@task-handoff/control-plane 0.0.25-alpha.1 → 0.0.26

package/dist/cli.js

@@ -1,6 +1,7 @@
-"use strict";var e=require("commander"),t=require("node:path"),n=require("node:fs"),s=require("node:crypto"),i=require("fastify"),r=require("@fastify/compress"),o=require("@fastify/cookie"),a=require("@fastify/websocket"),d=require("zod"),c=require("node:util"),l=require("write-file-atomic"),p=require("ws"),u=require("node:http"),h=require("node:net"),m=require("node:stream"),g=require("telegramify-markdown"),y=require("node:fs/promises"),f=require("node:os"),I=require("dingtalk-stream"),b=require("@larksuiteoapi/node-sdk"),v=require("node:child_process"),S=require("tar"),w=require("tweetnacl");function A(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var s=Object.getOwnPropertyDescriptor(e,n);Object.defineProperty(t,n,s.get?s:{enumerable:!0,get:function(){return e[n]}})}}),t.default=e,Object.freeze(t)}var z=A(S);function k(e,t){try{const s=JSON.parse(n.readFileSync(e,"utf8"));if(t&&s.name!==t)return;return"string"==typeof s.version&&s.version.trim()?s.version.trim():void 0}catch{return}}function T(e){if(e)try{return t.dirname(n.realpathSync(e))}catch{return}}function C(e,n=process.env,s=e){const i=n.TASK_HANDOFF_VERSION?.trim();if(i)return i;const r=s.split("/").at(-1),o=process.argv[1]?t.resolve(process.argv[1]):void 0,a=o?t.dirname(o):void 0,d=[T(o),a,process.cwd()].filter(e=>Boolean(e));for(const n of new Set(d)){let s=n;for(;;){const n=k(t.join(s,"package.json"),e);if(n)return n;const i=t.dirname(s);if(i===s)break;s=i}}let c;for(const e of new Set(d)){let n=e;for(;;){if(r){const e=k(t.join(n,"packages",r,"package.json"),s);if(e)return e}c||=k(t.join(n,"package.json"));const e=t.dirname(n);if(e===n)break;n=e}}return c||"unknown"}const E=new Set(["authorization","cookie"]),x=20971520,N=512e3,R=41943040,O=262144,_="ai.sessions",P="ai-session.snapshot",j="ai-session.patch",D="ai-session.removed",M="ai-session.message-delta",L="ai-session.timeline-item",q="ai-session.unread.updated",$=d.z.string().trim().min(1).max(80),B=d.z.enum(["app-session","ai-session"]),F=d.z.enum(["image","file"]),U={scopeType:d.z.enum(["session","create-request"]),scopeId:d.z.string().trim().min(1).max(160),kind:F,name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120)},H=d.z.object({...U,size:d.z.coerce.number().int().positive().max(x)}).strict(),W=d.z.string().regex(/^cia_[a-f0-9]{24}$/),G=d.z.object({attachmentId:W,...U,size:d.z.number().int().positive().max(x)}).strict();d.z.object({offset:d.z.coerce.number().int().nonnegative()}).strict();const V=d.z.object({attachmentId:W,offset:d.z.number().int().nonnegative()}),K=d.z.object({id:W,kind:F,name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120),size:d.z.number().int().positive().max(x),expiresAt:d.z.string().datetime()});function J(e){return["image/bmp","image/gif","image/jpeg","image/png","image/webp"].includes(e.split(";",1)[0].trim().toLowerCase())}const Y=d.z.object({id:d.z.string().trim().min(1).max(120),kind:F,name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120),size:d.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)}),Q=d.z.enum(["available","expired","missing"]),X=Y.extend({contentState:Q.default("available")}).strict(),Z=d.z.object({id:d.z.string().trim().min(1).max(240),text:d.z.string(),attachments:d.z.array(X).max(6).default([])}).strict(),ee=d.z.enum(["running","waiting","idle","failed"]),te=d.z.object({instanceId:d.z.string().trim().min(1).max(160),sessionId:d.z.string().trim().min(1).max(120),unread:d.z.boolean(),sessionUpdatedAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}).strict(),ne=d.z.enum(["thinking","tool","editing","approval","responding","unknown"]),se=d.z.object({id:d.z.string().trim().min(1).max(240).optional(),kind:d.z.string().trim().min(1).max(80).optional(),name:d.z.string().trim().min(1).max(120),inputPreview:d.z.string().trim().max(500).optional(),startedAt:d.z.string().datetime().optional()}).strict(),ie=d.z.enum(["running","completed","failed","waiting"]),re=d.z.object({id:d.z.string().trim().min(1).max(240),turnId:d.z.string().trim().min(1).max(240)}).strict(),oe=re.extend({type:d.z.literal("user-message"),text:d.z.string(),attachments:d.z.array(X).max(6).optional()}).strict(),ae=re.extend({type:d.z.literal("ai-message"),text:d.z.string()}).strict(),de=re.extend({type:d.z.literal("activity"),activityKind:d.z.string().trim().min(1).max(120),title:d.z.string().trim().min(1).max(240),status:ie.optional(),summary:d.z.string().max(4e3).optional(),input:d.z.string().max(1e5).optional(),output:d.z.string().max(1e6).optional(),paths:d.z.array(d.z.string().trim().min(1).max(4096)).max(500).optional(),exitCode:d.z.number().int().optional(),durationMs:d.z.number().int().nonnegative().optional()}).strict(),ce=d.z.discriminatedUnion("type",[oe,ae,de]),le=d.z.object({sessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),items:d.z.array(ce),generatedAt:d.z.string().datetime()}).strict(),pe=d.z.object({sessionId:d.z.string().trim().min(1).max(120),turnId:d.z.string().trim().min(1).max(240),items:d.z.array(ce),generatedAt:d.z.string().datetime()}).strict(),ue=d.z.enum(["pending-init","running","interrupted","completed","errored","shutdown","not-found"]),he=d.z.enum(["started","interacted","interrupted"]),me=d.z.object({threadId:d.z.string().trim().min(1).max(240),path:d.z.string().trim().max(4096).optional(),status:ue,activity:he.optional(),message:d.z.string().trim().max(1e3).optional(),updatedAt:d.z.string().datetime()}).strict(),ge=d.z.object({toolCalls:d.z.number().int().min(0).default(0),edits:d.z.number().int().min(0).default(0),approvals:d.z.number().int().min(0).default(0)}).strict().default({toolCalls:0,edits:0,approvals:0}),ye=d.z.object({send:d.z.boolean().optional(),interrupt:d.z.boolean().optional(),approval:d.z.boolean().optional(),fork:d.z.boolean().optional(),openApp:d.z.boolean().optional(),close:d.z.boolean().optional()}).strict(),fe=d.z.object({kind:d.z.literal("fork"),parentProviderSessionId:d.z.string().trim().min(1).max(240),throughTurnId:d.z.string().trim().min(1).max(240).optional()}).strict(),Ie=d.z.union([Y.extend({source:d.z.object({type:d.z.literal("inline"),encoding:d.z.literal("base64"),data:d.z.string().min(1).max(31457280)}).strict()}).strict().superRefine((e,t)=>{const n="image"===e.kind?x:N;(e.size<=0||("file"===e.kind?e.size>=n:e.size>n))&&t.addIssue({code:d.z.ZodIssueCode.custom,path:["size"],message:`Inline ${e.kind} must be between 1 byte and ${n} bytes.`})}),Y.extend({source:d.z.object({type:d.z.literal("runtime-path"),path:d.z.string().trim().min(1).max(4096)}).strict()}).strict()]),be=Y.extend({sourceType:d.z.enum(["inline","runtime-path"])}).strict(),ve=d.z.union([d.z.object({id:d.z.string().trim().min(1).max(120),kind:F.optional(),source:d.z.object({type:d.z.literal("upload-ref")}).strict().default({type:"upload-ref"})}).strict(),d.z.object({id:d.z.string().trim().min(1).max(120),kind:F,name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120),size:d.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),source:d.z.object({type:d.z.literal("runtime-path"),path:d.z.string().trim().min(1).max(4096)}).strict()}).strict()]),Se=d.z.enum(["auto","queue","steer","immediate"]),we=d.z.enum(["ask","auto-review","full-access"]),Ae=d.z.enum(["review","rename","goal","compact"]),ze=d.z.object({command:Ae,argument:d.z.string().trim().max(4e3).optional()}).strict().superRefine((e,t)=>{"rename"!==e.command||e.argument||t.addIssue({code:"custom",path:["argument"],message:"Rename requires a thread name."}),"review"!==e.command&&"compact"!==e.command||!e.argument||t.addIssue({code:"custom",path:["argument"],message:`${e.command} does not accept an argument.`})}),ke=d.z.object({command:Ae,value:d.z.string().max(4e3).optional(),turnId:d.z.string().trim().min(1).max(240).optional()}).strict();d.z.enum(["skill","app","plugin"]);const Te=d.z.object({name:d.z.string().trim().min(1).max(240),path:d.z.string().trim().min(1).max(4096)}),Ce=d.z.discriminatedUnion("kind",[Te.extend({kind:d.z.literal("skill"),path:d.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/"),"Skill paths must be absolute.")}).strict(),Te.extend({kind:d.z.literal("app"),path:d.z.string().trim().min(7).max(4096).regex(/^app:\/\/[^\s/]+$/,"App paths must use app://<id>.")}).strict(),Te.extend({kind:d.z.literal("plugin"),path:d.z.string().trim().min(10).max(4096).regex(/^plugin:\/\/[^\s/]+$/,"Plugin paths must use plugin://<id>.")}).strict()]),Ee=d.z.array(Ce).max(20).default([]),xe=d.z.enum(["plugin","skill","file","directory","app"]),Ne=d.z.object({kind:xe,name:d.z.string().trim().min(1).max(240),description:d.z.string().trim().max(1e3).optional(),path:d.z.string().trim().min(1).max(4096),icon:d.z.string().trim().max(4096).optional()}).strict().superRefine((e,t)=>{"skill"!==e.kind||e.path.startsWith("/")||t.addIssue({code:"custom",path:["path"],message:"Skill paths must be absolute."}),"app"!==e.kind||/^app:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"App paths must use app://<id>."}),"plugin"!==e.kind||/^plugin:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"Plugin paths must use plugin://<id>."}),"file"!==e.kind&&"directory"!==e.kind||!e.path.startsWith("/")&&!e.path.split(/[\\/]+/).includes("..")||t.addIssue({code:"custom",path:["path"],message:"File and directory paths must be relative to the session cwd."})}),Re=d.z.object({category:d.z.enum(["skills","plugins","apps","files"]),code:d.z.string().trim().min(1).max(160),message:d.z.string().trim().min(1).max(2e3)}).strict(),Oe=d.z.object({sessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),cwd:d.z.string().trim().min(1).max(4096),candidates:d.z.array(Ne).max(1e3).default([]),diagnostics:d.z.array(Re).max(20).default([])}).strict(),_e=d.z.object({query:d.z.string().trim().max(240).default("")}).strict(),Pe=d.z.object({sessionId:d.z.string().trim().min(1).max(120),cwd:d.z.string().trim().min(1).max(4096),query:d.z.string().trim().max(240),requestId:d.z.string().trim().min(1).max(160),candidates:d.z.array(Ne.refine(e=>"file"===e.kind||"directory"===e.kind,"File search only returns files and directories.")).max(200).default([]),complete:d.z.boolean().default(!1)}).strict(),je=d.z.object({message:d.z.string().trim().min(1).max(2e4),mode:Se.optional(),permissionMode:we.optional()}),De=je.extend({attachments:d.z.array(Ie).max(6).default([]),references:Ee}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>R&&t.addIssue({code:d.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),Me=je.extend({attachments:d.z.array(ve).max(6).default([]),references:Ee}).strict(),Le=d.z.object({type:d.z.literal("runtime-path"),path:d.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e),"Runtime paths must be absolute in the target controlled instance.")}).strict(),qe=De.extend({agent:$,cwd:Le,cwdFolderId:d.z.string().trim().min(1).max(120).optional(),clientRequestId:d.z.string().trim().min(1).max(160)}).strict(),$e=d.z.object({mode:d.z.enum(["current-folder","worktree"]),branch:d.z.string().trim().min(1).max(1024)}).strict(),Be=Me.extend({agent:$,cwdFolderId:d.z.string().trim().min(1).max(120).optional(),gitSelection:$e.optional(),clientRequestId:d.z.string().trim().min(1).max(160)}).strict(),Fe=d.z.object({disposition:d.z.enum(["created","already-created"]),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),creationSource:d.z.literal("ai-session")}).strict(),Ue=d.z.object({mode:d.z.enum(["current","managed-worktree"]).default("current")}).strict().default({mode:"current"}),He=d.z.object({clientRequestId:d.z.string().trim().min(1).max(160),throughTurnId:d.z.string().trim().min(1).max(240).optional(),workspace:Ue.optional().default({mode:"current"})}).strict(),We=d.z.object({disposition:d.z.enum(["created","already-created"]),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),creationSource:d.z.literal("ai-session")}).strict(),Ge=d.z.object({clientRequestId:d.z.string().trim().min(1).max(160)}).strict(),Ve=d.z.object({disposition:d.z.enum(["opened","already-open"]),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),appSessionId:d.z.string().trim().min(1).max(120),creationSource:B}).strict(),Ke=d.z.object({clientRequestId:d.z.string().trim().min(1).max(160)}).strict(),Je=d.z.object({disposition:d.z.enum(["closed","already-closed"]),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),creationSource:B}).strict();d.z.object({code:d.z.enum(["invalid-request","not-found","unsupported","provider-unavailable","materialization-failed","open-app-failed","close-failed","conflict"]),message:d.z.string().trim().min(1).max(4e3),retryable:d.z.boolean().default(!1),aiSessionId:d.z.string().trim().min(1).max(120).optional(),providerSessionId:d.z.string().trim().min(1).max(240).optional()}).strict();const Ye=d.z.object({decision:d.z.enum(["allow","deny","skip"])}).strict(),Qe=d.z.object({expectedRevision:d.z.number().int().min(0),queueIds:d.z.array(d.z.string().trim().min(1).max(120)).max(100)}).strict(),Xe=d.z.object({expectedRevision:d.z.number().int().min(0),message:d.z.string().trim().min(1).max(2e4)}).strict();d.z.object({code:d.z.string().trim().min(1).max(160),message:d.z.string(),instanceId:d.z.string().trim().min(1).max(160).optional(),nodeId:d.z.string().trim().min(1).max(160).optional(),route:d.z.string().trim().min(1).max(4096).optional()}).strict();const Ze=d.z.object({id:d.z.string().trim().min(1).max(120),messageId:d.z.string().trim().min(1).max(240).optional(),message:d.z.string().trim().min(1).max(2e4),attachments:d.z.array(be).max(6).default([]),references:Ee,permissionMode:we.optional(),status:d.z.enum(["queued","sending","failed"]).default("queued"),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime(),error:d.z.string().trim().max(4e3).optional()}).strict(),et=d.z.object({revision:d.z.number().int().min(0).default(0),pendingCount:d.z.number().int().min(0).default(0),items:d.z.array(Ze).max(100).default([])}).strict().default({revision:0,pendingCount:0,items:[]}),tt=d.z.enum(["control","realtime","adapter-snapshot","transcript-tail","transcript-scan","process-scan","app-session"]),nt=d.z.object({id:d.z.string().trim().min(1).max(240),status:d.z.enum(["running","completed"]),startedAt:d.z.string().datetime().optional(),completedAt:d.z.string().datetime().optional()}).strict(),st=d.z.object({id:d.z.string().trim().min(1).max(240),providerTurnId:d.z.string().trim().max(240).optional(),source:tt.optional(),userPrompt:d.z.string().trim().optional(),userMessages:d.z.array(Z).max(100).optional(),status:d.z.enum(["queued","running","waiting","completed","failed"]).default("running"),phase:ne.optional(),summary:d.z.string().trim().max(1e3).optional(),lastMessage:d.z.string().trim().optional(),lastMessageItemId:d.z.string().trim().max(240).optional(),contextCompactions:d.z.array(nt).max(20).optional(),revision:d.z.number().int().min(0).default(0),sourcePriority:d.z.number().int().min(0).max(100).optional(),snapshotVersion:d.z.number().int().min(0).optional(),observedAt:d.z.string().datetime().optional(),startedAt:d.z.string().datetime().optional(),updatedAt:d.z.string().datetime().optional(),completedAt:d.z.string().datetime().optional()}).strict(),it=st.pick({id:!0,providerTurnId:!0,userPrompt:!0,userMessages:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,contextCompactions:!0,startedAt:!0,updatedAt:!0,completedAt:!0}).strict(),rt=d.z.object({id:d.z.string().trim().min(1).max(120),agent:$,creationSource:B.default("app-session"),appSessionId:d.z.string().trim().max(120).optional(),appId:d.z.string().trim().max(120).optional(),providerSessionId:d.z.string().trim().max(240).optional(),lineage:fe.optional(),providerMeta:d.z.record(d.z.string(),d.z.unknown()).optional(),appBindingKeys:d.z.array(d.z.string().trim().min(1).max(240)).max(20).optional(),actions:ye.optional(),activeTurnId:d.z.string().trim().max(240).optional(),title:d.z.string().trim().max(240).optional(),cwd:d.z.string().trim().max(4096).optional(),cwdFolderId:d.z.string().trim().min(1).max(120).optional(),userPrompt:d.z.string().trim().optional(),turns:d.z.array(st).max(50).optional(),status:ee.default("running"),phase:ne.default("unknown"),summary:d.z.string().trim().max(1e3).optional(),lastMessage:d.z.string().trim().optional(),lastMessageItemId:d.z.string().trim().max(240).optional(),currentTool:se.optional(),toolCallsSinceLastMessage:d.z.number().int().min(0).default(0),subAgents:d.z.array(me).max(50).default([]),transcriptPath:d.z.string().trim().max(4096).optional(),transcriptSize:d.z.number().int().min(0).optional(),startedAt:d.z.string().datetime(),updatedAt:d.z.string().datetime(),completedAt:d.z.string().datetime().optional(),error:d.z.string().trim().max(4e3).optional(),counters:ge,queue:et}).strict(),ot=d.z.object({session:rt,provider:d.z.string().trim().min(1).max(80),action:d.z.enum(["send","queue","steer","interrupt","approval"]),decision:d.z.enum(["allow","deny","skip"]).optional(),turnId:d.z.string().trim().min(1).max(240).optional(),providerTurnId:d.z.string().trim().min(1).max(240).optional(),queueId:d.z.string().trim().min(1).max(120).optional()}).strict(),at=500,dt=d.z.object({id:d.z.string().trim().min(1).max(120),agent:d.z.enum(["codex","claude"]),creationSource:B,providerSessionId:d.z.string().trim().min(1).max(240),lineage:fe.optional(),title:d.z.string().trim().max(240).optional(),userPrompt:d.z.string().trim().optional(),lastMessage:d.z.string().trim().optional(),cwd:d.z.string().trim().min(1).max(4096),cwdFolderId:d.z.string().trim().min(1).max(120).optional(),lastActiveAt:d.z.string().datetime(),archivedAt:d.z.string().datetime()}).strict();d.z.object({schemaVersion:d.z.literal(1).default(1),items:d.z.array(dt).max(at).default([])}).strict();const ct=d.z.object({items:d.z.array(dt).max(at).default([])}).strict(),lt=d.z.object({item:dt,turns:d.z.array(it).max(50).default([])}).strict(),pt=d.z.object({disposition:d.z.enum(["resumed","already-open"]),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),appSessionId:d.z.string().trim().min(1).max(120).optional(),creationSource:B}).strict(),ut=st.omit({userMessages:!0}),ht=rt.pick({id:!0,agent:!0,creationSource:!0,appSessionId:!0,appId:!0,providerSessionId:!0,lineage:!0,providerMeta:!0,appBindingKeys:!0,actions:!0,activeTurnId:!0,title:!0,cwd:!0,cwdFolderId:!0,userPrompt:!0,turns:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,lastMessageItemId:!0,currentTool:!0,toolCallsSinceLastMessage:!0,subAgents:!0,queue:!0,startedAt:!0,updatedAt:!0,error:!0}).extend({turns:d.z.array(ut).max(50).optional()}).strict(),mt=d.z.object({runningCount:d.z.number().int().min(0).default(0),waitingCount:d.z.number().int().min(0).default(0),staleCount:d.z.number().int().min(0).default(0),sessions:d.z.array(ht).default([]),updatedAt:d.z.string().datetime()}).strict(),gt=d.z.object({streamId:d.z.string().trim().min(1).max(240),revision:d.z.number().int().min(0),lastEventAt:d.z.string().datetime(),snapshot:mt}).strict(),yt=mt.pick({runningCount:!0,waitingCount:!0,staleCount:!0,updatedAt:!0}).extend({idleCount:d.z.number().int().min(0).default(0),problemCount:d.z.number().int().min(0).default(0),revision:d.z.number().int().min(0).optional()});function ft(e,t={}){const n=e.sessions.filter(e=>"idle"===e.status).length,s=e.sessions.filter(e=>"failed"===e.status).length;return yt.parse({runningCount:e.runningCount,waitingCount:e.waitingCount,staleCount:e.staleCount,idleCount:n,problemCount:s,updatedAt:e.updatedAt,revision:t.revision})}const It=d.z.enum(["provider-event","app-session-created","app-session-updated","app-session-deleted","discovery-scan","control-action","heartbeat-sync","startup"]),bt=d.z.object({streamId:d.z.string().trim().min(1).max(240),instanceId:d.z.string().trim().min(1).max(160),nodeId:d.z.string().trim().min(1).max(160).optional(),revision:d.z.number().int().min(0),previousRevision:d.z.number().int().min(0).optional(),traceId:d.z.string().trim().min(1).max(160),generatedAt:d.z.string().datetime(),reason:It}).strict(),vt=d.z.object({meta:bt,snapshot:mt}).strict(),St=d.z.object({meta:bt,upserted:d.z.array(ht).default([]),removed:d.z.array(d.z.string().trim().min(1).max(120)).default([])}).strict(),wt=d.z.object({meta:bt,sessionIds:d.z.array(d.z.string().trim().min(1).max(120)).default([]),expiresAt:d.z.string().datetime()}).strict(),At=d.z.object({instanceId:d.z.string().trim().min(1).max(160),nodeId:d.z.string().trim().min(1).max(160).optional(),sessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),turnId:d.z.string().trim().min(1).max(240),itemId:d.z.string().trim().min(1).max(240),delta:d.z.string().min(1),generatedAt:d.z.string().datetime()}).strict(),zt=d.z.object({instanceId:d.z.string().trim().min(1).max(160),nodeId:d.z.string().trim().min(1).max(160).optional(),sessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().min(1).max(240),item:ce,generatedAt:d.z.string().datetime()}).strict(),kt=d.z.object({streamId:d.z.string().trim().min(1).max(240),instanceId:d.z.string().trim().min(1).max(160),sinceRevision:d.z.number().int().min(0),latestRevision:d.z.number().int().min(0),earliestRetainedRevision:d.z.number().int().min(0),syncRequired:d.z.boolean().default(!1),events:d.z.array(d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal(P),payload:vt}).strict(),d.z.object({type:d.z.literal(j),payload:St}).strict(),d.z.object({type:d.z.literal(D),payload:wt}).strict()])).default([])}).strict(),Tt=d.z.object({source:tt,sourcePriority:d.z.number().int().min(0).max(100).optional(),observedAt:d.z.string().datetime().optional(),snapshotVersion:d.z.number().int().min(0).optional()}).strict(),Ct=Tt.extend({type:d.z.literal("snapshot"),agent:d.z.string().trim().min(1).max(80),creationSource:B.optional(),appSessionId:d.z.string().trim().max(120).optional(),appId:d.z.string().trim().max(120).optional(),providerSessionId:d.z.string().trim().max(240).optional(),lineage:fe.optional(),providerMeta:d.z.record(d.z.string(),d.z.unknown()).optional(),appBindingKeys:d.z.array(d.z.string().trim().min(1).max(240)).max(20).optional(),actions:ye.optional(),title:d.z.string().trim().max(240).optional(),cwd:d.z.string().trim().max(4096).optional(),cwdFolderId:d.z.string().trim().min(1).max(120).optional(),activeTurnId:d.z.string().trim().max(240).optional(),userPrompt:d.z.string().trim().optional(),turns:d.z.array(st).max(50).optional(),status:ee.optional(),phase:ne.optional(),summary:d.z.string().trim().max(1e3).optional(),lastMessage:d.z.string().trim().optional(),lastMessageItemId:d.z.string().trim().max(240).optional(),error:d.z.string().trim().max(4e3).optional(),currentTool:se.optional(),toolCallsSinceLastMessage:d.z.number().int().min(0).optional(),subAgents:d.z.array(me).max(50).optional(),transcriptPath:d.z.string().trim().max(4096).optional(),transcriptSize:d.z.number().int().min(0).optional(),replaceActivity:d.z.boolean().optional()}).strict(),Et=Tt.extend({type:d.z.literal("event"),sessionId:d.z.string().trim().min(1).max(120),kind:d.z.enum(["lifecycle","send-ack","turn-started","user-message","assistant-message","approval-requested","turn-completed","session-error","tool-activity","sub-agent-activity","context-compaction"]),activeTurnId:d.z.string().trim().max(240).optional(),providerTurnId:d.z.string().trim().max(240).optional(),userPrompt:d.z.string().trim().optional(),userMessage:Z.optional(),text:d.z.string().optional(),itemId:d.z.string().trim().max(240).optional(),status:ee.optional(),phase:ne.optional(),summary:d.z.string().trim().max(1e3).optional(),error:d.z.string().trim().max(4e3).optional(),currentTool:se.nullable().optional(),toolCallsSinceLastMessage:d.z.number().int().min(0).optional(),subAgents:d.z.array(me).max(50).optional(),contextCompaction:nt.optional(),counters:d.z.object({toolCalls:d.z.number().int().min(0).optional(),edits:d.z.number().int().min(0).optional(),approvals:d.z.number().int().min(0).optional()}).strict().optional()}).strict().superRefine((e,t)=>{if("session-error"!==e.kind||e.error||t.addIssue({code:"custom",path:["error"],message:"session-error events require error"}),"context-compaction"===e.kind?e.contextCompaction||t.addIssue({code:"custom",path:["contextCompaction"],message:"context-compaction events require contextCompaction"}):void 0!==e.contextCompaction&&t.addIssue({code:"custom",path:["contextCompaction"],message:"contextCompaction is only valid for context-compaction events"}),"send-ack"!==e.kind&&"user-message"!==e.kind&&void 0!==e.userMessage&&t.addIssue({code:"custom",path:["userMessage"],message:"userMessage is only valid for send-ack and user-message events"}),"sub-agent-activity"===e.kind?e.subAgents||t.addIssue({code:"custom",path:["subAgents"],message:"sub-agent-activity events require subAgents"}):void 0!==e.subAgents&&t.addIssue({code:"custom",path:["subAgents"],message:"subAgents is only valid for sub-agent-activity events"}),"tool-activity"!==e.kind)return void 0!==e.currentTool&&t.addIssue({code:"custom",path:["currentTool"],message:"currentTool is only valid for tool-activity events"}),void(void 0!==e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"toolCallsSinceLastMessage is only valid for tool-activity events"}));"currentTool"in e||t.addIssue({code:"custom",path:["currentTool"],message:"tool-activity events require currentTool"}),void 0===e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"tool-activity events require toolCallsSinceLastMessage"})});d.z.discriminatedUnion("type",[Ct,Et]);const xt=d.z.object({type:d.z.literal("snapshot"),data:d.z.string(),pendingEscape:d.z.string(),cols:d.z.number().int().positive(),rows:d.z.number().int().positive()}).passthrough(),Nt="app-session.snapshot",Rt="app-session.patch",Ot="app-session.removed",_t=d.z.enum(["created","starting","running","stopping","stopped","exited","failed","closed","terminated","unknown"]),Pt=d.z.enum(["tty","vnc","web"]);d.z.object({mode:Pt,url:d.z.string().trim().min(1).max(4096),token:d.z.string().trim().min(1).max(512),expiresAt:d.z.string().datetime()}).strict(),d.z.object({revoked:d.z.boolean()}).strict();const jt=new Set(["stopped","failed","exited","closed","terminated"]),Dt=d.z.object({type:d.z.enum(["app-session","provider-session","adapter-key"]),id:d.z.string().trim().min(1).max(240),agent:d.z.string().trim().min(1).max(80).optional(),adapter:d.z.string().trim().min(1).max(80).optional(),key:d.z.string().trim().min(1).max(240).optional()}).strict(),Mt=d.z.record(d.z.string(),d.z.unknown()).and(d.z.object({id:d.z.string().trim().min(1).max(160),appId:d.z.string().trim().min(1).max(160).optional(),title:d.z.string().trim().max(240).optional(),kind:d.z.string().trim().max(80).optional(),status:_t.default("unknown"),bindings:d.z.array(Dt).max(40).default([]),workspace:d.z.object({cwd:d.z.string().trim().max(4096).optional()}).strict().optional(),createdAt:d.z.string().datetime().optional(),updatedAt:d.z.string().datetime().optional()})),Lt=d.z.object({runningCount:d.z.number().int().min(0).default(0),problemCount:d.z.number().int().min(0).default(0),sessions:d.z.array(Mt).default([]),updatedAt:d.z.string().datetime()}).strict(),qt=d.z.object({streamId:d.z.string().trim().min(1).max(240),revision:d.z.number().int().min(0),lastEventAt:d.z.string().datetime(),snapshot:Lt}).strict();Lt.pick({runningCount:!0,problemCount:!0,updatedAt:!0}).extend({revision:d.z.number().int().min(0).optional()});const $t=d.z.enum(["app-session-created","app-session-updated","app-session-deleted","app-session-recovered","control-action","heartbeat-sync","startup"]),Bt=d.z.object({streamId:d.z.string().trim().min(1).max(240),instanceId:d.z.string().trim().min(1).max(160),nodeId:d.z.string().trim().min(1).max(160).optional(),revision:d.z.number().int().min(0),previousRevision:d.z.number().int().min(0).optional(),traceId:d.z.string().trim().min(1).max(160),generatedAt:d.z.string().datetime(),reason:$t}).strict(),Ft=d.z.object({meta:Bt,snapshot:Lt}).strict(),Ut=d.z.object({meta:Bt,session:Mt}).strict(),Ht=d.z.object({meta:Bt,sessionId:d.z.string().trim().min(1).max(160),tombstone:Mt.optional(),expiresAt:d.z.string().datetime().optional()}).strict(),Wt=d.z.object({streamId:d.z.string().trim().min(1).max(240),instanceId:d.z.string().trim().min(1).max(160),sinceRevision:d.z.number().int().min(0),latestRevision:d.z.number().int().min(0),earliestRetainedRevision:d.z.number().int().min(0),syncRequired:d.z.boolean().default(!1),events:d.z.array(d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal(Nt),payload:Ft}).strict(),d.z.object({type:d.z.literal(Rt),payload:Ut}).strict(),d.z.object({type:d.z.literal(Ot),payload:Ht}).strict()])).default([])}).strict();function Gt(e,t=(new Date).toISOString()){const n=e.map(e=>Kt(e));return Lt.parse({runningCount:n.filter(e=>"running"===e.status).length,problemCount:n.filter(e=>"failed"===e.status).length,sessions:n,updatedAt:t})}function Vt(e,t=(new Date).toISOString()){return Gt(e.filter(e=>Yt("string"==typeof e.status?e.status:void 0)),t)}function Kt(e){const t=Jt("string"==typeof e.status?e.status:void 0),n="string"==typeof e.id?e.id:"",s=function(e){const t=nn(e.workspace),n=nn(e.tty),s=nn(e.launch),i=nn(e.ai),r=nn(i.claude),o=sn(t.cwd)||sn(n.cwd)||sn(r.cwd)||sn(s.cwd);return o?{cwd:o}:void 0}(e),{workspace:i,...r}=e;return Mt.parse({...r,status:t,bindings:tn([...(o=e.bindings,Array.isArray(o)?o.flatMap(e=>{const t=Dt.safeParse(e);return t.success?[t.data]:[]}):[]),...n?[{type:"app-session",id:n}]:[],...Zt(e)]),...s?{workspace:s}:{}});var o}function Jt(e){const t=(e||"unknown").trim().toLowerCase();return"ended"===t?"closed":"terminating"===t?"stopping":_t.options.includes(t)?t:"unknown"}function Yt(e){return!jt.has(Jt(e))}function Qt(e){return"tty"===e.kind?"tty":"gui"===e.kind?"vnc":"web"===e.kind?"web":void 0}function Xt(e){return"app-session"===e.type?`app:${e.id}`:"provider-session"===e.type?`provider:${e.agent||""}:${e.id}`:`adapter:${e.adapter||""}:${e.key||e.id}`}function Zt(e){const t=nn(e.ai),n=nn(t.claude),s=nn(t.appServer),i=nn(e.launch),r=[],o=sn(nn(i.aiSessionResume).providerSessionId),a="codex"===e.appId||"claude"===e.appId?e.appId:void 0;a&&o&&r.push({type:"provider-session",agent:a,id:o});const d=sn(n.short);d&&r.push({type:"adapter-key",adapter:"claude",agent:"claude",id:`short:${d}`,key:`short:${d}`});const c=sn(n.providerSessionId);c&&r.push({type:"provider-session",agent:"claude",id:c});const l=Array.isArray(t.threadIds)?t.threadIds.filter(e=>"string"==typeof e&&Boolean(e.trim())):[],p=sn(t.activeThreadId);for(const e of[...new Set([p,...l].filter(Boolean))])r.push({type:"provider-session",agent:"codex",id:e});const u=sn(s.socketPath);return u&&r.push({type:"adapter-key",adapter:"codex-app-server",agent:"codex",id:`socket:${u}`,key:`socket:${u}`}),r}function en(e){const t="string"==typeof e.id?e.id:"",n=nn(e.ai),s=sn(nn(n.claude).short);return[t?`app:${t}`:"",s?`claude-short:${s}`:""]}function tn(e){const t=new Map;for(const n of e)t.set(Xt(n),n);return[...t.values()]}function nn(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function sn(e){return"string"==typeof e&&e.trim()?e.trim():""}function rn(e=(new Date).toISOString()){return Lt.parse({runningCount:0,problemCount:0,sessions:[],updatedAt:e})}const on=d.z.string().trim().min(3).max(160).regex(/^[a-z][a-z0-9_-]*$/),an=d.z.string().datetime(),dn=d.z.string().regex(/^sha256:[A-Za-z0-9_-]{43}$/),cn=d.z.string().min(32).max(4096),ln=d.z.strictObject({default:d.z.string().trim().min(1).max(160),translations:d.z.record(d.z.string().regex(/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/),d.z.string().trim().min(1).max(160)).default({})});function pn(e){return Array.isArray(e)?`[${e.map(pn).join(",")}]`:e&&"object"==typeof e?`{${Object.entries(e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>`${JSON.stringify(e)}:${pn(t)}`).join(",")}}`:JSON.stringify(e)}const un="2026-08-10",hn="2026-08-10",mn="2026-08-10",gn=Object.freeze({AccountApi:"task-handoff:official-account-api",Binding:"task-handoff:control-plane-binding",CoordinatorControl:"task-handoff:coordinator-control",RelayAllocation:"task-handoff:relay-allocation",RelayClientAttach:"task-handoff:relay-client-attach",RelayControlPlaneAttach:"task-handoff:relay-control-plane-attach",RelayRevocation:"task-handoff:relay-revocation",ControlPlaneAccess:"task-handoff:control-plane-access"});d.z.strictObject({protocolVersion:d.z.literal("2026-08-10"),audience:d.z.literal(gn.AccountApi)});const yn=d.z.string().email().max(320).transform(e=>e.trim().toLowerCase()),fn=d.z.enum(["pending-verification","active","disabled","pending-deletion"]);d.z.strictObject({id:on,email:yn,emailVerified:d.z.boolean(),hasPassword:d.z.boolean().optional(),totpEnabled:d.z.boolean().optional(),displayName:ln.optional(),status:fn,createdAt:an}),d.z.strictObject({id:on,kind:d.z.enum(["browser","mobile"]),deviceName:d.z.string().trim().min(1).max(160),platform:d.z.string().trim().min(1).max(80).optional(),createdAt:an,lastSeenAt:an.optional(),expiresAt:an,revokedAt:an.optional()}),d.z.union([d.z.object({code:cn,state:d.z.string().min(1).max(4096).optional(),redirectUri:d.z.string().url(),expiresAt:an}),d.z.object({authorizationUrl:d.z.string().url(),expiresAt:an})]),d.z.object({tokenType:d.z.literal("Bearer"),accessToken:cn,accessExpiresAt:an,refreshCredential:cn,accountId:on,deviceSessionId:on}),d.z.strictObject({enrollmentToken:cn,secret:cn,algorithm:d.z.literal("SHA1"),digits:d.z.literal(6),periodSeconds:d.z.literal(30),otpauthUri:d.z.string().url().startsWith("otpauth://totp/"),expiresAt:an});const In=d.z.strictObject({controlPlaneId:on,algorithm:d.z.literal("Ed25519"),publicKey:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),fingerprint:dn});d.z.strictObject({protocolVersion:d.z.literal(un),audience:d.z.literal(gn.Binding),challengeId:on,challenge:cn,serviceOrigin:d.z.string().url(),identity:In,nonce:d.z.string().min(16).max(256),initiatingAdminSessionId:on,issuedAt:an,expiresAt:an}),d.z.strictObject({code:d.z.enum(["CONTROL_PLANE_ALREADY_BOUND","REVISION_CONFLICT","REVOCATION_PENDING","IDENTITY_CLONE_CONFLICT"]),controlPlaneId:on,expectedRevision:d.z.number().int().nonnegative().optional(),actualRevision:d.z.number().int().nonnegative().optional(),retryable:d.z.boolean()});const bn=d.z.strictObject({bindingId:on.optional(),controlPlaneId:on,displayName:ln,publicKeyFingerprint:dn,bindingRevision:d.z.number().int().positive(),remoteAccess:d.z.enum(["enabled","disabled","revocation-pending"]),leaseExpiresAt:an.optional(),lastConnectedAt:an.optional(),relayUsageBytes:d.z.number().int().nonnegative(),relayQuotaBytes:d.z.number().int().nonnegative().optional(),versionWarning:d.z.string().trim().min(1).max(500).optional(),errorCode:d.z.string().trim().min(1).max(160).optional()}),vn=d.z.enum(["interactive","stream","bulk"]),Sn=d.z.object({type:d.z.literal("tty-snapshot"),streamId:d.z.string().trim().min(1).optional(),data:d.z.string(),pendingEscape:d.z.string(),cols:d.z.number().int().positive(),rows:d.z.number().int().positive()}).passthrough(),wn=d.z.strictObject({protocolVersion:d.z.literal(hn),audience:d.z.literal(gn.CoordinatorControl),connectionId:on,processInstanceId:on,controlPlaneId:on,publicKey:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),publicKeyFingerprint:dn,bindingId:on.optional(),bindingRevision:d.z.number().int().positive().optional(),epoch:d.z.number().int().nonnegative(),capabilities:d.z.array(d.z.enum(["request","stream","websocket"])).min(1),issuedAt:an,expiresAt:an}).superRefine((e,t)=>{Boolean(e.bindingId)!==Boolean(e.bindingRevision)&&t.addIssue({code:"custom",message:"binding id and revision must be supplied together"})});wn.safeExtend({signature:cn}),d.z.strictObject({connectionId:on,controlPlaneId:on,bindingRevision:d.z.number().int().positive(),epoch:d.z.number().int().nonnegative(),relayId:on,relayRegion:d.z.string().trim().min(1).max(80),issuedAt:an,expiresAt:an});const An=d.z.strictObject({protocolVersion:d.z.literal(hn),audience:d.z.literal(gn.ControlPlaneAccess),ticketId:on,accountId:on,deviceSessionId:on,controlPlaneId:on,bindingId:on,bindingRevision:d.z.number().int().positive(),targetPublicKeyFingerprint:dn,nonce:d.z.string().min(16).max(256),trafficClasses:d.z.array(vn).min(1),issuedAt:an,expiresAt:an,signature:cn});d.z.strictObject({audience:d.z.literal(gn.ControlPlaneAccess),accountId:on,deviceSessionId:on,controlPlaneId:on,bindingId:on,bindingRevision:d.z.number().int().positive(),authenticatedAt:an,expiresAt:an,signature:cn});const zn=d.z.enum(["client","control-plane"]),kn=d.z.strictObject({protocolVersion:d.z.literal(mn),audience:d.z.enum([gn.RelayClientAttach,gn.RelayControlPlaneAttach]),allocationId:on,relayId:on,role:zn,controlPlaneId:on,accountId:on,deviceSessionId:on,bindingId:on,ticketId:on,bindingRevision:d.z.number().int().positive(),trafficClass:vn,nonce:d.z.string().min(16).max(256),issuedAt:an,expiresAt:an,signature:cn}).superRefine((e,t)=>{const n="client"===e.role?gn.RelayClientAttach:gn.RelayControlPlaneAttach;e.audience!==n&&t.addIssue({code:"custom",path:["audience"],message:`audience must match ${e.role} role`})});d.z.object({allocationId:on,relayId:on,relayRegion:d.z.string().trim().min(1).max(80),relayUrl:d.z.string().url(),clientAttach:kn,expiresAt:an}),d.z.strictObject({channelId:on,allocationId:on,controlPlaneId:on,bindingRevision:d.z.number().int().positive(),trafficClass:vn,state:d.z.enum(["waiting-for-peer","handshaking","open","closing","closed"]),clientAttached:d.z.boolean(),controlPlaneAttached:d.z.boolean(),openedAt:an.optional(),leaseExpiresAt:an}),d.z.strictObject({protocolVersion:d.z.literal(mn),channelId:on,sequence:d.z.number().int().nonnegative(),kind:d.z.enum(["handshake","data","cancel","window-update","close"]),ciphertext:d.z.string().max(1398102).optional(),creditBytes:d.z.number().int().positive().optional()}),d.z.strictObject({channelId:on,code:d.z.enum(["normal","expired","revoked","quota-exceeded","idle-timeout","slow-consumer","protocol-error","peer-disconnected"]),retryable:d.z.boolean()}),d.z.strictObject({protocolVersion:d.z.literal(mn),audience:d.z.literal(gn.RelayRevocation),revocationId:on,relayId:on.optional(),allocationId:on.optional(),accountId:on.optional(),deviceSessionId:on.optional(),bindingId:on.optional(),issuedAt:an,expiresAt:an,signature:cn}).refine(e=>[e.allocationId,e.accountId,e.deviceSessionId,e.bindingId].some(Boolean),"revocation target is required"),d.z.strictObject({data:d.z.strictObject({protocolVersion:d.z.literal(un),items:d.z.array(bn)})}),Object.keys(bn.shape);const Tn=d.z.object({ticketId:d.z.string().trim().min(3).max(160),deviceSessionId:d.z.string().trim().min(3).max(160),clientEphemeralPublicKey:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/)});function Cn(){return Object.assign(new Error("End-to-end handshake is invalid."),{code:"E2E_HANDSHAKE_INVALID"})}d.z.object({serverEphemeralPublicKey:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),transcript:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),signature:d.z.string().regex(/^[A-Za-z0-9_-]{86}$/)});const En=d.z.union([d.z.object({type:d.z.literal("schedule"),scheduleKind:d.z.literal("interval").default("interval"),intervalMs:d.z.number().int().min(1e3)}).strict(),d.z.object({type:d.z.literal("schedule"),scheduleKind:d.z.literal("daily"),timeOfDay:d.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:d.z.string().trim().min(1).max(120)}).strict(),d.z.object({type:d.z.literal("schedule"),scheduleKind:d.z.literal("weekly"),weekdays:d.z.array(d.z.number().int().min(0).max(6)).min(1).max(7),timeOfDay:d.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:d.z.string().trim().min(1).max(120)}).strict()]),xn=d.z.union([En,d.z.object({type:d.z.literal("file-change"),roots:d.z.array(d.z.string().trim().min(1).max(4096)).min(1).max(50),globs:d.z.array(d.z.string().trim().min(1).max(500)).min(1).max(100),ignore:d.z.array(d.z.string().trim().min(1).max(500)).max(100).optional(),debounceMs:d.z.number().int().min(100).max(6e4).default(1500)}).strict(),d.z.object({type:d.z.literal("ai-session"),agent:d.z.string().trim().min(1).max(80).optional(),statuses:d.z.array(d.z.enum(["running","waiting","idle","failed"])).max(20).optional(),phases:d.z.array(d.z.enum(["thinking","tool","editing","approval","responding","unknown"])).max(20).optional()}).strict()]),Nn=d.z.object({promptTemplate:d.z.string().trim().min(1).max(2e4)}).strict(),Rn=d.z.object({cooldownMs:d.z.number().int().min(0).max(864e5).optional(),maxConcurrentRuns:d.z.number().int().min(1).max(20).default(1),whenBusy:d.z.enum(["skip","queue"]).default("skip")}).strict(),On=d.z.object({configHash:d.z.string().trim().min(8).max(80),name:d.z.string().trim().min(1).max(160),description:d.z.string().trim().max(1e3).optional(),source:xn,action:Nn,policy:Rn.default({maxConcurrentRuns:1,whenBusy:"skip"}),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}).strict(),_n=d.z.object({type:d.z.literal("ai-session"),aiSessionId:d.z.string().trim().min(1).max(160)}).strict(),Pn=d.z.object({configHash:d.z.string().trim().min(8).max(80),deploymentId:d.z.string().trim().min(1).max(240).optional(),instanceId:d.z.string().trim().min(1).max(160),origin:d.z.enum(["control-plane","controlled-instance"]).default("controlled-instance"),enabled:d.z.boolean().default(!0),target:_n,localName:d.z.string().trim().min(1).max(160).optional(),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}).strict(),jn=d.z.object({configHash:d.z.string().trim().min(8).max(80),deploymentId:d.z.string().trim().min(1).max(240).optional(),instanceId:d.z.string().trim().min(1).max(160),status:d.z.enum(["idle","running","disabled","error"]).default("idle"),lastTriggeredAt:d.z.string().datetime().optional(),lastCompletedAt:d.z.string().datetime().optional(),lastSkippedAt:d.z.string().datetime().optional(),lastError:d.z.string().trim().max(4e3).optional(),runCount:d.z.number().int().min(0).default(0),skippedCount:d.z.number().int().min(0).default(0)}).strict(),Dn=d.z.object({id:d.z.string().trim().min(1).max(160),configHash:d.z.string().trim().min(8).max(80),deploymentId:d.z.string().trim().min(1).max(240).optional(),instanceId:d.z.string().trim().min(1).max(160),eventType:d.z.enum(["manual","schedule","file-change","ai-session"]),status:d.z.enum(["started","completed","failed","skipped"]),target:_n,promptPreview:d.z.string().trim().max(500),eventSummary:d.z.string().trim().max(1e3).optional(),error:d.z.string().trim().max(4e3).optional(),startedAt:d.z.string().datetime(),completedAt:d.z.string().datetime().optional()}).strict();d.z.object({schemaVersion:d.z.literal(1).default(1),configs:d.z.array(On).default([]),deployments:d.z.array(Pn).default([]),runtime:d.z.array(jn).default([]),recentRuns:d.z.array(Dn).default([])}).strict();const Mn=d.z.object({instanceId:d.z.string().trim().min(1).max(160),instanceName:d.z.string().trim().min(1).max(160),deployment:Pn,runtime:jn.optional()}).strip(),Ln=Dn.extend({instanceName:d.z.string().trim().min(1).max(160).optional()}).strip(),qn=d.z.object({configHash:d.z.string().trim().min(8).max(80),config:On,deploymentCount:d.z.number().int().min(0),enabledCount:d.z.number().int().min(0),runningCount:d.z.number().int().min(0),errorCount:d.z.number().int().min(0),ownedByControlPlane:d.z.boolean(),controlPlaneDeploymentCount:d.z.number().int().min(0),deployments:d.z.array(Mn),recentRuns:d.z.array(Ln)}).strip(),$n=d.z.object({updatedAt:d.z.string().datetime(),triggers:d.z.array(qn)}).strip();function Bn(e){const t=Hn({source:e.source,action:e.action,policy:Rn.parse(e.policy||{})});return`trg_${function(e){const t=(new TextEncoder).encode(e),n=64*Math.ceil((t.length+9)/64),s=new Uint8Array(n);s.set(t),s[t.length]=128;const i=new DataView(s.buffer),r=8*t.length;i.setUint32(n-8,Math.floor(r/4294967296)),i.setUint32(n-4,r>>>0);const o=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),a=new Uint32Array(64);for(let e=0;e<n;e+=64){for(let t=0;t<16;t+=1)a[t]=i.getUint32(e+4*t);for(let e=16;e<64;e+=1){const t=a[e-15],n=a[e-2],s=Un(t,7)^Un(t,18)^t>>>3,i=Un(n,17)^Un(n,19)^n>>>10;a[e]=a[e-16]+s+a[e-7]+i>>>0}let[t,n,s,r,d,c,l,p]=o;for(let e=0;e<64;e+=1){const i=p+(Un(d,6)^Un(d,11)^Un(d,25))+(d&c^~d&l)+Fn[e]+a[e]>>>0,o=t&n^t&s^n&s;p=l,l=c,c=d,d=r+i>>>0,r=s,s=n,n=t,t=i+((Un(t,2)^Un(t,13)^Un(t,22))+o>>>0)>>>0}o[0]=o[0]+t>>>0,o[1]=o[1]+n>>>0,o[2]=o[2]+s>>>0,o[3]=o[3]+r>>>0,o[4]=o[4]+d>>>0,o[5]=o[5]+c>>>0,o[6]=o[6]+l>>>0,o[7]=o[7]+p>>>0}return[...o].map(e=>e.toString(16).padStart(8,"0")).join("")}(JSON.stringify(t)).slice(0,24)}`}d.z.object({name:On.shape.name,description:On.shape.description,source:xn,action:Nn,policy:Rn.partial().optional()}).strict(),d.z.object({scope:d.z.enum(["node","instance"]),nodeId:d.z.string().trim().min(1).max(160).optional(),instanceId:d.z.string().trim().min(1).max(160).optional(),code:d.z.string().trim().min(1).max(160),message:d.z.string().trim().min(1).max(4e3)}).strip();const Fn=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Un(e,t){return e>>>t|e<<32-t}function Hn(e){return Array.isArray(e)?e.map(Hn):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).filter(([,e])=>void 0!==e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>[e,Hn(t)])):e}const Wn="2026-08-01",Gn=d.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Proxy protocol version must use YYYY-MM-DD format."),Vn=d.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Kn=d.z.string().datetime(),Jn=d.z.string().trim().min(32).max(4096),Yn=Vn,Qn=d.z.string().trim().max(2048).transform((e,t)=>{try{return function(e){const t=new URL(e.trim());if("https:"!==t.protocol||t.username||t.password||"/"!==t.pathname||t.search||t.hash)throw new Error("Proxy origin must be an HTTPS origin without credentials, path, query, or fragment.");return t.origin}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),d.z.NEVER}}),Xn=d.z.string().trim().min(1).max(4096).transform((e,t)=>{try{return function(e){const t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/%25/i.test(t))throw new Error("Proxy route must be a single-encoded node-agent relative route.");const n=t.split("?",1)[0];let s,i;try{s=n.split("/").map(e=>decodeURIComponent(e))}catch{throw new Error("Proxy route contains invalid percent encoding.")}if(s.some(e=>".."===e||"."===e))throw new Error("Proxy route cannot traverse outside the node-agent API.");try{i=new URL(t,"https://node-agent.invalid")}catch{throw new Error("Proxy route is invalid.")}if("https://node-agent.invalid"!==i.origin||i.username||i.password)throw new Error("Proxy route cannot select an absolute upstream URL.");return`${i.pathname}${i.search}`}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),d.z.NEVER}}),Zn=new Set(["accept","accept-language","authorization","content-type","if-match","if-none-match","range","x-request-id","x-task-handoff-trace-id"]),es=new Set(["cache-control","content-disposition","content-language","content-length","content-range","content-type","etag","last-modified","server-timing","x-request-id","x-task-handoff-trace-id"]),ts="x-task-handoff-proxy-protocol-version",ns="x-task-handoff-proxy-source-control-plane-id",ss="x-task-handoff-proxy-binding-key-id",is="x-task-handoff-proxy-credential",rs={ProtocolUnsupported:"CONTROL_PLANE_PROXY_PROTOCOL_UNSUPPORTED",InviteInvalid:"CONTROL_PLANE_PROXY_INVITE_INVALID",InviteExpired:"CONTROL_PLANE_PROXY_INVITE_EXPIRED",InviteConsumed:"CONTROL_PLANE_PROXY_INVITE_CONSUMED",InviteRevoked:"CONTROL_PLANE_PROXY_INVITE_REVOKED",TargetUnavailable:"CONTROL_PLANE_PROXY_TARGET_UNAVAILABLE",TargetMismatch:"CONTROL_PLANE_PROXY_TARGET_MISMATCH",BindingUnknown:"CONTROL_PLANE_PROXY_BINDING_UNKNOWN",BindingRevoked:"CONTROL_PLANE_PROXY_BINDING_REVOKED",BindingIdentityConflict:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",AuthenticationFailed:"CONTROL_PLANE_PROXY_AUTHENTICATION_FAILED",RouteInvalid:"CONTROL_PLANE_PROXY_ROUTE_INVALID",HeaderInvalid:"CONTROL_PLANE_PROXY_HEADER_INVALID",ResourceLimit:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",SnapshotRequired:"CONTROL_PLANE_PROXY_SNAPSHOT_REQUIRED",Unavailable:"CONTROL_PLANE_PROXY_UNAVAILABLE",TransportFailed:"CONTROL_PLANE_PROXY_TRANSPORT_FAILED"},os=d.z.enum(Object.values(rs)),as=d.z.object({code:os,message:d.z.string().trim().min(1).max(2048),retryable:d.z.boolean(),details:d.z.record(d.z.string(),d.z.unknown()).optional()}).strict(),ds=d.z.enum(["active","revoked"]),cs=d.z.object({id:Vn,targetNodeId:Vn,status:ds,createdBy:Vn,expiresAt:Kn,revokedAt:Kn.optional(),createdAt:Kn,updatedAt:Kn}).strict(),ls=d.z.object({targetNodeId:Vn,expiresInSeconds:d.z.number().int().min(60).max(3600).default(600)}).strict(),ps=d.z.object({invite:cs,token:d.z.string().trim().min(24).max(512),proxyOrigin:Qn,protocolVersion:Gn}).strict(),us=d.z.enum(["active","revoked"]),hs=d.z.object({id:Vn,claimId:Vn,sourceControlPlaneId:Vn,targetNodeId:Vn,bindingKeyId:Vn,status:us,revision:d.z.number().int().positive(),lastError:as.optional(),revokedAt:Kn.optional(),createdAt:Kn,updatedAt:Kn}).strict(),ms=d.z.object({protocolVersion:Gn,inviteToken:d.z.string().trim().min(24).max(512).optional(),claimId:Vn,sourceControlPlaneId:Vn,targetNodeId:Vn.optional(),bindingKeyId:Vn,credential:Jn}).strict(),gs=d.z.object({sourceControlPlaneId:Vn,bindingKeyId:Vn,credential:Jn}).strict(),ys=d.z.object({id:Vn,name:d.z.string().trim().min(1).max(160),status:d.z.enum(["unknown","online","offline","degraded"]),health:d.z.enum(["unknown","ok","degraded","failed"]),lastSeenAt:Kn.optional(),capabilities:d.z.record(d.z.string(),d.z.unknown()).default({})}).strict(),fs=d.z.object({protocolVersion:Gn,binding:hs,streamId:Vn,revision:d.z.number().int().nonnegative(),observedAt:Kn,target:ys}).strict(),Is=d.z.object({type:d.z.literal("control-plane-proxy.event"),protocolVersion:Gn,streamId:Vn,bindingId:Vn,sourceControlPlaneId:Vn,targetNodeId:Vn,revision:d.z.number().int().positive(),source:d.z.object({id:d.z.string().trim().min(1).max(512),seq:d.z.number().int().nonnegative()}).strict(),target:ys,event:d.z.object({type:d.z.string().trim().min(1).max(240),topic:d.z.string().trim().min(1).max(240),createdAt:Kn}).strict()}).strict(),bs=d.z.object({type:d.z.literal("control-plane-proxy.events.ready"),protocolVersion:Gn,streamId:Vn,bindingId:Vn,sourceControlPlaneId:Vn,targetNodeId:Vn,latestRevision:d.z.number().int().nonnegative(),earliestRetainedRevision:d.z.number().int().nonnegative()}).strict(),vs=d.z.object({type:d.z.literal("control-plane-proxy.snapshot-required"),protocolVersion:Gn,streamId:Vn,bindingId:Vn,sourceControlPlaneId:Vn,targetNodeId:Vn,sinceRevision:d.z.number().int().nonnegative(),latestRevision:d.z.number().int().nonnegative(),earliestRetainedRevision:d.z.number().int().nonnegative(),error:as}).strict(),Ss=d.z.discriminatedUnion("type",[Is,bs,vs]),ws=d.z.object({protocolVersion:Gn,binding:hs,target:fs.shape.target}).strict(),As=d.z.object({id:Vn,claimId:Vn,proxyOrigin:Qn,requestedName:d.z.string().trim().min(1).max(160).optional(),sourceControlPlaneId:Vn,targetNodeId:Vn.optional(),bindingKeyId:Vn,credential:Jn,status:d.z.enum(["pending","compensation-required"]),createdAt:Kn,updatedAt:Kn,expiresAt:Kn}).strict();As.omit({credential:!0});const zs=d.z.object({id:Vn,nodeId:Vn,proxyOrigin:Qn,proxyBindingId:Vn,targetNodeId:Vn,sourceControlPlaneId:Vn,bindingKeyId:Vn,credential:Jn,createdAt:Kn,updatedAt:Kn}).strict(),ks="2026-08-20",Ts=new Set(["2026-08-01","2026-08-16","2026-08-17",ks]),Cs=d.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Protocol version must use YYYY-MM-DD format."),Es=d.z.string().trim().min(1).max(120);function xs(){return{features:{appRuntime:!1,tty:!1,gui:!1,browser:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1}}}}const Ns=d.z.object({sessionReadAgents:d.z.array(Es).max(100).default([]),turnReadAgents:d.z.array(Es).max(100).default([]),liveItemAgents:d.z.array(Es).max(100).default([])}).passthrough(),Rs=d.z.object({metadataAgents:d.z.array(Es).max(100).default([]),contentAgents:d.z.array(Es).max(100).default([]),uploadAgents:d.z.array(Es).max(100).default([]),retentionSettings:d.z.boolean().default(!1)}).passthrough(),Os=d.z.object({appRuntime:d.z.boolean().default(!1),tty:d.z.boolean().default(!1),gui:d.z.boolean().default(!1),browser:d.z.boolean().default(!1),screenshots:d.z.boolean().default(!1),logs:d.z.boolean().default(!1),aiSessionWorkspaceSelection:d.z.boolean().default(!1),aiSessionPersistenceSettings:d.z.boolean().default(!1),aiSessionTimeline:Ns.default(function(){return{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),aiSessionConversationAttachments:Rs.optional()}).passthrough(),_s=d.z.object({features:Os.default(function(){return{appRuntime:!1,tty:!1,gui:!1,browser:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1}}})}).passthrough();function Ps(e){const t={features:{appRuntime:!1,tty:!1,gui:!1,browser:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1}}};if(!e||"object"!=typeof e||Array.isArray(e))return t;const n=e,s=n.features;if(!s||"object"!=typeof s||Array.isArray(s))return t;const i=s,r={appRuntime:!1,tty:!1,gui:!1,browser:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1}};for(const e of["appRuntime","tty","gui","browser","screenshots","logs","aiSessionWorkspaceSelection","aiSessionPersistenceSettings"]){const t=d.z.boolean().safeParse(i[e]);t.success&&(r[e]=t.data)}const o=Ns.safeParse(i.aiSessionTimeline);o.success&&(r.aiSessionTimeline=o.data);const a=Rs.safeParse(i.aiSessionConversationAttachments);return a.success&&(r.aiSessionConversationAttachments=a.data),_s.parse({...n,features:{...i,...r}})}function js(e,t){const n=function(e){return Ps(e).features.aiSessionTimeline}(e);return"session-read"===t?n.sessionReadAgents:"turn-read"===t?n.turnReadAgents:n.liveItemAgents}const Ds=d.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Ms=d.z.string().datetime(),Ls=d.z.record(d.z.string(),d.z.string()).default({}),qs=d.z.record(d.z.string(),d.z.string()).default({});function $s(e){if(null!=e){if("string"==typeof e)return{encoding:"utf8",data:e};if(Buffer.isBuffer(e))return{encoding:"base64",data:e.toString("base64")};if(e instanceof ArrayBuffer)return{encoding:"base64",data:Buffer.from(e).toString("base64")};if(ArrayBuffer.isView(e))return{encoding:"base64",data:Buffer.from(e.buffer,e.byteOffset,e.byteLength).toString("base64")};throw new TypeError("Node tunnel request body must be a string or binary buffer.")}}d.z.object({encoding:d.z.enum(["utf8","base64"]),data:d.z.string()}).strict().superRefine((e,t)=>{"base64"===e.encoding&&Buffer.from(e.data,"base64").toString("base64")!==e.data&&t.addIssue({code:"custom",path:["data"],message:"Node tunnel binary body must use canonical base64 encoding."})});const Bs=/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/,Fs=/^sha256:([a-fA-F0-9]{64})$/,Us=/^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/,Hs=/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;function Ws(e){const t=e.trim();if(!t||t.length>512||t.includes("://")||/\s/.test(t))throw new Error("Docker image reference must not contain a URL scheme or whitespace.");const n=t.indexOf("@");if(-1!==n&&n!==t.lastIndexOf("@"))throw new Error("Docker image reference contains more than one digest separator.");const s=-1===n?void 0:t.slice(n+1),i=-1===n?t:t.slice(0,n),r=s?Fs.exec(s):void 0;if(s&&!r)throw new Error("Docker image digest must use sha256 followed by 64 hexadecimal characters.");const o=i.lastIndexOf("/"),a=i.lastIndexOf(":"),d=a>o,c=d?i.slice(a+1):void 0,l=d?i.slice(0,a):i;if(c&&!Bs.test(c))throw new Error("Docker image tag is invalid.");if(!c&&!r)throw new Error("Docker image reference must include an explicit tag or sha256 digest.");const p=l.split("/");if(!p.length||p.some(e=>!e))throw new Error("Docker image repository path is invalid.");const u=p.length>1&&(p[0].includes(".")||p[0].includes(":")||"localhost"===p[0]),h=u?p.slice(1):p;if(u&&!Us.test(p[0].toLowerCase()))throw new Error("Docker image registry host or port is invalid.");if(!h.length||h.some(e=>!Hs.test(e)))throw new Error("Docker image repository names must be lowercase and use valid separators.");const m=p.map((e,t)=>u&&0===t?e.toLowerCase():e).join("/"),g=r?`sha256:${r[1].toLowerCase()}`:void 0;return`${m}${c?`:${c}`:""}${g?`@${g}`:""}`}function Gs(e){const t=Ws(e),n=t.indexOf("@"),s=-1===n?void 0:t.slice(n+1),i=-1===n?t:t.slice(0,n),r=i.lastIndexOf("/"),o=i.lastIndexOf(":"),a=o>r;return{reference:t,repository:a?i.slice(0,o):i,tag:a?i.slice(o+1):void 0,digest:s}}const Vs=d.z.string().trim().min(1).max(512).transform((e,t)=>{try{return Ws(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),d.z.NEVER}}),Ks=d.z.string().trim().transform((e,t)=>{const n=Fs.exec(e);return n?`sha256:${n[1].toLowerCase()}`:(t.addIssue({code:"custom",message:"Docker image digest must use sha256 followed by 64 hexadecimal characters."}),d.z.NEVER)}),Js=d.z.object({codexModelHash:Ds.nullable().optional(),claudeModelHash:Ds.nullable().optional()}).strict().default({}),Ys=d.z.object({imageId:Ds,tag:d.z.string().trim().min(1).max(128).regex(Bs).optional()}).strict(),Qs=d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal("image"),imageSelection:Ys}).strict(),d.z.object({type:d.z.literal("template"),environmentTemplateId:Ds}).strict()]),Xs=d.z.enum(["creating","ready","failed","deleting"]),Zs=d.z.enum(["linux","darwin","win32","freebsd","openbsd","aix","sunos","unknown"]),ei=d.z.enum(["x64","arm64","arm","ia32","ppc64","s390x","riscv64","unknown"]),ti=d.z.object({code:d.z.string().trim().min(1).max(120),message:d.z.string().trim().min(1).max(2048),phase:d.z.enum(["validate","commit","inspect","security-check","persist","delete","recovery"]).optional()}).strict(),ni=d.z.object({templateId:Ds,nodeId:Ds,imageId:Ks,name:d.z.string().trim().min(1).max(160),platform:Zs,architecture:ei}).strict(),si=d.z.enum(["data","agent-home","workspace"]),ii=d.z.object({deleteVolumes:d.z.boolean()}).strict(),ri=d.z.object({role:si,name:d.z.string().trim().min(1).max(255),mountPath:d.z.string().trim().startsWith("/").max(4096),status:d.z.enum(["deleted","retained","missing","failed"]),error:d.z.object({code:d.z.string().trim().min(1).max(120),message:d.z.string().trim().min(1).max(2048)}).strict().optional()}).strict(),oi=d.z.object({instanceId:Ds,containerDeleted:d.z.boolean(),completed:d.z.boolean(),deletedVolumes:d.z.array(ri),retainedVolumes:d.z.array(ri),volumeResults:d.z.array(ri)}).strict(),ai={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"};function di(e,t){if(e&&"object"==typeof e&&!Array.isArray(e)){const t=e;return{imageId:"string"==typeof t.imageId&&ai[t.imageId]||t.imageId,..."string"==typeof t.tag?{tag:t.tag}:{}}}if("string"==typeof t)return{imageId:ai[t]||t}}function ci(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,{defaultImageId:n,...s}=t;return{...s,defaultImageSelection:di(t.defaultImageSelection,n)}}const li=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(120),kind:d.z.enum(["tty","gui","web"]),source:d.z.enum(["builtin","custom"]),availability:d.z.enum(["available","missing-dependency"]),capabilities:d.z.object({automation:d.z.enum(["cdp"]).optional(),supportsCwdSelection:d.z.boolean().default(!1)}).strict().default({supportsCwdSelection:!1}),diagnosticCode:d.z.enum(["APP_EXECUTABLE_NOT_FOUND"]).optional()}).strict(),pi=d.z.object({code:d.z.enum(["APP_CATALOG_INVALID"]),message:d.z.string().trim().min(1).max(500)}).strict(),ui=d.z.object({items:d.z.array(li).max(256),observedAt:Ms,issues:d.z.array(pi).max(32).default([])}).strict(),hi=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),sourceInstanceId:Ds,nodeId:Ds,imageId:Ks.optional(),internalTag:d.z.string().trim().min(1).max(512).optional(),platform:Zs.optional(),architecture:ei.optional(),sizeBytes:d.z.number().int().nonnegative().optional(),status:Xs,error:ti.optional(),createdAt:Ms,updatedAt:Ms}).strict().superRefine((e,t)=>{if("ready"===e.status)for(const n of["imageId","internalTag","platform","architecture","sizeBytes"])void 0===e[n]&&t.addIssue({code:"custom",path:[n],message:`Ready environment template requires ${n}.`});"failed"!==e.status||e.error||t.addIssue({code:"custom",path:["error"],message:"Failed environment template requires an error diagnostic."})}),mi=d.z.enum(["apt","dnf","brew","npm"]),gi=d.z.enum(["user","passwordless-sudo","root"]),yi=d.z.object({platform:Zs,arch:ei,installers:d.z.array(mi).max(8),privilege:gi,installerAccess:d.z.object({npmGlobalWritable:d.z.boolean().optional()}).strict().optional()}).strict(),fi=d.z.enum(["installed","not-installed","broken","unsupported"]),Ii=d.z.enum(["recipe","bundled","external","none"]),bi=d.z.object({code:d.z.enum(["BUNDLED","EXTERNALLY_MANAGED","ALREADY_INSTALLED","NOT_INSTALLED","UNSUPPORTED_PLATFORM","INSTALLER_UNAVAILABLE","INSTALLER_NOT_WRITABLE","INSUFFICIENT_PRIVILEGE","OPERATION_IN_PROGRESS"]),message:d.z.string().trim().min(1).max(500)}).strict(),vi=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(120),kind:d.z.enum(["tty","gui","web"]),description:d.z.string().trim().max(500).optional(),state:fi,managementSource:Ii,version:d.z.string().trim().max(120).optional(),canInstall:d.z.boolean(),canUninstall:d.z.boolean(),installReason:bi.optional(),uninstallReason:bi.optional(),activeJobId:Ds.optional()}).strict(),Si=d.z.enum(["install","uninstall"]),wi=d.z.enum(["queued","running","succeeded","failed","cancelled","interrupted"]),Ai=d.z.object({current:d.z.number().finite().nonnegative().optional(),total:d.z.number().finite().positive().optional(),unit:d.z.string().trim().min(1).max(40).optional()}).strict().refine(e=>void 0===e.total||void 0===e.current||e.current<=e.total,{message:"Progress current must not exceed total.",path:["current"]}),zi=d.z.object({executable:d.z.string().trim().min(1).max(4096),args:d.z.array(d.z.string().max(4096)).max(128)}).strict(),ki=d.z.object({code:d.z.string().trim().min(1).max(120).regex(/^[a-z0-9][a-z0-9._-]*$/),message:d.z.string().trim().min(1).max(4096),retryable:d.z.boolean(),sessionIds:d.z.array(Ds).max(64).optional()}).strict(),Ti=d.z.object({id:Ds,requestId:Ds.optional(),appId:Ds,operation:Si,state:wi,phase:d.z.string().trim().min(1).max(120).optional(),progress:Ai.optional(),command:zi.optional(),logTail:d.z.string().max(32768).optional(),logTruncated:d.z.boolean().optional(),error:ki.optional(),requestedAt:Ms,startedAt:Ms.optional(),finishedAt:Ms.optional(),updatedAt:Ms}).strict(),Ci=d.z.object({streamId:Ds,sequence:d.z.number().int().nonnegative(),capabilities:yi,apps:d.z.array(vi).max(256),activeJobs:d.z.array(Ti).max(256),recentJobs:d.z.array(Ti).max(256),observedAt:Ms}).strict(),Ei=d.z.object({requestId:Ds.optional()}).strict(),xi=d.z.object({job:Ti}).strict();d.z.object({type:d.z.literal("app-management"),streamId:Ds,sequence:d.z.number().int().nonnegative(),observedAt:Ms,job:Ti.optional(),snapshot:Ci.optional()}).strict().refine(e=>void 0!==e.job||void 0!==e.snapshot,{message:"An app management event requires a job or snapshot."});const Ni=d.z.object({component:d.z.enum(["control-plane","node-agent","controlled-instance"]),packageName:d.z.string().trim().max(160).optional(),packageVersion:d.z.string().trim().max(80).optional(),protocolVersion:Cs.optional(),buildId:d.z.string().trim().max(160).optional(),builtAt:d.z.string().trim().max(120).optional(),gitCommit:d.z.string().trim().max(120).optional(),imageRef:d.z.string().trim().max(512).optional(),imageDigest:d.z.string().trim().max(240).optional()}).strict(),Ri=d.z.object({data:d.z.object({ok:d.z.literal(!0),role:d.z.literal("control-plane"),protocolVersion:Cs,build:Ni.extend({component:d.z.literal("control-plane"),packageVersion:d.z.string().trim().min(1).max(80)}).loose(),serverTime:Ms}).loose()}).loose(),Oi=d.z.enum(["stable","beta","alpha"]),_i=d.z.object({packageName:d.z.literal("@task-handoff/controlled-instance"),version:d.z.string().trim().min(1).max(80),platform:d.z.string().trim().min(1).max(40),arch:d.z.string().trim().min(1).max(40),formatVersion:d.z.number().int().positive(),launcherAbi:d.z.number().int().positive(),entrypoint:d.z.string().trim().min(1).max(512),sha256:d.z.string().regex(/^[a-f0-9]{64}$/)}).strict(),Pi=d.z.object({code:d.z.enum(["INSTANCE_RUNTIME_VERSION_MISMATCH","INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","INSTANCE_RUNTIME_ARTIFACT_INVALID","INSTANCE_RUNTIME_INSTALL_FAILED","INSTANCE_RUNTIME_RESTART_FAILED","INSTANCE_RUNTIME_VERIFICATION_FAILED","INSTANCE_BASE_RUNTIME_INCOMPATIBLE","NODE_UPDATE_PREFLIGHT_FAILED","NODE_UPDATE_FAILED","LEGACY_INSTANCE_UPDATE_RETIRED"]),message:d.z.string().trim().min(1).max(4096),expectedVersion:d.z.string().trim().min(1).max(80).optional(),actualVersion:d.z.string().trim().min(1).max(80).optional(),retryable:d.z.boolean().default(!1)}).strict(),ji=d.z.object({desiredVersion:d.z.string().trim().min(1).max(80),actualVersion:d.z.string().trim().min(1).max(80).optional(),phase:d.z.enum(["pending","draining","installing","restarting","verifying","matched","failed"]),attempt:d.z.number().int().nonnegative().default(0),lastAttemptAt:Ms.optional(),matchedAt:Ms.optional(),error:Pi.optional()}).strict(),Di=d.z.object({runningInstanceCount:d.z.number().int().nonnegative(),stoppedInstanceCount:d.z.number().int().nonnegative(),activeInstanceCount:d.z.number().int().nonnegative(),restartInstanceCount:d.z.number().int().nonnegative(),runningInstanceIds:d.z.array(Ds).max(1024).default([]),stoppedInstanceIds:d.z.array(Ds).max(1024).default([]),activeInstanceIds:d.z.array(Ds).max(1024).default([])}).strict(),Mi=d.z.object({phase:d.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),desiredVersion:d.z.string().trim().min(1).max(80),nodeVersion:d.z.string().trim().min(1).max(80).optional(),expectedInstanceIds:d.z.array(Ds).max(1024).default([]),expectedInstanceCount:d.z.number().int().nonnegative(),matchedInstanceCount:d.z.number().int().nonnegative(),pendingInstanceCount:d.z.number().int().nonnegative(),failedInstanceCount:d.z.number().int().nonnegative(),deferredInstanceCount:d.z.number().int().nonnegative().default(0)}).strict(),Li=d.z.object({channel:Oi.default("stable")}).strict(),qi=d.z.object({source:d.z.literal("npm"),channel:Oi,currentVersion:d.z.string().trim().max(240).optional(),availableVersion:d.z.string().trim().min(1).max(240),artifactRef:d.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:d.z.array(_i).default([]),impact:Di,updateAvailable:d.z.boolean(),supported:d.z.boolean().default(!0),reason:d.z.string().trim().max(2048).optional(),checkedAt:Ms,preflightToken:d.z.string().trim().min(16).max(240).optional()}).strict(),$i=d.z.object({id:Ds,nodeId:Ds,source:d.z.literal("npm"),channel:Oi,fromVersion:d.z.string().trim().max(240).optional(),toVersion:d.z.string().trim().min(1).max(240),artifactRef:d.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:d.z.array(_i).default([]),impact:Di,rollout:Mi,status:d.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),error:Pi.optional(),startedAt:Ms.optional(),completedAt:Ms.optional(),createdAt:Ms,updatedAt:Ms}).strict(),Bi=d.z.object({channel:Oi,targetVersion:d.z.string().trim().min(1).max(240),preflightToken:d.z.string().trim().min(16).max(240)}).strict(),Fi=d.z.object({type:d.z.enum(["branch","tag","commit"]),name:d.z.string().trim().min(1).max(240).optional(),commit:d.z.string().trim().max(80).optional()}).strict(),Ui=d.z.object({type:d.z.enum(["none","ssh-key","https-token"]).default("none"),secretId:d.z.string().trim().min(1).max(120).optional()}).strict(),Hi=d.z.object({depth:d.z.number().int().positive().max(1e5).optional(),submodules:d.z.boolean().default(!1),lfs:d.z.boolean().default(!1),subdirectory:d.z.string().trim().max(240).default("")}).strict();d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),url:d.z.string().trim().min(1).max(2048),provider:d.z.string().trim().max(80).optional(),ref:Fi.default({type:"branch",name:"main"}),auth:Ui.default({type:"none"}),clone:Hi.default({submodules:!1,lfs:!1,subdirectory:""}),defaultImageSelection:Ys.optional(),labels:Ls,createdAt:Ms,updatedAt:Ms}).strict();const Wi=d.z.object({id:Ds,nodeId:Ds,name:d.z.string().trim().min(1).max(160),path:d.z.string().trim().min(1).max(4096),defaultImageSelection:Ys.optional(),labels:Ls,createdAt:Ms,updatedAt:Ms}).strict(),Gi=d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal("git-repository"),repositoryId:Ds.optional(),url:d.z.string().trim().min(1).max(2048),provider:d.z.string().trim().max(80).optional(),ref:Fi.default({type:"branch",name:"main"}),auth:Ui.default({type:"none"}),clone:Hi.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),d.z.object({type:d.z.literal("git-template"),url:d.z.string().trim().min(1).max(2048),templateId:d.z.string().trim().min(1).max(120).optional(),ref:Fi.default({type:"branch",name:"main"}),auth:Ui.default({type:"none"}),clone:Hi.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),d.z.object({type:d.z.literal("local-folder"),localFolderId:Ds.optional(),path:d.z.string().trim().min(1).max(4096),ownerNodeId:Ds.optional()}).strict()]),Vi=d.z.object({mode:d.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]),path:d.z.string().trim().min(1).max(4096).default("/workspace"),volumeName:d.z.string().trim().max(240).optional(),readOnly:d.z.boolean().default(!1)}).strict(),Ki=d.z.enum(["codex","claude"]),Ji=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),source:Gi,defaultImageSelection:Ys.optional(),defaultNodeId:Ds.optional(),defaultRuntimeId:Ds.optional(),workspacePolicy:Vi,labels:Ls,createdAt:Ms,updatedAt:Ms}).strict(),Yi=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),endpoint:d.z.string().trim().min(1).max(2048),key:d.z.string().trim().min(1).max(4096),model:d.z.string().trim().min(1).max(240),app:Ki,enabled:d.z.boolean().default(!0),order:d.z.number().int().min(0).max(1e6).default(0),labels:Ls,createdAt:Ms,updatedAt:Ms}).strict(),Qi=Yi.omit({key:!0}).extend({keyPreview:d.z.string().trim().min(1).max(160),keySet:d.z.boolean()}).strict(),Xi=Qi.extend({referenceCount:d.z.number().int().min(0)}).strict(),Zi=d.z.object({instanceId:Ds,codexModelHash:Ds.optional(),claudeModelHash:Ds.optional(),updatedAt:Ms}).strict(),er=d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal("control-plane"),name:Yi.shape.name,enabled:Yi.shape.enabled,order:Yi.shape.order}).strict(),d.z.object({type:d.z.literal("node"),nodeId:Ds,name:Yi.shape.name,enabled:Yi.shape.enabled,order:Yi.shape.order,referenceCount:d.z.number().int().min(0)}).strict()]),tr=d.z.object({id:Ds,model:Qi,locations:d.z.array(er).min(1),referenceCount:d.z.number().int().min(0).default(0)}).strict(),nr=d.z.object({nodeId:Ds,code:d.z.string().trim().min(1).max(120),message:d.z.string().trim().min(1).max(2e3)}).strict(),sr=d.z.object({models:d.z.array(tr),nodeDiagnostics:d.z.array(nr).default([]),updatedAt:Ms}).strict();function ir(e){const t={app:Ki.parse(e.app),endpoint:Yi.shape.endpoint.parse(e.endpoint),key:Yi.shape.key.parse(e.key),model:Yi.shape.model.parse(e.model)};return`mdl_${s.createHash("sha256").update(JSON.stringify(t)).digest("hex")}`}Yi.omit({id:!0,createdAt:!0,updatedAt:!0}).strict().partial().strict(),d.z.object({modelSelection:Js,codexModelHash:Ds.optional(),claudeModelHash:Ds.optional()}).strict();const rr=d.z.enum(["market","custom"]),or=d.z.enum(["active","deprecated","yanked"]),ar=d.z.discriminatedUnion("kind",[d.z.object({kind:d.z.literal("builtin"),key:d.z.string().trim().min(1).max(120)}).strict(),d.z.object({kind:d.z.literal("remote"),url:d.z.string().trim().url().max(2048),mediaType:d.z.enum(["image/png","image/jpeg","image/webp"]).optional(),digest:Ks.optional()}).strict()]),dr={kind:"builtin",key:"default-image-cover"},cr=d.z.array(d.z.string().trim().min(1).max(80)).default([]),lr=d.z.array(d.z.string().trim().min(1).max(120)).default([]),pr=d.z.record(d.z.string().trim().min(2).max(35),d.z.string().trim().min(1).max(4096)),ur=d.z.object({os:d.z.string().trim().min(1).max(40),architecture:d.z.string().trim().min(1).max(40),digest:Ks.optional(),downloadSizeBytes:d.z.number().int().positive().optional(),unpackedSizeBytes:d.z.number().int().positive().optional()}).strict(),hr=d.z.object({name:d.z.string().trim().min(1).max(128).regex(Bs),version:d.z.string().trim().min(1).max(160).optional(),reference:Vs,manifestDigest:Ks.optional(),publishedAt:Ms.optional(),platforms:d.z.array(ur).default([]),status:or.default("active")}).strict(),mr=d.z.object({id:Ds,publisher:d.z.string().trim().min(1).max(160),slug:d.z.string().trim().min(1).max(160),name:d.z.string().trim().min(1).max(160),description:d.z.string().trim().min(1).max(4096),localizedDescriptions:pr.optional(),cover:ar.optional(),repository:d.z.string().trim().min(1).max(512),defaultTag:d.z.string().trim().min(1).max(128).regex(Bs),tags:d.z.array(hr).min(1),capabilities:cr,optionalApps:lr,defaultEnv:qs,labels:Ls,status:or.default("active")}).strict().superRefine((e,t)=>{e.tags.some(t=>t.name===e.defaultTag)||t.addIssue({code:"custom",path:["defaultTag"],message:"Market defaultTag must identify one of the image tags."})}),gr=d.z.object({protocolVersion:Cs,catalogId:Ds,revision:d.z.string().trim().min(1).max(240),source:d.z.enum(["embedded","remote","cache"]),generatedAt:Ms,expiresAt:Ms.optional(),items:d.z.array(mr)}).strict(),yr=d.z.object({source:d.z.enum(["embedded","remote","cache"]),state:d.z.enum(["ready","refreshing","stale","failed"]),revision:d.z.string().trim().min(1).max(240),updatedAt:Ms,error:d.z.string().trim().max(4096).optional()}).strict(),fr=d.z.object({id:Ds,origin:d.z.literal("custom"),name:d.z.string().trim().min(1).max(160),description:d.z.string().trim().max(4096).optional(),localizedDescriptions:pr.optional(),cover:ar.optional(),reference:Vs,repository:d.z.string().trim().min(1).max(512),tag:d.z.string().trim().min(1).max(128).regex(Bs).optional(),pullPolicy:d.z.literal("if-not-present").default("if-not-present"),capabilities:cr,optionalApps:lr,defaultEnv:qs,labels:Ls,createdAt:Ms,updatedAt:Ms}).strict(),Ir=d.z.object({name:d.z.string().trim().min(1).max(128).regex(Bs),version:d.z.string().trim().min(1).max(160).optional(),reference:Vs,manifestDigest:Ks.optional(),status:or}).strict(),br=d.z.object({id:Ds,origin:rr,name:d.z.string().trim().min(1).max(160),description:d.z.string().trim().max(4096).optional(),localizedDescriptions:pr.optional(),cover:ar,repository:d.z.string().trim().min(1).max(512),tag:d.z.string().trim().min(1).max(128).regex(Bs).optional(),availableTags:d.z.array(Ir),reference:Vs,digest:Ks.optional(),downloadSizeBytes:d.z.number().int().positive().optional(),unpackedSizeBytes:d.z.number().int().positive().optional(),capabilities:cr,optionalApps:lr,defaultEnv:qs,labels:Ls,readOnly:d.z.boolean(),lifecycleStatus:or.optional(),market:d.z.object({catalogId:Ds,catalogRevision:d.z.string().trim().min(1).max(240),publisher:d.z.string().trim().min(1).max(160),version:d.z.string().trim().min(1).max(160).optional()}).strict().optional()}).strict(),vr=d.z.object({id:Ds,origin:rr,name:d.z.string().trim().min(1).max(160),description:d.z.string().trim().max(4096).optional(),localizedDescriptions:pr.optional(),cover:ar.optional(),repository:d.z.string().trim().min(1).max(512),tag:d.z.string().trim().min(1).max(128).regex(Bs).optional(),requestedReference:Vs,resolvedDigest:Ks.optional(),resolvedReference:Vs.optional(),downloadSizeBytes:d.z.number().int().positive().optional(),pullPolicy:d.z.literal("if-not-present").default("if-not-present"),capabilities:cr,optionalApps:lr,defaultEnv:qs,labels:Ls,market:d.z.object({catalogId:Ds,catalogRevision:d.z.string().trim().min(1).max(240),publisher:d.z.string().trim().min(1).max(160),version:d.z.string().trim().min(1).max(160).optional()}).strict().optional(),createdAt:Ms,updatedAt:Ms}).strict(),Sr=d.z.object({phase:d.z.enum(["checking-image","pulling-image","resolving-image","ready","failed"]),requestedReference:Vs,generation:d.z.number().int().nonnegative().default(0),error:d.z.string().trim().max(4096).optional(),startedAt:Ms,updatedAt:Ms}).strict(),wr="image.pull.terminal.output",Ar="image.pull.terminal.finished",zr=d.z.object({instanceId:Ds,generation:d.z.number().int().nonnegative(),requestedReference:Vs,sequence:d.z.number().int().nonnegative(),observedAt:Ms}).strict(),kr=zr.extend({data:d.z.string().min(1).max(65536),replay:d.z.boolean().optional()}).strict(),Tr=zr.extend({outcome:d.z.enum(["succeeded","failed"])}).strict(),Cr=zr.extend({status:d.z.enum(["connecting","pulling","extracting","complete","failed"]),layers:d.z.object({total:d.z.number().int().nonnegative(),completed:d.z.number().int().nonnegative(),downloaded:d.z.number().int().nonnegative(),downloading:d.z.number().int().nonnegative(),extracting:d.z.number().int().nonnegative()}).strict(),bytes:d.z.object({current:d.z.number().finite().nonnegative(),total:d.z.number().finite().positive()}).strict().optional(),percent:d.z.number().finite().min(0).max(100).optional(),message:d.z.string().trim().min(1).max(500),terminalTail:d.z.string().max(262144).optional(),terminalTruncated:d.z.boolean().optional()}).strict();function Er(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,s=new Set(["id","origin","name","description","localizedDescriptions","cover","reference","repository","tag","image","registry","pullPolicy","capabilities","optionalApps","defaultEnv","labels","createdAt","updatedAt"]);for(const e of Object.keys(n))s.has(e)||t?.({imageId:"string"==typeof n.id?n.id:void 0,field:e});const i="string"==typeof n.id?n.id:void 0,r="string"==typeof n.image?n.image:void 0;void 0!==r&&t?.({imageId:i,field:"image"}),Object.prototype.hasOwnProperty.call(n,"registry")&&t?.({imageId:i,field:"registry"});let o,a="string"==typeof n.reference?n.reference:r;if(a)try{a=Ws(a)}catch{if(!a.includes("@")&&a.lastIndexOf(":")<=a.lastIndexOf("/"))try{a=Ws(`${a}:latest`),t?.({imageId:i,field:"reference:implicit-latest"})}catch{}}try{o=a?Gs(a):void 0}catch{}return{id:n.id,origin:"custom",name:n.name,description:n.description,localizedDescriptions:n.localizedDescriptions,cover:io(n.cover,["kind","key","url","mediaType","digest"]),reference:o?.reference??a,repository:o?.repository??n.repository,tag:o?.tag??n.tag,pullPolicy:n.pullPolicy??"if-not-present",capabilities:n.capabilities,optionalApps:n.optionalApps,defaultEnv:n.defaultEnv,labels:n.labels,createdAt:n.createdAt,updatedAt:n.updatedAt}}const xr=d.z.discriminatedUnion("kind",[d.z.object({kind:d.z.literal("direct")}).strict(),d.z.object({kind:d.z.literal("control-plane-proxy"),proxyId:Ds,proxyBindingId:Ds,targetNodeId:Ds}).strict()]);d.z.object({pingRttMs:d.z.number().nonnegative().optional(),pingRttP95Ms:d.z.number().nonnegative().optional(),consecutiveReconnects:d.z.number().int().nonnegative(),nextRetryAt:Ms.optional()}).strict();const Nr=d.z.object({reachability:d.z.enum(["unknown","reachable","unreachable"]),bindingStatus:d.z.enum(["unknown","active","revoked"]),bindingRevision:d.z.number().int().positive().optional(),streamId:d.z.string().trim().min(1).max(160).optional(),revision:d.z.number().int().nonnegative().optional(),observedAt:Ms.optional(),target:ys.optional(),lastError:as.optional(),updatedAt:Ms}).strict(),Rr=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),connectionMode:d.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]).default("direct-http"),connectionPath:xr.default({kind:"direct"}),connectionEnabled:d.z.boolean().default(!0),auth:d.z.object({mode:d.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:Ds.optional(),secret:d.z.string().trim().max(4096).optional(),pairedAt:Ms.optional(),pairing:d.z.object({status:d.z.enum(["pending","paired","expired"]).default("pending"),joinToken:d.z.string().trim().max(4096).optional(),expiresAt:Ms.optional()}).strict().optional()}).strict().default({mode:"local-static-key"}),endpoint:d.z.string().trim().max(2048).optional(),controlEndpoint:d.z.string().trim().max(2048).optional(),containerEndpoint:d.z.string().trim().max(2048).optional(),publicWebBase:d.z.string().trim().max(2048).optional(),status:d.z.enum(["unknown","online","offline","degraded"]).default("unknown"),health:d.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),capabilities:d.z.record(d.z.string(),d.z.unknown()).default({}),proxyState:Nr.optional(),appInventory:ui.optional(),labels:Ls,lastSeenAt:Ms.optional(),createdAt:Ms,updatedAt:Ms}).strict().superRefine((e,t)=>{"control-plane-proxy"===e.connectionPath.kind&&"control-plane-proxy"!==e.connectionMode&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy paths require control-plane-proxy connection mode."}),"control-plane-proxy"===e.connectionMode&&"control-plane-proxy"!==e.connectionPath.kind&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy nodes require a control-plane-proxy connection path."})}),Or=d.z.object({id:Ds,nodeId:Ds,name:d.z.string().trim().min(1).max(160),type:d.z.enum(["docker","kubernetes","local"]),status:d.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:d.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),capabilities:d.z.record(d.z.string(),d.z.unknown()).default({}),labels:Ls,createdAt:Ms,updatedAt:Ms}).strict(),_r=d.z.object({instanceId:Ds,runtimeKind:d.z.literal("docker"),state:d.z.enum(["pending","available","stopped","unavailable"]),sampledAt:Ms,cpu:d.z.object({usagePercent:d.z.number().nonnegative()}).strict().optional(),memory:d.z.object({usageBytes:d.z.number().nonnegative(),limitBytes:d.z.number().nonnegative().optional(),usagePercent:d.z.number().nonnegative().optional()}).strict().optional(),network:d.z.object({rxBytes:d.z.number().nonnegative(),txBytes:d.z.number().nonnegative()}).strict().optional(),blockIo:d.z.object({readBytes:d.z.number().nonnegative(),writeBytes:d.z.number().nonnegative()}).strict().optional(),pids:d.z.number().int().nonnegative().optional(),error:d.z.string().trim().max(2048).optional()}).strict(),Pr=d.z.object({modelEndpointProbe:d.z.boolean().optional(),aiSessionHistoryLimit:d.z.boolean().optional(),aiSessionAttachmentRetention:d.z.boolean().optional(),folderPlaces:d.z.boolean().optional(),localFolderNameUpdate:d.z.boolean().optional()}).strip(),jr=d.z.object({ok:d.z.boolean().optional(),role:d.z.string().optional(),nodeId:Ds.optional(),platform:Zs.optional(),arch:ei.optional(),protocolVersion:Cs.optional(),capabilities:Pr.optional(),build:Ni.strip().optional(),process:d.z.object({pid:d.z.number().int().positive(),startIdentity:d.z.string().trim().min(1).optional()}).strip().optional(),listener:d.z.object({host:d.z.string().trim().min(1),port:d.z.number().int().min(1).max(65535)}).strip().optional(),instanceProxy:d.z.object({requests:d.z.number().int().nonnegative(),active:d.z.number().int().nonnegative(),completed:d.z.number().int().nonnegative(),aborted:d.z.number().int().nonnegative(),limitRejected:d.z.number().int().nonnegative(),responseBytes:d.z.number().nonnegative(),totalDurationMs:d.z.number().nonnegative(),maxResponseBytes:d.z.number().int().nonnegative()}).partial().strip().optional(),serverTime:Ms.optional()}).strip(),Dr=d.z.object({bindScope:d.z.enum(["loopback","all-ipv4"]),port:d.z.number().int().min(1).max(65535)}).strict().extend({host:d.z.enum(["127.0.0.1","0.0.0.0"]),status:d.z.enum(["listening","error"]),source:d.z.enum(["bootstrap","persisted"]),error:d.z.string().trim().max(2048).optional()}).strict(),Mr=d.z.object({nodeId:Ds,joinToken:d.z.string().trim().min(1),expiresAt:Ms}).passthrough(),Lr=d.z.object({nodeId:Ds,keyId:Ds,secret:d.z.string().regex(/^[A-Za-z0-9_-]{32,128}$/),pairedAt:Ms}).strict(),qr=d.z.object({id:Ds,keyId:Ds,name:d.z.string().trim().min(1).max(160).optional(),pairedAt:Ms,updatedAt:Ms,current:d.z.boolean()}).passthrough(),$r=d.z.object({keyId:Ds,revoked:d.z.literal(!0),revokedAt:Ms}).strict(),Br=d.z.object({id:Ds,pairingKeyId:Ds,url:d.z.string().trim().min(1).max(2048),name:d.z.string().trim().min(1).max(160).optional(),enabled:d.z.boolean(),createdAt:Ms,updatedAt:Ms,status:d.z.enum(["disabled","connecting","connected","reconnecting","failed"]),pingRttMs:d.z.number().nonnegative().optional(),pingRttP95Ms:d.z.number().nonnegative().optional(),consecutiveReconnects:d.z.number().int().nonnegative().optional(),nextRetryAt:Ms.optional(),lastConnectedAt:Ms.optional(),lastDisconnectedAt:Ms.optional(),error:d.z.string().optional()}).passthrough(),Fr=d.z.object({pairing:qr,connection:d.z.object({id:Ds,pairingKeyId:Ds,url:d.z.string().trim().min(1).max(2048),name:d.z.string().trim().min(1).max(160).optional(),enabled:d.z.boolean(),createdAt:Ms,updatedAt:Ms}).passthrough(),tunnel:d.z.object({status:d.z.enum(["disabled","saved","connecting","connected","failed"]),error:d.z.string().trim().max(2048).optional()}).passthrough()}).passthrough(),Ur=d.z.object({deleted:d.z.boolean().optional()}).passthrough(),Hr=d.z.object({repository:d.z.string().trim().optional(),tag:d.z.string().trim().optional(),id:d.z.string().trim(),createdSince:d.z.string().trim().optional(),size:d.z.string().trim().optional(),sizeBytes:d.z.number().int().nonnegative().optional(),reference:d.z.string().trim().min(1),repoDigests:d.z.array(d.z.string().trim().min(1).max(512)).default([])}).passthrough(),Wr=d.z.object({image:br,status:d.z.enum(["available","pull-required","unknown"]),localImage:Hr.optional(),localSizeBytes:d.z.number().int().nonnegative().optional(),downloadSizeBytes:d.z.number().int().positive().optional(),unpackedSizeBytes:d.z.number().int().positive().optional(),error:d.z.string().trim().max(2048).optional()}).strict(),Gr=d.z.lazy(()=>d.z.object({name:d.z.string().trim().min(1),path:d.z.string().trim().min(1).max(4096),children:d.z.array(Gr)}).passthrough()),Vr=d.z.object({kind:d.z.enum(["home","root"]),name:d.z.string().trim().min(1),path:d.z.string().trim().min(1).max(4096)}).passthrough(),Kr=d.z.object({status:d.z.number().int().min(100).max(599).optional(),headers:d.z.record(d.z.string(),d.z.string()).optional(),bodyBase64:d.z.string().optional()}).passthrough(),Jr=d.z.object({strategy:d.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),web:d.z.string().trim().max(2048).optional(),api:d.z.string().trim().max(2048).optional(),vnc:d.z.string().trim().max(2048).optional(),tty:d.z.string().trim().max(2048).optional(),logs:d.z.string().trim().max(2048).optional(),status:d.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict(),Yr=d.z.object({...Jr.shape}).strict(),Qr=d.z.object({strategy:d.z.enum(["control-plane-proxy","direct-port","node-proxy","kubernetes-ingress","kubernetes-port-forward"]).default("control-plane-proxy"),web:d.z.string().trim().max(2048).optional(),api:d.z.string().trim().max(2048).optional(),ws:d.z.string().trim().max(2048).optional(),status:d.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict().default({strategy:"control-plane-proxy",status:"unknown"}),Xr=d.z.object({mode:d.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]).optional(),status:d.z.enum(["unknown","pending","ready","failed"]).default("unknown"),path:d.z.string().trim().max(4096).optional(),resolvedCommit:d.z.string().trim().max(120).optional(),error:d.z.string().trim().max(2048).optional()}).passthrough(),Zr=d.z.object({id:Ds,name:d.z.string().trim().min(1).max(160),projectId:Ds.optional(),source:Gi,sourceSnapshot:d.z.record(d.z.string(),d.z.unknown()).default({}),modelSelection:Js,nodeId:Ds,runtimeId:Ds,imageSelection:Ys.optional(),environmentSource:Qs.optional(),environmentTemplateOrigin:ni.optional(),imageSnapshot:vr.optional(),imageProvisioning:Sr.optional(),stateRevision:d.z.number().int().min(0).default(0),processIncarnationId:d.z.string().trim().min(1).max(120).optional(),status:d.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]).default("created"),health:d.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),connectionStatus:d.z.enum(["unknown","online","offline","endpoint-unreachable"]).default("unknown"),agentStatus:d.z.enum(["unknown","online","offline"]).default("unknown"),targetStatus:d.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),uiAccessStatus:d.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),controlMode:d.z.enum(["standalone","controlled"]).default("controlled"),protocolVersion:Cs.optional(),instanceVersion:d.z.string().trim().max(80).optional(),build:Ni.optional(),runtimeVersion:ji.optional(),ready:d.z.boolean().default(!1),capabilities:_s.default(xs),appInventory:ui.optional(),config:d.z.object({autoImportAgentConfigs:d.z.boolean().default(!0),defaultCodexPermissionMode:we.default("ask"),aiSessionHistoryLimit:d.z.number().int().min(1).max(at).default(50),aiSessionAttachmentRetentionDays:d.z.number().int().min(0).max(365).default(30)}).strict().default({autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask",aiSessionHistoryLimit:50,aiSessionAttachmentRetentionDays:30}),workspace:Xr.default({status:"unknown"}),target:Jr.default({strategy:"direct-port",status:"unknown"}),access:Qr,apps:d.z.object({runningCount:d.z.number().int().min(0).default(0),problemCount:d.z.number().int().min(0).default(0),updatedAt:Ms.optional(),revision:d.z.number().int().min(0).optional()}).strict().default({runningCount:0,problemCount:0}),aiSessions:mt.default(()=>({runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:(new Date).toISOString()})),triggers:d.z.object({enabledCount:d.z.number().int().min(0).default(0),runningCount:d.z.number().int().min(0).default(0),errorCount:d.z.number().int().min(0).default(0),configs:d.z.array(d.z.object({configHash:d.z.string().trim().min(1),config:On,deployments:d.z.array(Pn).default([]),runtime:d.z.array(jn).default([])}).strict()).default([]),recentRuns:d.z.array(Dn).default([])}).strict().optional(),runtime:d.z.object({kind:d.z.string().trim().max(80).optional(),containerName:d.z.string().trim().max(240).optional(),containerId:d.z.string().trim().max(240).optional(),workspacePath:d.z.string().trim().max(4096).optional(),pid:d.z.number().int().positive().optional(),port:d.z.number().int().positive().max(65535).optional(),labels:d.z.record(d.z.string(),d.z.string()).default({})}).strict().default({labels:{}}),registrationToken:d.z.string().trim().min(1).max(240).optional(),lastHeartbeatAt:Ms.optional(),createdAt:Ms,updatedAt:Ms}).strict(),eo="instance.lifecycle.snapshot",to=d.z.object({instanceId:Zr.shape.id,revision:d.z.number().int().min(0),updatedAt:Ms,status:Zr.shape.status.unwrap(),health:Zr.shape.health.unwrap(),connectionStatus:Zr.shape.connectionStatus.unwrap(),accessStatus:d.z.enum(["reachable","endpoint-unreachable"]),imageProvisioning:Sr.optional(),workspace:Xr,runtime:Zr.shape.runtime.unwrap(),runtimeVersion:ji.optional(),ready:d.z.boolean(),lastHeartbeatAt:Ms.optional()}).strict();function no(e,t,n,s,i){if(!t||"object"!=typeof t||Array.isArray(t))return;let r=structuredClone(t);for(let t=0;t<20;t+=1){const t=e.safeParse(r);if(t.success)return t.data;let n=!1;for(const e of t.error.issues){if("unrecognized_keys"!==e.code)continue;const t=so(r,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const s of e.keys)Object.prototype.hasOwnProperty.call(t,s)&&(delete t[s],n=!0)}if(!n){const n=structuredClone(r);let s=!1;for(const e of t.error.issues){if(!e.path.length||"string"!=typeof e.path.at(-1))continue;const t=so(n,e.path.slice(0,-1)),i=e.path.at(-1);t&&"object"==typeof t&&!Array.isArray(t)&&Object.prototype.hasOwnProperty.call(t,i)&&(delete t[i],s=!0)}if(s){const t=e.safeParse(n);if(t.success)return t.data}break}}}function so(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function io(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries(t.filter(e=>Object.prototype.hasOwnProperty.call(n,e)).map(e=>[e,n[e]]))}d.z.object({instanceId:Ds.optional(),projectId:Ds.optional(),source:Gi.optional(),nodeId:Ds.optional(),runtimeId:Ds.optional(),imageSelection:Ys.optional(),instanceVersion:d.z.string().trim().max(80).optional(),protocolVersion:Cs,build:Ni.optional(),controlMode:d.z.enum(["standalone","controlled"]).default("controlled"),capabilities:_s.default(xs),appInventory:ui.optional(),target:Yr.optional(),workspace:Xr.default({status:"unknown"}),registrationToken:d.z.string().trim().max(240).optional(),processIncarnationId:d.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{Ts.has(e.protocolVersion)&&!e.appInventory&&t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol register payload requires appInventory."})}),d.z.object({status:Zr.shape.status.optional(),health:Zr.shape.health.optional(),protocolVersion:Cs,build:Ni.optional(),capabilities:Zr.shape.capabilities.optional(),appInventory:ui.optional(),apps:Zr.shape.apps.optional(),aiSessions:Zr.shape.aiSessions.optional(),triggers:Zr.shape.triggers.optional(),workspace:Xr.optional(),target:Yr.optional(),processIncarnationId:d.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{Ts.has(e.protocolVersion)&&!e.appInventory&&t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol heartbeat payload requires appInventory."})});const ro=d.z.enum(["web","telegram","wechat","dingding","lark"]),oo=d.z.object({id:Ds,channel:ro,name:d.z.string().trim().min(1).max(160),enabled:d.z.boolean().default(!1),token:d.z.string().trim().max(4096).optional(),defaultChatId:d.z.string().trim().max(240).optional(),allowedUserIds:d.z.array(d.z.string().trim().min(1).max(240)).default([]),pollIntervalMs:d.z.number().int().positive().max(6e4).default(3e3),settings:d.z.record(d.z.string(),d.z.unknown()).default({}),createdAt:Ms,updatedAt:Ms}).strict(),ao=d.z.object({id:Ds,channel:ro,bridgeId:Ds.optional(),chatSessionId:d.z.string().trim().min(1).max(240),userId:d.z.string().trim().max(240).optional(),activeProjectId:Ds.optional(),activeInstanceId:Ds.optional(),activeAiSessionId:d.z.string().trim().min(1).max(120).optional(),lastUsedAt:Ms,createdAt:Ms,updatedAt:Ms}).strict(),co=d.z.object({source:d.z.object({type:d.z.literal("chat-gateway").default("chat-gateway"),channel:ro,bridgeId:Ds.optional(),chatSessionId:d.z.string().trim().min(1).max(240),userId:d.z.string().trim().max(240).optional()}).strict(),message:d.z.object({text:d.z.string().trim().max(2e4).default(""),attachments:d.z.array(Ie).max(6).default([])}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>R&&t.addIssue({code:d.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),target:d.z.object({instanceId:Ds,aiSessionId:d.z.string().trim().min(1).max(120)}).strict().optional()}).strict(),lo=d.z.object({id:Ds,instanceId:Ds,projectId:Ds.optional(),aiSessionId:d.z.string().trim().min(1).max(120),providerSessionId:d.z.string().trim().max(240).optional(),result:d.z.string().default(""),timeoutMs:d.z.number().positive().optional(),source:d.z.string().trim().max(120).optional(),kind:d.z.enum(["task","approval"]).default("task"),status:d.z.enum(["pending","unreachable"]).default("pending"),error:d.z.string().trim().max(2048).optional(),lastSeenAt:Ms}).strict();function po(e){return!1!==e.ready&&(!e.runtimeVersion||["matched","failed"].includes(e.runtimeVersion.phase))}const uo=6048e5;function ho(e,n){const s=t.resolve(e),i=t.resolve(s,n);if(t.dirname(i)!==s||t.basename(i)!==n)throw new Error(`Retention entry is not a direct child of its managed root: ${n}`);return i}function mo(e){if(n.existsSync(e)){const t=n.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw new Error(`Managed persistence path must be a real directory: ${e}`)}n.mkdirSync(e,{recursive:!0,mode:448}),n.chmodSync(e,448)}function go(e){return e.startsWith("ai-session.")||e.startsWith("ai.session.")?"ai.sessions":e.startsWith("app-session.")?"app.sessions":e.startsWith("app.management")?"apps":e.startsWith("trigger.")?"triggers":e.startsWith("instance.")?"instances":e.startsWith("node.")?"nodes":e.startsWith("project.")?"projects":e.startsWith("model.")?"models":e.startsWith("image.")?"images":e.startsWith("market.")?"market":"system"}const yo=d.z.object({replaySince:d.z.string().datetime().optional(),messageDeltas:d.z.object({allInstances:d.z.boolean().default(!1),instanceIds:d.z.array(d.z.string().trim().min(1).max(160)).max(1e3).default([])}).default({allInstances:!1,instanceIds:[]}),timelineAllSessions:d.z.boolean().default(!1),timelineSessions:d.z.array(d.z.object({instanceId:d.z.string().trim().min(1).max(160),sessionId:d.z.string().trim().min(1).max(120)})).max(1e3).default([])});function fo(e,t){if(!e)return!0;if("ai-session.message-delta"!==t.type&&"ai-session.timeline-item"!==t.type)return!0;const n=t.payload&&"object"==typeof t.payload&&!Array.isArray(t.payload)?t.payload:{},s=String(n.instanceId||t.scope?.instanceId||"");return"ai-session.message-delta"===t.type?e.messageDeltas.allInstances||e.messageDeltas.instanceIds.includes(s):e.timelineAllSessions||e.timelineSessions.some(e=>e.instanceId===s&&e.sessionId===n.sessionId)}const Io=d.z.enum(["ai.sessions","app.sessions"]),bo=d.z.object({topic:Io,instanceId:d.z.string().trim().min(1).max(160),streamId:d.z.string().trim().min(1).max(240),latestRevision:d.z.number().int().min(0),earliestRetainedRevision:d.z.number().int().min(0)}).strict(),vo=d.z.object({protocolVersion:d.z.literal(1),streams:d.z.array(bo)}).strict(),So=d.z.object({authentication:d.z.enum(["required","disabled"]),aiSessions:d.z.boolean(),nodes:d.z.boolean(),instanceBoard:d.z.boolean(),triggers:d.z.boolean().optional()}).strict(),wo=d.z.object({version:d.z.literal(1),kind:d.z.literal("control-plane"),controlPlaneId:d.z.string().trim().min(1).max(160),publicKey:d.z.object({algorithm:d.z.literal("Ed25519"),encoding:d.z.literal("base64url"),value:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),fingerprint:d.z.string().regex(/^sha256:[A-Za-z0-9_-]{43}$/)}).strict(),capabilities:So,protocolVersion:d.z.string().regex(/^\d{4}-\d{2}-\d{2}$/),issuedAt:d.z.string().datetime(),expiresAt:d.z.string().datetime()}).strict(),Ao=d.z.object({data:d.z.object({payload:wo,signature:d.z.string().regex(/^[A-Za-z0-9_-]{86}$/)}).strict()}).strict(),zo=d.z.object({id:d.z.string().trim().min(8).max(160),name:d.z.string().trim().min(1).max(160),platform:d.z.enum(["ios","android"]),appVersion:d.z.string().trim().min(1).max(80).optional()}).strict(),ko=d.z.object({username:d.z.string().trim().min(1).max(80),password:d.z.string().min(1).max(4096),device:zo}).strict(),To=d.z.object({id:d.z.string().trim().min(1),username:d.z.string().trim().min(1).max(80),role:d.z.enum(["viewer","operator","admin"]),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime(),lastLoginAt:d.z.string().datetime().optional()}).strict(),Co=d.z.object({id:d.z.string().trim().min(1),expiresAt:d.z.string().datetime(),createdAt:d.z.string().datetime(),lastSeenAt:d.z.string().datetime().optional(),device:zo,user:To}).strict();function Eo(){return(new Date).toISOString()}d.z.object({data:d.z.object({sessionToken:d.z.string().trim().min(32),session:Co}).strict()}).strict(),d.z.object({data:d.z.array(Co)}).strict(),d.z.object({data:d.z.object({revoked:d.z.boolean()}).strict()}).strict();function xo(e,t=448){n.mkdirSync(e,{recursive:!0,mode:t}),n.chmodSync(e,t)}function No(e,s,i={}){const r=i.directoryMode??448,o=i.fileMode??384;xo(t.dirname(e),r),l.sync(e,`${JSON.stringify(s,null,2)}\n`,{encoding:"utf8",mode:o}),n.chmodSync(e,o)}function Ro(e,t){console.warn(JSON.stringify({message:e,...t}))}function Oo(e){return e&&"object"==typeof e&&"issues"in e?{issues:e.issues}:{error:e instanceof Error?e.message:String(e)}}function _o(e,t){const s=t.logger||Ro;let i;try{i=JSON.parse(n.readFileSync(e,"utf8"))}catch(t){return void s("stored JSON could not be read",{filePath:e,...Oo(t)})}if(!t.schema)return i;const r=t.sanitize?t.sanitize(i):i,o=t.schema.safeParse(r);if(o.success)return o.data;const a="strip"in t.schema&&"function"==typeof t.schema.strip?t.schema.strip().safeParse(r):void 0;if(a?.success)return s("unknown stored fields were ignored",{filePath:e,issues:o.error.issues}),a.data;s("stored record failed validation and was isolated",{filePath:e,issues:o.error.issues})}function Po(e){return`${e}_${s.randomUUID().replace(/-/g,"").slice(0,20)}`}function jo(){return s.randomBytes(24).toString("base64url")}class Do{directory;options;permissionsInitialized=!1;constructor(e,t={}){this.directory=e,this.options=t}init(){if(this.permissionsInitialized&&n.existsSync(this.directory))return;xo(this.directory,this.options.directoryMode??448);const e=this.options.fileMode??384;for(const s of n.readdirSync(this.directory).filter(e=>e.endsWith(".json")))n.chmodSync(t.join(this.directory,s),e);this.permissionsInitialized=!0}filePath(e){return t.join(this.directory,`${e}.json`)}list(){return this.init(),n.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const n=_o(t.join(this.directory,e),this.options);return n?[n]:[]})}get(e){this.init();const t=this.filePath(e);return n.existsSync(t)?_o(t,this.options):void 0}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return No(this.filePath(n.id),n,this.options),n}patch(e,t){const n=this.get(e);if(!n)return;const s={...n,...t,id:n.id,createdAt:n.createdAt,updatedAt:(new Date).toISOString()};return this.put(s)}delete(e){const t=this.filePath(e);return!!n.existsSync(t)&&(n.unlinkSync(t),!0)}}class Mo{filePathValue;defaults;options;constructor(e,t,n={}){this.filePathValue=e,this.defaults=t,this.options=n}init(){xo(t.dirname(this.filePathValue),this.options.directoryMode??448),n.existsSync(this.filePathValue)?n.chmodSync(this.filePathValue,this.options.fileMode??384):this.put(this.defaults())}get(){return this.init(),n.existsSync(this.filePathValue)?_o(this.filePathValue,this.options)??this.defaults():this.defaults()}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return No(this.filePathValue,n,this.options),n}}const Lo=c.promisify(s.scrypt),qo="task_handoff_cp_session",$o=d.z.enum(["disabled","password"]),Bo=d.z.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9_.@-]+$/),Fo=d.z.string().min(8).max(4096),Uo=d.z.object({username:Bo,password:Fo}).strict(),Ho=d.z.object({username:d.z.string().trim().min(1).max(80),password:d.z.string().min(1).max(4096)}).strict(),Wo=d.z.object({currentPassword:d.z.string().min(1).max(4096),newPassword:Fo}).strict(),Go=d.z.object({username:Bo,password:Fo}).strict(),Vo=d.z.object({id:d.z.string().trim().min(1),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}),Ko=Vo.extend({username:Bo,passwordHash:d.z.string().trim().min(1),role:d.z.enum(["viewer","operator","admin"]),lastLoginAt:d.z.string().datetime().optional()}).strict(),Jo=Vo.extend({userId:d.z.string().trim().min(1),tokenHash:d.z.string().trim().min(1),expiresAt:d.z.string().datetime(),lastSeenAt:d.z.string().datetime().optional(),clientType:d.z.enum(["web","mobile"]).default("web"),device:zo.optional()}).strict().refine(e=>"mobile"!==e.clientType||Boolean(e.device),{path:["device"],message:"Mobile sessions require device metadata."});function Yo(e,t){return Number.isInteger(e)&&Number(e)>0?Number(e):t}class Qo{options;sourceFailures=new Map;usernameFailures=new Map;concurrent=0;constructor(e={}){this.options=function(e={}){return{windowMs:Yo(e.windowMs,9e5),maxFailuresPerSource:Yo(e.maxFailuresPerSource,20),maxFailuresPerUsername:Yo(e.maxFailuresPerUsername,10),maxConcurrent:Yo(e.maxConcurrent,4)}}(e)}begin(e,t){const n=Date.now();if(this.assertBucketAvailable(this.sourceFailures,e,this.options.maxFailuresPerSource,n),this.assertBucketAvailable(this.usernameFailures,t,this.options.maxFailuresPerUsername,n),this.concurrent>=this.options.maxConcurrent)throw Xo("Too many password verifications are already in progress.",1e3);this.concurrent+=1}finish(){this.concurrent=Math.max(0,this.concurrent-1)}recordFailure(e,t){const n=Date.now();this.record(this.sourceFailures,e,n),this.record(this.usernameFailures,t,n),this.sourceFailures.size+this.usernameFailures.size>1e4&&(this.pruneAll(n),this.trimOldest(this.sourceFailures,5e3),this.trimOldest(this.usernameFailures,5e3))}assertBucketAvailable(e,t,n,s){const i=this.currentFailures(e,t,s);if(!(i.length<n))throw Xo("Too many failed sign-in attempts. Try again later.",i[0]+this.options.windowMs-s)}record(e,t,n){const s=this.currentFailures(e,t,n);s.push(n),e.set(t,s)}currentFailures(e,t,n){const s=n-this.options.windowMs,i=(e.get(t)||[]).filter(e=>e>s);return i.length?e.set(t,i):e.delete(t),i}pruneAll(e){for(const[t]of this.sourceFailures)this.currentFailures(this.sourceFailures,t,e);for(const[t]of this.usernameFailures)this.currentFailures(this.usernameFailures,t,e)}trimOldest(e,t){for(;e.size>t;){const t=e.keys().next().value;if(void 0===t)return;e.delete(t)}}}function Xo(e,t){const n=new Error(e);return Object.assign(n,{statusCode:429,code:"AUTH_LOGIN_RATE_LIMITED",retryable:!0,retryAfterSeconds:Math.max(1,Math.ceil(t/1e3))}),n}function Zo(e){return s.createHash("sha256").update(e).digest("base64url")}async function ea(e){const t=s.randomBytes(16).toString("base64url");return`scrypt$${t}$${(await Lo(e,t,64)).toString("base64url")}`}async function ta(e,t){const[n,i,r]=t.split("$");if("scrypt"!==n||!i||!r)return!1;const o=await Lo(e,i,64),a=Buffer.from(r,"base64url");return a.length===o.length&&s.timingSafeEqual(a,o)}function na(e){return{id:e.id,username:e.username,role:e.role,createdAt:e.createdAt,updatedAt:e.updatedAt,lastLoginAt:e.lastLoginAt}}function sa(e,t){return Co.parse({id:e.id,expiresAt:e.expiresAt,createdAt:e.createdAt,lastSeenAt:e.lastSeenAt,device:e.device,user:na(t)})}class ia{mode;users;sessions;loginRateLimiter;bootstrapAdminInProgress=!1;credentialUpdateInProgress=!1;constructor(e,t={}){this.mode=function(e={}){return $o.parse(e.mode||process.env.TASK_HANDOFF_CONTROL_PLANE_AUTH_MODE||"disabled")}(t),this.users=new Do(e.authUsersDir,{schema:Ko}),this.sessions=new Do(e.authSessionsDir,{schema:Jo}),this.loginRateLimiter=new Qo(t.loginRateLimit)}init(){this.users.init(),this.sessions.init()}enabled(){return"password"===this.mode}state(){return{mode:this.mode,enabled:this.enabled(),requiresBootstrap:this.enabled()&&0===this.users.list().length}}async bootstrapAdmin(e){if(!this.enabled()){const e=new Error("Control Plane authentication is disabled.");throw Object.assign(e,{statusCode:400,code:"AUTH_DISABLED"}),e}if(this.bootstrapAdminInProgress){const e=new Error("Control Plane admin initialization is already in progress.");throw Object.assign(e,{statusCode:409,code:"AUTH_BOOTSTRAP_IN_PROGRESS"}),e}if(this.users.list().length>0){const e=new Error("Control Plane admin user already exists.");throw Object.assign(e,{statusCode:409,code:"AUTH_BOOTSTRAP_ALREADY_DONE"}),e}const t=Uo.parse(e);this.bootstrapAdminInProgress=!0;try{const e=Eo();return na(this.users.put({id:Po("user"),username:t.username,passwordHash:await ea(t.password),role:"admin",createdAt:e,updatedAt:e}))}finally{this.bootstrapAdminInProgress=!1}}async login(e,t={}){if(!this.enabled()){const e=new Error("Control Plane authentication is disabled.");throw Object.assign(e,{statusCode:400,code:"AUTH_DISABLED"}),e}const n=Ho.parse(e),s=await this.authenticate(n.username,n.password,t),i=this.createSession(s,"web");return{user:na(s),sessionToken:i.token,expiresAt:i.record.expiresAt}}async loginMobile(e,t={}){const n=ko.parse(e),s=await this.authenticate(n.username,n.password,t),i=this.createSession(s,"mobile",n.device);return{sessionToken:i.token,session:sa(i.record,s)}}async changePassword(e,t,n={}){const s=this.resolveSessionToken(e,"web");if(!s){const e=new Error("Sign in to change the password.");throw Object.assign(e,{statusCode:401,code:"CONTROL_PLANE_AUTH_REQUIRED"}),e}const i=Wo.parse(t);if(this.credentialUpdateInProgress){const e=new Error("Control Plane credentials are already being updated.");throw Object.assign(e,{statusCode:409,code:"AUTH_CREDENTIAL_UPDATE_IN_PROGRESS"}),e}this.credentialUpdateInProgress=!0;const r=String(n.sourceId||"unknown").trim()||"unknown",o=s.storedUser.username.toLocaleLowerCase("en-US");let a=!1;try{if(this.loginRateLimiter.begin(r,o),a=!0,!await ta(i.currentPassword,s.storedUser.passwordHash)){this.loginRateLimiter.recordFailure(r,o);const e=new Error("The current password is incorrect.");throw Object.assign(e,{statusCode:400,code:"AUTH_CURRENT_PASSWORD_INVALID"}),e}if(await ta(i.newPassword,s.storedUser.passwordHash)){const e=new Error("The new password must be different from the current password.");throw Object.assign(e,{statusCode:400,code:"AUTH_PASSWORD_UNCHANGED"}),e}const e=Eo(),t=this.users.put({...s.storedUser,passwordHash:await ea(i.newPassword),updatedAt:e});this.revokeUserSessions(t.id);const n=this.createSession(t,"web");return{user:na(t),sessionToken:n.token,expiresAt:n.record.expiresAt}}finally{a&&this.loginRateLimiter.finish(),this.credentialUpdateInProgress=!1}}async replaceCredentials(e){const t=Go.parse(e),n=this.users.list();if(0===n.length){const e=new Error("Control Plane administrator has not been initialized.");throw Object.assign(e,{statusCode:409,code:"AUTH_ACCOUNT_NOT_INITIALIZED"}),e}if(1!==n.length){const e=new Error("The account to update is ambiguous.");throw Object.assign(e,{statusCode:409,code:"AUTH_ACCOUNT_AMBIGUOUS"}),e}const s=Eo(),i=this.users.put({...n[0],username:t.username,passwordHash:await ea(t.password),updatedAt:s});return this.revokeUserSessions(i.id),na(i)}async authenticate(e,t,n){if(!this.enabled()){const e=new Error("Control Plane authentication is disabled.");throw Object.assign(e,{statusCode:400,code:"AUTH_DISABLED"}),e}const s=String(n.sourceId||"unknown").trim()||"unknown",i=e.toLocaleLowerCase("en-US");this.loginRateLimiter.begin(s,i);try{const n=this.users.list().find(t=>t.username===e);if(!n||!await ta(t,n.passwordHash)){this.loginRateLimiter.recordFailure(s,i);const e=new Error("Invalid username or password.");throw Object.assign(e,{statusCode:401,code:"AUTH_LOGIN_FAILED"}),e}const r=Eo();return this.users.put({...n,lastLoginAt:r,updatedAt:r})}finally{this.loginRateLimiter.finish()}}createSession(e,t,n){const s=Eo(),i=jo(),r=this.sessions.put({id:Po("mobile"===t?"msess":"sess"),userId:e.id,tokenHash:Zo(i),expiresAt:new Date(Date.now()+12096e5).toISOString(),createdAt:s,updatedAt:s,lastSeenAt:s,clientType:t,...n?{device:n}:{}});return{record:r,token:`${r.id}.${i}`}}revokeUserSessions(e){for(const t of this.sessions.list())t.userId===e&&this.sessions.delete(t.id)}async userForSessionToken(e){const t=this.resolveSessionToken(e,"web");return t?.user}async userForMobileSessionToken(e){const t=this.resolveSessionToken(e,"mobile");return t?.user}resolveSessionToken(e,t){if(!this.enabled()||!e)return;const[n,s]=e.split(".");if(!n||!s)return;const i=this.sessions.get(n);if(!i||t&&i.clientType!==t||i.expiresAt<=Eo()||i.tokenHash!==Zo(s))return;const r=this.users.get(i.userId);if(!r)return;const o=Eo();return{session:this.sessions.put({...i,lastSeenAt:o,updatedAt:o}),user:na(r),storedUser:r}}async currentSession(e,t="web"){const n=this.state(),s="mobile"===t?await this.userForMobileSessionToken(e):await this.userForSessionToken(e);return{...n,authenticated:!this.enabled()||Boolean(s),user:s}}logout(e){const t=e?.split(".")[0];return t&&this.sessions.delete(t),{ok:!0}}mobileSessions(e){const t=this.resolveSessionToken(e);if(t)return this.sessions.list().filter(e=>"mobile"===e.clientType&&e.userId===t.storedUser.id&&e.expiresAt>Eo()).map(e=>sa(e,t.storedUser))}revokeMobileSession(e,t){const n=this.resolveSessionToken(e);if(!n)return;const s=this.sessions.get(t);return!(!s||"mobile"!==s.clientType||s.userId!==n.storedUser.id)&&this.sessions.delete(s.id)}}function ra(e,t){let n=la(t);for(let t=0;t<100;t+=1){const t=e.safeParse(n);if(t.success)return t;const s=aa(t.error.issues);let i=!1;for(const e of s){const t=ca(n,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const n of e.keys)Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],i=!0)}if(!i)return t}return e.safeParse(n)}function oa(e,t){const n=ra(e,t);if(!n.success)throw n.error;return n.data}function aa(e,t=[]){const n=[];for(const s of e){if("unrecognized_keys"===s.code){n.push({code:"unrecognized_keys",keys:s.keys,path:[...t,...s.path]});continue}if("invalid_union"!==s.code||!Array.isArray(s.errors))continue;const e=s.errors.filter(e=>Array.isArray(e));if(!e.length)continue;const i=e.reduce((e,t)=>da(t)<da(e)?t:e);n.push(...aa(i,[...t,...s.path]))}return n}function da(e){return e.reduce((e,t)=>{if("unrecognized_keys"===t.code)return e;if("invalid_union"!==t.code||!Array.isArray(t.errors))return e+1;const n=t.errors.filter(e=>Array.isArray(e));return e+(n.length?Math.min(...n.map(da)):1)},0)}function ca(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function la(e){return Array.isArray(e)?e.map(la):e&&"object"==typeof e?Object.getPrototypeOf(e)!==Object.prototype&&null!==Object.getPrototypeOf(e)?e:Object.fromEntries(Object.entries(e).map(([e,t])=>[e,la(t)])):e}const pa=d.z.enum(["import","export"]),ua=d.z.object({id:d.z.string().trim().min(1).max(120),label:d.z.string().trim().min(1).max(120),directoryName:d.z.string().trim().min(1).max(120)}).strict(),ha=d.z.object({direction:pa,programIds:d.z.array(d.z.string().trim().min(1).max(120)).min(1).max(20).refine(e=>new Set(e).size===e.length,"Config sync program ids must be unique."),workspaceFolder:d.z.string().trim().min(1).max(1e3)}).strict(),ma=d.z.object({import:d.z.string().trim().min(1).max(1e3).default("."),export:d.z.string().trim().min(1).max(1e3).default(".")}).strict(),ga=d.z.object({programs:d.z.array(ua),preferences:ma}).strict(),ya=d.z.object({id:d.z.string().trim().min(1).max(120),type:d.z.enum(["file","dir"]),projectPath:d.z.string().trim().min(1).max(1e3),containerPath:d.z.string().trim().min(1).max(1e3),source:d.z.string().trim().min(1).max(4096),target:d.z.string().trim().min(1).max(4096),status:d.z.enum(["copied","skipped_missing_source","failed"]),error:d.z.string().trim().max(4096).optional()}).strict(),fa=d.z.object({preset:d.z.object({id:d.z.string().trim().min(1).max(120),label:d.z.string().trim().min(1).max(120),projectRoot:d.z.string().trim().min(1).max(1e3)}).strict(),direction:pa,items:d.z.array(ya).max(100)}).strict(),Ia=d.z.object({direction:pa,workspaceFolder:d.z.string().trim().min(1).max(1e3),programs:d.z.array(fa).min(1).max(20)}).strict(),ba="x-task-handoff-trace-id";function va(e,t){return`${e};dur=${(Number.isFinite(t)?Math.max(0,t):0).toFixed(1)}`}function Sa(...e){return e.map(e=>String(e||"").trim()).filter(Boolean).join(", ")}const wa=d.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Aa=d.z.string().datetime(),za=d.z.string().trim().min(1).max(255).refine(e=>!(/[\u0000-\u001f\u007f ~^:?*[\\]/.test(e)||e.includes("..")||e.endsWith(".")||e.endsWith("/")),"Invalid Git name."),ka=d.z.string().min(1).max(4096).refine(e=>!(e.includes("\0")||e.startsWith("/")||e.startsWith("\\")||/^[a-zA-Z]:[\\/]/.test(e))&&e.split("/").every(e=>e.length>0&&"."!==e&&".."!==e&&".git"!==e),"Path must be a safe repository-relative path."),Ta=d.z.enum(["ai-session","app-session"]),Ca=d.z.enum(["available","session-not-found","session-inactive","cwd-missing","cwd-inaccessible","git-unavailable","not-worktree"]),Ea=d.z.enum(["branch","detached","unborn"]),xa=d.z.enum(["review-changes","resolve-conflicts","publish-branch","push","pull","diverged","up-to-date"]),Na=d.z.enum(["conflict","staged","unstaged","untracked"]),Ra=d.z.enum(["added","modified","deleted","renamed","copied","type-changed","unmerged","untracked"]),Oa=d.z.object({state:Ea,oid:d.z.string().regex(/^[0-9a-f]{40,64}$/).optional(),branch:d.z.string().min(1).max(1024).optional()}).strict(),_a=d.z.object({ref:d.z.string().min(1).max(2048),remote:za,branch:d.z.string().min(1).max(1024),ahead:d.z.number().int().nonnegative(),behind:d.z.number().int().nonnegative()}).strict(),Pa=d.z.object({id:wa,isCurrent:d.z.boolean(),isMain:d.z.boolean(),managed:d.z.boolean(),head:Oa,dirty:d.z.boolean(),locked:d.z.boolean(),lockReason:d.z.string().max(1e3).optional(),prunable:d.z.boolean(),activeAiSessionIds:d.z.array(wa).max(256).default([]),activeAppSessionIds:d.z.array(wa).max(256).default([])}).strict(),ja=d.z.enum(["main-worktree","external-worktree","outside-workspace-roots","dirty","locked","prunable","session-occupied","path-inaccessible"]),Da=Pa.extend({canCreateAiSession:d.z.boolean(),canRemove:d.z.boolean(),createAiSessionBlockers:d.z.array(ja).max(16).default([]),removeBlockers:d.z.array(ja).max(16).default([])}).strict(),Ma=d.z.object({repositoryId:wa,repositoryContextId:wa,snapshotId:wa,items:d.z.array(Da).max(1e4)}).strict(),La=d.z.object({conflicts:d.z.number().int().nonnegative(),staged:d.z.number().int().nonnegative(),unstaged:d.z.number().int().nonnegative(),untracked:d.z.number().int().nonnegative()}).strict(),qa=d.z.object({name:za,fetchUrl:d.z.string().max(4096).optional(),pushUrl:d.z.string().max(4096).optional()}).strict(),$a=d.z.object({availability:Ca,sessionKind:Ta,sessionId:wa,observedAt:Aa,snapshotId:wa.optional(),repositoryId:wa.optional(),repositoryContextId:wa.optional(),repositoryRoot:d.z.string().min(1).max(4096).optional(),displayName:d.z.string().trim().min(1).max(255).optional(),cwdRelativePath:d.z.string().max(4096).optional(),head:Oa.optional(),upstream:_a.optional(),currentWorktree:Pa.optional(),changes:La.optional(),remotes:d.z.array(qa).max(128).optional(),primaryAction:xa.optional()}).strict(),Ba=d.z.enum(["directory","file","symlink","submodule","nested-repository","special"]),Fa=d.z.object({executable:d.z.boolean(),gitMode:d.z.enum(["100644","100755","120000","160000"]).optional()}).strict(),Ua=d.z.object({name:d.z.string().min(1).max(1024),path:ka,kind:Ba,traversable:d.z.boolean(),editable:d.z.boolean(),size:d.z.number().int().nonnegative().optional(),mode:Fa.optional()}).strict();d.z.object({path:d.z.string().max(4096),entries:d.z.array(Ua).max(1e4),snapshotId:wa}).strict();const Ha=d.z.string().min(16).max(160).regex(/^[a-zA-Z0-9_.:-]+$/),Wa=d.z.object({path:ka,content:d.z.string(),byteLength:d.z.number().int().nonnegative(),version:Ha,mode:Fa}).strict(),Ga=d.z.object({path:ka,oldPath:ka.optional(),scope:Na,status:Ra,version:Ha,binary:d.z.boolean().default(!1)}).strict(),Va=d.z.object({snapshotId:wa,summary:La,entries:d.z.array(Ga).max(1e5)}).strict();d.z.object({file:Wa.optional(),snapshotId:wa,context:$a,changes:Va}).strict();const Ka=d.z.object({kind:d.z.enum(["metadata","hunk","context","addition","deletion"]),content:d.z.string(),oldLine:d.z.number().int().positive().optional(),newLine:d.z.number().int().positive().optional(),oldStart:d.z.number().int().nonnegative().optional(),oldCount:d.z.number().int().nonnegative().optional(),newStart:d.z.number().int().nonnegative().optional(),newCount:d.z.number().int().nonnegative().optional(),heading:d.z.string().optional(),hunkId:d.z.string().min(1).max(200).optional()}).strict();d.z.object({path:ka,oldPath:ka.optional(),scope:Na,binary:d.z.boolean(),complete:d.z.boolean(),truncated:d.z.boolean(),byteLimit:d.z.number().int().positive(),content:d.z.string(),lines:d.z.array(Ka).max(2e5),contextGaps:d.z.array(d.z.object({gapId:d.z.string().min(1).max(500),beforeHunkId:d.z.string().min(1).max(200).optional(),afterHunkId:d.z.string().min(1).max(200).optional(),lines:d.z.array(Ka).max(6e3),startLineCount:d.z.number().int().nonnegative().max(3e3),hasMore:d.z.boolean()}).strict()).max(2e4),version:Ha,snapshotId:wa}).strict();const Ja=d.z.object({name:d.z.string().min(1).max(1024),oid:d.z.string().regex(/^[0-9a-f]{40,64}$/),kind:d.z.enum(["local","remote-tracking"]),current:d.z.boolean(),upstream:d.z.string().min(1).max(2048).optional(),ahead:d.z.number().int().nonnegative().optional(),behind:d.z.number().int().nonnegative().optional(),checkedOutWorktreeIds:d.z.array(wa).max(256).default([])}).strict(),Ya=d.z.object({snapshotId:wa,branches:d.z.array(Ja).max(1e5)}).strict();d.z.object({snapshotId:wa,context:$a,branches:Ya}).strict(),d.z.object({ok:d.z.literal(!0),snapshotId:wa,context:$a,changes:Va.optional(),commitOid:d.z.string().regex(/^[0-9a-f]{40,64}$/).optional()}).strict();const Qa=d.z.enum(["REPOSITORY_REQUEST_INVALID","REPOSITORY_SESSION_NOT_FOUND","REPOSITORY_SESSION_INACTIVE","REPOSITORY_CWD_MISSING","REPOSITORY_CWD_INACCESSIBLE","REPOSITORY_GIT_UNAVAILABLE","REPOSITORY_NOT_WORKTREE","REPOSITORY_PATH_INVALID","REPOSITORY_PATH_FORBIDDEN","REPOSITORY_FILE_NOT_FOUND","REPOSITORY_FILE_EXISTS","REPOSITORY_FILE_UNSUPPORTED","REPOSITORY_FILE_TOO_LARGE","REPOSITORY_FILE_BINARY","REPOSITORY_FILE_STALE","REPOSITORY_STATE_STALE","REPOSITORY_WORKTREE_NOT_FOUND","REPOSITORY_WORKTREE_OCCUPIED","REPOSITORY_WORKTREE_UNSAFE","REPOSITORY_BRANCH_INVALID","REPOSITORY_BRANCH_OCCUPIED","REPOSITORY_BRANCH_UNMERGED","REPOSITORY_CONFLICT","REPOSITORY_DIRTY","REPOSITORY_NOTHING_TO_COMMIT","REPOSITORY_IDENTITY_MISSING","REPOSITORY_HOOK_FAILED","REPOSITORY_SIGNING_FAILED","REPOSITORY_AUTHENTICATION_FAILED","REPOSITORY_NON_FAST_FORWARD","REPOSITORY_UPSTREAM_MISSING","REPOSITORY_COMMAND_TIMEOUT","REPOSITORY_OUTPUT_LIMIT","REPOSITORY_OPERATION_ABORTED","REPOSITORY_OPERATION_FAILED"]);d.z.object({ok:d.z.literal(!1),error:d.z.object({code:Qa,message:d.z.string().trim().min(1).max(2e3),retryable:d.z.boolean(),details:d.z.record(d.z.string(),d.z.union([d.z.string(),d.z.number(),d.z.boolean()])).optional()}).strict()}).strict();const Xa=d.z.object({expectedSnapshotId:wa}).strict(),Za=d.z.object({path:ka,expectedVersion:Ha}).strict();d.z.object({path:ka,content:d.z.string().max(4194304),expectedAbsent:d.z.literal(!0),expectedSnapshotId:wa}).strict(),d.z.object({path:ka,content:d.z.string().max(4194304),expectedVersion:Ha,expectedSnapshotId:wa}).strict(),d.z.object({path:ka,destination:ka,expectedVersion:Ha,expectedDestinationAbsent:d.z.literal(!0),expectedSnapshotId:wa}).strict(),d.z.object({path:ka,expectedVersion:Ha,expectedSnapshotId:wa,confirm:d.z.literal(!0)}).strict(),Xa.extend({paths:d.z.array(Za).min(1).max(1e3)}).strict(),Xa.extend({paths:d.z.array(Za).min(1).max(1e3)}).strict(),Xa.extend({paths:d.z.array(Za).min(1).max(1e3),confirm:d.z.literal(!0)}).strict(),Xa.extend({paths:d.z.array(Za).min(1).max(1e3),confirm:d.z.literal(!0)}).strict(),Xa.extend({message:d.z.string().trim().min(1).max(65536)}).strict();const ed=d.z.discriminatedUnion("mode",[d.z.object({mode:d.z.literal("new-branch"),branchName:za,startRef:d.z.string().trim().min(1).max(2048),expectedSnapshotId:wa}).strict(),d.z.object({mode:d.z.literal("existing-branch"),branchName:za,expectedSnapshotId:wa}).strict()]);Xa.extend({worktreeId:wa,confirm:d.z.literal(!0)}).strict(),d.z.object({worktreeId:wa,worktrees:Ma}).strict(),d.z.object({removedWorktreeId:wa,branchRetained:d.z.boolean(),worktrees:Ma}).strict();const td=d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal("current")}).strict(),d.z.object({type:d.z.literal("worktree"),repositoryContextId:wa,worktreeId:wa}).strict()]);d.z.object({agent:d.z.enum(["codex","claude"]),workspaceSelection:td,message:d.z.string().trim().min(1).max(2e4),clientRequestId:wa,permissionMode:d.z.enum(["ask","auto-review","full-access"]).optional()}).strict(),d.z.object({agent:d.z.enum(["codex","claude"]),worktree:ed,message:d.z.string().trim().min(1).max(2e4),clientRequestId:wa,permissionMode:d.z.enum(["ask","auto-review","full-access"]).optional()}).strict(),d.z.object({aiSessionId:wa,providerSessionId:d.z.string().trim().min(1).max(240),worktreeId:wa,disposition:d.z.literal("started")}).strict();const nd=d.z.object({name:d.z.string().min(1).max(1024),kind:d.z.enum(["branch","head"]).default("branch"),current:d.z.boolean(),currentFolderSelectable:d.z.boolean(),worktreeSelectable:d.z.boolean(),worktreeCheckout:d.z.enum(["attached","detached"]).default("attached"),currentFolderReason:d.z.enum(["dirty","session-occupied","branch-occupied"]).optional(),worktreeReason:d.z.enum(["current-branch","branch-occupied","worktree-unavailable"]).optional()}).strict(),sd=d.z.object({availability:Ca,currentBranch:d.z.string().min(1).max(1024).optional(),dirty:d.z.boolean().default(!1),branches:d.z.array(nd).max(1e5).default([])}).strict();d.z.object({cwd:Le}).strict();const id=$e;qe.extend({gitSelection:id}).strict(),Be.extend({cwd:Le,gitSelection:id}).strict(),Xa.extend({name:za}).strict(),Xa.extend({branch:d.z.string().trim().min(1).max(2048)}).strict(),Xa.extend({name:za,remoteTrackingRef:d.z.string().trim().min(1).max(2048)}).strict(),Xa.extend({name:za,confirm:d.z.literal(!0)}).strict(),Xa.extend({remote:za}).strict(),Xa.extend({remote:za,sourceBranch:za,targetBranch:za,setUpstream:d.z.boolean(),confirmSetUpstream:d.z.boolean().optional()}).strict().refine(e=>!e.setUpstream||!0===e.confirmSetUpstream,{message:"Setting an upstream requires explicit confirmation.",path:["confirmSetUpstream"]}),Xa.extend({remote:za,sourceBranch:za,targetBranch:za}).strict();class rd{options;resumeSnapshotRefreshFailures=0;lastResumeSnapshotRefreshFailure;constructor(e){this.options=e}async resolveApproval(e,t,n){return oa(ot,await this.post(e,ld(t,"approval"),{decision:n}))}async listHistory(e){return oa(ct,await this.get(e,"/ai-sessions/history"))}async historyDetail(e,t){return oa(lt,await this.get(e,`/ai-sessions/history/${encodeURIComponent(t)}`))}async detail(e,t){return oa(rt,await this.get(e,`/ai-sessions/${encodeURIComponent(t)}`))}async timeline(e,t){const n=await this.options.requireInstance(e);if(!function(e){return js(e.capabilities,"session-read").length>0}(n))throw function(){const e=new Error("The controlled instance does not support AI session Timeline reads.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_TIMELINE_UNSUPPORTED"}),e}();return oa(le,await this.options.request(n,ld(t,"timeline"),{method:"GET"}))}async turnTimeline(e,t,n){const s=await this.options.requireInstance(e);if(!function(e){return js(e.capabilities,"turn-read").length>0}(s))throw function(){const e=new Error("The controlled instance does not support per-turn AI session Timeline reads.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_TURN_TIMELINE_UNSUPPORTED"}),e}();return oa(pe,await this.options.request(s,`${ld(t,"turns")}/${encodeURIComponent(n)}/timeline`,{method:"GET"}))}async resume(e,t){const n=oa(pt,await this.post(e,ld(t,"resume"),{}));return await this.refreshAfterCommittedResume(e,t),n}async create(e,t){ud((t.attachments||[]).filter(e=>"upload-ref"!==e.source.type));const n=await this.options.requireInstance(e),s=od(n);if(t.gitSelection&&!s)throw ad();const i=t.permissionMode||("codex"===t.agent?n.config.defaultCodexPermissionMode:void 0),r=t.gitSelection?"/repository/ai-session-workspace/create":"/ai-sessions",{cwdFolderId:o,...a}=t;return oa(Fe,await this.options.request(n,r,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({...a,...s&&o?{cwdFolderId:o}:{},...i?{permissionMode:i}:{}})}))}async inspectWorkspace(e,t){const n=await this.options.requireInstance(e);if(!od(n))throw ad();return oa(sd,await this.options.request(n,"/repository/ai-session-workspace/inspect",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cwd:t})}))}async fork(e,t,n){const s=oa(We,await this.post(e,ld(t,"fork"),n));try{await this.options.refreshSnapshots()}catch(n){try{this.options.warn?.({instanceId:e,aiSessionId:t,providerSessionId:s.providerSessionId,code:dd(n),message:cd(n)},"AI session Fork committed but snapshot refresh failed")}catch{}}return s}async openApp(e,t,n){return oa(Ve,await this.post(e,ld(t,"open-app"),{clientRequestId:n}))}async close(e,t,n){return oa(Je,await this.post(e,ld(t,"close"),{clientRequestId:n}))}async refreshAfterCommittedResume(e,t){try{await this.options.refreshSnapshots()}catch(n){const s={instanceId:e,aiSessionId:t,code:dd(n),message:cd(n),occurredAt:(new Date).toISOString()};this.resumeSnapshotRefreshFailures+=1,this.lastResumeSnapshotRefreshFailure=s;try{this.options.warn?.(s,"AI session resumed but snapshot refresh failed")}catch{}}}diagnostics(){return{resumeSnapshotRefreshFailures:this.resumeSnapshotRefreshFailures,lastResumeSnapshotRefreshFailure:this.lastResumeSnapshotRefreshFailure}}async sendMessage(e,t,n,s,i=[],r=[],o,a){const d=i.filter(e=>"upload-ref"!==e.source.type);ud(d);const c=await this.options.requireInstance(e);i.some(e=>"runtime-path"===e.source.type)&&function(e,t){if(!e.some(e=>"runtime-path"===e.source.type)||"local"===t)return;const n=new Error("Runtime path attachments are currently available only for Local Runtime instances.");throw Object.assign(n,{statusCode:400,code:"AI_SESSION_RUNTIME_PATH_UNSUPPORTED"}),n}(d,(await this.options.requireRuntime(c.nodeId,c.runtimeId)).type);const l=c.aiSessions.sessions.find(e=>e.id===t),p=o||("codex"===l?.agent?c.config.defaultCodexPermissionMode:void 0);return oa(ot,await this.options.request(c,ld(t,"messages"),{method:"POST",headers:{"content-type":"application/json",...a?.traceId?{[ba]:a.traceId}:{}},body:JSON.stringify({message:n,...s?{mode:s}:{},...i.length?{attachments:i}:{},...r.length?{references:r}:{},...p?{permissionMode:p}:{}})},a?.onTiming))}async mentionCatalog(e,t){return oa(Oe,await this.get(e,ld(t,"mentions")))}async searchMentionFiles(e,t,n){return oa(Pe,await this.post(e,ld(t,"mentions/files"),{query:n}))}async executeCommand(e,t,n){return oa(ke,await this.post(e,ld(t,"commands"),n))}async queue(e,t){return oa(et,await this.get(e,ld(t,"queue")))}async steerQueuedMessage(e,t,n){return oa(ot,await this.post(e,pd(t,n,"steer"),{}))}async retryQueuedMessage(e,t,n){return oa(rt,await this.post(e,pd(t,n,"retry"),{}))}async removeQueuedMessage(e,t,n){const s=await this.options.requireInstance(e);return oa(rt,await this.options.request(s,pd(t,n),{method:"DELETE"}))}async editQueuedMessage(e,t,n,s){const i=Xe.parse(s);return oa(rt,await this.patch(e,pd(t,n),i))}async reorderQueuedMessages(e,t,n){const s=Qe.parse(n);return oa(rt,await this.patch(e,ld(t,"queue/reorder"),s))}async interrupt(e,t){return oa(ot,await this.post(e,ld(t,"interrupt"),{}))}async get(e,t){return this.options.request(await this.options.requireInstance(e),t)}async post(e,t,n){return this.options.request(await this.options.requireInstance(e),t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async patch(e,t,n){return this.options.request(await this.options.requireInstance(e),t,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}}function od(e){return Ps(e.capabilities).features.aiSessionWorkspaceSelection}function ad(){const e=new Error("The controlled instance does not support AI session workspace selection.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_WORKSPACE_SELECTION_UNSUPPORTED"}),e}function dd(e){return e&&"object"==typeof e&&"code"in e&&"string"==typeof e.code?e.code:"AI_SESSION_SNAPSHOT_REFRESH_FAILED"}function cd(e){return e instanceof Error?e.message:String(e)}function ld(e,t){return`/ai-sessions/${encodeURIComponent(e)}/${t}`}function pd(e,t,n){return`${ld(e,"queue")}/${encodeURIComponent(t)}${n?`/${n}`:""}`}function ud(e){if(e.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)<=R)return;const t=new Error("Inline attachments must be 41943040 bytes or less in total.");throw Object.assign(t,{statusCode:400,code:"AI_SESSION_ATTACHMENTS_TOO_LARGE"}),t}class hd{requestImpl;logger;constructor(e){this.requestImpl=e.request,this.logger=e.logger}async request(e,t,n={}){const s=n.method||"GET";let i,r;try{i=await this.requestImpl(e,t,n)}catch(n){throw this.logger?.warn?.({nodeId:e.id,route:t,method:s,error:n instanceof Error?n.message:String(n),errorCode:"NODE_AGENT_TRANSPORT_FAILED"},"node agent transport failed"),n}try{r=await i.json()}catch(n){this.logger?.warn?.({nodeId:e.id,route:t,method:s,statusCode:i.status,error:n instanceof Error?n.message:String(n),errorCode:"NODE_AGENT_RESPONSE_INVALID_JSON"},"node agent response was not valid json");const r=new Error(`Node agent ${e.id} returned invalid JSON for ${t}.`);throw Object.assign(r,{statusCode:502,code:"NODE_AGENT_RESPONSE_INVALID_JSON",nodeId:e.id,route:t}),r}if(!i.ok){const n=new Error(r.error?.message||`Node agent request failed with HTTP ${i.status}`);throw Object.assign(n,{statusCode:i.status,code:r.error?.code||"NODE_AGENT_REQUEST_FAILED",nodeId:e.id,route:t}),this.logger?.warn?.({nodeId:e.id,route:t,method:s,statusCode:i.status,errorCode:r.error?.code||"NODE_AGENT_REQUEST_FAILED",error:n.message},"node agent request failed"),n}return this.logger?.info?.({nodeId:e.id,route:t,method:s,statusCode:i.status},"node agent request ok"),r.data??r}async requestSchema(e,t,n,s={}){return this.parse(e,t,n,await this.request(e,t,s),s.method||"GET")}parse(e,t,n,s,i="GET"){const r=ra(n,s);if(r.success)return r.data;this.logger?.warn?.({nodeId:e.id,route:t,method:i,errorCode:"NODE_AGENT_PROTOCOL_INVALID",issues:r.error.issues},"node agent protocol response did not match schema");const o=new Error(`Node agent ${e.id} returned invalid protocol data for ${t}.`);throw Object.assign(o,{statusCode:502,code:"NODE_AGENT_PROTOCOL_INVALID",nodeId:e.id,route:t,issues:r.error.issues}),o}}class md{client;fleetRequestTimeoutMs;fleetSnapshotFreshMs;fleetRetryBaseMs;fleetRetryMaxMs;onFleetStateChanged;runtimeSnapshots=new Map;instanceSnapshots=new Map;modelSnapshots=new Map;fleetRefreshes=new Map;fleetRevisions=new Map;fleetRetryAttempts=new Map;fleetRetryTimers=new Map;disposed=!1;constructor(e,t={}){this.client=e,this.fleetRequestTimeoutMs=Number.isFinite(t.fleetRequestTimeoutMs)&&Number(t.fleetRequestTimeoutMs)>0?Number(t.fleetRequestTimeoutMs):2e3,this.fleetSnapshotFreshMs=Number.isFinite(t.fleetSnapshotFreshMs)&&Number(t.fleetSnapshotFreshMs)>=0?Number(t.fleetSnapshotFreshMs):15e3,this.fleetRetryBaseMs=Number.isFinite(t.fleetRetryBaseMs)&&Number(t.fleetRetryBaseMs)>0?Number(t.fleetRetryBaseMs):1e3,this.fleetRetryMaxMs=Number.isFinite(t.fleetRetryMaxMs)&&Number(t.fleetRetryMaxMs)>=this.fleetRetryBaseMs?Number(t.fleetRetryMaxMs):Math.max(3e4,this.fleetRetryBaseMs),this.onFleetStateChanged=t.onFleetStateChanged}request(e,t,n={}){return this.client.request(e,t,n)}forgetNode(e){this.runtimeSnapshots.delete(e),this.instanceSnapshots.delete(e),this.modelSnapshots.delete(e);for(const t of["runtimes","instances","models"])this.resetFleetRetry(`${t}:${e}`)}dispose(){this.disposed=!0;for(const e of this.fleetRetryTimers.values())clearTimeout(e);this.fleetRetryTimers.clear(),this.fleetRetryAttempts.clear()}health(e){return this.client.requestSchema(e,"/health",jr)}checkUpdate(e,t){return this.client.requestSchema(e,"/updates/check",qi,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}applyUpdate(e,t){return this.client.requestSchema(e,"/updates/apply",$i,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}listUpdateJobs(e){return this.client.requestSchema(e,"/updates/jobs",d.z.array($i))}getExternalListener(e){return this.client.requestSchema(e,"/settings/external-listener",Dr)}updateExternalListener(e,t){return this.client.requestSchema(e,"/settings/external-listener",Dr,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}createPairingInvite(e,t={}){return this.client.requestSchema(e,"/pairing/invites",Mr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t&&"object"==typeof t?t:{})})}createControlPlaneConnection(e,t){return this.client.requestSchema(e,"/control-plane-connections",Fr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}listControlPlanePairings(e){return this.client.requestSchema(e,"/control-plane-pairings",d.z.array(qr))}deleteControlPlanePairing(e,t){return this.client.requestSchema(e,`/control-plane-pairings/${encodeURIComponent(t)}`,Ur,{method:"DELETE"})}listControlPlaneConnections(e){return this.client.requestSchema(e,"/control-plane-connections",d.z.array(Br))}deleteControlPlaneConnection(e,t){return this.client.requestSchema(e,`/control-plane-connections/${encodeURIComponent(t)}`,Ur,{method:"DELETE"})}listDockerImages(e){return this.client.requestSchema(e,"/docker/images",d.z.array(Hr))}listFolderTree(e,t={}){const n=new URLSearchParams;t.path&&n.set("path",t.path),void 0!==t.depth&&n.set("depth",String(t.depth));const s=n.toString();return this.client.requestSchema(e,"/folders/tree"+(s?`?${s}`:""),d.z.array(Gr))}listFolderPlaces(e){return this.client.requestSchema(e,"/folders/places",d.z.array(Vr))}listLocalFolders(e,t={}){return this.client.requestSchema(e,"/local-folders",d.z.array(Wi),t)}createLocalFolder(e,t){return this.client.requestSchema(e,"/local-folders",Wi,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}updateLocalFolder(e,t,n){return this.client.requestSchema(e,`/local-folders/${encodeURIComponent(t)}`,Wi,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async requireLocalFolder(e,t){const n=(await this.listLocalFolders(e)).find(e=>e.id===t);if(!n){const n=new Error(`Local folder ${t} was not found on node ${e.id}.`);throw Object.assign(n,{statusCode:404,code:"NODE_LOCAL_FOLDER_NOT_FOUND",nodeId:e.id,route:"/local-folders"}),n}return n}listRuntimes(e,t={}){return this.client.requestSchema(e,"/runtimes",d.z.array(Or),t)}async createRuntime(e,t){const n=await this.client.requestSchema(e,"/runtimes",Or,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.invalidateFleetResource(e,"runtimes"),n}async updateRuntime(e,t,n){const s=`/runtimes/${encodeURIComponent(t)}`,i=await this.client.requestSchema(e,s,Or,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.invalidateFleetResource(e,"runtimes"),i}async checkRuntime(e,t){const n=`/runtimes/${encodeURIComponent(t)}/check`,s=await this.client.requestSchema(e,n,Or,{method:"POST"});return this.invalidateFleetResource(e,"runtimes"),s}async deleteRuntime(e,t){const n=await this.client.requestSchema(e,`/runtimes/${encodeURIComponent(t)}`,Ur,{method:"DELETE"});return this.invalidateFleetResource(e,"runtimes"),n}deleteLocalFolder(e,t){return this.client.requestSchema(e,`/local-folders/${encodeURIComponent(t)}`,Ur,{method:"DELETE"})}listModels(e,t={}){return this.client.requestSchema(e,"/models",d.z.array(Xi),t)}async createModel(e,t){const n=await this.client.requestSchema(e,"/models",Xi,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.invalidateFleetResource(e,"models"),n}async deployModel(e,t,n){const s=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}/deploy`,Xi,{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.invalidateFleetResource(e,"models"),s}async updateModel(e,t,n){const s=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}`,Xi,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.invalidateFleetResource(e,"models"),s}async deleteModel(e,t){const n=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}`,Ur,{method:"DELETE"});return this.invalidateFleetResource(e,"models"),n}discoverModels(e,t){return this.client.requestSchema(e,"/models/discover",d.z.object({models:d.z.array(d.z.object({id:d.z.string(),ownedBy:d.z.string().optional()}).strict()),latencyMs:d.z.number().nonnegative()}).strict(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}testModel(e,t){return this.client.requestSchema(e,"/models/test",d.z.object({success:d.z.literal(!0),latencyMs:d.z.number().nonnegative()}).strict(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}async assignInstanceModels(e,t,n){const s=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/model-assignment`,d.z.object({assignment:Zi,instance:Zr}).strict(),{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,s.instance),s}async listFleetModels(e,t={}){return await this.refreshFleetModels(e,t,!0),this.readFleetModels(e)}async listFleetRuntimes(e,t={}){return await this.refreshFleetRuntimes(e,t,!0),this.readFleetRuntimes(e)}readFleetModels(e){const t=this.readFleetSnapshots(e,"models",this.modelSnapshots);return{...t,items:t.items.map(({nodeId:e,item:t})=>({nodeId:e,model:t}))}}readFleetRuntimes(e){const t=this.readFleetSnapshots(e,"runtimes",this.runtimeSnapshots);return{...t,items:t.items.map(({item:e})=>e)}}readFleetInstances(e){const t=this.readFleetSnapshots(e,"instances",this.instanceSnapshots);return{...t,items:t.items.map(({item:e})=>e)}}refreshFleetModels(e,t={},n=!1){return this.refreshFleetSnapshots(e,"models","/models",t,this.modelSnapshots,async(e,t)=>({items:await this.listModels(e,t),nodeErrors:[]}),n)}refreshFleetRuntimes(e,t={},n=!1){return this.refreshFleetSnapshots(e,"runtimes","/runtimes",t,this.runtimeSnapshots,async(e,t)=>({items:await this.listRuntimes(e,t),nodeErrors:[]}),n)}refreshFleetInstances(e,t={},n=!1){return this.refreshFleetSnapshots(e,"instances","/instances",t,this.instanceSnapshots,(e,t)=>this.loadInstancesWithDiagnostics(e,t),n)}listInstances(e,t={}){return this.listInstancesWithDiagnostics(e,t).then(e=>e.items)}async listInstancesWithDiagnostics(e,t={}){const n=await this.loadInstancesWithDiagnostics(e,t);return this.setTargetedSnapshot(e,"instances",this.instanceSnapshots,n),n}async loadInstancesWithDiagnostics(e,t={}){return this.client.requestSchema(e,"/instances",d.z.array(d.z.unknown()),t).then(t=>t.reduce((t,n)=>{const s=this.normalizeInstance(e,n);return s.instance&&t.items.push(s.instance),s.error&&t.nodeErrors.push(s.error),t},{items:[],nodeErrors:[]}))}instanceFromSnapshot(e,t){for(const n of e){const e=this.instanceSnapshots.get(n.id);if(!e||e.connectionKey!==this.fleetConnectionKey(n))continue;const s=e.items.find(e=>e.id===t);if(s)return s}}async createInstance(e,t){const n=await this.client.requestSchema(e,"/instances",Zr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.upsertInstanceSnapshot(e,n),n}async updateInstance(e,t,n){const s=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}`,Zr,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,s),s}async deleteInstance(e,t,n){const s=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/delete`,oi,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.removeInstanceSnapshot(e,t),s}listEnvironmentTemplates(e,t={}){return this.client.requestSchema(e,"/environment-templates",d.z.array(hi),t)}getEnvironmentTemplate(e,t,n={}){return this.client.requestSchema(e,`/environment-templates/${encodeURIComponent(t)}`,hi,n)}createEnvironmentTemplate(e,t,n){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/environment-templates`,hi,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}deleteEnvironmentTemplate(e,t){return this.client.requestSchema(e,`/environment-templates/${encodeURIComponent(t)}`,d.z.object({deleted:d.z.boolean(),templateId:hi.shape.id}).strict(),{method:"DELETE"})}async startInstance(e,t,n={}){const s=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/start`,Zr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,s),s}async retryInstanceImageProvisioning(e,t){const n=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/image-provisioning/retry`,Zr,{method:"POST"});return this.upsertInstanceSnapshot(e,n),n}async stopInstance(e,t){const n=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/stop`,Zr,{method:"POST"});return this.upsertInstanceSnapshot(e,n),n}async restartInstance(e,t,n={}){const s=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/restart`,Zr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,s),s}instanceResourceMetrics(e,t){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/metrics`,_r)}proxyRawInstance(e,t,n){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/proxy/raw`,Kr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async listFleetInstances(e,t={}){return await this.refreshFleetInstances(e,t,!0),this.readFleetInstances(e)}readFleetSnapshots(e,t,n){this.reconcileFleetConnections(e,t,n);const s={items:[],nodeErrors:[],nodeStates:[]};for(const i of e){const e=n.get(i.id);if(!e){s.nodeStates.push({nodeId:i.id,resource:t,phase:"uninitialized",revision:this.fleetRevisions.get(`${t}:${i.id}`)});continue}s.items.push(...e.items.map(e=>({nodeId:i.id,item:e})));const r=this.publicFleetState(i.id,t,e);s.nodeStates.push(r),e.error&&s.nodeErrors.push(e.error)}return s}async refreshFleetSnapshots(e,t,n,s,i,r,o){this.reconcileFleetConnections(e,t,i),await Promise.all(e.map(e=>this.refreshFleetNode(e,t,n,s,i,r,o)))}refreshFleetNode(e,t,n,s,i,r,o){if(this.disposed)return Promise.resolve();const a=`${t}:${e.id}`,d=this.fleetRefreshes.get(a);if(d)return d;if(!o&&this.fleetRetryTimers.has(a))return Promise.resolve();o&&this.clearFleetRetry(a);const c=this.fleetConnectionKey(e),l=i.get(e.id),p=l?.connectionKey===c&&"ready"===l.phase&&void 0!==l.updatedAt&&Date.now()-Date.parse(l.updatedAt)<this.fleetSnapshotFreshMs;if(!o&&p)return Promise.resolve();const u=l?.connectionKey===c&&Boolean(l.error)&&("error"===l.phase||"stale"===l.phase),h=this.nextFleetRevision(e.id,t),m={connectionKey:c,items:l?.connectionKey===c?[...l.items]:[],phase:u?l.phase:l?.connectionKey===c&&l.updatedAt?"stale":"loading",revision:h,updatedAt:l?.connectionKey===c?l.updatedAt:void 0,error:u?l.error:void 0};i.set(e.id,m),u||this.emitFleetState(e.id,t,m);const g=(async()=>{try{this.requireFleetNodeReady(e,n);const o=await this.withFleetDeadline(e,n,s,t=>r(e,t));if(i.get(e.id)?.revision!==h)return;const d=o.nodeErrors[0],l={connectionKey:c,items:[...o.items],phase:d?"stale":"ready",revision:h,updatedAt:(new Date).toISOString(),error:d};if(i.set(e.id,l),d)return this.sameFleetState(m,l)||this.emitFleetState(e.id,t,l),void this.scheduleFleetRetry(a,()=>this.refreshFleetNode(e,t,n,{},i,r,!0));this.resetFleetRetry(a),this.emitFleetState(e.id,t,l)}catch(s){if(i.get(e.id)?.revision!==h)return;const o=function(e,t,n,s){const i=s&&"object"==typeof s?s:{};return{nodeId:e.id,route:"string"==typeof i.route?i.route:t,method:"GET",code:"string"==typeof i.code?i.code:"NODE_AGENT_REQUEST_FAILED",message:s instanceof Error?s.message:String(s),statusCode:"number"==typeof i.statusCode?i.statusCode:void 0,issues:Array.isArray(i.issues)?i.issues:void 0}}(e,n,0,s),d={...m,phase:m.updatedAt?"stale":"error",error:o};i.set(e.id,d),this.sameFleetState(m,d)||this.emitFleetState(e.id,t,d),this.scheduleFleetRetry(a,()=>this.refreshFleetNode(e,t,n,{},i,r,!0))}})().finally(()=>{this.fleetRefreshes.get(a)===g&&this.fleetRefreshes.delete(a)});return this.fleetRefreshes.set(a,g),g}reconcileFleetConnections(e,t,n){for(const s of e){const e=n.get(s.id);e&&e.connectionKey!==this.fleetConnectionKey(s)&&(n.delete(s.id),this.resetFleetRetry(`${t}:${s.id}`))}}invalidateFleetResource(e,t){const n="instances"===t?this.instanceSnapshots:"runtimes"===t?this.runtimeSnapshots:this.modelSnapshots;n.get(e.id)&&(this.resetFleetRetry(`${t}:${e.id}`),n.delete(e.id),this.onFleetStateChanged?.({nodeId:e.id,resource:t,phase:"uninitialized",revision:this.nextFleetRevision(e.id,t)}))}publicFleetState(e,t,n){const s=n.error?{nodeId:n.error.nodeId,route:n.error.route,method:n.error.method,code:n.error.code,message:n.error.message,...void 0!==n.error.statusCode?{statusCode:n.error.statusCode}:{},...n.error.issues?{issues:n.error.issues.map(e=>({path:e.path.map(e=>"symbol"==typeof e?String(e):e),message:e.message}))}:{}}:void 0;return{nodeId:e,resource:t,phase:n.phase,revision:n.revision,...n.updatedAt?{updatedAt:n.updatedAt}:{},...s?{error:s}:{}}}emitFleetState(e,t,n){this.onFleetStateChanged?.(this.publicFleetState(e,t,n))}sameFleetState(e,t){const n=e=>({phase:e.phase,items:e.items,error:e.error&&{code:e.error.code,message:e.error.message,statusCode:e.error.statusCode,route:e.error.route,method:e.error.method,issues:e.error.issues}});return JSON.stringify(n(e))===JSON.stringify(n(t))}scheduleFleetRetry(e,t){if(this.disposed||this.fleetRetryTimers.has(e))return;const n=(this.fleetRetryAttempts.get(e)||0)+1;this.fleetRetryAttempts.set(e,n);const s=Math.min(this.fleetRetryMaxMs,this.fleetRetryBaseMs*2**Math.min(n-1,10)),i=setTimeout(()=>{this.fleetRetryTimers.delete(e),this.disposed||t()},s);i.unref?.(),this.fleetRetryTimers.set(e,i)}clearFleetRetry(e){const t=this.fleetRetryTimers.get(e);t&&clearTimeout(t),this.fleetRetryTimers.delete(e)}resetFleetRetry(e){this.clearFleetRetry(e),this.fleetRetryAttempts.delete(e)}setTargetedSnapshot(e,t,n,s){const i={connectionKey:this.fleetConnectionKey(e),items:[...s.items],phase:s.nodeErrors.length?"stale":"ready",revision:this.nextFleetRevision(e.id,t),updatedAt:(new Date).toISOString(),error:s.nodeErrors[0]};n.set(e.id,i),this.emitFleetState(e.id,t,i)}nextFleetRevision(e,t){const n=`${t}:${e}`,s=(this.fleetRevisions.get(n)||0)+1;return this.fleetRevisions.set(n,s),s}fleetConnectionKey(e){return JSON.stringify([e.id,e.connectionMode,e.controlEndpoint,e.endpoint,e.auth.mode,e.auth.keyId])}upsertInstanceSnapshot(e,t){const n=this.instanceSnapshots.get(e.id),s=this.fleetConnectionKey(e);n&&n.connectionKey===s&&(n.items=[...n.items.filter(e=>e.id!==t.id),t],n.phase="ready",n.revision=this.nextFleetRevision(e.id,"instances"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"instances",n))}removeInstanceSnapshot(e,t){const n=this.instanceSnapshots.get(e.id);n&&n.connectionKey===this.fleetConnectionKey(e)&&(n.items=n.items.filter(e=>e.id!==t),n.phase="ready",n.revision=this.nextFleetRevision(e.id,"instances"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"instances",n))}requireFleetNodeReady(e,t){const n=e.connectionPhase,s="reverse-wss"!==e.connectionMode&&"control-plane-proxy"!==e.connectionMode;if(!n||"healthy"===n||s)return;const i=new Error(`Node agent ${e.id} is ${n}; serving its latest fleet snapshot.`);throw Object.assign(i,{code:"NODE_AGENT_CONNECTION_PENDING",nodeId:e.id,route:t}),i}async withFleetDeadline(e,t,n,s){const i=new AbortController,r=Object.assign(new Error(`Node agent ${e.id} did not return ${t} before the fleet aggregation deadline.`),{code:"NODE_AGENT_FLEET_TIMEOUT",nodeId:e.id,route:t}),o=new Promise((e,t)=>{const n=()=>t(i.signal.reason||r);i.signal.aborted?n():i.signal.addEventListener("abort",n,{once:!0})}),a=()=>i.abort(n.signal?.reason);n.signal?.aborted?a():n.signal?.addEventListener("abort",a,{once:!0});const d=setTimeout(()=>i.abort(r),this.fleetRequestTimeoutMs);d.unref?.();try{return await Promise.race([s({...n,signal:i.signal}),o])}finally{clearTimeout(d),n.signal?.removeEventListener("abort",a)}}normalizeInstance(e,t){const n=(s=t,Zr.safeParse(function(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=new Set(Object.keys(Zr.shape)),s={};for(const[e,i]of Object.entries(t))n.has(e)&&(s[e]=i);if(t.capabilities&&"object"==typeof t.capabilities&&!Array.isArray(t.capabilities)){const e={...t.capabilities};Object.prototype.hasOwnProperty.call(e,"apps")&&delete e.apps,s.capabilities=Ps(e)}else s.capabilities=Ps(void 0);s.appInventory=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e;Object.keys(t).some(e=>!["observedAt","items","issues"].includes(e));const n={observedAt:t.observedAt,items:Array.isArray(t.items)?t.items.map(e=>{e&&"object"==typeof e&&!Array.isArray(e)&&Object.keys(e).some(e=>!["id","name","kind","source","availability","capabilities","diagnosticCode"].includes(e));const t=io(e,["id","name","kind","source","availability","diagnosticCode"]);return!t||"object"!=typeof t||Array.isArray(t)?t:{...t,capabilities:io(e.capabilities,["automation","supportsCwdSelection"])}}):t.items,issues:Array.isArray(t.issues)?t.issues.map(e=>io(e,["code","message"])):t.issues},s=ui.safeParse(n);return s.success?s.data:void 0}(t.appInventory,"string"==typeof t.id&&t.id),s.source=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.type,s=Gi.options.find(e=>e.shape.type.value===n);if(!s)return e;const i="local-folder"===n?["type","localFolderId","path","ownerNodeId"]:"git-template"===n?["type","url","templateId","ref","auth","clone"]:["type","repositoryId","url","provider","ref","auth","clone"],r=io(t,i);if("local-folder"!==n){const e=no(Fi,io(t.ref,["type","name","commit"])),n=no(Ui,io(t.auth,["type","secretId"])),s=no(Hi,io(t.clone,["depth","submodules","lfs","subdirectory"]));e?r.ref=e:delete r.ref,n?r.auth=n:delete r.auth,s?r.clone=s:delete r.clone}const o=no(s,r);return o?(Object.keys(t).some(e=>!i.includes(e)),o):r}(t.source,"string"==typeof t.id&&t.id),s.sourceSnapshot=t.sourceSnapshot&&"object"==typeof t.sourceSnapshot&&!Array.isArray(t.sourceSnapshot)?t.sourceSnapshot:{},s.build=no(Ni,t.build,0,0,"string"==typeof t.id&&t.id),s.aiSessions=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=Array.isArray(t.sessions)?t.sessions.flatMap((e,t)=>{const n=no(ht,e);return n?[n]:[]}):[],s={runningCount:"number"==typeof t.runningCount&&Number.isInteger(t.runningCount)&&t.runningCount>=0?t.runningCount:0,waitingCount:"number"==typeof t.waitingCount&&Number.isInteger(t.waitingCount)&&t.waitingCount>=0?t.waitingCount:0,staleCount:"number"==typeof t.staleCount&&Number.isInteger(t.staleCount)&&t.staleCount>=0?t.staleCount:0,sessions:n,updatedAt:Ms.safeParse(t.updatedAt).success?t.updatedAt:(new Date).toISOString()};return Object.keys(t).some(e=>!["runningCount","waitingCount","staleCount","sessions","updatedAt"].includes(e)),mt.parse(s)}(t.aiSessions,"string"==typeof t.id&&t.id),s.triggers=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e;Object.keys(t).some(e=>!["enabledCount","runningCount","errorCount","configs","recentRuns"].includes(e));const n=(e,t,n)=>Array.isArray(e)?e.flatMap((e,n)=>{const s=no(t,e);return s?[s]:[]}):[],s=Array.isArray(t.configs)?t.configs.flatMap((e,t)=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const s=e;Object.keys(s).some(e=>!["configHash","config","deployments","runtime"].includes(e));const i=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=io(t,["configHash","name","description","createdAt","updatedAt"]);if(t.source&&"object"==typeof t.source&&!Array.isArray(t.source)){const e=t.source,s="schedule"===e.type?"interval"===e.scheduleKind?["type","scheduleKind","intervalMs"]:"daily"===e.scheduleKind?["type","scheduleKind","timeOfDay","timezone"]:["type","scheduleKind","weekdays","timeOfDay","timezone"]:"file-change"===e.type?["type","roots","globs","ignore","debounceMs"]:["type","agent","statuses","phases"];n.source=io(e,s)}return n.action=io(t.action,["promptTemplate"]),n.policy=io(t.policy,["cooldownMs","maxConcurrentRuns","whenBusy"]),no(On,n)}(s.config);return"string"==typeof s.configHash&&i?[{configHash:s.configHash,config:i,deployments:n(s.deployments,Pn),runtime:n(s.runtime,jn)}]:[]}):[];return{enabledCount:"number"==typeof t.enabledCount&&Number.isInteger(t.enabledCount)&&t.enabledCount>=0?t.enabledCount:0,runningCount:"number"==typeof t.runningCount&&Number.isInteger(t.runningCount)&&t.runningCount>=0?t.runningCount:0,errorCount:"number"==typeof t.errorCount&&Number.isInteger(t.errorCount)&&t.errorCount>=0?t.errorCount:0,configs:s,recentRuns:n(t.recentRuns,Dn)}}(t.triggers,"string"==typeof t.id&&t.id),s.apps=no(Zr.shape.apps.unwrap(),io(t.apps,["runningCount","problemCount","updatedAt","revision"]),0,0,"string"==typeof t.id&&t.id)||{runningCount:0,problemCount:0},s.config=no(Zr.shape.config.unwrap(),io(t.config,["autoImportAgentConfigs","defaultCodexPermissionMode","aiSessionHistoryLimit","aiSessionAttachmentRetentionDays"]),0,0,"string"==typeof t.id&&t.id)||{autoImportAgentConfigs:!0,defaultCodexPermissionMode:"ask",aiSessionHistoryLimit:50,aiSessionAttachmentRetentionDays:30},s.modelSelection=no(Js.unwrap(),io(t.modelSelection,["codexModelHash","claudeModelHash"]),0,0,"string"==typeof t.id&&t.id)||{},s.imageSnapshot=function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,s=Er(n),{reference:i,...r}=s,o=n.requestedReference??i;let a;try{a="string"==typeof o?Gs(o):void 0}catch{}const d={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"},c="string"==typeof n.id?n.id:"string"==typeof t?t:void 0,l="market"===n.origin||c&&d[c]?"market":"custom";return void 0!==n.image||n.reference,{...r,id:c&&d[c]?d[c]:c,origin:l,repository:a?.repository??n.repository,tag:a?.tag??n.tag,requestedReference:a?.reference??o,resolvedDigest:n.resolvedDigest,resolvedReference:n.resolvedReference,downloadSizeBytes:n.downloadSizeBytes,market:"market"===l?io(n.market,["catalogId","catalogRevision","publisher","version"])??{catalogId:"task_handoff_embedded",catalogRevision:"legacy",publisher:"task-handoff"}:void 0}}(t.imageSnapshot,t.imageId,"string"==typeof t.id&&t.id);const i="string"==typeof t.imageId?{img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"}[t.imageId]||t.imageId:void 0,r=io(t.imageSelection,["imageId","tag"]);s.imageSelection=r||(i?{imageId:i,tag:s.imageSnapshot?.tag}:void 0),s.imageProvisioning=no(Sr,io(t.imageProvisioning,["phase","requestedReference","generation","error","startedAt","updatedAt"]),0,0,"string"==typeof t.id&&t.id),s.runtimeVersion=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=e=>{if("string"!=typeof e)return;const t=e.trim();return t&&t.length<=80?t:void 0},s=n(t.desiredVersion);if(!s)return;const i=new Set(ji.shape.phase.options),r="string"==typeof t.phase?t.phase:"pending",o=i.has(r)?r:{idle:"pending",queued:"pending",checking:"pending",downloading:"installing",updating:"installing",completed:"matched",succeeded:"matched",ready:"matched",error:"failed"}[r]||"pending";let a;if(t.error&&"object"==typeof t.error&&!Array.isArray(t.error)){const e=t.error,s="string"==typeof e.message?e.message.trim().slice(0,4096):"";if(s){const t=new Set(Pi.shape.code.options),i="string"==typeof e.code&&t.has(e.code)?e.code:"INSTANCE_RUNTIME_INSTALL_FAILED";e.code;const r=n(e.expectedVersion),o=n(e.actualVersion);a={code:i,message:s,...r?{expectedVersion:r}:{},...o?{actualVersion:o}:{},retryable:!0===e.retryable}}}"string"==typeof t.error&&t.error.trim()&&(a={code:"INSTANCE_RUNTIME_INSTALL_FAILED",message:t.error.trim().slice(0,4096),expectedVersion:s,...n(t.actualVersion)?{actualVersion:n(t.actualVersion)}:{},retryable:!1});const d=n(t.actualVersion),c=Ms.safeParse(t.lastAttemptAt),l=Ms.safeParse(t.matchedAt);return void 0!==t.lastAttemptAt&&c.success,void 0!==t.matchedAt&&l.success,{desiredVersion:s,...d?{actualVersion:d}:{},phase:o,attempt:"number"==typeof t.attempt&&Number.isInteger(t.attempt)&&t.attempt>=0?t.attempt:0,...c.success?{lastAttemptAt:c.data}:{},...l.success?{matchedAt:l.data}:{},...a?{error:a}:{}}}(t.runtimeVersion,"string"==typeof t.id&&t.id),s.workspace=no(Xr,t.workspace,0,0,"string"==typeof t.id&&t.id)||{status:"unknown"},s.environmentSource=no(Qs,t.environmentSource,0,0,"string"==typeof t.id&&t.id),s.environmentTemplateOrigin=no(ni,t.environmentTemplateOrigin,0,0,"string"==typeof t.id&&t.id),s.runtime=no(Zr.shape.runtime.unwrap(),t.runtime,0,0,"string"==typeof t.id&&t.id)||{labels:{}},s.target=no(Jr,io(t.target??t.endpoints,["strategy","web","api","vnc","tty","logs","status"]),0,0,"string"==typeof t.id&&t.id)||{strategy:"direct-port",status:"unknown"},s.access=no(Qr,io(t.access,["strategy","web","api","ws","status"]),0,0,"string"==typeof t.id&&t.id)||{strategy:"control-plane-proxy",status:"unknown"};for(const[e,t]of Object.entries(Zr.shape))Object.prototype.hasOwnProperty.call(s,e)&&!t.safeParse(s[e]).success&&t.safeParse(void 0).success&&delete s[e];return s}(s)));var s;if(n.success)return n.data.protocolVersion&&n.data.protocolVersion!==ks?(this.client.logger?.warn?.({nodeId:e.id,instanceId:n.data.id,expectedProtocolVersion:ks,actualProtocolVersion:n.data.protocolVersion,errorCode:"PROTOCOL_VERSION_MISMATCH"},"node instance protocol version mismatch"),{instance:n.data}):{instance:n.data};const i=t&&"object"==typeof t?t:{},r="string"==typeof i.id?i.id:void 0;return this.client.logger?.warn?.({nodeId:e.id,instanceId:r,errorCode:"NODE_INSTANCE_PAYLOAD_INVALID",issues:n.error.issues.map(e=>({path:e.path.join("."),message:e.message}))},"node instance payload invalid"),{error:{nodeId:e.id,route:"/instances",method:"GET",code:"NODE_INSTANCE_PAYLOAD_INVALID",message:r?`Node instance ${r} payload is invalid.`:"Node instance payload is invalid.",statusCode:502,issues:n.error.issues}}}}function gd(e){return e.readyState===(e.OPEN??1)}function yd(e){const t=Buffer.isBuffer(e)?e.toString("utf8"):"string"==typeof e?e:"";if(Buffer.byteLength(t,"utf8")<=123)return t;let n="";for(const e of t){const t=`${n}${e}`;if(Buffer.byteLength(t,"utf8")>123)break;n=t}return n}function fd(e){if("number"==typeof e&&Number.isInteger(e))return e>=3e3&&e<=4999||e>=1e3&&e<=1014&&1004!==e&&1005!==e&&1006!==e?e:void 0}function Id(e,t,n){e.close(fd(t),yd(n)||void 0)}function bd(e,t,n,s){if(gd(e))for(const e of t.splice(0))if(s(e),!n(e))return}function vd(e,t,n={}){const s=n.pendingFrameLimit??256,i=n.maxFrameBytes??8388608,r=n.maxTotalBytes??1073741824,o=n.maxBufferedBytes??16777216;let a=!1,d=gd(t);const c=[],l=[];let p,u=0,h=0,m=0;const g=e=>Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8"),y=(s,o)=>{const a=g(o);return m+=a,n.onFrame?.(s,a),!(a>i||m>r)||(Id(e,1009,"WebSocket bridge traffic limit exceeded."),Id(t,1009,"WebSocket bridge traffic limit exceeded."),!1)},f=()=>{p&&(clearTimeout(p),p=void 0)},I=(n,s)=>{const i=s.bytes;if((n.bufferedAmount??0)+i>o)return Id(e,1013,"WebSocket bridge consumer is too slow."),Id(t,1013,"WebSocket bridge consumer is too slow."),!1;try{return function(e,t){e.send(t.data,{binary:t.isBinary})}(n,s),!0}catch{return Id(e,1011,"WebSocket bridge send failed."),Id(t,1011,"WebSocket bridge send failed."),!1}},b=(n,i,r)=>{if(i.length>=s)return Id(e,1011,"WebSocket bridge pending frame limit exceeded."),void Id(t,1011,"WebSocket bridge pending frame limit exceeded.");const a="upstream"===n?u:h;if((("upstream"===n?t:e).bufferedAmount??0)+a+r.bytes>o)return Id(e,1013,"WebSocket bridge consumer is too slow."),void Id(t,1013,"WebSocket bridge consumer is too slow.");i.push(r),"upstream"===n?u+=r.bytes:h+=r.bytes};return n.upstreamOpenTimeoutMs&&!d&&(p=setTimeout(()=>{d||a||(Id(e,1011,"Upstream websocket did not open."),Id(t))},n.upstreamOpenTimeoutMs)),e.on("open",()=>bd(e,l,t=>I(e,t),e=>{h-=e.bytes})),t.on("open",()=>{f(),d=!0,n.onUpstreamOpen?.(),bd(t,c,e=>I(t,e),e=>{u-=e.bytes})}),e.on("message",(e,n=!1)=>{if(!y("client-to-upstream",e))return;const s={data:e,isBinary:Boolean(n),bytes:g(e)};gd(t)?I(t,s):b("upstream",c,s)}),t.on("message",(t,n=!1)=>{if(!y("upstream-to-client",t))return;const s={data:t,isBinary:Boolean(n),bytes:g(t)};gd(e)?I(e,s):b("client",l,s)}),t.on("close",(t,s)=>{f(),n.onUpstreamClose?.(t,s),(d||a||!n.onUpstreamCloseBeforeOpen?.())&&Id(e,t,s)}),t.on("error",t=>{n.onUpstreamError?.(t),(d||a||!n.onUpstreamErrorBeforeOpen?.(t))&&Id(e)}),e.on("close",(e,s)=>{f(),a=!0,n.onClientClose?.(e,s),Id(t,e,s)}),e.on("error",e=>{f(),a=!0,n.onClientError?.(e),Id(t,1011,"WebSocket bridge client failed.")}),{close:(n,s)=>{f(),Id(t,n,s),Id(e,n,s)}}}const Sd="TASK_HANDOFF_NODE_AGENT_V1",wd=6e4,Ad="/api/node-tunnel";function zd(e,t){if("paired-hmac"===e.auth.mode&&e.auth.secret){if(!e.auth.keyId){const t=new Error(`Node ${e.id} paired-HMAC auth is missing keyId.`);throw Object.assign(t,{statusCode:500,code:"NODE_AGENT_REMOTE_KEY_ID_MISSING"}),t}return function(e){const t=e.timestamp||(new Date).toISOString(),n=e.nonce||s.randomBytes(18).toString("base64url"),i=kd(e.body||""),r=Td(e.secret,{keyId:e.keyId,method:e.method,pathWithQuery:e.pathWithQuery,timestamp:t,nonce:n,bodySha256:i});return{"x-taskhandoff-node-id":e.nodeId,"x-taskhandoff-key-id":e.keyId,"x-taskhandoff-timestamp":t,"x-taskhandoff-nonce":n,"x-taskhandoff-body-sha256":i,"x-taskhandoff-signature":r}}({nodeId:e.id,keyId:e.auth.keyId,secret:e.auth.secret,method:t.method,pathWithQuery:t.pathWithQuery,body:t.body})}const n="local-ipc"!==e.connectionMode&&"local-loopback"!==e.connectionMode||"local-static-key"!==e.auth.mode?void 0:e.auth.secret;return n?{authorization:`Bearer ${n}`}:{}}function kd(e=""){return s.createHash("sha256").update(e).digest("hex")}function Td(e,t){return s.createHmac("sha256",e).update(function(e){return[Sd,e.keyId,e.method.toUpperCase(),e.pathWithQuery,e.timestamp,e.nonce,e.bodySha256].join("\n")}(t)).digest("hex")}function Cd(e){if(e.startsWith("ipc://"))return decodeURIComponent(e.slice(6))}function Ed(e,t=process.platform){if(!function(e,t=process.platform){if("win32"===t)return e.startsWith("\\\\.\\pipe\\");const s=n.statSync(e),i=process.getuid?.();return void 0===i||s.uid===i}(e,t)){const e=new Error("Local node agent IPC socket is not owned by the current user.");throw Object.assign(e,{statusCode:403,code:"NODE_AGENT_IPC_OWNER_INVALID"}),e}}function xd(e,t){return Number.isFinite(e)&&Number(e)>0?Number(e):t}function Nd(e,t){const n=AbortSignal.timeout(t);return e?AbortSignal.any([e,n]):n}async function Rd(e,t,n,s={}){const i=Cd(t);return i?(Ed(i),async function(e,t,n={}){const s=n.method||"GET",i="string"==typeof n.body||n.body instanceof Buffer?n.body:void 0===n.body||null===n.body?void 0:String(n.body),r=new Headers(n.headers||{});return void 0===i||r.has("content-length")||r.set("content-length",String(Buffer.byteLength(i))),new Promise((o,a)=>{const d=u.request({socketPath:e,method:s,path:`/api/node-agent${t}`,headers:Object.fromEntries(r.entries())},e=>{const t=e.statusCode||500;o(new Response("HEAD"!==s&&204!==t&&205!==t&&304!==t?m.Readable.toWeb(e):null,{status:t,headers:e.headers}))});d.on("error",a);const c=()=>d.destroy(new DOMException("The operation was aborted.","AbortError"));n.signal?.aborted?c():n.signal?.addEventListener("abort",c,{once:!0}),d.once("close",()=>n.signal?.removeEventListener("abort",c)),void 0!==i&&d.write(i),d.end()})}(i,n,s)):e(`${t.replace(/\/$/,"")}/api/node-agent${n}`,s)}function Od(e){const t=e.controlEndpoint||e.endpoint;if(!t){const e=new Error("Node agent direct HTTP mode requires an endpoint.");throw Object.assign(e,{statusCode:400,code:"NODE_AGENT_ENDPOINT_REQUIRED"}),e}return t}function _d(e,t,n,s){const i=Od(e),r=Cd(i),o=`/api/node-agent${t}`;if(r)return Ed(r),function(e,t,n,s={}){const i=`/api/node-agent${t}`,r={createConnection:()=>h.connect(e),headers:{host:"task-handoff-node-agent.local",...s}};return n&&(Array.isArray(n)?n.length>0:n.trim().length>0)?new p.WebSocket(`ws://task-handoff-node-agent.local${i}`,n,r):new p.WebSocket(`ws://task-handoff-node-agent.local${i}`,r)}(r,t,n,s);const a=new URL(o,i.replace(/\/$/,""));return a.protocol="https:"===a.protocol?"wss:":"ws:",n?new p.WebSocket(a.toString(),n,{headers:s}):new p.WebSocket(a.toString(),{headers:s})}function Pd(e,t,n){const s=new Headers(n),i=zd(e,t);for(const[e,t]of Object.entries(i))"authorization"===e&&s.has(e)||s.set(e,t);return Object.fromEntries(s.entries())}function jd(e=fetch,t={}){const n=t.openWebSocket||_d,s=xd(t.requestTimeoutMs,3e4),i=xd(t.streamHeaderTimeoutMs,3e4),r=xd(t.websocketOpenTimeoutMs,1e4);return{request:async(t,n,i={})=>{const r=Od(t),o=i.method||"GET",a="string"==typeof i.body||i.body instanceof Buffer?i.body:void 0===i.body||null===i.body?void 0:String(i.body),d=Pd(t,{method:o,pathWithQuery:`/api/node-agent${n}`,body:a||""},i.headers);return Rd(e,r,n,{...i,body:a,headers:d,signal:Nd(i.signal,s)})},requestStream:async(t,n,s={})=>{const r=Od(t),o=s.method||"GET",a="string"==typeof s.body||s.body instanceof Buffer?s.body:void 0===s.body||null===s.body?void 0:String(s.body),d=Pd(t,{method:o,pathWithQuery:`/api/node-agent${n}`,body:a||""},s.headers),c=new AbortController,l=s.signal?AbortSignal.any([s.signal,c.signal]):c.signal;return async function(t,i,o){const c=setTimeout(()=>o.abort(Object.assign(new Error("Node agent response header timed out."),{code:"NODE_AGENT_RESPONSE_HEADER_TIMEOUT"})),i);c.unref?.();try{return await Rd(e,r,n,{...s,body:a,headers:d,signal:l})}finally{clearTimeout(c)}}(0,i,c)},proxyWebSocket(e,t,s,i,o={}){const a=Pd(e,{method:"GET",pathWithQuery:`/api/node-agent${s}`},o),d=n(e,s,i,a);let c,l=!1;return d.on("open",()=>{if(!l||d.readyState!==(d.OPEN??1))return;const e=c;c=void 0,l=!1,d.send(e)}),vd(t,d,{upstreamOpenTimeoutMs:r,onUpstreamError:()=>t.close(1011,"Instance websocket proxy failed."),onUpstreamErrorBeforeOpen:()=>!0}),{send:e=>{d.readyState!==(d.OPEN??1)?(c=e,l=!0):d.send(e)},ping:()=>{const e=d.ping;if(!e)throw new Error("Direct node-agent websocket does not support ping.");e.call(d)},onPong:e=>d.on("pong",e)}}}}class Dd{direct;tunnel;proxy;constructor(e){this.direct=e.direct,this.tunnel=e.tunnel,this.proxy=e.proxy}setTunnel(e){this.tunnel=e}setProxy(e){this.proxy=e}resolve(e){if(!1===e.connectionEnabled){const e=new Error("Node agent connection is disabled locally.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_CONNECTION_DISABLED"}),e}if("control-plane-proxy"===e.connectionMode){if(!this.proxy){const e=new Error("Control-plane proxy transport is not available.");throw Object.assign(e,{statusCode:503,code:"CONTROL_PLANE_PROXY_TRANSPORT_UNAVAILABLE"}),e}return this.proxy}if("reverse-wss"!==e.connectionMode)return this.direct;if(!this.tunnel){const e=new Error("Reverse node agent transport is not available.");throw Object.assign(e,{statusCode:503,code:"NODE_AGENT_REVERSE_TRANSPORT_UNAVAILABLE"}),e}return this.tunnel}}function Md(e,t,n,s){const i=new Error(e,void 0===s?void 0:{cause:s});return Object.assign(i,{code:t,statusCode:n,retryable:n>=500}),i}function Ld(e,t){if("control-plane-proxy"!==e.connectionPath.kind)throw Md("Control-plane proxy transport requires a proxy connection path.","CONTROL_PLANE_PROXY_CONFIGURATION_INVALID",400);const n=t(e);if(!n)throw Md("Control-plane proxy credential is missing.","CONTROL_PLANE_PROXY_CREDENTIAL_REQUIRED",503);if(n.nodeId!==e.id||n.proxyBindingId!==e.connectionPath.proxyBindingId||n.targetNodeId!==e.connectionPath.targetNodeId)throw Md("Control-plane proxy credential does not match the node connection identity.","CONTROL_PLANE_PROXY_CREDENTIAL_MISMATCH",409);return n}function qd(e,t){const n=new Headers(t);n.set(ts,Wn),n.set(ns,e.sourceControlPlaneId),n.set(ss,e.bindingKeyId),n.set(is,e.credential);const i=Yn.safeParse(n.get("x-request-id"));return n.set("x-request-id",i.success?i.data:`proxy_request_${s.randomUUID().replace(/-/g,"")}`),Object.fromEntries(n.entries())}function $d(e){const t=Xn.safeParse(e);if(t.success)return t.data;const n=Md("Control-plane proxy route is invalid.",rs.RouteInvalid,400);throw Object.assign(n,{issues:t.error.issues}),n}function Bd(e,t,n){return t?new p.WebSocket(e,t,{headers:n}):new p.WebSocket(e,{headers:n})}class Fd{credentialForNode;fetchImpl;openWebSocket;constructor(e){this.credentialForNode=e.credentialForNode,this.fetchImpl=e.fetchImpl||fetch,this.openWebSocket=e.openWebSocket||Bd}async fetch(e,t,n={}){const s=Ld(e,this.credentialForNode),i=function(e,t){const n=new URL($d(t),"https://node-agent.invalid"),s=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/http${n.pathname}`,e.proxyOrigin);return s.search=n.search,s}(s,t);try{return await this.fetchImpl(i,{...n,headers:qd(s,n.headers)})}catch(e){if(function(e){return e instanceof Error&&("AbortError"===e.name||"ABORT_ERR"===e.code)}(e))throw e;throw Md(`Trusted control-plane proxy ${s.proxyOrigin} is unavailable.`,"CONTROL_PLANE_PROXY_UNAVAILABLE",503,e)}}request(e,t,n={}){return this.fetch(e,t,n)}requestStream(e,t,n={}){return this.fetch(e,t,n)}proxyWebSocket(e,t,n,s,i={}){const r=Ld(e,this.credentialForNode),o=this.openWebSocket(function(e,t){const n=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/websocket`,e.proxyOrigin);return n.protocol="wss:",n.searchParams.set("route",$d(t)),n}(r,n).toString(),s,qd(r,i));let a,d=!1;return o.on("open",()=>{if(!d||o.readyState!==(o.OPEN??1))return;const e=a;a=void 0,d=!1,o.send(e)}),vd(t,o,{onUpstreamError:()=>t.close(1011,"Control-plane proxy websocket failed."),onUpstreamErrorBeforeOpen:()=>!0}),{send:e=>{o.readyState!==(o.OPEN??1)?(a=e,d=!0):o.send(e)},ping:()=>{const e=o.ping;if(!e)throw new Error("Control-plane proxy websocket does not support ping.");e.call(o)},onPong:e=>o.on("pong",e)}}}const Ud=new Set(Object.keys(As.shape)),Hd=new Set(Object.keys(zs.shape));function Wd(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return e;const s=e,i=Object.keys(s).filter(e=>!t.has(e));return i.length&&n?.(i),Object.fromEntries([...t].filter(e=>e in s).map(e=>[e,s[e]]))}function Gd(e){const{credential:t,...n}=e;return n}class Vd{pendingClaims;nodeCredentials;identity;constructor(e,t){this.pendingClaims=new Do(e.pendingClaimsDir,{schema:As,sanitize:e=>function(e){return Wd(e,Ud,e=>t?.("unknown stored pending proxy claim fields were ignored",{fields:e}))}(e),logger:t,directoryMode:448,fileMode:384}),this.nodeCredentials=new Do(e.nodeCredentialsDir,{schema:zs,sanitize:e=>function(e){return Wd(e,Hd,e=>t?.("unknown stored proxy node credential fields were ignored",{fields:e}))}(e),logger:t,directoryMode:448,fileMode:384}),this.identity=new Mo(e.identityPath,()=>({controlPlaneId:Po("control_plane")}),{schema:d.z.object({controlPlaneId:d.z.string().trim().min(1).max(160)}).strip(),logger:t,directoryMode:448,fileMode:384})}init(e=Date.now()){return this.pendingClaims.init(),this.nodeCredentials.init(),this.identity.init(),this.gcPendingClaims(e)}controlPlaneId(){return this.identity.get().controlPlaneId}pendingClaimByClaimId(e){return this.pendingClaims.list().find(t=>t.claimId===e)}pendingClaimByReference(e){return this.pendingClaims.get(e)||this.pendingClaimByClaimId(e)}putPendingClaim(e){const t=this.pendingClaimByClaimId(e.claimId);if(!t)return this.pendingClaims.put(e);if(t.proxyOrigin!==e.proxyOrigin||t.requestedName!==e.requestedName||t.sourceControlPlaneId!==e.sourceControlPlaneId||t.targetNodeId!==e.targetNodeId||t.bindingKeyId!==e.bindingKeyId||t.credential!==e.credential){const e=new Error("Pending proxy claim identity conflicts with an existing claim.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",statusCode:409}),e}return t}publicPendingClaims(){return this.pendingClaims.list().map(Gd)}nodeCredential(e){return this.nodeCredentials.list().find(t=>t.nodeId===e)}putNodeCredential(e){const t=this.nodeCredential(e.nodeId);if(t&&(t.proxyOrigin!==e.proxyOrigin||t.proxyBindingId!==e.proxyBindingId||t.targetNodeId!==e.targetNodeId||t.sourceControlPlaneId!==e.sourceControlPlaneId||t.bindingKeyId!==e.bindingKeyId||t.credential!==e.credential)){const e=new Error("Proxy node credential conflicts with the existing node identity.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_NODE_IDENTITY_CONFLICT",statusCode:409}),e}return t||this.nodeCredentials.put(e)}deleteNodeCredential(e){const t=this.nodeCredential(e);return!!t&&this.nodeCredentials.delete(t.id)}gcNodeCredentials(e){const t=[];for(const n of this.nodeCredentials.list())e(n)||(this.nodeCredentials.delete(n.id),t.push(n.id));return t}promotePendingClaim(e,t){const n=this.pendingClaimByClaimId(e);if(!n)return;if(n.proxyOrigin!==t.proxyOrigin||n.sourceControlPlaneId!==t.sourceControlPlaneId||void 0!==n.targetNodeId&&n.targetNodeId!==t.targetNodeId||n.bindingKeyId!==t.bindingKeyId||n.credential!==t.credential){const e=new Error("Proxy node credential does not match the pending claim identity.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",statusCode:409}),e}const s=this.putNodeCredential(t);return this.pendingClaims.delete(n.id),s}markCompensationRequired(e){const t=this.pendingClaimByClaimId(e);if(t)return this.pendingClaims.patch(t.id,{status:"compensation-required"})}cancelPendingClaim(e,t){const n=this.pendingClaimByClaimId(e);return n?t?(this.pendingClaims.patch(n.id,{status:"compensation-required"}),{deleted:!1,compensationRequired:!0}):{deleted:this.pendingClaims.delete(n.id),compensationRequired:!1}:{deleted:!1,compensationRequired:!1}}completePendingClaimCompensation(e){const t=this.pendingClaimByClaimId(e);return!(!t||"compensation-required"!==t.status)&&this.pendingClaims.delete(t.id)}forceDeletePendingClaim(e){const t=this.pendingClaimByReference(e);return!!t&&this.pendingClaims.delete(t.id)}gcPendingClaims(e=Date.now()){const t=[];for(const n of this.pendingClaims.list()){if("compensation-required"===n.status)continue;const s=Date.parse(n.expiresAt);!Number.isFinite(s)||s>e||(this.pendingClaims.delete(n.id),t.push(n.id))}return t}}const Kd=d.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Jd=d.z.string().datetime(),Yd=d.z.object({sessionReadAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([]),turnReadAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([]),liveItemAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([])}).passthrough();const Qd=d.z.object({metadataAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([]),contentAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([]),uploadAgents:d.z.array(d.z.string().trim().min(1).max(120)).max(100).default([]),retentionSettings:d.z.boolean().default(!1)}).passthrough(),Xd=d.z.object({aiSessionTimeline:Yd.default(function(){return{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),aiSessionConversationAttachments:Qd.optional()}).passthrough(),Zd=d.z.enum(["connecting","handshaking","healthy","reconnecting","suspect","offline"]),ec=d.z.enum(["start","stop","restart","retry-image"]);d.z.object({instanceId:Kd,revision:d.z.number().int().nonnegative(),updatedAt:Jd,status:d.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]),health:d.z.enum(["unknown","ok","degraded","failed"]),connectionStatus:d.z.enum(["unknown","online","offline","endpoint-unreachable"]),ready:d.z.boolean(),lastHeartbeatAt:Jd.optional()}).strip();const tc=d.z.object({code:d.z.string().trim().min(1).max(120),message:d.z.string().trim().min(1).max(2048)}).strict(),nc=d.z.enum(["instances","runtimes","models"]),sc=d.z.enum(["uninitialized","loading","ready","stale","error"]),ic=d.z.object({nodeId:Kd,resource:nc,phase:sc,revision:d.z.number().int().nonnegative().optional(),updatedAt:Jd.optional(),error:d.z.object({nodeId:Kd,route:d.z.string().trim().min(1).max(500),method:d.z.string().trim().min(1).max(20),code:d.z.string().trim().min(1).max(120),message:d.z.string().trim().min(1).max(4096),statusCode:d.z.number().int().optional(),issues:d.z.array(d.z.object({path:d.z.array(d.z.union([d.z.string(),d.z.number()])).optional(),message:d.z.string()}).passthrough()).optional()}).passthrough().optional()}).strict();d.z.object({nodeStates:d.z.array(ic).default([])}).passthrough();const rc=d.z.object({id:Kd,name:d.z.string().trim().min(1).max(160),status:d.z.enum(["unknown","online","offline","degraded"]),health:d.z.enum(["unknown","ok","degraded","failed"]),connectionMode:d.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]),connectionPhase:Zd.optional(),lastSeenAt:Jd.optional(),observedAt:Jd,capabilities:d.z.array(d.z.string().trim().min(1).max(120)).max(256),error:tc.optional()}).strict();d.z.array(rc);const oc=d.z.object({id:d.z.string().trim().min(1).max(120),name:d.z.string().trim().min(1).max(120),kind:d.z.enum(["tty","gui","web"]),supportsCwdSelection:d.z.boolean()}).strict(),ac=d.z.object({id:Kd,name:d.z.string().trim().min(1).max(160),nodeId:Kd,status:d.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]),health:d.z.enum(["unknown","ok","degraded","failed"]),connectionStatus:d.z.enum(["unknown","online","offline","endpoint-unreachable"]),ready:d.z.boolean(),capabilities:Xd.default({aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),config:d.z.object({defaultCodexPermissionMode:we.default("ask")}).strict().default({defaultCodexPermissionMode:"ask"}),lastHeartbeatAt:Jd.optional(),heartbeatAgeMs:d.z.number().int().nonnegative().optional(),observedAt:Jd,runtime:d.z.object({id:Kd,name:d.z.string().trim().min(1).max(160).optional(),type:d.z.enum(["docker","kubernetes","local"]).optional()}).strict(),workspace:d.z.object({status:d.z.enum(["unknown","pending","ready","failed"]),path:d.z.string().trim().max(4096).optional()}).strict(),protocol:d.z.object({version:d.z.string().optional(),compatible:d.z.boolean(),warning:d.z.string().trim().min(1).max(500).optional()}).strict(),aiSessions:yt,availableActions:d.z.array(ec).max(4).default([]),availableApps:d.z.array(oc).max(256).default([]),availableAgents:d.z.array(oc).max(256),error:tc.optional()}).strict();function dc(e){if(!e||"object"!=typeof e)return;const t=e,n=Ni.safeParse(t.build),s=Zs.safeParse(t.platform),i=ei.safeParse(t.arch),r=Pr.safeParse(t.capabilities);return{..."boolean"==typeof t.ok?{ok:t.ok}:{},..."string"==typeof t.role?{role:t.role}:{},..."string"==typeof t.nodeId?{nodeId:t.nodeId}:{},..."string"==typeof t.protocolVersion?{protocolVersion:t.protocolVersion}:{},...s.success?{platform:s.data}:{},...i.success?{arch:i.data}:{},...r.success?{capabilities:r.data}:{},...n.success?{build:n.data}:{},..."string"==typeof t.serverTime?{serverTime:t.serverTime}:{}}}function cc(e){const{agent:t,...n}=e.capabilities,{secret:s,...i}=e.auth,r=i.pairing?{...i.pairing,joinToken:void 0}:void 0,o=dc(t);return{...e,auth:r?{...i,pairing:r}:i,capabilities:o?{...n,agent:o}:n}}function lc(e){return"local-folder"===e.type?{mode:"local-bind",path:"/workspace",readOnly:!1}:{mode:"git-clone",path:"/workspace",readOnly:!1}}function pc(e){return function(e){const{registrationToken:t,target:n,agentStatus:s,targetStatus:i,uiAccessStatus:r,...o}=e;return o}(function(e){const t=`/instances/${encodeURIComponent(e.id)}`,n={strategy:"control-plane-proxy",web:`${t}/`,api:`${t}/api`,ws:`${t}/api`,status:"online"===e.connectionStatus||"online"===e.agentStatus?"reachable":"endpoint-unreachable"};return{...e,access:n}}(e))}function uc(e){const{key:t,...n}=e;return{...n,keyPreview:(s=e.key,s.length<=8?"set":`${s.slice(0,4)}...${s.slice(-4)}`),keySet:!0};var s}function hc(e){return e?e instanceof Headers?Object.fromEntries(e.entries()):Array.isArray(e)?Object.fromEntries(e.map(([e,t])=>[e,t])):Object.fromEntries(Object.entries(e).map(([e,t])=>[e,String(t)])):{}}function mc(e){const t=String(e||"").split(":");if(3===t.length&&"ai"===t[1]&&t[0]&&t[2])return{instanceId:t[0],aiSessionId:t[2]}}function gc(e){return e instanceof Error?e.message:String(e)}function yc(e,t){const n=new Error(t);throw Object.assign(n,{statusCode:404,code:e}),n}d.z.array(ac);const fc=d.z.object({proxyOrigin:Qn,inviteToken:d.z.string().trim().min(24).max(512),name:d.z.string().trim().min(1).max(160).optional()}).strict(),Ic=d.z.object({data:d.z.object({binding:hs,closed:d.z.object({abortedRequests:d.z.number().int().nonnegative(),closedSockets:d.z.number().int().nonnegative()}).strict()}).strict()}).strict();class bc{claimOperations=new Map;options;constructor(e){this.options=e}listPendingClaims(){return this.options.privateStore.publicPendingClaims()}async claimNode(e){const t=fc.parse(e),n=Eo(),s=Po("proxy_claim"),i={id:s,claimId:s,proxyOrigin:t.proxyOrigin,...t.name?{requestedName:t.name}:{},sourceControlPlaneId:this.options.privateStore.controlPlaneId(),bindingKeyId:Po("proxy_key"),credential:jo(),status:"pending",createdAt:n,updatedAt:n,expiresAt:new Date(Date.now()+864e5).toISOString()};return this.options.privateStore.putPendingClaim(i),this.withClaimLock(i.claimId,()=>this.completeClaim(i,t.inviteToken))}async resumeClaim(e){const t=this.options.privateStore.pendingClaimByReference(e);return t||yc("CONTROL_PLANE_PROXY_CLAIM_NOT_FOUND",`Proxy claim ${e} was not found.`),this.withClaimLock(t.claimId,async()=>{const t=this.options.privateStore.pendingClaimByReference(e);return t||yc("CONTROL_PLANE_PROXY_CLAIM_NOT_FOUND",`Proxy claim ${e} was not found.