+			const response = await this.fetchImpl(`${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`, request);
+			if (!retryable || attempt >= this.maxRetries || !retryableStatus(response.status)) return response;
+			await delay(retryDelayMs(response, attempt), signal);
+		} catch (error) {
+			if (!retryable || attempt >= this.maxRetries || signal.aborted) throw error;
+			await delay(100 * 2 ** attempt, signal);
+		}
+	}
+	async request(path, schema, init = {}) {
+		const response = await this.raw(path, init);
+		const text = await response.text();
+		let body;
+		try {
+			body = text ? JSON.parse(text) : void 0;
+		} catch {
+			throw new PocketCoderError({
+				message: `PocketCoder returned a non-JSON response (${response.status})`,
+				code: "client.non_json_response",
+				status: response.status
+			});
+		}
+		if (!response.ok) throw responseError(response, body);
+		const parsed = schema.safeParse(body);
+		if (!parsed.success) throw new PocketCoderError({
+			message: `PocketCoder returned an invalid response (${response.status})`,
+			code: "client.invalid_response",
+			status: response.status,
+			details: { issues: z.treeifyError(parsed.error) }
+		});
+		return parsed.data;
+	}
+};
+function isIdempotent(init) {
+	const method = (init.method ?? "GET").toUpperCase();
+	if ([
+		"GET",
+		"HEAD",
+		"OPTIONS"
+	].includes(method)) return true;
+	return new Headers(init.headers).has("idempotency-key");
+}
+function retryableStatus(status) {
+	return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+function retryDelayMs(response, attempt) {
+	const retryAfter = response.headers.get("retry-after");
+	if (retryAfter !== null) {
+		const seconds = Number(retryAfter);
+		if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+		const date = Date.parse(retryAfter);
+		if (!Number.isNaN(date)) return Math.max(0, date - Date.now());
+	}
+	return 100 * 2 ** attempt;
+}
+async function delay(milliseconds, signal) {
+	if (milliseconds === 0) return;
+	await new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, milliseconds);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+//#endregion
+//#region src/workspaces.ts
+const TERMINAL_WORKSPACE_STATES = new Set(TERMINAL_STATES);
+var WorkspacesApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async list(query = {}, options = {}) {
+		return page(await this.transport.request(`/v1/workspaces?${queryString({
+			state: query.state,
+			template: query.template,
+			external_id: query.externalId,
+			limit: query.limit ?? 50,
+			cursor: query.cursor
+		})}`, WorkspacePageSchema, options));
+	}
+	async *all(query = {}, options = {}) {
+		let cursor;
+		do {
+			const current = await this.list({
+				...query,
+				cursor
+			}, options);
+			for (const workspace of current.items) yield workspace;
+			cursor = current.nextCursor ?? void 0;
+		} while (cursor);
+	}
+	get(id, options = {}) {
+		return this.transport.request(`/v1/workspaces/${encodeURIComponent(id)}`, WorkspaceResourceSchema, options);
+	}
+	create(input, options = {}) {
+		const body = {
+			external_id: input.externalId,
+			template: {
+				name: input.templateName,
+				...input.templateVersion ? { version: input.templateVersion } : {}
+			},
+			...input.launchInput ? { launch_input: input.launchInput } : {},
+			...input.metadata ? { metadata: input.metadata } : {},
+			...input.source ? { source: input.source } : {}
+		};
+		return this.transport.request("/v1/workspaces", WorkspaceResourceSchema, {
+			method: "POST",
+			signal: options.signal,
+			headers: { "Idempotency-Key": input.idempotencyKey ?? input.externalId },
+			body: JSON.stringify(body)
+		});
+	}
+	cancel(id, options = {}) {
+		return this.transport.request(`/v1/workspaces/${encodeURIComponent(id)}/cancel`, WorkspaceResourceSchema, {
+			method: "POST",
+			signal: options.signal
+		});
+	}
+	change(id, after, wait, options = {}) {
+		return this.transport.request(`/v1/workspaces/${encodeURIComponent(id)}/changes?after=${after}&wait=${wait}`, WorkspaceChangeSchema, options);
+	}
+	async waitForReady(initial, timeoutMs, options = {}) {
+		const deadline = Date.now() + timeoutMs;
+		let workspace = initial;
+		while (workspace.state !== "ready") {
+			if (TERMINAL_STATES.includes(workspace.state)) throw new WorkspaceTerminalError(workspace);
+			const remainingMs = deadline - Date.now();
+			if (remainingMs <= 0) throw new Error(`workspace ${workspace.id} did not become ready within ${timeoutMs}ms`);
+			workspace = (await this.change(workspace.id, workspace.change_cursor, Math.max(1, Math.min(30, Math.ceil(remainingMs / 1e3))), options)).workspace;
+			options.onTick?.(workspace);
+		}
+		return workspace;
+	}
+	preserve(id, input, key, options = {}) {
+		return this.jsonOperation(`/v1/workspaces/${encodeURIComponent(id)}/preserve`, input, key, PreserveResponseSchema, options);
+	}
+	recreate(id, input, key, options = {}) {
+		return this.jsonOperation(`/v1/workspaces/${encodeURIComponent(id)}/recreate`, input, key, RestoreResponseSchema, options);
+	}
+	resume(id, input, key, options = {}) {
+		return this.jsonOperation(`/v1/workspaces/${encodeURIComponent(id)}/resume`, input, key, ResumeResponseSchema, options);
+	}
+	jsonOperation(path, input, key, schema, options) {
+		return this.transport.request(path, schema, {
+			method: "POST",
+			signal: options.signal,
+			headers: { "Idempotency-Key": key },
+			body: JSON.stringify(input)
+		});
+	}
+};
+//#endregion
+//#region src/client.ts
+var PocketCoderClient = class {
+	transport;
+	templates;
+	workspaces;
+	attachments;
+	agent;
+	conversations;
+	checkpoints;
+	operations;
+	logs;
+	networkEvents;
+	outputs;
+	administration;
+	terminals;
+	constructor(config, fetchImpl = fetch) {
+		this.transport = new PocketCoderTransport(config, fetchImpl);
+		this.templates = new TemplatesApi(this.transport);
+		this.workspaces = new WorkspacesApi(this.transport);
+		this.attachments = new AttachmentsApi(this.transport);
+		this.agent = new AgentApi(this.transport);
+		this.conversations = new ConversationsApi(this.transport);
+		this.checkpoints = new CheckpointsApi(this.transport);
+		this.operations = new OperationsApi(this.transport);
+		this.logs = new LogsApi(this.transport);
+		this.networkEvents = new NetworkEventsApi(this.transport);
+		this.outputs = new OutputsApi(this.transport);
+		this.administration = new AdministrationApi(this.transport);
+		this.terminals = new TerminalsApi(this.transport);
+	}
+	raw(path, init = {}) {
+		return this.transport.raw(path, init);
+	}
+};
+//#endregion
+export { AdministrationApi, AgentApi, AttachmentsApi, CheckpointsApi, ConversationGoneError, ConversationsApi, LogsApi, NetworkEventsApi, OperationsApi, OutputsApi, PocketCoderClient, PocketCoderError, TERMINAL_WORKSPACE_STATES, TemplatesApi, TerminalConnection, TerminalsApi, WorkspaceTerminalError, WorkspacesApi, splitAttachmentManifest };