`),this.completeClaim(t)})}async cancelClaim(e,t=!1){const n=this.options.privateStore.pendingClaimByReference(e);return n?this.withClaimLock(n.claimId,async()=>{const n=this.options.privateStore.pendingClaimByReference(e);if(!n)return{deleted:!1,compensationRequired:!1,remoteRevoke:"not-required"};if(t)return{deleted:this.options.privateStore.forceDeletePendingClaim(e),compensationRequired:!1,remoteRevoke:"not-required",forced:!0,orphanRisk:!0};if("pending"===n.status)return{...this.options.privateStore.cancelPendingClaim(n.claimId,!1),remoteRevoke:"not-required"};let s;try{s=await this.requestClaim(n)}catch(e){throw this.compensationError(n,"Trusted control-plane proxy is unavailable; claim cancellation requires retry.",e,503,"CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",!0,{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"})}const i=await this.responsePayload(s);if(!s.ok){const e=i?.error?.code;if(e===rs.InviteInvalid||e===rs.BindingRevoked||e===rs.BindingUnknown)return{deleted:this.options.privateStore.completePendingClaimCompensation(n.claimId),compensationRequired:!1,remoteRevoke:e===rs.InviteInvalid?"not-created":"already-revoked"};throw this.compensationError(n,i?.error?.message||`Proxy claim recovery failed with HTTP ${s.status}.`,void 0,s.status,e,i?.error?.retryable)}const r=oa(ws,i?.data);this.requireClaimResultIdentity(n,r);const o=this.compensationCredential(n,r);let a;try{a=await this.revokeBinding(o)}catch(e){throw this.compensationError(n,"Trusted control-plane proxy is unavailable; binding revocation requires retry.",e,503,"CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",!0,{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"})}const d=await this.responsePayload(a);if(!a.ok&&d?.error?.code!==rs.BindingRevoked&&d?.error?.code!==rs.BindingUnknown)throw this.compensationError(n,d?.error?.message||`Proxy binding revoke failed with HTTP ${a.status}.`,void 0,a.status,d?.error?.code,d?.error?.retryable);if(a.ok)try{this.requireRevocationReceipt(d,o)}catch(e){throw this.compensationError(n,"Proxy binding revocation returned an invalid receipt; compensation requires retry.",e,502,rs.TransportFailed,!0)}return{deleted:this.options.privateStore.completePendingClaimCompensation(n.claimId),compensationRequired:!1,remoteRevoke:a.ok?"revoked":"already-revoked"}}):{deleted:!1,compensationRequired:!1,remoteRevoke:"not-required"}}applyTargetSnapshot(e,t){const n=this.requireProxyNodeIdentity(e,t.binding.id,t.binding.targetNodeId);return this.putTargetState(n,t.target,{reachability:"reachable",bindingStatus:t.binding.status,bindingRevision:t.binding.revision,streamId:t.streamId,revision:t.revision,observedAt:t.observedAt})}applyTargetEvent(e,t){const n=this.requireProxyNodeIdentity(e,void 0,t.targetNodeId),s=n.proxyState;if(!s?.streamId||s.streamId!==t.streamId||void 0===s.revision||t.revision!==s.revision+1){const e=new Error("Proxy target event does not continue the authoritative snapshot cursor.");throw Object.assign(e,{code:rs.SnapshotRequired,statusCode:409,retryable:!0}),e}return this.putTargetState(n,t.target,{...s,reachability:"reachable",bindingStatus:"revoked"===s.bindingStatus?"revoked":"active",revision:t.revision,observedAt:t.event.createdAt})}markUnavailable(e,t){const n=this.requireProxyNodeIdentity(e),s=Eo();return this.options.nodes.put(Rr.parse({...n,status:"degraded",health:"degraded",proxyState:{...n.proxyState,reachability:"unreachable",bindingStatus:n.proxyState?.bindingStatus??"unknown",lastError:t,updatedAt:s},updatedAt:s}))}markBindingRevoked(e,t){const n=this.requireProxyNodeIdentity(e),s=Eo();return this.options.nodes.put(Rr.parse({...n,status:"degraded",health:"degraded",proxyState:{...n.proxyState,reachability:"reachable",bindingStatus:"revoked",lastError:t,updatedAt:s},updatedAt:s}))}assertIdentityPatch(e,t){const n=t.connectionMode??e.connectionMode,s=t.connectionPath??e.connectionPath,i=t.auth??e.auth,r="control-plane-proxy"===e.connectionMode||"control-plane-proxy"===e.connectionPath.kind||"proxy-binding"===e.auth.mode,o="control-plane-proxy"===n||"control-plane-proxy"===s.kind||"proxy-binding"===i.mode,a=n!==e.connectionMode||JSON.stringify(s)!==JSON.stringify(e.connectionPath)||JSON.stringify(i)!==JSON.stringify(e.auth);if((r||o)&&a){const e=new Error("Proxy node connection identity can only be changed through the control-plane proxy lifecycle API.");throw Object.assign(e,{statusCode:409,code:"CONTROL_PLANE_PROXY_IDENTITY_IMMUTABLE",retryable:!1}),e}}async deleteNode(e,t=!1){if("control-plane-proxy"!==e.connectionMode)return{deleted:this.options.deleteNode(e.id),revoke:{mode:"not-proxied",orphanRisk:!1}};const n=this.options.privateStore.nodeCredential(e.id);if(!n){if(!t){const e=new Error("Proxy node credential is missing; remote binding cannot be revoked.");throw Object.assign(e,{statusCode:409,code:"CONTROL_PLANE_PROXY_CREDENTIAL_REQUIRED",retryable:!1,details:{forceDeleteAllowed:!0,forceDeleteReason:"credential-missing"}}),e}return this.forceDeleteNode(e.id)}let s;try{s=await this.revokeBinding(n)}catch(n){if(t)return this.forceDeleteNode(e.id);const s=new Error("Trusted control-plane proxy is unavailable; the binding was not revoked.",{cause:n});throw Object.assign(s,{statusCode:503,code:"CONTROL_PLANE_PROXY_REVOKE_UNAVAILABLE",retryable:!0,details:{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"}}),s}const i=await this.responsePayload(s);if(!s.ok){if(i?.error?.code===rs.BindingRevoked||i?.error?.code===rs.BindingUnknown){const t=i.error.details?.bindingId;if(t===n.proxyBindingId)return this.finishRevokedNodeDelete(e.id)}const t=new Error(i?.error?.message||`Proxy binding revoke failed with HTTP ${s.status}.`);throw Object.assign(t,{statusCode:s.status,code:i?.error?.code||"CONTROL_PLANE_PROXY_REVOKE_FAILED",retryable:i?.error?.retryable??s.status>=500,details:{...(r=i?.error?.details,r&&"object"==typeof r&&!Array.isArray(r)?r:{}),forceDeleteAllowed:!1}}),t}var r;try{this.requireRevocationReceipt(i,n)}catch(e){if(e&&"object"==typeof e){const t=e;t.details={...t.details||{},forceDeleteAllowed:!1}}throw e}return this.finishRevokedNodeDelete(e.id)}async completeClaim(e,t){let n;this.options.privateStore.markCompensationRequired(e.claimId);try{n=await this.requestClaim(e,t)}catch(t){const n=new Error(`Trusted control-plane proxy ${e.proxyOrigin} is unavailable.`,{cause:t});throw Object.assign(n,{statusCode:503,code:"CONTROL_PLANE_PROXY_UNAVAILABLE",retryable:!0,claimId:e.claimId}),n}const s=await this.responsePayload(n);if(!n.ok){const t=s?.error?.retryable??n.status>=500;t||this.options.privateStore.completePendingClaimCompensation(e.claimId);const i=new Error(s?.error?.message||`Proxy claim failed with HTTP ${n.status}.`);throw Object.assign(i,{statusCode:n.status,code:s?.error?.code||"CONTROL_PLANE_PROXY_CLAIM_FAILED",retryable:t,details:s?.error?.details,claimId:e.claimId}),i}const i=oa(ws,s?.data);this.requireClaimResultIdentity(e,i);const r=this.options.nodes.get(i.target.id),o="control-plane-proxy"===r?.connectionMode&&"control-plane-proxy"===r.connectionPath.kind&&r.connectionPath.proxyBindingId===i.binding.id&&r.connectionPath.targetNodeId===i.target.id;if(r&&!o){this.options.privateStore.markCompensationRequired(e.claimId);const t=new Error(`Node ${i.target.id} already exists with another connection identity.`);throw Object.assign(t,{statusCode:409,code:"CONTROL_PLANE_PROXY_NODE_IDENTITY_CONFLICT",claimId:e.claimId}),t}const a={id:`proxy_credential_${i.target.id}`,nodeId:i.target.id,proxyOrigin:e.proxyOrigin,proxyBindingId:i.binding.id,targetNodeId:i.target.id,sourceControlPlaneId:e.sourceControlPlaneId,bindingKeyId:e.bindingKeyId,credential:e.credential,createdAt:e.createdAt,updatedAt:Eo()},d=r||Rr.parse({id:i.target.id,name:e.requestedName||i.target.name,connectionMode:"control-plane-proxy",connectionPath:{kind:"control-plane-proxy",proxyId:new URL(e.proxyOrigin).host,proxyBindingId:i.binding.id,targetNodeId:i.target.id},connectionEnabled:!0,auth:{mode:"proxy-binding"},status:i.target.status,health:i.target.health,capabilities:i.target.capabilities,proxyState:{reachability:"reachable",bindingStatus:i.binding.status,bindingRevision:i.binding.revision,observedAt:Eo(),target:i.target,updatedAt:Eo()},labels:{},lastSeenAt:i.target.lastSeenAt,createdAt:Eo(),updatedAt:Eo()});r||this.options.nodes.put(d);try{this.options.privateStore.promotePendingClaim(e.claimId,a)}catch(e){throw r||this.options.nodes.delete(d.id),e}return{node:cc(d),binding:i.binding}}requireProxyNodeIdentity(e,t,n){const s=this.options.requireNode(e);if("control-plane-proxy"!==s.connectionMode||"control-plane-proxy"!==s.connectionPath.kind||void 0!==t&&s.connectionPath.proxyBindingId!==t||void 0!==n&&s.connectionPath.targetNodeId!==n){const e=new Error("Proxy state identity does not match the node connection path.");throw Object.assign(e,{code:rs.BindingIdentityConflict,statusCode:409,retryable:!1}),e}return s}putTargetState(e,t,n){const s=Eo();return this.options.nodes.put(Rr.parse({...e,name:t.name,status:t.status,health:t.health,capabilities:t.capabilities,lastSeenAt:t.lastSeenAt,proxyState:{...n,target:t,updatedAt:s},updatedAt:s}))}requestClaim(e,t){return this.options.fetchImpl(new URL("/api/node-proxy/claims",e.proxyOrigin),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({protocolVersion:Wn,...t?{inviteToken:t}:{},claimId:e.claimId,sourceControlPlaneId:e.sourceControlPlaneId,...e.targetNodeId?{targetNodeId:e.targetNodeId}:{},bindingKeyId:e.bindingKeyId,credential:e.credential})})}revokeBinding(e){return this.options.fetchImpl(new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}`,e.proxyOrigin),{method:"DELETE",headers:qd(e)})}async responsePayload(e){return e.json().catch(()=>{})}requireRevocationReceipt(e,t){const n=ra(Ic,e),s=n.success?n.data.data.binding:void 0;if(!s||s.id!==t.proxyBindingId||s.sourceControlPlaneId!==t.sourceControlPlaneId||s.targetNodeId!==t.targetNodeId||s.bindingKeyId!==t.bindingKeyId||"revoked"!==s.status){const e=new Error("Proxy binding revocation receipt does not match the local binding identity.");throw Object.assign(e,{statusCode:502,code:rs.TransportFailed,retryable:!0,details:{bindingId:t.proxyBindingId}}),e}return s}requireClaimResultIdentity(e,t){if(t.binding.claimId!==e.claimId||t.binding.sourceControlPlaneId!==e.sourceControlPlaneId||t.binding.bindingKeyId!==e.bindingKeyId||t.binding.targetNodeId!==t.target.id||void 0!==e.targetNodeId&&t.binding.targetNodeId!==e.targetNodeId){const t=new Error("Proxy claim response does not match the persisted pending identity.");throw Object.assign(t,{statusCode:409,code:rs.BindingIdentityConflict,retryable:!1,claimId:e.claimId,compensationRequired:!0}),t}}compensationCredential(e,t){return{id:`proxy_compensation_${t.binding.id}`,nodeId:t.target.id,proxyOrigin:e.proxyOrigin,proxyBindingId:t.binding.id,targetNodeId:t.target.id,sourceControlPlaneId:e.sourceControlPlaneId,bindingKeyId:e.bindingKeyId,credential:e.credential,createdAt:e.createdAt,updatedAt:Eo()}}compensationError(e,t,n,s=503,i="CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",r=!0,o){const a=new Error(t,void 0===n?void 0:{cause:n});return Object.assign(a,{statusCode:s,code:i,retryable:r,claimId:e.claimId,compensationRequired:!0,...o?{details:o}:{}}),a}async withClaimLock(e,t){const n=(this.claimOperations.get(e)??Promise.resolve()).catch(()=>{}).then(t);this.claimOperations.set(e,n);try{return await n}finally{this.claimOperations.get(e)===n&&this.claimOperations.delete(e)}}finishRevokedNodeDelete(e){const t=this.options.deleteNode(e);return this.options.privateStore.deleteNodeCredential(e),{deleted:t,revoke:{mode:"revoked",orphanRisk:!1}}}forceDeleteNode(e){const t=this.options.deleteNode(e);return this.options.privateStore.deleteNodeCredential(e),{deleted:t,revoke:{mode:"forced",orphanRisk:!0}}}}const vc=d.z.object({id:Ji.shape.id.optional(),name:Ji.shape.name,source:Gi,defaultImageSelection:Ji.shape.defaultImageSelection,defaultNodeId:Ji.shape.defaultNodeId,defaultRuntimeId:Ji.shape.defaultRuntimeId,workspacePolicy:Vi.optional(),labels:Ji.shape.labels.optional()}).strict(),Sc=vc.omit({id:!0}).partial().strict();function wc(e){return 1===Array.from(e).length&&!/[\p{L}\p{N}\s]/u.test(e)&&"/"!==e&&"\\"!==e}const Ac=d.z.string().refine(wc,"Mention trigger must be one printable non-alphanumeric character other than / or \\.");function zc(e){return 1===Array.from(e).length&&!/[\p{L}\p{N}\s]/u.test(e)&&"\\"!==e}const kc=d.z.string().refine(zc,"Command trigger must be one printable non-alphanumeric character other than \\."),Tc=d.z.object({publicBaseUrl:d.z.string().trim().max(2048).optional(),updateChannel:Oi.default("stable"),mentionTrigger:Ac.default("@"),commandTrigger:kc.default("/"),diagnosticLogs:d.z.boolean().default(!1)}).strict().refine(e=>e.mentionTrigger!==e.commandTrigger,{path:["commandTrigger"],message:"Command and mention triggers must be different."}),Cc=d.z.object({publicBaseUrl:d.z.string().trim().max(2048).optional(),updateChannel:Oi.optional(),mentionTrigger:Ac.optional(),commandTrigger:kc.optional(),diagnosticLogs:d.z.boolean().optional()}).strict(),Ec=d.z.object({id:fr.shape.id.optional(),name:fr.shape.name,description:fr.shape.description,cover:fr.shape.cover,reference:fr.shape.reference,pullPolicy:fr.shape.pullPolicy.optional(),capabilities:d.z.array(d.z.string().trim().min(1).max(80)).optional(),optionalApps:d.z.array(d.z.string().trim().min(1).max(120)).optional(),defaultEnv:fr.shape.defaultEnv.optional(),labels:fr.shape.labels.optional()}).strict(),xc=Ec.omit({id:!0}).partial().strict(),Nc=d.z.object({name:oo.shape.name.optional(),channel:oo.shape.channel.optional(),enabled:d.z.boolean().optional(),token:oo.shape.token,defaultChatId:oo.shape.defaultChatId,allowedUserIds:d.z.array(d.z.string().trim().min(1).max(240)).optional(),pollIntervalMs:oo.shape.pollIntervalMs.optional(),settings:oo.shape.settings.optional()}).strict(),Rc=Nc.extend({channel:oo.shape.channel,name:oo.shape.name.optional()}),Oc=On.extend({id:On.shape.configHash}),_c=d.z.object({name:On.shape.name,description:On.shape.description,source:xn,action:Nn,policy:Rn.partial().optional()}).strict(),Pc=_c,jc=d.z.object({instanceIds:d.z.array(Zr.shape.id).min(1),target:_n,enabled:d.z.boolean().optional()}).strict(),Dc=d.z.object({configHash:On.shape.configHash,enabled:d.z.boolean().optional()}).strict(),Mc=d.z.object({mode:d.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:Rr.shape.id.optional(),secret:d.z.string().trim().max(4096).optional(),pairedAt:Rr.shape.createdAt.optional(),pairing:d.z.object({status:d.z.enum(["pending","paired","expired"]).default("pending"),joinToken:d.z.string().trim().max(4096).optional(),expiresAt:Rr.shape.createdAt.optional()}).strict().optional()}).strict(),Lc=d.z.object({autoImportAgentConfigs:d.z.boolean().optional(),defaultCodexPermissionMode:we.optional(),aiSessionHistoryLimit:d.z.number().int().min(1).max(at).optional(),aiSessionAttachmentRetentionDays:d.z.number().int().min(0).max(365).optional()}).strict(),qc=d.z.object({id:Zr.shape.id.optional(),name:Zr.shape.name.optional(),projectId:Zr.shape.projectId,source:Gi.optional(),sourceSnapshot:d.z.record(d.z.string(),d.z.unknown()).optional(),nodeId:Zr.shape.nodeId.optional(),runtimeId:Zr.shape.runtimeId.optional(),environmentSource:Qs.optional(),imageSelection:Zr.shape.imageSelection,config:Lc.optional(),modelSelection:Zr.shape.modelSelection.optional(),start:d.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.environmentSource&&e.imageSelection&&t.addIssue({code:"custom",path:["environmentSource"],message:"environmentSource and imageSelection are mutually exclusive."})}),$c=d.z.object({name:Zr.shape.name.optional(),config:Lc.optional(),modelSelection:Zr.shape.modelSelection.optional()}).strict(),Bc=d.z.object({name:Yi.shape.name,endpoint:Yi.shape.endpoint,key:Yi.shape.key,model:Yi.shape.model,app:Yi.shape.app,enabled:Yi.shape.enabled.optional(),order:Yi.shape.order.optional(),labels:Yi.shape.labels.optional()}).strict(),Fc=Bc.partial().strict(),Uc=d.z.object({endpoint:Yi.shape.endpoint,key:Yi.shape.key.optional(),existingModelId:Yi.shape.id.optional()}).strict(),Hc=Uc.extend({model:Yi.shape.model,app:Yi.shape.app}).strict(),Wc=d.z.object({id:Rr.shape.id.optional(),name:Rr.shape.name,connectionMode:Rr.shape.connectionMode.optional(),connectionPath:Rr.shape.connectionPath.optional(),connectionEnabled:Rr.shape.connectionEnabled.optional(),auth:Mc.optional(),joinToken:d.z.string().trim().min(1).max(4096).optional(),endpoint:Rr.shape.endpoint,controlEndpoint:Rr.shape.controlEndpoint,containerEndpoint:Rr.shape.containerEndpoint,publicWebBase:Rr.shape.publicWebBase,status:d.z.enum(["unknown","online","offline","degraded"]).optional(),health:d.z.enum(["unknown","ok","degraded","failed"]).optional(),capabilities:Rr.shape.capabilities.optional(),labels:Rr.shape.labels.optional(),lastSeenAt:Rr.shape.lastSeenAt}).strict(),Gc=d.z.object({name:Rr.shape.name.optional(),connectionMode:Rr.shape.connectionMode.unwrap().optional(),connectionPath:Rr.shape.connectionPath.unwrap().optional(),connectionEnabled:Rr.shape.connectionEnabled.unwrap().optional(),auth:Mc.optional(),endpoint:Rr.shape.endpoint,controlEndpoint:Rr.shape.controlEndpoint,containerEndpoint:Rr.shape.containerEndpoint,publicWebBase:Rr.shape.publicWebBase,status:Rr.shape.status.unwrap().optional(),health:Rr.shape.health.unwrap().optional(),capabilities:Rr.shape.capabilities.unwrap().optional(),labels:Rr.shape.labels.unwrap().optional(),lastSeenAt:Rr.shape.lastSeenAt}).strict(),Vc=d.z.object({controlPlaneUrl:d.z.string().trim().url().max(2048),joinToken:d.z.string().trim().min(1).max(4096),controlPlaneName:d.z.string().trim().min(1).max(160).optional(),activate:d.z.boolean().optional()}).strict(),Kc=d.z.object({nodeName:d.z.string().trim().min(1).max(160).optional(),expiresInMs:d.z.number().int().positive().max(36e5).optional()}).strict(),Jc=d.z.object({id:d.z.string().min(1),endpoint:d.z.string().min(1),nodeId:d.z.string().min(1),keyId:d.z.string().min(1),secret:d.z.string().min(1),pairedAt:d.z.string().min(1),createdAt:d.z.string().min(1),updatedAt:d.z.string().min(1)}).strict();class Yc{options;activePendingPairingRevokes=new Set;constructor(e){this.options=e}async syncLocal(){const e={[this.options.localNodeLabel]:"true",[this.options.builtinNodeLabel]:"true"},t=process.env.TASK_HANDOFF_NODE_AGENT_TOKEN?.trim()||void 0,n=process.env.TASK_HANDOFF_NODE_AGENT_CONTROL_ENDPOINT||process.env.TASK_HANDOFF_NODE_AGENT_ENDPOINT||"http://127.0.0.1:8091",s=function(e){return Cd(e)?"local-ipc":"local-loopback"}(n),i=Rr.parse({id:"node_local_probe",name:"Local Node Probe",connectionMode:s,auth:{mode:"local-static-key",secret:t},labels:e,createdAt:Eo(),updatedAt:Eo()}),r=await this.inspect(n,i),o=Eo(),a=this.options.nodes.get(r.nodeId);for(const e of this.options.nodes.list())"true"===e.labels[this.options.localNodeLabel]&&e.id!==r.nodeId&&this.options.nodes.delete(e.id);return this.options.nodes.put(Rr.parse({...a||{},id:r.nodeId,name:a?.name||"Local Node",connectionMode:s,auth:{mode:"local-static-key",secret:t},endpoint:n,controlEndpoint:n,containerEndpoint:process.env.TASK_HANDOFF_NODE_AGENT_CONTAINER_URL,publicWebBase:process.env.TASK_HANDOFF_INSTANCE_PUBLIC_WEB_BASE,status:"online",health:"ok",capabilities:{...a?.capabilities||{},agent:dc(r.data)},labels:{...a?.labels||{},...e},createdAt:a?.createdAt||o,updatedAt:o}))}async create(e){const t=Wc.parse(e),n=Eo(),s=t.connectionMode||"direct-http";let i="auth"in(e&&"object"==typeof e&&!Array.isArray(e)?e:{})?t.auth:{mode:"local-ipc"===s||"local-loopback"===s?"local-static-key":"paired-hmac"};const r="direct-http"===s||"reverse-wss"===s;if(r&&"paired-hmac"!==i.mode)throw Qc("Remote node connections require paired-HMAC authentication.","NODE_AGENT_REMOTE_REQUIRES_PAIRED_HMAC");const o=t.controlEndpoint||t.endpoint;if(!o&&"reverse-wss"!==s)throw Qc("Node agent direct HTTP mode requires an endpoint.","NODE_AGENT_ENDPOINT_REQUIRED");const a=t.joinToken&&o?await this.completePairing(o,t.joinToken):void 0;let d,c=!1;try{if(d=a&&o?this.pendingPairingRevoke(o,a):void 0,d&&(this.activePendingPairingRevokes.add(d.id),this.options.pendingPairingRevokes?.put(d)),a){if(a.invalidResponse||a.unsafePublicIdentifiers)throw Object.assign(new Error("Node agent pairing response reflected secret material in a public identifier."),{statusCode:502,code:"NODE_AGENT_PAIRING_RESPONSE_INVALID"});i={mode:"paired-hmac",keyId:a.keyId,secret:a.secret,pairedAt:a.pairedAt,pairing:{status:"paired"}}}if(r&&!i.secret)throw Qc("Remote node connections require a paired node secret or join token.","NODE_AGENT_REMOTE_SECRET_REQUIRED");if(r&&!i.keyId)throw Qc("Remote node connections require a paired key id.","NODE_AGENT_REMOTE_KEY_ID_REQUIRED");const e=t.id||a?.nodeId||Po("node"),u=Rr.parse({id:e,name:t.name,connectionMode:s,auth:i,labels:t.labels||{},createdAt:n,updatedAt:n}),h="reverse-wss"===s&&(t.id||a?.nodeId)?void 0:await this.inspect(o||"",u),m=t.id||a?.nodeId||h?.nodeId||e;if(!m)throw Qc("Node id is required.","NODE_ID_REQUIRED");if(a&&t.id&&t.id!==a.nodeId)throw Qc(`Paired node id ${a.nodeId} does not match requested node id ${t.id}.`,"NODE_AGENT_ID_MISMATCH");if(t.id&&h?.nodeId&&h.nodeId!==t.id)throw Qc(`Node agent id ${h.nodeId} does not match requested node id ${t.id}.`,"NODE_AGENT_ID_MISMATCH");if(a&&h?.nodeId&&h.nodeId!==a.nodeId)throw Object.assign(new Error("Node agent health identity did not match the completed pairing."),{statusCode:502,code:"NODE_AGENT_PAIRING_IDENTITY_MISMATCH"});const{joinToken:g,...y}=t,f=Rr.parse({...y,id:m,connectionMode:s,auth:i,endpoint:o,controlEndpoint:o,status:t.status||(h?"online":"unknown"),health:t.health||(h?"ok":"unknown"),capabilities:{...t.capabilities||{},...h?{agent:dc(h.data)}:{}},labels:t.labels||{},createdAt:n,updatedAt:n});if(a&&(l=f,p=a.secret,nl(cc(l),p)))throw Object.assign(new Error("Node agent health response reflected pairing secret material."),{statusCode:502,code:"NODE_AGENT_PAIRING_SECRET_REFLECTED"});c=!0;const I=this.options.nodes.put(f);return this.clearPendingPairingRevoke(d,a),I}catch(e){if(a&&o){const t=this.pairingPersistence(a);if("present"===t.state)return this.clearPendingPairingRevoke(d,a),t.node;if("unknown"===t.state&&c)throw sl(Object.assign(new Error("Node creation persistence outcome is uncertain; pairing compensation is pending."),{statusCode:503,code:"NODE_AGENT_PAIRING_PERSISTENCE_UNCERTAIN",retryable:!0}),a.secret);throw await this.compensatePairing(o,a,e),this.clearPendingPairingRevoke(d,a),sl(e,a.secret)}throw e}finally{d&&this.activePendingPairingRevokes.delete(d.id)}var l,p}async recoverPendingPairingRevokes(){const e=(this.options.pendingPairingRevokes?.list()||[]).filter(e=>!this.activePendingPairingRevokes.has(e.id));await Promise.all(e.map(async e=>{try{const t={nodeId:e.nodeId,keyId:e.keyId,secret:e.secret,pairedAt:e.pairedAt,invalidResponse:!1,unsafePublicIdentifiers:!1},n=this.pairingPersistence(t);if("present"===n.state)return void this.clearPendingPairingRevoke(e,t);if("unknown"===n.state)return;await this.compensatePairing(e.endpoint,t,Object.assign(new Error("Recovering a pending pairing revocation."),{code:"NODE_AGENT_PAIRING_REVOCATION_PENDING"})),this.clearPendingPairingRevoke(e,t)}catch{}}))}pendingPairingRevoke(e,t){if(!this.options.pendingPairingRevokes)return;const n=Eo();return Jc.parse({id:Po("pairing_revoke"),endpoint:e,nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,pairedAt:t.pairedAt,createdAt:n,updatedAt:n})}pairingPersistence(e){let t;try{t=this.options.nodes.get(e.nodeId)}catch{return{state:"unknown"}}return"paired-hmac"===t?.auth.mode&&t.auth.keyId===e.keyId&&t.auth.secret===e.secret?{state:"present",node:t}:{state:"absent"}}clearPendingPairingRevoke(e,t){if(e)try{this.options.pendingPairingRevokes?.delete(e.id)}catch(e){try{this.options.warn({nodeId:t?el(t.nodeId,t.secret):void 0,keyId:t?el(t.keyId,t.secret):void 0,errorCode:"NODE_AGENT_PAIRING_OUTBOX_CLEANUP_FAILED"},"node agent pairing outbox cleanup failed; recovery will retry")}catch{}}}async inspect(e,t){const n="/health",s=t?zd(t,{method:"GET",pathWithQuery:`/api/node-agent${n}`}):{},i=await Rd(this.options.fetchImpl,e,n,{headers:s}),r=await i.json().catch(()=>({}));if(!i.ok)throw this.options.warn(tl({nodeEndpoint:e,statusCode:i.status,errorCode:"NODE_AGENT_HEALTH_FAILED"},t?.auth.secret),"node agent health check failed"),Object.assign(new Error(r.error?.message||`Node agent health check failed with HTTP ${i.status}`),{statusCode:i.status,code:"NODE_AGENT_HEALTH_FAILED"});const o="string"==typeof r.data?.nodeId&&r.data.nodeId.trim()?r.data.nodeId.trim():void 0;if(!o)throw this.options.warn(tl({nodeEndpoint:e,errorCode:"NODE_AGENT_ID_MISSING"},t?.auth.secret),"node agent health response missing node id"),Object.assign(new Error("Node agent health response did not include nodeId."),{statusCode:502,code:"NODE_AGENT_ID_MISSING"});const a=ra(Ni,r.data?.build);return r.data?.protocolVersion!==ks&&this.options.warn(tl({nodeId:o,nodeEndpoint:e,expectedProtocolVersion:ks,actualProtocolVersion:r.data?.protocolVersion,build:a.success?a.data:void 0,errorCode:"PROTOCOL_VERSION_MISMATCH"},t?.auth.secret),"node agent protocol version mismatch"),this.options.info(tl({nodeId:o,nodeEndpoint:e,protocolVersion:r.data.protocolVersion,build:a.success?a.data:void 0},t?.auth.secret),"node agent health check ok"),{nodeId:o,data:r.data||{}}}async completePairing(e,t){const n=await this.options.fetchImpl(`${e.replace(/\/$/,"")}/api/node-agent/pairing/complete`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({joinToken:t,controlPlaneName:"Control Plane"})}),s=await n.json().catch(()=>({}));if(!n.ok)throw Object.assign(new Error(s.error?.message||`Node agent pairing failed with status ${n.status}.`),{statusCode:n.status,code:"NODE_AGENT_PAIRING_FAILED"});const i=s.data;if("string"!=typeof i?.nodeId||!i.nodeId.trim()||"string"!=typeof i?.keyId||!i.keyId.trim()||"string"!=typeof i?.secret||!i.secret.trim())throw Object.assign(new Error("Node agent pairing response did not include nodeId, keyId, and secret."),{statusCode:502,code:"NODE_AGENT_PAIRING_RESPONSE_INVALID"});const r=ra(Lr,i),o=i.nodeId.trim(),a=i.keyId.trim(),d=i.secret.trim();return{nodeId:o,keyId:a,secret:d,pairedAt:r.success?r.data.pairedAt:Eo(),invalidResponse:!r.success,unsafePublicIdentifiers:o.includes(d)||a.includes(d)}}async compensatePairing(e,t,n){const s="/pairing/current",i=`/api/node-agent${s}`,r={id:t.nodeId,connectionMode:"direct-http",auth:{mode:"paired-hmac",keyId:t.keyId,secret:t.secret}};try{const o=await Rd(this.options.fetchImpl,e,s,{method:"DELETE",headers:zd(r,{method:"DELETE",pathWithQuery:i}),signal:AbortSignal.timeout(1e4)}),a=await o.json().catch(()=>({}));if(!o.ok)throw Object.assign(new Error(`Node agent pairing revoke failed with HTTP ${o.status}.`),{statusCode:o.status,code:Zc(a.error?.code,t.secret,"NODE_AGENT_PAIRING_REVOKE_FAILED"),retryable:408===o.status||429===o.status||o.status>=500});const d=ra($r,a.data);if(!d.success)throw Object.assign(new Error("Node agent pairing revoke receipt was invalid."),{statusCode:502,code:"NODE_AGENT_PAIRING_REVOKE_RECEIPT_INVALID",retryable:!1});if(d.data.keyId!==t.keyId)throw Object.assign(new Error("Node agent pairing revoke receipt did not match the paired key."),{statusCode:502,code:"NODE_AGENT_PAIRING_REVOKE_RECEIPT_MISMATCH",retryable:!1});try{this.options.info({nodeId:el(t.nodeId,t.secret),keyId:el(t.keyId,t.secret),originalErrorCode:Xc(n,t.secret)},"node agent pairing revoked after node creation failed")}catch{}}catch(e){const s={nodeId:el(t.nodeId,t.secret),keyId:el(t.keyId,t.secret),originalErrorCode:Xc(n,t.secret),compensationErrorCode:Xc(e,t.secret)};try{this.options.warn(s,"node agent pairing compensation failed")}catch{}throw Object.assign(new Error("Node creation failed after pairing, and the remote pairing could not be revoked."),{statusCode:502,code:"NODE_AGENT_PAIRING_COMPENSATION_FAILED",retryable:(o=e,!o||"object"!=typeof o||!("retryable"in o)||"boolean"!=typeof o.retryable||o.retryable),details:s})}var o}}function Qc(e,t){return Object.assign(new Error(e),{statusCode:400,code:t})}function Xc(e,t){return Zc(e&&"object"==typeof e&&"code"in e?e.code:void 0,t,"UNKNOWN_ERROR")}function Zc(e,t,n){return"string"!=typeof e||!/^[A-Z][A-Z0-9_]{0,127}$/.test(e)||e.includes(t)?n:e}function el(e,t){return e.includes(t)?"[redacted]":e}function tl(e,t){if(!t)return e;const n=e=>"string"==typeof e?e.includes(t)?"[redacted]":e:Array.isArray(e)?e.map(n):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).map(([e,s])=>[e.includes(t)?"[redacted-key]":e,n(s)])):e;return n(e)}function nl(e,t){return"string"==typeof e?e.includes(t):Array.isArray(e)?e.some(e=>nl(e,t)):!(!e||"object"!=typeof e)&&Object.entries(e).some(([e,n])=>e.includes(t)||nl(n,t))}function sl(e,t){const n=e instanceof Error&&!e.message.includes(t)?e.message:"Node creation failed after pairing.",s=e&&"object"==typeof e&&"statusCode"in e&&"number"==typeof e.statusCode?e.statusCode:502,i=Object.assign(new Error(n),{statusCode:s,code:Xc(e,t)});return e&&"object"==typeof e&&"retryable"in e&&"boolean"==typeof e.retryable&&Object.assign(i,{retryable:e.retryable}),i}class il{values=new Map;put(e,t,n=Date.now()){this.prune(n),this.values.set(e,t)}take(e,t=Date.now()){this.prune(t);const n=this.values.get(e);return n&&this.values.delete(e),n}peek(e,t=Date.now()){return this.prune(t),this.values.get(e)}delete(e,t=Date.now()){this.prune(t);const n=this.values.get(e);return n&&this.values.delete(e),n}list(e=Date.now()){return this.prune(e),[...this.values.values()]}prune(e=Date.now()){for(const[t,n]of this.values)Date.parse(n.expiresAt)<=e&&this.values.delete(t)}}const rl=d.z.object({joinToken:d.z.string().trim().min(1).max(4096),nodeId:Rr.shape.id,nodeName:Rr.shape.name.optional(),keyId:d.z.string().trim().min(1).max(160),secret:d.z.string().trim().min(1).max(4096),pairedAt:d.z.string().datetime().optional()}).strict();class ol{options;invites=new il;constructor(e){this.options=e}createInvite(e={}){const t=Kc.parse(e&&"object"==typeof e?e:{}),n=jo(),s={id:Po("node_join"),tokenHash:al(n),expiresAt:new Date(Date.now()+(t.expiresInMs||6e5)).toISOString(),...t.nodeName?{nodeName:t.nodeName}:{}};return this.invites.put(s.tokenHash,s),{id:s.id,joinToken:n,expiresAt:s.expiresAt}}complete(e){const t=rl.parse(e),n=al(t.joinToken),s=this.invites.take(n);if(!s)throw Object.assign(new Error("Node join token is invalid or expired."),{statusCode:401,code:"NODE_JOIN_TOKEN_INVALID"});const i=Eo();if(this.options.nodes.get(t.nodeId))throw Object.assign(new Error(`Node ${t.nodeId} already exists in this control-plane.`),{statusCode:409,code:"NODE_JOIN_NODE_ALREADY_EXISTS"});return this.options.nodes.put(Rr.parse({id:t.nodeId,name:t.nodeName||s.nodeName||t.nodeId,connectionMode:"reverse-wss",auth:{mode:"paired-hmac",keyId:t.keyId,secret:t.secret,pairedAt:t.pairedAt||i,pairing:{status:"paired"}},status:"unknown",health:"unknown",capabilities:{},labels:{},createdAt:i,updatedAt:i}))}}function al(e){return s.createHash("sha256").update(e).digest("hex")}function dl(e,t){const n=cl(e);return n.pathname=`${n.pathname.replace(/\/+$/,"")}/${t.replace(/^\/+/,"")}`,n.search="",n.hash="",n.toString()}function cl(e){let t;try{t=new URL(e.trim())}catch{throw hl("MODEL_ENDPOINT_INVALID","The model endpoint must be a valid HTTP or HTTPS URL.",400)}if("http:"!==t.protocol&&"https:"!==t.protocol||t.username||t.password)throw hl("MODEL_ENDPOINT_INVALID","The model endpoint must be an HTTP or HTTPS URL without embedded credentials.",400);return t}async function ll(e,t,n){try{return await e(t,{...n,redirect:"error",signal:AbortSignal.timeout(15e3)})}catch(e){const t=e&&"object"==typeof e&&"name"in e&&"TimeoutError"===e.name;throw hl(t?"MODEL_ENDPOINT_TIMEOUT":"MODEL_ENDPOINT_UNREACHABLE",t?"The model endpoint timed out.":"The model endpoint could not be reached.",t?504:502)}}async function pl(e,t){const n=await e.text();if(n.length>1e6)throw hl(t,"The model endpoint response was too large.",502);try{const e=JSON.parse(n);if(!e||"object"!=typeof e||Array.isArray(e))throw new Error("not an object");return e}catch{throw hl(t,"The model endpoint returned invalid JSON.",502)}}function ul(e,t){return hl(e,401===t||403===t?"The model endpoint rejected the API key.":"The model endpoint rejected the request.",502,t)}function hl(e,t,n,s){return Object.assign(new Error(t),{code:e,statusCode:n,...s?{details:{upstreamStatus:s}}:{}})}function ml(e,t){e.includes(t)||e.push(t)}function gl(e){const t=new Set;return e.filter(e=>!t.has(e.id)&&(t.add(e.id),!0))}class yl{options;constructor(e){this.options=e}list(){return this.listAll().map(uc)}async listFederated(e,t=!1){const n=this.options.listNodes(),s=t?this.options.gateway.readFleetModels(n):await this.options.gateway.listFleetModels(n,{signal:e});t&&this.options.gateway.refreshFleetModels(n);const i=new Map;for(const e of this.listAll())i.set(e.id,{id:e.id,model:uc(e),locations:[{type:"control-plane",name:e.name,enabled:e.enabled,order:e.order}],referenceCount:0});for(const{nodeId:e,model:t}of s.items){const{referenceCount:n,...s}=t,r=i.get(t.id);r?(r.locations.push({type:"node",nodeId:e,name:t.name,enabled:t.enabled,order:t.order,referenceCount:t.referenceCount}),r.referenceCount+=t.referenceCount):i.set(t.id,{id:t.id,model:s,locations:[{type:"node",nodeId:e,name:t.name,enabled:t.enabled,order:t.order,referenceCount:t.referenceCount}],referenceCount:t.referenceCount})}return sr.parse({models:[...i.values()].sort((e,t)=>e.model.order-t.model.order||e.model.name.localeCompare(t.model.name)),nodeDiagnostics:s.nodeErrors.map(e=>({nodeId:e.nodeId,code:e.code,message:e.message})),updatedAt:Eo()})}create(e){const t=Bc.parse(e),n=Eo(),s=ir(t),i=this.options.models.get(s),r=Yi.parse({...t,id:s,enabled:t.enabled??!0,order:t.order??this.nextOrder(),labels:t.labels||{},createdAt:i?.createdAt||n,updatedAt:n});return uc(this.options.models.put(r))}update(e,t){const n=Fc.parse(t),s=this.requireSecret(e),i=Yi.parse({...s,...n,key:n.key?.trim()?n.key:s.key,createdAt:s.createdAt,updatedAt:Eo()}),r=ir(i);return uc(this.options.models.put(Yi.parse({...i,id:r})))}delete(e){return this.requireSecret(e),this.options.models.delete(e)}reorder(e){const t=[...new Set(e)],n=new Map(this.options.models.list().map(e=>[e.id,e]));for(const e of t)n.has(e)||yc("MODEL_NOT_FOUND",`Model ${e} was not found.`);return t.forEach((e,t)=>{const s=n.get(e);this.options.models.put(Yi.parse({...s,order:100*(t+1),updatedAt:Eo()}))}),this.list()}createOnNode(e,t){return this.options.gateway.createModel(this.options.requireNode(e),t)}updateOnNode(e,t,n){return this.options.gateway.updateModel(this.options.requireNode(e),t,n)}deleteOnNode(e,t){return this.options.gateway.deleteModel(this.options.requireNode(e),t)}discover(e){const t=Uc.parse(e);return async function(e,t){const n=function(e){const t=cl(e),n=[],s=t.pathname.split("/").filter(Boolean).at(-1)||"";return ml(n,dl(t.toString(),/^v\d+$/.test(s)?"models":"v1/models")),ml(n,new URL("/v1/models",t.origin).toString()),ml(n,new URL("/models",t.origin).toString()),n}(t.endpoint),s=Date.now();let i;for(const r of n){const n=await ll(e,r,{method:"GET",headers:{accept:"application/json",authorization:`Bearer ${t.key}`}});if(404===n.status||405===n.status){i=n.status;continue}if(!n.ok)throw ul("MODEL_DISCOVERY_FAILED",n.status);const o=await pl(n,"MODEL_DISCOVERY_RESPONSE_INVALID"),a=Array.isArray(o.data)?o.data:void 0;if(!a)throw hl("MODEL_DISCOVERY_RESPONSE_INVALID","The model endpoint returned an invalid model list.",502);return{models:gl(a.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e,n="string"==typeof t.id?t.id.trim():"";if(!n)return[];const s="string"==typeof t.owned_by?t.owned_by.trim():"";return[{id:n,...s?{ownedBy:s}:{}}]}).sort((e,t)=>e.id.localeCompare(t.id))),latencyMs:Date.now()-s}}throw hl("MODEL_DISCOVERY_UNSUPPORTED","No compatible model-list endpoint was found for this endpoint.",502,i)}(this.options.fetchImpl,this.resolvePrivateInput(t))}test(e){const t=Hc.parse(e);return async function(e,t){const n=Date.now(),s="codex"===t.app?await ll(e,dl(t.endpoint,"responses"),{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${t.key}`,"content-type":"application/json"},body:JSON.stringify({model:t.model,input:"Reply with OK.",max_output_tokens:32,stream:!1})}):await ll(e,function(e){const t=cl(e),n=t.pathname.split("/").filter(Boolean).at(-1)||"";return dl(t.toString(),/^v\d+$/.test(n)?"messages":"v1/messages")}(t.endpoint),{method:"POST",headers:{accept:"application/json","anthropic-version":"2023-06-01","content-type":"application/json","x-api-key":t.key},body:JSON.stringify({model:t.model,max_tokens:8,messages:[{role:"user",content:"Reply with OK."}]})});if(!s.ok)throw ul("MODEL_TEST_FAILED",s.status);if((await pl(s,"MODEL_TEST_RESPONSE_INVALID")).error)throw hl("MODEL_TEST_RESPONSE_INVALID","The model endpoint returned an error payload.",502);return{success:!0,latencyMs:Date.now()-n}}(this.options.fetchImpl,this.resolvePrivateInput(t))}discoverOnNode(e,t){const n=this.options.requireNode(e);return fl(n),this.options.gateway.discoverModels(n,t)}testOnNode(e,t){const n=this.options.requireNode(e);return fl(n),this.options.gateway.testModel(n,t)}require(e,t=!1){const n=this.requireSecret(e);return t?n:uc(n)}async prepareAssignment(e,t){const n=await this.options.gateway.listModels(e),s={...null===t.codexModelHash?{codexModelHash:null}:t.codexModelHash?.trim()?{codexModelHash:t.codexModelHash.trim()}:{},...null===t.claudeModelHash?{claudeModelHash:null}:t.claudeModelHash?.trim()?{claudeModelHash:t.claudeModelHash.trim()}:{}},i=async(t,s)=>{if(null===s)return;const i=s?this.listAll().find(e=>e.id===s):this.listAll().find(e=>e.enabled&&e.app===t);if(i)return Il(i,t),await this.options.gateway.deployModel(e,i.id,i),i.id;if(!s)return;const r=n.find(e=>e.id===s);return r||yc("MODEL_NOT_FOUND",`Model ${s} was not found on control-plane or node ${e.id}.`),Il(r,t),r.id};return{modelSelection:s,codexModelHash:await i("codex",s.codexModelHash),claudeModelHash:await i("claude",s.claudeModelHash)}}async ensureInstanceAssignment(e){const t=this.options.requireNode(e.nodeId),n=await this.prepareAssignment(t,e.modelSelection);return this.options.gateway.assignInstanceModels(t,e.id,n)}listAll(){return this.options.models.list().map(e=>this.normalize(e)).sort((e,t)=>e.order-t.order||e.createdAt.localeCompare(t.createdAt)||e.id.localeCompare(t.id))}requireSecret(e){const t=this.options.models.get(e);return t||yc("MODEL_NOT_FOUND",`Model ${e} was not found.`),this.normalize(t)}normalize(e){const t=function(e){if(e&&"object"==typeof e&&!Array.isArray(e)){const t={...e};if(!("app"in t)){const e=Array.isArray(t.apps)?t.apps:[];t.app=e.includes("claude")&&!e.includes("codex")?"claude":"codex"}return delete t.apps,Yi.parse(t)}return Yi.parse(e)}(e);return t!==e&&this.options.models.put(t),t}nextOrder(){return this.options.models.list().reduce((e,t)=>Math.max(e,t.order),0)+100}resolvePrivateInput(e){const t=e.key?.trim()||(e.existingModelId?this.requireSecret(e.existingModelId).key:"");if(!t)throw Object.assign(new Error("An API key is required to contact the model endpoint."),{statusCode:400,code:"MODEL_API_KEY_REQUIRED"});return{...e,key:t}}}function fl(e){const t=e.capabilities.agent,n=t&&"object"==typeof t&&!Array.isArray(t)?t.capabilities:void 0;if(!n||"object"!=typeof n||Array.isArray(n)||!0!==n.modelEndpointProbe)throw Object.assign(new Error("This node agent does not support model endpoint discovery or testing."),{statusCode:409,code:"NODE_MODEL_ENDPOINT_PROBE_UNSUPPORTED"})}function Il(e,t){if(e.app!==t)throw Object.assign(new Error(`Model ${e.id} is not a ${t} model.`),{statusCode:400,code:"MODEL_APP_MISMATCH"});if(!e.enabled)throw Object.assign(new Error(`Model ${e.id} is disabled.`),{statusCode:400,code:"MODEL_DISABLED"})}class bl{requireNode;nodeAgentTransport;constructor(e){this.requireNode=e.requireNode,this.nodeAgentTransport=e.nodeAgentTransport}async request(e,t,n={},s){if(!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_UNREACHABLE"}),t}vl(e);const i=this.requireNode(e.nodeId),r=hc(n.headers),o=performance.now(),a=await this.nodeAgentTransport(i).request(i,`/instances/${encodeURIComponent(e.id)}/proxy`,{method:"POST",headers:{"content-type":"application/json",...r[ba]?{[ba]:r[ba]}:{}},body:JSON.stringify({path:`/api/${t.replace(/^\/+/,"")}`,method:n.method||"GET",headers:r,body:(d=n.body,"string"==typeof d?d:null==d?void 0:String(d))})});var d;const c=performance.now()-o,l=Sa(a.headers.get("server-timing"),va("node_transport",c));s?.({traceId:a.headers.get(ba)||void 0,serverTiming:l,nodeTransportMs:c});const p=await a.json().catch(()=>({}));if(!a.ok){const n=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n="string"==typeof t.code&&t.code.trim()?t.code:void 0,s="string"==typeof t.message&&t.message?t.message:void 0,i=t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?t.details:void 0,r="boolean"==typeof t.retryable?t.retryable:void 0;return n||s?{code:n,message:s,details:i,retryable:r}:void 0}(p.error),s=n?.message||function(e){if(!e||"object"!=typeof e||Array.isArray(e))return"";const t=e.message;return"string"==typeof t?t:""}(p.error)||`Instance request failed with HTTP ${a.status}`,i=500===a.status&&"NODE_AGENT_ERROR"===n?.code,r=new Error(s);throw Object.assign(r,{statusCode:i?502:a.status,code:i?"INSTANCE_PROXY_UPSTREAM_FAILED":n?.code||"INSTANCE_REQUEST_FAILED",...i?{retryable:!0}:"boolean"==typeof n?.retryable?{retryable:n.retryable}:{},...n?.details?{details:n.details}:{},instanceId:e.id,nodeId:e.nodeId,route:t}),r}return p.data??p}async proxyHttp(e,t,n={}){if("online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_UNREACHABLE"}),t}if(!e.target.web){const t=new Error(`Instance ${e.name} web endpoint is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_WEB_UNREACHABLE"}),t}vl(e);const s=this.requireNode(e.nodeId),i=await this.nodeAgentTransport(s).requestStream(s,`/instances/${encodeURIComponent(e.id)}/proxy/stream`,{method:"POST",headers:{"content-type":"application/json"},signal:n.signal,body:JSON.stringify({path:t,method:n.method||"GET",headers:hc(n.headers),...(r=n.body,null==r?{}:"string"==typeof r?{body:r}:Buffer.isBuffer(r)?{bodyBase64:r.toString("base64")}:r instanceof Uint8Array?{bodyBase64:Buffer.from(r).toString("base64")}:{body:String(r)})})});var r;return{status:i.status||502,headers:Object.fromEntries(i.headers.entries()),body:i.body}}proxyWebSocket(e,t,n,s,i={}){if(!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} web endpoint is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_WEB_UNREACHABLE"}),t}vl(e);const r=this.requireNode(e.nodeId),o=n.startsWith("/")?n.slice(1):n;this.nodeAgentTransport(r).proxyWebSocket(r,t,`/instances/${encodeURIComponent(e.id)}/proxy/ws/${o}`,s,i)}async reportHeartbeat(e,t){if(!e.registrationToken)return;const n=this.requireNode(e.nodeId),s=`/instances/${encodeURIComponent(e.id)}/heartbeat`,i={method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.registrationToken}`},body:JSON.stringify(t)},r=await this.nodeAgentTransport(n).request(n,s,i),o=await r.json().catch(()=>({}));if(!r.ok){const e=new Error(o.error?.message||`Instance heartbeat sync failed with HTTP ${r.status}`);throw Object.assign(e,{statusCode:r.status,code:"INSTANCE_HEARTBEAT_SYNC_FAILED"}),e}}}function vl(e){if(po(e))return;const t=new Error(`Instance ${e.name} is not ready.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_NOT_READY",runtimePhase:e.runtimeVersion?.phase}),t}class Sl{read(e){const t=new Map(e.projects.map(e=>[e.id,e])),n=new Map(e.images.map(e=>[e.id,e])),s=new Map(e.nodes.map(e=>[e.id,e])),i=new Map(e.runtimes.map(e=>[`${e.nodeId}:${e.id}`,e])),r=Date.now();return{items:e.instances.map(e=>function(e){const t=e.instance.lastHeartbeatAt?e.currentTime-Date.parse(e.instance.lastHeartbeatAt):void 0,n=void 0!==t&&t>3e4?"offline":e.instance.connectionStatus,s=pc(e.instance);return{...s,aiSessions:ft(s.aiSessions),connectionStatus:n,heartbeatAgeMs:t,project:e.project,image:e.image,node:e.node?cc(e.node):void 0,runtime:e.runtime,protocolCompatible:!e.instance.protocolVersion||e.instance.protocolVersion===ks}}({instance:e,currentTime:r,project:e.projectId?t.get(e.projectId):void 0,image:e.imageSnapshot||(e.imageSelection?n.get(e.imageSelection.imageId):void 0),node:s.get(e.nodeId),runtime:i.get(`${e.nodeId}:${e.runtimeId}`)})),nodeErrors:e.nodeErrors||[],nodeStates:e.nodeStates||[]}}}class wl{options;constructor(e){this.options=e}async create(e){const t=qc.parse(e),n=t.projectId?this.options.requireProject(t.projectId):void 0,s=t.runtimeId||n?.defaultRuntimeId||"runtime_local_docker",i=t.nodeId||n?.defaultNodeId||this.options.defaultNodeId();if(!i)throw zl("At least one node connection is required before creating an instance.",400,"NODE_REQUIRED");const r=this.options.requireNode(i),o=await this.options.requireRuntime(r.id,s),a=o.capabilities.requiresImage??"local"!==o.type,d=t.environmentSource||(t.imageSelection?{type:"image",imageSelection:t.imageSelection}:void 0)||(a&&n?.defaultImageSelection?{type:"image",imageSelection:n.defaultImageSelection}:void 0);if("template"===d?.type&&"docker"!==o.type)throw zl(`Runtime ${o.name} does not support environment templates.`,409,"ENVIRONMENT_TEMPLATE_RUNTIME_UNSUPPORTED");const c="image"===d?.type?d.imageSelection:void 0,l=c?this.options.resolveImageSelection(c):void 0,p="template"===d?.type?await this.options.gateway.getEnvironmentTemplate(r,d.environmentTemplateId):void 0;if(p&&"ready"!==p.status)throw zl(`Environment template ${p.id} is ${p.status}.`,409,"ENVIRONMENT_TEMPLATE_NOT_READY");if(p&&p.nodeId!==r.id)throw zl(`Environment template ${p.id} belongs to node ${p.nodeId}.`,409,"ENVIRONMENT_TEMPLATE_NODE_MISMATCH");if(a&&!l&&!p)throw zl(`Runtime ${o.name} requires an image.`,400,"RUNTIME_IMAGE_REQUIRED");const u=await this.resolveSource({node:r,runtime:o,project:n,source:t.source,sourceSnapshot:t.sourceSnapshot,imageOption:l}),h=await this.options.prepareModels(r,t.modelSelection||{}),m=l?function(e){const t=Eo();return{id:e.id,origin:e.origin,name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover,repository:e.repository,tag:e.tag,requestedReference:e.reference,resolvedDigest:e.digest,resolvedReference:e.digest?`${e.repository}@${e.digest}`:void 0,downloadSizeBytes:e.downloadSizeBytes,pullPolicy:"if-not-present",capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,market:e.market,createdAt:t,updatedAt:t}}(l):void 0,g=await this.options.gateway.createInstance(r,{id:t.id,name:t.name,runtimeId:s,...d?{environmentSource:d}:{},...l&&m?{image:m}:{},projectId:n?.id,source:u.value,sourceSnapshot:u.snapshot,config:t.config,modelSelection:{}});let y=g;try{y=(await this.options.gateway.assignInstanceModels(r,g.id,h)).instance}catch(e){throw await this.options.gateway.deleteInstance(r,g.id,{deleteVolumes:!0}).catch(()=>{}),e}let f={status:"not-requested"};if(t.start)try{y=await this.options.gateway.startInstance(r,y.id),f={status:"started"}}catch(e){f={status:"failed",error:Al(e,"INSTANCE_START_FAILED")},y=await this.options.gateway.listInstances(r).then(e=>e.find(e=>e.id===y.id)||y).catch(()=>y)}return{...pc(y),registrationToken:y.registrationToken,startOutcome:f}}async resolveSource(e){let t=e.source||e.project?.source,n=e.sourceSnapshot||(e.project?e.project:{});if(!t)throw zl("Instance source is required.",400,"INSTANCE_SOURCE_REQUIRED");if("local"===e.runtime.type&&"local-folder"!==t.type)throw zl("Localhost runtime currently supports local folder sources only.",400,"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER");if("local-folder"!==t.type)return{value:t,snapshot:n};if(t.ownerNodeId&&t.ownerNodeId!==e.node.id)throw zl(`Local folder ${t.path} belongs to node ${t.ownerNodeId}, not ${e.node.id}.`,400,"LOCAL_FOLDER_REQUIRES_OWNER_NODE");const s=t.localFolderId?await this.options.requireLocalFolder(e.node,t.localFolderId):await this.options.gateway.createLocalFolder(e.node,{name:"string"==typeof n.name?n.name:"Local folder",path:t.path,defaultImageSelection:e.imageOption?{imageId:e.imageOption.id,tag:e.imageOption.tag}:void 0});return t={...t,localFolderId:s.id,ownerNodeId:s.nodeId,path:s.path},n=s,{value:t,snapshot:n}}}function Al(e,t){const n=e&&"object"==typeof e?e:{};return{code:"string"==typeof n.code&&n.code.trim()?n.code:t,message:"string"==typeof n.message&&n.message.trim()?n.message:String(e)}}function zl(e,t,n){return Object.assign(new Error(e),{statusCode:t,code:n})}class kl{triggers;listInstances;listMutationInstances;requireInstance;instanceRequest;constructor(e){this.triggers=e.triggers,this.listInstances=e.listInstances,this.listMutationInstances=e.listMutationInstances??(async()=>({items:await e.listInstances(),partialFailures:[]})),this.requireInstance=e.requireInstance,this.instanceRequest=e.instanceRequest}async listTriggers(){const e=await this.listInstances(),t=new Map;for(const e of this.triggers.list())t.set(e.configHash,{configHash:e.configHash,config:Cl(e),deploymentCount:0,enabledCount:0,runningCount:0,errorCount:0,ownedByControlPlane:!0,controlPlaneDeploymentCount:0,deployments:[],recentRuns:[]});for(const n of e){const e=n.triggers;for(const s of e?.configs||[]){const i=t.get(s.configHash)||{configHash:s.configHash,config:s.config,deploymentCount:0,enabledCount:0,runningCount:0,errorCount:0,ownedByControlPlane:!1,controlPlaneDeploymentCount:0,deployments:[],recentRuns:[]},r=(s.deployments||[]).map(e=>({instanceId:n.id,instanceName:n.name,deployment:e,runtime:(s.runtime||[]).find(t=>t.deploymentId?t.deploymentId===e.deploymentId:t.configHash===e.configHash)}));i.deploymentCount+=r.length,i.enabledCount+=r.filter(e=>Boolean(e.deployment.enabled)).length,i.controlPlaneDeploymentCount+=r.filter(e=>"control-plane"===e.deployment.origin).length,i.runningCount+=(s.runtime||[]).filter(e=>"running"===e.status).length,i.errorCount+=(s.runtime||[]).filter(e=>"error"===e.status).length,i.deployments.push(...r),i.recentRuns.push(...(e.recentRuns||[]).filter(e=>e.configHash===s.configHash).map(e=>({...e,instanceId:n.id,instanceName:n.name}))),t.set(s.configHash,i)}}return $n.parse({updatedAt:(new Date).toISOString(),triggers:[...t.values()].sort((e,t)=>String(e.config.name||e.configHash).localeCompare(String(t.config.name||t.configHash)))})}createTrigger(e){const t=_c.parse(e||{}),n=Eo(),s={maxConcurrentRuns:t.policy?.maxConcurrentRuns??1,whenBusy:t.policy?.whenBusy??"skip",cooldownMs:t.policy?.cooldownMs},i=Bn({source:t.source,action:t.action,policy:s}),r=Oc.parse({id:i,configHash:i,name:t.name,description:t.description,source:t.source,action:t.action,policy:s,createdAt:n,updatedAt:n});return this.triggers.put(r)}async updateTrigger(e,t){const n=this.requireTrigger(e),s=Pc.parse(t||{}),i=Eo(),r={maxConcurrentRuns:s.policy?.maxConcurrentRuns??1,whenBusy:s.policy?.whenBusy??"skip",cooldownMs:s.policy?.cooldownMs},o=Bn({source:s.source,action:s.action,policy:r});if(o!==e&&this.triggers.get(o)){const e=new Error(`Trigger ${o} already exists.`);throw Object.assign(e,{statusCode:409,code:"TRIGGER_ALREADY_EXISTS"}),e}const a=Oc.parse({id:o,configHash:o,name:s.name,description:s.description,source:s.source,action:s.action,policy:r,createdAt:n.createdAt,updatedAt:i}),d=await this.listMutationInstances(),c=await Tl(d.items,8,async t=>{const n=[],s=[],i=t.triggers?.configs?.find(t=>t.configHash===e),r=(i?.deployments||[]).filter(e=>"control-plane"===e.origin);if(o===e){if(r.length)try{const s=await this.instanceRequest(t,`/triggers/${encodeURIComponent(e)}`,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({name:a.name,description:a.description??null})});n.push({instanceId:t.id,data:s})}catch(e){s.push(El(t,e))}return{results:n,partialFailures:s}}for(const i of r){const r="ai-session"===i.target.type?xl(i.target.aiSessionId,o):i.deploymentId;try{const s=await this.instanceRequest(t,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:a.name,description:a.description,source:a.source,action:a.action,policy:a.policy,deployment:{deploymentId:r,origin:"control-plane",enabled:i.enabled,target:i.target,localName:i.localName}})}),o=i.deploymentId||i.configHash;await this.instanceRequest(t,`/triggers/${encodeURIComponent(e)}/deployments/${encodeURIComponent(o)}`,{method:"DELETE"}),n.push({instanceId:t.id,deploymentId:r,data:s})}catch(e){s.push(El(t,e))}}return{results:n,partialFailures:s}}),l=c.flatMap(e=>e.results),p=[...d.partialFailures,...c.flatMap(e=>e.partialFailures)];return this.triggers.put(a),o!==e&&this.triggers.delete(e),{previousConfigHash:e,trigger:a,results:l,partialFailures:p}}async deleteTrigger(e){const t=await this.listMutationInstances(),n=this.triggers.delete(e),s=await Tl(t.items,8,async t=>{const n=[],s=[],i=t.triggers?.configs?.find(t=>t.configHash===e);if(!i)return{results:n,partialFailures:s};const r=(i.deployments||[]).filter(e=>"control-plane"===e.origin);if(!r.length)return{results:n,partialFailures:s};const o=i.deployments.every(e=>"control-plane"===e.origin);for(const i of r)try{const r=i.deploymentId?`/triggers/${encodeURIComponent(e)}/deployments/${encodeURIComponent(i.deploymentId)}`:o?`/triggers/${encodeURIComponent(e)}`:void 0;if(!r){n.push({instanceId:t.id,configHash:e,deploymentId:i.deploymentId,deleted:!1,skipped:"missing-deployment-id"}),s.push({scope:"instance",nodeId:t.nodeId,instanceId:t.id,code:"TRIGGER_DEPLOYMENT_ID_MISSING",message:`Trigger deployment on instance ${t.name} has no deletable deployment id.`});continue}const a=await this.instanceRequest(t,r,{method:"DELETE"});if(n.push({instanceId:t.id,configHash:e,deploymentId:i.deploymentId,deleted:!0,data:a}),!i.deploymentId)break}catch(r){s.push(El(t,r)),n.push({instanceId:t.id,configHash:e,deploymentId:i.deploymentId,deleted:!1,error:r instanceof Error?r.message:String(r)})}return{results:n,partialFailures:s}}),i=s.flatMap(e=>e.results),r=[...t.partialFailures,...s.flatMap(e=>e.partialFailures)];return n||i.length||yc("TRIGGER_NOT_FOUND",`Trigger ${e} was not found.`),{configHash:e,deletedTemplate:n,results:i,partialFailures:r}}async applyTrigger(e,t){const n=this.requireTrigger(e),s=jc.parse(t||{});return{configHash:e,results:await Tl(s.instanceIds,8,async e=>{const t=await this.requireInstance(e);return{instanceId:e,data:await this.instanceRequest(t,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:n.name,description:n.description,source:n.source,action:n.action,policy:n.policy,deployment:{origin:"control-plane",enabled:s.enabled??!0,target:s.target}})})}})}}async listInstanceTriggers(e){const t=await this.requireInstance(e);return this.instanceRequest(t,"/triggers")}async bindAiSessionTrigger(e,t,n){const s=Dc.parse(n||{}),i=this.requireTrigger(s.configHash),r=await this.requireInstance(e);return this.instanceRequest(r,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:i.name,description:i.description,source:i.source,action:i.action,policy:i.policy,deployment:{deploymentId:xl(t,s.configHash),origin:"control-plane",enabled:s.enabled??!0,target:{type:"ai-session",aiSessionId:t}}})})}async unbindAiSessionTrigger(e,t,n){const s=await this.requireInstance(e),i=xl(t,n);return this.instanceRequest(s,`/triggers/${encodeURIComponent(n)}/deployments/${encodeURIComponent(i)}`,{method:"DELETE"})}async runInstanceTrigger(e,t,n={}){const s=await this.requireInstance(e);return this.instanceRequest(s,`/triggers/${encodeURIComponent(t)}/run`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n||{})})}requireTrigger(e){const t=this.triggers.get(e);return t||yc("TRIGGER_NOT_FOUND",`Trigger ${e} was not found.`),t}}async function Tl(e,t,n){const s=new Array(e.length);let i,r=0,o=!1;if(await Promise.all(Array.from({length:Math.min(t,e.length)},async()=>{for(;!o&&r<e.length;){const t=r++;try{s[t]=await n(e[t],t)}catch(e){o=!0,i=e}}})),o)throw i;return s}function Cl(e){return{configHash:e.configHash,name:e.name,...void 0!==e.description?{description:e.description}:{},source:e.source,action:e.action,policy:e.policy,createdAt:e.createdAt,updatedAt:e.updatedAt}}function El(e,t){const n=t&&"object"==typeof t?t:void 0,s="string"==typeof n?.code&&n.code?n.code:"TRIGGER_INSTANCE_MUTATION_FAILED",i="string"==typeof n?.message&&n.message?n.message:String(t);return{scope:"instance",nodeId:e.nodeId,instanceId:e.id,code:s.slice(0,160),message:i.slice(0,4e3)}}function xl(e,t){return`ai_${Buffer.from(e).toString("base64url")}_${t}`}class Nl{options;constructor(e){this.options=e}getSettings(){return Tc.parse(this.options.settings.get())}updateSettings(e){const t=Cc.parse(e),n=Tc.parse({...this.getSettings(),...t,..."publicBaseUrl"in t?{publicBaseUrl:t.publicBaseUrl?.trim()||void 0}:{}});return this.options.settings.put(n)}seedDefaults(){}listProjects(){return this.options.projects.list().map(e=>this.normalizeProjectRecord(e))}getProject(e){const t=this.options.projects.get(e);return t?this.normalizeProjectRecord(t):void 0}createProject(e){const t=vc.parse(e),n=Eo(),s=Gi.parse(t.source);return this.options.projects.put(Ji.parse({...t,id:t.id||Po("proj"),source:s,defaultImageSelection:t.defaultImageSelection||{imageId:"market_taskhandoff_browser"},defaultNodeId:t.defaultNodeId||this.options.defaultNodeId(),defaultRuntimeId:t.defaultRuntimeId||"runtime_local_docker",workspacePolicy:Vi.parse(t.workspacePolicy||lc(s)),labels:t.labels||{},createdAt:n,updatedAt:n}))}updateProject(e,t){const n=Sc.parse(t),s=this.requireProject(e),i=n.source?Gi.parse(n.source):s.source;return this.options.projects.put(Ji.parse({...s,...n,id:e,source:i,workspacePolicy:n.workspacePolicy?Vi.parse(n.workspacePolicy):s.workspacePolicy,createdAt:s.createdAt,updatedAt:Eo()}))}deleteProject(e){return this.options.projects.delete(e)}requireProject(e){const t=this.getProject(e);return t||yc("PROJECT_NOT_FOUND",`Project ${e} was not found.`),t}listImages(){return this.options.images.list()}getMarketCatalog(){return{catalog:this.options.market.getCatalog(),status:this.options.market.getStatus()}}listImageOptions(e){return[...this.options.market.getCatalog().items.map(t=>this.marketImageOption(t,void 0,e,!0)),...this.listImages().map(e=>this.customImageOption(e))]}resolveImageSelection(e,t){const n=this.options.market.getCatalog().items.find(t=>t.id===e.imageId);if(n)return this.marketImageOption(n,e.tag,t);const s=this.options.images.get(e.imageId);if(s||yc("IMAGE_NOT_FOUND",`Image ${e.imageId} was not found.`),e.tag&&e.tag!==s.tag)throw Object.assign(new Error(`Custom image ${s.id} cannot override its stored tag.`),{statusCode:400,code:"CUSTOM_IMAGE_TAG_OVERRIDE"});return this.customImageOption(s)}createImage(e){const t=Ec.parse(e),n=Eo(),s=Gs(t.reference);return this.options.images.put(fr.parse({...t,id:t.id||Po("img"),origin:"custom",reference:s.reference,repository:s.repository,tag:s.tag,pullPolicy:t.pullPolicy||"if-not-present",capabilities:t.capabilities||[],optionalApps:t.optionalApps||[],defaultEnv:t.defaultEnv||{},labels:t.labels||{},createdAt:n,updatedAt:n}))}updateImage(e,t){const n=xc.parse(t),s=this.requireImage(e),i=Gs(n.reference||s.reference);return this.options.images.put(fr.parse({...s,...n,id:e,origin:"custom",reference:i.reference,repository:i.repository,tag:i.tag,createdAt:s.createdAt,updatedAt:Eo()}))}deleteImage(e){return this.options.images.delete(e)}requireImage(e){if(this.options.market.getCatalog().items.some(t=>t.id===e))throw Object.assign(new Error(`Market image ${e} is read-only.`),{statusCode:403,code:"MARKET_IMAGE_READ_ONLY"});const t=this.options.images.get(e);return t||yc("IMAGE_NOT_FOUND",`Image ${e} was not found.`),t}normalizeProjectRecord(e){const t=function(e){if(e&&"object"==typeof e&&!Array.isArray(e)){const t={...ci(e)};return"defaultRuntimeId"in t||(t.defaultRuntimeId="runtime_local_docker"),Ji.parse(t)}return Ji.parse(e)}(e);return t!==e&&this.options.projects.put(t),t}customImageOption(e){return br.parse({id:e.id,origin:"custom",name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover||dr,repository:e.repository,tag:e.tag,availableTags:e.tag?[{name:e.tag,reference:e.reference,status:"active"}]:[],reference:e.reference,capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,readOnly:!1})}marketImageOption(e,t,n,s=!1){if("yanked"===e.status&&!s)throw Object.assign(new Error(`Market image ${e.id} is no longer selectable.`),{statusCode:409,code:"MARKET_IMAGE_YANKED"});const i=t||e.defaultTag,r=e.tags.find(e=>e.name===i);if(!r)throw Object.assign(new Error(`Market image ${e.id} does not provide tag ${i}.`),{statusCode:400,code:"MARKET_IMAGE_TAG_NOT_FOUND"});if("yanked"===r.status&&!s)throw Object.assign(new Error(`Market image tag ${e.id}:${i} is no longer selectable.`),{statusCode:409,code:"MARKET_IMAGE_TAG_YANKED"});const o=r.platforms.find(e=>!(n?.os&&e.os!==n.os||n?.architecture&&e.architecture!==n.architecture)),a=this.options.market.getCatalog();return br.parse({id:e.id,origin:"market",name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover||dr,repository:e.repository,tag:r.name,availableTags:e.tags.map(e=>({name:e.name,version:e.version,reference:e.reference,manifestDigest:e.manifestDigest,status:e.status})),reference:r.reference,digest:o?.digest||r.manifestDigest,downloadSizeBytes:o?.downloadSizeBytes,unpackedSizeBytes:o?.unpackedSizeBytes,capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,readOnly:!0,lifecycleStatus:"yanked"===r.status||"yanked"===e.status?"yanked":"deprecated"===r.status||"deprecated"===e.status?"deprecated":"active",market:{catalogId:a.catalogId,catalogRevision:a.revision,publisher:e.publisher,version:r.version}})}}function Rl(e){const t=Gs(e.reference),n=t.tag||"latest";return{id:e.id,publisher:"task-handoff",slug:e.slug,name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:dr,repository:t.repository,defaultTag:n,tags:[{name:n,reference:t.reference,platforms:[],status:"active"}],capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:{},labels:{"task-handoff.image.kind":"controlled-instance","task-handoff.image.profile":e.slug},status:"active"}}function Ol(){const e=(t=process.env.TASK_HANDOFF_BUILT_AT)&&!Number.isNaN(Date.parse(t))?new Date(t).toISOString():(new Date).toISOString();var t;return gr.parse({protocolVersion:"2026-07-29",catalogId:"task_handoff_embedded",revision:process.env.TASK_HANDOFF_VERSION||"0.0.1",source:"embedded",generatedAt:e,items:[Rl({id:"market_taskhandoff_codex",slug:"codex",name:"TaskHandoff Codex",description:"Minimal Codex runtime with terminal and Codex.",localizedDescriptions:{"zh-CN":"最小 Codex 运行环境，包含终端和 Codex。"},reference:process.env.TASK_HANDOFF_CONTROLLED_CODEX_IMAGE||"huadream/task-handoff-controlled-codex:latest",capabilities:["terminal","codex"],optionalApps:["terminal-tty"]}),Rl({id:"market_taskhandoff_ai",slug:"ai",name:"TaskHandoff Codex + Claude",description:"AI development runtime with Codex, Claude, and terminal.",localizedDescriptions:{"zh-CN":"AI 开发运行环境，包含 Codex、Claude 和终端。"},reference:process.env.TASK_HANDOFF_CONTROLLED_AI_IMAGE||"huadream/task-handoff-controlled-ai:latest",capabilities:["terminal","codex","claude"],optionalApps:["terminal-tty"]}),Rl({id:"market_taskhandoff_webcap",slug:"webcap",name:"TaskHandoff WebCap",description:"Browser automation runtime with WebCap, Codex, Claude, Chromium, and VNC.",localizedDescriptions:{"zh-CN":"浏览器自动化运行环境，包含 WebCap、Codex、Claude、Chromium 和 VNC。"},reference:process.env.TASK_HANDOFF_CONTROLLED_WEB_CAP_IMAGE||"huadream/task-handoff-controlled-webcap:latest",capabilities:["browser","terminal","gui-terminal","web-cap","codex","claude"],optionalApps:["chromium","terminal-tty","gui-terminal"]}),Rl({id:"market_taskhandoff_browser",slug:"browser",name:"TaskHandoff Browser",description:"Full runtime with Codex, Claude, Chromium, VNC, and code-server.",localizedDescriptions:{"zh-CN":"完整运行环境，包含 Codex、Claude、Chromium、VNC 和 code-server。"},reference:process.env.TASK_HANDOFF_CONTROLLED_BROWSER_IMAGE||"huadream/task-handoff-controlled-browser:latest",capabilities:["browser","terminal","gui-terminal","vscode-web","codex","claude"],optionalApps:["chromium","terminal-tty","gui-terminal","vscode-web"]})]})}class _l{async loadCatalog(){return Ol()}}class Pl{snapshot;status;constructor(e=Ol()){this.snapshot=gr.parse(e),this.status=yr.parse({source:this.snapshot.source,state:"ready",revision:this.snapshot.revision,updatedAt:this.snapshot.generatedAt})}getCatalog(){return this.snapshot}getStatus(){return this.status}acceptCandidate(e){const t=gr.safeParse(e);return t.success?(this.snapshot=t.data,this.status=yr.parse({source:t.data.source,state:"ready",revision:t.data.revision,updatedAt:(new Date).toISOString()}),{accepted:!0,snapshot:t.data}):(this.status=yr.parse({...this.status,state:"failed",updatedAt:(new Date).toISOString(),error:t.error.message}),{accepted:!1,error:t.error})}recordRefreshFailure(e){return this.status=yr.parse({...this.status,state:this.snapshot?"stale":"failed",updatedAt:(new Date).toISOString(),error:e instanceof Error?e.message:String(e)}),this.snapshot}async refresh(e){try{const t=await e.loadCatalog();return this.acceptCandidate(t)}catch(e){return this.recordRefreshFailure(e),{accepted:!1,error:e}}}}class jl{records=new Map;options;constructor(e){this.options=e}create(e){const t=s.randomBytes(this.options.tokenBytes).toString("base64url"),n={...e,token:t,expiresAt:new Date(Date.now()+(e.ttlMs||this.options.ttlMs)).toISOString()};return this.records.set(t,n),n}resolve(e,t){const n=this.records.get(e);if(!n)throw this.invalidError();if(n.expiresAt<=(new Date).toISOString())throw this.records.delete(e),this.invalidError();if(t&&!t(n))throw this.invalidError();return n}revoke(e,t){const n=this.resolve(e,t);return this.records.delete(e),n}invalidError(){const e=new Error(this.options.invalidMessage);return Object.assign(e,{statusCode:this.options.invalidStatusCode||400,code:this.options.invalidCode}),e}}class Dl{requireInstance;listAppSessions;tokens=new jl({invalidMessage:"App access link is invalid or expired.",invalidCode:"APP_ACCESS_TOKEN_INVALID",invalidStatusCode:401,tokenBytes:24,ttlMs:9e5});constructor(e){this.requireInstance=e.requireInstance,this.listAppSessions=e.listAppSessions}createToken(e){return this.tokens.create({instanceId:e.instanceId,sessionId:e.sessionId,mode:e.mode,ttlMs:e.ttlMs})}async createSessionToken(e){await this.requireInstance(e.instanceId);const t=await this.requireSession(e.instanceId,e.sessionId),n=Qt(t);if("vnc"!==n){const e=new Error("This app session does not expose a VNC view.");throw Object.assign(e,{statusCode:409,code:"APP_SESSION_ACCESS_UNAVAILABLE"}),e}if("running"!==t.status){const e=new Error("The app session is not running.");throw Object.assign(e,{statusCode:409,code:"APP_SESSION_NOT_RUNNING"}),e}return this.createToken({...e,mode:n})}resolveToken(e,t){return this.tokens.resolve(e,e=>!t||e.mode===t)}revokeToken(e,t){this.tokens.revoke(e,e=>e.instanceId===t.instanceId&&e.sessionId===t.sessionId)}async proxyTarget(e,t,n=""){const s=this.resolveToken(e,t),i=await this.requireInstance(s.instanceId),r=await this.requireSession(s.instanceId,s.sessionId);return{access:s,instance:i,session:r,path:Ml(t,s.sessionId,r,n)}}async requireSession(e,t){const n=await this.listAppSessions(),s=n.instances.find(t=>t.instanceId===e)?.appSessions.sessions.find(e=>ql(e.id)===t);if(s)return s;const i=new Error("App session was not found.");throw Object.assign(i,{statusCode:404,code:"APP_SESSION_NOT_FOUND"}),i}}function Ml(e,t,n,s=""){return"tty"===e?`/api/apps/sessions/${encodeURIComponent(t)}/tty`:"vnc"===e?s?function(e,t){const n=`/${t.replace(/^\/+/,"")}`,s=n.split("?",1)[0]||"/",i=encodeURIComponent(e);if(!["/api/novnc/",`/api/apps/sessions/${i}/web/`,`/api/apps/sessions/${i}/vnc`,`/api/apps/sessions/${i}/novnc/`].some(e=>s===e.replace(/\/$/,"")||s.startsWith(e))){const e=new Error("App access token cannot be used for this path.");throw Object.assign(e,{statusCode:403,code:"APP_ACCESS_PATH_FORBIDDEN"}),e}return n}(t,s):ql(Ll(n.vnc).noVncPath)||`/api/apps/sessions/${encodeURIComponent(t)}/web/`:ql(Ll(n.web).webPath)||`/api/apps/sessions/${encodeURIComponent(t)}/web/`}function Ll(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function ql(e){return"string"==typeof e&&e.trim()?e.trim():void 0}const $l={allow:"a",deny:"d",skip:"s"};function Bl(e){return s.createHash("sha256").update(e).digest("base64url").slice(0,Math.ceil(16))}class Fl{tokens=new jl({invalidMessage:"Chat action expired.",invalidCode:"CHAT_ACTION_TOKEN_INVALID",tokenBytes:9,ttlMs:6e5});create(e){return this.tokens.create({type:e.type,instanceId:"instanceId"in e?e.instanceId:void 0,appId:"appId"in e?e.appId:void 0,routeId:"routeId"in e?e.routeId:void 0,decision:"decision"in e?e.decision:void 0,ttlMs:e.ttlMs})}resolve(e,t){return this.tokens.resolve(e,e=>!t||e.type===t)}pendingDecisionCallbackData(e,t){return`task_handoff:cp_p:v1:${$l[t]}:${Bl(e)}`}}function Ul(e){const{token:t,...n}=e;return{...n,settings:Wl(e.settings),tokenSet:Boolean(e.token)}}function Hl(e,t){if(!t)return e;const n={...e};for(const[e,s]of Object.entries(t))void 0!==s&&""!==s&&(n[e]=s);return n}function Wl(e){const t={...e};return"string"==typeof t.clientSecret&&t.clientSecret&&(delete t.clientSecret,t.clientSecretSet=!0),"string"==typeof t.appSecret&&t.appSecret&&(delete t.appSecret,t.appSecretSet=!0),t}class Gl{chatBridges;chatSessions;constructor(e){this.chatBridges=e.chatBridges,this.chatSessions=e.chatSessions}list(){return this.chatBridges.list().map(Ul)}require(e){const t=this.chatBridges.get(e);return t||yc("CHAT_BRIDGE_NOT_FOUND",`Chat bridge ${e} was not found.`),t}create(e){const t=Rc.parse(e),n=Eo(),s=oo.parse({...t,id:Po(`chat_${t.channel}`),name:t.name||(i=t.channel,r=this.chatBridges.list().filter(e=>e.channel===t.channel).length+1,`${"telegram"===i?"Telegram":"wechat"===i?"WeChat":"dingding"===i?"DingDing":"lark"===i?"Lark":"Web"} ${r}`),enabled:t.enabled??!1,allowedUserIds:t.allowedUserIds||[],pollIntervalMs:t.pollIntervalMs||3e3,settings:Hl({},t.settings),createdAt:n,updatedAt:n});var i,r;return this.chatBridges.put(s),Ul(s)}update(e,t){const n=Nc.parse(t),s=this.require(e),i=Hl(s.settings,n.settings),r=oo.parse({...s,...n,id:e,channel:s.channel,name:n.name||s.name,settings:i,updatedAt:Eo()});return this.chatBridges.put(r),Ul(r)}delete(e){const t=this.chatBridges.delete(e);if(t)for(const t of this.chatSessions.list())t.bridgeId===e&&this.chatSessions.delete(t.id);return t}}class Vl{chatSessions;constructor(e){this.chatSessions=e.chatSessions}list(){return this.chatSessions.list()}require(e){const t=this.chatSessions.get(e);return t||yc("CHAT_SESSION_NOT_FOUND",`Chat session ${e} was not found.`),t}upsert(e){const t=Eo(),n=(s=e.channel,i=e.chatSessionId,`${e.bridgeId||s}:${i.replace(/[^a-zA-Z0-9_.:-]/g,"_")}`);var s,i;const r=this.chatSessions.get(n),o=ao.parse({...r||{},...e,id:n,channel:e.channel,bridgeId:e.bridgeId,chatSessionId:e.chatSessionId,lastUsedAt:t,createdAt:r?.createdAt||t,updatedAt:t});return this.chatSessions.put(o),o}}function Kl(e){return{inline_keyboard:e.map(e=>e.map(e=>({text:e.text,...e.url?{url:e.url}:{callback_data:e.callbackData||""}})))}}function Jl(e,t=40){return Kl(e.slice(0,t).map(e=>[e]))}function Yl(e){return Buffer.from(e,"utf8").toString("base64url")}function Ql(e){const t=Zl(e).inline_keyboard,n=Array.isArray(t)?t:[],s=[];for(const e of n)if(Array.isArray(e))for(const t of e){const e=Zl(t),n=String(e.callback_data||""),i=String(e.text||"").trim();i&&n&&s.push({text:i,id:`th_cb_${Yl(n)}`})}return s.slice(0,40)}function Xl(e,t){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function Zl(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function ep(e){return(e.aiSessions?.sessions||[]).filter(t=>function(e,t){const n=(e.apps?.sessions||[]).filter(op);if(t.appSessionId&&n.some(e=>e.id===t.appSessionId))return!0;const s=new Set(t.appBindingKeys||[]);return Boolean(s.size&&n.some(e=>function(e){return[...Kt(e).bindings.map(Xt),...en(e)].filter(Boolean)}(e).some(e=>s.has(e))))}(e,t))}function tp(e){return"waiting"===e.status?4:"failed"===e.status?3:"running"===e.status?2:"idle"===e.status?1:0}function np(e){return[e.cwd||"",e.agent||"",e.providerSessionId||e.id].join("\0")}function sp(e){const t=e.session.title||e.session.userPrompt||e.session.summary||e.session.lastMessage||"",n=t?` - ${Xl(t,18)}`:"";return`${e.instance.name} - ${e.session.agent} ${e.session.status}${n}`}function ip(e,t=(e,t)=>`task_handoff:approval:${e.id}:${t}`){return Jl(e.flatMap(e=>"approval"!==e.kind?[]:[{text:Xl(`Allow ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"allow")},{text:Xl(`Skip ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"skip")},{text:Xl(`Deny ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"deny")}]))}function rp(e){const t=`${e.project?.name||e.projectId} / ${e.instance?.name||e.instanceId}`,n="approval"===e.kind?`/approve ${e.id} | /deny ${e.id} | /skip ${e.id}`:`/reply ${e.id} <message>`;return`[${t}] ${e.kind} ${e.id}: ${e.result}\n${n}`}function op(e){const t=e&&"object"==typeof e&&!Array.isArray(e)?e:{};return Yt("string"==typeof t.status?t.status:void 0)}class ap{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleAiSessionsCommand(e){const t=await this.targets.aiSessionChoices(e),n=t.find(e=>e.active),s=t.map(e=>function(e){const t=e.session.userPrompt||e.session.summary||e.session.lastMessage||"",n=e.active?"* ":"",s=e.session.phase&&"unknown"!==e.session.phase?`/${e.session.phase}`:"";return`${n}${e.index+1}. ${e.projectName} / ${e.instance.name} - ${e.session.agent} - ${e.session.status}${s} - ${e.session.id}${t?` - ${t}`:""}`}(e));return{accepted:!0,routed:!1,binding:e,instances:t.map(e=>e.instance),reply:t.length?["Select AI session",`Current ${n?`${n.projectName} / ${n.instance.name} / ${n.session.id}`:await this.targets.renderChatTarget(e)}, total ${t.length}`,"",...s].join("\n"):"No AI sessions found.",replyMarkup:t.length?Jl(t.map(e=>({text:`${e.active?"✓ ":""}${sp(e)}`,callbackData:`task_handoff:cp_session:${e.index}`}))):void 0}}async handleAiSessionCommand(e,t){const n=String(t[0]||"").trim();if(!n)return this.handleAiSessionsCommand(e);const s=await this.targets.findAiSession(n);if(!s)return{accepted:!1,routed:!1,binding:e,reply:`AI session ${n} was not found. Try /sessions.`};const i=s.instance.projectId?this.deps.getProject(s.instance.projectId):void 0;return{accepted:!0,routed:!1,binding:this.deps.upsertChatSession({...e,activeProjectId:i?.id||e.activeProjectId,activeInstanceId:s.instance.id,activeAiSessionId:s.session.id}),instance:s.instance,aiSession:s.session,reply:`Active AI session: ${s.instance.name} / ${s.session.agent} ${s.session.id}`}}async handleAiSessionIndexAction(e,t){const n=(await this.targets.aiSessionChoices(e)).find(e=>e.index===t);if(!n)return{accepted:!1,routed:!1,binding:e,reply:"AI session was not found. Use /session to refresh the list.",replyMarkup:void 0};const s=this.deps.upsertChatSession({...e,activeProjectId:n.projectId||e.activeProjectId,activeInstanceId:n.instance.id,activeAiSessionId:n.session.id}),i=await this.handleAiSessionsCommand(s);return{...i,accepted:!0,binding:s,instance:n.instance,aiSession:n.session,message:`selected ${n.session.id}`,reply:[`Current chat is bound to AI session ${n.session.id}`,"",i.reply].join("\n")}}async handleAiSessionInterruptCommand(e){if(!e.activeInstanceId||!e.activeAiSessionId)return{accepted:!1,routed:!1,binding:e,reply:"No active AI session is selected. Use /sessions and /session <id> first."};const t=await this.deps.requireControlledInstance(e.activeInstanceId,!0),n=await this.deps.interruptAiSession(t.id,e.activeAiSessionId);return{accepted:!0,routed:!0,binding:e,instance:pc(t),aiSession:n,reply:`Interrupt sent to ${t.name} / ${e.activeAiSessionId}.`}}}function dp(e){return e.providerTurnId||e.turnId||""}function cp(e){return Yt(hp(e.status))}function lp(e,t){const n=hp(t.appId)||"App",s=hp(t.title).trim();if(s&&s!==n)return s;const i=function(e,t){for(const n of e.appInventory?.items||[])if(n.id===t)return n.name;return""}(e,n);return i||n}function pp(e){const t=function(e){return"online"!==e.connectionStatus?[]:(e.appInventory?.items||[]).filter(e=>"available"===e.availability)}(e),n=new Map;for(const e of t){const t=mp(e);t&&!n.has(t.id)&&n.set(t.id,t)}return[...n.values()]}function up(e,t,n,s){const i=hp(t.id)&&function(e,t){const n=Qt(e);if(!n)return;return`/apps/access/${n}?token=${encodeURIComponent(t(n))}`}(t,s)||`/instances/${encodeURIComponent(e.id)}/`,r=function(e,t){const n=hp(t);if(n&&new RegExp("^https?://","i").test(n))return new URL(e,n.endsWith("/")?n:n+"/").toString()}(i,n);return{text:r||i,url:r}}function hp(e){return"string"==typeof e&&e.trim()?e.trim():void 0}function mp(e){if("string"==typeof e&&e.trim())return{id:e,label:gp(e)};const t=function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e),n=hp(t.id).trim();return n?{id:n,label:hp(t.name).trim()||gp(n)}:void 0}function gp(e){return{"terminal-tty":"Terminal","gui-terminal":"GUI Terminal",chromium:"Chromium",browser:"Browser","vscode-web":"VS Code"}[e]||e.replace(/[-_]+/g," ").replace(/\b\w/g,e=>e.toUpperCase())}class yp{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleInstancesCommand(e){const t=await this.targets.instancesForBinding(e);return{accepted:!0,routed:!1,binding:e,instances:t,reply:(n=t.length,0===n?"No controlled instances are registered yet.":`Instances: ${n}. Tap an instance to create an app.`),replyMarkup:t.length?Jl(t.map(e=>{return{text:Xl(e.name||e.id,56),callbackData:(t=this.deps.createChatActionToken({type:"instance-app-menu",instanceId:e.id}).token,`task_handoff:cp_i:${t}`)};var t})):void 0};var n}async handleInstanceAppMenuAction(e,t){const n=(await this.targets.instancesForBinding(e)).find(e=>e.id===t);if(!n)return{accepted:!1,routed:!1,binding:e,reply:"Instance not found."};const s=pp(n);return{accepted:!0,routed:!1,binding:e,instance:n,message:`Select an app for ${n.name}.`,reply:s.length?`New app for ${n.name}`:`No launchable apps for ${n.name}.`,replyMarkup:s.length?Jl(s.map(e=>{return{text:Xl(e.label,56),callbackData:(t=this.deps.createChatActionToken({type:"launch-app",instanceId:n.id,appId:e.id}).token,`task_handoff:cp_a:${t}`)};var t})):void 0}}async handleLaunchAppAction(e,t,n){const s=(await this.targets.instancesForBinding(e)).find(e=>e.id===t);if(!s)return{accepted:!1,routed:!1,binding:e,reply:"Instance not found."};const i=pp(s).find(e=>e.id===n);return i?{accepted:!0,routed:!1,binding:e,instance:s,session:await this.deps.launchAppSession(s.id,i.id),message:`${i.label} launched`,reply:`Launched ${i.label} on ${s.name}.`}:{accepted:!1,routed:!1,binding:e,reply:`App ${n} is not launchable for ${s.name}.`}}async handleAppsCommand(e){const t=await this.deps.boardAsync(),n=new Map(t.map(e=>[e.id,e])),s=(await this.deps.listAppSessions()).instances.flatMap(e=>{const t=n.get(e.instanceId);return t?e.appSessions.sessions.filter(cp).filter(e=>Boolean(hp(e.id))).map(e=>({instance:t,session:e,link:up(t,e,this.deps.controlPlanePublicBaseUrl(),n=>this.deps.createAppAccessToken({instanceId:t.id,sessionId:hp(e.id)||"",mode:n}).token)})):[]}),i=s.filter(e=>e.link.url).map(e=>({text:Xl(`${e.instance.name} · ${lp(e.instance,e.session)}`,56),url:e.link.url}));return{accepted:!0,routed:!1,binding:e,instances:t,reply:(r=s.length,o=i.length,0===r?"No app sessions found.":0===o?`App sessions: ${r}. Set the control plane public URL in Settings > Appearance to open them from chat.`:`App sessions: ${r}. Tap a button to open.`),replyMarkup:i.length?Jl(i):void 0};var r,o}}class fp{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async forwardChatMessage(e,t){const n=t.target?.instanceId||e.activeInstanceId||"",s=t.target?.aiSessionId||e.activeAiSessionId,i=await this.deps.requireControlledInstance(n,!0),r=i.projectId?this.deps.requireProject(i.projectId):void 0;if("online"!==i.connectionStatus){const e=new Error(`Instance ${i.name} is not reachable.`);throw Object.assign(e,{statusCode:409,code:"CHAT_TARGET_UNREACHABLE"}),e}if(s){const n=await this.trySendAiSessionMessage(e,i.id,s,t.message.text,t.message.attachments,!t.target);return n.ok?this.sentResult(e,r,i,s,n.aiSession):this.failedSendResult(n.binding,r,i,n.reply)}const o=await this.targets.defaultAiSessionIdForInstance(i.id);if(o){const n=this.deps.upsertChatSession({...e,activeAiSessionId:o}),s=await this.trySendAiSessionMessage(n,i.id,o,t.message.text,t.message.attachments);return s.ok?this.sentResult(n,r,i,o,s.aiSession):this.failedSendResult(s.binding,r,i,s.reply)}return{accepted:!1,routed:!1,binding:e,project:r||void 0,instance:pc(i),reply:`No active AI session is selected for ${i.name}. Use /sessions and /session <id> first.`}}async trySendAiSessionMessage(e,t,n,s,i=[],r=!0){try{return{ok:!0,binding:e,aiSession:await this.deps.sendAiSessionMessage(t,n,s||"请查看附件。",void 0,i)}}catch(t){return function(e){return"AI_SESSION_NOT_FOUND"===(e&&"object"==typeof e?e:{}).code}(t)?{ok:!1,binding:r?this.deps.upsertChatSession({...e,activeAiSessionId:void 0}):e,reply:`The selected AI session ${n} no longer exists. Use /session to choose an active AI session.`}:{ok:!1,binding:e,reply:`Failed to send to AI session ${n}: ${gc(t)}`}}}failedSendResult(e,t,n,s){return{accepted:!1,routed:!1,binding:e,project:t||void 0,instance:pc(n),reply:s}}sentResult(e,t,n,s,i){return{accepted:!0,routed:!0,binding:e,project:t||void 0,instance:pc(n),aiSession:i,instanceId:n.id,aiSessionId:s,turnId:(r=i,r.turnId||r.providerTurnId||r.session.activeTurnId||""),providerTurnId:dp(i),reply:`Sent to ${t?.name||n.sourceSnapshot.name||"Source"} / ${n.name} / ${s}.`};var r}}class Ip{deps;constructor(e){this.deps=e}async handlePendingCommand(e){const t=await this.deps.listPendingRoutes(),n=e.activeInstanceId?t.filter(t=>t.instanceId===e.activeInstanceId):t;return{accepted:!0,routed:!1,binding:e,pending:n,reply:n.length?n.map(rp).join("\n"):"No pending routes.",replyMarkup:n.length?ip(n,(e,t)=>this.deps.pendingDecisionCallbackData(e.id,t)):void 0}}async handlePendingDecisionCommand(e,t,n){const s=mc(t[0]);return s?s.aiSessionId?{accepted:!0,routed:!0,binding:e,pending:s,aiSession:await this.deps.resolveAiSessionApproval(s.instanceId,s.aiSessionId,n),reply:`${n} sent for ${s.instanceId}:${s.aiSessionId}.`}:{accepted:!1,routed:!1,binding:e,pending:s,reply:"Only AI session pending routes are supported here."}:{accepted:!1,routed:!1,binding:e,reply:`Usage: /${"allow"===n?"approve":n} <instance-id:pending-id>`}}async handlePendingReplyCommand(e,t){const n=mc(t[0]),s=t.slice(1).join(" ").trim();return n&&s?n.aiSessionId?{accepted:!0,routed:!0,binding:e,pending:n,aiSession:await this.deps.sendAiSessionMessage(n.instanceId,n.aiSessionId,s),reply:`Reply sent for ${n.instanceId}:${n.aiSessionId}.`}:{accepted:!1,routed:!1,binding:e,pending:n,reply:"Only AI session pending routes are supported here."}:{accepted:!1,routed:!1,binding:e,reply:"Usage: /reply <instance-id:pending-id> <message>"}}}class bp{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleUseCommand(e,t){if(0===t.length)return{accepted:!0,routed:!1,binding:e,instances:await this.targets.instancesForBinding(e),reply:await this.targets.renderUseHelp(e)};if(t.length>=2){const n=this.targets.resolveProject(t[0]),s=await this.targets.resolveInstance(t[1],n.id),i=this.deps.upsertChatSession({...e,activeProjectId:n.id,activeInstanceId:s.id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(s.id)});return{accepted:!0,routed:!1,binding:i,reply:await this.targets.renderTargetSelected(i)}}const n=t[0],s=await this.targets.findInstance(n);if(s){const t=s.projectId?this.deps.requireProject(s.projectId):void 0,n=this.deps.upsertChatSession({...e,activeProjectId:t?.id,activeInstanceId:s.id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(s.id)});return{accepted:!0,routed:!1,binding:n,reply:await this.targets.renderTargetSelected(n)}}const i=this.targets.resolveProject(n),r=(await this.deps.boardAsync()).filter(e=>e.projectId===i.id),o=r.filter(e=>"running"===e.status&&"online"===e.connectionStatus);if(1===o.length){const t=this.deps.upsertChatSession({...e,activeProjectId:i.id,activeInstanceId:o[0].id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(o[0].id)});return{accepted:!0,routed:!1,binding:t,reply:await this.targets.renderTargetSelected(t)}}return{accepted:!0,routed:!1,binding:this.deps.upsertChatSession({...e,activeProjectId:i.id,activeInstanceId:void 0,activeAiSessionId:void 0}),instances:r,reply:`${i.name} selected. Choose an instance with /use ${i.id} <instance-id-or-name>.\n${this.targets.renderInstanceLines(r)}`}}async handleProjectCommand(e,t){if(0===t.length)return{accepted:!1,routed:!1,binding:e,reply:"Usage: /project <project-id-or-name>"};const n=this.targets.resolveProject(t[0]),s=e.activeInstanceId?await this.deps.requireControlledInstance(e.activeInstanceId).catch(()=>{}):void 0,i=this.deps.upsertChatSession({...e,activeProjectId:n.id,activeInstanceId:s?.projectId===n.id?s.id:void 0,activeAiSessionId:s?.projectId===n.id?e.activeAiSessionId:void 0});return{accepted:!0,routed:!1,binding:i,reply:`Active project: ${n.name}${i.activeInstanceId?"":". Choose an instance with /use."}`}}}class vp{deps;constructor(e){this.deps=e}async instancesForBinding(e){const t=await this.deps.boardAsync();return e.activeProjectId?t.filter(t=>t.projectId===e.activeProjectId):t}async fullInstancesForBinding(e){const t=await this.deps.listNodeInstances();return e.activeProjectId?t.filter(t=>t.projectId===e.activeProjectId):t}async renderUseHelp(e){return`Active target: ${await this.renderChatTarget(e)}\nUse /instances to list targets, then /use <instance-id-or-name>. Use /sessions to choose an AI session when there is more than one.`}async renderChatStatus(e){const t=e.activeInstanceId?(await this.deps.boardAsync()).find(t=>t.id===e.activeInstanceId):void 0;return t?`Active target: ${await this.renderChatTarget(e)}\nStatus: ${t.status}, connection: ${t.connectionStatus}`:`Active target: ${await this.renderChatTarget(e)}`}async renderChatHelp(e){return["TaskHandoff chat commands:","/help - show this help","/status or /target - show the active project, instance, and AI session","/instances - list controlled instances","/apps - list app sessions","/use <instance-id-or-name> - choose an active instance","/use <project-id-or-name> <instance-id-or-name> - choose a project and instance","/project <project-id-or-name> - narrow instance selection to a project","/sessions - list all AI sessions","/session <ai-session-id> - choose an active AI session","/pending - list waiting approvals","/approve <instance-id:pending-id>, /deny <...>, /skip <...> - answer approvals","/reply <instance-id:pending-id> <message> - reply to a waiting session","/cancel - interrupt the active AI session","","Send normal text after selecting a target; if there is only one AI session, it is selected automatically.",`Current target: ${await this.renderChatTarget(e)}`].join("\n")}renderInstanceLines(e){return e.map(e=>`${e.name} (${e.id}) - ${e.status}/${e.connectionStatus}`).join("\n")}async renderChatTarget(e){const t=e.activeProjectId?this.deps.getProject(e.activeProjectId):void 0,n=e.activeInstanceId?await this.deps.requireControlledInstance(e.activeInstanceId).catch(()=>{}):void 0,s=e.activeAiSessionId||"none";return`${t?.name||e.activeProjectId||"none"} / ${n?.name||e.activeInstanceId||"none"} / ${s}`}async renderTargetSelected(e){const t=await this.renderChatTarget(e);return e.activeAiSessionId?`Active target: ${t}`:`Active target: ${t}\nNo AI session selected yet. Use /sessions and /session <id>, or send a message once exactly one session is available.`}async defaultAiSessionIdForInstance(e){const t=await this.aiSessionSnapshotForInstance(e),n=(await this.deps.boardAsync()).find(t=>t.id===e),s=(await this.deps.listAppSessions()).instances.find(t=>t.instanceId===e),i=n?{...n,apps:{...n.apps,sessions:s?.appSessions.sessions||[]}}:void 0,r=t&&n?ep({...i,aiSessions:t}):t?.sessions||[];return 1===r.length?r[0].id:void 0}async aiSessionChoices(e){return(await this.boardInstancesForBinding({},{refresh:!0})).flatMap(t=>ep(t).map(n=>({index:0,projectId:t.projectId,projectName:t.project?.name||("string"==typeof t.sourceSnapshot.name?t.sourceSnapshot.name:"Source"),instance:t,session:n,active:e.activeInstanceId===t.id&&e.activeAiSessionId===n.id}))).sort((e,t)=>{const n=tp(t.session)-tp(e.session);return n||(String(e.instance.name||"").localeCompare(String(t.instance.name||""))||e.instance.id.localeCompare(t.instance.id)||np(e.session).localeCompare(np(t.session)))}).map((e,t)=>({...e,index:t}))}async boardInstancesForBinding(e,t={}){const n=await this.deps.boardAsync(),s=await this.deps.listAiSessions(t),i=await this.deps.listAppSessions(t),r=new Map(s.instances.map(e=>[e.instanceId,e.aiSessions])),o=new Map(i.instances.map(e=>[e.instanceId,e.appSessions])),a=n.map(e=>{return{...e,apps:{...e.apps,sessions:o.get(e.id)?.sessions||[]},aiSessions:r.get(e.id)||(t=e.aiSessions.updatedAt,{runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:t})};var t});return e.activeProjectId?a.filter(t=>t.projectId===e.activeProjectId):a}async findAiSession(e){const t=await this.boardInstancesForBinding({},{refresh:!0});for(const n of t){const t=(n.aiSessions?.sessions||[]).find(t=>t.id===e||t.providerSessionId===e);if(t)return{instance:n,session:t}}}async aiSessionSnapshotForInstance(e){const t=await this.deps.listAiSessions();return t.instances.find(t=>t.instanceId===e)?.aiSessions}resolveProject(e){const t=this.deps.getProject(e)||this.deps.listProjects().find(t=>t.name===e);return t||yc("PROJECT_NOT_FOUND",`Project ${e} was not found.`),t}async resolveInstance(e,t){const n=await this.findInstance(e,t);return n||yc("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`),n}async findInstance(e,t){return(await this.deps.listNodeInstances()).find(n=>!(n.id!==e&&n.name!==e||t&&n.projectId!==t))}}class Sp{deps;targets;sender;appCommands;pendingCommands;aiSessionCommands;targetCommands;constructor(e){this.deps=e,this.targets=new vp(e),this.sender=new fp(e,this.targets),this.appCommands=new yp(e,this.targets),this.pendingCommands=new Ip(e),this.aiSessionCommands=new ap(e,this.targets),this.targetCommands=new bp(e,this.targets)}async handleChatGatewayMessage(e){const t=co.parse(e),n=this.deps.upsertChatSession({channel:t.source.channel,bridgeId:t.source.bridgeId,chatSessionId:t.source.chatSessionId,userId:t.source.userId}),s=t.message.text.trim();return s.startsWith("/")?this.handleChatCommand(n,s):s||t.message.attachments.length?n.activeInstanceId?this.sender.forwardChatMessage(n,t):{accepted:!1,routed:!1,binding:n,reply:await this.targets.renderUseHelp(n)}:{accepted:!1,routed:!1,binding:n,reply:""}}async handleChatGatewayAction(e){const t=this.deps.upsertChatSession({channel:e.source.channel,bridgeId:e.source.bridgeId,chatSessionId:e.source.chatSessionId,userId:e.source.userId});return"ai-session"===e.action.type?this.aiSessionCommands.handleAiSessionIndexAction(t,e.action.index):"instance-app-menu"===e.action.type?this.appCommands.handleInstanceAppMenuAction(t,e.action.instanceId):"launch-app"===e.action.type?this.appCommands.handleLaunchAppAction(t,e.action.instanceId,e.action.appId):"pending-decision"===e.action.type?this.pendingCommands.handlePendingDecisionCommand(t,[e.action.routeId],e.action.decision):{accepted:!1,routed:!1,binding:t,reply:"Unknown action."}}async handleChatCommand(e,t){const[n="",...s]=t.split(/\s+/),i=n.replace(/@[\w_]+$/,"");switch(i.toLowerCase()){case"/help":case"/start":return{accepted:!0,routed:!1,binding:e,reply:await this.targets.renderChatHelp(e)};case"/sessions":return this.aiSessionCommands.handleAiSessionsCommand(e);case"/session":return this.aiSessionCommands.handleAiSessionCommand(e,s);case"/cancel":case"/interrupt":return this.aiSessionCommands.handleAiSessionInterruptCommand(e);case"/pending":return this.pendingCommands.handlePendingCommand(e);case"/approve":return this.pendingCommands.handlePendingDecisionCommand(e,s,"allow");case"/deny":return this.pendingCommands.handlePendingDecisionCommand(e,s,"deny");case"/skip":return this.pendingCommands.handlePendingDecisionCommand(e,s,"skip");case"/reply":return this.pendingCommands.handlePendingReplyCommand(e,s);case"/instances":return this.appCommands.handleInstancesCommand(e);case"/apps":return this.appCommands.handleAppsCommand(e);case"/use":return this.targetCommands.handleUseCommand(e,s);case"/project":return this.targetCommands.handleProjectCommand(e,s);case"/status":case"/target":return{accepted:!0,routed:!1,binding:e,instance:e.activeInstanceId?(await this.deps.boardAsync()).find(t=>t.id===e.activeInstanceId):void 0,reply:await this.targets.renderChatStatus(e)};default:return{accepted:!1,routed:!1,binding:e,reply:`Unknown command: ${i||n}. Try /help.`}}}}const wp=d.z.object({id:d.z.string().trim().min(1),preferences:ma,createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}).strict();function Ap(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.preferences&&"object"==typeof t.preferences&&!Array.isArray(t.preferences)?t.preferences:{};return{id:t.id,preferences:{import:"string"==typeof n.import&&n.import.trim()?n.import:".",export:"string"==typeof n.export&&n.export.trim()?n.export:"."},createdAt:t.createdAt,updatedAt:t.updatedAt}}function zp(){return ma.parse({})}function kp(e){return/^[a-z]:[\\/]/i.test(e)||/^[\\/]{2}[^\\/]+[\\/]+[^\\/]+/.test(e)}function Tp(e){return kp(e)?t.win32:t.posix}class Cp{retiredRoot;legacyControlledInstancesDir;legacyNodeRuntimesDir;legacyNodeJoinInvitesDir;paths;options;constructor(e,n={}){this.paths=e,this.options=n,this.retiredRoot=t.join(e.dataDir,"retired-persistence"),this.legacyControlledInstancesDir=t.join(e.dataDir,"controlled-instances"),this.legacyNodeRuntimesDir=t.join(e.dataDir,"node-runtimes"),this.legacyNodeJoinInvitesDir=t.join(e.dataDir,"node-join-invites")}run(){return this.removePersistedInvites(),this.retireLegacyProjection("controlled-instances",this.legacyControlledInstancesDir,!0),this.retireLegacyProjection("node-runtimes",this.legacyNodeRuntimesDir,!1),function(e){if(!n.existsSync(e.trashRoot))return[];const t=e.nowMs??Date.now(),s=e.retentionMs??uo,i=[];for(const r of n.readdirSync(e.trashRoot,{withFileTypes:!0})){const o=ho(e.trashRoot,r.name);try{const e=Number(r.name.split("-",1)[0]);if(!Number.isFinite(e)||e+s>t)continue;const a=n.lstatSync(o);a.isSymbolicLink()?n.unlinkSync(o):a.isDirectory()?n.rmSync(o,{recursive:!0,force:!0}):n.unlinkSync(o),i.push(o)}catch(t){e.logger?.("retired persistence entry cleanup failed",{path:o,error:t instanceof Error?t.message:String(t)})}}return i}({trashRoot:this.retiredRoot,retentionMs:this.options.retentionMs??uo,nowMs:this.now(),logger:this.options.logger})}removePersistedInvites(){n.existsSync(this.legacyNodeJoinInvitesDir)&&n.rmSync(this.legacyNodeJoinInvitesDir,{recursive:!0,force:!0})}retireLegacyProjection(e,s,i){if(!n.existsSync(s))return;const r=n.lstatSync(s);if(!r.isDirectory()||r.isSymbolicLink())return n.rmSync(s,{force:!0}),void this.options.logger?.("invalid legacy persistence path was removed",{store:e});n.readdirSync(s).length?(i&&this.redactLegacyInstanceCredentials(s),function(e){const t=ho(e.sourceRoot,e.entryName);if(!n.existsSync(t))return;const s=n.lstatSync(t);if(!s.isDirectory()||s.isSymbolicLink())throw new Error(`Retention source must be a real directory: ${t}`);mo(e.trashRoot);const i=e.nowMs??Date.now();let r=0,o=`${i}-${e.entryName}`;for(;n.existsSync(ho(e.trashRoot,o));)r+=1,o=`${i}-${r}-${e.entryName}`;const a=ho(e.trashRoot,o);n.renameSync(t,a)}({sourceRoot:this.paths.dataDir,entryName:t.basename(s),trashRoot:this.retiredRoot,nowMs:this.now()}),this.options.logger?.("legacy control-plane persistence was retired",{store:e})):n.rmdirSync(s)}redactLegacyInstanceCredentials(e){for(const s of n.readdirSync(e,{withFileTypes:!0})){if(!s.isFile()||s.isSymbolicLink())continue;const i=t.join(e,s.name);try{const e=JSON.parse(n.readFileSync(i,"utf8"));delete e.registrationToken,l.sync(i,`${JSON.stringify(e,null,2)}\n`,{encoding:"utf8",mode:384}),n.chmodSync(i,384)}catch(e){n.rmSync(i,{force:!0}),this.options.logger?.("unreadable legacy instance record was removed",{filePath:i,error:e instanceof Error?e.message:String(e)})}}mo(e)}now(){return this.options.now?.()??Date.now()}}const Ep="task-handoff.control-plane.local",xp="task-handoff.control-plane.builtin";function Np(e){return"true"===e.labels[Ep]}function Rp(e){return"true"===e.labels[xp]}class Op{projects;models;modelService;images;nodes;pendingPairingRevokes;chatSessions;chatBridges;triggers;nodeJoinService;configSyncPreferences;settings;paths;fetchImpl;dockerCommandRunner;logger;diagnosticLogsState;nodeConnectionRuntime;appAccessService;persistenceMaintenance;chatActionTokenService=new Fl;nodeAgentTransportResolver;proxyPrivateStore;proxyLifecycle;nodeConnectionManager;nodeAgentGateway;controlledInstanceGateway;aiSessionActionService;controlledInstanceCreator;instanceBoardReader=new Sl;controlPlaneTriggerService;catalogService;marketCatalogService;chatBridgeService;chatSessionService;chatSessionRuntime;aiSessionSnapshotProvider;appSessionSnapshotProvider;constructor(e,n={}){this.paths=e,this.fetchImpl=n.fetchImpl||fetch,this.dockerCommandRunner=n.dockerCommandRunner,this.nodeConnectionRuntime=n.nodeConnectionRuntime,this.persistenceMaintenance=new Cp(e,{logger:(e,t)=>this.logWarn(t,e)});const s=e=>({schema:e,logger:(e,t)=>this.logWarn(t,e)});this.proxyPrivateStore=new Vd(function(e){const n=t.resolve(e,"control-plane-proxy");return{pendingClaimsDir:t.join(n,"pending-claims"),nodeCredentialsDir:t.join(n,"node-credentials"),identityPath:t.join(n,"identity.json")}}(e.dataDir),(e,t)=>this.logWarn(t,e)),this.nodeAgentTransportResolver=new Dd({direct:jd(this.fetchImpl),tunnel:n.nodeAgentTransport,proxy:new Fd({credentialForNode:e=>this.proxyPrivateStore.nodeCredential(e.id),fetchImpl:this.fetchImpl})});const i=(r=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(r||"").trim().toLowerCase()));var r;this.diagnosticLogsState=i,this.settings=new Mo(e.settingsPath,()=>Tc.parse({diagnosticLogs:i}),{...s(Tc),sanitize:e=>function(e,t={}){if(!e||"object"!=typeof e||Array.isArray(e))return{};const n={...e};return"string"==typeof n.mentionTrigger&&wc(n.mentionTrigger)||(n.mentionTrigger="@"),"string"==typeof n.commandTrigger&&zc(n.commandTrigger)&&n.commandTrigger!==n.mentionTrigger||(n.commandTrigger="/"),"boolean"!=typeof n.diagnosticLogs&&(n.diagnosticLogs=t.diagnosticLogs??!1),n}(e,{diagnosticLogs:i})}),this.logger=n.logger?{info:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.info?.(e,t)},warn:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.warn?.(e,t)},error:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.error?.(e,t)}}:void 0;const o=new hd({request:(e,t,n)=>this.nodeAgentFetch(e,t,n),logger:this.logger});this.nodeAgentGateway=new md(o,{onFleetStateChanged:n.onFleetStateChanged}),this.controlledInstanceGateway=new bl({requireNode:e=>this.requireNode(e),nodeAgentTransport:e=>this.nodeAgentTransportResolver.resolve(e)}),this.aiSessionActionService=new rd({requireInstance:e=>this.requireControlledInstance(e,!0),request:(e,t,n,s)=>this.instanceRequest(e,t,n,s),requireRuntime:(e,t)=>this.requireNodeRuntimeOnNode(e,t),refreshSnapshots:()=>Promise.all([this.listAppSessions({refresh:!0}),this.listAiSessions({refresh:!0})]),warn:(e,t)=>this.logWarn(e,t)}),this.projects=new Do(e.projectsDir,{...s(Ji),sanitize:ci}),this.models=new Do(e.modelsDir,s(Yi)),this.modelService=new yl({models:this.models,gateway:this.nodeAgentGateway,listNodes:()=>this.listNodes(),requireNode:e=>this.requireNode(e),fetchImpl:this.fetchImpl}),this.images=new Do(e.imagesDir,{...s(fr),sanitize:e=>Er(e,e=>this.logWarn(e,"legacy image profile field was migrated"))}),this.nodes=new Do(e.nodesDir,{...s(Rr),sanitize:e=>function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,s=new Set(["id","name","connectionMode","connectionPath","connectionEnabled","auth","endpoint","controlEndpoint","containerEndpoint","publicWebBase","status","health","capabilities","proxyState","appInventory","labels","lastSeenAt","createdAt","updatedAt"]);for(const e of Object.keys(n))s.has(e)||t?.({field:e});const i=n.auth&&"object"==typeof n.auth&&!Array.isArray(n.auth)?io(n.auth,["mode","keyId","secret","pairedAt","pairing"]):n.auth;i&&"object"==typeof i&&"pairing"in i&&(i.pairing=io(i.pairing,["status","joinToken","expiresAt"]));const r=n.connectionPath&&"object"==typeof n.connectionPath&&!Array.isArray(n.connectionPath)?"control-plane-proxy"===n.connectionPath.kind?io(n.connectionPath,["kind","proxyId","proxyBindingId","targetNodeId"]):io(n.connectionPath,["kind"]):{kind:"direct"},o=n.proxyState&&"object"==typeof n.proxyState&&!Array.isArray(n.proxyState)?io(n.proxyState,["reachability","bindingStatus","bindingRevision","streamId","revision","observedAt","target","lastError","updatedAt"]):n.proxyState;if(o&&"object"==typeof o){const e=o;e.target=io(e.target,["id","name","status","health","lastSeenAt","capabilities"]),e.lastError=io(e.lastError,["code","message","retryable","details"])}return{...Object.fromEntries(Object.entries(n).filter(([e])=>s.has(e))),auth:i,connectionPath:r,proxyState:o}}(e,e=>this.logWarn(e,"unknown stored node field was ignored"))}),this.pendingPairingRevokes=new Do(e.pendingPairingRevokesDir,s(Jc)),this.proxyLifecycle=new bc({nodes:this.nodes,privateStore:this.proxyPrivateStore,fetchImpl:this.fetchImpl,requireNode:e=>this.requireNode(e),deleteNode:e=>this.deleteNode(e)}),this.nodeConnectionManager=new Yc({nodes:this.nodes,pendingPairingRevokes:this.pendingPairingRevokes,fetchImpl:this.fetchImpl,localNodeLabel:Ep,builtinNodeLabel:xp,info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)}),this.chatSessions=new Do(e.chatSessionsDir,s(ao)),this.chatBridges=new Do(e.chatBridgesDir,s(oo)),this.triggers=new Do(e.triggersDir,s(Oc)),this.nodeJoinService=new ol({nodes:this.nodes}),this.configSyncPreferences=new Do(t.join(e.dataDir,"config-sync-preferences"),{...s(wp),sanitize:Ap}),this.marketCatalogService=new Pl,this.catalogService=new Nl({projects:this.projects,images:this.images,market:this.marketCatalogService,settings:this.settings,defaultNodeId:()=>this.defaultNodeId()}),this.controlledInstanceCreator=new wl({gateway:this.nodeAgentGateway,defaultNodeId:()=>this.defaultNodeId(),requireProject:e=>this.requireProject(e),requireNode:e=>this.requireNode(e),requireRuntime:(e,t)=>this.requireNodeRuntimeOnNode(e,t),requireLocalFolder:(e,t)=>this.requireNodeLocalFolder(e,t),resolveImageSelection:e=>this.catalogService.resolveImageSelection(e),prepareModels:(e,t)=>this.modelService.prepareAssignment(e,t)}),this.controlPlaneTriggerService=new kl({triggers:this.triggers,listInstances:()=>this.listCachedNodeInstances(),listMutationInstances:()=>this.listTriggerMutationInstances(),requireInstance:async e=>this.requireControlledInstance(e,!0),instanceRequest:(e,t,n)=>this.instanceRequest(e,t,n)}),this.appAccessService=new Dl({requireInstance:async e=>this.requireControlledInstance(e,!0),listAppSessions:()=>this.listAppSessions()}),this.chatBridgeService=new Gl({chatBridges:this.chatBridges,chatSessions:this.chatSessions}),this.chatSessionService=new Vl({chatSessions:this.chatSessions}),this.chatSessionRuntime=new Sp({upsertChatSession:e=>this.upsertChatSession(e),boardAsync:()=>this.boardAsync(),listAiSessions:e=>this.listAiSessions(e),listAppSessions:e=>this.listAppSessions(e),listNodeInstances:()=>this.listBootstrapNodeInstances(),listPendingRoutes:()=>this.listPendingRoutes(),pendingDecisionCallbackData:(e,t)=>this.pendingDecisionCallbackData(e,t),createChatActionToken:e=>this.createChatActionToken(e),createAppAccessToken:e=>this.createAppAccessToken(e),controlPlanePublicBaseUrl:()=>this.getSettings().publicBaseUrl||process.env.TASK_HANDOFF_CONTROL_PLANE_URL||process.env.TASK_HANDOFF_PUBLIC_BASE||process.env.TASK_HANDOFF_CONTROL_PLANE_PUBLIC_URL,requireControlledInstance:(e,t)=>this.requireControlledInstance(e,t),requireProject:e=>this.requireProject(e),getProject:e=>this.catalogService.getProject(e),listProjects:()=>this.catalogService.listProjects(),resolveAiSessionApproval:(e,t,n)=>this.resolveAiSessionApproval(e,t,n),sendAiSessionMessage:(e,t,n,s,i)=>this.sendAiSessionMessage(e,t,n,s,i),interruptAiSession:(e,t)=>this.interruptAiSession(e,t),launchAppSession:(e,t,n)=>this.launchAppSession(e,t,n)})}logInfo(e,t){this.logger?.info?.(e,t)}logWarn(e,t){this.logger?.warn?.(e,t)}logError(e,t){this.logger?.error?.(e,t)}setNodeAgentTransport(e){this.nodeAgentTransportResolver.setTunnel(e)}resolveNodeAgentTransport(e){return this.nodeAgentTransportResolver.resolve(e)}setAiSessionSnapshotProvider(e){this.aiSessionSnapshotProvider=e}async listAiSessions(e={}){return this.aiSessionSnapshotProvider?this.aiSessionSnapshotProvider(e):this.bootstrapAiSessionsFromInstances()}setAppSessionSnapshotProvider(e){this.appSessionSnapshotProvider=e}async listAppSessions(e={}){return this.appSessionSnapshotProvider?this.appSessionSnapshotProvider(e):this.bootstrapAppSessionsFromInstances()}init(){this.runPersistenceMaintenance(),this.projects.init(),this.models.init(),this.images.init(),this.nodes.init(),this.pendingPairingRevokes.init(),this.chatSessions.init(),this.chatBridges.init(),this.triggers.init(),this.proxyPrivateStore.init(),this.proxyPrivateStore.gcNodeCredentials(e=>{const t=this.nodes.get(e.nodeId);return"control-plane-proxy"===t?.connectionMode&&"control-plane-proxy"===t.connectionPath.kind&&t.connectionPath.proxyBindingId===e.proxyBindingId&&t.connectionPath.targetNodeId===e.targetNodeId}),this.settings.init();const e=this.settings.put(this.settings.get());this.diagnosticLogsState=e.diagnosticLogs,this.migrateLegacyImageCatalog(),this.seedDefaults(),this.refreshCachedNodeInstances();const t=this.listNodes().map(e=>this.projectNodeConnection(e));this.nodeAgentGateway.refreshFleetRuntimes(t).catch(e=>{this.logWarn({error:gc(e)},"control plane runtime directory warmup failed")}),this.nodeAgentGateway.refreshFleetModels(t).catch(e=>{this.logWarn({error:gc(e)},"control plane model directory warmup failed")})}runPersistenceMaintenance(){try{return this.persistenceMaintenance.run()}catch(e){return this.logWarn({error:e instanceof Error?e.message:String(e)},"control-plane persistence maintenance failed"),[]}}migrateLegacyImageCatalog(){const e=Object.keys(ai),s=[];for(const t of e){const e=this.images.filePath(t);if(n.existsSync(e))try{s.push({id:t,filePath:e,record:JSON.parse(n.readFileSync(e,"utf8"))})}catch(e){return this.writeMarketMigrationState("failed",{code:"LEGACY_IMAGE_BACKUP_READ_FAILED",legacyId:t,error:gc(e)}),void this.logWarn({legacyId:t,error:gc(e)},"legacy embedded image migration was not applied")}}if(!s.length)return;const i=n.readdirSync(this.paths.projectsDir).filter(e=>e.endsWith(".json")).sort().map(e=>t.join(this.paths.projectsDir,e)),r=[];for(const e of i)try{const t=JSON.parse(n.readFileSync(e,"utf8")),s=Ji.parse(ci(t));r.push({filePath:e,raw:t,migrated:s})}catch(t){return this.writeMarketMigrationState("failed",{code:"PROJECT_REFERENCE_VALIDATION_FAILED",filePath:e,error:gc(t)}),void this.logWarn({filePath:e,error:gc(t)},"legacy embedded image migration was not applied")}const o=r.find(({migrated:t})=>{const n=t.defaultImageSelection?.imageId;return!!n&&e.includes(n)});if(o)this.writeMarketMigrationState("failed",{code:"PROJECT_REFERENCE_MIGRATION_INCOMPLETE",filePath:o.filePath});else{n.mkdirSync(this.paths.marketDir,{recursive:!0}),l.sync(this.paths.marketMigrationBackupPath,`${JSON.stringify({version:ks,createdAt:Eo(),images:s.map(({id:e,record:t})=>({id:e,record:t})),projects:r.map(({filePath:e,raw:n})=>({file:t.basename(e),record:n}))},null,2)}\n`,{encoding:"utf8"});for(const{migrated:e}of r)this.projects.put(e);for(const{id:e}of s)this.images.delete(e),this.logWarn({legacyId:e,marketId:ai[e]},"embedded image profile migrated to Market");this.writeMarketMigrationState("complete",{code:"LEGACY_IMAGE_MIGRATION_COMPLETE",migratedImageIds:s.map(({id:e})=>e),backupPath:this.paths.marketMigrationBackupPath})}}writeMarketMigrationState(e,t){n.mkdirSync(this.paths.marketDir,{recursive:!0}),l.sync(this.paths.marketStatePath,`${JSON.stringify({status:e,updatedAt:Eo(),...t},null,2)}\n`,{encoding:"utf8"})}getSettings(){return this.catalogService.getSettings()}diagnosticLogsEnabled(){return this.diagnosticLogsState}updateSettings(e){const t=this.catalogService.updateSettings(e);return this.diagnosticLogsState=t.diagnosticLogs,t}seedDefaults(){return this.catalogService.seedDefaults()}listProjects(){return this.catalogService.listProjects()}defaultNodeId(){return this.nodes.list().find(Np)?.id||this.nodes.list()[0]?.id}async syncLocalNodeConnection(){const e=await this.nodeConnectionManager.syncLocal();return this.nodeConnectionRuntime?.observedReachable(e),this.projectNodeConnection(e)}recoverPendingPairingRevokes(){return this.nodeConnectionManager.recoverPendingPairingRevokes()}listModels(){return this.modelService.list()}listFederatedModels(e,t=!1){return this.modelService.listFederated(e,t)}createModel(e){return this.modelService.create(e)}updateModel(e,t){return this.modelService.update(e,t)}deleteModel(e){return this.modelService.delete(e)}reorderModels(e){return this.modelService.reorder(e)}createNodeModel(e,t){return this.modelService.createOnNode(e,t)}updateNodeModel(e,t,n){return this.modelService.updateOnNode(e,t,n)}deleteNodeModel(e,t){return this.modelService.deleteOnNode(e,t)}discoverModels(e){return this.modelService.discover(e)}testModel(e){return this.modelService.test(e)}discoverNodeModels(e,t){return this.modelService.discoverOnNode(e,t)}testNodeModel(e,t){return this.modelService.testOnNode(e,t)}createProject(e){return this.catalogService.createProject(e)}updateProject(e,t){return this.catalogService.updateProject(e,t)}deleteProject(e){return this.catalogService.deleteProject(e)}listImages(){return this.catalogService.listImages()}getMarketCatalog(){return this.catalogService.getMarketCatalog()}async refreshMarketCatalog(){return await this.marketCatalogService.refresh(new _l),this.getMarketCatalog()}listImageOptions(){return this.catalogService.listImageOptions()}createImage(e){return this.catalogService.createImage(e)}async listNodeDockerImages(e){const t=this.requireNode(e);return this.nodeAgentGateway.listDockerImages(t)}async listNodeImageAvailability(e){const t=this.requireNode(e),n=t.capabilities.agent&&"object"==typeof t.capabilities.agent?t.capabilities.agent:{},s={os:"string"==typeof n.platform?n.platform:void 0,architecture:"string"==typeof n.arch?"x64"===n.arch?"amd64":n.arch:void 0},i=this.catalogService.listImageOptions(s);try{const e=await this.nodeAgentGateway.listDockerImages(t);return i.map(t=>{const n=e.find(e=>e.reference===t.reference||!!t.digest&&e.repoDigests.some(e=>e.endsWith(`@${t.digest}`))||e.repoDigests.includes(t.reference));return Wr.parse({image:t,status:n?"available":"pull-required",localImage:n,localSizeBytes:n?.sizeBytes,downloadSizeBytes:n?void 0:t.downloadSizeBytes,unpackedSizeBytes:n?void 0:t.unpackedSizeBytes})})}catch(e){const t=e instanceof Error?e.message:String(e);return i.map(e=>Wr.parse({image:e,status:"unknown",error:t}))}}async listNodeLocalFolders(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.listLocalFolders(n,{signal:t})}async listNodeFolderTree(e,t={}){const n=this.requireNode(e);return this.nodeAgentGateway.listFolderTree(n,t)}async listNodeFolderPlaces(e){const t=this.requireNode(e);if(n=t.capabilities?.agent&&"object"==typeof t.capabilities.agent?t.capabilities.agent.capabilities:void 0,!0!==Pr.safeParse(n).data?.folderPlaces)return(await this.nodeAgentGateway.listFolderTree(t,{depth:0})).map(e=>Vr.parse({kind:"root",name:e.name,path:e.path}));var n;try{return await this.nodeAgentGateway.listFolderPlaces(t)}catch(e){if(404!==(e&&"object"==typeof e?e.statusCode:void 0))throw e;return(await this.nodeAgentGateway.listFolderTree(t,{depth:0})).map(e=>Vr.parse({kind:"root",name:e.name,path:e.path}))}}async createNodeLocalFolder(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.createLocalFolder(n,t)}async updateNodeLocalFolder(e,t,n){const s=this.requireNode(e);if(i=s.capabilities?.agent&&"object"==typeof s.capabilities.agent?s.capabilities.agent.capabilities:void 0,!0!==Pr.safeParse(i).data?.localFolderNameUpdate){const e=new Error(`Node ${s.id} does not support local folder name updates.`);throw Object.assign(e,{statusCode:409,code:"NODE_LOCAL_FOLDER_NAME_UPDATE_UNSUPPORTED"})}var i;return this.nodeAgentGateway.updateLocalFolder(s,t,n)}async deleteNodeLocalFolder(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteLocalFolder(n,t)}async checkNode(e){const t=this.requireNode(e);try{const e=await this.nodeAgentGateway.health(t),n=e&&"object"==typeof e?e:{},s="string"==typeof n.nodeId&&n.nodeId.trim()?n.nodeId.trim():t.id,i=Rr.parse({...t,id:s,status:"online",health:"ok",capabilities:"object"==typeof e&&e?{...t.capabilities,agent:dc(e)}:t.capabilities,lastSeenAt:Eo(),updatedAt:Eo()});return s!==t.id&&this.nodes.delete(t.id),this.nodes.put(i),this.nodeConnectionRuntime?.observedReachable(i),{id:i.id,status:"online",checkedAt:Eo(),agent:e}}catch(e){const n=Rr.parse({...t,status:"offline",health:"failed",updatedAt:Eo()});return this.nodes.put(n),this.nodeConnectionRuntime?.observedFailure(n,gc(e)),{id:t.id,status:"offline",checkedAt:Eo(),error:e instanceof Error?e.message:String(e)}}}async checkNodeUpdate(e,t){return this.nodeAgentGateway.checkUpdate(this.requireNode(e),t)}async applyNodeUpdate(e,t){return this.nodeAgentGateway.applyUpdate(this.requireNode(e),t)}async listNodeUpdateJobs(e){return this.nodeAgentGateway.listUpdateJobs(this.requireNode(e))}async getLocalNodeExternalListener(e){return this.nodeAgentGateway.getExternalListener(this.requireLocalListenerNode(e))}async updateLocalNodeExternalListener(e,t){return this.nodeAgentGateway.updateExternalListener(this.requireLocalListenerNode(e),t)}async createNodePairingInvite(e,t={}){const n=this.requireNode(e);return this.nodeAgentGateway.createPairingInvite(n,t)}requireLocalListenerNode(e){const t=this.requireNode(e);if(!Rp(t)||!Np(t)){const e=new Error("Node agent TCP listener settings are available only for the built-in local node.");throw Object.assign(e,{statusCode:403,code:"LOCAL_NODE_LISTENER_ONLY"}),e}return t}createNodeJoinInvite(e={}){return this.nodeJoinService.createInvite(e)}completeNodeJoin(e){return this.nodeJoinService.complete(e)}async connectNodeToControlPlane(e,t){const n=this.requireNode(e),s=Vc.parse(t);return this.nodeAgentGateway.createControlPlaneConnection(n,s)}async listNodeControlPlanePairings(e){const t=this.requireNode(e);return this.nodeAgentGateway.listControlPlanePairings(t)}async deleteNodeControlPlanePairing(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteControlPlanePairing(n,t)}async listNodeControlPlaneConnections(e){const t=this.requireNode(e);return this.nodeAgentGateway.listControlPlaneConnections(t)}async deleteNodeControlPlaneConnection(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteControlPlaneConnection(n,t)}updateImage(e,t){return this.catalogService.updateImage(e,t)}async deleteImage(e){this.catalogService.requireImage(e);const t=this.listProjects().find(t=>t.defaultImageSelection?.imageId===e);if(t)throw Object.assign(new Error(`Image ${e} is the default for project ${t.name}.`),{statusCode:409,code:"IMAGE_IN_USE"});const n=this.readCachedNodeInstances(),s=n.nodeStates.filter(e=>"uninitialized"===e.phase||"loading"===e.phase||"stale"===e.phase);if(s.length){this.refreshCachedNodeInstances();const e=new Error("The instance directory is still loading; retry after every node has reported its instance snapshot.");throw Object.assign(e,{statusCode:503,code:"INSTANCE_DIRECTORY_LOADING",nodeIds:s.map(e=>e.nodeId)})}const i=n.items.find(t=>t.imageSelection?.imageId===e);if(i)throw Object.assign(new Error(`Image ${e} is used by instance ${i.name}.`),{statusCode:409,code:"IMAGE_IN_USE"});return this.catalogService.deleteImage(e)}listNodes(){return this.nodes.list()}listPublicNodes(){return this.listNodes().map(e=>cc(this.projectNodeConnection(e)))}projectNodeConnection(e){return this.nodeConnectionRuntime?.project(e)||e}createNode(e){return this.nodeConnectionManager.create(e)}listPendingProxyClaims(){return this.proxyLifecycle.listPendingClaims()}claimProxyNode(e){return this.proxyLifecycle.claimNode(e)}resumeProxyClaim(e){return this.proxyLifecycle.resumeClaim(e)}cancelProxyClaim(e,t=!1){return this.proxyLifecycle.cancelClaim(e,t)}applyProxyTargetSnapshot(e,t){return this.proxyLifecycle.applyTargetSnapshot(e,t)}applyProxyTargetEvent(e,t){return this.proxyLifecycle.applyTargetEvent(e,t)}markProxyUnavailable(e,t){return this.proxyLifecycle.markUnavailable(e,t)}markProxyBindingRevoked(e,t){return this.proxyLifecycle.markBindingRevoked(e,t)}updateNode(e,t){const n=Gc.parse(t),s=this.requireNode(e);this.proxyLifecycle.assertIdentityPatch(s,n);const i=Rr.parse({...s,...n,id:e,createdAt:s.createdAt,updatedAt:Eo()});return this.nodes.put(i)}deleteNode(e){if(Rp(this.requireNode(e))){const e=new Error("The built-in local node connection cannot be deleted.");throw Object.assign(e,{statusCode:400,code:"LOCAL_NODE_CANNOT_BE_DELETED"}),e}return this.nodeAgentGateway.forgetNode(e),this.nodes.delete(e)}dispose(){this.nodeAgentGateway.dispose()}async deleteNodeWithProxyLifecycle(e,t=!1){return this.proxyLifecycle.deleteNode(this.requireNode(e),t)}async listNodeRuntimes(e,t){const n=e?[this.requireNode(e)]:this.listNodes();return e?this.nodeAgentGateway.listRuntimes(n[0],{signal:t}):(await this.nodeAgentGateway.listFleetRuntimes(n,{signal:t})).items}async listNodeRuntimesWithDiagnostics(e,t=!1){const n=this.listNodes().map(e=>this.projectNodeConnection(e));return t?(this.nodeAgentGateway.refreshFleetRuntimes(n).catch(e=>{this.logWarn({error:gc(e)},"control plane runtime directory refresh failed")}),this.nodeAgentGateway.readFleetRuntimes(n)):this.nodeAgentGateway.listFleetRuntimes(n,{signal:e})}async createNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.createRuntime(n,t)}async updateNodeRuntime(e,t,n){const s=this.requireNode(e);return this.nodeAgentGateway.updateRuntime(s,t,n)}async deleteNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteRuntime(n,t)}async checkNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.checkRuntime(n,t)}async listControlledInstances(){return(await this.listNodeInstancesWithDiagnostics()).items.map(pc)}async listControlledInstancesWithDiagnostics(){const e=await this.listNodeInstancesWithDiagnostics();return{items:e.items.map(pc),nodeErrors:e.nodeErrors,nodeStates:e.nodeStates}}async instanceResourceMetrics(e){const t=await this.requireNodeInstance(e);return this.nodeAgentGateway.instanceResourceMetrics(this.requireNode(t.nodeId),t.id)}async nodeOwnsInstance(e,t){const n=this.requireNode(e),s=this.nodeAgentGateway.readFleetInstances([n]);return!!s.items.some(n=>n.id===t&&n.nodeId===e)||"ready"!==s.nodeStates[0]?.phase&&(await this.nodeAgentGateway.listInstances(n)).some(n=>n.id===t&&n.nodeId===e)}createControlledInstance(e){return this.controlledInstanceCreator.create(e)}async updateControlledInstance(e,t){const n=$c.parse(t),s=await this.requireNodeInstance(e),i=this.requireNode(s.nodeId);void 0!==n.config?.aiSessionHistoryLimit&&function(e,t){const n=e.capabilities.agent,s=n&&"object"==typeof n&&!Array.isArray(n)?n.capabilities:void 0;if(!Boolean(s&&"object"==typeof s&&!Array.isArray(s)&&!0===s.aiSessionHistoryLimit)||!Ps(t.capabilities).features.aiSessionPersistenceSettings)throw Object.assign(new Error("This instance does not support managed AI session history retention settings."),{statusCode:409,code:"AI_SESSION_HISTORY_LIMIT_UNSUPPORTED"})}(i,s),void 0!==n.config?.aiSessionAttachmentRetentionDays&&function(e,t){const n=e.capabilities.agent,s=n&&"object"==typeof n&&!Array.isArray(n)?n.capabilities:void 0;if(!Boolean(s&&"object"==typeof s&&!Array.isArray(s)&&!0===s.aiSessionAttachmentRetention)||!0!==t.capabilities.features.aiSessionConversationAttachments?.retentionSettings)throw Object.assign(new Error("This instance does not support managed AI session attachment retention settings."),{statusCode:409,code:"AI_SESSION_ATTACHMENT_RETENTION_UNSUPPORTED"})}(i,s);const{modelSelection:r,...o}=n;let a=Object.keys(o).length?await this.nodeAgentGateway.updateInstance(i,e,o):s;if(r){const t=await this.modelService.prepareAssignment(i,r);a=(await this.nodeAgentGateway.assignInstanceModels(i,e,t)).instance}return pc(a)}async deleteControlledInstance(e,t){const n=ii.parse(t),s=await this.requireNodeInstance(e),i=this.requireNode(s.nodeId),r=await this.nodeAgentGateway.deleteInstance(i,e,n);return r.completed&&this.configSyncPreferences.delete(e),r}listEnvironmentTemplates(e){return this.nodeAgentGateway.listEnvironmentTemplates(this.requireNode(e))}getEnvironmentTemplate(e,t){return this.nodeAgentGateway.getEnvironmentTemplate(this.requireNode(e),t)}async createEnvironmentTemplate(e,t){const n=await this.requireNodeInstance(e);return this.nodeAgentGateway.createEnvironmentTemplate(this.requireNode(n.nodeId),e,t)}deleteEnvironmentTemplate(e,t){return this.nodeAgentGateway.deleteEnvironmentTemplate(this.requireNode(e),t)}async startControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);return await this.modelService.ensureInstanceAssignment(t),pc(await this.nodeAgentGateway.startInstance(n,e))}async stopControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);return pc(await this.nodeAgentGateway.stopInstance(n,e))}async restartControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);return await this.modelService.ensureInstanceAssignment(t),pc(await this.nodeAgentGateway.restartInstance(n,e))}async retryControlledInstanceImageProvisioning(e){const t=await this.requireNodeInstance(e);return pc(await this.nodeAgentGateway.retryInstanceImageProvisioning(this.requireNode(t.nodeId),e))}async boardAsync(){return await this.listBootstrapNodeInstances(),(await this.boardWithDiagnostics(void 0,!0)).items}async boardWithDiagnostics(e,t=!1){const[n,s]=await Promise.all([this.listNodeRuntimesWithDiagnostics(e,t),this.listNodeInstancesWithDiagnostics(e,t)]);return this.instanceBoardReader.read({projects:this.listProjects(),images:this.listImageOptions(),nodes:this.nodes.list().map(e=>this.projectNodeConnection(e)),runtimes:n.items,instances:s.items,nodeErrors:[...n.nodeErrors,...s.nodeErrors],nodeStates:[...n.nodeStates,...s.nodeStates]})}async bootstrapAiSessionsFromInstances(){const e=await this.listBootstrapNodeInstances(),t=await Promise.all(e.map(async e=>{if(!po(e)||!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus)return{streamId:`bootstrap:${e.id}:ai.sessions`,revision:0,lastEventAt:e.aiSessions.updatedAt,snapshot:e.aiSessions};try{return oa(gt,await this.instanceRequest(e,"/ai-sessions/state"))}catch(t){return this.logWarn({instanceId:e.id,error:gc(t),errorCode:"AI_SESSION_LIVE_REFRESH_FAILED"},"control plane failed to refresh live AI sessions"),{streamId:`bootstrap:${e.id}:ai.sessions`,revision:0,lastEventAt:e.aiSessions.updatedAt,snapshot:e.aiSessions}}}));return{updatedAt:(new Date).toISOString(),instances:e.map((e,n)=>({instanceId:e.id,streamId:t[n].streamId,aiSessions:t[n].snapshot,revision:t[n].revision,lastEventAt:t[n].lastEventAt}))}}async bootstrapAppSessionsFromInstances(){const e=await this.listBootstrapNodeInstances(),t=await Promise.all(e.map(async e=>{if(!po(e)||!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=rn();return{streamId:`bootstrap:${e.id}:app.sessions`,revision:0,lastEventAt:t.updatedAt,snapshot:t}}try{return oa(qt,await this.instanceRequest(e,"/apps/sessions/state"))}catch(t){this.logWarn({instanceId:e.id,error:gc(t),errorCode:"APP_SESSION_LIVE_REFRESH_FAILED"},"control plane failed to refresh live app sessions");const n=rn();return{streamId:`bootstrap:${e.id}:app.sessions`,revision:0,lastEventAt:n.updatedAt,snapshot:n}}}));return{updatedAt:(new Date).toISOString(),instances:e.map((e,n)=>({instanceId:e.id,streamId:t[n].streamId,appSessions:t[n].snapshot,revision:t[n].revision,lastEventAt:t[n].lastEventAt}))}}async recoverAiSessionDelta(e,t,n){const s=await this.requireControlledInstance(e,!0),i=new URLSearchParams({streamId:t,sinceRevision:String(n)});return oa(kt,await this.instanceRequest(s,`/ai-sessions?${i}`))}async recoverAiSessionSnapshot(e){const t=await this.requireControlledInstance(e,!0);return oa(gt,await this.instanceRequest(t,"/ai-sessions/state"))}async recoverAppSessionDelta(e,t,n){const s=await this.requireControlledInstance(e,!0),i=new URLSearchParams({streamId:t,sinceRevision:String(n)});return oa(Wt,await this.instanceRequest(s,`/apps/sessions?${i}`))}async recoverAppSessionSnapshot(e){const t=await this.requireControlledInstance(e,!0);return oa(qt,await this.instanceRequest(t,"/apps/sessions/state"))}async listTriggers(){return this.controlPlaneTriggerService.listTriggers()}createTrigger(e){return this.controlPlaneTriggerService.createTrigger(e)}async updateTrigger(e,t){return this.controlPlaneTriggerService.updateTrigger(e,t)}async deleteTrigger(e){return this.controlPlaneTriggerService.deleteTrigger(e)}async applyTrigger(e,t){return this.controlPlaneTriggerService.applyTrigger(e,t)}async listInstanceTriggers(e){return this.controlPlaneTriggerService.listInstanceTriggers(e)}async bindAiSessionTrigger(e,t,n){return this.controlPlaneTriggerService.bindAiSessionTrigger(e,t,n)}async unbindAiSessionTrigger(e,t,n){return this.controlPlaneTriggerService.unbindAiSessionTrigger(e,t,n)}async runInstanceTrigger(e,t,n={}){return this.controlPlaneTriggerService.runInstanceTrigger(e,t,n)}listChatSessions(){return this.chatSessionService.list()}createAppAccessToken(e){return this.appAccessService.createToken(e)}createAppSessionAccessToken(e){return this.appAccessService.createSessionToken(e)}revokeAppSessionAccessToken(e,t){this.appAccessService.revokeToken(e,t)}resolveAppAccessToken(e,t){return this.appAccessService.resolveToken(e,t)}createChatActionToken(e){return this.chatActionTokenService.create(e)}resolveChatActionToken(e,t){return this.chatActionTokenService.resolve(e,t)}pendingDecisionCallbackData(e,t){return this.chatActionTokenService.pendingDecisionCallbackData(e,t)}async appAccessProxyTarget(e,t,n=""){return this.appAccessService.proxyTarget(e,t,n)}listChatBridges(){return this.chatBridgeService.list()}requireChatBridge(e){return this.chatBridgeService.require(e)}createChatBridge(e){return this.chatBridgeService.create(e)}updateChatBridge(e,t){return this.chatBridgeService.update(e,t)}deleteChatBridge(e){return this.chatBridgeService.delete(e)}requireChatSession(e){return this.chatSessionService.require(e)}upsertChatSession(e){return this.chatSessionService.upsert(e)}async handleChatGatewayMessage(e){return this.chatSessionRuntime.handleChatGatewayMessage(e)}async handleChatGatewayAction(e){return this.chatSessionRuntime.handleChatGatewayAction(e)}async handleChatCommand(e,t){return this.chatSessionRuntime.handleChatCommand(e,t)}async listPendingRoutes(){const e=Eo(),t=[],n=await this.listAiSessions(),s=new Map(n.instances.map(e=>[e.instanceId,e.aiSessions])),i=this.readCachedNodeInstances();this.refreshCachedNodeInstances();for(const n of i.items){if("online"!==n.connectionStatus&&"online"!==n.agentStatus||!n.target.web)continue;const i=n.projectId?this.catalogService.getProject(n.projectId):void 0;for(const r of s.get(n.id)?.sessions||[]){if("waiting"!==r.status)continue;const s=lo.parse({id:`${n.id}:ai:${r.id}`,instanceId:n.id,projectId:n.projectId,aiSessionId:r.id,providerSessionId:r.providerSessionId,result:r.summary||r.currentTool?.inputPreview||r.lastMessage||`${r.agent} is waiting for approval`,source:r.agent,kind:"approval",status:"pending",lastSeenAt:e});t.push({...s,project:i,instance:pc(n)})}}return t}async listAiSessionInstanceNames(){return(await this.listBootstrapNodeInstances()).map(e=>({id:e.id,name:e.name}))}resolveAiSessionApproval(e,t,n){return this.aiSessionActionService.resolveApproval(e,t,n)}listAiSessionHistory(e){return this.aiSessionActionService.listHistory(e)}getAiSessionHistoryDetail(e,t){return this.aiSessionActionService.historyDetail(e,t)}getAiSessionTimeline(e,t){return this.aiSessionActionService.timeline(e,t)}getAiSessionTurnTimeline(e,t,n){return this.aiSessionActionService.turnTimeline(e,t,n)}resumeAiSession(e,t){return this.aiSessionActionService.resume(e,t)}async createAiSession(e,t){const n=await this.requireControlledInstance(e,!0),{cwdFolderId:s,...i}=t,r={type:"runtime-path",path:await this.aiSessionRuntimeCwd(n,t.cwdFolderId)};return this.aiSessionActionService.create(e,{...i,cwd:r,...t.cwdFolderId?{cwdFolderId:t.cwdFolderId}:{}})}async inspectAiSessionWorkspace(e,t){const n=await this.requireControlledInstance(e,!0),s={type:"runtime-path",path:await this.aiSessionRuntimeCwd(n,t)};return this.aiSessionActionService.inspectWorkspace(e,s)}forkAiSession(e,t,n){return this.aiSessionActionService.fork(e,t,n)}openAiSessionApp(e,t,n){return this.aiSessionActionService.openApp(e,t,n)}closeAiSession(e,t,n){return this.aiSessionActionService.close(e,t,n)}aiSessionActionDiagnostics(){return this.aiSessionActionService.diagnostics()}async launchAppSession(e,t="terminal-tty",n={}){const s=await this.requireControlledInstance(e,!0);if("online"!==s.connectionStatus&&"online"!==s.agentStatus){const e=new Error(`Instance ${s.name} is still starting. Wait for it to connect before launching apps.`);throw Object.assign(e,{statusCode:409,code:"INSTANCE_NOT_CONNECTED"}),e}const i=await this.resolveAppLaunchOptions(s,n),r=await this.instanceRequest(s,"/apps/sessions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({appId:t,...i})});return await this.listAppSessions({refresh:!0}),r}async stopAppSession(e,t){const n=await this.requireControlledInstance(e,!0),s=await this.instanceRequest(n,`/apps/sessions/${encodeURIComponent(t)}/stop`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({})});return await this.listAppSessions({refresh:!0}),s}async instanceAppManagement(e){const t=await this.requireControlledInstance(e,!0);try{return function(e){try{return oa(Ci,e)}catch(e){if(e instanceof d.z.ZodError){const e=new Error("This controlled instance does not support managed app operations.");throw Object.assign(e,{statusCode:409,code:"INSTANCE_APP_MANAGEMENT_UNSUPPORTED"}),e}throw e}}(await this.instanceRequest(t,"/apps/management"))}catch(e){const t=e&&"object"==typeof e?e:{};if(e instanceof d.z.ZodError||404===t.statusCode){const e=new Error("This controlled instance does not support managed app operations.");throw Object.assign(e,{statusCode:409,code:"INSTANCE_APP_MANAGEMENT_UNSUPPORTED"}),e}throw e}}async requestInstanceAppOperation(e,t,n,s={}){const i=await this.requireControlledInstance(e,!0);return oa(xi,await this.instanceRequest(i,`/apps/${encodeURIComponent(t)}/${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(s)}))}async instanceAppManagementJob(e,t){const n=await this.requireControlledInstance(e,!0);return oa(xi,await this.instanceRequest(n,`/apps/jobs/${encodeURIComponent(t)}`))}async renameAppSession(e,t,n){const s=await this.requireControlledInstance(e,!0),i=await this.instanceRequest(s,`/apps/sessions/${encodeURIComponent(t)}`,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({title:n})});return await this.listAppSessions({refresh:!0}),i}sendAiSessionMessage(e,t,n,s,i=[],r=[],o,a){return this.aiSessionActionService.sendMessage(e,t,n,s,i,r,o,a)}aiSessionMentionCatalog(e,t){return this.aiSessionActionService.mentionCatalog(e,t)}searchAiSessionMentionFiles(e,t,n){return this.aiSessionActionService.searchMentionFiles(e,t,n)}executeAiSessionCommand(e,t,n){return this.aiSessionActionService.executeCommand(e,t,n)}aiSessionQueue(e,t){return this.aiSessionActionService.queue(e,t)}getAiSessionDetail(e,t){return this.aiSessionActionService.detail(e,t)}steerAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.steerQueuedMessage(e,t,n)}retryAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.retryQueuedMessage(e,t,n)}removeAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.removeQueuedMessage(e,t,n)}editAiSessionQueuedMessage(e,t,n,s){return this.aiSessionActionService.editQueuedMessage(e,t,n,s)}reorderAiSessionQueuedMessages(e,t,n){return this.aiSessionActionService.reorderQueuedMessages(e,t,n)}interruptAiSession(e,t){return this.aiSessionActionService.interrupt(e,t)}async proxyInstanceHttp(e,t,n={}){const s=await this.requireControlledInstance(e,!0);return this.controlledInstanceGateway.proxyHttp(s,t,n)}async proxyInstanceWebSocket(e,t,n,s,i={}){const r=await this.requireControlledInstance(e,!0);this.controlledInstanceGateway.proxyWebSocket(r,t,n,s,i)}async instanceConfigSyncState(e){const t=await this.requireControlledInstance(e,!0),n=d.z.array(ua).parse(await this.instanceRequest(t,"/config-sync/programs"));return ga.parse({programs:n,preferences:this.configSyncPreferences.get(e)?.preferences||zp()})}async listInstanceConfigSyncFolders(e,t={}){const n=await this.requireControlledInstance(e,!0),s=new URLSearchParams;return t.path&&s.set("path",t.path),void 0!==t.depth&&s.set("depth",String(t.depth)),d.z.array(Gr).parse(await this.instanceRequest(n,"/config-sync/folders"+(s.size?`?${s}`:"")))}async syncInstanceConfigs(e,t){const n=ha.parse(t),s=await this.requireControlledInstance(e,!0);if("export"===n.direction&&"local-folder"!==s.source.type){const e=new Error("Exporting instance config is only available for local folder projects.");throw Object.assign(e,{statusCode:400,code:"CONFIG_SYNC_EXPORT_REQUIRES_LOCAL_PROJECT"}),e}const i=function(e){const t=function(e){const t=[];for(const n of e.split("/"))if(n&&"."!==n)if(".."===n){if(!t.length)return"..";t.pop()}else t.push(n);return t.join("/")||"."}(e.trim().replace(/\\/g,"/")||".");if(t.startsWith("/")||".."===t||t.startsWith("../")){const e=new Error("Config sync folder must stay inside the instance workspace.");throw Object.assign(e,{statusCode:400,code:"CONFIG_SYNC_FOLDER_INVALID"}),e}return t||"."}(n.workspaceFolder),r={...n,workspaceFolder:i},o=oa(Ia,await this.instanceRequest(s,"/config-sync",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})),a=Eo(),d=this.configSyncPreferences.get(e);return this.configSyncPreferences.put({id:e,preferences:{...d?.preferences||zp(),[n.direction]:i},createdAt:d?.createdAt||a,updatedAt:a}),o}async instanceRequest(e,t,n={},s){return this.controlledInstanceGateway.request(e,t,n,s)}async reportInstanceHeartbeat(e,t){await this.controlledInstanceGateway.reportHeartbeat(e,t)}async nodeAgentFetch(e,t,n={}){const s="reverse-wss"!==e.connectionMode&&"control-plane-proxy"!==e.connectionMode;try{const i=await this.nodeAgentTransportResolver.resolve(e).request(e,t,n);return s&&this.nodeConnectionRuntime?.observedReachable(e),i}catch(t){throw!s||n.signal?.aborted||function(e){return e instanceof Error&&("AbortError"===e.name||"ABORT_ERR"===e.code)}(t)||this.nodeConnectionRuntime?.observedFailure(e,gc(t)),t}}readCachedNodeInstances(){return this.nodeAgentGateway.readFleetInstances(this.listNodes().map(e=>this.projectNodeConnection(e)))}refreshCachedNodeInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));this.nodeAgentGateway.refreshFleetInstances(e).catch(e=>{this.logWarn({error:gc(e)},"control plane instance directory refresh failed")})}async listCachedNodeInstances(){const e=this.readCachedNodeInstances();return this.refreshCachedNodeInstances(),e.items}async listBootstrapNodeInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));return await this.nodeAgentGateway.refreshFleetInstances(e),this.nodeAgentGateway.readFleetInstances(e).items}async listTriggerMutationInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));await this.nodeAgentGateway.refreshFleetInstances(e);const t=this.nodeAgentGateway.readFleetInstances(e),n=new Set(t.nodeStates.filter(e=>"ready"===e.phase).map(e=>e.nodeId)),s=t.nodeStates.filter(e=>"ready"!==e.phase).map(e=>({scope:"node",nodeId:e.nodeId,code:e.error?.code||"TRIGGER_NODE_DIRECTORY_UNAVAILABLE",message:e.error?.message||`Node ${e.nodeId} instance directory is ${e.phase}; trigger deployment changes were skipped.`}));return{items:t.items.filter(e=>n.has(e.nodeId)),partialFailures:s}}async listNodeInstancesWithDiagnostics(e,t=!1){const n=this.listNodes().map(e=>this.projectNodeConnection(e));return t?(this.nodeAgentGateway.refreshFleetInstances(n).catch(e=>{this.logWarn({error:gc(e)},"control plane instance directory refresh failed")}),this.nodeAgentGateway.readFleetInstances(n)):this.nodeAgentGateway.listFleetInstances(n,{signal:e})}async requireNodeInstance(e){const t=this.listNodes(),n=this.nodeAgentGateway.instanceFromSnapshot(t,e);if(n)return n;const s=(await this.nodeAgentGateway.listFleetInstances(t)).items.find(t=>t.id===e);if(s)return s;yc("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`)}async requireNodeRuntimeOnNode(e,t){const n=(await this.listNodeRuntimes(e)).find(e=>e.id===t);return n||yc("NODE_RUNTIME_NOT_FOUND",`Runtime ${t} was not found on node ${e}.`),n}async requireNodeLocalFolder(e,t){return this.nodeAgentGateway.requireLocalFolder(e,t)}async resolveAppLaunchOptions(e,t){const n="string"==typeof t.cwdFolderId?t.cwdFolderId.trim():"",s={...t};return delete s.cwdFolderId,n?{...s,cwd:await this.runtimeCwdForFolderId(e,n)}:s}async runtimeCwdForFolderId(e,t){const n=this.requireNode(e.nodeId),s=await this.requireNodeLocalFolder(n,t);if(s.nodeId!==e.nodeId){const t=new Error(`Local folder ${s.id} belongs to node ${s.nodeId}, not ${e.nodeId}.`);throw Object.assign(t,{statusCode:400,code:"LOCAL_FOLDER_REQUIRES_INSTANCE_NODE"}),t}const i=await this.requireNodeRuntimeOnNode(e.nodeId,e.runtimeId);return this.appLaunchCwdForFolder(e,s,i)}async aiSessionRuntimeCwd(e,t){return t?this.runtimeCwdForFolderId(e,t):e.runtime.workspacePath||e.workspace.path||lc(e.source).path||"/workspace"}appLaunchCwdForFolder(e,n,s){const i=function(e,n,s){if("local"===s.type)return Tp(i=n).resolve(i);var i;if("local-folder"!==e.source.type)return;const r=function(e,t){if(kp(e)!==kp(t))return;const n=Tp(e),s=n.resolve(e),i=n.resolve(t),r=n.relative(s,i);return r?".."===r||r.startsWith(`..${n.sep}`)||n.isAbsolute(r)?void 0:r.split(n.sep).filter(Boolean):[]}(e.source.path,n);if(!r)return;const o=e.runtime.workspacePath||e.workspace.path||lc(e.source).path||"/workspace";return r.length?t.posix.join(o,...r):o}(e,n.path,s);if(i)return i;if("local-folder"!==e.source.type){const e=new Error("App cwd folder selection is only supported for local-folder instances.");throw Object.assign(e,{statusCode:400,code:"APP_CWD_REQUIRES_LOCAL_FOLDER_SOURCE"}),e}const r=new Error(`Local folder ${n.path} is outside the instance workspace ${e.source.path}.`);throw Object.assign(r,{statusCode:400,code:"APP_CWD_OUTSIDE_WORKSPACE"}),r}requireProject(e){return this.catalogService.requireProject(e)}requireModel(e,t=!1){return this.modelService.require(e,t)}requireImage(e){return this.catalogService.requireImage(e)}requireNode(e){const t=this.nodes.get(e);return t||yc("NODE_NOT_FOUND",`Node ${e} was not found.`),t}requirePublicNode(e){return cc(this.projectNodeConnection(this.requireNode(e)))}async requireControlledInstance(e,t=!1){const n=await this.requireNodeInstance(e);return t?n:pc(n)}}function _p(e){return g(String(e),"escape").replace(/\n+$/,"")}function Pp(e){const[t,...n]=String(e).split("\n");return[`*${_p(t)}*`,...n.map(_p)].join("\n")}function jp(e,t=4e3){const n=String(e),s=Pp(n);if(s.length<=t)return s;const[i,...r]=n.split("\n"),o=r.join("\n"),a="...\n";let d=i;for(;Pp(`${d}\n${a}`).length>t&&d.length>0;)d=d.slice(0,Math.floor(.8*d.length));let c=0,l=o.length,p=0,u=Pp(`${d}\n${a}`);for(;c<=l;){const e=Math.floor((c+l)/2),n=Pp(`${d}\n${a}${o.slice(-e)}`);n.length<=t?(u=n,p=e,c=e+1):l=e-1}const h=o.slice(-p),m=h.indexOf("\n");return m>=0&&m<200&&(u=Pp(`${d}\n${a}${h.slice(m+1)}`)),u}function Dp(e){return String(e).replace(/\\([_*\[\]()~`>#+\-=|{}.!\\])/g,"$1")}async function Mp(e,t,n,s,i={}){if(!t.token)return;const r=n=>e(`https://api.telegram.org/bot${t.token}/sendMessage`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),o=function(e,t={}){const n=String(e),s=t.rawMarkdownV2?e=>e:_p;if(s(n).length<=4e3)return[n];const i=[];let r=n;for(;r;){let e=1,t=r.length,n=1;for(;e<=t;){const i=Math.floor((e+t)/2);s(r.slice(0,i)).length<=4e3?(n=i,e=i+1):t=i-1}if(n<r.length){const e=r.slice(0,n),t=Math.max(e.lastIndexOf("\n"),e.lastIndexOf(" "));t>=Math.floor(.6*n)&&(n=t+1)}i.push(r.slice(0,n).trimEnd()),r=r.slice(n).trimStart()}return i.filter(Boolean)}(s,i);let a;for(const[e,t]of o.entries())a=await qp(r,"sendMessage",t,{chat_id:n,...0===e&&i.replyToMessageId?{reply_to_message_id:i.replyToMessageId,allow_sending_without_reply:!0}:{},...e===o.length-1&&i.replyMarkup?{reply_markup:i.replyMarkup}:{}},i);return a}async function Lp(e,t,n){if(!t.token||!n)throw new Error("Telegram file id is required.");const s=await e(`https://api.telegram.org/bot${t.token}/getFile`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({file_id:n})}),i=await s.json().catch(()=>({}));if(!s.ok||!1===i.ok||!i.result?.file_path)throw new Error(i.description||`Telegram getFile failed with HTTP ${s.status}`);return`https://api.telegram.org/file/bot${t.token}/${i.result.file_path}`}async function qp(e,t,n,s,i){const r=i.parseMode||"MarkdownV2",o=i.rawMarkdownV2?String(n):_p(n),a=await e({...s,text:o,disable_web_page_preview:!0,parse_mode:r}),d=await a.json().catch(()=>({}));if(a.ok&&!1!==d.ok)return d.result;if("editMessageText"===t&&$p(d.description))return;if(i.rawMarkdownV2&&"MarkdownV2"===r){const i=await e({...s,text:Dp(n),disable_web_page_preview:!0,parse_mode:"Markdown"}),r=await i.json().catch(()=>({}));if(i.ok&&!1!==r.ok)return r.result;if("editMessageText"===t&&$p(r.description))return}const c=await e({...s,text:i.rawMarkdownV2?Dp(n):String(n),disable_web_page_preview:!0}),l=await c.json().catch(()=>({}));if(c.ok&&!1!==l.ok)return l.result;if("editMessageText"!==t||!$p(l.description))throw new Error(l.description||d.description||`Telegram ${t} failed with HTTP ${c.status}`)}function $p(e){return"string"==typeof e&&e.toLowerCase().includes("message is not modified")}function Bp(e,t){if("string"==typeof e&&e.trim())return e.trim();Up(`Chat action token is missing ${t}.`)}function Fp(e){if("allow"===e||"deny"===e||"skip"===e)return e;Up("Chat action token has an invalid decision.")}function Up(e){const t=new Error(e);throw Object.assign(t,{statusCode:400,code:"CHAT_ACTION_TOKEN_INVALID"}),t}function Hp(e){return Buffer.from(e,"base64url").toString("utf8")}function Wp(e){return String(e||"").split(/\r?\n/,1)[0].replace(/^#+\s*/,"").trim().slice(0,20)||"消息通知"}function Gp(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,"string"==typeof t?t:JSON.stringify(t)]))}function Vp(e){return`dtv1.card//IM_GROUP.${e}`}function Kp(e){return`dtv1.card//IM_ROBOT.${e}`}function Jp(e,t){return lu(t.biz_conversation_id).trim()||lu(e.spaceId).replace(/^dtv1\.card\/\/(?:IM_GROUP|IM_SINGLE|IM_ROBOT)\./,"")}function Yp(e,t={}){const n=lu(e).trim().toUpperCase();return"2"===n||"IM_GROUP"===n?"IM_GROUP":"1"===n||"IM_SINGLE"===n?t.robotMessage?"IM_ROBOT":"IM_SINGLE":"IM_ROBOT"===n?"IM_ROBOT":void 0}function Qp(e){if(e.startsWith("task_handoff:"))return e;if(!e.startsWith("th_cb_"))return"";try{return Buffer.from(e.slice(6),"base64url").toString("utf8")}catch{return""}}function Xp(e,t,n,s,i){const r=Jp(s,i);return{cardUpdateOptions:{updateCardDataByKey:!0,updatePrivateDataByKey:!1},cardData:{cardParamMap:Gp({type:"actions",title:"TaskHandoff",description:e,list:Ql(t),biz_out_track_id:s.outTrackId||i.biz_out_track_id||"",biz_conversation_id:r,biz_sender_id:i.biz_sender_id||s.userId||"",biz_session_webhook:i.biz_session_webhook||"",biz_conversation_type:i.biz_conversation_type||"",biz_step:n,error_msg:""})}}}function Zp(e,t,n){const s=[];return eu(s,n),eu(s,t),eu(s,e),s.find(e=>Qp(e))||""}function eu(e,t){for(const n of["actionIdList","actionIds"]){const s=t[n];Array.isArray(s)&&e.push(...s.map(e=>lu(e)).filter(Boolean))}for(const n of["actionId","action_id","id","actionValue"]){const s=lu(t[n]);s&&e.push(s)}}async function tu(e,t,n,s){s?.("info",{target:"sessionWebhook",hasSessionWebhook:Boolean(t),textPreview:au(n)},"dingding webhook send requested");const i=await e(t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({msgtype:"markdown",markdown:{title:Wp(n),text:n}})}),r=await i.json().catch(()=>{});if(s?.(i.ok?"info":"warn",{target:"sessionWebhook",status:i.status,response:ou(r)},"dingding webhook send completed"),!i.ok)throw new Error(`DingDing webhook failed with HTTP ${i.status}`)}async function nu(e){const t=Ql(e.replyMarkup);if(!t.length&&!e.forceCard)return e.sessionWebhook&&await tu(e.fetchImpl,e.sessionWebhook,e.text,e.runtime.onLog),e.sessionWebhook?{delivered:!0}:void 0;const n=e.bridge.settings||{},s=lu(n.robotCode),i=lu(n.cardTemplateId)||"13fc6717-12e4-43ed-8533-111a310d4995.schema",r=lu(n.cardCallbackRouteKey)||"task_handoff_message",o=e.senderId||e.runtime.senderIds.get(e.chatId)||lu(n.senderId),a=(d=e.runtime,c=e.chatId,d.conversationTypes?.get(c)||"IM_GROUP");var d,c;if(!s||!i||!o){if(e.sessionWebhook&&!e.forceCard)return await tu(e.fetchImpl,e.sessionWebhook,e.text,e.runtime.onLog),{delivered:!0};throw new Error("DingDing card target is incomplete.")}const l=`task_handoff_cp_${Date.now()}_${Math.random().toString(16).slice(2)}`,p=Gp({type:"actions",title:e.title||Wp(e.text),description:e.text,list:t,biz_out_track_id:l,biz_step:e.step||"task_handoff_actions",biz_conversation_id:e.chatId,biz_sender_id:o,biz_session_webhook:e.sessionWebhook||e.runtime.chatWebhooks.get(e.chatId)||"",biz_conversation_type:a,error_msg:""}),u=function(e,t,n,s){return"IM_SINGLE"===e?{openSpaceId:(i=t,`dtv1.card//IM_SINGLE.${i}`),imSingleOpenSpaceModel:{},imSingleOpenDeliverModel:{extension:{}}}:"IM_ROBOT"===e?{openSpaceId:Kp(n),imRobotOpenSpaceModel:{supportForward:!1},imRobotOpenDeliverModel:{extension:{},robotCode:s,spaceType:"IM_ROBOT"}}:{openSpaceId:Vp(t),imGroupOpenSpaceModel:{supportForward:!1},imGroupOpenDeliverModel:{extension:{},robotCode:s}};var i}(a,e.chatId,o,s);return e.runtime.onLog?.("info",{target:"card",chatId:e.chatId,senderId:o,conversationType:a,openSpaceId:u.openSpaceId,hasSessionWebhook:Boolean(e.sessionWebhook||e.runtime.chatWebhooks.get(e.chatId)),hasReplyMarkup:Boolean(e.replyMarkup),actionCount:t.length,textPreview:au(e.text)},"dingding card send requested"),await su(e.fetchImpl,e.bridge,e.runtime,"POST","/v1.0/card/instances/createAndDeliver",{userId:o,cardTemplateId:i,outTrackId:l,callbackType:"STREAM",callbackRouteKey:r,cardData:{cardParamMap:p},userIdType:Number(n.cardUserIdType||1),...u}),{delivered:!0,outTrackId:l}}async function su(e,t,n,s,i,r){const o=await async function(e,t,n){if(n.accessToken&&n.accessToken.expiresAt>Date.now()+6e4)return n.accessToken.value;const s=lu(t.settings.clientSecret);if(!t.token||!s)throw new Error("DingDing client id/secret is not configured.");const i=await e("https://api.dingtalk.com/v1.0/oauth2/accessToken",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({appKey:t.token,appSecret:s})}),r=await i.json().catch(()=>({}));if(!i.ok||!r.accessToken)throw new Error(`DingDing access token failed with HTTP ${i.status}`);const o=Number(r.expireIn||7200);return n.accessToken={value:r.accessToken,expiresAt:Date.now()+1e3*Math.max(60,o-120)},n.accessToken.value}(e,t,n);n.onLog?.("info",{method:s,path:i,body:iu(r)},"dingding api request");const a=await e(`https://api.dingtalk.com${i}`,{method:s,headers:{"content-type":"application/json","x-acs-dingtalk-access-token":o},body:JSON.stringify(r)}),d=await a.json().catch(()=>{});if(n.onLog?.(a.ok?"info":"warn",{method:s,path:i,status:a.status,response:ou(d)},"dingding api response"),!a.ok)throw new Error(`DingDing API failed with HTTP ${a.status}`);const c=du(d),l=c.code??c.errcode,p=c.success;if(void 0!==l&&"0"!==String(l)||!1===p)throw new Error(lu(c.message||c.errmsg)||`DingDing API returned ${String(l||"failure")}`);const u=function(e){const t=du(du(e).result).deliverResults;if(!Array.isArray(t))return"";const n=t.find(e=>!1===du(e).success);if(!n)return"";const s=du(n),i=lu(s.spaceId),r=lu(s.errorMsg||s.message||s.errmsg)||"delivery failed";return i?`DingDing card delivery failed for ${i}: ${r}`:`DingDing card delivery failed: ${r}`}(d);if(u)throw new Error(u);return a}function iu(e){const t=du(e),n=du(t.cardData),s=du(n.cardParamMap);return{openSpaceId:lu(t.openSpaceId),outTrackId:lu(t.outTrackId),userId:lu(t.userId),userIdType:t.userIdType,callbackType:lu(t.callbackType),callbackRouteKey:lu(t.callbackRouteKey),hasImGroupTarget:Boolean(t.imGroupOpenSpaceModel||t.imGroupOpenDeliverModel),hasImSingleTarget:Boolean(t.imSingleOpenSpaceModel||t.imSingleOpenDeliverModel),hasImRobotTarget:Boolean(t.imRobotOpenSpaceModel||t.imRobotOpenDeliverModel),imGroupOpenDeliverModel:ru(t.imGroupOpenDeliverModel),imSingleOpenDeliverModel:ru(t.imSingleOpenDeliverModel),imRobotOpenDeliverModel:ru(t.imRobotOpenDeliverModel),bizConversationId:lu(s.biz_conversation_id),bizConversationType:lu(s.biz_conversation_type),bizSenderId:lu(s.biz_sender_id),hasBizSessionWebhook:Boolean(lu(s.biz_session_webhook))}}function ru(e){const t=du(e);if(Object.keys(t).length)return{hasExtension:Boolean(t.extension),hasRobotCode:Boolean(lu(t.robotCode)),spaceType:lu(t.spaceType),recipients:Array.isArray(t.recipients)?t.recipients.length:void 0,atUserIds:t.atUserIds&&"object"==typeof t.atUserIds?Object.keys(t.atUserIds).length:void 0}}function ou(e){const t=du(e),n=du(t.result);return{code:t.code??t.errcode,message:au(t.message||t.errmsg,240),success:t.success,requestId:t.requestId,result:Object.keys(n).length?n:void 0}}function au(e,t=160){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function du(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function cu(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:"string"==typeof e&&e.trim()?pu(e):{}}function lu(e){return"string"==typeof e?e:""}function pu(e){try{return du(JSON.parse(String(e||"{}")))}catch{return{}}}function uu(e){return JSON.stringify(Ql(e))}const hu="task_handoff_action_id";function mu(e,t){const n=Ql(t);return{schema:"2.0",config:{summary:{content:fu(e)}},body:{elements:[{tag:"markdown",content:e},...n.map(e=>({tag:"button",text:{tag:"plain_text",content:e.text},type:Iu(e.text),width:"fill",size:"medium",behaviors:[{type:"callback",value:{[hu]:e.id}}]}))]}}}function gu(e){const t=function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e);return function(e){const t=String(e||"");return t.startsWith("th_cb_")?function(e){try{return Buffer.from(e,"base64url").toString("utf8")}catch{return""}}(t.slice(6)):""}(t[hu]||t.action_id||t.actionId||t.id||e)}function yu(e){return JSON.stringify(Ql(e))}function fu(e){const t=e.replace(/\s+/g," ").trim();return t.length<=50?t:`${t.slice(0,47)}...`}function Iu(e){const t=e.trim().toLowerCase();return["deny","cancel","delete","remove"].some(e=>t.includes(e))?"danger":["allow","approve","launch","open"].some(e=>t.includes(e))?"primary":"default"}function bu(e){return e instanceof Error?e.message:String(e)}function vu(e){const t=Number(function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e).message_id);return Number.isInteger(t)&&t>0?t:void 0}function Su(e){return Array.isArray(e?.actionRows)?e.actionRows:(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e])}function wu(e,t){const n=Su(e),s=Su(t);return n.length===s.length&&n.every((e,t)=>{const n=s[t];return e.length===n.length&&e.every((e,t)=>{const s=n[t];return e.text===s?.text&&e.callbackData===s.callbackData})})}class Au{entries;updateIntervalMs;send;edit;deleteMessage;messageIdFromResult;retryAfterMs;isMessageTooLong;onLog;constructor(e){this.entries=e.entries||new Map,this.updateIntervalMs=e.updateIntervalMs||1e3,this.send=e.send,this.edit=e.edit,this.deleteMessage=e.delete,this.messageIdFromResult=e.messageIdFromResult||vu,this.retryAfterMs=e.retryAfterMs,this.isMessageTooLong=e.isMessageTooLong,this.onLog=e.onLog}remember(e,t,n,s,i,r){const o=this.entries.get(e);return o&&(clearTimeout(o.timer),o.timer=void 0,o.pendingText=void 0),this.entries.set(e,{lastText:n,lastUpdateAt:Date.now(),messageId:t,route:s,options:i,lastOptions:i,renderOptions:r}),o}rekey(e,t){if(e===t)return this.entries.has(e);const n=this.entries.get(e);if(!n||this.entries.has(t))return!1;if(clearTimeout(n.timer),n.timer=void 0,this.entries.delete(e),this.entries.set(t,n),n.pendingText){const e=n.rateLimitedUntil?Math.max(0,n.rateLimitedUntil-Date.now()):Math.max(0,this.updateIntervalMs-(Date.now()-n.lastUpdateAt));this.scheduleFlush(t,e)}return!0}scheduleFlush(e,t){const n=this.entries.get(e);n&&!n.timer&&(n.timer=setTimeout(()=>{n.timer=void 0;const t=n.pendingText;n.pendingText=void 0,t&&this.applyUpdate(e,t,n.route,n.options)},t))}markRateLimited(e,t,n,s){const i=this.entries.get(e);i&&(i.rateLimitedUntil=Date.now()+n,i.pendingText=t,i.route=s||i.route,this.scheduleFlush(e,n))}async applyUpdate(e,t,n,s){let i=this.entries.get(e);const r=i,o=n||i?.route,a=s||i?.options;try{if(i&&(i.route=o,i.options=a),i?.pending&&await i.pending,i=this.entries.get(e),r&&i!==r)return!1;if(i?.messageId){if(i.lastText===t&&wu(i.lastOptions,a))return!0;const n=Date.now()-(i.lastUpdateAt||0);return n<this.updateIntervalMs?(i.pendingText=t,i.route=o||i.route,i.options=a||i.options,this.scheduleFlush(e,this.updateIntervalMs-n),!0):(await this.edit(i.messageId,t,o||i.route,a),i.lastText=t,i.lastOptions=a,i.lastUpdateAt=Date.now(),i.rateLimitedUntil=void 0,!0)}const n={lastText:t,lastUpdateAt:Date.now(),route:o,options:a,lastOptions:a};return n.pending=this.send(t,o,a).then(e=>{const t=this.messageIdFromResult(e);t&&(n.messageId=t)}).finally(()=>{n.pending=void 0}),this.entries.set(e,n),await n.pending,this.entries.get(e)===n&&(n.rateLimitedUntil=void 0,Boolean(n.messageId))}catch(n){const s=this.retryAfterMs?.(n);return s&&this.markRateLimited(e,t,s,o),this.onLog?.(`Telegram progress update skipped: ${bu(n)}`),!1}}update(e,t,n,s){const i=String(t||"").trim();if(!i)return;const r=this.entries.get(e);if(r&&(r.route=n||r.route,r.options=s||r.options),r?.lastText===i&&wu(r.lastOptions,s||r.options)&&!r.pending&&!r.pendingText)return;const o=Date.now();if(r?.rateLimitedUntil){if(r.rateLimitedUntil>o)return r.pendingText=i,void this.scheduleFlush(e,r.rateLimitedUntil-o);r.rateLimitedUntil=void 0}if(r?.pending&&!r.messageId)return r.pendingText=i,void this.scheduleFlush(e,this.updateIntervalMs);if(!r||!r.messageId)return void this.applyUpdate(e,i,n,s);const a=Date.now()-(r.lastUpdateAt||0);if(a>=this.updateIntervalMs)return clearTimeout(r.timer),r.timer=void 0,r.pendingText=void 0,void this.applyUpdate(e,i,n||r.route,s||r.options);r.pendingText=i,this.scheduleFlush(e,this.updateIntervalMs-a)}async finish(e,t,n,s,i){const r=this.entries.get(e);if(!r)return!1;try{if(clearTimeout(r.timer),r.timer=void 0,r.pendingText=void 0,r.pending&&await r.pending,this.entries.delete(e),!r.messageId)return!1;const o=s||r.options;return r.lastText===t&&wu(r.lastOptions,o)||await this.edit(r.messageId,t,n||r.route,o,i||r.renderOptions),!0}catch(t){return this.entries.delete(e),this.isMessageTooLong?.(t)?this.onLog?.("Telegram progress finish too long; sending result as multiple messages"):this.onLog?.(`Telegram progress finish skipped: ${bu(t)}`),!1}}async delete(e,t){const n=this.entries.get(e);if(!n)return!1;try{return clearTimeout(n.timer),n.timer=void 0,n.pendingText=void 0,n.pending&&await n.pending,this.entries.delete(e),!(!this.deleteMessage||!n.messageId)&&(await this.deleteMessage(n.messageId,t||n.route),!0)}catch(t){return this.entries.delete(e),this.onLog?.(`Telegram progress delete skipped: ${bu(t)}`),!1}}async flush(e){const t=this.entries.get(e);if(t?.pending&&await t.pending,t?.timer){clearTimeout(t.timer),t.timer=void 0;const n=t.pendingText;t.pendingText=void 0,n&&await this.applyUpdate(e,n,t.route,t.options)}}async wait(e){await function(e){return new Promise(t=>setTimeout(t,e))}(e)}}const zu=20971520;function ku(e){const t=[],n=[...e.photo||[]].filter(e=>e.file_id).sort((e,t)=>Number(t.file_size||t.width||0)-Number(e.file_size||e.width||0))[0];return n?.file_id&&t.push({fileId:n.file_id,fileName:"telegram-photo.jpg",fileSize:n.file_size}),e.document?.file_id&&String(e.document.mime_type||"").startsWith("image/")&&t.push({fileId:e.document.file_id,fileName:e.document.file_name,fileSize:e.document.file_size}),t}async function Tu(e,n,s="telegram-image",i){if(i&&i>zu)throw new Error(`image is too large: ${i} bytes`);const r=await e.getFileLink(n),o=String(r),a=await(e.fetchFile||fetch)(o);if(!a.ok)throw new Error(`download failed with HTTP ${a.status}`);const d=Number(a.headers.get("content-length")||0);if(d>zu)throw new Error(`image is too large: ${d} bytes`);const c=t.extname(s)||".jpg";let l=c;try{l=t.extname(new URL(o).pathname)||c}catch{l=c}const p=t.join(f.tmpdir(),"task-handoff-images");await y.mkdir(p,{recursive:!0});const u=l.replace(/[^.\w-]/g,"")||".jpg",h=t.join(p,`telegram-${Date.now()}-${Math.random().toString(16).slice(2)}${u}`),m=Buffer.from(await a.arrayBuffer());if(m.length>zu)throw new Error(`image is too large: ${m.length} bytes`);return await y.writeFile(h,m),h}class Cu{store;constructor(e){this.store=new Au({updateIntervalMs:e.updateIntervalMs,send:(t,n,s)=>e.send(e.requireBridge(n?.bridgeId||""),n?.chatId||"",jp(t),{rawMarkdownV2:!0,replyMarkup:_u(s)}),edit:(t,n,s,i)=>e.edit(e.requireBridge(s?.bridgeId||""),s?.chatId||"",t,jp(n),{rawMarkdownV2:!0,replyMarkup:_u(i)}),delete:(t,n)=>e.deleteMessage(e.requireBridge(n?.bridgeId||""),n?.chatId||"",t),onLog:e.onLog})}get entries(){return this.store.entries}remember(e,t,n,s){return this.store.remember(e,t,n,s)}rekey(e,t){return this.store.rekey(e,t)}delete(e){return this.store.delete(e)}async applyUpdate(e){return this.store.applyUpdate(e.key,e.text,{bridgeId:e.bridge.id,chatId:e.chatId},{actionRows:e.actionRows})}}async function Eu(e){return(await async function(e,t,n,s){const i=[];for(const r of ku(n))try{const n=await Tu({getFileLink:n=>Lp(e,t,n),fetchFile:e},r.fileId,r.fileName,r.fileSize);i.push(n)}catch(e){s?.({fileId:r.fileId,fileName:r.fileName,error:e})}return i}(e.fetchImpl,e.bridge,e.message,e.onImageDownloadError)).map((e,i)=>{const r=n.readFileSync(e);return{id:`tg_${s.randomUUID().replace(/-/g,"").slice(0,24)}`,kind:"image",name:t.basename(e)||`telegram-image-${i+1}`,mime:xu(e),size:r.length,source:{type:"inline",encoding:"base64",data:r.toString("base64")}}})}function xu(e){const n=t.extname(e).toLowerCase();return".png"===n?"image/png":".webp"===n?"image/webp":".gif"===n?"image/gif":".bmp"===n?"image/bmp":"image/jpeg"}function Nu(e){const t=Number(e?.message_id);return Number.isInteger(t)?t:void 0}function Ru(e){return e&&"object"==typeof e?e:{}}function Ou(e){return"string"==typeof e?e:""}function _u(e){const t=Array.isArray(e?.actionRows)?e.actionRows:void 0;return Kl(t||(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e]))}function Pu(e){const t=Array.isArray(e.item_list)?e.item_list:[];for(const e of t){const t=ju(e);if(1!==t.type)continue;const n=Du(ju(t.text_item).text).trim();if(n)return n}return""}function ju(e){return e&&"object"==typeof e?e:{}}function Du(e){return"string"==typeof e?e:""}function Mu(e){const{fetchImpl:t,bridge:n,dingdingRuntime:i,larkRuntime:r}=e;return"telegram"===n.channel?function(e,t){return{bridge:t,send:async(n,s,i={})=>{const r=await Mp(e,t,n,s,{replyMarkup:i.replyMarkup,replyToMessageId:i.replyToMessageId,rawMarkdownV2:i.rawMarkdownV2,parseMode:i.parseMode});return{provider:"telegram",raw:r,messageId:Number(Ru(r).message_id)||void 0}}}}(t,n):"dingding"===n.channel?function(e,t,n){return{bridge:t,send:async(s,i,r={})=>{const o=r.sessionWebhook||n?.chatWebhooks.get(s)||lu(t.settings.sessionWebhook);if(r.replyMarkup&&n){const a=await nu({fetchImpl:e,bridge:t,runtime:n,chatId:s,text:i,replyMarkup:r.replyMarkup,sessionWebhook:o,senderId:r.senderId||n.senderIds.get(s)||lu(t.settings.senderId)});if(a?.delivered)return{provider:"dingding",interactionId:a.outTrackId}}if(o)return await tu(e,o,i,n?.onLog),{provider:"dingding"}}}}(t,n,i):"lark"===n.channel?function(e,t){return{bridge:e,send:async(e,n,s={})=>{if(!t)return;const i=await t.channel.send(e,s.replyMarkup?{card:mu(n,s.replyMarkup)}:{markdown:n});return{provider:"lark",interactionId:i.messageId,raw:i}}}}(n,r):"wechat"===n.channel?function(e,t){return{bridge:t,send:async(n,i,r={})=>{const o=r.contextToken||Du(t.settings.contextToken);if(o)return await async function(e,t,n,i,r){const o=Du(t.settings.baseUrl)||"https://ilinkai.weixin.qq.com",a=await e(`${o}/ilink/bot/sendmessage`,{method:"POST",headers:{"content-type":"application/json",AuthorizationType:"ilink_bot_token",Authorization:`Bearer ${t.token}`,"X-WECHAT-UIN":String(Math.floor(Math.random()*2**31))},body:JSON.stringify({msg:{from_user_id:"",to_user_id:n,client_id:s.randomUUID(),message_type:2,message_state:2,context_token:i,item_list:[{type:1,text_item:{text:r}}]},base_info:{channel_version:"1.0.2"}})}),d=await a.json().catch(()=>({}));if(!a.ok||d.errcode)throw new Error(Du(d.errmsg)||`WeChat send failed with HTTP ${a.status}`)}(e,t,n,o,i),{provider:"wechat"}}}}(t,n):{bridge:n,send:async()=>{}}}class Lu{entries=new Map;fetchImpl;generations=new Map;constructor(e){this.fetchImpl=e}clear(){for(const e of new Set([...this.generations.keys(),...[...this.entries.values()].map(e=>e.bridgeId)]))this.clearBridge(e)}clearBridge(e){this.generations.set(e,this.generation(e)+1),this.clearEntries(t=>t.bridgeId===e)}generation(e){return this.generations.get(e)||0}isCurrent(e,t){return this.generation(e)===t}clearEntries(e){for(const[t,n]of this.entries)e(n)&&(n.timer&&clearTimeout(n.timer),n.cancelPending?.(new Error("DingDing progress update was cancelled.")),this.entries.delete(t))}async applyUpdate(e,t){const n=this.generation(e.bridge.id),s=uu(e.replyMarkup);let i=this.entries.get(e.key);if(i?.pending&&await i.pending,!this.isCurrent(e.bridge.id,n))return!1;if(i=this.entries.get(e.key),i?.outTrackId){if(i.lastText===e.text&&i.lastActionsFingerprint===s)return!0;const r=Date.now()-(i.lastUpdateAt||0);return r<1e3?(i.pendingText=e.text,i.pendingReplyMarkup=e.replyMarkup,i.timer||(i.pending=new Promise((s,o)=>{i.cancelPending=o,i.timer=setTimeout(()=>{i.timer=void 0,i.cancelPending=void 0;const r=i.pendingText,a=i.pendingReplyMarkup;if(i.pendingText=void 0,i.pendingReplyMarkup=void 0,!r)return s(void 0);this.updateExistingEntry(e,t,i,r,a,uu(a),n).then(s,o)},1e3-r)}).finally(()=>{i.pending=void 0,i.timer=void 0,i.cancelPending=void 0})),await i.pending,this.isCurrent(e.bridge.id,n)&&this.entries.has(e.key)):(await this.updateExistingEntry(e,t,i,e.text,e.replyMarkup,s,n),this.isCurrent(e.bridge.id,n))}const r={bridgeId:e.bridge.id,lastText:e.text,lastActionsFingerprint:s,lastUpdateAt:Date.now()};return r.pending=nu({fetchImpl:this.fetchImpl,bridge:e.bridge,runtime:t,chatId:e.chatId,text:e.text,replyMarkup:e.replyMarkup,sessionWebhook:t.chatWebhooks.get(e.chatId)||qu(e.bridge.settings.sessionWebhook),senderId:t.senderIds.get(e.chatId)||qu(e.bridge.settings.senderId),title:"TaskHandoff 执行中",step:"progress",forceCard:!0}).then(t=>{this.isCurrent(e.bridge.id,n)&&(t?.outTrackId&&(r.outTrackId=t.outTrackId),t?.delivered&&(r.delivered=!0,r.lastUpdateAt=Date.now()))}).catch(t=>{throw this.isCurrent(e.bridge.id,n)&&this.entries.delete(e.key),t}).finally(()=>{r.pending=void 0}),this.entries.set(e.key,r),await r.pending,this.isCurrent(e.bridge.id,n)&&Boolean(r.delivered)}async updateExistingEntry(e,t,n,s,i,r,o){n.outTrackId&&(await async function(e){await su(e.fetchImpl,e.bridge,e.runtime,"PUT","/v1.0/card/instances",{outTrackId:e.outTrackId,cardData:{cardParamMap:Gp({type:"actions",title:e.title,description:e.text,list:Ql(e.replyMarkup),biz_step:e.step,error_msg:""})},cardUpdateOptions:{updateCardDataByKey:!0,updatePrivateDataByKey:!1},userIdType:Number(e.bridge.settings.cardUserIdType||1)})}({fetchImpl:this.fetchImpl,bridge:e.bridge,runtime:t,outTrackId:n.outTrackId,text:s,replyMarkup:i,title:"TaskHandoff 执行中",step:"progress"}),this.isCurrent(e.bridge.id,o)&&(n.lastText=s,n.lastActionsFingerprint=r,n.lastUpdateAt=Date.now()))}}function qu(e){return"string"==typeof e?e:""}function $u(e){const t=new I.DWClient({clientId:e.clientId,clientSecret:e.clientSecret,ua:"task-handoff-control-plane",keepAlive:!1,autoReconnect:!1});let n,s=!1;return{async connect(){s=!1,await t.getEndpoint(),await t._connect();const e=t.socket;e?.once("close",()=>{s||n?.(new Error("DingDing stream connection closed."))})},disconnect(){s=!0,t.disconnect()},onDisconnect(e){n=e},getConfig:()=>t.getConfig(),registerCallbackListener(e,n){t.registerCallbackListener(e,n)},socketCallBackResponse(e,n){t.socketCallBackResponse(e,n)}}}class Bu{runtimes=new Map;connected=new Set;reconnectTimers=new Map;progress;options;createClient;constructor(e){this.options=e,this.createClient=e.createClient||$u,this.progress=new Lu(e.fetchImpl)}has(e){return this.runtimes.has(e)}isRunning(e){return this.connected.has(e)}get(e){return this.runtimes.get(e)}ids(){return this.runtimes.keys()}start(e){const t=(n=e.settings?.clientSecret,"string"==typeof n?n:"");var n;if(!e.token||!t)return this.options.onError(e.id,"DingDing client id/secret is not configured."),!1;const s={client:this.createClient({clientId:e.token,clientSecret:t}),chatWebhooks:new Map,senderIds:new Map,conversationTypes:new Map,onLog:(t,n,s)=>{this.options.logger["warn"===t?"warn":"info"]({bridgeId:e.id,...n},s)}};return s.client.onDisconnect?.(t=>{this.runtimes.get(e.id)===s&&this.handleConnectionFailure(e,s,t)}),s.client.registerCallbackListener(I.TOPIC_ROBOT,t=>{this.options.onRobotMessage(e,s,t).catch(t=>{this.options.onError(e.id,t)})}),s.client.registerCallbackListener(I.TOPIC_CARD,t=>{const n=t;this.options.onCardCallback(e,s,n).then(e=>s.client.socketCallBackResponse(n.headers.messageId,e||{})).catch(t=>{this.options.onError(e.id,t),s.client.socketCallBackResponse(n.headers.messageId,{})})}),this.options.clearError(e.id),this.runtimes.set(e.id,s),this.connect(e,s),!0}connect(e,t){this.reconnectTimers.delete(e.id),this.connected.add(e.id),t.client.connect().then(()=>{this.runtimes.get(e.id)===t&&(this.connected.add(e.id),this.options.clearError(e.id))}).catch(n=>{this.runtimes.get(e.id)===t&&this.handleConnectionFailure(e,t,n)})}handleConnectionFailure(e,t,n){if(this.connected.delete(e.id),this.progress.clearBridge(e.id),this.options.onError(e.id,n||"DingDing stream connection failed."),this.reconnectTimers.has(e.id))return;const s=setTimeout(()=>{this.runtimes.get(e.id)===t&&this.connect(e,t)},this.options.reconnectDelayMs??1e3);s.unref?.(),this.reconnectTimers.set(e.id,s)}stop(e){const t=this.reconnectTimers.get(e);t&&clearTimeout(t),this.reconnectTimers.delete(e),this.connected.delete(e);const n=this.runtimes.get(e);if(n){try{n.client.disconnect()}catch{}this.runtimes.delete(e)}this.progress.clearBridge(e)}stopAll(){for(const e of[...this.runtimes.keys()])this.stop(e);this.progress.clear()}applyUpdate(e){const t=this.runtimes.get(e.bridge.id);return t?this.progress.applyUpdate(e,t):Promise.resolve(!1)}applyProgressUpdate(e){return this.applyUpdate(e)}}class Fu{entries=new Map;generations=new Map;updateIntervalMs;constructor(e=1e3){this.updateIntervalMs=e}clear(){for(const e of new Set([...this.generations.keys(),...[...this.entries.values()].map(e=>e.bridgeId)]))this.clearBridge(e)}clearBridge(e){this.generations.set(e,this.generation(e)+1);for(const[t,n]of this.entries)n.bridgeId===e&&(n.timer&&clearTimeout(n.timer),n.cancelPending?.(new Error("Lark progress update was cancelled.")),this.entries.delete(t))}generation(e){return this.generations.get(e)||0}isCurrent(e,t){return this.generation(e)===t}async applyUpdate(e,t){const n=this.generation(e.bridge.id),s=yu(e.replyMarkup);let i=this.entries.get(e.key);if(i?.pending&&await i.pending,!this.isCurrent(e.bridge.id,n))return!1;if(i=this.entries.get(e.key),i?.messageId){if(i.lastText===e.text&&i.lastActionsFingerprint===s)return!0;const r=Date.now()-i.lastUpdateAt;return r<this.updateIntervalMs?(i.pendingText=e.text,i.pendingReplyMarkup=e.replyMarkup,i.timer||(i.pending=new Promise((s,o)=>{i.cancelPending=o,i.timer=setTimeout(()=>{i.timer=void 0,i.cancelPending=void 0;const r=i.pendingText,a=i.pendingReplyMarkup;if(i.pendingText=void 0,i.pendingReplyMarkup=void 0,!r)return s(void 0);this.updateExistingEntry(e,t,i,r,a,yu(a),n).then(s,o)},this.updateIntervalMs-r)}).finally(()=>{i.pending=void 0,i.timer=void 0,i.cancelPending=void 0})),await i.pending,this.isCurrent(e.bridge.id,n)&&this.entries.has(e.key)):(await this.updateExistingEntry(e,t,i,e.text,e.replyMarkup,s,n),this.isCurrent(e.bridge.id,n))}const r={bridgeId:e.bridge.id,lastText:e.text,lastActionsFingerprint:s,lastUpdateAt:Date.now()};return r.pending=t.channel.send(e.chatId,{card:mu(e.text,e.replyMarkup)}).then(t=>{this.isCurrent(e.bridge.id,n)&&(r.messageId=t.messageId,r.delivered=!0,r.lastUpdateAt=Date.now())}).catch(t=>{throw this.isCurrent(e.bridge.id,n)&&this.entries.delete(e.key),t}).finally(()=>{r.pending=void 0}),this.entries.set(e.key,r),await r.pending,this.isCurrent(e.bridge.id,n)&&Boolean(r.delivered)}async updateExistingEntry(e,t,n,s,i,r,o){n.messageId&&(await t.channel.updateCard(n.messageId,mu(s,i)),this.isCurrent(e.bridge.id,o)&&(n.lastText=s,n.lastActionsFingerprint=r,n.lastUpdateAt=Date.now()))}}function Uu(e){const t={appId:e.appId,appSecret:e.appSecret,domain:e.domain,transport:"websocket",source:"task-handoff-control-plane",handshakeTimeoutMs:15e3,policy:{requireMention:!0,dmMode:"open",respondToMentionAll:!1}};return b.createLarkChannel(t)}class Hu{runtimes=new Map;connected=new Set;unsubscribe=new Map;reconnectTimers=new Map;options;createChannel;progress;constructor(e){this.options=e,this.createChannel=e.createChannel||Uu,this.progress=new Fu(e.progressUpdateIntervalMs)}has(e){return this.runtimes.has(e)}isRunning(e){return this.connected.has(e)}get(e){return this.runtimes.get(e)}ids(){return this.runtimes.keys()}start(e){const t=(n=e.settings?.appSecret,"string"==typeof n?n.trim():"");var n;if(!e.token||!t)return this.options.onError(e.id,"Lark app id/secret is not configured."),!1;const s={channel:this.createChannel({appId:e.token,appSecret:t,domain:Wu(e.settings?.domain)})},i=s.channel.on({message:t=>{this.options.onMessage(e,s,t).catch(t=>{this.options.onError(e.id,t)})},cardAction:t=>{this.options.onCardAction(e,s,t).catch(t=>{this.options.onError(e.id,t)})},error:t=>{this.options.onError(e.id,t),this.options.logger.warn({bridgeId:e.id,error:t.message},"lark channel error")},reconnecting:()=>{this.connected.delete(e.id),this.options.onError(e.id,"Lark WebSocket is reconnecting."),this.options.logger.info({bridgeId:e.id},"lark channel reconnecting")},reconnected:()=>{this.runtimes.get(e.id)===s&&(this.connected.add(e.id),this.options.clearError(e.id),this.options.logger.info({bridgeId:e.id},"lark channel reconnected"))}});return this.options.clearError(e.id),this.runtimes.set(e.id,s),this.unsubscribe.set(e.id,i),this.connect(e,s),!0}connect(e,t){this.reconnectTimers.delete(e.id),t.channel.connect().then(()=>{this.runtimes.get(e.id)===t&&(this.connected.add(e.id),this.options.clearError(e.id),this.options.logger.info({bridgeId:e.id},"lark channel connected"))}).catch(n=>{if(this.runtimes.get(e.id)!==t)return;if(this.connected.delete(e.id),this.options.onError(e.id,n),t.channel.rawWsClient||this.reconnectTimers.has(e.id))return;const s=setTimeout(()=>{this.runtimes.get(e.id)===t&&this.connect(e,t)},this.options.reconnectDelayMs??1e3);s.unref?.(),this.reconnectTimers.set(e.id,s)})}stop(e){const t=this.reconnectTimers.get(e);t&&clearTimeout(t),this.reconnectTimers.delete(e),this.unsubscribe.get(e)?.(),this.unsubscribe.delete(e),this.connected.delete(e);const n=this.runtimes.get(e);if(this.runtimes.delete(e),this.progress.clearBridge(e),n){try{n.channel.rawWsClient?.close({force:!0})}catch{}n.channel.disconnect().catch(()=>{})}}stopAll(){for(const e of[...this.runtimes.keys()])this.stop(e);this.progress.clear()}applyUpdate(e){const t=this.runtimes.get(e.bridge.id);return t?this.progress.applyUpdate(e,t):Promise.resolve(!1)}applyProgressUpdate(e){return this.applyUpdate(e)}}function Wu(e){return"lark"===String(e||"").trim().toLowerCase()?b.Domain.Lark:b.Domain.Feishu}class Gu{ttlMs;load;now;cached;pending;generation=0;constructor(e,t,n={}){this.ttlMs=e,this.load=t,this.now=n.now||Date.now}get(){if(this.cached&&this.cached.expiresAt>this.now())return Promise.resolve(this.cached.value);if(this.pending)return this.pending;const e=this.generation,t=this.load().then(t=>(this.generation===e&&(this.cached={expiresAt:this.now()+this.ttlMs,value:t}),t)).finally(()=>{this.pending===t&&(this.pending=void 0)});return this.pending=t,t}invalidate(){this.generation+=1,this.cached=void 0,this.pending=void 0}}class Vu{aggregates=new Map;endTokens=new Map;options;delayMs;constructor(e){this.options=e,this.delayMs=e.delayMs??1e3}async handleIncoming(e,t,n,s,i=[],r={},o={}){const a=s.trim(),d=a.split(/\s+/,1)[0]?.toLowerCase()||"",c=Ku(e.id,t,n),l=this.aggregates.get(c);return o.autoBegin&&!l?(this.start(c,e,t,n,r),this.enqueue(c,e,t,n,s,i,r,!0),void await this.sendCollectionStarted(e,t,c,r.sourceMessageId,"Image received. Continue sending messages, then send /end when done.")):"/begin"===d?(this.start(c,e,t,n,r),void await this.sendCollectionStarted(e,t,c,r.sourceMessageId,"Started collecting messages. Send /end when done.")):void("/end"!==d?l?.explicit?this.enqueue(c,e,t,n,s,i,r,!0):a.startsWith("/")?await this.options.dispatch(e,t,n,s,i,r):this.enqueue(c,e,t,n,s,i,r,!1):await this.flush(c,"manual"))}async handleEndCallback(e,t,n,s,i){const r=this.endTokens.get(s)||"";if(r!==Ku(e.id,t,i))return void await this.options.answerCallback(e,n,"This collection is not active here");const o=await this.flush(r,"callback");await this.options.answerCallback(e,n,o?"Collected message sent":"No messages collected")}stop(){for(const e of this.aggregates.values())e.timer&&clearTimeout(e.timer);this.aggregates.clear(),this.endTokens.clear()}stopBridge(e){for(const[t,n]of this.aggregates)n.bridgeId===e&&(n.timer&&clearTimeout(n.timer),this.aggregates.delete(t));for(const[t,n]of this.endTokens)n.startsWith(`${e}:`)&&this.endTokens.delete(t)}start(e,t,n,s,i){const r=this.aggregates.get(e);r?.timer&&clearTimeout(r.timer),this.aggregates.set(e,{bridgeId:t.id,chatId:n,userId:s,texts:[],attachments:[],context:i,explicit:!0})}enqueue(e,t,n,s,i,r,o,a){const d=this.aggregates.get(e);d?.timer&&clearTimeout(d.timer);const c=d||{bridgeId:t.id,chatId:n,userId:s,texts:[],attachments:[],context:o,explicit:a};var l,p;c.bridgeId=t.id,c.chatId=n,c.userId=s,c.context=(l=c.context,p=o,{sourceMessageId:l?.sourceMessageId??p.sourceMessageId,replyToMessageId:l?.replyToMessageId??p.replyToMessageId,quoteText:l?.quoteText||p.quoteText}),c.explicit=c.explicit||a,i.trim()&&c.texts.push(i),c.attachments.push(...r),c.timer=c.explicit?void 0:setTimeout(()=>{this.flush(e,"timer").catch(e=>this.options.onError?.(c.bridgeId,e))},this.delayMs),this.aggregates.set(e,c)}async flush(e,t){const n=this.aggregates.get(e);if(!n)return!1;n.timer&&clearTimeout(n.timer),this.aggregates.delete(e);const s=this.options.requireBridge(n.bridgeId),i=n.texts.join("\n\n").trim();return i||n.attachments.length?(await this.options.dispatch(s,n.chatId,n.userId,i,n.attachments,n.context||{}),!0):("timer"!==t&&await this.options.send(s,n.chatId,"No messages collected.",{replyToMessageId:n.context?.sourceMessageId}),!1)}sendCollectionStarted(e,t,n,s,i){return this.options.send(e,t,i,{replyToMessageId:s,replyMarkup:Kl([[{text:"/end",callbackData:this.endCallbackData(n)}]])})}endCallbackData(e){const t=s.createHash("sha256").update(e).digest("base64url").slice(0,16);return this.endTokens.set(t,e),`task_handoff:cp_msg_end:${t}`}}function Ku(e,t,n){return[e,t,n||""].join(":")}class Ju{cancelTokens=new Map;queueActionTokens=new Map;options;constructor(e){this.options=e}cancelCallbackData(e,t){this.pruneExpired();const n=Qu([e,t]);return this.cancelTokens.set(n,this.expiring({instanceId:e,sessionId:t})),`task_handoff:cp_ai_cancel:${n}`}queueSteerCallbackData(e,t,n){return`task_handoff:cp_ai_steer:${this.queueActionToken({type:"steer",instanceId:e,sessionId:t,queueId:n})}`}queueDeleteMenuCallbackData(e,t){return`task_handoff:cp_ai_qdel_menu:${this.queueActionToken({type:"delete-menu",instanceId:e,sessionId:t})}`}async tryHandle(e,t){this.pruneExpired();const n=Yu(e,"task_handoff:cp_ai_cancel:");if(void 0!==n){const e=this.cancelTokens.get(n)?.value;return e?(await this.cancel(t,e.instanceId,e.sessionId),!0):this.expired(t)}const s=Yu(e,"task_handoff:cp_ai_steer:");if(void 0!==s){const e=this.queueActionTokens.get(s)?.value;return e&&"steer"===e.type?(await this.steer(t,e),!0):this.expired(t)}const i=Yu(e,"task_handoff:cp_ai_qdel_menu:");if(void 0!==i){const e=this.queueActionTokens.get(i)?.value;return e&&"delete-menu"===e.type?(await this.deleteMenu(t,e),!0):this.expired(t)}const r=Yu(e,"task_handoff:cp_ai_qdel:");if(void 0!==r){const e=this.queueActionTokens.get(r)?.value;return e&&"delete-item"===e.type?(await this.deleteItem(t,e),!0):this.expired(t)}return!1}async cancel(e,t,n){await this.requireAllowed(e,t,n)&&await this.run(e,{instanceId:t,sessionId:n,successText:"Interrupt sent",failurePrefix:"Interrupt failed",logMessage:"chat ai session cancel sent",operation:()=>this.options.interrupt(t,n)})}async steer(e,t){await this.requireAllowed(e,t.instanceId,t.sessionId)&&await this.run(e,{...t,successText:"Steered queued message",failurePrefix:"Steer failed",logMessage:"chat ai session queued message steered",operation:()=>this.options.steer(t.instanceId,t.sessionId,t.queueId)})}async deleteMenu(e,t){if(await this.requireAllowed(e,t.instanceId,t.sessionId))try{const n=Zu(await this.options.queue(t.instanceId,t.sessionId)),s=(Array.isArray(n.items)?n.items:[]).map(Zu).filter(e=>"queued"===eh(e.status)&&eh(e.id));if(!s.length)return void await this.answer(e,"Queue is empty");const i=s.slice(0,5).map((e,n)=>[{text:Xu(eh(e.message),n),callbackData:this.queueDeleteItemCallbackData(t.instanceId,t.sessionId,eh(e.id))}]);await this.send(e,"Delete queued message",{replyMarkup:Kl(i)}),await this.answer(e,"Select a queued message"),this.options.info(this.logData(e,t,{itemCount:s.length}),"chat ai session queue delete menu sent")}catch(t){await this.fail(e,t,"Queue menu failed")}}async deleteItem(e,t){if(await this.requireAllowed(e,t.instanceId,t.sessionId))try{await this.options.remove(t.instanceId,t.sessionId,t.queueId),await this.answer(e,"Queued message deleted"),(e.deleteMessage||Number.isInteger(e.messageId))&&await this.deleteMessage(e).catch(n=>{this.options.warn(this.logData(e,t,{messageId:e.messageId,error:th(n)}),"chat ai session queue delete menu message delete failed")}),this.options.info(this.logData(e,t),"chat ai session queued message deleted")}catch(t){await this.fail(e,t,"Delete failed")}}async run(e,t){try{await t.operation(),await this.answer(e,t.successText),this.options.info(this.logData(e,t),t.logMessage)}catch(n){await this.fail(e,n,t.failurePrefix)}}async requireAllowed(e,t,n){return!!(e.actionAllowed?e.actionAllowed(t,n):this.options.actionAllowed(e.bridge,e.chatId,t,n,Number.isInteger(e.messageId)?e.messageId:void 0))||(await this.answer(e,"This chat is not bound to that AI session"),!1)}async fail(e,t,n){const s=th(t);this.options.setBridgeError(e.bridge.id,s),await this.answer(e,`${n}: ${function(e){const t=e.replace(/\s+/g," ").trim();return t.length<=120?t:`${t.slice(0,Math.max(0,119))}…`}(s)}`)}async expired(e){return await this.answer(e,"This AI session action expired"),!0}answer(e,t){return e.answer?e.answer(t):this.options.answer(e.bridge,e.callbackQueryId,t)}send(e,t,n){return e.send?e.send(t,n):this.options.send(e.bridge,e.chatId,t,n)}deleteMessage(e){return e.deleteMessage?e.deleteMessage():Number.isInteger(e.messageId)?this.options.deleteMessage(e.bridge,e.chatId,e.messageId):Promise.resolve(void 0)}queueDeleteItemCallbackData(e,t,n){return`task_handoff:cp_ai_qdel:${this.queueActionToken({type:"delete-item",instanceId:e,sessionId:t,queueId:n})}`}queueActionToken(e){this.pruneExpired();const t=Qu([e.type,e.instanceId,e.sessionId,"queueId"in e?e.queueId:""]);return this.queueActionTokens.set(t,this.expiring(e)),t}clear(){this.cancelTokens.clear(),this.queueActionTokens.clear()}expiring(e){return{value:e,expiresAt:(this.options.now||Date.now)()+(this.options.tokenTtlMs??864e5)}}pruneExpired(){const e=(this.options.now||Date.now)();for(const[t,n]of this.cancelTokens)n.expiresAt<=e&&this.cancelTokens.delete(t);for(const[t,n]of this.queueActionTokens)n.expiresAt<=e&&this.queueActionTokens.delete(t)}logData(e,t,n={}){return{bridgeId:e.bridge.id,chatId:e.chatId,instanceId:t.instanceId,sessionId:t.sessionId,...t.queueId?{queueId:t.queueId}:{},userId:e.userId,...n}}}function Yu(e,t){if(!e.startsWith(t))return;const n=e.slice(t.length);return n&&!n.includes(":")?n:void 0}function Qu(e){return s.createHash("sha256").update(e.join("\0")).digest("base64url").slice(0,16)}function Xu(e,t){const n=`${t+1}. `,s=eh(e).replace(/\s+/g," ").trim()||"Queued message",i=Math.max(8,48-n.length),r=Array.from(s);return`${n}${r.length>i?`${r.slice(0,Math.max(1,i-3)).join("")}...`:s}`}function Zu(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function eh(e){return"string"==typeof e?e.trim():""}function th(e){return e instanceof Error?e.message:String(e)}class nh{announced=new Set;options;constructor(e){this.options=e}async poll(){const e=await this.options.listRoutes().catch(()=>[]);for(const t of e){if(this.announced.has(t.id))continue;const e=sh(t,this.options.callbackData),n=t.aiSessionId?this.options.listBindings().filter(e=>e.activeInstanceId===t.instanceId&&e.activeAiSessionId===t.aiSessionId):[];(await this.sendToBindings(n,e)||await this.sendToDefaults(e))&&this.announced.add(t.id)}}async sendToBindings(e,t){let n=!1;for(const s of e){if(!s.bridgeId)continue;const e=this.options.requireBridge(s.bridgeId);if(!e.enabled)continue;const i=await this.send(e,s.chatSessionId,t);n||=i}return n}async sendToDefaults(e){let t=!1;for(const n of this.options.listBridges()){if(!n.enabled||!n.defaultChatId)continue;let s=!1;await this.options.send(n,n.defaultChatId,e).catch(e=>(this.options.setBridgeError(n.id,ih(e)),s=!0,!1))?t=!0:s||this.options.setBridgeError(n.id,"Chat bridge message was not delivered.")}return t}async send(e,t,n){return this.options.send(e,t,n).then(Boolean).catch(t=>(this.options.setBridgeError(e.id,ih(t)),!1))}}function sh(e,t){const n=`${e.project?.name||e.projectId} / ${e.instance?.name||e.instanceId}`,s="approval"===e.kind?`/approve ${e.id}\n/deny ${e.id}\n/skip ${e.id}`:`/reply ${e.id} <message>`,i=`[${n}]\n${e.result}\n\n${s}`;return"approval"!==e.kind?{text:i}:{text:i,replyMarkup:Kl([[{text:"Allow",callbackData:t(e.id,"allow")},{text:"Skip",callbackData:t(e.id,"skip")},{text:"Deny",callbackData:t(e.id,"deny")}]])}}function ih(e){return e instanceof Error?e.message:String(e)}function rh(){return e=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(e||"").trim().toLowerCase());var e}class oh{service;fetchImpl;logger;diagnosticLogsEnabled;bridgeTimers=new Map;bridgePollingGenerations=new Map;bridgePolls=new Map;dingdingBridges;larkBridges;bridgeErrors=new Map;telegramOffsets=new Map;seenTelegramUpdates=new Set;wechatCursors=new Map;pendingRouteNotifier;deliveredAiSessionFingerprints=new Map;telegramAiSessionCallbacks;telegramMessageAggregator;telegramProgressMessageTargets=new Map;aiSessionInstanceNamesCache;aiSessionPendingRoutesCache;telegramProgress;stopAiSessionListener;constructor(e,t=fetch,n={}){this.service=e,this.fetchImpl=t,this.logger=n.logger,this.diagnosticLogsEnabled=n.diagnosticLogsEnabled||rh,this.aiSessionInstanceNamesCache=new Gu(3e4,async()=>{const e=await(this.service.listAiSessionInstanceNames?.()||this.service.boardAsync()).catch(()=>[]);return new Map(e.map(e=>[e.id,e.name||e.id]))}),this.aiSessionPendingRoutesCache=new Gu(1e3,()=>this.service.listPendingRoutes().catch(()=>[])),this.telegramMessageAggregator=new Vu({requireBridge:e=>this.service.requireChatBridge(e),send:(e,t,n,s={})=>this.sendTelegramMessage(e,t,n,s),answerCallback:(e,t,n)=>this.answerTelegramCallback(e,t,n),dispatch:(e,t,n,s,i,r)=>this.dispatchTelegramGatewayMessage(e,t,n,s,i,r),onError:(e,t)=>this.bridgeErrors.set(e,gh(t))}),this.telegramAiSessionCallbacks=new Ju({interrupt:(e,t)=>this.service.interruptAiSession(e,t),queue:(e,t)=>this.service.aiSessionQueue(e,t),steer:(e,t,n)=>this.service.steerAiSessionQueuedMessage(e,t,n),remove:(e,t,n)=>this.service.removeAiSessionQueuedMessage(e,t,n),actionAllowed:(e,t,n,s,i)=>this.telegramAiSessionActionAllowed(e,t,n,s,i),answer:(e,t,n)=>this.answerTelegramCallback(e,t,n),send:(e,t,n,s={})=>this.sendTelegramMessage(e,t,n,s),deleteMessage:(e,t,n)=>this.deleteTelegramMessage(e,t,n),setBridgeError:(e,t)=>this.bridgeErrors.set(e,t),info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)}),this.pendingRouteNotifier=new nh({listRoutes:()=>this.service.listPendingRoutes(),listBindings:()=>this.service.listChatSessions(),listBridges:()=>this.service.listChatBridges(),requireBridge:e=>this.service.requireChatBridge(e),callbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),send:(e,t,n)=>this.sendViaBridge(e,t,n),setBridgeError:(e,t)=>this.bridgeErrors.set(e,t)}),this.telegramProgress=new Cu({updateIntervalMs:n.telegramProgressUpdateIntervalMs,requireBridge:e=>this.service.requireChatBridge(e),send:(e,t,n,s={})=>this.sendTelegramMessage(e,t,n,s),edit:(e,t,n,s,i={})=>this.editTelegramMessage(e,t,n,s,i),deleteMessage:(e,t,n)=>this.deleteTelegramMessage(e,t,n),onLog:e=>this.logWarn({message:e},"telegram progress store warning")}),this.dingdingBridges=new Bu({fetchImpl:this.fetchImpl,createClient:n.createDingdingClient,logger:{info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)},onRobotMessage:(e,t,n)=>this.handleDingdingRobotMessage(e,t,n),onCardCallback:(e,t,n)=>this.handleDingdingCardCallback(e,t,n),onError:(e,t)=>this.bridgeErrors.set(e,gh(t)),clearError:e=>this.bridgeErrors.delete(e)}),this.larkBridges=new Hu({createChannel:n.createLarkChannel,progressUpdateIntervalMs:n.larkProgressUpdateIntervalMs,logger:{info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)},onMessage:(e,t,n)=>this.handleLarkMessage(e,t,n),onCardAction:(e,t,n)=>this.handleLarkCardAction(e,t,n),onError:(e,t)=>this.bridgeErrors.set(e,gh(t)),clearError:e=>this.bridgeErrors.delete(e)}),this.stopAiSessionListener=n.aiSessions?.onSnapshot(e=>{this.deliverAiSessionSnapshot(e.instanceId,e.aiSessions).catch(t=>{this.logWarn({instanceId:e.instanceId,snapshotRevision:e.revision,error:gh(t)},"chat ai session snapshot delivery failed")})})}logInfo(e,t){this.diagnosticLogsEnabled()&&this.logger?.info?.({component:"control-plane-chat-gateway",...e},t)}logWarn(e,t){this.diagnosticLogsEnabled()&&this.logger?.warn?.({component:"control-plane-chat-gateway",...e},t)}updateChatBridge(e,t){this.service.updateChatBridge?.(e,t)}startEnabled(){this.logAiSessionDelivery({stage:"runtime-start-enabled",bridgeCount:this.service.listChatBridges().length,enabledBridgeCount:this.service.listChatBridges().filter(e=>e.enabled).length});for(const e of this.service.listChatBridges())e.enabled&&this.startBridge(e.id)}startBridge(e){if(this.bridgeTimers.has(e)||this.dingdingBridges.has(e)||this.larkBridges.has(e))return this.logAiSessionDelivery({stage:"bridge-start-skipped-running",bridgeId:e}),this.status();const t=this.service.requireChatBridge(e);return this.logAiSessionDelivery({stage:"bridge-start",bridgeId:t.id,channel:t.channel,enabled:t.enabled,hasToken:Boolean(t.token)}),"wechat"===t.channel?this.startPollingBridge(t,(e,t)=>this.pollWechat(e,t)):"dingding"===t.channel?this.startDingdingBridge(t):"lark"===t.channel?this.startLarkBridge(t):"telegram"!==t.channel?(this.bridgeErrors.set(e,`${t.channel} bridge is not supported in the control plane.`),this.status()):t.token?this.startPollingBridge(t,(e,t)=>this.pollTelegram(e,t)):(this.bridgeErrors.set(e,"Telegram token is not configured."),this.status())}stopBridge(e){this.advanceBridgePollingGeneration(e);const t=`:${e}:`;for(const e of this.deliveredAiSessionFingerprints.keys())e.includes(t)&&this.deliveredAiSessionFingerprints.delete(e);const n=this.bridgeTimers.get(e);return n&&(clearInterval(n),this.bridgeTimers.delete(e)),this.dingdingBridges.stop(e),this.larkBridges.stop(e),this.telegramMessageAggregator.stopBridge(e),this.status()}stopAll(){const e=new Set([...this.service.listChatBridges().map(e=>e.id),...this.bridgePollingGenerations.keys(),...this.bridgeTimers.keys(),...this.bridgePolls.keys(),...this.dingdingBridges.ids(),...this.larkBridges.ids()]);for(const t of e)this.stopBridge(t);this.dingdingBridges.stopAll(),this.larkBridges.stopAll(),this.telegramMessageAggregator.stop(),this.telegramAiSessionCallbacks.clear(),this.stopAiSessionListener?.(),this.stopAiSessionListener=void 0}async pollBridgeNow(e){const t=this.service.requireChatBridge(e),n=this.bridgePollingGeneration(e);return"telegram"===t.channel?(await this.runBridgePoll(t,n,(e,t)=>this.pollTelegram(e,t)),this.status()):"wechat"===t.channel?(await this.runBridgePoll(t,n,(e,t)=>this.pollWechat(e,t)),this.status()):("dingding"===t.channel||"lark"===t.channel||this.bridgeErrors.set(e,`${t.channel} bridge is not supported in the control plane.`),this.status())}async pollAiSessionsNow(){return await this.pollAiSessionUpdates(),this.status()}status(){const e=this.service.listChatBridges().map(e=>({id:e.id,channel:e.channel,name:e.name,running:this.bridgeTimers.has(e.id)||this.dingdingBridges.isRunning(e.id)||this.larkBridges.isRunning(e.id),tokenSet:Boolean(e.tokenSet),defaultChatId:e.defaultChatId,lastUpdateId:this.telegramOffsets.get(e.id),error:this.bridgeErrors.get(e.id)}));return{running:e.some(e=>e.running),bridges:e}}startPollingBridge(e,t){if(!e.token)return this.bridgeErrors.set(e.id,`${e.channel} token is not configured.`),this.status();this.bridgeErrors.delete(e.id);const n=this.advanceBridgePollingGeneration(e.id),s=()=>this.bridgePollingGeneration(e.id)===n,i=i=>{s()&&this.runBridgePoll(i,n,t).catch(t=>{s()&&this.bridgeErrors.set(e.id,t instanceof Error?t.message:String(t))})},r=setInterval(()=>{if(!s())return;const t=this.service.requireChatBridge(e.id);t.enabled?i(t):this.stopBridge(e.id)},e.pollIntervalMs);if(this.bridgeTimers.set(e.id,r),this.logAiSessionDelivery({stage:"bridge-poll-started",bridgeId:e.id,channel:e.channel,intervalMs:e.pollIntervalMs}),e.enabled){const t=this.service.requireChatBridge(e.id);i(t)}return this.status()}runBridgePoll(e,t,n){const s=this.bridgePolls.get(e.id);if(s?.generation===t)return s.promise;const i=(async()=>{const s=()=>this.bridgePollingGeneration(e.id)===t;s()&&await n(e,s)})();this.bridgePolls.set(e.id,{generation:t,promise:i});const r=()=>{this.bridgePolls.get(e.id)?.promise===i&&this.bridgePolls.delete(e.id)};return i.then(r,r),i}bridgePollingGeneration(e){return this.bridgePollingGenerations.get(e)||0}advanceBridgePollingGeneration(e){const t=this.bridgePollingGeneration(e)+1;return this.bridgePollingGenerations.set(e,t),t}startDingdingBridge(e){return this.dingdingBridges.start(e),this.status()}startLarkBridge(e){return this.larkBridges.start(e),this.status()}async handleLarkMessage(e,t,n){const s=this.bindOrAllowChatUser(e,n.senderId),i=String(n.content||"").trim();if(!s||!i)return void this.logWarn({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,allowed:s,hasText:Boolean(i)},"lark message ignored");let r;e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:n.chatId}),this.logInfo({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,chatType:n.chatType,messageId:n.messageId,textPreview:fh(i)},"lark chat gateway message received");try{r=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"lark",bridgeId:e.id,chatSessionId:n.chatId,userId:n.senderId},message:{text:i,attachments:[]}})}catch(e){return void await t.channel.send(n.chatId,{markdown:`Failed to handle message: ${gh(e)}`})}const o=ah(r);if(!o)return;const a=ch(r);if(await this.sendLarkRoutedAiSessionProgress(r,e,n.chatId,o,a))return;const d=Mu({fetchImpl:this.fetchImpl,bridge:e,larkRuntime:t}),c=await d.send(n.chatId,o,{replyMarkup:a});c&&this.logInfo({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,provider:c.provider,interactionId:c.interactionId,routed:!0===vh(r).routed,replyPreview:fh(o)},"lark chat gateway reply sent")}async sendLarkRoutedAiSessionProgress(e,t,n,s,i){if(!0!==e.routed)return!1;const r=Ah(e),{instanceId:o,sessionId:a,turnId:d}=r;if(!o||!a||!d)return this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:a,turnId:d,turnIdSources:r.sources,routed:e.routed},"lark ai session progress message not started"),!1;const c=xh(o,a,d,t.id,n);return!!await this.larkBridges.applyProgressUpdate({bridge:t,key:c,chatId:n,text:s,replyMarkup:i})&&(this.deliveredAiSessionFingerprints.delete(c),this.logInfo({bridgeId:t.id,chatId:n,instanceId:o,sessionId:a,turnId:d,key:c,textPreview:fh(s)},"lark ai session progress message started"),!0)}async handleLarkCardAction(e,t,n){const s=n.operator.openId||n.operator.userId;if(!this.bindOrAllowChatUser(e,s))return void this.logWarn({bridgeId:e.id,chatId:n.chatId,messageId:n.messageId,userId:s},"lark card action ignored");const i=gu(n.action.value),r=(e,s)=>t.channel.updateCard(n.messageId,mu(e||"Updated",s));if(!i)return void await r("Unsupported action");if(await this.telegramAiSessionCallbacks.tryHandle(i,{bridge:e,chatId:n.chatId,callbackQueryId:n.messageId,userId:s,messageId:n.messageId,actionAllowed:(t,s)=>this.chatAiSessionBindingActive(e,n.chatId,t,s),answer:e=>r(e),send:(e,s)=>t.channel.send(n.chatId,{card:mu(e,s?.replyMarkup)})}))return;let o;try{o=await this.parseChatGatewayCallbackAction(i)}catch(e){if(yh(e,"CHAT_PENDING_ACTION_STALE"))return void await r(gh(e));throw e}if(!o)return void await r("Unsupported action");const a=await this.service.handleChatGatewayAction({source:{channel:"lark",bridgeId:e.id,chatSessionId:n.chatId,userId:s},action:o});if("pending-decision"===o.type&&dh(a))return void await r(`${o.decision} sent`);const d=ah(a)||mh(a.message)||"Updated";await r(d,ch(a))}async handleDingdingRobotMessage(e,t,n){const s=function(e){const t=pu(e),n=lu(t.conversationId),s=lu(du(t.text).content).trim();if(!n||!s)return;const i=lu(t.senderStaffId||t.senderId);return{chatId:n,userId:i||void 0,senderId:i||void 0,sessionWebhook:lu(t.sessionWebhook)||void 0,conversationType:Yp(t.conversationType,{robotMessage:!0}),text:s,raw:t}}(n.data);if(t.client.socketCallBackResponse(n.headers.messageId,{}),!s||!this.bindOrAllowChatUser(e,s.senderId))return void this.logWarn({bridgeId:e.id,hasEvent:Boolean(s),senderId:s?.senderId,allowed:s?this.bindOrAllowChatUser(e,s.senderId):void 0},"dingding robot message ignored");const{chatId:i,text:r,senderId:o,sessionWebhook:a}=s;a&&t.chatWebhooks.set(i,a),s.conversationType&&t.conversationTypes.set(i,s.conversationType);const d=a||t.chatWebhooks.get(i)||mh(e.settings.sessionWebhook);let c;o&&t.senderIds.set(i,o),e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:i}),this.logInfo({bridgeId:e.id,chatId:i,senderId:o,conversationType:s.conversationType,hasSessionWebhook:Boolean(a),hasCachedSessionWebhook:Boolean(t.chatWebhooks.get(i)),hasResolvedSessionWebhook:Boolean(d),textPreview:fh(r)},"dingding chat gateway message received");try{c=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"dingding",bridgeId:e.id,chatSessionId:i,userId:o||void 0},message:{text:r,attachments:[]}})}catch(e){if(d)return void await tu(this.fetchImpl,d,`Failed to handle message: ${gh(e)}`,t.onLog);throw e}const l=ah(c);if(l){const n=ch(c);if(await this.sendDingdingRoutedAiSessionProgress(c,e,t,i,l,{replyMarkup:n,sessionWebhook:d,senderId:o,sourcePrompt:r}))return;const s=Mu({fetchImpl:this.fetchImpl,bridge:e,dingdingRuntime:t}),a=await s.send(i,l,{replyMarkup:n,sessionWebhook:d,senderId:o});if(a)return void this.logInfo({bridgeId:e.id,chatId:i,senderId:o,provider:a.provider,interactionId:a.interactionId,routed:!0===vh(c).routed,hasReplyMarkup:Boolean(n),replyPreview:fh(l)},"dingding chat gateway reply sent");this.logWarn({bridgeId:e.id,chatId:i,senderId:o,hasReplyMarkup:Boolean(n),hasSessionWebhook:Boolean(d),hasRobotCode:Boolean(mh(e.settings.robotCode)),replyPreview:fh(l)},"dingding chat gateway reply skipped")}}async sendDingdingRoutedAiSessionProgress(e,t,n,s,i,r={}){if(!0!==e.routed)return!1;const o=Ah(e),{instanceId:a,sessionId:d,turnId:c}=o;if(!a||!d||!c)return this.logWarn({bridgeId:t.id,chatId:s,instanceId:a,sessionId:d,turnId:c,turnIdSources:o.sources,routed:e.routed},"dingding ai session progress card not started"),!1;const l=xh(a,d,c,t.id,s);return!!await this.dingdingBridges.applyProgressUpdate({bridge:t,key:l,chatId:s,text:i,replyMarkup:r.replyMarkup})&&(this.deliveredAiSessionFingerprints.delete(l),this.logInfo({bridgeId:t.id,chatId:s,instanceId:a,sessionId:d,turnId:c,key:l,hasSessionWebhook:Boolean(r.sessionWebhook),hasSenderId:Boolean(r.senderId),sourcePrompt:fh(r.sourcePrompt,80),textPreview:fh(i)},"dingding ai session progress card started"),!0)}async handleDingdingCardCallback(e,t,n){const s=function(e){const t=pu(e),n=cu(t.cardActionData||t.content),s=cu(n.cardPrivateData||t.cardPrivateData||t.content),i=cu(s.params||n.params||t.params),r=lu(t.userId),o=lu(i.biz_sender_id);return{userId:r||void 0,chatId:Jp(t,i),senderId:r||void 0,deliverySenderId:o||void 0,sessionWebhook:lu(i.biz_session_webhook)||void 0,conversationType:Yp(i.biz_conversation_type||t.conversationType||t.conversation_type),callbackData:Qp(Zp(t,n,s)),body:t,params:i}}(n.data);if(!this.bindOrAllowChatUser(e,s.userId))return Xp("not authorized",void 0,"unauthorized",s.body,s.params);const i=s.chatId||mh(e.defaultChatId),r=s.deliverySenderId||s.senderId,o=s.sessionWebhook;let a;i&&o&&t.chatWebhooks.set(i,o),i&&s.conversationType&&t.conversationTypes.set(i,s.conversationType),i&&r&&t.senderIds.set(i,r);try{a=await this.parseChatGatewayCallbackAction(s.callbackData)}catch(e){if(yh(e,"CHAT_PENDING_ACTION_STALE"))return Xp(gh(e),void 0,"approval_stale",s.body,s.params);throw e}if(!a)return this.logWarn({bridgeId:e.id,chatId:i,userId:s.userId,senderId:r,...Ih(s)},"dingding card callback action unsupported"),Xp("Unsupported action",void 0,"unsupported",s.body,s.params);this.logInfo({bridgeId:e.id,chatId:i,userId:s.userId,senderId:r,actionType:a.type,...Ih(s)},"dingding card callback action parsed");const d=await this.service.handleChatGatewayAction({source:{channel:"dingding",bridgeId:e.id,chatSessionId:i,userId:s.userId||void 0},action:a});return"pending-decision"===a.type&&dh(d)?Xp(`${a.decision} sent`,void 0,"approval_done",s.body,s.params):Xp(ah(d)||mh(d.message)||"updated",ch(d),"updated",s.body,s.params)}async pollWechat(e,t=()=>!0){if(!e.token)return;const n=e.settings||{},s=this.wechatCursors.get(e.id)||mh(n.updatesBuf),i=await async function(e){const t=Du((e.bridge.settings||{}).baseUrl)||"https://ilinkai.weixin.qq.com",n=await e.fetchImpl(`${t}/ilink/bot/getupdates`,{method:"POST",headers:{"content-type":"application/json",AuthorizationType:"ilink_bot_token",Authorization:`Bearer ${e.bridge.token}`,"X-WECHAT-UIN":String(Math.floor(Math.random()*2**31))},body:JSON.stringify({get_updates_buf:e.cursor,base_info:{channel_version:"1.0.2"}})}),s=await n.json().catch(()=>({}));if(!n.ok)throw new Error(`HTTP ${n.status}`);const i=Number(s.errcode??s.ret??0);if(0!==i)throw new Error(Du(s.errmsg||s.msg)||`chat bridge API returned ${i}`);const r=[];for(const e of Array.isArray(s.msgs)?s.msgs:[]){const t=ju(e);if(1!==t.message_type)continue;const n=Du(t.from_user_id),s=Pu(t);n&&s&&r.push({chatId:n,text:s,contextToken:Du(t.context_token)})}return{cursor:Du(s.get_updates_buf),messages:r}}({fetchImpl:this.fetchImpl,bridge:e,cursor:s});if(t()){i.cursor&&(this.wechatCursors.set(e.id,i.cursor),this.updateChatBridge(e.id,{settings:{updatesBuf:i.cursor}}));for(const s of i.messages){if(!t())return;const{chatId:i,contextToken:r,text:o}=s;if(e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:i,settings:{contextToken:r}}),e.defaultChatId&&e.defaultChatId!==i)continue;const a=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"wechat",bridgeId:e.id,chatSessionId:i},message:{text:o,attachments:[]}});if(!t())return;const d=ah(a);if(d){const t=Mu({fetchImpl:this.fetchImpl,bridge:e});await t.send(i,d,{contextToken:r||mh(n.contextToken)})}}}}pollPendingRoutes(){return this.pendingRouteNotifier.poll()}async sendToChatBinding(e,t){if(!e.bridgeId)return!1;const n=this.service.requireChatBridge(e.bridgeId);if(!n.enabled)return!1;const s=await this.sendViaBridge(n,e.chatSessionId,t).catch(e=>{this.bridgeErrors.set(n.id,e instanceof Error?e.message:String(e))});return Boolean(s)}async sendViaBridge(e,t,n){const s="string"==typeof n?n:n.text,i="string"==typeof n?void 0:n.replyMarkup;return Mu({fetchImpl:this.fetchImpl,bridge:e,dingdingRuntime:this.dingdingBridges.get(e.id),larkRuntime:this.larkBridges.get(e.id)}).send(t,s,{replyMarkup:i})}async pollTelegram(e,t=()=>!0){if(!e.token)return;const n=Number(e.settings?.telegramLastUpdateId),s=this.telegramOffsets.get(e.id)||(Number.isInteger(n)?n:void 0),i=await async function(e){const t=new URLSearchParams({timeout:"0",...e.offset?{offset:String(e.offset+1)}:{}}),n=await e.fetchImpl(`https://api.telegram.org/bot${e.bridge.token}/getUpdates?${t.toString()}`),s=await n.json().catch(()=>({}));if(!n.ok||!1===s.ok){if(409===n.status||/terminated by other getUpdates request/i.test(String(s.description||"")))return{updates:[],conflict:s.description||"Telegram getUpdates conflict: another bot instance is polling this token."};throw new Error(s.description||`Telegram getUpdates failed with HTTP ${n.status}`)}const i=[];for(const t of s.result||[]){const n=Number(t.update_id),s=Number.isInteger(n)?n:void 0,r=Ru(t.callback_query);if(Object.keys(r).length>0){i.push({updateId:s,callbackQuery:r});continue}const o=Ru(t.message||t.edited_message);if(0===Object.keys(o).length)continue;const a=Ru(o.chat),d=Ru(o.from),c=void 0!==a.id?String(a.id):e.bridge.defaultChatId,l=void 0!==d.id?String(d.id):void 0;if(!c)continue;const p=Ou(o.text??o.caption),u=ku(o);(p||0!==u.length)&&i.push({updateId:s,chatId:c,userId:l,text:p,rawText:p,message:o,messageId:Nu(o),replyToMessageId:Nu(Ru(o.reply_to_message)),quoteText:Ou(Ru(o.quote).text),autoBegin:1===u.length&&!p.trim(),hasSingleImageWithoutText:1===u.length&&!p.trim()})}return{updates:i}}({fetchImpl:this.fetchImpl,bridge:e,offset:s});if(t())if(i.conflict)this.bridgeErrors.set(e.id,i.conflict);else for(const n of i.updates){if(!t())return;if(void 0!==n.updateId){const t=`${e.id}:${n.updateId}`;if(this.seenTelegramUpdates.has(t)||n.updateId<=(this.telegramOffsets.get(e.id)||0))continue;this.seenTelegramUpdates.add(t),this.telegramOffsets.set(e.id,n.updateId),this.updateChatBridge(e.id,{settings:{...e.settings,telegramLastUpdateId:n.updateId}})}if("callbackQuery"in n){const t=n.callbackQuery;await this.handleTelegramCallback(e,t).catch(async n=>{const s=vh(t.message),i=vh(s.chat),r=void 0!==i.id?String(i.id):e.defaultChatId;this.bridgeErrors.set(e.id,gh(n)),r&&await this.sendTelegramMessage(e,r,`Action failed: ${gh(n)}`).catch(t=>{this.bridgeErrors.set(e.id,gh(t))})});continue}if(!this.bindOrAllowChatUser(e,n.userId))continue;const s=await Eu({fetchImpl:this.fetchImpl,bridge:e,message:n.message,onImageDownloadError:({fileId:t,fileName:n,error:s})=>{this.logWarn({bridgeId:e.id,fileId:t,fileName:n,error:gh(s)},"telegram image download skipped")}});if(!t())return;const i=n.rawText.trim();(i||s.length)&&(this.logInfo({bridgeId:e.id,chatId:n.chatId,messageId:n.messageId,replyToMessageId:n.replyToMessageId,hasQuote:Boolean(n.quoteText),textPreview:fh(i)},"telegram chat gateway message received"),await this.telegramMessageAggregator.handleIncoming(e,n.chatId,n.userId,i,s,{sourceMessageId:n.messageId,replyToMessageId:n.replyToMessageId,quoteText:n.quoteText},{autoBegin:n.autoBegin}))}}async dispatchTelegramGatewayMessage(e,t,n,s,i=[],r={}){try{const o=void 0!==r.replyToMessageId?this.telegramReplyAiSessionTarget(e.id,t,r.replyToMessageId):void 0,a=function(e,t){const n=String(t||"").trim(),s=e.trim();return n?[`引用：${n}`,s].filter(Boolean).join("\n"):s}(s,r.quoteText),d=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"telegram",bridgeId:e.id,chatSessionId:t,userId:n},message:{text:a,attachments:i},...o?{target:{instanceId:o.instanceId,aiSessionId:o.sessionId}}:{}}),c=ah(d),l=ch(d);if(c){const n=await this.sendTelegramMessage(e,t,c,{replyMarkup:l,replyToMessageId:r.sourceMessageId});this.logInfo({bridgeId:e.id,chatId:t,sourceMessageId:r.sourceMessageId,replyToMessageId:r.replyToMessageId,replyTargetInstanceId:o?.instanceId,replyTargetSessionId:o?.sessionId,sentMessageId:Number(vh(n).message_id)||void 0,routed:!0===vh(d).routed,replyPreview:fh(c)},"telegram chat gateway reply sent"),await this.rememberTelegramProgressMessage(d,e,t,n,c)}}catch(n){this.bridgeErrors.set(e.id,gh(n)),await this.sendTelegramMessage(e,t,`Failed to handle message: ${gh(n)}`,{replyToMessageId:r.sourceMessageId}).catch(t=>{this.bridgeErrors.set(e.id,gh(t))})}}async handleTelegramCallback(e,t){const n=mh(t.data),s=vh(t.from),i=vh(t.message),r=vh(i.chat),o=void 0!==r.id?String(r.id):e.defaultChatId,a=void 0!==s.id?String(s.id):void 0;if(!o||!this.bindOrAllowChatUser(e,a))return;if(await this.telegramAiSessionCallbacks.tryHandle(n,{bridge:e,chatId:o,callbackQueryId:mh(t.id),userId:a,messageId:ph(i)}))return;const d=n.match(/^task_handoff:cp_msg_end:([^:]+)$/);if(d)return void await this.telegramMessageAggregator.handleEndCallback(e,o,mh(t.id),d[1],a);let c;try{c=await this.parseChatGatewayCallbackAction(n)}catch(n){if(yh(n,"CHAT_PENDING_ACTION_STALE")){await this.answerTelegramCallback(e,mh(t.id),gh(n));const s=ph(i);return void(void 0!==s&&await this.deleteTelegramStandaloneApprovalMessage(e,o,s))}throw n}if(!c)return void await this.answerTelegramCallback(e,mh(t.id),"Unsupported action");const l=await this.service.handleChatGatewayAction({source:{channel:"telegram",bridgeId:e.id,chatSessionId:o,userId:a},action:c});if("pending-decision"===c.type&&dh(l)){await this.answerTelegramCallback(e,mh(t.id),"");const n=ph(i);return void(void 0!==n&&await this.deleteTelegramStandaloneApprovalMessage(e,o,n))}await this.answerTelegramCallback(e,mh(t.id),mh(l.message)||"updated");const p=ah(l),u=ch(l),h=i.message_id;p&&"number"==typeof h?await this.editTelegramMessage(e,o,h,p,{replyMarkup:u}):p&&await this.sendTelegramMessage(e,o,p,{replyMarkup:u})}async deleteTelegramStandaloneApprovalMessage(e,t,n){[...this.telegramProgress.entries.values()].find(s=>s.messageId===n&&s.route?.bridgeId===e.id&&s.route?.chatId===t)||await this.deleteTelegramMessage(e,t,n).catch(s=>{this.logWarn({bridgeId:e.id,chatId:t,messageId:n,error:gh(s)},"telegram callback message delete failed")})}chatAiSessionBindingActive(e,t,n,s){return this.service.listChatSessions().some(i=>i.bridgeId===e.id&&i.chatSessionId===t&&i.activeInstanceId===n&&i.activeAiSessionId===s)}telegramAiSessionActionAllowed(e,t,n,s,i){if(this.chatAiSessionBindingActive(e,t,n,s))return!0;if(!Number.isInteger(i))return!1;const r=this.telegramReplyAiSessionTarget(e.id,t,i);return Boolean(r&&r.instanceId===n&&r.sessionId===s)}async parseChatGatewayCallbackAction(e){const t=function(e){const t=e.match(/^task_handoff:cp_p:v1:([ads]):([A-Za-z0-9_-]{16})$/);if(!t)return;const n=Object.entries($l).find(([,e])=>e===t[1])?.[0];return"allow"===n||"deny"===n||"skip"===n?{routeFingerprint:t[2],decision:n}:void 0}(e);if(t){const e=(await this.service.listPendingRoutes()).filter(e=>"approval"===e.kind&&"pending"===e.status&&Bl(e.id)===t.routeFingerprint);if(1!==e.length){const e=new Error("This approval is no longer pending.");throw Object.assign(e,{statusCode:409,code:"CHAT_PENDING_ACTION_STALE"}),e}return{type:"pending-decision",routeId:e[0].id,decision:t.decision}}return function(e,t){const n=e.match(/^task_handoff:cp_session:(\d+)$/);if(n)return{type:"ai-session",index:Number(n[1])};const s=e.match(/^task_handoff:cp_i:([^:]+)$/)||e.match(/^task_handoff:cp_instance_apps:([^:]+)$/);if(s)return s[0].startsWith("task_handoff:cp_i:")?{type:"instance-app-menu",instanceId:Bp(t(s[1],"instance-app-menu").instanceId,"instanceId")}:{type:"instance-app-menu",instanceId:Hp(s[1])};const i=e.match(/^task_handoff:cp_a:([^:]+)$/)||e.match(/^task_handoff:cp_launch_app:([^:]+):([^:]+)$/);if(i){if(i[0].startsWith("task_handoff:cp_a:")){const e=t(i[1],"launch-app");return{type:"launch-app",instanceId:Bp(e.instanceId,"instanceId"),appId:Bp(e.appId,"appId")}}return{type:"launch-app",instanceId:Hp(i[1]),appId:Hp(i[2])}}const r=e.match(/^task_handoff:cp_p:([^:]+)$/);if(r){const e=t(r[1],"pending-decision");return{type:"pending-decision",routeId:Bp(e.routeId,"routeId"),decision:Fp(e.decision)}}const o=e.match(/^task_handoff:approval:([^:]+:ai:[^:]+):(allow|deny|skip)$/);return o?{type:"pending-decision",routeId:o[1],decision:o[2]}:void 0}(e,(e,t)=>this.service.resolveChatActionToken(e,t))}bindOrAllowChatUser(e,t){const n=String(t||"").trim();return!!n&&(0===e.allowedUserIds.length?(e.allowedUserIds=[n],this.updateChatBridge(e.id,{allowedUserIds:e.allowedUserIds}),this.logInfo({bridgeId:e.id,channel:e.channel,userId:n},"chat user bound"),!0):e.allowedUserIds.includes(n))}async answerTelegramCallback(e,t,n){return async function(e,t,n,s){t.token&&n&&await e(`https://api.telegram.org/bot${t.token}/answerCallbackQuery`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({callback_query_id:n,text:s.slice(0,200)})})}(this.fetchImpl,e,t,n)}async editTelegramMessage(e,t,n,s,i={}){return async function(e,t,n,s,i,r={}){if(t.token)return qp(n=>e(`https://api.telegram.org/bot${t.token}/editMessageText`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),"editMessageText",i,{chat_id:n,message_id:s,...r.replyMarkup?{reply_markup:r.replyMarkup}:{}},r)}(this.fetchImpl,e,t,n,s,i)}async sendTelegramMessage(e,t,n,s={}){return Mp(this.fetchImpl,e,t,n,s)}async deleteTelegramMessage(e,t,n){return async function(e,t,n,s){if(!t.token||!Number.isInteger(s))return;const i=await e(`https://api.telegram.org/bot${t.token}/deleteMessage`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({chat_id:n,message_id:s})}),r=await i.json().catch(()=>({}));if(!i.ok||!1===r.ok)throw new Error(r.description||`Telegram deleteMessage failed with HTTP ${i.status}`)}(this.fetchImpl,e,t,n)}async rememberTelegramProgressMessage(e,t,n,s,i){if(!0!==e.routed)return;const r=Ah(e),{instanceId:o,sessionId:a,turnId:d}=r,c=Number(vh(s).message_id);if(!(o&&a&&d&&Number.isInteger(c)))return void this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:a,turnId:d,turnIdSources:r.sources,messageId:Number.isInteger(c)?c:void 0,routed:e.routed},"telegram ai session progress message not remembered");const l=xh(o,a,d,t.id,n),p=this.telegramProgress.remember(l,c,i,{bridgeId:t.id,chatId:n});this.telegramProgressMessageTargets.set(uh(t.id,n,c),{instanceId:o,sessionId:a,turnId:d,messageId:c}),this.deliveredAiSessionFingerprints.delete(l),this.logInfo({bridgeId:t.id,chatId:n,instanceId:o,sessionId:a,turnId:d,turnIdSources:r.sources,key:l,messageId:c,progressKeys:this.telegramProgressKeysFor(o,a,t.id,n),textPreview:fh(i)},"telegram ai session progress message remembered"),"queue"===function(e){return e.aiSession&&"action"in e.aiSession?e.aiSession.action:void 0}(e)&&p?.messageId&&p.messageId!==c&&(this.telegramProgressMessageTargets.delete(uh(t.id,n,p.messageId)),await this.deleteTelegramMessage(t,n,p.messageId).catch(e=>{this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:a,turnId:d,replacedMessageId:p.messageId,replacementMessageId:c,error:gh(e)},"telegram queued progress message replacement cleanup failed")}))}telegramReplyAiSessionTarget(e,t,n){const s=this.telegramProgressMessageTargets.get(uh(e,t,n));if(s)return s;for(const[s,i]of this.telegramProgress.entries)if(i.messageId===n&&i.route?.bridgeId===e&&i.route?.chatId===t){const i=hh(s,e,t);if(i){const s={...i,messageId:n};return this.telegramProgressMessageTargets.set(uh(e,t,n),s),s}}}async pollAiSessionUpdates(){this.logAiSessionDelivery({stage:"poll-tick"});const e=await this.service.listAiSessions({refresh:!0}).catch(()=>{});if(!e)return void this.logAiSessionDelivery({stage:"poll-no-snapshot"});const t=new Map(e.instances.map(e=>[e.instanceId,e.aiSessions]));this.logAiSessionDelivery({stage:"poll-snapshot",instanceCount:t.size,instances:[...t.entries()].map(([e,t])=>({instanceId:e,sessionCount:t.sessions?.length||0,runningCount:t.runningCount,waitingCount:t.waitingCount,updatedAt:t.updatedAt}))});const n=await this.aiSessionInstanceNames();for(const[e,s]of t)await this.deliverAiSessionSnapshot(e,s,n)}async deliverAiSessionSnapshot(e,t,n){const s=Array.isArray(t.sessions)?t.sessions:[];if(this.pruneAiSessionDeliveryState(e,new Set(s.map(e=>e.id))),0===s.length)return;const i=n||await this.aiSessionInstanceNames(),r=await this.aiSessionPendingApprovalRoutes(e);await this.deliverOwnedTelegramProgress(e,s,i,r),await this.deliverActiveBindingTelegramProgress(e,s,i,r)}pruneAiSessionDeliveryState(e,t){for(const[n,s]of this.telegramProgress.entries){const i=s.route?.bridgeId&&s.route.chatId?this.telegramProgressMessageTargets.get(uh(s.route.bridgeId,s.route.chatId,s.messageId||0))||hh(n,s.route.bridgeId,s.route.chatId):void 0;i&&i.instanceId===e&&!t.has(i.sessionId)&&(s.timer&&clearTimeout(s.timer),this.telegramProgress.entries.delete(n),this.deliveredAiSessionFingerprints.delete(n),s.route?.bridgeId&&s.route.chatId&&s.messageId&&this.telegramProgressMessageTargets.delete(uh(s.route.bridgeId,s.route.chatId,s.messageId)))}}async deliverActiveBindingTelegramProgress(e,t,n,s){for(const i of this.service.listChatSessions()){if(!i.bridgeId||i.activeInstanceId!==e||!i.activeAiSessionId)continue;const r=t.find(e=>e.id===i.activeAiSessionId);if(!r)continue;const o=Ph(n.get(e)||e,r),a=_h(r,o);if(!a){this.logAiSessionDelivery({stage:"skip-empty-text",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,status:r.status,phase:r.phase,activeTurnId:r.activeTurnId,latestTurn:bh(Dh(r))});continue}const d=Nh(r);if(!d){this.logAiSessionDelivery({stage:"skip-empty-turn-id",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,status:r.status,phase:r.phase,activeTurnId:r.activeTurnId,latestTurn:bh(Dh(r))});continue}if(this.listTelegramOwnedProgressEntries(e).some(e=>e.route.bridgeId===i.bridgeId&&e.route.chatId===i.chatSessionId&&e.owner.sessionId===r.id&&e.owner.turnId===d))continue;const c=xh(e,r.id,d,i.bridgeId||"",i.chatSessionId),l=Rh(r,o);if(!l||this.deliveredAiSessionFingerprints.get(c)===l){this.logAiSessionDelivery({stage:"skip-duplicate-fingerprint",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,turnId:d,key:c,hasFingerprint:Boolean(l),fingerprintMatched:this.deliveredAiSessionFingerprints.get(c)===l,latestTurn:bh(Dh(r)),textPreview:fh(a)});continue}const p=Th({cancelCallbackData:this.telegramAiSessionCallbacks.cancelCallbackData(e,r.id),queueSteerCallbackData:t=>this.telegramAiSessionCallbacks.queueSteerCallbackData(e,r.id,t),queueDeleteMenuCallbackData:()=>this.telegramAiSessionCallbacks.queueDeleteMenuCallbackData(e,r.id),permissionCallbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),pendingApproval:s.get(r.id)||Ch(e,r),session:r});if(this.logAiSessionDelivery({stage:"attempt",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,turnId:d,key:c,relatedProgressKeys:this.telegramProgressKeysFor(e,r.id,i.bridgeId||"",i.chatSessionId),hasProgressEntry:this.telegramProgress.entries.has(c),status:r.status,phase:r.phase,activeTurnId:r.activeTurnId,latestTurn:bh(Dh(r)),textPreview:fh(a)}),await this.updateChatAiSessionProgress(i,a,c,p).catch(t=>(this.bridgeErrors.set(i.bridgeId||"",t instanceof Error?t.message:String(t)),this.logWarn({bridgeId:i.bridgeId,chatId:i.chatSessionId,instanceId:e,sessionId:r.id,turnId:d,key:c,error:gh(t)},"chat ai session progress update failed"),!1)))this.logAiSessionDelivery({stage:"delivered",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,turnId:d,key:c,textPreview:fh(a)}),this.deliveredAiSessionFingerprints.set(c,l);else{if("telegram"===this.service.requireChatBridge(i.bridgeId).channel){const t=this.telegramProgress.entries.get(c),n=this.service.requireChatBridge(i.bridgeId);this.logAiSessionDelivery({stage:t?"telegram-update-not-delivered":"telegram-no-progress-entry",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,turnId:d,key:c,relatedProgressKeys:this.telegramProgressKeysFor(e,r.id,i.bridgeId||"",i.chatSessionId),bridgeEnabled:n.enabled,bridgeChannel:n.channel,progressMessageId:t?.messageId,progressLastText:fh(t?.lastText),progressHasPending:Boolean(t?.pending),latestTurn:bh(Dh(r)),textPreview:fh(a)});continue}await this.sendToChatBinding(i,{text:a}).catch(e=>(this.bridgeErrors.set(i.bridgeId||"",e instanceof Error?e.message:String(e)),!1))&&(this.logAiSessionDelivery({stage:"fallback-sent",instanceId:e,sessionId:r.id,bridgeId:i.bridgeId,chatId:i.chatSessionId,turnId:d,key:c,textPreview:fh(a)}),this.deliveredAiSessionFingerprints.set(c,l))}}}async deliverOwnedTelegramProgress(e,t,n,s){for(const i of this.listTelegramOwnedProgressEntries(e)){const r=this.service.requireChatBridge(i.route.bridgeId);if("telegram"!==r.channel||!r.enabled)continue;const o=this.matchTelegramOwnedProgressSession(i,t);if(!o)continue;const a={bridgeId:i.route.bridgeId,chatSessionId:i.route.chatId},d=Ph(n.get(e)||e,o),c=_h(o,d),l=Nh(o);if(!c||!l){this.logAiSessionDelivery({stage:"remembered-skip-turn-or-text",key:i.key,parsedTurnId:i.owner.turnId,currentTurnId:l,hasText:Boolean(c),instanceId:e,sessionId:o.id,bridgeId:i.route.bridgeId,chatId:i.route.chatId});continue}if(i.owner.turnId&&l!==i.owner.turnId){this.logAiSessionDelivery({stage:"remembered-skip-different-active-turn",key:i.key,ownerTurnId:i.owner.turnId,currentTurnId:l,instanceId:e,sessionId:o.id,bridgeId:i.route.bridgeId,chatId:i.route.chatId});continue}const p=l===i.owner.turnId?i.key:xh(e,o.id,l,i.route.bridgeId,i.route.chatId);if(p!==i.key&&this.telegramProgress.entries.has(p))continue;if(p!==i.key&&!this.rekeyTelegramOwnedProgress(i,p,{instanceId:e,sessionId:o.id,turnId:l}))continue;const u=Rh(o,d);if(!u||this.deliveredAiSessionFingerprints.get(p)===u){this.logAiSessionDelivery({stage:"remembered-skip-fingerprint",key:i.key,hasFingerprint:Boolean(u),fingerprintMatched:this.deliveredAiSessionFingerprints.get(p)===u,instanceId:e,sessionId:o.id,bridgeId:i.route.bridgeId,chatId:i.route.chatId});continue}const h=Th({cancelCallbackData:this.telegramAiSessionCallbacks.cancelCallbackData(e,o.id),queueSteerCallbackData:t=>this.telegramAiSessionCallbacks.queueSteerCallbackData(e,o.id,t),queueDeleteMenuCallbackData:()=>this.telegramAiSessionCallbacks.queueDeleteMenuCallbackData(e,o.id),permissionCallbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),pendingApproval:s.get(o.id)||Ch(e,o),session:o}),m=await this.updateChatAiSessionProgress(a,c,p,h).catch(e=>(this.bridgeErrors.set(a.bridgeId||"",e instanceof Error?e.message:String(e)),!1));this.logAiSessionDelivery({stage:m?"remembered-delivered":"remembered-not-delivered",key:p,instanceId:e,sessionId:o.id,bridgeId:i.route.bridgeId,chatId:i.route.chatId,textPreview:fh(c)}),m&&(this.telegramProgressMessageTargets.set(uh(i.route.bridgeId,i.route.chatId,i.messageId),{instanceId:e,sessionId:o.id,turnId:l,messageId:i.messageId}),this.deliveredAiSessionFingerprints.set(p,u))}}rekeyTelegramOwnedProgress(e,t,n){return!!this.telegramProgress.rekey(e.key,t)&&(this.deliveredAiSessionFingerprints.delete(e.key),this.telegramProgressMessageTargets.set(uh(e.route.bridgeId,e.route.chatId,e.messageId),{...n,messageId:e.messageId}),!0)}logAiSessionDelivery(e){this.logInfo(e,"telegram ai session delivery flow")}telegramProgressKeysFor(e,t,n,s){const i=`${e}:${t}:`,r=`:${n}:${s}`;return[...this.telegramProgress.entries.keys()].filter(e=>e.startsWith(i)&&e.endsWith(r))}listTelegramOwnedProgressEntries(e){const t=[];for(const[n,s]of this.telegramProgress.entries){if(!s.route?.bridgeId||!s.route.chatId||!Number.isInteger(s.messageId))continue;const i=this.telegramProgressMessageTargets.get(uh(s.route.bridgeId,s.route.chatId,s.messageId))||hh(n,s.route.bridgeId,s.route.chatId);i&&i.instanceId===e&&t.push({key:n,route:{bridgeId:s.route.bridgeId,chatId:s.route.chatId},messageId:s.messageId,owner:{...i,messageId:s.messageId}})}return t}matchTelegramOwnedProgressSession(e,t){const n=t.find(t=>t.id===e.owner.sessionId);if(n)return n;if(e.owner.turnId){const n=t.find(t=>t.activeTurnId===e.owner.turnId||Dh(t)?.id===e.owner.turnId||Dh(t)?.providerTurnId===e.owner.turnId);if(n)return n}}async updateChatAiSessionProgress(e,t,n,s){if(!e.bridgeId)return this.logAiSessionDelivery({stage:"chat-update-skip-missing-bridge",chatId:e.chatSessionId,key:n}),!1;const i=this.service.requireChatBridge(e.bridgeId);if(!i.enabled)return this.logAiSessionDelivery({stage:"chat-update-skip-bridge-state",bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,bridgeEnabled:i.enabled,bridgeChannel:i.channel}),!1;if("dingding"===i.channel){if(!this.dingdingBridges.get(i.id))return!1;const r=await this.dingdingBridges.applyProgressUpdate({bridge:i,key:n,chatId:e.chatSessionId,text:t,replyMarkup:lh({actionRows:s})});return r&&this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,textPreview:fh(t)},"dingding ai session progress updated"),r}if("lark"===i.channel){const r=await this.larkBridges.applyProgressUpdate({bridge:i,key:n,chatId:e.chatSessionId,text:t,replyMarkup:lh({actionRows:s})});return r&&this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,textPreview:fh(t)},"lark ai session progress updated"),r}if("telegram"!==i.channel)return!1;const r=this.telegramProgress.entries.get(n);if(!await this.telegramProgress.applyUpdate({bridge:i,key:n,chatId:e.chatSessionId,text:t,actionRows:s})){const t=this.telegramProgress.entries.get(n);return this.logAiSessionDelivery({stage:"telegram-update-returned-false",bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,progressMessageId:r?.messageId||t?.messageId,progressLastText:fh(r?.lastText||t?.lastText),progressHasPending:Boolean(r?.pending||t?.pending)}),!1}return this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,messageId:r?.messageId||this.telegramProgress.entries.get(n)?.messageId,textPreview:fh(t)},r?"telegram ai session progress edited":"telegram ai session progress sent"),!0}async aiSessionInstanceNames(){return this.aiSessionInstanceNamesCache.get()}async aiSessionPendingApprovalRoutes(e){const t=await this.aiSessionPendingRoutesCache.get();return new Map(t.filter(t=>t.instanceId===e&&t.aiSessionId&&"approval"===t.kind).map(e=>[e.aiSessionId||"",e]))}}function ah(e){return"object"==typeof e&&e&&"reply"in e?String(e.reply||""):""}function dh(e){return"object"==typeof e&&null!==e&&!0===e.accepted}function ch(e){const t="object"==typeof e&&e&&"replyMarkup"in e?e.replyMarkup:void 0;if(t&&"object"==typeof t&&!Array.isArray(t))return t}function lh(e){const t=Array.isArray(e?.actionRows)?e.actionRows:void 0;return Kl(t||(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e]))}function ph(e){const t=Number(e?.message_id);return Number.isInteger(t)?t:void 0}function uh(e,t,n){return[e,t,String(n)].join(":")}function hh(e,t,n){const s=`:${t}:${n}`;if(!e.endsWith(s))return;const i=e.slice(0,-s.length).split(":"),r=i[0]||"",o=i[1]||"",a=i.slice(2).join(":")||void 0;return r&&o?{instanceId:r,sessionId:o,turnId:a}:void 0}function mh(e){return"string"==typeof e?e:""}function gh(e){return e instanceof Error?e.message:String(e)}function yh(e,t){return Boolean(e&&"object"==typeof e&&"code"in e&&e.code===t)}function fh(e,t=160){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function Ih(e){const t=Sh(e.body.cardActionData||e.body.content),n=Sh(t.cardPrivateData||e.body.cardPrivateData||e.body.content);return{outTrackId:mh(e.body.outTrackId),spaceId:mh(e.body.spaceId),conversationType:e.conversationType,hasCallbackData:Boolean(e.callbackData),callbackDataPreview:fh(e.callbackData,120),actionIds:[...wh(n.actionIdList),...wh(t.actionIdList),mh(n.actionId),mh(t.actionId),mh(e.body.actionId)].filter(Boolean).slice(0,5),cardActionDataKeys:Object.keys(t).sort(),privateDataKeys:Object.keys(n).sort(),paramKeys:Object.keys(e.params).sort(),hasSessionWebhook:Boolean(e.sessionWebhook)}}function bh(e){if(e)return{id:e.id,providerTurnId:e.providerTurnId,source:e.source,status:e.status,phase:e.phase,revision:e.revision,userPrompt:fh(e.userPrompt,80),hasResponse:Boolean(e.lastMessage?.trim()||e.summary?.trim()),responsePreview:fh(e.lastMessage||e.summary,80),updatedAt:e.updatedAt,observedAt:e.observedAt}}function vh(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function Sh(e){if(e&&"object"==typeof e&&!Array.isArray(e))return e;if("string"==typeof e&&e.trim())try{return vh(JSON.parse(e))}catch{return{}}return{}}function wh(e){return Array.isArray(e)?e.map(e=>mh(e)).filter(Boolean):[]}function Ah(e){const t=e.aiSession&&"session"in e.aiSession?e.aiSession:void 0,n=t?.session||(e.aiSession&&"id"in e.aiSession?e.aiSession:void 0);return{instanceId:e.instanceId||e.instance?.id||"",sessionId:e.aiSessionId||n?.id||e.binding?.activeAiSessionId||"",turnId:e.turnId||e.providerTurnId||t?.turnId||t?.providerTurnId||(n?Nh(n):""),sources:{resultTurnId:e.turnId,resultProviderTurnId:e.providerTurnId,actionTurnId:t?.turnId,actionProviderTurnId:t?.providerTurnId,sessionActiveTurnId:n?.activeTurnId,latestTurnId:n?Dh(n)?.id:void 0}}}const zh=5,kh=48;function Th(e){const{cancelCallbackData:t,queueSteerCallbackData:n,queueDeleteMenuCallbackData:s,permissionCallbackData:i,pendingApproval:r,session:o}=e,a="approval"===r?.kind?[[{text:"Allow",callbackData:i(r.id,"allow")},{text:"Skip",callbackData:i(r.id,"skip")},{text:"Deny",callbackData:i(r.id,"deny")}]]:[];if("running"!==o.status)return a;const d=(o.queue?.items||[]).filter(e=>"queued"===e.status).slice(0,zh);return[...d.map((e,t)=>[{text:Eh(e.message,t),callbackData:n(e.id)}]),d.length?[{text:"Delete Queue",callbackData:s()},{text:"Cancel",callbackData:t}]:[{text:"Cancel",callbackData:t}]]}function Ch(e,t){if("approval"===t.phase)return{id:`${e}:ai:${t.id}`,kind:"approval"}}function Eh(e,t){const n=`${t+1}. `,s=e.replace(/\s+/g," ").trim()||"Queued message",i=Math.max(8,kh-n.length),r=Array.from(s);return`${n}${r.length>i?`${r.slice(0,Math.max(1,i-3)).join("")}...`:s}`}function xh(e,t,...n){return[e,t,...n].join(":")}function Nh(e){const t=Dh(e);return t?.id?t.id:mh(e.activeTurnId)}function Rh(e,t=""){const n=Dh(e);return[t,n?.id||"",n?.status||e.status||"",n?.phase||e.phase||"",n?.lastMessage||"",n?.summary||"",n?.userPrompt||"",e.error||"",e.currentTool?.id||"",e.currentTool?.name||"",e.currentTool?.inputPreview||"",String(e.toolCallsSinceLastMessage??0),Oh(e)].join("\0")}function Oh(e){return(e.queue?.items||[]).map(e=>[e.id,e.status,e.message].join(":")).join("|")}function _h(e,t){const n=function(e,t){let n="";t?"waiting"===t.status&&"approval"===t.phase&&t.summary?.trim()?n=t.summary.trim():t.lastMessage?.trim()?n=t.lastMessage.trim():t.summary?.trim()&&(n=t.summary.trim()):"waiting"===e.status&&"approval"===e.phase&&e.summary?.trim()?n=e.summary.trim():e.lastMessage?.trim()?n=e.lastMessage.trim():e.summary?.trim()?n=e.summary.trim():e.error?.trim()&&(n="failed"===e.status?`${e.agent} session failed:\n${e.error.trim()}`:e.error.trim());const s=function(e){if(e.currentTool?.name)return`Thinking... · ${e.currentTool.name}${e.currentTool.inputPreview?` · ${e.currentTool.inputPreview}`:""}`;const t=e.toolCallsSinceLastMessage??0;return t>0?`Thinking... · ${t} ${1===t?"tool":"tools"} completed`:""}(e);return[n,s&&!jh(n,e)?s:""].filter(Boolean).join("\n\n")}(e,Dh(e));return n?`${t}\n${n}`:""}function Ph(e,t){const n=["idle"===t.status?"completed":t.status,t.phase&&"unknown"!==t.phase?t.phase:void 0].filter(Boolean).join("/");return`${e} · ${t.agent||"ai"} ${n||"unknown"}`}function jh(e,t){if("waiting"!==t.status||"approval"!==t.phase)return!1;const n=t.currentTool?.inputPreview?.trim();return Boolean(n&&e.includes(n))}function Dh(e){return(e.turns||[]).filter(e=>e.id||e.userPrompt?.trim()||e.lastMessage?.trim()||e.summary?.trim()).at(-1)}class Mh{clients=new Set;listeners=new Set;transientDemandListeners=new Set;externalTransientDemands=new Map;seq=0;connect(e,t={}){e.topics=new Set(["*"]),e.instanceIds=t.instanceIds?.length?new Set(t.instanceIds):void 0,e.subscriptionReceived=!0!==t.expectsTransientSubscription,this.clients.add(e),this.publishTransientDemand(),e.on("close",()=>{this.clients.delete(e),this.publishTransientDemand()}),e.on("message",t=>{const n=function(e){try{const t=JSON.parse(String(e||"{}"));if(!t||"object"!=typeof t)return;const n=t,s=void 0===n.aiSessionTransient?void 0:yo.safeParse(n.aiSessionTransient);if(s&&!s.success)return;return{type:n.type,topics:Array.isArray(n.topics)?n.topics.map(String).filter(Boolean):void 0,instanceIds:Array.isArray(n.instanceIds)?n.instanceIds.map(String).map(e=>e.trim()).filter(Boolean):void 0,...s?.success?{aiSessionTransient:s.data}:{}}}catch{return}}(t);"subscribe"===n?.type&&(e.topics=new Set(void 0===n.topics?["*"]:n.topics),e.instanceIds=n.instanceIds?.length?new Set(n.instanceIds):void 0,e.aiSessionTransient=n.aiSessionTransient,e.subscriptionReceived=!0,this.publishTransientDemand())})}publish(e,t,n={}){const s=this.createEvent(e,t,n),i=s.topic,r=JSON.stringify(s),o=Buffer.byteLength(r,"utf8");for(const e of this.listeners)try{e(s)}catch{this.listeners.delete(e)}for(const t of this.clients)if(t.readyState===t.OPEN&&qh(t.topics,i,e)&&Bh(t.instanceIds,s.scope)&&Fh(t,s)){if((t.bufferedAmount??0)+o>16777216){this.clients.delete(t);try{t.close?.(1013,"Event consumer is too slow.")}catch{}this.publishTransientDemand();continue}try{t.send(r)}catch{this.clients.delete(t),this.publishTransientDemand()}}return s}on(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}onAiSessionTransientDemand(e){return this.transientDemandListeners.add(e),e(this.aiSessionTransientDemand()),()=>this.transientDemandListeners.delete(e)}registerAiSessionTransientDemand(e){const t=Symbol("ai-session-transient-demand");return this.externalTransientDemands.set(t,e),this.publishTransientDemand(),()=>{this.externalTransientDemands.delete(t),this.publishTransientDemand()}}registerLegacyAiSessionTransientDemand(e){const t=new Set(e);if(t.has("*")||t.has(_))return this.registerAiSessionTransientDemand();const n=t.has(M),s=t.has(L);return n||s?this.registerAiSessionTransientDemand({messageDeltas:{allInstances:n,instanceIds:[]},timelineAllSessions:s,timelineSessions:[]}):()=>{}}aiSessionTransientDemand(){let e=!1,t=!1,n=!1;const s=new Set,i=new Map;let r;for(const o of this.clients)if(o.subscriptionReceived&&$h(o.topics))if(o.aiSessionTransient){t||=o.aiSessionTransient.messageDeltas.allInstances,n||=o.aiSessionTransient.timelineAllSessions,r=Lh(r,o.aiSessionTransient.replaySince);for(const e of o.aiSessionTransient.messageDeltas.instanceIds)s.add(e);for(const e of o.aiSessionTransient.timelineSessions)i.set(JSON.stringify([e.instanceId,e.sessionId]),e)}else e=!0;for(const o of this.externalTransientDemands.values())if(o){t||=o.messageDeltas.allInstances,n||=o.timelineAllSessions,r=Lh(r,o.replaySince);for(const e of o.messageDeltas.instanceIds)s.add(e);for(const e of o.timelineSessions)i.set(JSON.stringify([e.instanceId,e.sessionId]),e)}else e=!0;return{legacyAll:e,...r?{replaySince:r}:{},messageDeltas:{allInstances:e||t,instanceIds:[...s]},timelineAllSessions:e||n,timelineSessions:[...i.values()]}}send(e,t,n,s={}){const i=this.createEvent(t,n,s);return e.send(JSON.stringify(i)),i}createEvent(e,t,n={}){return{v:1,id:n.sourceEvent?.id||`evt_${Date.now().toString(36)}_${Math.random().toString(16).slice(2)}`,seq:++this.seq,type:e,topic:n.topic||go(e),createdAt:n.sourceEvent?.createdAt||(new Date).toISOString(),payload:t,...n.sourceEvent?.replay?{replay:!0}:{},scope:n.scope}}publishTransientDemand(){const e=this.aiSessionTransientDemand();for(const t of this.transientDemandListeners)try{t(e)}catch{}}}function Lh(e,t){return t&&(!e||t<e)?t:e}function qh(e,t,n){return!e||e.has("*")||e.has(t)||e.has(n)}function $h(e){return qh(e,_,M)||qh(e,_,L)}function Bh(e,t){return!e||!t?.instanceId||e.has(t.instanceId)}function Fh(e,t){return"ai-session.message-delta"!==t.type&&"ai-session.timeline-item"!==t.type||!!e.subscriptionReceived&&fo(e.aiSessionTransient,t)}function Uh(e,n="attachment",s={}){const i=s.maxLength??240,r=s.maxBytes??240,o=t.posix.basename(String(e).replace(/\\/g,"/")).replace(/[\u0000-\u001f\u007f<>:"/\\|?*]/g,"_").trim().replace(/[. ]+$/g,""),a=Hh(/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(o)?`_${o}`:o,i,r).replace(/[. ]+$/g,"");return a&&"."!==a&&".."!==a?a:Hh(n,i,r)||"attachment"}function Hh(e,t,n){if(!Number.isInteger(t)||t<=0||!Number.isInteger(n)||n<=0)return"";let s="",i=0,r=0;for(const o of e){const e=i+o.length,a=r+Buffer.byteLength(o);if(e>t||a>n)break;s+=o,i=e,r=a}return s}const Wh={"image/bmp":".bmp","image/gif":".gif","image/jpeg":".jpg","image/png":".png","image/webp":".webp"},Gh=d.z.object({instanceId:d.z.string().trim().min(1).max(120),sessionId:d.z.string().trim().min(1).max(120),kind:d.z.enum(["image","file"]),name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120),data:d.z.string().min(1).max(31457280)}).strict();function Vh(){return t.join(f.tmpdir(),"task-handoff-ai-session-attachments")}class Kh{items=new Map;ttlMs;constructor(e=864e5){this.ttlMs=e,this.pruneOrphanFiles()}upload(e){this.pruneExpired();const i=Gh.parse(e),r=function(e,t){const n=/^data:([^;,]+);base64,(.+)$/i.exec(e.trim()),s=n?.[1]||t,i=n?.[2]||e;return{mime:s,buffer:Buffer.from(i,"base64")}}(i.data,i.mime),o=r.mime.toLowerCase(),a=Wh[o]||"";if("image"===i.kind&&!a)throw new Error(`Unsupported image type: ${o}`);const d="image"===i.kind?r.buffer.length>x:r.buffer.length>=N;if(!r.buffer.length||d)throw new Error("image"===i.kind?"Image must be between 1 byte and 20971520 bytes.":"File must be smaller than 512000 bytes.");const c=`att_${s.randomUUID().replace(/-/g,"").slice(0,24)}`,l=new Date,p=new Date(l.getTime()+this.ttlMs),u=Vh();n.mkdirSync(u,{recursive:!0});const h=Uh(i.name),m=`${c}-`,g=Uh(h.endsWith(a)?h:`${h}${a}`,"attachment",{maxBytes:255-Buffer.byteLength(m)}),y=t.join(u,`${m}${g}`);n.writeFileSync(y,r.buffer);const f={id:c,instanceId:i.instanceId,sessionId:i.sessionId,kind:i.kind,name:h,mime:o,size:r.buffer.length,source:{type:"inline",encoding:"base64",data:r.buffer.toString("base64")},path:y,createdAt:l.toISOString(),expiresAt:p.toISOString()};return this.items.set(c,f),this.publicAttachment(f)}resolveRefs(e,t,n){this.pruneExpired();const s=d.z.array(ve).max(6).default([]).parse(e),i=s.map(e=>"runtime-path"===e.source.type?Ie.parse(e):this.requireAttachment(e,t,n));if(i.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>R)throw new Error("Inline attachments must be 41943040 bytes or less in total.");for(const e of s)"upload-ref"===e.source.type&&this.consumeAttachment(e.id);return i}dispose(){for(const e of[...this.items.keys()])this.consumeAttachment(e)}requireAttachment(e,t,n){const s=this.items.get(e.id);if(!s)throw new Error(`AI session attachment not found or expired: ${e.id}`);if(e.kind&&e.kind!==s.kind)throw new Error(`AI session attachment kind mismatch: ${e.id}`);if(s.instanceId!==t||s.sessionId!==n)throw new Error(`AI session attachment scope mismatch: ${e.id}`);return Ie.parse({id:s.id,kind:s.kind,name:s.name,mime:s.mime,size:s.size,source:s.source})}consumeAttachment(e){const t=this.items.get(e);if(t){this.items.delete(e);try{n.unlinkSync(t.path)}catch{}}}publicAttachment(e){return{id:e.id,kind:e.kind,name:e.name,mime:e.mime,size:e.size,expiresAt:e.expiresAt}}pruneExpired(){const e=Date.now();for(const[t,s]of this.items)if(!(Date.parse(s.expiresAt)>e)){this.items.delete(t);try{n.unlinkSync(s.path)}catch{}}this.pruneOrphanFiles()}pruneOrphanFiles(){const e=Vh();let s;try{s=n.readdirSync(e)}catch{return}const i=Date.now()-Math.max(this.ttlMs,864e5);for(const r of s){const s=t.join(e,r);try{n.statSync(s).isFile()&&n.statSync(s).mtimeMs<=i&&n.unlinkSync(s)}catch{}}}}const Jh=864e5,Yh=d.z.object({schemaVersion:d.z.literal(1),cacheId:d.z.string().regex(/^[a-f0-9]{64}$/),instanceId:d.z.string().trim().min(1).max(120),scopeType:d.z.enum(["session","create-request"]),scopeId:d.z.string().trim().min(1).max(160),attachmentId:d.z.string().trim().min(1).max(120),sessionId:d.z.string().trim().min(1).max(120).optional(),messageId:d.z.string().trim().min(1).max(240).optional(),kind:d.z.enum(["image","file"]),name:d.z.string().trim().min(1).max(240),mime:d.z.string().trim().min(1).max(120),disposition:d.z.string().trim().min(1).max(1024).optional(),size:d.z.number().int().positive(),etag:d.z.string().trim().min(1).max(160).optional(),instanceEpoch:d.z.string().trim().min(1).max(240).optional(),cachedAt:d.z.string().datetime(),lastAccessedAt:d.z.string().datetime(),expiresAt:d.z.string().datetime()}).strict();class Qh{root;contentDir;manifestDir;maxBytes;now;onWarning;entries=new Map;pendingBindings=new Map;reservedBytes=0;constructor(e,s={}){this.root=t.join(e,"ai-session-attachment-cache"),this.contentDir=t.join(this.root,"content"),this.manifestDir=t.join(this.root,"manifests"),this.maxBytes=s.maxBytes??2147483648,this.now=s.now||Date.now,this.onWarning=s.onWarning,n.mkdirSync(this.contentDir,{recursive:!0,mode:448}),n.mkdirSync(this.manifestDir,{recursive:!0,mode:448}),this.restore(),this.gc()}putFile(e){this.gc();const t=n.statSync(e.sourcePath);if(!t.isFile()||t.size!==e.size||e.size<=0)throw new Error("Attachment cache source size mismatch.");if(this.evictFor(e.size),this.usedBytes()+this.reservedBytes+e.size>this.maxBytes)return;const i=Xh(e.instanceId,e.attachmentId),r=this.contentPath(i),o=`${r}.${process.pid}.${s.randomUUID()}.tmp`;n.copyFileSync(e.sourcePath,o,n.constants.COPYFILE_EXCL),n.chmodSync(o,384),n.renameSync(o,r);const a=new Date(this.now()).toISOString(),d=new Date(Math.min(this.now()+Jh,e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),c=Yh.parse({schemaVersion:1,cacheId:i,instanceId:e.instanceId,scopeType:e.scopeType,scopeId:e.scopeId,attachmentId:e.attachmentId,...e.sessionId?{sessionId:e.sessionId}:{},...e.messageId?{messageId:e.messageId}:{},kind:e.kind,name:Uh(e.name),mime:e.mime.toLowerCase(),...e.disposition?{disposition:e.disposition}:{},size:e.size,...e.etag?{etag:e.etag}:{},...e.instanceEpoch?{instanceEpoch:e.instanceEpoch}:{},cachedAt:a,lastAccessedAt:a,expiresAt:d});return this.save(c),this.project(c)}beginBestEffortWrite(e){if(this.gc(),this.evictFor(e.size),e.size<=0||this.usedBytes()+this.reservedBytes+e.size>this.maxBytes)return;this.reservedBytes+=e.size;const t=Xh(e.instanceId,e.attachmentId),i=this.contentPath(t),r=`${i}.${process.pid}.${s.randomUUID()}.tmp`,o=n.createWriteStream(r,{flags:"wx",mode:384,highWaterMark:1048576});let a=0,d=!1,c=!0;const l=()=>{c&&(c=!1,this.reservedBytes=Math.max(0,this.reservedBytes-e.size))},p=()=>{if(!d){d=!0,l(),o.destroy();try{n.unlinkSync(r)}catch{}}};return o.on("error",p),{offer:t=>!d&&(a+=t.byteLength,!(a>e.size||!o.write(t))||(p(),!1)),finish:async()=>{if(d||a!==e.size)p();else if(await new Promise((e,t)=>{o.once("finish",e),o.once("error",t),o.end()}).catch(()=>{}),!d){l();try{n.renameSync(r,i);const s=new Date(this.now()).toISOString(),o=new Date(Math.min(this.now()+Jh,e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),a=Yh.parse({schemaVersion:1,cacheId:t,instanceId:e.instanceId,scopeType:e.scopeType,scopeId:e.scopeId,attachmentId:e.attachmentId,...e.sessionId?{sessionId:e.sessionId}:{},...e.messageId?{messageId:e.messageId}:{},kind:e.kind,name:Uh(e.name),mime:e.mime.toLowerCase(),...e.disposition?{disposition:e.disposition}:{},size:e.size,...e.etag?{etag:e.etag}:{},...e.instanceEpoch?{instanceEpoch:e.instanceEpoch}:{},cachedAt:s,lastAccessedAt:s,expiresAt:o});return this.save(a),this.project(a)}catch{return void p()}}},abort:p}}bind(e){const t=Xh(e.instanceId,e.attachmentId),n=this.entries.get(t);if(!n)return this.pendingBindings.set(t,e),!1;if(n.scopeId!==e.scopeId)return!1;const s=new Date(Math.min(Date.parse(n.expiresAt),e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString();return this.save(Yh.parse({...n,sessionId:e.sessionId,messageId:e.messageId,expiresAt:s,...e.etag?{etag:e.etag}:{}})),!0}get(e){this.gc();const t=Xh(e.instanceId,e.attachmentId),n=this.entries.get(t);if(!n||n.sessionId!==e.sessionId||n.messageId!==e.messageId||n.instanceEpoch&&n.instanceEpoch!==e.instanceEpoch)return;const s=Yh.parse({...n,lastAccessedAt:new Date(this.now()).toISOString()});return this.entries.set(t,s),this.project(s)}removeInstance(e){for(const t of[...this.entries.values()])t.instanceId===e&&this.remove(t.cacheId);for(const[t,n]of this.pendingBindings)n.instanceId===e&&this.pendingBindings.delete(t)}gc(){const e=this.now();for(const t of[...this.entries.values()])(Date.parse(t.expiresAt)<=e||!this.validContent(t))&&this.remove(t.cacheId);this.cleanupOrphans()}restore(){let e=[];try{e=n.readdirSync(this.manifestDir)}catch{return}for(const s of e)if(s.endsWith(".json"))try{const e=JSON.parse(n.readFileSync(t.join(this.manifestDir,s),"utf8")),i=Zh(e),r=Yh.safeParse(i);if(!r.success)throw new Error("invalid manifest");Object.keys(e).some(e=>!(e in Yh.shape))&&this.writeManifest(r.data),this.entries.set(r.data.cacheId,r.data)}catch{this.onWarning?.(`invalid AI session attachment cache manifest ignored: ${s}`)}}evictFor(e){const t=[...this.entries.values()].sort((e,t)=>Date.parse(e.lastAccessedAt)-Date.parse(t.lastAccessedAt));let n=this.usedBytes();for(const s of t){if(n+this.reservedBytes+e<=this.maxBytes)break;n-=s.size,this.remove(s.cacheId)}}save(e){const t=this.pendingBindings.get(e.cacheId),n=t&&t.scopeId===e.scopeId?Yh.parse({...e,sessionId:t.sessionId,messageId:t.messageId,expiresAt:new Date(Math.min(Date.parse(e.expiresAt),t.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),...t.etag?{etag:t.etag}:{}}):e;this.pendingBindings.delete(e.cacheId),this.writeManifest(n),this.entries.set(n.cacheId,n)}writeManifest(e){l.sync(this.manifestPath(e.cacheId),`${JSON.stringify(e,null,2)}\n`,{mode:384})}remove(e){this.entries.delete(e);try{n.unlinkSync(this.manifestPath(e))}catch{}try{n.unlinkSync(this.contentPath(e))}catch{}}cleanupOrphans(){const e=new Set(this.entries.keys());let s=[];try{s=n.readdirSync(this.contentDir)}catch{return}for(const i of s)if(!e.has(i))try{n.unlinkSync(t.join(this.contentDir,i))}catch{}}validContent(e){try{const t=n.statSync(this.contentPath(e.cacheId));return t.isFile()&&t.size===e.size}catch{return!1}}usedBytes(){return[...this.entries.values()].reduce((e,t)=>this.validContent(t)?e+t.size:e,0)}project(e){return{...e,path:this.contentPath(e.cacheId)}}contentPath(e){return t.join(this.contentDir,e)}manifestPath(e){return t.join(this.manifestDir,`${e}.json`)}}function Xh(e,t){return s.createHash("sha256").update(`${e}\0${t}`).digest("hex")}function Zh(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e;return Object.fromEntries(Object.keys(Yh.shape).filter(e=>Object.prototype.hasOwnProperty.call(t,e)).map(e=>[e,t[e]]))}const em={controlPlaneAuthBoundary:"public"},tm={controlPlaneAuthBoundary:"public-ui"},nm={controlPlaneAuthBoundary:"proxy-binding"},sm={controlPlaneAuthBoundary:"node-tunnel"};function im(e,t=Math.random){const n=Math.max(1,Math.floor(e));if(1===n)return 0;if(2===n)return 250;const s=Math.min(6e4,250*2**(n-2));return Math.min(6e4,Math.round(s*(.75+.5*t())))}class rm{retryNumber=0;random;constructor(e=Math.random){this.random=e}get attempts(){return this.retryNumber}next(){return this.retryNumber+=1,{attempt:this.retryNumber,delay:im(this.retryNumber,this.random)}}reset(){this.retryNumber=0}}class om{backoff;timer;constructor(e=Math.random){this.backoff=new rm(e)}get pending(){return Boolean(this.timer)}get attempts(){return this.backoff.attempts}schedule(e,t={}){if(this.timer)return;const n=this.backoff.next(),s=t.setTimeoutFn||setTimeout;return this.timer=s(()=>{this.timer=void 0,e()},n.delay),n}reset(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0,this.backoff.reset()}cancel(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0}}class am extends om{}function dm(e,t){return Number.isFinite(e)&&Number(e)>0?Number(e):t}function cm(e){if(!e.length)return;const t=[...e].sort((e,t)=>e-t);return t[Math.ceil(.95*t.length)-1]}function lm(e){return e.unref?.(),e}class pm{connectTimeoutMs;handshakeTimeoutMs;heartbeatIntervalMs;heartbeatTimeoutMs;heartbeatMissThreshold;stableThresholdMs;now;setTimeoutFn;clearTimeoutFn;ping;onTimeout;onStable;onPhase;connectTimer;handshakeTimer;heartbeatTimer;stableTimer;awaitingPongSince;consecutiveHeartbeatMisses=0;stable=!1;stopped=!1;currentPhase="connecting";lastActivityAt;lastPongAt;pingRttMs;recentPingRttMs=[];constructor(e){this.connectTimeoutMs=dm(e.connectTimeoutMs,1e4),this.handshakeTimeoutMs=dm(e.handshakeTimeoutMs,1e4),this.heartbeatIntervalMs=dm(e.heartbeatIntervalMs,25e3),this.heartbeatTimeoutMs=dm(e.heartbeatTimeoutMs,15e3),this.heartbeatMissThreshold=Math.max(1,Math.floor(dm(e.heartbeatMissThreshold,2))),this.stableThresholdMs=dm(e.stableThresholdMs,6e4),this.now=e.now||Date.now,this.setTimeoutFn=e.setTimeoutFn||setTimeout,this.clearTimeoutFn=e.clearTimeoutFn||clearTimeout,this.ping=e.ping,this.onTimeout=e.onTimeout,this.onStable=e.onStable,this.onPhase=e.onPhase}get phase(){return this.currentPhase}start(){this.stopped=!1,this.setPhase("connecting"),this.clearTimer("connectTimer"),this.connectTimer=lm(this.setTimeoutFn(()=>this.timeout("connect"),this.connectTimeoutMs))}opened(){this.stopped||(this.clearTimer("connectTimer"),this.setPhase("handshaking"),this.handshakeTimer=lm(this.setTimeoutFn(()=>this.timeout("handshake"),this.handshakeTimeoutMs)),this.scheduleHeartbeat(this.heartbeatIntervalMs))}healthy(){this.stopped||(this.clearTimer("handshakeTimer"),this.activity(),this.setPhase("healthy"),this.stable||this.stableTimer||(this.stableTimer=lm(this.setTimeoutFn(()=>{this.stableTimer=void 0,this.stopped||"healthy"!==this.currentPhase||(this.stable=!0,this.onStable?.())},this.stableThresholdMs))))}activity(){this.stopped||(this.lastActivityAt=this.now(),this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses=0,"handshaking"!==this.currentPhase&&"healthy"!==this.currentPhase||this.scheduleHeartbeat(this.heartbeatIntervalMs))}pong(){if(this.stopped)return;const e=this.now();void 0!==this.awaitingPongSince&&(this.pingRttMs=Math.max(0,e-this.awaitingPongSince),this.recentPingRttMs.push(this.pingRttMs),this.recentPingRttMs.length>20&&this.recentPingRttMs.shift()),this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses=0,this.lastPongAt=e,this.lastActivityAt=e,this.scheduleHeartbeat(this.heartbeatIntervalMs)}close(){this.stopped||(this.stopped=!0,this.clearTimers(),this.awaitingPongSince=void 0,this.setPhase("closed"))}diagnostics(){return{phase:this.currentPhase,stable:this.stable,...void 0===this.pingRttMs?{}:{pingRttMs:this.pingRttMs},...this.recentPingRttMs.length?{pingRttP95Ms:cm(this.recentPingRttMs)}:{},...void 0===this.lastActivityAt?{}:{lastActivityAt:new Date(this.lastActivityAt).toISOString()},...void 0===this.lastPongAt?{}:{lastPongAt:new Date(this.lastPongAt).toISOString()},...this.consecutiveHeartbeatMisses?{consecutiveHeartbeatMisses:this.consecutiveHeartbeatMisses}:{}}}scheduleHeartbeat(e){this.stopped||(this.clearTimer("heartbeatTimer"),this.heartbeatTimer=lm(this.setTimeoutFn(()=>{if(this.heartbeatTimer=void 0,!this.stopped){if(void 0!==this.awaitingPongSince){const e=Math.max(0,this.now()-this.awaitingPongSince);return e>=this.heartbeatTimeoutMs?(this.consecutiveHeartbeatMisses+=1,this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses>=this.heartbeatMissThreshold?void this.timeout("heartbeat"):void this.sendHeartbeatProbe()):void this.scheduleHeartbeat(this.heartbeatTimeoutMs-e)}this.sendHeartbeatProbe()}},e)))}sendHeartbeatProbe(){this.awaitingPongSince=this.now();try{this.ping()}catch{if(this.consecutiveHeartbeatMisses+=1,this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses>=this.heartbeatMissThreshold)return void this.timeout("heartbeat")}this.scheduleHeartbeat(this.heartbeatTimeoutMs)}timeout(e){this.stopped||(this.clearTimers(),this.setPhase("failed"),this.onTimeout(e))}setPhase(e){this.currentPhase!==e&&(this.currentPhase=e,this.onPhase?.(e))}clearTimers(){this.clearTimer("connectTimer"),this.clearTimer("handshakeTimer"),this.clearTimer("heartbeatTimer"),this.clearTimer("stableTimer")}clearTimer(e){const t=this[e];t&&this.clearTimeoutFn(t),this[e]=void 0}}class um{transport;constructor(e){this.transport=e}attachMain(e,t){this.transport.attach(e,t),t.send(JSON.stringify({type:"control-plane.hello",protocolVersion:"2026-08-01",nodeId:e,serverTime:(new Date).toISOString(),capabilities:{reverseTunnel:"request-response",auxiliaryChannels:!0,httpResponseStreaming:!0,lifecycleCommands:!0,instanceApiProxy:!0}})),t.on("message",n=>this.handleMainMessage(e,t,n))}attachAuxiliary(e,t,n){return this.transport.attachAuxiliary(e,t,n)}handleMainMessage(e,t,n){if(!this.transport.isCurrentSocket(e,t))return;let s;try{s=JSON.parse(String(n))}catch{return void t.send(JSON.stringify({type:"control-plane.error",code:"INVALID_JSON"}))}const i=s&&"object"==typeof s?s:{},r=this.transport.handleSocketMessage(e,t,i);if(void 0!==r&&!r){if("node-agent.ping"!==i.type)return"node-agent.identify"===i.type?(this.transport.markHealthy(e,t),void t.send(JSON.stringify({type:"control-plane.identified",nodeId:e,serverTime:(new Date).toISOString()}))):void t.send(JSON.stringify({type:"control-plane.error",code:"UNSUPPORTED_MESSAGE"}));t.send(JSON.stringify({type:"control-plane.pong",nodeId:e,serverTime:(new Date).toISOString()}))}}}const hm={[P]:vt,[j]:St,[D]:wt,[M]:At,[L]:zt,[Nt]:Ft,[Rt]:Ut,[Ot]:Ht},mm=new Set(Object.keys(hm));class gm{options;validatedScopes=new Map;validatingScopes=new Map;eventQueues=new Map;scopeEpochs=new Map;constructor(e={}){this.options=e}handle(e,t){const n="string"==typeof t.type?t.type:"";if("node-agent.streams.hello"===n){const n="string"==typeof t.instanceId?t.instanceId:"",s=ra(vo,t.payload);return n&&s.success&&this.enqueue(e,n,()=>this.options.onStreamsHello?.(n,s.data)),!0}if(!n.startsWith("node-agent.event."))return!1;const s=ym(t.event),i="string"==typeof s?.type?s.type:"";if(!i)return!0;const r="payload"in s?s.payload:{},o=ym(s.scope)||{},a="string"==typeof t.instanceId?t.instanceId:void 0,d=function(...e){return e.find(e=>"string"==typeof e)}(o.instanceId,s.instanceId,a);if("instance.metrics.snapshot"===i){const t=ra(_r,r);return!t.success||t.data.instanceId!==d||(this.enqueue(e,t.data.instanceId,()=>{this.options.events?.publish(i,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})}),!0)}if(i===eo){const t=ra(to,r);return!t.success||t.data.instanceId!==d||(this.enqueue(e,t.data.instanceId,()=>{this.options.events?.publish(i,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})}),!0)}if(i===wr||i===Ar){const t=ra(i===wr?kr:Tr,r);return!t.success||t.data.instanceId!==d||(this.enqueue(e,t.data.instanceId,()=>{this.options.events?.publish(i,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})}),!0)}if(mm.has(i)){const t=function(e,t){const n=hm[e];if(!n)return;const s=ra(n,t);if(!s.success)return;const i=s.data;return{instanceId:"meta"in i?i.meta.instanceId:i.instanceId,payload:i}}(i,r);return!t||([o.instanceId,s.instanceId,a].filter(e=>"string"==typeof e&&Boolean(e)).some(e=>e!==t.instanceId)||this.enqueue(e,t.instanceId,()=>{const n={...o,nodeId:e,instanceId:t.instanceId},r={v:1,id:"string"==typeof s.id?s.id:`forwarded_${Date.now().toString(36)}`,seq:"number"==typeof s.seq?s.seq:0,type:i,topic:"string"==typeof s.topic?s.topic:i.startsWith("app-session.")?"app.sessions":"ai.sessions",createdAt:"string"==typeof s.createdAt?s.createdAt:(new Date).toISOString(),payload:t.payload,...!0===s.replay?{replay:!0}:{},scope:n};this.options.onSessionEvent&&!this.options.onSessionEvent(r)||this.options.events?.publish(i,t.payload,{topic:r.topic,scope:n,sourceEvent:{id:r.id,createdAt:r.createdAt,replay:r.replay}})}),!0)}const c=()=>{this.options.events?.publish(i,r,{topic:"string"==typeof s.topic?s.topic:void 0,scope:{...o,nodeId:e,...d?{instanceId:d}:{}}})};return d?this.enqueue(e,d,c):c(),!0}invalidate(e={}){const t=new Set;for(const[n,s]of this.validatedScopes)e.nodeId&&s.nodeId!==e.nodeId||e.instanceId&&s.instanceId!==e.instanceId||t.add(n);for(const n of new Set([...this.validatingScopes.keys(),...this.eventQueues.keys()])){const[s,i]=Im(n);e.nodeId&&s!==e.nodeId||e.instanceId&&i!==e.instanceId||t.add(n)}for(const e of t)this.scopeEpochs.delete(e),this.validatedScopes.delete(e),this.validatingScopes.delete(e),this.eventQueues.delete(e)}diagnostics(){return{validatedScopes:this.validatedScopes.size,validatingScopes:this.validatingScopes.size,queuedScopes:this.eventQueues.size,scopeEpochs:this.scopeEpochs.size}}enqueue(e,t,n){const s=fm(e,t),i=this.scopeEpoch(s),r=(this.eventQueues.get(s)||Promise.resolve()).catch(()=>{}).then(async()=>{this.scopeEpochs.get(s)===i&&await this.isScopeValid(e,t,i)&&this.scopeEpochs.get(s)===i&&await n()});this.eventQueues.set(s,r);const o=()=>{this.eventQueues.get(s)===r&&this.eventQueues.delete(s),this.scopeEpochs.get(s)!==i||this.eventQueues.has(s)||this.validatingScopes.has(s)||this.scopeEpochs.delete(s)};r.then(o,o)}async isScopeValid(e,t,n){const s=fm(e,t);if((this.validatedScopes.get(s)?.expiresAt||0)>Date.now())return!0;const i=this.validatingScopes.get(s);if(i)return i;const r=Promise.resolve(this.options.validateInstanceScope?.(e,t)).then(Boolean).catch(()=>!1).then(i=>(i&&this.scopeEpochs.get(s)===n&&this.validatedScopes.set(s,{nodeId:e,instanceId:t,expiresAt:Date.now()+(this.options.scopeTtlMs??3e4)}),i));return this.validatingScopes.set(s,r),r.finally(()=>{this.validatingScopes.get(s)===r&&this.validatingScopes.delete(s)})}scopeEpoch(e){const t=this.scopeEpochs.get(e);if(t)return t;const n={};return this.scopeEpochs.set(e,n),n}}function ym(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:void 0}function fm(e,t){return JSON.stringify([e,t])}function Im(e){const t=JSON.parse(e);return Array.isArray(t)&&2===t.length?[String(t[0]),String(t[1])]:["",""]}const bm=d.z.object({nodeId:d.z.string().trim().min(1).max(120)}).strict();class vm{OPEN=1;readyState=this.OPEN;listeners=new Map;pingUpstream;sendToUpstream;on(e,t){const n=this.listeners.get(e)||new Set;n.add(t),this.listeners.set(e,n)}send(e){this.readyState===this.OPEN&&this.emit("message",e,!1)}sendUpstream(e){if(this.readyState===this.OPEN)try{this.sendToUpstream?.(e)}catch{this.close(1011,"Node event subscription delivery failed.")}}ping(){this.readyState===this.OPEN&&this.pingUpstream?.()}control(e,t,n){this.pingUpstream=e,this.sendToUpstream=n,t?.(()=>this.emit("pong"))}opened(){this.readyState===this.OPEN&&this.emit("open")}terminate(){this.close(1006)}close(e=1e3,t=""){this.readyState===this.OPEN&&(this.readyState=3,this.emit("close",e,Buffer.from(t)))}emit(e,...t){for(const n of this.listeners.get(e)||[])n(...t)}}function Sm(){return`req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2,10)}`}const wm=new Map;function Am(e,t){if("paired-hmac"!==e.auth.mode||!e.auth.keyId||!e.auth.secret){const e=new Error("Reverse tunnel requires paired-HMAC node auth.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_TUNNEL_REQUIRES_PAIRED_HMAC"}),e}const n=function(e){const t=new Map;for(const[n,s]of Object.entries(e)){const e=Array.isArray(s)?s.join(","):"string"==typeof s?s:void 0===s?"":String(s);t.set(n.toLowerCase(),e)}return{nodeId:t.get("x-taskhandoff-node-id")||"",keyId:t.get("x-taskhandoff-key-id")||"",timestamp:t.get("x-taskhandoff-timestamp")||"",nonce:t.get("x-taskhandoff-nonce")||"",bodySha256:t.get("x-taskhandoff-body-sha256")||"",signature:t.get("x-taskhandoff-signature")||""}}(t.headers);if(n.nodeId!==e.id)throw Object.assign(new Error("Invalid reverse tunnel node id."),{statusCode:401,code:"NODE_AGENT_TUNNEL_NODE_MISMATCH"});if(n.keyId!==e.auth.keyId)throw Object.assign(new Error("Invalid reverse tunnel key id."),{statusCode:401,code:"NODE_AGENT_TUNNEL_KEY_INVALID"});const i=Date.parse(n.timestamp);if(!Number.isFinite(i)||Math.abs(Date.now()-i)>wd)throw Object.assign(new Error("Reverse tunnel timestamp is outside the allowed window."),{statusCode:401,code:"NODE_AGENT_TUNNEL_TIMESTAMP_INVALID"});const r=Date.now()-wd;for(const[e,t]of wm)t<=r&&wm.delete(e);const o=`${e.id}:${n.keyId}:${n.nonce}`;if(!n.nonce||wm.has(o))throw Object.assign(new Error("Reverse tunnel nonce is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_NONCE_INVALID"});const a=kd("");if(n.bodySha256!==a)throw Object.assign(new Error("Reverse tunnel body hash is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_BODY_HASH_INVALID"});const d=t.url||`${Ad}?nodeId=${encodeURIComponent(e.id)}`,c=Td(e.auth.secret,{keyId:n.keyId,method:"GET",pathWithQuery:d,timestamp:n.timestamp,nonce:n.nonce,bodySha256:a});if(!function(e,t){const n=Buffer.from(e,"hex"),i=Buffer.from(t,"hex");return n.length===i.length&&s.timingSafeEqual(n,i)}(n.signature,c))throw Object.assign(new Error("Reverse tunnel signature is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_SIGNATURE_INVALID"});wm.set(o,Date.now()+wd)}function zm(e){return e?e instanceof Headers?Object.fromEntries(e.entries()):Array.isArray(e)?Object.fromEntries(e.map(([e,t])=>[e,t])):Object.fromEntries(Object.entries(e).map(([e,t])=>[e,String(t)])):{}}class km{sockets=new Map;eventSubscriptions=new Map;eventRouter;httpStreamHeaderTimeoutMs;requestTimeoutMs;auxiliaryAttachTimeoutMs;connectionRuntime;connectionOptions;constructor(e,t={}){this.eventRouter=new gm({events:e,onStreamsHello:t.onStreamsHello,onSessionEvent:t.onSessionEvent,validateInstanceScope:t.validateInstanceScope}),this.httpStreamHeaderTimeoutMs=t.httpStreamHeaderTimeoutMs??3e4,this.requestTimeoutMs=t.requestTimeoutMs??3e4,this.auxiliaryAttachTimeoutMs=t.auxiliaryAttachTimeoutMs??3e4,this.connectionRuntime=t.connectionRuntime,this.connectionOptions=t}attach(e,t){const n=this.sockets.get(e);if(n?.socket===t)return;n&&this.invalidateInstanceScope({nodeId:e});const s=new Map,i={socket:t,runtimeGeneration:this.connectionRuntime?.begin(e,"reverse-wss","handshaking"),pending:s,streams:new Map,httpStreams:new Map,pendingChannels:new Map},r=new pm({...this.connectionOptions,ping:()=>t.ping?.(),onTimeout:n=>{this.sockets.get(e)===i&&(i.failureReason=`Reverse tunnel ${n} timeout.`,void 0!==i.runtimeGeneration&&this.connectionRuntime?.update(e,i.runtimeGeneration,{phase:"suspect",error:i.failureReason}),t.terminate?t.terminate():t.close?.(1011,`Reverse tunnel ${n} timeout.`))},onStable:()=>{void 0!==i.runtimeGeneration&&this.connectionRuntime?.stable(e,i.runtimeGeneration)}});i.supervisor=r,this.sockets.set(e,i),r.start(),r.opened(),t.on?.("pong",()=>{this.sockets.get(e)===i&&(r.pong(),void 0!==i.runtimeGeneration&&this.connectionRuntime?.pong(e,i.runtimeGeneration,r.diagnostics()))}),t.on?.("close",()=>this.detach(e,t)),t.on?.("error",n=>{i.failureReason||=n instanceof Error?n.message:String(n||"Reverse tunnel transport error."),this.detach(e,t)}),n&&n.socket!==t&&this.finalizeConnection(n,new Error(`Reverse tunnel for node ${e} was replaced.`),"Reverse tunnel was replaced.",!0);const o=this.eventSubscriptions.get(e);o&&this.sendEventSubscription(e,o)}setEventSubscription(e,t){this.eventSubscriptions.set(e,t),this.sendEventSubscription(e,t)}sendEventSubscription(e,t){const n=this.sockets.get(e);if(n)try{n.socket.send(JSON.stringify({type:"control-plane.event-subscribe",aiSessionTransient:{...t.replaySince?{replaySince:t.replaySince}:{},messageDeltas:t.messageDeltas,timelineAllSessions:t.timelineAllSessions,timelineSessions:t.timelineSessions}}))}catch(t){n.failureReason=t instanceof Error?t.message:"Reverse tunnel event subscription delivery failed.",this.detach(e,n.socket);try{n.socket.close?.(1011,"Event subscription delivery failed.")}catch{}}}detach(e,t){const n=this.sockets.get(e);!n||t&&n.socket!==t||(this.sockets.delete(e),n.supervisor?.close(),void 0!==n.runtimeGeneration&&this.connectionRuntime?.disconnected(e,n.runtimeGeneration,{error:n.failureReason||"Reverse tunnel disconnected."}),this.invalidateInstanceScope({nodeId:e}),this.finalizeConnection(n,new Error(`Reverse tunnel for node ${e} disconnected.`),"Reverse tunnel disconnected.",!0))}disconnect(e,t="Node connection disabled locally."){const n=this.sockets.get(e);return!!n&&(this.detach(e,n.socket),n.socket.close?.(1e3,t),!0)}connected(e){return this.sockets.has(e)}markHealthy(e,t){const n=this.sockets.get(e);return!(!n||n.socket!==t||void 0===n.runtimeGeneration)&&(n.supervisor?.healthy(),this.connectionRuntime?.connected(e,n.runtimeGeneration)??!0)}finalizeConnection(e,t,n,s){e.supervisor?.close();for(const n of[...e.pending.keys()])this.cancelPendingRequest(e,n,t,!1);for(const[t,s]of e.streams)e.streams.delete(t),s.downstream.close(1011,n);for(const s of[...e.httpStreams.keys()])this.cancelHttpStream(e,s,t,n,!1);for(const t of e.pendingChannels.values())clearTimeout(t.timer);if(e.pendingChannels.clear(),s&&e.socket.close&&3!==e.socket.readyState)try{e.socket.close(1e3,n)}catch{}}isCurrentSocket(e,t){return this.sockets.get(e)?.socket===t}handleSocketMessage(e,t,n){if(this.isCurrentSocket(e,t))return this.sockets.get(e)?.supervisor?.activity(),this.handleMessage(e,n)}handleMessage(e,t){if(this.eventRouter.handle(e,t))return!0;if(this.handleWebSocketMessage(e,t))return!0;if("node-agent.response"!==t.type)return!1;const n="string"==typeof t.requestId?t.requestId:"",s=this.sockets.get(e),i=s?.pending.get(n);if(!i||!s)return!0;s.pending.delete(n),clearTimeout(i.timer),i.signal&&i.onAbort&&i.signal.removeEventListener("abort",i.onAbort);const r=Number(t.status)||502,o=t.headers&&"object"==typeof t.headers?t.headers:{},a="string"==typeof t.body?t.body:"";if(t.error&&"object"==typeof t.error){const e=t.error,n=new Error("string"==typeof e.message?e.message:`Reverse tunnel request failed with HTTP ${r}`);return Object.assign(n,{statusCode:r,code:"string"==typeof e.code?e.code:"NODE_AGENT_REVERSE_REQUEST_FAILED"}),i.reject(n),!0}return i.resolve(new Response(a,{status:r,headers:o})),!0}invalidateInstanceScope(e={}){this.eventRouter.invalidate(e)}instanceScopeDiagnostics(){return this.eventRouter.diagnostics()}async request(e,t,n={}){const s=this.sockets.get(e.id);if(!s){const t=new Error(`Reverse tunnel for node ${e.id} is not connected.`);throw Object.assign(t,{statusCode:503,code:"NODE_AGENT_REVERSE_TUNNEL_OFFLINE"}),t}const i=Sm(),r=$s(n.body),o={type:"control-plane.request",requestId:i,route:t,init:{method:n.method||"GET",headers:zm(n.headers),body:r}};return new Promise((r,a)=>{let d;if(d={resolve:r,reject:a,timer:setTimeout(()=>{const n=new Error(`Reverse tunnel request to ${e.id}${t} timed out.`);Object.assign(n,{statusCode:504,code:"NODE_AGENT_REVERSE_REQUEST_TIMEOUT"}),this.cancelPendingRequest(s,i,n)},this.requestTimeoutMs),signal:n.signal||void 0},n.signal&&(d.onAbort=()=>{this.cancelPendingRequest(s,i,Object.assign(new Error("Reverse tunnel request was aborted."),{name:"AbortError",code:"ABORT_ERR"}))},n.signal.addEventListener("abort",d.onAbort,{once:!0})),s.pending.set(i,d),n.signal?.aborted)d.onAbort?.();else try{s.socket.send(JSON.stringify(o))}catch(e){this.cancelPendingRequest(s,i,e instanceof Error?e:new Error(String(e)),!1)}})}cancelPendingRequest(e,t,n,s=!0){const i=e.pending.get(t);if(!i)return!1;if(e.pending.delete(t),clearTimeout(i.timer),i.signal&&i.onAbort&&i.signal.removeEventListener("abort",i.onAbort),i.reject(n),s)try{e.socket.send(JSON.stringify({type:"control-plane.request.cancel",requestId:t}))}catch{}return!0}async requestStream(e,t,n={}){const s=this.sockets.get(e.id);if(!s)throw Object.assign(new Error(`Reverse tunnel for node ${e.id} is not connected.`),{statusCode:503,code:"NODE_AGENT_REVERSE_TUNNEL_OFFLINE"});const i=Sm(),r=$s(n.body);return new Promise((o,a)=>{const d={resolve:o,reject:a,timer:setTimeout(()=>{this.cancelHttpStream(s,i,Object.assign(new Error(`Reverse tunnel stream to ${e.id}${t} timed out.`),{statusCode:504,code:"NODE_AGENT_REVERSE_STREAM_TIMEOUT"}),"Reverse HTTP stream header timeout.")},this.httpStreamHeaderTimeoutMs),settled:!1,finalized:!1,signal:n.signal||void 0};if(s.httpStreams.set(i,d),this.registerPendingChannel(s,{id:i,attach:t=>this.attachHttpStreamChannel(e.id,i,t),cancel:(e,t)=>{this.cancelHttpStream(s,i,e,t)}},"Reverse HTTP channel attach timed out."),n.signal&&(d.onAbort=()=>this.cancelHttpStream(s,i,Object.assign(new Error("Reverse HTTP stream consumer disconnected."),{name:"AbortError",code:"ABORT_ERR"}),"HTTP consumer disconnected."),n.signal.addEventListener("abort",d.onAbort,{once:!0}),n.signal.aborted))d.onAbort();else try{s.socket.send(JSON.stringify({type:"control-plane.http.open",streamId:i,route:t,init:{method:n.method||"GET",headers:zm(n.headers),body:r}}))}catch(e){this.cancelHttpStream(s,i,e instanceof Error?e:new Error(String(e)),"Reverse tunnel send failed.",!1)}})}cancelHttpStream(e,t,n,s,i=!0){const r=e.httpStreams.get(t);if(!r||r.finalized)return!1;if(r.finalized=!0,e.httpStreams.delete(t),this.removePendingChannel(e,t),clearTimeout(r.timer),r.signal&&r.onAbort&&r.signal.removeEventListener("abort",r.onAbort),r.settled?r.body?.destroy(n):(r.settled=!0,r.reject(n)),1===r.socket?.readyState&&r.socket.close(1e3,s),i)try{e.socket.send(JSON.stringify({type:"control-plane.http.cancel",streamId:t,reason:s}))}catch{}return!0}completeHttpStream(e,t){const n=e.httpStreams.get(t);return!(!n||n.finalized||(n.finalized=!0,e.httpStreams.delete(t),this.removePendingChannel(e,t),clearTimeout(n.timer),n.signal&&n.onAbort&&n.signal.removeEventListener("abort",n.onAbort),n.body?.end(),0))}attachAuxiliary(e,t,n){const s=this.sockets.get(e),i=s?.pendingChannels.get(t);return s&&i?(this.removePendingChannel(s,t),i.attach(n)):(n.close(1008,"Unknown reverse tunnel channel."),!1)}registerPendingChannel(e,t,n){this.removePendingChannel(e,t.id),t.timer=setTimeout(()=>{e.pendingChannels.get(t.id)===t&&(e.pendingChannels.delete(t.id),t.cancel(Object.assign(new Error(n),{code:"NODE_AGENT_REVERSE_CHANNEL_ATTACH_TIMEOUT"}),n))},this.auxiliaryAttachTimeoutMs),t.timer.unref?.(),e.pendingChannels.set(t.id,t)}removePendingChannel(e,t){const n=e.pendingChannels.get(t);return n?.timer&&clearTimeout(n.timer),e.pendingChannels.delete(t),n}attachHttpStream(e,t,n){return this.attachAuxiliary(e,t,n)}attachHttpStreamChannel(e,t,n){const s=this.sockets.get(e),i=s?.httpStreams.get(t);if(!s||!i)return n.close(1008,"Unknown reverse HTTP stream."),!1;i.socket=n;const r=e=>{this.cancelHttpStream(s,t,e,"Reverse HTTP stream failed.")};return n.on("message",(e,o)=>{if(i.finalized||s.httpStreams.get(t)!==i)return;if(o)return i.body?void(i.body.write(Buffer.isBuffer(e)?e:Buffer.from(e))||(n.pause?.(),i.body.once("drain",()=>n.resume?.()))):r(new Error("Reverse HTTP stream received data before response headers."));let a;try{a=JSON.parse(String(e))}catch{return void r(new Error("Reverse HTTP stream sent invalid JSON control data."))}if("node-agent.http.head"===a.type){if(i.settled)return;clearTimeout(i.timer);const e=Number(a.status)||502,n=a.headers&&"object"==typeof a.headers?a.headers:{},r=new m.PassThrough({highWaterMark:65536});return i.body=r,i.settled=!0,r.once("close",()=>{this.cancelHttpStream(s,t,new Error("Reverse HTTP stream consumer closed."),"HTTP consumer closed.")}),void i.resolve(new Response(m.Readable.toWeb(r),{status:e,headers:n}))}"node-agent.http.end"!==a.type?"node-agent.http.error"===a.type&&r(new Error("string"==typeof a.message?a.message:"Reverse HTTP stream failed.")):i.settled?this.completeHttpStream(s,t):r(new Error("Reverse HTTP stream ended before response headers."))}),n.on("close",()=>{r(new Error("Reverse HTTP stream disconnected."))}),n.on("error",()=>r(new Error("Reverse HTTP stream failed."))),!0}proxyWebSocket(e,t,n,s,i={}){const r=e.id,o=this.sockets.get(r);if(!o)return void t.close(1011,"Reverse tunnel is not connected.");const a=Sm(),d=e=>{try{o.socket.send(JSON.stringify(e))}catch{this.removePendingChannel(o,a),o.streams.delete(a),t.close(1011,"Reverse tunnel send failed.")}},c={downstream:t,pendingFrames:[]};return o.streams.set(a,c),this.registerPendingChannel(o,{id:a,attach:e=>this.attachWebSocketStreamChannel(r,a,e),cancel:(e,n)=>{this.removePendingChannel(o,a),o.streams.delete(a),t.close(1011,n)}},"Reverse websocket channel attach timed out."),d({type:"control-plane.websocket.open",streamId:a,route:n,protocols:Array.isArray(s)?s:s?[s]:[],headers:i}),t.on("message",(e,n)=>{const s=o.streams.get(a);if(s&&!s.upstream)return s.pendingFrames.length>=256?(this.removePendingChannel(o,a),o.streams.delete(a),t.close(1011,"Reverse websocket stream pending frame limit exceeded."),void d({type:"control-plane.websocket.close",streamId:a,code:1011,reason:"Reverse websocket stream pending frame limit exceeded."})):void s.pendingFrames.push({data:e,isBinary:Boolean(n)})}),t.on("close",(e,t)=>{const n=o.streams.get(a);if(n){this.removePendingChannel(o,a),o.streams.delete(a);const s=fd(e),i=yd(t);n.upstream&&Id(n.upstream,s,i),d({type:"control-plane.websocket.close",streamId:a,...void 0===s?{}:{code:s},...i?{reason:i}:{}})}}),t.on("error",()=>{const e=o.streams.get(a);e&&(this.removePendingChannel(o,a),o.streams.delete(a),e.upstream?.close(1011,"Downstream websocket failed."),d({type:"control-plane.websocket.close",streamId:a,code:1011,reason:"Downstream websocket failed."}))}),{send:e=>{const t=o.streams.get(a);t&&(t.upstream?t.upstream.send(e):t.pendingFrames.push({data:e,isBinary:!1}))}}}attachWebSocketStream(e,t,n){return this.attachAuxiliary(e,t,n)}attachWebSocketStreamChannel(e,t,n){const s=this.sockets.get(e),i=s?.streams.get(t);if(!s||!i)return n.close(1008,"Unknown reverse websocket stream."),!1;i.upstream=n;for(const e of i.pendingFrames.splice(0))n.send(e.data,{binary:e.isBinary});return vd(i.downstream,n,{pendingFrameLimit:256,onClientClose:()=>{this.removePendingChannel(s,t),s.streams.delete(t)},onClientError:()=>{this.removePendingChannel(s,t),s.streams.delete(t)},onUpstreamClose:()=>{this.removePendingChannel(s,t),s.streams.delete(t)},onUpstreamError:()=>{this.removePendingChannel(s,t),s.streams.delete(t)}}),!0}handleWebSocketMessage(e,t){const n="string"==typeof t.type?t.type:"";if(!n.startsWith("node-agent.websocket."))return!1;const s=this.sockets.get(e),i="string"==typeof t.streamId?t.streamId:"",r=s?.streams.get(i);return!r||("node-agent.websocket.close"===n?(s&&this.removePendingChannel(s,i),s?.streams.delete(i),Id(r.downstream,t.code,t.reason),!0):"node-agent.websocket.error"!==n||(s&&this.removePendingChannel(s,i),s?.streams.delete(i),r.downstream.close(1011,"string"==typeof t.message?t.message:"Reverse websocket proxy failed."),!0))}}class Tm{sockets=new Map;connectionKeys=new Map;retries=new Map;supervisors=new Map;runtimeGenerations=new Map;service;tunnel;safetyIntervalMs;logger;connectionRuntime;connectionOptions;reconnectAttempts=0;safetyReconciliations=0;timer;running=!1;transientDemand={legacyAll:!1,messageDeltas:{allInstances:!1,instanceIds:[]},timelineAllSessions:!1,timelineSessions:[]};constructor(e,t,n={}){var s;this.service=e,this.tunnel=t,this.safetyIntervalMs=(s=n.safetyIntervalMs,Math.min(6e4,Math.max(3e4,s??45e3))),this.logger=n.logger,this.connectionRuntime=n.connectionRuntime,this.connectionOptions=n}start(){this.running||(this.running=!0,this.sync(),this.timer=setInterval(()=>{this.safetyReconciliations+=1,this.sync()},this.safetyIntervalMs))}stop(){this.running=!1,this.timer&&(clearInterval(this.timer),this.timer=void 0);for(const e of this.sockets.values())e.close();for(const e of this.supervisors.values())e.close();this.sockets.clear(),this.connectionKeys.clear(),this.supervisors.clear(),this.runtimeGenerations.clear();for(const e of this.retries.values())e.timer.cancel();this.retries.clear()}syncNow(){this.sync()}setAiSessionTransientDemand(e){this.transientDemand=e;const t=JSON.stringify({v:1,type:"subscribe",aiSessionTransient:{...e.replaySince?{replaySince:e.replaySince}:{},messageDeltas:e.messageDeltas,timelineAllSessions:e.timelineAllSessions,timelineSessions:e.timelineSessions}});for(const e of this.sockets.values())e.sendUpstream(t);for(const t of this.service.listNodes())"reverse-wss"===t.connectionMode&&this.tunnel.setEventSubscription(t.id,e)}diagnostics(){return{reconnectAttempts:this.reconnectAttempts,safetyReconciliations:this.safetyReconciliations,activeConnections:this.sockets.size,pendingRetries:[...this.retries.values()].filter(e=>e.timer.pending).length,safetyIntervalMs:this.safetyIntervalMs,connections:[...this.supervisors.entries()].map(([e,t])=>({nodeId:e,...t.diagnostics()})),aiSessionTransientDemand:this.transientDemand}}sync(){const e=new Set;for(const t of this.service.listNodes()){const n=this.nodeEventConnectionKey(t);if(!n)continue;e.add(t.id);const s=this.retries.get(t.id);if(s?.timer.pending&&s.connectionKey!==n&&(s.timer.cancel(),this.retries.delete(t.id)),this.connectionKeys.get(t.id)!==n&&this.sockets.has(t.id)){const e=this.sockets.get(t.id),n=this.runtimeGenerations.get(t.id);this.supervisors.get(t.id)?.close(),this.sockets.delete(t.id),this.connectionKeys.delete(t.id),this.supervisors.delete(t.id),this.runtimeGenerations.delete(t.id),void 0!==n&&this.connectionRuntime?.disconnected(t.id,n,{error:"Direct event endpoint changed."}),e?.close()}this.sockets.has(t.id)||this.retries.get(t.id)?.timer.pending||this.connect(t,n)}for(const[t,n]of this.sockets)if(!e.has(t)){const e=this.runtimeGenerations.get(t);this.supervisors.get(t)?.close(),this.sockets.delete(t),this.connectionKeys.delete(t),this.supervisors.delete(t),this.runtimeGenerations.delete(t),void 0!==e&&this.connectionRuntime?.disconnected(t,e,{error:"Direct event connection is no longer configured."}),n.close();const s=this.retries.get(t);s?.timer.cancel(),this.retries.delete(t)}for(const[t,n]of this.retries)e.has(t)||(n.timer.cancel(),this.retries.delete(t),this.connectionKeys.delete(t))}connect(e,t){const n=new vm,s="control-plane-proxy"!==e.connectionMode?this.connectionRuntime?.begin(e.id,"direct-http","connecting"):void 0;void 0!==s&&this.runtimeGenerations.set(e.id,s);const i=this.retries.get(e.id)?.timer||new am;this.retries.set(e.id,{timer:i,connectionKey:t});const r=new pm({...this.connectionOptions,ping:()=>n.ping(),onTimeout:t=>{this.sockets.get(e.id)===n&&(void 0!==s&&this.connectionRuntime?.update(e.id,s,{phase:"suspect",error:`Direct event WebSocket ${t} timeout.`}),n.terminate())},onStable:()=>{i.reset(),void 0!==s&&this.connectionRuntime?.stable(e.id,s)}});this.sockets.set(e.id,n),this.connectionKeys.set(e.id,t),this.supervisors.set(e.id,r),r.start(),n.on("open",()=>{this.sockets.get(e.id)===n&&(r.opened(),void 0!==s&&this.connectionRuntime?.update(e.id,s,{phase:"handshaking"}))}),n.on("message",t=>{if(this.sockets.get(e.id)!==n)return;let i;try{i=JSON.parse(String(t))}catch{return}if(i&&"object"==typeof i&&!Array.isArray(i)){r.activity(),"healthy"!==r.phase&&(r.healthy(),void 0!==s&&this.connectionRuntime?.connected(e.id,s));const t=i,n="string"==typeof t.type&&t.type.startsWith("node-agent.")?t:{type:"node-agent.event.forwarded",event:t};this.tunnel.handleMessage(e.id,n)}}),n.on("pong",()=>{this.sockets.get(e.id)===n&&(r.pong(),void 0!==s&&this.connectionRuntime?.pong(e.id,s,r.diagnostics()))}),n.on("close",(t,i)=>{this.sockets.get(e.id)===n&&(r.close(),this.sockets.delete(e.id),this.connectionKeys.delete(e.id),this.supervisors.delete(e.id),this.runtimeGenerations.delete(e.id),this.scheduleReconnect(e.id,{generation:s,closeCode:"number"==typeof t?t:void 0,error:Buffer.isBuffer(i)?i.toString("utf8"):String(i||"Direct event WebSocket disconnected.")}))}),n.on("error",()=>{this.sockets.get(e.id)===n&&n.terminate()});try{n.opened();const t=this.service.resolveNodeAgentTransport(e).proxyWebSocket(e,n,"/events?aiSessionTransient=1");n.control(t&&t.ping,t&&t.onPong,t&&t.send),n.sendUpstream(JSON.stringify({v:1,type:"subscribe",aiSessionTransient:{...this.transientDemand.replaySince?{replaySince:this.transientDemand.replaySince}:{},messageDeltas:this.transientDemand.messageDeltas,timelineAllSessions:this.transientDemand.timelineAllSessions,timelineSessions:this.transientDemand.timelineSessions}}))}catch{n.close(1011,"Node event transport failed.")}}scheduleReconnect(e,t={}){const n=this.service.listNodes().find(t=>t.id===e),s=n&&this.nodeEventConnectionKey(n);if(!this.running||!n||!s)return void(void 0!==t.generation&&this.connectionRuntime?.disconnected(e,t.generation,t));const i=this.retries.get(e)??{timer:new am};if(i.timer.pending)return;i.connectionKey=s;const r=i.timer.schedule(()=>{this.running&&!this.sockets.has(e)&&this.connect(n,s)});r&&(this.reconnectAttempts+=1,void 0!==t.generation&&this.connectionRuntime?.disconnected(e,t.generation,{...t,nextRetryAt:new Date(Date.now()+r.delay).toISOString()}),this.logger?.info?.({nodeId:e,attempt:r.attempt,delay:r.delay,reconnectAttempts:this.reconnectAttempts},"session-stream.node-connection.reconnect-scheduled")),this.retries.set(e,i)}nodeEventConnectionKey(e){if(!1===e.connectionEnabled)return;if("reverse-wss"===e.connectionMode)return;const t="control-plane-proxy"===e.connectionMode?e.connectionPath:{endpoint:e.controlEndpoint||e.endpoint,auth:e.auth};return`transport:${e.connectionMode}:${kd(JSON.stringify(t))}`}}function Cm(e=function(){return process.env.TASK_HANDOFF_CONTROL_PLANE_DATA_DIR||t.join(f.homedir(),".config","task-handoff","control-plane")}()){const n=t.resolve(e);return{dataDir:n,settingsPath:t.join(n,"control-plane-settings.json"),projectsDir:t.join(n,"projects"),modelsDir:t.join(n,"models"),imagesDir:t.join(n,"images"),marketDir:t.join(n,"market"),marketCachePath:t.join(n,"market","catalog-cache.json"),marketStatePath:t.join(n,"market","catalog-state.json"),marketMigrationBackupPath:t.join(n,"market","legacy-image-migration-backup.json"),nodesDir:t.join(n,"nodes"),pendingPairingRevokesDir:t.join(n,"pending-pairing-revokes"),chatSessionsDir:t.join(n,"chat-sessions"),chatBridgesDir:t.join(n,"chat-bridges"),triggersDir:t.join(n,"triggers"),proxyAuthorityPath:t.join(n,"control-plane-proxy","authority.json"),identitySigningPath:t.join(n,"control-plane-identity-signing.json"),cloudConnectivityPath:t.join(n,"cloud-connectivity.json"),authUsersDir:t.join(n,"auth-users"),authSessionsDir:t.join(n,"auth-sessions"),aiSessionUnreadDir:t.join(n,"ai-session-unread"),logsDir:t.join(n,"logs")}}var Em,xm,Nm=function(){if(xm)return Em;xm=1;const e=n,{spawnSync:t}=v;return Em={processStartIdentity:function(n,s=process.platform){if(Number.isInteger(n)&&!(n<=0)){if("linux"===s)try{const t=e.readFileSync(`/proc/${n}/stat`,"utf8"),s=t.lastIndexOf(")");if(s<0)return;const i=t.slice(s+2).trim().split(/\s+/)[19];return i?`linux:${i}`:void 0}catch{return}if(["darwin","freebsd","openbsd","aix","sunos"].includes(s)){const e=t("ps",["-o","lstart=","-p",String(n)],{encoding:"utf8",timeout:1e3}),i=0===e.status?e.stdout.trim().replace(/\s+/g," "):"";return i?`${s}:${i}`:void 0}if("win32"===s){const e=t("powershell.exe",["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${n} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`],{encoding:"utf8",timeout:2e3}),s=0===e.status?e.stdout.trim():"";return/^\d+$/.test(s)?`win32:${s}`:void 0}}}}}();class Rm extends Error{code;lockPath;owner;constructor(e,t,n={}){const s=t?.pid?` pid ${t.pid}`:"";super(`${n.label||"Process"} is already running${s}. Lock: ${e}`),this.name="ProcessSingletonError",this.code=n.code||"PROCESS_ALREADY_RUNNING",this.lockPath=e,this.owner=t}}function Om(e){return t.join(e,"owner.json")}function _m(e){return t.join(e,"initializing.json")}function Pm(e){return t.join(e,"recovering.json")}function jm(e){return Number.isInteger(e)&&Number(e)>0}const Dm=function(e){try{const t=JSON.parse(n.readFileSync(Om(e),"utf8"));if(jm(t.pid)&&"string"==typeof t.startTime){const e=t;return{pid:e.pid,hostname:"string"==typeof e.hostname&&e.hostname?e.hostname:f.hostname(),component:e.component||"server-update",command:"string"==typeof e.command?e.command:"",acquiredAt:"string"==typeof e.createdAt&&Number.isFinite(Date.parse(e.createdAt))?e.createdAt:new Date(0).toISOString(),token:"string"==typeof e.token&&e.token?e.token:`legacy:${e.pid}:${e.startTime}`,startIdentity:e.startTime.startsWith("linux:")?e.startTime:`linux:${e.startTime}`}}if(!(jm(t.pid)&&"string"==typeof t.hostname&&t.hostname&&"string"==typeof t.command&&"string"==typeof t.acquiredAt&&Number.isFinite(Date.parse(t.acquiredAt))&&"string"==typeof t.token&&t.token))return;return t}catch{return}};function Mm(e){if(!jm(e))return!1;try{return process.kill(Number(e),0),!0}catch(e){return"EPERM"===e.code}}function Lm(e){if(!e||!Mm(e.pid))return!1;if(!e.startIdentity)return!0;const t=Nm.processStartIdentity(e.pid);return void 0===t||t===e.startIdentity}function qm(e,s){const i=t.join(e,`.owner-${s.token}.tmp`);n.writeFileSync(i,`${JSON.stringify(s,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"});const r=Bm(e);if(r?.token!==s.token)throw Um(i),new Error(`Process lock initialization was superseded: ${e}`);n.renameSync(i,Om(e)),Um(_m(e))}function $m(e,i,r){const o=Dm(e);if(o?.token!==i.token)return!1;const a={...i};for(const[e,t]of Object.entries(r))void 0===t?delete a[e]:Object.assign(a,{[e]:t});const d=t.join(e,`.owner-update-${i.token}-${s.randomUUID()}.tmp`);try{if(n.writeFileSync(d,`${JSON.stringify(a,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"}),Dm(e)?.token!==i.token)return!1;n.renameSync(d,Om(e));for(const e of Object.keys(i))delete i[e];return Object.assign(i,a),!0}catch(e){if("ENOENT"===e.code)return!1;throw e}finally{Um(d)}}function Bm(e){try{return JSON.parse(n.readFileSync(_m(e),"utf8"))}catch{return}}function Fm(e){const t=Bm(e);return jm(t?.pid)&&Lm({pid:t.pid,startIdentity:t.startIdentity})}function Um(e){try{n.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}function Hm(){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,20)}function Wm(e){try{const t=Bm(e),s=Date.parse(t?.startedAt||"");return Number.isFinite(s)?Math.max(0,Date.now()-s):Math.max(0,Date.now()-n.statSync(e).mtimeMs)}catch{return 0}}function Gm(e,i){try{return n.writeFileSync(Pm(e),`${JSON.stringify({token:i,pid:process.pid,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(r){if("EEXIST"===r.code)return!!function(e){const i=Pm(e),r=Vm(i),o=Date.parse(r?.startedAt||"");if(Mm(r?.pid)||Number.isFinite(o)&&Date.now()-o<2e3)return!1;const a=t.join(e,`.recovering-${s.randomUUID()}.stale`);try{n.renameSync(i,a)}catch(e){if(["ENOENT","EEXIST"].includes(e.code||""))return!1;throw e}const d=Vm(a);if(d?.token===r?.token)return Um(a),!0;try{n.linkSync(a,i)}catch(e){if("EEXIST"!==e.code)throw e}finally{Um(a)}return!1}(e)&&Gm(e,i);if("ENOENT"===r.code)return!1;throw r}}function Vm(e){try{return JSON.parse(n.readFileSync(e,"utf8"))}catch{return}}function Km(e,t){return Vm(Pm(e))?.token===t}function Jm(){const e=process.env.TASK_HANDOFF_CONTROL_PLANE_LOCK_PATH?.trim();return e?t.resolve(e):t.join(f.tmpdir(),`task-handoff-control-plane-${process.getuid?.()??"user"}.lock`)}function Ym(e,i={}){return function(e,i={}){n.mkdirSync(t.dirname(e),{recursive:!0});const r=Nm.processStartIdentity(process.pid),o={pid:process.pid,hostname:f.hostname(),command:process.argv.join(" "),acquiredAt:(new Date).toISOString(),token:s.randomUUID(),...void 0!==i.component?{component:i.component}:{},...r?{startIdentity:r}:{},...void 0!==i.dataDir?{dataDir:i.dataDir}:{},...void 0!==i.host?{host:i.host}:{},...void 0!==i.port?{port:i.port}:{},...void 0!==i.instanceId?{instanceId:i.instanceId}:{}};for(let t=0;t<5;t+=1)try{return n.mkdirSync(e),n.writeFileSync(_m(e),`${JSON.stringify({token:o.token,pid:o.pid,startIdentity:o.startIdentity,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),qm(e,o),{lockPath:e,owner:o,updateDetails:t=>$m(e,o,t),release(){const t=Dm(e);t?.token===o.token&&n.rmSync(e,{recursive:!0,force:!0})}}}catch(r){if("EEXIST"!==r.code)throw r;const o=Dm(e);if(Lm(o))throw new Rm(e,o,i.error);if(!o&&(Fm(e)||Wm(e)<(i.incompleteLockStaleMs??2e3))){if(t+1<5){Hm();continue}throw new Rm(e,void 0,i.error)}const a=s.randomUUID();if(!Gm(e,a)){if(t+1<5){Hm();continue}throw new Rm(e,Dm(e),i.error)}const d=Dm(e);if(Lm(d))throw Um(Pm(e)),new Rm(e,d,i.error);if(o?.token&&d?.token!==o.token){Um(Pm(e));continue}if(!Km(e,a))continue;n.rmSync(e,{recursive:!0,force:!0})}const a=Dm(e);throw new Rm(e,a,i.error)}(e,{...i,component:"control-plane",error:{label:"Control plane",code:"CONTROL_PLANE_ALREADY_RUNNING"}})}function Qm(e,t,n){if(function(e,t,n){return"system"===e.type||("chat-bridge"===e.type?function(e,t){return"ai-session"===t.type?["read","send-message","approve","interrupt"].includes(e):"instance"===t.type?["read","start","stop","restart"].includes(e):"read"===e}(t,n):"cloud-account"===e.type?function(e,t){return!["control-plane-settings","secret","chat-bridge"].includes(t.type)&&("node"===t.type?"read"===e:Xm(e,t))}(t,n):"admin"===e.role||("viewer"===e.role?"read"===t:"operator"===e.role&&Xm(t,n)))}(e,t,n))return;const s=new Error(`Actor is not allowed to ${t} ${n.type}${n.id?` ${n.id}`:""}.`);throw Object.assign(s,{statusCode:403,code:"CONTROL_PLANE_FORBIDDEN"}),s}function Xm(e,t){return"read"===e||("instance"===t.type?["create","update","delete","start","stop","restart","proxy"].includes(e):"ai-session"===t.type?["send-message","approve","interrupt"].includes(e):("trigger"===t.type||"runtime"===t.type)&&["create","update","delete"].includes(e))}const Zm=d.z.string().trim().min(1),eg=d.z.object({id:Zm}).strict(),tg=d.z.object({id:Zm,keyId:Zm}).strict(),ng=d.z.object({id:Zm,connectionId:Zm}).strict(),sg=d.z.object({id:Zm,runtimeId:Zm}).strict(),ig=d.z.object({id:Zm,folderId:Zm}).strict(),rg=d.z.object({id:Zm,sessionId:Zm}).strict(),og=d.z.object({id:Zm,sessionId:Zm,turnId:Zm}).strict(),ag=d.z.object({id:Zm,sessionId:Zm,messageId:Zm,attachmentId:Zm}).strict(),dg=d.z.object({id:Zm,sessionId:Zm,queueId:Zm}).strict(),cg=d.z.object({configHash:Zm}).strict(),lg=d.z.object({id:Zm,configHash:Zm}).strict(),pg=d.z.object({id:Zm,sessionId:Zm,configHash:Zm}).strict(),ug=d.z.object({path:d.z.string().optional(),depth:d.z.coerce.number().int().min(0).max(32).optional()}).strict();async function hg(e,t,n){const s=new AbortController,i=()=>s.abort(),r=()=>{t.raw.writableEnded||i()};e.raw.once("aborted",i),t.raw.once("close",r);try{return await n(s.signal)}finally{e.raw.off("aborted",i),t.raw.off("close",r)}}const mg=d.z.object({ids:d.z.array(d.z.string().trim().min(1).max(120)).default([])}).strict(),gg=d.z.object({nodeId:d.z.string().trim().min(1).max(120),modelId:d.z.string().trim().min(1).max(120).optional()}).strict(),yg=d.z.object({progressive:d.z.enum(["true","false"]).optional()}).strict(),fg=d.z.object({source:d.z.object({channel:ro,bridgeId:d.z.string().trim().min(1).max(120).optional(),chatSessionId:d.z.string().trim().min(1).max(240),userId:d.z.string().trim().max(240).optional()}).strict(),action:d.z.discriminatedUnion("type",[d.z.object({type:d.z.literal("ai-session"),index:d.z.number().int().nonnegative()}).strict(),d.z.object({type:d.z.literal("instance-app-menu"),instanceId:d.z.string().trim().min(1).max(120)}).strict(),d.z.object({type:d.z.literal("launch-app"),instanceId:d.z.string().trim().min(1).max(120),appId:d.z.string().trim().min(1).max(120)}).strict(),d.z.object({type:d.z.literal("pending-decision"),routeId:d.z.string().trim().min(1).max(120),decision:d.z.enum(["allow","deny","skip"])}).strict()])}).strict();function Ig(e){const t=fg.parse(e);if(!t.action)throw new Error("Chat gateway action is required.");return{source:t.source,action:t.action}}const bg=d.z.object({path:d.z.string().trim().max(1e3).optional(),depth:d.z.coerce.number().int().min(0).max(2).optional()}).strict(),vg=d.z.object({id:d.z.string().trim().min(1),appId:d.z.string().trim().min(1)}).strict(),Sg=d.z.object({id:d.z.string().trim().min(1),jobId:d.z.string().trim().min(1)}).strict(),wg=d.z.object({projection:d.z.literal("directory").optional(),instanceId:d.z.string().trim().min(1).max(120).optional(),progressive:d.z.enum(["true","false"]).optional()}).strict();const Ag=d.z.object({id:d.z.string().trim().min(1).max(120)}).strict(),zg=d.z.object({nodeId:d.z.string().trim().min(1).max(120),templateId:d.z.string().trim().min(1).max(120)}).strict(),kg=d.z.object({force:d.z.enum(["true","false"]).optional()}).strict(),Tg=d.z.object({projection:d.z.literal("directory").optional()}).strict(),Cg=d.z.object({progressive:d.z.enum(["true","false"]).optional()}).strict();const Eg=d.z.object({cwdFolderId:d.z.string().trim().min(1).max(120).optional()}).strict(),xg=d.z.object({appId:d.z.string().trim().min(1).max(120).default("terminal-tty"),cwdFolderId:d.z.string().trim().min(1).max(120).optional(),options:d.z.record(d.z.string(),d.z.unknown()).default({})}).strict().default({appId:"terminal-tty",options:{}}),Ng=d.z.object({title:d.z.string().trim().min(1).max(120)}).strict(),Rg=d.z.object({token:d.z.string().trim().min(1).max(512)}).strict(),Og=d.z.object({}).strict();function _g(e,t){if(!e)return t;const n=/filename\*=UTF-8''([^;]+)/i.exec(e)?.[1];if(n)try{return decodeURIComponent(n)}catch{}const s=/filename="([^"]+)"/i.exec(e)?.[1];return s||t}async function Pg(e){let t={};if(e.body)try{t=await new Response(e.body).json()}catch{}if(e.status<200||e.status>=300)throw Object.assign(new Error(t.error?.message||`Controlled instance attachment request failed with HTTP ${e.status}.`),{statusCode:e.status,code:t.error?.code||"AI_SESSION_ATTACHMENT_UPLOAD_FAILED"});return t.data}function jg(e,t,n){const s=e.safeParse(t);if(s.success)return s.data;throw Object.assign(new Error(`Controlled instance returned an invalid attachment ${n} response: ${s.error.issues.map(e=>`${e.path.join(".")||"response"}: ${e.message}`).join("; ")}`),{statusCode:502,code:"AI_SESSION_ATTACHMENT_PROTOCOL_INVALID"})}function Dg(e){const{app:t,service:i,events:r,appSessionAggregator:o,aiSessionAggregator:a,aiSessionUnread:c,chatGateway:l,aiSessionAttachments:p,aiSessionAttachmentCache:u,nodeAgentTunnel:h,nodeEventSubscriber:g,errorPayload:y}=e;!function({app:e,service:t,events:n}){e.get("/api/projects",async()=>({data:t.listProjects()})),e.post("/api/projects",async(e,s)=>{const i=t.createProject(e.body);return n.publish("project.created",{projectId:i.id}),s.code(201).send({data:i})}),e.get("/api/projects/:id",async e=>({data:t.requireProject(eg.parse(e.params).id)})),e.patch("/api/projects/:id",async e=>{const s=t.updateProject(eg.parse(e.params).id,e.body);return n.publish("project.updated",{projectId:s.id}),{data:s}}),e.delete("/api/projects/:id",async e=>{const s=eg.parse(e.params).id,i=t.deleteProject(s);return n.publish("project.deleted",{projectId:s,deleted:i}),{data:{deleted:i}}}),e.get("/api/models",async(e,n)=>hg(e,n,async n=>{const s=yg.parse(e.query);return{data:await t.listFederatedModels(n,"true"===s.progressive)}})),e.post("/api/models",async(e,s)=>{const i=await t.createModel(e.body);return n.publish("model.created",{modelId:i.id}),s.code(201).send({data:i})}),e.post("/api/models/discover",async e=>({data:await t.discoverModels(e.body)})),e.post("/api/models/test",async e=>({data:await t.testModel(e.body)})),e.post("/api/models/reorder",async e=>{const s=mg.parse(e.body),i=await t.reorderModels(s.ids);return n.publish("model.reordered",{ids:s.ids}),{data:i}}),e.get("/api/models/:id",async e=>({data:t.requireModel(eg.parse(e.params).id)})),e.patch("/api/models/:id",async e=>{const s=await t.updateModel(eg.parse(e.params).id,e.body);return n.publish("model.updated",{modelId:s.id}),{data:s}}),e.delete("/api/models/:id",async e=>{const s=eg.parse(e.params).id,i=await t.deleteModel(s);return n.publish("model.deleted",{modelId:s,deleted:i}),{data:{deleted:i}}}),e.post("/api/nodes/:nodeId/models",async(e,s)=>{const{nodeId:i}=gg.parse(e.params),r=await t.createNodeModel(i,e.body);return n.publish("model.created",{modelId:r.id,nodeId:i}),s.code(201).send({data:r})}),e.post("/api/nodes/:nodeId/models/discover",async e=>{const{nodeId:n}=gg.parse(e.params);return{data:await t.discoverNodeModels(n,e.body)}}),e.post("/api/nodes/:nodeId/models/test",async e=>{const{nodeId:n}=gg.parse(e.params);return{data:await t.testNodeModel(n,e.body)}}),e.patch("/api/nodes/:nodeId/models/:modelId",async e=>{const{nodeId:s,modelId:i}=gg.parse(e.params),r=await t.updateNodeModel(s,i,e.body);return n.publish("model.updated",{modelId:i,nodeId:s}),{data:r}}),e.delete("/api/nodes/:nodeId/models/:modelId",async e=>{const{nodeId:s,modelId:i}=gg.parse(e.params),r=await t.deleteNodeModel(s,i);return n.publish("model.deleted",{modelId:i,nodeId:s,deleted:r.deleted}),{data:r}}),e.get("/api/market/catalog",async()=>({data:t.getMarketCatalog()})),e.post("/api/market/refresh",async()=>{const e=await t.refreshMarketCatalog();return n.publish("market.catalog.updated",{revision:e.catalog.revision,source:e.catalog.source}),{data:e}}),e.get("/api/image-options",async()=>({data:t.listImageOptions()})),e.get("/api/images",async()=>({data:t.listImages()})),e.post("/api/images",async(e,s)=>{const i=t.createImage(e.body);return n.publish("image.created",{imageId:i.id}),s.code(201).send({data:i})}),e.get("/api/images/:id",async e=>({data:t.requireImage(eg.parse(e.params).id)})),e.patch("/api/images/:id",async e=>{const s=t.updateImage(eg.parse(e.params).id,e.body);return n.publish("image.updated",{imageId:s.id}),{data:s}}),e.delete("/api/images/:id",async e=>{const s=eg.parse(e.params).id,i=await t.deleteImage(s);return n.publish("image.deleted",{imageId:s,deleted:i}),{data:{deleted:i}}})}({app:t,service:i,events:r}),function({app:e,service:t,events:n,nodeAgentTunnel:s,nodeEventSubscriber:i,errorPayload:r}){const o=e=>{if(!e||"object"!=typeof e||Array.isArray(e)||!("target"in e))return;const t=e.target;if(!t||"object"!=typeof t||Array.isArray(t)||"controlled-instance"!==t.component)return;const n=new Error("Independent controlled-instance updates were retired; update the Node rollout instead.");throw Object.assign(n,{statusCode:404,code:"LEGACY_INSTANCE_UPDATE_RETIRED"}),n};e.get("/api/nodes",async e=>({data:"directory"===Tg.parse(e.query).projection?t.listNodes().map(e=>function(e){const t=e.proxyState?.lastError;return rc.parse({id:e.id,name:e.name,status:e.status,health:e.health,connectionMode:e.connectionMode,connectionPhase:e.connectionPhase,lastSeenAt:e.lastSeenAt,observedAt:e.updatedAt,capabilities:Object.keys(e.capabilities).sort(),error:t?{code:t.code,message:"Node connection failed. Use the desktop Control Plane for diagnostics."}:void 0})}(t.projectNodeConnection(e))):t.listPublicNodes()})),e.post("/api/nodes/local/sync",async()=>{const e=await t.syncLocalNodeConnection();return i.syncNow(),n.publish("node.local-synced",{nodeId:e.id}),{data:t.requirePublicNode(e.id)}}),e.post("/api/nodes",async(e,s)=>{const r=await t.createNode(e.body);return i.syncNow(),n.publish("node.created",{nodeId:r.id}),s.code(201).send({data:t.requirePublicNode(r.id)})}),e.post("/api/nodes/:id/check",async e=>{const s=await t.checkNode(eg.parse(e.params).id);return n.publish("node.checked",{nodeId:s.id},{topic:"node.state",scope:{nodeId:s.id}}),{data:s}}),e.get("/api/nodes/:id/updates/jobs",async e=>({data:await t.listNodeUpdateJobs(eg.parse(e.params).id)})),e.get("/api/nodes/:id/settings/external-listener",async e=>({data:await t.getLocalNodeExternalListener(eg.parse(e.params).id)})),e.patch("/api/nodes/:id/settings/external-listener",async e=>{const s=eg.parse(e.params).id,i=await t.updateLocalNodeExternalListener(s,e.body);return n.publish("node.external-listener.updated",{nodeId:s,bindScope:i.bindScope,port:i.port}),{data:i}}),e.post("/api/nodes/:id/updates/check",async e=>{o(e.body);const s=eg.parse(e.params).id,i=await t.checkNodeUpdate(s,Li.parse(e.body));return n.publish("node.update.checked",{nodeId:s,availableVersion:i.availableVersion,impact:i.impact}),{data:i}}),e.post("/api/nodes/:id/updates/apply",async(e,s)=>{o(e.body);const i=eg.parse(e.params).id,r=await t.applyNodeUpdate(i,Bi.parse(e.body));return n.publish("node.update.queued",{nodeId:i,updateJobId:r.id,desiredVersion:r.toVersion,impact:r.impact}),s.code(202).send({data:r})}),e.post("/api/nodes/:id/pairing/invites",async(e,s)=>{const i=eg.parse(e.params),r=await t.createNodePairingInvite(i.id,e.body);return n.publish("node.pairing-invite.created",{nodeId:i.id}),s.code(201).send({data:r})}),e.post("/api/nodes/:id/control-plane-connections",async e=>{const s=eg.parse(e.params),i=await t.connectNodeToControlPlane(s.id,e.body);return n.publish("node.remote-connect.requested",{nodeId:s.id}),{data:i}}),e.get("/api/nodes/:id/control-plane-pairings",async e=>{const n=eg.parse(e.params);return{data:await t.listNodeControlPlanePairings(n.id)}}),e.delete("/api/nodes/:id/control-plane-pairings/:keyId",async e=>{const s=tg.parse(e.params),i=await t.deleteNodeControlPlanePairing(s.id,s.keyId);return n.publish("node.control-plane-pairing.deleted",{nodeId:s.id,keyId:s.keyId}),{data:i}}),e.get("/api/nodes/:id/control-plane-connections",async e=>{const n=eg.parse(e.params);return{data:await t.listNodeControlPlaneConnections(n.id)}}),e.delete("/api/nodes/:id/control-plane-connections/:connectionId",async e=>{const s=ng.parse(e.params),i=await t.deleteNodeControlPlaneConnection(s.id,s.connectionId);return n.publish("node.control-plane-connection.deleted",{nodeId:s.id,connectionId:s.connectionId}),{data:i}}),e.post("/api/node-join/invites",async(e,s)=>{const i=t.createNodeJoinInvite(e.body);return n.publish("node-join.invite.created",{inviteId:i.id}),s.code(201).send({data:i})}),e.post("/api/node-join/complete",{config:em},async(e,s)=>{const r=t.completeNodeJoin(e.body);return i.syncNow(),n.publish("node.joined",{nodeId:r.id}),s.code(201).send({data:t.requirePublicNode(r.id)})}),e.get("/api/nodes/:id/runtimes",async e=>({data:await t.listNodeRuntimes(eg.parse(e.params).id)})),e.post("/api/nodes/:id/runtimes",async(e,s)=>{const i=eg.parse(e.params),r=await t.createNodeRuntime(i.id,e.body);return n.publish("node.runtime.created",{nodeId:i.id,runtimeId:r.id}),s.code(201).send({data:r})}),e.patch("/api/nodes/:id/runtimes/:runtimeId",async e=>{const s=sg.parse(e.params),i=await t.updateNodeRuntime(s.id,s.runtimeId,e.body);return n.publish("node.runtime.updated",{nodeId:s.id,runtimeId:i.id}),{data:i}}),e.delete("/api/nodes/:id/runtimes/:runtimeId",async e=>{const s=sg.parse(e.params),i=await t.deleteNodeRuntime(s.id,s.runtimeId);return n.publish("node.runtime.deleted",{nodeId:s.id,runtimeId:s.runtimeId}),{data:i}}),e.post("/api/nodes/:id/runtimes/:runtimeId/check",async e=>{const s=sg.parse(e.params),i=await t.checkNodeRuntime(s.id,s.runtimeId);return n.publish("node.runtime.checked",{nodeId:s.id,runtimeId:i.id}),{data:i}}),e.get("/api/nodes/:id/docker/images",async e=>({data:await t.listNodeDockerImages(eg.parse(e.params).id)})),e.get("/api/nodes/:id/image-options",async e=>({data:await t.listNodeImageAvailability(eg.parse(e.params).id)})),e.get("/api/nodes/:id/local-folders",async(e,n)=>hg(e,n,async n=>({data:await t.listNodeLocalFolders(eg.parse(e.params).id,n)}))),e.get("/api/nodes/:id/folders/places",async e=>({data:await t.listNodeFolderPlaces(eg.parse(e.params).id)})),e.get("/api/nodes/:id/folders/tree",async e=>{const n=eg.parse(e.params),s=ug.parse(e.query);return{data:await t.listNodeFolderTree(n.id,{path:s.path,depth:s.depth})}}),e.post("/api/nodes/:id/local-folders",async(e,s)=>{const i=eg.parse(e.params),r=await t.createNodeLocalFolder(i.id,e.body);return n.publish("node.local-folder.created",{nodeId:i.id,folderId:r.id}),s.code(201).send({data:r})}),e.patch("/api/nodes/:id/local-folders/:folderId",async e=>{const s=ig.parse(e.params),i=await t.updateNodeLocalFolder(s.id,s.folderId,e.body);return n.publish("node.local-folder.updated",{nodeId:s.id,folderId:s.folderId}),{data:i}}),e.delete("/api/nodes/:id/local-folders/:folderId",async e=>{const s=ig.parse(e.params),i=await t.deleteNodeLocalFolder(s.id,s.folderId);return n.publish("node.local-folder.deleted",{nodeId:s.id,folderId:s.folderId}),{data:i}}),e.get("/api/nodes/:id",async e=>({data:t.requirePublicNode(eg.parse(e.params).id)})),e.patch("/api/nodes/:id",async e=>{const r=t.updateNode(eg.parse(e.params).id,e.body);return r.connectionEnabled||s.disconnect(r.id),i.syncNow(),n.publish("node.updated",{nodeId:r.id}),{data:t.requirePublicNode(r.id)}}),e.delete("/api/nodes/:id",async e=>{const s=eg.parse(e.params).id,r=kg.parse(e.query),o=await t.deleteNodeWithProxyLifecycle(s,"true"===r.force);return i.syncNow(),n.publish("node.deleted",{nodeId:s,deleted:o.deleted,revoke:o.revoke}),{data:o}}),e.get("/api/node-runtimes",async(e,n)=>hg(e,n,async n=>{const s=Cg.parse(e.query),i=await t.listNodeRuntimesWithDiagnostics(n,"true"===s.progressive);return{data:i.items,meta:{nodeErrors:i.nodeErrors,nodeStates:i.nodeStates}}})),function(e){const{app:t,service:n,nodeAgentTunnel:s,errorPayload:i}=e,r=new um(s),o=e=>{if(!1===e.connectionEnabled){const e=new Error("Node agent connection is disabled locally.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_CONNECTION_DISABLED"}),e}};t.get(Ad,{websocket:!0,config:sm},(e,t)=>{try{const s=bm.parse(t.query),i=n.requireNode(s.nodeId);Am(i,t),o(i),r.attachMain(i.id,e)}catch(t){const n=i(t);e.send(JSON.stringify({type:"control-plane.error",code:n.code,message:n.message})),e.close(1008,n.message)}}),t.get(`${Ad}/streams/:streamId`,{websocket:!0,config:sm},(e,t)=>{try{const s=bm.parse(t.query),i=n.requireNode(s.nodeId);Am(i,t),o(i);const a=t.params.streamId;r.attachAuxiliary(i.id,a,e)}catch(t){const n=i(t);e.close(1008,n.message)}}),t.get(`${Ad}/channels/:channelId`,{websocket:!0,config:sm},(e,t)=>{try{const s=bm.parse(t.query),i=n.requireNode(s.nodeId);Am(i,t),o(i);const a=t.params.channelId;r.attachAuxiliary(i.id,a,e)}catch(t){const n=i(t);e.close(1008,n.message)}}),t.get(`${Ad}/http-streams/:streamId`,{websocket:!0,config:sm},(e,t)=>{try{const s=bm.parse(t.query),i=n.requireNode(s.nodeId);Am(i,t),o(i);const a=t.params.streamId;r.attachAuxiliary(i.id,a,e)}catch(t){const n=i(t);e.close(1008,n.message)}})}({app:e,service:t,nodeAgentTunnel:s,errorPayload:r})}({app:t,service:i,events:r,nodeAgentTunnel:h,nodeEventSubscriber:g,errorPayload:y}),function({app:e,service:t,events:n}){e.get("/api/controlled-instances",async()=>({data:await t.listControlledInstances()})),e.post("/api/controlled-instances",async(e,s)=>{const i=await t.createControlledInstance(e.body);return n.publish("instance.created",{instanceId:i.id}),s.code(201).send({data:i})}),e.get("/api/controlled-instances/:id",async e=>({data:await t.requireControlledInstance(eg.parse(e.params).id)})),e.get("/api/controlled-instances/:id/metrics",async e=>({data:await t.instanceResourceMetrics(eg.parse(e.params).id)})),e.get("/api/controlled-instances/:id/apps/management",async e=>({data:await t.instanceAppManagement(eg.parse(e.params).id)})),e.post("/api/controlled-instances/:id/apps/:appId/install",async e=>{const n=vg.parse(e.params),s=Ei.parse(e.body||{});return{data:await t.requestInstanceAppOperation(n.id,n.appId,"install",s)}}),e.post("/api/controlled-instances/:id/apps/:appId/uninstall",async e=>{const n=vg.parse(e.params),s=Ei.parse(e.body||{});return{data:await t.requestInstanceAppOperation(n.id,n.appId,"uninstall",s)}}),e.get("/api/controlled-instances/:id/apps/jobs/:jobId",async e=>{const n=Sg.parse(e.params);return{data:await t.instanceAppManagementJob(n.id,n.jobId)}}),e.patch("/api/controlled-instances/:id",async e=>{const s=await t.updateControlledInstance(eg.parse(e.params).id,e.body);return n.publish("instance.updated",{instanceId:s.id}),{data:s}}),e.delete("/api/controlled-instances/:id",async e=>{const s=eg.parse(e.params).id,i=await t.deleteControlledInstance(s,ii.parse(e.body));return i.completed&&n.publish("instance.deleted",{instanceId:s,result:i}),{data:i}}),e.post("/api/controlled-instances/:id/start",async e=>{const s=await t.startControlledInstance(eg.parse(e.params).id);return n.publish("instance.started",{instanceId:s.id}),{data:s}}),e.post("/api/controlled-instances/:id/stop",async e=>{const s=await t.stopControlledInstance(eg.parse(e.params).id);return n.publish("instance.stopped",{instanceId:s.id}),{data:s}}),e.post("/api/controlled-instances/:id/restart",async e=>{const s=await t.restartControlledInstance(eg.parse(e.params).id);return n.publish("instance.restarted",{instanceId:s.id}),{data:s}}),e.post("/api/controlled-instances/:id/image-provisioning/retry",async e=>{const s=await t.retryControlledInstanceImageProvisioning(eg.parse(e.params).id);return n.publish("instance.image-provisioning-retried",{instanceId:s.id}),{data:s}}),e.get("/api/controlled-instances/:id/config-sync",async e=>({data:await t.instanceConfigSyncState(eg.parse(e.params).id)})),e.get("/api/controlled-instances/:id/config-sync/folders",async e=>({data:await t.listInstanceConfigSyncFolders(eg.parse(e.params).id,bg.parse(e.query))})),e.post("/api/controlled-instances/:id/config-sync",async e=>{const s=eg.parse(e.params).id,i=await t.syncInstanceConfigs(s,e.body);return n.publish("instance.config-synced",{instanceId:s}),{data:i}}),e.get("/api/instance-board",async(e,n)=>hg(e,n,async n=>{const s=wg.parse(e.query),i=await t.boardWithDiagnostics(n,"true"===s.progressive);return{data:(s.instanceId?i.items.filter(e=>e.id===s.instanceId):i.items).map(e=>"directory"===s.projection?function(e){const t=e.runtimeVersion?.error,n=e.imageProvisioning?.error,s=e.workspace.error,i=t?{code:t.code,message:"Instance runtime convergence failed. Use the desktop Control Plane for diagnostics."}:n?{code:"IMAGE_PROVISIONING_FAILED",message:"Instance image provisioning failed. Use the desktop Control Plane for diagnostics."}:s?{code:"WORKSPACE_FAILED",message:"Instance workspace preparation failed. Use the desktop Control Plane for diagnostics."}:void 0,r=e.node?.capabilities.agent,o=r&&"object"==typeof r&&!Array.isArray(r)?r:void 0,a="string"==typeof o?.protocolVersion?o.protocolVersion:void 0,d=!a||a===ks,c=[e.protocolCompatible?void 0:`Instance protocol ${e.protocolVersion||"unknown"} differs from this Control Plane.`,d?void 0:`Node protocol ${a} differs from this Control Plane.`].filter(e=>Boolean(e)),l="running"===e.status||"online"===e.connectionStatus||"reachable"===e.access.status,p=!["failed","stopped","stopping","unhealthy"].includes(e.status)&&"online"!==e.connectionStatus&&["provisioning","starting","registering","registered"].includes(e.status),u=[l||["provisioning","starting","registering","registered","stopping"].includes(e.status)?void 0:"start",["failed","stopped","stopping","unhealthy"].includes(e.status)||!l&&!p?void 0:"stop",l?"restart":void 0,"failed"===e.status&&"failed"===e.imageProvisioning?.phase?"retry-image":void 0].filter(e=>Boolean(e));return ac.parse({id:e.id,name:e.name,nodeId:e.nodeId,status:e.status,health:e.health,connectionStatus:e.connectionStatus,ready:e.ready,capabilities:{aiSessionTimeline:e.capabilities.features.aiSessionTimeline,aiSessionConversationAttachments:e.capabilities.features.aiSessionConversationAttachments},config:{defaultCodexPermissionMode:e.config.defaultCodexPermissionMode},lastHeartbeatAt:e.lastHeartbeatAt,heartbeatAgeMs:e.heartbeatAgeMs,observedAt:e.updatedAt,runtime:{id:e.runtimeId,name:e.runtime?.name,type:e.runtime?.type},workspace:{status:e.workspace.status,path:e.workspace.path},protocol:{version:e.protocolVersion,compatible:e.protocolCompatible&&d,warning:c.length?c.join(" "):void 0},aiSessions:e.aiSessions,availableActions:u,availableApps:(e.appInventory?.items||[]).filter(e=>"available"===e.availability).map(e=>({id:e.id,name:e.name,kind:e.kind,supportsCwdSelection:e.capabilities.supportsCwdSelection})),availableAgents:(e.appInventory?.items||[]).filter(e=>"available"===e.availability&&("codex"===e.id||"claude"===e.id)).map(e=>({id:e.id,name:e.name,kind:e.kind,supportsCwdSelection:e.capabilities.supportsCwdSelection})),error:i})}(e):e),meta:{nodeErrors:i.nodeErrors,nodeStates:i.nodeStates}}}))}({app:t,service:i,events:r}),function(e,t,n){e.get("/api/nodes/:id/environment-templates",async e=>({data:await t.listEnvironmentTemplates(Ag.parse(e.params).id)})),e.get("/api/nodes/:nodeId/environment-templates/:templateId",async e=>{const n=zg.parse(e.params);return{data:await t.getEnvironmentTemplate(n.nodeId,n.templateId)}}),e.post("/api/controlled-instances/:id/environment-templates",async(e,s)=>{const i=Ag.parse(e.params).id,r=await t.createEnvironmentTemplate(i,e.body);return n.publish("environment-template.updated",{templateId:r.id,nodeId:r.nodeId,status:r.status}),s.code(201).send({data:r})}),e.delete("/api/nodes/:nodeId/environment-templates/:templateId",async e=>{const s=zg.parse(e.params),i=await t.deleteEnvironmentTemplate(s.nodeId,s.templateId);return n.publish("environment-template.deleted",i),{data:i}})}(t,i,r),function({app:e,service:t,events:i,appSessionAggregator:r,aiSessionAggregator:o,aiSessionUnread:a,aiSessionAttachments:c,aiSessionAttachmentCache:l}){e.get("/api/app-sessions",async e=>{const t=d.z.object({refresh:d.z.string().optional(),instanceId:d.z.string().trim().min(1).optional(),streamId:d.z.string().trim().min(1).optional(),sinceRevision:d.z.string().optional()}).parse(e.query||{});if(void 0!==t.sinceRevision){const e=Number(t.sinceRevision);if(!Number.isInteger(e)||e<0){const e=new Error("sinceRevision must be a non-negative integer.");throw Object.assign(e,{statusCode:400,code:"APP_SESSION_DELTA_INVALID"}),e}if(!t.streamId){const e=new Error("streamId is required with sinceRevision.");throw Object.assign(e,{statusCode:400,code:"APP_SESSION_DELTA_INVALID"}),e}return{data:await r.delta({instanceId:t.instanceId,streamId:t.streamId,sinceRevision:e})}}const n=await r.list({refresh:"true"===t.refresh||"1"===t.refresh});return{data:t.instanceId?{...n,instances:n.instances.filter(e=>e.instanceId===t.instanceId)}:n}}),e.post("/api/controlled-instances/:id/apps/sessions",async e=>{const n=eg.parse(e.params),s=xg.parse(e.body),r=await t.launchAppSession(n.id,s.appId,{...s.options,...s.cwdFolderId?{cwdFolderId:s.cwdFolderId}:{}});return i.publish("instance.app-session.launched",{instanceId:n.id,sessionId:"string"==typeof r.id?r.id:void 0,appId:s.appId}),{data:r}}),e.post("/api/controlled-instances/:id/apps/sessions/:sessionId/stop",async e=>{const n=rg.parse(e.params),s=await t.stopAppSession(n.id,n.sessionId);return i.publish("instance.app-session.stopped",{instanceId:n.id,sessionId:n.sessionId}),{data:s}}),e.patch("/api/controlled-instances/:id/apps/sessions/:sessionId",async e=>{const n=rg.parse(e.params),s=Ng.parse(e.body),r=await t.renameAppSession(n.id,n.sessionId,s.title);return i.publish("instance.app-session.renamed",{instanceId:n.id,sessionId:n.sessionId,title:s.title}),{data:r}}),e.post("/api/controlled-instances/:id/apps/sessions/:sessionId/access",async e=>{const n=rg.parse(e.params);Og.parse(e.body||{});const s=await t.createAppSessionAccessToken({instanceId:n.id,sessionId:n.sessionId});return{data:{mode:s.mode,url:`/apps/access/${s.mode}?token=${encodeURIComponent(s.token)}`,token:s.token,expiresAt:s.expiresAt}}}),e.delete("/api/controlled-instances/:id/apps/sessions/:sessionId/access",async e=>{const n=rg.parse(e.params),s=Rg.parse(e.body||{});return t.revokeAppSessionAccessToken(s.token,{instanceId:n.id,sessionId:n.sessionId}),{data:{revoked:!0}}}),e.get("/api/controlled-instances/:id/app-sessions",async e=>{const t=eg.parse(e.params),n=(await r.list()).instances.find(e=>e.instanceId===t.id);return{data:n?.appSessions||{runningCount:0,problemCount:0,sessions:[],updatedAt:(new Date).toISOString()}}}),e.get("/api/controlled-instances/:id/ai-sessions/history",async e=>{const n=eg.parse(e.params);return{data:await t.listAiSessionHistory(n.id)}}),e.get("/api/controlled-instances/:id/ai-sessions/history/:sessionId",async e=>{const n=rg.parse(e.params);return{data:await t.getAiSessionHistoryDetail(n.id,n.sessionId)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId",async e=>{const n=rg.parse(e.params);return{data:await t.getAiSessionDetail(n.id,n.sessionId)}}),e.post("/api/controlled-instances/:id/ai-session-attachments/drafts",{bodyLimit:22020096},async(e,n)=>{const i=eg.parse(e.params),r=H.parse(e.query),o=`cia_${s.randomUUID().replace(/-/g,"").slice(0,24)}`,a="/api/ai-session-attachments/draft-streams",d=new AbortController,p=()=>d.abort();e.raw.once("aborted",p),n.raw.once("close",p);const u=l.beginBestEffortWrite({instanceId:i.id,scopeType:r.scopeType,scopeId:r.scopeId,attachmentId:o,kind:r.kind,name:r.name,mime:r.mime,size:r.size,cacheUntil:Date.now()+864e5});let h=0;try{const s=jg(V,await Pg(await t.proxyInstanceHttp(i.id,a,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(G.parse({attachmentId:o,...r})),signal:d.signal})),"start");if(s.attachmentId!==o||0!==s.offset)throw Object.assign(new Error("Controlled instance returned an invalid attachment upload offset."),{statusCode:502,code:"AI_SESSION_ATTACHMENT_OFFSET_MISMATCH"});for await(const n of e.body){const e=Buffer.isBuffer(n)?n:Buffer.from(n);for(let n=0;n<e.length;n+=O){const s=e.subarray(n,Math.min(n+O,e.length));u?.offer(s);const r=jg(V,await Pg(await t.proxyInstanceHttp(i.id,`${a}/${encodeURIComponent(o)}?offset=${h}`,{method:"PUT",headers:{"content-type":"application/octet-stream","content-length":String(s.length)},body:s,signal:d.signal})),"chunk"),c=h+s.length;if(r.attachmentId!==o||r.offset!==c)throw Object.assign(new Error("Controlled instance returned an invalid attachment upload offset."),{statusCode:502,code:"AI_SESSION_ATTACHMENT_OFFSET_MISMATCH"});h=r.offset}}const c=jg(K,await Pg(await t.proxyInstanceHttp(i.id,`${a}/${encodeURIComponent(o)}/complete`,{method:"POST",headers:{"content-type":"application/json"},body:"{}",signal:d.signal})),"completion");return u?.finish(),n.code(201).send({data:c})}catch(s){if(u?.abort(),t.proxyInstanceHttp(i.id,`${a}/${encodeURIComponent(o)}`,{method:"DELETE"}).catch(()=>{}),0===h&&s&&"object"==typeof s&&"statusCode"in s&&404===s.statusCode&&(!("code"in s)||"AI_SESSION_NOT_FOUND"!==s.code)){const t=[];let s=0;for await(const n of e.body){const e=Buffer.isBuffer(n)?n:Buffer.from(n);if(s+=e.length,s>r.size)throw Object.assign(new Error("Attachment content exceeded its declared size."),{statusCode:400,code:"AI_SESSION_ATTACHMENT_SIZE_MISMATCH"});t.push(e)}if(s!==r.size)throw Object.assign(new Error("Attachment content did not match its declared size."),{statusCode:400,code:"AI_SESSION_ATTACHMENT_SIZE_MISMATCH"});return n.code(201).send({data:c.upload({instanceId:i.id,sessionId:r.scopeId,kind:r.kind,name:r.name,mime:r.mime,data:Buffer.concat(t).toString("base64")})})}throw s}finally{e.raw.off("aborted",p),n.raw.off("close",p)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/messages/:messageId/attachments/:attachmentId/content",async(e,s)=>{const i=ag.parse(e.params),r=l.get({instanceId:i.id,sessionId:i.sessionId,messageId:i.messageId,attachmentId:i.attachmentId});if(r)return s.header("Content-Type",r.mime),s.header("Content-Length",String(r.size)),r.etag&&s.header("ETag",r.etag),s.header("Cache-Control","private, max-age=0, must-revalidate"),s.header("X-Content-Type-Options","nosniff"),s.header("Accept-Ranges","none"),s.header("Content-Disposition",r.disposition||`${"image"===r.kind?"inline":"attachment"}; filename*=UTF-8''${encodeURIComponent(r.name)}`),r.etag&&e.headers["if-none-match"]===r.etag?s.code(304).send():s.send(n.createReadStream(r.path));const o=new AbortController;s.raw.once("close",()=>o.abort());const a=await t.proxyInstanceHttp(i.id,`/api/ai-sessions/${encodeURIComponent(i.sessionId)}/messages/${encodeURIComponent(i.messageId)}/attachments/${encodeURIComponent(i.attachmentId)}/content`,{method:"GET",signal:o.signal}),d=a.headers["x-task-handoff-attachment-cache-until"],c=a.headers["x-task-handoff-attachment-size"];for(const[e,t]of Object.entries(a.headers))["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","x-task-handoff-attachment-cache-until","x-task-handoff-attachment-size"].includes(e.toLowerCase())||s.header(e,t);if(!a.body)return s.code(a.status).send();const p=m.Readable.fromWeb(a.body),u=Number(c||a.headers["content-length"]);200===a.status&&Number.isInteger(u)&&u>0&&s.header("Content-Length",String(u));const h=Number(d),g=a.headers["content-type"]||"application/octet-stream",y=a.headers["content-disposition"],f=200===a.status&&Number.isInteger(u)&&u>0&&Number.isFinite(h)?l.beginBestEffortWrite({instanceId:i.id,scopeType:"session",scopeId:i.sessionId,attachmentId:i.attachmentId,sessionId:i.sessionId,messageId:i.messageId,kind:J(g)?"image":"file",name:_g(y,i.attachmentId),mime:g,size:u,...y?{disposition:y}:{},...a.headers.etag?{etag:a.headers.etag}:{},cacheUntil:h}):void 0,I=new m.Transform({transform(e,t,n){f?.offer(e),n(null,e)},flush(e){f?.finish(),e()}});return s.raw.once("close",()=>{p.destroy(),p.readableEnded||f?.abort()}),s.code(a.status).send(p.pipe(I))}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/timeline",async e=>{const n=rg.parse(e.params);return{data:await t.getAiSessionTimeline(n.id,n.sessionId)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/turns/:turnId/timeline",async e=>{const n=og.parse(e.params);return{data:await t.getAiSessionTurnTimeline(n.id,n.sessionId,n.turnId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/resume",async e=>{const n=rg.parse(e.params);Og.parse(e.body||{});const s=await t.resumeAiSession(n.id,n.sessionId);return i.publish("instance.ai-session.resumed",{instanceId:n.id,sessionId:s.aiSessionId,providerSessionId:s.providerSessionId,appSessionId:s.appSessionId,disposition:s.disposition}),{data:s}}),e.get("/api/controlled-instances/:id/ai-sessions/workspace",async e=>{const n=eg.parse(e.params),s=Eg.parse(e.query||{});return{data:await t.inspectAiSessionWorkspace(n.id,s.cwdFolderId)}}),e.post("/api/controlled-instances/:id/ai-sessions",async e=>{const n=eg.parse(e.params),s=Be.parse(e.body||{}),r=s.attachments.filter(e=>"upload-ref"!==e.source.type||!e.id.startsWith("cia_")),o=c.resolveRefs(r,n.id,s.clientRequestId),a=new Map(o.map(e=>[e.id,e])),d=s.attachments.map(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")?e:a.get(e.id)).filter(Boolean),p=await t.createAiSession(n.id,{...s,attachments:d}),u=new Set(s.attachments.filter(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")).map(e=>e.id));if(u.size){const e=(await t.requireControlledInstance(n.id,!0)).config.aiSessionAttachmentRetentionDays??30;t.getAiSessionDetail(n.id,p.aiSessionId).then(t=>{const i=t.turns?.flatMap(e=>e.userMessages||[]).find(e=>e.attachments.some(e=>u.has(e.id)))?.id;if(i)for(const t of u)l.bind({instanceId:n.id,attachmentId:t,scopeId:s.clientRequestId,sessionId:p.aiSessionId,messageId:i,cacheUntil:Date.now()+24*e*60*60*1e3})}).catch(()=>{})}return i.publish("instance.ai-session.created",{instanceId:n.id,sessionId:p.aiSessionId,providerSessionId:p.providerSessionId,clientRequestId:s.clientRequestId}),{data:p}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/open-app",async e=>{const n=rg.parse(e.params),s=Ge.parse(e.body||{}),r=await t.openAiSessionApp(n.id,n.sessionId,s.clientRequestId);return i.publish("instance.ai-session.app-opened",{instanceId:n.id,sessionId:n.sessionId,appSessionId:r.appSessionId}),{data:r}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/fork",async e=>{const n=rg.parse(e.params),s=He.parse(e.body||{}),r=await t.forkAiSession(n.id,n.sessionId,s);return i.publish("instance.ai-session.forked",{instanceId:n.id,sourceSessionId:n.sessionId,sessionId:r.aiSessionId,providerSessionId:r.providerSessionId,clientRequestId:s.clientRequestId}),{data:r}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/close",async e=>{const n=rg.parse(e.params),s=Ke.parse(e.body||{}),r=await t.closeAiSession(n.id,n.sessionId,s.clientRequestId);return i.publish("instance.ai-session.closed",{instanceId:n.id,sessionId:n.sessionId,providerSessionId:r.providerSessionId}),{data:r}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/messages",async(e,n)=>{const s=performance.now(),r=function(e,t){const n=Array.isArray(e)?e[0]:e,s="string"==typeof n?n.trim():"";return/^[A-Za-z0-9._:-]{1,128}$/.test(s)?s:t}(e.headers[ba],String(e.id));let o;const a=t=>{const i=performance.now()-s,a=Sa(o?.serverTiming,va("control_plane",i));n.header(ba,r),n.header("server-timing",a),e.log.info({traceId:r,instanceId:e.params.id,sessionId:e.params.sessionId,outcome:t,controlPlaneMs:i,nodeTransportMs:o?.nodeTransportMs,serverTiming:a},"AI session message request timing")},d=rg.parse(e.params),p=Me.parse(e.body||{}),u=p.attachments.filter(e=>"upload-ref"!==e.source.type||!e.id.startsWith("cia_")),h=c.resolveRefs(u,d.id,d.sessionId),m=new Map(h.map(e=>[e.id,e])),g=p.attachments.map(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")?e:m.get(e.id)).filter(Boolean);let y;try{y=await t.sendAiSessionMessage(d.id,d.sessionId,p.message,p.mode,g,p.references,p.permissionMode,{traceId:r,onTiming:e=>{o=e}})}catch(e){throw a("failed"),e}const f=new Set(p.attachments.filter(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")).map(e=>e.id)),I=y.session.turns?.flatMap(e=>e.userMessages||[]).find(e=>e.attachments.some(e=>f.has(e.id)))?.id||y.session.queue.items.find(e=>e.id===y.queueId)?.messageId;if(f.size&&I){const e=(await t.requireControlledInstance(d.id,!0)).config.aiSessionAttachmentRetentionDays??30,n=Date.now()+24*e*60*60*1e3;for(const e of f)l.bind({instanceId:d.id,attachmentId:e,scopeId:d.sessionId,sessionId:d.sessionId,messageId:I,cacheUntil:n})}return i.publish("instance.ai-session.message-sent",{instanceId:d.id,sessionId:d.sessionId}),a("completed"),{data:y}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/mentions",async e=>{const n=rg.parse(e.params);return{data:await t.aiSessionMentionCatalog(n.id,n.sessionId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/mentions/files",async e=>{const n=rg.parse(e.params),s=_e.parse(e.body||{});return{data:await t.searchAiSessionMentionFiles(n.id,n.sessionId,s.query)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/commands",async e=>{const n=rg.parse(e.params),s=ze.parse(e.body||{}),r=await t.executeAiSessionCommand(n.id,n.sessionId,s);return i.publish("instance.ai-session.command-executed",{instanceId:n.id,sessionId:n.sessionId,command:s.command}),{data:r}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/queue",async e=>{const n=rg.parse(e.params);return{data:await t.aiSessionQueue(n.id,n.sessionId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId/steer",async e=>{const n=dg.parse(e.params),s=await t.steerAiSessionQueuedMessage(n.id,n.sessionId,n.queueId);return i.publish("instance.ai-session.message-sent",{instanceId:n.id,sessionId:n.sessionId}),{data:s}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId/retry",async e=>{const n=dg.parse(e.params);return{data:await t.retryAiSessionQueuedMessage(n.id,n.sessionId,n.queueId)}}),e.delete("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId",async e=>{const n=dg.parse(e.params);return{data:await t.removeAiSessionQueuedMessage(n.id,n.sessionId,n.queueId)}}),e.patch("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId",async e=>{const n=dg.parse(e.params),s=Xe.parse(e.body||{});return{data:await t.editAiSessionQueuedMessage(n.id,n.sessionId,n.queueId,s)}}),e.patch("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/reorder",async e=>{const n=rg.parse(e.params),s=Qe.parse(e.body||{});return{data:await t.reorderAiSessionQueuedMessages(n.id,n.sessionId,s)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/interrupt",async e=>{const n=rg.parse(e.params),s=await t.interruptAiSession(n.id,n.sessionId);return i.publish("instance.ai-session.interrupted",{instanceId:n.id,sessionId:n.sessionId}),{data:s}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/approval",async e=>{const n=rg.parse(e.params),s=Ye.parse(e.body||{}),r=await t.resolveAiSessionApproval(n.id,n.sessionId,s.decision);return i.publish("instance.ai-session.approval-resolved",{instanceId:n.id,sessionId:n.sessionId,decision:s.decision}),{data:r}}),e.get("/api/ai-sessions",async(e,t)=>{const n=e.query;if(void 0!==n.sinceRevision){const e=Number(n.sinceRevision);if(!Number.isInteger(e)||e<0)return t.code(400).send({error:"invalid_since_revision"});try{return n.streamId?{data:await o.delta({instanceId:n.instanceId,streamId:n.streamId,sinceRevision:e})}:t.code(400).send({error:"stream_id_required"})}catch(e){if("AI_SESSION_DELTA_INSTANCE_ID_REQUIRED"===e.message)return t.code(400).send({error:"instance_id_required"});throw e}}const s=await o.list({refresh:"true"===n.refresh||"1"===n.refresh}),i=n.instanceId?{...s,instances:s.instances.filter(e=>e.instanceId===n.instanceId)}:s;for(const e of i.instances)a.reconcile(e.instanceId,e.aiSessions);return{data:{...i,instances:i.instances.map(e=>({...e,aiSessions:a.decorate(e.instanceId,e.aiSessions)}))}}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/read",async(e,t)=>{const n=rg.parse(e.params),s=d.z.object({sessionUpdatedAt:d.z.string().datetime()}).strict().parse(e.body||{}),r=(await o.list()).instances.find(e=>e.instanceId===n.id),c=r?.aiSessions.sessions.find(e=>e.id===n.sessionId);if(!r||!c)return t.code(404).send({error:{code:"AI_SESSION_NOT_FOUND",message:"AI session was not found."}});a.reconcile(n.id,r.aiSessions);const l=a.markRead(n.id,n.sessionId,s.sessionUpdatedAt);return l?(i.publish(q,l,{topic:"ai.sessions",scope:{instanceId:n.id,sessionId:n.sessionId}}),{data:l}):t.code(404).send({error:{code:"AI_SESSION_NOT_FOUND",message:"AI session was not found."}})})}({app:t,service:i,events:r,appSessionAggregator:o,aiSessionAggregator:a,aiSessionUnread:c,aiSessionAttachments:p,aiSessionAttachmentCache:u}),function({app:e,service:t,events:n}){e.get("/api/triggers",async()=>({data:await t.listTriggers()})),e.post("/api/triggers",async(e,s)=>{const i=t.createTrigger(e.body);return n.publish("trigger.created",{configHash:i.configHash}),s.code(201).send({data:i})}),e.put("/api/triggers/:configHash",async e=>{const s=cg.parse(e.params),i=await t.updateTrigger(s.configHash,e.body);return n.publish("trigger.updated",{previousConfigHash:s.configHash,configHash:i.trigger.configHash}),{data:i}}),e.delete("/api/triggers/:configHash",async e=>{const s=cg.parse(e.params),i=await t.deleteTrigger(s.configHash);return n.publish("trigger.deleted",{configHash:s.configHash}),{data:i}}),e.post("/api/triggers/:configHash/apply",async e=>{const s=cg.parse(e.params),i=await t.applyTrigger(s.configHash,e.body||{});return n.publish("trigger.applied",{configHash:s.configHash}),{data:i}}),e.get("/api/controlled-instances/:id/triggers",async e=>{const n=eg.parse(e.params);return{data:await t.listInstanceTriggers(n.id)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/triggers",async e=>{const s=rg.parse(e.params),i=await t.bindAiSessionTrigger(s.id,s.sessionId,e.body||{});return n.publish("trigger.deployment.bound",{instanceId:s.id,sessionId:s.sessionId},{topic:"triggers",scope:{instanceId:s.id}}),{data:i}}),e.delete("/api/controlled-instances/:id/ai-sessions/:sessionId/triggers/:configHash",async e=>{const s=pg.parse(e.params),i=await t.unbindAiSessionTrigger(s.id,s.sessionId,s.configHash);return n.publish("trigger.deployment.unbound",{instanceId:s.id,sessionId:s.sessionId,configHash:s.configHash},{topic:"triggers",scope:{instanceId:s.id}}),{data:i}}),e.post("/api/controlled-instances/:id/triggers/:configHash/run",async e=>{const s=lg.parse(e.params),i=await t.runInstanceTrigger(s.id,s.configHash,e.body||{});return n.publish("trigger.run.requested",{instanceId:s.id,configHash:s.configHash},{topic:"triggers",scope:{instanceId:s.id}}),{data:i}})}({app:t,service:i,events:r}),function({app:e,service:t,chatGateway:n}){e.get("/api/chat/sessions",async()=>({data:t.listChatSessions()})),e.get("/api/chat/sessions/:id",async e=>({data:t.requireChatSession(eg.parse(e.params).id)})),e.get("/api/chat-gateway/status",async()=>({data:n.status()})),e.post("/api/chat-gateway/poll-ai-sessions",async()=>({data:await n.pollAiSessionsNow()})),e.get("/api/chat-gateway/bridges",async()=>({data:t.listChatBridges()})),e.post("/api/chat-gateway/bridges",async e=>({data:t.createChatBridge(e.body)})),e.patch("/api/chat-gateway/bridges/:id",async s=>{const i=eg.parse(s.params).id,r=t.requireChatBridge(i),o=Nc.parse(s.body),a=t.updateChatBridge(i,s.body),d="boolean"==typeof o.enabled?o.enabled:void 0;return e.log.info({component:"control-plane-chat-gateway",action:"bridge-patch",bridgeId:i,hasEnabled:void 0!==d,requestedEnabled:d,previousEnabled:r.enabled,updatedEnabled:t.requireChatBridge(i).enabled},"chat gateway bridge state changed"),void 0!==d&&d!==r.enabled&&(d?n.startBridge(i):n.stopBridge(i)),{data:a}}),e.post("/api/chat-gateway/bridges/:id/start",async s=>{const i=eg.parse(s.params).id,r=t.requireChatBridge(i);return t.updateChatBridge(i,{enabled:!0}),e.log.info({component:"control-plane-chat-gateway",action:"bridge-start-request",bridgeId:i,previousEnabled:r.enabled,updatedEnabled:t.requireChatBridge(i).enabled},"chat gateway bridge state changed"),{data:n.startBridge(i)}}),e.post("/api/chat-gateway/bridges/:id/stop",async s=>{const i=eg.parse(s.params).id,r=t.requireChatBridge(i);return t.updateChatBridge(i,{enabled:!1}),e.log.info({component:"control-plane-chat-gateway",action:"bridge-stop-request",bridgeId:i,previousEnabled:r.enabled,updatedEnabled:t.requireChatBridge(i).enabled},"chat gateway bridge state changed"),{data:n.stopBridge(i)}}),e.delete("/api/chat-gateway/bridges/:id",async e=>{const s=eg.parse(e.params).id;return n.stopBridge(s),{data:{deleted:t.deleteChatBridge(s)}}}),e.post("/api/chat-gateway/messages",{bodyLimit:67108864},async e=>({data:await t.handleChatGatewayMessage(co.parse(e.body))})),e.post("/api/chat-gateway/actions",async e=>({data:await t.handleChatGatewayAction(Ig(e.body))})),e.get("/api/pending-routes",async()=>({data:await t.listPendingRoutes()}))}({app:t,service:i,chatGateway:l})}const Mg=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function Lg(e){const t=Object.entries(e).find(([e])=>"sec-websocket-protocol"===e.toLowerCase()),n=t?.[1],s=(Array.isArray(n)?n.join(","):"string"==typeof n?n:"").split(",").map(e=>e.trim()).filter(Boolean);return s.length?s:void 0}const qg=new Set(["content-encoding"]),$g=new Set(["host",...E]);function Bg(e){return Object.fromEntries(Object.entries(e).flatMap(([e,t])=>{const n=e.toLowerCase();if(Mg.has(n)||"authorization"===n||void 0===t)return[];const s=Array.isArray(t)?t.join(", "):String(t);if("cookie"!==n)return[[e,s]];const i=function(e){return e.split(";").map(e=>e.trim()).filter(e=>e&&e.slice(0,e.indexOf("=")).trim()!==qo).join("; ")}(s);return i?[[e,i]]:[]}))}function Fg(e){return function(e,t={}){return Object.fromEntries(Object.entries(e).flatMap(([e,n])=>{const s=e.toLowerCase();return void 0===n||t.blockedHeaders?.has(s)||s.startsWith("sec-websocket-")&&"sec-websocket-origin"!==s?[]:[[e,Array.isArray(n)?n.join(", "):String(n)]]}))}(Bg(e),{blockedHeaders:$g})}function Ug(e,t,n,s,i={}){const r=new AbortController;return t.raw.once("close",()=>r.abort()),e.proxyInstanceHttp(n,s,{...i,signal:r.signal})}function Hg(e,t,n){for(const[n,s]of Object.entries(t.headers)){const t=n.toLowerCase();Mg.has(t)||qg.has(t)||e.header(n,s)}if(!t.body)return e.code(t.status).send();const s=m.Readable.fromWeb(t.body);return e.raw.once("close",()=>s.destroy()),e.code(t.status).send(n?s.pipe(n):s)}function Wg(e){return`/instances/${encodeURIComponent(e)}`}function Gg(e,t,n,s){const i=function(e,t){const n=e.split("?",1)[0]||"/";return t.toLowerCase().includes("text/html")&&!n.startsWith("/api/")}(s,Object.entries(t.headers).find(([e])=>"content-type"===e.toLowerCase())?.[1]||"")?function(e){const t=[];let n=0,s=!1;const i=(i,r=!1)=>{if(s)return;const o=Buffer.concat(t,n).toString("utf8");!/<head(\s[^>]*)?>/i.exec(o)&&!r&&n<65536||(s=!0,i.push(function(e,t){if(e.includes("__TASK_HANDOFF_PUBLIC_BASE__"))return e;const n=`<script>window.__TASK_HANDOFF_PUBLIC_BASE__=${JSON.stringify(t)};<\/script>`;return/<head(\s[^>]*)?>/i.test(e)?e.replace(/<head(\s[^>]*)?>/i,e=>`${e}\n${n}`):`${n}\n${e}`}(o,e)),t.length=0,n=0)};return new m.Transform({transform(e,r,o){s?this.push(e):(t.push(Buffer.from(e)),n+=e.length,i(this)),o()},flush(e){i(this,!0),e()}})}(Wg(n)):void 0;return Hg(e,t,i)}function Vg(e){return Buffer.isBuffer(e)?e:e instanceof Uint8Array?Buffer.from(e):e instanceof URLSearchParams?e.toString():"string"==typeof e?e:null==e?void 0:JSON.stringify(e)}function Kg(e,t){if("string"!=typeof t||!e.hasContentTypeParser(t))try{e.addContentTypeParser(t,{parseAs:"buffer"},(e,t,n)=>n(null,t))}catch(e){if(e instanceof Error&&/Content type parser .* already present/i.test(e.message))return;throw e}}function Jg(e){return new URL(e,"http://control-plane.local").searchParams.get("token")||""}function Yg(e,t,n){const s=encodeURIComponent(e),i=encodeURIComponent(t),r=`apps/access/vnc/${s}/proxy`,o=n.vnc&&"object"==typeof n.vnc?n.vnc:{};return"kasmvnc"===("string"==typeof o.backend?o.backend:"")?`/${r}/api/apps/sessions/${i}/web/`:`/${r}/api/novnc/vnc.html?path=${encodeURIComponent(`${r}/api/apps/sessions/${i}/vnc`)}&autoconnect=1&resize=scale`}class Qg{snapshots=new Map;history=new Map;advertisedStreams=new Map;recoveries=new Map;listeners=new Set;bootstrap;logger;recoverDelta;recoverSnapshot;onRecoveredEvent;recoveryCount=0;counters={streamResets:0,gaps:0,deltaRecoveries:0,snapshotRecoveries:0,recoveryFailures:0};constructor(e){this.bootstrap=e.bootstrap,this.logger=e.logger,this.recoverDelta=e.recoverDelta,this.recoverSnapshot=e.recoverSnapshot,this.onRecoveredEvent=e.onRecoveredEvent}handleEvent(e){if(e.type===M||e.type===L){const t=ra(e.type===M?At:zt,e.payload);return!!t.success||(this.logger?.warn?.({eventType:e.type,issues:t.error.issues,errorCode:"AI_SESSION_TRANSIENT_EVENT_INVALID"},"ai-session.aggregator.transient-event.invalid"),!1)}const t=e.type===P?vt:e.type===j?St:e.type===D?wt:void 0;if(!t)return!1;const n=ra(t,e.payload);return n.success?e.type===P?this.applySnapshot(n.data):e.type===j?this.applyPatch(n.data):this.applyRemoved(n.data):(this.logger?.warn?.({eventType:e.type,issues:n.error.issues,errorCode:"AI_SESSION_EVENT_INVALID"},"ai-session.aggregator.event.invalid"),!1)}onSnapshot(e){return this.listeners.add(e),()=>this.listeners.delete(e)}applySnapshot(e){const t=this.advertisedStreams.get(e.meta.instanceId)?.streamId;return t&&t!==e.meta.streamId?(this.logger?.warn?.({instanceId:e.meta.instanceId,advertisedStreamId:t,streamId:e.meta.streamId,revision:e.meta.revision},"ai-session.aggregator.snapshot.obsolete-stream"),!1):this.apply({type:P,payload:e})}advertiseStream(e,t){return this.advertisedStreams.set(e,t),this.recoverStream(e,t.streamId,t.latestRevision).catch(n=>{this.counters.recoveryFailures+=1,this.logger?.warn?.({instanceId:e,streamId:t.streamId,error:n instanceof Error?n.message:String(n)},"ai-session.aggregator.recovery.failed")})}diagnostics(){return{...this.counters,recoveriesStarted:this.recoveryCount,activeRecoveries:this.recoveries.size}}removeInstance(e){this.snapshots.delete(e),this.history.delete(e),this.advertisedStreams.delete(e)}applyPatch(e){return this.apply({type:j,payload:e})}applyRemoved(e){return this.apply({type:D,payload:e})}async list(e={}){return(e.refresh||0===this.snapshots.size)&&await this.bootstrapFromInstances(),this.view()}async streamDescriptors(){return 0===this.snapshots.size&&await this.bootstrapFromInstances(),[...this.snapshots.entries()].map(([e,t])=>({topic:"ai.sessions",instanceId:e,streamId:t.streamId,latestRevision:t.revision,earliestRetainedRevision:this.history.get(e)?.[0]?.payload.meta.revision??t.revision+1}))}async delta(e){0===this.snapshots.size&&await this.bootstrapFromInstances();const t=this.resolveDeltaInstanceId(e.instanceId);this.pruneHistory(t);const n=this.snapshots.get(t)?.revision??0,s=this.snapshots.get(t)?.streamId||"unavailable",i=this.history.get(t)?.[0]?.payload.meta.revision??n+1;if(e.streamId!==s||e.sinceRevision>n)return kt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:!0,events:[]});if(e.sinceRevision===n)return kt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:!1,events:[]});const r=(this.history.get(t)??[]).filter(t=>t.payload.meta.revision>e.sinceRevision),o=!r.length||r[0].payload.meta.revision!==e.sinceRevision+1;return kt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:o,events:o?[]:r.map(({type:e,payload:t})=>({type:e,payload:t}))})}apply(e,t=!1){const{meta:n}=e.payload,s=this.advertisedStreams.get(n.instanceId)?.streamId;if(s&&s!==n.streamId)return this.logger?.warn?.({instanceId:n.instanceId,advertisedStreamId:s,streamId:n.streamId,revision:n.revision},"ai-session.aggregator.event.obsolete-stream"),!1;const i=this.recoveries.get(n.instanceId);if(i&&!t)return i.streamId===n.streamId&&(i.highWater=Math.max(i.highWater,n.revision)),!1;const r=this.snapshots.get(n.instanceId);e.type===P&&r&&r.streamId!==n.streamId&&(this.counters.streamResets+=1,this.logger?.info?.({instanceId:n.instanceId,previousStreamId:r.streamId,streamId:n.streamId,previousRevision:r.revision,revision:n.revision,traceId:n.traceId,resetCount:this.counters.streamResets},"ai-session.aggregator.stream-reset"));const o=function(e,t){const{meta:n}=t.payload;if(t.type===P)return e?.streamId===n.streamId&&n.revision===e.revision?{kind:"duplicate",projection:e}:e?.streamId===n.streamId&&n.revision<e.revision?{kind:"stale",projection:e}:{kind:"applied",projection:gt.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:t.payload.snapshot})};if(!e||e.streamId!==n.streamId)return{kind:"snapshot-required",projection:e,streamId:n.streamId};if(n.revision===e.revision)return{kind:"duplicate",projection:e};if(n.revision<e.revision)return{kind:"stale",projection:e};if(n.revision!==e.revision+1||n.previousRevision!==e.revision)return{kind:"gap",projection:e,expectedRevision:e.revision+1,receivedRevision:n.revision};const s=new Map(e.snapshot.sessions.map(e=>[e.id,e]));if(t.type===j){for(const e of t.payload.upserted)s.set(e.id,e);for(const e of t.payload.removed)s.delete(e)}else for(const e of t.payload.sessionIds)s.delete(e);const i=[...s.values()],r=mt.parse({runningCount:i.filter(e=>"running"===e.status).length,waitingCount:i.filter(e=>"waiting"===e.status).length,staleCount:e.snapshot.staleCount,sessions:i,updatedAt:n.generatedAt});return{kind:"applied",projection:gt.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:r})}}(r,e);if("applied"!==o.kind)return this.logger?.warn?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,currentRevision:r?.revision,revision:n.revision,outcome:o.kind},`ai-session.aggregator.event.${o.kind}`),"gap"!==o.kind&&"snapshot-required"!==o.kind||("gap"===o.kind&&(this.counters.gaps+=1),this.recoverStream(n.instanceId,n.streamId,n.revision).catch(e=>{this.logger?.warn?.({instanceId:n.instanceId,streamId:n.streamId,revision:n.revision,error:e instanceof Error?e.message:String(e)},"ai-session.aggregator.recovery.failed")})),!1;const a=o.projection;this.snapshots.set(n.instanceId,a),this.rememberEvent(n.instanceId,e);const d={instanceId:n.instanceId,streamId:a.streamId,aiSessions:a.snapshot,revision:a.revision,lastEventAt:a.lastEventAt};for(const e of this.listeners)try{e(d)}catch{this.listeners.delete(e)}return this.logger?.info?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,reason:n.reason,sessionCount:a.snapshot.sessions.length},"ai-session.aggregator.event.accepted"),!0}async bootstrapFromInstances(){this.logger?.info?.({},"ai-session.aggregator.bootstrap");const e=new Map(this.snapshots),t=await this.bootstrap(),n=new Set(t.instances.map(e=>e.instanceId));for(const[t,s]of e)n.has(t)||this.snapshots.get(t)!==s||(this.snapshots.delete(t),this.history.delete(t),this.advertisedStreams.delete(t));for(const n of t.instances){const t=this.snapshots.get(n.instanceId);if(t!==e.get(n.instanceId))continue;const s=this.advertisedStreams.get(n.instanceId)?.streamId;s&&s!==n.streamId||t?.streamId===n.streamId&&t.revision>=n.revision||(t?.streamId!==n.streamId&&this.history.delete(n.instanceId),this.snapshots.set(n.instanceId,{streamId:n.streamId,snapshot:n.aiSessions,revision:n.revision,lastEventAt:n.lastEventAt}))}}recoverStream(e,t,n){const s=this.recoveries.get(e);if(s)return s.streamId===t?s.highWater=Math.max(s.highWater,n):(s.streamId=t,s.highWater=n),s.promise;if(!this.recoverDelta||!this.recoverSnapshot)return Promise.resolve();const i={promise:Promise.resolve(),streamId:t,highWater:n},r=++this.recoveryCount;return this.logger?.info?.({instanceId:e,highWater:n,recoveryNumber:r},"ai-session.aggregator.recovery.started"),i.promise=(async()=>{for(;;){const t=this.advertisedStreams.get(e);if(!t)return;i.streamId!==t.streamId&&(i.streamId=t.streamId,i.highWater=t.latestRevision);const n=this.snapshots.get(e);if(n&&n.streamId===t.streamId){if(n.revision<Math.max(t.latestRevision,i.highWater)){const t=await this.recoverDelta(e,n.streamId,n.revision);if(this.advertisedStreams.get(e)?.streamId!==t.streamId||i.streamId!==t.streamId)continue;if(t.syncRequired){const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:P,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`ais_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:r,outcome:"snapshot-fallback"},"ai-session.aggregator.recovery.snapshot")}else{for(const e of t.events)this.apply(e,!0)&&this.onRecoveredEvent?.(e);this.counters.deltaRecoveries+=1,i.highWater=Math.max(i.highWater,t.latestRevision),this.logger?.info?.({instanceId:e,streamId:t.streamId,sinceRevision:t.sinceRevision,latestRevision:t.latestRevision,eventCount:t.events.length,recoveryNumber:r,outcome:"delta"},"ai-session.aggregator.recovery.delta")}}}else{const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:P,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`ais_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:r,outcome:"snapshot"},"ai-session.aggregator.recovery.snapshot")}const s=this.snapshots.get(e),o=this.advertisedStreams.get(e);if(s&&o&&s.streamId===o.streamId&&s.revision>=Math.max(o.latestRevision,i.highWater))return void this.logger?.info?.({instanceId:e,streamId:s.streamId,revision:s.revision,recoveryNumber:r,outcome:"success"},"ai-session.aggregator.recovery.completed")}})().finally(()=>this.recoveries.delete(e)),this.recoveries.set(e,i),i.promise}rememberEvent(e,t){const n=this.history.get(e)??[],s=n.length&&n[0].payload.meta.streamId!==t.payload.meta.streamId?[]:n;s.push({...t,createdAtMs:Date.now()}),this.history.set(e,s),this.pruneHistory(e)}pruneHistory(e){const t=this.history.get(e);if(!t?.length)return;const n=t.filter(e=>e.createdAtMs>=Date.now()-36e5);n.length?this.history.set(e,n):this.history.delete(e)}resolveDeltaInstanceId(e){if(e)return e;const t=[...this.snapshots.keys()];if(1===t.length)return t[0];throw new Error("AI_SESSION_DELTA_INSTANCE_ID_REQUIRED")}view(){return{updatedAt:(new Date).toISOString(),instances:[...this.snapshots.entries()].map(([e,t])=>({instanceId:e,streamId:t.streamId,aiSessions:t.snapshot,revision:t.revision,lastEventAt:t.lastEventAt}))}}}const Xg=d.z.object({id:d.z.string().trim().min(1),instanceId:d.z.string().trim().min(1).max(160),sessionId:d.z.string().trim().min(1).max(120),unread:d.z.boolean(),lastStatus:d.z.enum(["running","waiting","idle","failed"]),sessionUpdatedAt:d.z.string().datetime(),createdAt:d.z.string().datetime(),updatedAt:d.z.string().datetime()}).strict();class Zg{records;bySession=new Map;listener;constructor(e,t={}){this.records=new Do(e.aiSessionUnreadDir,{schema:Xg}),this.listener=t.onChanged}init(){this.records.init(),this.bySession.clear();for(const e of this.records.list())this.bySession.set(ty(e.instanceId,e.sessionId),e)}reconcile(e,t){const n=new Set;for(const s of t.sessions)n.add(s.id),this.reconcileSession(e,s);for(const t of[...this.bySession.values()])t.instanceId!==e||n.has(t.sessionId)||this.deleteRecord(t)}decorate(e,t){return{...t,sessions:t.sessions.map(t=>({...t,unread:this.bySession.get(ty(e,t.id))?.unread||!1}))}}markRead(e,t,n){const s=this.bySession.get(ty(e,t));return s&&s.sessionUpdatedAt===n&&s.unread?ey(this.store({...s,unread:!1,updatedAt:(new Date).toISOString()},!1)):s?ey(s):void 0}removeInstance(e){for(const t of[...this.bySession.values()])t.instanceId===e&&this.deleteRecord(t)}reconcileSession(e,t){const n=ty(e,t.id),s=this.bySession.get(n),i=(new Date).toISOString();if(!s)return void this.store({id:ny(e,t.id),instanceId:e,sessionId:t.id,unread:!1,lastStatus:t.status,sessionUpdatedAt:t.updatedAt,createdAt:i,updatedAt:i},!1);const r=function(e,t,n){return"running"!==n&&"waiting"!==n&&("running"===t||"waiting"===t||e)}(s.unread,s.lastStatus,t.status),o=r!==s.unread;(o||s.lastStatus!==t.status||s.sessionUpdatedAt!==t.updatedAt)&&this.store({...s,unread:r,lastStatus:t.status,sessionUpdatedAt:t.updatedAt,updatedAt:i},o)}store(e,t){const n=this.records.put(e);return this.bySession.set(ty(n.instanceId,n.sessionId),n),t&&this.listener?.(ey(n)),n}deleteRecord(e){this.records.delete(e.id),this.bySession.delete(ty(e.instanceId,e.sessionId))}}function ey(e){return te.parse({instanceId:e.instanceId,sessionId:e.sessionId,unread:e.unread,sessionUpdatedAt:e.sessionUpdatedAt,updatedAt:e.updatedAt})}function ty(e,t){return`${e}\0${t}`}function ny(e,t){return`ais_unread_${s.createHash("sha256").update(ty(e,t)).digest("hex").slice(0,32)}`}class sy{snapshots=new Map;history=new Map;advertisedStreams=new Map;recoveries=new Map;bootstrap;logger;recoverDelta;recoverSnapshot;onRecoveredEvent;recoveryCount=0;counters={streamResets:0,gaps:0,deltaRecoveries:0,snapshotRecoveries:0,recoveryFailures:0};constructor(e){this.bootstrap=e.bootstrap,this.logger=e.logger,this.recoverDelta=e.recoverDelta,this.recoverSnapshot=e.recoverSnapshot,this.onRecoveredEvent=e.onRecoveredEvent}handleEvent(e){const t=e.type===Nt?Ft:e.type===Rt?Ut:e.type===Ot?Ht:void 0;if(!t)return!1;const n=ra(t,e.payload);return n.success?e.type===Nt?this.applySnapshot(n.data):e.type===Rt?this.applyPatch(n.data):this.applyRemoved(n.data):(this.logger?.warn?.({eventType:e.type,issues:n.error.issues,errorCode:"APP_SESSION_EVENT_INVALID"},"app-session.aggregator.event.invalid"),!1)}applySnapshot(e){const t=this.advertisedStreams.get(e.meta.instanceId)?.streamId;return t&&t!==e.meta.streamId?(this.logger?.warn?.({instanceId:e.meta.instanceId,advertisedStreamId:t,streamId:e.meta.streamId,revision:e.meta.revision},"app-session.aggregator.snapshot.obsolete-stream"),!1):this.apply({type:Nt,payload:e})}advertiseStream(e,t){return this.advertisedStreams.set(e,t),this.recoverStream(e,t.streamId,t.latestRevision).catch(n=>{this.counters.recoveryFailures+=1,this.logger?.warn?.({instanceId:e,streamId:t.streamId,error:n instanceof Error?n.message:String(n)},"app-session.aggregator.recovery.failed")})}diagnostics(){return{...this.counters,recoveriesStarted:this.recoveryCount,activeRecoveries:this.recoveries.size}}removeInstance(e){this.snapshots.delete(e),this.history.delete(e),this.advertisedStreams.delete(e)}applyPatch(e){return this.apply({type:Rt,payload:e})}applyRemoved(e){return this.apply({type:Ot,payload:e})}async list(e={}){return(e.refresh||0===this.snapshots.size)&&await this.bootstrapFromInstances(),this.view()}async streamDescriptors(){return 0===this.snapshots.size&&await this.bootstrapFromInstances(),[...this.snapshots.entries()].map(([e,t])=>({topic:"app.sessions",instanceId:e,streamId:t.streamId,latestRevision:t.revision,earliestRetainedRevision:this.history.get(e)?.[0]?.payload.meta.revision??t.revision+1}))}async delta(e){0===this.snapshots.size&&await this.bootstrapFromInstances();const t=this.resolveDeltaInstanceId(e.instanceId);this.pruneHistory(t);const n=this.snapshots.get(t)?.revision??0,s=this.snapshots.get(t)?.streamId||"unavailable",i=this.history.get(t)?.[0]?.payload.meta.revision??n+1;if(e.streamId!==s||e.sinceRevision>n)return Wt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:!0,events:[]});if(e.sinceRevision===n)return Wt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:!1,events:[]});const r=(this.history.get(t)??[]).filter(t=>t.payload.meta.revision>e.sinceRevision),o=!r.length||r[0].payload.meta.revision!==e.sinceRevision+1;return Wt.parse({streamId:s,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:i,syncRequired:o,events:o?[]:r.map(({type:e,payload:t})=>({type:e,payload:t}))})}apply(e,t=!1){const{meta:n}=e.payload,s=this.advertisedStreams.get(n.instanceId)?.streamId;if(s&&s!==n.streamId)return this.logger?.warn?.({instanceId:n.instanceId,advertisedStreamId:s,streamId:n.streamId,revision:n.revision},"app-session.aggregator.event.obsolete-stream"),!1;const i=this.recoveries.get(n.instanceId);if(i&&!t)return i.streamId===n.streamId&&(i.highWater=Math.max(i.highWater,n.revision)),!1;const r=this.snapshots.get(n.instanceId);e.type===Nt&&r&&r.streamId!==n.streamId&&(this.counters.streamResets+=1,this.logger?.info?.({instanceId:n.instanceId,previousStreamId:r.streamId,streamId:n.streamId,previousRevision:r.revision,revision:n.revision,traceId:n.traceId,resetCount:this.counters.streamResets},"app-session.aggregator.stream-reset"));const o=function(e,t){const{meta:n}=t.payload;if(t.type===Nt)return e?.streamId===n.streamId&&n.revision===e.revision?{kind:"duplicate",projection:e}:e?.streamId===n.streamId&&n.revision<e.revision?{kind:"stale",projection:e}:{kind:"applied",projection:qt.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:Vt(t.payload.snapshot.sessions,t.payload.snapshot.updatedAt)})};if(!e||e.streamId!==n.streamId)return{kind:"snapshot-required",projection:e,streamId:n.streamId};if(n.revision===e.revision)return{kind:"duplicate",projection:e};if(n.revision<e.revision)return{kind:"stale",projection:e};if(n.revision!==e.revision+1||n.previousRevision!==e.revision)return{kind:"gap",projection:e,expectedRevision:e.revision+1,receivedRevision:n.revision};const s=[...e.snapshot.sessions];if(t.type===Rt){const e=s.findIndex(e=>e.id===t.payload.session.id);Yt(t.payload.session.status)?e<0?s.push(t.payload.session):s[e]=t.payload.session:e>=0&&s.splice(e,1)}else{const e=s.findIndex(e=>e.id===t.payload.sessionId);e>=0&&s.splice(e,1)}const i=Gt(s,n.generatedAt);return{kind:"applied",projection:qt.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:i})}}(r,e);if("applied"!==o.kind)return this.logger?.warn?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,currentRevision:r?.revision,revision:n.revision,outcome:o.kind},`app-session.aggregator.event.${o.kind}`),"gap"!==o.kind&&"snapshot-required"!==o.kind||("gap"===o.kind&&(this.counters.gaps+=1),this.recoverStream(n.instanceId,n.streamId,n.revision).catch(e=>{this.logger?.warn?.({instanceId:n.instanceId,streamId:n.streamId,revision:n.revision,error:e instanceof Error?e.message:String(e)},"app-session.aggregator.recovery.failed")})),!1;const a=o.projection;return this.snapshots.set(n.instanceId,a),this.rememberEvent(n.instanceId,e),this.logger?.info?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,reason:n.reason,sessionCount:a.snapshot.sessions.length,runningCount:a.snapshot.runningCount,problemCount:a.snapshot.problemCount},"app-session.aggregator.event.accepted"),!0}async bootstrapFromInstances(){this.logger?.info?.({},"app-session.aggregator.bootstrap");const e=new Map(this.snapshots),t=await this.bootstrap(),n=new Set(t.instances.map(e=>e.instanceId));for(const[t,s]of e)n.has(t)||this.snapshots.get(t)!==s||(this.snapshots.delete(t),this.history.delete(t),this.advertisedStreams.delete(t));for(const n of t.instances){const t=this.snapshots.get(n.instanceId);if(t!==e.get(n.instanceId))continue;const s=this.advertisedStreams.get(n.instanceId)?.streamId;s&&s!==n.streamId||t?.streamId===n.streamId&&t.revision>=n.revision||(t?.streamId!==n.streamId&&this.history.delete(n.instanceId),this.snapshots.set(n.instanceId,{streamId:n.streamId,snapshot:Vt(n.appSessions.sessions,n.appSessions.updatedAt),revision:n.revision,lastEventAt:n.lastEventAt}))}}recoverStream(e,t,n){const s=this.recoveries.get(e);if(s)return s.streamId===t?s.highWater=Math.max(s.highWater,n):(s.streamId=t,s.highWater=n),s.promise;if(!this.recoverDelta||!this.recoverSnapshot)return Promise.resolve();const i={promise:Promise.resolve(),streamId:t,highWater:n},r=++this.recoveryCount;return this.logger?.info?.({instanceId:e,highWater:n,recoveryNumber:r},"app-session.aggregator.recovery.started"),i.promise=(async()=>{for(;;){const t=this.advertisedStreams.get(e);if(!t)return;i.streamId!==t.streamId&&(i.streamId=t.streamId,i.highWater=t.latestRevision);const n=this.snapshots.get(e);if(n&&n.streamId===t.streamId){if(n.revision<Math.max(t.latestRevision,i.highWater)){const t=await this.recoverDelta(e,n.streamId,n.revision);if(this.advertisedStreams.get(e)?.streamId!==t.streamId||i.streamId!==t.streamId)continue;if(t.syncRequired){const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:Nt,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`aps_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:r,outcome:"snapshot-fallback"},"app-session.aggregator.recovery.snapshot")}else{for(const e of t.events)this.apply(e,!0)&&this.onRecoveredEvent?.(e);this.counters.deltaRecoveries+=1,i.highWater=Math.max(i.highWater,t.latestRevision),this.logger?.info?.({instanceId:e,streamId:t.streamId,sinceRevision:t.sinceRevision,latestRevision:t.latestRevision,eventCount:t.events.length,recoveryNumber:r,outcome:"delta"},"app-session.aggregator.recovery.delta")}}}else{const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:Nt,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`aps_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:r,outcome:"snapshot"},"app-session.aggregator.recovery.snapshot")}const s=this.snapshots.get(e),o=this.advertisedStreams.get(e);if(s&&o&&s.streamId===o.streamId&&s.revision>=Math.max(o.latestRevision,i.highWater))return void this.logger?.info?.({instanceId:e,streamId:s.streamId,revision:s.revision,recoveryNumber:r,outcome:"success"},"app-session.aggregator.recovery.completed")}})().finally(()=>this.recoveries.delete(e)),this.recoveries.set(e,i),i.promise}rememberEvent(e,t){const n=this.history.get(e)??[],s=n.length&&n[0].payload.meta.streamId!==t.payload.meta.streamId?[]:n;s.push({...t,createdAtMs:Date.now()}),this.history.set(e,s),this.pruneHistory(e)}pruneHistory(e){const t=this.history.get(e);if(!t?.length)return;const n=t.filter(e=>e.createdAtMs>=Date.now()-36e5);n.length?this.history.set(e,n):this.history.delete(e)}resolveDeltaInstanceId(e){if(e)return e;const t=[...this.snapshots.keys()];if(1===t.length)return t[0];throw new Error("APP_SESSION_DELTA_INSTANCE_ID_REQUIRED")}view(){return{updatedAt:(new Date).toISOString(),instances:[...this.snapshots.entries()].map(([e,t])=>({instanceId:e,streamId:t.streamId,appSessions:t.snapshot,revision:t.revision,lastEventAt:t.lastEventAt}))}}}function iy(e){return e.raw[0].replace(/\\\$\{/g,"${")}class ry{states=new Map;events;constructor(e){this.events=e}handle(e){if(e.type===eo){const t=ra(to,e.payload);return void(t.success&&this.reconcileLifecycle(t.data))}if("instance.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";return void(t&&this.deleteState(t))}if(e.type===wr){const t=ra(kr,e.payload);return void(t.success&&this.applyOutput(t.data))}if(e.type===Ar){const t=ra(Tr,e.payload);t.success&&this.applyFinished(t.data)}}snapshots(){return[...this.states.values()].filter(e=>e.progress).map(e=>Cr.parse({...e.progress,terminalTail:e.terminalTail,...e.terminalTruncated?{terminalTruncated:!0}:{}}))}close(){for(const e of this.states.values())e.timer&&clearTimeout(e.timer);this.states.clear()}deleteState(e){const t=this.states.get(e);t?.timer&&clearTimeout(t.timer),this.states.delete(e)}reconcileLifecycle(e){const t=this.states.get(e.instanceId),n=e.imageProvisioning;t&&(!n||n.generation>t.identity.generation||n.generation===t.identity.generation&&"ready"===n.phase)&&this.deleteState(e.instanceId)}applyOutput(e){const t=this.states.get(e.instanceId);if(t&&e.generation<t.identity.generation)return;if(t&&e.generation===t.identity.generation&&!e.replay&&e.sequence<=t.sequence)return;const n=this.requireState(e);e.replay&&(n.terminal=new cy,n.terminalTail="",n.layers.clear(),n.terminalTruncated=!1),n.sequence=Math.max(n.sequence,e.sequence),n.observedAt=e.observedAt,n.terminal.write(e.data);const s=`${n.terminalTail}${e.data}`;n.terminalTruncated||=s.length>262144,n.terminalTail=s.slice(-262144),function(e,t){for(const n of t.split("\n")){const t=n.trim().match(/^([a-f0-9]{6,64}):\s+(.+)$/i);if(!t)continue;const[,s,i]=t,r=i.toLowerCase(),o=["pull complete","already exists","download complete","pulling fs layer","waiting","downloading","extracting"].find(e=>r.startsWith(e));if(!o)continue;const a=e.get(s)||{status:o},d=ay(i);e.set(s,{...a,status:o,...d||{}})}}(n.layers,n.terminal.text()),n.progress=oy(n),this.schedule(n)}applyFinished(e){const t=this.states.get(e.instanceId);if(t&&e.generation<t.identity.generation)return;if(t&&e.generation===t.identity.generation&&e.sequence<=t.sequence)return;const n=this.requireState(e);n.sequence=Math.max(n.sequence,e.sequence),n.observedAt=e.observedAt,n.outcome=e.outcome,n.progress=oy(n),this.publish(n,!0)}requireState(e){const t=this.states.get(e.instanceId);if(t&&t.identity.generation===e.generation)return t;t?.timer&&clearTimeout(t.timer);const n={identity:{instanceId:e.instanceId,generation:e.generation,requestedReference:e.requestedReference},sequence:e.sequence,observedAt:e.observedAt,terminal:new cy,terminalTail:"",terminalTruncated:!1,layers:new Map};return this.states.set(e.instanceId,n),n}schedule(e){e.timer||(e.timer=setTimeout(()=>this.publish(e,!1),250),e.timer.unref?.())}publish(e,t){e.timer&&clearTimeout(e.timer),e.timer=void 0,e.progress&&(e.progress=oy(e),this.events.publish("image.pull.progress",e.progress,{topic:"instances",scope:{instanceId:e.identity.instanceId}}),t&&(e.progress=oy(e)))}}function oy(e){const t=[...e.layers.values()],n=t.filter(e=>["pull complete","already exists"].includes(e.status)).length,s=t.filter(e=>"download complete"===e.status).length,i=t.filter(e=>"downloading"===e.status).length,r=t.filter(e=>"extracting"===e.status).length;let o=0,a=0;for(const e of t)e.total&&(a+=e.total,o+=["pull complete","already exists","download complete"].includes(e.status)?e.total:Math.min(e.current||0,e.total));const d="failed"===e.outcome?"failed":"succeeded"===e.outcome?"complete":r>0?"extracting":t.length>0?"pulling":"connecting",c=t.filter(e=>"already exists"!==e.status),l=c.length>0&&c.every(e=>Boolean(e.total)),p=l&&a>0?Math.max(0,Math.min(100,o/a*100)):void 0,u="failed"===d?"Image pull failed":"complete"===d?"Image pull complete":t.length?`${n}/${t.length} layers ready${void 0===p?"":` · ${Math.round(p)}%`}`:"Connecting to image registry";return Cr.parse({...e.identity,sequence:e.sequence,observedAt:e.observedAt,status:d,layers:{total:t.length,completed:n,downloaded:s,downloading:i,extracting:r},...l&&a>0?{bytes:{current:o,total:a},percent:p}:{},message:u})}function ay(e){const t=e.match(/([\d.]+)\s*([kmgt]?i?b)\s*\/\s*([\d.]+)\s*([kmgt]?i?b)/i);if(t)return{current:dy(t[1],t[2]),total:dy(t[3],t[4])}}function dy(e,t){return Number(e)*1024**({b:0,kb:1,kib:1,mb:2,mib:2,gb:3,gib:3,tb:4,tib:4}[t.toLowerCase()]||0)}class cy{lines=[[]];row=0;col=0;pending="";write(e){const t=`${this.pending}${e}`;this.pending="";for(let e=0;e<t.length;){const n=t[e];if(""===n&&"["===t[e+1]){let n=e+2;for(;n<t.length&&!/[\x40-\x7e]/.test(t[n]);)n+=1;if(n>=t.length){this.pending=t.slice(e);break}this.csi(t.slice(e+2,n),t[n]),e=n+1;continue}"\r"===n?this.col=0:"\n"===n?(this.row+=1,this.col=0,this.ensureLine()):"\b"===n?this.col=Math.max(0,this.col-1):n>=" "&&(this.ensureLine(),this.lines[this.row][this.col]=n,this.col+=1),e+=1}this.trim()}text(){return this.lines.map(e=>e.join("").trimEnd()).join("\n")}csi(e,t){const n=e.replace(/^\?/,"").split(";").map(e=>Number(e||1)),s=n[0]||1;"A"===t?this.row=Math.max(0,this.row-s):"B"===t?(this.row+=s,this.ensureLine()):"C"===t?this.col+=s:"D"===t?this.col=Math.max(0,this.col-s):"G"===t?this.col=Math.max(0,s-1):"H"===t||"f"===t?(this.row=Math.max(0,s-1),this.col=Math.max(0,(n[1]||1)-1),this.ensureLine()):"K"===t?(this.ensureLine(),2===(n[0]||0)?this.lines[this.row]=[]:this.lines[this.row].splice(this.col)):"J"===t&&2===(n[0]||0)&&(this.lines=[[]],this.row=0,this.col=0)}ensureLine(){for(;this.lines.length<=this.row;)this.lines.push([])}trim(){if(this.lines.length<=500)return;const e=this.lines.length-500;this.lines.splice(0,e),this.row=Math.max(0,this.row-e)}}const ly=hs.extend({credentialHash:d.z.string().trim().min(32).max(256)}).strict(),py=d.z.object({revision:d.z.number().int().nonnegative(),invites:d.z.array(d.z.unknown()).length(0).default([]),bindings:d.z.array(ly)}).strict(),uy={binding:new Set(Object.keys(ly.shape))};function hy(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries([...t].filter(e=>e in n).map(e=>[e,n[e]]))}function my(e){const{tokenHash:t,...n}=e;return cs.parse(n)}function gy(e){const{credentialHash:t,...n}=e;return hs.parse(n)}class yy{authority;constructor(e,t){this.authority=new Mo(e,()=>({revision:0,invites:[],bindings:[]}),{schema:py,sanitize:e=>function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,s=new Set(["revision","invites","bindings"]),i=Object.keys(n).filter(e=>!s.has(e));return i.length>0&&t?.({kind:"authority",fields:i}),{...void 0===n.revision?{}:{revision:n.revision},invites:[],bindings:Array.isArray(n.bindings)?n.bindings.map(e=>function(e,t,n){if(!t||"object"!=typeof t||Array.isArray(t))return t;const s=t,i=uy[e],r=Object.keys(s).filter(e=>!i.has(e));r.length>0&&n?.({kind:e,fields:r});const o=hy(s,i);return o.lastError&&(o.lastError=hy(o.lastError,Object.keys(as.shape))),o}("binding",e,t)).filter(e=>!e||"object"!=typeof e||"revoked"!==e.status):n.bindings}}(e,e=>t?.("unknown stored control-plane proxy fields were ignored",e)),logger:t,directoryMode:448,fileMode:384})}init(){this.authority.init();const e=this.authority.get();this.authority.put(e)}snapshot(){return this.authority.get()}transaction(e){const t=this.authority.get(),n=structuredClone(t),s=e(n);return JSON.stringify(n)!==JSON.stringify(t)&&this.authority.put({...n,revision:t.revision+1}),s}listBindings(){return this.snapshot().bindings}getBinding(e){return this.snapshot().bindings.find(t=>t.id===e)}}class fy extends Error{code;statusCode;retryable;details;constructor(e,t,n,s=!1,i={}){super(t),this.name="ControlPlaneProxyServiceError",this.code=e,this.statusCode=n,this.retryable=s,this.details=i}}const Iy=e=>s.createHash("sha256").update(e).digest("base64url"),by=()=>s.randomBytes(32).toString("base64url");function vy(e,t,n,s=!1,i={}){throw new fy(e,t,n,s,i)}class Sy{store;targets;configuredProxyOrigin;proxyOriginProvider;now;createTokenValue;invites=new il;constructor(e,t,n){this.store=e,this.targets=t,this.configuredProxyOrigin=n.proxyOrigin,this.proxyOriginProvider=n.proxyOriginProvider,this.now=n.now??(()=>new Date),this.createTokenValue=n.createToken??by}init(){this.store.init()}createInvite(e,t){const n=this.resolveProxyOrigin();n||vy(rs.Unavailable,"Configure an externally reachable HTTPS control-plane proxy origin before creating an invite.",409,!1);const s=ls.parse(e);this.requireManageableTarget(s.targetNodeId);const i=this.createTokenValue(),r=this.nowIso(),o={id:Po("proxy_invite"),targetNodeId:s.targetNodeId,tokenHash:Iy(i),status:"active",createdBy:t,expiresAt:new Date(this.now().getTime()+Math.min(1e3*s.expiresInSeconds,6e5)).toISOString(),createdAt:r,updatedAt:r},a=ps.parse({invite:my(o),token:i,proxyOrigin:n,protocolVersion:Wn});return this.invites.put(o.tokenHash,o,this.now().getTime()),a}resolveProxyOrigin(){const e=this.configuredProxyOrigin??this.proxyOriginProvider?.();if(!e)return;const t=Qn.safeParse(e);return t.success?t.data:void 0}listInvites(){return this.invites.list(this.now().getTime()).map(my)}revokeInvite(e){const t=this.listInviteRecords().find(t=>t.id===e);t||vy(rs.InviteInvalid,"Proxy invite is unknown.",404,!1,{inviteId:e});const n=this.nowIso(),s={...t,status:"revoked",revokedAt:n,updatedAt:n};return this.invites.delete(t.tokenHash,this.now().getTime()),my(s)}claimInvite(e){const t=ms.parse(e);this.requireCurrentProtocol(t.protocolVersion);const n=Iy(t.credential),s=this.store.listBindings().find(e=>e.claimId===t.claimId);if(s)return this.requireRecoveredIdentity(s,t,n),this.claimResult(s,this.requireKnownTarget(s.targetNodeId));t.inviteToken||vy(rs.InviteInvalid,"Proxy invite token is required for the first claim.",401);const i=Iy(t.inviteToken),r=this.invites.peek(i,this.now().getTime());r||vy(rs.InviteInvalid,"Proxy invite is invalid or expired.",401),t.targetNodeId&&t.targetNodeId!==r.targetNodeId&&vy(rs.TargetMismatch,"Proxy invite is bound to a different target.",409,!1,{inviteId:r.id,targetNodeId:t.targetNodeId});const o=this.requireManageableTarget(r.targetNodeId),a=this.store.transaction(e=>{const s=(i=r.id,`proxy_binding_${Iy(i).slice(0,32)}`);var i;const a=this.nowIso(),d={id:s,claimId:t.claimId,sourceControlPlaneId:t.sourceControlPlaneId,targetNodeId:r.targetNodeId,bindingKeyId:t.bindingKeyId,credentialHash:n,status:"active",revision:1,createdAt:a,updatedAt:a};return e.bindings.push(d),this.claimResult(d,o)});return this.invites.delete(i,this.now().getTime()),a}listBindings(){return this.store.listBindings().map(gy)}authenticateBinding(e,t){const n=gs.parse(t),i=this.store.getBinding(e);return i||vy(rs.BindingUnknown,"Proxy binding is unknown.",404,!1,{bindingId:e}),"active"!==i.status&&vy(rs.BindingRevoked,"Proxy binding is revoked.",403,!1,{bindingId:e}),i.sourceControlPlaneId===n.sourceControlPlaneId&&i.bindingKeyId===n.bindingKeyId&&function(e,t){const n=Iy(t),i=Buffer.from(e),r=Buffer.from(n);return i.length===r.length&&s.timingSafeEqual(i,r)}(i.credentialHash,n.credential)||vy(rs.AuthenticationFailed,"Proxy binding authentication failed.",401,!1,{bindingId:e}),gy(i)}revokeBinding(e){const t=this.requireBinding(e);if("revoked"===t.status)return gy(t);const n=this.nowIso(),s={...t,status:"revoked",revision:t.revision+1,revokedAt:n,updatedAt:n};return this.store.transaction(t=>{t.bindings=t.bindings.filter(t=>t.id!==e)}),gy(s)}revokeTarget(e){return this.store.transaction(t=>{const n=this.nowIso(),s=t.bindings.filter(t=>t.targetNodeId===e&&"active"===t.status).map(e=>gy({...e,status:"revoked",revision:e.revision+1,revokedAt:n,updatedAt:n}));return t.bindings=t.bindings.filter(t=>t.targetNodeId!==e),{bindings:s,invites:this.revokeTargetInvites(e,n)}})}nowIso(){return this.now().toISOString()}requireCurrentProtocol(e){e!==Wn&&vy(rs.ProtocolUnsupported,"Control-plane proxy protocol version is unsupported.",426,!1,{requestedVersion:e,supportedVersion:Wn})}requireKnownTarget(e){const t=this.targets.get(e);return t||vy(rs.TargetUnavailable,"Proxy target no longer exists.",404,!1,{targetNodeId:e}),t}requireManageableTarget(e){const t=this.requireKnownTarget(e);return t.manageable&&"online"===t.status||vy(rs.TargetUnavailable,"Proxy target is not currently manageable.",503,!0,{targetNodeId:e}),t}requireBinding(e){const t=this.store.getBinding(e);return t||vy(rs.BindingUnknown,"Proxy binding is unknown.",404,!1,{bindingId:e}),t}requireRecoveredIdentity(e,t,n){(e.claimId!==t.claimId||e.sourceControlPlaneId!==t.sourceControlPlaneId||void 0!==t.targetNodeId&&e.targetNodeId!==t.targetNodeId||e.bindingKeyId!==t.bindingKeyId||e.credentialHash!==n)&&vy(rs.BindingIdentityConflict,"Proxy claim conflicts with an existing binding identity.",409,!1,{claimId:t.claimId})}claimResult(e,t){const{manageable:n,...s}=t;return ws.parse({protocolVersion:Wn,binding:gy(e),target:s})}listInviteRecords(){return this.invites.list(this.now().getTime())}revokeTargetInvites(e,t){const n=this.listInviteRecords().filter(t=>t.targetNodeId===e);for(const e of n)this.invites.delete(e.tokenHash,this.now().getTime());return n.map(e=>my({...e,status:"revoked",revokedAt:t,updatedAt:t}))}}class wy extends Error{statusCode=429;code=rs.ResourceLimit;retryable=!0;details;constructor(e,t){super(e),this.name="NodeProxyRuntimeError",this.details=t}}class Ay{maxRequestBodyBytes;maxConcurrentHttpPerBinding;maxConcurrentStreamsPerBinding;maxHttpRequestsPerMinutePerBinding;maxConcurrentWebSocketsPerBinding;maxHttpResponseBytes;httpStreamIdleTimeoutMs;maxWebSocketFrameBytes;maxWebSocketBytes;webSocketIdleTimeoutMs;httpRequestWindowMs;bindings=new Map;requestWindows=new Map;requestWindowTimers=new Map;constructor(e={}){this.maxConcurrentHttpPerBinding=e.maxConcurrentHttpPerBinding??32,this.maxConcurrentStreamsPerBinding=e.maxConcurrentStreamsPerBinding??16,this.maxHttpRequestsPerMinutePerBinding=e.maxHttpRequestsPerMinutePerBinding??600,this.maxConcurrentWebSocketsPerBinding=e.maxConcurrentWebSocketsPerBinding??16,this.maxRequestBodyBytes=e.maxRequestBodyBytes??8388608,this.maxHttpResponseBytes=e.maxHttpResponseBytes??268435456,this.httpStreamIdleTimeoutMs=e.httpStreamIdleTimeoutMs??12e4,this.maxWebSocketFrameBytes=e.maxWebSocketFrameBytes??8388608,this.maxWebSocketBytes=e.maxWebSocketBytes??268435456,this.webSocketIdleTimeoutMs=e.webSocketIdleTimeoutMs??3e5,this.httpRequestWindowMs=e.httpRequestWindowMs??6e4}reserveHttp(e){this.consumeRequestRate(e);const t=this.activity(e);if(t.controllers.size>=this.maxConcurrentHttpPerBinding)throw this.deleteIfEmpty(e,t),this.limit("Proxy HTTP concurrency limit exceeded.",e,"http-concurrency",this.maxConcurrentHttpPerBinding);const n=new AbortController;t.controllers.add(n);let s,i=!1,r=!1,o=0;const a=()=>{r&&!i&&(s&&clearTimeout(s),s=setTimeout(()=>{n.abort(Object.assign(new Error("Proxy HTTP stream idle timeout."),{code:rs.ResourceLimit}))},this.httpStreamIdleTimeoutMs),s.unref?.())};return{controller:n,acceptRequestBody:t=>{if(t>this.maxRequestBodyBytes)throw this.limit("Proxy request body limit exceeded.",e,"request-body",this.maxRequestBodyBytes)},beginResponseStream:()=>{if(!i&&!r){if(t.streams.size>=this.maxConcurrentStreamsPerBinding)throw this.limit("Proxy HTTP stream concurrency limit exceeded.",e,"stream-concurrency",this.maxConcurrentStreamsPerBinding);r=!0,t.streams.add(n),a()}},acceptResponseChunk:t=>{if(!i){if(o+=zy(t),o>this.maxHttpResponseBytes){const t=this.limit("Proxy HTTP response byte limit exceeded.",e,"response-bytes",this.maxHttpResponseBytes);throw n.abort(t),t}a()}},release:()=>{i||(i=!0,s&&clearTimeout(s),t.controllers.delete(n),t.streams.delete(n),this.deleteIfEmpty(e,t))}}}openHttp(e,t){const n=this.reserveHttp(e);try{return n.acceptRequestBody(t),n}catch(e){throw n.release(),e}}openWebSocket(e,t,n){const s=this.activity(e);if(s.sockets.size>=this.maxConcurrentWebSocketsPerBinding)throw this.limit("Proxy WebSocket concurrency limit exceeded.",e,"websocket-concurrency",this.maxConcurrentWebSocketsPerBinding);let i,r=!1,o=0;const a=()=>{r||(r=!0,i&&clearTimeout(i),s.sockets.delete(p),this.deleteIfEmpty(e,s),n?.())},d=e=>{a(),t.close(1009,e)},c=()=>{i&&clearTimeout(i),i=setTimeout(()=>{a(),t.close(1001,"Proxy WebSocket idle timeout.")},this.webSocketIdleTimeoutMs),i.unref?.()},l=e=>{const t=zy(e);return t>this.maxWebSocketFrameBytes?(d("Proxy WebSocket frame limit exceeded."),!1):(o+=t,o>this.maxWebSocketBytes?(d("Proxy WebSocket byte limit exceeded."),!1):(c(),!0))};c();const p={get readyState(){return t.readyState},send:e=>{!r&&l(e)&&t.send(e)},close:(e,n)=>{a(),t.close(e,n)},on:(e,n)=>{"message"!==e?"close"!==e&&"error"!==e?t.on(e,n):t.on(e,(...e)=>{a(),n(...e)}):t.on(e,(e,...t)=>{!r&&l(e)&&n(e,...t)})}};return s.sockets.add(p),p}closeBinding(e,t="Proxy binding was revoked."){const n=this.bindings.get(e);if(!n)return this.clearRequestWindow(e),{abortedRequests:0,closedSockets:0};const s=[...n.controllers],i=[...n.sockets],r=[...n.cleanup];this.bindings.delete(e);for(const e of s)e.abort(Object.assign(new Error(t),{code:rs.BindingRevoked}));for(const e of r)e();for(const e of i)e.close(1008,t);return n.controllers.clear(),n.streams.clear(),n.sockets.clear(),n.cleanup.clear(),this.clearRequestWindow(e),{abortedRequests:s.length,closedSockets:i.length}}diagnostics(e){if(e){const t=this.bindings.get(e);return{bindingId:e,activeHttp:t?.controllers.size??0,activeStreams:t?.streams.size??0,activeWebSockets:t?.sockets.size??0}}return[...this.bindings].map(([e,t])=>({bindingId:e,activeHttp:t.controllers.size,activeStreams:t.streams.size,activeWebSockets:t.sockets.size}))}registerBindingCleanup(e,t){const n=this.activity(e);return n.cleanup.add(t),()=>{n.cleanup.delete(t),this.deleteIfEmpty(e,n)}}activity(e){const t=this.bindings.get(e);if(t)return t;const n={controllers:new Set,streams:new Set,sockets:new Set,cleanup:new Set};return this.bindings.set(e,n),n}deleteIfEmpty(e,t){0===t.controllers.size&&0===t.streams.size&&0===t.sockets.size&&0===t.cleanup.size&&this.bindings.get(e)===t&&this.bindings.delete(e)}limit(e,t,n,s){return new wy(e,{bindingId:t,resource:n,limit:s})}consumeRequestRate(e){const t=Date.now(),n=t-this.httpRequestWindowMs,s=(this.requestWindows.get(e)||[]).filter(e=>e>n);if(s.length>=this.maxHttpRequestsPerMinutePerBinding)throw this.limit("Proxy HTTP request rate limit exceeded.",e,"request-rate",this.maxHttpRequestsPerMinutePerBinding);s.push(t),this.requestWindows.set(e,s),this.scheduleRequestWindowCleanup(e)}scheduleRequestWindowCleanup(e){const t=this.requestWindowTimers.get(e);t&&clearTimeout(t);const n=this.requestWindows.get(e);if(!n?.length)return this.requestWindows.delete(e),void this.requestWindowTimers.delete(e);const s=Math.max(1,n[0]+this.httpRequestWindowMs-Date.now()+1),i=setTimeout(()=>{this.requestWindowTimers.delete(e);const t=Date.now()-this.httpRequestWindowMs,n=(this.requestWindows.get(e)||[]).filter(e=>e>t);n.length?(this.requestWindows.set(e,n),this.scheduleRequestWindowCleanup(e)):this.requestWindows.delete(e)},s);i.unref?.(),this.requestWindowTimers.set(e,i)}clearRequestWindow(e){this.requestWindows.delete(e);const t=this.requestWindowTimers.get(e);t&&clearTimeout(t),this.requestWindowTimers.delete(e)}}function zy(e){return Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8")}class ky{streams=new Map;historyLimit;maxEventBytes;maxHistoryBytes;createStreamId;projectTarget;unsubscribeBus;constructor(e,t){this.historyLimit=Math.max(1,t.historyLimit??256),this.maxEventBytes=Math.max(1024,t.maxEventBytes??524288),this.maxHistoryBytes=Math.max(this.maxEventBytes,t.maxHistoryBytes??16777216),this.createStreamId=t.createStreamId??(e=>`proxy_events_${e}_${s.randomUUID().replace(/-/g,"").slice(0,16)}`),this.projectTarget=t.projectTarget,this.unsubscribeBus=e.on(e=>this.accept(e))}stop(){this.unsubscribeBus();for(const e of this.streams.values())e.subscribers.clear();this.streams.clear()}cursor(e){const t=this.stream(e);return{streamId:t.streamId,revision:t.revision,earliestRetainedRevision:Ty(t)}}subscribe(e,t,n,s=()=>{}){const{bindingId:i,sourceControlPlaneId:r,targetNodeId:o}=e,a=this.stream(o),d=Ty(a);if(t>a.revision||t<d-1)return n(vs.parse({type:"control-plane-proxy.snapshot-required",protocolVersion:Wn,streamId:a.streamId,bindingId:i,sourceControlPlaneId:r,targetNodeId:o,sinceRevision:t,latestRevision:a.revision,earliestRetainedRevision:d,error:{code:rs.SnapshotRequired,message:"Proxy target event history cannot continue from the requested revision; fetch a new snapshot.",retryable:!0,details:{targetNodeId:o}}})),{kind:"snapshot-required",close:()=>{}};n(bs.parse({type:"control-plane-proxy.events.ready",protocolVersion:Wn,streamId:a.streamId,bindingId:i,sourceControlPlaneId:r,targetNodeId:o,latestRevision:a.revision,earliestRetainedRevision:d}));for(const e of a.history)e.event.revision>t&&n(Cy(e.event,i,r));const c={bindingId:i,sourceControlPlaneId:r,send:n,onDeliveryFailure:s};a.subscribers.add(c);let l=!1;return{kind:"subscribed",close:()=>{l||(l=!0,a.subscribers.delete(c))}}}diagnostics(e){const t=this.stream(e);return{targetNodeId:e,streamId:t.streamId,revision:t.revision,earliestRetainedRevision:Ty(t),historySize:t.history.length,historyBytes:t.historyBytes,subscribers:t.subscribers.size,subscriberBindings:[...t.subscribers].map(({bindingId:e,sourceControlPlaneId:t})=>({bindingId:e,sourceControlPlaneId:t}))}}accept(e){const t=e.scope?.nodeId;if("string"!=typeof t||!t)return;let n;try{n=this.projectTarget(t)}catch{return}if(!n)return;const s=this.stream(t),i=s.revision+1,r=Is.safeParse({type:"control-plane-proxy.event",protocolVersion:Wn,streamId:s.streamId,bindingId:"proxy_projection",sourceControlPlaneId:"proxy_projection",targetNodeId:t,revision:i,source:{id:e.id,seq:e.seq},target:n,event:{type:e.type,topic:e.topic,createdAt:e.createdAt}});if(!r.success)return;const{bindingId:o,sourceControlPlaneId:a,...d}=r.data,c=Ey(d);if(!(void 0===c||c>this.maxEventBytes-512)){for(s.revision=i,s.history.push({event:d,bytes:c}),s.historyBytes+=c;s.history.length>this.historyLimit||s.historyBytes>this.maxHistoryBytes;){const e=s.history.shift();e&&(s.historyBytes-=e.bytes)}for(const e of[...s.subscribers])try{const t=Cy(d,e.bindingId,e.sourceControlPlaneId),n=Ey(t);if(void 0===n||n>this.maxEventBytes)throw new Error("Proxy event byte limit exceeded.");e.send(t)}catch{s.subscribers.delete(e);try{e.onDeliveryFailure()}catch{}}}}stream(e){const t=this.streams.get(e);if(t)return t;const n={streamId:this.createStreamId(e),revision:0,history:[],historyBytes:0,subscribers:new Set};return this.streams.set(e,n),n}}function Ty(e){return e.history[0]?.event.revision??e.revision+1}function Cy(e,t,n){return Is.parse({...e,bindingId:t,sourceControlPlaneId:n})}function Ey(e){try{return Buffer.byteLength(JSON.stringify(e),"utf8")}catch{return}}function xy(e,t){const n=new WeakSet;let s=t,i=0;const r=e=>{if(s-=Buffer.byteLength(e,"utf8"),s<0)throw Ny("Proxy target projection byte limit exceeded.",{resource:"target-projection-bytes",limit:t})},o=(e,t)=>{if(i+=1,i>16384||t>24)throw Ny("Proxy target projection complexity limit exceeded.");if(null===e||"boolean"==typeof e)return e;if("string"==typeof e)return r(e),e;if("number"==typeof e)return Number.isFinite(e)?e:null;if("object"!=typeof e)return;if(n.has(e))throw Ny("Proxy target projection contains a cycle.",void 0,!1);if(n.add(e),Array.isArray(e)){const s=e.map(e=>o(e,t+1)??null);return n.delete(e),s}const s={};for(const[n,i]of Object.entries(e)){if("__proto__"===n||"constructor"===n||"prototype"===n)continue;r(n);const e=o(i,t+1);void 0!==e&&(s[n]=e)}return n.delete(e),s};return o(e,0)}function Ny(e,t,n=!0){return Object.assign(new Error(e),{code:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",statusCode:429,retryable:n,...t?{details:t}:{}})}function Ry(e){const{manageable:t,...n}=e;return n}const Oy=d.z.object({bindingId:d.z.string().trim().min(1).max(160)}).passthrough(),_y=d.z.object({route:Xn}).strict(),Py=d.z.object({sinceRevision:d.z.coerce.number().int().nonnegative()}).strict(),jy=new Set(["connection","cookie","host","keep-alive","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),Dy=524288;function My(e,t,n){const s=Hy(n.headers,ts);if(s!==Wn)throw Uy(rs.ProtocolUnsupported,"Control-plane proxy protocol version is unsupported.",426,!1,{requestedVersion:s,supportedVersion:Wn});const i=Hy(n.headers,ns),r=Hy(n.headers,ss),o=Hy(n.headers,is);if(!i||!r||!o)throw Uy(rs.AuthenticationFailed,"Proxy binding authentication headers are incomplete.",401);return e.authenticateBinding(t,{sourceControlPlaneId:i,bindingKeyId:r,credential:o})}function Ly(e,t,n){const s=My(e,t.id,n);if(s.id!==t.id||s.revision!==t.revision||s.sourceControlPlaneId!==t.sourceControlPlaneId||s.targetNodeId!==t.targetNodeId||s.bindingKeyId!==t.bindingKeyId||"active"!==s.status)throw Uy(rs.BindingIdentityConflict,"Proxy binding changed while the request was being established.",409,!0,{bindingId:t.id,expectedRevision:t.revision,actualRevision:s.revision})}function qy(e,t){if(t.id!==e.targetNodeId)throw Uy(rs.TargetMismatch,"Proxy target resolver returned another node.",409,!1,{bindingId:e.id,targetNodeId:e.targetNodeId})}function $y(e){for(const t of Object.keys(e)){const e=t.toLowerCase();if(e.startsWith("x-taskhandoff-node-")||e.startsWith("x-task-handoff-node-"))throw Uy(rs.HeaderInvalid,"Caller-supplied node transport authentication headers are forbidden.",400,!1,{header:e})}const t=Object.fromEntries([...Zn].flatMap(t=>{if(jy.has(t))return[];const n=e[t];return void 0===n?[]:[[t,Array.isArray(n)?n.join(", "):String(n)]]}));if(void 0!==t["x-request-id"]){const e=Yn.safeParse(t["x-request-id"]);if(!e.success)throw Uy(rs.HeaderInvalid,"Proxy request correlation id is invalid.",400,!1,{header:"x-request-id"});t["x-request-id"]=e.data}if(void 0!==t[ba]){const e=Yn.safeParse(t[ba]);if(!e.success)throw Uy(rs.HeaderInvalid,"Proxy trace id is invalid.",400,!1,{header:ba});t[ba]=e.data}return t}function By(e,t,n){const s=Fy(t),i=Wy(n?.headers);return i&&e.header("x-request-id",i),e.code(s.statusCode).send({error:{code:s.code,message:s.message,retryable:s.retryable,...s.details?{details:s.details}:{}}})}function Fy(e){const t=e&&"object"==typeof e?e:{},n="number"==typeof t.statusCode?t.statusCode:502;return{statusCode:n,code:("string"==typeof t.code?t.code:void 0)||rs.TransportFailed,message:e instanceof Error?e.message:"Control-plane proxy transport failed.",retryable:"boolean"==typeof t.retryable?t.retryable:n>=500,details:t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?t.details:void 0}}function Uy(e,t,n,s=!1,i){return Object.assign(new Error(t),{code:e,statusCode:n,retryable:s,...i?{details:i}:{}})}function Hy(e,t){const n=e[t];return Array.isArray(n)?n.join(","):"string"==typeof n?n:""}function Wy(e){if(!e)return;const t=Yn.safeParse(Hy(e,"x-request-id"));return t.success?t.data:void 0}function Gy(e){let t="";for(const n of e){if(Buffer.byteLength(t+n)>123)break;t+=n}return t}const Vy=e=>as.parse({code:rs.Unavailable,message:e,retryable:!0});class Ky{service;subscriptions=new Map;fetchImpl;openWebSocket;onStateChanged;logger;running=!1;constructor(e,t={}){this.service=e,this.fetchImpl=t.fetchImpl??fetch,this.openWebSocket=t.openWebSocket??((e,t)=>new p.WebSocket(e,{headers:t})),this.onStateChanged=t.onStateChanged??(()=>{}),this.logger=t.logger}start(){this.running||(this.running=!0,this.syncNow())}syncNow(){if(!this.running)return;const e=new Map(this.service.listNodes().filter(e=>"control-plane-proxy"===e.connectionMode&&!1!==e.connectionEnabled).map(e=>[e.id,e]));for(const t of this.subscriptions.keys())e.has(t)||this.remove(t);for(const t of e.values()){const e=this.subscriptionIdentity(t),n=this.subscriptions.get(t.id);if(n?.identity===e)continue;n&&this.remove(t.id);const s={generation:1,identity:e,retry:new rm};this.subscriptions.set(t.id,s),this.connect(t.id,s.generation)}}stop(){this.running=!1;for(const e of[...this.subscriptions.keys()])this.remove(e)}remove(e){const t=this.subscriptions.get(e);t&&(t.generation+=1,t.reconnect&&clearTimeout(t.reconnect),t.socket?.close(),this.subscriptions.delete(e))}async connect(e,t){if(!this.current(e,t))return;const n=this.service.proxyPrivateStore.nodeCredential(e);if(n)try{const s=await this.fetchImpl(function(e){return new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/snapshot`,e.proxyOrigin)}(n),{headers:qd(n)});if(!this.current(e,t))return;const i=await s.json().catch(()=>{});if(!s.ok){const n=ra(as,i?.error),r=n.success?n.data:Vy(`Proxy snapshot failed with HTTP ${s.status}.`);return r.code===rs.BindingRevoked||r.code===rs.BindingUnknown?void this.onStateChanged(this.service.markProxyBindingRevoked(e,r)):void this.fail(e,t,r,r.retryable)}const r=oa(fs,i?.data);if(this.validateIdentity(n,r.binding.id,r.binding.targetNodeId),this.onStateChanged(this.service.applyProxyTargetSnapshot(e,r)),"revoked"===r.binding.status)return void this.onStateChanged(this.service.markProxyBindingRevoked(e,{code:rs.BindingRevoked,message:"Control-plane proxy binding was revoked.",retryable:!1}));this.openEvents(e,t,n,r)}catch(n){if(!this.current(e,t))return;this.logger?.warn?.({nodeId:e,error:Jy(n)},"control-plane proxy state bootstrap failed"),this.fail(e,t,Vy("Trusted control-plane proxy is unavailable."),!0)}else this.fail(e,t,Vy("Control-plane proxy credential is unavailable."),!1)}openEvents(e,t,n,s){const i=this.current(e,t);if(!i)return;const r=this.openWebSocket(function(e,t){const n=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/events`,e.proxyOrigin);return n.protocol="wss:",n.searchParams.set("sinceRevision",String(t)),n.toString()}(n,s.revision),qd(n));i.socket=r;let o=!1;const a=n=>{o||(o=!0,this.fail(e,t,Vy(n),!0))};r.on("message",r=>{if(this.current(e,t))try{const o=oa(Ss,JSON.parse(String(r)));if(o.bindingId!==n.proxyBindingId||o.sourceControlPlaneId!==n.sourceControlPlaneId||o.targetNodeId!==n.targetNodeId||o.streamId!==s.streamId)throw new Error("Proxy event stream identity changed.");if("control-plane-proxy.snapshot-required"===o.type)return void this.restart(e,t);if("control-plane-proxy.events.ready"===o.type)return void i.retry.reset();this.onStateChanged(this.service.applyProxyTargetEvent(e,o))}catch(n){this.logger?.warn?.({nodeId:e,error:Jy(n)},"control-plane proxy event requires a new snapshot"),this.restart(e,t)}}),r.on("error",()=>a("Control-plane proxy event stream failed.")),r.on("close",()=>a("Control-plane proxy event stream disconnected."))}restart(e,t){const n=this.current(e,t);n&&(n.generation+=1,n.socket?.close(),n.socket=void 0,this.connect(e,n.generation))}fail(e,t,n,s){const i=this.current(e,t);if(!i)return;if(this.onStateChanged(this.service.markProxyUnavailable(e,n)),!s)return i.generation+=1,i.socket?.close(),void this.subscriptions.delete(e);i.generation+=1,i.socket?.close(),i.socket=void 0;const r=i.retry.next();i.reconnect=setTimeout(()=>{i.reconnect=void 0,this.connect(e,i.generation)},r.delay),i.reconnect.unref?.()}current(e,t){const n=this.subscriptions.get(e);return this.running&&n?.generation===t?n:void 0}validateIdentity(e,t,n){if(t!==e.proxyBindingId||n!==e.targetNodeId){const e=new Error("Proxy snapshot identity does not match the private binding credential.");throw Object.assign(e,{code:rs.BindingIdentityConflict}),e}}subscriptionIdentity(e){const t=this.service.proxyPrivateStore.nodeCredential(e.id);return JSON.stringify({connectionMode:e.connectionMode,connectionPath:e.connectionPath,credential:t&&{id:t.id,proxyOrigin:t.proxyOrigin,proxyBindingId:t.proxyBindingId,targetNodeId:t.targetNodeId,sourceControlPlaneId:t.sourceControlPlaneId,bindingKeyId:t.bindingKeyId,updatedAt:t.updatedAt}})}}function Jy(e){const t=e&&"object"==typeof e?e:{};return{name:e instanceof Error?e.name:"Error",message:e instanceof Error?e.message:String(e),..."string"==typeof t.code?{code:t.code}:{}}}const Yy=d.z.object({id:d.z.string().trim().min(1).max(160)}).strict(),Qy=d.z.object({}).strict(),Xy=d.z.object({force:d.z.enum(["true","false"]).optional()}).strict(),Zy=d.z.object({algorithm:d.z.literal("Ed25519"),publicKey:d.z.string().regex(/^[A-Za-z0-9_-]{43}$/),privateKeyPkcs8:d.z.string().regex(/^[A-Za-z0-9_-]{64}$/)}).strip();function ef(){const{publicKey:e,privateKey:t}=s.generateKeyPairSync("ed25519"),n=e.export({format:"jwk"});if(!n.x)throw new Error("Generated Control Plane identity did not contain an Ed25519 public key.");return{algorithm:"Ed25519",publicKey:n.x,privateKeyPkcs8:t.export({format:"der",type:"pkcs8"}).toString("base64url")}}function tf(e){return`sha256:${s.createHash("sha256").update(Buffer.from(e,"base64url")).digest("base64url")}`}function nf(e){return Array.isArray(e)?`[${e.map(nf).join(",")}]`:e&&"object"==typeof e?`{${Object.entries(e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>`${JSON.stringify(e)}:${nf(t)}`).join(",")}}`:JSON.stringify(e)}class sf{identity;controlPlaneId;constructor(e,t,n){this.controlPlaneId=t,this.identity=new Mo(e,ef,{schema:Zy,logger:n,directoryMode:448,fileMode:384})}init(){this.identity.init(),this.privateKey()}publicDocument(e,t=Date.now()){const n=this.identity.get(),i={authentication:e,aiSessions:!0,nodes:!0,instanceBoard:!0,triggers:!0},r=wo.parse({version:1,kind:"control-plane",controlPlaneId:this.controlPlaneId(),publicKey:{algorithm:"Ed25519",encoding:"base64url",value:n.publicKey,fingerprint:tf(n.publicKey)},capabilities:i,protocolVersion:"2026-08-09",issuedAt:new Date(t).toISOString(),expiresAt:new Date(t+3e5).toISOString()}),o=s.sign(null,Buffer.from((a=r,JSON.stringify(wo.parse(a)))),this.privateKey()).toString("base64url");var a;return Ao.parse({data:{payload:r,signature:o}})}publicIdentity(){const e=this.identity.get();return{controlPlaneId:this.controlPlaneId(),algorithm:e.algorithm,publicKey:e.publicKey,fingerprint:tf(e.publicKey)}}signCloudBindingChallenge(e){return s.sign(null,Buffer.from(`task-handoff:cloud-binding-challenge:v1\n${nf(e)}`),this.privateKey()).toString("base64url")}signCloudOutboundRegistration(e){return s.sign(null,Buffer.from((t=e,`task-handoff:outbound-control-registration:v1\n${pn(wn.parse(t))}`)),this.privateKey()).toString("base64url");var t}acceptCloudAccessHandshake(e,t){return function(e){const t=An.parse(e.ticket),n=Tn.parse(e.clientHello);if(t.ticketId!==n.ticketId||t.deviceSessionId!==n.deviceSessionId||t.targetPublicKeyFingerprint!==e.controlPlaneFingerprint)throw Cn();const i=s.generateKeyPairSync("x25519"),r=function(e){const t=e.export({format:"jwk"}).x;if(!t)throw Cn();return t}(i.publicKey),o=function(e,t,n){return s.createHash("sha256").update(pn({audience:e.audience,ticketId:e.ticketId,accountId:e.accountId,deviceSessionId:e.deviceSessionId,controlPlaneId:e.controlPlaneId,bindingId:e.bindingId,bindingRevision:e.bindingRevision,nonce:e.nonce,clientEphemeralPublicKey:t,serverEphemeralPublicKey:n})).digest("base64url")}(t,n.clientEphemeralPublicKey,r);var a;const d=function(e,t){return s.createHash("sha256").update(e).update(t).update("task-handoff:control-plane-access:e2e:v1").digest()}(s.diffieHellman({privateKey:i.privateKey,publicKey:(a=n.clientEphemeralPublicKey,s.createPublicKey({key:{kty:"OKP",crv:"X25519",x:a},format:"jwk"}))}),o);return{sessionKey:d,response:{serverEphemeralPublicKey:r,transcript:o,signature:s.sign(null,Buffer.from(o),e.controlPlanePrivateKey).toString("base64url")}}}({ticket:e,clientHello:t,controlPlaneFingerprint:this.publicIdentity().fingerprint,controlPlanePrivateKey:this.privateKey()})}privateKey(){const e=this.identity.get(),t=s.createPrivateKey({key:Buffer.from(e.privateKeyPkcs8,"base64url"),format:"der",type:"pkcs8"});if(s.createPublicKey(t).export({format:"jwk"}).x!==e.publicKey)throw new Error("Stored Control Plane signing identity public and private keys do not match.");return t}}class rf{observations=new Map;listeners=new Set;begin(e,t,n="connecting"){const s=this.observations.get(e),i={nodeId:e,transport:t,generation:(s?.generation||0)+1,phase:n,changedAt:(new Date).toISOString(),consecutiveFailures:s?.transport===t?s.consecutiveFailures:0,controlReachability:s?.transport===t?s.controlReachability:"unknown",controlChangedAt:s?.transport===t?s.controlChangedAt:void 0,controlError:s?.transport===t?s.controlError:void 0};return this.observations.set(e,i),this.publish(i),i.generation}update(e,t,n,s=!0){const i=this.observations.get(e);if(!i||i.generation!==t)return!1;const r={...i,...n,changedAt:(new Date).toISOString()};return this.observations.set(e,r),s&&this.publish(r),!0}connected(e,t){const n=(new Date).toISOString();return this.update(e,t,{phase:"healthy",connectedAt:n,lastSeenAt:n,nextRetryAt:void 0,error:void 0})}pong(e,t,n={}){const s=(new Date).toISOString();return this.update(e,t,{lastSeenAt:s,lastPongAt:s,...void 0===n.pingRttMs?{}:{pingRttMs:n.pingRttMs},...void 0===n.pingRttP95Ms?{}:{pingRttP95Ms:n.pingRttP95Ms}},!1)}stable(e,t){return this.update(e,t,{consecutiveFailures:0},!1)}observedReachable(e){if("control-plane-proxy"===e.connectionMode)return!1;const t="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http",n=this.observations.get(e.id),s=n?.transport===t?n.generation:this.begin(e.id,t,"handshaking");if("direct-http"===t){const t=(new Date).toISOString();return"reachable"===n?.controlReachability?this.update(e.id,s,{lastSeenAt:t},!1):this.update(e.id,s,{controlReachability:"reachable",controlChangedAt:t,controlError:void 0,lastSeenAt:t})}return"healthy"===n?.phase?this.update(e.id,s,{lastSeenAt:(new Date).toISOString()},!1):this.connected(e.id,s)}observedFailure(e,t){if("control-plane-proxy"===e.connectionMode)return!1;const n="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http",s=this.observations.get(e.id),i=s?.transport===n?s.generation:this.begin(e.id,n,"connecting");return"direct-http"===n?"unreachable"===s?.controlReachability?this.update(e.id,i,{controlError:t},!1):this.update(e.id,i,{controlReachability:"unreachable",controlChangedAt:(new Date).toISOString(),controlError:t}):this.disconnected(e.id,i,{error:t})}disconnected(e,t,n={}){const s=this.observations.get(e);return!(!s||s.generation!==t)&&this.update(e,t,{phase:n.nextRetryAt?"reconnecting":"offline",consecutiveFailures:s.consecutiveFailures+1,closeCode:n.closeCode,error:n.error,nextRetryAt:n.nextRetryAt})}observation(e){return this.observations.get(e)}onChange(e){return this.listeners.add(e),()=>this.listeners.delete(e)}project(e){if(!1===e.connectionEnabled)return{...e,status:"offline",health:"failed",connectionPhase:"offline"};if("direct-http"!==e.connectionMode&&"reverse-wss"!==e.connectionMode&&"local-ipc"!==e.connectionMode&&"local-loopback"!==e.connectionMode)return e;const t=this.observations.get(e.id),n="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http";if(!t||t.transport!==n)return"direct-http"===n?{...e,status:"unknown",health:"unknown",connectionPhase:"connecting"}:e;const s={...void 0===t.pingRttMs?{}:{pingRttMs:t.pingRttMs},...void 0===t.pingRttP95Ms?{}:{pingRttP95Ms:t.pingRttP95Ms},consecutiveReconnects:t.consecutiveFailures,...t.nextRetryAt?{nextRetryAt:t.nextRetryAt}:{}};return"direct-http"===n?"reachable"===t.controlReachability?{...e,connectionDiagnostics:s,status:"online",health:"unknown"===e.health||"failed"===e.health?"ok":e.health,lastSeenAt:t.lastSeenAt||e.lastSeenAt,connectionPhase:"healthy"}:{...e,connectionDiagnostics:s,status:"unreachable"===t.controlReachability?"offline":"unknown",health:"unreachable"===t.controlReachability?"failed":"unknown",lastSeenAt:t.lastSeenAt,connectionPhase:"unreachable"===t.controlReachability?"offline":"connecting"}:"healthy"===t.phase?{...e,connectionDiagnostics:s,status:"online",health:"unknown"===e.health?"ok":e.health,lastSeenAt:t.lastSeenAt||t.connectedAt,connectionPhase:t.phase}:"connecting"===t.phase||"handshaking"===t.phase||"reconnecting"===t.phase||"suspect"===t.phase?{...e,connectionDiagnostics:s,status:"offline",health:"degraded",lastSeenAt:t.lastSeenAt,connectionPhase:t.phase}:{...e,connectionDiagnostics:s,status:"offline",health:"failed",lastSeenAt:t.lastSeenAt,connectionPhase:t.phase}}diagnostics(){return[...this.observations.values()].map(e=>({...e}))}publish(e){for(const t of this.listeners)t({...e})}}function of(e,n){const s=t.extname(e);return`${s?e.slice(0,-s.length):e}.${n}${s}`}const af=1048576,df=52428800;function cf(e){return e instanceof Error?{name:e.name,message:e.message,stack:e.stack}:e}function lf(e){const s=[],i=e=>{if(n.existsSync(e))for(const r of n.readdirSync(e,{withFileTypes:!0})){const n=t.join(e,r.name);r.isSymbolicLink()||(r.isDirectory()?i(n):r.isFile()&&(r.name.endsWith(".log")||r.name.endsWith(".jsonl"))&&s.push(n))}};return i(e),s.sort()}function pf(e,s,i){const r=n.statSync(e),o=Math.min(r.size,af,i);if(o<=0)return 0;const a=Buffer.allocUnsafe(o),d=n.openSync(e,"r");try{n.readSync(d,a,0,o,Math.max(0,r.size-o))}finally{n.closeSync(d)}return n.mkdirSync(t.dirname(s),{recursive:!0,mode:448}),n.writeFileSync(s,a,{mode:384}),o}const uf=d.z.object({version:d.z.literal(1),serviceOrigin:d.z.string().url(),status:d.z.enum(["unbound","pending-claim","active","pending-revocation","clone-conflict"]),remoteAccessEnabled:d.z.boolean(),accountId:d.z.string().optional(),bindingId:d.z.string().optional(),bindingRevision:d.z.number().int().positive().optional(),backgroundCredential:d.z.string().min(32).optional(),updatedAt:d.z.string().datetime(),connectionEpoch:d.z.number().int().nonnegative().default(0)}).strip();class hf{state;challenges=new Map;identity;serviceOrigin;clock;constructor(e){this.identity=e.identity,this.serviceOrigin=new URL(e.serviceOrigin).origin,this.clock=e.clock??Date.now,this.state=new Mo(e.statePath,()=>({version:1,serviceOrigin:this.serviceOrigin,status:"unbound",remoteAccessEnabled:!0,updatedAt:new Date(this.clock()).toISOString(),connectionEpoch:0}),{schema:uf,directoryMode:448,fileMode:384})}init(){if(this.state.init(),this.state.get().serviceOrigin!==this.serviceOrigin)throw gf("CLOUD_SERVICE_ORIGIN_CHANGED","Cloud service origin does not match persisted binding authority.")}snapshot(){const{backgroundCredential:e,connectionEpoch:t,...n}=this.state.get();return{...n,identity:this.identity.publicIdentity(),hasBackgroundCredential:Boolean(e)}}createChallenge(){const e=this.state.get();if(["active","pending-revocation","clone-conflict"].includes(e.status))throw gf("active"===e.status?"CONTROL_PLANE_ALREADY_BOUND":"BINDING_STATE_CONFLICT","Existing cloud binding must be resolved first.");this.prune();const t=Po("binding_challenge"),n=s.randomBytes(32).toString("base64url"),i=this.challengePayload(t);return this.challenges.set(t,{digest:mf(n),payload:i,expiresAtMs:Date.parse(i.expiresAt)}),this.state.put({...e,status:"pending-claim",updatedAt:new Date(this.clock()).toISOString()}),{challengeCode:`${t}.${n}`,authorizationUrl:`${this.serviceOrigin}/bindings/authorize`,payload:i,signature:this.identity.signCloudBindingChallenge(i)}}consumeChallenge(e){const t=e.challengeCode.indexOf("."),n=e.challengeCode.slice(0,t),i=e.challengeCode.slice(t+1),r=this.challenges.get(n);if(r&&this.challenges.delete(n),!r||r.expiresAtMs<=this.clock()||(o=r.digest,a=mf(i),o.length!==a.length||!s.timingSafeEqual(o,a)))throw gf("BINDING_CHALLENGE_INVALID_OR_CONSUMED","Binding challenge is invalid, expired, or consumed.");var o,a;if(r.payload.controlPlaneId!==e.controlPlaneId||r.payload.publicKeyFingerprint!==e.fingerprint)throw gf("BINDING_IDENTITY_CONFLICT","Binding challenge identity does not match.");return r.payload}activate(e){const t=this.state.get();if("active"===t.status){if(t.accountId===e.accountId&&t.bindingId===e.bindingId&&t.bindingRevision===e.bindingRevision)return this.snapshot();throw gf("CONTROL_PLANE_ALREADY_BOUND","Control Plane is already bound to another account.")}if("pending-claim"!==t.status)throw gf("BINDING_STATE_CONFLICT","Control Plane has no pending binding claim.");return this.state.put({...t,status:"active",remoteAccessEnabled:!0,...e,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}setRemoteAccess(e){const t=this.state.get();return this.state.put({...t,remoteAccessEnabled:e,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}beginRevocation(){const e=this.state.get();return"unbound"===e.status||(this.challenges.clear(),this.state.put({...e,status:"pending-revocation",remoteAccessEnabled:!1,updatedAt:new Date(this.clock()).toISOString()})),this.snapshot()}confirmRevocation(){const e=this.state.get();return this.state.put({version:1,serviceOrigin:e.serviceOrigin,status:"unbound",remoteAccessEnabled:!1,updatedAt:new Date(this.clock()).toISOString(),connectionEpoch:e.connectionEpoch}),this.snapshot()}markCloneConflict(){const e=this.state.get();return this.challenges.clear(),this.state.put({...e,status:"clone-conflict",remoteAccessEnabled:!1,backgroundCredential:void 0,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}backgroundCredential(){const e=this.state.get();return"active"===e.status&&e.remoteAccessEnabled?e.backgroundCredential:void 0}nextConnectionEpoch(){const e=this.state.get(),t=e.connectionEpoch+1;return this.state.put({...e,connectionEpoch:t,updatedAt:new Date(this.clock()).toISOString()}),t}challengePayload(e){const t=this.identity.publicIdentity(),n=this.clock();return{protocolVersion:"2026-08-10",audience:"task-handoff:binding",serviceOrigin:this.serviceOrigin,challengeId:e,controlPlaneId:t.controlPlaneId,publicKey:t.publicKey,publicKeyFingerprint:t.fingerprint,nonce:s.randomBytes(24).toString("base64url"),issuedAt:new Date(n).toISOString(),expiresAt:new Date(n+3e5).toISOString()}}prune(){const e=this.clock();for(const[t,n]of this.challenges)n.expiresAtMs<=e&&this.challenges.delete(t)}}function mf(e){return s.createHash("sha256").update(e).digest()}function gf(e,t){return Object.assign(new Error(t),{code:e,statusCode:e.includes("CONFLICT")||e.includes("BOUND")?409:400})}class yf{revision=0;options;constructor(e){this.options=e}async apply(e){if(!Number.isSafeInteger(e.bindingRevision)||e.bindingRevision<this.revision)return{applied:!1,reason:"stale-revision"};if(this.revision=e.bindingRevision,"binding-revoked"===e.type||"account-disabled"===e.type||"background-credential-revoked"===e.type)this.options.state.beginRevocation(),await Promise.all([this.options.connections.stop(e.type),this.options.dataConnections.closeAll(e.type)]),this.options.state.confirmRevocation();else if("remote-access-changed"===e.type)this.options.state.setRemoteAccess(!0===e.enabled),e.enabled||await Promise.all([this.options.connections.stop("remote-access-disabled"),this.options.dataConnections.closeAll("remote-access-disabled")]);else{if("identity-clone-detected"!==e.type)return{applied:!1,reason:"unsupported-event"};this.options.state.markCloneConflict(),await Promise.all([this.options.connections.stop(e.type),this.options.dataConnections.closeAll(e.type)])}return{applied:!0}}}class ff{connection;processInstanceId=`control_plane_process_${s.randomUUID().replaceAll("-","_")}`;backoff;options;constructor(e){this.options=e,this.backoff=e.backoff??new rm}async connectOnce(){const e=this.options.state.backgroundCredential(),t=this.options.state.snapshot();if(!t.remoteAccessEnabled||!("pending-claim"===t.status||"active"===t.status&&Boolean(e)))return{status:"disabled"};if(this.connection)return{status:"connected",reused:!0};const n=this.options.state.nextConnectionEpoch(),s=this.connection;return this.connection=await this.options.connector.connect({serviceOrigin:t.serviceOrigin,credential:e,bindingId:t.bindingId,bindingRevision:t.bindingRevision,controlPlaneId:t.identity.controlPlaneId,processInstanceId:this.processInstanceId,epoch:n,onEvent:this.options.onEvent}),await(s?.close("replaced-by-new-epoch")),this.backoff.reset(),{status:"connected",epoch:n}}reconnectDelay(){return this.backoff.next().delay}disconnected(){this.connection=void 0}async stop(e){const t=this.connection;this.connection=void 0,await(t?.close(e))}}class If{connections=new Map;options;constructor(e){this.options=e}async attach(e){const t=await this.options.verifyAllocation(e),n=this.connections.get(t.allocationId);if(n&&t.epoch<=n.epoch)throw Object.assign(new Error("Cloud connection state is invalid."),{code:"STALE_CONNECTION_EPOCH"});const s=await this.options.connector.connect({relayUrl:t.relayUrl,allocation:e,epoch:t.epoch});return await(n?.connection.close("replaced-by-new-epoch")),this.connections.set(t.allocationId,{epoch:t.epoch,connection:s}),{status:"attached",allocationId:t.allocationId,epoch:t.epoch}}async closeAll(e){const t=[...this.connections.values()];this.connections.clear(),await Promise.allSettled(t.map(({connection:t})=>t.close(e)))}}class bf{options;constructor(e){this.options=e}async disconnect(){const e=this.options.state.snapshot();if(!e.bindingId)return e;this.options.state.beginRevocation(),await this.options.connections.stop("binding-pending-revocation");try{if("revoked"===(await this.options.remote.revoke({bindingId:e.bindingId})).status)return this.options.state.confirmRevocation()}catch{}return this.options.state.snapshot()}async setRemoteAccess(e){const t=this.options.state.snapshot();if(this.options.state.setRemoteAccess(e),e||await this.options.connections.stop("remote-access-disabled"),t.bindingId)try{await this.options.remote.setRemoteAccess({bindingId:t.bindingId,enabled:e})}catch{return{...this.options.state.snapshot(),remoteResult:"unknown"}}return{...this.options.state.snapshot(),remoteResult:"confirmed"}}}class vf{options;constructor(e){this.options=e}async connect(e){const t=e.allocation,n=kn.parse(t.attach),s=An.parse(t.ticket),i=new(this.options.webSocket??p)(e.relayUrl,{followRedirects:!1,handshakeTimeout:1e4,perMessageDeflate:!1});return await function(e){return new Promise((t,n)=>{e.once("open",t),e.once("error",n),e.once("close",()=>n(zf("RELAY_SOCKET_CLOSED")))})}(i),i.send(JSON.stringify({type:"attach",capability:n})),async function(e,t,n,s,i){const r=await wf(e,e=>"frame"===e?.type&&"handshake"===e.frame?.kind);if(r.frame.channelId!==t||0!==r.frame.sequence)throw zf("RELAY_HANDSHAKE_SEQUENCE_INVALID");const o=JSON.parse(Buffer.from(r.frame.ciphertext,"base64url").toString("utf8")),a=s.acceptCloudAccessHandshake(n,o),d={...a.response,controlPlanePublicKey:s.publicIdentity().publicKey};e.send(JSON.stringify({type:"frame",frame:{protocolVersion:"2026-08-10",channelId:t,sequence:0,kind:"handshake",ciphertext:Buffer.from(JSON.stringify(d)).toString("base64url")}}));const c={type:"cloud-account",accountId:n.accountId,deviceSessionId:n.deviceSessionId,bindingId:n.bindingId,bindingRevision:n.bindingRevision},l=new Sf(e,t,a.sessionKey,c,i);return l.start(),{close:(e="normal")=>l.close(e)}}(i,(await wf(i,e=>"attached"===e?.type)).channelId,s,this.options.identity,this.options.bridge)}}class Sf{receiveSequence=1;sendSequence=1;receiveCounter=0;sendCounter=0;unsubscribe;ttys=new Map;socket;channelId;key;actor;bridge;constructor(e,t,n,s,i){this.socket=e,this.channelId=t,this.key=n,this.actor=s,this.bridge=i}start(){this.socket.on("message",e=>{this.receive(e).catch(()=>this.socket.close(4400,"encrypted-protocol-error"))}),this.socket.once("close",()=>{this.unsubscribe?.();for(const e of this.ttys.values())e.close();this.ttys.clear()})}async close(e){this.unsubscribe?.();for(const e of this.ttys.values())e.close();this.ttys.clear(),this.socket.readyState<p.CLOSING&&this.socket.close(1e3,e.slice(0,120))}async receive(e){const t=JSON.parse(e.toString()),n=t?.frame;if("frame"!==t?.type||n?.channelId!==this.channelId||n.sequence!==this.receiveSequence++)throw zf("RELAY_FRAME_SEQUENCE_INVALID");const s=w.secretbox.open(Buffer.from(n.ciphertext,"base64url"),Af(1,this.receiveCounter++),this.key);if(!s)throw zf("RELAY_E2E_DECRYPT_FAILED");const i=JSON.parse(Buffer.from(s).toString("utf8"));await this.dispatch(i)}async dispatch(e){if("request"===e.type&&e.id){try{const t=await this.bridge.request(this.actor,e.body);this.send({type:"response",id:e.id,status:t.status,body:t.body})}catch(t){this.send({type:"response",id:e.id,status:Number(t?.statusCode)||500,body:{error:{code:t?.code??"CONTROL_PLANE_ERROR",message:"Control Plane request failed."}}})}return}if("event-subscribe"===e.type){this.unsubscribe?.();const t=Array.isArray(e.body?.topics)?e.body.topics.map(String):["*"],n=yo.safeParse(e.body?.aiSessionTransient);return void(this.unsubscribe=this.bridge.subscribe(this.actor,t,e=>this.send({type:"event",event:e}),n.success?n.data:void 0))}if("tty-open"===e.type&&e.streamId&&this.bridge.openTty){const t=e.streamId,n=await this.bridge.openTty(this.actor,e.body,e=>this.send({...e,streamId:t}));return this.ttys.set(t,n),void this.send({type:"tty-opened",streamId:t})}const t=e.streamId?this.ttys.get(e.streamId):void 0;if(t&&"tty-input"===e.type)return t.send(String(e.data??""));if(t&&"tty-resize"===e.type)return t.resize(Number(e.body?.cols),Number(e.body?.rows));if(t&&"tty-close"===e.type)return t.close(),this.ttys.delete(e.streamId),void this.send({type:"tty-closed",streamId:e.streamId});if("cancel"!==e.type)throw zf("RELAY_ENVELOPE_UNSUPPORTED")}send(e){if(this.socket.readyState!==p.OPEN||this.socket.bufferedAmount>2097152)throw zf("RELAY_BACKPRESSURE_LIMIT");const t=w.secretbox(Buffer.from(JSON.stringify(e)),Af(2,this.sendCounter++),this.key);this.socket.send(JSON.stringify({type:"frame",frame:{protocolVersion:"2026-08-10",channelId:this.channelId,sequence:this.sendSequence++,kind:"cancel"===e.type?"cancel":"data",ciphertext:Buffer.from(t).toString("base64url")}}))}}function wf(e,t){return new Promise((n,s)=>{const i=e=>{try{const s=JSON.parse(e.toString());t(s)&&(o(),n(s))}catch(e){o(),s(e)}},r=()=>{o(),s(zf("RELAY_SOCKET_CLOSED"))},o=()=>{e.off("message",i),e.off("close",r)};e.on("message",i),e.once("close",r)})}function Af(e,t){const n=new Uint8Array(24);return n[0]=e,new DataView(n.buffer).setBigUint64(16,BigInt(t),!1),n}function zf(e){return Object.assign(new Error("Cloud Relay session is invalid."),{code:e,retryable:!0})}class kf{current;options;constructor(e){this.options=e}async connect(e){const t=this.options.identity.publicIdentity(),n=Date.now(),i={protocolVersion:"2026-08-10",audience:"task-handoff:coordinator-control",connectionId:`connection_${s.randomUUID().replaceAll("-","_")}`,processInstanceId:e.processInstanceId,controlPlaneId:t.controlPlaneId,publicKey:t.publicKey,publicKeyFingerprint:t.fingerprint,...e.bindingId?{bindingId:e.bindingId,bindingRevision:e.bindingRevision}:{},epoch:e.epoch,capabilities:["request","stream","websocket"],issuedAt:new Date(n).toISOString(),expiresAt:new Date(n+3e5).toISOString()},r=new URL("/api/v1/control-plane/connect",e.serviceOrigin);r.protocol="https:"===r.protocol?"wss:":"ws:";const o=new(this.options.webSocket??p)(r.href,{followRedirects:!1,handshakeTimeout:1e4});let a;return a=await function(e,t){return new Promise((n,i)=>{const r=new Map;let o,a=!1,d=!1;const c=e=>{for(const t of r.values())t.reject(e);r.clear(),a||i(e)},l={request(t,n){if(e.readyState!==p.OPEN)return Promise.reject(Cf("CLOUD_CONTROL_CONNECTION_UNAVAILABLE"));const i=`request_${s.randomUUID().replaceAll("-","_")}`;return e.send(JSON.stringify({type:"request",requestId:i,operation:t,payload:n})),new Promise((e,t)=>r.set(i,{resolve:e,reject:t}))},async close(t="normal"){d=!0,o&&clearInterval(o),e.close(1e3,t.slice(0,120))}};e.on("open",()=>e.send(JSON.stringify(t.register))),e.on("message",async s=>{let i;try{i=JSON.parse(s.toString())}catch{return e.close(1002,"invalid-json")}if("registered"===i.type)return a=!0,o=setInterval(()=>e.readyState===p.OPEN&&e.send(JSON.stringify({type:"heartbeat"})),1e4),o.unref(),n(l);if("event"===i.type)return t.onEvent(i.event);if("response"===i.type){const e=r.get(i.requestId);if(!e)return;return r.delete(i.requestId),i.error?e.reject(Object.assign(new Error(i.error.message),{code:i.error.code})):e.resolve(i.data)}if("request"===i.type&&t.onRequest)try{e.send(JSON.stringify({type:"response",requestId:i.requestId,data:await t.onRequest(i.operation,i.payload)}))}catch(t){e.send(JSON.stringify({type:"response",requestId:i.requestId,error:{code:t?.code??"REQUEST_FAILED",message:t instanceof Error?t.message:String(t)}}))}}),e.on("error",e=>c(e)),e.on("close",()=>{o&&clearInterval(o),c(Cf("CLOUD_CONTROL_CONNECTION_CLOSED")),d||t.onDisconnected()})})}(o,{register:{type:"register",registration:{...i,signature:this.options.identity.signCloudOutboundRegistration(i)},backgroundCredential:e.credential},onEvent:e.onEvent,onRequest:this.options.onRequest,onDisconnected:()=>{this.current===a&&(this.current=void 0),this.options.onDisconnected()}}),this.current=a,a}async request(e,t){if(!this.current)throw Cf("CLOUD_CONTROL_CONNECTION_UNAVAILABLE");return this.current.request(e,t)}}class Tf{lifecycle;dataConnections;connector;control;events;timer;running=!1;connecting;options;constructor(e){this.options=e,this.connector=new kf({identity:e.identity,webSocket:e.webSocket,onDisconnected:()=>{this.control.disconnected(),this.schedule()},onRequest:(e,t)=>this.handleRequest(e,t)});const t=e.relayConnector??(e.relayBridge?new vf({identity:e.identity,bridge:e.relayBridge,webSocket:e.webSocket}):{async connect(){throw Cf("CLOUD_RELAY_CONNECTOR_UNAVAILABLE")}});this.dataConnections=new If({verifyAllocation:e.verifyAllocation??(t=>function(e,t){const n=e,s=kn.parse(n?.attach),i=An.parse(n?.ticket),r=t.snapshot(),o=new URL(String(n?.relayUrl));if("relay-allocation"!==n?.type||n?.allocationId!==s.allocationId||"control-plane"!==s.role||s.ticketId!==i.ticketId||s.controlPlaneId!==i.controlPlaneId||s.accountId!==i.accountId||s.deviceSessionId!==i.deviceSessionId||s.bindingId!==i.bindingId||s.bindingRevision!==i.bindingRevision||"active"!==r.status||!r.remoteAccessEnabled||r.identity.controlPlaneId!==i.controlPlaneId||r.accountId!==i.accountId||r.bindingId!==i.bindingId||r.bindingRevision!==i.bindingRevision||i.targetPublicKeyFingerprint!==r.identity.fingerprint||Date.parse(s.expiresAt)<=Date.now())throw zf("RELAY_ALLOCATION_AUTHORITY_INVALID");if(!function(e,t){if("wss:"!==e.protocol)return!1;if("relay.thandoff.com"===e.hostname||e.hostname.endsWith(".relay.thandoff.com"))return!0;const n=new URL(t);return"cloud.thandoff.com"!==n.hostname&&e.hostname===n.hostname}(o,r.serviceOrigin))throw zf("UNTRUSTED_RELAY_URL");return{allocationId:s.allocationId,relayUrl:o.href,epoch:Date.parse(s.issuedAt),attach:s,ticket:i}}(t,e.state)),connector:t}),this.events=new yf({state:e.state,connections:{stop:e=>this.control.stop(e)},dataConnections:this.dataConnections}),this.control=new ff({state:e.state,connector:this.connector,onEvent:async e=>{await this.events.apply(e)}}),this.lifecycle=new bf({state:e.state,connections:this.control,remote:{revoke:async({bindingId:e})=>this.connector.request("revoke-binding",{bindingId:e}),setRemoteAccess:async({bindingId:e,enabled:t})=>{await this.connector.request("set-remote-access",{bindingId:e,enabled:t})}}})}start(){this.running=!0,"active"===this.options.state.snapshot().status&&this.schedule(0)}async stop(){this.running=!1,this.timer&&clearTimeout(this.timer),await Promise.all([this.control.stop("control-plane-stopping"),this.dataConnections.closeAll("control-plane-stopping")])}async publishBindingChallenge(e){await this.ensureConnected(),await this.connector.request("publish-binding-challenge",{payload:e.payload,signature:e.signature})}async request(e,t){return await this.ensureConnected(),this.connector.request(e,t)}async handleRequest(e,t){if("consume-binding-challenge"===e){const e=this.options.identity.publicIdentity();return this.options.state.consumeChallenge({challengeCode:t?.challengeCode,controlPlaneId:e.controlPlaneId,fingerprint:e.fingerprint})}if("deliver-binding-credential"===e)return this.options.state.activate(t);if("relay-allocation"===e)return this.dataConnections.attach(t);throw Cf("CLOUD_CONTROL_OPERATION_UNSUPPORTED")}async ensureConnected(){if(this.connecting||(this.connecting=this.control.connectOnce().finally(()=>{this.connecting=void 0})),"connected"!==(await this.connecting).status)throw Cf("CLOUD_CONTROL_CONNECTION_DISABLED")}schedule(e=this.control.reconnectDelay()){if(!this.running||this.timer)return;const t=this.options.state.snapshot();"active"===t.status&&t.remoteAccessEnabled&&(this.timer=setTimeout(()=>{this.timer=void 0,this.ensureConnected().catch(()=>this.schedule())},e),this.timer.unref())}}function Cf(e){return Object.assign(new Error("Cloud background connection is unavailable."),{code:e,retryable:!0})}const Ef="x-task-handoff-cloud-internal-actor",xf=d.z.object({code:d.z.string().trim().min(1),message:d.z.string(),details:d.z.record(d.z.string(),d.z.unknown()).optional(),retryable:d.z.boolean().optional()}).strict(),Nf=d.z.object({error:xf}).strict(),Rf="https://cloud.thandoff.com";function Of(e,t={}){const n=new URL(e||Rf).origin;if(n===Rf)return n;if(t.production||!0!==t.allowNonProduction)throw Object.assign(new Error("Non-production cloud service origin is not trusted by this build."),{code:"UNTRUSTED_CLOUD_SERVICE_ORIGIN"});return n}function _f(e){const t=process.env[e]?.trim();return t||void 0}const Pf=function(e,t=process.env,n=e){let s;return()=>{const i=t.TASK_HANDOFF_VERSION?.trim();return i||(s||=C(e,t,n),s)}}("@task-handoff/control-plane");function jf(){return{component:"control-plane",packageName:"@task-handoff/control-plane",packageVersion:Pf(),protocolVersion:ks,buildId:_f("TASK_HANDOFF_BUILD_ID"),builtAt:_f("TASK_HANDOFF_BUILT_AT"),gitCommit:_f("TASK_HANDOFF_GIT_COMMIT"),imageRef:_f("TASK_HANDOFF_IMAGE_REF"),imageDigest:_f("TASK_HANDOFF_IMAGE_DIGEST")}}const Df={".css":"text/css; charset=utf-8",".html":"text/html; charset=utf-8",".ico":"image/x-icon",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".map":"application/json; charset=utf-8",".png":"image/png",".svg":"image/svg+xml",".webp":"image/webp"};function Mf(e,s){const i=t.resolve(e),r=t.resolve(i,s);if(r===i||r.startsWith(`${i}${t.sep}`))return n.existsSync(r)&&n.statSync(r).isFile()?r:void 0}function Lf(e,s,i){const r=Mf(s,i);return r?(e.header("cache-control","no-store"),e.type(Df[t.extname(r).toLowerCase()]||"application/octet-stream"),e.send(n.createReadStream(r))):e.code(404).send({error:{code:"STATIC_FILE_NOT_FOUND",message:`${i} was not found in the Control Plane UI static directory.`}})}function qf(e){if(e instanceof d.z.ZodError)return{statusCode:400,code:"VALIDATION_ERROR",message:e.issues.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; ")};const t=e&&"object"==typeof e?e:{};return{statusCode:"number"==typeof t.statusCode?t.statusCode:500,code:"string"==typeof t.code?t.code:"CONTROL_PLANE_ERROR",message:e instanceof Error?e.message:String(e),...t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?{details:t.details}:{},..."boolean"==typeof t.retryable?{retryable:t.retryable}:{},..."number"==typeof t.retryAfterSeconds?{retryAfterSeconds:t.retryAfterSeconds}:{}}}function $f(e){const t=e.headers.authorization;if(void 0!==t){const e=/^Bearer ([^\s]+)$/.exec(t);return{token:e?.[1],clientType:"mobile"}}return{token:e.cookies[qo],clientType:"web"}}async function Bf(e,t){if(!e.enabled())return{type:"system",reason:"auth-disabled"};const n="mobile"===t.clientType?await e.userForMobileSessionToken(t.token):await e.userForSessionToken(t.token);return n?{type:"user",userId:n.id,role:n.role}:void 0}const Ff=new Set(["/api/auth/session","/api/auth/bootstrap-admin","/api/auth/login","/api/auth/logout","/api/auth/mobile/login","/api/control-plane/identity","/api/health","/api/events"]);function Uf(e,t){const n=t.split("?")[0]||"/";if(!n.startsWith("/api/"))return;if(Ff.has(n))return;const s=function(e){return"GET"===e||"HEAD"===e?"read":"POST"===e?"create":"PATCH"===e||"PUT"===e?"update":"DELETE"===e?"delete":"read"}(e);return"/api/control-plane/diagnostic-logs/export"===n?{action:"manage-settings",resource:{type:"control-plane-settings"}}:n.startsWith("/api/control-plane/settings")?{action:"GET"===e?"read":"manage-settings",resource:{type:"control-plane-settings"}}:"/api/auth/mobile/logout"===n||n.startsWith("/api/auth/mobile/sessions")||"/api/auth/password"===n?void 0:n.startsWith("/api/models")?{action:"GET"===e?"read":"manage-secrets",resource:{type:"model"}}:n.startsWith("/api/chat-gateway/bridges")?{action:"GET"===e?"read":"manage-secrets",resource:{type:"chat-bridge"}}:"/api/chat-gateway/messages"===n||"/api/chat-gateway/actions"===n?{action:"send-message",resource:{type:"ai-session"}}:"/api/chat-gateway/poll-ai-sessions"===n?{action:"manage-settings",resource:{type:"chat-bridge"}}:"/api/ai-session-attachments"===n?{action:"send-message",resource:{type:"ai-session"}}:"/api/node-join/invites"===n?{action:"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/control-plane-proxy")?{action:"GET"===e?"read":"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/nodes")?/\/(runtimes|local-folders)(\/|$)/.test(n)?{action:s,resource:{type:"runtime"}}:{action:"GET"===e?"read":"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/controlled-instances")?/\/apps\/sessions\/[^/]+\/access$/.test(n)?{action:"read",resource:{type:"instance"}}:n.includes("/ai-sessions")?n.includes("/triggers")?{action:s,resource:{type:"trigger"}}:"POST"===e&&/\/ai-sessions$/.test(n)?{action:"send-message",resource:{type:"ai-session"}}:n.endsWith("/approval")?{action:"approve",resource:{type:"ai-session"}}:n.endsWith("/interrupt")?{action:"interrupt",resource:{type:"ai-session"}}:n.endsWith("/resume")||n.endsWith("/fork")||n.endsWith("/commands")||n.includes("/messages")||n.includes("/queue/")?{action:"send-message",resource:{type:"ai-session"}}:n.endsWith("/read")||n.endsWith("/mentions/files")?{action:"read",resource:{type:"ai-session"}}:{action:s,resource:{type:"ai-session"}}:n.includes("/start")?{action:"start",resource:{type:"instance"}}:n.includes("/stop")?{action:"stop",resource:{type:"instance"}}:n.includes("/restart")?{action:"restart",resource:{type:"instance"}}:/\/config-sync(?:\/|$)/.test(n)?{action:"update",resource:{type:"instance"}}:{action:s,resource:{type:"instance"}}:n.startsWith("/api/projects")?{action:s,resource:{type:"project"}}:n.startsWith("/api/images")||n.startsWith("/api/image-options")||n.startsWith("/api/market")?{action:s,resource:{type:"runtime"}}:n.startsWith("/api/triggers")?{action:s,resource:{type:"trigger"}}:{action:s,resource:{type:"control-plane-settings"}}}async function Hf(e={}){const c=Cm(e.dataDir),l=i({logger:e.logger??!0});await l.register(r,{encodings:["br","gzip","deflate"],globalDecompression:!1,threshold:1024}),l.addContentTypeParser("application/octet-stream",(e,t,n)=>n(null,t));const p=new Mh,u=e.cloudConnectivityEnabled??"0"!==process.env.TASK_HANDOFF_CLOUD_CONNECTIVITY_ENABLED;let h=(g=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(g||"").trim().toLowerCase()));var g;const y=function(e,s,i,r={}){const o=(o,a,d)=>{if(s()){i[o]?.(a,d);try{!function(e,s,i=10485760,r=2){const o=Buffer.isBuffer(s)?s:Buffer.from(s),a=o.byteLength>i?o.subarray(o.byteLength-i):o;if(n.mkdirSync(t.dirname(e),{recursive:!0,mode:448}),n.existsSync(e)){const t=n.lstatSync(e);if(!t.isFile()||t.isSymbolicLink())throw new Error(`Managed log path must be a regular file: ${e}`);t.size+a.byteLength>i&&(function(e,t){if(!(t<=0)){n.rmSync(of(e,t),{force:!0});for(let s=t-1;s>=1;s-=1){const t=of(e,s);n.existsSync(t)&&n.renameSync(t,of(e,s+1))}}}(e,r),r>0?t.size>i?(n.writeFileSync(of(e,1),function(e,t){const s=n.statSync(e),i=Math.min(s.size,t),r=Buffer.allocUnsafe(i),o=n.openSync(e,"r");let a=0;try{for(;a<i;){const e=n.readSync(o,r,a,i-a,s.size-i+a);if(0===e)break;a+=e}}finally{n.closeSync(o)}return a===i?r:r.subarray(0,a)}(e,i),{mode:384}),n.rmSync(e,{force:!0})):n.renameSync(e,of(e,1)):n.rmSync(e,{force:!0}))}n.appendFileSync(e,a,{mode:384}),n.chmodSync(e,384)}(t.join(e,"control-plane.log"),`${JSON.stringify({time:(new Date).toISOString(),level:o,message:d,data:cf(a)},(e,t)=>cf(t))}\n`,r.maxBytes??10485760,r.backupCount??2)}catch{}}};return{info:(e,t)=>o("info",e,t),warn:(e,t)=>o("warn",e,t),error:(e,t)=>o("error",e,t)}}(c.logsDir,()=>h,l.log),I=new rf;I.onChange(e=>p.publish("node.connection.updated",e,{topic:"node.state",scope:{nodeId:e.nodeId}}));const b=new Op(c,{...e.service,logger:y,nodeConnectionRuntime:I,onFleetStateChanged:t=>{e.service?.onFleetStateChanged?.(t),p.publish("node.fleet.updated",t,{topic:"instances"===t.resource?"instances":"models"===t.resource?"models":"node.runtime",scope:{nodeId:t.nodeId}})}}),v=new ia(c,e.auth),S=new sf(c.identitySigningPath,()=>b.proxyPrivateStore.controlPlaneId(),(e,t)=>l.log.warn(t,e)),w=new hf({statePath:c.cloudConnectivityPath,identity:S,serviceOrigin:Of(e.cloudServiceOrigin||process.env.TASK_HANDOFF_CLOUD_SERVICE_ORIGIN,{production:"production"===process.env.NODE_ENV,allowNonProduction:!0===e.allowNonProductionCloudOrigin||"staging"===process.env.TASK_HANDOFF_CLOUD_ENV})}),A=new Map,k=new Tf({state:w,identity:S,relayBridge:{async request(e,t){const n=String(t?.method||"GET").toUpperCase(),i=String(t?.path||""),r=Uf(n,i);if(!i.startsWith("/api/")||!r||Ff.has(i.split("?")[0]))throw Object.assign(new Error("Cloud access route is not available."),{code:"CLOUD_ROUTE_FORBIDDEN",statusCode:403});Qm(e,r.action,r.resource);const o=s.randomBytes(32).toString("base64url");A.set(o,e);try{const e=Object.fromEntries(Object.entries(t.headers??{}).filter(([e])=>{const t=e.toLowerCase();return!function(e){return E.has(e.toLowerCase())}(t)&&!["host","connection","upgrade",Ef].includes(t)}).map(([e,t])=>[e,String(t)])),s=await l.inject({method:n,url:i,headers:{...e,[Ef]:o},...void 0===t.body?{}:{payload:t.body}});let r;try{r=s.json()}catch{r=s.body}return{status:s.statusCode,body:r}}finally{A.delete(o)}},subscribe(e,t,n,s){if("cloud-account"!==e.type)throw Object.assign(new Error("Cloud account actor required."),{code:"CLOUD_ACTOR_REQUIRED"});const i=new Set(t);if(!i.size)return()=>{};const r=p.on(e=>{(i.has("*")||i.has(e.topic)||i.has(e.type))&&fo(s,e)&&n(e)}),o=s?p.registerAiSessionTransientDemand(s):p.registerLegacyAiSessionTransientDemand(i);return()=>{r(),o()}},async openTty(e,t,n){const s=String(t?.instanceId||""),i=String(t?.sessionId||"");if(Qm(e,"proxy",{type:"instance",id:s}),!s||!i)throw Object.assign(new Error("TTY target is required."),{code:"TTY_TARGET_REQUIRED",statusCode:400});const r=new Map,o=(e,...t)=>{for(const n of r.get(e)??[])n(...t)};let a=!1;const d={readyState:1,on(e,t){const n=r.get(e)??new Set;n.add(t),r.set(e,n)},send(e){try{const t=JSON.parse(String(e));if("snapshot"===t.type){const e=xt.parse(t);n(Sn.parse({type:"tty-snapshot",data:e.data,pendingEscape:e.pendingEscape,cols:e.cols,rows:e.rows}))}else"output"===t.type?n({type:"tty-output",data:t.data}):"resize"===t.type?n({type:"tty-resize",body:{cols:t.cols,rows:t.rows}}):"exit"===t.type?n({type:"tty-exit",code:t.code,signal:t.signal}):"error"===t.type&&n({type:"tty-error"})}catch{n({type:"tty-error"})}},close(){a||(a=!0,o("close"),n({type:"tty-closed"}))}};return await b.proxyInstanceWebSocket(s,d,`/api/apps/sessions/${encodeURIComponent(i)}/tty`,[],{}),{send(e){a||o("message",Buffer.from(JSON.stringify({type:"input",data:e})))},resize(e,t){!a&&Number.isInteger(e)&&Number.isInteger(t)&&e>0&&t>0&&o("message",Buffer.from(JSON.stringify({type:"resize",cols:e,rows:t})))},close(){d.close()}}}}}),T=e.cloudConnectivityLifecycle?.(w)??k.lifecycle,C=e.publishCloudBindingChallenge??(e=>k.publishBindingChallenge(e)),x=new ry(p),N=new Zg(c,{onChanged:e=>queueMicrotask(()=>p.publish(q,e,{topic:"ai.sessions",scope:{instanceId:e.instanceId,sessionId:e.sessionId}}))});N.init();const R=new Qg({bootstrap:()=>b.bootstrapAiSessionsFromInstances(),logger:y,recoverDelta:(e,t,n)=>b.recoverAiSessionDelta(e,t,n),recoverSnapshot:e=>b.recoverAiSessionSnapshot(e),onRecoveredEvent:e=>p.publish(e.type,e.payload)});R.onSnapshot(e=>N.reconcile(e.instanceId,e.aiSessions));const O=new sy({bootstrap:()=>b.bootstrapAppSessionsFromInstances(),logger:y,recoverDelta:(e,t,n)=>b.recoverAppSessionDelta(e,t,n),recoverSnapshot:e=>b.recoverAppSessionSnapshot(e),onRecoveredEvent:e=>p.publish(e.type,e.payload)});b.setAppSessionSnapshotProvider(e=>O.list(e)),b.setAiSessionSnapshotProvider(e=>R.list(e));const _=new Qh(c.dataDir,{onWarning:e=>l.log.warn(e)});p.on(e=>{if(x.handle(e),"instance.deleted"===e.type||"instance.updated"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";t&&("instance.deleted"===e.type&&(O.removeInstance(t),R.removeInstance(t),N.removeInstance(t)),_.removeInstance(t))}});const P=new Kh;l.addHook("onClose",async()=>{P.dispose()});const j=new km(p,{connectionRuntime:I,validateInstanceScope:(e,t)=>b.nodeOwnsInstance(e,t),onStreamsHello:(e,t)=>{for(const n of t.streams)"ai.sessions"===n.topic&&R.advertiseStream(e,n),"app.sessions"===n.topic&&O.advertiseStream(e,n)},onSessionEvent:e=>e.type.startsWith("app-session.")?O.handleEvent(e):R.handleEvent(e)}),D=e.proxyOrigin||process.env.TASK_HANDOFF_CONTROL_PLANE_PROXY_ORIGIN,M=e=>{const t=b.nodes.get(e);return t?function(e,t){const n="reverse-wss"===e.connectionMode&&t,s=n?"online":e.status;return{id:e.id,name:e.name||e.id,status:s,health:e.health,...e.lastSeenAt?{lastSeenAt:e.lastSeenAt}:{},capabilities:xy(e.capabilities||{},262144),manageable:!1!==e.connectionEnabled&&(n||"online"===s)}}(t,j.connected(t.id)):void 0},L=new Sy(new yy(c.proxyAuthorityPath,(e,t)=>l.log.warn(t,e)),{get:M},{proxyOrigin:D,proxyOriginProvider:()=>b.getSettings().publicBaseUrl}),$=new Ay,B=new ky(p,{projectTarget:e=>{const t=M(e);return t?Ry(t):void 0}}),F=new Ky(b,{fetchImpl:e.service?.fetchImpl,logger:y,onStateChanged:e=>p.publish("node.proxy-state.updated",{nodeId:e.id,proxyState:e.proxyState},{topic:"node.state",scope:{nodeId:e.id}})});let U,H,W;p.on(e=>{if("node.created"!==e.type&&"node.updated"!==e.type&&"node.deleted"!==e.type||F.syncNow(),"instance.created"===e.type||"instance.updated"===e.type||"instance.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";t&&j.invalidateInstanceScope({instanceId:t})}if("node.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"nodeId"in e.payload?String(e.payload.nodeId||""):"";if(t){j.invalidateInstanceScope({nodeId:t});const e=L.revokeTarget(t);for(const n of e.bindings)$.closeBinding(n.id,"Proxy target was deleted."),p.publish("control-plane-proxy.binding.updated",{binding:n},{topic:"control-plane-proxy",scope:{nodeId:t}})}}}),b.setNodeAgentTransport(j),b.init(),h=b.diagnosticLogsEnabled(),S.init(),w.init(),u&&k.start();const G=()=>{if(U)return U;const e=b.recoverPendingPairingRevokes().then(()=>{});return U=e,e.then(()=>{U===e&&(U=void 0)},()=>{U===e&&(U=void 0)}),e};await G().catch(e=>l.log.warn({error:e},"pending node pairing recovery failed")),L.init(),F.start(),await b.syncLocalNodeConnection().catch(()=>{}),v.init();const V=new oh(b,e.service?.fetchImpl,{aiSessions:R,logger:y,diagnosticLogsEnabled:()=>h});V.startEnabled();const K=new Tm(b,j,{safetyIntervalMs:Number(process.env.TASK_HANDOFF_EVENT_CONNECTION_SAFETY_INTERVAL_MS)||void 0,logger:y,connectionRuntime:I}),J=p.onAiSessionTransientDemand(e=>{K.setAiSessionTransientDemand(e)});K.start(),await l.register(o),await l.register(a),l.addHook("onClose",async()=>{await k.stop(),H&&clearInterval(H),W&&clearInterval(W),await(U?.catch(()=>{})),x.close(),B.stop(),F.stop(),K.stop(),J(),V.stopAll(),b.dispose()}),l.setErrorHandler((e,t,n)=>{const s=qf(e);void 0!==s.retryAfterSeconds&&n.header("retry-after",String(s.retryAfterSeconds)),(h||s.statusCode>=500)&&(s.statusCode>=500?l.log.error.bind(l.log):l.log.warn.bind(l.log))({method:t.method,url:t.url,statusCode:s.statusCode,errorCode:s.code,error:s.message},"control plane request failed"),n.code(s.statusCode).send(Nf.parse({error:{code:s.code,message:s.message,...s.details?{details:s.details}:{},...void 0!==s.retryable?{retryable:s.retryable}:{}}}))}),l.addHook("preHandler",async(e,t)=>{const n=e.routeOptions.url,s=n&&"*"!==n?n:e.url,i=e.routeOptions.config.controlPlaneAuthBoundary,r=e.headers[Ef],o="string"==typeof r?A.get(r):void 0;if(o){A.delete(r);const t=Uf(e.method,s);if(!t)throw Object.assign(new Error("Cloud access route is not authorized."),{code:"CLOUD_ROUTE_FORBIDDEN",statusCode:403});return void Qm(o,t.action,t.resource)}if("proxy-binding"===i||"node-tunnel"===i)return;const a="public"===i||"public-ui"===i&&function(e){const t=e.split("?")[0]||"/";return!t.startsWith("/api/")&&"/api"!==t&&!t.startsWith("/instances/")&&"/instances"!==t}(e.url);if(!v.enabled()||a){const t=await Bf(v,$f(e)),n=Uf(e.method,s);return void(n&&Qm(t||{type:"system",reason:"auth-disabled"},n.action,n.resource))}const d=await Bf(v,$f(e));if(!d)return t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to access the Control Plane."}});const c=Uf(e.method,s);c&&Qm(d,c.action,c.resource)});const Y=t.resolve(e.staticDir||process.env.TASK_HANDOFF_CONTROL_PLANE_STATIC_DIR||t.resolve(process.cwd(),"packages","control-plane-ui","dist"));n.existsSync(Y)&&(l.get("/assets/*",{config:em},async(e,n)=>{const s=e.params["*"];return Lf(n,Y,t.join("assets",s||""))}),l.get("/favicon.ico",{config:em},async(e,t)=>Mf(Y,"favicon.ico")?Lf(t,Y,"favicon.ico"):t.code(204).send())),l.get("/api/health",{config:em},async()=>Ri.parse({data:{ok:!0,role:"control-plane",protocolVersion:ks,build:jf(),serverTime:(new Date).toISOString()}})),l.get("/api/control-plane/identity",{config:em},async()=>S.publicDocument(v.enabled()?"required":"disabled"));const Q=async e=>{if(!u)throw Object.assign(new Error("Cloud connectivity is disabled by feature flag."),{code:"CLOUD_CONNECTIVITY_DISABLED",statusCode:503});Qm(await Bf(v,$f(e))||{type:"system",reason:"auth-disabled"},"manage-settings",{type:"control-plane-settings"})};return l.get("/api/cloud-connectivity",async e=>(await Q(e),{data:w.snapshot()})),l.post("/api/cloud-connectivity/challenges",async(e,t)=>{await Q(e),t.header("cache-control","no-store");const n=w.createChallenge();return await C(n),{data:n}}),l.post("/api/cloud-connectivity/remote-access",async e=>{await Q(e);const t=d.z.object({enabled:d.z.boolean()}).strict().parse(e.body);return{data:T?await T.setRemoteAccess(t.enabled):w.setRemoteAccess(t.enabled)}}),l.post("/api/cloud-connectivity/disconnect",async e=>(await Q(e),{data:T?await T.disconnect():w.beginRevocation()})),l.get("/api/session-streams/diagnostics",async()=>({data:{aiSessions:R.diagnostics(),aiSessionActions:b.aiSessionActionDiagnostics(),appSessions:O.diagnostics(),nodeConnections:{...K.diagnostics(),runtime:I.diagnostics()}}})),l.get("/install-node-agent.sh",{config:em},async(e,t)=>(t.header("cache-control","no-store"),t.type("text/x-shellscript; charset=utf-8"),iy`#!/bin/sh
+"use strict";var e=require("commander"),t=require("node:path"),n=require("node:fs"),i=require("node:crypto"),s=require("fastify"),a=require("node:zlib"),o=require("node:util"),r=require("node:stream"),c=require("node:events"),d=require("node:string_decoder"),l=require("stream"),p=require("buffer"),u=require("events"),m=require("node:os"),h=require("@fastify/cookie"),g=require("@fastify/websocket"),f=require("zod"),y=require("write-file-atomic"),b=require("ws"),v=require("node:http"),I=require("node:net"),x=require("telegramify-markdown"),w=require("node:fs/promises"),S=require("dingtalk-stream"),A=require("@larksuiteoapi/node-sdk"),E=require("node:child_process"),_=require("tar"),T=require("tweetnacl"),z=require("drizzle-orm"),k=require("drizzle-orm/node-postgres"),N=require("pg"),C=require("drizzle-orm/pg-core"),R=require("node:sqlite"),O=require("drizzle-orm/node-sqlite"),j=require("drizzle-orm/sqlite-core");function P(e){var t=Object.create(null);return e&&Object.keys(e).forEach(function(n){if("default"!==n){var i=Object.getOwnPropertyDescriptor(e,n);Object.defineProperty(t,n,i.get?i:{enumerable:!0,get:function(){return e[n]}})}}),t.default=e,Object.freeze(t)}var D=P(_);function L(e,t){try{const i=JSON.parse(n.readFileSync(e,"utf8"));if(t&&i.name!==t)return;return"string"==typeof i.version&&i.version.trim()?i.version.trim():void 0}catch{return}}function M(e){if(e)try{return t.dirname(n.realpathSync(e))}catch{return}}function q(e,n=process.env,i=e){const s=n.TASK_HANDOFF_VERSION?.trim();if(s)return s;const a=i.split("/").at(-1),o=process.argv[1]?t.resolve(process.argv[1]):void 0,r=o?t.dirname(o):void 0,c=[M(o),r,process.cwd()].filter(e=>Boolean(e));for(const n of new Set(c)){let i=n;for(;;){const n=L(t.join(i,"package.json"),e);if(n)return n;const s=t.dirname(i);if(s===i)break;i=s}}let d;for(const e of new Set(c)){let n=e;for(;;){if(a){const e=L(t.join(n,"packages",a,"package.json"),i);if(e)return e}d||=L(t.join(n,"package.json"));const e=t.dirname(n);if(e===n)break;n=e}}return d||"unknown"}var U="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function $(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function B(e){if(Object.prototype.hasOwnProperty.call(e,"__esModule"))return e;var t=e.default;if("function"==typeof t){var n=function e(){var n=!1;try{n=this instanceof e}catch{}return n?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(t){var i=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,i.get?i:{enumerable:!0,get:function(){return e[t]}})}),n}var F,H,G,W,V={exports:{}},K={exports:{}},Y={exports:{}};function X(){if(F)return Y.exports;F=1;const e=/at\s(?:.*\.)?plugin\s.*\n\s*(.*)/,t=/(\w*(\.\w*)*)\..*/;function n(n){const i=n.match(e);return i?i[1].split(/[/\\]/).slice(-1)[0].match(t)[1]:"anonymous"}return Y.exports=function(e){if(e.name.length>0)return e.name;const t=Error.stackTraceLimit;Error.stackTraceLimit=10;try{throw new Error("anonymous function")}catch(e){return Error.stackTraceLimit=t,n(e.stack)}},Y.exports.extractPluginName=n,Y.exports}function J(){return G?H:(G=1,H=function(e){return"@"===e[0]&&(e=e.slice(1).replace("/","-")),e.replace(/-(.)/g,function(e,t){return t.toUpperCase()})})}var Q,Z={exports:{}};var ee,te,ne,ie={"application/1d-interleaved-parityfec":{source:"iana"},"application/3gpdash-qoe-report+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/3gpp-ims+xml":{source:"iana",compressible:!0},"application/3gpphal+json":{source:"iana",compressible:!0},"application/3gpphalforms+json":{source:"iana",compressible:!0},"application/a2l":{source:"iana"},"application/ace+cbor":{source:"iana"},"application/ace+json":{source:"iana",compressible:!0},"application/ace-groupcomm+cbor":{source:"iana"},"application/ace-trl+cbor":{source:"iana"},"application/activemessage":{source:"iana"},"application/activity+json":{source:"iana",compressible:!0},"application/aif+cbor":{source:"iana"},"application/aif+json":{source:"iana",compressible:!0},"application/alto-cdni+json":{source:"iana",compressible:!0},"application/alto-cdnifilter+json":{source:"iana",compressible:!0},"application/alto-costmap+json":{source:"iana",compressible:!0},"application/alto-costmapfilter+json":{source:"iana",compressible:!0},"application/alto-directory+json":{source:"iana",compressible:!0},"application/alto-endpointcost+json":{source:"iana",compressible:!0},"application/alto-endpointcostparams+json":{source:"iana",compressible:!0},"application/alto-endpointprop+json":{source:"iana",compressible:!0},"application/alto-endpointpropparams+json":{source:"iana",compressible:!0},"application/alto-error+json":{source:"iana",compressible:!0},"application/alto-networkmap+json":{source:"iana",compressible:!0},"application/alto-networkmapfilter+json":{source:"iana",compressible:!0},"application/alto-propmap+json":{source:"iana",compressible:!0},"application/alto-propmapparams+json":{source:"iana",compressible:!0},"application/alto-tips+json":{source:"iana",compressible:!0},"application/alto-tipsparams+json":{source:"iana",compressible:!0},"application/alto-updatestreamcontrol+json":{source:"iana",compressible:!0},"application/alto-updatestreamparams+json":{source:"iana",compressible:!0},"application/aml":{source:"iana"},"application/andrew-inset":{source:"iana",extensions:["ez"]},"application/appinstaller":{compressible:!1,extensions:["appinstaller"]},"application/applefile":{source:"iana"},"application/applixware":{source:"apache",extensions:["aw"]},"application/appx":{compressible:!1,extensions:["appx"]},"application/appxbundle":{compressible:!1,extensions:["appxbundle"]},"application/at+jwt":{source:"iana"},"application/atf":{source:"iana"},"application/atfx":{source:"iana"},"application/atom+xml":{source:"iana",compressible:!0,extensions:["atom"]},"application/atomcat+xml":{source:"iana",compressible:!0,extensions:["atomcat"]},"application/atomdeleted+xml":{source:"iana",compressible:!0,extensions:["atomdeleted"]},"application/atomicmail":{source:"iana"},"application/atomsvc+xml":{source:"iana",compressible:!0,extensions:["atomsvc"]},"application/atsc-dwd+xml":{source:"iana",compressible:!0,extensions:["dwd"]},"application/atsc-dynamic-event-message":{source:"iana"},"application/atsc-held+xml":{source:"iana",compressible:!0,extensions:["held"]},"application/atsc-rdt+json":{source:"iana",compressible:!0},"application/atsc-rsat+xml":{source:"iana",compressible:!0,extensions:["rsat"]},"application/atxml":{source:"iana"},"application/auth-policy+xml":{source:"iana",compressible:!0},"application/automationml-aml+xml":{source:"iana",compressible:!0,extensions:["aml"]},"application/automationml-amlx+zip":{source:"iana",compressible:!1,extensions:["amlx"]},"application/bacnet-xdd+zip":{source:"iana",compressible:!1},"application/batch-smtp":{source:"iana"},"application/bdoc":{compressible:!1,extensions:["bdoc"]},"application/beep+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/bufr":{source:"iana"},"application/c2pa":{source:"iana"},"application/calendar+json":{source:"iana",compressible:!0},"application/calendar+xml":{source:"iana",compressible:!0,extensions:["xcs"]},"application/call-completion":{source:"iana"},"application/cals-1840":{source:"iana"},"application/captive+json":{source:"iana",compressible:!0},"application/cbor":{source:"iana"},"application/cbor-seq":{source:"iana"},"application/cccex":{source:"iana"},"application/ccmp+xml":{source:"iana",compressible:!0},"application/ccxml+xml":{source:"iana",compressible:!0,extensions:["ccxml"]},"application/cda+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/cdfx+xml":{source:"iana",compressible:!0,extensions:["cdfx"]},"application/cdmi-capability":{source:"iana",extensions:["cdmia"]},"application/cdmi-container":{source:"iana",extensions:["cdmic"]},"application/cdmi-domain":{source:"iana",extensions:["cdmid"]},"application/cdmi-object":{source:"iana",extensions:["cdmio"]},"application/cdmi-queue":{source:"iana",extensions:["cdmiq"]},"application/cdni":{source:"iana"},"application/ce+cbor":{source:"iana"},"application/cea":{source:"iana"},"application/cea-2018+xml":{source:"iana",compressible:!0},"application/cellml+xml":{source:"iana",compressible:!0},"application/cfw":{source:"iana"},"application/cid-edhoc+cbor-seq":{source:"iana"},"application/city+json":{source:"iana",compressible:!0},"application/city+json-seq":{source:"iana"},"application/clr":{source:"iana"},"application/clue+xml":{source:"iana",compressible:!0},"application/clue_info+xml":{source:"iana",compressible:!0},"application/cms":{source:"iana"},"application/cnrp+xml":{source:"iana",compressible:!0},"application/coap-eap":{source:"iana"},"application/coap-group+json":{source:"iana",compressible:!0},"application/coap-payload":{source:"iana"},"application/commonground":{source:"iana"},"application/concise-problem-details+cbor":{source:"iana"},"application/conference-info+xml":{source:"iana",compressible:!0},"application/cose":{source:"iana"},"application/cose-key":{source:"iana"},"application/cose-key-set":{source:"iana"},"application/cose-x509":{source:"iana"},"application/cpl+xml":{source:"iana",compressible:!0,extensions:["cpl"]},"application/csrattrs":{source:"iana"},"application/csta+xml":{source:"iana",compressible:!0},"application/cstadata+xml":{source:"iana",compressible:!0},"application/csvm+json":{source:"iana",compressible:!0},"application/cu-seeme":{source:"apache",extensions:["cu"]},"application/cwl":{source:"iana",extensions:["cwl"]},"application/cwl+json":{source:"iana",compressible:!0},"application/cwl+yaml":{source:"iana"},"application/cwt":{source:"iana"},"application/cybercash":{source:"iana"},"application/dart":{compressible:!0},"application/dash+xml":{source:"iana",compressible:!0,extensions:["mpd"]},"application/dash-patch+xml":{source:"iana",compressible:!0,extensions:["mpp"]},"application/dashdelta":{source:"iana"},"application/davmount+xml":{source:"iana",compressible:!0,extensions:["davmount"]},"application/dca-rft":{source:"iana"},"application/dcd":{source:"iana"},"application/dec-dx":{source:"iana"},"application/dialog-info+xml":{source:"iana",compressible:!0},"application/dicom":{source:"iana",extensions:["dcm"]},"application/dicom+json":{source:"iana",compressible:!0},"application/dicom+xml":{source:"iana",compressible:!0},"application/dii":{source:"iana"},"application/dit":{source:"iana"},"application/dns":{source:"iana"},"application/dns+json":{source:"iana",compressible:!0},"application/dns-message":{source:"iana"},"application/docbook+xml":{source:"apache",compressible:!0,extensions:["dbk"]},"application/dots+cbor":{source:"iana"},"application/dpop+jwt":{source:"iana"},"application/dskpp+xml":{source:"iana",compressible:!0},"application/dssc+der":{source:"iana",extensions:["dssc"]},"application/dssc+xml":{source:"iana",compressible:!0,extensions:["xdssc"]},"application/dvcs":{source:"iana"},"application/eat+cwt":{source:"iana"},"application/eat+jwt":{source:"iana"},"application/eat-bun+cbor":{source:"iana"},"application/eat-bun+json":{source:"iana",compressible:!0},"application/eat-ucs+cbor":{source:"iana"},"application/eat-ucs+json":{source:"iana",compressible:!0},"application/ecmascript":{source:"apache",compressible:!0,extensions:["ecma"]},"application/edhoc+cbor-seq":{source:"iana"},"application/edi-consent":{source:"iana"},"application/edi-x12":{source:"iana",compressible:!1},"application/edifact":{source:"iana",compressible:!1},"application/efi":{source:"iana"},"application/elm+json":{source:"iana",charset:"UTF-8",compressible:!0},"application/elm+xml":{source:"iana",compressible:!0},"application/emergencycalldata.cap+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/emergencycalldata.comment+xml":{source:"iana",compressible:!0},"application/emergencycalldata.control+xml":{source:"iana",compressible:!0},"application/emergencycalldata.deviceinfo+xml":{source:"iana",compressible:!0},"application/emergencycalldata.ecall.msd":{source:"iana"},"application/emergencycalldata.legacyesn+json":{source:"iana",compressible:!0},"application/emergencycalldata.providerinfo+xml":{source:"iana",compressible:!0},"application/emergencycalldata.serviceinfo+xml":{source:"iana",compressible:!0},"application/emergencycalldata.subscriberinfo+xml":{source:"iana",compressible:!0},"application/emergencycalldata.veds+xml":{source:"iana",compressible:!0},"application/emma+xml":{source:"iana",compressible:!0,extensions:["emma"]},"application/emotionml+xml":{source:"iana",compressible:!0,extensions:["emotionml"]},"application/encaprtp":{source:"iana"},"application/entity-statement+jwt":{source:"iana"},"application/epp+xml":{source:"iana",compressible:!0},"application/epub+zip":{source:"iana",compressible:!1,extensions:["epub"]},"application/eshop":{source:"iana"},"application/exi":{source:"iana",extensions:["exi"]},"application/expect-ct-report+json":{source:"iana",compressible:!0},"application/express":{source:"iana",extensions:["exp"]},"application/fastinfoset":{source:"iana"},"application/fastsoap":{source:"iana"},"application/fdf":{source:"iana",extensions:["fdf"]},"application/fdt+xml":{source:"iana",compressible:!0,extensions:["fdt"]},"application/fhir+json":{source:"iana",charset:"UTF-8",compressible:!0},"application/fhir+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/fido.trusted-apps+json":{compressible:!0},"application/fits":{source:"iana"},"application/flexfec":{source:"iana"},"application/font-sfnt":{source:"iana"},"application/font-tdpfr":{source:"iana",extensions:["pfr"]},"application/font-woff":{source:"iana",compressible:!1},"application/framework-attributes+xml":{source:"iana",compressible:!0},"application/geo+json":{source:"iana",compressible:!0,extensions:["geojson"]},"application/geo+json-seq":{source:"iana"},"application/geopackage+sqlite3":{source:"iana"},"application/geopose+json":{source:"iana",compressible:!0},"application/geoxacml+json":{source:"iana",compressible:!0},"application/geoxacml+xml":{source:"iana",compressible:!0},"application/gltf-buffer":{source:"iana"},"application/gml+xml":{source:"iana",compressible:!0,extensions:["gml"]},"application/gnap-binding-jws":{source:"iana"},"application/gnap-binding-jwsd":{source:"iana"},"application/gnap-binding-rotation-jws":{source:"iana"},"application/gnap-binding-rotation-jwsd":{source:"iana"},"application/gpx+xml":{source:"apache",compressible:!0,extensions:["gpx"]},"application/grib":{source:"iana"},"application/gxf":{source:"apache",extensions:["gxf"]},"application/gzip":{source:"iana",compressible:!1,extensions:["gz"]},"application/h224":{source:"iana"},"application/held+xml":{source:"iana",compressible:!0},"application/hjson":{extensions:["hjson"]},"application/hl7v2+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/http":{source:"iana"},"application/hyperstudio":{source:"iana",extensions:["stk"]},"application/ibe-key-request+xml":{source:"iana",compressible:!0},"application/ibe-pkg-reply+xml":{source:"iana",compressible:!0},"application/ibe-pp-data":{source:"iana"},"application/iges":{source:"iana"},"application/im-iscomposing+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/index":{source:"iana"},"application/index.cmd":{source:"iana"},"application/index.obj":{source:"iana"},"application/index.response":{source:"iana"},"application/index.vnd":{source:"iana"},"application/inkml+xml":{source:"iana",compressible:!0,extensions:["ink","inkml"]},"application/iotp":{source:"iana"},"application/ipfix":{source:"iana",extensions:["ipfix"]},"application/ipp":{source:"iana"},"application/isup":{source:"iana"},"application/its+xml":{source:"iana",compressible:!0,extensions:["its"]},"application/java-archive":{source:"iana",compressible:!1,extensions:["jar","war","ear"]},"application/java-serialized-object":{source:"apache",compressible:!1,extensions:["ser"]},"application/java-vm":{source:"apache",compressible:!1,extensions:["class"]},"application/javascript":{source:"apache",charset:"UTF-8",compressible:!0,extensions:["js"]},"application/jf2feed+json":{source:"iana",compressible:!0},"application/jose":{source:"iana"},"application/jose+json":{source:"iana",compressible:!0},"application/jrd+json":{source:"iana",compressible:!0},"application/jscalendar+json":{source:"iana",compressible:!0},"application/jscontact+json":{source:"iana",compressible:!0},"application/json":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["json","map"]},"application/json-patch+json":{source:"iana",compressible:!0},"application/json-seq":{source:"iana"},"application/json5":{extensions:["json5"]},"application/jsonml+json":{source:"apache",compressible:!0,extensions:["jsonml"]},"application/jsonpath":{source:"iana"},"application/jwk+json":{source:"iana",compressible:!0},"application/jwk-set+json":{source:"iana",compressible:!0},"application/jwk-set+jwt":{source:"iana"},"application/jwt":{source:"iana"},"application/kpml-request+xml":{source:"iana",compressible:!0},"application/kpml-response+xml":{source:"iana",compressible:!0},"application/ld+json":{source:"iana",compressible:!0,extensions:["jsonld"]},"application/lgr+xml":{source:"iana",compressible:!0,extensions:["lgr"]},"application/link-format":{source:"iana"},"application/linkset":{source:"iana"},"application/linkset+json":{source:"iana",compressible:!0},"application/load-control+xml":{source:"iana",compressible:!0},"application/logout+jwt":{source:"iana"},"application/lost+xml":{source:"iana",compressible:!0,extensions:["lostxml"]},"application/lostsync+xml":{source:"iana",compressible:!0},"application/lpf+zip":{source:"iana",compressible:!1},"application/lxf":{source:"iana"},"application/mac-binhex40":{source:"iana",extensions:["hqx"]},"application/mac-compactpro":{source:"apache",extensions:["cpt"]},"application/macwriteii":{source:"iana"},"application/mads+xml":{source:"iana",compressible:!0,extensions:["mads"]},"application/manifest+json":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["webmanifest"]},"application/marc":{source:"iana",extensions:["mrc"]},"application/marcxml+xml":{source:"iana",compressible:!0,extensions:["mrcx"]},"application/mathematica":{source:"iana",extensions:["ma","nb","mb"]},"application/mathml+xml":{source:"iana",compressible:!0,extensions:["mathml"]},"application/mathml-content+xml":{source:"iana",compressible:!0},"application/mathml-presentation+xml":{source:"iana",compressible:!0},"application/mbms-associated-procedure-description+xml":{source:"iana",compressible:!0},"application/mbms-deregister+xml":{source:"iana",compressible:!0},"application/mbms-envelope+xml":{source:"iana",compressible:!0},"application/mbms-msk+xml":{source:"iana",compressible:!0},"application/mbms-msk-response+xml":{source:"iana",compressible:!0},"application/mbms-protection-description+xml":{source:"iana",compressible:!0},"application/mbms-reception-report+xml":{source:"iana",compressible:!0},"application/mbms-register+xml":{source:"iana",compressible:!0},"application/mbms-register-response+xml":{source:"iana",compressible:!0},"application/mbms-schedule+xml":{source:"iana",compressible:!0},"application/mbms-user-service-description+xml":{source:"iana",compressible:!0},"application/mbox":{source:"iana",extensions:["mbox"]},"application/media-policy-dataset+xml":{source:"iana",compressible:!0,extensions:["mpf"]},"application/media_control+xml":{source:"iana",compressible:!0},"application/mediaservercontrol+xml":{source:"iana",compressible:!0,extensions:["mscml"]},"application/merge-patch+json":{source:"iana",compressible:!0},"application/metalink+xml":{source:"apache",compressible:!0,extensions:["metalink"]},"application/metalink4+xml":{source:"iana",compressible:!0,extensions:["meta4"]},"application/mets+xml":{source:"iana",compressible:!0,extensions:["mets"]},"application/mf4":{source:"iana"},"application/mikey":{source:"iana"},"application/mipc":{source:"iana"},"application/missing-blocks+cbor-seq":{source:"iana"},"application/mmt-aei+xml":{source:"iana",compressible:!0,extensions:["maei"]},"application/mmt-usd+xml":{source:"iana",compressible:!0,extensions:["musd"]},"application/mods+xml":{source:"iana",compressible:!0,extensions:["mods"]},"application/moss-keys":{source:"iana"},"application/moss-signature":{source:"iana"},"application/mosskey-data":{source:"iana"},"application/mosskey-request":{source:"iana"},"application/mp21":{source:"iana",extensions:["m21","mp21"]},"application/mp4":{source:"iana",extensions:["mp4","mpg4","mp4s","m4p"]},"application/mpeg4-generic":{source:"iana"},"application/mpeg4-iod":{source:"iana"},"application/mpeg4-iod-xmt":{source:"iana"},"application/mrb-consumer+xml":{source:"iana",compressible:!0},"application/mrb-publish+xml":{source:"iana",compressible:!0},"application/msc-ivr+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/msc-mixer+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/msix":{compressible:!1,extensions:["msix"]},"application/msixbundle":{compressible:!1,extensions:["msixbundle"]},"application/msword":{source:"iana",compressible:!1,extensions:["doc","dot"]},"application/mud+json":{source:"iana",compressible:!0},"application/multipart-core":{source:"iana"},"application/mxf":{source:"iana",extensions:["mxf"]},"application/n-quads":{source:"iana",extensions:["nq"]},"application/n-triples":{source:"iana",extensions:["nt"]},"application/nasdata":{source:"iana"},"application/news-checkgroups":{source:"iana",charset:"US-ASCII"},"application/news-groupinfo":{source:"iana",charset:"US-ASCII"},"application/news-transmission":{source:"iana"},"application/nlsml+xml":{source:"iana",compressible:!0},"application/node":{source:"iana",extensions:["cjs"]},"application/nss":{source:"iana"},"application/oauth-authz-req+jwt":{source:"iana"},"application/oblivious-dns-message":{source:"iana"},"application/ocsp-request":{source:"iana"},"application/ocsp-response":{source:"iana"},"application/octet-stream":{source:"iana",compressible:!0,extensions:["bin","dms","lrf","mar","so","dist","distz","pkg","bpk","dump","elc","deploy","exe","dll","deb","dmg","iso","img","msi","msp","msm","buffer"]},"application/oda":{source:"iana",extensions:["oda"]},"application/odm+xml":{source:"iana",compressible:!0},"application/odx":{source:"iana"},"application/oebps-package+xml":{source:"iana",compressible:!0,extensions:["opf"]},"application/ogg":{source:"iana",compressible:!1,extensions:["ogx"]},"application/ohttp-keys":{source:"iana"},"application/omdoc+xml":{source:"apache",compressible:!0,extensions:["omdoc"]},"application/onenote":{source:"apache",extensions:["onetoc","onetoc2","onetmp","onepkg","one","onea"]},"application/opc-nodeset+xml":{source:"iana",compressible:!0},"application/oscore":{source:"iana"},"application/oxps":{source:"iana",extensions:["oxps"]},"application/p21":{source:"iana"},"application/p21+zip":{source:"iana",compressible:!1},"application/p2p-overlay+xml":{source:"iana",compressible:!0,extensions:["relo"]},"application/parityfec":{source:"iana"},"application/passport":{source:"iana"},"application/patch-ops-error+xml":{source:"iana",compressible:!0,extensions:["xer"]},"application/pdf":{source:"iana",compressible:!1,extensions:["pdf"]},"application/pdx":{source:"iana"},"application/pem-certificate-chain":{source:"iana"},"application/pgp-encrypted":{source:"iana",compressible:!1,extensions:["pgp"]},"application/pgp-keys":{source:"iana",extensions:["asc"]},"application/pgp-signature":{source:"iana",extensions:["sig","asc"]},"application/pics-rules":{source:"apache",extensions:["prf"]},"application/pidf+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/pidf-diff+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/pkcs10":{source:"iana",extensions:["p10"]},"application/pkcs12":{source:"iana"},"application/pkcs7-mime":{source:"iana",extensions:["p7m","p7c"]},"application/pkcs7-signature":{source:"iana",extensions:["p7s"]},"application/pkcs8":{source:"iana",extensions:["p8"]},"application/pkcs8-encrypted":{source:"iana"},"application/pkix-attr-cert":{source:"iana",extensions:["ac"]},"application/pkix-cert":{source:"iana",extensions:["cer"]},"application/pkix-crl":{source:"iana",extensions:["crl"]},"application/pkix-pkipath":{source:"iana",extensions:["pkipath"]},"application/pkixcmp":{source:"iana",extensions:["pki"]},"application/pls+xml":{source:"iana",compressible:!0,extensions:["pls"]},"application/poc-settings+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/postscript":{source:"iana",compressible:!0,extensions:["ai","eps","ps"]},"application/ppsp-tracker+json":{source:"iana",compressible:!0},"application/private-token-issuer-directory":{source:"iana"},"application/private-token-request":{source:"iana"},"application/private-token-response":{source:"iana"},"application/problem+json":{source:"iana",compressible:!0},"application/problem+xml":{source:"iana",compressible:!0},"application/provenance+xml":{source:"iana",compressible:!0,extensions:["provx"]},"application/provided-claims+jwt":{source:"iana"},"application/prs.alvestrand.titrax-sheet":{source:"iana"},"application/prs.cww":{source:"iana",extensions:["cww"]},"application/prs.cyn":{source:"iana",charset:"7-BIT"},"application/prs.hpub+zip":{source:"iana",compressible:!1},"application/prs.implied-document+xml":{source:"iana",compressible:!0},"application/prs.implied-executable":{source:"iana"},"application/prs.implied-object+json":{source:"iana",compressible:!0},"application/prs.implied-object+json-seq":{source:"iana"},"application/prs.implied-object+yaml":{source:"iana"},"application/prs.implied-structure":{source:"iana"},"application/prs.mayfile":{source:"iana"},"application/prs.nprend":{source:"iana"},"application/prs.plucker":{source:"iana"},"application/prs.rdf-xml-crypt":{source:"iana"},"application/prs.vcfbzip2":{source:"iana"},"application/prs.xsf+xml":{source:"iana",compressible:!0,extensions:["xsf"]},"application/pskc+xml":{source:"iana",compressible:!0,extensions:["pskcxml"]},"application/pvd+json":{source:"iana",compressible:!0},"application/qsig":{source:"iana"},"application/raml+yaml":{compressible:!0,extensions:["raml"]},"application/raptorfec":{source:"iana"},"application/rdap+json":{source:"iana",compressible:!0},"application/rdf+xml":{source:"iana",compressible:!0,extensions:["rdf","owl"]},"application/reginfo+xml":{source:"iana",compressible:!0,extensions:["rif"]},"application/relax-ng-compact-syntax":{source:"iana",extensions:["rnc"]},"application/remote-printing":{source:"apache"},"application/reputon+json":{source:"iana",compressible:!0},"application/resolve-response+jwt":{source:"iana"},"application/resource-lists+xml":{source:"iana",compressible:!0,extensions:["rl"]},"application/resource-lists-diff+xml":{source:"iana",compressible:!0,extensions:["rld"]},"application/rfc+xml":{source:"iana",compressible:!0},"application/riscos":{source:"iana"},"application/rlmi+xml":{source:"iana",compressible:!0},"application/rls-services+xml":{source:"iana",compressible:!0,extensions:["rs"]},"application/route-apd+xml":{source:"iana",compressible:!0,extensions:["rapd"]},"application/route-s-tsid+xml":{source:"iana",compressible:!0,extensions:["sls"]},"application/route-usd+xml":{source:"iana",compressible:!0,extensions:["rusd"]},"application/rpki-checklist":{source:"iana"},"application/rpki-ghostbusters":{source:"iana",extensions:["gbr"]},"application/rpki-manifest":{source:"iana",extensions:["mft"]},"application/rpki-publication":{source:"iana"},"application/rpki-roa":{source:"iana",extensions:["roa"]},"application/rpki-signed-tal":{source:"iana"},"application/rpki-updown":{source:"iana"},"application/rsd+xml":{source:"apache",compressible:!0,extensions:["rsd"]},"application/rss+xml":{source:"apache",compressible:!0,extensions:["rss"]},"application/rtf":{source:"iana",compressible:!0,extensions:["rtf"]},"application/rtploopback":{source:"iana"},"application/rtx":{source:"iana"},"application/samlassertion+xml":{source:"iana",compressible:!0},"application/samlmetadata+xml":{source:"iana",compressible:!0},"application/sarif+json":{source:"iana",compressible:!0},"application/sarif-external-properties+json":{source:"iana",compressible:!0},"application/sbe":{source:"iana"},"application/sbml+xml":{source:"iana",compressible:!0,extensions:["sbml"]},"application/scaip+xml":{source:"iana",compressible:!0},"application/scim+json":{source:"iana",compressible:!0},"application/scvp-cv-request":{source:"iana",extensions:["scq"]},"application/scvp-cv-response":{source:"iana",extensions:["scs"]},"application/scvp-vp-request":{source:"iana",extensions:["spq"]},"application/scvp-vp-response":{source:"iana",extensions:["spp"]},"application/sdp":{source:"iana",extensions:["sdp"]},"application/secevent+jwt":{source:"iana"},"application/senml+cbor":{source:"iana"},"application/senml+json":{source:"iana",compressible:!0},"application/senml+xml":{source:"iana",compressible:!0,extensions:["senmlx"]},"application/senml-etch+cbor":{source:"iana"},"application/senml-etch+json":{source:"iana",compressible:!0},"application/senml-exi":{source:"iana"},"application/sensml+cbor":{source:"iana"},"application/sensml+json":{source:"iana",compressible:!0},"application/sensml+xml":{source:"iana",compressible:!0,extensions:["sensmlx"]},"application/sensml-exi":{source:"iana"},"application/sep+xml":{source:"iana",compressible:!0},"application/sep-exi":{source:"iana"},"application/session-info":{source:"iana"},"application/set-payment":{source:"iana"},"application/set-payment-initiation":{source:"iana",extensions:["setpay"]},"application/set-registration":{source:"iana"},"application/set-registration-initiation":{source:"iana",extensions:["setreg"]},"application/sgml":{source:"iana"},"application/sgml-open-catalog":{source:"iana"},"application/shf+xml":{source:"iana",compressible:!0,extensions:["shf"]},"application/sieve":{source:"iana",extensions:["siv","sieve"]},"application/simple-filter+xml":{source:"iana",compressible:!0},"application/simple-message-summary":{source:"iana"},"application/simplesymbolcontainer":{source:"iana"},"application/sipc":{source:"iana"},"application/slate":{source:"iana"},"application/smil":{source:"apache"},"application/smil+xml":{source:"iana",compressible:!0,extensions:["smi","smil"]},"application/smpte336m":{source:"iana"},"application/soap+fastinfoset":{source:"iana"},"application/soap+xml":{source:"iana",compressible:!0},"application/sparql-query":{source:"iana",extensions:["rq"]},"application/sparql-results+xml":{source:"iana",compressible:!0,extensions:["srx"]},"application/spdx+json":{source:"iana",compressible:!0},"application/spirits-event+xml":{source:"iana",compressible:!0},"application/sql":{source:"iana",extensions:["sql"]},"application/srgs":{source:"iana",extensions:["gram"]},"application/srgs+xml":{source:"iana",compressible:!0,extensions:["grxml"]},"application/sru+xml":{source:"iana",compressible:!0,extensions:["sru"]},"application/ssdl+xml":{source:"apache",compressible:!0,extensions:["ssdl"]},"application/sslkeylogfile":{source:"iana"},"application/ssml+xml":{source:"iana",compressible:!0,extensions:["ssml"]},"application/st2110-41":{source:"iana"},"application/stix+json":{source:"iana",compressible:!0},"application/stratum":{source:"iana"},"application/swid+cbor":{source:"iana"},"application/swid+xml":{source:"iana",compressible:!0,extensions:["swidtag"]},"application/tamp-apex-update":{source:"iana"},"application/tamp-apex-update-confirm":{source:"iana"},"application/tamp-community-update":{source:"iana"},"application/tamp-community-update-confirm":{source:"iana"},"application/tamp-error":{source:"iana"},"application/tamp-sequence-adjust":{source:"iana"},"application/tamp-sequence-adjust-confirm":{source:"iana"},"application/tamp-status-query":{source:"iana"},"application/tamp-status-response":{source:"iana"},"application/tamp-update":{source:"iana"},"application/tamp-update-confirm":{source:"iana"},"application/tar":{compressible:!0},"application/taxii+json":{source:"iana",compressible:!0},"application/td+json":{source:"iana",compressible:!0},"application/tei+xml":{source:"iana",compressible:!0,extensions:["tei","teicorpus"]},"application/tetra_isi":{source:"iana"},"application/thraud+xml":{source:"iana",compressible:!0,extensions:["tfi"]},"application/timestamp-query":{source:"iana"},"application/timestamp-reply":{source:"iana"},"application/timestamped-data":{source:"iana",extensions:["tsd"]},"application/tlsrpt+gzip":{source:"iana"},"application/tlsrpt+json":{source:"iana",compressible:!0},"application/tm+json":{source:"iana",compressible:!0},"application/tnauthlist":{source:"iana"},"application/toc+cbor":{source:"iana"},"application/token-introspection+jwt":{source:"iana"},"application/toml":{source:"iana",compressible:!0,extensions:["toml"]},"application/trickle-ice-sdpfrag":{source:"iana"},"application/trig":{source:"iana",extensions:["trig"]},"application/trust-chain+json":{source:"iana",compressible:!0},"application/trust-mark+jwt":{source:"iana"},"application/trust-mark-delegation+jwt":{source:"iana"},"application/ttml+xml":{source:"iana",compressible:!0,extensions:["ttml"]},"application/tve-trigger":{source:"iana"},"application/tzif":{source:"iana"},"application/tzif-leap":{source:"iana"},"application/ubjson":{compressible:!1,extensions:["ubj"]},"application/uccs+cbor":{source:"iana"},"application/ujcs+json":{source:"iana",compressible:!0},"application/ulpfec":{source:"iana"},"application/urc-grpsheet+xml":{source:"iana",compressible:!0},"application/urc-ressheet+xml":{source:"iana",compressible:!0,extensions:["rsheet"]},"application/urc-targetdesc+xml":{source:"iana",compressible:!0,extensions:["td"]},"application/urc-uisocketdesc+xml":{source:"iana",compressible:!0},"application/vc":{source:"iana"},"application/vc+cose":{source:"iana"},"application/vc+jwt":{source:"iana"},"application/vcard+json":{source:"iana",compressible:!0},"application/vcard+xml":{source:"iana",compressible:!0},"application/vemmi":{source:"iana"},"application/vividence.scriptfile":{source:"apache"},"application/vnd.1000minds.decision-model+xml":{source:"iana",compressible:!0,extensions:["1km"]},"application/vnd.1ob":{source:"iana"},"application/vnd.3gpp-prose+xml":{source:"iana",compressible:!0},"application/vnd.3gpp-prose-pc3a+xml":{source:"iana",compressible:!0},"application/vnd.3gpp-prose-pc3ach+xml":{source:"iana",compressible:!0},"application/vnd.3gpp-prose-pc3ch+xml":{source:"iana",compressible:!0},"application/vnd.3gpp-prose-pc8+xml":{source:"iana",compressible:!0},"application/vnd.3gpp-v2x-local-service-information":{source:"iana"},"application/vnd.3gpp.5gnas":{source:"iana"},"application/vnd.3gpp.5gsa2x":{source:"iana"},"application/vnd.3gpp.5gsa2x-local-service-information":{source:"iana"},"application/vnd.3gpp.5gsv2x":{source:"iana"},"application/vnd.3gpp.5gsv2x-local-service-information":{source:"iana"},"application/vnd.3gpp.access-transfer-events+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.bsf+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.crs+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.current-location-discovery+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.gmop+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.gtpc":{source:"iana"},"application/vnd.3gpp.interworking-data":{source:"iana"},"application/vnd.3gpp.lpp":{source:"iana"},"application/vnd.3gpp.mc-signalling-ear":{source:"iana"},"application/vnd.3gpp.mcdata-affiliation-command+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-msgstore-ctrl-request+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-payload":{source:"iana"},"application/vnd.3gpp.mcdata-regroup+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-service-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-signalling":{source:"iana"},"application/vnd.3gpp.mcdata-ue-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcdata-user-profile+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-affiliation-command+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-floor-request+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-location-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-mbms-usage-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-regroup+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-service-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-signed+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-ue-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-ue-init-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcptt-user-profile+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-affiliation-command+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-location-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-mbms-usage-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-regroup+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-service-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-transmission-request+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-ue-config+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mcvideo-user-profile+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.mid-call+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.ngap":{source:"iana"},"application/vnd.3gpp.pfcp":{source:"iana"},"application/vnd.3gpp.pic-bw-large":{source:"iana",extensions:["plb"]},"application/vnd.3gpp.pic-bw-small":{source:"iana",extensions:["psb"]},"application/vnd.3gpp.pic-bw-var":{source:"iana",extensions:["pvb"]},"application/vnd.3gpp.pinapp-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.s1ap":{source:"iana"},"application/vnd.3gpp.seal-group-doc+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-location-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-mbms-usage-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-network-qos-management-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-ue-config-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-unicast-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.seal-user-profile-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.sms":{source:"iana"},"application/vnd.3gpp.sms+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.srvcc-ext+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.srvcc-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.state-and-event-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.ussd+xml":{source:"iana",compressible:!0},"application/vnd.3gpp.v2x":{source:"iana"},"application/vnd.3gpp.vae-info+xml":{source:"iana",compressible:!0},"application/vnd.3gpp2.bcmcsinfo+xml":{source:"iana",compressible:!0},"application/vnd.3gpp2.sms":{source:"iana"},"application/vnd.3gpp2.tcap":{source:"iana",extensions:["tcap"]},"application/vnd.3lightssoftware.imagescal":{source:"iana"},"application/vnd.3m.post-it-notes":{source:"iana",extensions:["pwn"]},"application/vnd.accpac.simply.aso":{source:"iana",extensions:["aso"]},"application/vnd.accpac.simply.imp":{source:"iana",extensions:["imp"]},"application/vnd.acm.addressxfer+json":{source:"iana",compressible:!0},"application/vnd.acm.chatbot+json":{source:"iana",compressible:!0},"application/vnd.acucobol":{source:"iana",extensions:["acu"]},"application/vnd.acucorp":{source:"iana",extensions:["atc","acutc"]},"application/vnd.adobe.air-application-installer-package+zip":{source:"apache",compressible:!1,extensions:["air"]},"application/vnd.adobe.flash.movie":{source:"iana"},"application/vnd.adobe.formscentral.fcdt":{source:"iana",extensions:["fcdt"]},"application/vnd.adobe.fxp":{source:"iana",extensions:["fxp","fxpl"]},"application/vnd.adobe.partial-upload":{source:"iana"},"application/vnd.adobe.xdp+xml":{source:"iana",compressible:!0,extensions:["xdp"]},"application/vnd.adobe.xfdf":{source:"apache",extensions:["xfdf"]},"application/vnd.aether.imp":{source:"iana"},"application/vnd.afpc.afplinedata":{source:"iana"},"application/vnd.afpc.afplinedata-pagedef":{source:"iana"},"application/vnd.afpc.cmoca-cmresource":{source:"iana"},"application/vnd.afpc.foca-charset":{source:"iana"},"application/vnd.afpc.foca-codedfont":{source:"iana"},"application/vnd.afpc.foca-codepage":{source:"iana"},"application/vnd.afpc.modca":{source:"iana"},"application/vnd.afpc.modca-cmtable":{source:"iana"},"application/vnd.afpc.modca-formdef":{source:"iana"},"application/vnd.afpc.modca-mediummap":{source:"iana"},"application/vnd.afpc.modca-objectcontainer":{source:"iana"},"application/vnd.afpc.modca-overlay":{source:"iana"},"application/vnd.afpc.modca-pagesegment":{source:"iana"},"application/vnd.age":{source:"iana",extensions:["age"]},"application/vnd.ah-barcode":{source:"apache"},"application/vnd.ahead.space":{source:"iana",extensions:["ahead"]},"application/vnd.airzip.filesecure.azf":{source:"iana",extensions:["azf"]},"application/vnd.airzip.filesecure.azs":{source:"iana",extensions:["azs"]},"application/vnd.amadeus+json":{source:"iana",compressible:!0},"application/vnd.amazon.ebook":{source:"apache",extensions:["azw"]},"application/vnd.amazon.mobi8-ebook":{source:"iana"},"application/vnd.americandynamics.acc":{source:"iana",extensions:["acc"]},"application/vnd.amiga.ami":{source:"iana",extensions:["ami"]},"application/vnd.amundsen.maze+xml":{source:"iana",compressible:!0},"application/vnd.android.ota":{source:"iana"},"application/vnd.android.package-archive":{source:"apache",compressible:!1,extensions:["apk"]},"application/vnd.anki":{source:"iana"},"application/vnd.anser-web-certificate-issue-initiation":{source:"iana",extensions:["cii"]},"application/vnd.anser-web-funds-transfer-initiation":{source:"apache",extensions:["fti"]},"application/vnd.antix.game-component":{source:"iana",extensions:["atx"]},"application/vnd.apache.arrow.file":{source:"iana"},"application/vnd.apache.arrow.stream":{source:"iana"},"application/vnd.apache.parquet":{source:"iana"},"application/vnd.apache.thrift.binary":{source:"iana"},"application/vnd.apache.thrift.compact":{source:"iana"},"application/vnd.apache.thrift.json":{source:"iana"},"application/vnd.apexlang":{source:"iana"},"application/vnd.api+json":{source:"iana",compressible:!0},"application/vnd.aplextor.warrp+json":{source:"iana",compressible:!0},"application/vnd.apothekende.reservation+json":{source:"iana",compressible:!0},"application/vnd.apple.installer+xml":{source:"iana",compressible:!0,extensions:["mpkg"]},"application/vnd.apple.keynote":{source:"iana",extensions:["key"]},"application/vnd.apple.mpegurl":{source:"iana",extensions:["m3u8"]},"application/vnd.apple.numbers":{source:"iana",extensions:["numbers"]},"application/vnd.apple.pages":{source:"iana",extensions:["pages"]},"application/vnd.apple.pkpass":{compressible:!1,extensions:["pkpass"]},"application/vnd.arastra.swi":{source:"apache"},"application/vnd.aristanetworks.swi":{source:"iana",extensions:["swi"]},"application/vnd.artisan+json":{source:"iana",compressible:!0},"application/vnd.artsquare":{source:"iana"},"application/vnd.astraea-software.iota":{source:"iana",extensions:["iota"]},"application/vnd.audiograph":{source:"iana",extensions:["aep"]},"application/vnd.autodesk.fbx":{extensions:["fbx"]},"application/vnd.autopackage":{source:"iana"},"application/vnd.avalon+json":{source:"iana",compressible:!0},"application/vnd.avistar+xml":{source:"iana",compressible:!0},"application/vnd.balsamiq.bmml+xml":{source:"iana",compressible:!0,extensions:["bmml"]},"application/vnd.balsamiq.bmpr":{source:"iana"},"application/vnd.banana-accounting":{source:"iana"},"application/vnd.bbf.usp.error":{source:"iana"},"application/vnd.bbf.usp.msg":{source:"iana"},"application/vnd.bbf.usp.msg+json":{source:"iana",compressible:!0},"application/vnd.bekitzur-stech+json":{source:"iana",compressible:!0},"application/vnd.belightsoft.lhzd+zip":{source:"iana",compressible:!1},"application/vnd.belightsoft.lhzl+zip":{source:"iana",compressible:!1},"application/vnd.bint.med-content":{source:"iana"},"application/vnd.biopax.rdf+xml":{source:"iana",compressible:!0},"application/vnd.blink-idb-value-wrapper":{source:"iana"},"application/vnd.blueice.multipass":{source:"iana",extensions:["mpm"]},"application/vnd.bluetooth.ep.oob":{source:"iana"},"application/vnd.bluetooth.le.oob":{source:"iana"},"application/vnd.bmi":{source:"iana",extensions:["bmi"]},"application/vnd.bpf":{source:"iana"},"application/vnd.bpf3":{source:"iana"},"application/vnd.businessobjects":{source:"iana",extensions:["rep"]},"application/vnd.byu.uapi+json":{source:"iana",compressible:!0},"application/vnd.bzip3":{source:"iana"},"application/vnd.c3voc.schedule+xml":{source:"iana",compressible:!0},"application/vnd.cab-jscript":{source:"iana"},"application/vnd.canon-cpdl":{source:"iana"},"application/vnd.canon-lips":{source:"iana"},"application/vnd.capasystems-pg+json":{source:"iana",compressible:!0},"application/vnd.cendio.thinlinc.clientconf":{source:"iana"},"application/vnd.century-systems.tcp_stream":{source:"iana"},"application/vnd.chemdraw+xml":{source:"iana",compressible:!0,extensions:["cdxml"]},"application/vnd.chess-pgn":{source:"iana"},"application/vnd.chipnuts.karaoke-mmd":{source:"iana",extensions:["mmd"]},"application/vnd.ciedi":{source:"iana"},"application/vnd.cinderella":{source:"iana",extensions:["cdy"]},"application/vnd.cirpack.isdn-ext":{source:"iana"},"application/vnd.citationstyles.style+xml":{source:"iana",compressible:!0,extensions:["csl"]},"application/vnd.claymore":{source:"iana",extensions:["cla"]},"application/vnd.cloanto.rp9":{source:"iana",extensions:["rp9"]},"application/vnd.clonk.c4group":{source:"iana",extensions:["c4g","c4d","c4f","c4p","c4u"]},"application/vnd.cluetrust.cartomobile-config":{source:"iana",extensions:["c11amc"]},"application/vnd.cluetrust.cartomobile-config-pkg":{source:"iana",extensions:["c11amz"]},"application/vnd.cncf.helm.chart.content.v1.tar+gzip":{source:"iana"},"application/vnd.cncf.helm.chart.provenance.v1.prov":{source:"iana"},"application/vnd.cncf.helm.config.v1+json":{source:"iana",compressible:!0},"application/vnd.coffeescript":{source:"iana"},"application/vnd.collabio.xodocuments.document":{source:"iana"},"application/vnd.collabio.xodocuments.document-template":{source:"iana"},"application/vnd.collabio.xodocuments.presentation":{source:"iana"},"application/vnd.collabio.xodocuments.presentation-template":{source:"iana"},"application/vnd.collabio.xodocuments.spreadsheet":{source:"iana"},"application/vnd.collabio.xodocuments.spreadsheet-template":{source:"iana"},"application/vnd.collection+json":{source:"iana",compressible:!0},"application/vnd.collection.doc+json":{source:"iana",compressible:!0},"application/vnd.collection.next+json":{source:"iana",compressible:!0},"application/vnd.comicbook+zip":{source:"iana",compressible:!1},"application/vnd.comicbook-rar":{source:"iana"},"application/vnd.commerce-battelle":{source:"iana"},"application/vnd.commonspace":{source:"iana",extensions:["csp"]},"application/vnd.contact.cmsg":{source:"iana",extensions:["cdbcmsg"]},"application/vnd.coreos.ignition+json":{source:"iana",compressible:!0},"application/vnd.cosmocaller":{source:"iana",extensions:["cmc"]},"application/vnd.crick.clicker":{source:"iana",extensions:["clkx"]},"application/vnd.crick.clicker.keyboard":{source:"iana",extensions:["clkk"]},"application/vnd.crick.clicker.palette":{source:"iana",extensions:["clkp"]},"application/vnd.crick.clicker.template":{source:"iana",extensions:["clkt"]},"application/vnd.crick.clicker.wordbank":{source:"iana",extensions:["clkw"]},"application/vnd.criticaltools.wbs+xml":{source:"iana",compressible:!0,extensions:["wbs"]},"application/vnd.cryptii.pipe+json":{source:"iana",compressible:!0},"application/vnd.crypto-shade-file":{source:"iana"},"application/vnd.cryptomator.encrypted":{source:"iana"},"application/vnd.cryptomator.vault":{source:"iana"},"application/vnd.ctc-posml":{source:"iana",extensions:["pml"]},"application/vnd.ctct.ws+xml":{source:"iana",compressible:!0},"application/vnd.cups-pdf":{source:"iana"},"application/vnd.cups-postscript":{source:"iana"},"application/vnd.cups-ppd":{source:"iana",extensions:["ppd"]},"application/vnd.cups-raster":{source:"iana"},"application/vnd.cups-raw":{source:"iana"},"application/vnd.curl":{source:"iana"},"application/vnd.curl.car":{source:"apache",extensions:["car"]},"application/vnd.curl.pcurl":{source:"apache",extensions:["pcurl"]},"application/vnd.cyan.dean.root+xml":{source:"iana",compressible:!0},"application/vnd.cybank":{source:"iana"},"application/vnd.cyclonedx+json":{source:"iana",compressible:!0},"application/vnd.cyclonedx+xml":{source:"iana",compressible:!0},"application/vnd.d2l.coursepackage1p0+zip":{source:"iana",compressible:!1},"application/vnd.d3m-dataset":{source:"iana"},"application/vnd.d3m-problem":{source:"iana"},"application/vnd.dart":{source:"iana",compressible:!0,extensions:["dart"]},"application/vnd.data-vision.rdz":{source:"iana",extensions:["rdz"]},"application/vnd.datalog":{source:"iana"},"application/vnd.datapackage+json":{source:"iana",compressible:!0},"application/vnd.dataresource+json":{source:"iana",compressible:!0},"application/vnd.dbf":{source:"iana",extensions:["dbf"]},"application/vnd.dcmp+xml":{source:"iana",compressible:!0,extensions:["dcmp"]},"application/vnd.debian.binary-package":{source:"iana"},"application/vnd.dece.data":{source:"iana",extensions:["uvf","uvvf","uvd","uvvd"]},"application/vnd.dece.ttml+xml":{source:"iana",compressible:!0,extensions:["uvt","uvvt"]},"application/vnd.dece.unspecified":{source:"iana",extensions:["uvx","uvvx"]},"application/vnd.dece.zip":{source:"iana",extensions:["uvz","uvvz"]},"application/vnd.denovo.fcselayout-link":{source:"iana",extensions:["fe_launch"]},"application/vnd.desmume.movie":{source:"iana"},"application/vnd.dir-bi.plate-dl-nosuffix":{source:"iana"},"application/vnd.dm.delegation+xml":{source:"iana",compressible:!0},"application/vnd.dna":{source:"iana",extensions:["dna"]},"application/vnd.document+json":{source:"iana",compressible:!0},"application/vnd.dolby.mlp":{source:"apache",extensions:["mlp"]},"application/vnd.dolby.mobile.1":{source:"iana"},"application/vnd.dolby.mobile.2":{source:"iana"},"application/vnd.doremir.scorecloud-binary-document":{source:"iana"},"application/vnd.dpgraph":{source:"iana",extensions:["dpg"]},"application/vnd.dreamfactory":{source:"iana",extensions:["dfac"]},"application/vnd.drive+json":{source:"iana",compressible:!0},"application/vnd.ds-keypoint":{source:"apache",extensions:["kpxx"]},"application/vnd.dtg.local":{source:"iana"},"application/vnd.dtg.local.flash":{source:"iana"},"application/vnd.dtg.local.html":{source:"iana"},"application/vnd.dvb.ait":{source:"iana",extensions:["ait"]},"application/vnd.dvb.dvbisl+xml":{source:"iana",compressible:!0},"application/vnd.dvb.dvbj":{source:"iana"},"application/vnd.dvb.esgcontainer":{source:"iana"},"application/vnd.dvb.ipdcdftnotifaccess":{source:"iana"},"application/vnd.dvb.ipdcesgaccess":{source:"iana"},"application/vnd.dvb.ipdcesgaccess2":{source:"iana"},"application/vnd.dvb.ipdcesgpdd":{source:"iana"},"application/vnd.dvb.ipdcroaming":{source:"iana"},"application/vnd.dvb.iptv.alfec-base":{source:"iana"},"application/vnd.dvb.iptv.alfec-enhancement":{source:"iana"},"application/vnd.dvb.notif-aggregate-root+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-container+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-generic+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-ia-msglist+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-ia-registration-request+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-ia-registration-response+xml":{source:"iana",compressible:!0},"application/vnd.dvb.notif-init+xml":{source:"iana",compressible:!0},"application/vnd.dvb.pfr":{source:"iana"},"application/vnd.dvb.service":{source:"iana",extensions:["svc"]},"application/vnd.dxr":{source:"iana"},"application/vnd.dynageo":{source:"iana",extensions:["geo"]},"application/vnd.dzr":{source:"iana"},"application/vnd.easykaraoke.cdgdownload":{source:"iana"},"application/vnd.ecdis-update":{source:"iana"},"application/vnd.ecip.rlp":{source:"iana"},"application/vnd.eclipse.ditto+json":{source:"iana",compressible:!0},"application/vnd.ecowin.chart":{source:"iana",extensions:["mag"]},"application/vnd.ecowin.filerequest":{source:"iana"},"application/vnd.ecowin.fileupdate":{source:"iana"},"application/vnd.ecowin.series":{source:"iana"},"application/vnd.ecowin.seriesrequest":{source:"iana"},"application/vnd.ecowin.seriesupdate":{source:"iana"},"application/vnd.efi.img":{source:"iana"},"application/vnd.efi.iso":{source:"iana"},"application/vnd.eln+zip":{source:"iana",compressible:!1},"application/vnd.emclient.accessrequest+xml":{source:"iana",compressible:!0},"application/vnd.enliven":{source:"iana",extensions:["nml"]},"application/vnd.enphase.envoy":{source:"iana"},"application/vnd.eprints.data+xml":{source:"iana",compressible:!0},"application/vnd.epson.esf":{source:"iana",extensions:["esf"]},"application/vnd.epson.msf":{source:"iana",extensions:["msf"]},"application/vnd.epson.quickanime":{source:"iana",extensions:["qam"]},"application/vnd.epson.salt":{source:"iana",extensions:["slt"]},"application/vnd.epson.ssf":{source:"iana",extensions:["ssf"]},"application/vnd.ericsson.quickcall":{source:"iana"},"application/vnd.erofs":{source:"iana"},"application/vnd.espass-espass+zip":{source:"iana",compressible:!1},"application/vnd.eszigno3+xml":{source:"iana",compressible:!0,extensions:["es3","et3"]},"application/vnd.etsi.aoc+xml":{source:"iana",compressible:!0},"application/vnd.etsi.asic-e+zip":{source:"iana",compressible:!1},"application/vnd.etsi.asic-s+zip":{source:"iana",compressible:!1},"application/vnd.etsi.cug+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvcommand+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvdiscovery+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvprofile+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvsad-bc+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvsad-cod+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvsad-npvr+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvservice+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvsync+xml":{source:"iana",compressible:!0},"application/vnd.etsi.iptvueprofile+xml":{source:"iana",compressible:!0},"application/vnd.etsi.mcid+xml":{source:"iana",compressible:!0},"application/vnd.etsi.mheg5":{source:"iana"},"application/vnd.etsi.overload-control-policy-dataset+xml":{source:"iana",compressible:!0},"application/vnd.etsi.pstn+xml":{source:"iana",compressible:!0},"application/vnd.etsi.sci+xml":{source:"iana",compressible:!0},"application/vnd.etsi.simservs+xml":{source:"iana",compressible:!0},"application/vnd.etsi.timestamp-token":{source:"iana"},"application/vnd.etsi.tsl+xml":{source:"iana",compressible:!0},"application/vnd.etsi.tsl.der":{source:"iana"},"application/vnd.eu.kasparian.car+json":{source:"iana",compressible:!0},"application/vnd.eudora.data":{source:"iana"},"application/vnd.evolv.ecig.profile":{source:"iana"},"application/vnd.evolv.ecig.settings":{source:"iana"},"application/vnd.evolv.ecig.theme":{source:"iana"},"application/vnd.exstream-empower+zip":{source:"iana",compressible:!1},"application/vnd.exstream-package":{source:"iana"},"application/vnd.ezpix-album":{source:"iana",extensions:["ez2"]},"application/vnd.ezpix-package":{source:"iana",extensions:["ez3"]},"application/vnd.f-secure.mobile":{source:"iana"},"application/vnd.familysearch.gedcom+zip":{source:"iana",compressible:!1},"application/vnd.fastcopy-disk-image":{source:"iana"},"application/vnd.fdf":{source:"apache",extensions:["fdf"]},"application/vnd.fdsn.mseed":{source:"iana",extensions:["mseed"]},"application/vnd.fdsn.seed":{source:"iana",extensions:["seed","dataless"]},"application/vnd.fdsn.stationxml+xml":{source:"iana",charset:"XML-BASED",compressible:!0},"application/vnd.ffsns":{source:"iana"},"application/vnd.ficlab.flb+zip":{source:"iana",compressible:!1},"application/vnd.filmit.zfc":{source:"iana"},"application/vnd.fints":{source:"iana"},"application/vnd.firemonkeys.cloudcell":{source:"iana"},"application/vnd.flographit":{source:"iana",extensions:["gph"]},"application/vnd.fluxtime.clip":{source:"iana",extensions:["ftc"]},"application/vnd.font-fontforge-sfd":{source:"iana"},"application/vnd.framemaker":{source:"iana",extensions:["fm","frame","maker","book"]},"application/vnd.freelog.comic":{source:"iana"},"application/vnd.frogans.fnc":{source:"apache",extensions:["fnc"]},"application/vnd.frogans.ltf":{source:"apache",extensions:["ltf"]},"application/vnd.fsc.weblaunch":{source:"iana",extensions:["fsc"]},"application/vnd.fujifilm.fb.docuworks":{source:"iana"},"application/vnd.fujifilm.fb.docuworks.binder":{source:"iana"},"application/vnd.fujifilm.fb.docuworks.container":{source:"iana"},"application/vnd.fujifilm.fb.jfi+xml":{source:"iana",compressible:!0},"application/vnd.fujitsu.oasys":{source:"iana",extensions:["oas"]},"application/vnd.fujitsu.oasys2":{source:"iana",extensions:["oa2"]},"application/vnd.fujitsu.oasys3":{source:"iana",extensions:["oa3"]},"application/vnd.fujitsu.oasysgp":{source:"iana",extensions:["fg5"]},"application/vnd.fujitsu.oasysprs":{source:"iana",extensions:["bh2"]},"application/vnd.fujixerox.art-ex":{source:"iana"},"application/vnd.fujixerox.art4":{source:"iana"},"application/vnd.fujixerox.ddd":{source:"iana",extensions:["ddd"]},"application/vnd.fujixerox.docuworks":{source:"iana",extensions:["xdw"]},"application/vnd.fujixerox.docuworks.binder":{source:"iana",extensions:["xbd"]},"application/vnd.fujixerox.docuworks.container":{source:"iana"},"application/vnd.fujixerox.hbpl":{source:"iana"},"application/vnd.fut-misnet":{source:"iana"},"application/vnd.futoin+cbor":{source:"iana"},"application/vnd.futoin+json":{source:"iana",compressible:!0},"application/vnd.fuzzysheet":{source:"iana",extensions:["fzs"]},"application/vnd.ga4gh.passport+jwt":{source:"iana"},"application/vnd.genomatix.tuxedo":{source:"iana",extensions:["txd"]},"application/vnd.genozip":{source:"iana"},"application/vnd.gentics.grd+json":{source:"iana",compressible:!0},"application/vnd.gentoo.catmetadata+xml":{source:"iana",compressible:!0},"application/vnd.gentoo.ebuild":{source:"iana"},"application/vnd.gentoo.eclass":{source:"iana"},"application/vnd.gentoo.gpkg":{source:"iana"},"application/vnd.gentoo.manifest":{source:"iana"},"application/vnd.gentoo.pkgmetadata+xml":{source:"iana",compressible:!0},"application/vnd.gentoo.xpak":{source:"iana"},"application/vnd.geo+json":{source:"apache",compressible:!0},"application/vnd.geocube+xml":{source:"apache",compressible:!0},"application/vnd.geogebra.file":{source:"iana",extensions:["ggb"]},"application/vnd.geogebra.pinboard":{source:"iana"},"application/vnd.geogebra.slides":{source:"iana",extensions:["ggs"]},"application/vnd.geogebra.tool":{source:"iana",extensions:["ggt"]},"application/vnd.geometry-explorer":{source:"iana",extensions:["gex","gre"]},"application/vnd.geonext":{source:"iana",extensions:["gxt"]},"application/vnd.geoplan":{source:"iana",extensions:["g2w"]},"application/vnd.geospace":{source:"iana",extensions:["g3w"]},"application/vnd.gerber":{source:"iana"},"application/vnd.globalplatform.card-content-mgt":{source:"iana"},"application/vnd.globalplatform.card-content-mgt-response":{source:"iana"},"application/vnd.gmx":{source:"iana",extensions:["gmx"]},"application/vnd.gnu.taler.exchange+json":{source:"iana",compressible:!0},"application/vnd.gnu.taler.merchant+json":{source:"iana",compressible:!0},"application/vnd.google-apps.audio":{},"application/vnd.google-apps.document":{compressible:!1,extensions:["gdoc"]},"application/vnd.google-apps.drawing":{compressible:!1,extensions:["gdraw"]},"application/vnd.google-apps.drive-sdk":{compressible:!1},"application/vnd.google-apps.file":{},"application/vnd.google-apps.folder":{compressible:!1},"application/vnd.google-apps.form":{compressible:!1,extensions:["gform"]},"application/vnd.google-apps.fusiontable":{},"application/vnd.google-apps.jam":{compressible:!1,extensions:["gjam"]},"application/vnd.google-apps.mail-layout":{},"application/vnd.google-apps.map":{compressible:!1,extensions:["gmap"]},"application/vnd.google-apps.photo":{},"application/vnd.google-apps.presentation":{compressible:!1,extensions:["gslides"]},"application/vnd.google-apps.script":{compressible:!1,extensions:["gscript"]},"application/vnd.google-apps.shortcut":{},"application/vnd.google-apps.site":{compressible:!1,extensions:["gsite"]},"application/vnd.google-apps.spreadsheet":{compressible:!1,extensions:["gsheet"]},"application/vnd.google-apps.unknown":{},"application/vnd.google-apps.video":{},"application/vnd.google-earth.kml+xml":{source:"iana",compressible:!0,extensions:["kml"]},"application/vnd.google-earth.kmz":{source:"iana",compressible:!1,extensions:["kmz"]},"application/vnd.gov.sk.e-form+xml":{source:"apache",compressible:!0},"application/vnd.gov.sk.e-form+zip":{source:"iana",compressible:!1},"application/vnd.gov.sk.xmldatacontainer+xml":{source:"iana",compressible:!0,extensions:["xdcf"]},"application/vnd.gpxsee.map+xml":{source:"iana",compressible:!0},"application/vnd.grafeq":{source:"iana",extensions:["gqf","gqs"]},"application/vnd.gridmp":{source:"iana"},"application/vnd.groove-account":{source:"iana",extensions:["gac"]},"application/vnd.groove-help":{source:"iana",extensions:["ghf"]},"application/vnd.groove-identity-message":{source:"iana",extensions:["gim"]},"application/vnd.groove-injector":{source:"iana",extensions:["grv"]},"application/vnd.groove-tool-message":{source:"iana",extensions:["gtm"]},"application/vnd.groove-tool-template":{source:"iana",extensions:["tpl"]},"application/vnd.groove-vcard":{source:"iana",extensions:["vcg"]},"application/vnd.hal+json":{source:"iana",compressible:!0},"application/vnd.hal+xml":{source:"iana",compressible:!0,extensions:["hal"]},"application/vnd.handheld-entertainment+xml":{source:"iana",compressible:!0,extensions:["zmm"]},"application/vnd.hbci":{source:"iana",extensions:["hbci"]},"application/vnd.hc+json":{source:"iana",compressible:!0},"application/vnd.hcl-bireports":{source:"iana"},"application/vnd.hdt":{source:"iana"},"application/vnd.heroku+json":{source:"iana",compressible:!0},"application/vnd.hhe.lesson-player":{source:"iana",extensions:["les"]},"application/vnd.hp-hpgl":{source:"iana",extensions:["hpgl"]},"application/vnd.hp-hpid":{source:"iana",extensions:["hpid"]},"application/vnd.hp-hps":{source:"iana",extensions:["hps"]},"application/vnd.hp-jlyt":{source:"iana",extensions:["jlt"]},"application/vnd.hp-pcl":{source:"iana",extensions:["pcl"]},"application/vnd.hp-pclxl":{source:"iana",extensions:["pclxl"]},"application/vnd.hsl":{source:"iana"},"application/vnd.httphone":{source:"iana"},"application/vnd.hydrostatix.sof-data":{source:"iana",extensions:["sfd-hdstx"]},"application/vnd.hyper+json":{source:"iana",compressible:!0},"application/vnd.hyper-item+json":{source:"iana",compressible:!0},"application/vnd.hyperdrive+json":{source:"iana",compressible:!0},"application/vnd.hzn-3d-crossword":{source:"iana"},"application/vnd.ibm.afplinedata":{source:"apache"},"application/vnd.ibm.electronic-media":{source:"iana"},"application/vnd.ibm.minipay":{source:"iana",extensions:["mpy"]},"application/vnd.ibm.modcap":{source:"apache",extensions:["afp","listafp","list3820"]},"application/vnd.ibm.rights-management":{source:"iana",extensions:["irm"]},"application/vnd.ibm.secure-container":{source:"iana",extensions:["sc"]},"application/vnd.iccprofile":{source:"iana",extensions:["icc","icm"]},"application/vnd.ieee.1905":{source:"iana"},"application/vnd.igloader":{source:"iana",extensions:["igl"]},"application/vnd.imagemeter.folder+zip":{source:"iana",compressible:!1},"application/vnd.imagemeter.image+zip":{source:"iana",compressible:!1},"application/vnd.immervision-ivp":{source:"iana",extensions:["ivp"]},"application/vnd.immervision-ivu":{source:"iana",extensions:["ivu"]},"application/vnd.ims.imsccv1p1":{source:"iana"},"application/vnd.ims.imsccv1p2":{source:"iana"},"application/vnd.ims.imsccv1p3":{source:"iana"},"application/vnd.ims.lis.v2.result+json":{source:"iana",compressible:!0},"application/vnd.ims.lti.v2.toolconsumerprofile+json":{source:"iana",compressible:!0},"application/vnd.ims.lti.v2.toolproxy+json":{source:"iana",compressible:!0},"application/vnd.ims.lti.v2.toolproxy.id+json":{source:"iana",compressible:!0},"application/vnd.ims.lti.v2.toolsettings+json":{source:"iana",compressible:!0},"application/vnd.ims.lti.v2.toolsettings.simple+json":{source:"iana",compressible:!0},"application/vnd.informedcontrol.rms+xml":{source:"iana",compressible:!0},"application/vnd.informix-visionary":{source:"apache"},"application/vnd.infotech.project":{source:"iana"},"application/vnd.infotech.project+xml":{source:"iana",compressible:!0},"application/vnd.innopath.wamp.notification":{source:"iana"},"application/vnd.insors.igm":{source:"iana",extensions:["igm"]},"application/vnd.intercon.formnet":{source:"iana",extensions:["xpw","xpx"]},"application/vnd.intergeo":{source:"iana",extensions:["i2g"]},"application/vnd.intertrust.digibox":{source:"iana"},"application/vnd.intertrust.nncp":{source:"iana"},"application/vnd.intu.qbo":{source:"iana",extensions:["qbo"]},"application/vnd.intu.qfx":{source:"iana",extensions:["qfx"]},"application/vnd.ipfs.ipns-record":{source:"iana"},"application/vnd.ipld.car":{source:"iana"},"application/vnd.ipld.dag-cbor":{source:"iana"},"application/vnd.ipld.dag-json":{source:"iana"},"application/vnd.ipld.raw":{source:"iana"},"application/vnd.iptc.g2.catalogitem+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.conceptitem+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.knowledgeitem+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.newsitem+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.newsmessage+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.packageitem+xml":{source:"iana",compressible:!0},"application/vnd.iptc.g2.planningitem+xml":{source:"iana",compressible:!0},"application/vnd.ipunplugged.rcprofile":{source:"iana",extensions:["rcprofile"]},"application/vnd.irepository.package+xml":{source:"iana",compressible:!0,extensions:["irp"]},"application/vnd.is-xpr":{source:"iana",extensions:["xpr"]},"application/vnd.isac.fcs":{source:"iana",extensions:["fcs"]},"application/vnd.iso11783-10+zip":{source:"iana",compressible:!1},"application/vnd.jam":{source:"iana",extensions:["jam"]},"application/vnd.japannet-directory-service":{source:"iana"},"application/vnd.japannet-jpnstore-wakeup":{source:"iana"},"application/vnd.japannet-payment-wakeup":{source:"iana"},"application/vnd.japannet-registration":{source:"iana"},"application/vnd.japannet-registration-wakeup":{source:"iana"},"application/vnd.japannet-setstore-wakeup":{source:"iana"},"application/vnd.japannet-verification":{source:"iana"},"application/vnd.japannet-verification-wakeup":{source:"iana"},"application/vnd.jcp.javame.midlet-rms":{source:"iana",extensions:["rms"]},"application/vnd.jisp":{source:"iana",extensions:["jisp"]},"application/vnd.joost.joda-archive":{source:"iana",extensions:["joda"]},"application/vnd.jsk.isdn-ngn":{source:"iana"},"application/vnd.kahootz":{source:"iana",extensions:["ktz","ktr"]},"application/vnd.kde.karbon":{source:"iana",extensions:["karbon"]},"application/vnd.kde.kchart":{source:"iana",extensions:["chrt"]},"application/vnd.kde.kformula":{source:"iana",extensions:["kfo"]},"application/vnd.kde.kivio":{source:"iana",extensions:["flw"]},"application/vnd.kde.kontour":{source:"iana",extensions:["kon"]},"application/vnd.kde.kpresenter":{source:"iana",extensions:["kpr","kpt"]},"application/vnd.kde.kspread":{source:"iana",extensions:["ksp"]},"application/vnd.kde.kword":{source:"iana",extensions:["kwd","kwt"]},"application/vnd.kdl":{source:"iana"},"application/vnd.kenameaapp":{source:"iana",extensions:["htke"]},"application/vnd.keyman.kmp+zip":{source:"iana",compressible:!1},"application/vnd.keyman.kmx":{source:"iana"},"application/vnd.kidspiration":{source:"iana",extensions:["kia"]},"application/vnd.kinar":{source:"iana",extensions:["kne","knp"]},"application/vnd.koan":{source:"iana",extensions:["skp","skd","skt","skm"]},"application/vnd.kodak-descriptor":{source:"iana",extensions:["sse"]},"application/vnd.las":{source:"iana"},"application/vnd.las.las+json":{source:"iana",compressible:!0},"application/vnd.las.las+xml":{source:"iana",compressible:!0,extensions:["lasxml"]},"application/vnd.laszip":{source:"iana"},"application/vnd.ldev.productlicensing":{source:"iana"},"application/vnd.leap+json":{source:"iana",compressible:!0},"application/vnd.liberty-request+xml":{source:"iana",compressible:!0},"application/vnd.llamagraphics.life-balance.desktop":{source:"iana",extensions:["lbd"]},"application/vnd.llamagraphics.life-balance.exchange+xml":{source:"iana",compressible:!0,extensions:["lbe"]},"application/vnd.logipipe.circuit+zip":{source:"iana",compressible:!1},"application/vnd.loom":{source:"iana"},"application/vnd.lotus-1-2-3":{source:"iana",extensions:["123"]},"application/vnd.lotus-approach":{source:"iana",extensions:["apr"]},"application/vnd.lotus-freelance":{source:"iana",extensions:["pre"]},"application/vnd.lotus-notes":{source:"iana",extensions:["nsf"]},"application/vnd.lotus-organizer":{source:"iana",extensions:["org"]},"application/vnd.lotus-screencam":{source:"iana",extensions:["scm"]},"application/vnd.lotus-wordpro":{source:"iana",extensions:["lwp"]},"application/vnd.macports.portpkg":{source:"iana",extensions:["portpkg"]},"application/vnd.mapbox-vector-tile":{source:"iana",extensions:["mvt"]},"application/vnd.marlin.drm.actiontoken+xml":{source:"iana",compressible:!0},"application/vnd.marlin.drm.conftoken+xml":{source:"iana",compressible:!0},"application/vnd.marlin.drm.license+xml":{source:"iana",compressible:!0},"application/vnd.marlin.drm.mdcf":{source:"iana"},"application/vnd.mason+json":{source:"iana",compressible:!0},"application/vnd.maxar.archive.3tz+zip":{source:"iana",compressible:!1},"application/vnd.maxmind.maxmind-db":{source:"iana"},"application/vnd.mcd":{source:"iana",extensions:["mcd"]},"application/vnd.mdl":{source:"iana"},"application/vnd.mdl-mbsdf":{source:"iana"},"application/vnd.medcalcdata":{source:"iana",extensions:["mc1"]},"application/vnd.mediastation.cdkey":{source:"iana",extensions:["cdkey"]},"application/vnd.medicalholodeck.recordxr":{source:"iana"},"application/vnd.meridian-slingshot":{source:"iana"},"application/vnd.mermaid":{source:"iana"},"application/vnd.mfer":{source:"iana",extensions:["mwf"]},"application/vnd.mfmp":{source:"iana",extensions:["mfm"]},"application/vnd.micro+json":{source:"iana",compressible:!0},"application/vnd.micrografx.flo":{source:"iana",extensions:["flo"]},"application/vnd.micrografx.igx":{source:"iana",extensions:["igx"]},"application/vnd.microsoft.portable-executable":{source:"iana"},"application/vnd.microsoft.windows.thumbnail-cache":{source:"iana"},"application/vnd.miele+json":{source:"iana",compressible:!0},"application/vnd.mif":{source:"iana",extensions:["mif"]},"application/vnd.minisoft-hp3000-save":{source:"iana"},"application/vnd.mitsubishi.misty-guard.trustweb":{source:"iana"},"application/vnd.mobius.daf":{source:"iana",extensions:["daf"]},"application/vnd.mobius.dis":{source:"iana",extensions:["dis"]},"application/vnd.mobius.mbk":{source:"iana",extensions:["mbk"]},"application/vnd.mobius.mqy":{source:"iana",extensions:["mqy"]},"application/vnd.mobius.msl":{source:"iana",extensions:["msl"]},"application/vnd.mobius.plc":{source:"iana",extensions:["plc"]},"application/vnd.mobius.txf":{source:"iana",extensions:["txf"]},"application/vnd.modl":{source:"iana"},"application/vnd.mophun.application":{source:"iana",extensions:["mpn"]},"application/vnd.mophun.certificate":{source:"iana",extensions:["mpc"]},"application/vnd.motorola.flexsuite":{source:"iana"},"application/vnd.motorola.flexsuite.adsi":{source:"iana"},"application/vnd.motorola.flexsuite.fis":{source:"iana"},"application/vnd.motorola.flexsuite.gotap":{source:"iana"},"application/vnd.motorola.flexsuite.kmr":{source:"iana"},"application/vnd.motorola.flexsuite.ttc":{source:"iana"},"application/vnd.motorola.flexsuite.wem":{source:"iana"},"application/vnd.motorola.iprm":{source:"iana"},"application/vnd.mozilla.xul+xml":{source:"iana",compressible:!0,extensions:["xul"]},"application/vnd.ms-3mfdocument":{source:"iana"},"application/vnd.ms-artgalry":{source:"iana",extensions:["cil"]},"application/vnd.ms-asf":{source:"iana"},"application/vnd.ms-cab-compressed":{source:"iana",extensions:["cab"]},"application/vnd.ms-color.iccprofile":{source:"apache"},"application/vnd.ms-excel":{source:"iana",compressible:!1,extensions:["xls","xlm","xla","xlc","xlt","xlw"]},"application/vnd.ms-excel.addin.macroenabled.12":{source:"iana",extensions:["xlam"]},"application/vnd.ms-excel.sheet.binary.macroenabled.12":{source:"iana",extensions:["xlsb"]},"application/vnd.ms-excel.sheet.macroenabled.12":{source:"iana",extensions:["xlsm"]},"application/vnd.ms-excel.template.macroenabled.12":{source:"iana",extensions:["xltm"]},"application/vnd.ms-fontobject":{source:"iana",compressible:!0,extensions:["eot"]},"application/vnd.ms-htmlhelp":{source:"iana",extensions:["chm"]},"application/vnd.ms-ims":{source:"iana",extensions:["ims"]},"application/vnd.ms-lrm":{source:"iana",extensions:["lrm"]},"application/vnd.ms-office.activex+xml":{source:"iana",compressible:!0},"application/vnd.ms-officetheme":{source:"iana",extensions:["thmx"]},"application/vnd.ms-opentype":{source:"apache",compressible:!0},"application/vnd.ms-outlook":{compressible:!1,extensions:["msg"]},"application/vnd.ms-package.obfuscated-opentype":{source:"apache"},"application/vnd.ms-pki.seccat":{source:"apache",extensions:["cat"]},"application/vnd.ms-pki.stl":{source:"apache",extensions:["stl"]},"application/vnd.ms-playready.initiator+xml":{source:"iana",compressible:!0},"application/vnd.ms-powerpoint":{source:"iana",compressible:!1,extensions:["ppt","pps","pot"]},"application/vnd.ms-powerpoint.addin.macroenabled.12":{source:"iana",extensions:["ppam"]},"application/vnd.ms-powerpoint.presentation.macroenabled.12":{source:"iana",extensions:["pptm"]},"application/vnd.ms-powerpoint.slide.macroenabled.12":{source:"iana",extensions:["sldm"]},"application/vnd.ms-powerpoint.slideshow.macroenabled.12":{source:"iana",extensions:["ppsm"]},"application/vnd.ms-powerpoint.template.macroenabled.12":{source:"iana",extensions:["potm"]},"application/vnd.ms-printdevicecapabilities+xml":{source:"iana",compressible:!0},"application/vnd.ms-printing.printticket+xml":{source:"apache",compressible:!0},"application/vnd.ms-printschematicket+xml":{source:"iana",compressible:!0},"application/vnd.ms-project":{source:"iana",extensions:["mpp","mpt"]},"application/vnd.ms-tnef":{source:"iana"},"application/vnd.ms-visio.viewer":{extensions:["vdx"]},"application/vnd.ms-windows.devicepairing":{source:"iana"},"application/vnd.ms-windows.nwprinting.oob":{source:"iana"},"application/vnd.ms-windows.printerpairing":{source:"iana"},"application/vnd.ms-windows.wsd.oob":{source:"iana"},"application/vnd.ms-wmdrm.lic-chlg-req":{source:"iana"},"application/vnd.ms-wmdrm.lic-resp":{source:"iana"},"application/vnd.ms-wmdrm.meter-chlg-req":{source:"iana"},"application/vnd.ms-wmdrm.meter-resp":{source:"iana"},"application/vnd.ms-word.document.macroenabled.12":{source:"iana",extensions:["docm"]},"application/vnd.ms-word.template.macroenabled.12":{source:"iana",extensions:["dotm"]},"application/vnd.ms-works":{source:"iana",extensions:["wps","wks","wcm","wdb"]},"application/vnd.ms-wpl":{source:"iana",extensions:["wpl"]},"application/vnd.ms-xpsdocument":{source:"iana",compressible:!1,extensions:["xps"]},"application/vnd.msa-disk-image":{source:"iana"},"application/vnd.mseq":{source:"iana",extensions:["mseq"]},"application/vnd.msgpack":{source:"iana"},"application/vnd.msign":{source:"iana"},"application/vnd.multiad.creator":{source:"iana"},"application/vnd.multiad.creator.cif":{source:"iana"},"application/vnd.music-niff":{source:"iana"},"application/vnd.musician":{source:"iana",extensions:["mus"]},"application/vnd.muvee.style":{source:"iana",extensions:["msty"]},"application/vnd.mynfc":{source:"iana",extensions:["taglet"]},"application/vnd.nacamar.ybrid+json":{source:"iana",compressible:!0},"application/vnd.nato.bindingdataobject+cbor":{source:"iana"},"application/vnd.nato.bindingdataobject+json":{source:"iana",compressible:!0},"application/vnd.nato.bindingdataobject+xml":{source:"iana",compressible:!0,extensions:["bdo"]},"application/vnd.nato.openxmlformats-package.iepd+zip":{source:"iana",compressible:!1},"application/vnd.ncd.control":{source:"iana"},"application/vnd.ncd.reference":{source:"iana"},"application/vnd.nearst.inv+json":{source:"iana",compressible:!0},"application/vnd.nebumind.line":{source:"iana"},"application/vnd.nervana":{source:"iana"},"application/vnd.netfpx":{source:"iana"},"application/vnd.neurolanguage.nlu":{source:"iana",extensions:["nlu"]},"application/vnd.nimn":{source:"iana"},"application/vnd.nintendo.nitro.rom":{source:"iana"},"application/vnd.nintendo.snes.rom":{source:"iana"},"application/vnd.nitf":{source:"iana",extensions:["ntf","nitf"]},"application/vnd.noblenet-directory":{source:"iana",extensions:["nnd"]},"application/vnd.noblenet-sealer":{source:"iana",extensions:["nns"]},"application/vnd.noblenet-web":{source:"iana",extensions:["nnw"]},"application/vnd.nokia.catalogs":{source:"iana"},"application/vnd.nokia.conml+wbxml":{source:"iana"},"application/vnd.nokia.conml+xml":{source:"iana",compressible:!0},"application/vnd.nokia.iptv.config+xml":{source:"iana",compressible:!0},"application/vnd.nokia.isds-radio-presets":{source:"iana"},"application/vnd.nokia.landmark+wbxml":{source:"iana"},"application/vnd.nokia.landmark+xml":{source:"iana",compressible:!0},"application/vnd.nokia.landmarkcollection+xml":{source:"iana",compressible:!0},"application/vnd.nokia.n-gage.ac+xml":{source:"iana",compressible:!0,extensions:["ac"]},"application/vnd.nokia.n-gage.data":{source:"iana",extensions:["ngdat"]},"application/vnd.nokia.n-gage.symbian.install":{source:"apache",extensions:["n-gage"]},"application/vnd.nokia.ncd":{source:"iana"},"application/vnd.nokia.pcd+wbxml":{source:"iana"},"application/vnd.nokia.pcd+xml":{source:"iana",compressible:!0},"application/vnd.nokia.radio-preset":{source:"iana",extensions:["rpst"]},"application/vnd.nokia.radio-presets":{source:"iana",extensions:["rpss"]},"application/vnd.novadigm.edm":{source:"iana",extensions:["edm"]},"application/vnd.novadigm.edx":{source:"iana",extensions:["edx"]},"application/vnd.novadigm.ext":{source:"iana",extensions:["ext"]},"application/vnd.ntt-local.content-share":{source:"iana"},"application/vnd.ntt-local.file-transfer":{source:"iana"},"application/vnd.ntt-local.ogw_remote-access":{source:"iana"},"application/vnd.ntt-local.sip-ta_remote":{source:"iana"},"application/vnd.ntt-local.sip-ta_tcp_stream":{source:"iana"},"application/vnd.oai.workflows":{source:"iana"},"application/vnd.oai.workflows+json":{source:"iana",compressible:!0},"application/vnd.oai.workflows+yaml":{source:"iana"},"application/vnd.oasis.opendocument.base":{source:"iana"},"application/vnd.oasis.opendocument.chart":{source:"iana",extensions:["odc"]},"application/vnd.oasis.opendocument.chart-template":{source:"iana",extensions:["otc"]},"application/vnd.oasis.opendocument.database":{source:"apache",extensions:["odb"]},"application/vnd.oasis.opendocument.formula":{source:"iana",extensions:["odf"]},"application/vnd.oasis.opendocument.formula-template":{source:"iana",extensions:["odft"]},"application/vnd.oasis.opendocument.graphics":{source:"iana",compressible:!1,extensions:["odg"]},"application/vnd.oasis.opendocument.graphics-template":{source:"iana",extensions:["otg"]},"application/vnd.oasis.opendocument.image":{source:"iana",extensions:["odi"]},"application/vnd.oasis.opendocument.image-template":{source:"iana",extensions:["oti"]},"application/vnd.oasis.opendocument.presentation":{source:"iana",compressible:!1,extensions:["odp"]},"application/vnd.oasis.opendocument.presentation-template":{source:"iana",extensions:["otp"]},"application/vnd.oasis.opendocument.spreadsheet":{source:"iana",compressible:!1,extensions:["ods"]},"application/vnd.oasis.opendocument.spreadsheet-template":{source:"iana",extensions:["ots"]},"application/vnd.oasis.opendocument.text":{source:"iana",compressible:!1,extensions:["odt"]},"application/vnd.oasis.opendocument.text-master":{source:"iana",extensions:["odm"]},"application/vnd.oasis.opendocument.text-master-template":{source:"iana"},"application/vnd.oasis.opendocument.text-template":{source:"iana",extensions:["ott"]},"application/vnd.oasis.opendocument.text-web":{source:"iana",extensions:["oth"]},"application/vnd.obn":{source:"iana"},"application/vnd.ocf+cbor":{source:"iana"},"application/vnd.oci.image.manifest.v1+json":{source:"iana",compressible:!0},"application/vnd.oftn.l10n+json":{source:"iana",compressible:!0},"application/vnd.oipf.contentaccessdownload+xml":{source:"iana",compressible:!0},"application/vnd.oipf.contentaccessstreaming+xml":{source:"iana",compressible:!0},"application/vnd.oipf.cspg-hexbinary":{source:"iana"},"application/vnd.oipf.dae.svg+xml":{source:"iana",compressible:!0},"application/vnd.oipf.dae.xhtml+xml":{source:"iana",compressible:!0},"application/vnd.oipf.mippvcontrolmessage+xml":{source:"iana",compressible:!0},"application/vnd.oipf.pae.gem":{source:"iana"},"application/vnd.oipf.spdiscovery+xml":{source:"iana",compressible:!0},"application/vnd.oipf.spdlist+xml":{source:"iana",compressible:!0},"application/vnd.oipf.ueprofile+xml":{source:"iana",compressible:!0},"application/vnd.oipf.userprofile+xml":{source:"iana",compressible:!0},"application/vnd.olpc-sugar":{source:"iana",extensions:["xo"]},"application/vnd.oma-scws-config":{source:"iana"},"application/vnd.oma-scws-http-request":{source:"iana"},"application/vnd.oma-scws-http-response":{source:"iana"},"application/vnd.oma.bcast.associated-procedure-parameter+xml":{source:"iana",compressible:!0},"application/vnd.oma.bcast.drm-trigger+xml":{source:"apache",compressible:!0},"application/vnd.oma.bcast.imd+xml":{source:"iana",compressible:!0},"application/vnd.oma.bcast.ltkm":{source:"iana"},"application/vnd.oma.bcast.notification+xml":{source:"iana",compressible:!0},"application/vnd.oma.bcast.provisioningtrigger":{source:"iana"},"application/vnd.oma.bcast.sgboot":{source:"iana"},"application/vnd.oma.bcast.sgdd+xml":{source:"iana",compressible:!0},"application/vnd.oma.bcast.sgdu":{source:"iana"},"application/vnd.oma.bcast.simple-symbol-container":{source:"iana"},"application/vnd.oma.bcast.smartcard-trigger+xml":{source:"apache",compressible:!0},"application/vnd.oma.bcast.sprov+xml":{source:"iana",compressible:!0},"application/vnd.oma.bcast.stkm":{source:"iana"},"application/vnd.oma.cab-address-book+xml":{source:"iana",compressible:!0},"application/vnd.oma.cab-feature-handler+xml":{source:"iana",compressible:!0},"application/vnd.oma.cab-pcc+xml":{source:"iana",compressible:!0},"application/vnd.oma.cab-subs-invite+xml":{source:"iana",compressible:!0},"application/vnd.oma.cab-user-prefs+xml":{source:"iana",compressible:!0},"application/vnd.oma.dcd":{source:"iana"},"application/vnd.oma.dcdc":{source:"iana"},"application/vnd.oma.dd2+xml":{source:"iana",compressible:!0,extensions:["dd2"]},"application/vnd.oma.drm.risd+xml":{source:"iana",compressible:!0},"application/vnd.oma.group-usage-list+xml":{source:"iana",compressible:!0},"application/vnd.oma.lwm2m+cbor":{source:"iana"},"application/vnd.oma.lwm2m+json":{source:"iana",compressible:!0},"application/vnd.oma.lwm2m+tlv":{source:"iana"},"application/vnd.oma.pal+xml":{source:"iana",compressible:!0},"application/vnd.oma.poc.detailed-progress-report+xml":{source:"iana",compressible:!0},"application/vnd.oma.poc.final-report+xml":{source:"iana",compressible:!0},"application/vnd.oma.poc.groups+xml":{source:"iana",compressible:!0},"application/vnd.oma.poc.invocation-descriptor+xml":{source:"iana",compressible:!0},"application/vnd.oma.poc.optimized-progress-report+xml":{source:"iana",compressible:!0},"application/vnd.oma.push":{source:"iana"},"application/vnd.oma.scidm.messages+xml":{source:"iana",compressible:!0},"application/vnd.oma.xcap-directory+xml":{source:"iana",compressible:!0},"application/vnd.omads-email+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/vnd.omads-file+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/vnd.omads-folder+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/vnd.omaloc-supl-init":{source:"iana"},"application/vnd.onepager":{source:"iana"},"application/vnd.onepagertamp":{source:"iana"},"application/vnd.onepagertamx":{source:"iana"},"application/vnd.onepagertat":{source:"iana"},"application/vnd.onepagertatp":{source:"iana"},"application/vnd.onepagertatx":{source:"iana"},"application/vnd.onvif.metadata":{source:"iana"},"application/vnd.openblox.game+xml":{source:"iana",compressible:!0,extensions:["obgx"]},"application/vnd.openblox.game-binary":{source:"iana"},"application/vnd.openeye.oeb":{source:"iana"},"application/vnd.openofficeorg.extension":{source:"apache",extensions:["oxt"]},"application/vnd.openstreetmap.data+xml":{source:"iana",compressible:!0,extensions:["osm"]},"application/vnd.opentimestamps.ots":{source:"iana"},"application/vnd.openvpi.dspx+json":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.custom-properties+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.customxmlproperties+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawing+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.chart+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.chartshapes+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.diagramcolors+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.diagramdata+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.diagramlayout+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.drawingml.diagramstyle+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.extended-properties+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.commentauthors+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.comments+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.handoutmaster+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.notesmaster+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.notesslide+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.presentation":{source:"iana",compressible:!1,extensions:["pptx"]},"application/vnd.openxmlformats-officedocument.presentationml.presentation.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.presprops+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.slide":{source:"iana",extensions:["sldx"]},"application/vnd.openxmlformats-officedocument.presentationml.slide+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.slidelayout+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.slidemaster+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.slideshow":{source:"iana",extensions:["ppsx"]},"application/vnd.openxmlformats-officedocument.presentationml.slideshow.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.slideupdateinfo+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.tablestyles+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.tags+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.template":{source:"iana",extensions:["potx"]},"application/vnd.openxmlformats-officedocument.presentationml.template.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.presentationml.viewprops+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.calcchain+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.chartsheet+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.comments+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.connections+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.dialogsheet+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.externallink+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotcachedefinition+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.pivotcacherecords+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.pivottable+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.querytable+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.revisionheaders+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.revisionlog+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.sharedstrings+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":{source:"iana",compressible:!1,extensions:["xlsx"]},"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.sheetmetadata+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.table+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.tablesinglecells+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.template":{source:"iana",extensions:["xltx"]},"application/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.usernames+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.volatiledependencies+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.theme+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.themeoverride+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.vmldrawing":{source:"iana"},"application/vnd.openxmlformats-officedocument.wordprocessingml.comments+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.document":{source:"iana",compressible:!1,extensions:["docx"]},"application/vnd.openxmlformats-officedocument.wordprocessingml.document.glossary+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.endnotes+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.fonttable+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.footer+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.footnotes+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.numbering+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.settings+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.styles+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.template":{source:"iana",extensions:["dotx"]},"application/vnd.openxmlformats-officedocument.wordprocessingml.template.main+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-officedocument.wordprocessingml.websettings+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-package.core-properties+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-package.digital-signature-xmlsignature+xml":{source:"iana",compressible:!0},"application/vnd.openxmlformats-package.relationships+xml":{source:"iana",compressible:!0},"application/vnd.oracle.resource+json":{source:"iana",compressible:!0},"application/vnd.orange.indata":{source:"iana"},"application/vnd.osa.netdeploy":{source:"iana"},"application/vnd.osgeo.mapguide.package":{source:"iana",extensions:["mgp"]},"application/vnd.osgi.bundle":{source:"iana"},"application/vnd.osgi.dp":{source:"iana",extensions:["dp"]},"application/vnd.osgi.subsystem":{source:"iana",extensions:["esa"]},"application/vnd.otps.ct-kip+xml":{source:"iana",compressible:!0},"application/vnd.oxli.countgraph":{source:"iana"},"application/vnd.pagerduty+json":{source:"iana",compressible:!0},"application/vnd.palm":{source:"iana",extensions:["pdb","pqa","oprc"]},"application/vnd.panoply":{source:"iana"},"application/vnd.paos.xml":{source:"iana"},"application/vnd.patentdive":{source:"iana"},"application/vnd.patientecommsdoc":{source:"iana"},"application/vnd.pawaafile":{source:"iana",extensions:["paw"]},"application/vnd.pcos":{source:"iana"},"application/vnd.pg.format":{source:"iana",extensions:["str"]},"application/vnd.pg.osasli":{source:"iana",extensions:["ei6"]},"application/vnd.piaccess.application-licence":{source:"iana"},"application/vnd.picsel":{source:"iana",extensions:["efif"]},"application/vnd.pmi.widget":{source:"iana",extensions:["wg"]},"application/vnd.poc.group-advertisement+xml":{source:"iana",compressible:!0},"application/vnd.pocketlearn":{source:"iana",extensions:["plf"]},"application/vnd.powerbuilder6":{source:"iana",extensions:["pbd"]},"application/vnd.powerbuilder6-s":{source:"iana"},"application/vnd.powerbuilder7":{source:"iana"},"application/vnd.powerbuilder7-s":{source:"iana"},"application/vnd.powerbuilder75":{source:"iana"},"application/vnd.powerbuilder75-s":{source:"iana"},"application/vnd.preminet":{source:"iana"},"application/vnd.previewsystems.box":{source:"iana",extensions:["box"]},"application/vnd.procrate.brushset":{extensions:["brushset"]},"application/vnd.procreate.brush":{extensions:["brush"]},"application/vnd.procreate.dream":{extensions:["drm"]},"application/vnd.proteus.magazine":{source:"iana",extensions:["mgz"]},"application/vnd.psfs":{source:"iana"},"application/vnd.pt.mundusmundi":{source:"iana"},"application/vnd.publishare-delta-tree":{source:"iana",extensions:["qps"]},"application/vnd.pvi.ptid1":{source:"iana",extensions:["ptid"]},"application/vnd.pwg-multiplexed":{source:"iana"},"application/vnd.pwg-xhtml-print+xml":{source:"iana",compressible:!0,extensions:["xhtm"]},"application/vnd.qualcomm.brew-app-res":{source:"iana"},"application/vnd.quarantainenet":{source:"iana"},"application/vnd.quark.quarkxpress":{source:"iana",extensions:["qxd","qxt","qwd","qwt","qxl","qxb"]},"application/vnd.quobject-quoxdocument":{source:"iana"},"application/vnd.radisys.moml+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-audit+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-audit-conf+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-audit-conn+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-audit-dialog+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-audit-stream+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-conf+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-base+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-fax-detect+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-fax-sendrecv+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-group+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-speech+xml":{source:"iana",compressible:!0},"application/vnd.radisys.msml-dialog-transform+xml":{source:"iana",compressible:!0},"application/vnd.rainstor.data":{source:"iana"},"application/vnd.rapid":{source:"iana"},"application/vnd.rar":{source:"iana",extensions:["rar"]},"application/vnd.realvnc.bed":{source:"iana",extensions:["bed"]},"application/vnd.recordare.musicxml":{source:"iana",extensions:["mxl"]},"application/vnd.recordare.musicxml+xml":{source:"iana",compressible:!0,extensions:["musicxml"]},"application/vnd.relpipe":{source:"iana"},"application/vnd.renlearn.rlprint":{source:"iana"},"application/vnd.resilient.logic":{source:"iana"},"application/vnd.restful+json":{source:"iana",compressible:!0},"application/vnd.rig.cryptonote":{source:"iana",extensions:["cryptonote"]},"application/vnd.rim.cod":{source:"apache",extensions:["cod"]},"application/vnd.rn-realmedia":{source:"apache",extensions:["rm"]},"application/vnd.rn-realmedia-vbr":{source:"apache",extensions:["rmvb"]},"application/vnd.route66.link66+xml":{source:"iana",compressible:!0,extensions:["link66"]},"application/vnd.rs-274x":{source:"iana"},"application/vnd.ruckus.download":{source:"iana"},"application/vnd.s3sms":{source:"iana"},"application/vnd.sailingtracker.track":{source:"iana",extensions:["st"]},"application/vnd.sar":{source:"iana"},"application/vnd.sbm.cid":{source:"iana"},"application/vnd.sbm.mid2":{source:"iana"},"application/vnd.scribus":{source:"iana"},"application/vnd.sealed.3df":{source:"iana"},"application/vnd.sealed.csf":{source:"iana"},"application/vnd.sealed.doc":{source:"iana"},"application/vnd.sealed.eml":{source:"iana"},"application/vnd.sealed.mht":{source:"iana"},"application/vnd.sealed.net":{source:"iana"},"application/vnd.sealed.ppt":{source:"iana"},"application/vnd.sealed.tiff":{source:"iana"},"application/vnd.sealed.xls":{source:"iana"},"application/vnd.sealedmedia.softseal.html":{source:"iana"},"application/vnd.sealedmedia.softseal.pdf":{source:"iana"},"application/vnd.seemail":{source:"iana",extensions:["see"]},"application/vnd.seis+json":{source:"iana",compressible:!0},"application/vnd.sema":{source:"iana",extensions:["sema"]},"application/vnd.semd":{source:"iana",extensions:["semd"]},"application/vnd.semf":{source:"iana",extensions:["semf"]},"application/vnd.shade-save-file":{source:"iana"},"application/vnd.shana.informed.formdata":{source:"iana",extensions:["ifm"]},"application/vnd.shana.informed.formtemplate":{source:"iana",extensions:["itp"]},"application/vnd.shana.informed.interchange":{source:"iana",extensions:["iif"]},"application/vnd.shana.informed.package":{source:"iana",extensions:["ipk"]},"application/vnd.shootproof+json":{source:"iana",compressible:!0},"application/vnd.shopkick+json":{source:"iana",compressible:!0},"application/vnd.shp":{source:"iana"},"application/vnd.shx":{source:"iana"},"application/vnd.sigrok.session":{source:"iana"},"application/vnd.simtech-mindmapper":{source:"iana",extensions:["twd","twds"]},"application/vnd.siren+json":{source:"iana",compressible:!0},"application/vnd.sketchometry":{source:"iana"},"application/vnd.smaf":{source:"iana",extensions:["mmf"]},"application/vnd.smart.notebook":{source:"iana"},"application/vnd.smart.teacher":{source:"iana",extensions:["teacher"]},"application/vnd.smintio.portals.archive":{source:"iana"},"application/vnd.snesdev-page-table":{source:"iana"},"application/vnd.software602.filler.form+xml":{source:"iana",compressible:!0,extensions:["fo"]},"application/vnd.software602.filler.form-xml-zip":{source:"iana"},"application/vnd.solent.sdkm+xml":{source:"iana",compressible:!0,extensions:["sdkm","sdkd"]},"application/vnd.spotfire.dxp":{source:"iana",extensions:["dxp"]},"application/vnd.spotfire.sfs":{source:"iana",extensions:["sfs"]},"application/vnd.sqlite3":{source:"iana"},"application/vnd.sss-cod":{source:"iana"},"application/vnd.sss-dtf":{source:"iana"},"application/vnd.sss-ntf":{source:"iana"},"application/vnd.stardivision.calc":{source:"apache",extensions:["sdc"]},"application/vnd.stardivision.draw":{source:"apache",extensions:["sda"]},"application/vnd.stardivision.impress":{source:"apache",extensions:["sdd"]},"application/vnd.stardivision.math":{source:"apache",extensions:["smf"]},"application/vnd.stardivision.writer":{source:"apache",extensions:["sdw","vor"]},"application/vnd.stardivision.writer-global":{source:"apache",extensions:["sgl"]},"application/vnd.stepmania.package":{source:"iana",extensions:["smzip"]},"application/vnd.stepmania.stepchart":{source:"iana",extensions:["sm"]},"application/vnd.street-stream":{source:"iana"},"application/vnd.sun.wadl+xml":{source:"iana",compressible:!0,extensions:["wadl"]},"application/vnd.sun.xml.calc":{source:"apache",extensions:["sxc"]},"application/vnd.sun.xml.calc.template":{source:"apache",extensions:["stc"]},"application/vnd.sun.xml.draw":{source:"apache",extensions:["sxd"]},"application/vnd.sun.xml.draw.template":{source:"apache",extensions:["std"]},"application/vnd.sun.xml.impress":{source:"apache",extensions:["sxi"]},"application/vnd.sun.xml.impress.template":{source:"apache",extensions:["sti"]},"application/vnd.sun.xml.math":{source:"apache",extensions:["sxm"]},"application/vnd.sun.xml.writer":{source:"apache",extensions:["sxw"]},"application/vnd.sun.xml.writer.global":{source:"apache",extensions:["sxg"]},"application/vnd.sun.xml.writer.template":{source:"apache",extensions:["stw"]},"application/vnd.sus-calendar":{source:"iana",extensions:["sus","susp"]},"application/vnd.svd":{source:"iana",extensions:["svd"]},"application/vnd.swiftview-ics":{source:"iana"},"application/vnd.sybyl.mol2":{source:"iana"},"application/vnd.sycle+xml":{source:"iana",compressible:!0},"application/vnd.syft+json":{source:"iana",compressible:!0},"application/vnd.symbian.install":{source:"apache",extensions:["sis","sisx"]},"application/vnd.syncml+xml":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["xsm"]},"application/vnd.syncml.dm+wbxml":{source:"iana",charset:"UTF-8",extensions:["bdm"]},"application/vnd.syncml.dm+xml":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["xdm"]},"application/vnd.syncml.dm.notification":{source:"iana"},"application/vnd.syncml.dmddf+wbxml":{source:"iana"},"application/vnd.syncml.dmddf+xml":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["ddf"]},"application/vnd.syncml.dmtnds+wbxml":{source:"iana"},"application/vnd.syncml.dmtnds+xml":{source:"iana",charset:"UTF-8",compressible:!0},"application/vnd.syncml.ds.notification":{source:"iana"},"application/vnd.tableschema+json":{source:"iana",compressible:!0},"application/vnd.tao.intent-module-archive":{source:"iana",extensions:["tao"]},"application/vnd.tcpdump.pcap":{source:"iana",extensions:["pcap","cap","dmp"]},"application/vnd.think-cell.ppttc+json":{source:"iana",compressible:!0},"application/vnd.tmd.mediaflex.api+xml":{source:"iana",compressible:!0},"application/vnd.tml":{source:"iana"},"application/vnd.tmobile-livetv":{source:"iana",extensions:["tmo"]},"application/vnd.tri.onesource":{source:"iana"},"application/vnd.trid.tpt":{source:"iana",extensions:["tpt"]},"application/vnd.triscape.mxs":{source:"iana",extensions:["mxs"]},"application/vnd.trueapp":{source:"iana",extensions:["tra"]},"application/vnd.truedoc":{source:"iana"},"application/vnd.ubisoft.webplayer":{source:"iana"},"application/vnd.ufdl":{source:"iana",extensions:["ufd","ufdl"]},"application/vnd.uic.osdm+json":{source:"iana",compressible:!0},"application/vnd.uiq.theme":{source:"iana",extensions:["utz"]},"application/vnd.umajin":{source:"iana",extensions:["umj"]},"application/vnd.unity":{source:"iana",extensions:["unityweb"]},"application/vnd.uoml+xml":{source:"iana",compressible:!0,extensions:["uoml","uo"]},"application/vnd.uplanet.alert":{source:"iana"},"application/vnd.uplanet.alert-wbxml":{source:"iana"},"application/vnd.uplanet.bearer-choice":{source:"iana"},"application/vnd.uplanet.bearer-choice-wbxml":{source:"iana"},"application/vnd.uplanet.cacheop":{source:"iana"},"application/vnd.uplanet.cacheop-wbxml":{source:"iana"},"application/vnd.uplanet.channel":{source:"iana"},"application/vnd.uplanet.channel-wbxml":{source:"iana"},"application/vnd.uplanet.list":{source:"iana"},"application/vnd.uplanet.list-wbxml":{source:"iana"},"application/vnd.uplanet.listcmd":{source:"iana"},"application/vnd.uplanet.listcmd-wbxml":{source:"iana"},"application/vnd.uplanet.signal":{source:"iana"},"application/vnd.uri-map":{source:"iana"},"application/vnd.valve.source.material":{source:"iana"},"application/vnd.vcx":{source:"iana",extensions:["vcx"]},"application/vnd.vd-study":{source:"iana"},"application/vnd.vectorworks":{source:"iana"},"application/vnd.vel+json":{source:"iana",compressible:!0},"application/vnd.veraison.tsm-report+cbor":{source:"iana"},"application/vnd.veraison.tsm-report+json":{source:"iana",compressible:!0},"application/vnd.verimatrix.vcas":{source:"iana"},"application/vnd.veritone.aion+json":{source:"iana",compressible:!0},"application/vnd.veryant.thin":{source:"iana"},"application/vnd.ves.encrypted":{source:"iana"},"application/vnd.vidsoft.vidconference":{source:"iana"},"application/vnd.visio":{source:"iana",extensions:["vsd","vst","vss","vsw","vsdx","vtx"]},"application/vnd.visionary":{source:"iana",extensions:["vis"]},"application/vnd.vividence.scriptfile":{source:"iana"},"application/vnd.vocalshaper.vsp4":{source:"iana"},"application/vnd.vsf":{source:"iana",extensions:["vsf"]},"application/vnd.wap.sic":{source:"iana"},"application/vnd.wap.slc":{source:"iana"},"application/vnd.wap.wbxml":{source:"iana",charset:"UTF-8",extensions:["wbxml"]},"application/vnd.wap.wmlc":{source:"iana",extensions:["wmlc"]},"application/vnd.wap.wmlscriptc":{source:"iana",extensions:["wmlsc"]},"application/vnd.wasmflow.wafl":{source:"iana"},"application/vnd.webturbo":{source:"iana",extensions:["wtb"]},"application/vnd.wfa.dpp":{source:"iana"},"application/vnd.wfa.p2p":{source:"iana"},"application/vnd.wfa.wsc":{source:"iana"},"application/vnd.windows.devicepairing":{source:"iana"},"application/vnd.wmc":{source:"iana"},"application/vnd.wmf.bootstrap":{source:"iana"},"application/vnd.wolfram.mathematica":{source:"iana"},"application/vnd.wolfram.mathematica.package":{source:"iana"},"application/vnd.wolfram.player":{source:"iana",extensions:["nbp"]},"application/vnd.wordlift":{source:"iana"},"application/vnd.wordperfect":{source:"iana",extensions:["wpd"]},"application/vnd.wqd":{source:"iana",extensions:["wqd"]},"application/vnd.wrq-hp3000-labelled":{source:"iana"},"application/vnd.wt.stf":{source:"iana",extensions:["stf"]},"application/vnd.wv.csp+wbxml":{source:"iana"},"application/vnd.wv.csp+xml":{source:"iana",compressible:!0},"application/vnd.wv.ssp+xml":{source:"iana",compressible:!0},"application/vnd.xacml+json":{source:"iana",compressible:!0},"application/vnd.xara":{source:"iana",extensions:["xar"]},"application/vnd.xarin.cpj":{source:"iana"},"application/vnd.xecrets-encrypted":{source:"iana"},"application/vnd.xfdl":{source:"iana",extensions:["xfdl"]},"application/vnd.xfdl.webform":{source:"iana"},"application/vnd.xmi+xml":{source:"iana",compressible:!0},"application/vnd.xmpie.cpkg":{source:"iana"},"application/vnd.xmpie.dpkg":{source:"iana"},"application/vnd.xmpie.plan":{source:"iana"},"application/vnd.xmpie.ppkg":{source:"iana"},"application/vnd.xmpie.xlim":{source:"iana"},"application/vnd.yamaha.hv-dic":{source:"iana",extensions:["hvd"]},"application/vnd.yamaha.hv-script":{source:"iana",extensions:["hvs"]},"application/vnd.yamaha.hv-voice":{source:"iana",extensions:["hvp"]},"application/vnd.yamaha.openscoreformat":{source:"iana",extensions:["osf"]},"application/vnd.yamaha.openscoreformat.osfpvg+xml":{source:"iana",compressible:!0,extensions:["osfpvg"]},"application/vnd.yamaha.remote-setup":{source:"iana"},"application/vnd.yamaha.smaf-audio":{source:"iana",extensions:["saf"]},"application/vnd.yamaha.smaf-phrase":{source:"iana",extensions:["spf"]},"application/vnd.yamaha.through-ngn":{source:"iana"},"application/vnd.yamaha.tunnel-udpencap":{source:"iana"},"application/vnd.yaoweme":{source:"iana"},"application/vnd.yellowriver-custom-menu":{source:"iana",extensions:["cmp"]},"application/vnd.zul":{source:"iana",extensions:["zir","zirz"]},"application/vnd.zzazz.deck+xml":{source:"iana",compressible:!0,extensions:["zaz"]},"application/voicexml+xml":{source:"iana",compressible:!0,extensions:["vxml"]},"application/voucher-cms+json":{source:"iana",compressible:!0},"application/voucher-jws+json":{source:"iana",compressible:!0},"application/vp":{source:"iana"},"application/vp+cose":{source:"iana"},"application/vp+jwt":{source:"iana"},"application/vq-rtcpxr":{source:"iana"},"application/wasm":{source:"iana",compressible:!0,extensions:["wasm"]},"application/watcherinfo+xml":{source:"iana",compressible:!0,extensions:["wif"]},"application/webpush-options+json":{source:"iana",compressible:!0},"application/whoispp-query":{source:"iana"},"application/whoispp-response":{source:"iana"},"application/widget":{source:"iana",extensions:["wgt"]},"application/winhlp":{source:"apache",extensions:["hlp"]},"application/wita":{source:"iana"},"application/wordperfect5.1":{source:"iana"},"application/wsdl+xml":{source:"iana",compressible:!0,extensions:["wsdl"]},"application/wspolicy+xml":{source:"iana",compressible:!0,extensions:["wspolicy"]},"application/x-7z-compressed":{source:"apache",compressible:!1,extensions:["7z"]},"application/x-abiword":{source:"apache",extensions:["abw"]},"application/x-ace-compressed":{source:"apache",extensions:["ace"]},"application/x-amf":{source:"apache"},"application/x-apple-diskimage":{source:"apache",extensions:["dmg"]},"application/x-arj":{compressible:!1,extensions:["arj"]},"application/x-authorware-bin":{source:"apache",extensions:["aab","x32","u32","vox"]},"application/x-authorware-map":{source:"apache",extensions:["aam"]},"application/x-authorware-seg":{source:"apache",extensions:["aas"]},"application/x-bcpio":{source:"apache",extensions:["bcpio"]},"application/x-bdoc":{compressible:!1,extensions:["bdoc"]},"application/x-bittorrent":{source:"apache",extensions:["torrent"]},"application/x-blender":{extensions:["blend"]},"application/x-blorb":{source:"apache",extensions:["blb","blorb"]},"application/x-bzip":{source:"apache",compressible:!1,extensions:["bz"]},"application/x-bzip2":{source:"apache",compressible:!1,extensions:["bz2","boz"]},"application/x-cbr":{source:"apache",extensions:["cbr","cba","cbt","cbz","cb7"]},"application/x-cdlink":{source:"apache",extensions:["vcd"]},"application/x-cfs-compressed":{source:"apache",extensions:["cfs"]},"application/x-chat":{source:"apache",extensions:["chat"]},"application/x-chess-pgn":{source:"apache",extensions:["pgn"]},"application/x-chrome-extension":{extensions:["crx"]},"application/x-cocoa":{source:"nginx",extensions:["cco"]},"application/x-compress":{source:"apache"},"application/x-compressed":{extensions:["rar"]},"application/x-conference":{source:"apache",extensions:["nsc"]},"application/x-cpio":{source:"apache",extensions:["cpio"]},"application/x-csh":{source:"apache",extensions:["csh"]},"application/x-deb":{compressible:!1},"application/x-debian-package":{source:"apache",extensions:["deb","udeb"]},"application/x-dgc-compressed":{source:"apache",extensions:["dgc"]},"application/x-director":{source:"apache",extensions:["dir","dcr","dxr","cst","cct","cxt","w3d","fgd","swa"]},"application/x-doom":{source:"apache",extensions:["wad"]},"application/x-dtbncx+xml":{source:"apache",compressible:!0,extensions:["ncx"]},"application/x-dtbook+xml":{source:"apache",compressible:!0,extensions:["dtb"]},"application/x-dtbresource+xml":{source:"apache",compressible:!0,extensions:["res"]},"application/x-dvi":{source:"apache",compressible:!1,extensions:["dvi"]},"application/x-envoy":{source:"apache",extensions:["evy"]},"application/x-eva":{source:"apache",extensions:["eva"]},"application/x-font-bdf":{source:"apache",extensions:["bdf"]},"application/x-font-dos":{source:"apache"},"application/x-font-framemaker":{source:"apache"},"application/x-font-ghostscript":{source:"apache",extensions:["gsf"]},"application/x-font-libgrx":{source:"apache"},"application/x-font-linux-psf":{source:"apache",extensions:["psf"]},"application/x-font-pcf":{source:"apache",extensions:["pcf"]},"application/x-font-snf":{source:"apache",extensions:["snf"]},"application/x-font-speedo":{source:"apache"},"application/x-font-sunos-news":{source:"apache"},"application/x-font-type1":{source:"apache",extensions:["pfa","pfb","pfm","afm"]},"application/x-font-vfont":{source:"apache"},"application/x-freearc":{source:"apache",extensions:["arc"]},"application/x-futuresplash":{source:"apache",extensions:["spl"]},"application/x-gca-compressed":{source:"apache",extensions:["gca"]},"application/x-glulx":{source:"apache",extensions:["ulx"]},"application/x-gnumeric":{source:"apache",extensions:["gnumeric"]},"application/x-gramps-xml":{source:"apache",extensions:["gramps"]},"application/x-gtar":{source:"apache",extensions:["gtar"]},"application/x-gzip":{source:"apache"},"application/x-hdf":{source:"apache",extensions:["hdf"]},"application/x-httpd-php":{compressible:!0,extensions:["php"]},"application/x-install-instructions":{source:"apache",extensions:["install"]},"application/x-ipynb+json":{compressible:!0,extensions:["ipynb"]},"application/x-iso9660-image":{source:"apache",extensions:["iso"]},"application/x-iwork-keynote-sffkey":{extensions:["key"]},"application/x-iwork-numbers-sffnumbers":{extensions:["numbers"]},"application/x-iwork-pages-sffpages":{extensions:["pages"]},"application/x-java-archive-diff":{source:"nginx",extensions:["jardiff"]},"application/x-java-jnlp-file":{source:"apache",compressible:!1,extensions:["jnlp"]},"application/x-javascript":{compressible:!0},"application/x-keepass2":{extensions:["kdbx"]},"application/x-latex":{source:"apache",compressible:!1,extensions:["latex"]},"application/x-lua-bytecode":{extensions:["luac"]},"application/x-lzh-compressed":{source:"apache",extensions:["lzh","lha"]},"application/x-makeself":{source:"nginx",extensions:["run"]},"application/x-mie":{source:"apache",extensions:["mie"]},"application/x-mobipocket-ebook":{source:"apache",extensions:["prc","mobi"]},"application/x-mpegurl":{compressible:!1},"application/x-ms-application":{source:"apache",extensions:["application"]},"application/x-ms-shortcut":{source:"apache",extensions:["lnk"]},"application/x-ms-wmd":{source:"apache",extensions:["wmd"]},"application/x-ms-wmz":{source:"apache",extensions:["wmz"]},"application/x-ms-xbap":{source:"apache",extensions:["xbap"]},"application/x-msaccess":{source:"apache",extensions:["mdb"]},"application/x-msbinder":{source:"apache",extensions:["obd"]},"application/x-mscardfile":{source:"apache",extensions:["crd"]},"application/x-msclip":{source:"apache",extensions:["clp"]},"application/x-msdos-program":{extensions:["exe"]},"application/x-msdownload":{source:"apache",extensions:["exe","dll","com","bat","msi"]},"application/x-msmediaview":{source:"apache",extensions:["mvb","m13","m14"]},"application/x-msmetafile":{source:"apache",extensions:["wmf","wmz","emf","emz"]},"application/x-msmoney":{source:"apache",extensions:["mny"]},"application/x-mspublisher":{source:"apache",extensions:["pub"]},"application/x-msschedule":{source:"apache",extensions:["scd"]},"application/x-msterminal":{source:"apache",extensions:["trm"]},"application/x-mswrite":{source:"apache",extensions:["wri"]},"application/x-netcdf":{source:"apache",extensions:["nc","cdf"]},"application/x-ns-proxy-autoconfig":{compressible:!0,extensions:["pac"]},"application/x-nzb":{source:"apache",extensions:["nzb"]},"application/x-perl":{source:"nginx",extensions:["pl","pm"]},"application/x-pilot":{source:"nginx",extensions:["prc","pdb"]},"application/x-pkcs12":{source:"apache",compressible:!1,extensions:["p12","pfx"]},"application/x-pkcs7-certificates":{source:"apache",extensions:["p7b","spc"]},"application/x-pkcs7-certreqresp":{source:"apache",extensions:["p7r"]},"application/x-pki-message":{source:"iana"},"application/x-rar-compressed":{source:"apache",compressible:!1,extensions:["rar"]},"application/x-redhat-package-manager":{source:"nginx",extensions:["rpm"]},"application/x-research-info-systems":{source:"apache",extensions:["ris"]},"application/x-sea":{source:"nginx",extensions:["sea"]},"application/x-sh":{source:"apache",compressible:!0,extensions:["sh"]},"application/x-shar":{source:"apache",extensions:["shar"]},"application/x-shockwave-flash":{source:"apache",compressible:!1,extensions:["swf"]},"application/x-silverlight-app":{source:"apache",extensions:["xap"]},"application/x-sql":{source:"apache",extensions:["sql"]},"application/x-stuffit":{source:"apache",compressible:!1,extensions:["sit"]},"application/x-stuffitx":{source:"apache",extensions:["sitx"]},"application/x-subrip":{source:"apache",extensions:["srt"]},"application/x-sv4cpio":{source:"apache",extensions:["sv4cpio"]},"application/x-sv4crc":{source:"apache",extensions:["sv4crc"]},"application/x-t3vm-image":{source:"apache",extensions:["t3"]},"application/x-tads":{source:"apache",extensions:["gam"]},"application/x-tar":{source:"apache",compressible:!0,extensions:["tar"]},"application/x-tcl":{source:"apache",extensions:["tcl","tk"]},"application/x-tex":{source:"apache",extensions:["tex"]},"application/x-tex-tfm":{source:"apache",extensions:["tfm"]},"application/x-texinfo":{source:"apache",extensions:["texinfo","texi"]},"application/x-tgif":{source:"apache",extensions:["obj"]},"application/x-ustar":{source:"apache",extensions:["ustar"]},"application/x-virtualbox-hdd":{compressible:!0,extensions:["hdd"]},"application/x-virtualbox-ova":{compressible:!0,extensions:["ova"]},"application/x-virtualbox-ovf":{compressible:!0,extensions:["ovf"]},"application/x-virtualbox-vbox":{compressible:!0,extensions:["vbox"]},"application/x-virtualbox-vbox-extpack":{compressible:!1,extensions:["vbox-extpack"]},"application/x-virtualbox-vdi":{compressible:!0,extensions:["vdi"]},"application/x-virtualbox-vhd":{compressible:!0,extensions:["vhd"]},"application/x-virtualbox-vmdk":{compressible:!0,extensions:["vmdk"]},"application/x-wais-source":{source:"apache",extensions:["src"]},"application/x-web-app-manifest+json":{compressible:!0,extensions:["webapp"]},"application/x-www-form-urlencoded":{source:"iana",compressible:!0},"application/x-x509-ca-cert":{source:"iana",extensions:["der","crt","pem"]},"application/x-x509-ca-ra-cert":{source:"iana"},"application/x-x509-next-ca-cert":{source:"iana"},"application/x-xfig":{source:"apache",extensions:["fig"]},"application/x-xliff+xml":{source:"apache",compressible:!0,extensions:["xlf"]},"application/x-xpinstall":{source:"apache",compressible:!1,extensions:["xpi"]},"application/x-xz":{source:"apache",extensions:["xz"]},"application/x-zip-compressed":{extensions:["zip"]},"application/x-zmachine":{source:"apache",extensions:["z1","z2","z3","z4","z5","z6","z7","z8"]},"application/x400-bp":{source:"iana"},"application/xacml+xml":{source:"iana",compressible:!0},"application/xaml+xml":{source:"apache",compressible:!0,extensions:["xaml"]},"application/xcap-att+xml":{source:"iana",compressible:!0,extensions:["xav"]},"application/xcap-caps+xml":{source:"iana",compressible:!0,extensions:["xca"]},"application/xcap-diff+xml":{source:"iana",compressible:!0,extensions:["xdf"]},"application/xcap-el+xml":{source:"iana",compressible:!0,extensions:["xel"]},"application/xcap-error+xml":{source:"iana",compressible:!0},"application/xcap-ns+xml":{source:"iana",compressible:!0,extensions:["xns"]},"application/xcon-conference-info+xml":{source:"iana",compressible:!0},"application/xcon-conference-info-diff+xml":{source:"iana",compressible:!0},"application/xenc+xml":{source:"iana",compressible:!0,extensions:["xenc"]},"application/xfdf":{source:"iana",extensions:["xfdf"]},"application/xhtml+xml":{source:"iana",compressible:!0,extensions:["xhtml","xht"]},"application/xhtml-voice+xml":{source:"apache",compressible:!0},"application/xliff+xml":{source:"iana",compressible:!0,extensions:["xlf"]},"application/xml":{source:"iana",compressible:!0,extensions:["xml","xsl","xsd","rng"]},"application/xml-dtd":{source:"iana",compressible:!0,extensions:["dtd"]},"application/xml-external-parsed-entity":{source:"iana"},"application/xml-patch+xml":{source:"iana",compressible:!0},"application/xmpp+xml":{source:"iana",compressible:!0},"application/xop+xml":{source:"iana",compressible:!0,extensions:["xop"]},"application/xproc+xml":{source:"apache",compressible:!0,extensions:["xpl"]},"application/xslt+xml":{source:"iana",compressible:!0,extensions:["xsl","xslt"]},"application/xspf+xml":{source:"apache",compressible:!0,extensions:["xspf"]},"application/xv+xml":{source:"iana",compressible:!0,extensions:["mxml","xhvml","xvml","xvm"]},"application/yaml":{source:"iana"},"application/yang":{source:"iana",extensions:["yang"]},"application/yang-data+cbor":{source:"iana"},"application/yang-data+json":{source:"iana",compressible:!0},"application/yang-data+xml":{source:"iana",compressible:!0},"application/yang-patch+json":{source:"iana",compressible:!0},"application/yang-patch+xml":{source:"iana",compressible:!0},"application/yang-sid+json":{source:"iana",compressible:!0},"application/yin+xml":{source:"iana",compressible:!0,extensions:["yin"]},"application/zip":{source:"iana",compressible:!1,extensions:["zip"]},"application/zip+dotlottie":{extensions:["lottie"]},"application/zlib":{source:"iana"},"application/zstd":{source:"iana"},"audio/1d-interleaved-parityfec":{source:"iana"},"audio/32kadpcm":{source:"iana"},"audio/3gpp":{source:"iana",compressible:!1,extensions:["3gpp"]},"audio/3gpp2":{source:"iana"},"audio/aac":{source:"iana",extensions:["adts","aac"]},"audio/ac3":{source:"iana"},"audio/adpcm":{source:"apache",extensions:["adp"]},"audio/amr":{source:"iana",extensions:["amr"]},"audio/amr-wb":{source:"iana"},"audio/amr-wb+":{source:"iana"},"audio/aptx":{source:"iana"},"audio/asc":{source:"iana"},"audio/atrac-advanced-lossless":{source:"iana"},"audio/atrac-x":{source:"iana"},"audio/atrac3":{source:"iana"},"audio/basic":{source:"iana",compressible:!1,extensions:["au","snd"]},"audio/bv16":{source:"iana"},"audio/bv32":{source:"iana"},"audio/clearmode":{source:"iana"},"audio/cn":{source:"iana"},"audio/dat12":{source:"iana"},"audio/dls":{source:"iana"},"audio/dsr-es201108":{source:"iana"},"audio/dsr-es202050":{source:"iana"},"audio/dsr-es202211":{source:"iana"},"audio/dsr-es202212":{source:"iana"},"audio/dv":{source:"iana"},"audio/dvi4":{source:"iana"},"audio/eac3":{source:"iana"},"audio/encaprtp":{source:"iana"},"audio/evrc":{source:"iana"},"audio/evrc-qcp":{source:"iana"},"audio/evrc0":{source:"iana"},"audio/evrc1":{source:"iana"},"audio/evrcb":{source:"iana"},"audio/evrcb0":{source:"iana"},"audio/evrcb1":{source:"iana"},"audio/evrcnw":{source:"iana"},"audio/evrcnw0":{source:"iana"},"audio/evrcnw1":{source:"iana"},"audio/evrcwb":{source:"iana"},"audio/evrcwb0":{source:"iana"},"audio/evrcwb1":{source:"iana"},"audio/evs":{source:"iana"},"audio/flac":{source:"iana"},"audio/flexfec":{source:"iana"},"audio/fwdred":{source:"iana"},"audio/g711-0":{source:"iana"},"audio/g719":{source:"iana"},"audio/g722":{source:"iana"},"audio/g7221":{source:"iana"},"audio/g723":{source:"iana"},"audio/g726-16":{source:"iana"},"audio/g726-24":{source:"iana"},"audio/g726-32":{source:"iana"},"audio/g726-40":{source:"iana"},"audio/g728":{source:"iana"},"audio/g729":{source:"iana"},"audio/g7291":{source:"iana"},"audio/g729d":{source:"iana"},"audio/g729e":{source:"iana"},"audio/gsm":{source:"iana"},"audio/gsm-efr":{source:"iana"},"audio/gsm-hr-08":{source:"iana"},"audio/ilbc":{source:"iana"},"audio/ip-mr_v2.5":{source:"iana"},"audio/isac":{source:"apache"},"audio/l16":{source:"iana"},"audio/l20":{source:"iana"},"audio/l24":{source:"iana",compressible:!1},"audio/l8":{source:"iana"},"audio/lpc":{source:"iana"},"audio/matroska":{source:"iana"},"audio/melp":{source:"iana"},"audio/melp1200":{source:"iana"},"audio/melp2400":{source:"iana"},"audio/melp600":{source:"iana"},"audio/mhas":{source:"iana"},"audio/midi":{source:"apache",extensions:["mid","midi","kar","rmi"]},"audio/midi-clip":{source:"iana"},"audio/mobile-xmf":{source:"iana",extensions:["mxmf"]},"audio/mp3":{compressible:!1,extensions:["mp3"]},"audio/mp4":{source:"iana",compressible:!1,extensions:["m4a","mp4a","m4b"]},"audio/mp4a-latm":{source:"iana"},"audio/mpa":{source:"iana"},"audio/mpa-robust":{source:"iana"},"audio/mpeg":{source:"iana",compressible:!1,extensions:["mpga","mp2","mp2a","mp3","m2a","m3a"]},"audio/mpeg4-generic":{source:"iana"},"audio/musepack":{source:"apache"},"audio/ogg":{source:"iana",compressible:!1,extensions:["oga","ogg","spx","opus"]},"audio/opus":{source:"iana"},"audio/parityfec":{source:"iana"},"audio/pcma":{source:"iana"},"audio/pcma-wb":{source:"iana"},"audio/pcmu":{source:"iana"},"audio/pcmu-wb":{source:"iana"},"audio/prs.sid":{source:"iana"},"audio/qcelp":{source:"iana"},"audio/raptorfec":{source:"iana"},"audio/red":{source:"iana"},"audio/rtp-enc-aescm128":{source:"iana"},"audio/rtp-midi":{source:"iana"},"audio/rtploopback":{source:"iana"},"audio/rtx":{source:"iana"},"audio/s3m":{source:"apache",extensions:["s3m"]},"audio/scip":{source:"iana"},"audio/silk":{source:"apache",extensions:["sil"]},"audio/smv":{source:"iana"},"audio/smv-qcp":{source:"iana"},"audio/smv0":{source:"iana"},"audio/sofa":{source:"iana"},"audio/sp-midi":{source:"iana"},"audio/speex":{source:"iana"},"audio/t140c":{source:"iana"},"audio/t38":{source:"iana"},"audio/telephone-event":{source:"iana"},"audio/tetra_acelp":{source:"iana"},"audio/tetra_acelp_bb":{source:"iana"},"audio/tone":{source:"iana"},"audio/tsvcis":{source:"iana"},"audio/uemclip":{source:"iana"},"audio/ulpfec":{source:"iana"},"audio/usac":{source:"iana"},"audio/vdvi":{source:"iana"},"audio/vmr-wb":{source:"iana"},"audio/vnd.3gpp.iufp":{source:"iana"},"audio/vnd.4sb":{source:"iana"},"audio/vnd.audiokoz":{source:"iana"},"audio/vnd.celp":{source:"iana"},"audio/vnd.cisco.nse":{source:"iana"},"audio/vnd.cmles.radio-events":{source:"iana"},"audio/vnd.cns.anp1":{source:"iana"},"audio/vnd.cns.inf1":{source:"iana"},"audio/vnd.dece.audio":{source:"iana",extensions:["uva","uvva"]},"audio/vnd.digital-winds":{source:"iana",extensions:["eol"]},"audio/vnd.dlna.adts":{source:"iana"},"audio/vnd.dolby.heaac.1":{source:"iana"},"audio/vnd.dolby.heaac.2":{source:"iana"},"audio/vnd.dolby.mlp":{source:"iana"},"audio/vnd.dolby.mps":{source:"iana"},"audio/vnd.dolby.pl2":{source:"iana"},"audio/vnd.dolby.pl2x":{source:"iana"},"audio/vnd.dolby.pl2z":{source:"iana"},"audio/vnd.dolby.pulse.1":{source:"iana"},"audio/vnd.dra":{source:"iana",extensions:["dra"]},"audio/vnd.dts":{source:"iana",extensions:["dts"]},"audio/vnd.dts.hd":{source:"iana",extensions:["dtshd"]},"audio/vnd.dts.uhd":{source:"iana"},"audio/vnd.dvb.file":{source:"iana"},"audio/vnd.everad.plj":{source:"iana"},"audio/vnd.hns.audio":{source:"iana"},"audio/vnd.lucent.voice":{source:"iana",extensions:["lvp"]},"audio/vnd.ms-playready.media.pya":{source:"iana",extensions:["pya"]},"audio/vnd.nokia.mobile-xmf":{source:"iana"},"audio/vnd.nortel.vbk":{source:"iana"},"audio/vnd.nuera.ecelp4800":{source:"iana",extensions:["ecelp4800"]},"audio/vnd.nuera.ecelp7470":{source:"iana",extensions:["ecelp7470"]},"audio/vnd.nuera.ecelp9600":{source:"iana",extensions:["ecelp9600"]},"audio/vnd.octel.sbc":{source:"iana"},"audio/vnd.presonus.multitrack":{source:"iana"},"audio/vnd.qcelp":{source:"apache"},"audio/vnd.rhetorex.32kadpcm":{source:"iana"},"audio/vnd.rip":{source:"iana",extensions:["rip"]},"audio/vnd.rn-realaudio":{compressible:!1},"audio/vnd.sealedmedia.softseal.mpeg":{source:"iana"},"audio/vnd.vmx.cvsd":{source:"iana"},"audio/vnd.wave":{compressible:!1},"audio/vorbis":{source:"iana",compressible:!1},"audio/vorbis-config":{source:"iana"},"audio/wav":{compressible:!1,extensions:["wav"]},"audio/wave":{compressible:!1,extensions:["wav"]},"audio/webm":{source:"apache",compressible:!1,extensions:["weba"]},"audio/x-aac":{source:"apache",compressible:!1,extensions:["aac"]},"audio/x-aiff":{source:"apache",extensions:["aif","aiff","aifc"]},"audio/x-caf":{source:"apache",compressible:!1,extensions:["caf"]},"audio/x-flac":{source:"apache",extensions:["flac"]},"audio/x-m4a":{source:"nginx",extensions:["m4a"]},"audio/x-matroska":{source:"apache",extensions:["mka"]},"audio/x-mpegurl":{source:"apache",extensions:["m3u"]},"audio/x-ms-wax":{source:"apache",extensions:["wax"]},"audio/x-ms-wma":{source:"apache",extensions:["wma"]},"audio/x-pn-realaudio":{source:"apache",extensions:["ram","ra"]},"audio/x-pn-realaudio-plugin":{source:"apache",extensions:["rmp"]},"audio/x-realaudio":{source:"nginx",extensions:["ra"]},"audio/x-tta":{source:"apache"},"audio/x-wav":{source:"apache",extensions:["wav"]},"audio/xm":{source:"apache",extensions:["xm"]},"chemical/x-cdx":{source:"apache",extensions:["cdx"]},"chemical/x-cif":{source:"apache",extensions:["cif"]},"chemical/x-cmdf":{source:"apache",extensions:["cmdf"]},"chemical/x-cml":{source:"apache",extensions:["cml"]},"chemical/x-csml":{source:"apache",extensions:["csml"]},"chemical/x-pdb":{source:"apache"},"chemical/x-xyz":{source:"apache",extensions:["xyz"]},"font/collection":{source:"iana",extensions:["ttc"]},"font/otf":{source:"iana",compressible:!0,extensions:["otf"]},"font/sfnt":{source:"iana"},"font/ttf":{source:"iana",compressible:!0,extensions:["ttf"]},"font/woff":{source:"iana",extensions:["woff"]},"font/woff2":{source:"iana",extensions:["woff2"]},"image/aces":{source:"iana",extensions:["exr"]},"image/apng":{source:"iana",compressible:!1,extensions:["apng"]},"image/avci":{source:"iana",extensions:["avci"]},"image/avcs":{source:"iana",extensions:["avcs"]},"image/avif":{source:"iana",compressible:!1,extensions:["avif"]},"image/bmp":{source:"iana",compressible:!0,extensions:["bmp","dib"]},"image/cgm":{source:"iana",extensions:["cgm"]},"image/dicom-rle":{source:"iana",extensions:["drle"]},"image/dpx":{source:"iana",extensions:["dpx"]},"image/emf":{source:"iana",extensions:["emf"]},"image/fits":{source:"iana",extensions:["fits"]},"image/g3fax":{source:"iana",extensions:["g3"]},"image/gif":{source:"iana",compressible:!1,extensions:["gif"]},"image/heic":{source:"iana",extensions:["heic"]},"image/heic-sequence":{source:"iana",extensions:["heics"]},"image/heif":{source:"iana",extensions:["heif"]},"image/heif-sequence":{source:"iana",extensions:["heifs"]},"image/hej2k":{source:"iana",extensions:["hej2"]},"image/ief":{source:"iana",extensions:["ief"]},"image/j2c":{source:"iana"},"image/jaii":{source:"iana",extensions:["jaii"]},"image/jais":{source:"iana",extensions:["jais"]},"image/jls":{source:"iana",extensions:["jls"]},"image/jp2":{source:"iana",compressible:!1,extensions:["jp2","jpg2"]},"image/jpeg":{source:"iana",compressible:!1,extensions:["jpg","jpeg","jpe"]},"image/jph":{source:"iana",extensions:["jph"]},"image/jphc":{source:"iana",extensions:["jhc"]},"image/jpm":{source:"iana",compressible:!1,extensions:["jpm","jpgm"]},"image/jpx":{source:"iana",compressible:!1,extensions:["jpx","jpf"]},"image/jxl":{source:"iana",extensions:["jxl"]},"image/jxr":{source:"iana",extensions:["jxr"]},"image/jxra":{source:"iana",extensions:["jxra"]},"image/jxrs":{source:"iana",extensions:["jxrs"]},"image/jxs":{source:"iana",extensions:["jxs"]},"image/jxsc":{source:"iana",extensions:["jxsc"]},"image/jxsi":{source:"iana",extensions:["jxsi"]},"image/jxss":{source:"iana",extensions:["jxss"]},"image/ktx":{source:"iana",extensions:["ktx"]},"image/ktx2":{source:"iana",extensions:["ktx2"]},"image/naplps":{source:"iana"},"image/pjpeg":{compressible:!1,extensions:["jfif"]},"image/png":{source:"iana",compressible:!1,extensions:["png"]},"image/prs.btif":{source:"iana",extensions:["btif","btf"]},"image/prs.pti":{source:"iana",extensions:["pti"]},"image/pwg-raster":{source:"iana"},"image/sgi":{source:"apache",extensions:["sgi"]},"image/svg+xml":{source:"iana",compressible:!0,extensions:["svg","svgz"]},"image/t38":{source:"iana",extensions:["t38"]},"image/tiff":{source:"iana",compressible:!1,extensions:["tif","tiff"]},"image/tiff-fx":{source:"iana",extensions:["tfx"]},"image/vnd.adobe.photoshop":{source:"iana",compressible:!0,extensions:["psd"]},"image/vnd.airzip.accelerator.azv":{source:"iana",extensions:["azv"]},"image/vnd.clip":{source:"iana"},"image/vnd.cns.inf2":{source:"iana"},"image/vnd.dece.graphic":{source:"iana",extensions:["uvi","uvvi","uvg","uvvg"]},"image/vnd.djvu":{source:"iana",extensions:["djvu","djv"]},"image/vnd.dvb.subtitle":{source:"iana",extensions:["sub"]},"image/vnd.dwg":{source:"iana",extensions:["dwg"]},"image/vnd.dxf":{source:"iana",extensions:["dxf"]},"image/vnd.fastbidsheet":{source:"iana",extensions:["fbs"]},"image/vnd.fpx":{source:"iana",extensions:["fpx"]},"image/vnd.fst":{source:"iana",extensions:["fst"]},"image/vnd.fujixerox.edmics-mmr":{source:"iana",extensions:["mmr"]},"image/vnd.fujixerox.edmics-rlc":{source:"iana",extensions:["rlc"]},"image/vnd.globalgraphics.pgb":{source:"iana"},"image/vnd.microsoft.icon":{source:"iana",compressible:!0,extensions:["ico"]},"image/vnd.mix":{source:"iana"},"image/vnd.mozilla.apng":{source:"iana"},"image/vnd.ms-dds":{compressible:!0,extensions:["dds"]},"image/vnd.ms-modi":{source:"iana",extensions:["mdi"]},"image/vnd.ms-photo":{source:"apache",extensions:["wdp"]},"image/vnd.net-fpx":{source:"iana",extensions:["npx"]},"image/vnd.pco.b16":{source:"iana",extensions:["b16"]},"image/vnd.radiance":{source:"iana"},"image/vnd.sealed.png":{source:"iana"},"image/vnd.sealedmedia.softseal.gif":{source:"iana"},"image/vnd.sealedmedia.softseal.jpg":{source:"iana"},"image/vnd.svf":{source:"iana"},"image/vnd.tencent.tap":{source:"iana",extensions:["tap"]},"image/vnd.valve.source.texture":{source:"iana",extensions:["vtf"]},"image/vnd.wap.wbmp":{source:"iana",extensions:["wbmp"]},"image/vnd.xiff":{source:"iana",extensions:["xif"]},"image/vnd.zbrush.pcx":{source:"iana",extensions:["pcx"]},"image/webp":{source:"iana",extensions:["webp"]},"image/wmf":{source:"iana",extensions:["wmf"]},"image/x-3ds":{source:"apache",extensions:["3ds"]},"image/x-adobe-dng":{extensions:["dng"]},"image/x-cmu-raster":{source:"apache",extensions:["ras"]},"image/x-cmx":{source:"apache",extensions:["cmx"]},"image/x-emf":{source:"iana"},"image/x-freehand":{source:"apache",extensions:["fh","fhc","fh4","fh5","fh7"]},"image/x-icon":{source:"apache",compressible:!0,extensions:["ico"]},"image/x-jng":{source:"nginx",extensions:["jng"]},"image/x-mrsid-image":{source:"apache",extensions:["sid"]},"image/x-ms-bmp":{source:"nginx",compressible:!0,extensions:["bmp"]},"image/x-pcx":{source:"apache",extensions:["pcx"]},"image/x-pict":{source:"apache",extensions:["pic","pct"]},"image/x-portable-anymap":{source:"apache",extensions:["pnm"]},"image/x-portable-bitmap":{source:"apache",extensions:["pbm"]},"image/x-portable-graymap":{source:"apache",extensions:["pgm"]},"image/x-portable-pixmap":{source:"apache",extensions:["ppm"]},"image/x-rgb":{source:"apache",extensions:["rgb"]},"image/x-tga":{source:"apache",extensions:["tga"]},"image/x-wmf":{source:"iana"},"image/x-xbitmap":{source:"apache",extensions:["xbm"]},"image/x-xcf":{compressible:!1},"image/x-xpixmap":{source:"apache",extensions:["xpm"]},"image/x-xwindowdump":{source:"apache",extensions:["xwd"]},"message/bhttp":{source:"iana"},"message/cpim":{source:"iana"},"message/delivery-status":{source:"iana"},"message/disposition-notification":{source:"iana",extensions:["disposition-notification"]},"message/external-body":{source:"iana"},"message/feedback-report":{source:"iana"},"message/global":{source:"iana",extensions:["u8msg"]},"message/global-delivery-status":{source:"iana",extensions:["u8dsn"]},"message/global-disposition-notification":{source:"iana",extensions:["u8mdn"]},"message/global-headers":{source:"iana",extensions:["u8hdr"]},"message/http":{source:"iana",compressible:!1},"message/imdn+xml":{source:"iana",compressible:!0},"message/mls":{source:"iana"},"message/news":{source:"apache"},"message/ohttp-req":{source:"iana"},"message/ohttp-res":{source:"iana"},"message/partial":{source:"iana",compressible:!1},"message/rfc822":{source:"iana",compressible:!0,extensions:["eml","mime","mht","mhtml"]},"message/s-http":{source:"apache"},"message/sip":{source:"iana"},"message/sipfrag":{source:"iana"},"message/tracking-status":{source:"iana"},"message/vnd.si.simp":{source:"apache"},"message/vnd.wfa.wsc":{source:"iana",extensions:["wsc"]},"model/3mf":{source:"iana",extensions:["3mf"]},"model/e57":{source:"iana"},"model/gltf+json":{source:"iana",compressible:!0,extensions:["gltf"]},"model/gltf-binary":{source:"iana",compressible:!0,extensions:["glb"]},"model/iges":{source:"iana",compressible:!1,extensions:["igs","iges"]},"model/jt":{source:"iana",extensions:["jt"]},"model/mesh":{source:"iana",compressible:!1,extensions:["msh","mesh","silo"]},"model/mtl":{source:"iana",extensions:["mtl"]},"model/obj":{source:"iana",extensions:["obj"]},"model/prc":{source:"iana",extensions:["prc"]},"model/step":{source:"iana",extensions:["step","stp","stpnc","p21","210"]},"model/step+xml":{source:"iana",compressible:!0,extensions:["stpx"]},"model/step+zip":{source:"iana",compressible:!1,extensions:["stpz"]},"model/step-xml+zip":{source:"iana",compressible:!1,extensions:["stpxz"]},"model/stl":{source:"iana",extensions:["stl"]},"model/u3d":{source:"iana",extensions:["u3d"]},"model/vnd.bary":{source:"iana",extensions:["bary"]},"model/vnd.cld":{source:"iana",extensions:["cld"]},"model/vnd.collada+xml":{source:"iana",compressible:!0,extensions:["dae"]},"model/vnd.dwf":{source:"iana",extensions:["dwf"]},"model/vnd.flatland.3dml":{source:"iana"},"model/vnd.gdl":{source:"iana",extensions:["gdl"]},"model/vnd.gs-gdl":{source:"apache"},"model/vnd.gs.gdl":{source:"iana"},"model/vnd.gtw":{source:"iana",extensions:["gtw"]},"model/vnd.moml+xml":{source:"iana",compressible:!0},"model/vnd.mts":{source:"iana",extensions:["mts"]},"model/vnd.opengex":{source:"iana",extensions:["ogex"]},"model/vnd.parasolid.transmit.binary":{source:"iana",extensions:["x_b"]},"model/vnd.parasolid.transmit.text":{source:"iana",extensions:["x_t"]},"model/vnd.pytha.pyox":{source:"iana",extensions:["pyo","pyox"]},"model/vnd.rosette.annotated-data-model":{source:"iana"},"model/vnd.sap.vds":{source:"iana",extensions:["vds"]},"model/vnd.usda":{source:"iana",extensions:["usda"]},"model/vnd.usdz+zip":{source:"iana",compressible:!1,extensions:["usdz"]},"model/vnd.valve.source.compiled-map":{source:"iana",extensions:["bsp"]},"model/vnd.vtu":{source:"iana",extensions:["vtu"]},"model/vrml":{source:"iana",compressible:!1,extensions:["wrl","vrml"]},"model/x3d+binary":{source:"apache",compressible:!1,extensions:["x3db","x3dbz"]},"model/x3d+fastinfoset":{source:"iana",extensions:["x3db"]},"model/x3d+vrml":{source:"apache",compressible:!1,extensions:["x3dv","x3dvz"]},"model/x3d+xml":{source:"iana",compressible:!0,extensions:["x3d","x3dz"]},"model/x3d-vrml":{source:"iana",extensions:["x3dv"]},"multipart/alternative":{source:"iana",compressible:!1},"multipart/appledouble":{source:"iana"},"multipart/byteranges":{source:"iana"},"multipart/digest":{source:"iana"},"multipart/encrypted":{source:"iana",compressible:!1},"multipart/form-data":{source:"iana",compressible:!1},"multipart/header-set":{source:"iana"},"multipart/mixed":{source:"iana"},"multipart/multilingual":{source:"iana"},"multipart/parallel":{source:"iana"},"multipart/related":{source:"iana",compressible:!1},"multipart/report":{source:"iana"},"multipart/signed":{source:"iana",compressible:!1},"multipart/vnd.bint.med-plus":{source:"iana"},"multipart/voice-message":{source:"iana"},"multipart/x-mixed-replace":{source:"iana"},"text/1d-interleaved-parityfec":{source:"iana"},"text/cache-manifest":{source:"iana",compressible:!0,extensions:["appcache","manifest"]},"text/calendar":{source:"iana",extensions:["ics","ifb"]},"text/calender":{compressible:!0},"text/cmd":{compressible:!0},"text/coffeescript":{extensions:["coffee","litcoffee"]},"text/cql":{source:"iana"},"text/cql-expression":{source:"iana"},"text/cql-identifier":{source:"iana"},"text/css":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["css"]},"text/csv":{source:"iana",compressible:!0,extensions:["csv"]},"text/csv-schema":{source:"iana"},"text/directory":{source:"iana"},"text/dns":{source:"iana"},"text/ecmascript":{source:"apache"},"text/encaprtp":{source:"iana"},"text/enriched":{source:"iana"},"text/fhirpath":{source:"iana"},"text/flexfec":{source:"iana"},"text/fwdred":{source:"iana"},"text/gff3":{source:"iana"},"text/grammar-ref-list":{source:"iana"},"text/hl7v2":{source:"iana"},"text/html":{source:"iana",compressible:!0,extensions:["html","htm","shtml"]},"text/jade":{extensions:["jade"]},"text/javascript":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["js","mjs"]},"text/jcr-cnd":{source:"iana"},"text/jsx":{compressible:!0,extensions:["jsx"]},"text/less":{compressible:!0,extensions:["less"]},"text/markdown":{source:"iana",compressible:!0,extensions:["md","markdown"]},"text/mathml":{source:"nginx",extensions:["mml"]},"text/mdx":{compressible:!0,extensions:["mdx"]},"text/mizar":{source:"iana"},"text/n3":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["n3"]},"text/parameters":{source:"iana",charset:"UTF-8"},"text/parityfec":{source:"iana"},"text/plain":{source:"iana",compressible:!0,extensions:["txt","text","conf","def","list","log","in","ini"]},"text/provenance-notation":{source:"iana",charset:"UTF-8"},"text/prs.fallenstein.rst":{source:"iana"},"text/prs.lines.tag":{source:"iana",extensions:["dsc"]},"text/prs.prop.logic":{source:"iana"},"text/prs.texi":{source:"iana"},"text/raptorfec":{source:"iana"},"text/red":{source:"iana"},"text/rfc822-headers":{source:"iana"},"text/richtext":{source:"iana",compressible:!0,extensions:["rtx"]},"text/rtf":{source:"iana",compressible:!0,extensions:["rtf"]},"text/rtp-enc-aescm128":{source:"iana"},"text/rtploopback":{source:"iana"},"text/rtx":{source:"iana"},"text/sgml":{source:"iana",extensions:["sgml","sgm"]},"text/shaclc":{source:"iana"},"text/shex":{source:"iana",extensions:["shex"]},"text/slim":{extensions:["slim","slm"]},"text/spdx":{source:"iana",extensions:["spdx"]},"text/strings":{source:"iana"},"text/stylus":{extensions:["stylus","styl"]},"text/t140":{source:"iana"},"text/tab-separated-values":{source:"iana",compressible:!0,extensions:["tsv"]},"text/troff":{source:"iana",extensions:["t","tr","roff","man","me","ms"]},"text/turtle":{source:"iana",charset:"UTF-8",extensions:["ttl"]},"text/ulpfec":{source:"iana"},"text/uri-list":{source:"iana",compressible:!0,extensions:["uri","uris","urls"]},"text/vcard":{source:"iana",compressible:!0,extensions:["vcard"]},"text/vnd.a":{source:"iana"},"text/vnd.abc":{source:"iana"},"text/vnd.ascii-art":{source:"iana"},"text/vnd.curl":{source:"iana",extensions:["curl"]},"text/vnd.curl.dcurl":{source:"apache",extensions:["dcurl"]},"text/vnd.curl.mcurl":{source:"apache",extensions:["mcurl"]},"text/vnd.curl.scurl":{source:"apache",extensions:["scurl"]},"text/vnd.debian.copyright":{source:"iana",charset:"UTF-8"},"text/vnd.dmclientscript":{source:"iana"},"text/vnd.dvb.subtitle":{source:"iana",extensions:["sub"]},"text/vnd.esmertec.theme-descriptor":{source:"iana",charset:"UTF-8"},"text/vnd.exchangeable":{source:"iana"},"text/vnd.familysearch.gedcom":{source:"iana",extensions:["ged"]},"text/vnd.ficlab.flt":{source:"iana"},"text/vnd.fly":{source:"iana",extensions:["fly"]},"text/vnd.fmi.flexstor":{source:"iana",extensions:["flx"]},"text/vnd.gml":{source:"iana"},"text/vnd.graphviz":{source:"iana",extensions:["gv"]},"text/vnd.hans":{source:"iana"},"text/vnd.hgl":{source:"iana"},"text/vnd.in3d.3dml":{source:"iana",extensions:["3dml"]},"text/vnd.in3d.spot":{source:"iana",extensions:["spot"]},"text/vnd.iptc.newsml":{source:"iana"},"text/vnd.iptc.nitf":{source:"iana"},"text/vnd.latex-z":{source:"iana"},"text/vnd.motorola.reflex":{source:"iana"},"text/vnd.ms-mediapackage":{source:"iana"},"text/vnd.net2phone.commcenter.command":{source:"iana"},"text/vnd.radisys.msml-basic-layout":{source:"iana"},"text/vnd.senx.warpscript":{source:"iana"},"text/vnd.si.uricatalogue":{source:"apache"},"text/vnd.sosi":{source:"iana"},"text/vnd.sun.j2me.app-descriptor":{source:"iana",charset:"UTF-8",extensions:["jad"]},"text/vnd.trolltech.linguist":{source:"iana",charset:"UTF-8"},"text/vnd.vcf":{source:"iana"},"text/vnd.wap.si":{source:"iana"},"text/vnd.wap.sl":{source:"iana"},"text/vnd.wap.wml":{source:"iana",extensions:["wml"]},"text/vnd.wap.wmlscript":{source:"iana",extensions:["wmls"]},"text/vnd.zoo.kcl":{source:"iana"},"text/vtt":{source:"iana",charset:"UTF-8",compressible:!0,extensions:["vtt"]},"text/wgsl":{source:"iana",extensions:["wgsl"]},"text/x-asm":{source:"apache",extensions:["s","asm"]},"text/x-c":{source:"apache",extensions:["c","cc","cxx","cpp","h","hh","dic"]},"text/x-component":{source:"nginx",extensions:["htc"]},"text/x-fortran":{source:"apache",extensions:["f","for","f77","f90"]},"text/x-gwt-rpc":{compressible:!0},"text/x-handlebars-template":{extensions:["hbs"]},"text/x-java-source":{source:"apache",extensions:["java"]},"text/x-jquery-tmpl":{compressible:!0},"text/x-lua":{extensions:["lua"]},"text/x-markdown":{compressible:!0,extensions:["mkd"]},"text/x-nfo":{source:"apache",extensions:["nfo"]},"text/x-opml":{source:"apache",extensions:["opml"]},"text/x-org":{compressible:!0,extensions:["org"]},"text/x-pascal":{source:"apache",extensions:["p","pas"]},"text/x-processing":{compressible:!0,extensions:["pde"]},"text/x-sass":{extensions:["sass"]},"text/x-scss":{extensions:["scss"]},"text/x-setext":{source:"apache",extensions:["etx"]},"text/x-sfv":{source:"apache",extensions:["sfv"]},"text/x-suse-ymp":{compressible:!0,extensions:["ymp"]},"text/x-uuencode":{source:"apache",extensions:["uu"]},"text/x-vcalendar":{source:"apache",extensions:["vcs"]},"text/x-vcard":{source:"apache",extensions:["vcf"]},"text/xml":{source:"iana",compressible:!0,extensions:["xml"]},"text/xml-external-parsed-entity":{source:"iana"},"text/yaml":{compressible:!0,extensions:["yaml","yml"]},"video/1d-interleaved-parityfec":{source:"iana"},"video/3gpp":{source:"iana",extensions:["3gp","3gpp"]},"video/3gpp-tt":{source:"iana"},"video/3gpp2":{source:"iana",extensions:["3g2"]},"video/av1":{source:"iana"},"video/bmpeg":{source:"iana"},"video/bt656":{source:"iana"},"video/celb":{source:"iana"},"video/dv":{source:"iana"},"video/encaprtp":{source:"iana"},"video/evc":{source:"iana"},"video/ffv1":{source:"iana"},"video/flexfec":{source:"iana"},"video/h261":{source:"iana",extensions:["h261"]},"video/h263":{source:"iana",extensions:["h263"]},"video/h263-1998":{source:"iana"},"video/h263-2000":{source:"iana"},"video/h264":{source:"iana",extensions:["h264"]},"video/h264-rcdo":{source:"iana"},"video/h264-svc":{source:"iana"},"video/h265":{source:"iana"},"video/h266":{source:"iana"},"video/iso.segment":{source:"iana",extensions:["m4s"]},"video/jpeg":{source:"iana",extensions:["jpgv"]},"video/jpeg2000":{source:"iana"},"video/jpm":{source:"apache",extensions:["jpm","jpgm"]},"video/jxsv":{source:"iana"},"video/lottie+json":{source:"iana",compressible:!0},"video/matroska":{source:"iana"},"video/matroska-3d":{source:"iana"},"video/mj2":{source:"iana",extensions:["mj2","mjp2"]},"video/mp1s":{source:"iana"},"video/mp2p":{source:"iana"},"video/mp2t":{source:"iana",extensions:["ts","m2t","m2ts","mts"]},"video/mp4":{source:"iana",compressible:!1,extensions:["mp4","mp4v","mpg4"]},"video/mp4v-es":{source:"iana"},"video/mpeg":{source:"iana",compressible:!1,extensions:["mpeg","mpg","mpe","m1v","m2v"]},"video/mpeg4-generic":{source:"iana"},"video/mpv":{source:"iana"},"video/nv":{source:"iana"},"video/ogg":{source:"iana",compressible:!1,extensions:["ogv"]},"video/parityfec":{source:"iana"},"video/pointer":{source:"iana"},"video/quicktime":{source:"iana",compressible:!1,extensions:["qt","mov"]},"video/raptorfec":{source:"iana"},"video/raw":{source:"iana"},"video/rtp-enc-aescm128":{source:"iana"},"video/rtploopback":{source:"iana"},"video/rtx":{source:"iana"},"video/scip":{source:"iana"},"video/smpte291":{source:"iana"},"video/smpte292m":{source:"iana"},"video/ulpfec":{source:"iana"},"video/vc1":{source:"iana"},"video/vc2":{source:"iana"},"video/vnd.cctv":{source:"iana"},"video/vnd.dece.hd":{source:"iana",extensions:["uvh","uvvh"]},"video/vnd.dece.mobile":{source:"iana",extensions:["uvm","uvvm"]},"video/vnd.dece.mp4":{source:"iana"},"video/vnd.dece.pd":{source:"iana",extensions:["uvp","uvvp"]},"video/vnd.dece.sd":{source:"iana",extensions:["uvs","uvvs"]},"video/vnd.dece.video":{source:"iana",extensions:["uvv","uvvv"]},"video/vnd.directv.mpeg":{source:"iana"},"video/vnd.directv.mpeg-tts":{source:"iana"},"video/vnd.dlna.mpeg-tts":{source:"iana"},"video/vnd.dvb.file":{source:"iana",extensions:["dvb"]},"video/vnd.fvt":{source:"iana",extensions:["fvt"]},"video/vnd.hns.video":{source:"iana"},"video/vnd.iptvforum.1dparityfec-1010":{source:"iana"},"video/vnd.iptvforum.1dparityfec-2005":{source:"iana"},"video/vnd.iptvforum.2dparityfec-1010":{source:"iana"},"video/vnd.iptvforum.2dparityfec-2005":{source:"iana"},"video/vnd.iptvforum.ttsavc":{source:"iana"},"video/vnd.iptvforum.ttsmpeg2":{source:"iana"},"video/vnd.motorola.video":{source:"iana"},"video/vnd.motorola.videop":{source:"iana"},"video/vnd.mpegurl":{source:"iana",extensions:["mxu","m4u"]},"video/vnd.ms-playready.media.pyv":{source:"iana",extensions:["pyv"]},"video/vnd.nokia.interleaved-multimedia":{source:"iana"},"video/vnd.nokia.mp4vr":{source:"iana"},"video/vnd.nokia.videovoip":{source:"iana"},"video/vnd.objectvideo":{source:"iana"},"video/vnd.planar":{source:"iana"},"video/vnd.radgamettools.bink":{source:"iana"},"video/vnd.radgamettools.smacker":{source:"apache"},"video/vnd.sealed.mpeg1":{source:"iana"},"video/vnd.sealed.mpeg4":{source:"iana"},"video/vnd.sealed.swf":{source:"iana"},"video/vnd.sealedmedia.softseal.mov":{source:"iana"},"video/vnd.uvvu.mp4":{source:"iana",extensions:["uvu","uvvu"]},"video/vnd.vivo":{source:"iana",extensions:["viv"]},"video/vnd.youtube.yt":{source:"iana"},"video/vp8":{source:"iana"},"video/vp9":{source:"iana"},"video/webm":{source:"apache",compressible:!1,extensions:["webm"]},"video/x-f4v":{source:"apache",extensions:["f4v"]},"video/x-fli":{source:"apache",extensions:["fli"]},"video/x-flv":{source:"apache",compressible:!1,extensions:["flv"]},"video/x-m4v":{source:"apache",extensions:["m4v"]},"video/x-matroska":{source:"apache",compressible:!1,extensions:["mkv","mk3d","mks"]},"video/x-mng":{source:"apache",extensions:["mng"]},"video/x-ms-asf":{source:"apache",extensions:["asf","asx"]},"video/x-ms-vob":{source:"apache",extensions:["vob"]},"video/x-ms-wm":{source:"apache",extensions:["wm"]},"video/x-ms-wmv":{source:"apache",compressible:!1,extensions:["wmv"]},"video/x-ms-wmx":{source:"apache",extensions:["wmx"]},"video/x-ms-wvx":{source:"apache",extensions:["wvx"]},"video/x-msvideo":{source:"apache",extensions:["avi"]},"video/x-sgi-movie":{source:"apache",extensions:["movie"]},"video/x-smv":{source:"apache",extensions:["smv"]},"x-conference/x-cooltalk":{source:"apache",extensions:["ice"]},"x-shader/x-fragment":{compressible:!0},"x-shader/x-vertex":{compressible:!0}},se={};var ae,oe,re={exports:{}},ce={exports:{}};function de(){if(oe)return ae;oe=1;class e extends Error{constructor(e){if(!Array.isArray(e))throw new TypeError("Expected input to be an Array, got "+typeof e);let t="";for(let n=0;n<e.length;n++)t+=`    ${e[n].stack}\n`;super(t),this.name="AggregateError",this.errors=e}}return ae={AggregateError:e,ArrayIsArray:e=>Array.isArray(e),ArrayPrototypeIncludes:(e,t)=>e.includes(t),ArrayPrototypeIndexOf:(e,t)=>e.indexOf(t),ArrayPrototypeJoin:(e,t)=>e.join(t),ArrayPrototypeMap:(e,t)=>e.map(t),ArrayPrototypePop:(e,t)=>e.pop(t),ArrayPrototypePush:(e,t)=>e.push(t),ArrayPrototypeSlice:(e,t,n)=>e.slice(t,n),Error:Error,FunctionPrototypeCall:(e,t,...n)=>e.call(t,...n),FunctionPrototypeSymbolHasInstance:(e,t)=>Function.prototype[Symbol.hasInstance].call(e,t),MathFloor:Math.floor,Number:Number,NumberIsInteger:Number.isInteger,NumberIsNaN:Number.isNaN,NumberMAX_SAFE_INTEGER:Number.MAX_SAFE_INTEGER,NumberMIN_SAFE_INTEGER:Number.MIN_SAFE_INTEGER,NumberParseInt:Number.parseInt,ObjectDefineProperties:(e,t)=>Object.defineProperties(e,t),ObjectDefineProperty:(e,t,n)=>Object.defineProperty(e,t,n),ObjectGetOwnPropertyDescriptor:(e,t)=>Object.getOwnPropertyDescriptor(e,t),ObjectKeys:e=>Object.keys(e),ObjectSetPrototypeOf:(e,t)=>Object.setPrototypeOf(e,t),Promise:Promise,PromisePrototypeCatch:(e,t)=>e.catch(t),PromisePrototypeThen:(e,t,n)=>e.then(t,n),PromiseReject:e=>Promise.reject(e),PromiseResolve:e=>Promise.resolve(e),ReflectApply:Reflect.apply,RegExpPrototypeTest:(e,t)=>e.test(t),SafeSet:Set,String:String,StringPrototypeSlice:(e,t,n)=>e.slice(t,n),StringPrototypeToLowerCase:e=>e.toLowerCase(),StringPrototypeToUpperCase:e=>e.toUpperCase(),StringPrototypeTrim:e=>e.trim(),Symbol:Symbol,SymbolFor:Symbol.for,SymbolAsyncIterator:Symbol.asyncIterator,SymbolHasInstance:Symbol.hasInstance,SymbolIterator:Symbol.iterator,SymbolDispose:Symbol.dispose||Symbol("Symbol.dispose"),SymbolAsyncDispose:Symbol.asyncDispose||Symbol("Symbol.asyncDispose"),TypedArrayPrototypeSet:(e,t,n)=>e.set(t,n),Boolean:Boolean,Uint8Array:Uint8Array}}var le,pe,ue,me,he={exports:{}};function ge(){return pe?le:(pe=1,le={format:(e,...t)=>e.replace(/%([sdifj])/g,function(...[e,n]){const i=t.shift();return"f"===n?i.toFixed(6):"j"===n?JSON.stringify(i):"s"===n&&"object"==typeof i?`${i.constructor!==Object?i.constructor.name:""} {}`.trim():i.toString()}),inspect(e){switch(typeof e){case"string":if(e.includes("'")){if(!e.includes('"'))return`"${e}"`;if(!e.includes("`")&&!e.includes("${"))return`\`${e}\``}return`'${e}'`;case"number":return isNaN(e)?"NaN":Object.is(e,-0)?String(e):e;case"bigint":return`${String(e)}n`;case"boolean":case"undefined":return String(e);case"object":return"{}"}}})}function fe(){if(me)return ue;me=1;const{format:e,inspect:t}=ge(),{AggregateError:n}=de(),i=globalThis.AggregateError||n,s=Symbol("kIsNodeError"),a=["string","function","number","object","Function","Object","boolean","bigint","symbol"],o=/^([A-Z][a-z0-9]*)+$/,r={};function c(e,t){if(!e)throw new r.ERR_INTERNAL_ASSERTION(t)}function d(e){let t="",n=e.length;const i="-"===e[0]?1:0;for(;n>=i+4;n-=3)t=`_${e.slice(n-3,n)}${t}`;return`${e.slice(0,n)}${t}`}function l(t,n,i){i||(i=Error);class a extends i{constructor(...i){super(function(t,n,i){if("function"==typeof n)return c(n.length<=i.length,`Code: ${t}; The provided arguments length (${i.length}) does not match the required ones (${n.length}).`),n(...i);const s=(n.match(/%[dfijoOs]/g)||[]).length;return c(s===i.length,`Code: ${t}; The provided arguments length (${i.length}) does not match the required ones (${s}).`),0===i.length?n:e(n,...i)}(t,n,i))}toString(){return`${this.name} [${t}]: ${this.message}`}}Object.defineProperties(a.prototype,{name:{value:i.name,writable:!0,enumerable:!1,configurable:!0},toString:{value(){return`${this.name} [${t}]: ${this.message}`},writable:!0,enumerable:!1,configurable:!0}}),a.prototype.code=t,a.prototype[s]=!0,r[t]=a}function p(e){const t="__node_internal_"+e.name;return Object.defineProperty(e,"name",{value:t}),e}class u extends Error{constructor(e="The operation was aborted",t=void 0){if(void 0!==t&&"object"!=typeof t)throw new r.ERR_INVALID_ARG_TYPE("options","Object",t);super(e,t),this.code="ABORT_ERR",this.name="AbortError"}}return l("ERR_ASSERTION","%s",Error),l("ERR_INVALID_ARG_TYPE",(e,n,i)=>{c("string"==typeof e,"'name' must be a string"),Array.isArray(n)||(n=[n]);let s="The ";e.endsWith(" argument")?s+=`${e} `:s+=`"${e}" ${e.includes(".")?"property":"argument"} `,s+="must be ";const r=[],d=[],l=[];for(const e of n)c("string"==typeof e,"All expected entries have to be of type string"),a.includes(e)?r.push(e.toLowerCase()):o.test(e)?d.push(e):(c("object"!==e,'The value "object" should be written as "Object"'),l.push(e));if(d.length>0){const e=r.indexOf("object");-1!==e&&(r.splice(r,e,1),d.push("Object"))}if(r.length>0){switch(r.length){case 1:s+=`of type ${r[0]}`;break;case 2:s+=`one of type ${r[0]} or ${r[1]}`;break;default:{const e=r.pop();s+=`one of type ${r.join(", ")}, or ${e}`}}(d.length>0||l.length>0)&&(s+=" or ")}if(d.length>0){switch(d.length){case 1:s+=`an instance of ${d[0]}`;break;case 2:s+=`an instance of ${d[0]} or ${d[1]}`;break;default:{const e=d.pop();s+=`an instance of ${d.join(", ")}, or ${e}`}}l.length>0&&(s+=" or ")}switch(l.length){case 0:break;case 1:l[0].toLowerCase()!==l[0]&&(s+="an "),s+=`${l[0]}`;break;case 2:s+=`one of ${l[0]} or ${l[1]}`;break;default:{const e=l.pop();s+=`one of ${l.join(", ")}, or ${e}`}}if(null==i)s+=`. Received ${i}`;else if("function"==typeof i&&i.name)s+=`. Received function ${i.name}`;else if("object"==typeof i){var p;null!==(p=i.constructor)&&void 0!==p&&p.name?s+=`. Received an instance of ${i.constructor.name}`:s+=`. Received ${t(i,{depth:-1})}`}else{let e=t(i,{colors:!1});e.length>25&&(e=`${e.slice(0,25)}...`),s+=`. Received type ${typeof i} (${e})`}return s},TypeError),l("ERR_INVALID_ARG_VALUE",(e,n,i="is invalid")=>{let s=t(n);return s.length>128&&(s=s.slice(0,128)+"..."),`The ${e.includes(".")?"property":"argument"} '${e}' ${i}. Received ${s}`},TypeError),l("ERR_INVALID_RETURN_VALUE",(e,t,n)=>{var i;return`Expected ${e} to be returned from the "${t}" function but got ${null!=n&&null!==(i=n.constructor)&&void 0!==i&&i.name?`instance of ${n.constructor.name}`:"type "+typeof n}.`},TypeError),l("ERR_MISSING_ARGS",(...e)=>{let t;c(e.length>0,"At least one arg needs to be specified");const n=e.length;switch(e=(Array.isArray(e)?e:[e]).map(e=>`"${e}"`).join(" or "),n){case 1:t+=`The ${e[0]} argument`;break;case 2:t+=`The ${e[0]} and ${e[1]} arguments`;break;default:{const n=e.pop();t+=`The ${e.join(", ")}, and ${n} arguments`}}return`${t} must be specified`},TypeError),l("ERR_OUT_OF_RANGE",(e,n,i)=>{let s;if(c(n,'Missing "range" argument'),Number.isInteger(i)&&Math.abs(i)>2**32)s=d(String(i));else if("bigint"==typeof i){s=String(i);const e=BigInt(2)**BigInt(32);(i>e||i<-e)&&(s=d(s)),s+="n"}else s=t(i);return`The value of "${e}" is out of range. It must be ${n}. Received ${s}`},RangeError),l("ERR_MULTIPLE_CALLBACK","Callback called multiple times",Error),l("ERR_METHOD_NOT_IMPLEMENTED","The %s method is not implemented",Error),l("ERR_STREAM_ALREADY_FINISHED","Cannot call %s after a stream was finished",Error),l("ERR_STREAM_CANNOT_PIPE","Cannot pipe, not readable",Error),l("ERR_STREAM_DESTROYED","Cannot call %s after a stream was destroyed",Error),l("ERR_STREAM_NULL_VALUES","May not write null values to stream",TypeError),l("ERR_STREAM_PREMATURE_CLOSE","Premature close",Error),l("ERR_STREAM_PUSH_AFTER_EOF","stream.push() after EOF",Error),l("ERR_STREAM_UNSHIFT_AFTER_END_EVENT","stream.unshift() after end event",Error),l("ERR_STREAM_WRITE_AFTER_END","write after end",Error),l("ERR_UNKNOWN_ENCODING","Unknown encoding: %s",TypeError),ue={AbortError:u,aggregateTwoErrors:p(function(e,t){if(e&&t&&e!==t){if(Array.isArray(t.errors))return t.errors.push(e),t;const n=new i([t,e],t.message);return n.code=t.code,n}return e||t}),hideStackFrames:p,codes:r}}const ye=new WeakMap,be=new WeakMap;function ve(e){const t=ye.get(e);return console.assert(null!=t,"'this' is expected an Event object, but got",e),t}function Ie(e){null==e.passiveListener?e.event.cancelable&&(e.canceled=!0,"function"==typeof e.event.preventDefault&&e.event.preventDefault()):"undefined"!=typeof console&&"function"==typeof console.error&&console.error("Unable to preventDefault inside passive event listener invocation.",e.passiveListener)}function xe(e,t){ye.set(this,{eventTarget:e,event:t,eventPhase:2,currentTarget:e,canceled:!1,stopped:!1,immediateStopped:!1,passiveListener:null,timeStamp:t.timeStamp||Date.now()}),Object.defineProperty(this,"isTrusted",{value:!1,enumerable:!0});const n=Object.keys(t);for(let e=0;e<n.length;++e){const t=n[e];t in this||Object.defineProperty(this,t,we(t))}}function we(e){return{get(){return ve(this).event[e]},set(t){ve(this).event[e]=t},configurable:!0,enumerable:!0}}function Se(e){return{value(){const t=ve(this).event;return t[e].apply(t,arguments)},configurable:!0,enumerable:!0}}function Ae(e){if(null==e||e===Object.prototype)return xe;let t=be.get(e);return null==t&&(t=function(e,t){const n=Object.keys(t);if(0===n.length)return e;function i(t,n){e.call(this,t,n)}i.prototype=Object.create(e.prototype,{constructor:{value:i,configurable:!0,writable:!0}});for(let s=0;s<n.length;++s){const a=n[s];if(!(a in e.prototype)){const e="function"==typeof Object.getOwnPropertyDescriptor(t,a).value;Object.defineProperty(i.prototype,a,e?Se(a):we(a))}}return i}(Ae(Object.getPrototypeOf(e)),e),be.set(e,t)),t}function Ee(e){return ve(e).immediateStopped}function _e(e,t){ve(e).passiveListener=t}xe.prototype={get type(){return ve(this).event.type},get target(){return ve(this).eventTarget},get currentTarget(){return ve(this).currentTarget},composedPath(){const e=ve(this).currentTarget;return null==e?[]:[e]},get NONE(){return 0},get CAPTURING_PHASE(){return 1},get AT_TARGET(){return 2},get BUBBLING_PHASE(){return 3},get eventPhase(){return ve(this).eventPhase},stopPropagation(){const e=ve(this);e.stopped=!0,"function"==typeof e.event.stopPropagation&&e.event.stopPropagation()},stopImmediatePropagation(){const e=ve(this);e.stopped=!0,e.immediateStopped=!0,"function"==typeof e.event.stopImmediatePropagation&&e.event.stopImmediatePropagation()},get bubbles(){return Boolean(ve(this).event.bubbles)},get cancelable(){return Boolean(ve(this).event.cancelable)},preventDefault(){Ie(ve(this))},get defaultPrevented(){return ve(this).canceled},get composed(){return Boolean(ve(this).event.composed)},get timeStamp(){return ve(this).timeStamp},get srcElement(){return ve(this).eventTarget},get cancelBubble(){return ve(this).stopped},set cancelBubble(e){if(!e)return;const t=ve(this);t.stopped=!0,"boolean"==typeof t.event.cancelBubble&&(t.event.cancelBubble=!0)},get returnValue(){return!ve(this).canceled},set returnValue(e){e||Ie(ve(this))},initEvent(){}},Object.defineProperty(xe.prototype,"constructor",{value:xe,configurable:!0,writable:!0}),"undefined"!=typeof window&&void 0!==window.Event&&(Object.setPrototypeOf(xe.prototype,window.Event.prototype),be.set(window.Event.prototype,xe));const Te=new WeakMap;function ze(e){return null!==e&&"object"==typeof e}function ke(e){const t=Te.get(e);if(null==t)throw new TypeError("'this' is expected an EventTarget object, but got another value.");return t}function Ne(e,t){Object.defineProperty(e,`on${t}`,function(e){return{get(){let t=ke(this).get(e);for(;null!=t;){if(3===t.listenerType)return t.listener;t=t.next}return null},set(t){"function"==typeof t||ze(t)||(t=null);const n=ke(this);let i=null,s=n.get(e);for(;null!=s;)3===s.listenerType?null!==i?i.next=s.next:null!==s.next?n.set(e,s.next):n.delete(e):i=s,s=s.next;if(null!==t){const s={listener:t,listenerType:3,passive:!1,once:!1,next:null};null===i?n.set(e,s):i.next=s}},configurable:!0,enumerable:!0}}(t))}function Ce(e){function t(){Re.call(this)}t.prototype=Object.create(Re.prototype,{constructor:{value:t,configurable:!0,writable:!0}});for(let n=0;n<e.length;++n)Ne(t.prototype,e[n]);return t}function Re(){if(!(this instanceof Re)){if(1===arguments.length&&Array.isArray(arguments[0]))return Ce(arguments[0]);if(arguments.length>0){const e=new Array(arguments.length);for(let t=0;t<arguments.length;++t)e[t]=arguments[t];return Ce(e)}throw new TypeError("Cannot call a class as a function")}Te.set(this,new Map)}Re.prototype={addEventListener(e,t,n){if(null==t)return;if("function"!=typeof t&&!ze(t))throw new TypeError("'listener' should be a function or an object.");const i=ke(this),s=ze(n),a=(s?Boolean(n.capture):Boolean(n))?1:2,o={listener:t,listenerType:a,passive:s&&Boolean(n.passive),once:s&&Boolean(n.once),next:null};let r=i.get(e);if(void 0===r)return void i.set(e,o);let c=null;for(;null!=r;){if(r.listener===t&&r.listenerType===a)return;c=r,r=r.next}c.next=o},removeEventListener(e,t,n){if(null==t)return;const i=ke(this),s=(ze(n)?Boolean(n.capture):Boolean(n))?1:2;let a=null,o=i.get(e);for(;null!=o;){if(o.listener===t&&o.listenerType===s)return void(null!==a?a.next=o.next:null!==o.next?i.set(e,o.next):i.delete(e));a=o,o=o.next}},dispatchEvent(e){if(null==e||"string"!=typeof e.type)throw new TypeError('"event.type" should be a string.');const t=ke(this),n=e.type;let i=t.get(n);if(null==i)return!0;const s=function(e,t){return new(Ae(Object.getPrototypeOf(t)))(e,t)}(this,e);let a=null;for(;null!=i;){if(i.once?null!==a?a.next=i.next:null!==i.next?t.set(n,i.next):t.delete(n):a=i,_e(s,i.passive?i.listener:null),"function"==typeof i.listener)try{i.listener.call(this,s)}catch(e){"undefined"!=typeof console&&"function"==typeof console.error&&console.error(e)}else 3!==i.listenerType&&"function"==typeof i.listener.handleEvent&&i.listener.handleEvent(s);if(Ee(s))break;i=i.next}return _e(s,null),function(e){ve(e).eventPhase=0}(s),function(e){ve(e).currentTarget=null}(s),!s.defaultPrevented}},Object.defineProperty(Re.prototype,"constructor",{value:Re,configurable:!0,writable:!0}),"undefined"!=typeof window&&void 0!==window.EventTarget&&Object.setPrototypeOf(Re.prototype,window.EventTarget.prototype);let Oe=class extends Re{constructor(){throw super(),new TypeError("AbortSignal cannot be constructed directly")}get aborted(){const e=je.get(this);if("boolean"!=typeof e)throw new TypeError("Expected 'this' to be an 'AbortSignal' object, but got "+(null===this?"null":typeof this));return e}};Ne(Oe.prototype,"abort");const je=new WeakMap;Object.defineProperties(Oe.prototype,{aborted:{enumerable:!0}}),"function"==typeof Symbol&&"symbol"==typeof Symbol.toStringTag&&Object.defineProperty(Oe.prototype,Symbol.toStringTag,{configurable:!0,value:"AbortSignal"});let Pe=class{constructor(){De.set(this,function(){const e=Object.create(Oe.prototype);return Re.call(e),je.set(e,!1),e}())}get signal(){return Le(this)}abort(){var e;e=Le(this),!1===je.get(e)&&(je.set(e,!0),e.dispatchEvent({type:"abort"}))}};const De=new WeakMap;function Le(e){const t=De.get(e);if(null==t)throw new TypeError("Expected 'this' to be an 'AbortController' object, but got "+(null===e?"null":typeof e));return t}Object.defineProperties(Pe.prototype,{signal:{enumerable:!0},abort:{enumerable:!0}}),"function"==typeof Symbol&&"symbol"==typeof Symbol.toStringTag&&Object.defineProperty(Pe.prototype,Symbol.toStringTag,{configurable:!0,value:"AbortController"});var Me,qe=B(Object.freeze({__proto__:null,AbortController:Pe,AbortSignal:Oe,default:Pe}));function Ue(){return Me||(Me=1,function(e){const t=p,{format:n,inspect:i}=ge(),{codes:{ERR_INVALID_ARG_TYPE:s}}=fe(),{kResistStopPropagation:a,AggregateError:o,SymbolDispose:r}=de(),c=globalThis.AbortSignal||qe.AbortSignal,d=globalThis.AbortController||qe.AbortController,l=Object.getPrototypeOf(async function(){}).constructor,m=globalThis.Blob||t.Blob,h=void 0!==m?function(e){return e instanceof m}:function(e){return!1},g=(e,t)=>{if(void 0!==e&&(null===e||"object"!=typeof e||!("aborted"in e)))throw new s(t,"AbortSignal",e)};e.exports={AggregateError:o,kEmptyObject:Object.freeze({}),once(e){let t=!1;return function(...n){t||(t=!0,e.apply(this,n))}},createDeferredPromise:function(){let e,t;return{promise:new Promise((n,i)=>{e=n,t=i}),resolve:e,reject:t}},promisify:e=>new Promise((t,n)=>{e((e,...i)=>e?n(e):t(...i))}),debuglog:()=>function(){},format:n,inspect:i,types:{isAsyncFunction:e=>e instanceof l,isArrayBufferView:e=>ArrayBuffer.isView(e)},isBlob:h,deprecate:(e,t)=>e,addAbortListener:u.addAbortListener||function(e,t){if(void 0===e)throw new s("signal","AbortSignal",e);let n;return g(e,"signal"),(e=>{if("function"!=typeof e)throw new s("listener","Function",e)})(t),e.aborted?queueMicrotask(()=>t()):(e.addEventListener("abort",t,{__proto__:null,once:!0,[a]:!0}),n=()=>{e.removeEventListener("abort",t)}),{__proto__:null,[r](){var e;null===(e=n)||void 0===e||e()}}},AbortSignalAny:c.any||function(e){if(1===e.length)return e[0];const t=new d,n=()=>t.abort();return e.forEach(e=>{g(e,"signals"),e.addEventListener("abort",n,{once:!0})}),t.signal.addEventListener("abort",()=>{e.forEach(e=>e.removeEventListener("abort",n))},{once:!0}),t.signal}},e.exports.promisify.custom=Symbol.for("nodejs.util.promisify.custom")}(he)),he.exports}var $e,Be,Fe={};function He(){if(Be)return $e;Be=1;const{ArrayIsArray:e,ArrayPrototypeIncludes:t,ArrayPrototypeJoin:n,ArrayPrototypeMap:i,NumberIsInteger:s,NumberIsNaN:a,NumberMAX_SAFE_INTEGER:o,NumberMIN_SAFE_INTEGER:r,NumberParseInt:c,ObjectPrototypeHasOwnProperty:d,RegExpPrototypeExec:l,String:p,StringPrototypeToUpperCase:u,StringPrototypeTrim:m}=de(),{hideStackFrames:h,codes:{ERR_SOCKET_BAD_PORT:g,ERR_INVALID_ARG_TYPE:f,ERR_INVALID_ARG_VALUE:y,ERR_OUT_OF_RANGE:b,ERR_UNKNOWN_SIGNAL:v}}=fe(),{normalizeEncoding:I}=Ue(),{isAsyncFunction:x,isArrayBufferView:w}=Ue().types,S={},A=/^[0-7]+$/,E=h((e,t,n=r,i=o)=>{if("number"!=typeof e)throw new f(t,"number",e);if(!s(e))throw new b(t,"an integer",e);if(e<n||e>i)throw new b(t,`>= ${n} && <= ${i}`,e)}),_=h((e,t,n=-2147483648,i=2147483647)=>{if("number"!=typeof e)throw new f(t,"number",e);if(!s(e))throw new b(t,"an integer",e);if(e<n||e>i)throw new b(t,`>= ${n} && <= ${i}`,e)}),T=h((e,t,n=!1)=>{if("number"!=typeof e)throw new f(t,"number",e);if(!s(e))throw new b(t,"an integer",e);const i=n?1:0,a=4294967295;if(e<i||e>a)throw new b(t,`>= ${i} && <= ${a}`,e)});function z(e,t){if("string"!=typeof e)throw new f(t,"string",e)}const k=h((e,s,a)=>{if(!t(a,e)){const t=n(i(a,e=>"string"==typeof e?`'${e}'`:p(e)),", ");throw new y(s,e,"must be one of: "+t)}});function N(e,t){if("boolean"!=typeof e)throw new f(t,"boolean",e)}function C(e,t,n){return null!=e&&d(e,t)?e[t]:n}const R=h((t,n,i=null)=>{const s=C(i,"allowArray",!1),a=C(i,"allowFunction",!1);if(!C(i,"nullable",!1)&&null===t||!s&&e(t)||"object"!=typeof t&&(!a||"function"!=typeof t))throw new f(n,"Object",t)}),O=h((e,t)=>{if(null!=e&&"object"!=typeof e&&"function"!=typeof e)throw new f(t,"a dictionary",e)}),j=h((t,n,i=0)=>{if(!e(t))throw new f(n,"Array",t);if(t.length<i)throw new y(n,t,`must be longer than ${i}`)}),P=h((e,t="buffer")=>{if(!w(e))throw new f(t,["Buffer","TypedArray","DataView"],e)}),D=h((e,t)=>{if(void 0!==e&&(null===e||"object"!=typeof e||!("aborted"in e)))throw new f(t,"AbortSignal",e)}),L=h((e,t)=>{if("function"!=typeof e)throw new f(t,"Function",e)}),M=h((e,t)=>{if("function"!=typeof e||x(e))throw new f(t,"Function",e)}),q=h((e,t)=>{if(void 0!==e)throw new f(t,"undefined",e)}),U=/^(?:<[^>]*>)(?:\s*;\s*[^;"\s]+(?:=(")?[^;"\s]*\1)?)*$/;function $(e,t){if(void 0===e||!l(U,e))throw new y(t,e,'must be an array or string of format "</styles.css>; rel=preload; as=style"')}return $e={isInt32:function(e){return e===(0|e)},isUint32:function(e){return e===e>>>0},parseFileMode:function(e,t,n){if(void 0===e&&(e=n),"string"==typeof e){if(null===l(A,e))throw new y(t,e,"must be a 32-bit unsigned integer or an octal string");e=c(e,8)}return T(e,t),e},validateArray:j,validateStringArray:function(e,t){j(e,t);for(let n=0;n<e.length;n++)z(e[n],`${t}[${n}]`)},validateBooleanArray:function(e,t){j(e,t);for(let n=0;n<e.length;n++)N(e[n],`${t}[${n}]`)},validateAbortSignalArray:function(e,t){j(e,t);for(let n=0;n<e.length;n++){const i=e[n],s=`${t}[${n}]`;if(null==i)throw new f(s,"AbortSignal",i);D(i,s)}},validateBoolean:N,validateBuffer:P,validateDictionary:O,validateEncoding:function(e,t){const n=I(t),i=e.length;if("hex"===n&&i%2!=0)throw new y("encoding",t,`is invalid for data of length ${i}`)},validateFunction:L,validateInt32:_,validateInteger:E,validateNumber:function(e,t,n=void 0,i){if("number"!=typeof e)throw new f(t,"number",e);if(null!=n&&e<n||null!=i&&e>i||(null!=n||null!=i)&&a(e))throw new b(t,`${null!=n?`>= ${n}`:""}${null!=n&&null!=i?" && ":""}${null!=i?`<= ${i}`:""}`,e)},validateObject:R,validateOneOf:k,validatePlainFunction:M,validatePort:function(e,t="Port",n=!0){if("number"!=typeof e&&"string"!=typeof e||"string"==typeof e&&0===m(e).length||+e!==+e>>>0||e>65535||0===e&&!n)throw new g(t,e,n);return 0|e},validateSignalName:function(e,t="signal"){if(z(e,t),void 0===S[e]){if(void 0!==S[u(e)])throw new v(e+" (signals must use all capital letters)");throw new v(e)}},validateString:z,validateUint32:T,validateUndefined:q,validateUnion:function(e,i,s){if(!t(s,e))throw new f(i,`('${n(s,"|")}')`,e)},validateAbortSignal:D,validateLinkHeaderValue:function(t){if("string"==typeof t)return $(t,"hints"),t;if(e(t)){const e=t.length;let n="";if(0===e)return n;for(let i=0;i<e;i++){const s=t[i];$(s,"hints"),n+=s,i!==e-1&&(n+=", ")}return n}throw new y("hints",t,'must be an array or string of format "</styles.css>; rel=preload; as=style"')}}}var Ge,We,Ve,Ke,Ye,Xe,Je,Qe,Ze,et={exports:{}};function tt(){return We?Ge:(We=1,Ge=U.process)}function nt(){if(Ke)return Ve;Ke=1;const{SymbolAsyncIterator:e,SymbolIterator:t,SymbolFor:n}=de(),i=n("nodejs.stream.destroyed"),s=n("nodejs.stream.errored"),a=n("nodejs.stream.readable"),o=n("nodejs.stream.writable"),r=n("nodejs.stream.disturbed"),c=n("nodejs.webstream.isClosedPromise"),d=n("nodejs.webstream.controllerErrorFunction");function l(e,t=!1){var n;return!(!e||"function"!=typeof e.pipe||"function"!=typeof e.on||t&&("function"!=typeof e.pause||"function"!=typeof e.resume)||e._writableState&&!1===(null===(n=e._readableState)||void 0===n?void 0:n.readable)||e._writableState&&!e._readableState)}function p(e){var t;return!(!e||"function"!=typeof e.write||"function"!=typeof e.on||e._readableState&&!1===(null===(t=e._writableState)||void 0===t?void 0:t.writable))}function u(e){return e&&(e._readableState||e._writableState||"function"==typeof e.write&&"function"==typeof e.on||"function"==typeof e.pipe&&"function"==typeof e.on)}function m(e){return!(!e||u(e)||"function"!=typeof e.pipeThrough||"function"!=typeof e.getReader||"function"!=typeof e.cancel)}function h(e){return!(!e||u(e)||"function"!=typeof e.getWriter||"function"!=typeof e.abort)}function g(e){return!(!e||u(e)||"object"!=typeof e.readable||"object"!=typeof e.writable)}function f(e){if(!u(e))return null;const t=e._writableState,n=e._readableState,s=t||n;return!!(e.destroyed||e[i]||null!=s&&s.destroyed)}function y(e){if(!p(e))return null;if(!0===e.writableEnded)return!0;const t=e._writableState;return(null==t||!t.errored)&&("boolean"!=typeof(null==t?void 0:t.ended)?null:t.ended)}function b(e,t){if(!l(e))return null;const n=e._readableState;return(null==n||!n.errored)&&("boolean"!=typeof(null==n?void 0:n.endEmitted)?null:!!(n.endEmitted||!1===t&&!0===n.ended&&0===n.length))}function v(e){return e&&null!=e[a]?e[a]:"boolean"!=typeof(null==e?void 0:e.readable)?null:!f(e)&&l(e)&&e.readable&&!b(e)}function I(e){return e&&null!=e[o]?e[o]:"boolean"!=typeof(null==e?void 0:e.writable)?null:!f(e)&&p(e)&&e.writable&&!y(e)}function x(e){return"boolean"==typeof e._closed&&"boolean"==typeof e._defaultKeepAlive&&"boolean"==typeof e._removedConnection&&"boolean"==typeof e._removedContLen}function w(e){return"boolean"==typeof e._sent100&&x(e)}return Ve={isDestroyed:f,kIsDestroyed:i,isDisturbed:function(e){var t;return!(!e||!(null!==(t=e[r])&&void 0!==t?t:e.readableDidRead||e.readableAborted))},kIsDisturbed:r,isErrored:function(e){var t,n,i,a,o,r,c,d,l,p;return!(!e||!(null!==(t=null!==(n=null!==(i=null!==(a=null!==(o=null!==(r=e[s])&&void 0!==r?r:e.readableErrored)&&void 0!==o?o:e.writableErrored)&&void 0!==a?a:null===(c=e._readableState)||void 0===c?void 0:c.errorEmitted)&&void 0!==i?i:null===(d=e._writableState)||void 0===d?void 0:d.errorEmitted)&&void 0!==n?n:null===(l=e._readableState)||void 0===l?void 0:l.errored)&&void 0!==t?t:null===(p=e._writableState)||void 0===p?void 0:p.errored))},kIsErrored:s,isReadable:v,kIsReadable:a,kIsClosedPromise:c,kControllerErrorFunction:d,kIsWritable:o,isClosed:function(e){if(!u(e))return null;if("boolean"==typeof e.closed)return e.closed;const t=e._writableState,n=e._readableState;return"boolean"==typeof(null==t?void 0:t.closed)||"boolean"==typeof(null==n?void 0:n.closed)?(null==t?void 0:t.closed)||(null==n?void 0:n.closed):"boolean"==typeof e._closed&&x(e)?e._closed:null},isDuplexNodeStream:function(e){return!(!e||"function"!=typeof e.pipe||!e._readableState||"function"!=typeof e.on||"function"!=typeof e.write)},isFinished:function(e,t){return u(e)?!(!f(e)&&(!1!==(null==t?void 0:t.readable)&&v(e)||!1!==(null==t?void 0:t.writable)&&I(e))):null},isIterable:function(n,i){return null!=n&&(!0===i?"function"==typeof n[e]:!1===i?"function"==typeof n[t]:"function"==typeof n[e]||"function"==typeof n[t])},isReadableNodeStream:l,isReadableStream:m,isReadableEnded:function(e){if(!l(e))return null;if(!0===e.readableEnded)return!0;const t=e._readableState;return!(!t||t.errored)&&("boolean"!=typeof(null==t?void 0:t.ended)?null:t.ended)},isReadableFinished:b,isReadableErrored:function(e){var t,n;return u(e)?e.readableErrored?e.readableErrored:null!==(t=null===(n=e._readableState)||void 0===n?void 0:n.errored)&&void 0!==t?t:null:null},isNodeStream:u,isWebStream:function(e){return m(e)||h(e)||g(e)},isWritable:I,isWritableNodeStream:p,isWritableStream:h,isWritableEnded:y,isWritableFinished:function(e,t){if(!p(e))return null;if(!0===e.writableFinished)return!0;const n=e._writableState;return(null==n||!n.errored)&&("boolean"!=typeof(null==n?void 0:n.finished)?null:!!(n.finished||!1===t&&!0===n.ended&&0===n.length))},isWritableErrored:function(e){var t,n;return u(e)?e.writableErrored?e.writableErrored:null!==(t=null===(n=e._writableState)||void 0===n?void 0:n.errored)&&void 0!==t?t:null:null},isServerRequest:function(e){var t;return"boolean"==typeof e._consuming&&"boolean"==typeof e._dumped&&void 0===(null===(t=e.req)||void 0===t?void 0:t.upgradeOrConnect)},isServerResponse:w,willEmitClose:function(e){if(!u(e))return null;const t=e._writableState,n=e._readableState,i=t||n;return!i&&w(e)||!!(i&&i.autoDestroy&&i.emitClose&&!1===i.closed)},isTransformStream:g},Ve}function it(){if(Ye)return et.exports;Ye=1;const e=tt(),{AbortError:t,codes:n}=fe(),{ERR_INVALID_ARG_TYPE:i,ERR_STREAM_PREMATURE_CLOSE:s}=n,{kEmptyObject:a,once:o}=Ue(),{validateAbortSignal:r,validateFunction:c,validateObject:d,validateBoolean:l}=He(),{Promise:p,PromisePrototypeThen:u,SymbolDispose:m}=de(),{isClosed:h,isReadable:g,isReadableNodeStream:f,isReadableStream:y,isReadableFinished:b,isReadableErrored:v,isWritable:I,isWritableNodeStream:x,isWritableStream:w,isWritableFinished:S,isWritableErrored:A,isNodeStream:E,willEmitClose:_,kIsClosedPromise:T}=nt();let z;const k=()=>{};function N(n,l,p){var N,C;if(2===arguments.length?(p=l,l=a):null==l?l=a:d(l,"options"),c(p,"callback"),r(l.signal,"options.signal"),p=o(p),y(n)||w(n))return function(n,i,s){let a=!1,r=k;if(i.signal)if(r=()=>{a=!0,s.call(n,new t(void 0,{cause:i.signal.reason}))},i.signal.aborted)e.nextTick(r);else{z=z||Ue().addAbortListener;const e=z(i.signal,r),t=s;s=o((...i)=>{e[m](),t.apply(n,i)})}const c=(...t)=>{a||e.nextTick(()=>s.apply(n,t))};return u(n[T].promise,c,c),k}(n,l,p);if(!E(n))throw new i("stream",["ReadableStream","WritableStream","Stream"],n);const R=null!==(N=l.readable)&&void 0!==N?N:f(n),O=null!==(C=l.writable)&&void 0!==C?C:x(n),j=n._writableState,P=n._readableState,D=()=>{n.writable||q()};let L=_(n)&&f(n)===R&&x(n)===O,M=S(n,!1);const q=()=>{M=!0,n.destroyed&&(L=!1),(!L||n.readable&&!R)&&(R&&!U||p.call(n))};let U=b(n,!1);const $=()=>{U=!0,n.destroyed&&(L=!1),(!L||n.writable&&!O)&&(O&&!M||p.call(n))},B=e=>{p.call(n,e)};let F=h(n);const H=()=>{F=!0;const e=A(n)||v(n);return e&&"boolean"!=typeof e?p.call(n,e):R&&!U&&f(n,!0)&&!b(n,!1)?p.call(n,new s):!O||M||S(n,!1)?void p.call(n):p.call(n,new s)},G=()=>{F=!0;const e=A(n)||v(n);if(e&&"boolean"!=typeof e)return p.call(n,e);p.call(n)},W=()=>{n.req.on("finish",q)};!function(e){return e.setHeader&&"function"==typeof e.abort}(n)?O&&!j&&(n.on("end",D),n.on("close",D)):(n.on("complete",q),L||n.on("abort",H),n.req?W():n.on("request",W)),L||"boolean"!=typeof n.aborted||n.on("aborted",H),n.on("end",$),n.on("finish",q),!1!==l.error&&n.on("error",B),n.on("close",H),F?e.nextTick(H):null!=j&&j.errorEmitted||null!=P&&P.errorEmitted?L||e.nextTick(G):(R||L&&!g(n)||!M&&!1!==I(n))&&(O||L&&!I(n)||!U&&!1!==g(n))?P&&n.req&&n.aborted&&e.nextTick(G):e.nextTick(G);const V=()=>{p=k,n.removeListener("aborted",H),n.removeListener("complete",q),n.removeListener("abort",H),n.removeListener("request",W),n.req&&n.req.removeListener("finish",q),n.removeListener("end",D),n.removeListener("close",D),n.removeListener("finish",q),n.removeListener("end",$),n.removeListener("error",B),n.removeListener("close",H)};if(l.signal&&!F){const i=()=>{const e=p;V(),e.call(n,new t(void 0,{cause:l.signal.reason}))};if(l.signal.aborted)e.nextTick(i);else{z=z||Ue().addAbortListener;const e=z(l.signal,i),t=p;p=o((...i)=>{e[m](),t.apply(n,i)})}}return V}return et.exports=N,et.exports.finished=function(e,t){var n;let i=!1;return null===t&&(t=a),null!==(n=t)&&void 0!==n&&n.cleanup&&(l(t.cleanup,"cleanup"),i=t.cleanup),new p((n,s)=>{const a=N(e,t,e=>{i&&a(),e?s(e):n()})})},et.exports}function st(){if(Je)return Xe;Je=1;const e=tt(),{aggregateTwoErrors:t,codes:{ERR_MULTIPLE_CALLBACK:n},AbortError:i}=fe(),{Symbol:s}=de(),{kIsDestroyed:a,isDestroyed:o,isFinished:r,isServerRequest:c}=nt(),d=s("kDestroy"),l=s("kConstruct");function p(e,t,n){e&&(e.stack,t&&!t.errored&&(t.errored=e),n&&!n.errored&&(n.errored=e))}function u(t,n,i){let s=!1;function a(n){if(s)return;s=!0;const a=t._readableState,o=t._writableState;p(n,o,a),o&&(o.closed=!0),a&&(a.closed=!0),"function"==typeof i&&i(n),n?e.nextTick(m,t,n):e.nextTick(h,t)}try{t._destroy(n||null,a)}catch(n){a(n)}}function m(e,t){g(e,t),h(e)}function h(e){const t=e._readableState,n=e._writableState;n&&(n.closeEmitted=!0),t&&(t.closeEmitted=!0),(null!=n&&n.emitClose||null!=t&&t.emitClose)&&e.emit("close")}function g(e,t){const n=e._readableState,i=e._writableState;null!=i&&i.errorEmitted||null!=n&&n.errorEmitted||(i&&(i.errorEmitted=!0),n&&(n.errorEmitted=!0),e.emit("error",t))}function f(t,n,i){const s=t._readableState,a=t._writableState;if(null!=a&&a.destroyed||null!=s&&s.destroyed)return this;null!=s&&s.autoDestroy||null!=a&&a.autoDestroy?t.destroy(n):n&&(n.stack,a&&!a.errored&&(a.errored=n),s&&!s.errored&&(s.errored=n),i?e.nextTick(g,t,n):g(t,n))}function y(t){let i=!1;function s(s){if(i)return void f(t,null!=s?s:new n);i=!0;const a=t._readableState,o=t._writableState,r=o||a;a&&(a.constructed=!0),o&&(o.constructed=!0),r.destroyed?t.emit(d,s):s?f(t,s,!0):e.nextTick(b,t)}try{t._construct(t=>{e.nextTick(s,t)})}catch(t){e.nextTick(s,t)}}function b(e){e.emit(l)}function v(e){return(null==e?void 0:e.setHeader)&&"function"==typeof e.abort}function I(e){e.emit("close")}function x(t,n){t.emit("error",n),e.nextTick(I,t)}return Xe={construct:function(t,n){if("function"!=typeof t._construct)return;const i=t._readableState,s=t._writableState;i&&(i.constructed=!1),s&&(s.constructed=!1),t.once(l,n),t.listenerCount(l)>1||e.nextTick(y,t)},destroyer:function(t,n){t&&!o(t)&&(n||r(t)||(n=new i),c(t)?(t.socket=null,t.destroy(n)):v(t)?t.abort():v(t.req)?t.req.abort():"function"==typeof t.destroy?t.destroy(n):"function"==typeof t.close?t.close():n?e.nextTick(x,t,n):e.nextTick(I,t),t.destroyed||(t[a]=!0))},destroy:function(e,n){const i=this._readableState,s=this._writableState,a=s||i;return null!=s&&s.destroyed||null!=i&&i.destroyed?("function"==typeof n&&n(),this):(p(e,s,i),s&&(s.destroyed=!0),i&&(i.destroyed=!0),a.constructed?u(this,e,n):this.once(d,function(i){u(this,t(i,e),n)}),this)},undestroy:function(){const e=this._readableState,t=this._writableState;e&&(e.constructed=!0,e.closed=!1,e.closeEmitted=!1,e.destroyed=!1,e.errored=null,e.errorEmitted=!1,e.reading=!1,e.ended=!1===e.readable,e.endEmitted=!1===e.readable),t&&(t.constructed=!0,t.destroyed=!1,t.closed=!1,t.closeEmitted=!1,t.errored=null,t.errorEmitted=!1,t.finalCalled=!1,t.prefinished=!1,t.ended=!1===t.writable,t.ending=!1===t.writable,t.finished=!1===t.writable)},errorOrDestroy:f},Xe}function at(){if(Ze)return Qe;Ze=1;const{ArrayIsArray:e,ObjectSetPrototypeOf:t}=de(),{EventEmitter:n}=u;function i(e){n.call(this,e)}function s(t,n,i){if("function"==typeof t.prependListener)return t.prependListener(n,i);t._events&&t._events[n]?e(t._events[n])?t._events[n].unshift(i):t._events[n]=[i,t._events[n]]:t.on(n,i)}return t(i.prototype,n.prototype),t(i,n),i.prototype.pipe=function(e,t){const i=this;function a(t){e.writable&&!1===e.write(t)&&i.pause&&i.pause()}function o(){i.readable&&i.resume&&i.resume()}i.on("data",a),e.on("drain",o),e._isStdio||t&&!1===t.end||(i.on("end",c),i.on("close",d));let r=!1;function c(){r||(r=!0,e.end())}function d(){r||(r=!0,"function"==typeof e.destroy&&e.destroy())}function l(e){p(),0===n.listenerCount(this,"error")&&this.emit("error",e)}function p(){i.removeListener("data",a),e.removeListener("drain",o),i.removeListener("end",c),i.removeListener("close",d),i.removeListener("error",l),e.removeListener("error",l),i.removeListener("end",p),i.removeListener("close",p),e.removeListener("close",p)}return s(i,"error",l),s(e,"error",l),i.on("end",p),i.on("close",p),e.on("close",p),e.emit("pipe",i),e},Qe={Stream:i,prependListener:s}}var ot,rt,ct,dt,lt,pt={exports:{}};function ut(){return ot||(ot=1,function(e){const{SymbolDispose:t}=de(),{AbortError:n,codes:i}=fe(),{isNodeStream:s,isWebStream:a,kControllerErrorFunction:o}=nt(),r=it(),{ERR_INVALID_ARG_TYPE:c}=i;let d;e.exports.addAbortSignal=function(t,n){if((e=>{if("object"!=typeof e||!("aborted"in e))throw new c("signal","AbortSignal",e)})(t),!s(n)&&!a(n))throw new c("stream",["ReadableStream","WritableStream","Stream"],n);return e.exports.addAbortSignalNoValidate(t,n)},e.exports.addAbortSignalNoValidate=function(e,i){if("object"!=typeof e||!("aborted"in e))return i;const a=s(i)?()=>{i.destroy(new n(void 0,{cause:e.reason}))}:()=>{i[o](new n(void 0,{cause:e.reason}))};if(e.aborted)a();else{d=d||Ue().addAbortListener;const n=d(e,a);r(i,n[t])}return i}}(pt)),pt.exports}function mt(){if(ct)return rt;ct=1;const{StringPrototypeSlice:e,SymbolIterator:t,TypedArrayPrototypeSet:n,Uint8Array:i}=de(),{Buffer:s}=p,{inspect:a}=Ue();return rt=class{constructor(){this.head=null,this.tail=null,this.length=0}push(e){const t={data:e,next:null};this.length>0?this.tail.next=t:this.head=t,this.tail=t,++this.length}unshift(e){const t={data:e,next:this.head};0===this.length&&(this.tail=t),this.head=t,++this.length}shift(){if(0===this.length)return;const e=this.head.data;return 1===this.length?this.head=this.tail=null:this.head=this.head.next,--this.length,e}clear(){this.head=this.tail=null,this.length=0}join(e){if(0===this.length)return"";let t=this.head,n=""+t.data;for(;null!==(t=t.next);)n+=e+t.data;return n}concat(e){if(0===this.length)return s.alloc(0);const t=s.allocUnsafe(e>>>0);let i=this.head,a=0;for(;i;)n(t,i.data,a),a+=i.data.length,i=i.next;return t}consume(e,t){const n=this.head.data;if(e<n.length){const t=n.slice(0,e);return this.head.data=n.slice(e),t}return e===n.length?this.shift():t?this._getString(e):this._getBuffer(e)}first(){return this.head.data}*[t](){for(let e=this.head;e;e=e.next)yield e.data}_getString(t){let n="",i=this.head,s=0;do{const a=i.data;if(!(t>a.length)){t===a.length?(n+=a,++s,i.next?this.head=i.next:this.head=this.tail=null):(n+=e(a,0,t),this.head=i,i.data=e(a,t));break}n+=a,t-=a.length,++s}while(null!==(i=i.next));return this.length-=s,n}_getBuffer(e){const t=s.allocUnsafe(e),a=e;let o=this.head,r=0;do{const s=o.data;if(!(e>s.length)){e===s.length?(n(t,s,a-e),++r,o.next?this.head=o.next:this.head=this.tail=null):(n(t,new i(s.buffer,s.byteOffset,e),a-e),this.head=o,o.data=s.slice(e));break}n(t,s,a-e),e-=s.length,++r}while(null!==(o=o.next));return this.length-=r,t}[Symbol.for("nodejs.util.inspect.custom")](e,t){return a(this,{...t,depth:0,customInspect:!1})}}}function ht(){if(lt)return dt;lt=1;const{MathFloor:e,NumberIsInteger:t}=de(),{validateInteger:n}=He(),{ERR_INVALID_ARG_VALUE:i}=fe().codes;let s=16384,a=16;function o(e){return e?a:s}return dt={getHighWaterMark:function(n,s,a,r){const c=function(e,t,n){return null!=e.highWaterMark?e.highWaterMark:t?e[n]:null}(s,r,a);if(null!=c){if(!t(c)||c<0)throw new i(r?`options.${a}`:"options.highWaterMark",c);return e(c)}return o(n.objectMode)},getDefaultHighWaterMark:o,setDefaultHighWaterMark:function(e,t){n(t,"value",0),e?a=t:s=t}}}var gt,ft,yt,bt,vt,It,xt,wt,St,At,Et,_t,Tt,zt,kt,Nt,Ct,Rt,Ot,jt,Pt,Dt,Lt,Mt,qt,Ut,$t,Bt,Ft={},Ht={exports:{}};function Gt(){if(bt)return yt;bt=1;const e=tt(),{PromisePrototypeThen:t,SymbolAsyncIterator:n,SymbolIterator:i}=de(),{Buffer:s}=p,{ERR_INVALID_ARG_TYPE:a,ERR_STREAM_NULL_VALUES:o}=fe().codes;return yt=function(r,c,d){let l,p;if("string"==typeof c||c instanceof s)return new r({objectMode:!0,...d,read(){this.push(c),this.push(null)}});if(c&&c[n])p=!0,l=c[n]();else{if(!c||!c[i])throw new a("iterable",["Iterable"],c);p=!1,l=c[i]()}const u=new r({objectMode:!0,highWaterMark:1,...d});let m=!1;return u._read=function(){m||(m=!0,async function(){for(;;){try{const{value:e,done:t}=p?await l.next():l.next();if(t)u.push(null);else{const t=e&&"function"==typeof e.then?await e:e;if(null===t)throw m=!1,new o;if(u.push(t))continue;m=!1}}catch(e){u.destroy(e)}break}}())},u._destroy=function(n,i){t(async function(e){const t=null!=e,n="function"==typeof l.throw;if(t&&n){const{value:t,done:n}=await l.throw(e);if(await t,n)return}if("function"==typeof l.return){const{value:e}=await l.return();await e}}(n),()=>e.nextTick(i,n),t=>e.nextTick(i,t||n))},u},yt}function Wt(){if(It)return vt;It=1;const e=tt(),{ArrayPrototypeIndexOf:t,NumberIsInteger:n,NumberIsNaN:i,NumberParseInt:s,ObjectDefineProperties:a,ObjectKeys:o,ObjectSetPrototypeOf:r,Promise:c,SafeSet:d,SymbolAsyncDispose:l,SymbolAsyncIterator:m,Symbol:h}=de();vt=W,W.ReadableState=G;const{EventEmitter:g}=u,{Stream:f,prependListener:y}=at(),{Buffer:b}=p,{addAbortSignal:v}=ut(),I=it();let x=Ue().debuglog("stream",e=>{x=e});const w=mt(),S=st(),{getHighWaterMark:A,getDefaultHighWaterMark:E}=ht(),{aggregateTwoErrors:_,codes:{ERR_INVALID_ARG_TYPE:T,ERR_METHOD_NOT_IMPLEMENTED:z,ERR_OUT_OF_RANGE:k,ERR_STREAM_PUSH_AFTER_EOF:N,ERR_STREAM_UNSHIFT_AFTER_END_EVENT:C},AbortError:R}=fe(),{validateObject:O}=He(),j=h("kPaused"),{StringDecoder:P}=function(){if(ft)return Ft;ft=1;var e=(gt||(gt=1,function(e,t){var n=p,i=n.Buffer;function s(e,t){for(var n in e)t[n]=e[n]}function a(e,t,n){return i(e,t,n)}i.from&&i.alloc&&i.allocUnsafe&&i.allocUnsafeSlow?e.exports=n:(s(n,t),t.Buffer=a),a.prototype=Object.create(i.prototype),s(i,a),a.from=function(e,t,n){if("number"==typeof e)throw new TypeError("Argument must not be a number");return i(e,t,n)},a.alloc=function(e,t,n){if("number"!=typeof e)throw new TypeError("Argument must be a number");var s=i(e);return void 0!==t?"string"==typeof n?s.fill(t,n):s.fill(t):s.fill(0),s},a.allocUnsafe=function(e){if("number"!=typeof e)throw new TypeError("Argument must be a number");return i(e)},a.allocUnsafeSlow=function(e){if("number"!=typeof e)throw new TypeError("Argument must be a number");return n.SlowBuffer(e)}}(Ht,Ht.exports)),Ht.exports).Buffer,t=e.isEncoding||function(e){switch((e=""+e)&&e.toLowerCase()){case"hex":case"utf8":case"utf-8":case"ascii":case"binary":case"base64":case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":case"raw":return!0;default:return!1}};function n(n){var i;switch(this.encoding=function(n){var i=function(e){if(!e)return"utf8";for(var t;;)switch(e){case"utf8":case"utf-8":return"utf8";case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return"utf16le";case"latin1":case"binary":return"latin1";case"base64":case"ascii":case"hex":return e;default:if(t)return;e=(""+e).toLowerCase(),t=!0}}(n);if("string"!=typeof i&&(e.isEncoding===t||!t(n)))throw new Error("Unknown encoding: "+n);return i||n}(n),this.encoding){case"utf16le":this.text=a,this.end=o,i=4;break;case"utf8":this.fillLast=s,i=4;break;case"base64":this.text=r,this.end=c,i=3;break;default:return this.write=d,void(this.end=l)}this.lastNeed=0,this.lastTotal=0,this.lastChar=e.allocUnsafe(i)}function i(e){return e<=127?0:e>>5==6?2:e>>4==14?3:e>>3==30?4:e>>6==2?-1:-2}function s(e){var t=this.lastTotal-this.lastNeed,n=function(e,t){if(128!=(192&t[0]))return e.lastNeed=0,"�";if(e.lastNeed>1&&t.length>1){if(128!=(192&t[1]))return e.lastNeed=1,"�";if(e.lastNeed>2&&t.length>2&&128!=(192&t[2]))return e.lastNeed=2,"�"}}(this,e);return void 0!==n?n:this.lastNeed<=e.length?(e.copy(this.lastChar,t,0,this.lastNeed),this.lastChar.toString(this.encoding,0,this.lastTotal)):(e.copy(this.lastChar,t,0,e.length),void(this.lastNeed-=e.length))}function a(e,t){if((e.length-t)%2==0){var n=e.toString("utf16le",t);if(n){var i=n.charCodeAt(n.length-1);if(i>=55296&&i<=56319)return this.lastNeed=2,this.lastTotal=4,this.lastChar[0]=e[e.length-2],this.lastChar[1]=e[e.length-1],n.slice(0,-1)}return n}return this.lastNeed=1,this.lastTotal=2,this.lastChar[0]=e[e.length-1],e.toString("utf16le",t,e.length-1)}function o(e){var t=e&&e.length?this.write(e):"";if(this.lastNeed){var n=this.lastTotal-this.lastNeed;return t+this.lastChar.toString("utf16le",0,n)}return t}function r(e,t){var n=(e.length-t)%3;return 0===n?e.toString("base64",t):(this.lastNeed=3-n,this.lastTotal=3,1===n?this.lastChar[0]=e[e.length-1]:(this.lastChar[0]=e[e.length-2],this.lastChar[1]=e[e.length-1]),e.toString("base64",t,e.length-n))}function c(e){var t=e&&e.length?this.write(e):"";return this.lastNeed?t+this.lastChar.toString("base64",0,3-this.lastNeed):t}function d(e){return e.toString(this.encoding)}function l(e){return e&&e.length?this.write(e):""}return Ft.StringDecoder=n,n.prototype.write=function(e){if(0===e.length)return"";var t,n;if(this.lastNeed){if(void 0===(t=this.fillLast(e)))return"";n=this.lastNeed,this.lastNeed=0}else n=0;return n<e.length?t?t+this.text(e,n):this.text(e,n):t||""},n.prototype.end=function(e){var t=e&&e.length?this.write(e):"";return this.lastNeed?t+"�":t},n.prototype.text=function(e,t){var n=function(e,t,n){var s=t.length-1;if(s<n)return 0;var a=i(t[s]);return a>=0?(a>0&&(e.lastNeed=a-1),a):--s<n||-2===a?0:(a=i(t[s]))>=0?(a>0&&(e.lastNeed=a-2),a):--s<n||-2===a?0:(a=i(t[s]))>=0?(a>0&&(2===a?a=0:e.lastNeed=a-3),a):0}(this,e,t);if(!this.lastNeed)return e.toString("utf8",t);this.lastTotal=n;var s=e.length-(n-this.lastNeed);return e.copy(this.lastChar,0,s),e.toString("utf8",t,s)},n.prototype.fillLast=function(e){if(this.lastNeed<=e.length)return e.copy(this.lastChar,this.lastTotal-this.lastNeed,0,this.lastNeed),this.lastChar.toString(this.encoding,0,this.lastTotal);e.copy(this.lastChar,this.lastTotal-this.lastNeed,0,e.length),this.lastNeed-=e.length},Ft}(),D=Gt();r(W.prototype,f.prototype),r(W,f);const L=()=>{},{errorOrDestroy:M}=S,q=1,U=16,$=32,B=2048,F=4096;function H(e){return{enumerable:!1,get(){return 0!==(this.state&e)},set(t){t?this.state|=e:this.state&=~e}}}function G(e,t,n){"boolean"!=typeof n&&(n=t instanceof Yt()),this.state=B|F|U|$,e&&e.objectMode&&(this.state|=q),n&&e&&e.readableObjectMode&&(this.state|=q),this.highWaterMark=e?A(this,e,"readableHighWaterMark",n):E(!1),this.buffer=new w,this.length=0,this.pipes=[],this.flowing=null,this[j]=null,e&&!1===e.emitClose&&(this.state&=~B),e&&!1===e.autoDestroy&&(this.state&=~F),this.errored=null,this.defaultEncoding=e&&e.defaultEncoding||"utf8",this.awaitDrainWriters=null,this.decoder=null,this.encoding=null,e&&e.encoding&&(this.decoder=new P(e.encoding),this.encoding=e.encoding)}function W(e){if(!(this instanceof W))return new W(e);const t=this instanceof Yt();this._readableState=new G(e,this,t),e&&("function"==typeof e.read&&(this._read=e.read),"function"==typeof e.destroy&&(this._destroy=e.destroy),"function"==typeof e.construct&&(this._construct=e.construct),e.signal&&!t&&v(e.signal,this)),f.call(this,e),S.construct(this,()=>{this._readableState.needReadable&&Q(this,this._readableState)})}function V(e,t,n,i){x("readableAddChunk",t);const s=e._readableState;let a;if(0===(s.state&q)&&("string"==typeof t?(n=n||s.defaultEncoding,s.encoding!==n&&(i&&s.encoding?t=b.from(t,n).toString(s.encoding):(t=b.from(t,n),n=""))):t instanceof b?n="":f._isUint8Array(t)?(t=f._uint8ArrayToBuffer(t),n=""):null!=t&&(a=new T("chunk",["string","Buffer","Uint8Array"],t))),a)M(e,a);else if(null===t)s.state&=-9,function(e,t){if(x("onEofChunk"),!t.ended){if(t.decoder){const e=t.decoder.end();e&&e.length&&(t.buffer.push(e),t.length+=t.objectMode?1:e.length)}t.ended=!0,t.sync?X(e):(t.needReadable=!1,t.emittedReadable=!0,J(e))}}(e,s);else if(0!==(s.state&q)||t&&t.length>0)if(i)if(4&s.state)M(e,new C);else{if(s.destroyed||s.errored)return!1;K(e,s,t,!0)}else if(s.ended)M(e,new N);else{if(s.destroyed||s.errored)return!1;s.state&=-9,s.decoder&&!n?(t=s.decoder.write(t),s.objectMode||0!==t.length?K(e,s,t,!1):Q(e,s)):K(e,s,t,!1)}else i||(s.state&=-9,Q(e,s));return!s.ended&&(s.length<s.highWaterMark||0===s.length)}function K(e,t,n,i){t.flowing&&0===t.length&&!t.sync&&e.listenerCount("data")>0?(65536&t.state?t.awaitDrainWriters.clear():t.awaitDrainWriters=null,t.dataEmitted=!0,e.emit("data",n)):(t.length+=t.objectMode?1:n.length,i?t.buffer.unshift(n):t.buffer.push(n),64&t.state&&X(e)),Q(e,t)}function Y(e,t){return e<=0||0===t.length&&t.ended?0:0!==(t.state&q)?1:i(e)?t.flowing&&t.length?t.buffer.first().length:t.length:e<=t.length?e:t.ended?t.length:0}function X(t){const n=t._readableState;x("emitReadable",n.needReadable,n.emittedReadable),n.needReadable=!1,n.emittedReadable||(x("emitReadable",n.flowing),n.emittedReadable=!0,e.nextTick(J,t))}function J(e){const t=e._readableState;x("emitReadable_",t.destroyed,t.length,t.ended),t.destroyed||t.errored||!t.length&&!t.ended||(e.emit("readable"),t.emittedReadable=!1),t.needReadable=!t.flowing&&!t.ended&&t.length<=t.highWaterMark,ie(e)}function Q(t,n){!n.readingMore&&n.constructed&&(n.readingMore=!0,e.nextTick(Z,t,n))}function Z(e,t){for(;!t.reading&&!t.ended&&(t.length<t.highWaterMark||t.flowing&&0===t.length);){const n=t.length;if(x("maybeReadMore read 0"),e.read(0),n===t.length)break}t.readingMore=!1}function ee(e){const t=e._readableState;t.readableListening=e.listenerCount("readable")>0,t.resumeScheduled&&!1===t[j]?t.flowing=!0:e.listenerCount("data")>0?e.resume():t.readableListening||(t.flowing=null)}function te(e){x("readable nexttick read 0"),e.read(0)}function ne(e,t){x("resume",t.reading),t.reading||e.read(0),t.resumeScheduled=!1,e.emit("resume"),ie(e),t.flowing&&!t.reading&&e.read(0)}function ie(e){const t=e._readableState;for(x("flow",t.flowing);t.flowing&&null!==e.read(););}function se(e,t){"function"!=typeof e.read&&(e=W.wrap(e,{objectMode:!0}));const n=async function*(e,t){let n,i=L;function s(t){this===e?(i(),i=L):i=t}e.on("readable",s);const a=I(e,{writable:!1},e=>{n=e?_(n,e):null,i(),i=L});try{for(;;){const t=e.destroyed?null:e.read();if(null!==t)yield t;else{if(n)throw n;if(null===n)return;await new c(s)}}}catch(e){throw n=_(n,e),n}finally{!n&&!1===(null==t?void 0:t.destroyOnReturn)||void 0!==n&&!e._readableState.autoDestroy?(e.off("readable",s),a()):S.destroyer(e,null)}}(e,t);return n.stream=e,n}function ae(e,t){if(0===t.length)return null;let n;return t.objectMode?n=t.buffer.shift():!e||e>=t.length?(n=t.decoder?t.buffer.join(""):1===t.buffer.length?t.buffer.first():t.buffer.concat(t.length),t.buffer.clear()):n=t.buffer.consume(e,t.decoder),n}function oe(t){const n=t._readableState;x("endReadable",n.endEmitted),n.endEmitted||(n.ended=!0,e.nextTick(re,n,t))}function re(t,n){if(x("endReadableNT",t.endEmitted,t.length),!t.errored&&!t.closeEmitted&&!t.endEmitted&&0===t.length)if(t.endEmitted=!0,n.emit("end"),n.writable&&!1===n.allowHalfOpen)e.nextTick(ce,n);else if(t.autoDestroy){const e=n._writableState;(!e||e.autoDestroy&&(e.finished||!1===e.writable))&&n.destroy()}}function ce(e){e.writable&&!e.writableEnded&&!e.destroyed&&e.end()}let le;function pe(){return void 0===le&&(le={}),le}return a(G.prototype,{objectMode:H(q),ended:H(2),endEmitted:H(4),reading:H(8),constructed:H(U),sync:H($),needReadable:H(64),emittedReadable:H(128),readableListening:H(256),resumeScheduled:H(512),errorEmitted:H(1024),emitClose:H(B),autoDestroy:H(F),destroyed:H(8192),closed:H(16384),closeEmitted:H(32768),multiAwaitDrain:H(65536),readingMore:H(1<<17),dataEmitted:H(1<<18)}),W.prototype.destroy=S.destroy,W.prototype._undestroy=S.undestroy,W.prototype._destroy=function(e,t){t(e)},W.prototype[g.captureRejectionSymbol]=function(e){this.destroy(e)},W.prototype[l]=function(){let e;return this.destroyed||(e=this.readableEnded?null:new R,this.destroy(e)),new c((t,n)=>I(this,i=>i&&i!==e?n(i):t(null)))},W.prototype.push=function(e,t){return V(this,e,t,!1)},W.prototype.unshift=function(e,t){return V(this,e,t,!0)},W.prototype.isPaused=function(){const e=this._readableState;return!0===e[j]||!1===e.flowing},W.prototype.setEncoding=function(e){const t=new P(e);this._readableState.decoder=t,this._readableState.encoding=this._readableState.decoder.encoding;const n=this._readableState.buffer;let i="";for(const e of n)i+=t.write(e);return n.clear(),""!==i&&n.push(i),this._readableState.length=i.length,this},W.prototype.read=function(e){x("read",e),void 0===e?e=NaN:n(e)||(e=s(e,10));const t=this._readableState,i=e;if(e>t.highWaterMark&&(t.highWaterMark=function(e){if(e>1073741824)throw new k("size","<= 1GiB",e);return e--,e|=e>>>1,e|=e>>>2,e|=e>>>4,e|=e>>>8,e|=e>>>16,++e}(e)),0!==e&&(t.state&=-129),0===e&&t.needReadable&&((0!==t.highWaterMark?t.length>=t.highWaterMark:t.length>0)||t.ended))return x("read: emitReadable",t.length,t.ended),0===t.length&&t.ended?oe(this):X(this),null;if(0===(e=Y(e,t))&&t.ended)return 0===t.length&&oe(this),null;let a,o=!!(64&t.state);if(x("need readable",o),(0===t.length||t.length-e<t.highWaterMark)&&(o=!0,x("length less than watermark",o)),t.ended||t.reading||t.destroyed||t.errored||!t.constructed)o=!1,x("reading, ended or constructing",o);else if(o){x("do read"),t.state|=8|$,0===t.length&&(t.state|=64);try{this._read(t.highWaterMark)}catch(e){M(this,e)}t.state&=~$,t.reading||(e=Y(i,t))}return a=e>0?ae(e,t):null,null===a?(t.needReadable=t.length<=t.highWaterMark,e=0):(t.length-=e,t.multiAwaitDrain?t.awaitDrainWriters.clear():t.awaitDrainWriters=null),0===t.length&&(t.ended||(t.needReadable=!0),i!==e&&t.ended&&oe(this)),null===a||t.errorEmitted||t.closeEmitted||(t.dataEmitted=!0,this.emit("data",a)),a},W.prototype._read=function(e){throw new z("_read()")},W.prototype.pipe=function(t,n){const i=this,s=this._readableState;1===s.pipes.length&&(s.multiAwaitDrain||(s.multiAwaitDrain=!0,s.awaitDrainWriters=new d(s.awaitDrainWriters?[s.awaitDrainWriters]:[]))),s.pipes.push(t),x("pipe count=%d opts=%j",s.pipes.length,n);const a=n&&!1===n.end||t===e.stdout||t===e.stderr?g:o;function o(){x("onend"),t.end()}let r;s.endEmitted?e.nextTick(a):i.once("end",a),t.on("unpipe",function e(n,a){x("onunpipe"),n===i&&a&&!1===a.hasUnpiped&&(a.hasUnpiped=!0,x("cleanup"),t.removeListener("close",m),t.removeListener("finish",h),r&&t.removeListener("drain",r),t.removeListener("error",u),t.removeListener("unpipe",e),i.removeListener("end",o),i.removeListener("end",g),i.removeListener("data",p),c=!0,r&&s.awaitDrainWriters&&(!t._writableState||t._writableState.needDrain)&&r())});let c=!1;function l(){c||(1===s.pipes.length&&s.pipes[0]===t?(x("false write response, pause",0),s.awaitDrainWriters=t,s.multiAwaitDrain=!1):s.pipes.length>1&&s.pipes.includes(t)&&(x("false write response, pause",s.awaitDrainWriters.size),s.awaitDrainWriters.add(t)),i.pause()),r||(r=function(e,t){return function(){const n=e._readableState;n.awaitDrainWriters===t?(x("pipeOnDrain",1),n.awaitDrainWriters=null):n.multiAwaitDrain&&(x("pipeOnDrain",n.awaitDrainWriters.size),n.awaitDrainWriters.delete(t)),n.awaitDrainWriters&&0!==n.awaitDrainWriters.size||!e.listenerCount("data")||e.resume()}}(i,t),t.on("drain",r))}function p(e){x("ondata");const n=t.write(e);x("dest.write",n),!1===n&&l()}function u(e){if(x("onerror",e),g(),t.removeListener("error",u),0===t.listenerCount("error")){const n=t._writableState||t._readableState;n&&!n.errorEmitted?M(t,e):t.emit("error",e)}}function m(){t.removeListener("finish",h),g()}function h(){x("onfinish"),t.removeListener("close",m),g()}function g(){x("unpipe"),i.unpipe(t)}return i.on("data",p),y(t,"error",u),t.once("close",m),t.once("finish",h),t.emit("pipe",i),!0===t.writableNeedDrain?l():s.flowing||(x("pipe resume"),i.resume()),t},W.prototype.unpipe=function(e){const n=this._readableState;if(0===n.pipes.length)return this;if(!e){const e=n.pipes;n.pipes=[],this.pause();for(let t=0;t<e.length;t++)e[t].emit("unpipe",this,{hasUnpiped:!1});return this}const i=t(n.pipes,e);return-1===i||(n.pipes.splice(i,1),0===n.pipes.length&&this.pause(),e.emit("unpipe",this,{hasUnpiped:!1})),this},W.prototype.on=function(t,n){const i=f.prototype.on.call(this,t,n),s=this._readableState;return"data"===t?(s.readableListening=this.listenerCount("readable")>0,!1!==s.flowing&&this.resume()):"readable"===t&&(s.endEmitted||s.readableListening||(s.readableListening=s.needReadable=!0,s.flowing=!1,s.emittedReadable=!1,x("on readable",s.length,s.reading),s.length?X(this):s.reading||e.nextTick(te,this))),i},W.prototype.addListener=W.prototype.on,W.prototype.removeListener=function(t,n){const i=f.prototype.removeListener.call(this,t,n);return"readable"===t&&e.nextTick(ee,this),i},W.prototype.off=W.prototype.removeListener,W.prototype.removeAllListeners=function(t){const n=f.prototype.removeAllListeners.apply(this,arguments);return"readable"!==t&&void 0!==t||e.nextTick(ee,this),n},W.prototype.resume=function(){const t=this._readableState;return t.flowing||(x("resume"),t.flowing=!t.readableListening,function(t,n){n.resumeScheduled||(n.resumeScheduled=!0,e.nextTick(ne,t,n))}(this,t)),t[j]=!1,this},W.prototype.pause=function(){return x("call pause flowing=%j",this._readableState.flowing),!1!==this._readableState.flowing&&(x("pause"),this._readableState.flowing=!1,this.emit("pause")),this._readableState[j]=!0,this},W.prototype.wrap=function(e){let t=!1;e.on("data",n=>{!this.push(n)&&e.pause&&(t=!0,e.pause())}),e.on("end",()=>{this.push(null)}),e.on("error",e=>{M(this,e)}),e.on("close",()=>{this.destroy()}),e.on("destroy",()=>{this.destroy()}),this._read=()=>{t&&e.resume&&(t=!1,e.resume())};const n=o(e);for(let t=1;t<n.length;t++){const i=n[t];void 0===this[i]&&"function"==typeof e[i]&&(this[i]=e[i].bind(e))}return this},W.prototype[m]=function(){return se(this)},W.prototype.iterator=function(e){return void 0!==e&&O(e,"options"),se(this,e)},a(W.prototype,{readable:{__proto__:null,get(){const e=this._readableState;return!(!e||!1===e.readable||e.destroyed||e.errorEmitted||e.endEmitted)},set(e){this._readableState&&(this._readableState.readable=!!e)}},readableDidRead:{__proto__:null,enumerable:!1,get:function(){return this._readableState.dataEmitted}},readableAborted:{__proto__:null,enumerable:!1,get:function(){return!(!1===this._readableState.readable||!this._readableState.destroyed&&!this._readableState.errored||this._readableState.endEmitted)}},readableHighWaterMark:{__proto__:null,enumerable:!1,get:function(){return this._readableState.highWaterMark}},readableBuffer:{__proto__:null,enumerable:!1,get:function(){return this._readableState&&this._readableState.buffer}},readableFlowing:{__proto__:null,enumerable:!1,get:function(){return this._readableState.flowing},set:function(e){this._readableState&&(this._readableState.flowing=e)}},readableLength:{__proto__:null,enumerable:!1,get(){return this._readableState.length}},readableObjectMode:{__proto__:null,enumerable:!1,get(){return!!this._readableState&&this._readableState.objectMode}},readableEncoding:{__proto__:null,enumerable:!1,get(){return this._readableState?this._readableState.encoding:null}},errored:{__proto__:null,enumerable:!1,get(){return this._readableState?this._readableState.errored:null}},closed:{__proto__:null,get(){return!!this._readableState&&this._readableState.closed}},destroyed:{__proto__:null,enumerable:!1,get(){return!!this._readableState&&this._readableState.destroyed},set(e){this._readableState&&(this._readableState.destroyed=e)}},readableEnded:{__proto__:null,enumerable:!1,get(){return!!this._readableState&&this._readableState.endEmitted}}}),a(G.prototype,{pipesCount:{__proto__:null,get(){return this.pipes.length}},paused:{__proto__:null,get(){return!1!==this[j]},set(e){this[j]=!!e}}}),W._fromList=ae,W.from=function(e,t){return D(W,e,t)},W.fromWeb=function(e,t){return pe().newStreamReadableFromReadableStream(e,t)},W.toWeb=function(e,t){return pe().newReadableStreamFromStreamReadable(e,t)},W.wrap=function(e,t){var n,i;return new W({objectMode:null===(n=null!==(i=e.readableObjectMode)&&void 0!==i?i:e.objectMode)||void 0===n||n,...t,destroy(t,n){S.destroyer(e,t),n(t)}}).wrap(e)},vt}function Vt(){if(wt)return xt;wt=1;const e=tt(),{ArrayPrototypeSlice:t,Error:n,FunctionPrototypeSymbolHasInstance:i,ObjectDefineProperty:s,ObjectDefineProperties:a,ObjectSetPrototypeOf:o,StringPrototypeToLowerCase:r,Symbol:c,SymbolHasInstance:d}=de();xt=O,O.WritableState=C;const{EventEmitter:l}=u,m=at().Stream,{Buffer:h}=p,g=st(),{addAbortSignal:f}=ut(),{getHighWaterMark:y,getDefaultHighWaterMark:b}=ht(),{ERR_INVALID_ARG_TYPE:v,ERR_METHOD_NOT_IMPLEMENTED:I,ERR_MULTIPLE_CALLBACK:x,ERR_STREAM_CANNOT_PIPE:w,ERR_STREAM_DESTROYED:S,ERR_STREAM_ALREADY_FINISHED:A,ERR_STREAM_NULL_VALUES:E,ERR_STREAM_WRITE_AFTER_END:_,ERR_UNKNOWN_ENCODING:T}=fe().codes,{errorOrDestroy:z}=g;function k(){}o(O.prototype,m.prototype),o(O,m);const N=c("kOnFinished");function C(e,t,n){"boolean"!=typeof n&&(n=t instanceof Yt()),this.objectMode=!(!e||!e.objectMode),n&&(this.objectMode=this.objectMode||!(!e||!e.writableObjectMode)),this.highWaterMark=e?y(this,e,"writableHighWaterMark",n):b(!1),this.finalCalled=!1,this.needDrain=!1,this.ending=!1,this.ended=!1,this.finished=!1,this.destroyed=!1;const i=!(!e||!1!==e.decodeStrings);this.decodeStrings=!i,this.defaultEncoding=e&&e.defaultEncoding||"utf8",this.length=0,this.writing=!1,this.corked=0,this.sync=!0,this.bufferProcessing=!1,this.onwrite=L.bind(void 0,t),this.writecb=null,this.writelen=0,this.afterWriteTickInfo=null,R(this),this.pendingcb=0,this.constructed=!0,this.prefinished=!1,this.errorEmitted=!1,this.emitClose=!e||!1!==e.emitClose,this.autoDestroy=!e||!1!==e.autoDestroy,this.errored=null,this.closed=!1,this.closeEmitted=!1,this[N]=[]}function R(e){e.buffered=[],e.bufferedIndex=0,e.allBuffers=!0,e.allNoop=!0}function O(e){const t=this instanceof Yt();if(!t&&!i(O,this))return new O(e);this._writableState=new C(e,this,t),e&&("function"==typeof e.write&&(this._write=e.write),"function"==typeof e.writev&&(this._writev=e.writev),"function"==typeof e.destroy&&(this._destroy=e.destroy),"function"==typeof e.final&&(this._final=e.final),"function"==typeof e.construct&&(this._construct=e.construct),e.signal&&f(e.signal,this)),m.call(this,e),g.construct(this,()=>{const e=this._writableState;e.writing||$(this,e),F(this,e)})}function j(t,n,i,s){const a=t._writableState;if("function"==typeof i)s=i,i=a.defaultEncoding;else{if(i){if("buffer"!==i&&!h.isEncoding(i))throw new T(i)}else i=a.defaultEncoding;"function"!=typeof s&&(s=k)}if(null===n)throw new E;if(!a.objectMode)if("string"==typeof n)!1!==a.decodeStrings&&(n=h.from(n,i),i="buffer");else if(n instanceof h)i="buffer";else{if(!m._isUint8Array(n))throw new v("chunk",["string","Buffer","Uint8Array"],n);n=m._uint8ArrayToBuffer(n),i="buffer"}let o;return a.ending?o=new _:a.destroyed&&(o=new S("write")),o?(e.nextTick(s,o),z(t,o,!0),o):(a.pendingcb++,function(e,t,n,i,s){const a=t.objectMode?1:n.length;t.length+=a;const o=t.length<t.highWaterMark;return o||(t.needDrain=!0),t.writing||t.corked||t.errored||!t.constructed?(t.buffered.push({chunk:n,encoding:i,callback:s}),t.allBuffers&&"buffer"!==i&&(t.allBuffers=!1),t.allNoop&&s!==k&&(t.allNoop=!1)):(t.writelen=a,t.writecb=s,t.writing=!0,t.sync=!0,e._write(n,i,t.onwrite),t.sync=!1),o&&!t.errored&&!t.destroyed}(t,a,n,i,s))}function P(e,t,n,i,s,a,o){t.writelen=i,t.writecb=o,t.writing=!0,t.sync=!0,t.destroyed?t.onwrite(new S("write")):n?e._writev(s,t.onwrite):e._write(s,a,t.onwrite),t.sync=!1}function D(e,t,n,i){--t.pendingcb,i(n),U(t),z(e,n)}function L(t,n){const i=t._writableState,s=i.sync,a=i.writecb;"function"==typeof a?(i.writing=!1,i.writecb=null,i.length-=i.writelen,i.writelen=0,n?(n.stack,i.errored||(i.errored=n),t._readableState&&!t._readableState.errored&&(t._readableState.errored=n),s?e.nextTick(D,t,i,n,a):D(t,i,n,a)):(i.buffered.length>i.bufferedIndex&&$(t,i),s?null!==i.afterWriteTickInfo&&i.afterWriteTickInfo.cb===a?i.afterWriteTickInfo.count++:(i.afterWriteTickInfo={count:1,cb:a,stream:t,state:i},e.nextTick(M,i.afterWriteTickInfo)):q(t,i,1,a))):z(t,new x)}function M({stream:e,state:t,count:n,cb:i}){return t.afterWriteTickInfo=null,q(e,t,n,i)}function q(e,t,n,i){for(!t.ending&&!e.destroyed&&0===t.length&&t.needDrain&&(t.needDrain=!1,e.emit("drain"));n-- >0;)t.pendingcb--,i();t.destroyed&&U(t),F(e,t)}function U(e){if(e.writing)return;for(let n=e.bufferedIndex;n<e.buffered.length;++n){var t;const{chunk:i,callback:s}=e.buffered[n],a=e.objectMode?1:i.length;e.length-=a,s(null!==(t=e.errored)&&void 0!==t?t:new S("write"))}const n=e[N].splice(0);for(let t=0;t<n.length;t++){var i;n[t](null!==(i=e.errored)&&void 0!==i?i:new S("end"))}R(e)}function $(e,n){if(n.corked||n.bufferProcessing||n.destroyed||!n.constructed)return;const{buffered:i,bufferedIndex:s,objectMode:a}=n,o=i.length-s;if(!o)return;let r=s;if(n.bufferProcessing=!0,o>1&&e._writev){n.pendingcb-=o-1;const s=n.allNoop?k:e=>{for(let t=r;t<i.length;++t)i[t].callback(e)},a=n.allNoop&&0===r?i:t(i,r);a.allBuffers=n.allBuffers,P(e,n,!0,n.length,a,"",s),R(n)}else{do{const{chunk:t,encoding:s,callback:o}=i[r];i[r++]=null,P(e,n,!1,a?1:t.length,t,s,o)}while(r<i.length&&!n.writing);r===i.length?R(n):r>256?(i.splice(0,r),n.bufferedIndex=0):n.bufferedIndex=r}n.bufferProcessing=!1}function B(e){return e.ending&&!e.destroyed&&e.constructed&&0===e.length&&!e.errored&&0===e.buffered.length&&!e.finished&&!e.writing&&!e.errorEmitted&&!e.closeEmitted}function F(t,n,i){B(n)&&(function(t,n){n.prefinished||n.finalCalled||("function"!=typeof t._final||n.destroyed?(n.prefinished=!0,t.emit("prefinish")):(n.finalCalled=!0,function(t,n){let i=!1;function s(s){if(i)z(t,null!=s?s:x());else if(i=!0,n.pendingcb--,s){const e=n[N].splice(0);for(let t=0;t<e.length;t++)e[t](s);z(t,s,n.sync)}else B(n)&&(n.prefinished=!0,t.emit("prefinish"),n.pendingcb++,e.nextTick(H,t,n))}n.sync=!0,n.pendingcb++;try{t._final(s)}catch(e){s(e)}n.sync=!1}(t,n)))}(t,n),0===n.pendingcb&&(i?(n.pendingcb++,e.nextTick((e,t)=>{B(t)?H(e,t):t.pendingcb--},t,n)):B(n)&&(n.pendingcb++,H(t,n))))}function H(e,t){t.pendingcb--,t.finished=!0;const n=t[N].splice(0);for(let e=0;e<n.length;e++)n[e]();if(e.emit("finish"),t.autoDestroy){const t=e._readableState;(!t||t.autoDestroy&&(t.endEmitted||!1===t.readable))&&e.destroy()}}C.prototype.getBuffer=function(){return t(this.buffered,this.bufferedIndex)},s(C.prototype,"bufferedRequestCount",{__proto__:null,get(){return this.buffered.length-this.bufferedIndex}}),s(O,d,{__proto__:null,value:function(e){return!!i(this,e)||this===O&&e&&e._writableState instanceof C}}),O.prototype.pipe=function(){z(this,new w)},O.prototype.write=function(e,t,n){return!0===j(this,e,t,n)},O.prototype.cork=function(){this._writableState.corked++},O.prototype.uncork=function(){const e=this._writableState;e.corked&&(e.corked--,e.writing||$(this,e))},O.prototype.setDefaultEncoding=function(e){if("string"==typeof e&&(e=r(e)),!h.isEncoding(e))throw new T(e);return this._writableState.defaultEncoding=e,this},O.prototype._write=function(e,t,n){if(!this._writev)throw new I("_write()");this._writev([{chunk:e,encoding:t}],n)},O.prototype._writev=null,O.prototype.end=function(t,i,s){const a=this._writableState;let o;if("function"==typeof t?(s=t,t=null,i=null):"function"==typeof i&&(s=i,i=null),null!=t){const e=j(this,t,i);e instanceof n&&(o=e)}return a.corked&&(a.corked=1,this.uncork()),o||(a.errored||a.ending?a.finished?o=new A("end"):a.destroyed&&(o=new S("end")):(a.ending=!0,F(this,a,!0),a.ended=!0)),"function"==typeof s&&(o||a.finished?e.nextTick(s,o):a[N].push(s)),this},a(O.prototype,{closed:{__proto__:null,get(){return!!this._writableState&&this._writableState.closed}},destroyed:{__proto__:null,get(){return!!this._writableState&&this._writableState.destroyed},set(e){this._writableState&&(this._writableState.destroyed=e)}},writable:{__proto__:null,get(){const e=this._writableState;return!(!e||!1===e.writable||e.destroyed||e.errored||e.ending||e.ended)},set(e){this._writableState&&(this._writableState.writable=!!e)}},writableFinished:{__proto__:null,get(){return!!this._writableState&&this._writableState.finished}},writableObjectMode:{__proto__:null,get(){return!!this._writableState&&this._writableState.objectMode}},writableBuffer:{__proto__:null,get(){return this._writableState&&this._writableState.getBuffer()}},writableEnded:{__proto__:null,get(){return!!this._writableState&&this._writableState.ending}},writableNeedDrain:{__proto__:null,get(){const e=this._writableState;return!!e&&!e.destroyed&&!e.ending&&e.needDrain}},writableHighWaterMark:{__proto__:null,get(){return this._writableState&&this._writableState.highWaterMark}},writableCorked:{__proto__:null,get(){return this._writableState?this._writableState.corked:0}},writableLength:{__proto__:null,get(){return this._writableState&&this._writableState.length}},errored:{__proto__:null,enumerable:!1,get(){return this._writableState?this._writableState.errored:null}},writableAborted:{__proto__:null,enumerable:!1,get:function(){return!(!1===this._writableState.writable||!this._writableState.destroyed&&!this._writableState.errored||this._writableState.finished)}}});const G=g.destroy;let W;function V(){return void 0===W&&(W={}),W}return O.prototype.destroy=function(t,n){const i=this._writableState;return!i.destroyed&&(i.bufferedIndex<i.buffered.length||i[N].length)&&e.nextTick(U,i),G.call(this,t,n),this},O.prototype._undestroy=g.undestroy,O.prototype._destroy=function(e,t){t(e)},O.prototype[l.captureRejectionSymbol]=function(e){this.destroy(e)},O.fromWeb=function(e,t){return V().newStreamWritableFromWritableStream(e,t)},O.toWeb=function(e){return V().newWritableStreamFromStreamWritable(e)},xt}function Kt(){if(At)return St;At=1;const e=tt(),t=p,{isReadable:n,isWritable:i,isIterable:s,isNodeStream:a,isReadableNodeStream:o,isWritableNodeStream:r,isDuplexNodeStream:c,isReadableStream:d,isWritableStream:l}=nt(),u=it(),{AbortError:m,codes:{ERR_INVALID_ARG_TYPE:h,ERR_INVALID_RETURN_VALUE:g}}=fe(),{destroyer:f}=st(),y=Yt(),b=Wt(),v=Vt(),{createDeferredPromise:I}=Ue(),x=Gt(),w=globalThis.Blob||t.Blob,S=void 0!==w?function(e){return e instanceof w}:function(e){return!1},A=globalThis.AbortController||qe.AbortController,{FunctionPrototypeCall:E}=de();class _ extends y{constructor(e){super(e),!1===(null==e?void 0:e.readable)&&(this._readableState.readable=!1,this._readableState.ended=!0,this._readableState.endEmitted=!0),!1===(null==e?void 0:e.writable)&&(this._writableState.writable=!1,this._writableState.ending=!0,this._writableState.ended=!0,this._writableState.finished=!0)}}function T(e){const t=e.readable&&"function"!=typeof e.readable.read?b.wrap(e.readable):e.readable,s=e.writable;let a,o,r,c,d,l=!!n(t),p=!!i(s);function h(e){const t=c;c=null,t?t(e):e&&d.destroy(e)}return d=new _({readableObjectMode:!(null==t||!t.readableObjectMode),writableObjectMode:!(null==s||!s.writableObjectMode),readable:l,writable:p}),p&&(u(s,e=>{p=!1,e&&f(t,e),h(e)}),d._write=function(e,t,n){s.write(e,t)?n():a=n},d._final=function(e){s.end(),o=e},s.on("drain",function(){if(a){const e=a;a=null,e()}}),s.on("finish",function(){if(o){const e=o;o=null,e()}})),l&&(u(t,e=>{l=!1,e&&f(t,e),h(e)}),t.on("readable",function(){if(r){const e=r;r=null,e()}}),t.on("end",function(){d.push(null)}),d._read=function(){for(;;){const e=t.read();if(null===e)return void(r=d._read);if(!d.push(e))return}}),d._destroy=function(e,n){e||null===c||(e=new m),r=null,a=null,o=null,null===c?n(e):(c=n,f(s,e),f(t,e))},d}return St=function t(n,i){if(c(n))return n;if(o(n))return T({readable:n});if(r(n))return T({writable:n});if(a(n))return T({writable:!1,readable:!1});if(d(n))return T({readable:b.fromWeb(n)});if(l(n))return T({writable:v.fromWeb(n)});if("function"==typeof n){const{value:t,write:a,final:o,destroy:r}=function(t){let{promise:n,resolve:i}=I();const s=new A,a=s.signal;return{value:t(async function*(){for(;;){const t=n;n=null;const{chunk:s,done:o,cb:r}=await t;if(e.nextTick(r),o)return;if(a.aborted)throw new m(void 0,{cause:a.reason});({promise:n,resolve:i}=I()),yield s}}(),{signal:a}),write(e,t,n){const s=i;i=null,s({chunk:e,done:!1,cb:n})},final(e){const t=i;i=null,t({done:!0,cb:e})},destroy(e,t){s.abort(),t(e)}}}(n);if(s(t))return x(_,t,{objectMode:!0,write:a,final:o,destroy:r});const c=null==t?void 0:t.then;if("function"==typeof c){let n;const i=E(c,t,e=>{if(null!=e)throw new g("nully","body",e)},e=>{f(n,e)});return n=new _({objectMode:!0,readable:!1,write:a,final(t){o(async()=>{try{await i,e.nextTick(t,null)}catch(n){e.nextTick(t,n)}})},destroy:r})}throw new g("Iterable, AsyncIterable or AsyncFunction",i,t)}if(S(n))return t(n.arrayBuffer());if(s(n))return x(_,n,{objectMode:!0,writable:!1});if(d(null==n?void 0:n.readable)&&l(null==n?void 0:n.writable))return _.fromWeb(n);if("object"==typeof(null==n?void 0:n.writable)||"object"==typeof(null==n?void 0:n.readable))return T({readable:null!=n&&n.readable?o(null==n?void 0:n.readable)?null==n?void 0:n.readable:t(n.readable):void 0,writable:null!=n&&n.writable?r(null==n?void 0:n.writable)?null==n?void 0:n.writable:t(n.writable):void 0});const p=null==n?void 0:n.then;if("function"==typeof p){let e;return E(p,n,t=>{null!=t&&e.push(t),e.push(null)},t=>{f(e,t)}),e=new _({objectMode:!0,writable:!1,read(){}})}throw new h(i,["Blob","ReadableStream","WritableStream","Stream","Iterable","AsyncIterable","Function","{ readable, writable } pair","Promise"],n)}}function Yt(){if(_t)return Et;_t=1;const{ObjectDefineProperties:e,ObjectGetOwnPropertyDescriptor:t,ObjectKeys:n,ObjectSetPrototypeOf:i}=de();Et=o;const s=Wt(),a=Vt();i(o.prototype,s.prototype),i(o,s);{const e=n(a.prototype);for(let t=0;t<e.length;t++){const n=e[t];o.prototype[n]||(o.prototype[n]=a.prototype[n])}}function o(e){if(!(this instanceof o))return new o(e);s.call(this,e),a.call(this,e),e?(this.allowHalfOpen=!1!==e.allowHalfOpen,!1===e.readable&&(this._readableState.readable=!1,this._readableState.ended=!0,this._readableState.endEmitted=!0),!1===e.writable&&(this._writableState.writable=!1,this._writableState.ending=!0,this._writableState.ended=!0,this._writableState.finished=!0)):this.allowHalfOpen=!0}let r,c;function d(){return void 0===r&&(r={}),r}return e(o.prototype,{writable:{__proto__:null,...t(a.prototype,"writable")},writableHighWaterMark:{__proto__:null,...t(a.prototype,"writableHighWaterMark")},writableObjectMode:{__proto__:null,...t(a.prototype,"writableObjectMode")},writableBuffer:{__proto__:null,...t(a.prototype,"writableBuffer")},writableLength:{__proto__:null,...t(a.prototype,"writableLength")},writableFinished:{__proto__:null,...t(a.prototype,"writableFinished")},writableCorked:{__proto__:null,...t(a.prototype,"writableCorked")},writableEnded:{__proto__:null,...t(a.prototype,"writableEnded")},writableNeedDrain:{__proto__:null,...t(a.prototype,"writableNeedDrain")},destroyed:{__proto__:null,get(){return void 0!==this._readableState&&void 0!==this._writableState&&this._readableState.destroyed&&this._writableState.destroyed},set(e){this._readableState&&this._writableState&&(this._readableState.destroyed=e,this._writableState.destroyed=e)}}}),o.fromWeb=function(e,t){return d().newStreamDuplexFromReadableWritablePair(e,t)},o.toWeb=function(e){return d().newReadableWritablePairFromDuplex(e)},o.from=function(e){return c||(c=Kt()),c(e,"body")},Et}function Xt(){if(zt)return Tt;zt=1;const{ObjectSetPrototypeOf:e,Symbol:t}=de();Tt=o;const{ERR_METHOD_NOT_IMPLEMENTED:n}=fe().codes,i=Yt(),{getHighWaterMark:s}=ht();e(o.prototype,i.prototype),e(o,i);const a=t("kCallback");function o(e){if(!(this instanceof o))return new o(e);const t=e?s(this,e,"readableHighWaterMark",!0):null;0===t&&(e={...e,highWaterMark:null,readableHighWaterMark:t,writableHighWaterMark:e.writableHighWaterMark||0}),i.call(this,e),this._readableState.sync=!1,this[a]=null,e&&("function"==typeof e.transform&&(this._transform=e.transform),"function"==typeof e.flush&&(this._flush=e.flush)),this.on("prefinish",c)}function r(e){"function"!=typeof this._flush||this.destroyed?(this.push(null),e&&e()):this._flush((t,n)=>{t?e?e(t):this.destroy(t):(null!=n&&this.push(n),this.push(null),e&&e())})}function c(){this._final!==r&&r.call(this)}return o.prototype._final=r,o.prototype._transform=function(e,t,i){throw new n("_transform()")},o.prototype._write=function(e,t,n){const i=this._readableState,s=this._writableState,o=i.length;this._transform(e,t,(e,t)=>{e?n(e):(null!=t&&this.push(t),s.ended||o===i.length||i.length<i.highWaterMark?n():this[a]=n)})},o.prototype._read=function(){if(this[a]){const e=this[a];this[a]=null,e()}},Tt}function Jt(){if(Nt)return kt;Nt=1;const{ObjectSetPrototypeOf:e}=de();kt=n;const t=Xt();function n(e){if(!(this instanceof n))return new n(e);t.call(this,e)}return e(n.prototype,t.prototype),e(n,t),n.prototype._transform=function(e,t,n){n(null,e)},kt}function Qt(){if(Rt)return Ct;Rt=1;const e=tt(),{ArrayIsArray:t,Promise:n,SymbolAsyncIterator:i,SymbolDispose:s}=de(),a=it(),{once:o}=Ue(),r=st(),c=Yt(),{aggregateTwoErrors:d,codes:{ERR_INVALID_ARG_TYPE:l,ERR_INVALID_RETURN_VALUE:p,ERR_MISSING_ARGS:u,ERR_STREAM_DESTROYED:m,ERR_STREAM_PREMATURE_CLOSE:h},AbortError:g}=fe(),{validateFunction:f,validateAbortSignal:y}=He(),{isIterable:b,isReadable:v,isReadableNodeStream:I,isNodeStream:x,isTransformStream:w,isWebStream:S,isReadableStream:A,isReadableFinished:E}=nt(),_=globalThis.AbortController||qe.AbortController;let T,z,k;function N(e,t,n){let i=!1;return e.on("close",()=>{i=!0}),{destroy:t=>{i||(i=!0,r.destroyer(e,t||new m("pipe")))},cleanup:a(e,{readable:t,writable:n},e=>{i=!e})}}function C(e){if(b(e))return e;if(I(e))return async function*(e){z||(z=Wt()),yield*z.prototype[i].call(e)}(e);throw new l("val",["Readable","Iterable","AsyncIterable"],e)}async function R(e,t,i,{end:s}){let o,r=null;const c=e=>{if(e&&(o=e),r){const e=r;r=null,e()}},l=()=>new n((e,t)=>{o?t(o):r=()=>{o?t(o):e()}});t.on("drain",c);const p=a(t,{readable:!1},c);try{t.writableNeedDrain&&await l();for await(const n of e)t.write(n)||await l();s&&(t.end(),await l()),i()}catch(e){i(o!==e?d(o,e):e)}finally{p(),t.off("drain",c)}}async function O(e,t,n,{end:i}){w(t)&&(t=t.writable);const s=t.getWriter();try{for await(const t of e)await s.ready,s.write(t).catch(()=>{});await s.ready,i&&await s.close(),n()}catch(e){try{await s.abort(e),n(e)}catch(e){n(e)}}}function j(n,i,a){if(1===n.length&&t(n[0])&&(n=n[0]),n.length<2)throw new u("streams");const o=new _,r=o.signal,d=null==a?void 0:a.signal,m=[];function h(){q(new g)}let f,E,z;y(d,"options.signal"),k=k||Ue().addAbortListener,d&&(f=k(d,h));const j=[];let D,L=0;function M(e){q(e,0===--L)}function q(t,n){var a;if(!t||E&&"ERR_STREAM_PREMATURE_CLOSE"!==E.code||(E=t),E||n){for(;j.length;)j.shift()(E);null===(a=f)||void 0===a||a[s](),o.abort(),n&&(E||m.forEach(e=>e()),e.nextTick(i,E,z))}}for(let B=0;B<n.length;B++){const F=n[B],H=B<n.length-1,G=B>0,W=H||!1!==(null==a?void 0:a.end),V=B===n.length-1;if(x(F)){if(W){const{destroy:Y,cleanup:X}=N(F,H,G);j.push(Y),v(F)&&V&&m.push(X)}function K(e){e&&"AbortError"!==e.name&&"ERR_STREAM_PREMATURE_CLOSE"!==e.code&&M(e)}F.on("error",K),v(F)&&V&&m.push(()=>{F.removeListener("error",K)})}if(0===B)if("function"==typeof F){if(D=F({signal:r}),!b(D))throw new p("Iterable, AsyncIterable or Stream","source",D)}else D=b(F)||I(F)||w(F)?F:c.from(F);else if("function"==typeof F){var U;if(D=w(D)?C(null===(U=D)||void 0===U?void 0:U.readable):C(D),D=F(D,{signal:r}),H){if(!b(D,!0))throw new p("AsyncIterable",`transform[${B-1}]`,D)}else{var $;T||(T=Jt());const J=new T({objectMode:!0}),Q=null===($=D)||void 0===$?void 0:$.then;if("function"==typeof Q)L++,Q.call(D,t=>{z=t,null!=t&&J.write(t),W&&J.end(),e.nextTick(M)},t=>{J.destroy(t),e.nextTick(M,t)});else if(b(D,!0))L++,R(D,J,M,{end:W});else{if(!A(D)&&!w(D))throw new p("AsyncIterable or Promise","destination",D);{const te=D.readable||D;L++,R(te,J,M,{end:W})}}D=J;const{destroy:Z,cleanup:ee}=N(D,!1,!0);j.push(Z),V&&m.push(ee)}}else if(x(F)){if(I(D)){L+=2;const ne=P(D,F,M,{end:W});v(F)&&V&&m.push(ne)}else if(w(D)||A(D)){const ie=D.readable||D;L++,R(ie,F,M,{end:W})}else{if(!b(D))throw new l("val",["Readable","Iterable","AsyncIterable","ReadableStream","TransformStream"],D);L++,R(D,F,M,{end:W})}D=F}else if(S(F)){if(I(D))L++,O(C(D),F,M,{end:W});else if(A(D)||b(D))L++,O(D,F,M,{end:W});else{if(!w(D))throw new l("val",["Readable","Iterable","AsyncIterable","ReadableStream","TransformStream"],D);L++,O(D.readable,F,M,{end:W})}D=F}else D=c.from(F)}return(null!=r&&r.aborted||null!=d&&d.aborted)&&e.nextTick(h),D}function P(t,n,i,{end:s}){let o=!1;if(n.on("close",()=>{o||i(new h)}),t.pipe(n,{end:!1}),s){function r(){o=!0,n.end()}E(t)?e.nextTick(r):t.once("end",r)}else i();return a(t,{readable:!0,writable:!1},e=>{const n=t._readableState;e&&"ERR_STREAM_PREMATURE_CLOSE"===e.code&&n&&n.ended&&!n.errored&&!n.errorEmitted?t.once("end",i).once("error",i):i(e)}),a(n,{readable:!1,writable:!0},i)}return Ct={pipelineImpl:j,pipeline:function(...e){return j(e,o(function(e){return f(e[e.length-1],"streams[stream.length - 1]"),e.pop()}(e)))}}}function Zt(){if(jt)return Ot;jt=1;const{pipeline:e}=Qt(),t=Yt(),{destroyer:n}=st(),{isNodeStream:i,isReadable:s,isWritable:a,isWebStream:o,isTransformStream:r,isWritableStream:c,isReadableStream:d}=nt(),{AbortError:l,codes:{ERR_INVALID_ARG_VALUE:p,ERR_MISSING_ARGS:u}}=fe(),m=it();return Ot=function(...h){if(0===h.length)throw new u("streams");if(1===h.length)return t.from(h[0]);const g=[...h];if("function"==typeof h[0]&&(h[0]=t.from(h[0])),"function"==typeof h[h.length-1]){const e=h.length-1;h[e]=t.from(h[e])}for(let e=0;e<h.length;++e)if(i(h[e])||o(h[e])){if(e<h.length-1&&!(s(h[e])||d(h[e])||r(h[e])))throw new p(`streams[${e}]`,g[e],"must be readable");if(e>0&&!(a(h[e])||c(h[e])||r(h[e])))throw new p(`streams[${e}]`,g[e],"must be writable")}let f,y,b,v,I;const x=h[0],w=e(h,function(e){const t=v;v=null,t?t(e):e?I.destroy(e):A||S||I.destroy()}),S=!!(a(x)||c(x)||r(x)),A=!!(s(w)||d(w)||r(w));if(I=new t({writableObjectMode:!(null==x||!x.writableObjectMode),readableObjectMode:!(null==w||!w.readableObjectMode),writable:S,readable:A}),S){if(i(x))I._write=function(e,t,n){x.write(e,t)?n():f=n},I._final=function(e){x.end(),y=e},x.on("drain",function(){if(f){const e=f;f=null,e()}});else if(o(x)){const e=(r(x)?x.writable:x).getWriter();I._write=async function(t,n,i){try{await e.ready,e.write(t).catch(()=>{}),i()}catch(e){i(e)}},I._final=async function(t){try{await e.ready,e.close().catch(()=>{}),y=t}catch(e){t(e)}}}const e=r(w)?w.readable:w;m(e,()=>{if(y){const e=y;y=null,e()}})}if(A)if(i(w))w.on("readable",function(){if(b){const e=b;b=null,e()}}),w.on("end",function(){I.push(null)}),I._read=function(){for(;;){const e=w.read();if(null===e)return void(b=I._read);if(!I.push(e))return}};else if(o(w)){const e=(r(w)?w.readable:w).getReader();I._read=async function(){for(;;)try{const{value:t,done:n}=await e.read();if(!I.push(t))return;if(n)return void I.push(null)}catch{return}}}return I._destroy=function(e,t){e||null===v||(e=new l),b=null,f=null,y=null,null===v?t(e):(v=t,i(w)&&n(w,e))},I},Ot}function en(){if(Lt)return Dt;Lt=1;const{ArrayPrototypePop:e,Promise:t}=de(),{isIterable:n,isNodeStream:i,isWebStream:s}=nt(),{pipelineImpl:a}=Qt(),{finished:o}=it();return tn(),Dt={finished:o,pipeline:function(...o){return new t((t,r)=>{let c,d;const l=o[o.length-1];if(l&&"object"==typeof l&&!i(l)&&!n(l)&&!s(l)){const t=e(o);c=t.signal,d=t.end}a(o,(e,n)=>{e?r(e):t(n)},{signal:c,end:d})})}}}function tn(){if(Mt)return ce.exports;Mt=1;const{Buffer:e}=p,{ObjectDefineProperty:t,ObjectKeys:n,ReflectApply:i}=de(),{promisify:{custom:s}}=Ue(),{streamReturningOperators:a,promiseReturningOperators:o}=function(){if(Pt)return Fe;Pt=1;const e=globalThis.AbortController||qe.AbortController,{codes:{ERR_INVALID_ARG_VALUE:t,ERR_INVALID_ARG_TYPE:n,ERR_MISSING_ARGS:i,ERR_OUT_OF_RANGE:s},AbortError:a}=fe(),{validateAbortSignal:o,validateInteger:r,validateObject:c}=He(),d=de().Symbol("kWeak"),l=de().Symbol("kResistStopPropagation"),{finished:p}=it(),u=Zt(),{addAbortSignalNoValidate:m}=ut(),{isWritable:h,isNodeStream:g}=nt(),{deprecate:f}=Ue(),{ArrayPrototypePush:y,Boolean:b,MathFloor:v,Number:I,NumberIsNaN:x,Promise:w,PromiseReject:S,PromiseResolve:A,PromisePrototypeThen:E,Symbol:_}=de(),T=_("kEmpty"),z=_("kEof");function k(e,t){if("function"!=typeof e)throw new n("fn",["Function","AsyncFunction"],e);null!=t&&c(t,"options"),null!=(null==t?void 0:t.signal)&&o(t.signal,"options.signal");let i=1;null!=(null==t?void 0:t.concurrency)&&(i=v(t.concurrency));let s=i-1;return null!=(null==t?void 0:t.highWaterMark)&&(s=v(t.highWaterMark)),r(i,"options.concurrency",1),r(s,"options.highWaterMark",0),s+=i,async function*(){const n=Ue().AbortSignalAny([null==t?void 0:t.signal].filter(b)),o=this,r=[],c={signal:n};let d,l,p=!1,u=0;function m(){p=!0,h()}function h(){u-=1,g()}function g(){l&&!p&&u<i&&r.length<s&&(l(),l=null)}!async function(){try{for await(let t of o){if(p)return;if(n.aborted)throw new a;try{if(t=e(t,c),t===T)continue;t=A(t)}catch(e){t=S(e)}u+=1,E(t,h,m),r.push(t),d&&(d(),d=null),!p&&(r.length>=s||u>=i)&&await new w(e=>{l=e})}r.push(z)}catch(e){const t=S(e);E(t,h,m),r.push(t)}finally{p=!0,d&&(d(),d=null)}}();try{for(;;){for(;r.length>0;){const e=await r[0];if(e===z)return;if(n.aborted)throw new a;e!==T&&(yield e),r.shift(),g()}await new w(e=>{d=e})}}finally{p=!0,l&&(l(),l=null)}}.call(this)}async function N(e,t=void 0){for await(const n of C.call(this,e,t))return!0;return!1}function C(e,t){if("function"!=typeof e)throw new n("fn",["Function","AsyncFunction"],e);return k.call(this,async function(t,n){return await e(t,n)?t:T},t)}class R extends i{constructor(){super("reduce"),this.message="Reduce of an empty stream requires an initial value"}}function O(e){if(e=I(e),x(e))return 0;if(e<0)throw new s("number",">= 0",e);return e}return Fe.streamReturningOperators={asIndexedPairs:f(function(e=void 0){return null!=e&&c(e,"options"),null!=(null==e?void 0:e.signal)&&o(e.signal,"options.signal"),async function*(){let t=0;for await(const i of this){var n;if(null!=e&&null!==(n=e.signal)&&void 0!==n&&n.aborted)throw new a({cause:e.signal.reason});yield[t++,i]}}.call(this)},"readable.asIndexedPairs will be removed in a future version."),drop:function(e,t=void 0){return null!=t&&c(t,"options"),null!=(null==t?void 0:t.signal)&&o(t.signal,"options.signal"),e=O(e),async function*(){var n;if(null!=t&&null!==(n=t.signal)&&void 0!==n&&n.aborted)throw new a;for await(const n of this){var i;if(null!=t&&null!==(i=t.signal)&&void 0!==i&&i.aborted)throw new a;e--<=0&&(yield n)}}.call(this)},filter:C,flatMap:function(e,t){const n=k.call(this,e,t);return async function*(){for await(const e of n)yield*e}.call(this)},map:k,take:function(e,t=void 0){return null!=t&&c(t,"options"),null!=(null==t?void 0:t.signal)&&o(t.signal,"options.signal"),e=O(e),async function*(){var n;if(null!=t&&null!==(n=t.signal)&&void 0!==n&&n.aborted)throw new a;for await(const n of this){var i;if(null!=t&&null!==(i=t.signal)&&void 0!==i&&i.aborted)throw new a;if(e-- >0&&(yield n),e<=0)return}}.call(this)},compose:function(e,n){if(null!=n&&c(n,"options"),null!=(null==n?void 0:n.signal)&&o(n.signal,"options.signal"),g(e)&&!h(e))throw new t("stream",e,"must be writable");const i=u(this,e);return null!=n&&n.signal&&m(n.signal,i),i}},Fe.promiseReturningOperators={every:async function(e,t=void 0){if("function"!=typeof e)throw new n("fn",["Function","AsyncFunction"],e);return!await N.call(this,async(...t)=>!await e(...t),t)},forEach:async function(e,t){if("function"!=typeof e)throw new n("fn",["Function","AsyncFunction"],e);for await(const n of k.call(this,async function(t,n){return await e(t,n),T},t));},reduce:async function(t,i,s){var r;if("function"!=typeof t)throw new n("reducer",["Function","AsyncFunction"],t);null!=s&&c(s,"options"),null!=(null==s?void 0:s.signal)&&o(s.signal,"options.signal");let u=arguments.length>1;if(null!=s&&null!==(r=s.signal)&&void 0!==r&&r.aborted){const e=new a(void 0,{cause:s.signal.reason});throw this.once("error",()=>{}),await p(this.destroy(e)),e}const m=new e,h=m.signal;if(null!=s&&s.signal){const e={once:!0,[d]:this,[l]:!0};s.signal.addEventListener("abort",()=>m.abort(),e)}let g=!1;try{for await(const e of this){var f;if(g=!0,null!=s&&null!==(f=s.signal)&&void 0!==f&&f.aborted)throw new a;u?i=await t(i,e,{signal:h}):(i=e,u=!0)}if(!g&&!u)throw new R}finally{m.abort()}return i},toArray:async function(e){null!=e&&c(e,"options"),null!=(null==e?void 0:e.signal)&&o(e.signal,"options.signal");const t=[];for await(const i of this){var n;if(null!=e&&null!==(n=e.signal)&&void 0!==n&&n.aborted)throw new a(void 0,{cause:e.signal.reason});y(t,i)}return t},some:N,find:async function(e,t){for await(const n of C.call(this,e,t))return n}},Fe}(),{codes:{ERR_ILLEGAL_CONSTRUCTOR:r}}=fe(),c=Zt(),{setDefaultHighWaterMark:d,getDefaultHighWaterMark:l}=ht(),{pipeline:u}=Qt(),{destroyer:m}=st(),h=it(),g=en(),f=nt(),y=ce.exports=at().Stream;y.isDestroyed=f.isDestroyed,y.isDisturbed=f.isDisturbed,y.isErrored=f.isErrored,y.isReadable=f.isReadable,y.isWritable=f.isWritable,y.Readable=Wt();for(const v of n(a)){const I=a[v];function x(...e){if(new.target)throw r();return y.Readable.from(i(I,this,e))}t(x,"name",{__proto__:null,value:I.name}),t(x,"length",{__proto__:null,value:I.length}),t(y.Readable.prototype,v,{__proto__:null,value:x,enumerable:!1,configurable:!0,writable:!0})}for(const w of n(o)){const S=o[w];function A(...e){if(new.target)throw r();return i(S,this,e)}t(A,"name",{__proto__:null,value:S.name}),t(A,"length",{__proto__:null,value:S.length}),t(y.Readable.prototype,w,{__proto__:null,value:A,enumerable:!1,configurable:!0,writable:!0})}y.Writable=Vt(),y.Duplex=Yt(),y.Transform=Xt(),y.PassThrough=Jt(),y.pipeline=u;const{addAbortSignal:b}=ut();return y.addAbortSignal=b,y.finished=h,y.destroy=m,y.compose=c,y.setDefaultHighWaterMark=d,y.getDefaultHighWaterMark=l,t(y,"promises",{__proto__:null,configurable:!0,enumerable:!0,get:()=>g}),t(u,s,{__proto__:null,enumerable:!0,get:()=>g.pipeline}),t(h,s,{__proto__:null,enumerable:!0,get:()=>g.finished}),y.Stream=y,y._isUint8Array=function(e){return e instanceof Uint8Array},y._uint8ArrayToBuffer=function(t){return e.from(t.buffer,t.byteOffset,t.byteLength)},ce.exports}function nn(){return qt||(qt=1,function(e){const t=l;if(t&&"disable"===process.env.READABLE_STREAM){const n=t.promises;e.exports._uint8ArrayToBuffer=t._uint8ArrayToBuffer,e.exports._isUint8Array=t._isUint8Array,e.exports.isDisturbed=t.isDisturbed,e.exports.isErrored=t.isErrored,e.exports.isReadable=t.isReadable,e.exports.Readable=t.Readable,e.exports.Writable=t.Writable,e.exports.Duplex=t.Duplex,e.exports.Transform=t.Transform,e.exports.PassThrough=t.PassThrough,e.exports.addAbortSignal=t.addAbortSignal,e.exports.finished=t.finished,e.exports.destroy=t.destroy,e.exports.pipeline=t.pipeline,e.exports.compose=t.compose,Object.defineProperty(t,"promises",{configurable:!0,enumerable:!0,get:()=>n}),e.exports.Stream=t.Stream}else{const t=tn(),n=en(),i=t.Readable.destroy;e.exports=t.Readable,e.exports._uint8ArrayToBuffer=t._uint8ArrayToBuffer,e.exports._isUint8Array=t._isUint8Array,e.exports.isDisturbed=t.isDisturbed,e.exports.isErrored=t.isErrored,e.exports.isReadable=t.isReadable,e.exports.Readable=t.Readable,e.exports.Writable=t.Writable,e.exports.Duplex=t.Duplex,e.exports.Transform=t.Transform,e.exports.PassThrough=t.PassThrough,e.exports.addAbortSignal=t.addAbortSignal,e.exports.finished=t.finished,e.exports.destroy=t.destroy,e.exports.destroy=i,e.exports.pipeline=t.pipeline,e.exports.compose=t.compose,Object.defineProperty(t,"promises",{configurable:!0,enumerable:!0,get:()=>n}),e.exports.Stream=t.Stream}e.exports.default=e.exports}(re)),re.exports}var sn=function(){if(Bt)return V.exports;Bt=1;const e=a,{inherits:t,format:n}=o,{pipeline:i,compose:s}=r,l=function(){if(W)return K.exports;W=1;const e=X(),t=J();let n=0;function i(i,s={}){let a=!1;if(void 0!==i.default&&(i=i.default),"function"!=typeof i)throw new TypeError(`fastify-plugin expects a function, instead got a '${typeof i}'`);if("string"==typeof s&&(s={fastify:s}),"object"!=typeof s||Array.isArray(s)||null===s)throw new TypeError("The options object should be an object");if(void 0!==s.fastify&&"string"!=typeof s.fastify)throw new TypeError(`fastify-plugin expects a version string, instead got '${typeof s.fastify}'`);s.name||(a=!0,s.name=e(i)+"-auto-"+n++),i[Symbol.for("skip-override")]=!0!==s.encapsulate,i[Symbol.for("fastify.display-name")]=s.name,i[Symbol.for("plugin-meta")]=s,i.default||(i.default=i);const o=t(s.name);return a||i[o]||(i[o]=i),i}return K.exports=i,K.exports.default=i,K.exports.fastifyPlugin=i,K.exports}(),p=function(){if(Q)return Z.exports;function e(t){if(!new.target)return new e(t);const{supportedValues:n=[],cache:i}=t&&"object"==typeof t&&t||{};this.supportedValues=n,this.cache=i}function t(e,t){if(!e||!Array.isArray(t)||0===t.length)return null;if("*"===e)return t[0];let o=null,r=1/0,c=0;return function(e,t){let o,r="",c=n;for(let d=0,l=e.length;d<l;++d){const l=e[d];if(" "!==l&&"\t"!==l)if(";"!==l){if(","!==l){if(c===s){if("q"===l||"="===l)continue;if("."===l||"1"===l||"0"===l||"2"===l||"3"===l||"4"===l||"5"===l||"6"===l||"7"===l||"8"===l||"9"===l){o+=l;continue}}else if(c===n){c=i,r+=l;continue}if(c===i){const t=e[d-1];" "!==t&&"\t"!==t||(r=""),r+=l;continue}if(t(r,parseFloat(o)||0)){c=a;break}c=n,r=l,o=""}else if(c===i){if(t(r,1)){c=a;break}c=n,r=""}else if(c===s){if(t(r,parseFloat(o)||0)){c=a;break}c=n,r="",o=""}}else c===i&&(c=s,o="")}c===i?t(r,1):c===s&&t(r,parseFloat(o)||0)}(e,function(e,n){if(0===n||c>n)return!1;const i="*"===e&&t[0]||e,s=t.indexOf(i);return-1!==s&&(0===s&&1===n?(o=i,!0):((c<n||r>s)&&(o=i,r=s,c=n),!1))}),o}Q=1,e.prototype.negotiate=function(e){return"string"!=typeof e?null:this.cache?(this.cache.has(e)||this.cache.set(e,t(e,this.supportedValues)),this.cache.get(e)):t(e,this.supportedValues)};const n=0,i=1,s=2,a=3;return Z.exports=t,Z.exports.default=t,Z.exports.negotiate=t,Z.exports.Negotiator=e,Z.exports}(),u=te?ee:(te=1,ee=ie),{Minipass:h}=(ne||(ne=1,function(e){var t=se&&se.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(e,"__esModule",{value:!0}),e.Minipass=e.isWritable=e.isReadable=e.isStream=void 0;const n="object"==typeof process&&process?process:{stdout:null,stderr:null},i=c,s=t(r),a=d;e.isStream=t=>!!t&&"object"==typeof t&&(t instanceof H||t instanceof s.default||(0,e.isReadable)(t)||(0,e.isWritable)(t)),e.isReadable=e=>!!e&&"object"==typeof e&&e instanceof i.EventEmitter&&"function"==typeof e.pipe&&e.pipe!==s.default.Writable.prototype.pipe,e.isWritable=e=>!!e&&"object"==typeof e&&e instanceof i.EventEmitter&&"function"==typeof e.write&&"function"==typeof e.end;const o=Symbol("EOF"),l=Symbol("maybeEmitEnd"),p=Symbol("emittedEnd"),u=Symbol("emittingEnd"),m=Symbol("emittedError"),h=Symbol("closed"),g=Symbol("read"),f=Symbol("flush"),y=Symbol("flushChunk"),b=Symbol("encoding"),v=Symbol("decoder"),I=Symbol("flowing"),x=Symbol("paused"),w=Symbol("resume"),S=Symbol("buffer"),A=Symbol("pipes"),E=Symbol("bufferLength"),_=Symbol("bufferPush"),T=Symbol("bufferShift"),z=Symbol("objectMode"),k=Symbol("destroyed"),N=Symbol("error"),C=Symbol("emitData"),R=Symbol("emitEnd"),O=Symbol("emitEnd2"),j=Symbol("async"),P=Symbol("abort"),D=Symbol("aborted"),L=Symbol("signal"),M=Symbol("dataListeners"),q=Symbol("discarded"),U=e=>Promise.resolve().then(e),$=e=>e();class B{src;dest;opts;ondrain;constructor(e,t,n){this.src=e,this.dest=t,this.opts=n,this.ondrain=()=>e[w](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}}class F extends B{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,n){super(e,t,n),this.proxyErrors=e=>this.dest.emit("error",e),e.on("error",this.proxyErrors)}}class H extends i.EventEmitter{[I]=!1;[x]=!1;[A]=[];[S]=[];[z];[b];[j];[v];[o]=!1;[p]=!1;[u]=!1;[h]=!1;[m]=null;[E]=0;[k]=!1;[L];[D]=!1;[M]=0;[q]=!1;writable=!0;readable=!0;constructor(...e){const t=e[0]||{};if(super(),t.objectMode&&"string"==typeof t.encoding)throw new TypeError("Encoding and objectMode may not be used together");var n;t.objectMode?(this[z]=!0,this[b]=null):!(n=t).objectMode&&n.encoding&&"buffer"!==n.encoding?(this[b]=t.encoding,this[z]=!1):(this[z]=!1,this[b]=null),this[j]=!!t.async,this[v]=this[b]?new a.StringDecoder(this[b]):null,t&&!0===t.debugExposeBuffer&&Object.defineProperty(this,"buffer",{get:()=>this[S]}),t&&!0===t.debugExposePipes&&Object.defineProperty(this,"pipes",{get:()=>this[A]});const{signal:i}=t;i&&(this[L]=i,i.aborted?this[P]():i.addEventListener("abort",()=>this[P]()))}get bufferLength(){return this[E]}get encoding(){return this[b]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[z]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[j]}set async(e){this[j]=this[j]||!!e}[P](){this[D]=!0,this.emit("abort",this[L]?.reason),this.destroy(this[L]?.reason)}get aborted(){return this[D]}set aborted(e){}write(e,t,n){if(this[D])return!1;if(this[o])throw new Error("write after end");if(this[k])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;"function"==typeof t&&(n=t,t="utf8"),t||(t="utf8");const i=this[j]?U:$;if(!this[z]&&!Buffer.isBuffer(e))if(s=e,!Buffer.isBuffer(s)&&ArrayBuffer.isView(s))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if((e=>e instanceof ArrayBuffer||!!e&&"object"==typeof e&&e.constructor&&"ArrayBuffer"===e.constructor.name&&e.byteLength>=0)(e))e=Buffer.from(e);else if("string"!=typeof e)throw new Error("Non-contiguous data written to non-objectMode stream");var s;return this[z]?(this[I]&&0!==this[E]&&this[f](!0),this[I]?this.emit("data",e):this[_](e),0!==this[E]&&this.emit("readable"),n&&i(n),this[I]):e.length?("string"!=typeof e||t===this[b]&&!this[v]?.lastNeed||(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[b]&&(e=this[v].write(e)),this[I]&&0!==this[E]&&this[f](!0),this[I]?this.emit("data",e):this[_](e),0!==this[E]&&this.emit("readable"),n&&i(n),this[I]):(0!==this[E]&&this.emit("readable"),n&&i(n),this[I])}read(e){if(this[k])return null;if(this[q]=!1,0===this[E]||0===e||e&&e>this[E])return this[l](),null;this[z]&&(e=null),this[S].length>1&&!this[z]&&(this[S]=[this[b]?this[S].join(""):Buffer.concat(this[S],this[E])]);const t=this[g](e||null,this[S][0]);return this[l](),t}[g](e,t){if(this[z])this[T]();else{const n=t;e===n.length||null===e?this[T]():"string"==typeof n?(this[S][0]=n.slice(e),t=n.slice(0,e),this[E]-=e):(this[S][0]=n.subarray(e),t=n.subarray(0,e),this[E]-=e)}return this.emit("data",t),this[S].length||this[o]||this.emit("drain"),t}end(e,t,n){return"function"==typeof e&&(n=e,e=void 0),"function"==typeof t&&(n=t,t="utf8"),void 0!==e&&this.write(e,t),n&&this.once("end",n),this[o]=!0,this.writable=!1,!this[I]&&this[x]||this[l](),this}[w](){this[k]||(this[M]||this[A].length||(this[q]=!0),this[x]=!1,this[I]=!0,this.emit("resume"),this[S].length?this[f]():this[o]?this[l]():this.emit("drain"))}resume(){return this[w]()}pause(){this[I]=!1,this[x]=!0,this[q]=!1}get destroyed(){return this[k]}get flowing(){return this[I]}get paused(){return this[x]}[_](e){this[z]?this[E]+=1:this[E]+=e.length,this[S].push(e)}[T](){return this[z]?this[E]-=1:this[E]-=this[S][0].length,this[S].shift()}[f](e=!1){do{}while(this[y](this[T]())&&this[S].length);e||this[S].length||this[o]||this.emit("drain")}[y](e){return this.emit("data",e),this[I]}pipe(e,t){if(this[k])return e;this[q]=!1;const i=this[p];return t=t||{},e===n.stdout||e===n.stderr?t.end=!1:t.end=!1!==t.end,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[A].push(t.proxyErrors?new F(this,e,t):new B(this,e,t)),this[j]?U(()=>this[w]()):this[w]()),e}unpipe(e){const t=this[A].find(t=>t.dest===e);t&&(1===this[A].length?(this[I]&&0===this[M]&&(this[I]=!1),this[A]=[]):this[A].splice(this[A].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){const n=super.on(e,t);if("data"===e)this[q]=!1,this[M]++,this[A].length||this[I]||this[w]();else if("readable"===e&&0!==this[E])super.emit("readable");else if((e=>"end"===e||"finish"===e||"prefinish"===e)(e)&&this[p])super.emit(e),this.removeAllListeners(e);else if("error"===e&&this[m]){const e=t;this[j]?U(()=>e.call(this,this[m])):e.call(this,this[m])}return n}removeListener(e,t){return this.off(e,t)}off(e,t){const n=super.off(e,t);return"data"===e&&(this[M]=this.listeners("data").length,0!==this[M]||this[q]||this[A].length||(this[I]=!1)),n}removeAllListeners(e){const t=super.removeAllListeners(e);return"data"!==e&&void 0!==e||(this[M]=0,this[q]||this[A].length||(this[I]=!1)),t}get emittedEnd(){return this[p]}[l](){this[u]||this[p]||this[k]||0!==this[S].length||!this[o]||(this[u]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[h]&&this.emit("close"),this[u]=!1)}emit(e,...t){const n=t[0];if("error"!==e&&"close"!==e&&e!==k&&this[k])return!1;if("data"===e)return!(!this[z]&&!n)&&(this[j]?(U(()=>this[C](n)),!0):this[C](n));if("end"===e)return this[R]();if("close"===e){if(this[h]=!0,!this[p]&&!this[k])return!1;const e=super.emit("close");return this.removeAllListeners("close"),e}if("error"===e){this[m]=n,super.emit(N,n);const e=!(this[L]&&!this.listeners("error").length)&&super.emit("error",n);return this[l](),e}if("resume"===e){const e=super.emit("resume");return this[l](),e}if("finish"===e||"prefinish"===e){const t=super.emit(e);return this.removeAllListeners(e),t}const i=super.emit(e,...t);return this[l](),i}[C](e){for(const t of this[A])!1===t.dest.write(e)&&this.pause();const t=!this[q]&&super.emit("data",e);return this[l](),t}[R](){return!this[p]&&(this[p]=!0,this.readable=!1,this[j]?(U(()=>this[O]()),!0):this[O]())}[O](){if(this[v]){const e=this[v].end();if(e){for(const t of this[A])t.dest.write(e);this[q]||super.emit("data",e)}}for(const e of this[A])e.end();const e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){const e=Object.assign([],{dataLength:0});this[z]||(e.dataLength=0);const t=this.promise();return this.on("data",t=>{e.push(t),this[z]||(e.dataLength+=t.length)}),await t,e}async concat(){if(this[z])throw new Error("cannot concat in objectMode");const e=await this.collect();return this[b]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(k,()=>t(new Error("stream destroyed"))),this.on("error",e=>t(e)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[q]=!1;let e=!1;const t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();const n=this.read();if(null!==n)return Promise.resolve({done:!1,value:n});if(this[o])return t();let i,s;const a=e=>{this.off("data",r),this.off("end",c),this.off(k,d),t(),s(e)},r=e=>{this.off("error",a),this.off("end",c),this.off(k,d),this.pause(),i({value:e,done:!!this[o]})},c=()=>{this.off("error",a),this.off("data",r),this.off(k,d),t(),i({done:!0,value:void 0})},d=()=>a(new Error("stream destroyed"));return new Promise((e,t)=>{s=t,i=e,this.once(k,d),this.once("error",a),this.once("end",c),this.once("data",r)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[q]=!1;let e=!1;const t=()=>(this.pause(),this.off(N,t),this.off(k,t),this.off("end",t),e=!0,{done:!0,value:void 0});return this.once("end",t),this.once(N,t),this.once(k,t),{next:()=>{if(e)return t();const n=this.read();return null===n?t():{done:!1,value:n}},throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){return this[k]?(e?this.emit("error",e):this.emit(k),this):(this[k]=!0,this[q]=!0,this[S].length=0,this[E]=0,"function"!=typeof this.close||this[h]||this.close(),e?this.emit("error",e):this.emit(k),this)}static get isStream(){return e.isStream}}e.Minipass=H}(se)),se),{Readable:g}=nn(),{computeSyncThreshold:f,isStream:y,isGzip:b,isDeflate:v,intoAsyncIterator:I,isWebReadableStream:x,isFetchResponse:w,webStreamToNodeReadable:S,unwrapFetchResponse:A,createPeekTransform:E}=function(){if($t)return Ut;$t=1;const{Readable:e}=r,{availableParallelism:t}=m,{Transform:n}=nn();return Ut={computeSyncThreshold:function(e=t()){const n=65536>>3*(Math.min(e,4)-1);return Math.min(Math.max(n,4096),65536)},isZstd:function(e){return"object"==typeof e&&null!==e&&e.length>3&&40===e[0]&&181===e[1]&&47===e[2]&&253===e[3]},isGzip:function(e){return"object"==typeof e&&null!==e&&e.length>2&&31===e[0]&&139===e[1]&&8===e[2]},isDeflate:function(e){return"object"==typeof e&&null!==e&&e.length>1&&8==(15&e[0])&&!(128&e[0])&&((e[0]<<8)+e[1])%31==0},isStream:function(e){return null!==e&&"object"==typeof e&&"function"==typeof e.pipe},intoAsyncIterator:async function*(e){if("object"==typeof e){if(Buffer.isBuffer(e))return void(yield e);if(e instanceof ArrayBuffer||ArrayBuffer.isView(e))return void(yield Buffer.from(e));if(Symbol.iterator in e){for(const t of e)yield t;return}if(Symbol.asyncIterator in e){for await(const t of e)yield t;return}}yield e},isWebReadableStream:function(e){return e instanceof ReadableStream},isFetchResponse:function(e){return e instanceof Response},webStreamToNodeReadable:function(t){return e.fromWeb(t)},unwrapFetchResponse:function(e,t){e.code(t.status);for(const[n,i]of t.headers)e.header(n,i);return t.body},createPeekTransform:function(e,t=10){const i=[];let s=0,a=null,o=null;const r=new n({transform:(e,n,o)=>null!==a?a.write(e,n,o):(s+=e.length,i.push(e),s<t?o():void p(o)),flush(e){o=e,null!==a?a.end():p(t=>{t?(o=null,e(t)):a.end()})}});function c(e){r.push(e)}function d(e){r.destroy(e)}function l(){o&&o(),a.off("data",c),a.off("error",d),a.off("end",l),a=null,o=null,r.push(null)}function p(n){const s=Buffer.concat(i);try{a=e(s.subarray(0,t)),a.on("data",c),a.on("error",d),a.on("end",l),a.write(s,n),i.length=0}catch(e){n(e)}}return r}},Ut}(),_=f(),T=ce("FST_CP_ERR_INVALID_CONTENT_ENCODING","Unsupported Content-Encoding: %s",415),z=ce("FST_CP_ERR_INVALID_CONTENT","Could not decompress the request payload using the provided encoding",400);function k(e,t,n){const i=R(t),s=P(t);t.encodings&&t.encodings.length<1?n(new Error("The `encodings` option array must have at least 1 item.")):t.requestEncodings&&t.requestEncodings.length<1?n(new Error("The `requestEncodings` option array must have at least 1 item.")):i.encodings.length<1?n(new Error("None of the passed `encodings` were supported — compression not possible.")):s.encodings.length<1?n(new Error("None of the passed `requestEncodings` were supported — request decompression not possible.")):!s.forceEncoding||s.encodings.includes(s.forceEncoding)?(e.decorateReply("compress",null),e.addHook("onRoute",e=>{if(void 0!==e.compress){if("object"==typeof e.compress){D(0,Object.assign({},i,R(e.compress)),e)}else if(!1!==e.compress)throw new Error("Unknown value for route compress configuration")}else i.global?D(0,i,e):D(0,i,e,!0);if(void 0!==e.decompress){if("object"==typeof e.decompress){L(0,Object.assign({},s,P(e.decompress)),e)}else if(!1!==e.decompress)throw new Error("Unknown value for route decompress configuration")}else s.global&&L(0,s,e)}),n()):n(new Error(`Unsupported decompression encoding ${t.forceRequestEncoding}.`))}const N=/^text\/(?!event-stream)|(?:\+|\/)json(?:;|$)|(?:\+|\/)text(?:;|$)|(?:\+|\/)xml(?:;|$)|octet-stream(?:;|$)/u,C={params:{[e.constants.BROTLI_PARAM_QUALITY]:4}};function R(t){if(!t)return;const n={global:"boolean"==typeof t.globalCompression?t.globalCompression:"boolean"!=typeof t.global||t.global};n.removeContentLengthHeader="boolean"!=typeof t.removeContentLengthHeader||t.removeContentLengthHeader,n.brotliOptions={...C,...t.brotliOptions},n.zlibOptions=t.zlibOptions,n.onUnsupportedEncoding=t.onUnsupportedEncoding,n.inflateIfDeflated=!0===t.inflateIfDeflated,n.threshold="number"==typeof t.threshold?t.threshold:1024,n.syncThreshold="number"==typeof t.syncThreshold?t.syncThreshold:_,n.compressibleTypes=t.customTypes instanceof RegExp?t.customTypes.test.bind(t.customTypes):"function"==typeof t.customTypes?t.customTypes:N.test.bind(N),n.compressStream={br:()=>((t.zlib||e).createBrotliCompress||e.createBrotliCompress)(n.brotliOptions),gzip:()=>((t.zlib||e).createGzip||e.createGzip)(n.zlibOptions),deflate:()=>((t.zlib||e).createDeflate||e.createDeflate)(n.zlibOptions)},"function"==typeof((t.zlib||e).createZstdCompress||e.createZstdCompress)&&(n.compressStream.zstd=()=>((t.zlib||e).createZstdCompress||e.createZstdCompress)(n.zlibOptions)),n.compressSync={};for(const[e,i,s,a]of[["br","createBrotliCompress","brotliCompressSync",n.brotliOptions],["gzip","createGzip","gzipSync",n.zlibOptions],["deflate","createDeflate","deflateSync",n.zlibOptions],["zstd","createZstdCompress","zstdCompressSync",n.zlibOptions]]){const o=O(t.zlib,i,s,a);void 0!==o&&(n.compressSync[e]=o)}n.uncompressStream={br:()=>((t.zlib||e).createBrotliDecompress||e.createBrotliDecompress)(n.brotliOptions),gzip:()=>((t.zlib||e).createGunzip||e.createGunzip)(n.zlibOptions),deflate:()=>((t.zlib||e).createInflate||e.createInflate)(n.zlibOptions)},"function"==typeof((t.zlib||e).createZstdDecompress||e.createZstdDecompress)&&(n.uncompressStream.zstd=()=>((t.zlib||e).createZstdDecompress||e.createZstdDecompress)(n.zlibOptions));const i=["br","gzip","deflate","identity"];return"function"==typeof e.createZstdCompress&&i.unshift("zstd"),n.encodings=Array.isArray(t.encodings)?i.filter(e=>t.encodings.includes(e)).sort((e,n)=>t.encodings.indexOf(e)-t.encodings.indexOf(n)):i,n}function O(t,n,i,s){let a;if(null!=t&&"function"==typeof t[i])a=t[i];else{if(null!=t&&"function"==typeof t[n]||"function"!=typeof e[i])return;a=e[i]}return e=>a(e,s)}function j(e,t,n,i,s){if(e.syncThreshold<=0||s>e.syncThreshold)return null;const a=e.compressSync[n];if(void 0===a)return null;if("string"!=typeof i&&!Buffer.isBuffer(i))return null;if(!1===e.removeContentLengthHeader&&void 0!==t.getHeader("content-length"))return null;const o=Buffer.isBuffer(i)?i:Buffer.from(i);return 0!==Y(o)?o:a(o)}function P(t){if(!t)return;const n=t.zlib||e,i={global:"boolean"==typeof t.globalDecompression?t.globalDecompression:"boolean"!=typeof t.global||t.global,onUnsupportedRequestEncoding:t.onUnsupportedRequestEncoding,onInvalidRequestPayload:t.onInvalidRequestPayload,decompressStream:{br:n.createBrotliDecompress||e.createBrotliDecompress,gzip:n.createGunzip||e.createGunzip,deflate:n.createInflate||e.createInflate},encodings:[],forceEncoding:null};"function"==typeof(n.createZstdDecompress||e.createZstdDecompress)&&(i.decompressStream.zstd=n.createZstdDecompress||e.createZstdDecompress);const s=["br","gzip","deflate","identity"];return"function"==typeof e.createZstdCompress&&s.unshift("zstd"),i.encodings=Array.isArray(t.requestEncodings)?s.filter(e=>t.requestEncodings.includes(e)).sort((e,n)=>t.requestEncodings.indexOf(e)-t.requestEncodings.indexOf(n)):s,t.forceRequestEncoding&&(i.forceEncoding=t.forceRequestEncoding,i.encodings.includes(t.forceRequestEncoding)&&(i.encodings=[t.forceRequestEncoding])),i}function D(e,t,n,s){Array.isArray(n.onRequest)?n.onRequest.push(o):"function"==typeof n.onRequest?n.onRequest=[n.onRequest,o]:n.onRequest=[o];const a=function(e){return function(t){if(null==t)return void this.send(new Error("Internal server error"));if(w(t)){if(null===t.body)return this.send(t);t=A(this,t)}let n,s;const a=void 0!==this.request.headers["x-no-compression"]||!1===G(this.getHeader("Content-Type")||"application/json",e.compressibleTypes)||null==(s=H(e.encodings,this.request))||"identity"===s;if(null==s&&null!=e.onUnsupportedEncoding){const t=this.request.headers["accept-encoding"];let n;try{n=e.onUnsupportedEncoding(t,this.request,this)}catch(e){n=e}return this.send(n)}if(a)return e.inflateIfDeflated&&y(n=ae(t,this.serialize.bind(this)))&&(void 0===s?this.removeHeader("Content-Encoding"):this.header("Content-Encoding","identity"),i(n,t=re(e.uncompressStream),q.bind(this))),this.send(t);if("function"!=typeof t.pipe&&(x(t)?t=S(t):Buffer.isBuffer(t)||"string"==typeof t||(t=this.serialize(t))),"function"!=typeof t.pipe){const n=Buffer.byteLength(t);if(n<e.threshold)return this.send(t);let i=null;try{i=j(e,this,s,t,n)}catch(e){return this.send(e)}if(null!==i)return M(this),this.header("Content-Encoding",s),this.header("Content-Length",i.length),this.send(i);t=g.from(I(t))}return M(this),this.header("Content-Encoding",s),e.removeContentLengthHeader&&this.removeHeader("content-length"),n=oe(e.compressStream,s),i(t,n,q.bind(this)),this.send(n)}}(t);function o(e,t,n){t.compress=a,n()}function r(e,n,s,a){if(w(s)&&(s=A(n,s)),null==s)return a(null,s);const o=n.getHeader("Content-Encoding");if(o&&"identity"!==o)return a(null,s);let r,c;const d=void 0!==e.headers["x-no-compression"]||206===n.statusCode||void 0!==n.getHeader("Content-Range")||!1===G(n.getHeader("Content-Type")||"application/json",t.compressibleTypes)||null==(c=H(t.encodings,e))||"identity"===c;if(null==c&&null!=t.onUnsupportedEncoding){const i=e.headers["accept-encoding"];try{return a(null,t.onUnsupportedEncoding(i,n.request,n))}catch(e){return a(e)}}if(d)return t.inflateIfDeflated&&y(r=ae(s))&&(void 0===c?n.removeHeader("Content-Encoding"):n.header("Content-Encoding","identity"),i(r,s=re(t.uncompressStream),q.bind(n))),a(null,s);if("function"!=typeof s.pipe)if(x(s))s=S(s);else{const e=Buffer.byteLength(s);if(e<t.threshold)return a();let i=null;try{i=j(t,n,c,s,e)}catch(e){return a(e)}if(null!==i)return M(n),n.header("Content-Encoding",c),n.header("Content-Length",i.length),a(null,i);s=g.from(I(s))}M(n),n.header("Content-Encoding",c),t.removeContentLengthHeader&&n.removeHeader("content-length"),r=oe(t.compressStream,c),i(s,r,q.bind(n)),a(null,r)}s||(Array.isArray(n.onSend)?n.onSend.push(r):"function"==typeof n.onSend?n.onSend=[n.onSend,r]:n.onSend=[r])}function L(e,t,n){function s(e,n,s,a){let o=t.forceEncoding;if(o||(o=e.headers["content-encoding"]),!o)return a(null,s);if(!t.encodings.includes(o)){let n;if(t.onUnsupportedRequestEncoding)try{n=t.onUnsupportedRequestEncoding(o,e)}catch{n=void 0}return n||(n=new T(o)),a(n)}if("identity"===o)return a(null,s);const r=t.decompressStream[o]();r.receivedEncodedLength=0,r.on("error",B.bind(this,e,t,o)),r.pause(),s.on("data",U.bind(r)),s.on("end",$),i(s,r,()=>{}),a(null,r)}Array.isArray(n.preParsing)?n.preParsing.unshift(s):"function"==typeof n.preParsing?n.preParsing=[s,n.preParsing]:n.preParsing=[s]}function M(e){if(e.hasHeader("Vary")){const t=e.getHeader("Vary"),n=Array.isArray(t)?t:[t];n.some(e=>e.includes("accept-encoding"))||e.header("Vary",n.concat("accept-encoding").join(", "))}else e.header("Vary","accept-encoding")}function q(e){e&&"ERR_STREAM_PREMATURE_CLOSE"!==e.code&&"premature close"!==e.message&&this.log.error(e)}function U(e){this.receivedEncodedLength+=e.length}function $(){this.removeListener("data",U),this.removeListener("end",$)}function B(e,t,n,i){let s;if(this.log.debug(`compress: invalid request payload - ${i}`),t.onInvalidRequestPayload)try{s=t.onInvalidRequestPayload(n,e,i)}catch{s=void 0}s||(s=new z),i.decompressError=i,Object.assign(i,s)}const F=/\*|x-gzip/gu;function H(e,t){let n=t.headers["accept-encoding"];return null!=n?(n=n.toLowerCase().replace(F,"gzip"),p.negotiate(n,e)):void 0}function G(e,t){if(t(e))return!0;const n=u[e.split(";",1)[0].trim().toLowerCase()];return void 0!==n&&!0===n.compressible}function Y(e){return b(e)?1:v(e)?2:0}function ae(e,t){if(y(e))return e;let n=e,i=e;return ArrayBuffer.isView(e)?n=i=Buffer.from(e.buffer,e.byteOffset,e.byteLength):t&&"string"!=typeof e&&(n=i=t(e)),Buffer.isBuffer(n)?0===Y(n)?i:g.from(I(i)):i}function oe(e,t){return E(function(n){switch(Y(n)){case 1:case 2:return new h}return e[t]()})}function re(e,t){return t>=0||(t=3),E(function(n){if(t<0)throw new Error("Maximum recursion reached");switch(Y(n)){case 1:return s(e.gzip(),re(e,t-1));case 2:return s(e.deflate(),re(e,t-1))}return new h})}function ce(e,i,s){function a(t){Error.captureStackTrace(this,a),this.name="FastifyCompressError",this.code=e,this.message=t?n(i,t):i,this.statusCode=s}return e=e.toUpperCase(),a.prototype[Symbol.toStringTag]="Error",a.prototype.toString=function(){return`${this.name} [${this.code}]: ${this.message}`},t(a,Error),a}return V.exports=l(k,{fastify:"5.x",name:"@fastify/compress"}),V.exports.default=k,V.exports.fastifyCompress=k,V.exports}(),an=$(sn);const on={perMessageDeflate:{threshold:256,serverNoContextTakeover:!0,clientNoContextTakeover:!0,concurrencyLimit:4,zlibDeflateOptions:{level:1}}};function rn(e){return e.readyState===(e.OPEN??1)}function cn(e){const t=Buffer.isBuffer(e)?e.toString("utf8"):"string"==typeof e?e:"";if(Buffer.byteLength(t,"utf8")<=123)return t;let n="";for(const e of t){const t=`${n}${e}`;if(Buffer.byteLength(t,"utf8")>123)break;n=t}return n}function dn(e){if("number"==typeof e&&Number.isInteger(e))return e>=3e3&&e<=4999||e>=1e3&&e<=1014&&1004!==e&&1005!==e&&1006!==e?e:void 0}function ln(e,t,n){e.close(dn(t),cn(n)||void 0)}function pn(e,t,n,i){if(rn(e))for(const e of t.splice(0))if(i(e),!n(e))return}function un(e,t,n={}){const i=n.pendingFrameLimit??256,s=n.maxFrameBytes??8388608,a=n.maxTotalBytes??1073741824,o=n.maxBufferedBytes??16777216;let r=!1,c=rn(t);const d=[],l=[];let p,u=0,m=0,h=0;const g=e=>Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8"),f=(i,o)=>{const r=g(o);return h+=r,n.onFrame?.(i,r),!(r>s||h>a)||(ln(e,1009,"WebSocket bridge traffic limit exceeded."),ln(t,1009,"WebSocket bridge traffic limit exceeded."),!1)},y=()=>{p&&(clearTimeout(p),p=void 0)},b=(n,i)=>{const s=i.bytes;if((n.bufferedAmount??0)+s>o)return ln(e,1013,"WebSocket bridge consumer is too slow."),ln(t,1013,"WebSocket bridge consumer is too slow."),!1;try{return function(e,t){e.send(t.data,{binary:t.isBinary,compress:!1})}(n,i),!0}catch{return ln(e,1011,"WebSocket bridge send failed."),ln(t,1011,"WebSocket bridge send failed."),!1}},v=(n,s,a)=>{if(s.length>=i)return ln(e,1011,"WebSocket bridge pending frame limit exceeded."),void ln(t,1011,"WebSocket bridge pending frame limit exceeded.");const r="upstream"===n?u:m;if((("upstream"===n?t:e).bufferedAmount??0)+r+a.bytes>o)return ln(e,1013,"WebSocket bridge consumer is too slow."),void ln(t,1013,"WebSocket bridge consumer is too slow.");s.push(a),"upstream"===n?u+=a.bytes:m+=a.bytes};return n.upstreamOpenTimeoutMs&&!c&&(p=setTimeout(()=>{c||r||(ln(e,1011,"Upstream websocket did not open."),ln(t))},n.upstreamOpenTimeoutMs)),e.on("open",()=>pn(e,l,t=>b(e,t),e=>{m-=e.bytes})),t.on("open",()=>{y(),c=!0,n.onUpstreamOpen?.(),pn(t,d,e=>b(t,e),e=>{u-=e.bytes})}),e.on("message",(e,n=!1)=>{if(!f("client-to-upstream",e))return;const i={data:e,isBinary:Boolean(n),bytes:g(e)};rn(t)?b(t,i):v("upstream",d,i)}),t.on("message",(t,n=!1)=>{if(!f("upstream-to-client",t))return;const i={data:t,isBinary:Boolean(n),bytes:g(t)};rn(e)?b(e,i):v("client",l,i)}),t.on("close",(t,i)=>{y(),n.onUpstreamClose?.(t,i),(c||r||!n.onUpstreamCloseBeforeOpen?.())&&ln(e,t,i)}),t.on("error",t=>{n.onUpstreamError?.(t),(c||r||!n.onUpstreamErrorBeforeOpen?.(t))&&ln(e)}),e.on("close",(e,i)=>{y(),r=!0,n.onClientClose?.(e,i),ln(t,e,i)}),e.on("error",e=>{y(),r=!0,n.onClientError?.(e),ln(t,1011,"WebSocket bridge client failed.")}),{close:(n,i)=>{y(),ln(t,n,i),ln(e,n,i)}}}const mn=new Set(["authorization","cookie"]),hn=20971520,gn=512e3,fn=gn,yn=hn,bn=41943040,vn=262144,In="ai.sessions",xn="ai-session.snapshot",wn="ai-session.patch",Sn="ai-session.removed",An="ai-session.message-delta",En="ai-session.timeline-item",_n="ai-session.unread.updated",Tn=f.z.string().trim().min(1).max(80),zn=f.z.enum(["app-session","ai-session"]),kn=f.z.enum(["image","file"]),Nn={scopeType:f.z.enum(["session","create-request"]),scopeId:f.z.string().trim().min(1).max(160),kind:kn,name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120)},Cn=f.z.object({...Nn,size:f.z.coerce.number().int().positive().max(hn)}).strict(),Rn=f.z.string().regex(/^cia_[a-f0-9]{24}$/),On=f.z.object({attachmentId:Rn,...Nn,size:f.z.number().int().positive().max(hn)}).strict();f.z.object({offset:f.z.coerce.number().int().nonnegative()}).strict();const jn=f.z.object({attachmentId:Rn,offset:f.z.number().int().nonnegative()}),Pn=f.z.object({id:Rn,kind:kn,name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120),size:f.z.number().int().positive().max(hn),expiresAt:f.z.string().datetime()});function Dn(e){return["image/bmp","image/gif","image/jpeg","image/png","image/webp"].includes(e.split(";",1)[0].trim().toLowerCase())}const Ln=f.z.object({id:f.z.string().trim().min(1).max(120),kind:kn,name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120),size:f.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)}),Mn=f.z.enum(["available","expired","missing"]),qn=Ln.extend({contentState:Mn.default("available")}).strict(),Un=f.z.object({id:f.z.string().trim().min(1).max(240),text:f.z.string(),attachments:f.z.array(qn).max(6).default([])}).strict(),$n=f.z.enum(["running","waiting","idle","failed"]),Bn=f.z.object({instanceId:f.z.string().trim().min(1).max(160),sessionId:f.z.string().trim().min(1).max(120),unread:f.z.boolean(),sessionUpdatedAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict(),Fn=f.z.enum(["thinking","tool","editing","approval","responding","unknown"]),Hn=f.z.object({id:f.z.string().trim().min(1).max(240).optional(),kind:f.z.string().trim().min(1).max(80).optional(),name:f.z.string().trim().min(1).max(120),inputPreview:f.z.string().trim().max(500).optional(),startedAt:f.z.string().datetime().optional()}).strict(),Gn=f.z.enum(["running","completed","failed","waiting"]),Wn=f.z.object({id:f.z.string().trim().min(1).max(240),turnId:f.z.string().trim().min(1).max(240)}).strict(),Vn=Wn.extend({type:f.z.literal("user-message"),text:f.z.string(),attachments:f.z.array(qn).max(6).optional()}).strict(),Kn=Wn.extend({type:f.z.literal("ai-message"),text:f.z.string()}).strict(),Yn=Wn.extend({type:f.z.literal("activity"),activityKind:f.z.string().trim().min(1).max(120),title:f.z.string().trim().min(1).max(240),status:Gn.optional(),summary:f.z.string().max(4e3).optional(),input:f.z.string().max(1e5).optional(),output:f.z.string().max(1e6).optional(),paths:f.z.array(f.z.string().trim().min(1).max(4096)).max(500).optional(),exitCode:f.z.number().int().optional(),durationMs:f.z.number().int().nonnegative().optional()}).strict(),Xn=f.z.discriminatedUnion("type",[Vn,Kn,Yn]),Jn=f.z.object({sessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),items:f.z.array(Xn),generatedAt:f.z.string().datetime()}).strict(),Qn=f.z.object({sessionId:f.z.string().trim().min(1).max(120),turnId:f.z.string().trim().min(1).max(240),items:f.z.array(Xn),generatedAt:f.z.string().datetime()}).strict(),Zn=f.z.enum(["pending-init","running","interrupted","completed","errored","shutdown","not-found"]),ei=f.z.enum(["started","interacted","interrupted"]),ti=f.z.object({threadId:f.z.string().trim().min(1).max(240),path:f.z.string().trim().max(4096).optional(),status:Zn,activity:ei.optional(),message:f.z.string().trim().max(1e3).optional(),updatedAt:f.z.string().datetime()}).strict(),ni=f.z.object({toolCalls:f.z.number().int().min(0).default(0),edits:f.z.number().int().min(0).default(0),approvals:f.z.number().int().min(0).default(0)}).strict().default({toolCalls:0,edits:0,approvals:0}),ii=f.z.object({send:f.z.boolean().optional(),interrupt:f.z.boolean().optional(),approval:f.z.boolean().optional(),fork:f.z.boolean().optional(),openApp:f.z.boolean().optional(),close:f.z.boolean().optional()}).strict(),si=f.z.object({kind:f.z.literal("fork"),parentProviderSessionId:f.z.string().trim().min(1).max(240),throughTurnId:f.z.string().trim().min(1).max(240).optional()}).strict(),ai=f.z.union([Ln.extend({source:f.z.object({type:f.z.literal("inline"),encoding:f.z.literal("base64"),data:f.z.string().min(1).max(31457280)}).strict()}).strict().superRefine((e,t)=>{const n="image"===e.kind?hn:gn;(e.size<=0||("file"===e.kind?e.size>=n:e.size>n))&&t.addIssue({code:f.z.ZodIssueCode.custom,path:["size"],message:`Inline ${e.kind} must be between 1 byte and ${n} bytes.`})}),Ln.extend({source:f.z.object({type:f.z.literal("runtime-path"),path:f.z.string().trim().min(1).max(4096)}).strict()}).strict()]),oi=Ln.extend({sourceType:f.z.enum(["inline","runtime-path"])}).strict(),ri=f.z.union([f.z.object({id:f.z.string().trim().min(1).max(120),kind:kn.optional(),source:f.z.object({type:f.z.literal("upload-ref")}).strict().default({type:"upload-ref"})}).strict(),f.z.object({id:f.z.string().trim().min(1).max(120),kind:kn,name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120),size:f.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),source:f.z.object({type:f.z.literal("runtime-path"),path:f.z.string().trim().min(1).max(4096)}).strict()}).strict()]),ci=f.z.enum(["auto","queue","steer","immediate"]),di=f.z.enum(["ask","auto-review","full-access"]),li=f.z.enum(["review","rename","goal","compact"]),pi=f.z.object({command:li,argument:f.z.string().trim().max(4e3).optional()}).strict().superRefine((e,t)=>{"rename"!==e.command||e.argument||t.addIssue({code:"custom",path:["argument"],message:"Rename requires a thread name."}),"review"!==e.command&&"compact"!==e.command||!e.argument||t.addIssue({code:"custom",path:["argument"],message:`${e.command} does not accept an argument.`})}),ui=f.z.object({command:li,value:f.z.string().max(4e3).optional(),turnId:f.z.string().trim().min(1).max(240).optional()}).strict();f.z.enum(["skill","app","plugin"]);const mi=f.z.object({name:f.z.string().trim().min(1).max(240),path:f.z.string().trim().min(1).max(4096)}),hi=f.z.discriminatedUnion("kind",[mi.extend({kind:f.z.literal("skill"),path:f.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/"),"Skill paths must be absolute.")}).strict(),mi.extend({kind:f.z.literal("app"),path:f.z.string().trim().min(7).max(4096).regex(/^app:\/\/[^\s/]+$/,"App paths must use app://<id>.")}).strict(),mi.extend({kind:f.z.literal("plugin"),path:f.z.string().trim().min(10).max(4096).regex(/^plugin:\/\/[^\s/]+$/,"Plugin paths must use plugin://<id>.")}).strict()]),gi=f.z.array(hi).max(20).default([]),fi=f.z.enum(["plugin","skill","file","directory","app"]),yi=f.z.object({kind:fi,name:f.z.string().trim().min(1).max(240),description:f.z.string().trim().max(1e3).optional(),path:f.z.string().trim().min(1).max(4096),icon:f.z.string().trim().max(4096).optional()}).strict().superRefine((e,t)=>{"skill"!==e.kind||e.path.startsWith("/")||t.addIssue({code:"custom",path:["path"],message:"Skill paths must be absolute."}),"app"!==e.kind||/^app:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"App paths must use app://<id>."}),"plugin"!==e.kind||/^plugin:\/\/[^\s/]+$/.test(e.path)||t.addIssue({code:"custom",path:["path"],message:"Plugin paths must use plugin://<id>."}),"file"!==e.kind&&"directory"!==e.kind||!e.path.startsWith("/")&&!e.path.split(/[\\/]+/).includes("..")||t.addIssue({code:"custom",path:["path"],message:"File and directory paths must be relative to the session cwd."})}),bi=f.z.object({category:f.z.enum(["skills","plugins","apps","files"]),code:f.z.string().trim().min(1).max(160),message:f.z.string().trim().min(1).max(2e3)}).strict(),vi=f.z.object({sessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),cwd:f.z.string().trim().min(1).max(4096),candidates:f.z.array(yi).max(1e3).default([]),diagnostics:f.z.array(bi).max(20).default([])}).strict(),Ii=f.z.object({query:f.z.string().trim().max(240).default("")}).strict(),xi=f.z.object({sessionId:f.z.string().trim().min(1).max(120),cwd:f.z.string().trim().min(1).max(4096),query:f.z.string().trim().max(240),requestId:f.z.string().trim().min(1).max(160),candidates:f.z.array(yi.refine(e=>"file"===e.kind||"directory"===e.kind,"File search only returns files and directories.")).max(200).default([]),complete:f.z.boolean().default(!1)}).strict(),wi=f.z.object({message:f.z.string().trim().min(1).max(2e4),mode:ci.optional(),permissionMode:di.optional()}),Si=wi.extend({attachments:f.z.array(ai).max(6).default([]),references:gi}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>bn&&t.addIssue({code:f.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),Ai=wi.extend({attachments:f.z.array(ri).max(6).default([]),references:gi}).strict(),Ei=f.z.object({type:f.z.literal("runtime-path"),path:f.z.string().trim().min(1).max(4096).refine(e=>e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e),"Runtime paths must be absolute in the target controlled instance.")}).strict(),_i=f.z.object({modelEntityId:f.z.string().trim().min(1).max(120),modelName:f.z.string().trim().min(1).max(240)}).strict(),Ti=f.z.enum(["none","minimal","low","medium","high","xhigh","max","ultra"]),zi=Si.extend({agent:Tn,cwd:Ei,cwdFolderId:f.z.string().trim().min(1).max(120).optional(),clientRequestId:f.z.string().trim().min(1).max(160),modelSelection:_i.optional(),reasoningEffort:Ti.optional()}).strict(),ki=f.z.object({mode:f.z.enum(["current-folder","worktree"]),branch:f.z.string().trim().min(1).max(1024)}).strict(),Ni=Ai.extend({agent:Tn,cwdFolderId:f.z.string().trim().min(1).max(120).optional(),gitSelection:ki.optional(),clientRequestId:f.z.string().trim().min(1).max(160),modelSelection:_i.optional(),reasoningEffort:Ti.optional()}).strict(),Ci=f.z.object({clientRequestId:f.z.string().trim().min(1).max(160),modelSelection:_i}).strict(),Ri=f.z.object({sessionId:f.z.string().trim().min(1).max(120),accepted:f.z.literal(!0)}).strict(),Oi=f.z.object({clientRequestId:f.z.string().trim().min(1).max(160),reasoningEffort:Ti}).strict(),ji=f.z.object({sessionId:f.z.string().trim().min(1).max(120),accepted:f.z.literal(!0)}).strict(),Pi=f.z.object({disposition:f.z.enum(["created","already-created"]),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),creationSource:f.z.literal("ai-session")}).strict(),Di=f.z.object({mode:f.z.enum(["current","managed-worktree"]).default("current")}).strict().default({mode:"current"}),Li=f.z.object({clientRequestId:f.z.string().trim().min(1).max(160),throughTurnId:f.z.string().trim().min(1).max(240).optional(),workspace:Di.optional().default({mode:"current"})}).strict(),Mi=f.z.object({disposition:f.z.enum(["created","already-created"]),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),creationSource:f.z.literal("ai-session")}).strict(),qi=f.z.object({clientRequestId:f.z.string().trim().min(1).max(160)}).strict(),Ui=f.z.object({disposition:f.z.enum(["opened","already-open"]),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),appSessionId:f.z.string().trim().min(1).max(120),creationSource:zn}).strict(),$i=f.z.object({clientRequestId:f.z.string().trim().min(1).max(160)}).strict(),Bi=f.z.object({disposition:f.z.enum(["closed","already-closed"]),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),creationSource:zn}).strict();f.z.object({code:f.z.enum(["invalid-request","not-found","unsupported","provider-unavailable","materialization-failed","open-app-failed","close-failed","conflict"]),message:f.z.string().trim().min(1).max(4e3),retryable:f.z.boolean().default(!1),aiSessionId:f.z.string().trim().min(1).max(120).optional(),providerSessionId:f.z.string().trim().min(1).max(240).optional()}).strict();const Fi=f.z.object({decision:f.z.enum(["allow","deny","skip"])}).strict(),Hi=f.z.object({expectedRevision:f.z.number().int().min(0),queueIds:f.z.array(f.z.string().trim().min(1).max(120)).max(100)}).strict(),Gi=f.z.object({expectedRevision:f.z.number().int().min(0),message:f.z.string().trim().min(1).max(2e4)}).strict();f.z.object({code:f.z.string().trim().min(1).max(160),message:f.z.string(),instanceId:f.z.string().trim().min(1).max(160).optional(),nodeId:f.z.string().trim().min(1).max(160).optional(),route:f.z.string().trim().min(1).max(4096).optional()}).strict();const Wi=f.z.object({id:f.z.string().trim().min(1).max(120),messageId:f.z.string().trim().min(1).max(240).optional(),message:f.z.string().trim().min(1).max(2e4),attachments:f.z.array(oi).max(6).default([]),references:gi,permissionMode:di.optional(),status:f.z.enum(["queued","sending","failed"]).default("queued"),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime(),error:f.z.string().trim().max(4e3).optional()}).strict(),Vi=f.z.object({revision:f.z.number().int().min(0).default(0),pendingCount:f.z.number().int().min(0).default(0),items:f.z.array(Wi).max(100).default([])}).strict().default({revision:0,pendingCount:0,items:[]}),Ki=f.z.enum(["control","realtime","adapter-snapshot","transcript-tail","transcript-scan","process-scan","app-session"]),Yi=f.z.object({id:f.z.string().trim().min(1).max(240),status:f.z.enum(["running","completed"]),startedAt:f.z.string().datetime().optional(),completedAt:f.z.string().datetime().optional()}).strict(),Xi=f.z.object({id:f.z.string().trim().min(1).max(240),providerTurnId:f.z.string().trim().max(240).optional(),source:Ki.optional(),userPrompt:f.z.string().trim().optional(),userMessages:f.z.array(Un).max(100).optional(),status:f.z.enum(["queued","running","waiting","completed","failed"]).default("running"),phase:Fn.optional(),summary:f.z.string().trim().max(1e3).optional(),lastMessage:f.z.string().trim().optional(),lastMessageItemId:f.z.string().trim().max(240).optional(),contextCompactions:f.z.array(Yi).max(20).optional(),revision:f.z.number().int().min(0).default(0),sourcePriority:f.z.number().int().min(0).max(100).optional(),snapshotVersion:f.z.number().int().min(0).optional(),observedAt:f.z.string().datetime().optional(),startedAt:f.z.string().datetime().optional(),updatedAt:f.z.string().datetime().optional(),completedAt:f.z.string().datetime().optional()}).strict(),Ji=Xi.pick({id:!0,providerTurnId:!0,userPrompt:!0,userMessages:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,contextCompactions:!0,startedAt:!0,updatedAt:!0,completedAt:!0}).strict(),Qi=f.z.object({id:f.z.string().trim().min(1).max(120),agent:Tn,creationSource:zn.default("app-session"),appSessionId:f.z.string().trim().max(120).optional(),appId:f.z.string().trim().max(120).optional(),providerSessionId:f.z.string().trim().max(240).optional(),lineage:si.optional(),providerMeta:f.z.record(f.z.string(),f.z.unknown()).optional(),modelSelection:_i.optional(),reasoningEffort:Ti.optional(),appBindingKeys:f.z.array(f.z.string().trim().min(1).max(240)).max(20).optional(),actions:ii.optional(),activeTurnId:f.z.string().trim().max(240).optional(),title:f.z.string().trim().max(240).optional(),cwd:f.z.string().trim().max(4096).optional(),cwdFolderId:f.z.string().trim().min(1).max(120).optional(),userPrompt:f.z.string().trim().optional(),turns:f.z.array(Xi).max(50).optional(),status:$n.default("running"),phase:Fn.default("unknown"),summary:f.z.string().trim().max(1e3).optional(),lastMessage:f.z.string().trim().optional(),lastMessageItemId:f.z.string().trim().max(240).optional(),currentTool:Hn.optional(),toolCallsSinceLastMessage:f.z.number().int().min(0).default(0),subAgents:f.z.array(ti).max(50).default([]),transcriptPath:f.z.string().trim().max(4096).optional(),transcriptSize:f.z.number().int().min(0).optional(),startedAt:f.z.string().datetime(),updatedAt:f.z.string().datetime(),completedAt:f.z.string().datetime().optional(),error:f.z.string().trim().max(4e3).optional(),counters:ni,queue:Vi}).strict(),Zi=Qi.pick({id:!0,appBindingKeys:!0,cwd:!0,error:!0,providerMeta:!0,modelSelection:!0,reasoningEffort:!0,queue:!0,subAgents:!0}).strict(),es=Xi.pick({id:!0,providerTurnId:!0,status:!0,phase:!0,revision:!0,startedAt:!0,updatedAt:!0,completedAt:!0}).extend({bodyRevision:f.z.string().trim().min(1).max(64)}).strict(),ts=f.z.object({sessionId:f.z.string().trim().min(1).max(120),revision:f.z.string().trim().min(1).max(64),turns:f.z.array(es).max(50)}).strict(),ns=f.z.object({sessionId:f.z.string().trim().min(1).max(120),revision:f.z.string().trim().min(1).max(64),turn:Xi}).strict(),is=f.z.string().trim().min(1).max(64),ss=f.z.object({kind:f.z.literal("not-modified"),revision:is}).strict(),as=f.z.discriminatedUnion("kind",[ss,f.z.object({kind:f.z.literal("updated"),revision:is,detail:Zi}).strict()]),os=f.z.discriminatedUnion("kind",[ss,f.z.object({kind:f.z.literal("updated"),revision:is,index:ts}).strict()]),rs=f.z.discriminatedUnion("kind",[ss,f.z.object({kind:f.z.literal("updated"),revision:is,body:ns}).strict()]),cs=f.z.object({session:Qi,provider:f.z.string().trim().min(1).max(80),action:f.z.enum(["send","queue","steer","interrupt","approval"]),decision:f.z.enum(["allow","deny","skip"]).optional(),turnId:f.z.string().trim().min(1).max(240).optional(),providerTurnId:f.z.string().trim().min(1).max(240).optional(),queueId:f.z.string().trim().min(1).max(120).optional()}).strict(),ds=cs.omit({session:!0}).extend({sessionId:f.z.string().trim().min(1).max(120),messageId:f.z.string().trim().min(1).max(240).optional()}).strict(),ls=f.z.object({sessionId:f.z.string().trim().min(1).max(120),queueRevision:f.z.number().int().min(0),action:f.z.enum(["retry","remove","edit","reorder"]),queueId:f.z.string().trim().min(1).max(120).optional()}).strict(),ps=f.z.union([ds,cs.transform(function(e){const t=e.session.turns?.at(-1),n=(e.queueId?e.session.queue?.items.find(t=>t.id===e.queueId)?.messageId:void 0)||("send"===e.action||"queue"===e.action||"steer"===e.action?t?.userMessages?.at(-1)?.id:void 0);return ds.parse({sessionId:e.session.id,provider:e.provider,action:e.action,...e.decision?{decision:e.decision}:{},...e.turnId||e.session.activeTurnId||t?.id?{turnId:e.turnId||e.session.activeTurnId||t?.id}:{},...e.providerTurnId||t?.providerTurnId?{providerTurnId:e.providerTurnId||t?.providerTurnId}:{},...e.queueId?{queueId:e.queueId}:{},...n?{messageId:n}:{}})})]),us=500,ms=f.z.object({id:f.z.string().trim().min(1).max(120),agent:Tn,creationSource:zn,providerSessionId:f.z.string().trim().min(1).max(240),lineage:si.optional(),modelSelection:_i.optional(),reasoningEffort:Ti.optional(),title:f.z.string().trim().max(240).optional(),userPrompt:f.z.string().trim().optional(),lastMessage:f.z.string().trim().optional(),cwd:f.z.string().trim().min(1).max(4096),cwdFolderId:f.z.string().trim().min(1).max(120).optional(),lastActiveAt:f.z.string().datetime(),archivedAt:f.z.string().datetime()}).strict();f.z.object({schemaVersion:f.z.literal(1).default(1),items:f.z.array(ms).max(us).default([])}).strict();const hs=f.z.object({items:f.z.array(ms).max(us).default([])}).strict(),gs=f.z.object({item:ms,turns:f.z.array(Ji).max(50).default([])}).strict(),fs=f.z.object({disposition:f.z.enum(["resumed","already-open"]),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),appSessionId:f.z.string().trim().min(1).max(120).optional(),creationSource:zn}).strict(),ys=Xi.omit({userMessages:!0}),bs=Qi.pick({id:!0,agent:!0,creationSource:!0,appSessionId:!0,appId:!0,providerSessionId:!0,lineage:!0,providerMeta:!0,modelSelection:!0,reasoningEffort:!0,appBindingKeys:!0,actions:!0,activeTurnId:!0,title:!0,cwd:!0,cwdFolderId:!0,userPrompt:!0,turns:!0,status:!0,phase:!0,summary:!0,lastMessage:!0,lastMessageItemId:!0,currentTool:!0,toolCallsSinceLastMessage:!0,subAgents:!0,queue:!0,startedAt:!0,updatedAt:!0,error:!0}).extend({turns:f.z.array(ys).max(50).optional(),detailRevision:f.z.string().trim().min(1).max(64).optional(),turnsRevision:f.z.string().trim().min(1).max(64).optional(),latestTurnRef:f.z.object({id:Xi.shape.id,bodyRevision:f.z.string().trim().min(1).max(64)}).strict().optional(),turnCount:f.z.number().int().min(0).optional(),subAgentCount:f.z.number().int().min(0).optional(),lastUserMessageAt:f.z.string().datetime().optional()}).strict(),vs=f.z.object({runningCount:f.z.number().int().min(0).default(0),waitingCount:f.z.number().int().min(0).default(0),staleCount:f.z.number().int().min(0).default(0),sessions:f.z.array(bs).default([]),updatedAt:f.z.string().datetime()}).strict(),Is=f.z.object({streamId:f.z.string().trim().min(1).max(240),revision:f.z.number().int().min(0),lastEventAt:f.z.string().datetime(),snapshot:vs}).strict(),xs=vs.pick({runningCount:!0,waitingCount:!0,staleCount:!0,updatedAt:!0}).extend({idleCount:f.z.number().int().min(0).default(0),problemCount:f.z.number().int().min(0).default(0),revision:f.z.number().int().min(0).optional()});function ws(e,t={}){const n=e.sessions.filter(e=>"idle"===e.status).length,i=e.sessions.filter(e=>"failed"===e.status).length;return xs.parse({runningCount:e.runningCount,waitingCount:e.waitingCount,staleCount:e.staleCount,idleCount:n,problemCount:i,updatedAt:e.updatedAt,revision:t.revision})}const Ss=f.z.enum(["provider-event","app-session-created","app-session-updated","app-session-deleted","discovery-scan","control-action","heartbeat-sync","startup"]),As=f.z.object({streamId:f.z.string().trim().min(1).max(240),instanceId:f.z.string().trim().min(1).max(160),nodeId:f.z.string().trim().min(1).max(160).optional(),revision:f.z.number().int().min(0),previousRevision:f.z.number().int().min(0).optional(),traceId:f.z.string().trim().min(1).max(160),generatedAt:f.z.string().datetime(),reason:Ss}).strict(),Es=f.z.object({meta:As,snapshot:vs}).strict(),_s=f.z.object({meta:As,upserted:f.z.array(bs).default([]),removed:f.z.array(f.z.string().trim().min(1).max(120)).default([])}).strict(),Ts=f.z.object({meta:As,sessionIds:f.z.array(f.z.string().trim().min(1).max(120)).default([]),expiresAt:f.z.string().datetime()}).strict(),zs=f.z.object({instanceId:f.z.string().trim().min(1).max(160),nodeId:f.z.string().trim().min(1).max(160).optional(),sessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240).optional(),turnId:f.z.string().trim().min(1).max(240),itemId:f.z.string().trim().min(1).max(240),delta:f.z.string().min(1),generatedAt:f.z.string().datetime()}).strict(),ks=zs.omit({instanceId:!0,nodeId:!0,providerSessionId:!0}).strict(),Ns=f.z.object({instanceId:f.z.string().trim().min(1).max(160),nodeId:f.z.string().trim().min(1).max(160).optional(),sessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().min(1).max(240),item:Xn,generatedAt:f.z.string().datetime()}).strict(),Cs=f.z.object({streamId:f.z.string().trim().min(1).max(240),instanceId:f.z.string().trim().min(1).max(160),sinceRevision:f.z.number().int().min(0),latestRevision:f.z.number().int().min(0),earliestRetainedRevision:f.z.number().int().min(0),syncRequired:f.z.boolean().default(!1),events:f.z.array(f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal(xn),payload:Es}).strict(),f.z.object({type:f.z.literal(wn),payload:_s}).strict(),f.z.object({type:f.z.literal(Sn),payload:Ts}).strict()])).default([])}).strict(),Rs=f.z.object({source:Ki,sourcePriority:f.z.number().int().min(0).max(100).optional(),observedAt:f.z.string().datetime().optional(),snapshotVersion:f.z.number().int().min(0).optional()}).strict(),Os=Rs.extend({type:f.z.literal("snapshot"),agent:f.z.string().trim().min(1).max(80),creationSource:zn.optional(),appSessionId:f.z.string().trim().max(120).optional(),appId:f.z.string().trim().max(120).optional(),providerSessionId:f.z.string().trim().max(240).optional(),lineage:si.optional(),providerMeta:f.z.record(f.z.string(),f.z.unknown()).optional(),modelSelection:_i.optional(),reasoningEffort:Ti.optional(),appBindingKeys:f.z.array(f.z.string().trim().min(1).max(240)).max(20).optional(),actions:ii.optional(),title:f.z.string().trim().max(240).optional(),cwd:f.z.string().trim().max(4096).optional(),cwdFolderId:f.z.string().trim().min(1).max(120).optional(),activeTurnId:f.z.string().trim().max(240).optional(),userPrompt:f.z.string().trim().optional(),turns:f.z.array(Xi).max(50).optional(),status:$n.optional(),phase:Fn.optional(),summary:f.z.string().trim().max(1e3).optional(),lastMessage:f.z.string().trim().optional(),lastMessageItemId:f.z.string().trim().max(240).optional(),error:f.z.string().trim().max(4e3).optional(),currentTool:Hn.optional(),toolCallsSinceLastMessage:f.z.number().int().min(0).optional(),subAgents:f.z.array(ti).max(50).optional(),transcriptPath:f.z.string().trim().max(4096).optional(),transcriptSize:f.z.number().int().min(0).optional(),replaceActivity:f.z.boolean().optional()}).strict(),js=Rs.extend({type:f.z.literal("event"),sessionId:f.z.string().trim().min(1).max(120),kind:f.z.enum(["lifecycle","send-ack","turn-started","user-message","assistant-message","approval-requested","turn-completed","session-error","tool-activity","sub-agent-activity","context-compaction","model-selection","reasoning-effort"]),modelSelection:_i.optional(),reasoningEffort:Ti.optional(),activeTurnId:f.z.string().trim().max(240).optional(),providerTurnId:f.z.string().trim().max(240).optional(),userPrompt:f.z.string().trim().optional(),userMessage:Un.optional(),text:f.z.string().optional(),itemId:f.z.string().trim().max(240).optional(),status:$n.optional(),phase:Fn.optional(),summary:f.z.string().trim().max(1e3).optional(),error:f.z.string().trim().max(4e3).optional(),currentTool:Hn.nullable().optional(),toolCallsSinceLastMessage:f.z.number().int().min(0).optional(),subAgents:f.z.array(ti).max(50).optional(),contextCompaction:Yi.optional(),counters:f.z.object({toolCalls:f.z.number().int().min(0).optional(),edits:f.z.number().int().min(0).optional(),approvals:f.z.number().int().min(0).optional()}).strict().optional()}).strict().superRefine((e,t)=>{if("model-selection"===e.kind?e.modelSelection||t.addIssue({code:"custom",path:["modelSelection"],message:"model-selection events require modelSelection"}):void 0!==e.modelSelection&&t.addIssue({code:"custom",path:["modelSelection"],message:"modelSelection is only valid for model-selection events"}),"reasoning-effort"===e.kind?e.reasoningEffort||t.addIssue({code:"custom",path:["reasoningEffort"],message:"reasoning-effort events require reasoningEffort"}):void 0!==e.reasoningEffort&&t.addIssue({code:"custom",path:["reasoningEffort"],message:"reasoningEffort is only valid for reasoning-effort events"}),"session-error"!==e.kind||e.error||t.addIssue({code:"custom",path:["error"],message:"session-error events require error"}),"context-compaction"===e.kind?e.contextCompaction||t.addIssue({code:"custom",path:["contextCompaction"],message:"context-compaction events require contextCompaction"}):void 0!==e.contextCompaction&&t.addIssue({code:"custom",path:["contextCompaction"],message:"contextCompaction is only valid for context-compaction events"}),"send-ack"!==e.kind&&"user-message"!==e.kind&&void 0!==e.userMessage&&t.addIssue({code:"custom",path:["userMessage"],message:"userMessage is only valid for send-ack and user-message events"}),"sub-agent-activity"===e.kind?e.subAgents||t.addIssue({code:"custom",path:["subAgents"],message:"sub-agent-activity events require subAgents"}):void 0!==e.subAgents&&t.addIssue({code:"custom",path:["subAgents"],message:"subAgents is only valid for sub-agent-activity events"}),"tool-activity"!==e.kind)return void 0!==e.currentTool&&t.addIssue({code:"custom",path:["currentTool"],message:"currentTool is only valid for tool-activity events"}),void(void 0!==e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"toolCallsSinceLastMessage is only valid for tool-activity events"}));"currentTool"in e||t.addIssue({code:"custom",path:["currentTool"],message:"tool-activity events require currentTool"}),void 0===e.toolCallsSinceLastMessage&&t.addIssue({code:"custom",path:["toolCallsSinceLastMessage"],message:"tool-activity events require toolCallsSinceLastMessage"})});f.z.discriminatedUnion("type",[Os,js]);const Ps=f.z.object({type:f.z.literal("snapshot"),data:f.z.string(),pendingEscape:f.z.string(),cols:f.z.number().int().positive(),rows:f.z.number().int().positive()}).passthrough(),Ds="app-session.snapshot",Ls="app-session.patch",Ms="app-session.removed",qs=f.z.enum(["created","starting","running","stopping","stopped","exited","failed","closed","terminated","unknown"]),Us=f.z.enum(["tty","vnc","web"]);f.z.object({mode:Us,url:f.z.string().trim().min(1).max(4096),token:f.z.string().trim().min(1).max(512),expiresAt:f.z.string().datetime()}).strict(),f.z.object({revoked:f.z.boolean()}).strict();const $s=new Set(["stopped","failed","exited","closed","terminated"]),Bs=f.z.object({type:f.z.enum(["app-session","provider-session","adapter-key"]),id:f.z.string().trim().min(1).max(240),agent:f.z.string().trim().min(1).max(80).optional(),adapter:f.z.string().trim().min(1).max(80).optional(),key:f.z.string().trim().min(1).max(240).optional()}).strict(),Fs=f.z.record(f.z.string(),f.z.unknown()).and(f.z.object({id:f.z.string().trim().min(1).max(160),appId:f.z.string().trim().min(1).max(160).optional(),title:f.z.string().trim().max(240).optional(),kind:f.z.string().trim().max(80).optional(),status:qs.default("unknown"),bindings:f.z.array(Bs).max(40).default([]),workspace:f.z.object({cwd:f.z.string().trim().max(4096).optional()}).strict().optional(),createdAt:f.z.string().datetime().optional(),updatedAt:f.z.string().datetime().optional()})),Hs=f.z.object({runningCount:f.z.number().int().min(0).default(0),problemCount:f.z.number().int().min(0).default(0),sessions:f.z.array(Fs).default([]),updatedAt:f.z.string().datetime()}).strict(),Gs=f.z.object({streamId:f.z.string().trim().min(1).max(240),revision:f.z.number().int().min(0),lastEventAt:f.z.string().datetime(),snapshot:Hs}).strict();Hs.pick({runningCount:!0,problemCount:!0,updatedAt:!0}).extend({revision:f.z.number().int().min(0).optional()});const Ws=f.z.enum(["app-session-created","app-session-updated","app-session-deleted","app-session-recovered","control-action","heartbeat-sync","startup"]),Vs=f.z.object({streamId:f.z.string().trim().min(1).max(240),instanceId:f.z.string().trim().min(1).max(160),nodeId:f.z.string().trim().min(1).max(160).optional(),revision:f.z.number().int().min(0),previousRevision:f.z.number().int().min(0).optional(),traceId:f.z.string().trim().min(1).max(160),generatedAt:f.z.string().datetime(),reason:Ws}).strict(),Ks=f.z.object({meta:Vs,snapshot:Hs}).strict(),Ys=f.z.object({meta:Vs,session:Fs}).strict(),Xs=f.z.object({meta:Vs,sessionId:f.z.string().trim().min(1).max(160),tombstone:Fs.optional(),expiresAt:f.z.string().datetime().optional()}).strict(),Js=f.z.object({streamId:f.z.string().trim().min(1).max(240),instanceId:f.z.string().trim().min(1).max(160),sinceRevision:f.z.number().int().min(0),latestRevision:f.z.number().int().min(0),earliestRetainedRevision:f.z.number().int().min(0),syncRequired:f.z.boolean().default(!1),events:f.z.array(f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal(Ds),payload:Ks}).strict(),f.z.object({type:f.z.literal(Ls),payload:Ys}).strict(),f.z.object({type:f.z.literal(Ms),payload:Xs}).strict()])).default([])}).strict();function Qs(e,t=(new Date).toISOString()){const n=e.map(e=>ea(e));return Hs.parse({runningCount:n.filter(e=>"running"===e.status).length,problemCount:n.filter(e=>"failed"===e.status).length,sessions:n,updatedAt:t})}function Zs(e,t=(new Date).toISOString()){return Qs(e.filter(e=>na("string"==typeof e.status?e.status:void 0)),t)}function ea(e){const t=ta("string"==typeof e.status?e.status:void 0),n="string"==typeof e.id?e.id:"",i=function(e){const t=ca(e.workspace),n=ca(e.tty),i=ca(e.launch),s=ca(e.ai),a=ca(s.claude),o=da(t.cwd)||da(n.cwd)||da(a.cwd)||da(i.cwd);return o?{cwd:o}:void 0}(e),{workspace:s,...a}=e;return Fs.parse({...a,status:t,bindings:ra([...(o=e.bindings,Array.isArray(o)?o.flatMap(e=>{const t=Bs.safeParse(e);return t.success?[t.data]:[]}):[]),...n?[{type:"app-session",id:n}]:[],...aa(e)]),...i?{workspace:i}:{}});var o}function ta(e){const t=(e||"unknown").trim().toLowerCase();return"ended"===t?"closed":"terminating"===t?"stopping":qs.options.includes(t)?t:"unknown"}function na(e){return!$s.has(ta(e))}function ia(e){return"tty"===e.kind?"tty":"gui"===e.kind?"vnc":"web"===e.kind?"web":void 0}function sa(e){return"app-session"===e.type?`app:${e.id}`:"provider-session"===e.type?`provider:${e.agent||""}:${e.id}`:`adapter:${e.adapter||""}:${e.key||e.id}`}function aa(e){const t=ca(e.ai),n=ca(t.claude),i=ca(t.appServer),s=ca(e.launch),a=[],o=da(ca(s.aiSessionResume).providerSessionId),r="codex"===e.appId||"claude"===e.appId||"opencode"===e.appId?e.appId:void 0;r&&o&&a.push({type:"provider-session",agent:r,id:o});const c=da(n.short);c&&a.push({type:"adapter-key",adapter:"claude",agent:"claude",id:`short:${c}`,key:`short:${c}`});const d=da(n.providerSessionId);d&&a.push({type:"provider-session",agent:"claude",id:d});const l=Array.isArray(t.threadIds)?t.threadIds.filter(e=>"string"==typeof e&&Boolean(e.trim())):[],p=da(t.activeThreadId);for(const e of[...new Set([p,...l].filter(Boolean))])a.push({type:"provider-session",agent:"codex",id:e});const u=da(i.socketPath);return u&&a.push({type:"adapter-key",adapter:"codex-app-server",agent:"codex",id:`socket:${u}`,key:`socket:${u}`}),a}function oa(e){const t="string"==typeof e.id?e.id:"",n=ca(e.ai),i=da(ca(n.claude).short);return[t?`app:${t}`:"",i?`claude-short:${i}`:""]}function ra(e){const t=new Map;for(const n of e)t.set(sa(n),n);return[...t.values()]}function ca(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function da(e){return"string"==typeof e&&e.trim()?e.trim():""}function la(e=(new Date).toISOString()){return Hs.parse({runningCount:0,problemCount:0,sessions:[],updatedAt:e})}const pa=f.z.string().trim().min(3).max(160).regex(/^[a-z][a-z0-9_-]*$/),ua=f.z.string().datetime(),ma=f.z.string().regex(/^sha256:[A-Za-z0-9_-]{43}$/),ha=f.z.string().min(32).max(4096),ga=f.z.strictObject({default:f.z.string().trim().min(1).max(160),translations:f.z.record(f.z.string().regex(/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/),f.z.string().trim().min(1).max(160)).default({})});function fa(e){return Array.isArray(e)?`[${e.map(fa).join(",")}]`:e&&"object"==typeof e?`{${Object.entries(e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>`${JSON.stringify(e)}:${fa(t)}`).join(",")}}`:JSON.stringify(e)}const ya="2026-08-10",ba="2026-08-10",va="2026-08-10",Ia=Object.freeze({AccountApi:"task-handoff:official-account-api",Binding:"task-handoff:control-plane-binding",CoordinatorControl:"task-handoff:coordinator-control",RelayAllocation:"task-handoff:relay-allocation",RelayClientAttach:"task-handoff:relay-client-attach",RelayControlPlaneAttach:"task-handoff:relay-control-plane-attach",RelayRevocation:"task-handoff:relay-revocation",ControlPlaneAccess:"task-handoff:control-plane-access"});f.z.strictObject({protocolVersion:f.z.literal("2026-08-10"),audience:f.z.literal(Ia.AccountApi)});const xa=f.z.string().email().max(320).transform(e=>e.trim().toLowerCase()),wa=f.z.enum(["pending-verification","active","disabled","pending-deletion"]);f.z.strictObject({id:pa,email:xa,emailVerified:f.z.boolean(),hasPassword:f.z.boolean().optional(),totpEnabled:f.z.boolean().optional(),displayName:ga.optional(),status:wa,createdAt:ua}),f.z.strictObject({id:pa,kind:f.z.enum(["browser","mobile"]),deviceName:f.z.string().trim().min(1).max(160),platform:f.z.string().trim().min(1).max(80).optional(),createdAt:ua,lastSeenAt:ua.optional(),expiresAt:ua,revokedAt:ua.optional()}),f.z.union([f.z.object({code:ha,state:f.z.string().min(1).max(4096).optional(),redirectUri:f.z.string().url(),expiresAt:ua}),f.z.object({authorizationUrl:f.z.string().url(),expiresAt:ua})]),f.z.object({tokenType:f.z.literal("Bearer"),accessToken:ha,accessExpiresAt:ua,refreshCredential:ha,accountId:pa,deviceSessionId:pa}),f.z.strictObject({enrollmentToken:ha,secret:ha,algorithm:f.z.literal("SHA1"),digits:f.z.literal(6),periodSeconds:f.z.literal(30),otpauthUri:f.z.string().url().startsWith("otpauth://totp/"),expiresAt:ua});const Sa=f.z.strictObject({controlPlaneId:pa,algorithm:f.z.literal("Ed25519"),publicKey:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),fingerprint:ma});f.z.strictObject({protocolVersion:f.z.literal(ya),audience:f.z.literal(Ia.Binding),challengeId:pa,challenge:ha,serviceOrigin:f.z.string().url(),identity:Sa,nonce:f.z.string().min(16).max(256),initiatingAdminSessionId:pa,issuedAt:ua,expiresAt:ua}),f.z.strictObject({code:f.z.enum(["CONTROL_PLANE_ALREADY_BOUND","REVISION_CONFLICT","REVOCATION_PENDING","IDENTITY_CLONE_CONFLICT"]),controlPlaneId:pa,expectedRevision:f.z.number().int().nonnegative().optional(),actualRevision:f.z.number().int().nonnegative().optional(),retryable:f.z.boolean()});const Aa=f.z.strictObject({bindingId:pa.optional(),controlPlaneId:pa,displayName:ga,publicKeyFingerprint:ma,bindingRevision:f.z.number().int().positive(),remoteAccess:f.z.enum(["enabled","disabled","revocation-pending"]),leaseExpiresAt:ua.optional(),lastConnectedAt:ua.optional(),relayUsageBytes:f.z.number().int().nonnegative(),relayQuotaBytes:f.z.number().int().nonnegative().optional(),versionWarning:f.z.string().trim().min(1).max(500).optional(),errorCode:f.z.string().trim().min(1).max(160).optional()}),Ea=f.z.enum(["interactive","stream","bulk"]),_a=f.z.object({type:f.z.literal("tty-snapshot"),streamId:f.z.string().trim().min(1).optional(),data:f.z.string(),pendingEscape:f.z.string(),cols:f.z.number().int().positive(),rows:f.z.number().int().positive()}).passthrough(),Ta=f.z.strictObject({protocolVersion:f.z.literal(ba),audience:f.z.literal(Ia.CoordinatorControl),connectionId:pa,processInstanceId:pa,controlPlaneId:pa,publicKey:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),publicKeyFingerprint:ma,bindingId:pa.optional(),bindingRevision:f.z.number().int().positive().optional(),epoch:f.z.number().int().nonnegative(),capabilities:f.z.array(f.z.enum(["request","stream","websocket"])).min(1),issuedAt:ua,expiresAt:ua}).superRefine((e,t)=>{Boolean(e.bindingId)!==Boolean(e.bindingRevision)&&t.addIssue({code:"custom",message:"binding id and revision must be supplied together"})});Ta.safeExtend({signature:ha}),f.z.strictObject({connectionId:pa,controlPlaneId:pa,bindingRevision:f.z.number().int().positive(),epoch:f.z.number().int().nonnegative(),relayId:pa,relayRegion:f.z.string().trim().min(1).max(80),issuedAt:ua,expiresAt:ua});const za=f.z.strictObject({protocolVersion:f.z.literal(ba),audience:f.z.literal(Ia.ControlPlaneAccess),ticketId:pa,accountId:pa,deviceSessionId:pa,controlPlaneId:pa,bindingId:pa,bindingRevision:f.z.number().int().positive(),targetPublicKeyFingerprint:ma,nonce:f.z.string().min(16).max(256),trafficClasses:f.z.array(Ea).min(1),issuedAt:ua,expiresAt:ua,signature:ha});f.z.strictObject({audience:f.z.literal(Ia.ControlPlaneAccess),accountId:pa,deviceSessionId:pa,controlPlaneId:pa,bindingId:pa,bindingRevision:f.z.number().int().positive(),authenticatedAt:ua,expiresAt:ua,signature:ha});const ka=f.z.enum(["client","control-plane"]),Na=f.z.strictObject({protocolVersion:f.z.literal(va),audience:f.z.enum([Ia.RelayClientAttach,Ia.RelayControlPlaneAttach]),allocationId:pa,relayId:pa,role:ka,controlPlaneId:pa,accountId:pa,deviceSessionId:pa,bindingId:pa,ticketId:pa,bindingRevision:f.z.number().int().positive(),trafficClass:Ea,nonce:f.z.string().min(16).max(256),issuedAt:ua,expiresAt:ua,signature:ha}).superRefine((e,t)=>{const n="client"===e.role?Ia.RelayClientAttach:Ia.RelayControlPlaneAttach;e.audience!==n&&t.addIssue({code:"custom",path:["audience"],message:`audience must match ${e.role} role`})});f.z.object({allocationId:pa,relayId:pa,relayRegion:f.z.string().trim().min(1).max(80),relayUrl:f.z.string().url(),clientAttach:Na,expiresAt:ua}),f.z.strictObject({channelId:pa,allocationId:pa,controlPlaneId:pa,bindingRevision:f.z.number().int().positive(),trafficClass:Ea,state:f.z.enum(["waiting-for-peer","handshaking","open","closing","closed"]),clientAttached:f.z.boolean(),controlPlaneAttached:f.z.boolean(),openedAt:ua.optional(),leaseExpiresAt:ua}),f.z.strictObject({protocolVersion:f.z.literal(va),channelId:pa,sequence:f.z.number().int().nonnegative(),kind:f.z.enum(["handshake","data","cancel","window-update","close"]),ciphertext:f.z.string().max(1398102).optional(),creditBytes:f.z.number().int().positive().optional()}),f.z.strictObject({channelId:pa,code:f.z.enum(["normal","expired","revoked","quota-exceeded","idle-timeout","slow-consumer","protocol-error","peer-disconnected"]),retryable:f.z.boolean()}),f.z.strictObject({protocolVersion:f.z.literal(va),audience:f.z.literal(Ia.RelayRevocation),revocationId:pa,relayId:pa.optional(),allocationId:pa.optional(),accountId:pa.optional(),deviceSessionId:pa.optional(),bindingId:pa.optional(),issuedAt:ua,expiresAt:ua,signature:ha}).refine(e=>[e.allocationId,e.accountId,e.deviceSessionId,e.bindingId].some(Boolean),"revocation target is required"),f.z.strictObject({data:f.z.strictObject({protocolVersion:f.z.literal(ya),items:f.z.array(Aa)})}),Object.keys(Aa.shape);const Ca=f.z.object({ticketId:f.z.string().trim().min(3).max(160),deviceSessionId:f.z.string().trim().min(3).max(160),clientEphemeralPublicKey:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/)});function Ra(){return Object.assign(new Error("End-to-end handshake is invalid."),{code:"E2E_HANDSHAKE_INVALID"})}f.z.object({serverEphemeralPublicKey:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),transcript:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),signature:f.z.string().regex(/^[A-Za-z0-9_-]{86}$/)});const Oa=f.z.union([f.z.object({type:f.z.literal("schedule"),scheduleKind:f.z.literal("interval").default("interval"),intervalMs:f.z.number().int().min(1e3)}).strict(),f.z.object({type:f.z.literal("schedule"),scheduleKind:f.z.literal("daily"),timeOfDay:f.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:f.z.string().trim().min(1).max(120)}).strict(),f.z.object({type:f.z.literal("schedule"),scheduleKind:f.z.literal("weekly"),weekdays:f.z.array(f.z.number().int().min(0).max(6)).min(1).max(7),timeOfDay:f.z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),timezone:f.z.string().trim().min(1).max(120)}).strict()]),ja=f.z.union([Oa,f.z.object({type:f.z.literal("file-change"),roots:f.z.array(f.z.string().trim().min(1).max(4096)).min(1).max(50),globs:f.z.array(f.z.string().trim().min(1).max(500)).min(1).max(100),ignore:f.z.array(f.z.string().trim().min(1).max(500)).max(100).optional(),debounceMs:f.z.number().int().min(100).max(6e4).default(1500)}).strict(),f.z.object({type:f.z.literal("ai-session"),agent:f.z.string().trim().min(1).max(80).optional(),statuses:f.z.array(f.z.enum(["running","waiting","idle","failed"])).max(20).optional(),phases:f.z.array(f.z.enum(["thinking","tool","editing","approval","responding","unknown"])).max(20).optional()}).strict()]),Pa=f.z.object({promptTemplate:f.z.string().trim().min(1).max(2e4)}).strict(),Da=f.z.object({cooldownMs:f.z.number().int().min(0).max(864e5).optional(),maxConcurrentRuns:f.z.number().int().min(1).max(20).default(1),whenBusy:f.z.enum(["skip","queue"]).default("skip")}).strict(),La=f.z.object({configHash:f.z.string().trim().min(8).max(80),name:f.z.string().trim().min(1).max(160),description:f.z.string().trim().max(1e3).optional(),source:ja,action:Pa,policy:Da.default({maxConcurrentRuns:1,whenBusy:"skip"}),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict(),Ma=f.z.object({type:f.z.literal("ai-session"),aiSessionId:f.z.string().trim().min(1).max(160)}).strict(),qa=f.z.object({configHash:f.z.string().trim().min(8).max(80),deploymentId:f.z.string().trim().min(1).max(240).optional(),instanceId:f.z.string().trim().min(1).max(160),origin:f.z.enum(["control-plane","controlled-instance"]).default("controlled-instance"),enabled:f.z.boolean().default(!0),target:Ma,localName:f.z.string().trim().min(1).max(160).optional(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict(),Ua=f.z.object({configHash:f.z.string().trim().min(8).max(80),deploymentId:f.z.string().trim().min(1).max(240).optional(),instanceId:f.z.string().trim().min(1).max(160),status:f.z.enum(["idle","running","disabled","error"]).default("idle"),lastTriggeredAt:f.z.string().datetime().optional(),lastCompletedAt:f.z.string().datetime().optional(),lastSkippedAt:f.z.string().datetime().optional(),lastError:f.z.string().trim().max(4e3).optional(),runCount:f.z.number().int().min(0).default(0),skippedCount:f.z.number().int().min(0).default(0)}).strict(),$a=f.z.object({id:f.z.string().trim().min(1).max(160),configHash:f.z.string().trim().min(8).max(80),deploymentId:f.z.string().trim().min(1).max(240).optional(),instanceId:f.z.string().trim().min(1).max(160),eventType:f.z.enum(["manual","schedule","file-change","ai-session"]),status:f.z.enum(["started","completed","failed","skipped"]),target:Ma,promptPreview:f.z.string().trim().max(500),eventSummary:f.z.string().trim().max(1e3).optional(),error:f.z.string().trim().max(4e3).optional(),startedAt:f.z.string().datetime(),completedAt:f.z.string().datetime().optional()}).strict();f.z.object({schemaVersion:f.z.literal(1).default(1),configs:f.z.array(La).default([]),deployments:f.z.array(qa).default([]),runtime:f.z.array(Ua).default([]),recentRuns:f.z.array($a).default([])}).strict();const Ba=f.z.object({config:La,deployment:qa,runtime:Ua.optional()}).strict();f.z.object({instanceId:f.z.string().trim().min(1).max(160),sessionId:f.z.string().trim().min(1).max(160),mutation:Ba.optional()}).strip(),f.z.object({instanceId:f.z.string().trim().min(1).max(160),sessionId:f.z.string().trim().min(1).max(160),configHash:La.shape.configHash}).strip();const Fa=f.z.object({instanceId:f.z.string().trim().min(1).max(160),instanceName:f.z.string().trim().min(1).max(160),deployment:qa,runtime:Ua.optional()}).strip(),Ha=$a.extend({instanceName:f.z.string().trim().min(1).max(160).optional()}).strip(),Ga=f.z.object({configHash:f.z.string().trim().min(8).max(80),config:La,deploymentCount:f.z.number().int().min(0),enabledCount:f.z.number().int().min(0),runningCount:f.z.number().int().min(0),errorCount:f.z.number().int().min(0),ownedByControlPlane:f.z.boolean(),controlPlaneDeploymentCount:f.z.number().int().min(0),deployments:f.z.array(Fa),recentRuns:f.z.array(Ha)}).strip(),Wa=f.z.object({updatedAt:f.z.string().datetime(),triggers:f.z.array(Ga)}).strip();function Va(e){const t=Xa({source:e.source,action:e.action,policy:Da.parse(e.policy||{})});return`trg_${function(e){const t=(new TextEncoder).encode(e),n=64*Math.ceil((t.length+9)/64),i=new Uint8Array(n);i.set(t),i[t.length]=128;const s=new DataView(i.buffer),a=8*t.length;s.setUint32(n-8,Math.floor(a/4294967296)),s.setUint32(n-4,a>>>0);const o=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),r=new Uint32Array(64);for(let e=0;e<n;e+=64){for(let t=0;t<16;t+=1)r[t]=s.getUint32(e+4*t);for(let e=16;e<64;e+=1){const t=r[e-15],n=r[e-2],i=Ya(t,7)^Ya(t,18)^t>>>3,s=Ya(n,17)^Ya(n,19)^n>>>10;r[e]=r[e-16]+i+r[e-7]+s>>>0}let[t,n,i,a,c,d,l,p]=o;for(let e=0;e<64;e+=1){const s=p+(Ya(c,6)^Ya(c,11)^Ya(c,25))+(c&d^~c&l)+Ka[e]+r[e]>>>0,o=t&n^t&i^n&i;p=l,l=d,d=c,c=a+s>>>0,a=i,i=n,n=t,t=s+((Ya(t,2)^Ya(t,13)^Ya(t,22))+o>>>0)>>>0}o[0]=o[0]+t>>>0,o[1]=o[1]+n>>>0,o[2]=o[2]+i>>>0,o[3]=o[3]+a>>>0,o[4]=o[4]+c>>>0,o[5]=o[5]+d>>>0,o[6]=o[6]+l>>>0,o[7]=o[7]+p>>>0}return[...o].map(e=>e.toString(16).padStart(8,"0")).join("")}(JSON.stringify(t)).slice(0,24)}`}f.z.object({name:La.shape.name,description:La.shape.description,source:ja,action:Pa,policy:Da.partial().optional()}).strict(),f.z.object({scope:f.z.enum(["node","instance"]),nodeId:f.z.string().trim().min(1).max(160).optional(),instanceId:f.z.string().trim().min(1).max(160).optional(),code:f.z.string().trim().min(1).max(160),message:f.z.string().trim().min(1).max(4e3)}).strip();const Ka=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Ya(e,t){return e>>>t|e<<32-t}function Xa(e){return Array.isArray(e)?e.map(Xa):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).filter(([,e])=>void 0!==e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>[e,Xa(t)])):e}const Ja="2026-08-01",Qa=f.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Proxy protocol version must use YYYY-MM-DD format."),Za=f.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),eo=f.z.string().datetime(),to=f.z.string().trim().min(32).max(4096),no=Za,io=f.z.string().trim().max(2048).transform((e,t)=>{try{return function(e){const t=new URL(e.trim());if("https:"!==t.protocol||t.username||t.password||"/"!==t.pathname||t.search||t.hash)throw new Error("Proxy origin must be an HTTPS origin without credentials, path, query, or fragment.");return t.origin}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),f.z.NEVER}}),so=f.z.string().trim().min(1).max(4096).transform((e,t)=>{try{return function(e){const t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/%25/i.test(t))throw new Error("Proxy route must be a single-encoded node-agent relative route.");const n=t.split("?",1)[0];let i,s;try{i=n.split("/").map(e=>decodeURIComponent(e))}catch{throw new Error("Proxy route contains invalid percent encoding.")}if(i.some(e=>".."===e||"."===e))throw new Error("Proxy route cannot traverse outside the node-agent API.");try{s=new URL(t,"https://node-agent.invalid")}catch{throw new Error("Proxy route is invalid.")}if("https://node-agent.invalid"!==s.origin||s.username||s.password)throw new Error("Proxy route cannot select an absolute upstream URL.");return`${s.pathname}${s.search}`}(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),f.z.NEVER}}),ao=new Set(["accept","accept-language","authorization","content-type","if-match","if-none-match","range","x-request-id","x-task-handoff-trace-id"]),oo=new Set(["cache-control","content-disposition","content-language","content-length","content-range","content-type","etag","last-modified","server-timing","x-request-id","x-task-handoff-trace-id"]),ro="x-task-handoff-proxy-protocol-version",co="x-task-handoff-proxy-source-control-plane-id",lo="x-task-handoff-proxy-binding-key-id",po="x-task-handoff-proxy-credential",uo={ProtocolUnsupported:"CONTROL_PLANE_PROXY_PROTOCOL_UNSUPPORTED",InviteInvalid:"CONTROL_PLANE_PROXY_INVITE_INVALID",InviteExpired:"CONTROL_PLANE_PROXY_INVITE_EXPIRED",InviteConsumed:"CONTROL_PLANE_PROXY_INVITE_CONSUMED",InviteRevoked:"CONTROL_PLANE_PROXY_INVITE_REVOKED",TargetUnavailable:"CONTROL_PLANE_PROXY_TARGET_UNAVAILABLE",TargetMismatch:"CONTROL_PLANE_PROXY_TARGET_MISMATCH",BindingUnknown:"CONTROL_PLANE_PROXY_BINDING_UNKNOWN",BindingRevoked:"CONTROL_PLANE_PROXY_BINDING_REVOKED",BindingIdentityConflict:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",AuthenticationFailed:"CONTROL_PLANE_PROXY_AUTHENTICATION_FAILED",RouteInvalid:"CONTROL_PLANE_PROXY_ROUTE_INVALID",HeaderInvalid:"CONTROL_PLANE_PROXY_HEADER_INVALID",ResourceLimit:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",SnapshotRequired:"CONTROL_PLANE_PROXY_SNAPSHOT_REQUIRED",Unavailable:"CONTROL_PLANE_PROXY_UNAVAILABLE",TransportFailed:"CONTROL_PLANE_PROXY_TRANSPORT_FAILED"},mo=f.z.enum(Object.values(uo)),ho=f.z.object({code:mo,message:f.z.string().trim().min(1).max(2048),retryable:f.z.boolean(),details:f.z.record(f.z.string(),f.z.unknown()).optional()}).strict(),go=f.z.enum(["active","revoked"]),fo=f.z.object({id:Za,targetNodeId:Za,status:go,createdBy:Za,expiresAt:eo,revokedAt:eo.optional(),createdAt:eo,updatedAt:eo}).strict(),yo=f.z.object({targetNodeId:Za,expiresInSeconds:f.z.number().int().min(60).max(3600).default(600)}).strict(),bo=f.z.object({invite:fo,token:f.z.string().trim().min(24).max(512),proxyOrigin:io,protocolVersion:Qa}).strict(),vo=f.z.enum(["active","revoked"]),Io=f.z.object({id:Za,claimId:Za,sourceControlPlaneId:Za,targetNodeId:Za,bindingKeyId:Za,status:vo,revision:f.z.number().int().positive(),lastError:ho.optional(),revokedAt:eo.optional(),createdAt:eo,updatedAt:eo}).strict(),xo=f.z.object({protocolVersion:Qa,inviteToken:f.z.string().trim().min(24).max(512).optional(),claimId:Za,sourceControlPlaneId:Za,targetNodeId:Za.optional(),bindingKeyId:Za,credential:to}).strict(),wo=f.z.object({sourceControlPlaneId:Za,bindingKeyId:Za,credential:to}).strict(),So=f.z.object({id:Za,name:f.z.string().trim().min(1).max(160),status:f.z.enum(["unknown","online","offline","degraded"]),health:f.z.enum(["unknown","ok","degraded","failed"]),lastSeenAt:eo.optional(),capabilities:f.z.record(f.z.string(),f.z.unknown()).default({})}).strict(),Ao=f.z.object({protocolVersion:Qa,binding:Io,streamId:Za,revision:f.z.number().int().nonnegative(),observedAt:eo,target:So}).strict(),Eo=f.z.object({type:f.z.literal("control-plane-proxy.event"),protocolVersion:Qa,streamId:Za,bindingId:Za,sourceControlPlaneId:Za,targetNodeId:Za,revision:f.z.number().int().positive(),source:f.z.object({id:f.z.string().trim().min(1).max(512),seq:f.z.number().int().nonnegative()}).strict(),target:So,event:f.z.object({type:f.z.string().trim().min(1).max(240),topic:f.z.string().trim().min(1).max(240),createdAt:eo}).strict()}).strict(),_o=f.z.object({type:f.z.literal("control-plane-proxy.events.ready"),protocolVersion:Qa,streamId:Za,bindingId:Za,sourceControlPlaneId:Za,targetNodeId:Za,latestRevision:f.z.number().int().nonnegative(),earliestRetainedRevision:f.z.number().int().nonnegative()}).strict(),To=f.z.object({type:f.z.literal("control-plane-proxy.snapshot-required"),protocolVersion:Qa,streamId:Za,bindingId:Za,sourceControlPlaneId:Za,targetNodeId:Za,sinceRevision:f.z.number().int().nonnegative(),latestRevision:f.z.number().int().nonnegative(),earliestRetainedRevision:f.z.number().int().nonnegative(),error:ho}).strict(),zo=f.z.discriminatedUnion("type",[Eo,_o,To]),ko=f.z.object({protocolVersion:Qa,binding:Io,target:Ao.shape.target}).strict(),No=f.z.object({id:Za,claimId:Za,proxyOrigin:io,requestedName:f.z.string().trim().min(1).max(160).optional(),sourceControlPlaneId:Za,targetNodeId:Za.optional(),bindingKeyId:Za,credential:to,status:f.z.enum(["pending","compensation-required"]),createdAt:eo,updatedAt:eo,expiresAt:eo}).strict();No.omit({credential:!0});const Co=f.z.object({id:Za,nodeId:Za,proxyOrigin:io,proxyBindingId:Za,targetNodeId:Za,sourceControlPlaneId:Za,bindingKeyId:Za,credential:to,createdAt:eo,updatedAt:eo}).strict(),Ro=f.z.string().trim().min(1).max(120),Oo=f.z.object({selectModelAtCreate:f.z.boolean().default(!1),selectProviderAtCreate:f.z.boolean().default(!1),switchModelWithinProvider:f.z.boolean().default(!1),switchProviderDuringSession:f.z.boolean().default(!1)}).strip().default({selectModelAtCreate:!1,selectProviderAtCreate:!1,switchModelWithinProvider:!1,switchProviderDuringSession:!1}),jo=f.z.object({selectAtCreate:f.z.boolean().default(!1),updateDuringSession:f.z.boolean().default(!1)}).strip().default({selectAtCreate:!1,updateDuringSession:!1}),Po=f.z.object({agent:Ro,actions:f.z.object({create:f.z.boolean().default(!1),send:f.z.boolean().default(!1),queue:f.z.boolean().default(!1),steer:f.z.boolean().default(!1),interrupt:f.z.boolean().default(!1),archive:f.z.boolean().default(!1),delete:f.z.boolean().default(!1),fork:f.z.boolean().default(!1),approvalDecisions:f.z.array(f.z.enum(["allow","deny","skip"])).max(3).default([])}).passthrough(),timeline:f.z.object({sessionRead:f.z.boolean().default(!1),turnRead:f.z.boolean().default(!1),liveItems:f.z.boolean().default(!1)}).passthrough(),modelSelection:Oo.optional(),reasoningEffort:jo.optional()}).passthrough(),Do=f.z.array(Po).max(100).default([]);function Lo(e){const t=Po.safeParse(e);return Oo.parse(t.success?t.data.modelSelection:void 0)}function Mo(e){const t=Po.safeParse(e);return jo.parse(t.success?t.data.reasoningEffort:void 0)}const qo="2026-08-27",Uo=new Set(["2026-08-01","2026-08-16","2026-08-17","2026-08-20",qo]),$o=f.z.string().regex(/^\d{4}-\d{2}-\d{2}$/,"Protocol version must use YYYY-MM-DD format."),Bo=f.z.string().trim().min(1).max(120);function Fo(){return{features:{appRuntime:!1,tty:!1,gui:!1,browser:!1,browserTunnel:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,privateModelCatalog:!1,gitCliCredentialBroker:!1,gitCredentialProxy:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1,fileSizeLimitSettings:!1},aiSessionProviders:[]}}}const Ho=f.z.object({sessionReadAgents:f.z.array(Bo).max(100).default([]),turnReadAgents:f.z.array(Bo).max(100).default([]),liveItemAgents:f.z.array(Bo).max(100).default([])}).passthrough(),Go=f.z.object({metadataAgents:f.z.array(Bo).max(100).default([]),contentAgents:f.z.array(Bo).max(100).default([]),uploadAgents:f.z.array(Bo).max(100).default([]),retentionSettings:f.z.boolean().default(!1),fileSizeLimitSettings:f.z.boolean().default(!1)}).passthrough(),Wo=f.z.object({appRuntime:f.z.boolean().default(!1),tty:f.z.boolean().default(!1),gui:f.z.boolean().default(!1),browser:f.z.boolean().default(!1),browserTunnel:f.z.boolean().optional(),screenshots:f.z.boolean().default(!1),logs:f.z.boolean().default(!1),aiSessionWorkspaceSelection:f.z.boolean().default(!1),aiSessionPersistenceSettings:f.z.boolean().default(!1),privateModelCatalog:f.z.boolean().optional(),gitCliCredentialBroker:f.z.boolean().optional(),gitCredentialProxy:f.z.boolean().optional(),aiSessionTimeline:Ho.default(function(){return{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),aiSessionConversationAttachments:Go.optional(),aiSessionProviders:Do.optional()}).passthrough(),Vo=f.z.object({features:Wo.default(function(){return{appRuntime:!1,tty:!1,gui:!1,browser:!1,browserTunnel:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,privateModelCatalog:!1,gitCliCredentialBroker:!1,gitCredentialProxy:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1,fileSizeLimitSettings:!1},aiSessionProviders:[]}})}).passthrough();function Ko(e){const t={features:{appRuntime:!1,tty:!1,gui:!1,browser:!1,browserTunnel:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,privateModelCatalog:!1,gitCliCredentialBroker:!1,gitCredentialProxy:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1,fileSizeLimitSettings:!1},aiSessionProviders:[]}};if(!e||"object"!=typeof e||Array.isArray(e))return t;const n=e,i=n.features;if(!i||"object"!=typeof i||Array.isArray(i))return t;const s=i,a={appRuntime:!1,tty:!1,gui:!1,browser:!1,browserTunnel:!1,screenshots:!1,logs:!1,aiSessionWorkspaceSelection:!1,aiSessionPersistenceSettings:!1,privateModelCatalog:!1,gitCliCredentialBroker:!1,gitCredentialProxy:!1,aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]},aiSessionConversationAttachments:{metadataAgents:[],contentAgents:[],uploadAgents:[],retentionSettings:!1,fileSizeLimitSettings:!1},aiSessionProviders:[]};for(const e of["appRuntime","tty","gui","browser","browserTunnel","screenshots","logs","aiSessionWorkspaceSelection","aiSessionPersistenceSettings","privateModelCatalog","gitCliCredentialBroker","gitCredentialProxy"]){const t=f.z.boolean().safeParse(s[e]);t.success&&(a[e]=t.data)}const o=Ho.safeParse(s.aiSessionTimeline);o.success&&(a.aiSessionTimeline=o.data);const r=Go.safeParse(s.aiSessionConversationAttachments);r.success&&(a.aiSessionConversationAttachments=r.data);const c=Do.safeParse(s.aiSessionProviders);return c.success&&(a.aiSessionProviders=c.data),Vo.parse({...n,features:{...s,...a}})}function Yo(e){return Ko(e).features.gitCredentialProxy}function Xo(e,t){return function(e){return Ko(e).features.aiSessionProviders}(e).find(e=>e.agent===t)}function Jo(e,t){const n=function(e){return Ko(e).features.aiSessionTimeline}(e);return"session-read"===t?n.sessionReadAgents:"turn-read"===t?n.turnReadAgents:n.liveItemAgents}const Qo=f.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),Zo=f.z.string().datetime(),er=f.z.record(f.z.string(),f.z.string()).default({}),tr=f.z.record(f.z.string(),f.z.string()).default({});function nr(e){if(null!=e){if("string"==typeof e)return{encoding:"utf8",data:e};if(Buffer.isBuffer(e))return{encoding:"base64",data:e.toString("base64")};if(e instanceof ArrayBuffer)return{encoding:"base64",data:Buffer.from(e).toString("base64")};if(ArrayBuffer.isView(e))return{encoding:"base64",data:Buffer.from(e.buffer,e.byteOffset,e.byteLength).toString("base64")};throw new TypeError("Node tunnel request body must be a string or binary buffer.")}}f.z.object({encoding:f.z.enum(["utf8","base64"]),data:f.z.string()}).strict().superRefine((e,t)=>{"base64"===e.encoding&&Buffer.from(e.data,"base64").toString("base64")!==e.data&&t.addIssue({code:"custom",path:["data"],message:"Node tunnel binary body must use canonical base64 encoding."})});const ir=/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/,sr=/^sha256:([a-fA-F0-9]{64})$/,ar=/^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/,or=/^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;function rr(e){const t=e.trim();if(!t||t.length>512||t.includes("://")||/\s/.test(t))throw new Error("Docker image reference must not contain a URL scheme or whitespace.");const n=t.indexOf("@");if(-1!==n&&n!==t.lastIndexOf("@"))throw new Error("Docker image reference contains more than one digest separator.");const i=-1===n?void 0:t.slice(n+1),s=-1===n?t:t.slice(0,n),a=i?sr.exec(i):void 0;if(i&&!a)throw new Error("Docker image digest must use sha256 followed by 64 hexadecimal characters.");const o=s.lastIndexOf("/"),r=s.lastIndexOf(":"),c=r>o,d=c?s.slice(r+1):void 0,l=c?s.slice(0,r):s;if(d&&!ir.test(d))throw new Error("Docker image tag is invalid.");if(!d&&!a)throw new Error("Docker image reference must include an explicit tag or sha256 digest.");const p=l.split("/");if(!p.length||p.some(e=>!e))throw new Error("Docker image repository path is invalid.");const u=p.length>1&&(p[0].includes(".")||p[0].includes(":")||"localhost"===p[0]),m=u?p.slice(1):p;if(u&&!ar.test(p[0].toLowerCase()))throw new Error("Docker image registry host or port is invalid.");if(!m.length||m.some(e=>!or.test(e)))throw new Error("Docker image repository names must be lowercase and use valid separators.");const h=p.map((e,t)=>u&&0===t?e.toLowerCase():e).join("/"),g=a?`sha256:${a[1].toLowerCase()}`:void 0;return`${h}${d?`:${d}`:""}${g?`@${g}`:""}`}function cr(e){const t=rr(e),n=t.indexOf("@"),i=-1===n?void 0:t.slice(n+1),s=-1===n?t:t.slice(0,n),a=s.lastIndexOf("/"),o=s.lastIndexOf(":"),r=o>a;return{reference:t,repository:r?s.slice(0,o):s,tag:r?s.slice(o+1):void 0,digest:i}}const dr=f.z.string().trim().min(1).max(512).transform((e,t)=>{try{return rr(e)}catch(e){return t.addIssue({code:"custom",message:e instanceof Error?e.message:String(e)}),f.z.NEVER}}),lr=f.z.string().trim().transform((e,t)=>{const n=sr.exec(e);return n?`sha256:${n[1].toLowerCase()}`:(t.addIssue({code:"custom",message:"Docker image digest must use sha256 followed by 64 hexadecimal characters."}),f.z.NEVER)}),pr=f.z.object({modelEntityIds:f.z.array(Qo).max(64).transform(e=>[...new Set(e)]).optional(),codexModelHash:Qo.nullable().optional(),claudeModelHash:Qo.nullable().optional(),opencodeModelHash:Qo.nullable().optional()}).strict().default({}),ur=f.z.object({imageId:Qo,tag:f.z.string().trim().min(1).max(128).regex(ir).optional()}).strict(),mr=f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal("image"),imageSelection:ur}).strict(),f.z.object({type:f.z.literal("template"),environmentTemplateId:Qo}).strict()]),hr=f.z.enum(["creating","ready","failed","deleting"]),gr=f.z.enum(["linux","darwin","win32","freebsd","openbsd","aix","sunos","unknown"]),fr=f.z.enum(["x64","arm64","arm","ia32","ppc64","s390x","riscv64","unknown"]),yr=f.z.object({code:f.z.string().trim().min(1).max(120),message:f.z.string().trim().min(1).max(2048),phase:f.z.enum(["validate","commit","inspect","security-check","persist","delete","recovery"]).optional()}).strict(),br=f.z.object({templateId:Qo,nodeId:Qo,imageId:lr,name:f.z.string().trim().min(1).max(160),platform:gr,architecture:fr}).strict(),vr=f.z.enum(["data","agent-home","workspace"]),Ir=f.z.object({deleteVolumes:f.z.boolean()}).strict(),xr=f.z.object({role:vr,name:f.z.string().trim().min(1).max(255),mountPath:f.z.string().trim().startsWith("/").max(4096),status:f.z.enum(["deleted","retained","missing","failed"]),error:f.z.object({code:f.z.string().trim().min(1).max(120),message:f.z.string().trim().min(1).max(2048)}).strict().optional()}).strict(),wr=f.z.object({instanceId:Qo,containerDeleted:f.z.boolean(),completed:f.z.boolean(),deletedVolumes:f.z.array(xr),retainedVolumes:f.z.array(xr),volumeResults:f.z.array(xr)}).strict(),Sr={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"};function Ar(e,t){if(e&&"object"==typeof e&&!Array.isArray(e)){const t=e;return{imageId:"string"==typeof t.imageId&&Sr[t.imageId]||t.imageId,..."string"==typeof t.tag?{tag:t.tag}:{}}}if("string"==typeof t)return{imageId:Sr[t]||t}}function Er(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,{defaultImageId:n,defaultRuntimeId:i,...s}=t;return{...s,source:Md(t.source),defaultImageSelection:Ar(t.defaultImageSelection,n)}}const _r=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(120),kind:f.z.enum(["tty","gui","web"]),source:f.z.enum(["builtin","custom"]),availability:f.z.enum(["available","missing-dependency"]),capabilities:f.z.object({automation:f.z.enum(["cdp"]).optional(),supportsCwdSelection:f.z.boolean().default(!1)}).strict().default({supportsCwdSelection:!1}),diagnosticCode:f.z.enum(["APP_EXECUTABLE_NOT_FOUND"]).optional()}).strict(),Tr=f.z.object({code:f.z.enum(["APP_CATALOG_INVALID"]),message:f.z.string().trim().min(1).max(500)}).strict(),zr=f.z.object({items:f.z.array(_r).max(256),observedAt:Zo,issues:f.z.array(Tr).max(32).default([])}).strict(),kr=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),sourceInstanceId:Qo,nodeId:Qo,imageId:lr.optional(),internalTag:f.z.string().trim().min(1).max(512).optional(),platform:gr.optional(),architecture:fr.optional(),sizeBytes:f.z.number().int().nonnegative().optional(),status:hr,error:yr.optional(),createdAt:Zo,updatedAt:Zo}).strict().superRefine((e,t)=>{if("ready"===e.status)for(const n of["imageId","internalTag","platform","architecture","sizeBytes"])void 0===e[n]&&t.addIssue({code:"custom",path:[n],message:`Ready environment template requires ${n}.`});"failed"!==e.status||e.error||t.addIssue({code:"custom",path:["error"],message:"Failed environment template requires an error diagnostic."})}),Nr=f.z.enum(["apt","dnf","brew","npm"]),Cr=f.z.enum(["user","passwordless-sudo","root"]),Rr=f.z.object({platform:gr,arch:fr,installers:f.z.array(Nr).max(8),privilege:Cr,installerAccess:f.z.object({npmGlobalWritable:f.z.boolean().optional()}).strict().optional()}).strict(),Or=f.z.enum(["installed","not-installed","broken","unsupported"]),jr=f.z.enum(["recipe","bundled","external","none"]),Pr=f.z.object({code:f.z.enum(["BUNDLED","EXTERNALLY_MANAGED","ALREADY_INSTALLED","NOT_INSTALLED","UNSUPPORTED_PLATFORM","INSTALLER_UNAVAILABLE","INSTALLER_NOT_WRITABLE","INSUFFICIENT_PRIVILEGE","OPERATION_IN_PROGRESS"]),message:f.z.string().trim().min(1).max(500)}).strict(),Dr=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(120),kind:f.z.enum(["tty","gui","web"]),description:f.z.string().trim().max(500).optional(),state:Or,managementSource:jr,version:f.z.string().trim().max(120).optional(),canInstall:f.z.boolean(),canUninstall:f.z.boolean(),installReason:Pr.optional(),uninstallReason:Pr.optional(),activeJobId:Qo.optional()}).strict(),Lr=f.z.enum(["install","uninstall"]),Mr=f.z.enum(["queued","running","succeeded","failed","cancelled","interrupted"]),qr=f.z.object({current:f.z.number().finite().nonnegative().optional(),total:f.z.number().finite().positive().optional(),unit:f.z.string().trim().min(1).max(40).optional()}).strict().refine(e=>void 0===e.total||void 0===e.current||e.current<=e.total,{message:"Progress current must not exceed total.",path:["current"]}),Ur=f.z.object({executable:f.z.string().trim().min(1).max(4096),args:f.z.array(f.z.string().max(4096)).max(128)}).strict(),$r=f.z.object({code:f.z.string().trim().min(1).max(120).regex(/^[a-z0-9][a-z0-9._-]*$/),message:f.z.string().trim().min(1).max(4096),retryable:f.z.boolean(),sessionIds:f.z.array(Qo).max(64).optional()}).strict(),Br=f.z.object({id:Qo,requestId:Qo.optional(),appId:Qo,operation:Lr,state:Mr,phase:f.z.string().trim().min(1).max(120).optional(),progress:qr.optional(),command:Ur.optional(),logTail:f.z.string().max(32768).optional(),logTruncated:f.z.boolean().optional(),error:$r.optional(),requestedAt:Zo,startedAt:Zo.optional(),finishedAt:Zo.optional(),updatedAt:Zo}).strict(),Fr=f.z.object({streamId:Qo,sequence:f.z.number().int().nonnegative(),capabilities:Rr,apps:f.z.array(Dr).max(256),activeJobs:f.z.array(Br).max(256),recentJobs:f.z.array(Br).max(256),observedAt:Zo}).strict(),Hr=f.z.object({requestId:Qo.optional()}).strict(),Gr=f.z.object({job:Br}).strict();f.z.object({type:f.z.literal("app-management"),streamId:Qo,sequence:f.z.number().int().nonnegative(),observedAt:Zo,job:Br.optional(),snapshot:Fr.optional()}).strict().refine(e=>void 0!==e.job||void 0!==e.snapshot,{message:"An app management event requires a job or snapshot."});const Wr=f.z.object({component:f.z.enum(["control-plane","node-agent","controlled-instance"]),packageName:f.z.string().trim().max(160).optional(),packageVersion:f.z.string().trim().max(80).optional(),protocolVersion:$o.optional(),buildId:f.z.string().trim().max(160).optional(),builtAt:f.z.string().trim().max(120).optional(),gitCommit:f.z.string().trim().max(120).optional(),imageRef:f.z.string().trim().max(512).optional(),imageDigest:f.z.string().trim().max(240).optional()}).strict(),Vr=f.z.object({data:f.z.object({ok:f.z.literal(!0),role:f.z.literal("control-plane"),protocolVersion:$o,build:Wr.extend({component:f.z.literal("control-plane"),packageVersion:f.z.string().trim().min(1).max(80)}).loose(),serverTime:Zo}).loose()}).loose(),Kr=f.z.enum(["stable","beta","alpha"]),Yr=f.z.object({packageName:f.z.literal("@task-handoff/controlled-instance"),version:f.z.string().trim().min(1).max(80),platform:f.z.string().trim().min(1).max(40),arch:f.z.string().trim().min(1).max(40),formatVersion:f.z.number().int().positive(),launcherAbi:f.z.number().int().positive(),entrypoint:f.z.string().trim().min(1).max(512),sha256:f.z.string().regex(/^[a-f0-9]{64}$/)}).strict(),Xr=f.z.object({code:f.z.enum(["INSTANCE_RUNTIME_VERSION_MISMATCH","INSTANCE_RUNTIME_ARTIFACT_UNAVAILABLE","INSTANCE_RUNTIME_ARTIFACT_INVALID","INSTANCE_RUNTIME_INSTALL_FAILED","INSTANCE_RUNTIME_RESTART_FAILED","INSTANCE_RUNTIME_VERIFICATION_FAILED","INSTANCE_BASE_RUNTIME_INCOMPATIBLE","NODE_UPDATE_PREFLIGHT_FAILED","NODE_UPDATE_FAILED","LEGACY_INSTANCE_UPDATE_RETIRED"]),message:f.z.string().trim().min(1).max(4096),expectedVersion:f.z.string().trim().min(1).max(80).optional(),actualVersion:f.z.string().trim().min(1).max(80).optional(),retryable:f.z.boolean().default(!1)}).strict(),Jr=f.z.object({desiredVersion:f.z.string().trim().min(1).max(80),actualVersion:f.z.string().trim().min(1).max(80).optional(),phase:f.z.enum(["pending","draining","installing","restarting","verifying","matched","failed"]),attempt:f.z.number().int().nonnegative().default(0),lastAttemptAt:Zo.optional(),matchedAt:Zo.optional(),error:Xr.optional()}).strict(),Qr=f.z.object({runningInstanceCount:f.z.number().int().nonnegative(),stoppedInstanceCount:f.z.number().int().nonnegative(),activeInstanceCount:f.z.number().int().nonnegative(),restartInstanceCount:f.z.number().int().nonnegative(),runningInstanceIds:f.z.array(Qo).max(1024).default([]),stoppedInstanceIds:f.z.array(Qo).max(1024).default([]),activeInstanceIds:f.z.array(Qo).max(1024).default([])}).strict(),Zr=f.z.object({phase:f.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),desiredVersion:f.z.string().trim().min(1).max(80),nodeVersion:f.z.string().trim().min(1).max(80).optional(),expectedInstanceIds:f.z.array(Qo).max(1024).default([]),expectedInstanceCount:f.z.number().int().nonnegative(),matchedInstanceCount:f.z.number().int().nonnegative(),pendingInstanceCount:f.z.number().int().nonnegative(),failedInstanceCount:f.z.number().int().nonnegative(),deferredInstanceCount:f.z.number().int().nonnegative().default(0)}).strict(),ec=f.z.object({channel:Kr.default("stable")}).strict(),tc=f.z.object({source:f.z.literal("npm"),channel:Kr,currentVersion:f.z.string().trim().max(240).optional(),availableVersion:f.z.string().trim().min(1).max(240),artifactRef:f.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:f.z.array(Yr).default([]),impact:Qr,updateAvailable:f.z.boolean(),supported:f.z.boolean().default(!0),reason:f.z.string().trim().max(2048).optional(),checkedAt:Zo,preflightToken:f.z.string().trim().min(16).max(240).optional()}).strict(),nc=f.z.object({id:Qo,nodeId:Qo,source:f.z.literal("npm"),channel:Kr,fromVersion:f.z.string().trim().max(240).optional(),toVersion:f.z.string().trim().min(1).max(240),artifactRef:f.z.string().trim().min(1).max(512).optional(),runtimeArtifacts:f.z.array(Yr).default([]),impact:Qr,rollout:Zr,status:f.z.enum(["queued","updating-node","restarting-node","converging-instances","succeeded","degraded","failed"]),error:Xr.optional(),startedAt:Zo.optional(),completedAt:Zo.optional(),createdAt:Zo,updatedAt:Zo}).strict(),ic=f.z.object({channel:Kr,targetVersion:f.z.string().trim().min(1).max(240),preflightToken:f.z.string().trim().min(16).max(240)}).strict(),sc=f.z.object({type:f.z.enum(["branch","tag"]),name:f.z.string().trim().min(1).max(240)}).strict(),ac=f.z.object({type:f.z.literal("commit"),commit:f.z.string().trim().regex(/^[0-9a-fA-F]{4,64}$/,"commit must be a hexadecimal Git object id")}).strict(),oc=f.z.discriminatedUnion("type",[sc,ac]),rc=f.z.object({type:f.z.enum(["none","ssh-key","https-token"]).default("none"),secretId:f.z.string().trim().min(1).max(120).optional()}).strict(),cc=f.z.object({depth:f.z.number().int().positive().max(1e5).optional(),submodules:f.z.boolean().default(!1),lfs:f.z.boolean().default(!1),subdirectory:f.z.string().trim().max(240).refine(e=>!e.startsWith("/")&&!e.split("/").some(e=>".."===e),"subdirectory must be a relative path within the repository").transform(e=>e.split("/").filter(e=>e&&"."!==e).join("/")).default("")}).strict();f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),url:f.z.string().trim().min(1).max(2048),provider:f.z.string().trim().max(80).optional(),ref:oc.default({type:"branch",name:"main"}),auth:rc.default({type:"none"}),clone:cc.default({submodules:!1,lfs:!1,subdirectory:""}),defaultImageSelection:ur.optional(),labels:er,createdAt:Zo,updatedAt:Zo}).strict();const dc=f.z.object({id:Qo,nodeId:Qo,name:f.z.string().trim().min(1).max(160),path:f.z.string().trim().min(1).max(4096),defaultImageSelection:ur.optional(),labels:er,createdAt:Zo,updatedAt:Zo}).strict(),lc=f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal("git-repository"),repositoryId:Qo.optional(),url:f.z.string().trim().min(1).max(2048),provider:f.z.string().trim().max(80).optional(),ref:oc.default({type:"branch",name:"main"}),auth:rc.default({type:"none"}),clone:cc.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),f.z.object({type:f.z.literal("git-template"),url:f.z.string().trim().min(1).max(2048),templateId:f.z.string().trim().min(1).max(120).optional(),ref:oc.default({type:"branch",name:"main"}),auth:rc.default({type:"none"}),clone:cc.default({submodules:!1,lfs:!1,subdirectory:""})}).strict(),f.z.object({type:f.z.literal("local-folder"),localFolderId:Qo.optional(),path:f.z.string().trim().min(1).max(4096),ownerNodeId:Qo.optional()}).strict()]);function pc(e){const t=lc.parse(e);return"local-folder"===t.type?t:lc.parse({...t,auth:{type:"none"}})}const uc=f.z.object({mode:f.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]),path:f.z.string().trim().min(1).max(4096).default("/workspace"),volumeName:f.z.string().trim().max(240).optional(),readOnly:f.z.boolean().default(!1)}).strict(),mc=f.z.enum(["codex","claude","opencode"]),hc=f.z.enum(["openai-responses","openai-chat-completions","anthropic-messages"]),gc=f.z.object({name:f.z.string().trim().min(1).max(240),order:f.z.number().int().min(0).max(1e6).default(0)}).strict(),fc=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),source:lc,defaultImageSelection:ur.optional(),defaultNodeId:Qo.optional(),workspacePolicy:uc,labels:er,createdAt:Zo,updatedAt:Zo}).strict(),yc=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),endpoint:f.z.string().trim().min(1).max(2048),key:f.z.string().trim().min(1).max(4096),model:f.z.string().trim().min(1).max(240),modelNames:f.z.array(gc).max(256).default([]),protocols:f.z.array(hc).max(3).default([]),app:mc,enabled:f.z.boolean().default(!0),order:f.z.number().int().min(0).max(1e6).default(0),labels:er,createdAt:Zo,updatedAt:Zo}).strict(),bc=yc.omit({key:!0}).extend({keyPreview:f.z.string().trim().min(1).max(160),keySet:f.z.boolean()}).strict(),vc=bc.extend({referenceCount:f.z.number().int().min(0)}).strict(),Ic=f.z.object({instanceId:Qo,modelEntityIds:f.z.array(Qo).max(64).transform(e=>[...new Set(e)]).optional(),codexModelHash:Qo.optional(),claudeModelHash:Qo.optional(),opencodeModelHash:Qo.optional(),updatedAt:Zo}).strict().transform(e=>({...e,modelEntityIds:e.modelEntityIds?.length?e.modelEntityIds:[...new Set([e.codexModelHash,e.claudeModelHash,e.opencodeModelHash].filter(e=>Boolean(e)))]})),xc=f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal("control-plane"),name:yc.shape.name,enabled:yc.shape.enabled,order:yc.shape.order}).strict(),f.z.object({type:f.z.literal("node"),nodeId:Qo,name:yc.shape.name,enabled:yc.shape.enabled,order:yc.shape.order,referenceCount:f.z.number().int().min(0)}).strict()]),wc=f.z.object({id:Qo,model:bc,locations:f.z.array(xc).min(1),referenceCount:f.z.number().int().min(0).default(0)}).strict(),Sc=f.z.object({nodeId:Qo,code:f.z.string().trim().min(1).max(120),message:f.z.string().trim().min(1).max(2e3)}).strict(),Ac=f.z.object({models:f.z.array(wc),nodeDiagnostics:f.z.array(Sc).default([]),updatedAt:Zo}).strict();function Ec(e){const t={app:mc.parse(e.app),endpoint:yc.shape.endpoint.parse(e.endpoint),key:yc.shape.key.parse(e.key),model:yc.shape.model.parse(e.model)};return`mdl_${i.createHash("sha256").update(JSON.stringify(t)).digest("hex")}`}yc.omit({id:!0,createdAt:!0,updatedAt:!0}).strict().partial().strict(),f.z.object({modelSelection:pr,modelEntityIds:f.z.array(Qo).max(64).transform(e=>[...new Set(e)]).optional(),codexModelHash:Qo.optional(),claudeModelHash:Qo.optional(),opencodeModelHash:Qo.optional()}).strict().transform(e=>({...e,modelEntityIds:e.modelEntityIds||e.modelSelection.modelEntityIds||[...new Set([e.codexModelHash,e.claudeModelHash,e.opencodeModelHash].filter(e=>Boolean(e)))]}));const _c=f.z.enum(["market","custom"]),Tc=f.z.enum(["active","deprecated","yanked"]),zc=f.z.discriminatedUnion("kind",[f.z.object({kind:f.z.literal("builtin"),key:f.z.string().trim().min(1).max(120)}).strict(),f.z.object({kind:f.z.literal("remote"),url:f.z.string().trim().url().max(2048),mediaType:f.z.enum(["image/png","image/jpeg","image/webp"]).optional(),digest:lr.optional()}).strict()]),kc={kind:"builtin",key:"default-image-cover"},Nc=f.z.array(f.z.string().trim().min(1).max(80)).default([]),Cc=f.z.array(f.z.string().trim().min(1).max(120)).default([]),Rc=f.z.record(f.z.string().trim().min(2).max(35),f.z.string().trim().min(1).max(4096)),Oc=f.z.object({os:f.z.string().trim().min(1).max(40),architecture:f.z.string().trim().min(1).max(40),digest:lr.optional(),downloadSizeBytes:f.z.number().int().positive().optional(),unpackedSizeBytes:f.z.number().int().positive().optional()}).strict(),jc=f.z.object({name:f.z.string().trim().min(1).max(128).regex(ir),version:f.z.string().trim().min(1).max(160).optional(),reference:dr,manifestDigest:lr.optional(),publishedAt:Zo.optional(),platforms:f.z.array(Oc).default([]),status:Tc.default("active")}).strict(),Pc=f.z.object({id:Qo,publisher:f.z.string().trim().min(1).max(160),slug:f.z.string().trim().min(1).max(160),name:f.z.string().trim().min(1).max(160),description:f.z.string().trim().min(1).max(4096),localizedDescriptions:Rc.optional(),cover:zc.optional(),repository:f.z.string().trim().min(1).max(512),defaultTag:f.z.string().trim().min(1).max(128).regex(ir),tags:f.z.array(jc).min(1),capabilities:Nc,optionalApps:Cc,defaultEnv:tr,labels:er,status:Tc.default("active")}).strict().superRefine((e,t)=>{e.tags.some(t=>t.name===e.defaultTag)||t.addIssue({code:"custom",path:["defaultTag"],message:"Market defaultTag must identify one of the image tags."})}),Dc=f.z.object({protocolVersion:$o,catalogId:Qo,revision:f.z.string().trim().min(1).max(240),source:f.z.enum(["embedded","remote","cache"]),generatedAt:Zo,expiresAt:Zo.optional(),items:f.z.array(Pc)}).strict(),Lc=f.z.object({source:f.z.enum(["embedded","remote","cache"]),state:f.z.enum(["ready","refreshing","stale","failed"]),revision:f.z.string().trim().min(1).max(240),updatedAt:Zo,error:f.z.string().trim().max(4096).optional()}).strict(),Mc=f.z.object({id:Qo,origin:f.z.literal("custom"),name:f.z.string().trim().min(1).max(160),description:f.z.string().trim().max(4096).optional(),localizedDescriptions:Rc.optional(),cover:zc.optional(),reference:dr,repository:f.z.string().trim().min(1).max(512),tag:f.z.string().trim().min(1).max(128).regex(ir).optional(),pullPolicy:f.z.literal("if-not-present").default("if-not-present"),capabilities:Nc,optionalApps:Cc,defaultEnv:tr,labels:er,createdAt:Zo,updatedAt:Zo}).strict(),qc=f.z.object({name:f.z.string().trim().min(1).max(128).regex(ir),version:f.z.string().trim().min(1).max(160).optional(),reference:dr,manifestDigest:lr.optional(),status:Tc}).strict(),Uc=f.z.object({id:Qo,origin:_c,name:f.z.string().trim().min(1).max(160),description:f.z.string().trim().max(4096).optional(),localizedDescriptions:Rc.optional(),cover:zc,repository:f.z.string().trim().min(1).max(512),tag:f.z.string().trim().min(1).max(128).regex(ir).optional(),availableTags:f.z.array(qc),reference:dr,digest:lr.optional(),downloadSizeBytes:f.z.number().int().positive().optional(),unpackedSizeBytes:f.z.number().int().positive().optional(),capabilities:Nc,optionalApps:Cc,defaultEnv:tr,labels:er,readOnly:f.z.boolean(),lifecycleStatus:Tc.optional(),market:f.z.object({catalogId:Qo,catalogRevision:f.z.string().trim().min(1).max(240),publisher:f.z.string().trim().min(1).max(160),version:f.z.string().trim().min(1).max(160).optional()}).strict().optional()}).strict(),$c=f.z.object({id:Qo,origin:_c,name:f.z.string().trim().min(1).max(160),description:f.z.string().trim().max(4096).optional(),localizedDescriptions:Rc.optional(),cover:zc.optional(),repository:f.z.string().trim().min(1).max(512),tag:f.z.string().trim().min(1).max(128).regex(ir).optional(),requestedReference:dr,resolvedDigest:lr.optional(),resolvedReference:dr.optional(),downloadSizeBytes:f.z.number().int().positive().optional(),pullPolicy:f.z.literal("if-not-present").default("if-not-present"),capabilities:Nc,optionalApps:Cc,defaultEnv:tr,labels:er,market:f.z.object({catalogId:Qo,catalogRevision:f.z.string().trim().min(1).max(240),publisher:f.z.string().trim().min(1).max(160),version:f.z.string().trim().min(1).max(160).optional()}).strict().optional(),createdAt:Zo,updatedAt:Zo}).strict(),Bc=f.z.object({phase:f.z.enum(["checking-image","pulling-image","resolving-image","ready","failed"]),requestedReference:dr,generation:f.z.number().int().nonnegative().default(0),error:f.z.string().trim().max(4096).optional(),startedAt:Zo,updatedAt:Zo}).strict(),Fc="image.pull.terminal.output",Hc="image.pull.terminal.finished",Gc=f.z.object({instanceId:Qo,generation:f.z.number().int().nonnegative(),requestedReference:dr,sequence:f.z.number().int().nonnegative(),observedAt:Zo}).strict(),Wc=Gc.extend({data:f.z.string().min(1).max(65536),replay:f.z.boolean().optional()}).strict(),Vc=Gc.extend({outcome:f.z.enum(["succeeded","failed"])}).strict(),Kc=Gc.extend({status:f.z.enum(["connecting","pulling","extracting","complete","failed"]),layers:f.z.object({total:f.z.number().int().nonnegative(),completed:f.z.number().int().nonnegative(),downloaded:f.z.number().int().nonnegative(),downloading:f.z.number().int().nonnegative(),extracting:f.z.number().int().nonnegative()}).strict(),bytes:f.z.object({current:f.z.number().finite().nonnegative(),total:f.z.number().finite().positive()}).strict().optional(),percent:f.z.number().finite().min(0).max(100).optional(),message:f.z.string().trim().min(1).max(500),terminalTail:f.z.string().max(262144).optional(),terminalTruncated:f.z.boolean().optional()}).strict();function Yc(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=new Set(["id","origin","name","description","localizedDescriptions","cover","reference","repository","tag","image","registry","pullPolicy","capabilities","optionalApps","defaultEnv","labels","createdAt","updatedAt"]);for(const e of Object.keys(n))i.has(e)||t?.({imageId:"string"==typeof n.id?n.id:void 0,field:e});const s="string"==typeof n.id?n.id:void 0,a="string"==typeof n.image?n.image:void 0;void 0!==a&&t?.({imageId:s,field:"image"}),Object.prototype.hasOwnProperty.call(n,"registry")&&t?.({imageId:s,field:"registry"});let o,r="string"==typeof n.reference?n.reference:a;if(r)try{r=rr(r)}catch{if(!r.includes("@")&&r.lastIndexOf(":")<=r.lastIndexOf("/"))try{r=rr(`${r}:latest`),t?.({imageId:s,field:"reference:implicit-latest"})}catch{}}try{o=r?cr(r):void 0}catch{}return{id:n.id,origin:"custom",name:n.name,description:n.description,localizedDescriptions:n.localizedDescriptions,cover:qd(n.cover,["kind","key","url","mediaType","digest"]),reference:o?.reference??r,repository:o?.repository??n.repository,tag:o?.tag??n.tag,pullPolicy:n.pullPolicy??"if-not-present",capabilities:n.capabilities,optionalApps:n.optionalApps,defaultEnv:n.defaultEnv,labels:n.labels,createdAt:n.createdAt,updatedAt:n.updatedAt}}const Xc=f.z.discriminatedUnion("kind",[f.z.object({kind:f.z.literal("direct")}).strict(),f.z.object({kind:f.z.literal("control-plane-proxy"),proxyId:Qo,proxyBindingId:Qo,targetNodeId:Qo}).strict()]),Jc=f.z.object({pingRttMs:f.z.number().nonnegative().optional(),pingRttP95Ms:f.z.number().nonnegative().optional(),consecutiveReconnects:f.z.number().int().nonnegative(),nextRetryAt:Zo.optional()}).strict();f.z.object({nodeId:Qo,inviteId:Qo.optional()}).strict();const Qc=f.z.discriminatedUnion("status",[f.z.object({id:Qo,status:f.z.literal("pending")}).strict(),f.z.object({id:Qo,status:f.z.literal("completed"),nodeId:Qo}).strict()]),Zc=f.z.object({reachability:f.z.enum(["unknown","reachable","unreachable"]),bindingStatus:f.z.enum(["unknown","active","revoked"]),bindingRevision:f.z.number().int().positive().optional(),streamId:f.z.string().trim().min(1).max(160).optional(),revision:f.z.number().int().nonnegative().optional(),observedAt:Zo.optional(),target:So.optional(),lastError:ho.optional(),updatedAt:Zo}).strict(),ed=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),connectionMode:f.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]).default("direct-http"),connectionPath:Xc.default({kind:"direct"}),connectionEnabled:f.z.boolean().default(!0),auth:f.z.object({mode:f.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:Qo.optional(),secret:f.z.string().trim().max(4096).optional(),pairedAt:Zo.optional(),pairing:f.z.object({status:f.z.enum(["pending","paired","expired"]).default("pending"),joinToken:f.z.string().trim().max(4096).optional(),expiresAt:Zo.optional()}).strict().optional()}).strict().default({mode:"local-static-key"}),endpoint:f.z.string().trim().max(2048).optional(),controlEndpoint:f.z.string().trim().max(2048).optional(),containerEndpoint:f.z.string().trim().max(2048).optional(),publicWebBase:f.z.string().trim().max(2048).optional(),status:f.z.enum(["unknown","online","offline","degraded"]).default("unknown"),health:f.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),capabilities:f.z.record(f.z.string(),f.z.unknown()).default({}),proxyState:Zc.optional(),appInventory:zr.optional(),labels:er,lastSeenAt:Zo.optional(),createdAt:Zo,updatedAt:Zo}).strict().superRefine((e,t)=>{"control-plane-proxy"===e.connectionPath.kind&&"control-plane-proxy"!==e.connectionMode&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy paths require control-plane-proxy connection mode."}),"control-plane-proxy"===e.connectionMode&&"control-plane-proxy"!==e.connectionPath.kind&&t.addIssue({code:"custom",path:["connectionPath"],message:"Control-plane proxy nodes require a control-plane-proxy connection path."})}),td=f.z.object({nodeId:Qo,status:f.z.enum(["unknown","online","offline","degraded"]),health:f.z.enum(["unknown","ok","degraded","failed"]),lastSeenAt:Zo.nullable(),connectionPhase:f.z.enum(["connecting","handshaking","healthy","reconnecting","suspect","offline"]).nullable(),connectionDiagnostics:Jc.nullable(),proxyState:Zc.nullable()}).strict(),nd=f.z.object({id:Qo,nodeId:Qo,name:f.z.string().trim().min(1).max(160),type:f.z.enum(["docker","kubernetes","local"]),status:f.z.enum(["unknown","online","offline","degraded"]).default("unknown"),accessStrategy:f.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),capabilities:f.z.record(f.z.string(),f.z.unknown()).default({}),labels:er,createdAt:Zo,updatedAt:Zo}).strict(),id=f.z.object({instanceId:Qo,runtimeKind:f.z.literal("docker"),state:f.z.enum(["pending","available","stopped","unavailable"]),sampledAt:Zo,cpu:f.z.object({usagePercent:f.z.number().nonnegative()}).strict().optional(),memory:f.z.object({usageBytes:f.z.number().nonnegative(),limitBytes:f.z.number().nonnegative().optional(),usagePercent:f.z.number().nonnegative().optional()}).strict().optional(),network:f.z.object({rxBytes:f.z.number().nonnegative(),txBytes:f.z.number().nonnegative()}).strict().optional(),blockIo:f.z.object({readBytes:f.z.number().nonnegative(),writeBytes:f.z.number().nonnegative()}).strict().optional(),pids:f.z.number().int().nonnegative().optional(),error:f.z.string().trim().max(2048).optional()}).strict(),sd=f.z.object({registry:f.z.boolean().default(!1),runtimeBroker:f.z.boolean().default(!1),workspaceProvisioning:f.z.object({docker:f.z.boolean().default(!1),kubernetes:f.z.boolean().default(!1),local:f.z.boolean().default(!1)}).strip().default({docker:!1,kubernetes:!1,local:!1})}).strip(),ad=f.z.object({multiEntityAssignment:f.z.boolean().default(!1),privateModelCatalog:f.z.boolean().default(!1)}).strip(),od=f.z.object({modelEndpointProbe:f.z.boolean().optional(),aiSessionHistoryLimit:f.z.boolean().optional(),aiSessionAttachmentRetention:f.z.boolean().optional(),aiSessionFileAttachmentLimit:f.z.boolean().optional(),folderPlaces:f.z.boolean().optional(),localFolderNameUpdate:f.z.boolean().optional(),managedGitCredentials:sd.optional(),managedModels:ad.optional()}).strip();function rd(e){const t=od.safeParse(e),n=t.success?t.data:{};return{...n,managedGitCredentials:sd.parse(n.managedGitCredentials||{}),managedModels:ad.parse(n.managedModels||{})}}function cd(e){return rd(e).managedGitCredentials.registry}function dd(e){return rd(e).managedGitCredentials.runtimeBroker}function ld(e){return!0===od.safeParse(e).data?.aiSessionFileAttachmentLimit}const pd=f.z.object({status:f.z.enum(["healthy","congested","recovering"]),activeOutputs:f.z.number().int().nonnegative(),bufferedBytes:f.z.number().int().nonnegative(),peakBufferedBytes:f.z.number().int().nonnegative(),coalescedEvents:f.z.number().int().nonnegative(),oversizedEvents:f.z.number().int().nonnegative().optional(),peakEventBytes:f.z.number().int().nonnegative().optional(),congestedSince:Zo.optional(),lastCongestedAt:Zo.optional()}).strip(),ud=f.z.object({ok:f.z.boolean().optional(),role:f.z.string().optional(),nodeId:Qo.optional(),platform:gr.optional(),arch:fr.optional(),protocolVersion:$o.optional(),capabilities:od.optional(),build:Wr.strip().optional(),process:f.z.object({pid:f.z.number().int().positive(),startIdentity:f.z.string().trim().min(1).optional()}).strip().optional(),listener:f.z.object({host:f.z.string().trim().min(1),port:f.z.number().int().min(1).max(65535)}).strip().optional(),instanceProxy:f.z.object({requests:f.z.number().int().nonnegative(),active:f.z.number().int().nonnegative(),completed:f.z.number().int().nonnegative(),aborted:f.z.number().int().nonnegative(),limitRejected:f.z.number().int().nonnegative(),responseBytes:f.z.number().nonnegative(),totalDurationMs:f.z.number().nonnegative(),maxResponseBytes:f.z.number().int().nonnegative()}).partial().strip().optional(),eventTransport:pd.optional(),serverTime:Zo.optional()}).strip(),md=f.z.object({bindScope:f.z.enum(["loopback","all-ipv4"]),port:f.z.number().int().min(1).max(65535)}).strict().extend({host:f.z.enum(["127.0.0.1","0.0.0.0"]),status:f.z.enum(["listening","error"]),source:f.z.enum(["bootstrap","persisted"]),error:f.z.string().trim().max(2048).optional()}).strict(),hd=f.z.object({nodeId:Qo,joinToken:f.z.string().trim().min(1),expiresAt:Zo}).passthrough(),gd=f.z.object({nodeId:Qo,keyId:Qo,secret:f.z.string().regex(/^[A-Za-z0-9_-]{32,128}$/),pairedAt:Zo}).strict(),fd=f.z.object({id:Qo,keyId:Qo,name:f.z.string().trim().min(1).max(160).optional(),pairedAt:Zo,updatedAt:Zo,current:f.z.boolean()}).passthrough(),yd=f.z.object({keyId:Qo,revoked:f.z.literal(!0),revokedAt:Zo}).strict(),bd=f.z.object({id:Qo,pairingKeyId:Qo,url:f.z.string().trim().min(1).max(2048),name:f.z.string().trim().min(1).max(160).optional(),enabled:f.z.boolean(),createdAt:Zo,updatedAt:Zo,status:f.z.enum(["disabled","connecting","connected","reconnecting","failed"]),pingRttMs:f.z.number().nonnegative().optional(),pingRttP95Ms:f.z.number().nonnegative().optional(),consecutiveReconnects:f.z.number().int().nonnegative().optional(),nextRetryAt:Zo.optional(),lastConnectedAt:Zo.optional(),lastDisconnectedAt:Zo.optional(),error:f.z.string().optional()}).passthrough(),vd=f.z.object({pairing:fd,connection:f.z.object({id:Qo,pairingKeyId:Qo,url:f.z.string().trim().min(1).max(2048),name:f.z.string().trim().min(1).max(160).optional(),enabled:f.z.boolean(),createdAt:Zo,updatedAt:Zo}).passthrough(),tunnel:f.z.object({status:f.z.enum(["disabled","saved","connecting","connected","failed"]),error:f.z.string().trim().max(2048).optional()}).passthrough()}).passthrough(),Id=f.z.object({deleted:f.z.boolean().optional()}).passthrough(),xd=f.z.object({repository:f.z.string().trim().optional(),tag:f.z.string().trim().optional(),id:f.z.string().trim(),createdSince:f.z.string().trim().optional(),size:f.z.string().trim().optional(),sizeBytes:f.z.number().int().nonnegative().optional(),reference:f.z.string().trim().min(1),repoDigests:f.z.array(f.z.string().trim().min(1).max(512)).default([])}).passthrough(),wd=f.z.object({image:Uc,status:f.z.enum(["available","pull-required","unknown"]),localImage:xd.optional(),localSizeBytes:f.z.number().int().nonnegative().optional(),downloadSizeBytes:f.z.number().int().positive().optional(),unpackedSizeBytes:f.z.number().int().positive().optional(),error:f.z.string().trim().max(2048).optional()}).strict(),Sd=f.z.lazy(()=>f.z.object({name:f.z.string().trim().min(1),path:f.z.string().trim().min(1).max(4096),children:f.z.array(Sd)}).passthrough()),Ad=f.z.object({kind:f.z.enum(["home","root"]),name:f.z.string().trim().min(1),path:f.z.string().trim().min(1).max(4096)}).passthrough(),Ed=f.z.object({status:f.z.number().int().min(100).max(599).optional(),headers:f.z.record(f.z.string(),f.z.string()).optional(),bodyBase64:f.z.string().optional()}).passthrough(),_d=f.z.object({strategy:f.z.enum(["node-proxy","direct-port","kubernetes-ingress","kubernetes-port-forward"]).default("node-proxy"),web:f.z.string().trim().max(2048).optional(),api:f.z.string().trim().max(2048).optional(),vnc:f.z.string().trim().max(2048).optional(),tty:f.z.string().trim().max(2048).optional(),logs:f.z.string().trim().max(2048).optional(),status:f.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict(),Td=f.z.object({..._d.shape}).strict(),zd=f.z.object({strategy:f.z.enum(["control-plane-proxy","direct-port","node-proxy","kubernetes-ingress","kubernetes-port-forward"]).default("control-plane-proxy"),web:f.z.string().trim().max(2048).optional(),api:f.z.string().trim().max(2048).optional(),ws:f.z.string().trim().max(2048).optional(),status:f.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown")}).strict().default({strategy:"control-plane-proxy",status:"unknown"}),kd=f.z.object({mode:f.z.enum(["local-bind","git-clone","empty-volume","persistent-volume"]).optional(),status:f.z.enum(["unknown","pending","ready","failed"]).default("unknown"),path:f.z.string().trim().max(4096).optional(),resolvedCommit:f.z.string().trim().max(120).optional(),error:f.z.string().trim().max(2048).optional()}).passthrough(),Nd=f.z.object({id:Qo,name:f.z.string().trim().min(1).max(160),projectId:Qo.optional(),source:lc,sourceSnapshot:f.z.record(f.z.string(),f.z.unknown()).default({}),modelSelection:pr,nodeId:Qo,runtimeId:Qo,imageSelection:ur.optional(),environmentSource:mr.optional(),environmentTemplateOrigin:br.optional(),imageSnapshot:$c.optional(),imageProvisioning:Bc.optional(),stateRevision:f.z.number().int().min(0).default(0),processIncarnationId:f.z.string().trim().min(1).max(120).optional(),status:f.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]).default("created"),health:f.z.enum(["unknown","ok","degraded","failed"]).default("unknown"),connectionStatus:f.z.enum(["unknown","online","offline","endpoint-unreachable"]).default("unknown"),agentStatus:f.z.enum(["unknown","online","offline"]).default("unknown"),targetStatus:f.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),uiAccessStatus:f.z.enum(["unknown","reachable","endpoint-unreachable"]).default("unknown"),controlMode:f.z.enum(["standalone","controlled"]).default("controlled"),protocolVersion:$o.optional(),instanceVersion:f.z.string().trim().max(80).optional(),build:Wr.optional(),runtimeVersion:Jr.optional(),ready:f.z.boolean().default(!1),capabilities:Vo.default(Fo),appInventory:zr.optional(),config:f.z.object({autoImportAgentConfigs:f.z.boolean().default(!0),codexConfigEnabled:f.z.boolean().default(!0),codexHomeMode:f.z.enum(["default","taskhandoff"]).default("taskhandoff"),defaultCodexPermissionMode:di.default("ask"),aiSessionHistoryLimit:f.z.number().int().min(1).max(us).default(50),aiSessionAttachmentRetentionDays:f.z.number().int().min(0).max(365).default(30),aiSessionMaxFileAttachmentBytes:f.z.number().int().positive().max(yn).default(fn)}).strict().default({autoImportAgentConfigs:!0,codexConfigEnabled:!0,codexHomeMode:"taskhandoff",defaultCodexPermissionMode:"ask",aiSessionHistoryLimit:50,aiSessionAttachmentRetentionDays:30,aiSessionMaxFileAttachmentBytes:fn}),workspace:kd.default({status:"unknown"}),target:_d.default({strategy:"direct-port",status:"unknown"}),access:zd,apps:f.z.object({runningCount:f.z.number().int().min(0).default(0),problemCount:f.z.number().int().min(0).default(0),updatedAt:Zo.optional(),revision:f.z.number().int().min(0).optional()}).strict().default({runningCount:0,problemCount:0}),aiSessions:vs.default(()=>({runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:(new Date).toISOString()})),triggers:f.z.object({enabledCount:f.z.number().int().min(0).default(0),runningCount:f.z.number().int().min(0).default(0),errorCount:f.z.number().int().min(0).default(0),configs:f.z.array(f.z.object({configHash:f.z.string().trim().min(1),config:La,deployments:f.z.array(qa).default([]),runtime:f.z.array(Ua).default([])}).strict()).default([]),recentRuns:f.z.array($a).default([])}).strict().optional(),runtime:f.z.object({kind:f.z.string().trim().max(80).optional(),containerName:f.z.string().trim().max(240).optional(),containerId:f.z.string().trim().max(240).optional(),workspacePath:f.z.string().trim().max(4096).optional(),pid:f.z.number().int().positive().optional(),port:f.z.number().int().positive().max(65535).optional(),labels:f.z.record(f.z.string(),f.z.string()).default({})}).strict().default({labels:{}}),registrationToken:f.z.string().trim().min(1).max(240).optional(),lastHeartbeatAt:Zo.optional(),createdAt:Zo,updatedAt:Zo}).strict(),Cd=f.z.union([Nd.transform(e=>({instance:e,gitWorkspaceProvisioningOperationId:void 0})),f.z.object({instance:Nd,gitWorkspaceProvisioningOperationId:Qo.optional()}).strict()]),Rd=f.z.preprocess(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e;return t.instance&&"object"==typeof t.instance&&!Array.isArray(t.instance)?{instance:Pd(t.instance),..."string"==typeof t.gitWorkspaceProvisioningOperationId?{gitWorkspaceProvisioningOperationId:t.gitWorkspaceProvisioningOperationId}:{}}:Pd(t)},Cd),Od="instance.lifecycle.snapshot",jd=f.z.object({instanceId:Nd.shape.id,revision:f.z.number().int().min(0),updatedAt:Zo,status:Nd.shape.status.unwrap(),health:Nd.shape.health.unwrap(),connectionStatus:Nd.shape.connectionStatus.unwrap(),accessStatus:f.z.enum(["reachable","endpoint-unreachable"]),imageProvisioning:Bc.optional(),workspace:kd,runtime:Nd.shape.runtime.unwrap(),runtimeVersion:Jr.optional(),ready:f.z.boolean(),lastHeartbeatAt:Zo.optional()}).strict();function Pd(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=new Set(Object.keys(Nd.shape)),s={};for(const[e,t]of Object.entries(n))i.has(e)&&(s[e]=t);if(n.capabilities&&"object"==typeof n.capabilities&&!Array.isArray(n.capabilities)){const e={...n.capabilities};Object.prototype.hasOwnProperty.call(e,"apps")&&delete e.apps,s.capabilities=Ko(e)}else s.capabilities=Ko(void 0);s.appInventory=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e;Object.keys(t).some(e=>!["observedAt","items","issues"].includes(e));const n={observedAt:t.observedAt,items:Array.isArray(t.items)?t.items.map(e=>{e&&"object"==typeof e&&!Array.isArray(e)&&Object.keys(e).some(e=>!["id","name","kind","source","availability","capabilities","diagnosticCode"].includes(e));const t=qd(e,["id","name","kind","source","availability","diagnosticCode"]);return!t||"object"!=typeof t||Array.isArray(t)?t:{...t,capabilities:qd(e.capabilities,["automation","supportsCwdSelection"])}}):t.items,issues:Array.isArray(t.issues)?t.issues.map(e=>qd(e,["code","message"])):t.issues},i=zr.safeParse(n);return i.success?i.data:void 0}(n.appInventory,"string"==typeof n.id&&n.id),s.source=Md(n.source,0,"string"==typeof n.id&&n.id),s.sourceSnapshot=n.sourceSnapshot&&"object"==typeof n.sourceSnapshot&&!Array.isArray(n.sourceSnapshot)?n.sourceSnapshot:{},s.build=Dd(Wr,n.build,0,0,"string"==typeof n.id&&n.id),s.aiSessions=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=Array.isArray(t.sessions)?t.sessions.flatMap((e,t)=>{const n=Dd(bs,e);return n?[n]:[]}):[],i={runningCount:"number"==typeof t.runningCount&&Number.isInteger(t.runningCount)&&t.runningCount>=0?t.runningCount:0,waitingCount:"number"==typeof t.waitingCount&&Number.isInteger(t.waitingCount)&&t.waitingCount>=0?t.waitingCount:0,staleCount:"number"==typeof t.staleCount&&Number.isInteger(t.staleCount)&&t.staleCount>=0?t.staleCount:0,sessions:n,updatedAt:Zo.safeParse(t.updatedAt).success?t.updatedAt:(new Date).toISOString()};return Object.keys(t).some(e=>!["runningCount","waitingCount","staleCount","sessions","updatedAt"].includes(e)),vs.parse(i)}(n.aiSessions,"string"==typeof n.id&&n.id),s.triggers=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e;Object.keys(t).some(e=>!["enabledCount","runningCount","errorCount","configs","recentRuns"].includes(e));const n=(e,t,n)=>Array.isArray(e)?e.flatMap((e,n)=>{const i=Dd(t,e);return i?[i]:[]}):[],i=Array.isArray(t.configs)?t.configs.flatMap((e,t)=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const i=e;Object.keys(i).some(e=>!["configHash","config","deployments","runtime"].includes(e));const s=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=qd(t,["configHash","name","description","createdAt","updatedAt"]);if(t.source&&"object"==typeof t.source&&!Array.isArray(t.source)){const e=t.source,i="schedule"===e.type?"interval"===e.scheduleKind?["type","scheduleKind","intervalMs"]:"daily"===e.scheduleKind?["type","scheduleKind","timeOfDay","timezone"]:["type","scheduleKind","weekdays","timeOfDay","timezone"]:"file-change"===e.type?["type","roots","globs","ignore","debounceMs"]:["type","agent","statuses","phases"];n.source=qd(e,i)}return n.action=qd(t.action,["promptTemplate"]),n.policy=qd(t.policy,["cooldownMs","maxConcurrentRuns","whenBusy"]),Dd(La,n)}(i.config);return"string"==typeof i.configHash&&s?[{configHash:i.configHash,config:s,deployments:n(i.deployments,qa),runtime:n(i.runtime,Ua)}]:[]}):[];return{enabledCount:"number"==typeof t.enabledCount&&Number.isInteger(t.enabledCount)&&t.enabledCount>=0?t.enabledCount:0,runningCount:"number"==typeof t.runningCount&&Number.isInteger(t.runningCount)&&t.runningCount>=0?t.runningCount:0,errorCount:"number"==typeof t.errorCount&&Number.isInteger(t.errorCount)&&t.errorCount>=0?t.errorCount:0,configs:i,recentRuns:n(t.recentRuns,$a)}}(n.triggers,"string"==typeof n.id&&n.id),s.apps=Dd(Nd.shape.apps.unwrap(),qd(n.apps,["runningCount","problemCount","updatedAt","revision"]),0,0,"string"==typeof n.id&&n.id)||{runningCount:0,problemCount:0},s.config=Dd(Nd.shape.config.unwrap(),qd(n.config,["autoImportAgentConfigs","codexConfigEnabled","codexHomeMode","defaultCodexPermissionMode","aiSessionHistoryLimit","aiSessionAttachmentRetentionDays","aiSessionMaxFileAttachmentBytes"]),0,0,"string"==typeof n.id&&n.id)||{autoImportAgentConfigs:!0,codexConfigEnabled:!0,codexHomeMode:"taskhandoff",defaultCodexPermissionMode:"ask",aiSessionHistoryLimit:50,aiSessionAttachmentRetentionDays:30,aiSessionMaxFileAttachmentBytes:fn},s.modelSelection=Dd(pr.unwrap(),qd(n.modelSelection,["modelEntityIds","codexModelHash","claudeModelHash","opencodeModelHash"]),0,0,"string"==typeof n.id&&n.id)||{},s.imageSnapshot=function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=Yc(n),{reference:s,...a}=i,o=n.requestedReference??s;let r;try{r="string"==typeof o?cr(o):void 0}catch{}const c={img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"},d="string"==typeof n.id?n.id:"string"==typeof t?t:void 0,l="market"===n.origin||d&&c[d]?"market":"custom";return void 0!==n.image||n.reference,{...a,id:d&&c[d]?c[d]:d,origin:l,repository:r?.repository??n.repository,tag:r?.tag??n.tag,requestedReference:r?.reference??o,resolvedDigest:n.resolvedDigest,resolvedReference:n.resolvedReference,downloadSizeBytes:n.downloadSizeBytes,market:"market"===l?qd(n.market,["catalogId","catalogRevision","publisher","version"])??{catalogId:"task_handoff_embedded",catalogRevision:"legacy",publisher:"task-handoff"}:void 0}}(n.imageSnapshot,n.imageId,"string"==typeof n.id&&n.id);const a="string"==typeof n.imageId?{img_default:"market_taskhandoff_browser",img_codex:"market_taskhandoff_codex",img_ai:"market_taskhandoff_ai"}[n.imageId]||n.imageId:void 0,o=qd(n.imageSelection,["imageId","tag"]);s.imageSelection=o||(a?{imageId:a,tag:s.imageSnapshot?.tag}:void 0),s.imageProvisioning=Dd(Bc,qd(n.imageProvisioning,["phase","requestedReference","generation","error","startedAt","updatedAt"]),0,0,"string"==typeof n.id&&n.id),s.runtimeVersion=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n=e=>{if("string"!=typeof e)return;const t=e.trim();return t&&t.length<=80?t:void 0},i=n(t.desiredVersion);if(!i)return;const s=new Set(Jr.shape.phase.options),a="string"==typeof t.phase?t.phase:"pending",o=s.has(a)?a:{idle:"pending",queued:"pending",checking:"pending",downloading:"installing",updating:"installing",completed:"matched",succeeded:"matched",ready:"matched",error:"failed"}[a]||"pending";let r;if(t.error&&"object"==typeof t.error&&!Array.isArray(t.error)){const e=t.error,i="string"==typeof e.message?e.message.trim().slice(0,4096):"";if(i){const t=new Set(Xr.shape.code.options),s="string"==typeof e.code&&t.has(e.code)?e.code:"INSTANCE_RUNTIME_INSTALL_FAILED";e.code;const a=n(e.expectedVersion),o=n(e.actualVersion);r={code:s,message:i,...a?{expectedVersion:a}:{},...o?{actualVersion:o}:{},retryable:!0===e.retryable}}}"string"==typeof t.error&&t.error.trim()&&(r={code:"INSTANCE_RUNTIME_INSTALL_FAILED",message:t.error.trim().slice(0,4096),expectedVersion:i,...n(t.actualVersion)?{actualVersion:n(t.actualVersion)}:{},retryable:!1});const c=n(t.actualVersion),d=Zo.safeParse(t.lastAttemptAt),l=Zo.safeParse(t.matchedAt);return void 0!==t.lastAttemptAt&&d.success,void 0!==t.matchedAt&&l.success,{desiredVersion:i,...c?{actualVersion:c}:{},phase:o,attempt:"number"==typeof t.attempt&&Number.isInteger(t.attempt)&&t.attempt>=0?t.attempt:0,...d.success?{lastAttemptAt:d.data}:{},...l.success?{matchedAt:l.data}:{},...r?{error:r}:{}}}(n.runtimeVersion,"string"==typeof n.id&&n.id),s.workspace=Dd(kd,n.workspace,0,0,"string"==typeof n.id&&n.id)||{status:"unknown"},s.environmentSource=Dd(mr,n.environmentSource,0,0,"string"==typeof n.id&&n.id),s.environmentTemplateOrigin=Dd(br,n.environmentTemplateOrigin,0,0,"string"==typeof n.id&&n.id),s.runtime=Dd(Nd.shape.runtime.unwrap(),n.runtime,0,0,"string"==typeof n.id&&n.id)||{labels:{}},s.target=Dd(_d,qd(n.target??n.endpoints,["strategy","web","api","vnc","tty","logs","status"]),0,0,"string"==typeof n.id&&n.id)||{strategy:"direct-port",status:"unknown"},s.access=Dd(zd,qd(n.access,["strategy","web","api","ws","status"]),0,0,"string"==typeof n.id&&n.id)||{strategy:"control-plane-proxy",status:"unknown"};for(const[e,t]of Object.entries(Nd.shape))Object.prototype.hasOwnProperty.call(s,e)&&!t.safeParse(s[e]).success&&t.safeParse(void 0).success&&delete s[e];return s}function Dd(e,t,n,i,s){if(!t||"object"!=typeof t||Array.isArray(t))return;let a=structuredClone(t);for(let t=0;t<20;t+=1){const t=e.safeParse(a);if(t.success)return t.data;let n=!1;for(const e of t.error.issues){if("unrecognized_keys"!==e.code)continue;const t=Ld(a,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const i of e.keys)Object.prototype.hasOwnProperty.call(t,i)&&(delete t[i],n=!0)}if(!n){const n=structuredClone(a);let i=!1;for(const e of t.error.issues){if(!e.path.length||"string"!=typeof e.path.at(-1))continue;const t=Ld(n,e.path.slice(0,-1)),s=e.path.at(-1);t&&"object"==typeof t&&!Array.isArray(t)&&Object.prototype.hasOwnProperty.call(t,s)&&(delete t[s],i=!0)}if(i){const t=e.safeParse(n);if(t.success)return t.data}break}}}function Ld(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function Md(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return e;const i=e,s=i.type,a=lc.options.find(e=>e.shape.type.value===s);if(!a)return e;const o="local-folder"===s?["type","localFolderId","path","ownerNodeId"]:"git-template"===s?["type","url","templateId","ref","auth","clone"]:["type","repositoryId","url","provider","ref","auth","clone"],r=qd(i,o);if("local-folder"!==s){const e=function(e){const t=e&&"object"==typeof e&&!Array.isArray(e)?e:void 0,n=oc.safeParse(qd(t,["type","name","commit"]));if(n.success)return n.data;const i="string"==typeof t?.commit?t.commit.trim():"",s="string"==typeof t?.name?t.name.trim():"",a=i?oc.safeParse({type:"commit",commit:i}):s?oc.safeParse({type:"tag"===t?.type?"tag":"branch",name:s}):oc.safeParse({type:"branch",name:"main"});return a.success?a.data:void 0}(i.ref),t=Dd(rc,qd(i.auth,["type","secretId"])),n=Dd(cc,qd(i.clone,["depth","submodules","lfs","subdirectory"]));e?r.ref=e:delete r.ref,t?r.auth=t:delete r.auth,n?r.clone=n:delete r.clone}const c=Dd(a,r);return c?(Object.keys(i).some(e=>!o.includes(e)),c):r}function qd(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries(t.filter(e=>Object.prototype.hasOwnProperty.call(n,e)).map(e=>[e,n[e]]))}f.z.object({instanceId:Qo.optional(),projectId:Qo.optional(),source:lc.optional(),nodeId:Qo.optional(),runtimeId:Qo.optional(),imageSelection:ur.optional(),instanceVersion:f.z.string().trim().max(80).optional(),protocolVersion:$o,build:Wr.optional(),controlMode:f.z.enum(["standalone","controlled"]).default("controlled"),capabilities:Vo.default(Fo),appInventory:zr.optional(),target:Td.optional(),workspace:kd.default({status:"unknown"}),registrationToken:f.z.string().trim().max(240).optional(),processIncarnationId:f.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{Uo.has(e.protocolVersion)&&!e.appInventory&&t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol register payload requires appInventory."})}),f.z.object({status:Nd.shape.status.optional(),health:Nd.shape.health.optional(),protocolVersion:$o,build:Wr.optional(),capabilities:Nd.shape.capabilities.optional(),appInventory:zr.optional(),apps:Nd.shape.apps.optional(),aiSessions:Nd.shape.aiSessions.optional(),triggers:Nd.shape.triggers.optional(),workspace:kd.optional(),target:Td.optional(),processIncarnationId:f.z.string().trim().min(1).max(120).optional()}).strict().superRefine((e,t)=>{Uo.has(e.protocolVersion)&&!e.appInventory&&t.addIssue({code:"custom",path:["appInventory"],message:"Current protocol heartbeat payload requires appInventory."})});const Ud=f.z.enum(["web","telegram","wechat","dingding","lark"]),$d=f.z.object({id:Qo,channel:Ud,name:f.z.string().trim().min(1).max(160),enabled:f.z.boolean().default(!1),token:f.z.string().trim().max(4096).optional(),defaultChatId:f.z.string().trim().max(240).optional(),allowedUserIds:f.z.array(f.z.string().trim().min(1).max(240)).default([]),pollIntervalMs:f.z.number().int().positive().max(6e4).default(3e3),settings:f.z.record(f.z.string(),f.z.unknown()).default({}),createdAt:Zo,updatedAt:Zo}).strict(),Bd=f.z.object({id:Qo,channel:Ud,bridgeId:Qo.optional(),chatSessionId:f.z.string().trim().min(1).max(240),userId:f.z.string().trim().max(240).optional(),activeProjectId:Qo.optional(),activeInstanceId:Qo.optional(),activeAiSessionId:f.z.string().trim().min(1).max(120).optional(),lastUsedAt:Zo,createdAt:Zo,updatedAt:Zo}).strict(),Fd=f.z.object({source:f.z.object({type:f.z.literal("chat-gateway").default("chat-gateway"),channel:Ud,bridgeId:Qo.optional(),chatSessionId:f.z.string().trim().min(1).max(240),userId:f.z.string().trim().max(240).optional()}).strict(),message:f.z.object({text:f.z.string().trim().max(2e4).default(""),attachments:f.z.array(ai).max(6).default([])}).strict().superRefine((e,t)=>{e.attachments.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>bn&&t.addIssue({code:f.z.ZodIssueCode.custom,path:["attachments"],message:"Inline attachments must be 41943040 bytes or less in total."})}),target:f.z.object({instanceId:Qo,aiSessionId:f.z.string().trim().min(1).max(120)}).strict().optional()}).strict(),Hd=f.z.object({id:Qo,instanceId:Qo,projectId:Qo.optional(),aiSessionId:f.z.string().trim().min(1).max(120),providerSessionId:f.z.string().trim().max(240).optional(),result:f.z.string().default(""),timeoutMs:f.z.number().positive().optional(),source:f.z.string().trim().max(120).optional(),kind:f.z.enum(["task","approval"]).default("task"),status:f.z.enum(["pending","unreachable"]).default("pending"),error:f.z.string().trim().max(2048).optional(),lastSeenAt:Zo}).strict();function Gd(e){return!1!==e.ready&&(!e.runtimeVersion||["matched","failed"].includes(e.runtimeVersion.phase))}const Wd=6048e5;function Vd(e,n){const i=t.resolve(e),s=t.resolve(i,n);if(t.dirname(s)!==i||t.basename(s)!==n)throw new Error(`Retention entry is not a direct child of its managed root: ${n}`);return s}function Kd(e){if(n.existsSync(e)){const t=n.lstatSync(e);if(!t.isDirectory()||t.isSymbolicLink())throw new Error(`Managed persistence path must be a real directory: ${e}`)}n.mkdirSync(e,{recursive:!0,mode:448}),n.chmodSync(e,448)}const Yd="2026-08-25",Xd=f.z.object({nodeId:f.z.string().optional(),instanceId:f.z.string().optional()}).passthrough(),Jd=f.z.object({v:f.z.literal(1),id:f.z.string().min(1),seq:f.z.number().finite(),type:f.z.string().min(1),topic:f.z.string().min(1),createdAt:f.z.string().datetime(),payload:f.z.unknown(),replay:f.z.literal(!0).optional(),scope:Xd.optional()}).passthrough(),Qd=f.z.object({v:f.z.literal(Yd),id:f.z.string().min(1),type:f.z.string().min(1),createdAt:f.z.string().datetime(),payload:f.z.unknown(),topic:f.z.string().min(1).optional(),replay:f.z.literal(!0).optional(),scope:Xd.optional()}).passthrough();f.z.discriminatedUnion("v",[Jd,Qd]);const Zd=f.z.object({v:f.z.literal(1),type:f.z.literal("ping"),sentAt:f.z.string().datetime()}).strict();function el(e){return e.startsWith("ai-session.")||e.startsWith("ai.session.")?"ai.sessions":e.startsWith("app-session.")?"app.sessions":e.startsWith("app.management")?"apps":e.startsWith("trigger.")?"triggers":e.startsWith("instance.")?"instances":e.startsWith("node.")?"nodes":e.startsWith("project.")?"projects":e.startsWith("model.")?"models":e.startsWith("image.")?"images":e.startsWith("market.")?"market":"system"}f.z.object({v:f.z.literal(1),type:f.z.literal("pong"),sentAt:f.z.string().datetime(),receivedAt:f.z.string().datetime()}).strict();const tl=f.z.object({replaySince:f.z.string().datetime().optional(),messageDeltas:f.z.object({allInstances:f.z.boolean().default(!1),instanceIds:f.z.array(f.z.string().trim().min(1).max(160)).max(1e3).default([])}).default({allInstances:!1,instanceIds:[]}),timelineAllSessions:f.z.boolean().default(!1),timelineSessions:f.z.array(f.z.object({instanceId:f.z.string().trim().min(1).max(160),sessionId:f.z.string().trim().min(1).max(120)})).max(1e3).default([])});function nl(e,t){if(!e)return!0;if("ai-session.message-delta"!==t.type&&"ai-session.timeline-item"!==t.type)return!0;const n=t.payload&&"object"==typeof t.payload&&!Array.isArray(t.payload)?t.payload:{},i=String(n.instanceId||t.scope?.instanceId||"");return"ai-session.message-delta"===t.type?e.messageDeltas.allInstances||e.messageDeltas.instanceIds.includes(i):e.timelineAllSessions||e.timelineSessions.some(e=>e.instanceId===i&&e.sessionId===n.sessionId)}const il=f.z.enum(["ai.sessions","app.sessions"]),sl=f.z.object({topic:il,instanceId:f.z.string().trim().min(1).max(160),streamId:f.z.string().trim().min(1).max(240),latestRevision:f.z.number().int().min(0),earliestRetainedRevision:f.z.number().int().min(0)}).strict(),al=f.z.object({protocolVersion:f.z.literal(1),streams:f.z.array(sl)}).strict(),ol={project:"projects",node:"nodes",runtime:"runtimes",template:"templates",instance:"instances","app-session":"app-sessions","ai-session":"ai-sessions","trigger-template":"triggers","trigger-deployment":"triggers",repository:"repositories",attachment:"attachments",image:"images",model:"models",user:"users",role:"roles","identity-provider":"identity-providers","user-session":"users","identity-approval":"users","user-audit":"users","chat-bridge":"chat-bridges","control-plane-settings":"settings",secret:"secrets","public-directory":"public-directory"},rl=new Set(["instance","app-session","ai-session"]);function cl(e,t){return"all"===e.kind||e.nodeIds.includes(t)}function dl(e,t,n,i){return t&&"inherit-node-scope"!==t.kind?t.instanceIds.includes(n):cl(e,i)}function ll(e,t,n){const i=function(e,t){const n=ol[t];return"manage-secrets"===e?"secrets:manage":"manage-settings"===e?"settings:manage":"manage-members"===e?"users:manage":"manage-node-auth"===e?"secrets:manage":"trigger-template"===t&&"read"!==e?"settings:manage":"interactive-access"===e||"proxy"===e?rl.has(t)?`${n}:interactive`:void 0:"read"===e?`${n}:read`:`${n}:manage`}(t,n.type);return Boolean(i&&e.permissionIds.includes(i))}function pl(e,t,n){if(!function(e,t,n){return"system"===e.type||("chat-bridge"===e.type?function(e,t){return"ai-session"===t.type?["read","send-message","approve","interrupt"].includes(e):"instance"===t.type?["read","start","stop","restart"].includes(e):"read"===e}(t,n):"cloud-account"===e.type?function(e,t){return!["user","role","identity-provider","user-session","identity-approval","user-audit","control-plane-settings","secret","chat-bridge"].includes(t.type)&&("node"===t.type?"read"===e:"read"===e||"image"!==t.type&&"public-directory"!==t.type&&["create","update","delete","start","stop","restart","proxy","interactive-access","send-message","approve","interrupt","read-file-content"].includes(e))}(t,n):ll(e,t,n))}(e,t,n))throw ml(t,n)}function ul(e,t,n,i){if(!ll(e,t,n))throw ml(t,n);if(!function(e,t){return"global-public"===t.kind||"global-shared"===t.kind||"global-admin"===t.kind||("node"===t.kind?cl(e.nodeScope,t.nodeId):dl(e.nodeScope,e.instanceScope,t.instanceId,t.nodeId))}(e,i))throw Object.assign(new Error("The requested resource is not visible."),{statusCode:404,code:"CONTROL_PLANE_RESOURCE_NOT_VISIBLE"})}function ml(e,t){return Object.assign(new Error(`Actor is not allowed to ${e} ${t.type}${t.id?` ${t.id}`:""}.`),{statusCode:403,code:"CONTROL_PLANE_FORBIDDEN"})}function hl(){return(new Date).toISOString()}function gl(e,t=448){n.mkdirSync(e,{recursive:!0,mode:t}),n.chmodSync(e,t)}function fl(e,i,s={}){const a=s.directoryMode??448,o=s.fileMode??384;gl(t.dirname(e),a),y.sync(e,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:o}),n.chmodSync(e,o)}function yl(e,t){console.warn(JSON.stringify({message:e,...t}))}function bl(e){return e&&"object"==typeof e&&"issues"in e?{issues:e.issues}:{error:e instanceof Error?e.message:String(e)}}function vl(e,t){const i=t.logger||yl;let s;try{s=JSON.parse(n.readFileSync(e,"utf8"))}catch(t){return void i("stored JSON could not be read",{filePath:e,...bl(t)})}if(!t.schema)return s;const a=t.sanitize?t.sanitize(s):s,o=t.schema.safeParse(a);if(o.success)return o.data;const r="strip"in t.schema&&"function"==typeof t.schema.strip?t.schema.strip().safeParse(a):void 0;if(r?.success)return i("unknown stored fields were ignored",{filePath:e,issues:o.error.issues}),r.data;i("stored record failed validation and was isolated",{filePath:e,issues:o.error.issues})}function Il(e){return`${e}_${i.randomUUID().replace(/-/g,"").slice(0,20)}`}function xl(){return i.randomBytes(24).toString("base64url")}class wl{directory;options;permissionsInitialized=!1;constructor(e,t={}){this.directory=e,this.options=t}init(){if(this.permissionsInitialized&&n.existsSync(this.directory))return;gl(this.directory,this.options.directoryMode??448);const e=this.options.fileMode??384;for(const i of n.readdirSync(this.directory).filter(e=>e.endsWith(".json")))n.chmodSync(t.join(this.directory,i),e);this.permissionsInitialized=!0}filePath(e){return t.join(this.directory,`${e}.json`)}list(){return this.init(),n.readdirSync(this.directory).filter(e=>e.endsWith(".json")).sort().flatMap(e=>{const n=vl(t.join(this.directory,e),this.options);return n?[n]:[]})}get(e){this.init();const t=this.filePath(e);return n.existsSync(t)?vl(t,this.options):void 0}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return fl(this.filePath(n.id),n,this.options),n}patch(e,t){const n=this.get(e);if(!n)return;const i={...n,...t,id:n.id,createdAt:n.createdAt,updatedAt:(new Date).toISOString()};return this.put(i)}delete(e){const t=this.filePath(e);return!!n.existsSync(t)&&(n.unlinkSync(t),!0)}}class Sl{filePathValue;defaults;options;constructor(e,t,n={}){this.filePathValue=e,this.defaults=t,this.options=n}init(){gl(t.dirname(this.filePathValue),this.options.directoryMode??448),n.existsSync(this.filePathValue)?n.chmodSync(this.filePathValue,this.options.fileMode??384):this.put(this.defaults())}get(){return this.init(),n.existsSync(this.filePathValue)?vl(this.filePathValue,this.options)??this.defaults():this.defaults()}put(e){const t=this.options.sanitize?this.options.sanitize(e):e,n=this.options.schema?this.options.schema.parse(t):t;return fl(this.filePathValue,n,this.options),n}}const Al=f.z.object({sub:f.z.string().trim().min(1).max(500),email:f.z.string().email().optional(),email_verified:f.z.boolean().optional(),name:f.z.string().trim().min(1).max(160).optional(),preferred_username:f.z.string().trim().min(1).max(160).optional()}).passthrough(),El=f.z.object({id:f.z.union([f.z.number().int().positive(),f.z.string().trim().regex(/^\d+$/)]),login:f.z.string().trim().min(1).max(160),name:f.z.string().trim().min(1).max(160).nullable().optional(),email:f.z.string().email().nullable().optional()}).passthrough(),_l={oidc:{kind:"oidc",identityKind:"oidc",normalizeClaims(e){const t=Al.parse(e);return{subject:t.sub,...t.email&&!0===t.email_verified?{verifiedEmail:t.email}:{},...t.name||t.preferred_username?{displayName:t.name||t.preferred_username}:{}}}},github:{kind:"github",identityKind:"oauth",normalizeClaims(e){const t=El.parse(e);return{subject:String(t.id),...t.email?{verifiedEmail:t.email}:{},displayName:t.name||t.login}}}};function Tl(e){const t=_l[e];if(!t)throw Object.assign(new Error(`Unsupported external identity provider adapter: ${e}`),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_UNSUPPORTED",statusCode:400});return t}const zl=f.z.object({issuer:f.z.string().url(),authorization_endpoint:f.z.string().url(),token_endpoint:f.z.string().url(),jwks_uri:f.z.string().url()}).passthrough(),kl=f.z.object({iss:f.z.string().url(),sub:f.z.string().trim().min(1).max(500),aud:f.z.union([f.z.string().trim().min(1),f.z.array(f.z.string().trim().min(1)).min(1)]),exp:f.z.number().int().positive(),iat:f.z.number().int().positive().optional(),nonce:f.z.string().trim().min(1),email:f.z.string().email().optional(),email_verified:f.z.boolean().optional(),name:f.z.string().trim().min(1).max(160).optional(),preferred_username:f.z.string().trim().min(1).max(160).optional()}).passthrough();function Nl(e){return JSON.parse(Buffer.from(e,"base64url").toString("utf8"))}function Cl(e=32){return i.randomBytes(e).toString("base64url")}function Rl(e){return i.createHash("sha256").update(e).digest("base64url")}function Ol(e){return new URLSearchParams(e).toString()}class jl{flows=new Map;fetchImplementation;users;sessions;providers;constructor(e,t,n,i={}){this.users=e,this.sessions=t,this.providers=n,this.fetchImplementation=i.fetch||fetch}async begin(e,t="web"){this.pruneFlows();const n=await this.users.store.providers.get(e);if(!n||"enabled"!==n.status)throw Object.assign(new Error("Identity provider is unavailable."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_UNAVAILABLE",statusCode:404});const i={providerId:e,state:Cl(),nonce:Cl(),codeVerifier:Cl(48),expiresAt:Date.now()+6e5,clientType:t};return this.flows.set(i.state,i),{authorizationUrl:"oidc"===n.kind?await this.oidcAuthorizationUrl(n,i):this.githubAuthorizationUrl(n,i),expiresAt:new Date(i.expiresAt).toISOString()}}async callback(e){const t=f.z.object({state:f.z.string().trim().min(32),code:f.z.string().trim().min(1)}).strict().parse(e),n=this.flows.get(t.state);if(this.flows.delete(t.state),!n||n.expiresAt<=Date.now())throw Object.assign(new Error("External login callback is invalid or expired."),{code:"AUTH_EXTERNAL_FLOW_INVALID",statusCode:401});const i=await this.users.store.providers.get(n.providerId);if(!i||"enabled"!==i.status)throw Object.assign(new Error("Identity provider is unavailable."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_UNAVAILABLE",statusCode:401});const s="oidc"===i.kind?await this.exchangeOidc(i,n,t.code):await this.exchangeGitHub(i,n,t.code),a=await this.users.store.identities.findByProviderSubject(i.id,s.subject);if(a)return{kind:"session",...await this.sessions.createSessionForIdentity(a.id,n.clientType)};if("existing-only"===i.loginPolicy)throw Object.assign(new Error("External identity is not bound to a Control Plane user."),{code:"AUTH_EXTERNAL_IDENTITY_NOT_BOUND",statusCode:403});const o=await this.users.store.approvals.findActivePending(i.id,s.subject,hl());if(o)return{kind:"pending-approval",approvalId:o.id,expiresAt:o.expiresAt};const r=hl(),c=await this.users.store.approvals.put({id:Il("identity_approval"),providerId:i.id,subject:s.subject,verifiedEmail:s.verifiedEmail,displayName:s.displayName,status:"pending",expiresAt:new Date(Date.now()+864e5).toISOString(),createdAt:r,updatedAt:r});return{kind:"pending-approval",approvalId:c.id,expiresAt:c.expiresAt}}async oidcAuthorizationUrl(e,t){const n=await this.discovery(e.issuer),i=new URL(n.authorization_endpoint);return i.search=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.callbackUrl,scope:"openid profile email",state:t.state,nonce:t.nonce,code_challenge:Rl(t.codeVerifier),code_challenge_method:"S256"}).toString(),i.toString()}githubAuthorizationUrl(e,t){const n=new URL("https://github.com/login/oauth/authorize");return n.search=new URLSearchParams({client_id:e.clientId,redirect_uri:e.callbackUrl,scope:"read:user user:email",state:t.state,code_challenge:Rl(t.codeVerifier),code_challenge_method:"S256"}).toString(),n.toString()}async exchangeOidc(e,t,n){const s=await this.discovery(e.issuer),a=await this.fetchImplementation(s.token_endpoint,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:Ol({grant_type:"authorization_code",code:n,redirect_uri:e.callbackUrl,client_id:e.clientId,client_secret:await this.providers.clientSecret(e.id),code_verifier:t.codeVerifier})});if(!a.ok)throw Object.assign(new Error("OIDC token exchange failed."),{code:"AUTH_EXTERNAL_TOKEN_EXCHANGE_FAILED",statusCode:401});const o=f.z.object({id_token:f.z.string().trim().min(1)}).passthrough().parse(await a.json()),r=await this.fetchImplementation(s.jwks_uri,{headers:{accept:"application/json"}});if(!r.ok)throw Object.assign(new Error("OIDC signing keys are unavailable."),{code:"AUTH_EXTERNAL_KEYS_UNAVAILABLE",statusCode:401});const c=function(e){const[t,n,s]=e.token.split(".");if(!t||!n||!s)throw new Error("OIDC ID token is malformed.");const a=f.z.object({alg:f.z.enum(["RS256","ES256"]),kid:f.z.string().trim().min(1)}).passthrough().parse(Nl(t)),o=f.z.object({keys:f.z.array(f.z.record(f.z.string(),f.z.unknown()))}).passthrough().parse(e.jwks).keys.find(e=>e.kid===a.kid);if(!o)throw new Error("OIDC ID token signing key was not found.");const r=i.createPublicKey({key:o,format:"jwk"});if(!i.verify("sha256",Buffer.from(`${t}.${n}`),{key:r,..."ES256"===a.alg?{dsaEncoding:"ieee-p1363"}:{}},Buffer.from(s,"base64url")))throw new Error("OIDC ID token signature is invalid.");const c=kl.parse(Nl(n)),d=e.issuer.replace(/\/$/,"");if(c.iss.replace(/\/$/,"")!==d)throw new Error("OIDC ID token issuer is invalid.");if(!(Array.isArray(c.aud)?c.aud:[c.aud]).includes(e.clientId))throw new Error("OIDC ID token audience is invalid.");if(c.nonce!==e.nonce)throw new Error("OIDC ID token nonce is invalid.");const l=Math.floor((e.now??Date.now())/1e3);if(c.exp<=l)throw new Error("OIDC ID token is expired.");return c}({token:o.id_token,jwks:await r.json(),issuer:e.issuer,clientId:e.clientId,nonce:t.nonce});return Tl("oidc").normalizeClaims(c)}async exchangeGitHub(e,t,n){const i=await this.fetchImplementation("https://github.com/login/oauth/access_token",{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:Ol({client_id:e.clientId,client_secret:await this.providers.clientSecret(e.id),code:n,redirect_uri:e.callbackUrl,code_verifier:t.codeVerifier})});if(!i.ok)throw Object.assign(new Error("GitHub token exchange failed."),{code:"AUTH_EXTERNAL_TOKEN_EXCHANGE_FAILED",statusCode:401});const{access_token:s}=f.z.object({access_token:f.z.string().trim().min(1)}).passthrough().parse(await i.json()),a=await this.fetchImplementation("https://api.github.com/user",{headers:{accept:"application/vnd.github+json",authorization:`Bearer ${s}`}});if(!a.ok)throw Object.assign(new Error("GitHub identity lookup failed."),{code:"AUTH_EXTERNAL_IDENTITY_LOOKUP_FAILED",statusCode:401});const o=await a.json(),r=await this.fetchImplementation("https://api.github.com/user/emails",{headers:{accept:"application/vnd.github+json",authorization:`Bearer ${s}`}});if(r.ok){const e=f.z.array(f.z.object({email:f.z.string().email(),primary:f.z.boolean(),verified:f.z.boolean()}).passthrough()).safeParse(await r.json()),t=e.success?e.data.find(e=>e.primary&&e.verified):void 0;t&&(o.email=t.email)}return Tl("github").normalizeClaims(o)}async discovery(e){const t=e.replace(/\/$/,""),n=await this.fetchImplementation(`${t}/.well-known/openid-configuration`,{headers:{accept:"application/json"}});if(!n.ok)throw Object.assign(new Error("OIDC discovery failed."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_UNAVAILABLE",statusCode:401});const i=zl.parse(await n.json());if(i.issuer.replace(/\/$/,"")!==t)throw Object.assign(new Error("OIDC issuer mismatch."),{code:"AUTH_EXTERNAL_ISSUER_MISMATCH",statusCode:401});return i}pruneFlows(){const e=Date.now();for(const[t,n]of this.flows)n.expiresAt<=e&&this.flows.delete(t)}}function Pl(e,t){let n=Ul(t);for(let t=0;t<100;t+=1){const t=e.safeParse(n);if(t.success)return t;const i=Ll(t.error.issues);let s=!1;for(const e of i){const t=ql(n,e.path);if(t&&"object"==typeof t&&!Array.isArray(t))for(const n of e.keys)Object.prototype.hasOwnProperty.call(t,n)&&(delete t[n],s=!0)}if(!s)return t}return e.safeParse(n)}function Dl(e,t){const n=Pl(e,t);if(!n.success)throw n.error;return n.data}function Ll(e,t=[]){const n=[];for(const i of e){if("unrecognized_keys"===i.code){n.push({code:"unrecognized_keys",keys:i.keys,path:[...t,...i.path]});continue}if("invalid_union"!==i.code||!Array.isArray(i.errors))continue;const e=i.errors.filter(e=>Array.isArray(e));if(!e.length)continue;const s=e.reduce((e,t)=>Ml(t)<Ml(e)?t:e);n.push(...Ll(s,[...t,...i.path]))}return n}function Ml(e){return e.reduce((e,t)=>{if("unrecognized_keys"===t.code)return e;if("invalid_union"!==t.code||!Array.isArray(t.errors))return e+1;const n=t.errors.filter(e=>Array.isArray(e));return e+(n.length?Math.min(...n.map(Ml)):1)},0)}function ql(e,t){let n=e;for(const e of t){if(!n||"object"!=typeof n)return;n=n[e]}return n}function Ul(e){return Array.isArray(e)?e.map(Ul):e&&"object"==typeof e?Object.getPrototypeOf(e)!==Object.prototype&&null!==Object.getPrototypeOf(e)?e:Object.fromEntries(Object.entries(e).map(([e,t])=>[e,Ul(t)])):e}const $l=["users:read","users:manage","roles:read","roles:manage","identity-providers:read","identity-providers:manage","nodes:read","nodes:manage","projects:read","projects:manage","runtimes:read","runtimes:manage","templates:read","templates:manage","instances:read","instances:manage","instances:interactive","app-sessions:read","app-sessions:manage","app-sessions:interactive","ai-sessions:read","ai-sessions:manage","ai-sessions:interactive","triggers:read","triggers:manage","repositories:read","repositories:manage","attachments:read","attachments:manage","images:read","images:manage","models:read","models:manage","settings:read","settings:manage","secrets:manage","chat-bridges:read","chat-bridges:manage","public-directory:read"],Bl=f.z.enum($l),Fl=f.z.enum(["active","disabled","archived"]),Hl=f.z.enum(["local-password","oidc","oauth"]),Gl=f.z.enum(["active","archived"]),Wl=f.z.enum(["oidc","github"]),Vl=f.z.enum(["enabled","disabled"]),Kl=f.z.enum(["existing-only","admin-approved-create"]),Yl=f.z.enum(["pending","approved","rejected","expired"]),Xl=f.z.discriminatedUnion("kind",[f.z.object({kind:f.z.literal("all")}).strict(),f.z.object({kind:f.z.literal("selected"),nodeIds:f.z.array(f.z.string().trim().min(1)).max(1e4)}).strict()]),Jl=f.z.discriminatedUnion("kind",[f.z.object({kind:f.z.literal("inherit-node-scope")}).strict(),f.z.object({kind:f.z.literal("selected"),instanceIds:f.z.array(f.z.string().trim().min(1)).max(1e4)}).strict()]),Ql=f.z.object({id:Bl,resource:f.z.string().trim().min(1).max(80),action:f.z.string().trim().min(1).max(80),nodeScoped:f.z.boolean(),name:f.z.string().trim().min(1).max(160),translationKey:f.z.string().trim().min(1).max(200).optional(),description:f.z.string().trim().min(1).max(500).optional()}).strict(),Zl=new Set(["users","roles","identity-providers","settings","secrets","chat-bridges","public-directory"]),ep=$l.map(e=>{const[t,n]=e.split(":");return Ql.parse({id:e,resource:t,action:n,nodeScoped:!Zl.has(t),name:e,translationKey:`settings.userAccess.permissionLabels.${t}.${n}`})}),tp=f.z.object({id:f.z.string().trim().min(1),displayName:f.z.string().trim().min(1).max(160),primaryUsername:f.z.string().trim().min(1).max(80).optional(),status:Fl,createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime(),lastLoginAt:f.z.string().datetime().optional()}).strict(),np=f.z.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9_.@-]+$/),ip=f.z.object({displayName:f.z.string().trim().min(1).max(160).optional(),username:np.optional(),status:Fl.optional()}).strict().refine(e=>Object.values(e).some(e=>void 0!==e),{message:"At least one user field must be updated."}),sp=f.z.object({id:f.z.string().trim().min(1),userId:f.z.string().trim().min(1),kind:Hl,providerId:f.z.string().trim().min(1).optional(),loginName:f.z.string().trim().min(1).max(160).optional(),subject:f.z.string().trim().min(1).max(500).optional(),verifiedEmail:f.z.string().email().optional(),requiresPasswordChange:f.z.boolean().optional(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime(),lastUsedAt:f.z.string().datetime().optional()}).strict().superRefine((e,t)=>{"local-password"!==e.kind||e.loginName||t.addIssue({code:"custom",path:["loginName"],message:"Local password identities require loginName."}),"local-password"===e.kind||e.providerId&&e.subject||t.addIssue({code:"custom",path:["providerId"],message:"External identities require providerId and subject."})}),ap=f.z.object({id:f.z.string().trim().min(1),userId:f.z.string().trim().min(1),identityId:f.z.string().trim().min(1),clientType:f.z.enum(["web","mobile"]),createdAt:f.z.string().datetime(),expiresAt:f.z.string().datetime(),lastSeenAt:f.z.string().datetime().optional(),current:f.z.boolean().optional()}).strict(),op=f.z.object({id:f.z.string().trim().min(1),name:f.z.string().trim().min(1).max(120),description:f.z.string().trim().max(500).optional(),system:f.z.boolean(),status:Gl,permissionIds:f.z.array(Bl).max($l.length),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict(),rp=f.z.object({userId:f.z.string().trim().min(1),roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),nodeScope:Xl,instanceScope:Jl.default({kind:"inherit-node-scope"}),authorizationRevision:f.z.number().int().positive(),updatedAt:f.z.string().datetime()}).strict(),cp=tp.extend({identities:f.z.array(sp),accessGrant:rp}).strict(),dp=f.z.object({userId:f.z.string().trim().min(1),identityId:f.z.string().trim().min(1),roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),permissionIds:f.z.array(Bl).max($l.length),nodeScope:Xl,instanceScope:Jl.default({kind:"inherit-node-scope"}),authorizationRevision:f.z.number().int().positive()}).strict(),lp=f.z.object({id:f.z.string().trim().min(1),name:f.z.string().trim().min(1).max(120),kind:Wl,status:Vl,loginPolicy:Kl,issuer:f.z.string().url().optional(),clientId:f.z.string().trim().min(1).max(500),callbackUrl:f.z.string().url(),clientSecretConfigured:f.z.boolean(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict().superRefine((e,t)=>{"oidc"!==e.kind||e.issuer||t.addIssue({code:"custom",path:["issuer"],message:"OIDC providers require issuer."})});f.z.object({id:f.z.string().trim().min(1),providerId:f.z.string().trim().min(1),subject:f.z.string().trim().min(1).max(500),verifiedEmail:f.z.string().email().optional(),displayName:f.z.string().trim().min(1).max(160).optional(),status:Yl,expiresAt:f.z.string().datetime(),decidedAt:f.z.string().datetime().optional(),decidedByUserId:f.z.string().trim().min(1).optional(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict();const pp=f.z.object({userManagement:f.z.object({users:f.z.literal(!0),identities:f.z.literal(!0),sessions:f.z.literal(!0)}).strict(),authentication:f.z.object({externalIdentity:f.z.object({oidc:f.z.boolean(),oauthAdapters:f.z.array(Wl).max(20)}).strict().optional()}).strict(),authorization:f.z.object({customRoles:f.z.boolean(),nodeScopes:f.z.literal(!0),instanceScopes:f.z.literal(!0).optional(),authorizationRevisions:f.z.literal(!0)}).strict()}).strict(),up=f.z.object({authentication:f.z.enum(["required","disabled"]),aiSessions:f.z.boolean(),nodes:f.z.boolean(),instanceBoard:f.z.boolean(),triggers:f.z.boolean().optional(),accessManagement:pp.optional()}).strict(),mp=f.z.object({version:f.z.literal(1),kind:f.z.literal("control-plane"),controlPlaneId:f.z.string().trim().min(1).max(160),publicKey:f.z.object({algorithm:f.z.literal("Ed25519"),encoding:f.z.literal("base64url"),value:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),fingerprint:f.z.string().regex(/^sha256:[A-Za-z0-9_-]{43}$/)}).strict(),capabilities:up,protocolVersion:f.z.string().regex(/^\d{4}-\d{2}-\d{2}$/),issuedAt:f.z.string().datetime(),expiresAt:f.z.string().datetime()}).strict(),hp=f.z.object({data:f.z.object({payload:mp,signature:f.z.string().regex(/^[A-Za-z0-9_-]{86}$/)}).strict()}).strict(),gp=f.z.object({id:f.z.string().trim().min(8).max(160),name:f.z.string().trim().min(1).max(160),platform:f.z.enum(["ios","android"]),appVersion:f.z.string().trim().min(1).max(80).optional()}).strict();f.z.object({username:f.z.string().trim().min(1).max(80),password:f.z.string().min(1).max(4096),device:gp}).strict();const fp=ap.extend({device:gp,user:tp}).strict();f.z.enum(["CONTROL_PLANE_FORBIDDEN","CONTROL_PLANE_AUTH_REQUIRED","AUTH_PASSWORD_CHANGE_REQUIRED","CONTROL_PLANE_USER_DISABLED","CONTROL_PLANE_AUTHORIZATION_REVISION_CONFLICT","CONTROL_PLANE_LAST_ACTIVE_ADMIN","CONTROL_PLANE_USERNAME_CONFLICT","CONTROL_PLANE_EXTERNAL_IDENTITY_CONFLICT","CONTROL_PLANE_IDENTITY_PROVIDER_NAMESPACE_IMMUTABLE","CONTROL_PLANE_IDENTITY_PROVIDER_UNAVAILABLE","USER_STORE_REINITIALIZATION_REQUIRED"]),f.z.object({data:f.z.object({sessionToken:f.z.string().trim().min(32),session:fp,authorization:dp}).strict()}).strict(),f.z.object({data:f.z.array(fp)}).strict(),f.z.object({data:f.z.object({revoked:f.z.boolean()}).strict()}).strict();const yp=f.z.object({version:f.z.literal(1),key:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/)}).strict();class bp{keyFile;constructor(e){this.keyFile=new Sl(e,()=>({version:1,key:i.randomBytes(32).toString("base64url")}),{schema:yp,directoryMode:448,fileMode:384})}init(){this.keyFile.init()}seal(e){const t=Buffer.from(this.keyFile.get().key,"base64url"),n=i.randomBytes(12),s=i.createCipheriv("aes-256-gcm",t,n),a=Buffer.concat([s.update(e,"utf8"),s.final()]);return["v1",n.toString("base64url"),a.toString("base64url"),s.getAuthTag().toString("base64url")].join(".")}open(e){const[t,n,s,a]=e.split(".");if("v1"!==t||!n||!s||!a)throw new Error("Unsupported encrypted secret envelope.");const o=Buffer.from(this.keyFile.get().key,"base64url"),r=i.createDecipheriv("aes-256-gcm",o,Buffer.from(n,"base64url"));return r.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([r.update(Buffer.from(s,"base64url")),r.final()]).toString("utf8")}}const vp=f.z.object({name:f.z.string().trim().min(1).max(120),kind:f.z.enum(["oidc","github"]),status:f.z.enum(["enabled","disabled"]).optional(),loginPolicy:f.z.enum(["existing-only","admin-approved-create"]).optional(),issuer:f.z.string().url().optional(),clientId:f.z.string().trim().min(1).max(500),clientSecret:f.z.string().min(1).max(1e4),callbackUrl:f.z.string().url()}).strict().superRefine((e,t)=>{"oidc"!==e.kind||e.issuer||t.addIssue({code:"custom",path:["issuer"],message:"OIDC provider requires issuer."})}),Ip=f.z.object({name:f.z.string().trim().min(1).max(120).optional(),kind:f.z.enum(["oidc","github"]).optional(),status:f.z.enum(["enabled","disabled"]).optional(),loginPolicy:f.z.enum(["existing-only","admin-approved-create"]).optional(),issuer:f.z.string().url().optional(),clientId:f.z.string().trim().min(1).max(500).optional(),clientSecret:f.z.string().min(1).max(1e4).optional(),callbackUrl:f.z.string().url().optional()}).strict().refine(e=>Object.values(e).some(e=>void 0!==e),{message:"At least one provider field must be updated."});function xp(e,t){return"github"===e?"github":`oidc:${new URL(t).toString().replace(/\/$/,"")}`}class wp{users;secrets;fetchImplementation;constructor(e,t,n={}){this.users=t,this.secrets=new bp(e.identityProviderEncryptionKeyPath),this.fetchImplementation=n.fetch||fetch}init(){this.secrets.init()}async list(){return(await this.users.store.providers.list()).map(e=>this.publicProvider(e))}async create(e){const t=vp.parse(e);Tl(t.kind),await this.validateConfiguration(t);const n=hl();return this.publicProvider(await this.users.store.providers.put({id:Il("idp"),name:t.name,kind:t.kind,status:t.status||"disabled",loginPolicy:t.loginPolicy||"existing-only",issuer:t.issuer,clientId:t.clientId,clientSecretCiphertext:this.secrets.seal(t.clientSecret),callbackUrl:t.callbackUrl,createdAt:n,updatedAt:n}))}async update(e,t){const n=Ip.parse(t),i=await this.users.store.providers.get(e);if(!i)throw Object.assign(new Error("Identity provider was not found."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_NOT_FOUND",statusCode:404});const s=n.kind||i.kind,a=void 0===n.issuer?i.issuer:n.issuer;if("oidc"===s&&!a)throw Object.assign(new Error("OIDC provider requires issuer."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_ISSUER_REQUIRED",statusCode:400});Tl(s),await this.assertIdentityNamespaceChangeAllowed(i,s,a,this.users.store);const{clientSecret:o,...r}=n;return await this.validateConfiguration({name:r.name||i.name,kind:s,status:r.status||i.status,loginPolicy:r.loginPolicy||i.loginPolicy,issuer:a,clientId:r.clientId||i.clientId,clientSecret:o||await this.clientSecret(e),callbackUrl:r.callbackUrl||i.callbackUrl}),this.users.store.transaction(async t=>{const i=await t.providers.get(e);if(!i)throw Object.assign(new Error("Identity provider was not found."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_NOT_FOUND",statusCode:404});const s=n.kind||i.kind,a=void 0===n.issuer?i.issuer:n.issuer;return await this.assertIdentityNamespaceChangeAllowed(i,s,a,t),await this.users.assertProviderStatusChangeAllowed(e,r.status||i.status,t),this.publicProvider(await t.providers.put({...i,...r,kind:s,issuer:a,clientSecretCiphertext:o?this.secrets.seal(o):i.clientSecretCiphertext,updatedAt:hl()}))})}async remove(e){if(!await this.users.store.providers.get(e))return!1;if(await this.users.store.identities.existsForProvider(e))throw Object.assign(new Error("Identity provider is referenced by login identities."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_IN_USE",statusCode:409});return this.users.store.providers.delete(e)}async clientSecret(e){const t=await this.users.store.providers.get(e);if(!t)throw Object.assign(new Error("Identity provider was not found."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_NOT_FOUND",statusCode:404});return this.secrets.open(t.clientSecretCiphertext)}async validateConfiguration(e){if("oidc"!==e.kind)return;const t=e.issuer.replace(/\/$/,""),n=await this.fetchImplementation(`${t}/.well-known/openid-configuration`,{headers:{accept:"application/json"}});if(!n.ok)throw Object.assign(new Error("OIDC discovery failed."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_UNAVAILABLE",statusCode:400});if(f.z.object({issuer:f.z.string().url(),authorization_endpoint:f.z.string().url(),token_endpoint:f.z.string().url(),jwks_uri:f.z.string().url()}).passthrough().parse(await n.json()).issuer.replace(/\/$/,"")!==t)throw Object.assign(new Error("OIDC discovery issuer does not match configured issuer."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_ISSUER_MISMATCH",statusCode:400})}async assertIdentityNamespaceChangeAllowed(e,t,n,i){if(xp(e.kind,e.issuer)!==xp(t,n)&&(await i.identities.existsForProvider(e.id)||await i.approvals.hasActivePendingForProvider(e.id,hl())))throw Object.assign(new Error("Identity provider kind and issuer cannot change while identities or pending approvals reference it."),{code:"CONTROL_PLANE_IDENTITY_PROVIDER_NAMESPACE_IMMUTABLE",statusCode:409})}publicProvider(e){return lp.parse({id:e.id,name:e.name,kind:e.kind,status:e.status,loginPolicy:e.loginPolicy,issuer:e.issuer,clientId:e.clientId,callbackUrl:e.callbackUrl,clientSecretConfigured:Boolean(e.clientSecretCiphertext),createdAt:e.createdAt,updatedAt:e.updatedAt})}}const Sp=o.promisify(i.scrypt);function Ap(e){return e.trim().toLocaleLowerCase("en-US")}async function Ep(e){const t=i.randomBytes(16).toString("base64url");return`scrypt$${t}$${(await Sp(e,t,64)).toString("base64url")}`}async function _p(e,t){const[n,s,a]=t.split("$");if("scrypt"!==n||!s||!a)return!1;const o=await Sp(e,s,64),r=Buffer.from(a,"base64url");return r.length===o.length&&i.timingSafeEqual(r,o)}const Tp=f.z.object({username:f.z.string().trim().min(1).max(80),password:f.z.string().min(1).max(4096)}).strict(),zp={windowMs:9e5,maxFailuresPerSource:20,maxFailuresPerUsername:10,maxConcurrent:4};class kp{sourceFailures=new Map;usernameFailures=new Map;options;concurrent=0;constructor(e){this.options=e}begin(e,t){const n=Date.now();if(this.assertAvailable(this.sourceFailures,e,this.options.maxFailuresPerSource,n),this.assertAvailable(this.usernameFailures,t,this.options.maxFailuresPerUsername,n),this.concurrent>=this.options.maxConcurrent)throw this.error();this.concurrent+=1}finish(){this.concurrent=Math.max(0,this.concurrent-1)}failure(e,t){const n=Date.now();this.current(this.sourceFailures,e,n).push(n),this.current(this.usernameFailures,t,n).push(n)}current(e,t,n){const i=(e.get(t)||[]).filter(e=>e>n-this.options.windowMs);return e.set(t,i),i}assertAvailable(e,t,n,i){const s=this.current(e,t,i);if(s.length>=n)throw this.error(s[0]+this.options.windowMs-i)}error(e=1e3){return Object.assign(new Error("Too many failed sign-in attempts. Try again later."),{code:"AUTH_LOGIN_RATE_LIMITED",statusCode:429,retryAfterSeconds:Math.max(1,Math.ceil(e/1e3))})}}function Np(e){return i.createHash("sha256").update(e).digest("base64url")}class Cp{passwordUpdates=new Set;limiter;sessionActivity=new Map;users;nextSessionActivityPruneAt=0;constructor(e,t={}){this.users=e,this.limiter=new kp({...zp,...t})}async loginLocal(e,t={}){const n=Tp.parse(e),i=Ap(n.username),s=t.sourceId?.trim()||"unknown";this.limiter.begin(s,i);try{const e=await this.users.store.identities.findByLoginName(i),a=!!e&&await _p(n.password,e.passwordHash||"");if(!e||!a)throw this.limiter.failure(s,i),Object.assign(new Error("Invalid username or password."),{code:"AUTH_LOGIN_FAILED",statusCode:401});const o=await this.users.store.users.get(e.userId);if(!o||"active"!==o.status)throw this.limiter.failure(s,i),Object.assign(new Error("Invalid username or password."),{code:"AUTH_LOGIN_FAILED",statusCode:401});const r=hl();return this.createSessionForIdentity(e.id,t.clientType||"web",t.device,{loginAt:r})}finally{this.limiter.finish()}}async createSessionForIdentity(e,t,n,i={}){const s=n?gp.parse(n):void 0;if("mobile"===t&&!s)throw Object.assign(new Error("Mobile sessions require device metadata."),{code:"AUTH_MOBILE_DEVICE_REQUIRED",statusCode:400});const a=hl(),o=xl(),r=await this.users.store.transaction(async n=>{const r=await n.identities.get(e);if(!r)throw Object.assign(new Error("Login identity was not found."),{code:"CONTROL_PLANE_IDENTITY_NOT_FOUND",statusCode:404});if("mobile"===t&&!0===r.requiresPasswordChange)throw Object.assign(new Error("Change the temporary password in the Control Plane before signing in on mobile."),{code:"AUTH_PASSWORD_CHANGE_REQUIRED",statusCode:403});const c=await this.users.authorization(r.userId,n);if(i.loginAt){const e=await n.users.get(r.userId);await n.users.put({...e,lastLoginAt:i.loginAt,updatedAt:i.loginAt}),await n.identities.put({...r,lastUsedAt:i.loginAt,updatedAt:i.loginAt})}return{record:await n.sessions.put({id:Il("mobile"===t?"msess":"sess"),userId:r.userId,identityId:e,authorizationRevision:c.authorizationRevision,tokenHash:Np(o),expiresAt:new Date(Date.now()+12096e5).toISOString(),createdAt:a,updatedAt:a,clientType:t,...s?{device:s}:{}}),identity:r,authorization:c}}),{record:c,identity:d,authorization:l}=r;return this.trackSessionActivity(c,a),{sessionToken:`${c.id}.${o}`,expiresAt:c.expiresAt,session:await this.publicSession(c.id),user:await this.users.detail(d.userId),authorization:dp.parse({...l,identityId:e}),requiresPasswordChange:!0===d.requiresPasswordChange}}async changeLocalPassword(e,t){const n=f.z.object({currentPassword:f.z.string().min(1).max(4096),newPassword:f.z.string().min(8).max(4096)}).strict().parse(t),i=await this.resolve(e,"web");if(!i)throw Object.assign(new Error("Sign in to change the password."),{code:"CONTROL_PLANE_AUTH_REQUIRED",statusCode:401});if(this.passwordUpdates.has(i.user.id))throw Object.assign(new Error("A password update is already in progress for this account."),{code:"AUTH_CREDENTIAL_UPDATE_IN_PROGRESS",statusCode:409});this.passwordUpdates.add(i.user.id);try{const e=await this.users.store.identities.get(i.session.identityId);if(!e||"local-password"!==e.kind||!await _p(n.currentPassword,e.passwordHash||""))throw Object.assign(new Error("The current password is incorrect."),{code:"AUTH_CURRENT_PASSWORD_INVALID",statusCode:400});if(await _p(n.newPassword,e.passwordHash||""))throw Object.assign(new Error("The new password must be different from the current password."),{code:"AUTH_PASSWORD_UNCHANGED",statusCode:400});return await this.users.resetLocalPassword(e.userId,n.newPassword,!1),this.createSessionForIdentity(e.id,"web")}finally{this.passwordUpdates.delete(i.user.id)}}async resolve(e,t){const[n,i]=e?.split(".")||[];if(!n||!i)return;const s=await this.users.store.sessions.get(n),a=hl();if(!s)return void this.sessionActivity.delete(n);if(s.expiresAt<=a)return void this.sessionActivity.delete(n);if(t&&s.clientType!==t||s.tokenHash!==Np(i))return;let o;try{o=await this.users.authorization(s.userId)}catch{return await this.users.store.sessions.delete(s.id),void this.sessionActivity.delete(s.id)}return o.authorizationRevision!==s.authorizationRevision?(await this.users.store.sessions.delete(s.id),void this.sessionActivity.delete(s.id)):(this.trackSessionActivity(s,a),{session:{...s,lastSeenAt:a},user:await this.users.detail(s.userId),authorization:dp.parse({...o,identityId:s.identityId}),requiresPasswordChange:!0===(await this.users.store.identities.get(s.identityId))?.requiresPasswordChange})}async currentSession(e,t="web"){const n=await this.resolve(e,t);return{authenticated:Boolean(n),user:n?.user,authorization:n?.authorization,requiresPasswordChange:!0===n?.requiresPasswordChange}}async listSessions(e,t=e){if(e!==t&&!(await this.users.authorization(e)).permissionIds.includes("users:manage"))throw Object.assign(new Error("Session management is forbidden."),{code:"CONTROL_PLANE_FORBIDDEN",statusCode:403});const n=(await this.users.store.sessions.listByUser(t)).filter(e=>e.expiresAt>hl());return Promise.all(n.map(e=>this.publicSession(e.id)))}async listMobileSessions(e){const t=(await this.users.store.sessions.listByUser(e)).filter(e=>"mobile"===e.clientType&&e.expiresAt>hl());return Promise.all(t.map(async e=>({...await this.publicSession(e.id),device:e.device,user:await this.users.detail(e.userId)})))}async revokeSession(e,t){const n=await this.users.store.sessions.get(t);if(!n)return this.sessionActivity.delete(t),!1;if(n.userId!==e&&!(await this.users.authorization(e)).permissionIds.includes("users:manage"))throw Object.assign(new Error("Session management is forbidden."),{code:"CONTROL_PLANE_FORBIDDEN",statusCode:403});const i=await this.users.store.sessions.delete(t);return i&&this.sessionActivity.delete(t),i}async logout(e){const t=e?.split(".")[0];return t&&(await this.users.store.sessions.delete(t),this.sessionActivity.delete(t)),{ok:!0}}async publicSession(e){const t=await this.users.store.sessions.get(e);if(!t)throw Object.assign(new Error("Session was not found."),{code:"CONTROL_PLANE_SESSION_NOT_FOUND",statusCode:404});return ap.parse({id:t.id,userId:t.userId,identityId:t.identityId,clientType:t.clientType,createdAt:t.createdAt,expiresAt:t.expiresAt,lastSeenAt:this.sessionActivity.get(t.id)?.lastSeenAt||t.lastSeenAt||t.createdAt})}trackSessionActivity(e,t){const n=Date.parse(t);if(n>=this.nextSessionActivityPruneAt){for(const[e,t]of this.sessionActivity)Date.parse(t.expiresAt)<=n&&this.sessionActivity.delete(e);this.nextSessionActivityPruneAt=n+36e5}this.sessionActivity.set(e.id,{expiresAt:e.expiresAt,lastSeenAt:t})}}const Rp=f.z.object({dialect:f.z.literal("sqlite").default("sqlite"),path:f.z.string().trim().min(1).optional()}).strict(),Op=f.z.object({dialect:f.z.literal("postgresql"),connectionString:f.z.string().trim().url(),schema:f.z.string().trim().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/).default("public")}).strict(),jp=f.z.discriminatedUnion("dialect",[Rp,Op]);const Pp="import_v0.0.21_auth_json",Dp=f.z.object({id:f.z.string().trim().min(1),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}),Lp=Dp.extend({username:f.z.string().trim().min(1).max(80).regex(/^[a-zA-Z0-9_.@-]+$/),passwordHash:f.z.string().trim().min(1),role:f.z.enum(["viewer","operator","admin"]),lastLoginAt:f.z.string().datetime().optional()}).strip(),Mp=Dp.extend({userId:f.z.string().trim().min(1),tokenHash:f.z.string().trim().min(1),expiresAt:f.z.string().datetime(),lastSeenAt:f.z.string().datetime().optional(),clientType:f.z.enum(["web","mobile"]).default("web"),device:gp.optional()}).strip().refine(e=>"mobile"!==e.clientType||Boolean(e.device),{path:["device"],message:"Mobile sessions require device metadata."}),qp=Dp.extend({subject:f.z.object({type:f.z.literal("local-user"),userId:f.z.string().trim().min(1)}).strip(),role:f.z.enum(["viewer","operator","admin"]),nodeScope:Xl,status:f.z.enum(["active","disabled"]),authorizationRevision:f.z.number().int().positive()}).strip();function Up(e){return n.existsSync(e)?n.readdirSync(e).filter(e=>e.endsWith(".json")).sort():[]}function $p(e,i){return Up(e).map(s=>{const a=t.join(e,s);let o;try{o=JSON.parse(n.readFileSync(a,"utf8"))}catch(e){throw Bp(`Cannot read ${a}: ${e instanceof Error?e.message:String(e)}`)}const r=i.safeParse(o);if(!r.success)throw Bp(`Invalid v0.0.21 record ${a}: ${f.z.prettifyError(r.error)}`);if(s!==`${r.data.id}.json`)throw Bp(`Legacy record filename does not match id: ${a}.`);return r.data})}function Bp(e){return Object.assign(new Error(e),{code:"CONTROL_PLANE_LEGACY_AUTH_IMPORT_FAILED",recovery:"Fix or restore the v0.0.21 auth JSON files, then restart. The source files were not modified."})}function Fp(e){return`identity_legacy_${i.createHash("sha256").update(e).digest("hex").slice(0,20)}`}function Hp(e){return Up(e.authUsersDir).length>0||Up(e.authSessionsDir).length>0||Up(e.authMembershipsDir).length>0}const Gp="role_admin",Wp=$l.filter(e=>e.endsWith(":read")),Vp=["users:","roles:","identity-providers:","settings:","secrets:","chat-bridges:"],Kp=$l.filter(e=>!Vp.some(t=>e.startsWith(t)));function Yp(e,t,n){const i=hl();return{id:e,name:t,system:!0,status:"active",permissionIds:[...n],createdAt:i,updatedAt:i}}class Xp{repositoryValue;stateValue;paths;database;constructor(e,t={}){this.paths=e,this.database=t.database}get users(){return this.repository().users}get identities(){return this.repository().identities}get roles(){return this.repository().roles}get grants(){return this.repository().grants}get sessions(){return this.repository().sessions}get providers(){return this.repository().providers}get approvals(){return this.repository().approvals}get audit(){return this.repository().audit}async init(){if(this.repositoryValue)return this.state();this.repositoryValue=await async function(e,n){const i=function(e,n){const i=n?.dialect||process.env.TASK_HANDOFF_CONTROL_PLANE_DATABASE_DIALECT||"sqlite";if("postgresql"===i)return jp.parse(n||{dialect:i,connectionString:process.env.TASK_HANDOFF_CONTROL_PLANE_DATABASE_URL,schema:process.env.TASK_HANDOFF_CONTROL_PLANE_DATABASE_SCHEMA});if("sqlite"!==i)throw Object.assign(new Error(`Unsupported Control Plane database dialect: ${i}.`),{code:"CONTROL_PLANE_DATABASE_DIALECT_UNSUPPORTED"});const s=Rp.parse(n||{dialect:"sqlite",path:process.env.TASK_HANDOFF_CONTROL_PLANE_SQLITE_PATH});return{...s,path:t.resolve(s.path||e.databasePath)}}(e,n);if("postgresql"===i.dialect){const{createPostgresqlUserRepository:e}=await Promise.resolve().then(function(){return HA});return e(i)}const{createSqliteUserRepository:s}=await Promise.resolve().then(function(){return pE});return s(i.path)}(this.paths,this.database);try{Hp(this.paths)&&await this.repositoryValue.transaction(async e=>{await this.ensureSystemRoles(e),await async function(e,t){const n=$p(t.authUsersDir,Lp),s=$p(t.authSessionsDir,Mp),a=$p(t.authMembershipsDir,qp),o=function(e,t,n){return i.createHash("sha256").update(JSON.stringify({users:e,sessions:t,memberships:n})).digest("hex")}(n,s,a),r=await e.migration(Pp);if(r){if(r.checksum!==o)throw Bp("Legacy auth JSON changed after it was imported.");return{imported:!1,users:Number(r.details.users||0),sessions:Number(r.details.sessions||0),memberships:Number(r.details.memberships||0)}}const c=new Set(n.map(e=>e.id));if(c.size!==n.length)throw Bp("Legacy auth data contains duplicate user ids.");const d=n.map(e=>Ap(e.username));if(new Set(d).size!==d.length)throw Bp("Legacy auth data contains usernames that collide after normalization.");const l=new Map;for(const e of a){const t=e.subject.userId;if(!c.has(t))throw Bp(`Legacy membership ${e.id} references missing user ${t}.`);if(l.has(t))throw Bp(`Legacy auth data contains multiple memberships for user ${t}.`);l.set(t,e)}const p=s.map(e=>e.tokenHash);if(new Set(p).size!==p.length)throw Bp("Legacy auth data contains duplicate session token hashes.");for(const e of s)if(!c.has(e.userId))throw Bp(`Legacy session ${e.id} references missing user ${e.userId}.`);if((await Promise.all([e.users.list(),e.identities.list(),e.grants.list(),e.sessions.list()])).some(e=>e.length>0))throw Bp("The SQL user store is not empty; refusing to merge legacy auth JSON automatically.");try{await e.transaction(async e=>{for(const t of n){const n=l.get(t.id);await e.users.put({id:t.id,displayName:t.username,status:"disabled"===n?.status?"disabled":"active",lastLoginAt:t.lastLoginAt,createdAt:t.createdAt,updatedAt:t.updatedAt}),await e.identities.put({id:Fp(t.id),userId:t.id,kind:"local-password",normalizedLoginName:Ap(t.username),passwordHash:t.passwordHash,requiresPasswordChange:!1,lastUsedAt:t.lastLoginAt,createdAt:t.createdAt,updatedAt:t.updatedAt}),await e.grants.put({userId:t.id,roleIds:[`role_${n?.role||t.role}`],nodeScope:n?.nodeScope||{kind:"all"},instanceScope:{kind:"inherit-node-scope"},authorizationRevision:n?.authorizationRevision||1,createdAt:t.createdAt,updatedAt:t.updatedAt})}const t=(new Date).toISOString();for(const n of s.filter(e=>e.expiresAt>t)){const t=l.get(n.userId)?.authorizationRevision||1;await e.sessions.put({...n,identityId:Fp(n.userId),authorizationRevision:t})}const i=n.map(e=>e.createdAt).sort()[0]||t;await e.putMetadata({schemaVersion:1,initializedAt:i}),await e.putMigration({id:Pp,checksum:o,appliedAt:t,details:{sourceVersion:a.length?"v0.0.24":"v0.0.21",users:n.length,sessions:s.length,memberships:a.length}})})}catch(e){if("CONTROL_PLANE_LEGACY_AUTH_IMPORT_FAILED"===e.code)throw e;throw Bp(`v0.0.21 import transaction failed: ${e instanceof Error?e.message:String(e)}`)}return{imported:!0,users:n.length,sessions:s.length,memberships:a.length}}(e,this.paths)});const e=await this.repositoryValue.metadata(),t={initialized:Boolean(e.initializedAt),legacyDataPresent:Hp(this.paths),databaseDialect:this.repositoryValue.dialect};return this.stateValue=t,t.initialized&&await this.ensureSystemRoles(),t}catch(e){throw await this.close(),e}}state(){if(!this.stateValue)throw Object.assign(new Error("Control Plane user database is not initialized."),{code:"CONTROL_PLANE_DATABASE_NOT_INITIALIZED"});return this.stateValue}async initializeForBootstrap(){await this.repository().transaction(async e=>{const t=await e.metadata();t.initializedAt||await e.putMetadata({...t,initializedAt:hl()}),await this.ensureSystemRoles(e)}),this.stateValue={...this.state(),initialized:!0}}transaction(e){return this.repository().transaction(e)}async close(){const e=this.repositoryValue;this.repositoryValue=void 0,this.stateValue=void 0,await(e?.close())}repository(){if(!this.repositoryValue)throw Object.assign(new Error("Control Plane user database is not initialized."),{code:"CONTROL_PLANE_DATABASE_NOT_INITIALIZED"});return this.repositoryValue}async ensureSystemRoles(e=this.repository()){const t=[Yp(Gp,"Admin",$l),Yp("role_operator","Operator",Kp),Yp("role_viewer","Viewer",Wp)];for(const n of t){const t=await e.roles.get(n.id);await e.roles.put(t?{...n,createdAt:t.createdAt,updatedAt:t.permissionIds.join("\0")===n.permissionIds.join("\0")?t.updatedAt:n.updatedAt}:n)}}}const Jp=np,Qp=f.z.string().min(8).max(4096),Zp=Xl,eu=Jl,tu=f.z.object({username:Jp,password:Qp,displayName:f.z.string().trim().min(1).max(160).optional()}).strict(),nu=tu.extend({roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),nodeScope:Zp,instanceScope:eu.optional(),requirePasswordChange:f.z.boolean().optional()}).strict(),iu=f.z.object({roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),nodeScope:Zp,instanceScope:eu.optional(),expectedAuthorizationRevision:f.z.number().int().positive()}).strict(),su=f.z.object({name:f.z.string().trim().min(1).max(120),description:f.z.string().trim().max(500).optional(),permissionIds:f.z.array(Bl).min(1)}).strict(),au=f.z.object({name:f.z.string().trim().min(1).max(120).optional(),description:f.z.string().trim().max(500).optional(),permissionIds:f.z.array(Bl).min(1).optional()}).strict().refine(e=>Object.values(e).some(e=>void 0!==e),{message:"At least one role field must be updated."}),ou=f.z.object({username:Jp,password:Qp,userId:f.z.string().trim().min(1).optional(),targetUsername:Jp.optional()}).strict().refine(e=>!(e.userId&&e.targetUsername),{message:"Select an account by either userId or targetUsername, not both."}),ru=f.z.object({displayName:f.z.string().trim().min(1).max(160).optional(),roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),nodeScope:Zp,instanceScope:eu.optional()}).strict();function cu(e,t){return Object.assign(new Error(t),{code:e,statusCode:409})}function du(e){return Object.assign(new Error(`${e} was not found.`),{code:`CONTROL_PLANE_${e.toUpperCase()}_NOT_FOUND`,statusCode:404})}function lu(e){return"all"===e.kind?{kind:"all"}:{kind:"selected",nodeIds:[...new Set(e.nodeIds.map(e=>e.trim()).filter(Boolean))].sort()}}function pu(e){return"inherit-node-scope"===e.kind?{kind:"inherit-node-scope"}:{kind:"selected",instanceIds:[...new Set(e.instanceIds.map(e=>e.trim()).filter(Boolean))].sort()}}class uu{store;bootstrapInProgress=!1;initPromise;constructor(e,t={}){this.store=new Xp(e,t)}init(){return this.initPromise||(this.initPromise=this.store.init().catch(e=>{throw this.initPromise=void 0,e})),this.initPromise}async state(){const e=this.store.state();return{...e,requiresBootstrap:!e.initialized||0===(await this.store.users.list()).length}}async bootstrapAdmin(e){if(await this.init(),this.bootstrapInProgress)throw cu("AUTH_BOOTSTRAP_IN_PROGRESS","Control Plane admin initialization is already in progress.");const t=tu.parse(e);if(this.store.state().initialized&&(await this.store.users.list()).length>0)throw cu("AUTH_BOOTSTRAP_ALREADY_DONE","Control Plane user store is already initialized.");let n,i;this.bootstrapInProgress=!0;try{await this.store.initializeForBootstrap();const e=await this.createLocalUserInternal({...t,roleIds:[Gp],nodeScope:{kind:"all"},instanceScope:{kind:"inherit-node-scope"}});return n=e.user.id,i=e.identity.id,await this.detail(e.user.id)}catch(e){throw n&&(await this.store.grants.delete(n),await this.store.users.delete(n)),i&&await this.store.identities.delete(i),e}finally{this.bootstrapInProgress=!1}}async list(e={}){const t=e.search?.trim().toLocaleLowerCase("en-US"),[n,i]=await Promise.all([this.store.users.list(),this.store.identities.list()]),s=new Map(i.filter(e=>"local-password"===e.kind).map(e=>[e.userId,e]));return n.filter(t=>e.includeArchived||"archived"!==t.status).filter(e=>!t||e.displayName.toLocaleLowerCase("en-US").includes(t)||s.get(e.id)?.normalizedLoginName?.includes(t)).sort((e,t)=>e.displayName.localeCompare(t.displayName)).map(e=>this.publicUser(e,s.get(e.id)))}async detail(e){const t=await this.requireUser(e),[n,i]=await Promise.all([this.store.identities.listByUser(e),this.store.grants.get(e)]);if(!i)throw cu("CONTROL_PLANE_USER_ACCESS_REQUIRED","User has no access grant.");const s=n.map(e=>this.publicIdentity(e));return cp.parse({...this.publicUser(t,n.find(e=>"local-password"===e.kind)),identities:s,accessGrant:{userId:i.userId,roleIds:i.roleIds,nodeScope:i.nodeScope,instanceScope:i.instanceScope,authorizationRevision:i.authorizationRevision,updatedAt:i.updatedAt}})}async createLocalUser(e){const t=nu.parse(e),n=await this.createLocalUserInternal(t);return this.detail(n.user.id)}async updateUser(e,t){const n=ip.parse(t);return await this.store.transaction(async t=>{const i=await this.requireUser(e,t),s=hl();if(void 0!==n.username){const i=await this.localIdentity(e,t);if(!i)throw du("identity");const a=Ap(n.username),o=await t.identities.findByLoginName(a);if(o&&o.id!==i.id)throw cu("CONTROL_PLANE_USERNAME_CONFLICT","A Control Plane user already uses that username.");await t.identities.put({...i,normalizedLoginName:a,updatedAt:s})}const a={...i,...void 0===n.displayName?{}:{displayName:n.displayName},...void 0===n.status?{}:{status:n.status,archivedAt:"archived"===n.status?hl():void 0},updatedAt:s};await this.assertLoginCapableAdminRemains(t,{userStatus:{userId:e,status:a.status}}),await t.users.put(a),void 0!==n.status&&n.status!==i.status&&await this.bumpAuthorizationRevisionIn(t,e)}),this.detail(e)}async setAccess(e,t){const n=iu.parse(t);return await this.store.transaction(async t=>{await this.requireUser(e,t);const i=await t.grants.get(e);if(!i)throw cu("CONTROL_PLANE_USER_ACCESS_REQUIRED","User has no access grant.");if(i.authorizationRevision!==n.expectedAuthorizationRevision)throw cu("CONTROL_PLANE_AUTHORIZATION_REVISION_CONFLICT","User authorization changed before this update was applied.");await this.assertActiveRoles(n.roleIds,t),await this.assertLoginCapableAdminRemains(t,{roleIds:{userId:e,roleIds:n.roleIds}}),await t.grants.put({...i,roleIds:[...new Set(n.roleIds)].sort(),nodeScope:lu(n.nodeScope),instanceScope:n.instanceScope?pu(n.instanceScope):i.instanceScope,authorizationRevision:i.authorizationRevision+1,updatedAt:hl()}),await this.revokeSessionsIn(t,e)}),this.detail(e)}async authorization(e,t){const n=t||this.store;if("active"!==(await this.requireUser(e,t)).status)throw Object.assign(new Error("User is not active."),{code:"CONTROL_PLANE_USER_DISABLED",statusCode:403});const i=await n.grants.get(e);if(!i)throw cu("CONTROL_PLANE_USER_ACCESS_REQUIRED","User has no access grant.");const s=(await Promise.all(i.roleIds.map(e=>n.roles.get(e)))).filter(e=>Boolean(e&&"active"===e.status));if(s.length!==i.roleIds.length)throw cu("CONTROL_PLANE_ROLE_INACTIVE","User access references an unavailable role.");const a=[...new Set(s.flatMap(e=>e.permissionIds))].sort();return{userId:e,roleIds:i.roleIds,permissionIds:a,nodeScope:i.nodeScope,instanceScope:i.instanceScope,authorizationRevision:i.authorizationRevision}}async resetLocalPassword(e,t,n=!0){Qp.parse(t);const i=await Ep(t);let s="";return await this.store.transaction(async t=>{await this.requireUser(e,t);const a=await this.localIdentity(e,t);if(!a)throw du("identity");s=a.id,await t.identities.put({...a,passwordHash:i,requiresPasswordChange:n,updatedAt:hl()}),await this.bumpAuthorizationRevisionIn(t,e)}),this.publicIdentity(await this.store.identities.get(s))}async recoverLocalCredentials(e){const t=ou.parse(e),n=Ap(t.username),i=await Ep(t.password);let s="";return await this.store.transaction(async e=>{const a=await e.users.list(),o=t.userId?a.find(e=>e.id===t.userId):t.targetUsername?(await Promise.all(a.map(async t=>({user:t,identity:await this.localIdentity(t.id,e)})))).find(({identity:e})=>e?.normalizedLoginName===Ap(t.targetUsername))?.user:1===a.length?a[0]:void 0;if(!o&&(t.userId||t.targetUsername))throw du("user");if(!o)throw cu("AUTH_ACCOUNT_AMBIGUOUS","The account to recover is ambiguous.");const r=await e.identities.findByLoginName(n);if(r&&r.userId!==o.id)throw cu("CONTROL_PLANE_USERNAME_CONFLICT","A Control Plane user already uses that username.");const c=await this.localIdentity(o.id,e);if(!c)throw du("identity");s=o.id,await e.identities.put({...c,normalizedLoginName:n,passwordHash:i,requiresPasswordChange:!1,updatedAt:hl()}),await this.bumpAuthorizationRevisionIn(e,o.id)}),this.detail(s)}async unbindExternalIdentity(e,t){return await this.store.transaction(async n=>{const i=await this.requireUser(e,n),s=await n.identities.get(t);if(!s||s.userId!==e)throw du("identity");if("local-password"===s.kind)throw cu("CONTROL_PLANE_LOCAL_IDENTITY_IMMUTABLE","Local password identities cannot be unbound.");const a={removedIdentityId:t};if(await this.assertLoginCapableAdminRemains(n,a),"active"===i.status&&!await this.hasLoginCapableIdentity(e,n,a))throw cu("CONTROL_PLANE_LAST_LOGIN_IDENTITY","An active user must retain at least one login identity.");await n.identities.delete(t),await this.bumpAuthorizationRevisionIn(n,e)}),{unbound:!0}}async approveExternalIdentity(e,t,n){if(!(await this.authorization(e)).permissionIds.includes("users:manage"))throw Object.assign(new Error("User management is forbidden."),{code:"CONTROL_PLANE_FORBIDDEN",statusCode:403});const i=ru.parse(n);await this.assertActiveRoles(i.roleIds);const s=await this.store.approvals.get(t);if(!s||"pending"!==s.status||s.expiresAt<=hl())throw cu("CONTROL_PLANE_EXTERNAL_IDENTITY_APPROVAL_INVALID","External identity approval is invalid or expired.");const a=await this.store.providers.get(s.providerId);if(!a||"enabled"!==a.status)throw du("identity_provider");if(await this.store.identities.findByProviderSubject(s.providerId,s.subject))throw cu("CONTROL_PLANE_EXTERNAL_IDENTITY_CONFLICT","External identity is already bound to a user.");const o=hl(),r={id:Il("user"),displayName:i.displayName||s.displayName||s.verifiedEmail||"External user",status:"active",createdAt:o,updatedAt:o},c={id:Il("identity"),userId:r.id,kind:"oidc"===a.kind?"oidc":"oauth",providerId:a.id,subject:s.subject,verifiedEmail:s.verifiedEmail,createdAt:o,updatedAt:o};return await this.store.transaction(async n=>{const a=await n.approvals.get(t);if(!a||"pending"!==a.status||a.expiresAt<=hl())throw cu("CONTROL_PLANE_EXTERNAL_IDENTITY_APPROVAL_INVALID","External identity approval is invalid or expired.");if(await n.identities.findByProviderSubject(s.providerId,s.subject))throw cu("CONTROL_PLANE_EXTERNAL_IDENTITY_CONFLICT","External identity is already bound to a user.");await this.assertActiveRoles(i.roleIds,n),await n.users.put(r),await n.identities.put(c),await n.grants.put({userId:r.id,roleIds:[...new Set(i.roleIds)].sort(),nodeScope:lu(i.nodeScope),instanceScope:pu(i.instanceScope||{kind:"inherit-node-scope"}),authorizationRevision:1,createdAt:o,updatedAt:o}),await n.approvals.put({...a,status:"approved",decidedAt:o,decidedByUserId:e,updatedAt:o})}),this.detail(r.id)}async rejectExternalIdentity(e,t){if(!(await this.authorization(e)).permissionIds.includes("users:manage"))throw Object.assign(new Error("User management is forbidden."),{code:"CONTROL_PLANE_FORBIDDEN",statusCode:403});const n=hl();return await this.store.transaction(async i=>{const s=await i.approvals.get(t);if(!s||"pending"!==s.status)throw du("external_identity_approval");await i.approvals.put({...s,status:"rejected",decidedAt:n,decidedByUserId:e,updatedAt:n})}),{rejected:!0}}async createRole(e){const t=su.parse(e),n=hl();return this.store.transaction(async e=>{if((await e.roles.list()).some(e=>e.name.toLocaleLowerCase("en-US")===t.name.toLocaleLowerCase("en-US")&&"active"===e.status))throw cu("CONTROL_PLANE_ROLE_NAME_CONFLICT","An active role already uses that name.");return op.parse(await e.roles.put({id:Il("role"),name:t.name,description:t.description,system:!1,status:"active",permissionIds:[...new Set(t.permissionIds)].sort(),createdAt:n,updatedAt:n}))})}async updateRole(e,t){const n=au.parse(t),i=await this.store.transaction(async t=>{const i=await t.roles.get(e);if(!i)throw du("role");if(i.system)throw cu("CONTROL_PLANE_SYSTEM_ROLE_IMMUTABLE","System roles cannot be edited.");if(n.name&&(await t.roles.list()).some(t=>t.id!==e&&"active"===t.status&&t.name.toLocaleLowerCase("en-US")===n.name.toLocaleLowerCase("en-US")))throw cu("CONTROL_PLANE_ROLE_NAME_CONFLICT","An active role already uses that name.");const s=await t.roles.put({...i,...void 0===n.name?{}:{name:n.name},...void 0===n.description?{}:{description:n.description},...void 0===n.permissionIds?{}:{permissionIds:[...new Set(n.permissionIds)].sort()},updatedAt:hl()});for(const n of await t.grants.listByRole(e))await t.grants.put({...n,authorizationRevision:n.authorizationRevision+1,updatedAt:hl()}),await this.revokeSessionsIn(t,n.userId);return s});return op.parse(i)}async archiveRole(e){return this.store.transaction(async t=>{const n=await t.roles.get(e);if(!n)throw du("role");if(n.system)throw cu("CONTROL_PLANE_SYSTEM_ROLE_IMMUTABLE","System roles cannot be archived.");if((await t.grants.listByRole(e)).length>0)throw cu("CONTROL_PLANE_ROLE_IN_USE","Role is assigned to one or more users.");return op.parse(await t.roles.put({...n,status:"archived",updatedAt:hl()}))})}async revokeSessions(e){return this.store.transaction(t=>this.revokeSessionsIn(t,e))}async removeInstanceFromAccessScopes(e){return this.store.transaction(async t=>{const n=[];for(const i of await t.grants.list())"selected"===i.instanceScope.kind&&i.instanceScope.instanceIds.includes(e)&&(await t.grants.put({...i,instanceScope:{kind:"selected",instanceIds:i.instanceScope.instanceIds.filter(t=>t!==e)},authorizationRevision:i.authorizationRevision+1,updatedAt:hl()}),await this.revokeSessionsIn(t,i.userId),n.push(i.userId));return n})}async revokeSessionsIn(e,t){let n=0;for(const i of await e.sessions.listByUser(t))await e.sessions.delete(i.id)&&(n+=1);return n}async bumpAuthorizationRevisionIn(e,t){const n=await e.grants.get(t);if(!n)throw cu("CONTROL_PLANE_USER_ACCESS_REQUIRED","User has no access grant.");await e.grants.put({...n,authorizationRevision:n.authorizationRevision+1,updatedAt:hl()}),await this.revokeSessionsIn(e,t)}async createLocalUserInternal(e){const t=Ap(e.username),n=hl(),i={id:Il("user"),displayName:e.displayName||e.username,status:"active",createdAt:n,updatedAt:n},s={id:Il("identity"),userId:i.id,kind:"local-password",normalizedLoginName:t,passwordHash:await Ep(e.password),requiresPasswordChange:e.requirePasswordChange||!1,createdAt:n,updatedAt:n};return this.store.transaction(async a=>{if(await a.identities.findByLoginName(t))throw cu("CONTROL_PLANE_USERNAME_CONFLICT","A Control Plane user already uses that username.");return await this.assertActiveRoles(e.roleIds,a),await a.users.put(i),await a.identities.put(s),await a.grants.put({userId:i.id,roleIds:[...new Set(e.roleIds)].sort(),nodeScope:lu(e.nodeScope),instanceScope:pu(e.instanceScope||{kind:"inherit-node-scope"}),authorizationRevision:1,createdAt:n,updatedAt:n}),{user:i,identity:s}})}async requireUser(e,t){const n=await(t?.users||this.store.users).get(e);if(!n)throw du("user");return n}async localIdentity(e,t){return(await(t?.identities||this.store.identities).listByUser(e)).find(e=>"local-password"===e.kind)}publicUser(e,t){return tp.parse({id:e.id,displayName:e.displayName,primaryUsername:t?.normalizedLoginName,status:e.status,createdAt:e.createdAt,updatedAt:e.updatedAt,lastLoginAt:e.lastLoginAt})}publicIdentity(e){return sp.parse({id:e.id,userId:e.userId,kind:e.kind,providerId:e.providerId,loginName:e.normalizedLoginName,subject:e.subject,verifiedEmail:e.verifiedEmail,requiresPasswordChange:e.requiresPasswordChange,createdAt:e.createdAt,updatedAt:e.updatedAt,lastUsedAt:e.lastUsedAt})}async assertActiveRoles(e,t){const n=[...new Set(e)];if(n.length!==e.length)throw cu("CONTROL_PLANE_ROLE_DUPLICATE","Role assignments must be unique.");for(const e of n){const n=await(t?.roles||this.store.roles).get(e);if(!n||"active"!==n.status)throw du("role")}}async assertProviderStatusChangeAllowed(e,t,n){"enabled"!==t&&await this.assertLoginCapableAdminRemains(n||this.store,{providerStatus:{providerId:e,status:t}})}async assertLoginCapableAdminRemains(e,t={}){let n=!1;for(const i of await e.users.list()){if("active"!==(t.userStatus?.userId===i.id?t.userStatus.status:i.status))continue;const s=await e.grants.get(i.id),a=t.roleIds?.userId===i.id?t.roleIds.roleIds:s?.roleIds;if(!0===a?.includes(Gp)&&await this.hasLoginCapableIdentity(i.id,e,t)){n=!0;break}}if(!n)throw cu("CONTROL_PLANE_LAST_ACTIVE_ADMIN","At least one active login-capable Admin must remain.")}async hasLoginCapableIdentity(e,t,n){for(const i of await t.identities.listByUser(e)){if(i.id===n.removedIdentityId)continue;if("local-password"===i.kind)return!0;const e=await t.providers.get(i.providerId||"");if("enabled"===(n.providerStatus?.providerId===e?.id?n.providerStatus.status:e?.status))return!0}return!1}async roleSummaries(){return(await this.store.roles.list()).map(e=>op.parse(e))}}const mu="task_handoff_cp_session",hu=f.z.enum(["disabled","password"]);class gu{mode;users;sessions;identityProviders;external;onUserAuthorizationChanged;constructor(e,t={}){this.mode=hu.parse(t.mode||process.env.TASK_HANDOFF_CONTROL_PLANE_AUTH_MODE||"disabled"),this.users=new uu(e,{database:t.database}),this.sessions=new Cp(this.users,t.loginRateLimit),this.identityProviders=new wp(e,this.users),this.external=new jl(this.users,this.sessions,this.identityProviders),this.onUserAuthorizationChanged=t.onUserAuthorizationChanged}async init(){this.enabled()&&(await this.users.init(),this.identityProviders.init())}close(){return this.users.store.close()}enabled(){return"password"===this.mode}async state(){return this.enabled()?{mode:this.mode,enabled:!0,requiresBootstrap:(await this.users.state()).requiresBootstrap}:{mode:this.mode,enabled:!1,requiresBootstrap:!1}}async bootstrapAdmin(e){return this.assertEnabled(),this.users.bootstrapAdmin(e)}async login(e,t={}){return this.assertEnabled(),this.sessions.loginLocal(e,{sourceId:t.sourceId,clientType:"web"})}async loginMobile(e,t={}){this.assertEnabled();const n=f.z.object({username:f.z.string().trim().min(1).max(80),password:f.z.string().min(1).max(4096),device:f.z.custom()}).strict().parse(e),i=await this.sessions.loginLocal({username:n.username,password:n.password},{sourceId:t.sourceId,clientType:"mobile",device:n.device});return{sessionToken:i.sessionToken,session:{...i.session,device:n.device,user:i.user},authorization:i.authorization}}changePassword(e,t){return this.sessions.changeLocalPassword(e,t)}async currentSession(e,t="web"){const n=this.enabled()?await this.sessions.currentSession(e,t):{authenticated:!0};return{...await this.state(),...n}}async currentAccess(e,t){return(await this.sessions.resolve(e,t))?.authorization}async authorizationForSessionToken(e,t){const n=await this.sessions.resolve(e,t);if(n)return{type:"user",userId:n.authorization.userId,identityId:n.authorization.identityId,roleIds:n.authorization.roleIds,permissionIds:n.authorization.permissionIds,nodeScope:n.authorization.nodeScope,instanceScope:n.authorization.instanceScope,authorizationRevision:n.authorization.authorizationRevision,requiresPasswordChange:n.requiresPasswordChange}}logout(e){return this.sessions.logout(e)}async mobileSessions(e){const t=await this.sessions.resolve(e);return t?this.sessions.listMobileSessions(t.user.id):void 0}async revokeMobileSession(e,t){const n=await this.sessions.resolve(e);return n?this.sessions.revokeSession(n.user.id,t):void 0}async assertAppAccessAuthorization(e){const t=await this.users.authorization(e.userId);if(t.authorizationRevision!==e.authorizationRevision)throw Object.assign(new Error("The app access authorization has changed."),{code:"CONTROL_PLANE_AUTHORIZATION_REVISION_CONFLICT",statusCode:401});ul({...t},"interactive-access",{type:"app-session"},{kind:"instance-derived",instanceId:e.instanceId,nodeId:e.nodeId})}async notifyAuthorizationChanged(e){const[t,n]=await Promise.all([this.users.store.users.get(e),this.users.store.grants.get(e)]);t&&n&&this.onUserAuthorizationChanged?.({userId:e,authorizationRevision:n.authorizationRevision,status:t.status})}assertEnabled(){if(!this.enabled())throw Object.assign(new Error("Control Plane authentication is disabled."),{code:"AUTH_DISABLED",statusCode:400})}}const fu=f.z.enum(["import","export"]),yu=f.z.object({id:f.z.string().trim().min(1).max(120),label:f.z.string().trim().min(1).max(120),directoryName:f.z.string().trim().min(1).max(120)}).strict(),bu=f.z.object({direction:fu,programIds:f.z.array(f.z.string().trim().min(1).max(120)).min(1).max(20).refine(e=>new Set(e).size===e.length,"Config sync program ids must be unique."),workspaceFolder:f.z.string().trim().min(1).max(1e3)}).strict(),vu=f.z.object({import:f.z.string().trim().min(1).max(1e3).default("."),export:f.z.string().trim().min(1).max(1e3).default(".")}).strict(),Iu=f.z.object({programs:f.z.array(yu),preferences:vu}).strict(),xu=f.z.object({id:f.z.string().trim().min(1).max(120),type:f.z.enum(["file","dir"]),projectPath:f.z.string().trim().min(1).max(1e3),containerPath:f.z.string().trim().min(1).max(1e3),source:f.z.string().trim().min(1).max(4096),target:f.z.string().trim().min(1).max(4096),status:f.z.enum(["copied","skipped_missing_source","failed"]),error:f.z.string().trim().max(4096).optional()}).strict(),wu=f.z.object({preset:f.z.object({id:f.z.string().trim().min(1).max(120),label:f.z.string().trim().min(1).max(120),projectRoot:f.z.string().trim().min(1).max(1e3)}).strict(),direction:fu,items:f.z.array(xu).max(100)}).strict(),Su=f.z.object({direction:fu,workspaceFolder:f.z.string().trim().min(1).max(1e3),programs:f.z.array(wu).min(1).max(20)}).strict(),Au="x-task-handoff-trace-id";function Eu(e,t){return`${e};dur=${(Number.isFinite(t)?Math.max(0,t):0).toFixed(1)}`}function _u(...e){return e.map(e=>String(e||"").trim()).filter(Boolean).join(", ")}const Tu=f.z.string().trim().min(1).max(160).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),zu=f.z.string().datetime(),ku=f.z.string().trim().min(1).max(255).refine(e=>!(/[\u0000-\u001f\u007f ~^:?*[\\]/.test(e)||e.includes("..")||e.endsWith(".")||e.endsWith("/")),"Invalid Git name."),Nu=f.z.string().min(1).max(4096).refine(e=>!(e.includes("\0")||e.startsWith("/")||e.startsWith("\\")||/^[a-zA-Z]:[\\/]/.test(e))&&e.split("/").every(e=>e.length>0&&"."!==e&&".."!==e&&".git"!==e),"Path must be a safe repository-relative path."),Cu=f.z.enum(["ai-session","app-session"]),Ru=f.z.enum(["available","session-not-found","session-inactive","cwd-missing","cwd-inaccessible","git-unavailable","not-worktree"]),Ou=f.z.enum(["branch","detached","unborn"]),ju=f.z.enum(["review-changes","resolve-conflicts","publish-branch","push","pull","diverged","up-to-date"]),Pu=f.z.enum(["conflict","staged","unstaged","untracked"]),Du=f.z.enum(["added","modified","deleted","renamed","copied","type-changed","unmerged","untracked"]),Lu=f.z.object({state:Ou,oid:f.z.string().regex(/^[0-9a-f]{40,64}$/).optional(),branch:f.z.string().min(1).max(1024).optional()}).strict(),Mu=f.z.object({ref:f.z.string().min(1).max(2048),remote:ku,branch:f.z.string().min(1).max(1024),ahead:f.z.number().int().nonnegative(),behind:f.z.number().int().nonnegative()}).strict(),qu=f.z.object({id:Tu,isCurrent:f.z.boolean(),isMain:f.z.boolean(),managed:f.z.boolean(),head:Lu,dirty:f.z.boolean(),locked:f.z.boolean(),lockReason:f.z.string().max(1e3).optional(),prunable:f.z.boolean(),activeAiSessionIds:f.z.array(Tu).max(256).default([]),activeAppSessionIds:f.z.array(Tu).max(256).default([])}).strict(),Uu=f.z.enum(["main-worktree","external-worktree","outside-workspace-roots","dirty","locked","prunable","session-occupied","path-inaccessible"]),$u=qu.extend({canCreateAiSession:f.z.boolean(),canRemove:f.z.boolean(),createAiSessionBlockers:f.z.array(Uu).max(16).default([]),removeBlockers:f.z.array(Uu).max(16).default([])}).strict(),Bu=f.z.object({repositoryId:Tu,repositoryContextId:Tu,snapshotId:Tu,items:f.z.array($u).max(1e4)}).strict(),Fu=f.z.object({conflicts:f.z.number().int().nonnegative(),staged:f.z.number().int().nonnegative(),unstaged:f.z.number().int().nonnegative(),untracked:f.z.number().int().nonnegative()}).strict(),Hu=f.z.object({name:ku,fetchUrl:f.z.string().max(4096).optional(),pushUrl:f.z.string().max(4096).optional()}).strict(),Gu=f.z.object({availability:Ru,sessionKind:Cu,sessionId:Tu,observedAt:zu,snapshotId:Tu.optional(),repositoryId:Tu.optional(),repositoryContextId:Tu.optional(),repositoryRoot:f.z.string().min(1).max(4096).optional(),displayName:f.z.string().trim().min(1).max(255).optional(),cwdRelativePath:f.z.string().max(4096).optional(),head:Lu.optional(),upstream:Mu.optional(),currentWorktree:qu.optional(),changes:Fu.optional(),remotes:f.z.array(Hu).max(128).optional(),primaryAction:ju.optional()}).strict(),Wu=f.z.enum(["directory","file","symlink","submodule","nested-repository","special"]),Vu=f.z.object({executable:f.z.boolean(),gitMode:f.z.enum(["100644","100755","120000","160000"]).optional()}).strict(),Ku=f.z.object({name:f.z.string().min(1).max(1024),path:Nu,kind:Wu,traversable:f.z.boolean(),editable:f.z.boolean(),size:f.z.number().int().nonnegative().optional(),mode:Vu.optional()}).strict();f.z.object({path:f.z.string().max(4096),entries:f.z.array(Ku).max(1e4),snapshotId:Tu}).strict();const Yu=f.z.string().min(16).max(160).regex(/^[a-zA-Z0-9_.:-]+$/),Xu=f.z.object({path:Nu,content:f.z.string(),byteLength:f.z.number().int().nonnegative(),version:Yu,mode:Vu}).strict(),Ju=f.z.object({path:Nu,oldPath:Nu.optional(),scope:Pu,status:Du,version:Yu,binary:f.z.boolean().default(!1)}).strict(),Qu=f.z.object({snapshotId:Tu,summary:Fu,entries:f.z.array(Ju).max(1e5)}).strict();f.z.object({file:Xu.optional(),snapshotId:Tu,context:Gu,changes:Qu}).strict();const Zu=f.z.object({kind:f.z.enum(["metadata","hunk","context","addition","deletion"]),content:f.z.string(),oldLine:f.z.number().int().positive().optional(),newLine:f.z.number().int().positive().optional(),oldStart:f.z.number().int().nonnegative().optional(),oldCount:f.z.number().int().nonnegative().optional(),newStart:f.z.number().int().nonnegative().optional(),newCount:f.z.number().int().nonnegative().optional(),heading:f.z.string().optional(),hunkId:f.z.string().min(1).max(200).optional()}).strict();f.z.object({path:Nu,oldPath:Nu.optional(),scope:Pu,binary:f.z.boolean(),complete:f.z.boolean(),truncated:f.z.boolean(),byteLimit:f.z.number().int().positive(),content:f.z.string(),lines:f.z.array(Zu).max(2e5),contextGaps:f.z.array(f.z.object({gapId:f.z.string().min(1).max(500),beforeHunkId:f.z.string().min(1).max(200).optional(),afterHunkId:f.z.string().min(1).max(200).optional(),lines:f.z.array(Zu).max(6e3),startLineCount:f.z.number().int().nonnegative().max(3e3),hasMore:f.z.boolean()}).strict()).max(2e4),version:Yu,snapshotId:Tu}).strict();const em=f.z.object({name:f.z.string().min(1).max(1024),oid:f.z.string().regex(/^[0-9a-f]{40,64}$/),kind:f.z.enum(["local","remote-tracking"]),current:f.z.boolean(),upstream:f.z.string().min(1).max(2048).optional(),ahead:f.z.number().int().nonnegative().optional(),behind:f.z.number().int().nonnegative().optional(),checkedOutWorktreeIds:f.z.array(Tu).max(256).default([])}).strict(),tm=f.z.object({snapshotId:Tu,branches:f.z.array(em).max(1e5)}).strict();f.z.object({snapshotId:Tu,context:Gu,branches:tm}).strict(),f.z.object({ok:f.z.literal(!0),snapshotId:Tu,context:Gu,changes:Qu.optional(),commitOid:f.z.string().regex(/^[0-9a-f]{40,64}$/).optional()}).strict();const nm=f.z.enum(["REPOSITORY_REQUEST_INVALID","REPOSITORY_SESSION_NOT_FOUND","REPOSITORY_SESSION_INACTIVE","REPOSITORY_CWD_MISSING","REPOSITORY_CWD_INACCESSIBLE","REPOSITORY_GIT_UNAVAILABLE","REPOSITORY_NOT_WORKTREE","REPOSITORY_PATH_INVALID","REPOSITORY_PATH_FORBIDDEN","REPOSITORY_FILE_NOT_FOUND","REPOSITORY_FILE_EXISTS","REPOSITORY_FILE_UNSUPPORTED","REPOSITORY_FILE_TOO_LARGE","REPOSITORY_FILE_BINARY","REPOSITORY_FILE_STALE","REPOSITORY_STATE_STALE","REPOSITORY_WORKTREE_NOT_FOUND","REPOSITORY_WORKTREE_OCCUPIED","REPOSITORY_WORKTREE_UNSAFE","REPOSITORY_BRANCH_INVALID","REPOSITORY_BRANCH_OCCUPIED","REPOSITORY_BRANCH_UNMERGED","REPOSITORY_CONFLICT","REPOSITORY_DIRTY","REPOSITORY_NOTHING_TO_COMMIT","REPOSITORY_IDENTITY_MISSING","REPOSITORY_HOOK_FAILED","REPOSITORY_SIGNING_FAILED","REPOSITORY_AUTHENTICATION_FAILED","REPOSITORY_CREDENTIAL_MISSING","REPOSITORY_CREDENTIAL_AMBIGUOUS","REPOSITORY_REMOTE_UNSUPPORTED","REPOSITORY_HOST_KEY_REQUIRED","REPOSITORY_AUTHENTICATION_REJECTED","REPOSITORY_NON_FAST_FORWARD","REPOSITORY_UPSTREAM_MISSING","REPOSITORY_COMMAND_TIMEOUT","REPOSITORY_OUTPUT_LIMIT","REPOSITORY_OPERATION_ABORTED","REPOSITORY_OPERATION_FAILED"]);f.z.object({ok:f.z.literal(!1),error:f.z.object({code:nm,message:f.z.string().trim().min(1).max(2e3),retryable:f.z.boolean(),details:f.z.record(f.z.string(),f.z.union([f.z.string(),f.z.number(),f.z.boolean()])).optional()}).strict()}).strict();const im=f.z.object({expectedSnapshotId:Tu}).strict(),sm=f.z.object({path:Nu,expectedVersion:Yu}).strict();f.z.object({path:Nu,content:f.z.string().max(4194304),expectedAbsent:f.z.literal(!0),expectedSnapshotId:Tu}).strict(),f.z.object({path:Nu,content:f.z.string().max(4194304),expectedVersion:Yu,expectedSnapshotId:Tu}).strict(),f.z.object({path:Nu,destination:Nu,expectedVersion:Yu,expectedDestinationAbsent:f.z.literal(!0),expectedSnapshotId:Tu}).strict(),f.z.object({path:Nu,expectedVersion:Yu,expectedSnapshotId:Tu,confirm:f.z.literal(!0)}).strict(),im.extend({paths:f.z.array(sm).min(1).max(1e3)}).strict(),im.extend({paths:f.z.array(sm).min(1).max(1e3)}).strict(),im.extend({paths:f.z.array(sm).min(1).max(1e3),confirm:f.z.literal(!0)}).strict(),im.extend({paths:f.z.array(sm).min(1).max(1e3),confirm:f.z.literal(!0)}).strict(),im.extend({message:f.z.string().trim().min(1).max(65536)}).strict();const am=f.z.discriminatedUnion("mode",[f.z.object({mode:f.z.literal("new-branch"),branchName:ku,startRef:f.z.string().trim().min(1).max(2048),expectedSnapshotId:Tu}).strict(),f.z.object({mode:f.z.literal("existing-branch"),branchName:ku,expectedSnapshotId:Tu}).strict()]);im.extend({worktreeId:Tu,confirm:f.z.literal(!0)}).strict(),f.z.object({worktreeId:Tu,worktrees:Bu}).strict(),f.z.object({removedWorktreeId:Tu,branchRetained:f.z.boolean(),worktrees:Bu}).strict();const om=f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal("current")}).strict(),f.z.object({type:f.z.literal("worktree"),repositoryContextId:Tu,worktreeId:Tu}).strict()]);f.z.object({agent:f.z.enum(["codex","claude","opencode"]),workspaceSelection:om,message:f.z.string().trim().min(1).max(2e4),clientRequestId:Tu,permissionMode:f.z.enum(["ask","auto-review","full-access"]).optional()}).strict(),f.z.object({agent:f.z.enum(["codex","claude","opencode"]),worktree:am,message:f.z.string().trim().min(1).max(2e4),clientRequestId:Tu,permissionMode:f.z.enum(["ask","auto-review","full-access"]).optional()}).strict(),f.z.object({aiSessionId:Tu,providerSessionId:f.z.string().trim().min(1).max(240),worktreeId:Tu,disposition:f.z.literal("started")}).strict();const rm=f.z.object({name:f.z.string().min(1).max(1024),kind:f.z.enum(["branch","head"]).default("branch"),current:f.z.boolean(),currentFolderSelectable:f.z.boolean(),worktreeSelectable:f.z.boolean(),worktreeCheckout:f.z.enum(["attached","detached"]).default("attached"),currentFolderReason:f.z.enum(["dirty","session-occupied","branch-occupied"]).optional(),worktreeReason:f.z.enum(["current-branch","branch-occupied","worktree-unavailable"]).optional()}).strict(),cm=f.z.object({availability:Ru,currentBranch:f.z.string().min(1).max(1024).optional(),dirty:f.z.boolean().default(!1),branches:f.z.array(rm).max(1e5).default([])}).strict();f.z.object({cwd:Ei}).strict();const dm=ki;function lm(e){return{id:e.id,providerTurnId:e.providerTurnId,status:e.status,phase:e.phase,revision:e.revision,startedAt:e.startedAt,updatedAt:e.updatedAt,completedAt:e.completedAt,bodyRevision:pm(e)}}function pm(e){return i.createHash("sha256").update(JSON.stringify(e)).digest("base64url").slice(0,22)}zi.extend({gitSelection:dm}).strict(),Ni.extend({cwd:Ei,gitSelection:dm}).strict(),im.extend({name:ku}).strict(),im.extend({branch:f.z.string().trim().min(1).max(2048)}).strict(),im.extend({name:ku,remoteTrackingRef:f.z.string().trim().min(1).max(2048)}).strict(),im.extend({name:ku,confirm:f.z.literal(!0)}).strict(),im.extend({remote:ku}).strict(),im.extend({remote:ku,sourceBranch:ku,targetBranch:ku,setUpstream:f.z.boolean(),confirmSetUpstream:f.z.boolean().optional()}).strict().refine(e=>!e.setUpstream||!0===e.confirmSetUpstream,{message:"Setting an upstream requires explicit confirmation.",path:["confirmSetUpstream"]}),im.extend({remote:ku,sourceBranch:ku,targetBranch:ku}).strict();class um{options;resumeSnapshotRefreshFailures=0;lastResumeSnapshotRefreshFailure;constructor(e){this.options=e}async resolveApproval(e,t,n){return Dl(ps,await this.post(e,gm(t,"approval"),{decision:n}))}async listHistory(e,t){const n=t?.length?`?agents=${encodeURIComponent(t.join(","))}`:"";return Dl(hs,await this.get(e,`/ai-sessions/history${n}`))}async historyDetail(e,t){return Dl(gs,await this.get(e,`/ai-sessions/history/${encodeURIComponent(t)}`))}async detail(e,t,n){const i=n?`?revision=${encodeURIComponent(n)}`:"",s=await this.get(e,`/ai-sessions/${encodeURIComponent(t)}${i}`),a=as.safeParse(s);if(a.success)return a.data;const o=Dl(Qi,s),r=`legacy:${o.updatedAt}`;return as.parse({kind:n===r?"not-modified":"updated",revision:r,...n===r?{}:{detail:(c=o,Zi.parse({id:c.id,appBindingKeys:c.appBindingKeys,cwd:c.cwd,error:c.error,providerMeta:c.providerMeta,queue:c.queue,subAgents:c.subAgents}))}});var c}async turnIndex(e,t,n){const i=new URLSearchParams({projection:"index"});n&&i.set("revision",n);try{return Dl(os,await this.get(e,`${gm(t,"turns")}?${i}`))}catch(i){if(!fm(i))throw i;const s=await this.legacyStatus(e,t),a=`legacy:${s.updatedAt}`;if(n===a)return os.parse({kind:"not-modified",revision:a});const o=ts.parse({sessionId:s.id,revision:a,turns:(s.turns||[]).filter(e=>e.userPrompt?.trim()||e.lastMessage?.trim()||e.summary?.trim()||e.contextCompactions?.length).map(lm)});return os.parse({kind:"updated",revision:a,index:o})}}async turnBody(e,t,n,i){const s=i?`?revision=${encodeURIComponent(i)}`:"";try{return Dl(rs,await this.get(e,`${gm(t,"turns")}/${encodeURIComponent(n)}${s}`))}catch(s){if(!fm(s))throw s;const a=await this.legacyStatus(e,t),o=(a.turns||[]).find(e=>e.id===n||e.providerTurnId===n);if(!o)throw new Error(`AI session Turn ${n} was not found.`);const r=pm(o);if(i===r)return rs.parse({kind:"not-modified",revision:r});const c=ns.parse({sessionId:a.id,revision:r,turn:o});return rs.parse({kind:"updated",revision:r,body:c})}}async legacyStatus(e,t){return Dl(Qi,await this.get(e,`/ai-sessions/${encodeURIComponent(t)}`))}async timeline(e,t){const n=await this.options.requireInstance(e);if(!function(e){return Jo(e.capabilities,"session-read").length>0}(n))throw function(){const e=new Error("The controlled instance does not support AI session Timeline reads.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_TIMELINE_UNSUPPORTED"}),e}();return Dl(Jn,await this.options.request(n,gm(t,"timeline"),{method:"GET"}))}async turnTimeline(e,t,n){const i=await this.options.requireInstance(e);if(!function(e){return Jo(e.capabilities,"turn-read").length>0}(i))throw function(){const e=new Error("The controlled instance does not support per-turn AI session Timeline reads.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_TURN_TIMELINE_UNSUPPORTED"}),e}();return Dl(Qn,await this.options.request(i,`${gm(t,"turns")}/${encodeURIComponent(n)}/timeline`,{method:"GET"}))}async resume(e,t){return Dl(fs,await this.post(e,gm(t,"resume"),{}))}async create(e,t){bm((t.attachments||[]).filter(e=>"upload-ref"!==e.source.type));const n=await this.options.requireInstance(e);if(t.modelSelection&&!Lo(Xo(n.capabilities,t.agent)).selectModelAtCreate)throw Object.assign(new Error(`${t.agent} does not support selecting a model at creation.`),{statusCode:409,code:"AI_SESSION_MODEL_SELECTION_UNSUPPORTED"});if(t.reasoningEffort&&!Mo(Xo(n.capabilities,t.agent)).selectAtCreate)throw Object.assign(new Error(`${t.agent} does not support selecting reasoning effort at creation.`),{statusCode:409,code:"AI_SESSION_REASONING_EFFORT_UNSUPPORTED"});const i=mm(n);if(t.gitSelection&&!i)throw hm();const s=t.permissionMode||("codex"===t.agent?n.config.defaultCodexPermissionMode:void 0),a=t.gitSelection?"/repository/ai-session-workspace/create":"/ai-sessions",{cwdFolderId:o,...r}=t;return Dl(Pi,await this.options.request(n,a,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({...r,...i&&o?{cwdFolderId:o}:{},...s?{permissionMode:s}:{}})}))}async inspectWorkspace(e,t){const n=await this.options.requireInstance(e);if(!mm(n))throw hm();return Dl(cm,await this.options.request(n,"/repository/ai-session-workspace/inspect",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({cwd:t})}))}async fork(e,t,n){return Dl(Mi,await this.post(e,gm(t,"fork"),n))}async updateModelSelection(e,t,n,i){const s=await this.options.requireInstance(e),a=s.aiSessions.sessions.find(e=>e.id===t);if(!a)throw Object.assign(new Error("AI Session was not found."),{statusCode:404,code:"AI_SESSION_NOT_FOUND"});const o=Lo(Xo(s.capabilities,a.agent)),r=Boolean(a.modelSelection&&a.modelSelection.modelEntityId!==i.modelEntityId);if(r?!o.switchProviderDuringSession:!o.switchModelWithinProvider){const e=r&&"codex"===a.agent?"AI_SESSION_PROVIDER_SWITCH_REQUIRES_NEW_SESSION":"AI_SESSION_MODEL_SELECTION_UNSUPPORTED";throw Object.assign(new Error(r&&"codex"===a.agent?"Codex provider changes require a new session.":`${a.agent} does not support this model change.`),{statusCode:409,code:e})}return Dl(Ri,await this.options.request(s,gm(t,"model-selection"),{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify({clientRequestId:n,modelSelection:i})}))}async updateReasoningEffort(e,t,n,i){const s=await this.options.requireInstance(e),a=s.aiSessions.sessions.find(e=>e.id===t);if(!a)throw Object.assign(new Error("AI Session was not found."),{statusCode:404,code:"AI_SESSION_NOT_FOUND"});if(!Mo(Xo(s.capabilities,a.agent)).updateDuringSession)throw Object.assign(new Error(`${a.agent} does not support reasoning effort changes.`),{statusCode:409,code:"AI_SESSION_REASONING_EFFORT_UNSUPPORTED"});return Dl(ji,await this.options.request(s,gm(t,"reasoning-effort"),{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify({clientRequestId:n,reasoningEffort:i})}))}async openApp(e,t,n){return Dl(Ui,await this.post(e,gm(t,"open-app"),{clientRequestId:n}))}async close(e,t,n){return Dl(Bi,await this.post(e,gm(t,"close"),{clientRequestId:n}))}diagnostics(){return{resumeSnapshotRefreshFailures:this.resumeSnapshotRefreshFailures,lastResumeSnapshotRefreshFailure:this.lastResumeSnapshotRefreshFailure}}async sendMessage(e,t,n,i,s=[],a=[],o,r){const c=s.filter(e=>"upload-ref"!==e.source.type);bm(c);const d=await this.options.requireInstance(e);s.some(e=>"runtime-path"===e.source.type)&&function(e,t){if(!e.some(e=>"runtime-path"===e.source.type)||"local"===t)return;const n=new Error("Runtime path attachments are currently available only for Local Runtime instances.");throw Object.assign(n,{statusCode:400,code:"AI_SESSION_RUNTIME_PATH_UNSUPPORTED"}),n}(c,(await this.options.requireRuntime(d.nodeId,d.runtimeId)).type);const l=d.aiSessions.sessions.find(e=>e.id===t),p=o||("codex"===l?.agent?d.config.defaultCodexPermissionMode:void 0);return Dl(ps,await this.options.request(d,gm(t,"messages"),{method:"POST",headers:{"content-type":"application/json",...r?.traceId?{[Au]:r.traceId}:{}},body:JSON.stringify({message:n,...i?{mode:i}:{},...s.length?{attachments:s}:{},...a.length?{references:a}:{},...p?{permissionMode:p}:{}})},r?.onTiming))}async mentionCatalog(e,t){return Dl(vi,await this.get(e,gm(t,"mentions")))}async searchMentionFiles(e,t,n){return Dl(xi,await this.post(e,gm(t,"mentions/files"),{query:n}))}async executeCommand(e,t,n){return Dl(ui,await this.post(e,gm(t,"commands"),n))}async queue(e,t){return Dl(Vi,await this.get(e,gm(t,"queue")))}async steerQueuedMessage(e,t,n){return Dl(ps,await this.post(e,ym(t,n,"steer"),{}))}async retryQueuedMessage(e,t,n){return Dl(ls,await this.post(e,ym(t,n,"retry"),{}))}async removeQueuedMessage(e,t,n){const i=await this.options.requireInstance(e);return Dl(ls,await this.options.request(i,ym(t,n),{method:"DELETE"}))}async editQueuedMessage(e,t,n,i){const s=Gi.parse(i);return Dl(ls,await this.patch(e,ym(t,n),s))}async reorderQueuedMessages(e,t,n){const i=Hi.parse(n);return Dl(ls,await this.patch(e,gm(t,"queue/reorder"),i))}async interrupt(e,t){return Dl(ps,await this.post(e,gm(t,"interrupt"),{}))}async get(e,t){return this.options.request(await this.options.requireInstance(e),t)}async post(e,t,n){return this.options.request(await this.options.requireInstance(e),t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async patch(e,t,n){return this.options.request(await this.options.requireInstance(e),t,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}}function mm(e){return Ko(e.capabilities).features.aiSessionWorkspaceSelection}function hm(){const e=new Error("The controlled instance does not support AI session workspace selection.");return Object.assign(e,{statusCode:409,code:"AI_SESSION_WORKSPACE_SELECTION_UNSUPPORTED"}),e}function gm(e,t){return`/ai-sessions/${encodeURIComponent(e)}/${t}`}function fm(e){if(e instanceof f.z.ZodError)return!0;if(!e||"object"!=typeof e)return!1;const t=e;return 404===(t.statusCode??t.status)&&"AI_SESSION_NOT_FOUND"!==t.code&&"AI_SESSION_TURN_NOT_FOUND"!==t.code}function ym(e,t,n){return`${gm(e,"queue")}/${encodeURIComponent(t)}${n?`/${n}`:""}`}function bm(e){if(e.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)<=bn)return;const t=new Error("Inline attachments must be 41943040 bytes or less in total.");throw Object.assign(t,{statusCode:400,code:"AI_SESSION_ATTACHMENTS_TOO_LARGE"}),t}class vm{requestImpl;logger;constructor(e){this.requestImpl=e.request,this.logger=e.logger}async request(e,t,n={}){const i=n.method||"GET";let s,a;try{s=await this.requestImpl(e,t,n)}catch(n){throw this.logger?.warn?.({nodeId:e.id,route:t,method:i,error:n instanceof Error?n.message:String(n),errorCode:"NODE_AGENT_TRANSPORT_FAILED"},"node agent transport failed"),n}try{a=await s.json()}catch(n){this.logger?.warn?.({nodeId:e.id,route:t,method:i,statusCode:s.status,error:n instanceof Error?n.message:String(n),errorCode:"NODE_AGENT_RESPONSE_INVALID_JSON"},"node agent response was not valid json");const a=new Error(`Node agent ${e.id} returned invalid JSON for ${t}.`);throw Object.assign(a,{statusCode:502,code:"NODE_AGENT_RESPONSE_INVALID_JSON",nodeId:e.id,route:t}),a}if(!s.ok){const n=new Error(a.error?.message||`Node agent request failed with HTTP ${s.status}`);throw Object.assign(n,{statusCode:s.status,code:a.error?.code||"NODE_AGENT_REQUEST_FAILED",nodeId:e.id,route:t}),this.logger?.warn?.({nodeId:e.id,route:t,method:i,statusCode:s.status,errorCode:a.error?.code||"NODE_AGENT_REQUEST_FAILED",error:n.message},"node agent request failed"),n}return this.logger?.info?.({nodeId:e.id,route:t,method:i,statusCode:s.status},"node agent request ok"),a.data??a}async requestSchema(e,t,n,i={}){return this.parse(e,t,n,await this.request(e,t,i),i.method||"GET")}parse(e,t,n,i,s="GET"){const a=Pl(n,i);if(a.success)return a.data;this.logger?.warn?.({nodeId:e.id,route:t,method:s,errorCode:"NODE_AGENT_PROTOCOL_INVALID",issues:a.error.issues},"node agent protocol response did not match schema");const o=new Error(`Node agent ${e.id} returned invalid protocol data for ${t}.`);throw Object.assign(o,{statusCode:502,code:"NODE_AGENT_PROTOCOL_INVALID",nodeId:e.id,route:t,issues:a.error.issues}),o}}const Im=f.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),xm=f.z.string().datetime(),wm=f.z.number().int().nonnegative(),Sm=f.z.enum(["https-token","ssh-key"]),Am=f.z.enum(["operation-only","instance-retained"]),Em=f.z.enum(["enabled","disabled"]),_m=f.z.enum(["pending","synced","deferred","revoking","revoked"]),Tm=f.z.object({scheme:f.z.enum(["https","ssh"]),host:f.z.string().trim().min(1).max(253),port:f.z.number().int().min(1).max(65535).optional(),pathPrefix:f.z.string().min(1).max(2048).default("/")}).strict();function zm(e){throw new Error(`Invalid Git credential scope: ${e}`)}function km(e){const t=e.trim().replace(/^\[|\]$/g,"");(!t||t.includes("*")||/[/?#@\s]/.test(t))&&zm("host is invalid");try{const e=new URL(t.includes(":")?`http://[${t}]/`:`http://${t}/`).hostname.replace(/^\[|\]$/g,"").toLowerCase();return(!e||e.length>253||e.includes("*"))&&zm("host is invalid"),e}catch{zm("host is invalid")}}function Nm(e){try{return decodeURIComponent(e)}catch{zm("path contains invalid percent encoding")}}function Cm(e){const t=e?.trim()||"/";(t.includes("?")||t.includes("#")||t.includes("\\")||t.includes("\0"))&&zm("path contains an unsupported delimiter");const n=(t.startsWith("/")?t:`/${t}`).split("/").filter(Boolean);for(const e of n){const t=Nm(e);("."===t||".."===t||t.includes("/")||t.includes("\\")||t.includes("\0"))&&zm("path contains an unsafe segment")}return 0===n.length?"/":`/${n.join("/")}/`}function Rm(e){const t=Tm.parse(e),n="https"===t.scheme?443:22;return Tm.parse({scheme:t.scheme,host:km(t.host),...void 0===t.port||t.port===n?{}:{port:t.port},pathPrefix:Cm(t.pathPrefix)})}function Om(e){return Cm(e.replace(/\.git\/?$/,""))}const jm=f.z.object({id:Im,name:f.z.string().trim().min(1).max(160),kind:Sm,scope:Tm,secretSet:f.z.literal(!0),status:Em,revision:wm,createdAt:xm,updatedAt:xm}).strict(),Pm=f.z.object({kind:f.z.literal("https-token"),username:f.z.string().trim().min(1).max(240),token:f.z.string().min(1).max(8192)}).strict(),Dm=f.z.object({kind:f.z.literal("ssh-key"),privateKey:f.z.string().min(1).max(131072),passphrase:f.z.string().max(8192).optional(),pinnedKnownHosts:f.z.string().min(1).max(131072)}).strict(),Lm=f.z.discriminatedUnion("kind",[Pm,Dm]),Mm=f.z.object({name:f.z.string().trim().min(1).max(160),scope:Tm,secret:Lm}).strict().superRefine((e,t)=>{"https"===e.scope.scheme!=("https-token"===e.secret.kind)&&t.addIssue({code:"custom",path:["scope","scheme"],message:"Credential kind must match the remote scheme."});try{Rm(e.scope)}catch(e){t.addIssue({code:"custom",path:["scope"],message:e instanceof Error?e.message:"Invalid Git scope."})}}),qm=f.z.object({name:f.z.string().trim().min(1).max(160).optional(),scope:Tm.optional(),secret:Lm.optional(),status:Em.optional()}).strict().refine(e=>Object.keys(e).length>0,"At least one credential field must be updated.");f.z.object({items:f.z.array(jm).max(1e4)}).strict();const Um=f.z.object({instanceId:Im,credentialId:Im,credentialRevision:wm,assignmentRevision:wm,status:_m,authorizedAt:xm,updatedAt:xm}).strict(),$m=f.z.object({credential:jm,secret:Lm}).strict().superRefine((e,t)=>{e.credential.kind!==e.secret.kind&&t.addIssue({code:"custom",path:["secret","kind"],message:"Credential payload kind mismatch."})}),Bm=f.z.object({instanceId:Im,generation:wm,credentialIds:f.z.array(Im).max(256).transform(e=>[...new Set(e)].sort()),updatedAt:xm}).strict();f.z.object({remoteUrl:f.z.string().trim().min(1).max(4096)}).strict(),f.z.discriminatedUnion("status",[f.z.object({status:f.z.literal("ok"),username:f.z.string().min(1).max(240),password:f.z.string().min(1).max(8192)}).strict(),f.z.object({status:f.z.enum(["none","ambiguous","unsupported","missing-host-key","rejected"])}).strict()]),f.z.object({remoteUrl:f.z.string().trim().min(1).max(4096)}).strict(),f.z.discriminatedUnion("status",[f.z.object({status:f.z.literal("ok"),invocationId:Im,publicIdentity:f.z.string().min(1).max(131072),pinnedKnownHosts:f.z.string().min(1).max(131072)}).strict(),f.z.object({status:f.z.enum(["none","ambiguous","unsupported","missing-host-key","rejected"])}).strict()]),f.z.object({invocationId:Im,frame:f.z.string().min(1).max(1048576)}).strict(),f.z.object({frame:f.z.string().min(1).max(1048576)}).strict();const Fm=f.z.object({operationId:Im,retention:Am,payload:$m}).strict(),Hm=f.z.object({operationId:Im,instanceId:Im,remoteUrl:f.z.string().trim().min(1).max(4096),ref:f.z.discriminatedUnion("type",[f.z.object({type:f.z.enum(["branch","tag"]),name:f.z.string().trim().min(1).max(240)}).strict(),f.z.object({type:f.z.literal("commit"),commit:f.z.string().trim().regex(/^[0-9a-fA-F]{4,64}$/,"commit must be a hexadecimal Git object id")}).strict()]),clone:f.z.object({depth:f.z.number().int().positive().max(1e5).optional(),submodules:f.z.boolean().default(!1),lfs:f.z.boolean().default(!1),subdirectory:f.z.string().trim().max(240).refine(e=>!e.startsWith("/")&&!e.split("/").some(e=>".."===e),"subdirectory must be a relative path within the repository").transform(e=>e.split("/").filter(e=>e&&"."!==e).join("/")).default("")}).strict(),credentials:f.z.array(Fm).max(256).default([])}).strict();function Gm(e,t){let n;try{n=function(e){const t=e.trim();if(t&&!t.includes("\0")||zm("remote is empty or invalid"),/^https?:\/\//i.test(t)||/^ssh:\/\//i.test(t)){let e;Cm(t.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]+/i,"").split(/[?#]/,1)[0]||"/");try{e=new URL(t)}catch{zm("remote URL is invalid")}"https:"!==e.protocol&&"ssh:"!==e.protocol&&zm("remote scheme is unsupported"),(e.password||"https:"===e.protocol&&e.username)&&zm("HTTPS userinfo is forbidden"),(e.search||e.hash)&&zm("query and fragment are forbidden");const n="https:"===e.protocol?"https":"ssh",i=e.port?Number(e.port):void 0;return{...Rm({scheme:n,host:e.hostname,port:i,pathPrefix:Om(e.pathname)}),original:t}}/^[a-z][a-z0-9+.-]*:\/\//i.test(t)&&zm("remote scheme is unsupported");const n=/^(?:([^@/:\s]+)@)?([^/:\s]+):(.+)$/.exec(t);n||zm("remote must use HTTPS, ssh://, or scp-like SSH syntax");const[,,i,s]=n;return(s.includes("?")||s.includes("#"))&&zm("query and fragment are forbidden"),{...Rm({scheme:"ssh",host:i,pathPrefix:Om(s)}),original:t}}(e)}catch(e){return{status:"unsupported",reason:e instanceof Error?e.message:"Unsupported Git remote."}}const i=t.filter(e=>"enabled"===e.status).filter(e=>"https"===n.scheme==("https-token"===e.kind)).filter(e=>function(e,t){const n=Rm(e);return n.scheme===t.scheme&&n.host===t.host&&n.port===t.port&&("/"===n.pathPrefix||t.pathPrefix.startsWith(n.pathPrefix))}(e.scope,n)).map(e=>({candidate:e,specificity:Rm(e.scope).pathPrefix.length}));if(0===i.length)return{status:"none",remote:n};const s=Math.max(...i.map(e=>e.specificity)),a=i.filter(e=>e.specificity===s).map(e=>e.candidate);if(a.length>1)return{status:"ambiguous",remote:n,credentialIds:a.map(e=>e.id).sort()};const o=a[0];return"ssh-key"===o.kind&&!0!==o.pinnedKnownHosts?{status:"missing-host-key",remote:n,credentialId:o.id}:{status:"unique",remote:n,credential:o}}class Wm{client;fleetRequestTimeoutMs;fleetSnapshotFreshMs;fleetRetryBaseMs;fleetRetryMaxMs;onFleetStateChanged;runtimeSnapshots=new Map;instanceSnapshots=new Map;modelSnapshots=new Map;fleetRefreshes=new Map;fleetRevisions=new Map;fleetRetryAttempts=new Map;fleetRetryTimers=new Map;disposed=!1;constructor(e,t={}){this.client=e,this.fleetRequestTimeoutMs=Number.isFinite(t.fleetRequestTimeoutMs)&&Number(t.fleetRequestTimeoutMs)>0?Number(t.fleetRequestTimeoutMs):2e3,this.fleetSnapshotFreshMs=Number.isFinite(t.fleetSnapshotFreshMs)&&Number(t.fleetSnapshotFreshMs)>=0?Number(t.fleetSnapshotFreshMs):15e3,this.fleetRetryBaseMs=Number.isFinite(t.fleetRetryBaseMs)&&Number(t.fleetRetryBaseMs)>0?Number(t.fleetRetryBaseMs):1e3,this.fleetRetryMaxMs=Number.isFinite(t.fleetRetryMaxMs)&&Number(t.fleetRetryMaxMs)>=this.fleetRetryBaseMs?Number(t.fleetRetryMaxMs):Math.max(3e4,this.fleetRetryBaseMs),this.onFleetStateChanged=t.onFleetStateChanged}request(e,t,n={}){return this.client.request(e,t,n)}forgetNode(e){this.runtimeSnapshots.delete(e),this.instanceSnapshots.delete(e),this.modelSnapshots.delete(e);for(const t of["runtimes","instances","models"])this.resetFleetRetry(`${t}:${e}`)}dispose(){this.disposed=!0;for(const e of this.fleetRetryTimers.values())clearTimeout(e);this.fleetRetryTimers.clear(),this.fleetRetryAttempts.clear()}health(e){return this.client.requestSchema(e,"/health",ud)}checkUpdate(e,t){return this.client.requestSchema(e,"/updates/check",tc,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}applyUpdate(e,t){return this.client.requestSchema(e,"/updates/apply",nc,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}listUpdateJobs(e){return this.client.requestSchema(e,"/updates/jobs",f.z.array(nc))}getExternalListener(e){return this.client.requestSchema(e,"/settings/external-listener",md)}updateExternalListener(e,t){return this.client.requestSchema(e,"/settings/external-listener",md,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}deployGitCredential(e,t){return this.client.requestSchema(e,`/git-credentials/${encodeURIComponent(t.credential.id)}`,jm,{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}removeGitCredential(e,t){return this.client.requestSchema(e,`/git-credentials/${encodeURIComponent(t)}`,f.z.object({deleted:f.z.boolean()}).strip(),{method:"DELETE"})}replaceGitCredentialAuthorizations(e,t){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t.instanceId)}/git-credential-authorizations`,Bm,{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}createPairingInvite(e,t={}){return this.client.requestSchema(e,"/pairing/invites",hd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t&&"object"==typeof t?t:{})})}createControlPlaneConnection(e,t){return this.client.requestSchema(e,"/control-plane-connections",vd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}listControlPlanePairings(e){return this.client.requestSchema(e,"/control-plane-pairings",f.z.array(fd))}deleteControlPlanePairing(e,t){return this.client.requestSchema(e,`/control-plane-pairings/${encodeURIComponent(t)}`,Id,{method:"DELETE"})}listControlPlaneConnections(e){return this.client.requestSchema(e,"/control-plane-connections",f.z.array(bd))}deleteControlPlaneConnection(e,t){return this.client.requestSchema(e,`/control-plane-connections/${encodeURIComponent(t)}`,Id,{method:"DELETE"})}listDockerImages(e){return this.client.requestSchema(e,"/docker/images",f.z.array(xd))}listFolderTree(e,t={}){const n=new URLSearchParams;t.path&&n.set("path",t.path),void 0!==t.depth&&n.set("depth",String(t.depth));const i=n.toString();return this.client.requestSchema(e,"/folders/tree"+(i?`?${i}`:""),f.z.array(Sd))}listFolderPlaces(e){return this.client.requestSchema(e,"/folders/places",f.z.array(Ad))}listLocalFolders(e,t={}){return this.client.requestSchema(e,"/local-folders",f.z.array(dc),t)}createLocalFolder(e,t){return this.client.requestSchema(e,"/local-folders",dc,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}updateLocalFolder(e,t,n){return this.client.requestSchema(e,`/local-folders/${encodeURIComponent(t)}`,dc,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async requireLocalFolder(e,t){const n=(await this.listLocalFolders(e)).find(e=>e.id===t);if(!n){const n=new Error(`Local folder ${t} was not found on node ${e.id}.`);throw Object.assign(n,{statusCode:404,code:"NODE_LOCAL_FOLDER_NOT_FOUND",nodeId:e.id,route:"/local-folders"}),n}return n}listRuntimes(e,t={}){return this.client.requestSchema(e,"/runtimes",f.z.array(nd),t)}async createRuntime(e,t){const n=await this.client.requestSchema(e,"/runtimes",nd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.upsertRuntimeSnapshot(e,n),n}async updateRuntime(e,t,n){const i=`/runtimes/${encodeURIComponent(t)}`,s=await this.client.requestSchema(e,i,nd,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertRuntimeSnapshot(e,s),s}async checkRuntime(e,t){const n=`/runtimes/${encodeURIComponent(t)}/check`,i=await this.client.requestSchema(e,n,nd,{method:"POST"});return this.upsertRuntimeSnapshot(e,i),i}async deleteRuntime(e,t){const n=await this.client.requestSchema(e,`/runtimes/${encodeURIComponent(t)}`,Id,{method:"DELETE"});return this.removeRuntimeSnapshot(e,t),n}deleteLocalFolder(e,t){return this.client.requestSchema(e,`/local-folders/${encodeURIComponent(t)}`,Id,{method:"DELETE"})}listModels(e,t={}){return this.client.requestSchema(e,"/models",f.z.array(vc),t)}async createModel(e,t){const n=await this.client.requestSchema(e,"/models",vc,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.invalidateFleetResource(e,"models"),n}async deployModel(e,t,n){const i=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}/deploy`,vc,{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.invalidateFleetResource(e,"models"),i}async updateModel(e,t,n){const i=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}`,vc,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.invalidateFleetResource(e,"models"),i}async deleteModel(e,t){const n=await this.client.requestSchema(e,`/models/${encodeURIComponent(t)}`,Id,{method:"DELETE"});return this.invalidateFleetResource(e,"models"),n}discoverModels(e,t){return this.client.requestSchema(e,"/models/discover",f.z.object({models:f.z.array(f.z.object({id:f.z.string(),ownedBy:f.z.string().optional()}).strict()),latencyMs:f.z.number().nonnegative()}).strict(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}testModel(e,t){return this.client.requestSchema(e,"/models/test",f.z.object({success:f.z.literal(!0),latencyMs:f.z.number().nonnegative()}).strict(),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)})}async assignInstanceModels(e,t,n){const i=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/model-assignment`,f.z.object({assignment:Ic,instance:Nd}).strict(),{method:"PUT",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,i.instance),i}async listFleetModels(e,t={}){return await this.refreshFleetModels(e,t,!0),this.readFleetModels(e)}async listFleetRuntimes(e,t={}){return await this.refreshFleetRuntimes(e,t,!0),this.readFleetRuntimes(e)}readFleetModels(e){const t=this.readFleetSnapshots(e,"models",this.modelSnapshots);return{...t,items:t.items.map(({nodeId:e,item:t})=>({nodeId:e,model:t}))}}readFleetRuntimes(e){const t=this.readFleetSnapshots(e,"runtimes",this.runtimeSnapshots);return{...t,items:t.items.map(({item:e})=>e)}}readFleetInstances(e){const t=this.readFleetSnapshots(e,"instances",this.instanceSnapshots);return{...t,items:t.items.map(({item:e})=>e)}}refreshFleetModels(e,t={},n=!1){return this.refreshFleetSnapshots(e,"models","/models",t,this.modelSnapshots,async(e,t)=>({items:await this.listModels(e,t),nodeErrors:[]}),n)}refreshFleetRuntimes(e,t={},n=!1){return this.refreshFleetSnapshots(e,"runtimes","/runtimes",t,this.runtimeSnapshots,async(e,t)=>({items:await this.listRuntimes(e,t),nodeErrors:[]}),n)}refreshFleetInstances(e,t={},n=!1){return this.refreshFleetSnapshots(e,"instances","/instances",t,this.instanceSnapshots,(e,t)=>this.loadInstancesWithDiagnostics(e,t),n)}listInstances(e,t={}){return this.listInstancesWithDiagnostics(e,t).then(e=>e.items)}async listInstancesWithDiagnostics(e,t={}){const n=await this.loadInstancesWithDiagnostics(e,t);return this.setTargetedSnapshot(e,"instances",this.instanceSnapshots,n),n}async loadInstancesWithDiagnostics(e,t={}){return this.client.requestSchema(e,"/instances",f.z.array(f.z.unknown()),t).then(t=>t.reduce((t,n)=>{const i=this.normalizeInstance(e,n);return i.instance&&t.items.push(i.instance),i.error&&t.nodeErrors.push(i.error),t},{items:[],nodeErrors:[]}))}instanceFromSnapshot(e,t){for(const n of e){const e=this.instanceSnapshots.get(n.id);if(!e||e.connectionKey!==this.fleetConnectionKey(n))continue;const i=e.items.find(e=>e.id===t);if(i)return i}}applyInstanceLifecycle(e,t){const n=this.instanceSnapshots.get(e.id);if(!n||n.connectionKey!==this.fleetConnectionKey(e))return"missing";const i=n.items.findIndex(e=>e.id===t.instanceId);if(i<0)return"missing";const s=n.items[i];if(s.nodeId!==e.id)return"missing";if(s.stateRevision>=t.revision)return"ignored";const a=Nd.parse({...s,stateRevision:t.revision,updatedAt:t.updatedAt,status:t.status,health:t.health,connectionStatus:t.connectionStatus,uiAccessStatus:t.accessStatus,imageProvisioning:t.imageProvisioning,workspace:t.workspace,runtime:t.runtime,runtimeVersion:t.runtimeVersion,ready:t.ready,lastHeartbeatAt:t.lastHeartbeatAt});return n.items=n.items.map((e,t)=>t===i?a:e),"applied"}async createInstance(e,t){const n=await this.client.requestSchema(e,"/instances",Nd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)});return this.upsertInstanceSnapshot(e,n),n}async updateInstance(e,t,n){const i=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}`,Nd,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,i),i}async deleteInstance(e,t,n){const i=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/delete`,wr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.removeInstanceSnapshot(e,t),i}listEnvironmentTemplates(e,t={}){return this.client.requestSchema(e,"/environment-templates",f.z.array(kr),t)}getEnvironmentTemplate(e,t,n={}){return this.client.requestSchema(e,`/environment-templates/${encodeURIComponent(t)}`,kr,n)}createEnvironmentTemplate(e,t,n){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/environment-templates`,kr,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}deleteEnvironmentTemplate(e,t){return this.client.requestSchema(e,`/environment-templates/${encodeURIComponent(t)}`,f.z.object({deleted:f.z.boolean(),templateId:kr.shape.id}).strict(),{method:"DELETE"})}async startInstance(e,t,n={}){const i=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/start`,Rd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,i.instance),i}async retryInstanceImageProvisioning(e,t){const n=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/image-provisioning/retry`,Nd,{method:"POST"});return this.upsertInstanceSnapshot(e,n),n}async stopInstance(e,t){const n=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/stop`,Nd,{method:"POST"});return this.upsertInstanceSnapshot(e,n),n}async restartInstance(e,t,n={}){const i=await this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/restart`,Rd,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)});return this.upsertInstanceSnapshot(e,i.instance),i}instanceResourceMetrics(e,t){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/metrics`,id)}proxyRawInstance(e,t,n){return this.client.requestSchema(e,`/instances/${encodeURIComponent(t)}/proxy/raw`,Ed,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)})}async listFleetInstances(e,t={}){return await this.refreshFleetInstances(e,t,!0),this.readFleetInstances(e)}readFleetSnapshots(e,t,n){this.reconcileFleetConnections(e,t,n);const i={items:[],nodeErrors:[],nodeStates:[]};for(const s of e){const e=n.get(s.id);if(!e){i.nodeStates.push({nodeId:s.id,resource:t,phase:"uninitialized",revision:this.fleetRevisions.get(`${t}:${s.id}`)});continue}i.items.push(...e.items.map(e=>({nodeId:s.id,item:e})));const a=this.publicFleetState(s.id,t,e);i.nodeStates.push(a),e.error&&i.nodeErrors.push(e.error)}return i}async refreshFleetSnapshots(e,t,n,i,s,a,o){this.reconcileFleetConnections(e,t,s),await Promise.all(e.map(e=>this.refreshFleetNode(e,t,n,i,s,a,o)))}refreshFleetNode(e,t,n,i,s,a,o){if(this.disposed)return Promise.resolve();const r=`${t}:${e.id}`,c=this.fleetRefreshes.get(r);if(c)return c;if(!o&&this.fleetRetryTimers.has(r))return Promise.resolve();o&&this.clearFleetRetry(r);const d=this.fleetConnectionKey(e),l=s.get(e.id),p=l?.connectionKey===d?l:void 0,u="ready"===p?.phase&&void 0!==p.updatedAt&&Date.now()-Date.parse(p.updatedAt)<this.fleetSnapshotFreshMs;if(!o&&u)return Promise.resolve();const m=l?.connectionKey===d&&Boolean(l.error)&&("error"===l.phase||"stale"===l.phase),h=this.nextFleetRevision(e.id,t),g={connectionKey:d,items:l?.connectionKey===d?[...l.items]:[],phase:m?l.phase:"ready"===p?.phase?"ready":p?.updatedAt?"stale":"loading",revision:h,updatedAt:l?.connectionKey===d?l.updatedAt:void 0,error:m?l.error:void 0};s.set(e.id,g),m||p&&this.sameFleetState(t,p,g)||this.emitFleetState(e.id,t,g,{contentChanged:!1});const f=(async()=>{try{this.requireFleetNodeReady(e,n);const o=await this.withFleetDeadline(e,n,i,t=>a(e,t));if(s.get(e.id)?.revision!==h)return;const c=o.nodeErrors[0],l={connectionKey:d,items:[...o.items],phase:c?"stale":"ready",revision:h,updatedAt:(new Date).toISOString(),error:c};s.set(e.id,l);const u=!p||!this.sameFleetItems(t,p,l);if(c)return this.sameFleetState(t,g,l)||this.emitFleetState(e.id,t,l,{contentChanged:u}),void this.scheduleFleetRetry(r,()=>this.refreshFleetNode(e,t,n,{},s,a,!0));this.resetFleetRetry(r),p&&this.sameFleetState(t,p,l)||this.emitFleetState(e.id,t,l,{contentChanged:u})}catch(i){if(s.get(e.id)?.revision!==h)return;const o=function(e,t,n,i){const s=i&&"object"==typeof i?i:{};return{nodeId:e.id,route:"string"==typeof s.route?s.route:t,method:"GET",code:"string"==typeof s.code?s.code:"NODE_AGENT_REQUEST_FAILED",message:i instanceof Error?i.message:String(i),statusCode:"number"==typeof s.statusCode?s.statusCode:void 0,issues:Array.isArray(s.issues)?s.issues:void 0}}(e,n,0,i),c={...g,phase:g.updatedAt?"stale":"error",error:o};s.set(e.id,c),this.sameFleetState(t,g,c)||this.emitFleetState(e.id,t,c,{contentChanged:!1}),this.scheduleFleetRetry(r,()=>this.refreshFleetNode(e,t,n,{},s,a,!0))}})().finally(()=>{this.fleetRefreshes.get(r)===f&&this.fleetRefreshes.delete(r)});return this.fleetRefreshes.set(r,f),f}reconcileFleetConnections(e,t,n){for(const i of e){const e=n.get(i.id);e&&e.connectionKey!==this.fleetConnectionKey(i)&&(n.delete(i.id),this.resetFleetRetry(`${t}:${i.id}`))}}invalidateFleetResource(e,t){const n="instances"===t?this.instanceSnapshots:"runtimes"===t?this.runtimeSnapshots:this.modelSnapshots;n.get(e.id)&&(this.resetFleetRetry(`${t}:${e.id}`),n.delete(e.id),this.onFleetStateChanged?.({nodeId:e.id,resource:t,phase:"uninitialized",revision:this.nextFleetRevision(e.id,t),contentChanged:!0}))}publicFleetState(e,t,n){const i=n.error?{nodeId:n.error.nodeId,route:n.error.route,method:n.error.method,code:n.error.code,message:n.error.message,...void 0!==n.error.statusCode?{statusCode:n.error.statusCode}:{},...n.error.issues?{issues:n.error.issues.map(e=>({path:e.path.map(e=>"symbol"==typeof e?String(e):e),message:e.message}))}:{}}:void 0;return{nodeId:e,resource:t,phase:n.phase,revision:n.revision,...n.updatedAt?{updatedAt:n.updatedAt}:{},...i?{error:i}:{}}}emitFleetState(e,t,n,i={}){this.onFleetStateChanged?.({...this.publicFleetState(e,t,n),...void 0===i.contentChanged?{}:{contentChanged:i.contentChanged}})}sameFleetItems(e,t,n){return JSON.stringify(this.fleetItemsForComparison(e,t.items))===JSON.stringify(this.fleetItemsForComparison(e,n.items))}fleetItemsForComparison(e,t){return"instances"!==e?t:t.map(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return e;const{stateRevision:t,updatedAt:n,lastHeartbeatAt:i,aiSessions:s,appInventory:a,...o}=e,r=a&&"object"==typeof a&&!Array.isArray(a)?(({observedAt:e,...t})=>t)(a):a;return{...o,...r?{appInventory:r}:{}}})}sameFleetState(e,t,n){const i=t=>({phase:t.phase,items:this.fleetItemsForComparison(e,t.items),error:t.error&&{code:t.error.code,message:t.error.message,statusCode:t.error.statusCode,route:t.error.route,method:t.error.method,issues:t.error.issues}});return JSON.stringify(i(t))===JSON.stringify(i(n))}scheduleFleetRetry(e,t){if(this.disposed||this.fleetRetryTimers.has(e))return;const n=(this.fleetRetryAttempts.get(e)||0)+1;this.fleetRetryAttempts.set(e,n);const i=Math.min(this.fleetRetryMaxMs,this.fleetRetryBaseMs*2**Math.min(n-1,10)),s=setTimeout(()=>{this.fleetRetryTimers.delete(e),this.disposed||t()},i);s.unref?.(),this.fleetRetryTimers.set(e,s)}clearFleetRetry(e){const t=this.fleetRetryTimers.get(e);t&&clearTimeout(t),this.fleetRetryTimers.delete(e)}resetFleetRetry(e){this.clearFleetRetry(e),this.fleetRetryAttempts.delete(e)}setTargetedSnapshot(e,t,n,i){const s=n.get(e.id),a={connectionKey:this.fleetConnectionKey(e),items:[...i.items],phase:i.nodeErrors.length?"stale":"ready",revision:this.nextFleetRevision(e.id,t),updatedAt:(new Date).toISOString(),error:i.nodeErrors[0]};n.set(e.id,a),this.emitFleetState(e.id,t,a,{contentChanged:!s||s.connectionKey!==a.connectionKey||!this.sameFleetItems(t,s,a)})}upsertRuntimeSnapshot(e,t){const n=this.runtimeSnapshots.get(e.id);if(!n||n.connectionKey!==this.fleetConnectionKey(e))return;const i={...n,items:[...n.items]},s=n.items.findIndex(e=>e.id===t.id);n.items=s<0?[...n.items,t]:n.items.map((e,n)=>n===s?t:e),n.phase="ready",n.revision=this.nextFleetRevision(e.id,"runtimes"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"runtimes",n,{contentChanged:!this.sameFleetItems("runtimes",i,n)})}removeRuntimeSnapshot(e,t){const n=this.runtimeSnapshots.get(e.id);if(!n||n.connectionKey!==this.fleetConnectionKey(e))return;const i={...n,items:[...n.items]};n.items=n.items.filter(e=>e.id!==t),n.phase="ready",n.revision=this.nextFleetRevision(e.id,"runtimes"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"runtimes",n,{contentChanged:!this.sameFleetItems("runtimes",i,n)})}nextFleetRevision(e,t){const n=`${t}:${e}`,i=(this.fleetRevisions.get(n)||0)+1;return this.fleetRevisions.set(n,i),i}fleetConnectionKey(e){return JSON.stringify([e.id,e.connectionMode,e.controlEndpoint,e.endpoint,e.auth.mode,e.auth.keyId])}upsertInstanceSnapshot(e,t){const n=this.instanceSnapshots.get(e.id),i=this.fleetConnectionKey(e);if(!n||n.connectionKey!==i)return;const s=n.items;n.items=[...n.items.filter(e=>e.id!==t.id),t],n.phase="ready",n.revision=this.nextFleetRevision(e.id,"instances"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"instances",n,{contentChanged:!this.sameFleetItems("instances",{...n,items:s},n)})}removeInstanceSnapshot(e,t){const n=this.instanceSnapshots.get(e.id);if(!n||n.connectionKey!==this.fleetConnectionKey(e))return;const i=n.items;n.items=n.items.filter(e=>e.id!==t),n.phase="ready",n.revision=this.nextFleetRevision(e.id,"instances"),n.updatedAt=(new Date).toISOString(),n.error=void 0,this.emitFleetState(e.id,"instances",n,{contentChanged:JSON.stringify(i)!==JSON.stringify(n.items)})}requireFleetNodeReady(e,t){const n=e.connectionPhase,i="reverse-wss"!==e.connectionMode&&"control-plane-proxy"!==e.connectionMode;if(!n||"healthy"===n||i)return;const s=new Error(`Node agent ${e.id} is ${n}; serving its latest fleet snapshot.`);throw Object.assign(s,{code:"NODE_AGENT_CONNECTION_PENDING",nodeId:e.id,route:t}),s}async withFleetDeadline(e,t,n,i){const s=new AbortController,a=Object.assign(new Error(`Node agent ${e.id} did not return ${t} before the fleet aggregation deadline.`),{code:"NODE_AGENT_FLEET_TIMEOUT",nodeId:e.id,route:t}),o=new Promise((e,t)=>{const n=()=>t(s.signal.reason||a);s.signal.aborted?n():s.signal.addEventListener("abort",n,{once:!0})}),r=()=>s.abort(n.signal?.reason);n.signal?.aborted?r():n.signal?.addEventListener("abort",r,{once:!0});const c=setTimeout(()=>s.abort(a),this.fleetRequestTimeoutMs);c.unref?.();try{return await Promise.race([i({...n,signal:s.signal}),o])}finally{clearTimeout(c),n.signal?.removeEventListener("abort",r)}}normalizeInstance(e,t){const n=(i=t,Nd.safeParse(Pd(i)));var i;if(n.success)return n.data.protocolVersion&&n.data.protocolVersion!==qo?(this.client.logger?.warn?.({nodeId:e.id,instanceId:n.data.id,expectedProtocolVersion:qo,actualProtocolVersion:n.data.protocolVersion,errorCode:"PROTOCOL_VERSION_MISMATCH"},"node instance protocol version mismatch"),{instance:n.data}):{instance:n.data};const s=t&&"object"==typeof t?t:{},a="string"==typeof s.id?s.id:void 0;return this.client.logger?.warn?.({nodeId:e.id,instanceId:a,errorCode:"NODE_INSTANCE_PAYLOAD_INVALID",issues:n.error.issues.map(e=>({path:e.path.join("."),message:e.message}))},"node instance payload invalid"),{error:{nodeId:e.id,route:"/instances",method:"GET",code:"NODE_INSTANCE_PAYLOAD_INVALID",message:a?`Node instance ${a} payload is invalid.`:"Node instance payload is invalid.",statusCode:502,issues:n.error.issues}}}}const Vm="TASK_HANDOFF_NODE_AGENT_V1",Km=6e4,Ym="/api/node-tunnel";function Xm(e,t){if("paired-hmac"===e.auth.mode&&e.auth.secret){if(!e.auth.keyId){const t=new Error(`Node ${e.id} paired-HMAC auth is missing keyId.`);throw Object.assign(t,{statusCode:500,code:"NODE_AGENT_REMOTE_KEY_ID_MISSING"}),t}return function(e){const t=e.timestamp||(new Date).toISOString(),n=e.nonce||i.randomBytes(18).toString("base64url"),s=Jm(e.body||""),a=Qm(e.secret,{keyId:e.keyId,method:e.method,pathWithQuery:e.pathWithQuery,timestamp:t,nonce:n,bodySha256:s});return{"x-taskhandoff-node-id":e.nodeId,"x-taskhandoff-key-id":e.keyId,"x-taskhandoff-timestamp":t,"x-taskhandoff-nonce":n,"x-taskhandoff-body-sha256":s,"x-taskhandoff-signature":a}}({nodeId:e.id,keyId:e.auth.keyId,secret:e.auth.secret,method:t.method,pathWithQuery:t.pathWithQuery,body:t.body})}const n="local-ipc"!==e.connectionMode&&"local-loopback"!==e.connectionMode||"local-static-key"!==e.auth.mode?void 0:e.auth.secret;return n?{authorization:`Bearer ${n}`}:{}}function Jm(e=""){return i.createHash("sha256").update(e).digest("hex")}function Qm(e,t){return i.createHmac("sha256",e).update(function(e){return[Vm,e.keyId,e.method.toUpperCase(),e.pathWithQuery,e.timestamp,e.nonce,e.bodySha256].join("\n")}(t)).digest("hex")}function Zm(e){if(e.startsWith("ipc://"))return decodeURIComponent(e.slice(6))}function eh(e,t=process.platform){if(!function(e,t=process.platform){if("win32"===t)return e.startsWith("\\\\.\\pipe\\");const i=n.statSync(e),s=process.getuid?.();return void 0===s||i.uid===s}(e,t)){const e=new Error("Local node agent IPC socket is not owned by the current user.");throw Object.assign(e,{statusCode:403,code:"NODE_AGENT_IPC_OWNER_INVALID"}),e}}function th(e,t){return Number.isFinite(e)&&Number(e)>0?Number(e):t}function nh(e,t){const n=AbortSignal.timeout(t);return e?AbortSignal.any([e,n]):n}async function ih(e,t,n,i={}){const s=Zm(t);return s?(eh(s),async function(e,t,n={}){const i=n.method||"GET",s="string"==typeof n.body||n.body instanceof Buffer?n.body:void 0===n.body||null===n.body?void 0:String(n.body),a=new Headers(n.headers||{});return void 0===s||a.has("content-length")||a.set("content-length",String(Buffer.byteLength(s))),new Promise((o,c)=>{const d=v.request({socketPath:e,method:i,path:`/api/node-agent${t}`,headers:Object.fromEntries(a.entries())},e=>{const t=e.statusCode||500;o(new Response("HEAD"!==i&&204!==t&&205!==t&&304!==t?r.Readable.toWeb(e):null,{status:t,headers:e.headers}))});d.on("error",c);const l=()=>d.destroy(new DOMException("The operation was aborted.","AbortError"));n.signal?.aborted?l():n.signal?.addEventListener("abort",l,{once:!0}),d.once("close",()=>n.signal?.removeEventListener("abort",l)),void 0!==s&&d.write(s),d.end()})}(s,n,i)):e(`${t.replace(/\/$/,"")}/api/node-agent${n}`,i)}function sh(e){const t=e.controlEndpoint||e.endpoint;if(!t){const e=new Error("Node agent direct HTTP mode requires an endpoint.");throw Object.assign(e,{statusCode:400,code:"NODE_AGENT_ENDPOINT_REQUIRED"}),e}return t}function ah(e,t,n,i){const s=sh(e),a=Zm(s),o=`/api/node-agent${t}`;if(a)return eh(a),function(e,t,n,i={}){const s=`/api/node-agent${t}`,a={createConnection:()=>I.connect(e),headers:{host:"task-handoff-node-agent.local",...i}};return n&&(Array.isArray(n)?n.length>0:n.trim().length>0)?new b.WebSocket(`ws://task-handoff-node-agent.local${s}`,n,a):new b.WebSocket(`ws://task-handoff-node-agent.local${s}`,a)}(a,t,n,i);const r=new URL(o,s.replace(/\/$/,""));return r.protocol="https:"===r.protocol?"wss:":"ws:",n?new b.WebSocket(r.toString(),n,{headers:i}):new b.WebSocket(r.toString(),{headers:i})}function oh(e,t,n){const i=new Headers(n),s=Xm(e,t);for(const[e,t]of Object.entries(s))"authorization"===e&&i.has(e)||i.set(e,t);return Object.fromEntries(i.entries())}function rh(e=fetch,t={}){const n=t.openWebSocket||ah,i=th(t.requestTimeoutMs,3e4),s=th(t.streamHeaderTimeoutMs,3e4),a=th(t.websocketOpenTimeoutMs,1e4);return{request:async(t,n,s={})=>{const a=sh(t),o=s.method||"GET",r="string"==typeof s.body||s.body instanceof Buffer?s.body:void 0===s.body||null===s.body?void 0:String(s.body),c=oh(t,{method:o,pathWithQuery:`/api/node-agent${n}`,body:r||""},s.headers);return ih(e,a,n,{...s,body:r,headers:c,signal:nh(s.signal,i)})},requestStream:async(t,n,i={})=>{const a=sh(t),o=i.method||"GET",r="string"==typeof i.body||i.body instanceof Buffer?i.body:void 0===i.body||null===i.body?void 0:String(i.body),c=oh(t,{method:o,pathWithQuery:`/api/node-agent${n}`,body:r||""},i.headers),d=new AbortController,l=i.signal?AbortSignal.any([i.signal,d.signal]):d.signal;return async function(t,s,o){const d=setTimeout(()=>o.abort(Object.assign(new Error("Node agent response header timed out."),{code:"NODE_AGENT_RESPONSE_HEADER_TIMEOUT"})),s);d.unref?.();try{return await ih(e,a,n,{...i,body:r,headers:c,signal:l})}finally{clearTimeout(d)}}(0,s,d)},proxyWebSocket(e,t,i,s,o={}){const r=oh(e,{method:"GET",pathWithQuery:`/api/node-agent${i}`},o),c=n(e,i,s,r);let d,l=!1;return c.on("open",()=>{if(!l||c.readyState!==(c.OPEN??1))return;const e=d;d=void 0,l=!1,c.send(e)}),un(t,c,{upstreamOpenTimeoutMs:a,onUpstreamError:()=>t.close(1011,"Instance websocket proxy failed."),onUpstreamErrorBeforeOpen:()=>!0}),{send:e=>{c.readyState!==(c.OPEN??1)?(d=e,l=!0):c.send(e)},ping:()=>{const e=c.ping;if(!e)throw new Error("Direct node-agent websocket does not support ping.");e.call(c)},onPong:e=>c.on("pong",e)}}}}class ch{direct;tunnel;proxy;constructor(e){this.direct=e.direct,this.tunnel=e.tunnel,this.proxy=e.proxy}setTunnel(e){this.tunnel=e}setProxy(e){this.proxy=e}resolve(e){if(!1===e.connectionEnabled){const e=new Error("Node agent connection is disabled locally.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_CONNECTION_DISABLED"}),e}if("control-plane-proxy"===e.connectionMode){if(!this.proxy){const e=new Error("Control-plane proxy transport is not available.");throw Object.assign(e,{statusCode:503,code:"CONTROL_PLANE_PROXY_TRANSPORT_UNAVAILABLE"}),e}return this.proxy}if("reverse-wss"!==e.connectionMode)return this.direct;if(!this.tunnel){const e=new Error("Reverse node agent transport is not available.");throw Object.assign(e,{statusCode:503,code:"NODE_AGENT_REVERSE_TRANSPORT_UNAVAILABLE"}),e}return this.tunnel}}function dh(e,t,n,i){const s=new Error(e,void 0===i?void 0:{cause:i});return Object.assign(s,{code:t,statusCode:n,retryable:n>=500}),s}function lh(e,t){if("control-plane-proxy"!==e.connectionPath.kind)throw dh("Control-plane proxy transport requires a proxy connection path.","CONTROL_PLANE_PROXY_CONFIGURATION_INVALID",400);const n=t(e);if(!n)throw dh("Control-plane proxy credential is missing.","CONTROL_PLANE_PROXY_CREDENTIAL_REQUIRED",503);if(n.nodeId!==e.id||n.proxyBindingId!==e.connectionPath.proxyBindingId||n.targetNodeId!==e.connectionPath.targetNodeId)throw dh("Control-plane proxy credential does not match the node connection identity.","CONTROL_PLANE_PROXY_CREDENTIAL_MISMATCH",409);return n}function ph(e,t){const n=new Headers(t);n.set(ro,Ja),n.set(co,e.sourceControlPlaneId),n.set(lo,e.bindingKeyId),n.set(po,e.credential);const s=no.safeParse(n.get("x-request-id"));return n.set("x-request-id",s.success?s.data:`proxy_request_${i.randomUUID().replace(/-/g,"")}`),Object.fromEntries(n.entries())}function uh(e){const t=so.safeParse(e);if(t.success)return t.data;const n=dh("Control-plane proxy route is invalid.",uo.RouteInvalid,400);throw Object.assign(n,{issues:t.error.issues}),n}function mh(e,t,n){return t?new b.WebSocket(e,t,{headers:n}):new b.WebSocket(e,{headers:n})}class hh{credentialForNode;fetchImpl;openWebSocket;constructor(e){this.credentialForNode=e.credentialForNode,this.fetchImpl=e.fetchImpl||fetch,this.openWebSocket=e.openWebSocket||mh}async fetch(e,t,n={}){const i=lh(e,this.credentialForNode),s=function(e,t){const n=new URL(uh(t),"https://node-agent.invalid"),i=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/http${n.pathname}`,e.proxyOrigin);return i.search=n.search,i}(i,t);try{return await this.fetchImpl(s,{...n,headers:ph(i,n.headers)})}catch(e){if(function(e){return e instanceof Error&&("AbortError"===e.name||"ABORT_ERR"===e.code)}(e))throw e;throw dh(`Trusted control-plane proxy ${i.proxyOrigin} is unavailable.`,"CONTROL_PLANE_PROXY_UNAVAILABLE",503,e)}}request(e,t,n={}){return this.fetch(e,t,n)}requestStream(e,t,n={}){return this.fetch(e,t,n)}proxyWebSocket(e,t,n,i,s={}){const a=lh(e,this.credentialForNode),o=this.openWebSocket(function(e,t){const n=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/websocket`,e.proxyOrigin);return n.protocol="wss:",n.searchParams.set("route",uh(t)),n}(a,n).toString(),i,ph(a,s));let r,c=!1;return o.on("open",()=>{if(!c||o.readyState!==(o.OPEN??1))return;const e=r;r=void 0,c=!1,o.send(e)}),un(t,o,{onUpstreamError:()=>t.close(1011,"Control-plane proxy websocket failed."),onUpstreamErrorBeforeOpen:()=>!0}),{send:e=>{o.readyState!==(o.OPEN??1)?(r=e,c=!0):o.send(e)},ping:()=>{const e=o.ping;if(!e)throw new Error("Control-plane proxy websocket does not support ping.");e.call(o)},onPong:e=>o.on("pong",e)}}}const gh=new Set(Object.keys(No.shape)),fh=new Set(Object.keys(Co.shape));function yh(e,t,n){if(!e||"object"!=typeof e||Array.isArray(e))return e;const i=e,s=Object.keys(i).filter(e=>!t.has(e));return s.length&&n?.(s),Object.fromEntries([...t].filter(e=>e in i).map(e=>[e,i[e]]))}function bh(e){const{credential:t,...n}=e;return n}class vh{pendingClaims;nodeCredentials;identity;constructor(e,t){this.pendingClaims=new wl(e.pendingClaimsDir,{schema:No,sanitize:e=>function(e){return yh(e,gh,e=>t?.("unknown stored pending proxy claim fields were ignored",{fields:e}))}(e),logger:t,directoryMode:448,fileMode:384}),this.nodeCredentials=new wl(e.nodeCredentialsDir,{schema:Co,sanitize:e=>function(e){return yh(e,fh,e=>t?.("unknown stored proxy node credential fields were ignored",{fields:e}))}(e),logger:t,directoryMode:448,fileMode:384}),this.identity=new Sl(e.identityPath,()=>({controlPlaneId:Il("control_plane")}),{schema:f.z.object({controlPlaneId:f.z.string().trim().min(1).max(160)}).strip(),logger:t,directoryMode:448,fileMode:384})}init(e=Date.now()){return this.pendingClaims.init(),this.nodeCredentials.init(),this.identity.init(),this.gcPendingClaims(e)}controlPlaneId(){return this.identity.get().controlPlaneId}pendingClaimByClaimId(e){return this.pendingClaims.list().find(t=>t.claimId===e)}pendingClaimByReference(e){return this.pendingClaims.get(e)||this.pendingClaimByClaimId(e)}putPendingClaim(e){const t=this.pendingClaimByClaimId(e.claimId);if(!t)return this.pendingClaims.put(e);if(t.proxyOrigin!==e.proxyOrigin||t.requestedName!==e.requestedName||t.sourceControlPlaneId!==e.sourceControlPlaneId||t.targetNodeId!==e.targetNodeId||t.bindingKeyId!==e.bindingKeyId||t.credential!==e.credential){const e=new Error("Pending proxy claim identity conflicts with an existing claim.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",statusCode:409}),e}return t}publicPendingClaims(){return this.pendingClaims.list().map(bh)}nodeCredential(e){return this.nodeCredentials.list().find(t=>t.nodeId===e)}putNodeCredential(e){const t=this.nodeCredential(e.nodeId);if(t&&(t.proxyOrigin!==e.proxyOrigin||t.proxyBindingId!==e.proxyBindingId||t.targetNodeId!==e.targetNodeId||t.sourceControlPlaneId!==e.sourceControlPlaneId||t.bindingKeyId!==e.bindingKeyId||t.credential!==e.credential)){const e=new Error("Proxy node credential conflicts with the existing node identity.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_NODE_IDENTITY_CONFLICT",statusCode:409}),e}return t||this.nodeCredentials.put(e)}deleteNodeCredential(e){const t=this.nodeCredential(e);return!!t&&this.nodeCredentials.delete(t.id)}gcNodeCredentials(e){const t=[];for(const n of this.nodeCredentials.list())e(n)||(this.nodeCredentials.delete(n.id),t.push(n.id));return t}promotePendingClaim(e,t){const n=this.pendingClaimByClaimId(e);if(!n)return;if(n.proxyOrigin!==t.proxyOrigin||n.sourceControlPlaneId!==t.sourceControlPlaneId||void 0!==n.targetNodeId&&n.targetNodeId!==t.targetNodeId||n.bindingKeyId!==t.bindingKeyId||n.credential!==t.credential){const e=new Error("Proxy node credential does not match the pending claim identity.");throw Object.assign(e,{code:"CONTROL_PLANE_PROXY_BINDING_IDENTITY_CONFLICT",statusCode:409}),e}const i=this.putNodeCredential(t);return this.pendingClaims.delete(n.id),i}markCompensationRequired(e){const t=this.pendingClaimByClaimId(e);if(t)return this.pendingClaims.patch(t.id,{status:"compensation-required"})}cancelPendingClaim(e,t){const n=this.pendingClaimByClaimId(e);return n?t?(this.pendingClaims.patch(n.id,{status:"compensation-required"}),{deleted:!1,compensationRequired:!0}):{deleted:this.pendingClaims.delete(n.id),compensationRequired:!1}:{deleted:!1,compensationRequired:!1}}completePendingClaimCompensation(e){const t=this.pendingClaimByClaimId(e);return!(!t||"compensation-required"!==t.status)&&this.pendingClaims.delete(t.id)}forceDeletePendingClaim(e){const t=this.pendingClaimByReference(e);return!!t&&this.pendingClaims.delete(t.id)}gcPendingClaims(e=Date.now()){const t=[];for(const n of this.pendingClaims.list()){if("compensation-required"===n.status)continue;const i=Date.parse(n.expiresAt);!Number.isFinite(i)||i>e||(this.pendingClaims.delete(n.id),t.push(n.id))}return t}}const Ih=f.z.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$/),xh=f.z.string().datetime(),wh=f.z.object({sessionReadAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([]),turnReadAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([]),liveItemAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([])}).passthrough();const Sh=f.z.object({metadataAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([]),contentAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([]),uploadAgents:f.z.array(f.z.string().trim().min(1).max(120)).max(100).default([]),retentionSettings:f.z.boolean().default(!1)}).passthrough(),Ah=f.z.object({aiSessionTimeline:wh.default(function(){return{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),aiSessionConversationAttachments:Sh.optional(),aiSessionProviders:Do.optional(),browserTunnel:f.z.boolean().optional()}).passthrough(),Eh=f.z.enum(["connecting","handshaking","healthy","reconnecting","suspect","offline"]),_h=f.z.enum(["start","stop","restart","retry-image"]);f.z.object({instanceId:Ih,revision:f.z.number().int().nonnegative(),updatedAt:xh,status:f.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]),health:f.z.enum(["unknown","ok","degraded","failed"]),connectionStatus:f.z.enum(["unknown","online","offline","endpoint-unreachable"]),ready:f.z.boolean(),lastHeartbeatAt:xh.optional()}).strip();const Th=f.z.object({code:f.z.string().trim().min(1).max(120),message:f.z.string().trim().min(1).max(2048)}).strict(),zh=f.z.enum(["instances","runtimes","models"]),kh=f.z.enum(["uninitialized","loading","ready","stale","error"]),Nh=f.z.object({nodeId:Ih,resource:zh,phase:kh,revision:f.z.number().int().nonnegative().optional(),updatedAt:xh.optional(),error:f.z.object({nodeId:Ih,route:f.z.string().trim().min(1).max(500),method:f.z.string().trim().min(1).max(20),code:f.z.string().trim().min(1).max(120),message:f.z.string().trim().min(1).max(4096),statusCode:f.z.number().int().optional(),issues:f.z.array(f.z.object({path:f.z.array(f.z.union([f.z.string(),f.z.number()])).optional(),message:f.z.string()}).passthrough()).optional()}).passthrough().optional()}).strict();Nh.extend({contentChanged:f.z.boolean().optional()}).strict(),f.z.object({nodeStates:f.z.array(Nh).default([])}).passthrough();const Ch=f.z.object({id:Ih,name:f.z.string().trim().min(1).max(160),status:f.z.enum(["unknown","online","offline","degraded"]),health:f.z.enum(["unknown","ok","degraded","failed"]),connectionMode:f.z.enum(["local-ipc","local-loopback","direct-http","reverse-wss","control-plane-proxy"]),connectionPhase:Eh.optional(),lastSeenAt:xh.optional(),observedAt:xh,capabilities:f.z.array(f.z.string().trim().min(1).max(120)).max(256),error:Th.optional()}).strict();f.z.array(Ch);const Rh=f.z.object({id:f.z.string().trim().min(1).max(120),name:f.z.string().trim().min(1).max(120),kind:f.z.enum(["tty","gui","web"]),supportsCwdSelection:f.z.boolean()}).strict(),Oh=f.z.object({modelEntityIds:f.z.array(Ih).max(64).transform(e=>[...new Set(e)]).optional(),codexModelHash:Ih.nullable().optional(),claudeModelHash:Ih.nullable().optional(),opencodeModelHash:Ih.nullable().optional()}).strict().default({}),jh=f.z.object({id:Ih,name:f.z.string().trim().min(1).max(160),nodeId:Ih,status:f.z.enum(["created","provisioning","starting","registering","registered","running","stopping","stopped","deleting","failed","unhealthy"]),health:f.z.enum(["unknown","ok","degraded","failed"]),connectionStatus:f.z.enum(["unknown","online","offline","endpoint-unreachable"]),ready:f.z.boolean(),capabilities:Ah.default({aiSessionTimeline:{sessionReadAgents:[],turnReadAgents:[],liveItemAgents:[]}}),config:f.z.object({defaultCodexPermissionMode:di.default("ask"),aiSessionMaxFileAttachmentBytes:f.z.number().int().positive().default(fn)}).strict().default({defaultCodexPermissionMode:"ask",aiSessionMaxFileAttachmentBytes:fn}),modelSelection:Oh,lastHeartbeatAt:xh.optional(),heartbeatAgeMs:f.z.number().int().nonnegative().optional(),observedAt:xh,runtime:f.z.object({id:Ih,name:f.z.string().trim().min(1).max(160).optional(),type:f.z.enum(["docker","kubernetes","local"]).optional()}).strict(),workspace:f.z.object({status:f.z.enum(["unknown","pending","ready","failed"]),path:f.z.string().trim().max(4096).optional()}).strict(),protocol:f.z.object({version:f.z.string().optional(),compatible:f.z.boolean(),warning:f.z.string().trim().min(1).max(500).optional()}).strict(),aiSessions:xs,availableActions:f.z.array(_h).max(4).default([]),availableApps:f.z.array(Rh).max(256).default([]),availableAgents:f.z.array(Rh).max(256),error:Th.optional()}).strict();function Ph(e){if(!e||"object"!=typeof e)return;const t=e,n=Wr.safeParse(t.build),i=gr.safeParse(t.platform),s=fr.safeParse(t.arch),a=od.safeParse(t.capabilities);return{..."boolean"==typeof t.ok?{ok:t.ok}:{},..."string"==typeof t.role?{role:t.role}:{},..."string"==typeof t.nodeId?{nodeId:t.nodeId}:{},..."string"==typeof t.protocolVersion?{protocolVersion:t.protocolVersion}:{},...i.success?{platform:i.data}:{},...s.success?{arch:s.data}:{},...a.success?{capabilities:a.data}:{},...n.success?{build:n.data}:{},..."string"==typeof t.serverTime?{serverTime:t.serverTime}:{}}}function Dh(e){const{agent:t,...n}=e.capabilities,{secret:i,...s}=e.auth,a=s.pairing?{...s.pairing,joinToken:void 0}:void 0,o=Ph(t);return{...e,auth:a?{...s,pairing:a}:s,capabilities:o?{...n,agent:o}:n}}function Lh(e){return"local-folder"===e.type?{mode:"local-bind",path:"/workspace",readOnly:!1}:{mode:"git-clone",path:"/workspace",readOnly:!1}}function Mh(e){return function(e){const{registrationToken:t,target:n,agentStatus:i,targetStatus:s,uiAccessStatus:a,...o}=e;return o}(function(e){const t=`/instances/${encodeURIComponent(e.id)}`,n={strategy:"control-plane-proxy",web:`${t}/`,api:`${t}/api`,ws:`${t}/api`,status:"online"===e.connectionStatus||"online"===e.agentStatus?"reachable":"endpoint-unreachable"};return{...e,access:n}}(e))}function qh(e){const{key:t,...n}=e;return{...n,keyPreview:(i=e.key,i.length<=8?"set":`${i.slice(0,4)}...${i.slice(-4)}`),keySet:!0};var i}function Uh(e){return e?e instanceof Headers?Object.fromEntries(e.entries()):Array.isArray(e)?Object.fromEntries(e.map(([e,t])=>[e,t])):Object.fromEntries(Object.entries(e).map(([e,t])=>[e,String(t)])):{}}function $h(e){const t=String(e||"").split(":");if(3===t.length&&"ai"===t[1]&&t[0]&&t[2])return{instanceId:t[0],aiSessionId:t[2]}}function Bh(e){return e instanceof Error?e.message:String(e)}function Fh(e,t){const n=new Error(t);throw Object.assign(n,{statusCode:404,code:e}),n}f.z.array(jh);const Hh=f.z.object({proxyOrigin:io,inviteToken:f.z.string().trim().min(24).max(512),name:f.z.string().trim().min(1).max(160).optional()}).strict(),Gh=f.z.object({data:f.z.object({binding:Io,closed:f.z.object({abortedRequests:f.z.number().int().nonnegative(),closedSockets:f.z.number().int().nonnegative()}).strict()}).strict()}).strict();class Wh{claimOperations=new Map;options;constructor(e){this.options=e}listPendingClaims(){return this.options.privateStore.publicPendingClaims()}async claimNode(e){const t=Hh.parse(e),n=hl(),i=Il("proxy_claim"),s={id:i,claimId:i,proxyOrigin:t.proxyOrigin,...t.name?{requestedName:t.name}:{},sourceControlPlaneId:this.options.privateStore.controlPlaneId(),bindingKeyId:Il("proxy_key"),credential:xl(),status:"pending",createdAt:n,updatedAt:n,expiresAt:new Date(Date.now()+864e5).toISOString()};return this.options.privateStore.putPendingClaim(s),this.withClaimLock(s.claimId,()=>this.completeClaim(s,t.inviteToken))}async resumeClaim(e){const t=this.options.privateStore.pendingClaimByReference(e);return t||Fh("CONTROL_PLANE_PROXY_CLAIM_NOT_FOUND",`Proxy claim ${e} was not found.`),this.withClaimLock(t.claimId,async()=>{const t=this.options.privateStore.pendingClaimByReference(e);return t||Fh("CONTROL_PLANE_PROXY_CLAIM_NOT_FOUND",`Proxy claim ${e} was not found.`),this.completeClaim(t)})}async cancelClaim(e,t=!1){const n=this.options.privateStore.pendingClaimByReference(e);return n?this.withClaimLock(n.claimId,async()=>{const n=this.options.privateStore.pendingClaimByReference(e);if(!n)return{deleted:!1,compensationRequired:!1,remoteRevoke:"not-required"};if(t)return{deleted:this.options.privateStore.forceDeletePendingClaim(e),compensationRequired:!1,remoteRevoke:"not-required",forced:!0,orphanRisk:!0};if("pending"===n.status)return{...this.options.privateStore.cancelPendingClaim(n.claimId,!1),remoteRevoke:"not-required"};let i;try{i=await this.requestClaim(n)}catch(e){throw this.compensationError(n,"Trusted control-plane proxy is unavailable; claim cancellation requires retry.",e,503,"CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",!0,{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"})}const s=await this.responsePayload(i);if(!i.ok){const e=s?.error?.code;if(e===uo.InviteInvalid||e===uo.BindingRevoked||e===uo.BindingUnknown)return{deleted:this.options.privateStore.completePendingClaimCompensation(n.claimId),compensationRequired:!1,remoteRevoke:e===uo.InviteInvalid?"not-created":"already-revoked"};throw this.compensationError(n,s?.error?.message||`Proxy claim recovery failed with HTTP ${i.status}.`,void 0,i.status,e,s?.error?.retryable)}const a=Dl(ko,s?.data);this.requireClaimResultIdentity(n,a);const o=this.compensationCredential(n,a);let r;try{r=await this.revokeBinding(o)}catch(e){throw this.compensationError(n,"Trusted control-plane proxy is unavailable; binding revocation requires retry.",e,503,"CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",!0,{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"})}const c=await this.responsePayload(r);if(!r.ok&&c?.error?.code!==uo.BindingRevoked&&c?.error?.code!==uo.BindingUnknown)throw this.compensationError(n,c?.error?.message||`Proxy binding revoke failed with HTTP ${r.status}.`,void 0,r.status,c?.error?.code,c?.error?.retryable);if(r.ok)try{this.requireRevocationReceipt(c,o)}catch(e){throw this.compensationError(n,"Proxy binding revocation returned an invalid receipt; compensation requires retry.",e,502,uo.TransportFailed,!0)}return{deleted:this.options.privateStore.completePendingClaimCompensation(n.claimId),compensationRequired:!1,remoteRevoke:r.ok?"revoked":"already-revoked"}}):{deleted:!1,compensationRequired:!1,remoteRevoke:"not-required"}}applyTargetSnapshot(e,t){const n=this.requireProxyNodeIdentity(e,t.binding.id,t.binding.targetNodeId);return this.putTargetState(n,t.target,{reachability:"reachable",bindingStatus:t.binding.status,bindingRevision:t.binding.revision,streamId:t.streamId,revision:t.revision,observedAt:t.observedAt})}applyTargetEvent(e,t){const n=this.requireProxyNodeIdentity(e,void 0,t.targetNodeId),i=n.proxyState;if(!i?.streamId||i.streamId!==t.streamId||void 0===i.revision||t.revision!==i.revision+1){const e=new Error("Proxy target event does not continue the authoritative snapshot cursor.");throw Object.assign(e,{code:uo.SnapshotRequired,statusCode:409,retryable:!0}),e}return this.putTargetState(n,t.target,{...i,reachability:"reachable",bindingStatus:"revoked"===i.bindingStatus?"revoked":"active",revision:t.revision,observedAt:t.event.createdAt})}markUnavailable(e,t){const n=this.requireProxyNodeIdentity(e),i=hl();return this.options.nodes.put(ed.parse({...n,status:"degraded",health:"degraded",proxyState:{...n.proxyState,reachability:"unreachable",bindingStatus:n.proxyState?.bindingStatus??"unknown",lastError:t,updatedAt:i},updatedAt:i}))}markBindingRevoked(e,t){const n=this.requireProxyNodeIdentity(e),i=hl();return this.options.nodes.put(ed.parse({...n,status:"degraded",health:"degraded",proxyState:{...n.proxyState,reachability:"reachable",bindingStatus:"revoked",lastError:t,updatedAt:i},updatedAt:i}))}assertIdentityPatch(e,t){const n=t.connectionMode??e.connectionMode,i=t.connectionPath??e.connectionPath,s=t.auth??e.auth,a="control-plane-proxy"===e.connectionMode||"control-plane-proxy"===e.connectionPath.kind||"proxy-binding"===e.auth.mode,o="control-plane-proxy"===n||"control-plane-proxy"===i.kind||"proxy-binding"===s.mode,r=n!==e.connectionMode||JSON.stringify(i)!==JSON.stringify(e.connectionPath)||JSON.stringify(s)!==JSON.stringify(e.auth);if((a||o)&&r){const e=new Error("Proxy node connection identity can only be changed through the control-plane proxy lifecycle API.");throw Object.assign(e,{statusCode:409,code:"CONTROL_PLANE_PROXY_IDENTITY_IMMUTABLE",retryable:!1}),e}}async deleteNode(e,t=!1){if("control-plane-proxy"!==e.connectionMode)return{deleted:this.options.deleteNode(e.id),revoke:{mode:"not-proxied",orphanRisk:!1}};const n=this.options.privateStore.nodeCredential(e.id);if(!n){if(!t){const e=new Error("Proxy node credential is missing; remote binding cannot be revoked.");throw Object.assign(e,{statusCode:409,code:"CONTROL_PLANE_PROXY_CREDENTIAL_REQUIRED",retryable:!1,details:{forceDeleteAllowed:!0,forceDeleteReason:"credential-missing"}}),e}return this.forceDeleteNode(e.id)}let i;try{i=await this.revokeBinding(n)}catch(n){if(t)return this.forceDeleteNode(e.id);const i=new Error("Trusted control-plane proxy is unavailable; the binding was not revoked.",{cause:n});throw Object.assign(i,{statusCode:503,code:"CONTROL_PLANE_PROXY_REVOKE_UNAVAILABLE",retryable:!0,details:{forceDeleteAllowed:!0,forceDeleteReason:"proxy-unavailable"}}),i}const s=await this.responsePayload(i);if(!i.ok){if(s?.error?.code===uo.BindingRevoked||s?.error?.code===uo.BindingUnknown){const t=s.error.details?.bindingId;if(t===n.proxyBindingId)return this.finishRevokedNodeDelete(e.id)}const t=new Error(s?.error?.message||`Proxy binding revoke failed with HTTP ${i.status}.`);throw Object.assign(t,{statusCode:i.status,code:s?.error?.code||"CONTROL_PLANE_PROXY_REVOKE_FAILED",retryable:s?.error?.retryable??i.status>=500,details:{...(a=s?.error?.details,a&&"object"==typeof a&&!Array.isArray(a)?a:{}),forceDeleteAllowed:!1}}),t}var a;try{this.requireRevocationReceipt(s,n)}catch(e){if(e&&"object"==typeof e){const t=e;t.details={...t.details||{},forceDeleteAllowed:!1}}throw e}return this.finishRevokedNodeDelete(e.id)}async completeClaim(e,t){let n;this.options.privateStore.markCompensationRequired(e.claimId);try{n=await this.requestClaim(e,t)}catch(t){const n=new Error(`Trusted control-plane proxy ${e.proxyOrigin} is unavailable.`,{cause:t});throw Object.assign(n,{statusCode:503,code:"CONTROL_PLANE_PROXY_UNAVAILABLE",retryable:!0,claimId:e.claimId}),n}const i=await this.responsePayload(n);if(!n.ok){const t=i?.error?.retryable??n.status>=500;t||this.options.privateStore.completePendingClaimCompensation(e.claimId);const s=new Error(i?.error?.message||`Proxy claim failed with HTTP ${n.status}.`);throw Object.assign(s,{statusCode:n.status,code:i?.error?.code||"CONTROL_PLANE_PROXY_CLAIM_FAILED",retryable:t,details:i?.error?.details,claimId:e.claimId}),s}const s=Dl(ko,i?.data);this.requireClaimResultIdentity(e,s);const a=this.options.nodes.get(s.target.id),o="control-plane-proxy"===a?.connectionMode&&"control-plane-proxy"===a.connectionPath.kind&&a.connectionPath.proxyBindingId===s.binding.id&&a.connectionPath.targetNodeId===s.target.id;if(a&&!o){this.options.privateStore.markCompensationRequired(e.claimId);const t=new Error(`Node ${s.target.id} already exists with another connection identity.`);throw Object.assign(t,{statusCode:409,code:"CONTROL_PLANE_PROXY_NODE_IDENTITY_CONFLICT",claimId:e.claimId}),t}const r={id:`proxy_credential_${s.target.id}`,nodeId:s.target.id,proxyOrigin:e.proxyOrigin,proxyBindingId:s.binding.id,targetNodeId:s.target.id,sourceControlPlaneId:e.sourceControlPlaneId,bindingKeyId:e.bindingKeyId,credential:e.credential,createdAt:e.createdAt,updatedAt:hl()},c=a||ed.parse({id:s.target.id,name:e.requestedName||s.target.name,connectionMode:"control-plane-proxy",connectionPath:{kind:"control-plane-proxy",proxyId:new URL(e.proxyOrigin).host,proxyBindingId:s.binding.id,targetNodeId:s.target.id},connectionEnabled:!0,auth:{mode:"proxy-binding"},status:s.target.status,health:s.target.health,capabilities:s.target.capabilities,proxyState:{reachability:"reachable",bindingStatus:s.binding.status,bindingRevision:s.binding.revision,observedAt:hl(),target:s.target,updatedAt:hl()},labels:{},lastSeenAt:s.target.lastSeenAt,createdAt:hl(),updatedAt:hl()});a||this.options.nodes.put(c);try{this.options.privateStore.promotePendingClaim(e.claimId,r)}catch(e){throw a||this.options.nodes.delete(c.id),e}return{node:Dh(c),binding:s.binding}}requireProxyNodeIdentity(e,t,n){const i=this.options.requireNode(e);if("control-plane-proxy"!==i.connectionMode||"control-plane-proxy"!==i.connectionPath.kind||void 0!==t&&i.connectionPath.proxyBindingId!==t||void 0!==n&&i.connectionPath.targetNodeId!==n){const e=new Error("Proxy state identity does not match the node connection path.");throw Object.assign(e,{code:uo.BindingIdentityConflict,statusCode:409,retryable:!1}),e}return i}putTargetState(e,t,n){const i=hl();return this.options.nodes.put(ed.parse({...e,name:t.name,status:t.status,health:t.health,capabilities:t.capabilities,lastSeenAt:t.lastSeenAt,proxyState:{...n,target:t,updatedAt:i},updatedAt:i}))}requestClaim(e,t){return this.options.fetchImpl(new URL("/api/node-proxy/claims",e.proxyOrigin),{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({protocolVersion:Ja,...t?{inviteToken:t}:{},claimId:e.claimId,sourceControlPlaneId:e.sourceControlPlaneId,...e.targetNodeId?{targetNodeId:e.targetNodeId}:{},bindingKeyId:e.bindingKeyId,credential:e.credential})})}revokeBinding(e){return this.options.fetchImpl(new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}`,e.proxyOrigin),{method:"DELETE",headers:ph(e)})}async responsePayload(e){return e.json().catch(()=>{})}requireRevocationReceipt(e,t){const n=Pl(Gh,e),i=n.success?n.data.data.binding:void 0;if(!i||i.id!==t.proxyBindingId||i.sourceControlPlaneId!==t.sourceControlPlaneId||i.targetNodeId!==t.targetNodeId||i.bindingKeyId!==t.bindingKeyId||"revoked"!==i.status){const e=new Error("Proxy binding revocation receipt does not match the local binding identity.");throw Object.assign(e,{statusCode:502,code:uo.TransportFailed,retryable:!0,details:{bindingId:t.proxyBindingId}}),e}return i}requireClaimResultIdentity(e,t){if(t.binding.claimId!==e.claimId||t.binding.sourceControlPlaneId!==e.sourceControlPlaneId||t.binding.bindingKeyId!==e.bindingKeyId||t.binding.targetNodeId!==t.target.id||void 0!==e.targetNodeId&&t.binding.targetNodeId!==e.targetNodeId){const t=new Error("Proxy claim response does not match the persisted pending identity.");throw Object.assign(t,{statusCode:409,code:uo.BindingIdentityConflict,retryable:!1,claimId:e.claimId,compensationRequired:!0}),t}}compensationCredential(e,t){return{id:`proxy_compensation_${t.binding.id}`,nodeId:t.target.id,proxyOrigin:e.proxyOrigin,proxyBindingId:t.binding.id,targetNodeId:t.target.id,sourceControlPlaneId:e.sourceControlPlaneId,bindingKeyId:e.bindingKeyId,credential:e.credential,createdAt:e.createdAt,updatedAt:hl()}}compensationError(e,t,n,i=503,s="CONTROL_PLANE_PROXY_COMPENSATION_REQUIRED",a=!0,o){const r=new Error(t,void 0===n?void 0:{cause:n});return Object.assign(r,{statusCode:i,code:s,retryable:a,claimId:e.claimId,compensationRequired:!0,...o?{details:o}:{}}),r}async withClaimLock(e,t){const n=(this.claimOperations.get(e)??Promise.resolve()).catch(()=>{}).then(t);this.claimOperations.set(e,n);try{return await n}finally{this.claimOperations.get(e)===n&&this.claimOperations.delete(e)}}finishRevokedNodeDelete(e){const t=this.options.deleteNode(e);return this.options.privateStore.deleteNodeCredential(e),{deleted:t,revoke:{mode:"revoked",orphanRisk:!1}}}forceDeleteNode(e){const t=this.options.deleteNode(e);return this.options.privateStore.deleteNodeCredential(e),{deleted:t,revoke:{mode:"forced",orphanRisk:!0}}}}const Vh=f.z.object({id:fc.shape.id.optional(),name:fc.shape.name,source:lc,defaultImageSelection:fc.shape.defaultImageSelection,defaultNodeId:fc.shape.defaultNodeId,workspacePolicy:uc.optional(),labels:fc.shape.labels.optional()}),Kh={defaultRuntimeId:nd.shape.id.optional()},Yh=Vh.extend(Kh).strict().transform(({defaultRuntimeId:e,...t})=>({...t,source:lc.parse(t.source)})),Xh=Vh.omit({id:!0}).partial().extend(Kh).strict().transform(({defaultRuntimeId:e,...t})=>({...t,...t.source?{source:lc.parse(t.source)}:{}}));function Jh(e){return 1===Array.from(e).length&&!/[\p{L}\p{N}\s]/u.test(e)&&"/"!==e&&"\\"!==e}const Qh=f.z.string().refine(Jh,"Mention trigger must be one printable non-alphanumeric character other than / or \\.");function Zh(e){return 1===Array.from(e).length&&!/[\p{L}\p{N}\s]/u.test(e)&&"\\"!==e}const eg=f.z.string().refine(Zh,"Command trigger must be one printable non-alphanumeric character other than \\."),tg=f.z.object({publicBaseUrl:f.z.string().trim().max(2048).optional(),updateChannel:Kr.default("stable"),mentionTrigger:Qh.default("@"),commandTrigger:eg.default("/"),diagnosticLogs:f.z.boolean().default(!1)}).strict().refine(e=>e.mentionTrigger!==e.commandTrigger,{path:["commandTrigger"],message:"Command and mention triggers must be different."}),ng=f.z.object({publicBaseUrl:f.z.string().trim().max(2048).optional(),updateChannel:Kr.optional(),mentionTrigger:Qh.optional(),commandTrigger:eg.optional(),diagnosticLogs:f.z.boolean().optional()}).strict(),ig=f.z.object({id:Mc.shape.id.optional(),name:Mc.shape.name,description:Mc.shape.description,cover:Mc.shape.cover,reference:Mc.shape.reference,pullPolicy:Mc.shape.pullPolicy.optional(),capabilities:f.z.array(f.z.string().trim().min(1).max(80)).optional(),optionalApps:f.z.array(f.z.string().trim().min(1).max(120)).optional(),defaultEnv:Mc.shape.defaultEnv.optional(),labels:Mc.shape.labels.optional()}).strict(),sg=ig.omit({id:!0}).partial().strict(),ag=f.z.object({name:$d.shape.name.optional(),channel:$d.shape.channel.optional(),enabled:f.z.boolean().optional(),token:$d.shape.token,defaultChatId:$d.shape.defaultChatId,allowedUserIds:f.z.array(f.z.string().trim().min(1).max(240)).optional(),pollIntervalMs:$d.shape.pollIntervalMs.optional(),settings:$d.shape.settings.optional()}).strict(),og=ag.extend({channel:$d.shape.channel,name:$d.shape.name.optional()}),rg=La.extend({id:La.shape.configHash}),cg=f.z.object({name:La.shape.name,description:La.shape.description,source:ja,action:Pa,policy:Da.partial().optional()}).strict(),dg=cg,lg=f.z.object({instanceIds:f.z.array(Nd.shape.id).min(1),target:Ma,enabled:f.z.boolean().optional()}).strict(),pg=f.z.object({configHash:La.shape.configHash,enabled:f.z.boolean().optional()}).strict(),ug=f.z.object({mode:f.z.enum(["local-static-key","paired-hmac","proxy-binding"]).default("local-static-key"),keyId:ed.shape.id.optional(),secret:f.z.string().trim().max(4096).optional(),pairedAt:ed.shape.createdAt.optional(),pairing:f.z.object({status:f.z.enum(["pending","paired","expired"]).default("pending"),joinToken:f.z.string().trim().max(4096).optional(),expiresAt:ed.shape.createdAt.optional()}).strict().optional()}).strict(),mg=f.z.object({autoImportAgentConfigs:f.z.boolean().optional(),defaultCodexPermissionMode:di.optional(),aiSessionHistoryLimit:f.z.number().int().min(1).max(us).optional(),aiSessionAttachmentRetentionDays:f.z.number().int().min(0).max(365).optional(),aiSessionMaxFileAttachmentBytes:f.z.number().int().positive().max(yn).optional()}).strict(),hg=f.z.object({id:Nd.shape.id.optional(),name:Nd.shape.name.optional(),projectId:Nd.shape.projectId,source:lc.optional(),sourceSnapshot:f.z.record(f.z.string(),f.z.unknown()).optional(),nodeId:Nd.shape.nodeId.optional(),runtimeId:Nd.shape.runtimeId.optional(),environmentSource:mr.optional(),imageSelection:Nd.shape.imageSelection,config:mg.optional(),modelSelection:Nd.shape.modelSelection.optional(),gitCredentialRetention:Am.optional(),start:f.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.environmentSource&&e.imageSelection&&t.addIssue({code:"custom",path:["environmentSource"],message:"environmentSource and imageSelection are mutually exclusive."}),e.gitCredentialRetention&&"local-folder"===e.source?.type&&t.addIssue({code:"custom",path:["gitCredentialRetention"],message:"Git credential retention requires a Git source."})}),gg=f.z.object({name:Nd.shape.name.optional(),config:mg.optional(),modelSelection:Nd.shape.modelSelection.unwrap().optional()}).strict(),fg=f.z.object({name:yc.shape.name,endpoint:yc.shape.endpoint,key:yc.shape.key,model:yc.shape.model,modelNames:yc.shape.modelNames.optional(),protocols:yc.shape.protocols.optional(),app:yc.shape.app,enabled:yc.shape.enabled.optional(),order:yc.shape.order.optional(),labels:yc.shape.labels.optional()}).strict(),yg=fg.omit({key:!0}).extend({key:yc.shape.key.optional()}).strict(),bg=fg.partial().strict(),vg=f.z.object({endpoint:yc.shape.endpoint,key:yc.shape.key.optional(),existingModelId:yc.shape.id.optional()}).strict(),Ig=vg.extend({model:yc.shape.model,app:yc.shape.app.optional(),protocol:f.z.enum(["openai-responses","openai-chat-completions","anthropic-messages"]).optional()}).strict().refine(e=>Boolean(e.protocol||e.app),{message:"A model protocol is required.",path:["protocol"]}),xg=f.z.object({id:ed.shape.id.optional(),name:ed.shape.name,connectionMode:ed.shape.connectionMode.optional(),connectionPath:ed.shape.connectionPath.optional(),connectionEnabled:ed.shape.connectionEnabled.optional(),auth:ug.optional(),joinToken:f.z.string().trim().min(1).max(4096).optional(),endpoint:ed.shape.endpoint,controlEndpoint:ed.shape.controlEndpoint,containerEndpoint:ed.shape.containerEndpoint,publicWebBase:ed.shape.publicWebBase,status:f.z.enum(["unknown","online","offline","degraded"]).optional(),health:f.z.enum(["unknown","ok","degraded","failed"]).optional(),capabilities:ed.shape.capabilities.optional(),labels:ed.shape.labels.optional(),lastSeenAt:ed.shape.lastSeenAt}).strict(),wg=f.z.object({name:ed.shape.name.optional(),connectionMode:ed.shape.connectionMode.unwrap().optional(),connectionPath:ed.shape.connectionPath.unwrap().optional(),connectionEnabled:ed.shape.connectionEnabled.unwrap().optional(),auth:ug.optional(),endpoint:ed.shape.endpoint,controlEndpoint:ed.shape.controlEndpoint,containerEndpoint:ed.shape.containerEndpoint,publicWebBase:ed.shape.publicWebBase,status:ed.shape.status.unwrap().optional(),health:ed.shape.health.unwrap().optional(),capabilities:ed.shape.capabilities.unwrap().optional(),labels:ed.shape.labels.unwrap().optional(),lastSeenAt:ed.shape.lastSeenAt}).strict(),Sg=f.z.object({controlPlaneUrl:f.z.string().trim().url().max(2048),joinToken:f.z.string().trim().min(1).max(4096),controlPlaneName:f.z.string().trim().min(1).max(160).optional(),activate:f.z.boolean().optional()}).strict(),Ag=f.z.object({nodeName:f.z.string().trim().min(1).max(160).optional(),expiresInMs:f.z.number().int().positive().max(36e5).optional()}).strict(),Eg=f.z.object({id:f.z.string().min(1),endpoint:f.z.string().min(1),nodeId:f.z.string().min(1),keyId:f.z.string().min(1),secret:f.z.string().min(1),pairedAt:f.z.string().min(1),createdAt:f.z.string().min(1),updatedAt:f.z.string().min(1)}).strict();class _g{options;activePendingPairingRevokes=new Set;constructor(e){this.options=e}async syncLocal(){const e={[this.options.localNodeLabel]:"true",[this.options.builtinNodeLabel]:"true"},t=process.env.TASK_HANDOFF_NODE_AGENT_TOKEN?.trim()||void 0,n=process.env.TASK_HANDOFF_NODE_AGENT_CONTROL_ENDPOINT||process.env.TASK_HANDOFF_NODE_AGENT_ENDPOINT||"http://127.0.0.1:8091",i=function(e){return Zm(e)?"local-ipc":"local-loopback"}(n),s=ed.parse({id:"node_local_probe",name:"Local Node Probe",connectionMode:i,auth:{mode:"local-static-key",secret:t},labels:e,createdAt:hl(),updatedAt:hl()}),a=await this.inspect(n,s),o=hl(),r=this.options.nodes.get(a.nodeId);for(const e of this.options.nodes.list())"true"===e.labels[this.options.localNodeLabel]&&e.id!==a.nodeId&&this.options.nodes.delete(e.id);return this.options.nodes.put(ed.parse({...r||{},id:a.nodeId,name:r?.name||"Local Node",connectionMode:i,auth:{mode:"local-static-key",secret:t},endpoint:n,controlEndpoint:n,containerEndpoint:process.env.TASK_HANDOFF_NODE_AGENT_CONTAINER_URL,publicWebBase:process.env.TASK_HANDOFF_INSTANCE_PUBLIC_WEB_BASE,status:"online",health:"ok",capabilities:{...r?.capabilities||{},agent:Ph(a.data)},labels:{...r?.labels||{},...e},createdAt:r?.createdAt||o,updatedAt:o}))}async create(e){const t=xg.parse(e),n=hl(),i=t.connectionMode||"direct-http";let s="auth"in(e&&"object"==typeof e&&!Array.isArray(e)?e:{})?t.auth:{mode:"local-ipc"===i||"local-loopback"===i?"local-static-key":"paired-hmac"};const a="direct-http"===i||"reverse-wss"===i;if(a&&"paired-hmac"!==s.mode)throw Tg("Remote node connections require paired-HMAC authentication.","NODE_AGENT_REMOTE_REQUIRES_PAIRED_HMAC");const o=t.controlEndpoint||t.endpoint;if(!o&&"reverse-wss"!==i)throw Tg("Node agent direct HTTP mode requires an endpoint.","NODE_AGENT_ENDPOINT_REQUIRED");const r=t.joinToken&&o?await this.completePairing(o,t.joinToken):void 0;let c,d=!1;try{if(c=r&&o?this.pendingPairingRevoke(o,r):void 0,c&&(this.activePendingPairingRevokes.add(c.id),this.options.pendingPairingRevokes?.put(c)),r){if(r.invalidResponse||r.unsafePublicIdentifiers)throw Object.assign(new Error("Node agent pairing response reflected secret material in a public identifier."),{statusCode:502,code:"NODE_AGENT_PAIRING_RESPONSE_INVALID"});s={mode:"paired-hmac",keyId:r.keyId,secret:r.secret,pairedAt:r.pairedAt,pairing:{status:"paired"}}}if(a&&!s.secret)throw Tg("Remote node connections require a paired node secret or join token.","NODE_AGENT_REMOTE_SECRET_REQUIRED");if(a&&!s.keyId)throw Tg("Remote node connections require a paired key id.","NODE_AGENT_REMOTE_KEY_ID_REQUIRED");const e=t.id||r?.nodeId||Il("node"),u=ed.parse({id:e,name:t.name,connectionMode:i,auth:s,labels:t.labels||{},createdAt:n,updatedAt:n}),m="reverse-wss"===i&&(t.id||r?.nodeId)?void 0:await this.inspect(o||"",u),h=t.id||r?.nodeId||m?.nodeId||e;if(!h)throw Tg("Node id is required.","NODE_ID_REQUIRED");if(r&&t.id&&t.id!==r.nodeId)throw Tg(`Paired node id ${r.nodeId} does not match requested node id ${t.id}.`,"NODE_AGENT_ID_MISMATCH");if(t.id&&m?.nodeId&&m.nodeId!==t.id)throw Tg(`Node agent id ${m.nodeId} does not match requested node id ${t.id}.`,"NODE_AGENT_ID_MISMATCH");if(r&&m?.nodeId&&m.nodeId!==r.nodeId)throw Object.assign(new Error("Node agent health identity did not match the completed pairing."),{statusCode:502,code:"NODE_AGENT_PAIRING_IDENTITY_MISMATCH"});const{joinToken:g,...f}=t,y=ed.parse({...f,id:h,connectionMode:i,auth:s,endpoint:o,controlEndpoint:o,status:t.status||(m?"online":"unknown"),health:t.health||(m?"ok":"unknown"),capabilities:{...t.capabilities||{},...m?{agent:Ph(m.data)}:{}},labels:t.labels||{},createdAt:n,updatedAt:n});if(r&&(l=y,p=r.secret,Rg(Dh(l),p)))throw Object.assign(new Error("Node agent health response reflected pairing secret material."),{statusCode:502,code:"NODE_AGENT_PAIRING_SECRET_REFLECTED"});d=!0;const b=this.options.nodes.put(y);return this.clearPendingPairingRevoke(c,r),b}catch(e){if(r&&o){const t=this.pairingPersistence(r);if("present"===t.state)return this.clearPendingPairingRevoke(c,r),t.node;if("unknown"===t.state&&d)throw Og(Object.assign(new Error("Node creation persistence outcome is uncertain; pairing compensation is pending."),{statusCode:503,code:"NODE_AGENT_PAIRING_PERSISTENCE_UNCERTAIN",retryable:!0}),r.secret);throw await this.compensatePairing(o,r,e),this.clearPendingPairingRevoke(c,r),Og(e,r.secret)}throw e}finally{c&&this.activePendingPairingRevokes.delete(c.id)}var l,p}async recoverPendingPairingRevokes(){const e=(this.options.pendingPairingRevokes?.list()||[]).filter(e=>!this.activePendingPairingRevokes.has(e.id));await Promise.all(e.map(async e=>{try{const t={nodeId:e.nodeId,keyId:e.keyId,secret:e.secret,pairedAt:e.pairedAt,invalidResponse:!1,unsafePublicIdentifiers:!1},n=this.pairingPersistence(t);if("present"===n.state)return void this.clearPendingPairingRevoke(e,t);if("unknown"===n.state)return;await this.compensatePairing(e.endpoint,t,Object.assign(new Error("Recovering a pending pairing revocation."),{code:"NODE_AGENT_PAIRING_REVOCATION_PENDING"})),this.clearPendingPairingRevoke(e,t)}catch{}}))}pendingPairingRevoke(e,t){if(!this.options.pendingPairingRevokes)return;const n=hl();return Eg.parse({id:Il("pairing_revoke"),endpoint:e,nodeId:t.nodeId,keyId:t.keyId,secret:t.secret,pairedAt:t.pairedAt,createdAt:n,updatedAt:n})}pairingPersistence(e){let t;try{t=this.options.nodes.get(e.nodeId)}catch{return{state:"unknown"}}return"paired-hmac"===t?.auth.mode&&t.auth.keyId===e.keyId&&t.auth.secret===e.secret?{state:"present",node:t}:{state:"absent"}}clearPendingPairingRevoke(e,t){if(e)try{this.options.pendingPairingRevokes?.delete(e.id)}catch(e){try{this.options.warn({nodeId:t?Ng(t.nodeId,t.secret):void 0,keyId:t?Ng(t.keyId,t.secret):void 0,errorCode:"NODE_AGENT_PAIRING_OUTBOX_CLEANUP_FAILED"},"node agent pairing outbox cleanup failed; recovery will retry")}catch{}}}async inspect(e,t){const n="/health",i=t?Xm(t,{method:"GET",pathWithQuery:`/api/node-agent${n}`}):{},s=await ih(this.options.fetchImpl,e,n,{headers:i}),a=await s.json().catch(()=>({}));if(!s.ok)throw this.options.warn(Cg({nodeEndpoint:e,statusCode:s.status,errorCode:"NODE_AGENT_HEALTH_FAILED"},t?.auth.secret),"node agent health check failed"),Object.assign(new Error(a.error?.message||`Node agent health check failed with HTTP ${s.status}`),{statusCode:s.status,code:"NODE_AGENT_HEALTH_FAILED"});const o="string"==typeof a.data?.nodeId&&a.data.nodeId.trim()?a.data.nodeId.trim():void 0;if(!o)throw this.options.warn(Cg({nodeEndpoint:e,errorCode:"NODE_AGENT_ID_MISSING"},t?.auth.secret),"node agent health response missing node id"),Object.assign(new Error("Node agent health response did not include nodeId."),{statusCode:502,code:"NODE_AGENT_ID_MISSING"});const r=Pl(Wr,a.data?.build);return a.data?.protocolVersion!==qo&&this.options.warn(Cg({nodeId:o,nodeEndpoint:e,expectedProtocolVersion:qo,actualProtocolVersion:a.data?.protocolVersion,build:r.success?r.data:void 0,errorCode:"PROTOCOL_VERSION_MISMATCH"},t?.auth.secret),"node agent protocol version mismatch"),this.options.info(Cg({nodeId:o,nodeEndpoint:e,protocolVersion:a.data.protocolVersion,build:r.success?r.data:void 0},t?.auth.secret),"node agent health check ok"),{nodeId:o,data:a.data||{}}}async completePairing(e,t){const n=await this.options.fetchImpl(`${e.replace(/\/$/,"")}/api/node-agent/pairing/complete`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({joinToken:t,controlPlaneName:"Control Plane"})}),i=await n.json().catch(()=>({}));if(!n.ok)throw Object.assign(new Error(i.error?.message||`Node agent pairing failed with status ${n.status}.`),{statusCode:n.status,code:"NODE_AGENT_PAIRING_FAILED"});const s=i.data;if("string"!=typeof s?.nodeId||!s.nodeId.trim()||"string"!=typeof s?.keyId||!s.keyId.trim()||"string"!=typeof s?.secret||!s.secret.trim())throw Object.assign(new Error("Node agent pairing response did not include nodeId, keyId, and secret."),{statusCode:502,code:"NODE_AGENT_PAIRING_RESPONSE_INVALID"});const a=Pl(gd,s),o=s.nodeId.trim(),r=s.keyId.trim(),c=s.secret.trim();return{nodeId:o,keyId:r,secret:c,pairedAt:a.success?a.data.pairedAt:hl(),invalidResponse:!a.success,unsafePublicIdentifiers:o.includes(c)||r.includes(c)}}async compensatePairing(e,t,n){const i="/pairing/current",s=`/api/node-agent${i}`,a={id:t.nodeId,connectionMode:"direct-http",auth:{mode:"paired-hmac",keyId:t.keyId,secret:t.secret}};try{const o=await ih(this.options.fetchImpl,e,i,{method:"DELETE",headers:Xm(a,{method:"DELETE",pathWithQuery:s}),signal:AbortSignal.timeout(1e4)}),r=await o.json().catch(()=>({}));if(!o.ok)throw Object.assign(new Error(`Node agent pairing revoke failed with HTTP ${o.status}.`),{statusCode:o.status,code:kg(r.error?.code,t.secret,"NODE_AGENT_PAIRING_REVOKE_FAILED"),retryable:408===o.status||429===o.status||o.status>=500});const c=Pl(yd,r.data);if(!c.success)throw Object.assign(new Error("Node agent pairing revoke receipt was invalid."),{statusCode:502,code:"NODE_AGENT_PAIRING_REVOKE_RECEIPT_INVALID",retryable:!1});if(c.data.keyId!==t.keyId)throw Object.assign(new Error("Node agent pairing revoke receipt did not match the paired key."),{statusCode:502,code:"NODE_AGENT_PAIRING_REVOKE_RECEIPT_MISMATCH",retryable:!1});try{this.options.info({nodeId:Ng(t.nodeId,t.secret),keyId:Ng(t.keyId,t.secret),originalErrorCode:zg(n,t.secret)},"node agent pairing revoked after node creation failed")}catch{}}catch(e){const i={nodeId:Ng(t.nodeId,t.secret),keyId:Ng(t.keyId,t.secret),originalErrorCode:zg(n,t.secret),compensationErrorCode:zg(e,t.secret)};try{this.options.warn(i,"node agent pairing compensation failed")}catch{}throw Object.assign(new Error("Node creation failed after pairing, and the remote pairing could not be revoked."),{statusCode:502,code:"NODE_AGENT_PAIRING_COMPENSATION_FAILED",retryable:(o=e,!o||"object"!=typeof o||!("retryable"in o)||"boolean"!=typeof o.retryable||o.retryable),details:i})}var o}}function Tg(e,t){return Object.assign(new Error(e),{statusCode:400,code:t})}function zg(e,t){return kg(e&&"object"==typeof e&&"code"in e?e.code:void 0,t,"UNKNOWN_ERROR")}function kg(e,t,n){return"string"!=typeof e||!/^[A-Z][A-Z0-9_]{0,127}$/.test(e)||e.includes(t)?n:e}function Ng(e,t){return e.includes(t)?"[redacted]":e}function Cg(e,t){if(!t)return e;const n=e=>"string"==typeof e?e.includes(t)?"[redacted]":e:Array.isArray(e)?e.map(n):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).map(([e,i])=>[e.includes(t)?"[redacted-key]":e,n(i)])):e;return n(e)}function Rg(e,t){return"string"==typeof e?e.includes(t):Array.isArray(e)?e.some(e=>Rg(e,t)):!(!e||"object"!=typeof e)&&Object.entries(e).some(([e,n])=>e.includes(t)||Rg(n,t))}function Og(e,t){const n=e instanceof Error&&!e.message.includes(t)?e.message:"Node creation failed after pairing.",i=e&&"object"==typeof e&&"statusCode"in e&&"number"==typeof e.statusCode?e.statusCode:502,s=Object.assign(new Error(n),{statusCode:i,code:zg(e,t)});return e&&"object"==typeof e&&"retryable"in e&&"boolean"==typeof e.retryable&&Object.assign(s,{retryable:e.retryable}),s}class jg{values=new Map;put(e,t,n=Date.now()){this.prune(n),this.values.set(e,t)}take(e,t=Date.now()){this.prune(t);const n=this.values.get(e);return n&&this.values.delete(e),n}peek(e,t=Date.now()){return this.prune(t),this.values.get(e)}delete(e,t=Date.now()){this.prune(t);const n=this.values.get(e);return n&&this.values.delete(e),n}list(e=Date.now()){return this.prune(e),[...this.values.values()]}prune(e=Date.now()){for(const[t,n]of this.values)Date.parse(n.expiresAt)<=e&&this.values.delete(t)}}const Pg=f.z.object({joinToken:f.z.string().trim().min(1).max(4096),nodeId:ed.shape.id,nodeName:ed.shape.name.optional(),keyId:f.z.string().trim().min(1).max(160),secret:f.z.string().trim().min(1).max(4096),pairedAt:f.z.string().datetime().optional()}).strict();class Dg{options;invites=new jg;completedInvites=new jg;constructor(e){this.options=e}createInvite(e={}){const t=Ag.parse(e&&"object"==typeof e?e:{}),n=xl(),i={id:Il("node_join"),tokenHash:Lg(n),expiresAt:new Date(Date.now()+(t.expiresInMs||6e5)).toISOString(),...t.nodeName?{nodeName:t.nodeName}:{}};return this.invites.put(i.tokenHash,i),{id:i.id,joinToken:n,expiresAt:i.expiresAt}}status(e){const t=this.completedInvites.peek(e);if(t)return{id:e,status:"completed",nodeId:t.nodeId};if(this.invites.list().some(t=>t.id===e))return{id:e,status:"pending"};throw Object.assign(new Error(`Node join invite ${e} was not found or has expired.`),{statusCode:404,code:"NODE_JOIN_INVITE_NOT_FOUND"})}complete(e){const t=Pg.parse(e),n=Lg(t.joinToken),i=this.invites.take(n);if(!i)throw Object.assign(new Error("Node join token is invalid or expired."),{statusCode:401,code:"NODE_JOIN_TOKEN_INVALID"});const s=hl();if(this.options.nodes.get(t.nodeId))throw Object.assign(new Error(`Node ${t.nodeId} already exists in this control-plane.`),{statusCode:409,code:"NODE_JOIN_NODE_ALREADY_EXISTS"});const a=this.options.nodes.put(ed.parse({id:t.nodeId,name:t.nodeName||i.nodeName||t.nodeId,connectionMode:"reverse-wss",auth:{mode:"paired-hmac",keyId:t.keyId,secret:t.secret,pairedAt:t.pairedAt||s,pairing:{status:"paired"}},status:"unknown",health:"unknown",capabilities:{},labels:{},createdAt:s,updatedAt:s}));return this.completedInvites.put(i.id,{nodeId:a.id,expiresAt:new Date(Date.now()+6e5).toISOString()}),{node:a,inviteId:i.id}}}function Lg(e){return i.createHash("sha256").update(e).digest("hex")}function Mg(e,t){const n=Ug(e);return n.pathname=`${n.pathname.replace(/\/+$/,"")}/${t.replace(/^\/+/,"")}`,n.search="",n.hash="",n.toString()}function qg(e,t){const n=Ug(e);return n.pathname.replace(/\/+$/,"").endsWith(`/${t}`)?n.toString():Mg(n.toString(),t)}function Ug(e){let t;try{t=new URL(e.trim())}catch{throw Hg("MODEL_ENDPOINT_INVALID","The model endpoint must be a valid HTTP or HTTPS URL.",400)}if("http:"!==t.protocol&&"https:"!==t.protocol||t.username||t.password)throw Hg("MODEL_ENDPOINT_INVALID","The model endpoint must be an HTTP or HTTPS URL without embedded credentials.",400);return t}async function $g(e,t,n){try{return await e(t,{...n,redirect:"error",signal:AbortSignal.timeout(15e3)})}catch(e){const t=e&&"object"==typeof e&&"name"in e&&"TimeoutError"===e.name;throw Hg(t?"MODEL_ENDPOINT_TIMEOUT":"MODEL_ENDPOINT_UNREACHABLE",t?"The model endpoint timed out.":"The model endpoint could not be reached.",t?504:502)}}async function Bg(e,t){const n=await e.text();if(n.length>1e6)throw Hg(t,"The model endpoint response was too large.",502);try{const e=JSON.parse(n);if(!e||"object"!=typeof e||Array.isArray(e))throw new Error("not an object");return e}catch{throw Hg(t,"The model endpoint returned invalid JSON.",502)}}function Fg(e,t){return Hg(e,401===t||403===t?"The model endpoint rejected the API key.":"The model endpoint rejected the request.",502,t)}function Hg(e,t,n,i){return Object.assign(new Error(t),{code:e,statusCode:n,...i?{details:{upstreamStatus:i}}:{}})}function Gg(e,t){e.includes(t)||e.push(t)}function Wg(e){const t=new Set;return e.filter(e=>!t.has(e.id)&&(t.add(e.id),!0))}class Vg{options;constructor(e){this.options=e}list(){return this.listAll().map(qh)}async listFederated(e,t=!1){const n=this.options.listNodes(),i=t?this.options.gateway.readFleetModels(n):await this.options.gateway.listFleetModels(n,{signal:e});t&&this.options.gateway.refreshFleetModels(n);const s=new Map;for(const e of this.listAll())s.set(e.id,{id:e.id,model:qh(e),locations:[{type:"control-plane",name:e.name,enabled:e.enabled,order:e.order}],referenceCount:0});for(const{nodeId:e,model:t}of i.items){const{referenceCount:n,...i}=t,a=s.get(t.id);a?(a.locations.push({type:"node",nodeId:e,name:t.name,enabled:t.enabled,order:t.order,referenceCount:t.referenceCount}),a.referenceCount+=t.referenceCount):s.set(t.id,{id:t.id,model:i,locations:[{type:"node",nodeId:e,name:t.name,enabled:t.enabled,order:t.order,referenceCount:t.referenceCount}],referenceCount:t.referenceCount})}return Ac.parse({models:[...s.values()].sort((e,t)=>e.model.order-t.model.order||e.model.name.localeCompare(t.model.name)),nodeDiagnostics:i.nodeErrors.map(e=>({nodeId:e.nodeId,code:e.code,message:e.message})),updatedAt:hl()})}create(e){const t=fg.parse(e),n=t.protocols?.length?t.protocols:"claude"===t.app?["anthropic-messages"]:"opencode"===t.app?["openai-chat-completions"]:["openai-responses"],i=Kg(t.modelNames,t.model),s={...t,modelNames:i,model:i[0].name},a=hl(),o=Ec(s),r=this.options.models.get(o),c=yc.parse({...s,protocols:n,id:o,enabled:t.enabled??!0,order:t.order??this.nextOrder(),labels:t.labels||{},createdAt:r?.createdAt||a,updatedAt:a});return qh(this.options.models.put(c))}copy(e,t){const n=this.requireSecret(e),i=yg.parse(t),s={...i,key:i.key?.trim()||n.key},a=Kg(s.modelNames,s.model),o=Ec({...s,model:a[0].name});if(o===n.id)throw Object.assign(new Error("Change the model, endpoint, app, or API key before creating a copy."),{statusCode:409,code:"MODEL_COPY_UNCHANGED"});if(this.options.models.get(o))throw Object.assign(new Error(`Model ${o} already exists.`),{statusCode:409,code:"MODEL_COPY_CONFLICT"});return this.create(s)}update(e,t){const n=bg.parse(t),i=this.requireSecret(e),s=n.modelNames?.length?Kg(n.modelNames,n.model||i.model):n.model?Kg(void 0,n.model):Kg(i.modelNames,i.model),a=n.protocols?.length?n.protocols:i.protocols?.length?i.protocols:"claude"===(o=n.app||i.app)?["anthropic-messages"]:"opencode"===o?["openai-chat-completions"]:["openai-responses"];var o;const r=yc.parse({...i,...n,key:n.key?.trim()?n.key:i.key,protocols:a,modelNames:s,model:s[0].name,createdAt:i.createdAt,updatedAt:hl()}),c=Ec(r);return qh(this.options.models.put(yc.parse({...r,id:c})))}async delete(e){this.requireSecret(e);const t=await this.references(e);if(t.length)throw Object.assign(new Error(`Model ${e} is referenced by managed instances or AI Sessions.`),{statusCode:409,code:"MODEL_IN_USE",details:{references:t}});return this.options.models.delete(e)}reorder(e){const t=[...new Set(e)],n=new Map(this.options.models.list().map(e=>[e.id,e]));for(const e of t)n.has(e)||Fh("MODEL_NOT_FOUND",`Model ${e} was not found.`);return t.forEach((e,t)=>{const i=n.get(e);this.options.models.put(yc.parse({...i,order:100*(t+1),updatedAt:hl()}))}),this.list()}createOnNode(e,t){return this.options.gateway.createModel(this.options.requireNode(e),t)}updateOnNode(e,t,n){return this.options.gateway.updateModel(this.options.requireNode(e),t,n)}deleteOnNode(e,t){return this.options.gateway.deleteModel(this.options.requireNode(e),t)}discover(e){const t=vg.parse(e);return async function(e,t){const n=function(e){const t=Ug(e),n=[],i=t.pathname.split("/").filter(Boolean).at(-1)||"";return Gg(n,Mg(t.toString(),/^v\d+$/.test(i)?"models":"v1/models")),Gg(n,new URL("/v1/models",t.origin).toString()),Gg(n,new URL("/models",t.origin).toString()),n}(t.endpoint),i=Date.now();let s;for(const a of n){const n=await $g(e,a,{method:"GET",headers:{accept:"application/json",authorization:`Bearer ${t.key}`}});if(404===n.status||405===n.status){s=n.status;continue}if(!n.ok)throw Fg("MODEL_DISCOVERY_FAILED",n.status);const o=await Bg(n,"MODEL_DISCOVERY_RESPONSE_INVALID"),r=Array.isArray(o.data)?o.data:void 0;if(!r)throw Hg("MODEL_DISCOVERY_RESPONSE_INVALID","The model endpoint returned an invalid model list.",502);const c=r.flatMap(e=>{if(!e||"object"!=typeof e||Array.isArray(e))return[];const t=e,n="string"==typeof t.id?t.id.trim():"";if(!n)return[];const i="string"==typeof t.owned_by?t.owned_by.trim():"";return[{id:n,...i?{ownedBy:i}:{}}]}).sort((e,t)=>e.id.localeCompare(t.id));return{models:Wg(c),latencyMs:Date.now()-i}}throw Hg("MODEL_DISCOVERY_UNSUPPORTED","No compatible model-list endpoint was found for this endpoint.",502,s)}(this.options.fetchImpl,this.resolvePrivateInput(t))}test(e){const t=Ig.parse(e);return async function(e,t){const n=Date.now(),i=t.protocol||("claude"===t.app?"anthropic-messages":"opencode"===t.app?"openai-chat-completions":"openai-responses"),s="openai-responses"===i?await $g(e,qg(t.endpoint,"responses"),{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${t.key}`,"content-type":"application/json"},body:JSON.stringify({model:t.model,input:"Reply with OK.",max_output_tokens:32,stream:!1})}):"openai-chat-completions"===i?await $g(e,qg(t.endpoint,"chat/completions"),{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${t.key}`,"content-type":"application/json"},body:JSON.stringify({model:t.model,messages:[{role:"user",content:"Reply with OK."}],max_tokens:32,stream:!1})}):await $g(e,function(e){const t=Ug(e);if(/\/messages\/?$/.test(t.pathname))return t.toString();const n=t.pathname.split("/").filter(Boolean).at(-1)||"";return Mg(t.toString(),/^v\d+$/.test(n)?"messages":"v1/messages")}(t.endpoint),{method:"POST",headers:{accept:"application/json","anthropic-version":"2023-06-01","content-type":"application/json","x-api-key":t.key},body:JSON.stringify({model:t.model,max_tokens:8,messages:[{role:"user",content:"Reply with OK."}]})});if(!s.ok)throw Fg("MODEL_TEST_FAILED",s.status);if((await Bg(s,"MODEL_TEST_RESPONSE_INVALID")).error)throw Hg("MODEL_TEST_RESPONSE_INVALID","The model endpoint returned an error payload.",502);return{success:!0,latencyMs:Date.now()-n}}(this.options.fetchImpl,this.resolvePrivateInput(t))}discoverOnNode(e,t){const n=this.options.requireNode(e);return Xg(n),this.options.gateway.discoverModels(n,t)}testOnNode(e,t){const n=this.options.requireNode(e);return Xg(n),this.options.gateway.testModel(n,t)}require(e,t=!1){const n=this.requireSecret(e);return t?n:qh(n)}async prepareAssignment(e,t){const n=await this.options.gateway.listModels(e),i={...t.modelEntityIds?.length?{modelEntityIds:[...new Set(t.modelEntityIds.map(e=>e.trim()).filter(Boolean))]}:{},...null===t.codexModelHash?{codexModelHash:null}:t.codexModelHash?.trim()?{codexModelHash:t.codexModelHash.trim()}:{},...null===t.claudeModelHash?{claudeModelHash:null}:t.claudeModelHash?.trim()?{claudeModelHash:t.claudeModelHash.trim()}:{},...null===t.opencodeModelHash?{opencodeModelHash:null}:t.opencodeModelHash?.trim()?{opencodeModelHash:t.opencodeModelHash.trim()}:{}},s=i.modelEntityIds||[],a=this.listAll(),o=[];for(const t of s){const i=a.find(e=>e.id===t);if(i){Qg(i),await this.options.gateway.deployModel(e,i.id,i),o.push(i);continue}const s=n.find(e=>e.id===t);s||Fh("MODEL_NOT_FOUND",`Model ${t} was not found on control-plane or node ${e.id}.`),Qg(s),o.push(Yg(s))}const r=async(t,i)=>{if(null===i)return;const s=i?this.listAll().find(e=>e.id===i):a.find(e=>e.enabled&&Zg(e,t));if(s)return Jg(s,t),await this.options.gateway.deployModel(e,s.id,s),s.id;if(!i)return;const o=n.find(e=>e.id===i);return o||Fh("MODEL_NOT_FOUND",`Model ${i} was not found on control-plane or node ${e.id}.`),Jg(o,t),o.id},c=e=>o.find(t=>Zg(t,e))?.id;s.length&&(i.codexModelHash=c("codex"),i.claudeModelHash=c("claude"),i.opencodeModelHash=c("opencode"));const d=s.length?i.codexModelHash:await r("codex",i.codexModelHash),l=s.length?i.claudeModelHash:await r("claude",i.claudeModelHash),p=s.length?i.opencodeModelHash:await r("opencode",i.opencodeModelHash),u={modelSelection:i,modelEntityIds:s,codexModelHash:d,claudeModelHash:l,opencodeModelHash:p},m=e.capabilities.agent;if(rd(m&&"object"==typeof m&&!Array.isArray(m)?m.capabilities:void 0).managedModels.multiEntityAssignment)return u;const{modelEntityIds:h,...g}=i;return{modelSelection:g,codexModelHash:d,claudeModelHash:l,opencodeModelHash:p}}async ensureInstanceAssignment(e){const t=this.options.requireNode(e.nodeId),n=await this.prepareAssignment(t,e.modelSelection);return this.options.gateway.assignInstanceModels(t,e.id,n)}listAll(){return this.options.models.list().map(e=>this.normalize(e)).sort((e,t)=>e.order-t.order||e.createdAt.localeCompare(t.createdAt)||e.id.localeCompare(t.id))}requireSecret(e){const t=this.options.models.get(e);return t||Fh("MODEL_NOT_FOUND",`Model ${e} was not found.`),this.normalize(t)}normalize(e){const t=function(e){if(e&&"object"==typeof e&&!Array.isArray(e)){const t={...e};if(!("app"in t)){const e=Array.isArray(t.apps)?t.apps:[];t.app=e.includes("claude")&&!e.includes("codex")?"claude":"codex"}Array.isArray(t.protocols)&&0!==t.protocols.length||(t.protocols="claude"===t.app?["anthropic-messages"]:"opencode"===t.app?["openai-chat-completions"]:["openai-responses"]);const n=Array.isArray(t.modelNames)&&t.modelNames.length>0?t.modelNames:[{name:t.model,order:100}],i=new Set,s=n.flatMap(e=>{if(!e||"object"!=typeof e)return[];const t=e;return"string"!=typeof t.name||!t.name.trim()||i.has(t.name.trim())?[]:(i.add(t.name.trim()),[{name:t.name.trim(),order:"number"==typeof t.order?t.order:0}])}).sort((e,t)=>e.order-t.order||e.name.localeCompare(t.name)).map((e,t)=>({name:e.name,order:100*(t+1)}));return t.modelNames=0===s.length&&"string"==typeof t.model&&t.model.trim()?[{name:t.model.trim(),order:100}]:s,t.model=t.modelNames[0]?.name||t.model,delete t.apps,yc.parse(t)}return yc.parse(e)}(e);return t!==e&&this.options.models.put(t),t}nextOrder(){return this.options.models.list().reduce((e,t)=>Math.max(e,t.order),0)+100}async references(e){const t=await(this.options.listInstances?.())||[],n=[];for(const i of t)(i.modelSelection.modelEntityIds?.length?i.modelSelection.modelEntityIds:[i.modelSelection.codexModelHash,i.modelSelection.claudeModelHash,i.modelSelection.opencodeModelHash]).includes(e)&&n.push({kind:"instance",instanceId:i.id});const i=await(this.options.listAiSessions?.())||{instances:[]};for(const t of i.instances)for(const i of t.aiSessions.sessions)i.modelSelection?.modelEntityId===e&&n.push({kind:"ai-session",instanceId:t.instanceId,aiSessionId:i.id});const s=[];if(await Promise.all(this.options.listAiSessionHistory?t.map(async t=>{try{const i=await this.options.listAiSessionHistory(t.id);for(const s of i.items)s.modelSelection?.modelEntityId===e&&n.push({kind:"history",instanceId:t.id,aiSessionId:s.id})}catch(e){s.push({instanceId:t.id,code:e&&"object"==typeof e&&"code"in e&&"string"==typeof e.code?e.code:"AI_SESSION_HISTORY_UNAVAILABLE"})}}):[]),s.length&&0===n.length)throw Object.assign(new Error("Model references could not be verified for every managed instance."),{statusCode:409,code:"MODEL_REFERENCE_CHECK_INCOMPLETE",details:{diagnostics:s}});return n.filter((e,t,n)=>n.findIndex(t=>t.kind===e.kind&&t.instanceId===e.instanceId&&t.aiSessionId===e.aiSessionId)===t).sort((e,t)=>e.instanceId.localeCompare(t.instanceId)||e.kind.localeCompare(t.kind)||(e.aiSessionId||"").localeCompare(t.aiSessionId||""))}resolvePrivateInput(e){const t=e.key?.trim()||(e.existingModelId?this.requireSecret(e.existingModelId).key:"");if(!t)throw Object.assign(new Error("An API key is required to contact the model endpoint."),{statusCode:400,code:"MODEL_API_KEY_REQUIRED"});return{...e,key:t}}}function Kg(e,t){const n=e?.length?e:[{name:t,order:100}],i=new Set;return n.map(e=>({name:e.name.trim(),order:e.order})).filter(e=>!(!e.name||i.has(e.name)||(i.add(e.name),0))).sort((e,t)=>e.order-t.order||e.name.localeCompare(t.name)).map((e,t)=>({name:e.name,order:100*(t+1)}))}function Yg(e){return yc.parse({id:e.id,name:e.name,endpoint:e.endpoint,key:"node-private",model:e.model,modelNames:e.modelNames,protocols:e.protocols,app:e.app,enabled:e.enabled,order:e.order,labels:e.labels,createdAt:e.createdAt,updatedAt:e.updatedAt})}function Xg(e){const t=e.capabilities.agent,n=t&&"object"==typeof t&&!Array.isArray(t)?t.capabilities:void 0;if(!n||"object"!=typeof n||Array.isArray(n)||!0!==n.modelEndpointProbe)throw Object.assign(new Error("This node agent does not support model endpoint discovery or testing."),{statusCode:409,code:"NODE_MODEL_ENDPOINT_PROBE_UNSUPPORTED"})}function Jg(e,t){if(!Zg(e,t))throw Object.assign(new Error(`Model ${e.id} is not a ${t} model.`),{statusCode:400,code:"MODEL_APP_MISMATCH"});if(!e.enabled)throw Object.assign(new Error(`Model ${e.id} is disabled.`),{statusCode:400,code:"MODEL_DISABLED"})}function Qg(e){if(!e.enabled)throw Object.assign(new Error(`Model ${e.id} is disabled.`),{statusCode:400,code:"MODEL_DISABLED"})}function Zg(e,t){const n="claude"===t?"anthropic-messages":"opencode"===t?"openai-chat-completions":"openai-responses";return e.protocols?.length?e.protocols.includes(n):e.app===t}class ef{requireNode;nodeAgentTransport;constructor(e){this.requireNode=e.requireNode,this.nodeAgentTransport=e.nodeAgentTransport}async request(e,t,n={},i){if(!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_UNREACHABLE"}),t}tf(e);const s=this.requireNode(e.nodeId),a=Uh(n.headers),o=performance.now(),r=await this.nodeAgentTransport(s).request(s,`/instances/${encodeURIComponent(e.id)}/proxy`,{method:"POST",headers:{"content-type":"application/json",...a[Au]?{[Au]:a[Au]}:{}},body:JSON.stringify({path:`/api/${t.replace(/^\/+/,"")}`,method:n.method||"GET",headers:a,body:(c=n.body,"string"==typeof c?c:null==c?void 0:String(c))})});var c;const d=performance.now()-o,l=_u(r.headers.get("server-timing"),Eu("node_transport",d));i?.({traceId:r.headers.get(Au)||void 0,serverTiming:l,nodeTransportMs:d});const p=await r.json().catch(()=>({}));if(!r.ok){const n=function(e){if(!e||"object"!=typeof e||Array.isArray(e))return;const t=e,n="string"==typeof t.code&&t.code.trim()?t.code:void 0,i="string"==typeof t.message&&t.message?t.message:void 0,s=t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?t.details:void 0,a="boolean"==typeof t.retryable?t.retryable:void 0;return n||i?{code:n,message:i,details:s,retryable:a}:void 0}(p.error),i=n?.message||function(e){if(!e||"object"!=typeof e||Array.isArray(e))return"";const t=e.message;return"string"==typeof t?t:""}(p.error)||`Instance request failed with HTTP ${r.status}`,s=500===r.status&&"NODE_AGENT_ERROR"===n?.code,a=new Error(i);throw Object.assign(a,{statusCode:s?502:r.status,code:s?"INSTANCE_PROXY_UPSTREAM_FAILED":n?.code||"INSTANCE_REQUEST_FAILED",...s?{retryable:!0}:"boolean"==typeof n?.retryable?{retryable:n.retryable}:{},...n?.details?{details:n.details}:{},instanceId:e.id,nodeId:e.nodeId,route:t}),a}return p.data??p}async proxyHttp(e,t,n={}){if("online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_UNREACHABLE"}),t}if(!e.target.web){const t=new Error(`Instance ${e.name} web endpoint is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_WEB_UNREACHABLE"}),t}tf(e);const i=this.requireNode(e.nodeId),s=await this.nodeAgentTransport(i).requestStream(i,`/instances/${encodeURIComponent(e.id)}/proxy/stream`,{method:"POST",headers:{"content-type":"application/json"},signal:n.signal,body:JSON.stringify({path:t,method:n.method||"GET",headers:Uh(n.headers),...(a=n.body,null==a?{}:"string"==typeof a?{body:a}:Buffer.isBuffer(a)?{bodyBase64:a.toString("base64")}:a instanceof Uint8Array?{bodyBase64:Buffer.from(a).toString("base64")}:{body:String(a)})})});var a;return{status:s.status||502,headers:Object.fromEntries(s.headers.entries()),body:s.body}}proxyWebSocket(e,t,n,i,s={}){if(!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=new Error(`Instance ${e.name} web endpoint is not reachable.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_WEB_UNREACHABLE"}),t}tf(e);const a=this.requireNode(e.nodeId),o=n.startsWith("/")?n.slice(1):n;this.nodeAgentTransport(a).proxyWebSocket(a,t,`/instances/${encodeURIComponent(e.id)}/proxy/ws/${o}`,i,s)}async reportHeartbeat(e,t){if(!e.registrationToken)return;const n=this.requireNode(e.nodeId),i=`/instances/${encodeURIComponent(e.id)}/heartbeat`,s={method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.registrationToken}`},body:JSON.stringify(t)},a=await this.nodeAgentTransport(n).request(n,i,s),o=await a.json().catch(()=>({}));if(!a.ok){const e=new Error(o.error?.message||`Instance heartbeat sync failed with HTTP ${a.status}`);throw Object.assign(e,{statusCode:a.status,code:"INSTANCE_HEARTBEAT_SYNC_FAILED"}),e}}}function tf(e){if(Gd(e))return;const t=new Error(`Instance ${e.name} is not ready.`);throw Object.assign(t,{statusCode:409,code:"INSTANCE_NOT_READY",runtimePhase:e.runtimeVersion?.phase}),t}class nf{read(e){const t=new Map(e.projects.map(e=>[e.id,e])),n=new Map(e.images.map(e=>[e.id,e])),i=new Map(e.nodes.map(e=>[e.id,e])),s=new Map(e.runtimes.map(e=>[`${e.nodeId}:${e.id}`,e])),a=Date.now();return{items:e.instances.map(e=>function(e){const t=e.instance.lastHeartbeatAt?e.currentTime-Date.parse(e.instance.lastHeartbeatAt):void 0,n=void 0!==t&&t>3e4?"offline":e.instance.connectionStatus,i=Mh(e.instance);return{...i,aiSessions:ws(i.aiSessions),connectionStatus:n,heartbeatAgeMs:t,project:e.project,image:e.image,node:e.node?Dh(e.node):void 0,runtime:e.runtime,protocolCompatible:!e.instance.protocolVersion||e.instance.protocolVersion===qo}}({instance:e,currentTime:a,project:e.projectId?t.get(e.projectId):void 0,image:e.imageSnapshot||(e.imageSelection?n.get(e.imageSelection.imageId):void 0),node:i.get(e.nodeId),runtime:s.get(`${e.nodeId}:${e.runtimeId}`)})),nodeErrors:e.nodeErrors||[],nodeStates:e.nodeStates||[]}}}class sf{options;constructor(e){this.options=e}targetNodeId(e){const t=hg.parse(e),n=t.projectId?this.options.requireProject(t.projectId):void 0,i=t.nodeId||n?.defaultNodeId||this.options.defaultNodeId();if(!i)throw of("At least one node connection is required before creating an instance.",400,"NODE_REQUIRED");return i}async create(e){const t=hg.parse(e),n=t.projectId?this.options.requireProject(t.projectId):void 0,i=t.runtimeId||"runtime_local_docker",s=this.targetNodeId(t),a=this.options.requireNode(s),o=a.capabilities.agent,r=o&&"object"==typeof o&&!Array.isArray(o)?o.capabilities:void 0;if(void 0!==t.config?.aiSessionMaxFileAttachmentBytes&&!ld(r))throw of("This node does not support managed AI session file attachment limits.",409,"AI_SESSION_FILE_ATTACHMENT_LIMIT_UNSUPPORTED");const c=await this.options.requireRuntime(a.id,i),d=c.capabilities.requiresImage??"local"!==c.type,l=t.environmentSource||(t.imageSelection?{type:"image",imageSelection:t.imageSelection}:void 0)||(d&&n?.defaultImageSelection?{type:"image",imageSelection:n.defaultImageSelection}:void 0);if("template"===l?.type&&"docker"!==c.type)throw of(`Runtime ${c.name} does not support environment templates.`,409,"ENVIRONMENT_TEMPLATE_RUNTIME_UNSUPPORTED");const p="image"===l?.type?l.imageSelection:void 0,u=p?this.options.resolveImageSelection(p):void 0,m="template"===l?.type?await this.options.gateway.getEnvironmentTemplate(a,l.environmentTemplateId):void 0;if(m&&"ready"!==m.status)throw of(`Environment template ${m.id} is ${m.status}.`,409,"ENVIRONMENT_TEMPLATE_NOT_READY");if(m&&m.nodeId!==a.id)throw of(`Environment template ${m.id} belongs to node ${m.nodeId}.`,409,"ENVIRONMENT_TEMPLATE_NODE_MISMATCH");if(d&&!u&&!m)throw of(`Runtime ${c.name} requires an image.`,400,"RUNTIME_IMAGE_REQUIRED");const h=await this.resolveSource({node:a,runtime:c,project:n,source:t.source,sourceSnapshot:t.sourceSnapshot,imageOption:u}),g=t.id||Il("inst"),f=this.prepareGitProvisioning({instanceId:g,runtime:c,source:h.configured,retention:t.gitCredentialRetention,agentCapabilities:r}),y=await this.options.prepareModels(a,t.modelSelection||{}),b=u?function(e){const t=hl();return{id:e.id,origin:e.origin,name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover,repository:e.repository,tag:e.tag,requestedReference:e.reference,resolvedDigest:e.digest,resolvedReference:e.digest?`${e.repository}@${e.digest}`:void 0,downloadSizeBytes:e.downloadSizeBytes,pullPolicy:"if-not-present",capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,market:e.market,createdAt:t,updatedAt:t}}(u):void 0,v="instance-retained"===f?.retention?f.input.credentials[0].payload:void 0;let I,x,w=!1,S=!1;try{"operation-only"===f?.retention&&this.options.gitCredentials.rememberOperationProvisioning(f.input);const e={id:g,name:t.name,runtimeId:i,...l?{environmentSource:l}:{},...u&&b?{image:b}:{},projectId:n?.id,source:h.value,sourceSnapshot:h.snapshot,config:t.config,modelSelection:{},..."operation-only"===f?.retention?{gitWorkspaceProvisioning:f.input}:{}};try{I=await this.options.gateway.createInstance(a,e)}catch(e){if(I=await this.options.gateway.listInstances(a).then(e=>e.find(e=>e.id===g)).catch(()=>{}),!I)throw e}x=I,"instance-retained"===f?.retention&&(w=!0,await this.options.gateway.deployGitCredential(a,v),this.options.gitCredentials.authorize(I.id,f.credentialId),S=!0,await this.options.gateway.replaceGitCredentialAuthorizations(a,this.options.gitCredentials.desiredAuthorizationSet(I.id)),this.options.gitCredentials.markAssignmentStatus(I.id,f.credentialId,"synced")),x=(await this.options.gateway.assignInstanceModels(a,I.id,y)).instance}catch(e){let t;if(S&&"instance-retained"===f?.retention){this.options.gitCredentials.revoke(g,f.credentialId);try{await this.options.gateway.replaceGitCredentialAuthorizations(a,this.options.gitCredentials.desiredAuthorizationSet(g))}catch(e){t=e}}let n,i,s=!1;try{const e=await this.options.gateway.deleteInstance(a,g,{deleteVolumes:!0});s=e.completed,e.completed||(n=new Error(`Instance ${g} deletion requires retry.`))}catch(e){!function(e){if(!e||"object"!=typeof e)return!1;const t=e;return 404===t.statusCode||"CONTROLLED_INSTANCE_NOT_FOUND"===t.code}(e)?n=e:s=!0}if(w&&v)try{await this.options.gateway.removeGitCredential(a,v.credential.id)}catch(e){i=e}if(s&&"operation-only"===f?.retention&&this.options.gitCredentials.forgetOperationProvisioning(g),n||t||i){const s=of(`Instance ${g} creation failed and node cleanup could not be confirmed.`,502,"INSTANCE_CREATE_COMPENSATION_REQUIRED");throw Object.assign(s,{cause:e,compensationError:n,retainedAuthorizationCleanupError:t,retainedPayloadCleanupError:i}),s}throw e}if(!x)throw of("Instance creation did not return an instance.",502,"INSTANCE_CREATE_FAILED");let A={status:"not-requested"};if(t.start)try{const e=await this.options.gateway.startInstance(a,x.id,"operation-only"===f?.retention?{gitWorkspaceProvisioning:f.input}:{});x=e.instance,"operation-only"===f?.retention&&e.gitWorkspaceProvisioningOperationId===f.input.operationId&&this.options.gitCredentials.forgetOperationProvisioning(x.id),A={status:"started"}}catch(e){A={status:"failed",error:af(e,"INSTANCE_START_FAILED")},x=await this.options.gateway.listInstances(a).then(e=>e.find(e=>e.id===x.id)||x).catch(()=>x)}return{...Mh(x),registrationToken:x.registrationToken,startOutcome:A}}prepareGitProvisioning(e){if("local-folder"===e.source.type){if(e.retention)throw of("Git credential retention requires a Git source.",400,"GIT_CREDENTIAL_SOURCE_REQUIRED");return}if("none"===e.source.auth.type){if(e.retention)throw of("The Git Repository does not have a credential to retain.",409,"GIT_REPOSITORY_CREDENTIAL_NOT_CONFIGURED");return}const t=e.source.auth.secretId;if(!t)throw of("The Git Repository credential reference is missing.",409,"GIT_REPOSITORY_CREDENTIAL_REQUIRED");const n=e.retention||"operation-only";if(!cd(e.agentCapabilities)||!dd(e.agentCapabilities))throw of("The selected node does not support managed Git credentials.",409,"GIT_CREDENTIAL_NODE_UNSUPPORTED");if(i=e.agentCapabilities,s=e.runtime.type,!rd(i).managedGitCredentials.workspaceProvisioning[s])throw of(`Runtime ${e.runtime.name} does not support managed Git workspace provisioning.`,409,"GIT_CREDENTIAL_PROVISIONING_UNSUPPORTED");var i,s;const a=this.options.gitCredentials.payload(t);if(a.credential.kind!==e.source.auth.type)throw of("The Git Repository auth type does not match its credential.",409,"GIT_REPOSITORY_CREDENTIAL_KIND_MISMATCH");const o=Gm(e.source.url,[{id:a.credential.id,kind:a.credential.kind,scope:a.credential.scope,status:a.credential.status,pinnedKnownHosts:"ssh-key"===a.secret.kind&&Boolean(a.secret.pinnedKnownHosts.trim())}]);if("unique"!==o.status||o.credential.id!==t)throw of(`The Git Repository credential does not uniquely authorize its remote (${o.status}).`,409,`GIT_REPOSITORY_CREDENTIAL_${o.status.replace(/-/g,"_").toUpperCase()}`);return{credentialId:t,retention:n,input:{operationId:Il("gitop"),instanceId:e.instanceId,remoteUrl:e.source.url,ref:e.source.ref,clone:e.source.clone,credentials:[{operationId:Il("gitcredop"),retention:n,payload:a}]}}}async resolveSource(e){let t=e.source||e.project?.source,n=function(e){const t=lc.safeParse(e.source);return t.success?{...e,source:pc(t.data)}:e}(e.sourceSnapshot||(e.project?{...e.project,source:pc(e.project.source)}:{}));if(!t)throw of("Instance source is required.",400,"INSTANCE_SOURCE_REQUIRED");if("local"===e.runtime.type&&"local-folder"!==t.type)throw of("Localhost runtime currently supports local folder sources only.",400,"LOCAL_RUNTIME_REQUIRES_LOCAL_FOLDER");if("local-folder"!==t.type)return{value:pc(t),configured:t,snapshot:n};if(t.ownerNodeId&&t.ownerNodeId!==e.node.id)throw of(`Local folder ${t.path} belongs to node ${t.ownerNodeId}, not ${e.node.id}.`,400,"LOCAL_FOLDER_REQUIRES_OWNER_NODE");const i=t.localFolderId?await this.options.requireLocalFolder(e.node,t.localFolderId):await this.options.gateway.createLocalFolder(e.node,{name:"string"==typeof n.name?n.name:"Local folder",path:t.path,defaultImageSelection:e.imageOption?{imageId:e.imageOption.id,tag:e.imageOption.tag}:void 0});return t={...t,localFolderId:i.id,ownerNodeId:i.nodeId,path:i.path},n=i,{value:t,configured:t,snapshot:n}}}function af(e,t){const n=e&&"object"==typeof e?e:{};return{code:"string"==typeof n.code&&n.code.trim()?n.code:t,message:"string"==typeof n.message&&n.message.trim()?n.message:String(e)}}function of(e,t,n){return Object.assign(new Error(e),{statusCode:t,code:n})}class rf{triggers;listInstances;listMutationInstances;requireInstance;instanceRequest;constructor(e){this.triggers=e.triggers,this.listInstances=e.listInstances,this.listMutationInstances=e.listMutationInstances??(async()=>({items:await e.listInstances(),partialFailures:[]})),this.requireInstance=e.requireInstance,this.instanceRequest=e.instanceRequest}async listTriggers(){const e=await this.listInstances(),t=new Map;for(const e of this.triggers.list())t.set(e.configHash,{configHash:e.configHash,config:df(e),deploymentCount:0,enabledCount:0,runningCount:0,errorCount:0,ownedByControlPlane:!0,controlPlaneDeploymentCount:0,deployments:[],recentRuns:[]});for(const n of e){const e=n.triggers;for(const i of e?.configs||[]){const s=t.get(i.configHash)||{configHash:i.configHash,config:i.config,deploymentCount:0,enabledCount:0,runningCount:0,errorCount:0,ownedByControlPlane:!1,controlPlaneDeploymentCount:0,deployments:[],recentRuns:[]},a=(i.deployments||[]).map(e=>({instanceId:n.id,instanceName:n.name,deployment:e,runtime:(i.runtime||[]).find(t=>t.deploymentId?t.deploymentId===e.deploymentId:t.configHash===e.configHash)}));s.deploymentCount+=a.length,s.enabledCount+=a.filter(e=>Boolean(e.deployment.enabled)).length,s.controlPlaneDeploymentCount+=a.filter(e=>"control-plane"===e.deployment.origin).length,s.runningCount+=(i.runtime||[]).filter(e=>"running"===e.status).length,s.errorCount+=(i.runtime||[]).filter(e=>"error"===e.status).length,s.deployments.push(...a),s.recentRuns.push(...(e.recentRuns||[]).filter(e=>e.configHash===i.configHash).map(e=>({...e,instanceId:n.id,instanceName:n.name}))),t.set(i.configHash,s)}}return Wa.parse({updatedAt:(new Date).toISOString(),triggers:[...t.values()].sort((e,t)=>String(e.config.name||e.configHash).localeCompare(String(t.config.name||t.configHash)))})}createTrigger(e){const t=cg.parse(e||{}),n=hl(),i={maxConcurrentRuns:t.policy?.maxConcurrentRuns??1,whenBusy:t.policy?.whenBusy??"skip",cooldownMs:t.policy?.cooldownMs},s=Va({source:t.source,action:t.action,policy:i}),a=rg.parse({id:s,configHash:s,name:t.name,description:t.description,source:t.source,action:t.action,policy:i,createdAt:n,updatedAt:n});return this.triggers.put(a)}async updateTrigger(e,t){const n=this.requireTrigger(e),i=dg.parse(t||{}),s=hl(),a={maxConcurrentRuns:i.policy?.maxConcurrentRuns??1,whenBusy:i.policy?.whenBusy??"skip",cooldownMs:i.policy?.cooldownMs},o=Va({source:i.source,action:i.action,policy:a});if(o!==e&&this.triggers.get(o)){const e=new Error(`Trigger ${o} already exists.`);throw Object.assign(e,{statusCode:409,code:"TRIGGER_ALREADY_EXISTS"}),e}const r=rg.parse({id:o,configHash:o,name:i.name,description:i.description,source:i.source,action:i.action,policy:a,createdAt:n.createdAt,updatedAt:s}),c=await this.listMutationInstances(),d=await cf(c.items,8,async t=>{const n=[],i=[],s=t.triggers?.configs?.find(t=>t.configHash===e),a=(s?.deployments||[]).filter(e=>"control-plane"===e.origin);if(o===e){if(a.length)try{const i=await this.instanceRequest(t,`/triggers/${encodeURIComponent(e)}`,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({name:r.name,description:r.description??null})});n.push({instanceId:t.id,data:i})}catch(e){i.push(lf(t,e))}return{results:n,partialFailures:i}}for(const s of a){const a="ai-session"===s.target.type?pf(s.target.aiSessionId,o):s.deploymentId;try{const i=await this.instanceRequest(t,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:r.name,description:r.description,source:r.source,action:r.action,policy:r.policy,deployment:{deploymentId:a,origin:"control-plane",enabled:s.enabled,target:s.target,localName:s.localName}})}),o=s.deploymentId||s.configHash;await this.instanceRequest(t,`/triggers/${encodeURIComponent(e)}/deployments/${encodeURIComponent(o)}`,{method:"DELETE"}),n.push({instanceId:t.id,deploymentId:a,data:i})}catch(e){i.push(lf(t,e))}}return{results:n,partialFailures:i}}),l=d.flatMap(e=>e.results),p=[...c.partialFailures,...d.flatMap(e=>e.partialFailures)];return this.triggers.put(r),o!==e&&this.triggers.delete(e),{previousConfigHash:e,trigger:r,results:l,partialFailures:p}}async deleteTrigger(e){const t=await this.listMutationInstances(),n=this.triggers.delete(e),i=await cf(t.items,8,async t=>{const n=[],i=[],s=t.triggers?.configs?.find(t=>t.configHash===e);if(!s)return{results:n,partialFailures:i};const a=(s.deployments||[]).filter(e=>"control-plane"===e.origin);if(!a.length)return{results:n,partialFailures:i};const o=s.deployments.every(e=>"control-plane"===e.origin);for(const s of a)try{const a=s.deploymentId?`/triggers/${encodeURIComponent(e)}/deployments/${encodeURIComponent(s.deploymentId)}`:o?`/triggers/${encodeURIComponent(e)}`:void 0;if(!a){n.push({instanceId:t.id,configHash:e,deploymentId:s.deploymentId,deleted:!1,skipped:"missing-deployment-id"}),i.push({scope:"instance",nodeId:t.nodeId,instanceId:t.id,code:"TRIGGER_DEPLOYMENT_ID_MISSING",message:`Trigger deployment on instance ${t.name} has no deletable deployment id.`});continue}const r=await this.instanceRequest(t,a,{method:"DELETE"});if(n.push({instanceId:t.id,configHash:e,deploymentId:s.deploymentId,deleted:!0,data:r}),!s.deploymentId)break}catch(a){i.push(lf(t,a)),n.push({instanceId:t.id,configHash:e,deploymentId:s.deploymentId,deleted:!1,error:a instanceof Error?a.message:String(a)})}return{results:n,partialFailures:i}}),s=i.flatMap(e=>e.results),a=[...t.partialFailures,...i.flatMap(e=>e.partialFailures)];return n||s.length||Fh("TRIGGER_NOT_FOUND",`Trigger ${e} was not found.`),{configHash:e,deletedTemplate:n,results:s,partialFailures:a}}async applyTrigger(e,t){const n=this.requireTrigger(e),i=lg.parse(t||{});return{configHash:e,results:await cf(i.instanceIds,8,async e=>{const t=await this.requireInstance(e);return{instanceId:e,data:await this.instanceRequest(t,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:n.name,description:n.description,source:n.source,action:n.action,policy:n.policy,deployment:{origin:"control-plane",enabled:i.enabled??!0,target:i.target}})})}})}}async listInstanceTriggers(e){const t=await this.requireInstance(e);return this.instanceRequest(t,"/triggers")}async bindAiSessionTrigger(e,t,n){const i=pg.parse(n||{}),s=this.requireTrigger(i.configHash),a=await this.requireInstance(e);return Ba.parse(await this.instanceRequest(a,"/triggers",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({name:s.name,description:s.description,source:s.source,action:s.action,policy:s.policy,deployment:{deploymentId:pf(t,i.configHash),origin:"control-plane",enabled:i.enabled??!0,target:{type:"ai-session",aiSessionId:t}}})}))}async unbindAiSessionTrigger(e,t,n){const i=await this.requireInstance(e),s=pf(t,n);return this.instanceRequest(i,`/triggers/${encodeURIComponent(n)}/deployments/${encodeURIComponent(s)}`,{method:"DELETE"})}async runInstanceTrigger(e,t,n={}){const i=await this.requireInstance(e);return this.instanceRequest(i,`/triggers/${encodeURIComponent(t)}/run`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n||{})})}requireTrigger(e){const t=this.triggers.get(e);return t||Fh("TRIGGER_NOT_FOUND",`Trigger ${e} was not found.`),t}}async function cf(e,t,n){const i=new Array(e.length);let s,a=0,o=!1;if(await Promise.all(Array.from({length:Math.min(t,e.length)},async()=>{for(;!o&&a<e.length;){const t=a++;try{i[t]=await n(e[t],t)}catch(e){o=!0,s=e}}})),o)throw s;return i}function df(e){return{configHash:e.configHash,name:e.name,...void 0!==e.description?{description:e.description}:{},source:e.source,action:e.action,policy:e.policy,createdAt:e.createdAt,updatedAt:e.updatedAt}}function lf(e,t){const n=t&&"object"==typeof t?t:void 0,i="string"==typeof n?.code&&n.code?n.code:"TRIGGER_INSTANCE_MUTATION_FAILED",s="string"==typeof n?.message&&n.message?n.message:String(t);return{scope:"instance",nodeId:e.nodeId,instanceId:e.id,code:i.slice(0,160),message:s.slice(0,4e3)}}function pf(e,t){return`ai_${Buffer.from(e).toString("base64url")}_${t}`}class uf{options;constructor(e){this.options=e}getSettings(){return tg.parse(this.options.settings.get())}updateSettings(e){const t=ng.parse(e),n=tg.parse({...this.getSettings(),...t,..."publicBaseUrl"in t?{publicBaseUrl:t.publicBaseUrl?.trim()||void 0}:{}});return this.options.settings.put(n)}seedDefaults(){}listProjects(){return this.options.projects.list().map(e=>this.normalizeProjectRecord(e))}getProject(e){const t=this.options.projects.get(e);return t?this.normalizeProjectRecord(t):void 0}createProject(e){const t=Yh.parse(e),n=hl(),i=this.validateProjectSource(t.source);return this.options.projects.put(fc.parse({...t,id:t.id||Il("proj"),source:i,defaultImageSelection:t.defaultImageSelection||{imageId:"market_taskhandoff_browser"},defaultNodeId:t.defaultNodeId||this.options.defaultNodeId(),workspacePolicy:uc.parse(t.workspacePolicy||Lh(i)),labels:t.labels||{},createdAt:n,updatedAt:n}))}updateProject(e,t){const n=Xh.parse(t),i=this.requireProject(e),s=n.source?this.validateProjectSource(n.source):i.source;return this.options.projects.put(fc.parse({...i,...n,id:e,source:s,workspacePolicy:n.workspacePolicy?uc.parse(n.workspacePolicy):i.workspacePolicy,createdAt:i.createdAt,updatedAt:hl()}))}deleteProject(e){return this.options.projects.delete(e)}requireProject(e){const t=this.getProject(e);return t||Fh("PROJECT_NOT_FOUND",`Project ${e} was not found.`),t}validateProjectSource(e){const t=lc.parse(e);if("local-folder"===t.type)return t;if("none"===t.auth.type){if(t.auth.secretId)throw mf("A public Git repository cannot reference a credential.","GIT_REPOSITORY_AUTH_INVALID");return t}if(!t.auth.secretId)throw mf("Git repository authentication requires a credential.","GIT_REPOSITORY_CREDENTIAL_REQUIRED");const n=this.options.requireGitCredential(t.auth.secretId);if("enabled"!==n.status)throw mf("The Git repository credential is disabled.","GIT_REPOSITORY_CREDENTIAL_DISABLED");if(n.kind!==t.auth.type)throw mf("Git repository auth type does not match its credential.","GIT_REPOSITORY_CREDENTIAL_KIND_MISMATCH");const i=Gm(t.url,[{...n,status:"enabled"}]);if("unique"!==i.status||i.credential.id!==n.id)throw mf(`Git repository credential does not authorize its remote (${i.status}).`,`GIT_REPOSITORY_CREDENTIAL_${i.status.replace(/-/g,"_").toUpperCase()}`);return t}listImages(){return this.options.images.list()}getMarketCatalog(){return{catalog:this.options.market.getCatalog(),status:this.options.market.getStatus()}}listImageOptions(e){return[...this.options.market.getCatalog().items.map(t=>this.marketImageOption(t,void 0,e,!0)),...this.listImages().map(e=>this.customImageOption(e))]}resolveImageSelection(e,t){const n=this.options.market.getCatalog().items.find(t=>t.id===e.imageId);if(n)return this.marketImageOption(n,e.tag,t);const i=this.options.images.get(e.imageId);if(i||Fh("IMAGE_NOT_FOUND",`Image ${e.imageId} was not found.`),e.tag&&e.tag!==i.tag)throw Object.assign(new Error(`Custom image ${i.id} cannot override its stored tag.`),{statusCode:400,code:"CUSTOM_IMAGE_TAG_OVERRIDE"});return this.customImageOption(i)}createImage(e){const t=ig.parse(e),n=hl(),i=cr(t.reference);return this.options.images.put(Mc.parse({...t,id:t.id||Il("img"),origin:"custom",reference:i.reference,repository:i.repository,tag:i.tag,pullPolicy:t.pullPolicy||"if-not-present",capabilities:t.capabilities||[],optionalApps:t.optionalApps||[],defaultEnv:t.defaultEnv||{},labels:t.labels||{},createdAt:n,updatedAt:n}))}updateImage(e,t){const n=sg.parse(t),i=this.requireImage(e),s=cr(n.reference||i.reference);return this.options.images.put(Mc.parse({...i,...n,id:e,origin:"custom",reference:s.reference,repository:s.repository,tag:s.tag,createdAt:i.createdAt,updatedAt:hl()}))}deleteImage(e){return this.options.images.delete(e)}requireImage(e){if(this.options.market.getCatalog().items.some(t=>t.id===e))throw Object.assign(new Error(`Market image ${e} is read-only.`),{statusCode:403,code:"MARKET_IMAGE_READ_ONLY"});const t=this.options.images.get(e);return t||Fh("IMAGE_NOT_FOUND",`Image ${e} was not found.`),t}normalizeProjectRecord(e){const t=function(e){return e&&"object"==typeof e&&!Array.isArray(e)?fc.parse(Er(e)):fc.parse(e)}(e);return t!==e&&this.options.projects.put(t),t}customImageOption(e){return Uc.parse({id:e.id,origin:"custom",name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover||kc,repository:e.repository,tag:e.tag,availableTags:e.tag?[{name:e.tag,reference:e.reference,status:"active"}]:[],reference:e.reference,capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,readOnly:!1})}marketImageOption(e,t,n,i=!1){if("yanked"===e.status&&!i)throw Object.assign(new Error(`Market image ${e.id} is no longer selectable.`),{statusCode:409,code:"MARKET_IMAGE_YANKED"});const s=t||e.defaultTag,a=e.tags.find(e=>e.name===s);if(!a)throw Object.assign(new Error(`Market image ${e.id} does not provide tag ${s}.`),{statusCode:400,code:"MARKET_IMAGE_TAG_NOT_FOUND"});if("yanked"===a.status&&!i)throw Object.assign(new Error(`Market image tag ${e.id}:${s} is no longer selectable.`),{statusCode:409,code:"MARKET_IMAGE_TAG_YANKED"});const o=a.platforms.find(e=>!(n?.os&&e.os!==n.os||n?.architecture&&e.architecture!==n.architecture)),r=this.options.market.getCatalog();return Uc.parse({id:e.id,origin:"market",name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:e.cover||kc,repository:e.repository,tag:a.name,availableTags:e.tags.map(e=>({name:e.name,version:e.version,reference:e.reference,manifestDigest:e.manifestDigest,status:e.status})),reference:a.reference,digest:o?.digest||a.manifestDigest,downloadSizeBytes:o?.downloadSizeBytes,unpackedSizeBytes:o?.unpackedSizeBytes,capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:e.defaultEnv,labels:e.labels,readOnly:!0,lifecycleStatus:"yanked"===a.status||"yanked"===e.status?"yanked":"deprecated"===a.status||"deprecated"===e.status?"deprecated":"active",market:{catalogId:r.catalogId,catalogRevision:r.revision,publisher:e.publisher,version:a.version}})}}function mf(e,t){return Object.assign(new Error(e),{code:t,statusCode:409})}function hf(e){const t=cr(e.reference),n=t.tag||"latest";return{id:e.id,publisher:"task-handoff",slug:e.slug,name:e.name,description:e.description,localizedDescriptions:e.localizedDescriptions,cover:kc,repository:t.repository,defaultTag:n,tags:[{name:n,reference:t.reference,platforms:[],status:"active"}],capabilities:e.capabilities,optionalApps:e.optionalApps,defaultEnv:{},labels:{"task-handoff.image.kind":"controlled-instance","task-handoff.image.profile":e.slug},status:"active"}}function gf(){const e=(t=process.env.TASK_HANDOFF_BUILT_AT)&&!Number.isNaN(Date.parse(t))?new Date(t).toISOString():(new Date).toISOString();var t;return Dc.parse({protocolVersion:"2026-07-29",catalogId:"task_handoff_embedded",revision:process.env.TASK_HANDOFF_VERSION||"0.0.1",source:"embedded",generatedAt:e,items:[hf({id:"market_taskhandoff_codex",slug:"codex",name:"TaskHandoff Codex",description:"Minimal Codex runtime with terminal and Codex.",localizedDescriptions:{"zh-CN":"最小 Codex 运行环境，包含终端和 Codex。"},reference:process.env.TASK_HANDOFF_CONTROLLED_CODEX_IMAGE||"huadream/task-handoff-controlled-codex:latest",capabilities:["terminal","codex"],optionalApps:["terminal-tty"]}),hf({id:"market_taskhandoff_opencode",slug:"opencode",name:"TaskHandoff OpenCode",description:"Minimal OpenCode runtime with terminal and OpenCode.",localizedDescriptions:{"zh-CN":"最小 OpenCode 运行环境，包含终端和 OpenCode。"},reference:process.env.TASK_HANDOFF_CONTROLLED_OPENCODE_IMAGE||"huadream/task-handoff-controlled-opencode:latest",capabilities:["terminal","opencode"],optionalApps:["terminal-tty"]}),hf({id:"market_taskhandoff_ai",slug:"ai",name:"TaskHandoff Codex + Claude",description:"AI development runtime with Codex, Claude, and terminal.",localizedDescriptions:{"zh-CN":"AI 开发运行环境，包含 Codex、Claude 和终端。"},reference:process.env.TASK_HANDOFF_CONTROLLED_AI_IMAGE||"huadream/task-handoff-controlled-ai:latest",capabilities:["terminal","codex","claude"],optionalApps:["terminal-tty"]}),hf({id:"market_taskhandoff_webcap",slug:"webcap",name:"TaskHandoff WebCap",description:"Browser automation runtime with WebCap, Codex, Claude, Chromium, and VNC.",localizedDescriptions:{"zh-CN":"浏览器自动化运行环境，包含 WebCap、Codex、Claude、Chromium 和 VNC。"},reference:process.env.TASK_HANDOFF_CONTROLLED_WEB_CAP_IMAGE||"huadream/task-handoff-controlled-webcap:latest",capabilities:["browser","terminal","gui-terminal","web-cap","codex","claude"],optionalApps:["chromium","terminal-tty","gui-terminal"]}),hf({id:"market_taskhandoff_browser",slug:"browser",name:"TaskHandoff Browser",description:"Full runtime with Codex, Claude, Chromium, VNC, and code-server.",localizedDescriptions:{"zh-CN":"完整运行环境，包含 Codex、Claude、Chromium、VNC 和 code-server。"},reference:process.env.TASK_HANDOFF_CONTROLLED_BROWSER_IMAGE||"huadream/task-handoff-controlled-browser:latest",capabilities:["browser","terminal","gui-terminal","vscode-web","codex","claude"],optionalApps:["chromium","terminal-tty","gui-terminal","vscode-web"]})]})}class ff{async loadCatalog(){return gf()}}class yf{snapshot;status;constructor(e=gf()){this.snapshot=Dc.parse(e),this.status=Lc.parse({source:this.snapshot.source,state:"ready",revision:this.snapshot.revision,updatedAt:this.snapshot.generatedAt})}getCatalog(){return this.snapshot}getStatus(){return this.status}acceptCandidate(e){const t=Dc.safeParse(e);return t.success?(this.snapshot=t.data,this.status=Lc.parse({source:t.data.source,state:"ready",revision:t.data.revision,updatedAt:(new Date).toISOString()}),{accepted:!0,snapshot:t.data}):(this.status=Lc.parse({...this.status,state:"failed",updatedAt:(new Date).toISOString(),error:t.error.message}),{accepted:!1,error:t.error})}recordRefreshFailure(e){return this.status=Lc.parse({...this.status,state:this.snapshot?"stale":"failed",updatedAt:(new Date).toISOString(),error:e instanceof Error?e.message:String(e)}),this.snapshot}async refresh(e){try{const t=await e.loadCatalog();return this.acceptCandidate(t)}catch(e){return this.recordRefreshFailure(e),{accepted:!1,error:e}}}}const bf=f.z.object({id:jm.shape.id,name:jm.shape.name,kind:jm.shape.kind,scope:jm.shape.scope,status:jm.shape.status,revision:jm.shape.revision,secretCiphertext:f.z.string().min(1).max(262144),createdAt:jm.shape.createdAt,updatedAt:jm.shape.updatedAt}).strict(),vf=Um.extend({id:f.z.string().trim().min(1).max(300),createdAt:jm.shape.createdAt}).strict(),If=f.z.object({id:f.z.string().trim().min(1).max(120),action:f.z.enum(["create","update","delete","authorize","assignment-status","revoke"]),credentialId:jm.shape.id,instanceId:jm.shape.id.optional(),credentialRevision:jm.shape.revision.optional(),assignmentRevision:jm.shape.revision.optional(),createdAt:jm.shape.createdAt,updatedAt:jm.shape.updatedAt}).strict(),xf=f.z.object({id:jm.shape.id,instanceId:jm.shape.id,credentialId:jm.shape.id,operationId:Hm.shape.operationId,remoteUrl:Hm.shape.remoteUrl,ref:Hm.shape.ref,clone:Hm.shape.clone,createdAt:jm.shape.createdAt,updatedAt:jm.shape.updatedAt}).strict();function wf(e,t){return`${e}:${t}`}function Sf(e,t,n){return Object.assign(new Error(e),{code:t,statusCode:n})}function Af(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.scope&&"object"==typeof t.scope&&!Array.isArray(t.scope)?t.scope:void 0;return{id:t.id,name:t.name,kind:t.kind,scope:n?{scheme:n.scheme,host:n.host,...void 0===n.port?{}:{port:n.port},pathPrefix:n.pathPrefix}:t.scope,status:t.status,revision:t.revision,secretCiphertext:t.secretCiphertext,createdAt:t.createdAt,updatedAt:t.updatedAt}}function Ef(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e;return Object.fromEntries(["id","instanceId","credentialId","credentialRevision","assignmentRevision","status","authorizedAt","createdAt","updatedAt"].flatMap(e=>Object.prototype.hasOwnProperty.call(t,e)?[[e,t[e]]]:[]))}function _f(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e;return{id:t.id,instanceId:t.instanceId,credentialId:t.credentialId,operationId:t.operationId||t.instanceId,remoteUrl:t.remoteUrl,ref:t.ref,clone:t.clone,createdAt:t.createdAt,updatedAt:t.updatedAt}}class Tf{credentials;assignments;audit;provisioningIntents;secrets;repositoryReferences;constructor(e,t={}){this.credentials=new wl(e.gitCredentialsDir,{schema:bf,sanitize:Af,directoryMode:448,fileMode:384}),this.assignments=new wl(e.gitCredentialAssignmentsDir,{schema:vf,sanitize:Ef,directoryMode:448,fileMode:384}),this.audit=new wl(e.gitCredentialAuditDir,{schema:If,directoryMode:448,fileMode:384}),this.provisioningIntents=new wl(e.gitCredentialProvisioningIntentsDir,{schema:xf,sanitize:_f,directoryMode:448,fileMode:384}),this.secrets=new bp(e.gitCredentialEncryptionKeyPath),this.repositoryReferences=t.repositoryReferences||(()=>[])}init(){this.secrets.init(),this.credentials.init(),this.assignments.init(),this.audit.init(),this.provisioningIntents.init()}list(){return this.credentials.list().map(e=>this.publicCredential(e))}get(e){const t=this.credentials.get(e);return t?this.publicCredential(t):void 0}requirePublic(e){return this.publicCredential(this.require(e))}require(e){const t=this.credentials.get(e);if(!t)throw Sf(`Git credential ${e} was not found.`,"GIT_CREDENTIAL_NOT_FOUND",404);return t}create(e){const t=Mm.parse(e),n=hl(),i=this.credentials.put({id:Il("gitcred"),name:t.name,kind:t.secret.kind,scope:Rm(t.scope),status:"enabled",revision:1,secretCiphertext:this.secrets.seal(JSON.stringify(t.secret)),createdAt:n,updatedAt:n});return this.auditEvent("create",i.id,{credentialRevision:i.revision}),this.publicCredential(i)}update(e,t){const n=qm.parse(t),i=this.require(e),s=n.scope?Rm(n.scope):i.scope;if("https"===s.scheme!=("https-token"===i.kind))throw Sf("Credential kind must match the remote scheme.","GIT_CREDENTIAL_SCOPE_KIND_MISMATCH",400);if(n.secret&&n.secret.kind!==i.kind)throw Sf("Credential kind cannot be changed during secret rotation.","GIT_CREDENTIAL_KIND_IMMUTABLE",409);const a=void 0!==n.secret,o={...i,...void 0===n.name?{}:{name:n.name},...void 0===n.scope?{}:{scope:s},...void 0===n.status?{}:{status:n.status},...a?{secretCiphertext:this.secrets.seal(JSON.stringify(n.secret))}:{},revision:i.revision+1,updatedAt:hl()};this.assertRepositoryCompatibility(this.publicCredential(o));const r=this.credentials.put(o);return this.auditEvent("update",r.id,{credentialRevision:r.revision}),this.publicCredential(r)}disable(e){return this.update(e,{status:"disabled"})}remove(e){this.require(e);const t=this.assignments.list().filter(t=>t.credentialId===e&&"revoked"!==t.status),n=this.repositoryReferences(e),i=this.provisioningIntents.list().filter(t=>t.credentialId===e).map(e=>e.instanceId);if(t.length>0||n.length>0||i.length>0)throw Object.assign(Sf("Git credential is referenced by one or more repositories or instances.","GIT_CREDENTIAL_IN_USE",409),{details:{instances:[...new Set([...t.map(e=>e.instanceId),...i])].sort(),repositories:n.map(e=>({id:e.id,name:e.name}))}});const s=this.credentials.delete(e);return s&&this.auditEvent("delete",e),s}payload(e,t={}){const n=this.require(e);if("enabled"!==n.status&&!t.allowDisabled)throw Sf(`Git credential ${e} is disabled.`,"GIT_CREDENTIAL_DISABLED",409);let i;try{i=Lm.parse(JSON.parse(this.secrets.open(n.secretCiphertext)))}catch{throw Sf(`Git credential ${e} secret could not be opened.`,"GIT_CREDENTIAL_SECRET_INVALID",500)}return $m.parse({credential:this.publicCredential(n),secret:i})}rememberOperationProvisioning(e){const t=Hm.parse(e),n=1===t.credentials.length&&"operation-only"===t.credentials[0].retention?t.credentials[0]:void 0;if(!n)throw Sf("Operation-only provisioning requires exactly one credential.","GIT_CREDENTIAL_PROVISIONING_INVALID",400);const i=hl();return this.provisioningIntents.put({id:t.instanceId,instanceId:t.instanceId,credentialId:n.payload.credential.id,operationId:t.operationId,remoteUrl:t.remoteUrl,ref:t.ref,clone:t.clone,createdAt:this.provisioningIntents.get(t.instanceId)?.createdAt||i,updatedAt:i})}operationProvisioning(e){const t=this.provisioningIntents.get(e);if(t)return Hm.parse({operationId:t.operationId,instanceId:e,remoteUrl:t.remoteUrl,ref:t.ref,clone:t.clone,credentials:[{operationId:t.operationId,retention:"operation-only",payload:this.payload(t.credentialId)}]})}forgetOperationProvisioning(e){return this.provisioningIntents.delete(e)}listAssignments(e){return this.assignments.list().filter(t=>"revoked"!==t.status&&(!e||t.instanceId===e)).map(({id:e,createdAt:t,...n})=>Um.parse(n))}authorize(e,t,n={}){const i=this.require(t);if("enabled"!==i.status&&!n.allowDisabled)throw Sf(`Git credential ${t} is disabled.`,"GIT_CREDENTIAL_DISABLED",409);const s=wf(e,t),a=this.assignments.get(s),o=hl(),r=this.assignments.put({id:s,instanceId:e,credentialId:t,credentialRevision:i.revision,assignmentRevision:(a?.assignmentRevision||0)+1,status:"pending",authorizedAt:a?.authorizedAt||o,createdAt:a?.createdAt||o,updatedAt:o});this.auditEvent("authorize",t,{instanceId:e,credentialRevision:r.credentialRevision,assignmentRevision:r.assignmentRevision});const{id:c,createdAt:d,...l}=r;return Um.parse(l)}markAssignmentStatus(e,t,n){const i=wf(e,t),s=this.assignments.get(i);if(!s)throw Sf("Git credential assignment was not found.","GIT_CREDENTIAL_ASSIGNMENT_NOT_FOUND",404);const a=this.assignments.put({...s,status:n,assignmentRevision:s.assignmentRevision+1,updatedAt:hl()});this.auditEvent("assignment-status",t,{instanceId:e,credentialRevision:a.credentialRevision,assignmentRevision:a.assignmentRevision});const{id:o,createdAt:r,...c}=a;return Um.parse(c)}revoke(e,t){const n=this.assignments.get(wf(e,t));if(!n||"revoked"===n.status)return!1;const i=this.assignments.put({...n,status:"revoked",assignmentRevision:n.assignmentRevision+1,updatedAt:hl()});return this.auditEvent("revoke",t,{instanceId:e,credentialRevision:i.credentialRevision,assignmentRevision:i.assignmentRevision}),!0}desiredAuthorizationSet(e){const t=this.assignments.list().filter(t=>t.instanceId===e);return Bm.parse({instanceId:e,generation:t.reduce((e,t)=>e+t.assignmentRevision,0),credentialIds:t.filter(e=>"revoking"!==e.status&&"revoked"!==e.status).map(e=>e.credentialId),updatedAt:hl()})}revokeInstance(e){let t=0;for(const n of this.assignments.list().filter(t=>t.instanceId===e))this.assignments.delete(n.id)&&(t+=1);return this.provisioningIntents.delete(e),t}publicCredential(e){return jm.parse({id:e.id,name:e.name,kind:e.kind,scope:e.scope,secretSet:!0,status:e.status,revision:e.revision,createdAt:e.createdAt,updatedAt:e.updatedAt})}assertRepositoryCompatibility(e){const t=this.provisioningIntents.list().filter(t=>t.credentialId===e.id).map(t=>({id:t.instanceId,name:t.instanceId,url:t.remoteUrl,authType:e.kind}));for(const n of[...this.repositoryReferences(e.id),...t]){if(n.authType!==e.kind)throw Sf(`Credential kind no longer matches repository ${n.id}.`,"GIT_CREDENTIAL_REPOSITORY_KIND_MISMATCH",409);if("unique"!==Gm(n.url,[{...e,status:"enabled"}]).status)throw Sf(`Credential scope no longer covers repository ${n.id}.`,"GIT_CREDENTIAL_REPOSITORY_SCOPE_MISMATCH",409)}}auditEvent(e,t,n={}){const i=hl();this.audit.put({id:Il("gitaudit"),action:e,credentialId:t,...n,createdAt:i,updatedAt:i})}}class zf{records=new Map;options;constructor(e){this.options=e}create(e){const t=i.randomBytes(this.options.tokenBytes).toString("base64url"),n={...e,token:t,expiresAt:new Date(Date.now()+(e.ttlMs||this.options.ttlMs)).toISOString()};return this.records.set(t,n),n}resolve(e,t){const n=this.records.get(e);if(!n)throw this.invalidError();if(n.expiresAt<=(new Date).toISOString())throw this.records.delete(e),this.invalidError();if(t&&!t(n))throw this.invalidError();return n}revoke(e,t){const n=this.resolve(e,t);return this.records.delete(e),n}invalidError(){const e=new Error(this.options.invalidMessage);return Object.assign(e,{statusCode:this.options.invalidStatusCode||400,code:this.options.invalidCode}),e}}class kf{requireInstance;listAppSessions;tokens=new zf({invalidMessage:"App access link is invalid or expired.",invalidCode:"APP_ACCESS_TOKEN_INVALID",invalidStatusCode:401,tokenBytes:24,ttlMs:9e5});constructor(e){this.requireInstance=e.requireInstance,this.listAppSessions=e.listAppSessions}createToken(e){return this.tokens.create({instanceId:e.instanceId,sessionId:e.sessionId,mode:e.mode,ttlMs:e.ttlMs,authorization:e.authorization})}async createSessionToken(e){await this.requireInstance(e.instanceId);const t=await this.requireSession(e.instanceId,e.sessionId),n=ia(t);if("vnc"!==n){const e=new Error("This app session does not expose a VNC view.");throw Object.assign(e,{statusCode:409,code:"APP_SESSION_ACCESS_UNAVAILABLE"}),e}if("running"!==t.status){const e=new Error("The app session is not running.");throw Object.assign(e,{statusCode:409,code:"APP_SESSION_NOT_RUNNING"}),e}return this.createToken({instanceId:e.instanceId,sessionId:e.sessionId,ttlMs:e.ttlMs,mode:n,...e.authorization?{authorization:e.authorization}:{}})}resolveToken(e,t){return this.tokens.resolve(e,e=>!t||e.mode===t)}revokeToken(e,t){this.tokens.revoke(e,e=>e.instanceId===t.instanceId&&e.sessionId===t.sessionId)}async proxyTarget(e,t,n=""){const i=this.resolveToken(e,t),s=await this.requireInstance(i.instanceId),a=await this.requireSession(i.instanceId,i.sessionId);return{access:i,instance:s,session:a,path:Nf(t,i.sessionId,a,n)}}async requireSession(e,t){const n=await this.listAppSessions(),i=n.instances.find(t=>t.instanceId===e)?.appSessions.sessions.find(e=>Rf(e.id)===t);if(i)return i;const s=new Error("App session was not found.");throw Object.assign(s,{statusCode:404,code:"APP_SESSION_NOT_FOUND"}),s}}function Nf(e,t,n,i=""){return"tty"===e?`/api/apps/sessions/${encodeURIComponent(t)}/tty`:"vnc"===e?i?function(e,t){const n=`/${t.replace(/^\/+/,"")}`,i=n.split("?",1)[0]||"/",s=encodeURIComponent(e);if(!["/api/novnc/",`/api/apps/sessions/${s}/web/`,`/api/apps/sessions/${s}/vnc`,`/api/apps/sessions/${s}/novnc/`].some(e=>i===e.replace(/\/$/,"")||i.startsWith(e))){const e=new Error("App access token cannot be used for this path.");throw Object.assign(e,{statusCode:403,code:"APP_ACCESS_PATH_FORBIDDEN"}),e}return n}(t,i):Rf(Cf(n.vnc).noVncPath)||`/api/apps/sessions/${encodeURIComponent(t)}/web/`:Rf(Cf(n.web).webPath)||`/api/apps/sessions/${encodeURIComponent(t)}/web/`}function Cf(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function Rf(e){return"string"==typeof e&&e.trim()?e.trim():void 0}const Of={allow:"a",deny:"d",skip:"s"};function jf(e){return i.createHash("sha256").update(e).digest("base64url").slice(0,Math.ceil(16))}class Pf{tokens=new zf({invalidMessage:"Chat action expired.",invalidCode:"CHAT_ACTION_TOKEN_INVALID",tokenBytes:9,ttlMs:6e5});create(e){return this.tokens.create({type:e.type,instanceId:"instanceId"in e?e.instanceId:void 0,appId:"appId"in e?e.appId:void 0,routeId:"routeId"in e?e.routeId:void 0,decision:"decision"in e?e.decision:void 0,ttlMs:e.ttlMs})}resolve(e,t){return this.tokens.resolve(e,e=>!t||e.type===t)}pendingDecisionCallbackData(e,t){return`task_handoff:cp_p:v1:${Of[t]}:${jf(e)}`}}function Df(e){const{token:t,...n}=e;return{...n,settings:Mf(e.settings),tokenSet:Boolean(e.token)}}function Lf(e,t){if(!t)return e;const n={...e};for(const[e,i]of Object.entries(t))void 0!==i&&""!==i&&(n[e]=i);return n}function Mf(e){const t={...e};return"string"==typeof t.clientSecret&&t.clientSecret&&(delete t.clientSecret,t.clientSecretSet=!0),"string"==typeof t.appSecret&&t.appSecret&&(delete t.appSecret,t.appSecretSet=!0),t}class qf{chatBridges;chatSessions;constructor(e){this.chatBridges=e.chatBridges,this.chatSessions=e.chatSessions}list(){return this.chatBridges.list().map(Df)}require(e){const t=this.chatBridges.get(e);return t||Fh("CHAT_BRIDGE_NOT_FOUND",`Chat bridge ${e} was not found.`),t}create(e){const t=og.parse(e),n=hl(),i=$d.parse({...t,id:Il(`chat_${t.channel}`),name:t.name||(s=t.channel,a=this.chatBridges.list().filter(e=>e.channel===t.channel).length+1,`${"telegram"===s?"Telegram":"wechat"===s?"WeChat":"dingding"===s?"DingDing":"lark"===s?"Lark":"Web"} ${a}`),enabled:t.enabled??!1,allowedUserIds:t.allowedUserIds||[],pollIntervalMs:t.pollIntervalMs||3e3,settings:Lf({},t.settings),createdAt:n,updatedAt:n});var s,a;return this.chatBridges.put(i),Df(i)}update(e,t){const n=ag.parse(t),i=this.require(e),s=Lf(i.settings,n.settings),a=$d.parse({...i,...n,id:e,channel:i.channel,name:n.name||i.name,settings:s,updatedAt:hl()});return this.chatBridges.put(a),Df(a)}delete(e){const t=this.chatBridges.delete(e);if(t)for(const t of this.chatSessions.list())t.bridgeId===e&&this.chatSessions.delete(t.id);return t}}class Uf{chatSessions;constructor(e){this.chatSessions=e.chatSessions}list(){return this.chatSessions.list()}require(e){const t=this.chatSessions.get(e);return t||Fh("CHAT_SESSION_NOT_FOUND",`Chat session ${e} was not found.`),t}upsert(e){const t=hl(),n=(i=e.channel,s=e.chatSessionId,`${e.bridgeId||i}:${s.replace(/[^a-zA-Z0-9_.:-]/g,"_")}`);var i,s;const a=this.chatSessions.get(n),o=Bd.parse({...a||{},...e,id:n,channel:e.channel,bridgeId:e.bridgeId,chatSessionId:e.chatSessionId,lastUsedAt:t,createdAt:a?.createdAt||t,updatedAt:t});return this.chatSessions.put(o),o}}function $f(e){return{inline_keyboard:e.map(e=>e.map(e=>({text:e.text,...e.url?{url:e.url}:{callback_data:e.callbackData||""}})))}}function Bf(e,t=40){return $f(e.slice(0,t).map(e=>[e]))}function Ff(e){return Buffer.from(e,"utf8").toString("base64url")}function Hf(e){const t=Wf(e).inline_keyboard,n=Array.isArray(t)?t:[],i=[];for(const e of n)if(Array.isArray(e))for(const t of e){const e=Wf(t),n=String(e.callback_data||""),s=String(e.text||"").trim();s&&n&&i.push({text:s,id:`th_cb_${Ff(n)}`})}return i.slice(0,40)}function Gf(e,t){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function Wf(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function Vf(e){return(e.aiSessions?.sessions||[]).filter(t=>function(e,t){const n=(e.apps?.sessions||[]).filter(Zf);if(t.appSessionId&&n.some(e=>e.id===t.appSessionId))return!0;const i=new Set(t.appBindingKeys||[]);return Boolean(i.size&&n.some(e=>function(e){return[...ea(e).bindings.map(sa),...oa(e)].filter(Boolean)}(e).some(e=>i.has(e))))}(e,t))}function Kf(e){return"waiting"===e.status?4:"failed"===e.status?3:"running"===e.status?2:"idle"===e.status?1:0}function Yf(e){return[e.cwd||"",e.agent||"",e.providerSessionId||e.id].join("\0")}function Xf(e){const t=e.session.title||e.session.userPrompt||e.session.summary||e.session.lastMessage||"",n=t?` - ${Gf(t,18)}`:"";return`${e.instance.name} - ${e.session.agent} ${e.session.status}${n}`}function Jf(e,t=(e,t)=>`task_handoff:approval:${e.id}:${t}`){return Bf(e.flatMap(e=>"approval"!==e.kind?[]:[{text:Gf(`Allow ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"allow")},{text:Gf(`Skip ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"skip")},{text:Gf(`Deny ${e.instance?.name||e.instanceId} / ${e.aiSessionId}`,56),callbackData:t(e,"deny")}]))}function Qf(e){const t=`${e.project?.name||e.projectId} / ${e.instance?.name||e.instanceId}`,n="approval"===e.kind?`/approve ${e.id} | /deny ${e.id} | /skip ${e.id}`:`/reply ${e.id} <message>`;return`[${t}] ${e.kind} ${e.id}: ${e.result}\n${n}`}function Zf(e){const t=e&&"object"==typeof e&&!Array.isArray(e)?e:{};return na("string"==typeof t.status?t.status:void 0)}class ey{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleAiSessionsCommand(e){const t=await this.targets.aiSessionChoices(e),n=t.find(e=>e.active),i=t.map(e=>function(e){const t=e.session.userPrompt||e.session.summary||e.session.lastMessage||"",n=e.active?"* ":"",i=e.session.phase&&"unknown"!==e.session.phase?`/${e.session.phase}`:"";return`${n}${e.index+1}. ${e.projectName} / ${e.instance.name} - ${e.session.agent} - ${e.session.status}${i} - ${e.session.id}${t?` - ${t}`:""}`}(e));return{accepted:!0,routed:!1,binding:e,instances:t.map(e=>e.instance),reply:t.length?["Select AI session",`Current ${n?`${n.projectName} / ${n.instance.name} / ${n.session.id}`:await this.targets.renderChatTarget(e)}, total ${t.length}`,"",...i].join("\n"):"No AI sessions found.",replyMarkup:t.length?Bf(t.map(e=>({text:`${e.active?"✓ ":""}${Xf(e)}`,callbackData:`task_handoff:cp_session:${e.index}`}))):void 0}}async handleAiSessionCommand(e,t){const n=String(t[0]||"").trim();if(!n)return this.handleAiSessionsCommand(e);const i=await this.targets.findAiSession(n);if(!i)return{accepted:!1,routed:!1,binding:e,reply:`AI session ${n} was not found. Try /sessions.`};const s=i.instance.projectId?this.deps.getProject(i.instance.projectId):void 0;return{accepted:!0,routed:!1,binding:this.deps.upsertChatSession({...e,activeProjectId:s?.id||e.activeProjectId,activeInstanceId:i.instance.id,activeAiSessionId:i.session.id}),instance:i.instance,aiSession:i.session,reply:`Active AI session: ${i.instance.name} / ${i.session.agent} ${i.session.id}`}}async handleAiSessionIndexAction(e,t){const n=(await this.targets.aiSessionChoices(e)).find(e=>e.index===t);if(!n)return{accepted:!1,routed:!1,binding:e,reply:"AI session was not found. Use /session to refresh the list.",replyMarkup:void 0};const i=this.deps.upsertChatSession({...e,activeProjectId:n.projectId||e.activeProjectId,activeInstanceId:n.instance.id,activeAiSessionId:n.session.id}),s=await this.handleAiSessionsCommand(i);return{...s,accepted:!0,binding:i,instance:n.instance,aiSession:n.session,message:`selected ${n.session.id}`,reply:[`Current chat is bound to AI session ${n.session.id}`,"",s.reply].join("\n")}}async handleAiSessionInterruptCommand(e){if(!e.activeInstanceId||!e.activeAiSessionId)return{accepted:!1,routed:!1,binding:e,reply:"No active AI session is selected. Use /sessions and /session <id> first."};const t=await this.deps.requireControlledInstance(e.activeInstanceId,!0),n=await this.deps.interruptAiSession(t.id,e.activeAiSessionId);return{accepted:!0,routed:!0,binding:e,instance:Mh(t),aiSession:n,reply:`Interrupt sent to ${t.name} / ${e.activeAiSessionId}.`}}}function ty(e){return e.providerTurnId||e.turnId||""}function ny(e){return na(oy(e.status))}function iy(e,t){const n=oy(t.appId)||"App",i=oy(t.title).trim();if(i&&i!==n)return i;const s=function(e,t){for(const n of e.appInventory?.items||[])if(n.id===t)return n.name;return""}(e,n);return s||n}function sy(e){const t=function(e){return"online"!==e.connectionStatus?[]:(e.appInventory?.items||[]).filter(e=>"available"===e.availability)}(e),n=new Map;for(const e of t){const t=ry(e);t&&!n.has(t.id)&&n.set(t.id,t)}return[...n.values()]}function ay(e,t,n,i){const s=oy(t.id)&&function(e,t){const n=ia(e);if(!n)return;return`/apps/access/${n}?token=${encodeURIComponent(t(n))}`}(t,i)||`/instances/${encodeURIComponent(e.id)}/`,a=function(e,t){const n=oy(t);if(n&&new RegExp("^https?://","i").test(n))return new URL(e,n.endsWith("/")?n:n+"/").toString()}(s,n);return{text:a||s,url:a}}function oy(e){return"string"==typeof e&&e.trim()?e.trim():void 0}function ry(e){if("string"==typeof e&&e.trim())return{id:e,label:cy(e)};const t=function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e),n=oy(t.id).trim();return n?{id:n,label:oy(t.name).trim()||cy(n)}:void 0}function cy(e){return{"terminal-tty":"Terminal","gui-terminal":"GUI Terminal",chromium:"Chromium",browser:"Browser","vscode-web":"VS Code"}[e]||e.replace(/[-_]+/g," ").replace(/\b\w/g,e=>e.toUpperCase())}class dy{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleInstancesCommand(e){const t=await this.targets.instancesForBinding(e);return{accepted:!0,routed:!1,binding:e,instances:t,reply:(n=t.length,0===n?"No controlled instances are registered yet.":`Instances: ${n}. Tap an instance to create an app.`),replyMarkup:t.length?Bf(t.map(e=>{return{text:Gf(e.name||e.id,56),callbackData:(t=this.deps.createChatActionToken({type:"instance-app-menu",instanceId:e.id}).token,`task_handoff:cp_i:${t}`)};var t})):void 0};var n}async handleInstanceAppMenuAction(e,t){const n=(await this.targets.instancesForBinding(e)).find(e=>e.id===t);if(!n)return{accepted:!1,routed:!1,binding:e,reply:"Instance not found."};const i=sy(n);return{accepted:!0,routed:!1,binding:e,instance:n,message:`Select an app for ${n.name}.`,reply:i.length?`New app for ${n.name}`:`No launchable apps for ${n.name}.`,replyMarkup:i.length?Bf(i.map(e=>{return{text:Gf(e.label,56),callbackData:(t=this.deps.createChatActionToken({type:"launch-app",instanceId:n.id,appId:e.id}).token,`task_handoff:cp_a:${t}`)};var t})):void 0}}async handleLaunchAppAction(e,t,n){const i=(await this.targets.instancesForBinding(e)).find(e=>e.id===t);if(!i)return{accepted:!1,routed:!1,binding:e,reply:"Instance not found."};const s=sy(i).find(e=>e.id===n);return s?{accepted:!0,routed:!1,binding:e,instance:i,session:await this.deps.launchAppSession(i.id,s.id),message:`${s.label} launched`,reply:`Launched ${s.label} on ${i.name}.`}:{accepted:!1,routed:!1,binding:e,reply:`App ${n} is not launchable for ${i.name}.`}}async handleAppsCommand(e){const t=await this.deps.boardAsync(),n=new Map(t.map(e=>[e.id,e])),i=(await this.deps.listAppSessions()).instances.flatMap(e=>{const t=n.get(e.instanceId);return t?e.appSessions.sessions.filter(ny).filter(e=>Boolean(oy(e.id))).map(e=>({instance:t,session:e,link:ay(t,e,this.deps.controlPlanePublicBaseUrl(),n=>this.deps.createAppAccessToken({instanceId:t.id,sessionId:oy(e.id)||"",mode:n}).token)})):[]}),s=i.filter(e=>e.link.url).map(e=>({text:Gf(`${e.instance.name} · ${iy(e.instance,e.session)}`,56),url:e.link.url}));return{accepted:!0,routed:!1,binding:e,instances:t,reply:(a=i.length,o=s.length,0===a?"No app sessions found.":0===o?`App sessions: ${a}. Set the control plane public URL in Settings > Appearance to open them from chat.`:`App sessions: ${a}. Tap a button to open.`),replyMarkup:s.length?Bf(s):void 0};var a,o}}class ly{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async forwardChatMessage(e,t){const n=t.target?.instanceId||e.activeInstanceId||"",i=t.target?.aiSessionId||e.activeAiSessionId,s=await this.deps.requireControlledInstance(n,!0),a=s.projectId?this.deps.requireProject(s.projectId):void 0;if("online"!==s.connectionStatus){const e=new Error(`Instance ${s.name} is not reachable.`);throw Object.assign(e,{statusCode:409,code:"CHAT_TARGET_UNREACHABLE"}),e}if(i){const n=await this.trySendAiSessionMessage(e,s.id,i,t.message.text,t.message.attachments,!t.target);return n.ok?this.sentResult(e,a,s,i,n.aiSession):this.failedSendResult(n.binding,a,s,n.reply)}const o=await this.targets.defaultAiSessionIdForInstance(s.id);if(o){const n=this.deps.upsertChatSession({...e,activeAiSessionId:o}),i=await this.trySendAiSessionMessage(n,s.id,o,t.message.text,t.message.attachments);return i.ok?this.sentResult(n,a,s,o,i.aiSession):this.failedSendResult(i.binding,a,s,i.reply)}return{accepted:!1,routed:!1,binding:e,project:a||void 0,instance:Mh(s),reply:`No active AI session is selected for ${s.name}. Use /sessions and /session <id> first.`}}async trySendAiSessionMessage(e,t,n,i,s=[],a=!0){try{return{ok:!0,binding:e,aiSession:await this.deps.sendAiSessionMessage(t,n,i||"请查看附件。",void 0,s)}}catch(t){return function(e){return"AI_SESSION_NOT_FOUND"===(e&&"object"==typeof e?e:{}).code}(t)?{ok:!1,binding:a?this.deps.upsertChatSession({...e,activeAiSessionId:void 0}):e,reply:`The selected AI session ${n} no longer exists. Use /session to choose an active AI session.`}:{ok:!1,binding:e,reply:`Failed to send to AI session ${n}: ${Bh(t)}`}}}failedSendResult(e,t,n,i){return{accepted:!1,routed:!1,binding:e,project:t||void 0,instance:Mh(n),reply:i}}sentResult(e,t,n,i,s){return{accepted:!0,routed:!0,binding:e,project:t||void 0,instance:Mh(n),aiSession:s,instanceId:n.id,aiSessionId:i,turnId:(a=s,a.turnId||a.providerTurnId||""),providerTurnId:ty(s),reply:`Sent to ${t?.name||n.sourceSnapshot.name||"Source"} / ${n.name} / ${i}.`};var a}}class py{deps;constructor(e){this.deps=e}async handlePendingCommand(e){const t=await this.deps.listPendingRoutes(),n=e.activeInstanceId?t.filter(t=>t.instanceId===e.activeInstanceId):t;return{accepted:!0,routed:!1,binding:e,pending:n,reply:n.length?n.map(Qf).join("\n"):"No pending routes.",replyMarkup:n.length?Jf(n,(e,t)=>this.deps.pendingDecisionCallbackData(e.id,t)):void 0}}async handlePendingDecisionCommand(e,t,n){const i=$h(t[0]);return i?i.aiSessionId?{accepted:!0,routed:!0,binding:e,pending:i,aiSession:await this.deps.resolveAiSessionApproval(i.instanceId,i.aiSessionId,n),reply:`${n} sent for ${i.instanceId}:${i.aiSessionId}.`}:{accepted:!1,routed:!1,binding:e,pending:i,reply:"Only AI session pending routes are supported here."}:{accepted:!1,routed:!1,binding:e,reply:`Usage: /${"allow"===n?"approve":n} <instance-id:pending-id>`}}async handlePendingReplyCommand(e,t){const n=$h(t[0]),i=t.slice(1).join(" ").trim();return n&&i?n.aiSessionId?{accepted:!0,routed:!0,binding:e,pending:n,aiSession:await this.deps.sendAiSessionMessage(n.instanceId,n.aiSessionId,i),reply:`Reply sent for ${n.instanceId}:${n.aiSessionId}.`}:{accepted:!1,routed:!1,binding:e,pending:n,reply:"Only AI session pending routes are supported here."}:{accepted:!1,routed:!1,binding:e,reply:"Usage: /reply <instance-id:pending-id> <message>"}}}class uy{deps;targets;constructor(e,t){this.deps=e,this.targets=t}async handleUseCommand(e,t){if(0===t.length)return{accepted:!0,routed:!1,binding:e,instances:await this.targets.instancesForBinding(e),reply:await this.targets.renderUseHelp(e)};if(t.length>=2){const n=this.targets.resolveProject(t[0]),i=await this.targets.resolveInstance(t[1],n.id),s=this.deps.upsertChatSession({...e,activeProjectId:n.id,activeInstanceId:i.id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(i.id)});return{accepted:!0,routed:!1,binding:s,reply:await this.targets.renderTargetSelected(s)}}const n=t[0],i=await this.targets.findInstance(n);if(i){const t=i.projectId?this.deps.requireProject(i.projectId):void 0,n=this.deps.upsertChatSession({...e,activeProjectId:t?.id,activeInstanceId:i.id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(i.id)});return{accepted:!0,routed:!1,binding:n,reply:await this.targets.renderTargetSelected(n)}}const s=this.targets.resolveProject(n),a=(await this.deps.boardAsync()).filter(e=>e.projectId===s.id),o=a.filter(e=>"running"===e.status&&"online"===e.connectionStatus);if(1===o.length){const t=this.deps.upsertChatSession({...e,activeProjectId:s.id,activeInstanceId:o[0].id,activeAiSessionId:await this.targets.defaultAiSessionIdForInstance(o[0].id)});return{accepted:!0,routed:!1,binding:t,reply:await this.targets.renderTargetSelected(t)}}return{accepted:!0,routed:!1,binding:this.deps.upsertChatSession({...e,activeProjectId:s.id,activeInstanceId:void 0,activeAiSessionId:void 0}),instances:a,reply:`${s.name} selected. Choose an instance with /use ${s.id} <instance-id-or-name>.\n${this.targets.renderInstanceLines(a)}`}}async handleProjectCommand(e,t){if(0===t.length)return{accepted:!1,routed:!1,binding:e,reply:"Usage: /project <project-id-or-name>"};const n=this.targets.resolveProject(t[0]),i=e.activeInstanceId?await this.deps.requireControlledInstance(e.activeInstanceId).catch(()=>{}):void 0,s=this.deps.upsertChatSession({...e,activeProjectId:n.id,activeInstanceId:i?.projectId===n.id?i.id:void 0,activeAiSessionId:i?.projectId===n.id?e.activeAiSessionId:void 0});return{accepted:!0,routed:!1,binding:s,reply:`Active project: ${n.name}${s.activeInstanceId?"":". Choose an instance with /use."}`}}}class my{deps;constructor(e){this.deps=e}async instancesForBinding(e){const t=await this.deps.boardAsync();return e.activeProjectId?t.filter(t=>t.projectId===e.activeProjectId):t}async fullInstancesForBinding(e){const t=await this.deps.listNodeInstances();return e.activeProjectId?t.filter(t=>t.projectId===e.activeProjectId):t}async renderUseHelp(e){return`Active target: ${await this.renderChatTarget(e)}\nUse /instances to list targets, then /use <instance-id-or-name>. Use /sessions to choose an AI session when there is more than one.`}async renderChatStatus(e){const t=e.activeInstanceId?(await this.deps.boardAsync()).find(t=>t.id===e.activeInstanceId):void 0;return t?`Active target: ${await this.renderChatTarget(e)}\nStatus: ${t.status}, connection: ${t.connectionStatus}`:`Active target: ${await this.renderChatTarget(e)}`}async renderChatHelp(e){return["TaskHandoff chat commands:","/help - show this help","/status or /target - show the active project, instance, and AI session","/instances - list controlled instances","/apps - list app sessions","/use <instance-id-or-name> - choose an active instance","/use <project-id-or-name> <instance-id-or-name> - choose a project and instance","/project <project-id-or-name> - narrow instance selection to a project","/sessions - list all AI sessions","/session <ai-session-id> - choose an active AI session","/pending - list waiting approvals","/approve <instance-id:pending-id>, /deny <...>, /skip <...> - answer approvals","/reply <instance-id:pending-id> <message> - reply to a waiting session","/cancel - interrupt the active AI session","","Send normal text after selecting a target; if there is only one AI session, it is selected automatically.",`Current target: ${await this.renderChatTarget(e)}`].join("\n")}renderInstanceLines(e){return e.map(e=>`${e.name} (${e.id}) - ${e.status}/${e.connectionStatus}`).join("\n")}async renderChatTarget(e){const t=e.activeProjectId?this.deps.getProject(e.activeProjectId):void 0,n=e.activeInstanceId?await this.deps.requireControlledInstance(e.activeInstanceId).catch(()=>{}):void 0,i=e.activeAiSessionId||"none";return`${t?.name||e.activeProjectId||"none"} / ${n?.name||e.activeInstanceId||"none"} / ${i}`}async renderTargetSelected(e){const t=await this.renderChatTarget(e);return e.activeAiSessionId?`Active target: ${t}`:`Active target: ${t}\nNo AI session selected yet. Use /sessions and /session <id>, or send a message once exactly one session is available.`}async defaultAiSessionIdForInstance(e){const t=await this.aiSessionSnapshotForInstance(e),n=(await this.deps.boardAsync()).find(t=>t.id===e),i=(await this.deps.listAppSessions()).instances.find(t=>t.instanceId===e),s=n?{...n,apps:{...n.apps,sessions:i?.appSessions.sessions||[]}}:void 0,a=t&&n?Vf({...s,aiSessions:t}):t?.sessions||[];return 1===a.length?a[0].id:void 0}async aiSessionChoices(e){return(await this.boardInstancesForBinding({},{refresh:!0})).flatMap(t=>Vf(t).map(n=>({index:0,projectId:t.projectId,projectName:t.project?.name||("string"==typeof t.sourceSnapshot.name?t.sourceSnapshot.name:"Source"),instance:t,session:n,active:e.activeInstanceId===t.id&&e.activeAiSessionId===n.id}))).sort((e,t)=>{const n=Kf(t.session)-Kf(e.session);return n||(String(e.instance.name||"").localeCompare(String(t.instance.name||""))||e.instance.id.localeCompare(t.instance.id)||Yf(e.session).localeCompare(Yf(t.session)))}).map((e,t)=>({...e,index:t}))}async boardInstancesForBinding(e,t={}){const n=await this.deps.boardAsync(),i=await this.deps.listAiSessions(t),s=await this.deps.listAppSessions(t),a=new Map(i.instances.map(e=>[e.instanceId,e.aiSessions])),o=new Map(s.instances.map(e=>[e.instanceId,e.appSessions])),r=n.map(e=>{return{...e,apps:{...e.apps,sessions:o.get(e.id)?.sessions||[]},aiSessions:a.get(e.id)||(t=e.aiSessions.updatedAt,{runningCount:0,waitingCount:0,staleCount:0,sessions:[],updatedAt:t})};var t});return e.activeProjectId?r.filter(t=>t.projectId===e.activeProjectId):r}async findAiSession(e){const t=await this.boardInstancesForBinding({},{refresh:!0});for(const n of t){const t=(n.aiSessions?.sessions||[]).find(t=>t.id===e||t.providerSessionId===e);if(t)return{instance:n,session:t}}}async aiSessionSnapshotForInstance(e){const t=await this.deps.listAiSessions();return t.instances.find(t=>t.instanceId===e)?.aiSessions}resolveProject(e){const t=this.deps.getProject(e)||this.deps.listProjects().find(t=>t.name===e);return t||Fh("PROJECT_NOT_FOUND",`Project ${e} was not found.`),t}async resolveInstance(e,t){const n=await this.findInstance(e,t);return n||Fh("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`),n}async findInstance(e,t){return(await this.deps.listNodeInstances()).find(n=>!(n.id!==e&&n.name!==e||t&&n.projectId!==t))}}class hy{deps;targets;sender;appCommands;pendingCommands;aiSessionCommands;targetCommands;constructor(e){this.deps=e,this.targets=new my(e),this.sender=new ly(e,this.targets),this.appCommands=new dy(e,this.targets),this.pendingCommands=new py(e),this.aiSessionCommands=new ey(e,this.targets),this.targetCommands=new uy(e,this.targets)}async handleChatGatewayMessage(e){const t=Fd.parse(e),n=this.deps.upsertChatSession({channel:t.source.channel,bridgeId:t.source.bridgeId,chatSessionId:t.source.chatSessionId,userId:t.source.userId}),i=t.message.text.trim();return i.startsWith("/")?this.handleChatCommand(n,i):i||t.message.attachments.length?n.activeInstanceId?this.sender.forwardChatMessage(n,t):{accepted:!1,routed:!1,binding:n,reply:await this.targets.renderUseHelp(n)}:{accepted:!1,routed:!1,binding:n,reply:""}}async handleChatGatewayAction(e){const t=this.deps.upsertChatSession({channel:e.source.channel,bridgeId:e.source.bridgeId,chatSessionId:e.source.chatSessionId,userId:e.source.userId});return"ai-session"===e.action.type?this.aiSessionCommands.handleAiSessionIndexAction(t,e.action.index):"instance-app-menu"===e.action.type?this.appCommands.handleInstanceAppMenuAction(t,e.action.instanceId):"launch-app"===e.action.type?this.appCommands.handleLaunchAppAction(t,e.action.instanceId,e.action.appId):"pending-decision"===e.action.type?this.pendingCommands.handlePendingDecisionCommand(t,[e.action.routeId],e.action.decision):{accepted:!1,routed:!1,binding:t,reply:"Unknown action."}}async handleChatCommand(e,t){const[n="",...i]=t.split(/\s+/),s=n.replace(/@[\w_]+$/,"");switch(s.toLowerCase()){case"/help":case"/start":return{accepted:!0,routed:!1,binding:e,reply:await this.targets.renderChatHelp(e)};case"/sessions":return this.aiSessionCommands.handleAiSessionsCommand(e);case"/session":return this.aiSessionCommands.handleAiSessionCommand(e,i);case"/cancel":case"/interrupt":return this.aiSessionCommands.handleAiSessionInterruptCommand(e);case"/pending":return this.pendingCommands.handlePendingCommand(e);case"/approve":return this.pendingCommands.handlePendingDecisionCommand(e,i,"allow");case"/deny":return this.pendingCommands.handlePendingDecisionCommand(e,i,"deny");case"/skip":return this.pendingCommands.handlePendingDecisionCommand(e,i,"skip");case"/reply":return this.pendingCommands.handlePendingReplyCommand(e,i);case"/instances":return this.appCommands.handleInstancesCommand(e);case"/apps":return this.appCommands.handleAppsCommand(e);case"/use":return this.targetCommands.handleUseCommand(e,i);case"/project":return this.targetCommands.handleProjectCommand(e,i);case"/status":case"/target":return{accepted:!0,routed:!1,binding:e,instance:e.activeInstanceId?(await this.deps.boardAsync()).find(t=>t.id===e.activeInstanceId):void 0,reply:await this.targets.renderChatStatus(e)};default:return{accepted:!1,routed:!1,binding:e,reply:`Unknown command: ${s||n}. Try /help.`}}}}const gy=f.z.object({id:f.z.string().trim().min(1),preferences:vu,createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict();function fy(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e,n=t.preferences&&"object"==typeof t.preferences&&!Array.isArray(t.preferences)?t.preferences:{};return{id:t.id,preferences:{import:"string"==typeof n.import&&n.import.trim()?n.import:".",export:"string"==typeof n.export&&n.export.trim()?n.export:"."},createdAt:t.createdAt,updatedAt:t.updatedAt}}function yy(){return vu.parse({})}function by(e){return/^[a-z]:[\\/]/i.test(e)||/^[\\/]{2}[^\\/]+[\\/]+[^\\/]+/.test(e)}function vy(e){return by(e)?t.win32:t.posix}class Iy{retiredRoot;legacyControlledInstancesDir;legacyNodeRuntimesDir;legacyNodeJoinInvitesDir;paths;options;constructor(e,n={}){this.paths=e,this.options=n,this.retiredRoot=t.join(e.dataDir,"retired-persistence"),this.legacyControlledInstancesDir=t.join(e.dataDir,"controlled-instances"),this.legacyNodeRuntimesDir=t.join(e.dataDir,"node-runtimes"),this.legacyNodeJoinInvitesDir=t.join(e.dataDir,"node-join-invites")}run(){return this.removePersistedInvites(),this.retireLegacyProjection("controlled-instances",this.legacyControlledInstancesDir,!0),this.retireLegacyProjection("node-runtimes",this.legacyNodeRuntimesDir,!1),function(e){if(!n.existsSync(e.trashRoot))return[];const t=e.nowMs??Date.now(),i=e.retentionMs??Wd,s=[];for(const a of n.readdirSync(e.trashRoot,{withFileTypes:!0})){const o=Vd(e.trashRoot,a.name);try{const e=Number(a.name.split("-",1)[0]);if(!Number.isFinite(e)||e+i>t)continue;const r=n.lstatSync(o);r.isSymbolicLink()?n.unlinkSync(o):r.isDirectory()?n.rmSync(o,{recursive:!0,force:!0}):n.unlinkSync(o),s.push(o)}catch(t){e.logger?.("retired persistence entry cleanup failed",{path:o,error:t instanceof Error?t.message:String(t)})}}return s}({trashRoot:this.retiredRoot,retentionMs:this.options.retentionMs??Wd,nowMs:this.now(),logger:this.options.logger})}removePersistedInvites(){n.existsSync(this.legacyNodeJoinInvitesDir)&&n.rmSync(this.legacyNodeJoinInvitesDir,{recursive:!0,force:!0})}retireLegacyProjection(e,i,s){if(!n.existsSync(i))return;const a=n.lstatSync(i);if(!a.isDirectory()||a.isSymbolicLink())return n.rmSync(i,{force:!0}),void this.options.logger?.("invalid legacy persistence path was removed",{store:e});n.readdirSync(i).length?(s&&this.redactLegacyInstanceCredentials(i),function(e){const t=Vd(e.sourceRoot,e.entryName);if(!n.existsSync(t))return;const i=n.lstatSync(t);if(!i.isDirectory()||i.isSymbolicLink())throw new Error(`Retention source must be a real directory: ${t}`);Kd(e.trashRoot);const s=e.nowMs??Date.now();let a=0,o=`${s}-${e.entryName}`;for(;n.existsSync(Vd(e.trashRoot,o));)a+=1,o=`${s}-${a}-${e.entryName}`;const r=Vd(e.trashRoot,o);n.renameSync(t,r)}({sourceRoot:this.paths.dataDir,entryName:t.basename(i),trashRoot:this.retiredRoot,nowMs:this.now()}),this.options.logger?.("legacy control-plane persistence was retired",{store:e})):n.rmdirSync(i)}redactLegacyInstanceCredentials(e){for(const i of n.readdirSync(e,{withFileTypes:!0})){if(!i.isFile()||i.isSymbolicLink())continue;const s=t.join(e,i.name);try{const e=JSON.parse(n.readFileSync(s,"utf8"));delete e.registrationToken,y.sync(s,`${JSON.stringify(e,null,2)}\n`,{encoding:"utf8",mode:384}),n.chmodSync(s,384)}catch(e){n.rmSync(s,{force:!0}),this.options.logger?.("unreadable legacy instance record was removed",{filePath:s,error:e instanceof Error?e.message:String(e)})}}Kd(e)}now(){return this.options.now?.()??Date.now()}}const xy="task-handoff.control-plane.local",wy="task-handoff.control-plane.builtin";function Sy(e){return"true"===e.labels[xy]}function Ay(e){return"true"===e.labels[wy]}class Ey{projects;models;modelService;images;nodes;pendingPairingRevokes;chatSessions;chatBridges;triggers;nodeJoinService;configSyncPreferences;settings;paths;fetchImpl;dockerCommandRunner;logger;diagnosticLogsState;nodeConnectionRuntime;appAccessService;persistenceMaintenance;chatActionTokenService=new Pf;nodeAgentTransportResolver;proxyPrivateStore;proxyLifecycle;nodeConnectionManager;nodeAgentGateway;controlledInstanceGateway;aiSessionActionService;controlledInstanceCreator;instanceBoardReader=new nf;controlPlaneTriggerService;catalogService;marketCatalogService;gitCredentials;chatBridgeService;chatSessionService;chatSessionRuntime;aiSessionSnapshotProvider;appSessionSnapshotProvider;constructor(e,n={}){this.paths=e,this.fetchImpl=n.fetchImpl||fetch,this.dockerCommandRunner=n.dockerCommandRunner,this.nodeConnectionRuntime=n.nodeConnectionRuntime,this.persistenceMaintenance=new Iy(e,{logger:(e,t)=>this.logWarn(t,e)});const i=e=>({schema:e,logger:(e,t)=>this.logWarn(t,e)});this.proxyPrivateStore=new vh(function(e){const n=t.resolve(e,"control-plane-proxy");return{pendingClaimsDir:t.join(n,"pending-claims"),nodeCredentialsDir:t.join(n,"node-credentials"),identityPath:t.join(n,"identity.json")}}(e.dataDir),(e,t)=>this.logWarn(t,e)),this.nodeAgentTransportResolver=new ch({direct:rh(this.fetchImpl),tunnel:n.nodeAgentTransport,proxy:new hh({credentialForNode:e=>this.proxyPrivateStore.nodeCredential(e.id),fetchImpl:this.fetchImpl})});const s=(a=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(a||"").trim().toLowerCase()));var a;this.diagnosticLogsState=s,this.settings=new Sl(e.settingsPath,()=>tg.parse({diagnosticLogs:s}),{...i(tg),sanitize:e=>function(e,t={}){if(!e||"object"!=typeof e||Array.isArray(e))return{};const n={...e};return"string"==typeof n.mentionTrigger&&Jh(n.mentionTrigger)||(n.mentionTrigger="@"),"string"==typeof n.commandTrigger&&Zh(n.commandTrigger)&&n.commandTrigger!==n.mentionTrigger||(n.commandTrigger="/"),"boolean"!=typeof n.diagnosticLogs&&(n.diagnosticLogs=t.diagnosticLogs??!1),n}(e,{diagnosticLogs:s})}),this.logger=n.logger?{info:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.info?.(e,t)},warn:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.warn?.(e,t)},error:(e,t)=>{this.diagnosticLogsEnabled()&&n.logger?.error?.(e,t)}}:void 0;const o=new vm({request:(e,t,n)=>this.nodeAgentFetch(e,t,n),logger:this.logger});this.nodeAgentGateway=new Wm(o,{onFleetStateChanged:n.onFleetStateChanged}),this.controlledInstanceGateway=new ef({requireNode:e=>this.requireNode(e),nodeAgentTransport:e=>this.nodeAgentTransportResolver.resolve(e)}),this.aiSessionActionService=new um({requireInstance:e=>this.requireControlledInstance(e,!0),request:(e,t,n,i)=>this.instanceRequest(e,t,n,i),requireRuntime:(e,t)=>this.requireNodeRuntimeOnNode(e,t)}),this.projects=new wl(e.projectsDir,{...i(fc),sanitize:Er}),this.models=new wl(e.modelsDir,i(yc)),this.modelService=new Vg({models:this.models,gateway:this.nodeAgentGateway,listNodes:()=>this.listNodes(),requireNode:e=>this.requireNode(e),fetchImpl:this.fetchImpl,listInstances:()=>this.listCachedNodeInstances(),listAiSessions:()=>this.listAiSessions(),listAiSessionHistory:e=>this.listAiSessionHistory(e)}),this.images=new wl(e.imagesDir,{...i(Mc),sanitize:e=>Yc(e,e=>this.logWarn(e,"legacy image profile field was migrated"))}),this.nodes=new wl(e.nodesDir,{...i(ed),sanitize:e=>function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=new Set(["id","name","connectionMode","connectionPath","connectionEnabled","auth","endpoint","controlEndpoint","containerEndpoint","publicWebBase","status","health","capabilities","proxyState","appInventory","labels","lastSeenAt","createdAt","updatedAt"]);for(const e of Object.keys(n))i.has(e)||t?.({field:e});const s=n.auth&&"object"==typeof n.auth&&!Array.isArray(n.auth)?qd(n.auth,["mode","keyId","secret","pairedAt","pairing"]):n.auth;s&&"object"==typeof s&&"pairing"in s&&(s.pairing=qd(s.pairing,["status","joinToken","expiresAt"]));const a=n.connectionPath&&"object"==typeof n.connectionPath&&!Array.isArray(n.connectionPath)?"control-plane-proxy"===n.connectionPath.kind?qd(n.connectionPath,["kind","proxyId","proxyBindingId","targetNodeId"]):qd(n.connectionPath,["kind"]):{kind:"direct"},o=n.proxyState&&"object"==typeof n.proxyState&&!Array.isArray(n.proxyState)?qd(n.proxyState,["reachability","bindingStatus","bindingRevision","streamId","revision","observedAt","target","lastError","updatedAt"]):n.proxyState;if(o&&"object"==typeof o){const e=o;e.target=qd(e.target,["id","name","status","health","lastSeenAt","capabilities"]),e.lastError=qd(e.lastError,["code","message","retryable","details"])}return{...Object.fromEntries(Object.entries(n).filter(([e])=>i.has(e))),auth:s,connectionPath:a,proxyState:o}}(e,e=>this.logWarn(e,"unknown stored node field was ignored"))}),this.pendingPairingRevokes=new wl(e.pendingPairingRevokesDir,i(Eg)),this.proxyLifecycle=new Wh({nodes:this.nodes,privateStore:this.proxyPrivateStore,fetchImpl:this.fetchImpl,requireNode:e=>this.requireNode(e),deleteNode:e=>this.deleteNode(e)}),this.nodeConnectionManager=new _g({nodes:this.nodes,pendingPairingRevokes:this.pendingPairingRevokes,fetchImpl:this.fetchImpl,localNodeLabel:xy,builtinNodeLabel:wy,info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)}),this.chatSessions=new wl(e.chatSessionsDir,i(Bd)),this.chatBridges=new wl(e.chatBridgesDir,i($d)),this.triggers=new wl(e.triggersDir,i(rg)),this.nodeJoinService=new Dg({nodes:this.nodes}),this.configSyncPreferences=new wl(t.join(e.dataDir,"config-sync-preferences"),{...i(gy),sanitize:fy}),this.marketCatalogService=new yf,this.gitCredentials=new Tf(e,{repositoryReferences:e=>this.projects.list().flatMap(t=>{const n=t.source;return"local-folder"!==n.type&&n.auth.secretId===e?[{id:t.id,name:t.name,url:n.url,authType:n.auth.type}]:[]})}),this.catalogService=new uf({projects:this.projects,images:this.images,market:this.marketCatalogService,settings:this.settings,defaultNodeId:()=>this.defaultNodeId(),requireGitCredential:e=>this.gitCredentials.requirePublic(e)}),this.controlledInstanceCreator=new sf({gateway:this.nodeAgentGateway,defaultNodeId:()=>this.defaultNodeId(),requireProject:e=>this.requireProject(e),requireNode:e=>this.requireNode(e),requireRuntime:(e,t)=>this.requireNodeRuntimeOnNode(e,t),requireLocalFolder:(e,t)=>this.requireNodeLocalFolder(e,t),resolveImageSelection:e=>this.catalogService.resolveImageSelection(e),prepareModels:(e,t)=>this.modelService.prepareAssignment(e,t),gitCredentials:this.gitCredentials}),this.controlPlaneTriggerService=new rf({triggers:this.triggers,listInstances:()=>this.listCachedNodeInstances(),listMutationInstances:()=>this.listTriggerMutationInstances(),requireInstance:async e=>this.requireControlledInstance(e,!0),instanceRequest:(e,t,n)=>this.instanceRequest(e,t,n)}),this.appAccessService=new kf({requireInstance:async e=>this.requireControlledInstance(e,!0),listAppSessions:()=>this.listAppSessions()}),this.chatBridgeService=new qf({chatBridges:this.chatBridges,chatSessions:this.chatSessions}),this.chatSessionService=new Uf({chatSessions:this.chatSessions}),this.chatSessionRuntime=new hy({upsertChatSession:e=>this.upsertChatSession(e),boardAsync:()=>this.boardAsync(),listAiSessions:e=>this.listAiSessions(e),listAppSessions:e=>this.listAppSessions(e),listNodeInstances:()=>this.listBootstrapNodeInstances(),listPendingRoutes:()=>this.listPendingRoutes(),pendingDecisionCallbackData:(e,t)=>this.pendingDecisionCallbackData(e,t),createChatActionToken:e=>this.createChatActionToken(e),createAppAccessToken:e=>this.createAppAccessToken(e),controlPlanePublicBaseUrl:()=>this.getSettings().publicBaseUrl||process.env.TASK_HANDOFF_CONTROL_PLANE_URL||process.env.TASK_HANDOFF_PUBLIC_BASE||process.env.TASK_HANDOFF_CONTROL_PLANE_PUBLIC_URL,requireControlledInstance:(e,t)=>this.requireControlledInstance(e,t),requireProject:e=>this.requireProject(e),getProject:e=>this.catalogService.getProject(e),listProjects:()=>this.catalogService.listProjects(),resolveAiSessionApproval:(e,t,n)=>this.resolveAiSessionApproval(e,t,n),sendAiSessionMessage:(e,t,n,i,s)=>this.sendAiSessionMessage(e,t,n,i,s),interruptAiSession:(e,t)=>this.interruptAiSession(e,t),launchAppSession:(e,t,n)=>this.launchAppSession(e,t,n)})}logInfo(e,t){this.logger?.info?.(e,t)}logWarn(e,t){this.logger?.warn?.(e,t)}logError(e,t){this.logger?.error?.(e,t)}setNodeAgentTransport(e){this.nodeAgentTransportResolver.setTunnel(e)}resolveNodeAgentTransport(e){return this.nodeAgentTransportResolver.resolve(e)}setAiSessionSnapshotProvider(e){this.aiSessionSnapshotProvider=e}async listAiSessions(e={}){return this.aiSessionSnapshotProvider?this.aiSessionSnapshotProvider(e):this.bootstrapAiSessionsFromInstances()}setAppSessionSnapshotProvider(e){this.appSessionSnapshotProvider=e}async listAppSessions(e={}){return this.appSessionSnapshotProvider?this.appSessionSnapshotProvider(e):this.bootstrapAppSessionsFromInstances()}listInstanceGitCredentialAssignments(e){return this.gitCredentials.listAssignments(e)}async updateGitCredential(e,t){const n=this.gitCredentials.update(e,t),i=this.gitCredentials.payload(e,{allowDisabled:!0}),s=new Set;for(const t of this.gitCredentials.listAssignments().filter(t=>t.credentialId===e)){let a=this.gitCredentials.authorize(t.instanceId,e,{allowDisabled:!0});try{const n=await this.requireControlledInstance(t.instanceId,!0),o=this.requireNode(n.nodeId),r=o.capabilities.agent,c=r&&"object"==typeof r&&!Array.isArray(r)?r.capabilities:void 0;if(!cd(c)||!dd(c)||!Yo(n.capabilities))throw new Error("Managed Git credential synchronization is unsupported by the target.");s.has(o.id)||(await this.nodeAgentGateway.deployGitCredential(o,i),s.add(o.id)),await this.nodeAgentGateway.replaceGitCredentialAuthorizations(o,this.gitCredentials.desiredAuthorizationSet(t.instanceId)),a=this.gitCredentials.markAssignmentStatus(t.instanceId,e,"synced")}catch(i){a=this.gitCredentials.markAssignmentStatus(t.instanceId,e,"deferred"),this.logWarn({instanceId:t.instanceId,credentialId:e,credentialRevision:n.revision,assignmentRevision:a.assignmentRevision,error:i instanceof Error?i.message:String(i)},"Git credential revision sync deferred")}}return n}async authorizeInstanceGitCredential(e,t){const n=await this.requireControlledInstance(e,!0),i=this.requireNode(n.nodeId);if(!Yo(n.capabilities))throw Object.assign(new Error(`Instance ${n.id} does not support managed Git CLI credentials.`),{code:"GIT_CREDENTIAL_INSTANCE_UNSUPPORTED",statusCode:409});const s=i.capabilities.agent,a=s&&"object"==typeof s&&!Array.isArray(s)?s.capabilities:void 0;if(!cd(a)||!dd(a))throw Object.assign(new Error(`Node ${i.id} does not support managed Git credentials.`),{code:"GIT_CREDENTIAL_NODE_UNSUPPORTED",statusCode:409});const o=this.gitCredentials.payload(t);await this.nodeAgentGateway.deployGitCredential(i,o);let r=this.gitCredentials.authorize(e,t);try{await this.nodeAgentGateway.replaceGitCredentialAuthorizations(i,this.gitCredentials.desiredAuthorizationSet(e)),r=this.gitCredentials.markAssignmentStatus(e,t,"synced")}catch(n){r=this.gitCredentials.markAssignmentStatus(e,t,"deferred"),this.logWarn({instanceId:e,credentialId:t,error:n instanceof Error?n.message:String(n)},"Git credential assignment sync deferred")}return r}async revokeInstanceGitCredential(e,t){const n=await this.requireControlledInstance(e,!0),i=this.requireNode(n.nodeId);if(!this.gitCredentials.listAssignments(e).find(e=>e.credentialId===t))return!1;this.gitCredentials.markAssignmentStatus(e,t,"revoking");try{await this.nodeAgentGateway.replaceGitCredentialAuthorizations(i,this.gitCredentials.desiredAuthorizationSet(e)),this.gitCredentials.revoke(e,t);const n=await this.listCachedNodeInstances();return this.gitCredentials.listAssignments().some(e=>{if(e.credentialId!==t)return!1;const s=n.find(t=>t.id===e.instanceId);return s?.nodeId===i.id})||await this.nodeAgentGateway.removeGitCredential(i,t).catch(()=>{}),!0}catch(n){return this.logWarn({instanceId:e,credentialId:t,error:n instanceof Error?n.message:String(n)},"Git credential revocation deferred"),!1}}init(){this.runPersistenceMaintenance(),this.projects.init(),this.models.init(),this.images.init(),this.nodes.init(),this.pendingPairingRevokes.init(),this.chatSessions.init(),this.chatBridges.init(),this.triggers.init(),this.gitCredentials.init(),this.proxyPrivateStore.init(),this.proxyPrivateStore.gcNodeCredentials(e=>{const t=this.nodes.get(e.nodeId);return"control-plane-proxy"===t?.connectionMode&&"control-plane-proxy"===t.connectionPath.kind&&t.connectionPath.proxyBindingId===e.proxyBindingId&&t.connectionPath.targetNodeId===e.targetNodeId}),this.settings.init();const e=this.settings.put(this.settings.get());this.diagnosticLogsState=e.diagnosticLogs,this.migrateLegacyImageCatalog(),this.seedDefaults(),this.refreshCachedNodeInstances();const t=this.listNodes().map(e=>this.projectNodeConnection(e));this.nodeAgentGateway.refreshFleetRuntimes(t).catch(e=>{this.logWarn({error:Bh(e)},"control plane runtime directory warmup failed")}),this.nodeAgentGateway.refreshFleetModels(t).catch(e=>{this.logWarn({error:Bh(e)},"control plane model directory warmup failed")})}runPersistenceMaintenance(){try{return this.persistenceMaintenance.run()}catch(e){return this.logWarn({error:e instanceof Error?e.message:String(e)},"control-plane persistence maintenance failed"),[]}}migrateLegacyImageCatalog(){const e=Object.keys(Sr),i=[];for(const t of e){const e=this.images.filePath(t);if(n.existsSync(e))try{i.push({id:t,filePath:e,record:JSON.parse(n.readFileSync(e,"utf8"))})}catch(e){return this.writeMarketMigrationState("failed",{code:"LEGACY_IMAGE_BACKUP_READ_FAILED",legacyId:t,error:Bh(e)}),void this.logWarn({legacyId:t,error:Bh(e)},"legacy embedded image migration was not applied")}}if(!i.length)return;const s=n.readdirSync(this.paths.projectsDir).filter(e=>e.endsWith(".json")).sort().map(e=>t.join(this.paths.projectsDir,e)),a=[];for(const e of s)try{const t=JSON.parse(n.readFileSync(e,"utf8")),i=fc.parse(Er(t));a.push({filePath:e,raw:t,migrated:i})}catch(t){return this.writeMarketMigrationState("failed",{code:"PROJECT_REFERENCE_VALIDATION_FAILED",filePath:e,error:Bh(t)}),void this.logWarn({filePath:e,error:Bh(t)},"legacy embedded image migration was not applied")}const o=a.find(({migrated:t})=>{const n=t.defaultImageSelection?.imageId;return!!n&&e.includes(n)});if(o)this.writeMarketMigrationState("failed",{code:"PROJECT_REFERENCE_MIGRATION_INCOMPLETE",filePath:o.filePath});else{n.mkdirSync(this.paths.marketDir,{recursive:!0}),y.sync(this.paths.marketMigrationBackupPath,`${JSON.stringify({version:qo,createdAt:hl(),images:i.map(({id:e,record:t})=>({id:e,record:t})),projects:a.map(({filePath:e,raw:n})=>({file:t.basename(e),record:n}))},null,2)}\n`,{encoding:"utf8"});for(const{migrated:e}of a)this.projects.put(e);for(const{id:e}of i)this.images.delete(e),this.logWarn({legacyId:e,marketId:Sr[e]},"embedded image profile migrated to Market");this.writeMarketMigrationState("complete",{code:"LEGACY_IMAGE_MIGRATION_COMPLETE",migratedImageIds:i.map(({id:e})=>e),backupPath:this.paths.marketMigrationBackupPath})}}writeMarketMigrationState(e,t){n.mkdirSync(this.paths.marketDir,{recursive:!0}),y.sync(this.paths.marketStatePath,`${JSON.stringify({status:e,updatedAt:hl(),...t},null,2)}\n`,{encoding:"utf8"})}getSettings(){return this.catalogService.getSettings()}diagnosticLogsEnabled(){return this.diagnosticLogsState}updateSettings(e){const t=this.catalogService.updateSettings(e);return this.diagnosticLogsState=t.diagnosticLogs,t}seedDefaults(){return this.catalogService.seedDefaults()}listProjects(){return this.catalogService.listProjects()}defaultNodeId(){return this.nodes.list().find(Sy)?.id||this.nodes.list()[0]?.id}async syncLocalNodeConnection(){const e=await this.nodeConnectionManager.syncLocal();return this.nodeConnectionRuntime?.observedReachable(e),this.projectNodeConnection(e)}async recoverPendingPairingRevokes(){await this.nodeConnectionManager.recoverPendingPairingRevokes(),await this.reconcileGitCredentialAssignments()}async reconcileGitCredentialAssignments(){const e=this.gitCredentials.listAssignments().filter(e=>"synced"!==e.status);for(const t of e)try{const e=await this.requireControlledInstance(t.instanceId,!0),n=this.requireNode(e.nodeId);if("revoking"===t.status){await this.nodeAgentGateway.replaceGitCredentialAuthorizations(n,this.gitCredentials.desiredAuthorizationSet(t.instanceId)),this.gitCredentials.revoke(t.instanceId,t.credentialId);continue}const i=this.gitCredentials.payload(t.credentialId,{allowDisabled:!0});await this.nodeAgentGateway.deployGitCredential(n,i),await this.nodeAgentGateway.replaceGitCredentialAuthorizations(n,this.gitCredentials.desiredAuthorizationSet(t.instanceId)),this.gitCredentials.markAssignmentStatus(t.instanceId,t.credentialId,"synced")}catch(e){this.logWarn({instanceId:t.instanceId,credentialId:t.credentialId,assignmentRevision:t.assignmentRevision,error:e instanceof Error?e.message:String(e)},"Git credential assignment convergence deferred")}}listModels(){return this.modelService.list()}listFederatedModels(e,t=!1){return this.modelService.listFederated(e,t)}createModel(e){return this.modelService.create(e)}copyModel(e,t){return this.modelService.copy(e,t)}updateModel(e,t){return this.modelService.update(e,t)}deleteModel(e){return this.modelService.delete(e)}reorderModels(e){return this.modelService.reorder(e)}createNodeModel(e,t){return this.modelService.createOnNode(e,t)}updateNodeModel(e,t,n){return this.modelService.updateOnNode(e,t,n)}deleteNodeModel(e,t){return this.modelService.deleteOnNode(e,t)}discoverModels(e){return this.modelService.discover(e)}testModel(e){return this.modelService.test(e)}discoverNodeModels(e,t){return this.modelService.discoverOnNode(e,t)}testNodeModel(e,t){return this.modelService.testOnNode(e,t)}createProject(e){return this.catalogService.createProject(e)}updateProject(e,t){return this.catalogService.updateProject(e,t)}deleteProject(e){return this.catalogService.deleteProject(e)}listImages(){return this.catalogService.listImages()}getMarketCatalog(){return this.catalogService.getMarketCatalog()}async refreshMarketCatalog(){return await this.marketCatalogService.refresh(new ff),this.getMarketCatalog()}listImageOptions(){return this.catalogService.listImageOptions()}createImage(e){return this.catalogService.createImage(e)}async listNodeDockerImages(e){const t=this.requireNode(e);return this.nodeAgentGateway.listDockerImages(t)}async listNodeImageAvailability(e){const t=this.requireNode(e),n=t.capabilities.agent&&"object"==typeof t.capabilities.agent?t.capabilities.agent:{},i={os:"string"==typeof n.platform?n.platform:void 0,architecture:"string"==typeof n.arch?"x64"===n.arch?"amd64":n.arch:void 0},s=this.catalogService.listImageOptions(i);try{const e=await this.nodeAgentGateway.listDockerImages(t);return s.map(t=>{const n=e.find(e=>e.reference===t.reference||!!t.digest&&e.repoDigests.some(e=>e.endsWith(`@${t.digest}`))||e.repoDigests.includes(t.reference));return wd.parse({image:t,status:n?"available":"pull-required",localImage:n,localSizeBytes:n?.sizeBytes,downloadSizeBytes:n?void 0:t.downloadSizeBytes,unpackedSizeBytes:n?void 0:t.unpackedSizeBytes})})}catch(e){const t=e instanceof Error?e.message:String(e);return s.map(e=>wd.parse({image:e,status:"unknown",error:t}))}}async listNodeLocalFolders(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.listLocalFolders(n,{signal:t})}async listNodeFolderTree(e,t={}){const n=this.requireNode(e);return this.nodeAgentGateway.listFolderTree(n,t)}async listNodeFolderPlaces(e){const t=this.requireNode(e);if(n=t.capabilities?.agent&&"object"==typeof t.capabilities.agent?t.capabilities.agent.capabilities:void 0,!0!==od.safeParse(n).data?.folderPlaces)return(await this.nodeAgentGateway.listFolderTree(t,{depth:0})).map(e=>Ad.parse({kind:"root",name:e.name,path:e.path}));var n;try{return await this.nodeAgentGateway.listFolderPlaces(t)}catch(e){if(404!==(e&&"object"==typeof e?e.statusCode:void 0))throw e;return(await this.nodeAgentGateway.listFolderTree(t,{depth:0})).map(e=>Ad.parse({kind:"root",name:e.name,path:e.path}))}}async createNodeLocalFolder(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.createLocalFolder(n,t)}async updateNodeLocalFolder(e,t,n){const i=this.requireNode(e);if(s=i.capabilities?.agent&&"object"==typeof i.capabilities.agent?i.capabilities.agent.capabilities:void 0,!0!==od.safeParse(s).data?.localFolderNameUpdate){const e=new Error(`Node ${i.id} does not support local folder name updates.`);throw Object.assign(e,{statusCode:409,code:"NODE_LOCAL_FOLDER_NAME_UPDATE_UNSUPPORTED"})}var s;return this.nodeAgentGateway.updateLocalFolder(i,t,n)}async deleteNodeLocalFolder(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteLocalFolder(n,t)}async checkNode(e){const t=this.requireNode(e);try{const e=await this.nodeAgentGateway.health(t),n=e&&"object"==typeof e?e:{},i="string"==typeof n.nodeId&&n.nodeId.trim()?n.nodeId.trim():t.id,s=ed.parse({...t,id:i,status:"online",health:"ok",capabilities:"object"==typeof e&&e?{...t.capabilities,agent:Ph(e)}:t.capabilities,lastSeenAt:hl(),updatedAt:hl()});return i!==t.id&&this.nodes.delete(t.id),this.nodes.put(s),this.nodeConnectionRuntime?.observedReachable(s),{id:s.id,status:"online",checkedAt:hl(),agent:e}}catch(e){const n=ed.parse({...t,status:"offline",health:"failed",updatedAt:hl()});return this.nodes.put(n),this.nodeConnectionRuntime?.observedFailure(n,Bh(e)),{id:t.id,status:"offline",checkedAt:hl(),error:e instanceof Error?e.message:String(e)}}}async checkNodeUpdate(e,t){return this.nodeAgentGateway.checkUpdate(this.requireNode(e),t)}async applyNodeUpdate(e,t){return this.nodeAgentGateway.applyUpdate(this.requireNode(e),t)}async listNodeUpdateJobs(e){return this.nodeAgentGateway.listUpdateJobs(this.requireNode(e))}async getLocalNodeExternalListener(e){return this.nodeAgentGateway.getExternalListener(this.requireLocalListenerNode(e))}async updateLocalNodeExternalListener(e,t){return this.nodeAgentGateway.updateExternalListener(this.requireLocalListenerNode(e),t)}async createNodePairingInvite(e,t={}){const n=this.requireNode(e);return this.nodeAgentGateway.createPairingInvite(n,t)}requireLocalListenerNode(e){const t=this.requireNode(e);if(!Ay(t)||!Sy(t)){const e=new Error("Node agent TCP listener settings are available only for the built-in local node.");throw Object.assign(e,{statusCode:403,code:"LOCAL_NODE_LISTENER_ONLY"}),e}return t}createNodeJoinInvite(e={}){return this.nodeJoinService.createInvite(e)}getNodeJoinInviteStatus(e){return this.nodeJoinService.status(e)}completeNodeJoin(e){return this.nodeJoinService.complete(e)}async connectNodeToControlPlane(e,t){const n=this.requireNode(e),i=Sg.parse(t);return this.nodeAgentGateway.createControlPlaneConnection(n,i)}async listNodeControlPlanePairings(e){const t=this.requireNode(e);return this.nodeAgentGateway.listControlPlanePairings(t)}async deleteNodeControlPlanePairing(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteControlPlanePairing(n,t)}async listNodeControlPlaneConnections(e){const t=this.requireNode(e);return this.nodeAgentGateway.listControlPlaneConnections(t)}async deleteNodeControlPlaneConnection(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteControlPlaneConnection(n,t)}updateImage(e,t){return this.catalogService.updateImage(e,t)}async deleteImage(e){this.catalogService.requireImage(e);const t=this.listProjects().find(t=>t.defaultImageSelection?.imageId===e);if(t)throw Object.assign(new Error(`Image ${e} is the default for project ${t.name}.`),{statusCode:409,code:"IMAGE_IN_USE"});const n=this.readCachedNodeInstances(),i=n.nodeStates.filter(e=>"uninitialized"===e.phase||"loading"===e.phase||"stale"===e.phase);if(i.length){this.refreshCachedNodeInstances();const e=new Error("The instance directory is still loading; retry after every node has reported its instance snapshot.");throw Object.assign(e,{statusCode:503,code:"INSTANCE_DIRECTORY_LOADING",nodeIds:i.map(e=>e.nodeId)})}const s=n.items.find(t=>t.imageSelection?.imageId===e);if(s)throw Object.assign(new Error(`Image ${e} is used by instance ${s.name}.`),{statusCode:409,code:"IMAGE_IN_USE"});return this.catalogService.deleteImage(e)}listNodes(){return this.nodes.list()}listPublicNodes(){return this.listNodes().map(e=>Dh(this.projectNodeConnection(e)))}projectNodeConnection(e){return this.nodeConnectionRuntime?.project(e)||e}createNode(e){return this.nodeConnectionManager.create(e)}listPendingProxyClaims(){return this.proxyLifecycle.listPendingClaims()}claimProxyNode(e){return this.proxyLifecycle.claimNode(e)}resumeProxyClaim(e){return this.proxyLifecycle.resumeClaim(e)}cancelProxyClaim(e,t=!1){return this.proxyLifecycle.cancelClaim(e,t)}applyProxyTargetSnapshot(e,t){return this.proxyLifecycle.applyTargetSnapshot(e,t)}applyProxyTargetEvent(e,t){return this.proxyLifecycle.applyTargetEvent(e,t)}markProxyUnavailable(e,t){return this.proxyLifecycle.markUnavailable(e,t)}markProxyBindingRevoked(e,t){return this.proxyLifecycle.markBindingRevoked(e,t)}updateNode(e,t){const n=wg.parse(t),i=this.requireNode(e);this.proxyLifecycle.assertIdentityPatch(i,n);const s=ed.parse({...i,...n,id:e,createdAt:i.createdAt,updatedAt:hl()});return this.nodes.put(s)}deleteNode(e){if(Ay(this.requireNode(e))){const e=new Error("The built-in local node connection cannot be deleted.");throw Object.assign(e,{statusCode:400,code:"LOCAL_NODE_CANNOT_BE_DELETED"}),e}return this.nodeAgentGateway.forgetNode(e),this.nodes.delete(e)}dispose(){this.nodeAgentGateway.dispose()}async deleteNodeWithProxyLifecycle(e,t=!1){return this.proxyLifecycle.deleteNode(this.requireNode(e),t)}async listNodeRuntimes(e,t){const n=e?[this.requireNode(e)]:this.listNodes();return e?this.nodeAgentGateway.listRuntimes(n[0],{signal:t}):(await this.nodeAgentGateway.listFleetRuntimes(n,{signal:t})).items}async listNodeRuntimesWithDiagnostics(e,t=!1){const n=this.listNodes().map(e=>this.projectNodeConnection(e));return t?(this.nodeAgentGateway.refreshFleetRuntimes(n).catch(e=>{this.logWarn({error:Bh(e)},"control plane runtime directory refresh failed")}),this.nodeAgentGateway.readFleetRuntimes(n)):this.nodeAgentGateway.listFleetRuntimes(n,{signal:e})}async createNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.createRuntime(n,t)}async updateNodeRuntime(e,t,n){const i=this.requireNode(e);return this.nodeAgentGateway.updateRuntime(i,t,n)}async deleteNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.deleteRuntime(n,t)}async checkNodeRuntime(e,t){const n=this.requireNode(e);return this.nodeAgentGateway.checkRuntime(n,t)}async listControlledInstances(){return(await this.listNodeInstancesWithDiagnostics()).items.map(Mh)}async listControlledInstancesWithDiagnostics(){const e=await this.listNodeInstancesWithDiagnostics();return{items:e.items.map(Mh),nodeErrors:e.nodeErrors,nodeStates:e.nodeStates}}async instanceResourceMetrics(e){const t=await this.requireNodeInstance(e);return this.nodeAgentGateway.instanceResourceMetrics(this.requireNode(t.nodeId),t.id)}async nodeOwnsInstance(e,t){const n=this.requireNode(e),i=this.nodeAgentGateway.readFleetInstances([n]);return!!i.items.some(n=>n.id===t&&n.nodeId===e)||"ready"!==i.nodeStates[0]?.phase&&(await this.nodeAgentGateway.listInstances(n)).some(n=>n.id===t&&n.nodeId===e)}async applyInstanceLifecycle(e,t){const n=this.requireNode(e);if("missing"!==this.nodeAgentGateway.applyInstanceLifecycle(n,t))return!0;await this.nodeAgentGateway.refreshFleetInstances([n],{},!0);const i=this.nodeAgentGateway.instanceFromSnapshot([n],t.instanceId);return!(!i||i.nodeId!==e||(this.nodeAgentGateway.applyInstanceLifecycle(n,t),0))}createControlledInstance(e){return this.controlledInstanceCreator.create(e)}resolveControlledInstanceTargetNodeId(e){return this.controlledInstanceCreator.targetNodeId(e)}async updateControlledInstance(e,t){const n=gg.parse(t),i=await this.requireNodeInstance(e),s=this.requireNode(i.nodeId);void 0!==n.config?.aiSessionHistoryLimit&&function(e,t){const n=e.capabilities.agent,i=n&&"object"==typeof n&&!Array.isArray(n)?n.capabilities:void 0;if(!Boolean(i&&"object"==typeof i&&!Array.isArray(i)&&!0===i.aiSessionHistoryLimit)||!Ko(t.capabilities).features.aiSessionPersistenceSettings)throw Object.assign(new Error("This instance does not support managed AI session history retention settings."),{statusCode:409,code:"AI_SESSION_HISTORY_LIMIT_UNSUPPORTED"})}(s,i),void 0!==n.config?.aiSessionAttachmentRetentionDays&&function(e,t){const n=e.capabilities.agent,i=n&&"object"==typeof n&&!Array.isArray(n)?n.capabilities:void 0;if(!Boolean(i&&"object"==typeof i&&!Array.isArray(i)&&!0===i.aiSessionAttachmentRetention)||!0!==t.capabilities.features.aiSessionConversationAttachments?.retentionSettings)throw Object.assign(new Error("This instance does not support managed AI session attachment retention settings."),{statusCode:409,code:"AI_SESSION_ATTACHMENT_RETENTION_UNSUPPORTED"})}(s,i),void 0!==n.config?.aiSessionMaxFileAttachmentBytes&&function(e,t){const n=e.capabilities.agent;if(!ld(n&&"object"==typeof n&&!Array.isArray(n)?n.capabilities:void 0)||!0!==function(e){return Ko(e).features.aiSessionConversationAttachments}(t.capabilities).fileSizeLimitSettings)throw Object.assign(new Error("This instance does not support managed AI session file attachment limits."),{statusCode:409,code:"AI_SESSION_FILE_ATTACHMENT_LIMIT_UNSUPPORTED"})}(s,i);const{modelSelection:a,...o}=n;let r=Object.keys(o).length?await this.nodeAgentGateway.updateInstance(s,e,o):i;if(a){const t=await this.modelService.prepareAssignment(s,a);r=(await this.nodeAgentGateway.assignInstanceModels(s,e,t)).instance}return Mh(r)}async deleteControlledInstance(e,t){const n=Ir.parse(t),i=await this.requireNodeInstance(e),s=this.requireNode(i.nodeId),a=await this.nodeAgentGateway.deleteInstance(s,e,n);return a.completed&&(this.configSyncPreferences.delete(e),this.gitCredentials.revokeInstance(e)),a}listEnvironmentTemplates(e){return this.nodeAgentGateway.listEnvironmentTemplates(this.requireNode(e))}getEnvironmentTemplate(e,t){return this.nodeAgentGateway.getEnvironmentTemplate(this.requireNode(e),t)}async createEnvironmentTemplate(e,t){const n=await this.requireNodeInstance(e);return this.nodeAgentGateway.createEnvironmentTemplate(this.requireNode(n.nodeId),e,t)}deleteEnvironmentTemplate(e,t){return this.nodeAgentGateway.deleteEnvironmentTemplate(this.requireNode(e),t)}async startControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);await this.modelService.ensureInstanceAssignment(t);const i=this.gitCredentials.operationProvisioning(e),s=await this.nodeAgentGateway.startInstance(n,e,i?{gitWorkspaceProvisioning:i}:{});return i&&s.gitWorkspaceProvisioningOperationId===i.operationId&&this.gitCredentials.forgetOperationProvisioning(e),Mh(s.instance)}async stopControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);return Mh(await this.nodeAgentGateway.stopInstance(n,e))}async restartControlledInstance(e){const t=await this.requireNodeInstance(e),n=this.requireNode(t.nodeId);await this.modelService.ensureInstanceAssignment(t);const i=this.gitCredentials.operationProvisioning(e),s=await this.nodeAgentGateway.restartInstance(n,e,i?{gitWorkspaceProvisioning:i}:{});return i&&s.gitWorkspaceProvisioningOperationId===i.operationId&&this.gitCredentials.forgetOperationProvisioning(e),Mh(s.instance)}async retryControlledInstanceImageProvisioning(e){const t=await this.requireNodeInstance(e);return Mh(await this.nodeAgentGateway.retryInstanceImageProvisioning(this.requireNode(t.nodeId),e))}async boardAsync(){return await this.listBootstrapNodeInstances(),(await this.boardWithDiagnostics(void 0,!0)).items}async boardWithDiagnostics(e,t=!1){const[n,i]=await Promise.all([this.listNodeRuntimesWithDiagnostics(e,t),this.listNodeInstancesWithDiagnostics(e,t)]);return this.instanceBoardReader.read({projects:this.listProjects(),images:this.listImageOptions(),nodes:this.nodes.list().map(e=>this.projectNodeConnection(e)),runtimes:n.items,instances:i.items,nodeErrors:[...n.nodeErrors,...i.nodeErrors],nodeStates:[...n.nodeStates,...i.nodeStates]})}async bootstrapAiSessionsFromInstances(){const e=await this.listBootstrapNodeInstances(),t=await Promise.all(e.map(async e=>{if(!Gd(e)||!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus)return{streamId:`bootstrap:${e.id}:ai.sessions`,revision:0,lastEventAt:e.aiSessions.updatedAt,snapshot:e.aiSessions};try{return Dl(Is,await this.instanceRequest(e,"/ai-sessions/state"))}catch(t){return this.logWarn({instanceId:e.id,error:Bh(t),errorCode:"AI_SESSION_LIVE_REFRESH_FAILED"},"control plane failed to refresh live AI sessions"),{streamId:`bootstrap:${e.id}:ai.sessions`,revision:0,lastEventAt:e.aiSessions.updatedAt,snapshot:e.aiSessions}}}));return{updatedAt:(new Date).toISOString(),instances:e.map((e,n)=>({instanceId:e.id,streamId:t[n].streamId,aiSessions:t[n].snapshot,revision:t[n].revision,lastEventAt:t[n].lastEventAt}))}}async bootstrapAppSessionsFromInstances(){const e=await this.listBootstrapNodeInstances(),t=await Promise.all(e.map(async e=>{if(!Gd(e)||!e.target.web||"online"!==e.connectionStatus&&"online"!==e.agentStatus){const t=la();return{streamId:`bootstrap:${e.id}:app.sessions`,revision:0,lastEventAt:t.updatedAt,snapshot:t}}try{return Dl(Gs,await this.instanceRequest(e,"/apps/sessions/state"))}catch(t){this.logWarn({instanceId:e.id,error:Bh(t),errorCode:"APP_SESSION_LIVE_REFRESH_FAILED"},"control plane failed to refresh live app sessions");const n=la();return{streamId:`bootstrap:${e.id}:app.sessions`,revision:0,lastEventAt:n.updatedAt,snapshot:n}}}));return{updatedAt:(new Date).toISOString(),instances:e.map((e,n)=>({instanceId:e.id,streamId:t[n].streamId,appSessions:t[n].snapshot,revision:t[n].revision,lastEventAt:t[n].lastEventAt}))}}async recoverAiSessionDelta(e,t,n){const i=await this.requireControlledInstance(e,!0),s=new URLSearchParams({streamId:t,sinceRevision:String(n)});return Dl(Cs,await this.instanceRequest(i,`/ai-sessions?${s}`))}async recoverAiSessionSnapshot(e){const t=await this.requireControlledInstance(e,!0);return Dl(Is,await this.instanceRequest(t,"/ai-sessions/state"))}async recoverAppSessionDelta(e,t,n){const i=await this.requireControlledInstance(e,!0),s=new URLSearchParams({streamId:t,sinceRevision:String(n)});return Dl(Js,await this.instanceRequest(i,`/apps/sessions?${s}`))}async recoverAppSessionSnapshot(e){const t=await this.requireControlledInstance(e,!0);return Dl(Gs,await this.instanceRequest(t,"/apps/sessions/state"))}async listTriggers(){return this.controlPlaneTriggerService.listTriggers()}createTrigger(e){return this.controlPlaneTriggerService.createTrigger(e)}async updateTrigger(e,t){return this.controlPlaneTriggerService.updateTrigger(e,t)}async deleteTrigger(e){return this.controlPlaneTriggerService.deleteTrigger(e)}async applyTrigger(e,t){return this.controlPlaneTriggerService.applyTrigger(e,t)}async listInstanceTriggers(e){return this.controlPlaneTriggerService.listInstanceTriggers(e)}async bindAiSessionTrigger(e,t,n){return this.controlPlaneTriggerService.bindAiSessionTrigger(e,t,n)}async unbindAiSessionTrigger(e,t,n){return this.controlPlaneTriggerService.unbindAiSessionTrigger(e,t,n)}async runInstanceTrigger(e,t,n={}){return this.controlPlaneTriggerService.runInstanceTrigger(e,t,n)}listChatSessions(){return this.chatSessionService.list()}createAppAccessToken(e){return this.appAccessService.createToken(e)}createAppSessionAccessToken(e){return this.appAccessService.createSessionToken(e)}revokeAppSessionAccessToken(e,t){this.appAccessService.revokeToken(e,t)}resolveAppAccessToken(e,t){return this.appAccessService.resolveToken(e,t)}createChatActionToken(e){return this.chatActionTokenService.create(e)}resolveChatActionToken(e,t){return this.chatActionTokenService.resolve(e,t)}pendingDecisionCallbackData(e,t){return this.chatActionTokenService.pendingDecisionCallbackData(e,t)}async appAccessProxyTarget(e,t,n=""){return this.appAccessService.proxyTarget(e,t,n)}listChatBridges(){return this.chatBridgeService.list()}requireChatBridge(e){return this.chatBridgeService.require(e)}createChatBridge(e){return this.chatBridgeService.create(e)}updateChatBridge(e,t){return this.chatBridgeService.update(e,t)}deleteChatBridge(e){return this.chatBridgeService.delete(e)}requireChatSession(e){return this.chatSessionService.require(e)}upsertChatSession(e){return this.chatSessionService.upsert(e)}async handleChatGatewayMessage(e){return this.chatSessionRuntime.handleChatGatewayMessage(e)}async handleChatGatewayAction(e){return this.chatSessionRuntime.handleChatGatewayAction(e)}async handleChatCommand(e,t){return this.chatSessionRuntime.handleChatCommand(e,t)}async listPendingRoutes(){const e=hl(),t=[],n=await this.listAiSessions(),i=new Map(n.instances.map(e=>[e.instanceId,e.aiSessions])),s=this.readCachedNodeInstances();this.refreshCachedNodeInstances();for(const n of s.items){if("online"!==n.connectionStatus&&"online"!==n.agentStatus||!n.target.web)continue;const s=n.projectId?this.catalogService.getProject(n.projectId):void 0;for(const a of i.get(n.id)?.sessions||[]){if("waiting"!==a.status)continue;const i=Hd.parse({id:`${n.id}:ai:${a.id}`,instanceId:n.id,projectId:n.projectId,aiSessionId:a.id,providerSessionId:a.providerSessionId,result:a.summary||a.currentTool?.inputPreview||a.lastMessage||`${a.agent} is waiting for approval`,source:a.agent,kind:"approval",status:"pending",lastSeenAt:e});t.push({...i,project:s,instance:Mh(n)})}}return t}async listAiSessionInstanceNames(){return(await this.listBootstrapNodeInstances()).map(e=>({id:e.id,name:e.name}))}resolveAiSessionApproval(e,t,n){return this.aiSessionActionService.resolveApproval(e,t,n)}listAiSessionHistory(e,t){return this.aiSessionActionService.listHistory(e,t)}getAiSessionHistoryDetail(e,t){return this.aiSessionActionService.historyDetail(e,t)}getAiSessionTimeline(e,t){return this.aiSessionActionService.timeline(e,t)}getAiSessionTurnTimeline(e,t,n){return this.aiSessionActionService.turnTimeline(e,t,n)}resumeAiSession(e,t){return this.aiSessionActionService.resume(e,t)}async createAiSession(e,t){const n=await this.requireControlledInstance(e,!0),{cwdFolderId:i,...s}=t,a={type:"runtime-path",path:await this.aiSessionRuntimeCwd(n,t.cwdFolderId)};return this.aiSessionActionService.create(e,{...s,cwd:a,...t.cwdFolderId?{cwdFolderId:t.cwdFolderId}:{}})}async inspectAiSessionWorkspace(e,t){const n=await this.requireControlledInstance(e,!0),i={type:"runtime-path",path:await this.aiSessionRuntimeCwd(n,t)};return this.aiSessionActionService.inspectWorkspace(e,i)}forkAiSession(e,t,n){return this.aiSessionActionService.fork(e,t,n)}updateAiSessionModelSelection(e,t,n,i){return this.aiSessionActionService.updateModelSelection(e,t,n,i)}updateAiSessionReasoningEffort(e,t,n,i){return this.aiSessionActionService.updateReasoningEffort(e,t,n,i)}openAiSessionApp(e,t,n){return this.aiSessionActionService.openApp(e,t,n)}closeAiSession(e,t,n){return this.aiSessionActionService.close(e,t,n)}aiSessionActionDiagnostics(){return this.aiSessionActionService.diagnostics()}async launchAppSession(e,t="terminal-tty",n={}){const i=await this.requireControlledInstance(e,!0);if("online"!==i.connectionStatus&&"online"!==i.agentStatus){const e=new Error(`Instance ${i.name} is still starting. Wait for it to connect before launching apps.`);throw Object.assign(e,{statusCode:409,code:"INSTANCE_NOT_CONNECTED"}),e}const s=await this.resolveAppLaunchOptions(i,n);return await this.instanceRequest(i,"/apps/sessions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({appId:t,...s})})}async stopAppSession(e,t){const n=await this.requireControlledInstance(e,!0);return await this.instanceRequest(n,`/apps/sessions/${encodeURIComponent(t)}/stop`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({})})}async instanceAppManagement(e){const t=await this.requireControlledInstance(e,!0);try{return function(e){try{return Dl(Fr,e)}catch(e){if(e instanceof f.z.ZodError){const e=new Error("This controlled instance does not support managed app operations.");throw Object.assign(e,{statusCode:409,code:"INSTANCE_APP_MANAGEMENT_UNSUPPORTED"}),e}throw e}}(await this.instanceRequest(t,"/apps/management"))}catch(e){const t=e&&"object"==typeof e?e:{};if(e instanceof f.z.ZodError||404===t.statusCode){const e=new Error("This controlled instance does not support managed app operations.");throw Object.assign(e,{statusCode:409,code:"INSTANCE_APP_MANAGEMENT_UNSUPPORTED"}),e}throw e}}async requestInstanceAppOperation(e,t,n,i={}){const s=await this.requireControlledInstance(e,!0);return Dl(Gr,await this.instanceRequest(s,`/apps/${encodeURIComponent(t)}/${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)}))}async instanceAppManagementJob(e,t){const n=await this.requireControlledInstance(e,!0);return Dl(Gr,await this.instanceRequest(n,`/apps/jobs/${encodeURIComponent(t)}`))}async renameAppSession(e,t,n){const i=await this.requireControlledInstance(e,!0);return await this.instanceRequest(i,`/apps/sessions/${encodeURIComponent(t)}`,{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({title:n})})}sendAiSessionMessage(e,t,n,i,s=[],a=[],o,r){return this.aiSessionActionService.sendMessage(e,t,n,i,s,a,o,r)}aiSessionMentionCatalog(e,t){return this.aiSessionActionService.mentionCatalog(e,t)}searchAiSessionMentionFiles(e,t,n){return this.aiSessionActionService.searchMentionFiles(e,t,n)}executeAiSessionCommand(e,t,n){return this.aiSessionActionService.executeCommand(e,t,n)}aiSessionQueue(e,t){return this.aiSessionActionService.queue(e,t)}getAiSessionDetail(e,t,n){return this.aiSessionActionService.detail(e,t,n)}getAiSessionTurnIndex(e,t,n){return this.aiSessionActionService.turnIndex(e,t,n)}getAiSessionTurnBody(e,t,n,i){return this.aiSessionActionService.turnBody(e,t,n,i)}steerAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.steerQueuedMessage(e,t,n)}retryAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.retryQueuedMessage(e,t,n)}removeAiSessionQueuedMessage(e,t,n){return this.aiSessionActionService.removeQueuedMessage(e,t,n)}editAiSessionQueuedMessage(e,t,n,i){return this.aiSessionActionService.editQueuedMessage(e,t,n,i)}reorderAiSessionQueuedMessages(e,t,n){return this.aiSessionActionService.reorderQueuedMessages(e,t,n)}interruptAiSession(e,t){return this.aiSessionActionService.interrupt(e,t)}async proxyInstanceHttp(e,t,n={}){const i=await this.requireControlledInstance(e,!0);return this.controlledInstanceGateway.proxyHttp(i,t,n)}async proxyInstanceWebSocket(e,t,n,i,s={}){const a=await this.requireControlledInstance(e,!0);this.controlledInstanceGateway.proxyWebSocket(a,t,n,i,s)}async instanceConfigSyncState(e){const t=await this.requireControlledInstance(e,!0),n=f.z.array(yu).parse(await this.instanceRequest(t,"/config-sync/programs"));return Iu.parse({programs:n,preferences:this.configSyncPreferences.get(e)?.preferences||yy()})}async listInstanceConfigSyncFolders(e,t={}){const n=await this.requireControlledInstance(e,!0),i=new URLSearchParams;return t.path&&i.set("path",t.path),void 0!==t.depth&&i.set("depth",String(t.depth)),f.z.array(Sd).parse(await this.instanceRequest(n,"/config-sync/folders"+(i.size?`?${i}`:"")))}async syncInstanceConfigs(e,t){const n=bu.parse(t),i=await this.requireControlledInstance(e,!0);if("export"===n.direction&&"local-folder"!==i.source.type){const e=new Error("Exporting instance config is only available for local folder projects.");throw Object.assign(e,{statusCode:400,code:"CONFIG_SYNC_EXPORT_REQUIRES_LOCAL_PROJECT"}),e}const s=function(e){const t=function(e){const t=[];for(const n of e.split("/"))if(n&&"."!==n)if(".."===n){if(!t.length)return"..";t.pop()}else t.push(n);return t.join("/")||"."}(e.trim().replace(/\\/g,"/")||".");if(t.startsWith("/")||".."===t||t.startsWith("../")){const e=new Error("Config sync folder must stay inside the instance workspace.");throw Object.assign(e,{statusCode:400,code:"CONFIG_SYNC_FOLDER_INVALID"}),e}return t||"."}(n.workspaceFolder),a={...n,workspaceFolder:s},o=Dl(Su,await this.instanceRequest(i,"/config-sync",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a)})),r=hl(),c=this.configSyncPreferences.get(e);return this.configSyncPreferences.put({id:e,preferences:{...c?.preferences||yy(),[n.direction]:s},createdAt:c?.createdAt||r,updatedAt:r}),o}async instanceRequest(e,t,n={},i){return this.controlledInstanceGateway.request(e,t,n,i)}async reportInstanceHeartbeat(e,t){await this.controlledInstanceGateway.reportHeartbeat(e,t)}async nodeAgentFetch(e,t,n={}){const i="reverse-wss"!==e.connectionMode&&"control-plane-proxy"!==e.connectionMode;try{const s=await this.nodeAgentTransportResolver.resolve(e).request(e,t,n);return i&&this.nodeConnectionRuntime?.observedReachable(e),s}catch(t){throw!i||n.signal?.aborted||function(e){return e instanceof Error&&("AbortError"===e.name||"ABORT_ERR"===e.code)}(t)||this.nodeConnectionRuntime?.observedFailure(e,Bh(t)),t}}readCachedNodeInstances(){return this.nodeAgentGateway.readFleetInstances(this.listNodes().map(e=>this.projectNodeConnection(e)))}refreshCachedNodeInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));this.nodeAgentGateway.refreshFleetInstances(e).catch(e=>{this.logWarn({error:Bh(e)},"control plane instance directory refresh failed")})}async listCachedNodeInstances(){const e=this.readCachedNodeInstances();return this.refreshCachedNodeInstances(),e.items}async listBootstrapNodeInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));return await this.nodeAgentGateway.refreshFleetInstances(e),this.nodeAgentGateway.readFleetInstances(e).items}async listTriggerMutationInstances(){const e=this.listNodes().map(e=>this.projectNodeConnection(e));await this.nodeAgentGateway.refreshFleetInstances(e);const t=this.nodeAgentGateway.readFleetInstances(e),n=new Set(t.nodeStates.filter(e=>"ready"===e.phase).map(e=>e.nodeId)),i=t.nodeStates.filter(e=>"ready"!==e.phase).map(e=>({scope:"node",nodeId:e.nodeId,code:e.error?.code||"TRIGGER_NODE_DIRECTORY_UNAVAILABLE",message:e.error?.message||`Node ${e.nodeId} instance directory is ${e.phase}; trigger deployment changes were skipped.`}));return{items:t.items.filter(e=>n.has(e.nodeId)),partialFailures:i}}async listNodeInstancesWithDiagnostics(e,t=!1){const n=this.listNodes().map(e=>this.projectNodeConnection(e));return t?(this.nodeAgentGateway.refreshFleetInstances(n).catch(e=>{this.logWarn({error:Bh(e)},"control plane instance directory refresh failed")}),this.nodeAgentGateway.readFleetInstances(n)):this.nodeAgentGateway.listFleetInstances(n,{signal:e})}async requireNodeInstance(e,t=!1){return this.requireNodeInstanceFromNodes(e,this.listNodes(),t)}async requireNodeInstanceFromNodes(e,t,n=!1){const i=this.nodeAgentGateway.instanceFromSnapshot(t,e);if(i&&n){const n=t.find(e=>e.id===i.nodeId);if(n){await this.nodeAgentGateway.refreshFleetInstances([n],{},!0);const t=this.nodeAgentGateway.instanceFromSnapshot([n],e);if(t)return t;const i=this.nodeAgentGateway.readFleetInstances([n]).nodeStates.find(e=>e.nodeId===n.id);"ready"===i?.phase&&Fh("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`)}}if(i)return i;const s=(await this.nodeAgentGateway.listFleetInstances(t)).items.find(t=>t.id===e);if(s)return s;Fh("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`)}async requireNodeRuntimeOnNode(e,t){const n=(await this.listNodeRuntimes(e)).find(e=>e.id===t);return n||Fh("NODE_RUNTIME_NOT_FOUND",`Runtime ${t} was not found on node ${e}.`),n}async requireNodeLocalFolder(e,t){return this.nodeAgentGateway.requireLocalFolder(e,t)}async resolveAppLaunchOptions(e,t){const n="string"==typeof t.cwdFolderId?t.cwdFolderId.trim():"",i={...t};return delete i.cwdFolderId,n?{...i,cwd:await this.runtimeCwdForFolderId(e,n)}:i}async runtimeCwdForFolderId(e,t){const n=this.requireNode(e.nodeId),i=await this.requireNodeLocalFolder(n,t);if(i.nodeId!==e.nodeId){const t=new Error(`Local folder ${i.id} belongs to node ${i.nodeId}, not ${e.nodeId}.`);throw Object.assign(t,{statusCode:400,code:"LOCAL_FOLDER_REQUIRES_INSTANCE_NODE"}),t}const s=await this.requireNodeRuntimeOnNode(e.nodeId,e.runtimeId);return this.appLaunchCwdForFolder(e,i,s)}async aiSessionRuntimeCwd(e,t){return t?this.runtimeCwdForFolderId(e,t):e.runtime.workspacePath||e.workspace.path||Lh(e.source).path||"/workspace"}appLaunchCwdForFolder(e,n,i){const s=function(e,n,i){if("local"===i.type)return vy(s=n).resolve(s);var s;if("local-folder"!==e.source.type)return;const a=function(e,t){if(by(e)!==by(t))return;const n=vy(e),i=n.resolve(e),s=n.resolve(t),a=n.relative(i,s);return a?".."===a||a.startsWith(`..${n.sep}`)||n.isAbsolute(a)?void 0:a.split(n.sep).filter(Boolean):[]}(e.source.path,n);if(!a)return;const o=e.runtime.workspacePath||e.workspace.path||Lh(e.source).path||"/workspace";return a.length?t.posix.join(o,...a):o}(e,n.path,i);if(s)return s;if("local-folder"!==e.source.type){const e=new Error("App cwd folder selection is only supported for local-folder instances.");throw Object.assign(e,{statusCode:400,code:"APP_CWD_REQUIRES_LOCAL_FOLDER_SOURCE"}),e}const a=new Error(`Local folder ${n.path} is outside the instance workspace ${e.source.path}.`);throw Object.assign(a,{statusCode:400,code:"APP_CWD_OUTSIDE_WORKSPACE"}),a}requireProject(e){return this.catalogService.requireProject(e)}requireModel(e,t=!1){return this.modelService.require(e,t)}requireImage(e){return this.catalogService.requireImage(e)}requireNode(e){const t=this.nodes.get(e);return t||Fh("NODE_NOT_FOUND",`Node ${e} was not found.`),t}requirePublicNode(e){return Dh(this.projectNodeConnection(this.requireNode(e)))}async requireControlledInstance(e,t=!1,n=!1){const i=await this.requireNodeInstance(e,n);return t?i:Mh(i)}requireControlledInstanceForAuthorization(e,t){const n=t?this.listNodes().filter(e=>t.has(e.id)):this.listNodes(),i=this.nodeAgentGateway.instanceFromSnapshot(n,e);return i||Fh("CONTROLLED_INSTANCE_NOT_FOUND",`Controlled instance ${e} was not found.`),Mh(i)}}function _y(e){return x(String(e),"escape").replace(/\n+$/,"")}function Ty(e){const[t,...n]=String(e).split("\n");return[`*${_y(t)}*`,...n.map(_y)].join("\n")}function zy(e,t=4e3){const n=String(e),i=Ty(n);if(i.length<=t)return i;const[s,...a]=n.split("\n"),o=a.join("\n"),r="...\n";let c=s;for(;Ty(`${c}\n${r}`).length>t&&c.length>0;)c=c.slice(0,Math.floor(.8*c.length));let d=0,l=o.length,p=0,u=Ty(`${c}\n${r}`);for(;d<=l;){const e=Math.floor((d+l)/2),n=Ty(`${c}\n${r}${o.slice(-e)}`);n.length<=t?(u=n,p=e,d=e+1):l=e-1}const m=o.slice(-p),h=m.indexOf("\n");return h>=0&&h<200&&(u=Ty(`${c}\n${r}${m.slice(h+1)}`)),u}function ky(e){return String(e).replace(/\\([_*\[\]()~`>#+\-=|{}.!\\])/g,"$1")}async function Ny(e,t,n,i,s={}){if(!t.token)return;const a=n=>e(`https://api.telegram.org/bot${t.token}/sendMessage`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),o=function(e,t={}){const n=String(e),i=t.rawMarkdownV2?e=>e:_y;if(i(n).length<=4e3)return[n];const s=[];let a=n;for(;a;){let e=1,t=a.length,n=1;for(;e<=t;){const s=Math.floor((e+t)/2);i(a.slice(0,s)).length<=4e3?(n=s,e=s+1):t=s-1}if(n<a.length){const e=a.slice(0,n),t=Math.max(e.lastIndexOf("\n"),e.lastIndexOf(" "));t>=Math.floor(.6*n)&&(n=t+1)}s.push(a.slice(0,n).trimEnd()),a=a.slice(n).trimStart()}return s.filter(Boolean)}(i,s);let r;for(const[e,t]of o.entries())r=await Ry(a,"sendMessage",t,{chat_id:n,...0===e&&s.replyToMessageId?{reply_to_message_id:s.replyToMessageId,allow_sending_without_reply:!0}:{},...e===o.length-1&&s.replyMarkup?{reply_markup:s.replyMarkup}:{}},s);return r}async function Cy(e,t,n){if(!t.token||!n)throw new Error("Telegram file id is required.");const i=await e(`https://api.telegram.org/bot${t.token}/getFile`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({file_id:n})}),s=await i.json().catch(()=>({}));if(!i.ok||!1===s.ok||!s.result?.file_path)throw new Error(s.description||`Telegram getFile failed with HTTP ${i.status}`);return`https://api.telegram.org/file/bot${t.token}/${s.result.file_path}`}async function Ry(e,t,n,i,s){const a=s.parseMode||"MarkdownV2",o=s.rawMarkdownV2?String(n):_y(n),r=await e({...i,text:o,disable_web_page_preview:!0,parse_mode:a}),c=await r.json().catch(()=>({}));if(r.ok&&!1!==c.ok)return c.result;if("editMessageText"===t&&Oy(c.description))return;if(s.rawMarkdownV2&&"MarkdownV2"===a){const s=await e({...i,text:ky(n),disable_web_page_preview:!0,parse_mode:"Markdown"}),a=await s.json().catch(()=>({}));if(s.ok&&!1!==a.ok)return a.result;if("editMessageText"===t&&Oy(a.description))return}const d=await e({...i,text:s.rawMarkdownV2?ky(n):String(n),disable_web_page_preview:!0}),l=await d.json().catch(()=>({}));if(d.ok&&!1!==l.ok)return l.result;if("editMessageText"!==t||!Oy(l.description))throw new Error(l.description||c.description||`Telegram ${t} failed with HTTP ${d.status}`)}function Oy(e){return"string"==typeof e&&e.toLowerCase().includes("message is not modified")}function jy(e,t){if("string"==typeof e&&e.trim())return e.trim();Dy(`Chat action token is missing ${t}.`)}function Py(e){if("allow"===e||"deny"===e||"skip"===e)return e;Dy("Chat action token has an invalid decision.")}function Dy(e){const t=new Error(e);throw Object.assign(t,{statusCode:400,code:"CHAT_ACTION_TOKEN_INVALID"}),t}function Ly(e){return Buffer.from(e,"base64url").toString("utf8")}function My(e){return String(e||"").split(/\r?\n/,1)[0].replace(/^#+\s*/,"").trim().slice(0,20)||"消息通知"}function qy(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,"string"==typeof t?t:JSON.stringify(t)]))}function Uy(e){return`dtv1.card//IM_GROUP.${e}`}function $y(e){return`dtv1.card//IM_ROBOT.${e}`}function By(e,t){return ib(t.biz_conversation_id).trim()||ib(e.spaceId).replace(/^dtv1\.card\/\/(?:IM_GROUP|IM_SINGLE|IM_ROBOT)\./,"")}function Fy(e,t={}){const n=ib(e).trim().toUpperCase();return"2"===n||"IM_GROUP"===n?"IM_GROUP":"1"===n||"IM_SINGLE"===n?t.robotMessage?"IM_ROBOT":"IM_SINGLE":"IM_ROBOT"===n?"IM_ROBOT":void 0}function Hy(e){if(e.startsWith("task_handoff:"))return e;if(!e.startsWith("th_cb_"))return"";try{return Buffer.from(e.slice(6),"base64url").toString("utf8")}catch{return""}}function Gy(e,t,n,i,s){const a=By(i,s);return{cardUpdateOptions:{updateCardDataByKey:!0,updatePrivateDataByKey:!1},cardData:{cardParamMap:qy({type:"actions",title:"TaskHandoff",description:e,list:Hf(t),biz_out_track_id:i.outTrackId||s.biz_out_track_id||"",biz_conversation_id:a,biz_sender_id:s.biz_sender_id||i.userId||"",biz_session_webhook:s.biz_session_webhook||"",biz_conversation_type:s.biz_conversation_type||"",biz_step:n,error_msg:""})}}}function Wy(e,t,n){const i=[];return Vy(i,n),Vy(i,t),Vy(i,e),i.find(e=>Hy(e))||""}function Vy(e,t){for(const n of["actionIdList","actionIds"]){const i=t[n];Array.isArray(i)&&e.push(...i.map(e=>ib(e)).filter(Boolean))}for(const n of["actionId","action_id","id","actionValue"]){const i=ib(t[n]);i&&e.push(i)}}async function Ky(e,t,n,i){i?.("info",{target:"sessionWebhook",hasSessionWebhook:Boolean(t),textPreview:eb(n)},"dingding webhook send requested");const s=await e(t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({msgtype:"markdown",markdown:{title:My(n),text:n}})}),a=await s.json().catch(()=>{});if(i?.(s.ok?"info":"warn",{target:"sessionWebhook",status:s.status,response:Zy(a)},"dingding webhook send completed"),!s.ok)throw new Error(`DingDing webhook failed with HTTP ${s.status}`)}async function Yy(e){const t=Hf(e.replyMarkup);if(!t.length&&!e.forceCard)return e.sessionWebhook&&await Ky(e.fetchImpl,e.sessionWebhook,e.text,e.runtime.onLog),e.sessionWebhook?{delivered:!0}:void 0;const n=e.bridge.settings||{},i=ib(n.robotCode),s=ib(n.cardTemplateId)||"13fc6717-12e4-43ed-8533-111a310d4995.schema",a=ib(n.cardCallbackRouteKey)||"task_handoff_message",o=e.senderId||e.runtime.senderIds.get(e.chatId)||ib(n.senderId),r=(c=e.runtime,d=e.chatId,c.conversationTypes?.get(d)||"IM_GROUP");var c,d;if(!i||!s||!o){if(e.sessionWebhook&&!e.forceCard)return await Ky(e.fetchImpl,e.sessionWebhook,e.text,e.runtime.onLog),{delivered:!0};throw new Error("DingDing card target is incomplete.")}const l=`task_handoff_cp_${Date.now()}_${Math.random().toString(16).slice(2)}`,p=qy({type:"actions",title:e.title||My(e.text),description:e.text,list:t,biz_out_track_id:l,biz_step:e.step||"task_handoff_actions",biz_conversation_id:e.chatId,biz_sender_id:o,biz_session_webhook:e.sessionWebhook||e.runtime.chatWebhooks.get(e.chatId)||"",biz_conversation_type:r,error_msg:""}),u=function(e,t,n,i){return"IM_SINGLE"===e?{openSpaceId:(s=t,`dtv1.card//IM_SINGLE.${s}`),imSingleOpenSpaceModel:{},imSingleOpenDeliverModel:{extension:{}}}:"IM_ROBOT"===e?{openSpaceId:$y(n),imRobotOpenSpaceModel:{supportForward:!1},imRobotOpenDeliverModel:{extension:{},robotCode:i,spaceType:"IM_ROBOT"}}:{openSpaceId:Uy(t),imGroupOpenSpaceModel:{supportForward:!1},imGroupOpenDeliverModel:{extension:{},robotCode:i}};var s}(r,e.chatId,o,i);return e.runtime.onLog?.("info",{target:"card",chatId:e.chatId,senderId:o,conversationType:r,openSpaceId:u.openSpaceId,hasSessionWebhook:Boolean(e.sessionWebhook||e.runtime.chatWebhooks.get(e.chatId)),hasReplyMarkup:Boolean(e.replyMarkup),actionCount:t.length,textPreview:eb(e.text)},"dingding card send requested"),await Xy(e.fetchImpl,e.bridge,e.runtime,"POST","/v1.0/card/instances/createAndDeliver",{userId:o,cardTemplateId:s,outTrackId:l,callbackType:"STREAM",callbackRouteKey:a,cardData:{cardParamMap:p},userIdType:Number(n.cardUserIdType||1),...u}),{delivered:!0,outTrackId:l}}async function Xy(e,t,n,i,s,a){const o=await async function(e,t,n){if(n.accessToken&&n.accessToken.expiresAt>Date.now()+6e4)return n.accessToken.value;const i=ib(t.settings.clientSecret);if(!t.token||!i)throw new Error("DingDing client id/secret is not configured.");const s=await e("https://api.dingtalk.com/v1.0/oauth2/accessToken",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({appKey:t.token,appSecret:i})}),a=await s.json().catch(()=>({}));if(!s.ok||!a.accessToken)throw new Error(`DingDing access token failed with HTTP ${s.status}`);const o=Number(a.expireIn||7200);return n.accessToken={value:a.accessToken,expiresAt:Date.now()+1e3*Math.max(60,o-120)},n.accessToken.value}(e,t,n);n.onLog?.("info",{method:i,path:s,body:Jy(a)},"dingding api request");const r=await e(`https://api.dingtalk.com${s}`,{method:i,headers:{"content-type":"application/json","x-acs-dingtalk-access-token":o},body:JSON.stringify(a)}),c=await r.json().catch(()=>{});if(n.onLog?.(r.ok?"info":"warn",{method:i,path:s,status:r.status,response:Zy(c)},"dingding api response"),!r.ok)throw new Error(`DingDing API failed with HTTP ${r.status}`);const d=tb(c),l=d.code??d.errcode,p=d.success;if(void 0!==l&&"0"!==String(l)||!1===p)throw new Error(ib(d.message||d.errmsg)||`DingDing API returned ${String(l||"failure")}`);const u=function(e){const t=tb(tb(e).result).deliverResults;if(!Array.isArray(t))return"";const n=t.find(e=>!1===tb(e).success);if(!n)return"";const i=tb(n),s=ib(i.spaceId),a=ib(i.errorMsg||i.message||i.errmsg)||"delivery failed";return s?`DingDing card delivery failed for ${s}: ${a}`:`DingDing card delivery failed: ${a}`}(c);if(u)throw new Error(u);return r}function Jy(e){const t=tb(e),n=tb(t.cardData),i=tb(n.cardParamMap);return{openSpaceId:ib(t.openSpaceId),outTrackId:ib(t.outTrackId),userId:ib(t.userId),userIdType:t.userIdType,callbackType:ib(t.callbackType),callbackRouteKey:ib(t.callbackRouteKey),hasImGroupTarget:Boolean(t.imGroupOpenSpaceModel||t.imGroupOpenDeliverModel),hasImSingleTarget:Boolean(t.imSingleOpenSpaceModel||t.imSingleOpenDeliverModel),hasImRobotTarget:Boolean(t.imRobotOpenSpaceModel||t.imRobotOpenDeliverModel),imGroupOpenDeliverModel:Qy(t.imGroupOpenDeliverModel),imSingleOpenDeliverModel:Qy(t.imSingleOpenDeliverModel),imRobotOpenDeliverModel:Qy(t.imRobotOpenDeliverModel),bizConversationId:ib(i.biz_conversation_id),bizConversationType:ib(i.biz_conversation_type),bizSenderId:ib(i.biz_sender_id),hasBizSessionWebhook:Boolean(ib(i.biz_session_webhook))}}function Qy(e){const t=tb(e);if(Object.keys(t).length)return{hasExtension:Boolean(t.extension),hasRobotCode:Boolean(ib(t.robotCode)),spaceType:ib(t.spaceType),recipients:Array.isArray(t.recipients)?t.recipients.length:void 0,atUserIds:t.atUserIds&&"object"==typeof t.atUserIds?Object.keys(t.atUserIds).length:void 0}}function Zy(e){const t=tb(e),n=tb(t.result);return{code:t.code??t.errcode,message:eb(t.message||t.errmsg,240),success:t.success,requestId:t.requestId,result:Object.keys(n).length?n:void 0}}function eb(e,t=160){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function tb(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function nb(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:"string"==typeof e&&e.trim()?sb(e):{}}function ib(e){return"string"==typeof e?e:""}function sb(e){try{return tb(JSON.parse(String(e||"{}")))}catch{return{}}}function ab(e){return JSON.stringify(Hf(e))}const ob="task_handoff_action_id";function rb(e,t){const n=Hf(t);return{schema:"2.0",config:{summary:{content:lb(e)}},body:{elements:[{tag:"markdown",content:e},...n.map(e=>({tag:"button",text:{tag:"plain_text",content:e.text},type:pb(e.text),width:"fill",size:"medium",behaviors:[{type:"callback",value:{[ob]:e.id}}]}))]}}}function cb(e){const t=function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e);return function(e){const t=String(e||"");return t.startsWith("th_cb_")?function(e){try{return Buffer.from(e,"base64url").toString("utf8")}catch{return""}}(t.slice(6)):""}(t[ob]||t.action_id||t.actionId||t.id||e)}function db(e){return JSON.stringify(Hf(e))}function lb(e){const t=e.replace(/\s+/g," ").trim();return t.length<=50?t:`${t.slice(0,47)}...`}function pb(e){const t=e.trim().toLowerCase();return["deny","cancel","delete","remove"].some(e=>t.includes(e))?"danger":["allow","approve","launch","open"].some(e=>t.includes(e))?"primary":"default"}function ub(e){return e instanceof Error?e.message:String(e)}function mb(e){const t=Number(function(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}(e).message_id);return Number.isInteger(t)&&t>0?t:void 0}function hb(e){return Array.isArray(e?.actionRows)?e.actionRows:(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e])}function gb(e,t){const n=hb(e),i=hb(t);return n.length===i.length&&n.every((e,t)=>{const n=i[t];return e.length===n.length&&e.every((e,t)=>{const i=n[t];return e.text===i?.text&&e.callbackData===i.callbackData})})}class fb{entries;updateIntervalMs;send;edit;deleteMessage;messageIdFromResult;retryAfterMs;isMessageTooLong;onLog;constructor(e){this.entries=e.entries||new Map,this.updateIntervalMs=e.updateIntervalMs||1e3,this.send=e.send,this.edit=e.edit,this.deleteMessage=e.delete,this.messageIdFromResult=e.messageIdFromResult||mb,this.retryAfterMs=e.retryAfterMs,this.isMessageTooLong=e.isMessageTooLong,this.onLog=e.onLog}remember(e,t,n,i,s,a){const o=this.entries.get(e);return o&&(clearTimeout(o.timer),o.timer=void 0,o.pendingText=void 0),this.entries.set(e,{lastText:n,lastUpdateAt:Date.now(),messageId:t,route:i,options:s,lastOptions:s,renderOptions:a}),o}rekey(e,t){if(e===t)return this.entries.has(e);const n=this.entries.get(e);if(!n||this.entries.has(t))return!1;if(clearTimeout(n.timer),n.timer=void 0,this.entries.delete(e),this.entries.set(t,n),n.pendingText){const e=n.rateLimitedUntil?Math.max(0,n.rateLimitedUntil-Date.now()):Math.max(0,this.updateIntervalMs-(Date.now()-n.lastUpdateAt));this.scheduleFlush(t,e)}return!0}scheduleFlush(e,t){const n=this.entries.get(e);n&&!n.timer&&(n.timer=setTimeout(()=>{n.timer=void 0;const t=n.pendingText;n.pendingText=void 0,t&&this.applyUpdate(e,t,n.route,n.options)},t))}markRateLimited(e,t,n,i){const s=this.entries.get(e);s&&(s.rateLimitedUntil=Date.now()+n,s.pendingText=t,s.route=i||s.route,this.scheduleFlush(e,n))}async applyUpdate(e,t,n,i){let s=this.entries.get(e);const a=s,o=n||s?.route,r=i||s?.options;try{if(s&&(s.route=o,s.options=r),s?.pending&&await s.pending,s=this.entries.get(e),a&&s!==a)return!1;if(s?.messageId){if(s.lastText===t&&gb(s.lastOptions,r))return!0;const n=Date.now()-(s.lastUpdateAt||0);return n<this.updateIntervalMs?(s.pendingText=t,s.route=o||s.route,s.options=r||s.options,this.scheduleFlush(e,this.updateIntervalMs-n),!0):(await this.edit(s.messageId,t,o||s.route,r),s.lastText=t,s.lastOptions=r,s.lastUpdateAt=Date.now(),s.rateLimitedUntil=void 0,!0)}const n={lastText:t,lastUpdateAt:Date.now(),route:o,options:r,lastOptions:r};return n.pending=this.send(t,o,r).then(e=>{const t=this.messageIdFromResult(e);t&&(n.messageId=t)}).finally(()=>{n.pending=void 0}),this.entries.set(e,n),await n.pending,this.entries.get(e)===n&&(n.rateLimitedUntil=void 0,Boolean(n.messageId))}catch(n){const i=this.retryAfterMs?.(n);return i&&this.markRateLimited(e,t,i,o),this.onLog?.(`Telegram progress update skipped: ${ub(n)}`),!1}}update(e,t,n,i){const s=String(t||"").trim();if(!s)return;const a=this.entries.get(e);if(a&&(a.route=n||a.route,a.options=i||a.options),a?.lastText===s&&gb(a.lastOptions,i||a.options)&&!a.pending&&!a.pendingText)return;const o=Date.now();if(a?.rateLimitedUntil){if(a.rateLimitedUntil>o)return a.pendingText=s,void this.scheduleFlush(e,a.rateLimitedUntil-o);a.rateLimitedUntil=void 0}if(a?.pending&&!a.messageId)return a.pendingText=s,void this.scheduleFlush(e,this.updateIntervalMs);if(!a||!a.messageId)return void this.applyUpdate(e,s,n,i);const r=Date.now()-(a.lastUpdateAt||0);if(r>=this.updateIntervalMs)return clearTimeout(a.timer),a.timer=void 0,a.pendingText=void 0,void this.applyUpdate(e,s,n||a.route,i||a.options);a.pendingText=s,this.scheduleFlush(e,this.updateIntervalMs-r)}async finish(e,t,n,i,s){const a=this.entries.get(e);if(!a)return!1;try{if(clearTimeout(a.timer),a.timer=void 0,a.pendingText=void 0,a.pending&&await a.pending,this.entries.delete(e),!a.messageId)return!1;const o=i||a.options;return a.lastText===t&&gb(a.lastOptions,o)||await this.edit(a.messageId,t,n||a.route,o,s||a.renderOptions),!0}catch(t){return this.entries.delete(e),this.isMessageTooLong?.(t)?this.onLog?.("Telegram progress finish too long; sending result as multiple messages"):this.onLog?.(`Telegram progress finish skipped: ${ub(t)}`),!1}}async delete(e,t){const n=this.entries.get(e);if(!n)return!1;try{return clearTimeout(n.timer),n.timer=void 0,n.pendingText=void 0,n.pending&&await n.pending,this.entries.delete(e),!(!this.deleteMessage||!n.messageId)&&(await this.deleteMessage(n.messageId,t||n.route),!0)}catch(t){return this.entries.delete(e),this.onLog?.(`Telegram progress delete skipped: ${ub(t)}`),!1}}async flush(e){const t=this.entries.get(e);if(t?.pending&&await t.pending,t?.timer){clearTimeout(t.timer),t.timer=void 0;const n=t.pendingText;t.pendingText=void 0,n&&await this.applyUpdate(e,n,t.route,t.options)}}async wait(e){await function(e){return new Promise(t=>setTimeout(t,e))}(e)}}const yb=20971520;function bb(e){const t=[],n=[...e.photo||[]].filter(e=>e.file_id).sort((e,t)=>Number(t.file_size||t.width||0)-Number(e.file_size||e.width||0))[0];return n?.file_id&&t.push({fileId:n.file_id,fileName:"telegram-photo.jpg",fileSize:n.file_size}),e.document?.file_id&&String(e.document.mime_type||"").startsWith("image/")&&t.push({fileId:e.document.file_id,fileName:e.document.file_name,fileSize:e.document.file_size}),t}async function vb(e,n,i="telegram-image",s){if(s&&s>yb)throw new Error(`image is too large: ${s} bytes`);const a=await e.getFileLink(n),o=String(a),r=await(e.fetchFile||fetch)(o);if(!r.ok)throw new Error(`download failed with HTTP ${r.status}`);const c=Number(r.headers.get("content-length")||0);if(c>yb)throw new Error(`image is too large: ${c} bytes`);const d=t.extname(i)||".jpg";let l=d;try{l=t.extname(new URL(o).pathname)||d}catch{l=d}const p=t.join(m.tmpdir(),"task-handoff-images");await w.mkdir(p,{recursive:!0});const u=l.replace(/[^.\w-]/g,"")||".jpg",h=t.join(p,`telegram-${Date.now()}-${Math.random().toString(16).slice(2)}${u}`),g=Buffer.from(await r.arrayBuffer());if(g.length>yb)throw new Error(`image is too large: ${g.length} bytes`);return await w.writeFile(h,g),h}class Ib{store;constructor(e){this.store=new fb({updateIntervalMs:e.updateIntervalMs,send:(t,n,i)=>e.send(e.requireBridge(n?.bridgeId||""),n?.chatId||"",zy(t),{rawMarkdownV2:!0,replyMarkup:_b(i)}),edit:(t,n,i,s)=>e.edit(e.requireBridge(i?.bridgeId||""),i?.chatId||"",t,zy(n),{rawMarkdownV2:!0,replyMarkup:_b(s)}),delete:(t,n)=>e.deleteMessage(e.requireBridge(n?.bridgeId||""),n?.chatId||"",t),onLog:e.onLog})}get entries(){return this.store.entries}remember(e,t,n,i){return this.store.remember(e,t,n,i)}rekey(e,t){return this.store.rekey(e,t)}delete(e){return this.store.delete(e)}async applyUpdate(e){return this.store.applyUpdate(e.key,e.text,{bridgeId:e.bridge.id,chatId:e.chatId},{actionRows:e.actionRows})}}async function xb(e){return(await async function(e,t,n,i){const s=[];for(const a of bb(n))try{const n=await vb({getFileLink:n=>Cy(e,t,n),fetchFile:e},a.fileId,a.fileName,a.fileSize);s.push(n)}catch(e){i?.({fileId:a.fileId,fileName:a.fileName,error:e})}return s}(e.fetchImpl,e.bridge,e.message,e.onImageDownloadError)).map((e,s)=>{const a=n.readFileSync(e);return{id:`tg_${i.randomUUID().replace(/-/g,"").slice(0,24)}`,kind:"image",name:t.basename(e)||`telegram-image-${s+1}`,mime:wb(e),size:a.length,source:{type:"inline",encoding:"base64",data:a.toString("base64")}}})}function wb(e){const n=t.extname(e).toLowerCase();return".png"===n?"image/png":".webp"===n?"image/webp":".gif"===n?"image/gif":".bmp"===n?"image/bmp":"image/jpeg"}function Sb(e){const t=Number(e?.message_id);return Number.isInteger(t)?t:void 0}function Ab(e){return e&&"object"==typeof e?e:{}}function Eb(e){return"string"==typeof e?e:""}function _b(e){const t=Array.isArray(e?.actionRows)?e.actionRows:void 0;return $f(t||(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e]))}function Tb(e){const t=Array.isArray(e.item_list)?e.item_list:[];for(const e of t){const t=zb(e);if(1!==t.type)continue;const n=kb(zb(t.text_item).text).trim();if(n)return n}return""}function zb(e){return e&&"object"==typeof e?e:{}}function kb(e){return"string"==typeof e?e:""}function Nb(e){const{fetchImpl:t,bridge:n,dingdingRuntime:s,larkRuntime:a}=e;return"telegram"===n.channel?function(e,t){return{bridge:t,send:async(n,i,s={})=>{const a=await Ny(e,t,n,i,{replyMarkup:s.replyMarkup,replyToMessageId:s.replyToMessageId,rawMarkdownV2:s.rawMarkdownV2,parseMode:s.parseMode});return{provider:"telegram",raw:a,messageId:Number(Ab(a).message_id)||void 0}}}}(t,n):"dingding"===n.channel?function(e,t,n){return{bridge:t,send:async(i,s,a={})=>{const o=a.sessionWebhook||n?.chatWebhooks.get(i)||ib(t.settings.sessionWebhook);if(a.replyMarkup&&n){const r=await Yy({fetchImpl:e,bridge:t,runtime:n,chatId:i,text:s,replyMarkup:a.replyMarkup,sessionWebhook:o,senderId:a.senderId||n.senderIds.get(i)||ib(t.settings.senderId)});if(r?.delivered)return{provider:"dingding",interactionId:r.outTrackId}}if(o)return await Ky(e,o,s,n?.onLog),{provider:"dingding"}}}}(t,n,s):"lark"===n.channel?function(e,t){return{bridge:e,send:async(e,n,i={})=>{if(!t)return;const s=await t.channel.send(e,i.replyMarkup?{card:rb(n,i.replyMarkup)}:{markdown:n});return{provider:"lark",interactionId:s.messageId,raw:s}}}}(n,a):"wechat"===n.channel?function(e,t){return{bridge:t,send:async(n,s,a={})=>{const o=a.contextToken||kb(t.settings.contextToken);if(o)return await async function(e,t,n,s,a){const o=kb(t.settings.baseUrl)||"https://ilinkai.weixin.qq.com",r=await e(`${o}/ilink/bot/sendmessage`,{method:"POST",headers:{"content-type":"application/json",AuthorizationType:"ilink_bot_token",Authorization:`Bearer ${t.token}`,"X-WECHAT-UIN":String(Math.floor(Math.random()*2**31))},body:JSON.stringify({msg:{from_user_id:"",to_user_id:n,client_id:i.randomUUID(),message_type:2,message_state:2,context_token:s,item_list:[{type:1,text_item:{text:a}}]},base_info:{channel_version:"1.0.2"}})}),c=await r.json().catch(()=>({}));if(!r.ok||c.errcode)throw new Error(kb(c.errmsg)||`WeChat send failed with HTTP ${r.status}`)}(e,t,n,o,s),{provider:"wechat"}}}}(t,n):{bridge:n,send:async()=>{}}}class Cb{entries=new Map;fetchImpl;generations=new Map;constructor(e){this.fetchImpl=e}clear(){for(const e of new Set([...this.generations.keys(),...[...this.entries.values()].map(e=>e.bridgeId)]))this.clearBridge(e)}clearBridge(e){this.generations.set(e,this.generation(e)+1),this.clearEntries(t=>t.bridgeId===e)}generation(e){return this.generations.get(e)||0}isCurrent(e,t){return this.generation(e)===t}clearEntries(e){for(const[t,n]of this.entries)e(n)&&(n.timer&&clearTimeout(n.timer),n.cancelPending?.(new Error("DingDing progress update was cancelled.")),this.entries.delete(t))}async applyUpdate(e,t){const n=this.generation(e.bridge.id),i=ab(e.replyMarkup);let s=this.entries.get(e.key);if(s?.pending&&await s.pending,!this.isCurrent(e.bridge.id,n))return!1;if(s=this.entries.get(e.key),s?.outTrackId){if(s.lastText===e.text&&s.lastActionsFingerprint===i)return!0;const a=Date.now()-(s.lastUpdateAt||0);return a<1e3?(s.pendingText=e.text,s.pendingReplyMarkup=e.replyMarkup,s.timer||(s.pending=new Promise((i,o)=>{s.cancelPending=o,s.timer=setTimeout(()=>{s.timer=void 0,s.cancelPending=void 0;const a=s.pendingText,r=s.pendingReplyMarkup;if(s.pendingText=void 0,s.pendingReplyMarkup=void 0,!a)return i(void 0);this.updateExistingEntry(e,t,s,a,r,ab(r),n).then(i,o)},1e3-a)}).finally(()=>{s.pending=void 0,s.timer=void 0,s.cancelPending=void 0})),await s.pending,this.isCurrent(e.bridge.id,n)&&this.entries.has(e.key)):(await this.updateExistingEntry(e,t,s,e.text,e.replyMarkup,i,n),this.isCurrent(e.bridge.id,n))}const a={bridgeId:e.bridge.id,lastText:e.text,lastActionsFingerprint:i,lastUpdateAt:Date.now()};return a.pending=Yy({fetchImpl:this.fetchImpl,bridge:e.bridge,runtime:t,chatId:e.chatId,text:e.text,replyMarkup:e.replyMarkup,sessionWebhook:t.chatWebhooks.get(e.chatId)||Rb(e.bridge.settings.sessionWebhook),senderId:t.senderIds.get(e.chatId)||Rb(e.bridge.settings.senderId),title:"TaskHandoff 执行中",step:"progress",forceCard:!0}).then(t=>{this.isCurrent(e.bridge.id,n)&&(t?.outTrackId&&(a.outTrackId=t.outTrackId),t?.delivered&&(a.delivered=!0,a.lastUpdateAt=Date.now()))}).catch(t=>{throw this.isCurrent(e.bridge.id,n)&&this.entries.delete(e.key),t}).finally(()=>{a.pending=void 0}),this.entries.set(e.key,a),await a.pending,this.isCurrent(e.bridge.id,n)&&Boolean(a.delivered)}async updateExistingEntry(e,t,n,i,s,a,o){n.outTrackId&&(await async function(e){await Xy(e.fetchImpl,e.bridge,e.runtime,"PUT","/v1.0/card/instances",{outTrackId:e.outTrackId,cardData:{cardParamMap:qy({type:"actions",title:e.title,description:e.text,list:Hf(e.replyMarkup),biz_step:e.step,error_msg:""})},cardUpdateOptions:{updateCardDataByKey:!0,updatePrivateDataByKey:!1},userIdType:Number(e.bridge.settings.cardUserIdType||1)})}({fetchImpl:this.fetchImpl,bridge:e.bridge,runtime:t,outTrackId:n.outTrackId,text:i,replyMarkup:s,title:"TaskHandoff 执行中",step:"progress"}),this.isCurrent(e.bridge.id,o)&&(n.lastText=i,n.lastActionsFingerprint=a,n.lastUpdateAt=Date.now()))}}function Rb(e){return"string"==typeof e?e:""}function Ob(e){const t=new S.DWClient({clientId:e.clientId,clientSecret:e.clientSecret,ua:"task-handoff-control-plane",keepAlive:!1,autoReconnect:!1});let n,i=!1;return{async connect(){i=!1,await t.getEndpoint(),await t._connect();const e=t.socket;e?.once("close",()=>{i||n?.(new Error("DingDing stream connection closed."))})},disconnect(){i=!0,t.disconnect()},onDisconnect(e){n=e},getConfig:()=>t.getConfig(),registerCallbackListener(e,n){t.registerCallbackListener(e,n)},socketCallBackResponse(e,n){t.socketCallBackResponse(e,n)}}}class jb{runtimes=new Map;connected=new Set;reconnectTimers=new Map;progress;options;createClient;constructor(e){this.options=e,this.createClient=e.createClient||Ob,this.progress=new Cb(e.fetchImpl)}has(e){return this.runtimes.has(e)}isRunning(e){return this.connected.has(e)}get(e){return this.runtimes.get(e)}ids(){return this.runtimes.keys()}start(e){const t=(n=e.settings?.clientSecret,"string"==typeof n?n:"");var n;if(!e.token||!t)return this.options.onError(e.id,"DingDing client id/secret is not configured."),!1;const i={client:this.createClient({clientId:e.token,clientSecret:t}),chatWebhooks:new Map,senderIds:new Map,conversationTypes:new Map,onLog:(t,n,i)=>{this.options.logger["warn"===t?"warn":"info"]({bridgeId:e.id,...n},i)}};return i.client.onDisconnect?.(t=>{this.runtimes.get(e.id)===i&&this.handleConnectionFailure(e,i,t)}),i.client.registerCallbackListener(S.TOPIC_ROBOT,t=>{this.options.onRobotMessage(e,i,t).catch(t=>{this.options.onError(e.id,t)})}),i.client.registerCallbackListener(S.TOPIC_CARD,t=>{const n=t;this.options.onCardCallback(e,i,n).then(e=>i.client.socketCallBackResponse(n.headers.messageId,e||{})).catch(t=>{this.options.onError(e.id,t),i.client.socketCallBackResponse(n.headers.messageId,{})})}),this.options.clearError(e.id),this.runtimes.set(e.id,i),this.connect(e,i),!0}connect(e,t){this.reconnectTimers.delete(e.id),this.connected.add(e.id),t.client.connect().then(()=>{this.runtimes.get(e.id)===t&&(this.connected.add(e.id),this.options.clearError(e.id))}).catch(n=>{this.runtimes.get(e.id)===t&&this.handleConnectionFailure(e,t,n)})}handleConnectionFailure(e,t,n){if(this.connected.delete(e.id),this.progress.clearBridge(e.id),this.options.onError(e.id,n||"DingDing stream connection failed."),this.reconnectTimers.has(e.id))return;const i=setTimeout(()=>{this.runtimes.get(e.id)===t&&this.connect(e,t)},this.options.reconnectDelayMs??1e3);i.unref?.(),this.reconnectTimers.set(e.id,i)}stop(e){const t=this.reconnectTimers.get(e);t&&clearTimeout(t),this.reconnectTimers.delete(e),this.connected.delete(e);const n=this.runtimes.get(e);if(n){try{n.client.disconnect()}catch{}this.runtimes.delete(e)}this.progress.clearBridge(e)}stopAll(){for(const e of[...this.runtimes.keys()])this.stop(e);this.progress.clear()}applyUpdate(e){const t=this.runtimes.get(e.bridge.id);return t?this.progress.applyUpdate(e,t):Promise.resolve(!1)}applyProgressUpdate(e){return this.applyUpdate(e)}}class Pb{entries=new Map;generations=new Map;updateIntervalMs;constructor(e=1e3){this.updateIntervalMs=e}clear(){for(const e of new Set([...this.generations.keys(),...[...this.entries.values()].map(e=>e.bridgeId)]))this.clearBridge(e)}clearBridge(e){this.generations.set(e,this.generation(e)+1);for(const[t,n]of this.entries)n.bridgeId===e&&(n.timer&&clearTimeout(n.timer),n.cancelPending?.(new Error("Lark progress update was cancelled.")),this.entries.delete(t))}generation(e){return this.generations.get(e)||0}isCurrent(e,t){return this.generation(e)===t}async applyUpdate(e,t){const n=this.generation(e.bridge.id),i=db(e.replyMarkup);let s=this.entries.get(e.key);if(s?.pending&&await s.pending,!this.isCurrent(e.bridge.id,n))return!1;if(s=this.entries.get(e.key),s?.messageId){if(s.lastText===e.text&&s.lastActionsFingerprint===i)return!0;const a=Date.now()-s.lastUpdateAt;return a<this.updateIntervalMs?(s.pendingText=e.text,s.pendingReplyMarkup=e.replyMarkup,s.timer||(s.pending=new Promise((i,o)=>{s.cancelPending=o,s.timer=setTimeout(()=>{s.timer=void 0,s.cancelPending=void 0;const a=s.pendingText,r=s.pendingReplyMarkup;if(s.pendingText=void 0,s.pendingReplyMarkup=void 0,!a)return i(void 0);this.updateExistingEntry(e,t,s,a,r,db(r),n).then(i,o)},this.updateIntervalMs-a)}).finally(()=>{s.pending=void 0,s.timer=void 0,s.cancelPending=void 0})),await s.pending,this.isCurrent(e.bridge.id,n)&&this.entries.has(e.key)):(await this.updateExistingEntry(e,t,s,e.text,e.replyMarkup,i,n),this.isCurrent(e.bridge.id,n))}const a={bridgeId:e.bridge.id,lastText:e.text,lastActionsFingerprint:i,lastUpdateAt:Date.now()};return a.pending=t.channel.send(e.chatId,{card:rb(e.text,e.replyMarkup)}).then(t=>{this.isCurrent(e.bridge.id,n)&&(a.messageId=t.messageId,a.delivered=!0,a.lastUpdateAt=Date.now())}).catch(t=>{throw this.isCurrent(e.bridge.id,n)&&this.entries.delete(e.key),t}).finally(()=>{a.pending=void 0}),this.entries.set(e.key,a),await a.pending,this.isCurrent(e.bridge.id,n)&&Boolean(a.delivered)}async updateExistingEntry(e,t,n,i,s,a,o){n.messageId&&(await t.channel.updateCard(n.messageId,rb(i,s)),this.isCurrent(e.bridge.id,o)&&(n.lastText=i,n.lastActionsFingerprint=a,n.lastUpdateAt=Date.now()))}}function Db(e){const t={appId:e.appId,appSecret:e.appSecret,domain:e.domain,transport:"websocket",source:"task-handoff-control-plane",handshakeTimeoutMs:15e3,policy:{requireMention:!0,dmMode:"open",respondToMentionAll:!1}};return A.createLarkChannel(t)}class Lb{runtimes=new Map;connected=new Set;unsubscribe=new Map;reconnectTimers=new Map;options;createChannel;progress;constructor(e){this.options=e,this.createChannel=e.createChannel||Db,this.progress=new Pb(e.progressUpdateIntervalMs)}has(e){return this.runtimes.has(e)}isRunning(e){return this.connected.has(e)}get(e){return this.runtimes.get(e)}ids(){return this.runtimes.keys()}start(e){const t=(n=e.settings?.appSecret,"string"==typeof n?n.trim():"");var n;if(!e.token||!t)return this.options.onError(e.id,"Lark app id/secret is not configured."),!1;const i={channel:this.createChannel({appId:e.token,appSecret:t,domain:Mb(e.settings?.domain)})},s=i.channel.on({message:t=>{this.options.onMessage(e,i,t).catch(t=>{this.options.onError(e.id,t)})},cardAction:t=>{this.options.onCardAction(e,i,t).catch(t=>{this.options.onError(e.id,t)})},error:t=>{this.options.onError(e.id,t),this.options.logger.warn({bridgeId:e.id,error:t.message},"lark channel error")},reconnecting:()=>{this.connected.delete(e.id),this.options.onError(e.id,"Lark WebSocket is reconnecting."),this.options.logger.info({bridgeId:e.id},"lark channel reconnecting")},reconnected:()=>{this.runtimes.get(e.id)===i&&(this.connected.add(e.id),this.options.clearError(e.id),this.options.logger.info({bridgeId:e.id},"lark channel reconnected"))}});return this.options.clearError(e.id),this.runtimes.set(e.id,i),this.unsubscribe.set(e.id,s),this.connect(e,i),!0}connect(e,t){this.reconnectTimers.delete(e.id),t.channel.connect().then(()=>{this.runtimes.get(e.id)===t&&(this.connected.add(e.id),this.options.clearError(e.id),this.options.logger.info({bridgeId:e.id},"lark channel connected"))}).catch(n=>{if(this.runtimes.get(e.id)!==t)return;if(this.connected.delete(e.id),this.options.onError(e.id,n),t.channel.rawWsClient||this.reconnectTimers.has(e.id))return;const i=setTimeout(()=>{this.runtimes.get(e.id)===t&&this.connect(e,t)},this.options.reconnectDelayMs??1e3);i.unref?.(),this.reconnectTimers.set(e.id,i)})}stop(e){const t=this.reconnectTimers.get(e);t&&clearTimeout(t),this.reconnectTimers.delete(e),this.unsubscribe.get(e)?.(),this.unsubscribe.delete(e),this.connected.delete(e);const n=this.runtimes.get(e);if(this.runtimes.delete(e),this.progress.clearBridge(e),n){try{n.channel.rawWsClient?.close({force:!0})}catch{}n.channel.disconnect().catch(()=>{})}}stopAll(){for(const e of[...this.runtimes.keys()])this.stop(e);this.progress.clear()}applyUpdate(e){const t=this.runtimes.get(e.bridge.id);return t?this.progress.applyUpdate(e,t):Promise.resolve(!1)}applyProgressUpdate(e){return this.applyUpdate(e)}}function Mb(e){return"lark"===String(e||"").trim().toLowerCase()?A.Domain.Lark:A.Domain.Feishu}class qb{ttlMs;load;now;cached;pending;generation=0;constructor(e,t,n={}){this.ttlMs=e,this.load=t,this.now=n.now||Date.now}get(){if(this.cached&&this.cached.expiresAt>this.now())return Promise.resolve(this.cached.value);if(this.pending)return this.pending;const e=this.generation,t=this.load().then(t=>(this.generation===e&&(this.cached={expiresAt:this.now()+this.ttlMs,value:t}),t)).finally(()=>{this.pending===t&&(this.pending=void 0)});return this.pending=t,t}invalidate(){this.generation+=1,this.cached=void 0,this.pending=void 0}}class Ub{aggregates=new Map;endTokens=new Map;options;delayMs;constructor(e){this.options=e,this.delayMs=e.delayMs??1e3}async handleIncoming(e,t,n,i,s=[],a={},o={}){const r=i.trim(),c=r.split(/\s+/,1)[0]?.toLowerCase()||"",d=$b(e.id,t,n),l=this.aggregates.get(d);return o.autoBegin&&!l?(this.start(d,e,t,n,a),this.enqueue(d,e,t,n,i,s,a,!0),void await this.sendCollectionStarted(e,t,d,a.sourceMessageId,"Image received. Continue sending messages, then send /end when done.")):"/begin"===c?(this.start(d,e,t,n,a),void await this.sendCollectionStarted(e,t,d,a.sourceMessageId,"Started collecting messages. Send /end when done.")):void("/end"!==c?l?.explicit?this.enqueue(d,e,t,n,i,s,a,!0):r.startsWith("/")?await this.options.dispatch(e,t,n,i,s,a):this.enqueue(d,e,t,n,i,s,a,!1):await this.flush(d,"manual"))}async handleEndCallback(e,t,n,i,s){const a=this.endTokens.get(i)||"";if(a!==$b(e.id,t,s))return void await this.options.answerCallback(e,n,"This collection is not active here");const o=await this.flush(a,"callback");await this.options.answerCallback(e,n,o?"Collected message sent":"No messages collected")}stop(){for(const e of this.aggregates.values())e.timer&&clearTimeout(e.timer);this.aggregates.clear(),this.endTokens.clear()}stopBridge(e){for(const[t,n]of this.aggregates)n.bridgeId===e&&(n.timer&&clearTimeout(n.timer),this.aggregates.delete(t));for(const[t,n]of this.endTokens)n.startsWith(`${e}:`)&&this.endTokens.delete(t)}start(e,t,n,i,s){const a=this.aggregates.get(e);a?.timer&&clearTimeout(a.timer),this.aggregates.set(e,{bridgeId:t.id,chatId:n,userId:i,texts:[],attachments:[],context:s,explicit:!0})}enqueue(e,t,n,i,s,a,o,r){const c=this.aggregates.get(e);c?.timer&&clearTimeout(c.timer);const d=c||{bridgeId:t.id,chatId:n,userId:i,texts:[],attachments:[],context:o,explicit:r};var l,p;d.bridgeId=t.id,d.chatId=n,d.userId=i,d.context=(l=d.context,p=o,{sourceMessageId:l?.sourceMessageId??p.sourceMessageId,replyToMessageId:l?.replyToMessageId??p.replyToMessageId,quoteText:l?.quoteText||p.quoteText}),d.explicit=d.explicit||r,s.trim()&&d.texts.push(s),d.attachments.push(...a),d.timer=d.explicit?void 0:setTimeout(()=>{this.flush(e,"timer").catch(e=>this.options.onError?.(d.bridgeId,e))},this.delayMs),this.aggregates.set(e,d)}async flush(e,t){const n=this.aggregates.get(e);if(!n)return!1;n.timer&&clearTimeout(n.timer),this.aggregates.delete(e);const i=this.options.requireBridge(n.bridgeId),s=n.texts.join("\n\n").trim();return s||n.attachments.length?(await this.options.dispatch(i,n.chatId,n.userId,s,n.attachments,n.context||{}),!0):("timer"!==t&&await this.options.send(i,n.chatId,"No messages collected.",{replyToMessageId:n.context?.sourceMessageId}),!1)}sendCollectionStarted(e,t,n,i,s){return this.options.send(e,t,s,{replyToMessageId:i,replyMarkup:$f([[{text:"/end",callbackData:this.endCallbackData(n)}]])})}endCallbackData(e){const t=i.createHash("sha256").update(e).digest("base64url").slice(0,16);return this.endTokens.set(t,e),`task_handoff:cp_msg_end:${t}`}}function $b(e,t,n){return[e,t,n||""].join(":")}class Bb{cancelTokens=new Map;queueActionTokens=new Map;options;constructor(e){this.options=e}cancelCallbackData(e,t){this.pruneExpired();const n=Hb([e,t]);return this.cancelTokens.set(n,this.expiring({instanceId:e,sessionId:t})),`task_handoff:cp_ai_cancel:${n}`}queueSteerCallbackData(e,t,n){return`task_handoff:cp_ai_steer:${this.queueActionToken({type:"steer",instanceId:e,sessionId:t,queueId:n})}`}queueDeleteMenuCallbackData(e,t){return`task_handoff:cp_ai_qdel_menu:${this.queueActionToken({type:"delete-menu",instanceId:e,sessionId:t})}`}async tryHandle(e,t){this.pruneExpired();const n=Fb(e,"task_handoff:cp_ai_cancel:");if(void 0!==n){const e=this.cancelTokens.get(n)?.value;return e?(await this.cancel(t,e.instanceId,e.sessionId),!0):this.expired(t)}const i=Fb(e,"task_handoff:cp_ai_steer:");if(void 0!==i){const e=this.queueActionTokens.get(i)?.value;return e&&"steer"===e.type?(await this.steer(t,e),!0):this.expired(t)}const s=Fb(e,"task_handoff:cp_ai_qdel_menu:");if(void 0!==s){const e=this.queueActionTokens.get(s)?.value;return e&&"delete-menu"===e.type?(await this.deleteMenu(t,e),!0):this.expired(t)}const a=Fb(e,"task_handoff:cp_ai_qdel:");if(void 0!==a){const e=this.queueActionTokens.get(a)?.value;return e&&"delete-item"===e.type?(await this.deleteItem(t,e),!0):this.expired(t)}return!1}async cancel(e,t,n){await this.requireAllowed(e,t,n)&&await this.run(e,{instanceId:t,sessionId:n,successText:"Interrupt sent",failurePrefix:"Interrupt failed",logMessage:"chat ai session cancel sent",operation:()=>this.options.interrupt(t,n)})}async steer(e,t){await this.requireAllowed(e,t.instanceId,t.sessionId)&&await this.run(e,{...t,successText:"Steered queued message",failurePrefix:"Steer failed",logMessage:"chat ai session queued message steered",operation:()=>this.options.steer(t.instanceId,t.sessionId,t.queueId)})}async deleteMenu(e,t){if(await this.requireAllowed(e,t.instanceId,t.sessionId))try{const n=Wb(await this.options.queue(t.instanceId,t.sessionId)),i=(Array.isArray(n.items)?n.items:[]).map(Wb).filter(e=>"queued"===Vb(e.status)&&Vb(e.id));if(!i.length)return void await this.answer(e,"Queue is empty");const s=i.slice(0,5).map((e,n)=>[{text:Gb(Vb(e.message),n),callbackData:this.queueDeleteItemCallbackData(t.instanceId,t.sessionId,Vb(e.id))}]);await this.send(e,"Delete queued message",{replyMarkup:$f(s)}),await this.answer(e,"Select a queued message"),this.options.info(this.logData(e,t,{itemCount:i.length}),"chat ai session queue delete menu sent")}catch(t){await this.fail(e,t,"Queue menu failed")}}async deleteItem(e,t){if(await this.requireAllowed(e,t.instanceId,t.sessionId))try{await this.options.remove(t.instanceId,t.sessionId,t.queueId),await this.answer(e,"Queued message deleted"),(e.deleteMessage||Number.isInteger(e.messageId))&&await this.deleteMessage(e).catch(n=>{this.options.warn(this.logData(e,t,{messageId:e.messageId,error:Kb(n)}),"chat ai session queue delete menu message delete failed")}),this.options.info(this.logData(e,t),"chat ai session queued message deleted")}catch(t){await this.fail(e,t,"Delete failed")}}async run(e,t){try{await t.operation(),await this.answer(e,t.successText),this.options.info(this.logData(e,t),t.logMessage)}catch(n){await this.fail(e,n,t.failurePrefix)}}async requireAllowed(e,t,n){return!!(e.actionAllowed?e.actionAllowed(t,n):this.options.actionAllowed(e.bridge,e.chatId,t,n,Number.isInteger(e.messageId)?e.messageId:void 0))||(await this.answer(e,"This chat is not bound to that AI session"),!1)}async fail(e,t,n){const i=Kb(t);this.options.setBridgeError(e.bridge.id,i),await this.answer(e,`${n}: ${function(e){const t=e.replace(/\s+/g," ").trim();return t.length<=120?t:`${t.slice(0,Math.max(0,119))}…`}(i)}`)}async expired(e){return await this.answer(e,"This AI session action expired"),!0}answer(e,t){return e.answer?e.answer(t):this.options.answer(e.bridge,e.callbackQueryId,t)}send(e,t,n){return e.send?e.send(t,n):this.options.send(e.bridge,e.chatId,t,n)}deleteMessage(e){return e.deleteMessage?e.deleteMessage():Number.isInteger(e.messageId)?this.options.deleteMessage(e.bridge,e.chatId,e.messageId):Promise.resolve(void 0)}queueDeleteItemCallbackData(e,t,n){return`task_handoff:cp_ai_qdel:${this.queueActionToken({type:"delete-item",instanceId:e,sessionId:t,queueId:n})}`}queueActionToken(e){this.pruneExpired();const t=Hb([e.type,e.instanceId,e.sessionId,"queueId"in e?e.queueId:""]);return this.queueActionTokens.set(t,this.expiring(e)),t}clear(){this.cancelTokens.clear(),this.queueActionTokens.clear()}expiring(e){return{value:e,expiresAt:(this.options.now||Date.now)()+(this.options.tokenTtlMs??864e5)}}pruneExpired(){const e=(this.options.now||Date.now)();for(const[t,n]of this.cancelTokens)n.expiresAt<=e&&this.cancelTokens.delete(t);for(const[t,n]of this.queueActionTokens)n.expiresAt<=e&&this.queueActionTokens.delete(t)}logData(e,t,n={}){return{bridgeId:e.bridge.id,chatId:e.chatId,instanceId:t.instanceId,sessionId:t.sessionId,...t.queueId?{queueId:t.queueId}:{},userId:e.userId,...n}}}function Fb(e,t){if(!e.startsWith(t))return;const n=e.slice(t.length);return n&&!n.includes(":")?n:void 0}function Hb(e){return i.createHash("sha256").update(e.join("\0")).digest("base64url").slice(0,16)}function Gb(e,t){const n=`${t+1}. `,i=Vb(e).replace(/\s+/g," ").trim()||"Queued message",s=Math.max(8,48-n.length),a=Array.from(i);return`${n}${a.length>s?`${a.slice(0,Math.max(1,s-3)).join("")}...`:i}`}function Wb(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function Vb(e){return"string"==typeof e?e.trim():""}function Kb(e){return e instanceof Error?e.message:String(e)}class Yb{announced=new Set;options;constructor(e){this.options=e}async poll(){const e=await this.options.listRoutes().catch(()=>[]);for(const t of e){if(this.announced.has(t.id))continue;const e=Xb(t,this.options.callbackData),n=t.aiSessionId?this.options.listBindings().filter(e=>e.activeInstanceId===t.instanceId&&e.activeAiSessionId===t.aiSessionId):[];(await this.sendToBindings(n,e)||await this.sendToDefaults(e))&&this.announced.add(t.id)}}async sendToBindings(e,t){let n=!1;for(const i of e){if(!i.bridgeId)continue;const e=this.options.requireBridge(i.bridgeId);if(!e.enabled)continue;const s=await this.send(e,i.chatSessionId,t);n||=s}return n}async sendToDefaults(e){let t=!1;for(const n of this.options.listBridges()){if(!n.enabled||!n.defaultChatId)continue;let i=!1;await this.options.send(n,n.defaultChatId,e).catch(e=>(this.options.setBridgeError(n.id,Jb(e)),i=!0,!1))?t=!0:i||this.options.setBridgeError(n.id,"Chat bridge message was not delivered.")}return t}async send(e,t,n){return this.options.send(e,t,n).then(Boolean).catch(t=>(this.options.setBridgeError(e.id,Jb(t)),!1))}}function Xb(e,t){const n=`${e.project?.name||e.projectId} / ${e.instance?.name||e.instanceId}`,i="approval"===e.kind?`/approve ${e.id}\n/deny ${e.id}\n/skip ${e.id}`:`/reply ${e.id} <message>`,s=`[${n}]\n${e.result}\n\n${i}`;return"approval"!==e.kind?{text:s}:{text:s,replyMarkup:$f([[{text:"Allow",callbackData:t(e.id,"allow")},{text:"Skip",callbackData:t(e.id,"skip")},{text:"Deny",callbackData:t(e.id,"deny")}]])}}function Jb(e){return e instanceof Error?e.message:String(e)}function Qb(){return e=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(e||"").trim().toLowerCase());var e}class Zb{service;fetchImpl;logger;diagnosticLogsEnabled;bridgeTimers=new Map;bridgePollingGenerations=new Map;bridgePolls=new Map;dingdingBridges;larkBridges;bridgeErrors=new Map;telegramOffsets=new Map;seenTelegramUpdates=new Set;wechatCursors=new Map;pendingRouteNotifier;deliveredAiSessionFingerprints=new Map;telegramAiSessionCallbacks;telegramMessageAggregator;telegramProgressMessageTargets=new Map;aiSessionInstanceNamesCache;aiSessionPendingRoutesCache;telegramProgress;stopAiSessionListener;constructor(e,t=fetch,n={}){this.service=e,this.fetchImpl=t,this.logger=n.logger,this.diagnosticLogsEnabled=n.diagnosticLogsEnabled||Qb,this.aiSessionInstanceNamesCache=new qb(3e4,async()=>{const e=await(this.service.listAiSessionInstanceNames?.()||this.service.boardAsync()).catch(()=>[]);return new Map(e.map(e=>[e.id,e.name||e.id]))}),this.aiSessionPendingRoutesCache=new qb(1e3,()=>this.service.listPendingRoutes().catch(()=>[])),this.telegramMessageAggregator=new Ub({requireBridge:e=>this.service.requireChatBridge(e),send:(e,t,n,i={})=>this.sendTelegramMessage(e,t,n,i),answerCallback:(e,t,n)=>this.answerTelegramCallback(e,t,n),dispatch:(e,t,n,i,s,a)=>this.dispatchTelegramGatewayMessage(e,t,n,i,s,a),onError:(e,t)=>this.bridgeErrors.set(e,cv(t))}),this.telegramAiSessionCallbacks=new Bb({interrupt:(e,t)=>this.service.interruptAiSession(e,t),queue:(e,t)=>this.service.aiSessionQueue(e,t),steer:(e,t,n)=>this.service.steerAiSessionQueuedMessage(e,t,n),remove:(e,t,n)=>this.service.removeAiSessionQueuedMessage(e,t,n),actionAllowed:(e,t,n,i,s)=>this.telegramAiSessionActionAllowed(e,t,n,i,s),answer:(e,t,n)=>this.answerTelegramCallback(e,t,n),send:(e,t,n,i={})=>this.sendTelegramMessage(e,t,n,i),deleteMessage:(e,t,n)=>this.deleteTelegramMessage(e,t,n),setBridgeError:(e,t)=>this.bridgeErrors.set(e,t),info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)}),this.pendingRouteNotifier=new Yb({listRoutes:()=>this.service.listPendingRoutes(),listBindings:()=>this.service.listChatSessions(),listBridges:()=>this.service.listChatBridges(),requireBridge:e=>this.service.requireChatBridge(e),callbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),send:(e,t,n)=>this.sendViaBridge(e,t,n),setBridgeError:(e,t)=>this.bridgeErrors.set(e,t)}),this.telegramProgress=new Ib({updateIntervalMs:n.telegramProgressUpdateIntervalMs,requireBridge:e=>this.service.requireChatBridge(e),send:(e,t,n,i={})=>this.sendTelegramMessage(e,t,n,i),edit:(e,t,n,i,s={})=>this.editTelegramMessage(e,t,n,i,s),deleteMessage:(e,t,n)=>this.deleteTelegramMessage(e,t,n),onLog:e=>this.logWarn({message:e},"telegram progress store warning")}),this.dingdingBridges=new jb({fetchImpl:this.fetchImpl,createClient:n.createDingdingClient,logger:{info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)},onRobotMessage:(e,t,n)=>this.handleDingdingRobotMessage(e,t,n),onCardCallback:(e,t,n)=>this.handleDingdingCardCallback(e,t,n),onError:(e,t)=>this.bridgeErrors.set(e,cv(t)),clearError:e=>this.bridgeErrors.delete(e)}),this.larkBridges=new Lb({createChannel:n.createLarkChannel,progressUpdateIntervalMs:n.larkProgressUpdateIntervalMs,logger:{info:(e,t)=>this.logInfo(e,t),warn:(e,t)=>this.logWarn(e,t)},onMessage:(e,t,n)=>this.handleLarkMessage(e,t,n),onCardAction:(e,t,n)=>this.handleLarkCardAction(e,t,n),onError:(e,t)=>this.bridgeErrors.set(e,cv(t)),clearError:e=>this.bridgeErrors.delete(e)}),this.stopAiSessionListener=n.aiSessions?.onSnapshot(e=>{this.deliverAiSessionSnapshot(e.instanceId,e.aiSessions).catch(t=>{this.logWarn({instanceId:e.instanceId,snapshotRevision:e.revision,error:cv(t)},"chat ai session snapshot delivery failed")})})}logInfo(e,t){this.diagnosticLogsEnabled()&&this.logger?.info?.({component:"control-plane-chat-gateway",...e},t)}logWarn(e,t){this.diagnosticLogsEnabled()&&this.logger?.warn?.({component:"control-plane-chat-gateway",...e},t)}updateChatBridge(e,t){this.service.updateChatBridge?.(e,t)}startEnabled(){this.logAiSessionDelivery({stage:"runtime-start-enabled",bridgeCount:this.service.listChatBridges().length,enabledBridgeCount:this.service.listChatBridges().filter(e=>e.enabled).length});for(const e of this.service.listChatBridges())e.enabled&&this.startBridge(e.id)}startBridge(e){if(this.bridgeTimers.has(e)||this.dingdingBridges.has(e)||this.larkBridges.has(e))return this.logAiSessionDelivery({stage:"bridge-start-skipped-running",bridgeId:e}),this.status();const t=this.service.requireChatBridge(e);return this.logAiSessionDelivery({stage:"bridge-start",bridgeId:t.id,channel:t.channel,enabled:t.enabled,hasToken:Boolean(t.token)}),"wechat"===t.channel?this.startPollingBridge(t,(e,t)=>this.pollWechat(e,t)):"dingding"===t.channel?this.startDingdingBridge(t):"lark"===t.channel?this.startLarkBridge(t):"telegram"!==t.channel?(this.bridgeErrors.set(e,`${t.channel} bridge is not supported in the control plane.`),this.status()):t.token?this.startPollingBridge(t,(e,t)=>this.pollTelegram(e,t)):(this.bridgeErrors.set(e,"Telegram token is not configured."),this.status())}stopBridge(e){this.advanceBridgePollingGeneration(e);const t=`:${e}:`;for(const e of this.deliveredAiSessionFingerprints.keys())e.includes(t)&&this.deliveredAiSessionFingerprints.delete(e);const n=this.bridgeTimers.get(e);return n&&(clearInterval(n),this.bridgeTimers.delete(e)),this.dingdingBridges.stop(e),this.larkBridges.stop(e),this.telegramMessageAggregator.stopBridge(e),this.status()}stopAll(){const e=new Set([...this.service.listChatBridges().map(e=>e.id),...this.bridgePollingGenerations.keys(),...this.bridgeTimers.keys(),...this.bridgePolls.keys(),...this.dingdingBridges.ids(),...this.larkBridges.ids()]);for(const t of e)this.stopBridge(t);this.dingdingBridges.stopAll(),this.larkBridges.stopAll(),this.telegramMessageAggregator.stop(),this.telegramAiSessionCallbacks.clear(),this.stopAiSessionListener?.(),this.stopAiSessionListener=void 0}async pollBridgeNow(e){const t=this.service.requireChatBridge(e),n=this.bridgePollingGeneration(e);return"telegram"===t.channel?(await this.runBridgePoll(t,n,(e,t)=>this.pollTelegram(e,t)),this.status()):"wechat"===t.channel?(await this.runBridgePoll(t,n,(e,t)=>this.pollWechat(e,t)),this.status()):("dingding"===t.channel||"lark"===t.channel||this.bridgeErrors.set(e,`${t.channel} bridge is not supported in the control plane.`),this.status())}async pollAiSessionsNow(){return await this.pollAiSessionUpdates(),this.status()}status(){const e=this.service.listChatBridges().map(e=>({id:e.id,channel:e.channel,name:e.name,running:this.bridgeTimers.has(e.id)||this.dingdingBridges.isRunning(e.id)||this.larkBridges.isRunning(e.id),tokenSet:Boolean(e.tokenSet),defaultChatId:e.defaultChatId,lastUpdateId:this.telegramOffsets.get(e.id),error:this.bridgeErrors.get(e.id)}));return{running:e.some(e=>e.running),bridges:e}}startPollingBridge(e,t){if(!e.token)return this.bridgeErrors.set(e.id,`${e.channel} token is not configured.`),this.status();this.bridgeErrors.delete(e.id);const n=this.advanceBridgePollingGeneration(e.id),i=()=>this.bridgePollingGeneration(e.id)===n,s=s=>{i()&&this.runBridgePoll(s,n,t).catch(t=>{i()&&this.bridgeErrors.set(e.id,t instanceof Error?t.message:String(t))})},a=setInterval(()=>{if(!i())return;const t=this.service.requireChatBridge(e.id);t.enabled?s(t):this.stopBridge(e.id)},e.pollIntervalMs);if(this.bridgeTimers.set(e.id,a),this.logAiSessionDelivery({stage:"bridge-poll-started",bridgeId:e.id,channel:e.channel,intervalMs:e.pollIntervalMs}),e.enabled){const t=this.service.requireChatBridge(e.id);s(t)}return this.status()}runBridgePoll(e,t,n){const i=this.bridgePolls.get(e.id);if(i?.generation===t)return i.promise;const s=(async()=>{const i=()=>this.bridgePollingGeneration(e.id)===t;i()&&await n(e,i)})();this.bridgePolls.set(e.id,{generation:t,promise:s});const a=()=>{this.bridgePolls.get(e.id)?.promise===s&&this.bridgePolls.delete(e.id)};return s.then(a,a),s}bridgePollingGeneration(e){return this.bridgePollingGenerations.get(e)||0}advanceBridgePollingGeneration(e){const t=this.bridgePollingGeneration(e)+1;return this.bridgePollingGenerations.set(e,t),t}startDingdingBridge(e){return this.dingdingBridges.start(e),this.status()}startLarkBridge(e){return this.larkBridges.start(e),this.status()}async handleLarkMessage(e,t,n){const i=this.bindOrAllowChatUser(e,n.senderId),s=String(n.content||"").trim();if(!i||!s)return void this.logWarn({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,allowed:i,hasText:Boolean(s)},"lark message ignored");let a;e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:n.chatId}),this.logInfo({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,chatType:n.chatType,messageId:n.messageId,textPreview:lv(s)},"lark chat gateway message received");try{a=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"lark",bridgeId:e.id,chatSessionId:n.chatId,userId:n.senderId},message:{text:s,attachments:[]}})}catch(e){return void await t.channel.send(n.chatId,{markdown:`Failed to handle message: ${cv(e)}`})}const o=ev(a);if(!o)return;const r=nv(a);if(await this.sendLarkRoutedAiSessionProgress(a,e,n.chatId,o,r))return;const c=Nb({fetchImpl:this.fetchImpl,bridge:e,larkRuntime:t}),d=await c.send(n.chatId,o,{replyMarkup:r});d&&this.logInfo({bridgeId:e.id,chatId:n.chatId,senderId:n.senderId,provider:d.provider,interactionId:d.interactionId,routed:!0===mv(a).routed,replyPreview:lv(o)},"lark chat gateway reply sent")}async sendLarkRoutedAiSessionProgress(e,t,n,i,s){if(!0!==e.routed)return!1;const a=fv(e),{instanceId:o,sessionId:r,turnId:c}=a;if(!o||!r||!c)return this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:r,turnId:c,turnIdSources:a.sources,routed:e.routed},"lark ai session progress message not started"),!1;const d=wv(o,r,c,t.id,n);return!!await this.larkBridges.applyProgressUpdate({bridge:t,key:d,chatId:n,text:i,replyMarkup:s})&&(this.deliveredAiSessionFingerprints.delete(d),this.logInfo({bridgeId:t.id,chatId:n,instanceId:o,sessionId:r,turnId:c,key:d,textPreview:lv(i)},"lark ai session progress message started"),!0)}async handleLarkCardAction(e,t,n){const i=n.operator.openId||n.operator.userId;if(!this.bindOrAllowChatUser(e,i))return void this.logWarn({bridgeId:e.id,chatId:n.chatId,messageId:n.messageId,userId:i},"lark card action ignored");const s=cb(n.action.value),a=(e,i)=>t.channel.updateCard(n.messageId,rb(e||"Updated",i));if(!s)return void await a("Unsupported action");if(await this.telegramAiSessionCallbacks.tryHandle(s,{bridge:e,chatId:n.chatId,callbackQueryId:n.messageId,userId:i,messageId:n.messageId,actionAllowed:(t,i)=>this.chatAiSessionBindingActive(e,n.chatId,t,i),answer:e=>a(e),send:(e,i)=>t.channel.send(n.chatId,{card:rb(e,i?.replyMarkup)})}))return;let o;try{o=await this.parseChatGatewayCallbackAction(s)}catch(e){if(dv(e,"CHAT_PENDING_ACTION_STALE"))return void await a(cv(e));throw e}if(!o)return void await a("Unsupported action");const r=await this.service.handleChatGatewayAction({source:{channel:"lark",bridgeId:e.id,chatSessionId:n.chatId,userId:i},action:o});if("pending-decision"===o.type&&tv(r))return void await a(`${o.decision} sent`);const c=ev(r)||rv(r.message)||"Updated";await a(c,nv(r))}async handleDingdingRobotMessage(e,t,n){const i=function(e){const t=sb(e),n=ib(t.conversationId),i=ib(tb(t.text).content).trim();if(!n||!i)return;const s=ib(t.senderStaffId||t.senderId);return{chatId:n,userId:s||void 0,senderId:s||void 0,sessionWebhook:ib(t.sessionWebhook)||void 0,conversationType:Fy(t.conversationType,{robotMessage:!0}),text:i,raw:t}}(n.data);if(t.client.socketCallBackResponse(n.headers.messageId,{}),!i||!this.bindOrAllowChatUser(e,i.senderId))return void this.logWarn({bridgeId:e.id,hasEvent:Boolean(i),senderId:i?.senderId,allowed:i?this.bindOrAllowChatUser(e,i.senderId):void 0},"dingding robot message ignored");const{chatId:s,text:a,senderId:o,sessionWebhook:r}=i;r&&t.chatWebhooks.set(s,r),i.conversationType&&t.conversationTypes.set(s,i.conversationType);const c=r||t.chatWebhooks.get(s)||rv(e.settings.sessionWebhook);let d;o&&t.senderIds.set(s,o),e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:s}),this.logInfo({bridgeId:e.id,chatId:s,senderId:o,conversationType:i.conversationType,hasSessionWebhook:Boolean(r),hasCachedSessionWebhook:Boolean(t.chatWebhooks.get(s)),hasResolvedSessionWebhook:Boolean(c),textPreview:lv(a)},"dingding chat gateway message received");try{d=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"dingding",bridgeId:e.id,chatSessionId:s,userId:o||void 0},message:{text:a,attachments:[]}})}catch(e){if(c)return void await Ky(this.fetchImpl,c,`Failed to handle message: ${cv(e)}`,t.onLog);throw e}const l=ev(d);if(l){const n=nv(d);if(await this.sendDingdingRoutedAiSessionProgress(d,e,t,s,l,{replyMarkup:n,sessionWebhook:c,senderId:o,sourcePrompt:a}))return;const i=Nb({fetchImpl:this.fetchImpl,bridge:e,dingdingRuntime:t}),r=await i.send(s,l,{replyMarkup:n,sessionWebhook:c,senderId:o});if(r)return void this.logInfo({bridgeId:e.id,chatId:s,senderId:o,provider:r.provider,interactionId:r.interactionId,routed:!0===mv(d).routed,hasReplyMarkup:Boolean(n),replyPreview:lv(l)},"dingding chat gateway reply sent");this.logWarn({bridgeId:e.id,chatId:s,senderId:o,hasReplyMarkup:Boolean(n),hasSessionWebhook:Boolean(c),hasRobotCode:Boolean(rv(e.settings.robotCode)),replyPreview:lv(l)},"dingding chat gateway reply skipped")}}async sendDingdingRoutedAiSessionProgress(e,t,n,i,s,a={}){if(!0!==e.routed)return!1;const o=fv(e),{instanceId:r,sessionId:c,turnId:d}=o;if(!r||!c||!d)return this.logWarn({bridgeId:t.id,chatId:i,instanceId:r,sessionId:c,turnId:d,turnIdSources:o.sources,routed:e.routed},"dingding ai session progress card not started"),!1;const l=wv(r,c,d,t.id,i);return!!await this.dingdingBridges.applyProgressUpdate({bridge:t,key:l,chatId:i,text:s,replyMarkup:a.replyMarkup})&&(this.deliveredAiSessionFingerprints.delete(l),this.logInfo({bridgeId:t.id,chatId:i,instanceId:r,sessionId:c,turnId:d,key:l,hasSessionWebhook:Boolean(a.sessionWebhook),hasSenderId:Boolean(a.senderId),sourcePrompt:lv(a.sourcePrompt,80),textPreview:lv(s)},"dingding ai session progress card started"),!0)}async handleDingdingCardCallback(e,t,n){const i=function(e){const t=sb(e),n=nb(t.cardActionData||t.content),i=nb(n.cardPrivateData||t.cardPrivateData||t.content),s=nb(i.params||n.params||t.params),a=ib(t.userId),o=ib(s.biz_sender_id);return{userId:a||void 0,chatId:By(t,s),senderId:a||void 0,deliverySenderId:o||void 0,sessionWebhook:ib(s.biz_session_webhook)||void 0,conversationType:Fy(s.biz_conversation_type||t.conversationType||t.conversation_type),callbackData:Hy(Wy(t,n,i)),body:t,params:s}}(n.data);if(!this.bindOrAllowChatUser(e,i.userId))return Gy("not authorized",void 0,"unauthorized",i.body,i.params);const s=i.chatId||rv(e.defaultChatId),a=i.deliverySenderId||i.senderId,o=i.sessionWebhook;let r;s&&o&&t.chatWebhooks.set(s,o),s&&i.conversationType&&t.conversationTypes.set(s,i.conversationType),s&&a&&t.senderIds.set(s,a);try{r=await this.parseChatGatewayCallbackAction(i.callbackData)}catch(e){if(dv(e,"CHAT_PENDING_ACTION_STALE"))return Gy(cv(e),void 0,"approval_stale",i.body,i.params);throw e}if(!r)return this.logWarn({bridgeId:e.id,chatId:s,userId:i.userId,senderId:a,...pv(i)},"dingding card callback action unsupported"),Gy("Unsupported action",void 0,"unsupported",i.body,i.params);this.logInfo({bridgeId:e.id,chatId:s,userId:i.userId,senderId:a,actionType:r.type,...pv(i)},"dingding card callback action parsed");const c=await this.service.handleChatGatewayAction({source:{channel:"dingding",bridgeId:e.id,chatSessionId:s,userId:i.userId||void 0},action:r});return"pending-decision"===r.type&&tv(c)?Gy(`${r.decision} sent`,void 0,"approval_done",i.body,i.params):Gy(ev(c)||rv(c.message)||"updated",nv(c),"updated",i.body,i.params)}async pollWechat(e,t=()=>!0){if(!e.token)return;const n=e.settings||{},i=this.wechatCursors.get(e.id)||rv(n.updatesBuf),s=await async function(e){const t=kb((e.bridge.settings||{}).baseUrl)||"https://ilinkai.weixin.qq.com",n=await e.fetchImpl(`${t}/ilink/bot/getupdates`,{method:"POST",headers:{"content-type":"application/json",AuthorizationType:"ilink_bot_token",Authorization:`Bearer ${e.bridge.token}`,"X-WECHAT-UIN":String(Math.floor(Math.random()*2**31))},body:JSON.stringify({get_updates_buf:e.cursor,base_info:{channel_version:"1.0.2"}})}),i=await n.json().catch(()=>({}));if(!n.ok)throw new Error(`HTTP ${n.status}`);const s=Number(i.errcode??i.ret??0);if(0!==s)throw new Error(kb(i.errmsg||i.msg)||`chat bridge API returned ${s}`);const a=[];for(const e of Array.isArray(i.msgs)?i.msgs:[]){const t=zb(e);if(1!==t.message_type)continue;const n=kb(t.from_user_id),i=Tb(t);n&&i&&a.push({chatId:n,text:i,contextToken:kb(t.context_token)})}return{cursor:kb(i.get_updates_buf),messages:a}}({fetchImpl:this.fetchImpl,bridge:e,cursor:i});if(t()){s.cursor&&(this.wechatCursors.set(e.id,s.cursor),this.updateChatBridge(e.id,{settings:{updatesBuf:s.cursor}}));for(const i of s.messages){if(!t())return;const{chatId:s,contextToken:a,text:o}=i;if(e.defaultChatId||this.updateChatBridge(e.id,{defaultChatId:s,settings:{contextToken:a}}),e.defaultChatId&&e.defaultChatId!==s)continue;const r=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"wechat",bridgeId:e.id,chatSessionId:s},message:{text:o,attachments:[]}});if(!t())return;const c=ev(r);if(c){const t=Nb({fetchImpl:this.fetchImpl,bridge:e});await t.send(s,c,{contextToken:a||rv(n.contextToken)})}}}}pollPendingRoutes(){return this.pendingRouteNotifier.poll()}async sendToChatBinding(e,t){if(!e.bridgeId)return!1;const n=this.service.requireChatBridge(e.bridgeId);if(!n.enabled)return!1;const i=await this.sendViaBridge(n,e.chatSessionId,t).catch(e=>{this.bridgeErrors.set(n.id,e instanceof Error?e.message:String(e))});return Boolean(i)}async sendViaBridge(e,t,n){const i="string"==typeof n?n:n.text,s="string"==typeof n?void 0:n.replyMarkup;return Nb({fetchImpl:this.fetchImpl,bridge:e,dingdingRuntime:this.dingdingBridges.get(e.id),larkRuntime:this.larkBridges.get(e.id)}).send(t,i,{replyMarkup:s})}async pollTelegram(e,t=()=>!0){if(!e.token)return;const n=Number(e.settings?.telegramLastUpdateId),i=this.telegramOffsets.get(e.id)||(Number.isInteger(n)?n:void 0),s=await async function(e){const t=new URLSearchParams({timeout:"0",...e.offset?{offset:String(e.offset+1)}:{}}),n=await e.fetchImpl(`https://api.telegram.org/bot${e.bridge.token}/getUpdates?${t.toString()}`),i=await n.json().catch(()=>({}));if(!n.ok||!1===i.ok){if(409===n.status||/terminated by other getUpdates request/i.test(String(i.description||"")))return{updates:[],conflict:i.description||"Telegram getUpdates conflict: another bot instance is polling this token."};throw new Error(i.description||`Telegram getUpdates failed with HTTP ${n.status}`)}const s=[];for(const t of i.result||[]){const n=Number(t.update_id),i=Number.isInteger(n)?n:void 0,a=Ab(t.callback_query);if(Object.keys(a).length>0){s.push({updateId:i,callbackQuery:a});continue}const o=Ab(t.message||t.edited_message);if(0===Object.keys(o).length)continue;const r=Ab(o.chat),c=Ab(o.from),d=void 0!==r.id?String(r.id):e.bridge.defaultChatId,l=void 0!==c.id?String(c.id):void 0;if(!d)continue;const p=Eb(o.text??o.caption),u=bb(o);(p||0!==u.length)&&s.push({updateId:i,chatId:d,userId:l,text:p,rawText:p,message:o,messageId:Sb(o),replyToMessageId:Sb(Ab(o.reply_to_message)),quoteText:Eb(Ab(o.quote).text),autoBegin:1===u.length&&!p.trim(),hasSingleImageWithoutText:1===u.length&&!p.trim()})}return{updates:s}}({fetchImpl:this.fetchImpl,bridge:e,offset:i});if(t())if(s.conflict)this.bridgeErrors.set(e.id,s.conflict);else for(const n of s.updates){if(!t())return;if(void 0!==n.updateId){const t=`${e.id}:${n.updateId}`;if(this.seenTelegramUpdates.has(t)||n.updateId<=(this.telegramOffsets.get(e.id)||0))continue;this.seenTelegramUpdates.add(t),this.telegramOffsets.set(e.id,n.updateId),this.updateChatBridge(e.id,{settings:{...e.settings,telegramLastUpdateId:n.updateId}})}if("callbackQuery"in n){const t=n.callbackQuery;await this.handleTelegramCallback(e,t).catch(async n=>{const i=mv(t.message),s=mv(i.chat),a=void 0!==s.id?String(s.id):e.defaultChatId;this.bridgeErrors.set(e.id,cv(n)),a&&await this.sendTelegramMessage(e,a,`Action failed: ${cv(n)}`).catch(t=>{this.bridgeErrors.set(e.id,cv(t))})});continue}if(!this.bindOrAllowChatUser(e,n.userId))continue;const i=await xb({fetchImpl:this.fetchImpl,bridge:e,message:n.message,onImageDownloadError:({fileId:t,fileName:n,error:i})=>{this.logWarn({bridgeId:e.id,fileId:t,fileName:n,error:cv(i)},"telegram image download skipped")}});if(!t())return;const s=n.rawText.trim();(s||i.length)&&(this.logInfo({bridgeId:e.id,chatId:n.chatId,messageId:n.messageId,replyToMessageId:n.replyToMessageId,hasQuote:Boolean(n.quoteText),textPreview:lv(s)},"telegram chat gateway message received"),await this.telegramMessageAggregator.handleIncoming(e,n.chatId,n.userId,s,i,{sourceMessageId:n.messageId,replyToMessageId:n.replyToMessageId,quoteText:n.quoteText},{autoBegin:n.autoBegin}))}}async dispatchTelegramGatewayMessage(e,t,n,i,s=[],a={}){try{const o=void 0!==a.replyToMessageId?this.telegramReplyAiSessionTarget(e.id,t,a.replyToMessageId):void 0,r=function(e,t){const n=String(t||"").trim(),i=e.trim();return n?[`引用：${n}`,i].filter(Boolean).join("\n"):i}(i,a.quoteText),c=await this.service.handleChatGatewayMessage({source:{type:"chat-gateway",channel:"telegram",bridgeId:e.id,chatSessionId:t,userId:n},message:{text:r,attachments:s},...o?{target:{instanceId:o.instanceId,aiSessionId:o.sessionId}}:{}}),d=ev(c),l=nv(c);if(d){const n=await this.sendTelegramMessage(e,t,d,{replyMarkup:l,replyToMessageId:a.sourceMessageId});this.logInfo({bridgeId:e.id,chatId:t,sourceMessageId:a.sourceMessageId,replyToMessageId:a.replyToMessageId,replyTargetInstanceId:o?.instanceId,replyTargetSessionId:o?.sessionId,sentMessageId:Number(mv(n).message_id)||void 0,routed:!0===mv(c).routed,replyPreview:lv(d)},"telegram chat gateway reply sent"),await this.rememberTelegramProgressMessage(c,e,t,n,d)}}catch(n){this.bridgeErrors.set(e.id,cv(n)),await this.sendTelegramMessage(e,t,`Failed to handle message: ${cv(n)}`,{replyToMessageId:a.sourceMessageId}).catch(t=>{this.bridgeErrors.set(e.id,cv(t))})}}async handleTelegramCallback(e,t){const n=rv(t.data),i=mv(t.from),s=mv(t.message),a=mv(s.chat),o=void 0!==a.id?String(a.id):e.defaultChatId,r=void 0!==i.id?String(i.id):void 0;if(!o||!this.bindOrAllowChatUser(e,r))return;if(await this.telegramAiSessionCallbacks.tryHandle(n,{bridge:e,chatId:o,callbackQueryId:rv(t.id),userId:r,messageId:sv(s)}))return;const c=n.match(/^task_handoff:cp_msg_end:([^:]+)$/);if(c)return void await this.telegramMessageAggregator.handleEndCallback(e,o,rv(t.id),c[1],r);let d;try{d=await this.parseChatGatewayCallbackAction(n)}catch(n){if(dv(n,"CHAT_PENDING_ACTION_STALE")){await this.answerTelegramCallback(e,rv(t.id),cv(n));const i=sv(s);return void(void 0!==i&&await this.deleteTelegramStandaloneApprovalMessage(e,o,i))}throw n}if(!d)return void await this.answerTelegramCallback(e,rv(t.id),"Unsupported action");const l=await this.service.handleChatGatewayAction({source:{channel:"telegram",bridgeId:e.id,chatSessionId:o,userId:r},action:d});if("pending-decision"===d.type&&tv(l)){await this.answerTelegramCallback(e,rv(t.id),"");const n=sv(s);return void(void 0!==n&&await this.deleteTelegramStandaloneApprovalMessage(e,o,n))}await this.answerTelegramCallback(e,rv(t.id),rv(l.message)||"updated");const p=ev(l),u=nv(l),m=s.message_id;p&&"number"==typeof m?await this.editTelegramMessage(e,o,m,p,{replyMarkup:u}):p&&await this.sendTelegramMessage(e,o,p,{replyMarkup:u})}async deleteTelegramStandaloneApprovalMessage(e,t,n){[...this.telegramProgress.entries.values()].find(i=>i.messageId===n&&i.route?.bridgeId===e.id&&i.route?.chatId===t)||await this.deleteTelegramMessage(e,t,n).catch(i=>{this.logWarn({bridgeId:e.id,chatId:t,messageId:n,error:cv(i)},"telegram callback message delete failed")})}chatAiSessionBindingActive(e,t,n,i){return this.service.listChatSessions().some(s=>s.bridgeId===e.id&&s.chatSessionId===t&&s.activeInstanceId===n&&s.activeAiSessionId===i)}telegramAiSessionActionAllowed(e,t,n,i,s){if(this.chatAiSessionBindingActive(e,t,n,i))return!0;if(!Number.isInteger(s))return!1;const a=this.telegramReplyAiSessionTarget(e.id,t,s);return Boolean(a&&a.instanceId===n&&a.sessionId===i)}async parseChatGatewayCallbackAction(e){const t=function(e){const t=e.match(/^task_handoff:cp_p:v1:([ads]):([A-Za-z0-9_-]{16})$/);if(!t)return;const n=Object.entries(Of).find(([,e])=>e===t[1])?.[0];return"allow"===n||"deny"===n||"skip"===n?{routeFingerprint:t[2],decision:n}:void 0}(e);if(t){const e=(await this.service.listPendingRoutes()).filter(e=>"approval"===e.kind&&"pending"===e.status&&jf(e.id)===t.routeFingerprint);if(1!==e.length){const e=new Error("This approval is no longer pending.");throw Object.assign(e,{statusCode:409,code:"CHAT_PENDING_ACTION_STALE"}),e}return{type:"pending-decision",routeId:e[0].id,decision:t.decision}}return function(e,t){const n=e.match(/^task_handoff:cp_session:(\d+)$/);if(n)return{type:"ai-session",index:Number(n[1])};const i=e.match(/^task_handoff:cp_i:([^:]+)$/)||e.match(/^task_handoff:cp_instance_apps:([^:]+)$/);if(i)return i[0].startsWith("task_handoff:cp_i:")?{type:"instance-app-menu",instanceId:jy(t(i[1],"instance-app-menu").instanceId,"instanceId")}:{type:"instance-app-menu",instanceId:Ly(i[1])};const s=e.match(/^task_handoff:cp_a:([^:]+)$/)||e.match(/^task_handoff:cp_launch_app:([^:]+):([^:]+)$/);if(s){if(s[0].startsWith("task_handoff:cp_a:")){const e=t(s[1],"launch-app");return{type:"launch-app",instanceId:jy(e.instanceId,"instanceId"),appId:jy(e.appId,"appId")}}return{type:"launch-app",instanceId:Ly(s[1]),appId:Ly(s[2])}}const a=e.match(/^task_handoff:cp_p:([^:]+)$/);if(a){const e=t(a[1],"pending-decision");return{type:"pending-decision",routeId:jy(e.routeId,"routeId"),decision:Py(e.decision)}}const o=e.match(/^task_handoff:approval:([^:]+:ai:[^:]+):(allow|deny|skip)$/);return o?{type:"pending-decision",routeId:o[1],decision:o[2]}:void 0}(e,(e,t)=>this.service.resolveChatActionToken(e,t))}bindOrAllowChatUser(e,t){const n=String(t||"").trim();return!!n&&(0===e.allowedUserIds.length?(e.allowedUserIds=[n],this.updateChatBridge(e.id,{allowedUserIds:e.allowedUserIds}),this.logInfo({bridgeId:e.id,channel:e.channel,userId:n},"chat user bound"),!0):e.allowedUserIds.includes(n))}async answerTelegramCallback(e,t,n){return async function(e,t,n,i){t.token&&n&&await e(`https://api.telegram.org/bot${t.token}/answerCallbackQuery`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({callback_query_id:n,text:i.slice(0,200)})})}(this.fetchImpl,e,t,n)}async editTelegramMessage(e,t,n,i,s={}){return async function(e,t,n,i,s,a={}){if(t.token)return Ry(n=>e(`https://api.telegram.org/bot${t.token}/editMessageText`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n)}),"editMessageText",s,{chat_id:n,message_id:i,...a.replyMarkup?{reply_markup:a.replyMarkup}:{}},a)}(this.fetchImpl,e,t,n,i,s)}async sendTelegramMessage(e,t,n,i={}){return Ny(this.fetchImpl,e,t,n,i)}async deleteTelegramMessage(e,t,n){return async function(e,t,n,i){if(!t.token||!Number.isInteger(i))return;const s=await e(`https://api.telegram.org/bot${t.token}/deleteMessage`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({chat_id:n,message_id:i})}),a=await s.json().catch(()=>({}));if(!s.ok||!1===a.ok)throw new Error(a.description||`Telegram deleteMessage failed with HTTP ${s.status}`)}(this.fetchImpl,e,t,n)}async rememberTelegramProgressMessage(e,t,n,i,s){if(!0!==e.routed)return;const a=fv(e),{instanceId:o,sessionId:r,turnId:c}=a,d=Number(mv(i).message_id);if(!(o&&r&&c&&Number.isInteger(d)))return void this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:r,turnId:c,turnIdSources:a.sources,messageId:Number.isInteger(d)?d:void 0,routed:e.routed},"telegram ai session progress message not remembered");const l=wv(o,r,c,t.id,n),p=this.telegramProgress.remember(l,d,s,{bridgeId:t.id,chatId:n});this.telegramProgressMessageTargets.set(av(t.id,n,d),{instanceId:o,sessionId:r,turnId:c,messageId:d}),this.deliveredAiSessionFingerprints.delete(l),this.logInfo({bridgeId:t.id,chatId:n,instanceId:o,sessionId:r,turnId:c,turnIdSources:a.sources,key:l,messageId:d,progressKeys:this.telegramProgressKeysFor(o,r,t.id,n),textPreview:lv(s)},"telegram ai session progress message remembered"),"queue"===function(e){return e.aiSession&&"action"in e.aiSession?e.aiSession.action:void 0}(e)&&p?.messageId&&p.messageId!==d&&(this.telegramProgressMessageTargets.delete(av(t.id,n,p.messageId)),await this.deleteTelegramMessage(t,n,p.messageId).catch(e=>{this.logWarn({bridgeId:t.id,chatId:n,instanceId:o,sessionId:r,turnId:c,replacedMessageId:p.messageId,replacementMessageId:d,error:cv(e)},"telegram queued progress message replacement cleanup failed")}))}telegramReplyAiSessionTarget(e,t,n){const i=this.telegramProgressMessageTargets.get(av(e,t,n));if(i)return i;for(const[i,s]of this.telegramProgress.entries)if(s.messageId===n&&s.route?.bridgeId===e&&s.route?.chatId===t){const s=ov(i,e,t);if(s){const i={...s,messageId:n};return this.telegramProgressMessageTargets.set(av(e,t,n),i),i}}}async pollAiSessionUpdates(){this.logAiSessionDelivery({stage:"poll-tick"});const e=await this.service.listAiSessions({refresh:!0}).catch(()=>{});if(!e)return void this.logAiSessionDelivery({stage:"poll-no-snapshot"});const t=new Map(e.instances.map(e=>[e.instanceId,e.aiSessions]));this.logAiSessionDelivery({stage:"poll-snapshot",instanceCount:t.size,instances:[...t.entries()].map(([e,t])=>({instanceId:e,sessionCount:t.sessions?.length||0,runningCount:t.runningCount,waitingCount:t.waitingCount,updatedAt:t.updatedAt}))});const n=await this.aiSessionInstanceNames();for(const[e,i]of t)await this.deliverAiSessionSnapshot(e,i,n)}async deliverAiSessionSnapshot(e,t,n){const i=Array.isArray(t.sessions)?t.sessions:[];if(this.pruneAiSessionDeliveryState(e,new Set(i.map(e=>e.id))),0===i.length)return;const s=n||await this.aiSessionInstanceNames(),a=await this.aiSessionPendingApprovalRoutes(e);await this.deliverOwnedTelegramProgress(e,i,s,a),await this.deliverActiveBindingTelegramProgress(e,i,s,a)}pruneAiSessionDeliveryState(e,t){for(const[n,i]of this.telegramProgress.entries){const s=i.route?.bridgeId&&i.route.chatId?this.telegramProgressMessageTargets.get(av(i.route.bridgeId,i.route.chatId,i.messageId||0))||ov(n,i.route.bridgeId,i.route.chatId):void 0;s&&s.instanceId===e&&!t.has(s.sessionId)&&(i.timer&&clearTimeout(i.timer),this.telegramProgress.entries.delete(n),this.deliveredAiSessionFingerprints.delete(n),i.route?.bridgeId&&i.route.chatId&&i.messageId&&this.telegramProgressMessageTargets.delete(av(i.route.bridgeId,i.route.chatId,i.messageId)))}}async deliverActiveBindingTelegramProgress(e,t,n,i){for(const s of this.service.listChatSessions()){if(!s.bridgeId||s.activeInstanceId!==e||!s.activeAiSessionId)continue;const a=t.find(e=>e.id===s.activeAiSessionId);if(!a)continue;const o=Tv(n.get(e)||e,a),r=_v(a,o);if(!r){this.logAiSessionDelivery({stage:"skip-empty-text",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,status:a.status,phase:a.phase,activeTurnId:a.activeTurnId,latestTurn:uv(kv(a))});continue}const c=Sv(a);if(!c){this.logAiSessionDelivery({stage:"skip-empty-turn-id",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,status:a.status,phase:a.phase,activeTurnId:a.activeTurnId,latestTurn:uv(kv(a))});continue}if(this.listTelegramOwnedProgressEntries(e).some(e=>e.route.bridgeId===s.bridgeId&&e.route.chatId===s.chatSessionId&&e.owner.sessionId===a.id&&e.owner.turnId===c))continue;const d=wv(e,a.id,c,s.bridgeId||"",s.chatSessionId),l=Av(a,o);if(!l||this.deliveredAiSessionFingerprints.get(d)===l){this.logAiSessionDelivery({stage:"skip-duplicate-fingerprint",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,turnId:c,key:d,hasFingerprint:Boolean(l),fingerprintMatched:this.deliveredAiSessionFingerprints.get(d)===l,latestTurn:uv(kv(a)),textPreview:lv(r)});continue}const p=vv({cancelCallbackData:this.telegramAiSessionCallbacks.cancelCallbackData(e,a.id),queueSteerCallbackData:t=>this.telegramAiSessionCallbacks.queueSteerCallbackData(e,a.id,t),queueDeleteMenuCallbackData:()=>this.telegramAiSessionCallbacks.queueDeleteMenuCallbackData(e,a.id),permissionCallbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),pendingApproval:i.get(a.id)||Iv(e,a),session:a});if(this.logAiSessionDelivery({stage:"attempt",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,turnId:c,key:d,relatedProgressKeys:this.telegramProgressKeysFor(e,a.id,s.bridgeId||"",s.chatSessionId),hasProgressEntry:this.telegramProgress.entries.has(d),status:a.status,phase:a.phase,activeTurnId:a.activeTurnId,latestTurn:uv(kv(a)),textPreview:lv(r)}),await this.updateChatAiSessionProgress(s,r,d,p).catch(t=>(this.bridgeErrors.set(s.bridgeId||"",t instanceof Error?t.message:String(t)),this.logWarn({bridgeId:s.bridgeId,chatId:s.chatSessionId,instanceId:e,sessionId:a.id,turnId:c,key:d,error:cv(t)},"chat ai session progress update failed"),!1)))this.logAiSessionDelivery({stage:"delivered",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,turnId:c,key:d,textPreview:lv(r)}),this.deliveredAiSessionFingerprints.set(d,l);else{if("telegram"===this.service.requireChatBridge(s.bridgeId).channel){const t=this.telegramProgress.entries.get(d),n=this.service.requireChatBridge(s.bridgeId);this.logAiSessionDelivery({stage:t?"telegram-update-not-delivered":"telegram-no-progress-entry",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,turnId:c,key:d,relatedProgressKeys:this.telegramProgressKeysFor(e,a.id,s.bridgeId||"",s.chatSessionId),bridgeEnabled:n.enabled,bridgeChannel:n.channel,progressMessageId:t?.messageId,progressLastText:lv(t?.lastText),progressHasPending:Boolean(t?.pending),latestTurn:uv(kv(a)),textPreview:lv(r)});continue}await this.sendToChatBinding(s,{text:r}).catch(e=>(this.bridgeErrors.set(s.bridgeId||"",e instanceof Error?e.message:String(e)),!1))&&(this.logAiSessionDelivery({stage:"fallback-sent",instanceId:e,sessionId:a.id,bridgeId:s.bridgeId,chatId:s.chatSessionId,turnId:c,key:d,textPreview:lv(r)}),this.deliveredAiSessionFingerprints.set(d,l))}}}async deliverOwnedTelegramProgress(e,t,n,i){for(const s of this.listTelegramOwnedProgressEntries(e)){const a=this.service.requireChatBridge(s.route.bridgeId);if("telegram"!==a.channel||!a.enabled)continue;const o=this.matchTelegramOwnedProgressSession(s,t);if(!o)continue;const r={bridgeId:s.route.bridgeId,chatSessionId:s.route.chatId},c=Tv(n.get(e)||e,o),d=_v(o,c),l=Sv(o);if(!d||!l){this.logAiSessionDelivery({stage:"remembered-skip-turn-or-text",key:s.key,parsedTurnId:s.owner.turnId,currentTurnId:l,hasText:Boolean(d),instanceId:e,sessionId:o.id,bridgeId:s.route.bridgeId,chatId:s.route.chatId});continue}if(s.owner.turnId&&l!==s.owner.turnId){this.logAiSessionDelivery({stage:"remembered-skip-different-active-turn",key:s.key,ownerTurnId:s.owner.turnId,currentTurnId:l,instanceId:e,sessionId:o.id,bridgeId:s.route.bridgeId,chatId:s.route.chatId});continue}const p=l===s.owner.turnId?s.key:wv(e,o.id,l,s.route.bridgeId,s.route.chatId);if(p!==s.key&&this.telegramProgress.entries.has(p))continue;if(p!==s.key&&!this.rekeyTelegramOwnedProgress(s,p,{instanceId:e,sessionId:o.id,turnId:l}))continue;const u=Av(o,c);if(!u||this.deliveredAiSessionFingerprints.get(p)===u){this.logAiSessionDelivery({stage:"remembered-skip-fingerprint",key:s.key,hasFingerprint:Boolean(u),fingerprintMatched:this.deliveredAiSessionFingerprints.get(p)===u,instanceId:e,sessionId:o.id,bridgeId:s.route.bridgeId,chatId:s.route.chatId});continue}const m=vv({cancelCallbackData:this.telegramAiSessionCallbacks.cancelCallbackData(e,o.id),queueSteerCallbackData:t=>this.telegramAiSessionCallbacks.queueSteerCallbackData(e,o.id,t),queueDeleteMenuCallbackData:()=>this.telegramAiSessionCallbacks.queueDeleteMenuCallbackData(e,o.id),permissionCallbackData:(e,t)=>this.service.pendingDecisionCallbackData(e,t),pendingApproval:i.get(o.id)||Iv(e,o),session:o}),h=await this.updateChatAiSessionProgress(r,d,p,m).catch(e=>(this.bridgeErrors.set(r.bridgeId||"",e instanceof Error?e.message:String(e)),!1));this.logAiSessionDelivery({stage:h?"remembered-delivered":"remembered-not-delivered",key:p,instanceId:e,sessionId:o.id,bridgeId:s.route.bridgeId,chatId:s.route.chatId,textPreview:lv(d)}),h&&(this.telegramProgressMessageTargets.set(av(s.route.bridgeId,s.route.chatId,s.messageId),{instanceId:e,sessionId:o.id,turnId:l,messageId:s.messageId}),this.deliveredAiSessionFingerprints.set(p,u))}}rekeyTelegramOwnedProgress(e,t,n){return!!this.telegramProgress.rekey(e.key,t)&&(this.deliveredAiSessionFingerprints.delete(e.key),this.telegramProgressMessageTargets.set(av(e.route.bridgeId,e.route.chatId,e.messageId),{...n,messageId:e.messageId}),!0)}logAiSessionDelivery(e){this.logInfo(e,"telegram ai session delivery flow")}telegramProgressKeysFor(e,t,n,i){const s=`${e}:${t}:`,a=`:${n}:${i}`;return[...this.telegramProgress.entries.keys()].filter(e=>e.startsWith(s)&&e.endsWith(a))}listTelegramOwnedProgressEntries(e){const t=[];for(const[n,i]of this.telegramProgress.entries){if(!i.route?.bridgeId||!i.route.chatId||!Number.isInteger(i.messageId))continue;const s=this.telegramProgressMessageTargets.get(av(i.route.bridgeId,i.route.chatId,i.messageId))||ov(n,i.route.bridgeId,i.route.chatId);s&&s.instanceId===e&&t.push({key:n,route:{bridgeId:i.route.bridgeId,chatId:i.route.chatId},messageId:i.messageId,owner:{...s,messageId:i.messageId}})}return t}matchTelegramOwnedProgressSession(e,t){const n=t.find(t=>t.id===e.owner.sessionId);if(n)return n;if(e.owner.turnId){const n=t.find(t=>t.activeTurnId===e.owner.turnId||kv(t)?.id===e.owner.turnId||kv(t)?.providerTurnId===e.owner.turnId);if(n)return n}}async updateChatAiSessionProgress(e,t,n,i){if(!e.bridgeId)return this.logAiSessionDelivery({stage:"chat-update-skip-missing-bridge",chatId:e.chatSessionId,key:n}),!1;const s=this.service.requireChatBridge(e.bridgeId);if(!s.enabled)return this.logAiSessionDelivery({stage:"chat-update-skip-bridge-state",bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,bridgeEnabled:s.enabled,bridgeChannel:s.channel}),!1;if("dingding"===s.channel){if(!this.dingdingBridges.get(s.id))return!1;const a=await this.dingdingBridges.applyProgressUpdate({bridge:s,key:n,chatId:e.chatSessionId,text:t,replyMarkup:iv({actionRows:i})});return a&&this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,textPreview:lv(t)},"dingding ai session progress updated"),a}if("lark"===s.channel){const a=await this.larkBridges.applyProgressUpdate({bridge:s,key:n,chatId:e.chatSessionId,text:t,replyMarkup:iv({actionRows:i})});return a&&this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,textPreview:lv(t)},"lark ai session progress updated"),a}if("telegram"!==s.channel)return!1;const a=this.telegramProgress.entries.get(n);if(!await this.telegramProgress.applyUpdate({bridge:s,key:n,chatId:e.chatSessionId,text:t,actionRows:i})){const t=this.telegramProgress.entries.get(n);return this.logAiSessionDelivery({stage:"telegram-update-returned-false",bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,progressMessageId:a?.messageId||t?.messageId,progressLastText:lv(a?.lastText||t?.lastText),progressHasPending:Boolean(a?.pending||t?.pending)}),!1}return this.logInfo({bridgeId:e.bridgeId,chatId:e.chatSessionId,key:n,messageId:a?.messageId||this.telegramProgress.entries.get(n)?.messageId,textPreview:lv(t)},a?"telegram ai session progress edited":"telegram ai session progress sent"),!0}async aiSessionInstanceNames(){return this.aiSessionInstanceNamesCache.get()}async aiSessionPendingApprovalRoutes(e){const t=await this.aiSessionPendingRoutesCache.get();return new Map(t.filter(t=>t.instanceId===e&&t.aiSessionId&&"approval"===t.kind).map(e=>[e.aiSessionId||"",e]))}}function ev(e){return"object"==typeof e&&e&&"reply"in e?String(e.reply||""):""}function tv(e){return"object"==typeof e&&null!==e&&!0===e.accepted}function nv(e){const t="object"==typeof e&&e&&"replyMarkup"in e?e.replyMarkup:void 0;if(t&&"object"==typeof t&&!Array.isArray(t))return t}function iv(e){const t=Array.isArray(e?.actionRows)?e.actionRows:void 0;return $f(t||(Array.isArray(e?.actions)?e.actions:[]).map(e=>[e]))}function sv(e){const t=Number(e?.message_id);return Number.isInteger(t)?t:void 0}function av(e,t,n){return[e,t,String(n)].join(":")}function ov(e,t,n){const i=`:${t}:${n}`;if(!e.endsWith(i))return;const s=e.slice(0,-i.length).split(":"),a=s[0]||"",o=s[1]||"",r=s.slice(2).join(":")||void 0;return a&&o?{instanceId:a,sessionId:o,turnId:r}:void 0}function rv(e){return"string"==typeof e?e:""}function cv(e){return e instanceof Error?e.message:String(e)}function dv(e,t){return Boolean(e&&"object"==typeof e&&"code"in e&&e.code===t)}function lv(e,t=160){const n=String(e||"").replace(/\s+/g," ").trim();return n.length<=t?n:`${n.slice(0,Math.max(0,t-3))}...`}function pv(e){const t=hv(e.body.cardActionData||e.body.content),n=hv(t.cardPrivateData||e.body.cardPrivateData||e.body.content);return{outTrackId:rv(e.body.outTrackId),spaceId:rv(e.body.spaceId),conversationType:e.conversationType,hasCallbackData:Boolean(e.callbackData),callbackDataPreview:lv(e.callbackData,120),actionIds:[...gv(n.actionIdList),...gv(t.actionIdList),rv(n.actionId),rv(t.actionId),rv(e.body.actionId)].filter(Boolean).slice(0,5),cardActionDataKeys:Object.keys(t).sort(),privateDataKeys:Object.keys(n).sort(),paramKeys:Object.keys(e.params).sort(),hasSessionWebhook:Boolean(e.sessionWebhook)}}function uv(e){if(e)return{id:e.id,providerTurnId:e.providerTurnId,source:e.source,status:e.status,phase:e.phase,revision:e.revision,userPrompt:lv(e.userPrompt,80),hasResponse:Boolean(e.lastMessage?.trim()||e.summary?.trim()),responsePreview:lv(e.lastMessage||e.summary,80),updatedAt:e.updatedAt,observedAt:e.observedAt}}function mv(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function hv(e){if(e&&"object"==typeof e&&!Array.isArray(e))return e;if("string"==typeof e&&e.trim())try{return mv(JSON.parse(e))}catch{return{}}return{}}function gv(e){return Array.isArray(e)?e.map(e=>rv(e)).filter(Boolean):[]}function fv(e){const t=e.aiSession&&"sessionId"in e.aiSession?e.aiSession:void 0,n=e.aiSession&&"id"in e.aiSession?e.aiSession:void 0;return{instanceId:e.instanceId||e.instance?.id||"",sessionId:e.aiSessionId||t?.sessionId||n?.id||e.binding?.activeAiSessionId||"",turnId:e.turnId||e.providerTurnId||t?.turnId||t?.providerTurnId||(n?Sv(n):""),sources:{resultTurnId:e.turnId,resultProviderTurnId:e.providerTurnId,actionTurnId:t?.turnId,actionProviderTurnId:t?.providerTurnId,sessionActiveTurnId:n?.activeTurnId,latestTurnId:n?kv(n)?.id:void 0}}}const yv=5,bv=48;function vv(e){const{cancelCallbackData:t,queueSteerCallbackData:n,queueDeleteMenuCallbackData:i,permissionCallbackData:s,pendingApproval:a,session:o}=e,r="approval"===a?.kind?[[{text:"Allow",callbackData:s(a.id,"allow")},{text:"Skip",callbackData:s(a.id,"skip")},{text:"Deny",callbackData:s(a.id,"deny")}]]:[];if("running"!==o.status)return r;const c=(o.queue?.items||[]).filter(e=>"queued"===e.status).slice(0,yv);return[...c.map((e,t)=>[{text:xv(e.message,t),callbackData:n(e.id)}]),c.length?[{text:"Delete Queue",callbackData:i()},{text:"Cancel",callbackData:t}]:[{text:"Cancel",callbackData:t}]]}function Iv(e,t){if("approval"===t.phase)return{id:`${e}:ai:${t.id}`,kind:"approval"}}function xv(e,t){const n=`${t+1}. `,i=e.replace(/\s+/g," ").trim()||"Queued message",s=Math.max(8,bv-n.length),a=Array.from(i);return`${n}${a.length>s?`${a.slice(0,Math.max(1,s-3)).join("")}...`:i}`}function wv(e,t,...n){return[e,t,...n].join(":")}function Sv(e){const t=kv(e);return t?.id?t.id:rv(e.activeTurnId)}function Av(e,t=""){const n=kv(e);return[t,n?.id||"",n?.status||e.status||"",n?.phase||e.phase||"",n?.lastMessage||"",n?.summary||"",n?.userPrompt||"",e.error||"",e.currentTool?.id||"",e.currentTool?.name||"",e.currentTool?.inputPreview||"",String(e.toolCallsSinceLastMessage??0),Ev(e)].join("\0")}function Ev(e){return(e.queue?.items||[]).map(e=>[e.id,e.status,e.message].join(":")).join("|")}function _v(e,t){const n=function(e,t){let n="";t?"waiting"===t.status&&"approval"===t.phase&&t.summary?.trim()?n=t.summary.trim():t.lastMessage?.trim()?n=t.lastMessage.trim():t.summary?.trim()&&(n=t.summary.trim()):"waiting"===e.status&&"approval"===e.phase&&e.summary?.trim()?n=e.summary.trim():e.lastMessage?.trim()?n=e.lastMessage.trim():e.summary?.trim()&&(n=e.summary.trim()),!n&&e.error?.trim()&&(n="failed"===e.status?`${e.agent} session failed:\n${e.error.trim()}`:e.error.trim());const i=function(e){if(e.currentTool?.name)return`Thinking... · ${e.currentTool.name}${e.currentTool.inputPreview?` · ${e.currentTool.inputPreview}`:""}`;const t=e.toolCallsSinceLastMessage??0;return t>0?`Thinking... · ${t} ${1===t?"tool":"tools"} completed`:""}(e);return[n,i&&!zv(n,e)?i:""].filter(Boolean).join("\n\n")}(e,kv(e));return n?`${t}\n${n}`:""}function Tv(e,t){const n=["idle"===t.status?"completed":t.status,t.phase&&"unknown"!==t.phase?t.phase:void 0].filter(Boolean).join("/");return`${e} · ${t.agent||"ai"} ${n||"unknown"}`}function zv(e,t){if("waiting"!==t.status||"approval"!==t.phase)return!1;const n=t.currentTool?.inputPreview?.trim();return Boolean(n&&e.includes(n))}function kv(e){return(e.turns||[]).filter(e=>e.id||e.userPrompt?.trim()||e.lastMessage?.trim()||e.summary?.trim()).at(-1)}class Nv{clients=new Set;listeners=new Set;transientDemandListeners=new Set;externalTransientDemands=new Map;seq=0;droppedUnscopedNodeEvents=0;lastUnscopedNodeEvent;connect(e,t={}){e.topics=new Set(["*"]),e.instanceIds=t.instanceIds?.length?new Set(t.instanceIds):void 0,e.metricInstanceIds=t.expectsMetricSubscription?new Set:void 0,e.authorization=t.authorization,e.subscriptionReceived=!t.authorization&&!0!==t.expectsTransientSubscription,this.clients.add(e),this.publishTransientDemand();const n=e.ping?setInterval(()=>{if(e.readyState===e.OPEN)try{e.ping?.()}catch{}},2e4):void 0;n?.unref?.(),e.on("close",()=>{n&&clearInterval(n),this.clients.delete(e),this.publishTransientDemand()}),e.on("message",t=>{const n=function(e){try{const t=JSON.parse(String(e||"{}"));if(!t||"object"!=typeof t)return;const n=Zd.safeParse(t);if(n.success)return n.data;const i=t;if(void 0!==i.metricInstanceIds&&!Array.isArray(i.metricInstanceIds))return;const s=void 0===i.aiSessionTransient?void 0:tl.safeParse(i.aiSessionTransient);if(s&&!s.success)return;return{type:i.type,topics:Array.isArray(i.topics)?i.topics.map(String).filter(Boolean):void 0,instanceIds:Array.isArray(i.instanceIds)?i.instanceIds.map(String).map(e=>e.trim()).filter(Boolean):void 0,metricInstanceIds:Array.isArray(i.metricInstanceIds)?i.metricInstanceIds.map(String).map(e=>e.trim()).filter(Boolean):void 0,...s?.success?{aiSessionTransient:s.data}:{},...i.eventEnvelopeVersion===Yd?{eventEnvelopeVersion:Yd}:{}}}catch{return}}(t);"ping"!==n?.type?"subscribe"===n?.type&&(e.topics=new Set(void 0===n.topics?["*"]:n.topics),e.instanceIds=function(e,t){const n=e.authorization?.allowedInstanceIds;if(!n)return t?.length?new Set(t):void 0;const i=t?.length?t.filter(e=>n.has(e)):[...n];return new Set(i)}(e,n.instanceIds),e.metricInstanceIds=function(e,t){if(void 0===t)return;const n=e.authorization?.allowedInstanceIds;return new Set(n?t.filter(e=>n.has(e)):t)}(e,n.metricInstanceIds),e.aiSessionTransient=function(e,t){const n=e.authorization?.allowedInstanceIds;return n?t?{...t,messageDeltas:{allInstances:!1,instanceIds:t.messageDeltas.allInstances?[...n]:t.messageDeltas.instanceIds.filter(e=>n.has(e))},timelineAllSessions:!1,timelineSessions:t.timelineSessions.filter(e=>n.has(e.instanceId))}:{messageDeltas:{allInstances:!1,instanceIds:[...n]},timelineAllSessions:!1,timelineSessions:[]}:t}(e,n.aiSessionTransient),e.eventEnvelopeVersion=n.eventEnvelopeVersion??1,e.subscriptionReceived=!0,this.publishTransientDemand()):e.send(JSON.stringify({v:1,type:"pong",sentAt:n.sentAt,receivedAt:(new Date).toISOString()}))})}publish(e,t,n={}){const i=this.createEvent(e,t,n);!Lv.has(i.topic)||i.scope?.nodeId||i.scope?.instanceId||(this.droppedUnscopedNodeEvents+=1,this.lastUnscopedNodeEvent={type:i.type,topic:i.topic,createdAt:i.createdAt});const s=i.topic,a=JSON.stringify(i),o=Buffer.byteLength(a,"utf8");let r;for(const e of this.listeners)try{e(i)}catch{this.listeners.delete(e)}for(const t of this.clients)if(t.readyState===t.OPEN&&Mv(t,i)&&Rv(t.topics,s,e)&&jv(t.instanceIds,i.scope)&&Pv(t,i)&&Dv(t,i)){const e=t.eventEnvelopeVersion===Yd?r??=$v(i):{encoded:a,bytes:o};if((t.bufferedAmount??0)+e.bytes>16777216){this.clients.delete(t);try{t.close?.(1013,"Event consumer is too slow.")}catch{}this.publishTransientDemand();continue}try{t.send(e.encoded)}catch{this.clients.delete(t),this.publishTransientDemand()}}return i}authorizationDiagnostics(){return{droppedUnscopedNodeEvents:this.droppedUnscopedNodeEvents,...this.lastUnscopedNodeEvent?{lastUnscopedNodeEvent:this.lastUnscopedNodeEvent}:{}}}invalidateUserAuthorization(e,t){for(const n of this.clients){const i=n.authorization;if(i&&i.userId===e&&i.authorizationRevision!==t){this.clients.delete(n);try{n.close?.(4001,"Authorization changed. Reconnect for a current snapshot.")}catch{}}}this.publishTransientDemand()}on(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}onAiSessionTransientDemand(e){return this.transientDemandListeners.add(e),e(this.aiSessionTransientDemand()),()=>this.transientDemandListeners.delete(e)}registerAiSessionTransientDemand(e){const t=Symbol("ai-session-transient-demand");return this.externalTransientDemands.set(t,e),this.publishTransientDemand(),()=>{this.externalTransientDemands.delete(t),this.publishTransientDemand()}}registerLegacyAiSessionTransientDemand(e){const t=new Set(e);if(t.has("*")||t.has(In))return this.registerAiSessionTransientDemand();const n=t.has(An),i=t.has(En);return n||i?this.registerAiSessionTransientDemand({messageDeltas:{allInstances:n,instanceIds:[]},timelineAllSessions:i,timelineSessions:[]}):()=>{}}aiSessionTransientDemand(){let e=!1,t=!1,n=!1;const i=new Set,s=new Map;let a;for(const o of this.clients)if(o.subscriptionReceived&&Ov(o.topics))if(o.aiSessionTransient){t||=o.aiSessionTransient.messageDeltas.allInstances,n||=o.aiSessionTransient.timelineAllSessions,a=Cv(a,o.aiSessionTransient.replaySince);for(const e of o.aiSessionTransient.messageDeltas.instanceIds)i.add(e);for(const e of o.aiSessionTransient.timelineSessions)s.set(JSON.stringify([e.instanceId,e.sessionId]),e)}else e=!0;for(const o of this.externalTransientDemands.values())if(o){t||=o.messageDeltas.allInstances,n||=o.timelineAllSessions,a=Cv(a,o.replaySince);for(const e of o.messageDeltas.instanceIds)i.add(e);for(const e of o.timelineSessions)s.set(JSON.stringify([e.instanceId,e.sessionId]),e)}else e=!0;return{legacyAll:e,...a?{replaySince:a}:{},messageDeltas:{allInstances:e||t,instanceIds:[...i]},timelineAllSessions:e||n,timelineSessions:[...s.values()]}}send(e,t,n,i={}){const s=this.createEvent(t,n,i);return e.send(JSON.stringify(s)),s}createEvent(e,t,n={}){return{v:1,id:n.sourceEvent?.id||`evt_${Date.now().toString(36)}_${Math.random().toString(16).slice(2)}`,seq:++this.seq,type:e,topic:n.topic||el(e),createdAt:n.sourceEvent?.createdAt||(new Date).toISOString(),payload:t,...n.sourceEvent?.replay?{replay:!0}:{},scope:qv(n.scope,t)}}publishTransientDemand(){const e=this.aiSessionTransientDemand();for(const t of this.transientDemandListeners)try{t(e)}catch{}}}function Cv(e,t){return t&&(!e||t<e)?t:e}function Rv(e,t,n){return!e||e.has("*")||e.has(t)||e.has(n)}function Ov(e){return Rv(e,In,An)||Rv(e,In,En)}function jv(e,t){return!e||!t?.instanceId||e.has(t.instanceId)}function Pv(e,t){return"instance.metrics.snapshot"!==t.type||!e.metricInstanceIds||Boolean(t.scope?.instanceId&&e.metricInstanceIds.has(t.scope.instanceId))}function Dv(e,t){return"ai-session.message-delta"!==t.type&&"ai-session.timeline-item"!==t.type||!!e.subscriptionReceived&&nl(e.aiSessionTransient,t)}const Lv=new Set(["nodes","node.state","node.runtime","instances","app.sessions","ai.sessions","apps"]);function Mv(e,t){const n=e.authorization;return!n||("triggers"!==t.topic||t.scope?.nodeId||t.scope?.instanceId?t.scope?.nodeId?!n.allowedNodeIds||n.allowedNodeIds.has(t.scope.nodeId):t.scope?.instanceId?!n.allowedInstanceIds||n.allowedInstanceIds.has(t.scope.instanceId):!n.allowedNodeIds&&!n.allowedInstanceIds||!Lv.has(t.topic):n.permissionIds.includes("triggers:manage"))}function qv(e,t){if(e?.nodeId||e?.instanceId)return e;if(!t||"object"!=typeof t||Array.isArray(t))return e;const n=t,i=n.meta&&"object"==typeof n.meta&&!Array.isArray(n.meta)?n.meta:{},s=n.nodeId??i.nodeId,a=n.instanceId??i.instanceId,o="string"==typeof s&&s.trim()?s.trim():void 0,r="string"==typeof a&&a.trim()?a.trim():void 0;return o||r?{...o?{nodeId:o}:{},...r?{instanceId:r}:{}}:e}function Uv(e){const t=e.type===An?zs.safeParse(e.payload):void 0;return function(e,t,n={}){const i=e.scope?n.publicScope&&e.scope.instanceId?{instanceId:e.scope.instanceId}:e.scope:void 0;return{v:Yd,id:e.id,type:e.type,createdAt:e.createdAt,payload:void 0===n.payload?e.payload:n.payload,...e.topic!==el(e.type)?{topic:e.topic}:{},...e.replay?{replay:!0}:{},...i&&Object.keys(i).length?{scope:i}:{}}}(e,0,{publicScope:!0,...t?.success?{payload:(n=t.data,ks.parse({sessionId:n.sessionId,turnId:n.turnId,itemId:n.itemId,delta:n.delta,generatedAt:n.generatedAt}))}:{}});var n}function $v(e){const t=Uv(e),n=JSON.stringify(t);return{encoded:n,bytes:Buffer.byteLength(n,"utf8")}}function Bv(e,n="attachment",i={}){const s=i.maxLength??240,a=i.maxBytes??240,o=t.posix.basename(String(e).replace(/\\/g,"/")).replace(/[\u0000-\u001f\u007f<>:"/\\|?*]/g,"_").trim().replace(/[. ]+$/g,""),r=Fv(/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(o)?`_${o}`:o,s,a).replace(/[. ]+$/g,"");return r&&"."!==r&&".."!==r?r:Fv(n,s,a)||"attachment"}function Fv(e,t,n){if(!Number.isInteger(t)||t<=0||!Number.isInteger(n)||n<=0)return"";let i="",s=0,a=0;for(const o of e){const e=s+o.length,r=a+Buffer.byteLength(o);if(e>t||r>n)break;i+=o,s=e,a=r}return i}const Hv={"image/bmp":".bmp","image/gif":".gif","image/jpeg":".jpg","image/png":".png","image/webp":".webp"},Gv=f.z.object({instanceId:f.z.string().trim().min(1).max(120),sessionId:f.z.string().trim().min(1).max(120),kind:f.z.enum(["image","file"]),name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120),data:f.z.string().min(1).max(31457280)}).strict();function Wv(){return t.join(m.tmpdir(),"task-handoff-ai-session-attachments")}class Vv{items=new Map;ttlMs;constructor(e=864e5){this.ttlMs=e,this.pruneOrphanFiles()}upload(e){this.pruneExpired();const s=Gv.parse(e),a=function(e,t){const n=/^data:([^;,]+);base64,(.+)$/i.exec(e.trim()),i=n?.[1]||t,s=n?.[2]||e;return{mime:i,buffer:Buffer.from(s,"base64")}}(s.data,s.mime),o=a.mime.toLowerCase(),r=Hv[o]||"";if("image"===s.kind&&!r)throw new Error(`Unsupported image type: ${o}`);const c="image"===s.kind?a.buffer.length>hn:a.buffer.length>=gn;if(!a.buffer.length||c)throw new Error("image"===s.kind?"Image must be between 1 byte and 20971520 bytes.":"File must be smaller than 512000 bytes.");const d=`att_${i.randomUUID().replace(/-/g,"").slice(0,24)}`,l=new Date,p=new Date(l.getTime()+this.ttlMs),u=Wv();n.mkdirSync(u,{recursive:!0});const m=Bv(s.name),h=`${d}-`,g=Bv(m.endsWith(r)?m:`${m}${r}`,"attachment",{maxBytes:255-Buffer.byteLength(h)}),f=t.join(u,`${h}${g}`);n.writeFileSync(f,a.buffer);const y={id:d,instanceId:s.instanceId,sessionId:s.sessionId,kind:s.kind,name:m,mime:o,size:a.buffer.length,source:{type:"inline",encoding:"base64",data:a.buffer.toString("base64")},path:f,createdAt:l.toISOString(),expiresAt:p.toISOString()};return this.items.set(d,y),this.publicAttachment(y)}resolveRefs(e,t,n){this.pruneExpired();const i=f.z.array(ri).max(6).default([]).parse(e),s=i.map(e=>"runtime-path"===e.source.type?ai.parse(e):this.requireAttachment(e,t,n));if(s.reduce((e,t)=>e+("inline"===t.source.type?t.size:0),0)>bn)throw new Error("Inline attachments must be 41943040 bytes or less in total.");for(const e of i)"upload-ref"===e.source.type&&this.consumeAttachment(e.id);return s}dispose(){for(const e of[...this.items.keys()])this.consumeAttachment(e)}requireAttachment(e,t,n){const i=this.items.get(e.id);if(!i)throw new Error(`AI session attachment not found or expired: ${e.id}`);if(e.kind&&e.kind!==i.kind)throw new Error(`AI session attachment kind mismatch: ${e.id}`);if(i.instanceId!==t||i.sessionId!==n)throw new Error(`AI session attachment scope mismatch: ${e.id}`);return ai.parse({id:i.id,kind:i.kind,name:i.name,mime:i.mime,size:i.size,source:i.source})}consumeAttachment(e){const t=this.items.get(e);if(t){this.items.delete(e);try{n.unlinkSync(t.path)}catch{}}}publicAttachment(e){return{id:e.id,kind:e.kind,name:e.name,mime:e.mime,size:e.size,expiresAt:e.expiresAt}}pruneExpired(){const e=Date.now();for(const[t,i]of this.items)if(!(Date.parse(i.expiresAt)>e)){this.items.delete(t);try{n.unlinkSync(i.path)}catch{}}this.pruneOrphanFiles()}pruneOrphanFiles(){const e=Wv();let i;try{i=n.readdirSync(e)}catch{return}const s=Date.now()-Math.max(this.ttlMs,864e5);for(const a of i){const i=t.join(e,a);try{n.statSync(i).isFile()&&n.statSync(i).mtimeMs<=s&&n.unlinkSync(i)}catch{}}}}const Kv=864e5,Yv=f.z.object({schemaVersion:f.z.literal(1),cacheId:f.z.string().regex(/^[a-f0-9]{64}$/),instanceId:f.z.string().trim().min(1).max(120),scopeType:f.z.enum(["session","create-request"]),scopeId:f.z.string().trim().min(1).max(160),attachmentId:f.z.string().trim().min(1).max(120),sessionId:f.z.string().trim().min(1).max(120).optional(),messageId:f.z.string().trim().min(1).max(240).optional(),kind:f.z.enum(["image","file"]),name:f.z.string().trim().min(1).max(240),mime:f.z.string().trim().min(1).max(120),disposition:f.z.string().trim().min(1).max(1024).optional(),size:f.z.number().int().positive(),etag:f.z.string().trim().min(1).max(160).optional(),instanceEpoch:f.z.string().trim().min(1).max(240).optional(),cachedAt:f.z.string().datetime(),lastAccessedAt:f.z.string().datetime(),expiresAt:f.z.string().datetime()}).strict();class Xv{root;contentDir;manifestDir;maxBytes;now;onWarning;entries=new Map;pendingBindings=new Map;reservedBytes=0;constructor(e,i={}){this.root=t.join(e,"ai-session-attachment-cache"),this.contentDir=t.join(this.root,"content"),this.manifestDir=t.join(this.root,"manifests"),this.maxBytes=i.maxBytes??2147483648,this.now=i.now||Date.now,this.onWarning=i.onWarning,n.mkdirSync(this.contentDir,{recursive:!0,mode:448}),n.mkdirSync(this.manifestDir,{recursive:!0,mode:448}),this.restore(),this.gc()}putFile(e){this.gc();const t=n.statSync(e.sourcePath);if(!t.isFile()||t.size!==e.size||e.size<=0)throw new Error("Attachment cache source size mismatch.");if(this.evictFor(e.size),this.usedBytes()+this.reservedBytes+e.size>this.maxBytes)return;const s=Jv(e.instanceId,e.attachmentId),a=this.contentPath(s),o=`${a}.${process.pid}.${i.randomUUID()}.tmp`;n.copyFileSync(e.sourcePath,o,n.constants.COPYFILE_EXCL),n.chmodSync(o,384),n.renameSync(o,a);const r=new Date(this.now()).toISOString(),c=new Date(Math.min(this.now()+Kv,e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),d=Yv.parse({schemaVersion:1,cacheId:s,instanceId:e.instanceId,scopeType:e.scopeType,scopeId:e.scopeId,attachmentId:e.attachmentId,...e.sessionId?{sessionId:e.sessionId}:{},...e.messageId?{messageId:e.messageId}:{},kind:e.kind,name:Bv(e.name),mime:e.mime.toLowerCase(),...e.disposition?{disposition:e.disposition}:{},size:e.size,...e.etag?{etag:e.etag}:{},...e.instanceEpoch?{instanceEpoch:e.instanceEpoch}:{},cachedAt:r,lastAccessedAt:r,expiresAt:c});return this.save(d),this.project(d)}beginBestEffortWrite(e){if(this.gc(),this.evictFor(e.size),e.size<=0||this.usedBytes()+this.reservedBytes+e.size>this.maxBytes)return;this.reservedBytes+=e.size;const t=Jv(e.instanceId,e.attachmentId),s=this.contentPath(t),a=`${s}.${process.pid}.${i.randomUUID()}.tmp`,o=n.createWriteStream(a,{flags:"wx",mode:384,highWaterMark:1048576});let r=0,c=!1,d=!0;const l=()=>{d&&(d=!1,this.reservedBytes=Math.max(0,this.reservedBytes-e.size))},p=()=>{if(!c){c=!0,l(),o.destroy();try{n.unlinkSync(a)}catch{}}};return o.on("error",p),{offer:t=>!c&&(r+=t.byteLength,!(r>e.size||!o.write(t))||(p(),!1)),finish:async()=>{if(c||r!==e.size)p();else if(await new Promise((e,t)=>{o.once("finish",e),o.once("error",t),o.end()}).catch(()=>{}),!c){l();try{n.renameSync(a,s);const i=new Date(this.now()).toISOString(),o=new Date(Math.min(this.now()+Kv,e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),r=Yv.parse({schemaVersion:1,cacheId:t,instanceId:e.instanceId,scopeType:e.scopeType,scopeId:e.scopeId,attachmentId:e.attachmentId,...e.sessionId?{sessionId:e.sessionId}:{},...e.messageId?{messageId:e.messageId}:{},kind:e.kind,name:Bv(e.name),mime:e.mime.toLowerCase(),...e.disposition?{disposition:e.disposition}:{},size:e.size,...e.etag?{etag:e.etag}:{},...e.instanceEpoch?{instanceEpoch:e.instanceEpoch}:{},cachedAt:i,lastAccessedAt:i,expiresAt:o});return this.save(r),this.project(r)}catch{return void p()}}},abort:p}}bind(e){const t=Jv(e.instanceId,e.attachmentId),n=this.entries.get(t);if(!n)return this.pendingBindings.set(t,e),!1;if(n.scopeId!==e.scopeId)return!1;const i=new Date(Math.min(Date.parse(n.expiresAt),e.cacheUntil??Number.POSITIVE_INFINITY)).toISOString();return this.save(Yv.parse({...n,sessionId:e.sessionId,messageId:e.messageId,expiresAt:i,...e.etag?{etag:e.etag}:{}})),!0}get(e){this.gc();const t=Jv(e.instanceId,e.attachmentId),n=this.entries.get(t);if(!n||n.sessionId!==e.sessionId||n.messageId!==e.messageId||n.instanceEpoch&&n.instanceEpoch!==e.instanceEpoch)return;const i=Yv.parse({...n,lastAccessedAt:new Date(this.now()).toISOString()});return this.entries.set(t,i),this.project(i)}removeInstance(e){for(const t of[...this.entries.values()])t.instanceId===e&&this.remove(t.cacheId);for(const[t,n]of this.pendingBindings)n.instanceId===e&&this.pendingBindings.delete(t)}gc(){const e=this.now();for(const t of[...this.entries.values()])(Date.parse(t.expiresAt)<=e||!this.validContent(t))&&this.remove(t.cacheId);this.cleanupOrphans()}restore(){let e=[];try{e=n.readdirSync(this.manifestDir)}catch{return}for(const i of e)if(i.endsWith(".json"))try{const e=JSON.parse(n.readFileSync(t.join(this.manifestDir,i),"utf8")),s=Qv(e),a=Yv.safeParse(s);if(!a.success)throw new Error("invalid manifest");Object.keys(e).some(e=>!(e in Yv.shape))&&this.writeManifest(a.data),this.entries.set(a.data.cacheId,a.data)}catch{this.onWarning?.(`invalid AI session attachment cache manifest ignored: ${i}`)}}evictFor(e){const t=[...this.entries.values()].sort((e,t)=>Date.parse(e.lastAccessedAt)-Date.parse(t.lastAccessedAt));let n=this.usedBytes();for(const i of t){if(n+this.reservedBytes+e<=this.maxBytes)break;n-=i.size,this.remove(i.cacheId)}}save(e){const t=this.pendingBindings.get(e.cacheId),n=t&&t.scopeId===e.scopeId?Yv.parse({...e,sessionId:t.sessionId,messageId:t.messageId,expiresAt:new Date(Math.min(Date.parse(e.expiresAt),t.cacheUntil??Number.POSITIVE_INFINITY)).toISOString(),...t.etag?{etag:t.etag}:{}}):e;this.pendingBindings.delete(e.cacheId),this.writeManifest(n),this.entries.set(n.cacheId,n)}writeManifest(e){y.sync(this.manifestPath(e.cacheId),`${JSON.stringify(e,null,2)}\n`,{mode:384})}remove(e){this.entries.delete(e);try{n.unlinkSync(this.manifestPath(e))}catch{}try{n.unlinkSync(this.contentPath(e))}catch{}}cleanupOrphans(){const e=new Set(this.entries.keys());let i=[];try{i=n.readdirSync(this.contentDir)}catch{return}for(const s of i)if(!e.has(s))try{n.unlinkSync(t.join(this.contentDir,s))}catch{}}validContent(e){try{const t=n.statSync(this.contentPath(e.cacheId));return t.isFile()&&t.size===e.size}catch{return!1}}usedBytes(){return[...this.entries.values()].reduce((e,t)=>this.validContent(t)?e+t.size:e,0)}project(e){return{...e,path:this.contentPath(e.cacheId)}}contentPath(e){return t.join(this.contentDir,e)}manifestPath(e){return t.join(this.manifestDir,`${e}.json`)}}function Jv(e,t){return i.createHash("sha256").update(`${e}\0${t}`).digest("hex")}function Qv(e){if(!e||"object"!=typeof e||Array.isArray(e))return e;const t=e;return Object.fromEntries(Object.keys(Yv.shape).filter(e=>Object.prototype.hasOwnProperty.call(t,e)).map(e=>[e,t[e]]))}const Zv={controlPlaneAuthBoundary:"public"},eI={controlPlaneAuthBoundary:"public-ui"},tI={controlPlaneAuthBoundary:"proxy-binding"},nI={controlPlaneAuthBoundary:"node-tunnel"};function iI(e,t=Math.random){const n=Math.max(1,Math.floor(e));if(1===n)return 0;if(2===n)return 250;const i=Math.min(6e4,250*2**(n-2));return Math.min(6e4,Math.round(i*(.75+.5*t())))}class sI{retryNumber=0;random;constructor(e=Math.random){this.random=e}get attempts(){return this.retryNumber}next(){return this.retryNumber+=1,{attempt:this.retryNumber,delay:iI(this.retryNumber,this.random)}}reset(){this.retryNumber=0}}class aI{backoff;timer;constructor(e=Math.random){this.backoff=new sI(e)}get pending(){return Boolean(this.timer)}get attempts(){return this.backoff.attempts}schedule(e,t={}){if(this.timer)return;const n=this.backoff.next(),i=t.setTimeoutFn||setTimeout;return this.timer=i(()=>{this.timer=void 0,e()},n.delay),n}reset(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0,this.backoff.reset()}cancel(e=clearTimeout){this.timer&&e(this.timer),this.timer=void 0}}class oI extends aI{}function rI(e,t){return Number.isFinite(e)&&Number(e)>0?Number(e):t}function cI(e){if(!e.length)return;const t=[...e].sort((e,t)=>e-t);return t[Math.ceil(.95*t.length)-1]}function dI(e){return e.unref?.(),e}class lI{connectTimeoutMs;handshakeTimeoutMs;heartbeatIntervalMs;heartbeatTimeoutMs;heartbeatMissThreshold;stableThresholdMs;now;setTimeoutFn;clearTimeoutFn;ping;onTimeout;onStable;onPhase;connectTimer;handshakeTimer;heartbeatTimer;stableTimer;awaitingPongSince;consecutiveHeartbeatMisses=0;stable=!1;stopped=!1;currentPhase="connecting";lastActivityAt;lastPongAt;pingRttMs;recentPingRttMs=[];constructor(e){this.connectTimeoutMs=rI(e.connectTimeoutMs,1e4),this.handshakeTimeoutMs=rI(e.handshakeTimeoutMs,1e4),this.heartbeatIntervalMs=rI(e.heartbeatIntervalMs,25e3),this.heartbeatTimeoutMs=rI(e.heartbeatTimeoutMs,15e3),this.heartbeatMissThreshold=Math.max(1,Math.floor(rI(e.heartbeatMissThreshold,2))),this.stableThresholdMs=rI(e.stableThresholdMs,6e4),this.now=e.now||Date.now,this.setTimeoutFn=e.setTimeoutFn||setTimeout,this.clearTimeoutFn=e.clearTimeoutFn||clearTimeout,this.ping=e.ping,this.onTimeout=e.onTimeout,this.onStable=e.onStable,this.onPhase=e.onPhase}get phase(){return this.currentPhase}start(){this.stopped=!1,this.setPhase("connecting"),this.clearTimer("connectTimer"),this.connectTimer=dI(this.setTimeoutFn(()=>this.timeout("connect"),this.connectTimeoutMs))}opened(){this.stopped||(this.clearTimer("connectTimer"),this.setPhase("handshaking"),this.handshakeTimer=dI(this.setTimeoutFn(()=>this.timeout("handshake"),this.handshakeTimeoutMs)),this.scheduleHeartbeat(this.heartbeatIntervalMs))}healthy(){this.stopped||(this.clearTimer("handshakeTimer"),this.activity(),this.setPhase("healthy"),this.stable||this.stableTimer||(this.stableTimer=dI(this.setTimeoutFn(()=>{this.stableTimer=void 0,this.stopped||"healthy"!==this.currentPhase||(this.stable=!0,this.onStable?.())},this.stableThresholdMs))))}activity(){this.stopped||(this.lastActivityAt=this.now(),this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses=0,"handshaking"!==this.currentPhase&&"healthy"!==this.currentPhase||this.scheduleHeartbeat(this.heartbeatIntervalMs))}pong(){if(this.stopped)return;const e=this.now();void 0!==this.awaitingPongSince&&(this.pingRttMs=Math.max(0,e-this.awaitingPongSince),this.recentPingRttMs.push(this.pingRttMs),this.recentPingRttMs.length>20&&this.recentPingRttMs.shift()),this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses=0,this.lastPongAt=e,this.lastActivityAt=e,this.scheduleHeartbeat(this.heartbeatIntervalMs)}close(){this.stopped||(this.stopped=!0,this.clearTimers(),this.awaitingPongSince=void 0,this.setPhase("closed"))}diagnostics(){return{phase:this.currentPhase,stable:this.stable,...void 0===this.pingRttMs?{}:{pingRttMs:this.pingRttMs},...this.recentPingRttMs.length?{pingRttP95Ms:cI(this.recentPingRttMs)}:{},...void 0===this.lastActivityAt?{}:{lastActivityAt:new Date(this.lastActivityAt).toISOString()},...void 0===this.lastPongAt?{}:{lastPongAt:new Date(this.lastPongAt).toISOString()},...this.consecutiveHeartbeatMisses?{consecutiveHeartbeatMisses:this.consecutiveHeartbeatMisses}:{}}}scheduleHeartbeat(e){this.stopped||(this.clearTimer("heartbeatTimer"),this.heartbeatTimer=dI(this.setTimeoutFn(()=>{if(this.heartbeatTimer=void 0,!this.stopped){if(void 0!==this.awaitingPongSince){const e=Math.max(0,this.now()-this.awaitingPongSince);return e>=this.heartbeatTimeoutMs?(this.consecutiveHeartbeatMisses+=1,this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses>=this.heartbeatMissThreshold?void this.timeout("heartbeat"):void this.sendHeartbeatProbe()):void this.scheduleHeartbeat(this.heartbeatTimeoutMs-e)}this.sendHeartbeatProbe()}},e)))}sendHeartbeatProbe(){this.awaitingPongSince=this.now();try{this.ping()}catch{if(this.consecutiveHeartbeatMisses+=1,this.awaitingPongSince=void 0,this.consecutiveHeartbeatMisses>=this.heartbeatMissThreshold)return void this.timeout("heartbeat")}this.scheduleHeartbeat(this.heartbeatTimeoutMs)}timeout(e){this.stopped||(this.clearTimers(),this.setPhase("failed"),this.onTimeout(e))}setPhase(e){this.currentPhase!==e&&(this.currentPhase=e,this.onPhase?.(e))}clearTimers(){this.clearTimer("connectTimer"),this.clearTimer("handshakeTimer"),this.clearTimer("heartbeatTimer"),this.clearTimer("stableTimer")}clearTimer(e){const t=this[e];t&&this.clearTimeoutFn(t),this[e]=void 0}}class pI{transport;constructor(e){this.transport=e}attachMain(e,t){this.transport.attach(e,t),t.send(JSON.stringify({type:"control-plane.hello",protocolVersion:"2026-08-01",nodeId:e,serverTime:(new Date).toISOString(),capabilities:{reverseTunnel:"request-response",auxiliaryChannels:!0,httpResponseStreaming:!0,lifecycleCommands:!0,instanceApiProxy:!0}})),t.on("message",n=>this.handleMainMessage(e,t,n))}attachAuxiliary(e,t,n){return this.transport.attachAuxiliary(e,t,n)}handleMainMessage(e,t,n){if(!this.transport.isCurrentSocket(e,t))return;let i;try{i=JSON.parse(String(n))}catch{return void t.send(JSON.stringify({type:"control-plane.error",code:"INVALID_JSON"}))}const s=i&&"object"==typeof i?i:{},a=this.transport.handleSocketMessage(e,t,s);if(void 0!==a&&!a){if("node-agent.ping"!==s.type)return"node-agent.identify"===s.type?(t.send(JSON.stringify({type:"control-plane.identified",nodeId:e,serverTime:(new Date).toISOString()})),void this.transport.markHealthy(e,t)):void t.send(JSON.stringify({type:"control-plane.error",code:"UNSUPPORTED_MESSAGE"}));t.send(JSON.stringify({type:"control-plane.pong",nodeId:e,serverTime:(new Date).toISOString()}))}}}const uI={[xn]:Es,[wn]:_s,[Sn]:Ts,[An]:zs,[En]:Ns,[Ds]:Ks,[Ls]:Ys,[Ms]:Xs},mI=new Set(Object.keys(uI));class hI{options;validatedScopes=new Map;validatingScopes=new Map;eventQueues=new Map;scopeEpochs=new Map;constructor(e={}){this.options=e}setLogger(e){this.options.logger=e}handle(e,t){const n="string"==typeof t.type?t.type:"";if("node-agent.streams.hello"===n){const n="string"==typeof t.instanceId?t.instanceId:"",i=Pl(al,t.payload);return n&&i.success&&this.enqueue(e,n,()=>this.options.onStreamsHello?.(n,i.data)),!0}if(!n.startsWith("node-agent.event."))return!1;const i=gI(t.event),s="string"==typeof i?.type?i.type:"";if(!s)return!0;const a="payload"in i?i.payload:{},o=gI(i.scope)||{},r="string"==typeof t.instanceId?t.instanceId:void 0,c=function(...e){return e.find(e=>"string"==typeof e)}(o.instanceId,i.instanceId,r);if("instance.metrics.snapshot"===s){const t=Pl(id,a);return!t.success||t.data.instanceId!==c||(this.enqueue(e,t.data.instanceId,()=>{this.options.events?.publish(s,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})}),!0)}if(s===Od){const t=Pl(jd,a);return!t.success||t.data.instanceId!==c||(this.enqueue(e,t.data.instanceId,async()=>{this.options.onInstanceLifecycle&&!await this.options.onInstanceLifecycle(e,t.data)||this.options.events?.publish(s,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})},void 0,!this.options.onInstanceLifecycle),!0)}if(s===Fc||s===Hc){const t=Pl(s===Fc?Wc:Vc,a);return!t.success||t.data.instanceId!==c||(this.enqueue(e,t.data.instanceId,()=>{this.options.events?.publish(s,t.data,{topic:"instances",scope:{...o,nodeId:e,instanceId:t.data.instanceId}})}),!0)}if(mI.has(s)){const t=function(e,t,n){const i=uI[e];if(!i)return;let s=t;if(e===An&&n)try{s=function(e,t){const n=ks.safeParse(e);return n.success?zs.parse({instanceId:t,...n.data}):zs.parse(e)}(t,n)}catch{return}const a=Pl(i,s);if(!a.success)return;const o=a.data;return{instanceId:"meta"in o?o.meta.instanceId:o.instanceId,payload:o}}(s,a,c);if(!t)return this.options.logger?.warn?.({nodeId:e,eventType:s,reason:"invalid-payload"},"session-event.transport.rejected"),!0;const n=function(e,t,n,i){const s=gI(i)||{},a=gI(s.meta)||{};return{nodeId:e,instanceId:n,eventType:t,traceId:"string"==typeof a.traceId?a.traceId:void 0,streamId:"string"==typeof a.streamId?a.streamId:void 0,revision:"number"==typeof a.revision?a.revision:void 0}}(e,s,t.instanceId,t.payload),d=[o.instanceId,i.instanceId,r].filter(e=>"string"==typeof e&&Boolean(e));return d.some(e=>e!==t.instanceId)?(this.options.logger?.warn?.({...n,claimedInstanceIds:d,reason:"instance-claim-mismatch"},"session-event.transport.rejected"),!0):(this.enqueue(e,t.instanceId,()=>{const a={...o,nodeId:e,instanceId:t.instanceId},r={v:1,id:"string"==typeof i.id?i.id:`forwarded_${Date.now().toString(36)}`,seq:"number"==typeof i.seq?i.seq:0,type:s,topic:"string"==typeof i.topic?i.topic:s.startsWith("app-session.")?"app.sessions":"ai.sessions",createdAt:"string"==typeof i.createdAt?i.createdAt:(new Date).toISOString(),payload:t.payload,...!0===i.replay?{replay:!0}:{},scope:a};!this.options.onSessionEvent||this.options.onSessionEvent(r)?this.options.events?.publish(s,t.payload,{topic:r.topic,scope:a,sourceEvent:{id:r.id,createdAt:r.createdAt,replay:r.replay}}):this.options.logger?.warn?.({...n,reason:"aggregator-rejected"},"session-event.transport.rejected")},n),!0)}const d=()=>{this.options.events?.publish(s,a,{topic:"string"==typeof i.topic?i.topic:void 0,scope:{...o,nodeId:e,...c?{instanceId:c}:{}}})};return c?this.enqueue(e,c,d):d(),!0}invalidate(e={}){const t=new Set;for(const[n,i]of this.validatedScopes)e.nodeId&&i.nodeId!==e.nodeId||e.instanceId&&i.instanceId!==e.instanceId||t.add(n);for(const n of new Set([...this.validatingScopes.keys(),...this.eventQueues.keys()])){const[i,s]=yI(n);e.nodeId&&i!==e.nodeId||e.instanceId&&s!==e.instanceId||t.add(n)}for(const e of t)this.scopeEpochs.delete(e),this.validatedScopes.delete(e),this.validatingScopes.delete(e),this.eventQueues.delete(e)}diagnostics(){return{validatedScopes:this.validatedScopes.size,validatingScopes:this.validatingScopes.size,queuedScopes:this.eventQueues.size,scopeEpochs:this.scopeEpochs.size}}enqueue(e,t,n,i,s=!0){const a=fI(e,t),o=this.scopeEpoch(a),r=(this.eventQueues.get(a)||Promise.resolve()).catch(()=>{}).then(async()=>{this.scopeEpochs.get(a)===o&&(s&&!await this.isScopeValid(e,t,o)||this.scopeEpochs.get(a)!==o?i&&this.options.logger?.warn?.({...i,reason:"instance-scope-invalid"},"session-event.transport.rejected"):await n())});this.eventQueues.set(a,r);const c=()=>{this.eventQueues.get(a)===r&&this.eventQueues.delete(a),this.scopeEpochs.get(a)!==o||this.eventQueues.has(a)||this.validatingScopes.has(a)||this.scopeEpochs.delete(a)};r.then(c,c)}async isScopeValid(e,t,n){const i=fI(e,t);if((this.validatedScopes.get(i)?.expiresAt||0)>Date.now())return!0;const s=this.validatingScopes.get(i);if(s)return s;const a=Promise.resolve(this.options.validateInstanceScope?.(e,t)).then(Boolean).catch(()=>!1).then(s=>(s&&this.scopeEpochs.get(i)===n&&this.validatedScopes.set(i,{nodeId:e,instanceId:t,expiresAt:Date.now()+(this.options.scopeTtlMs??3e4)}),s));return this.validatingScopes.set(i,a),a.finally(()=>{this.validatingScopes.get(i)===a&&this.validatingScopes.delete(i)})}scopeEpoch(e){const t=this.scopeEpochs.get(e);if(t)return t;const n={};return this.scopeEpochs.set(e,n),n}}function gI(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:void 0}function fI(e,t){return JSON.stringify([e,t])}function yI(e){const t=JSON.parse(e);return Array.isArray(t)&&2===t.length?[String(t[0]),String(t[1])]:["",""]}const bI=f.z.object({nodeId:f.z.string().trim().min(1).max(120)}).strict();class vI{OPEN=1;readyState=this.OPEN;listeners=new Map;pingUpstream;sendToUpstream;on(e,t){const n=this.listeners.get(e)||new Set;n.add(t),this.listeners.set(e,n)}send(e){this.readyState===this.OPEN&&this.emit("message",e,!1)}sendUpstream(e){if(this.readyState===this.OPEN)try{this.sendToUpstream?.(e)}catch{this.close(1011,"Node event subscription delivery failed.")}}ping(){this.readyState===this.OPEN&&this.pingUpstream?.()}control(e,t,n){this.pingUpstream=e,this.sendToUpstream=n,t?.(()=>this.emit("pong"))}opened(){this.readyState===this.OPEN&&this.emit("open")}terminate(){this.close(1006)}close(e=1e3,t=""){this.readyState===this.OPEN&&(this.readyState=3,this.emit("close",e,Buffer.from(t)))}emit(e,...t){for(const n of this.listeners.get(e)||[])n(...t)}}function II(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:void 0}function xI(...e){return e.find(e=>"string"==typeof e&&Boolean(e))}function wI(){return`req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2,10)}`}const SI=new Map;function AI(e,t){if("paired-hmac"!==e.auth.mode||!e.auth.keyId||!e.auth.secret){const e=new Error("Reverse tunnel requires paired-HMAC node auth.");throw Object.assign(e,{statusCode:401,code:"NODE_AGENT_TUNNEL_REQUIRES_PAIRED_HMAC"}),e}const n=function(e){const t=new Map;for(const[n,i]of Object.entries(e)){const e=Array.isArray(i)?i.join(","):"string"==typeof i?i:void 0===i?"":String(i);t.set(n.toLowerCase(),e)}return{nodeId:t.get("x-taskhandoff-node-id")||"",keyId:t.get("x-taskhandoff-key-id")||"",timestamp:t.get("x-taskhandoff-timestamp")||"",nonce:t.get("x-taskhandoff-nonce")||"",bodySha256:t.get("x-taskhandoff-body-sha256")||"",signature:t.get("x-taskhandoff-signature")||""}}(t.headers);if(n.nodeId!==e.id)throw Object.assign(new Error("Invalid reverse tunnel node id."),{statusCode:401,code:"NODE_AGENT_TUNNEL_NODE_MISMATCH"});if(n.keyId!==e.auth.keyId)throw Object.assign(new Error("Invalid reverse tunnel key id."),{statusCode:401,code:"NODE_AGENT_TUNNEL_KEY_INVALID"});const s=Date.parse(n.timestamp);if(!Number.isFinite(s)||Math.abs(Date.now()-s)>Km)throw Object.assign(new Error("Reverse tunnel timestamp is outside the allowed window."),{statusCode:401,code:"NODE_AGENT_TUNNEL_TIMESTAMP_INVALID"});const a=Date.now()-Km;for(const[e,t]of SI)t<=a&&SI.delete(e);const o=`${e.id}:${n.keyId}:${n.nonce}`;if(!n.nonce||SI.has(o))throw Object.assign(new Error("Reverse tunnel nonce is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_NONCE_INVALID"});const r=Jm("");if(n.bodySha256!==r)throw Object.assign(new Error("Reverse tunnel body hash is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_BODY_HASH_INVALID"});const c=t.url||`${Ym}?nodeId=${encodeURIComponent(e.id)}`,d=Qm(e.auth.secret,{keyId:n.keyId,method:"GET",pathWithQuery:c,timestamp:n.timestamp,nonce:n.nonce,bodySha256:r});if(!function(e,t){const n=Buffer.from(e,"hex"),s=Buffer.from(t,"hex");return n.length===s.length&&i.timingSafeEqual(n,s)}(n.signature,d))throw Object.assign(new Error("Reverse tunnel signature is invalid."),{statusCode:401,code:"NODE_AGENT_TUNNEL_SIGNATURE_INVALID"});SI.set(o,Date.now()+Km)}function EI(e){return e?e instanceof Headers?Object.fromEntries(e.entries()):Array.isArray(e)?Object.fromEntries(e.map(([e,t])=>[e,t])):Object.fromEntries(Object.entries(e).map(([e,t])=>[e,String(t)])):{}}class _I{sockets=new Map;eventSubscriptions=new Map;eventRouter;httpStreamHeaderTimeoutMs;requestTimeoutMs;auxiliaryAttachTimeoutMs;connectionRuntime;connectionOptions;constructor(e,t={}){this.eventRouter=new hI({events:e,onStreamsHello:t.onStreamsHello,onSessionEvent:t.onSessionEvent,onInstanceLifecycle:t.onInstanceLifecycle,validateInstanceScope:t.validateInstanceScope}),this.httpStreamHeaderTimeoutMs=t.httpStreamHeaderTimeoutMs??3e4,this.requestTimeoutMs=t.requestTimeoutMs??3e4,this.auxiliaryAttachTimeoutMs=t.auxiliaryAttachTimeoutMs??3e4,this.connectionRuntime=t.connectionRuntime,this.connectionOptions=t}attach(e,t){const n=this.sockets.get(e);if(n?.socket===t)return;n&&this.invalidateInstanceScope({nodeId:e});const i=new Map,s={socket:t,runtimeGeneration:this.connectionRuntime?.begin(e,"reverse-wss","handshaking"),pending:i,streams:new Map,httpStreams:new Map,pendingChannels:new Map},a=new lI({...this.connectionOptions,ping:()=>t.ping?.(),onTimeout:n=>{this.sockets.get(e)===s&&(s.failureReason=`Reverse tunnel ${n} timeout.`,void 0!==s.runtimeGeneration&&this.connectionRuntime?.update(e,s.runtimeGeneration,{phase:"suspect",error:s.failureReason}),t.terminate?t.terminate():t.close?.(1011,`Reverse tunnel ${n} timeout.`))},onStable:()=>{void 0!==s.runtimeGeneration&&this.connectionRuntime?.stable(e,s.runtimeGeneration)}});s.supervisor=a,this.sockets.set(e,s),a.start(),a.opened(),t.on?.("pong",()=>{this.sockets.get(e)===s&&(a.pong(),void 0!==s.runtimeGeneration&&this.connectionRuntime?.pong(e,s.runtimeGeneration,a.diagnostics()))}),t.on?.("close",()=>this.detach(e,t)),t.on?.("error",n=>{s.failureReason||=n instanceof Error?n.message:String(n||"Reverse tunnel transport error."),this.detach(e,t)}),n&&n.socket!==t&&this.finalizeConnection(n,new Error(`Reverse tunnel for node ${e} was replaced.`),"Reverse tunnel was replaced.",!0)}setEventSubscription(e,t){this.eventSubscriptions.set(e,t),this.sendEventSubscription(e,t)}sendEventSubscription(e,t){const n=this.sockets.get(e);if(n)try{n.socket.send(JSON.stringify({type:"control-plane.event-subscribe",eventEnvelopeVersion:Yd,aiSessionTransient:{...t.replaySince?{replaySince:t.replaySince}:{},messageDeltas:t.messageDeltas,timelineAllSessions:t.timelineAllSessions,timelineSessions:t.timelineSessions}}))}catch(t){n.failureReason=t instanceof Error?t.message:"Reverse tunnel event subscription delivery failed.",this.detach(e,n.socket);try{n.socket.close?.(1011,"Event subscription delivery failed.")}catch{}}}detach(e,t){const n=this.sockets.get(e);!n||t&&n.socket!==t||(this.sockets.delete(e),n.supervisor?.close(),void 0!==n.runtimeGeneration&&this.connectionRuntime?.disconnected(e,n.runtimeGeneration,{error:n.failureReason||"Reverse tunnel disconnected."}),this.invalidateInstanceScope({nodeId:e}),this.finalizeConnection(n,new Error(`Reverse tunnel for node ${e} disconnected.`),"Reverse tunnel disconnected.",!0))}disconnect(e,t="Node connection disabled locally."){const n=this.sockets.get(e);return!!n&&(this.detach(e,n.socket),n.socket.close?.(1e3,t),!0)}connected(e){return this.sockets.has(e)}markHealthy(e,t){const n=this.sockets.get(e);if(!n||n.socket!==t||void 0===n.runtimeGeneration)return!1;n.supervisor?.healthy();const i=this.connectionRuntime?.connected(e,n.runtimeGeneration)??!0,s=this.eventSubscriptions.get(e);return s&&this.sendEventSubscription(e,s),i}finalizeConnection(e,t,n,i){e.supervisor?.close();for(const n of[...e.pending.keys()])this.cancelPendingRequest(e,n,t,!1);for(const[t,i]of e.streams)e.streams.delete(t),i.downstream.close(1011,n);for(const i of[...e.httpStreams.keys()])this.cancelHttpStream(e,i,t,n,!1);for(const t of e.pendingChannels.values())clearTimeout(t.timer);if(e.pendingChannels.clear(),i&&e.socket.close&&3!==e.socket.readyState)try{e.socket.close(1e3,n)}catch{}}isCurrentSocket(e,t){return this.sockets.get(e)?.socket===t}handleSocketMessage(e,t,n){if(this.isCurrentSocket(e,t))return this.sockets.get(e)?.supervisor?.activity(),this.handleMessage(e,n)}handleMessage(e,t){if(this.eventRouter.handle(e,t))return!0;if(this.handleWebSocketMessage(e,t))return!0;if("node-agent.response"!==t.type)return!1;const n="string"==typeof t.requestId?t.requestId:"",i=this.sockets.get(e),s=i?.pending.get(n);if(!s||!i)return!0;i.pending.delete(n),clearTimeout(s.timer),s.signal&&s.onAbort&&s.signal.removeEventListener("abort",s.onAbort);const a=Number(t.status)||502,o=t.headers&&"object"==typeof t.headers?t.headers:{},r="string"==typeof t.body?t.body:"";if(t.error&&"object"==typeof t.error){const e=t.error,n=new Error("string"==typeof e.message?e.message:`Reverse tunnel request failed with HTTP ${a}`);return Object.assign(n,{statusCode:a,code:"string"==typeof e.code?e.code:"NODE_AGENT_REVERSE_REQUEST_FAILED"}),s.reject(n),!0}return s.resolve(new Response(r,{status:a,headers:o})),!0}invalidateInstanceScope(e={}){this.eventRouter.invalidate(e)}instanceScopeDiagnostics(){return this.eventRouter.diagnostics()}setEventDiagnosticLogger(e){this.eventRouter.setLogger(e)}async request(e,t,n={}){const i=this.sockets.get(e.id);if(!i){const t=new Error(`Reverse tunnel for node ${e.id} is not connected.`);throw Object.assign(t,{statusCode:503,code:"NODE_AGENT_REVERSE_TUNNEL_OFFLINE"}),t}const s=wI(),a=nr(n.body),o={type:"control-plane.request",requestId:s,route:t,init:{method:n.method||"GET",headers:EI(n.headers),body:a}};return new Promise((a,r)=>{let c;if(c={resolve:a,reject:r,timer:setTimeout(()=>{const n=new Error(`Reverse tunnel request to ${e.id}${t} timed out.`);Object.assign(n,{statusCode:504,code:"NODE_AGENT_REVERSE_REQUEST_TIMEOUT"}),this.cancelPendingRequest(i,s,n)},this.requestTimeoutMs),signal:n.signal||void 0},n.signal&&(c.onAbort=()=>{this.cancelPendingRequest(i,s,Object.assign(new Error("Reverse tunnel request was aborted."),{name:"AbortError",code:"ABORT_ERR"}))},n.signal.addEventListener("abort",c.onAbort,{once:!0})),i.pending.set(s,c),n.signal?.aborted)c.onAbort?.();else try{i.socket.send(JSON.stringify(o))}catch(e){this.cancelPendingRequest(i,s,e instanceof Error?e:new Error(String(e)),!1)}})}cancelPendingRequest(e,t,n,i=!0){const s=e.pending.get(t);if(!s)return!1;if(e.pending.delete(t),clearTimeout(s.timer),s.signal&&s.onAbort&&s.signal.removeEventListener("abort",s.onAbort),s.reject(n),i)try{e.socket.send(JSON.stringify({type:"control-plane.request.cancel",requestId:t}))}catch{}return!0}async requestStream(e,t,n={}){const i=this.sockets.get(e.id);if(!i)throw Object.assign(new Error(`Reverse tunnel for node ${e.id} is not connected.`),{statusCode:503,code:"NODE_AGENT_REVERSE_TUNNEL_OFFLINE"});const s=wI(),a=nr(n.body);return new Promise((o,r)=>{const c={resolve:o,reject:r,timer:setTimeout(()=>{this.cancelHttpStream(i,s,Object.assign(new Error(`Reverse tunnel stream to ${e.id}${t} timed out.`),{statusCode:504,code:"NODE_AGENT_REVERSE_STREAM_TIMEOUT"}),"Reverse HTTP stream header timeout.")},this.httpStreamHeaderTimeoutMs),settled:!1,finalized:!1,signal:n.signal||void 0};if(i.httpStreams.set(s,c),this.registerPendingChannel(i,{id:s,attach:t=>this.attachHttpStreamChannel(e.id,s,t),cancel:(e,t)=>{this.cancelHttpStream(i,s,e,t)}},"Reverse HTTP channel attach timed out."),n.signal&&(c.onAbort=()=>this.cancelHttpStream(i,s,Object.assign(new Error("Reverse HTTP stream consumer disconnected."),{name:"AbortError",code:"ABORT_ERR"}),"HTTP consumer disconnected."),n.signal.addEventListener("abort",c.onAbort,{once:!0}),n.signal.aborted))c.onAbort();else try{i.socket.send(JSON.stringify({type:"control-plane.http.open",streamId:s,route:t,init:{method:n.method||"GET",headers:EI(n.headers),body:a}}))}catch(e){this.cancelHttpStream(i,s,e instanceof Error?e:new Error(String(e)),"Reverse tunnel send failed.",!1)}})}cancelHttpStream(e,t,n,i,s=!0){const a=e.httpStreams.get(t);if(!a||a.finalized)return!1;if(a.finalized=!0,e.httpStreams.delete(t),this.removePendingChannel(e,t),clearTimeout(a.timer),a.signal&&a.onAbort&&a.signal.removeEventListener("abort",a.onAbort),a.settled?a.body?.destroy(n):(a.settled=!0,a.reject(n)),1===a.socket?.readyState&&a.socket.close(1e3,i),s)try{e.socket.send(JSON.stringify({type:"control-plane.http.cancel",streamId:t,reason:i}))}catch{}return!0}completeHttpStream(e,t){const n=e.httpStreams.get(t);return!(!n||n.finalized||(n.finalized=!0,e.httpStreams.delete(t),this.removePendingChannel(e,t),clearTimeout(n.timer),n.signal&&n.onAbort&&n.signal.removeEventListener("abort",n.onAbort),n.body?.end(),0))}attachAuxiliary(e,t,n){const i=this.sockets.get(e),s=i?.pendingChannels.get(t);return i&&s?(this.removePendingChannel(i,t),s.attach(n)):(n.close(1008,"Unknown reverse tunnel channel."),!1)}registerPendingChannel(e,t,n){this.removePendingChannel(e,t.id),t.timer=setTimeout(()=>{e.pendingChannels.get(t.id)===t&&(e.pendingChannels.delete(t.id),t.cancel(Object.assign(new Error(n),{code:"NODE_AGENT_REVERSE_CHANNEL_ATTACH_TIMEOUT"}),n))},this.auxiliaryAttachTimeoutMs),t.timer.unref?.(),e.pendingChannels.set(t.id,t)}removePendingChannel(e,t){const n=e.pendingChannels.get(t);return n?.timer&&clearTimeout(n.timer),e.pendingChannels.delete(t),n}attachHttpStream(e,t,n){return this.attachAuxiliary(e,t,n)}attachHttpStreamChannel(e,t,n){const i=this.sockets.get(e),s=i?.httpStreams.get(t);if(!i||!s)return n.close(1008,"Unknown reverse HTTP stream."),!1;s.socket=n;const a=e=>{this.cancelHttpStream(i,t,e,"Reverse HTTP stream failed.")};return n.on("message",(e,o)=>{if(s.finalized||i.httpStreams.get(t)!==s)return;if(o)return s.body?void(s.body.write(Buffer.isBuffer(e)?e:Buffer.from(e))||(n.pause?.(),s.body.once("drain",()=>n.resume?.()))):a(new Error("Reverse HTTP stream received data before response headers."));let c;try{c=JSON.parse(String(e))}catch{return void a(new Error("Reverse HTTP stream sent invalid JSON control data."))}if("node-agent.http.head"===c.type){if(s.settled)return;clearTimeout(s.timer);const e=Number(c.status)||502,n=c.headers&&"object"==typeof c.headers?c.headers:{},a=new r.PassThrough({highWaterMark:65536});return s.body=a,s.settled=!0,a.once("close",()=>{this.cancelHttpStream(i,t,new Error("Reverse HTTP stream consumer closed."),"HTTP consumer closed.")}),void s.resolve(new Response(r.Readable.toWeb(a),{status:e,headers:n}))}"node-agent.http.end"!==c.type?"node-agent.http.error"===c.type&&a(new Error("string"==typeof c.message?c.message:"Reverse HTTP stream failed.")):s.settled?this.completeHttpStream(i,t):a(new Error("Reverse HTTP stream ended before response headers."))}),n.on("close",()=>{a(new Error("Reverse HTTP stream disconnected."))}),n.on("error",()=>a(new Error("Reverse HTTP stream failed."))),!0}proxyWebSocket(e,t,n,i,s={}){const a=e.id,o=this.sockets.get(a);if(!o)return void t.close(1011,"Reverse tunnel is not connected.");const r=wI(),c=e=>{try{o.socket.send(JSON.stringify(e))}catch{this.removePendingChannel(o,r),o.streams.delete(r),t.close(1011,"Reverse tunnel send failed.")}},d={downstream:t,pendingFrames:[]};return o.streams.set(r,d),this.registerPendingChannel(o,{id:r,attach:e=>this.attachWebSocketStreamChannel(a,r,e),cancel:(e,n)=>{this.removePendingChannel(o,r),o.streams.delete(r),t.close(1011,n)}},"Reverse websocket channel attach timed out."),c({type:"control-plane.websocket.open",streamId:r,route:n,protocols:Array.isArray(i)?i:i?[i]:[],headers:s}),t.on("message",(e,n)=>{const i=o.streams.get(r);if(i&&!i.upstream)return i.pendingFrames.length>=256?(this.removePendingChannel(o,r),o.streams.delete(r),t.close(1011,"Reverse websocket stream pending frame limit exceeded."),void c({type:"control-plane.websocket.close",streamId:r,code:1011,reason:"Reverse websocket stream pending frame limit exceeded."})):void i.pendingFrames.push({data:e,isBinary:Boolean(n)})}),t.on("close",(e,t)=>{const n=o.streams.get(r);if(n){this.removePendingChannel(o,r),o.streams.delete(r);const i=dn(e),s=cn(t);n.upstream&&ln(n.upstream,i,s),c({type:"control-plane.websocket.close",streamId:r,...void 0===i?{}:{code:i},...s?{reason:s}:{}})}}),t.on("error",()=>{const e=o.streams.get(r);e&&(this.removePendingChannel(o,r),o.streams.delete(r),e.upstream?.close(1011,"Downstream websocket failed."),c({type:"control-plane.websocket.close",streamId:r,code:1011,reason:"Downstream websocket failed."}))}),{send:e=>{const t=o.streams.get(r);t&&(t.upstream?t.upstream.send(e):t.pendingFrames.push({data:e,isBinary:!1}))}}}attachWebSocketStream(e,t,n){return this.attachAuxiliary(e,t,n)}attachWebSocketStreamChannel(e,t,n){const i=this.sockets.get(e),s=i?.streams.get(t);if(!i||!s)return n.close(1008,"Unknown reverse websocket stream."),!1;s.upstream=n;for(const e of s.pendingFrames.splice(0))n.send(e.data,{binary:e.isBinary});return un(s.downstream,n,{pendingFrameLimit:256,onClientClose:()=>{this.removePendingChannel(i,t),i.streams.delete(t)},onClientError:()=>{this.removePendingChannel(i,t),i.streams.delete(t)},onUpstreamClose:()=>{this.removePendingChannel(i,t),i.streams.delete(t)},onUpstreamError:()=>{this.removePendingChannel(i,t),i.streams.delete(t)}}),!0}handleWebSocketMessage(e,t){const n="string"==typeof t.type?t.type:"";if(!n.startsWith("node-agent.websocket."))return!1;const i=this.sockets.get(e),s="string"==typeof t.streamId?t.streamId:"",a=i?.streams.get(s);return!a||("node-agent.websocket.close"===n?(i&&this.removePendingChannel(i,s),i?.streams.delete(s),ln(a.downstream,t.code,t.reason),!0):"node-agent.websocket.error"!==n||(i&&this.removePendingChannel(i,s),i?.streams.delete(s),a.downstream.close(1011,"string"==typeof t.message?t.message:"Reverse websocket proxy failed."),!0))}}class TI{sockets=new Map;connectionKeys=new Map;retries=new Map;supervisors=new Map;runtimeGenerations=new Map;service;tunnel;safetyIntervalMs;logger;connectionRuntime;connectionOptions;reconnectAttempts=0;safetyReconciliations=0;timer;running=!1;transientDemand={legacyAll:!1,messageDeltas:{allInstances:!1,instanceIds:[]},timelineAllSessions:!1,timelineSessions:[]};constructor(e,t,n={}){var i;this.service=e,this.tunnel=t,this.safetyIntervalMs=(i=n.safetyIntervalMs,Math.min(6e4,Math.max(3e4,i??45e3))),this.logger=n.logger,this.tunnel.setEventDiagnosticLogger?.(this.logger),this.connectionRuntime=n.connectionRuntime,this.connectionOptions=n}start(){this.running||(this.running=!0,this.sync(),this.timer=setInterval(()=>{this.safetyReconciliations+=1,this.sync()},this.safetyIntervalMs))}stop(){this.running=!1,this.timer&&(clearInterval(this.timer),this.timer=void 0);for(const e of this.sockets.values())e.close();for(const e of this.supervisors.values())e.close();this.sockets.clear(),this.connectionKeys.clear(),this.supervisors.clear(),this.runtimeGenerations.clear();for(const e of this.retries.values())e.timer.cancel();this.retries.clear()}syncNow(){this.sync()}setAiSessionTransientDemand(e){this.transientDemand=e;const t=JSON.stringify({v:1,type:"subscribe",eventEnvelopeVersion:Yd,aiSessionTransient:{...e.replaySince?{replaySince:e.replaySince}:{},messageDeltas:e.messageDeltas,timelineAllSessions:e.timelineAllSessions,timelineSessions:e.timelineSessions}});for(const e of this.sockets.values())e.sendUpstream(t);for(const t of this.service.listNodes())"reverse-wss"===t.connectionMode&&this.tunnel.setEventSubscription(t.id,e)}diagnostics(){return{reconnectAttempts:this.reconnectAttempts,safetyReconciliations:this.safetyReconciliations,activeConnections:this.sockets.size,pendingRetries:[...this.retries.values()].filter(e=>e.timer.pending).length,safetyIntervalMs:this.safetyIntervalMs,connections:[...this.supervisors.entries()].map(([e,t])=>({nodeId:e,...t.diagnostics()})),aiSessionTransientDemand:this.transientDemand}}sync(){const e=new Set;for(const t of this.service.listNodes()){const n=this.nodeEventConnectionKey(t);if(!n)continue;e.add(t.id);const i=this.retries.get(t.id);if(i?.timer.pending&&i.connectionKey!==n&&(i.timer.cancel(),this.retries.delete(t.id)),this.connectionKeys.get(t.id)!==n&&this.sockets.has(t.id)){const e=this.sockets.get(t.id),n=this.runtimeGenerations.get(t.id);this.supervisors.get(t.id)?.close(),this.sockets.delete(t.id),this.connectionKeys.delete(t.id),this.supervisors.delete(t.id),this.runtimeGenerations.delete(t.id),void 0!==n&&this.connectionRuntime?.disconnected(t.id,n,{error:"Direct event endpoint changed."}),e?.close()}this.sockets.has(t.id)||this.retries.get(t.id)?.timer.pending||this.connect(t,n)}for(const[t,n]of this.sockets)if(!e.has(t)){const e=this.runtimeGenerations.get(t);this.supervisors.get(t)?.close(),this.sockets.delete(t),this.connectionKeys.delete(t),this.supervisors.delete(t),this.runtimeGenerations.delete(t),void 0!==e&&this.connectionRuntime?.disconnected(t,e,{error:"Direct event connection is no longer configured."}),n.close();const i=this.retries.get(t);i?.timer.cancel(),this.retries.delete(t)}for(const[t,n]of this.retries)e.has(t)||(n.timer.cancel(),this.retries.delete(t),this.connectionKeys.delete(t))}connect(e,t){const n=new vI,i="control-plane-proxy"!==e.connectionMode?this.connectionRuntime?.begin(e.id,"direct-http","connecting"):void 0;void 0!==i&&this.runtimeGenerations.set(e.id,i);const s=this.retries.get(e.id)?.timer||new oI;this.retries.set(e.id,{timer:s,connectionKey:t});const a=new lI({...this.connectionOptions,ping:()=>n.ping(),onTimeout:t=>{this.sockets.get(e.id)===n&&(void 0!==i&&this.connectionRuntime?.update(e.id,i,{phase:"suspect",error:`Direct event WebSocket ${t} timeout.`}),n.terminate())},onStable:()=>{s.reset(),void 0!==i&&this.connectionRuntime?.stable(e.id,i)}});this.sockets.set(e.id,n),this.connectionKeys.set(e.id,t),this.supervisors.set(e.id,a),a.start(),n.on("open",()=>{this.sockets.get(e.id)===n&&(a.opened(),void 0!==i&&this.connectionRuntime?.update(e.id,i,{phase:"handshaking"}))}),n.on("message",t=>{if(this.sockets.get(e.id)!==n)return;let s;try{s=JSON.parse(String(t))}catch{return}if(s&&"object"==typeof s&&!Array.isArray(s)){a.activity(),"healthy"!==a.phase&&(a.healthy(),void 0!==i&&this.connectionRuntime?.connected(e.id,i));const t=s,n=II(t.event),o=II(n?.payload),r=II(o?.meta);"string"==typeof n?.type&&n.type.startsWith("app-session.")&&this.logger?.info?.({nodeId:e.id,instanceId:xI(t.instanceId,II(n.scope)?.instanceId,r?.instanceId),eventType:n.type,traceId:"string"==typeof r?.traceId?r.traceId:void 0,streamId:"string"==typeof r?.streamId?r.streamId:void 0,revision:"number"==typeof r?.revision?r.revision:void 0},"app-session.event.transport.received");const c="string"==typeof t.type&&t.type.startsWith("node-agent.")?t:{type:"node-agent.event.forwarded",event:t};this.tunnel.handleMessage(e.id,c)}}),n.on("pong",()=>{this.sockets.get(e.id)===n&&(a.pong(),void 0!==i&&this.connectionRuntime?.pong(e.id,i,a.diagnostics()))}),n.on("close",(t,s)=>{this.sockets.get(e.id)===n&&(a.close(),this.sockets.delete(e.id),this.connectionKeys.delete(e.id),this.supervisors.delete(e.id),this.runtimeGenerations.delete(e.id),this.scheduleReconnect(e.id,{generation:i,closeCode:"number"==typeof t?t:void 0,error:Buffer.isBuffer(s)?s.toString("utf8"):String(s||"Direct event WebSocket disconnected.")}))}),n.on("error",()=>{this.sockets.get(e.id)===n&&n.terminate()});try{n.opened();const t=this.service.resolveNodeAgentTransport(e).proxyWebSocket(e,n,"/events?aiSessionTransient=1");n.control(t&&t.ping,t&&t.onPong,t&&t.send),n.sendUpstream(JSON.stringify({v:1,type:"subscribe",eventEnvelopeVersion:Yd,aiSessionTransient:{...this.transientDemand.replaySince?{replaySince:this.transientDemand.replaySince}:{},messageDeltas:this.transientDemand.messageDeltas,timelineAllSessions:this.transientDemand.timelineAllSessions,timelineSessions:this.transientDemand.timelineSessions}}))}catch{n.close(1011,"Node event transport failed.")}}scheduleReconnect(e,t={}){const n=this.service.listNodes().find(t=>t.id===e),i=n&&this.nodeEventConnectionKey(n);if(!this.running||!n||!i)return void(void 0!==t.generation&&this.connectionRuntime?.disconnected(e,t.generation,t));const s=this.retries.get(e)??{timer:new oI};if(s.timer.pending)return;s.connectionKey=i;const a=s.timer.schedule(()=>{this.running&&!this.sockets.has(e)&&this.connect(n,i)});a&&(this.reconnectAttempts+=1,void 0!==t.generation&&this.connectionRuntime?.disconnected(e,t.generation,{...t,nextRetryAt:new Date(Date.now()+a.delay).toISOString()}),this.logger?.info?.({nodeId:e,attempt:a.attempt,delay:a.delay,reconnectAttempts:this.reconnectAttempts},"session-stream.node-connection.reconnect-scheduled")),this.retries.set(e,s)}nodeEventConnectionKey(e){if(!1===e.connectionEnabled)return;if("reverse-wss"===e.connectionMode)return;const t="control-plane-proxy"===e.connectionMode?e.connectionPath:{endpoint:e.controlEndpoint||e.endpoint,auth:e.auth};return`transport:${e.connectionMode}:${Jm(JSON.stringify(t))}`}}function zI(e=function(){return process.env.TASK_HANDOFF_CONTROL_PLANE_DATA_DIR||t.join(m.homedir(),".config","task-handoff","control-plane")}()){const n=t.resolve(e);return{dataDir:n,settingsPath:t.join(n,"control-plane-settings.json"),projectsDir:t.join(n,"projects"),modelsDir:t.join(n,"models"),imagesDir:t.join(n,"images"),marketDir:t.join(n,"market"),marketCachePath:t.join(n,"market","catalog-cache.json"),marketStatePath:t.join(n,"market","catalog-state.json"),marketMigrationBackupPath:t.join(n,"market","legacy-image-migration-backup.json"),nodesDir:t.join(n,"nodes"),pendingPairingRevokesDir:t.join(n,"pending-pairing-revokes"),chatSessionsDir:t.join(n,"chat-sessions"),chatBridgesDir:t.join(n,"chat-bridges"),triggersDir:t.join(n,"triggers"),proxyAuthorityPath:t.join(n,"control-plane-proxy","authority.json"),identitySigningPath:t.join(n,"control-plane-identity-signing.json"),cloudConnectivityPath:t.join(n,"cloud-connectivity.json"),authUsersDir:t.join(n,"auth-users"),authSessionsDir:t.join(n,"auth-sessions"),authMembershipsDir:t.join(n,"auth-memberships"),databasePath:t.join(n,"control-plane.sqlite"),identityProviderEncryptionKeyPath:t.join(n,"user-access","identity-provider-encryption-key.json"),gitCredentialsDir:t.join(n,"git-credentials","credentials"),gitCredentialAssignmentsDir:t.join(n,"git-credentials","assignments"),gitCredentialAuditDir:t.join(n,"git-credentials","audit"),gitCredentialProvisioningIntentsDir:t.join(n,"git-credentials","provisioning-intents"),gitCredentialEncryptionKeyPath:t.join(n,"git-credentials","encryption-key.json"),aiSessionUnreadDir:t.join(n,"ai-session-unread"),logsDir:t.join(n,"logs")}}var kI,NI,CI=function(){if(NI)return kI;NI=1;const e=n,{spawnSync:t}=E;return kI={processStartIdentity:function(n,i=process.platform){if(Number.isInteger(n)&&!(n<=0)){if("linux"===i)try{const t=e.readFileSync(`/proc/${n}/stat`,"utf8"),i=t.lastIndexOf(")");if(i<0)return;const s=t.slice(i+2).trim().split(/\s+/)[19];return s?`linux:${s}`:void 0}catch{return}if(["darwin","freebsd","openbsd","aix","sunos"].includes(i)){const e=t("ps",["-o","lstart=","-p",String(n)],{encoding:"utf8",timeout:1e3}),s=0===e.status?e.stdout.trim().replace(/\s+/g," "):"";return s?`${i}:${s}`:void 0}if("win32"===i){const e=t("powershell.exe",["-NoProfile","-NonInteractive","-Command",`(Get-Process -Id ${n} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`],{encoding:"utf8",timeout:2e3}),i=0===e.status?e.stdout.trim():"";return/^\d+$/.test(i)?`win32:${i}`:void 0}}}}}();class RI extends Error{code;lockPath;owner;constructor(e,t,n={}){const i=t?.pid?` pid ${t.pid}`:"";super(`${n.label||"Process"} is already running${i}. Lock: ${e}`),this.name="ProcessSingletonError",this.code=n.code||"PROCESS_ALREADY_RUNNING",this.lockPath=e,this.owner=t}}function OI(e){return t.join(e,"owner.json")}function jI(e){return t.join(e,"initializing.json")}function PI(e){return t.join(e,"recovering.json")}function DI(e){return Number.isInteger(e)&&Number(e)>0}const LI=function(e){try{const t=JSON.parse(n.readFileSync(OI(e),"utf8"));if(DI(t.pid)&&"string"==typeof t.startTime){const e=t;return{pid:e.pid,hostname:"string"==typeof e.hostname&&e.hostname?e.hostname:m.hostname(),component:e.component||"server-update",command:"string"==typeof e.command?e.command:"",acquiredAt:"string"==typeof e.createdAt&&Number.isFinite(Date.parse(e.createdAt))?e.createdAt:new Date(0).toISOString(),token:"string"==typeof e.token&&e.token?e.token:`legacy:${e.pid}:${e.startTime}`,startIdentity:e.startTime.startsWith("linux:")?e.startTime:`linux:${e.startTime}`}}if(!(DI(t.pid)&&"string"==typeof t.hostname&&t.hostname&&"string"==typeof t.command&&"string"==typeof t.acquiredAt&&Number.isFinite(Date.parse(t.acquiredAt))&&"string"==typeof t.token&&t.token))return;return t}catch{return}};function MI(e){if(!DI(e))return!1;try{return process.kill(Number(e),0),!0}catch(e){return"EPERM"===e.code}}function qI(e){if(!e||!MI(e.pid))return!1;if(!e.startIdentity)return!0;const t=CI.processStartIdentity(e.pid);return void 0===t||t===e.startIdentity}function UI(e,i){const s=t.join(e,`.owner-${i.token}.tmp`);n.writeFileSync(s,`${JSON.stringify(i,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"});const a=BI(e);if(a?.token!==i.token)throw HI(s),new Error(`Process lock initialization was superseded: ${e}`);n.renameSync(s,OI(e)),HI(jI(e))}function $I(e,s,a){const o=LI(e);if(o?.token!==s.token)return!1;const r={...s};for(const[e,t]of Object.entries(a))void 0===t?delete r[e]:Object.assign(r,{[e]:t});const c=t.join(e,`.owner-update-${s.token}-${i.randomUUID()}.tmp`);try{if(n.writeFileSync(c,`${JSON.stringify(r,null,2)}\n`,{encoding:"utf8",mode:384,flag:"wx"}),LI(e)?.token!==s.token)return!1;n.renameSync(c,OI(e));for(const e of Object.keys(s))delete s[e];return Object.assign(s,r),!0}catch(e){if("ENOENT"===e.code)return!1;throw e}finally{HI(c)}}function BI(e){try{return JSON.parse(n.readFileSync(jI(e),"utf8"))}catch{return}}function FI(e){const t=BI(e);return DI(t?.pid)&&qI({pid:t.pid,startIdentity:t.startIdentity})}function HI(e){try{n.unlinkSync(e)}catch(e){if("ENOENT"!==e.code)throw e}}function GI(){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,20)}function WI(e){try{const t=BI(e),i=Date.parse(t?.startedAt||"");return Number.isFinite(i)?Math.max(0,Date.now()-i):Math.max(0,Date.now()-n.statSync(e).mtimeMs)}catch{return 0}}function VI(e,s){try{return n.writeFileSync(PI(e),`${JSON.stringify({token:s,pid:process.pid,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),!0}catch(a){if("EEXIST"===a.code)return!!function(e){const s=PI(e),a=KI(s),o=Date.parse(a?.startedAt||"");if(MI(a?.pid)||Number.isFinite(o)&&Date.now()-o<2e3)return!1;const r=t.join(e,`.recovering-${i.randomUUID()}.stale`);try{n.renameSync(s,r)}catch(e){if(["ENOENT","EEXIST"].includes(e.code||""))return!1;throw e}const c=KI(r);if(c?.token===a?.token)return HI(r),!0;try{n.linkSync(r,s)}catch(e){if("EEXIST"!==e.code)throw e}finally{HI(r)}return!1}(e)&&VI(e,s);if("ENOENT"===a.code)return!1;throw a}}function KI(e){try{return JSON.parse(n.readFileSync(e,"utf8"))}catch{return}}function YI(e,t){return KI(PI(e))?.token===t}function XI(){const e=process.env.TASK_HANDOFF_CONTROL_PLANE_LOCK_PATH?.trim();return e?t.resolve(e):t.join(m.tmpdir(),`task-handoff-control-plane-${process.getuid?.()??"user"}.lock`)}function JI(e,s={}){return function(e,s={}){n.mkdirSync(t.dirname(e),{recursive:!0});const a=CI.processStartIdentity(process.pid),o={pid:process.pid,hostname:m.hostname(),command:process.argv.join(" "),acquiredAt:(new Date).toISOString(),token:i.randomUUID(),...void 0!==s.component?{component:s.component}:{},...a?{startIdentity:a}:{},...void 0!==s.dataDir?{dataDir:s.dataDir}:{},...void 0!==s.host?{host:s.host}:{},...void 0!==s.port?{port:s.port}:{},...void 0!==s.instanceId?{instanceId:s.instanceId}:{}};for(let t=0;t<5;t+=1)try{return n.mkdirSync(e),n.writeFileSync(jI(e),`${JSON.stringify({token:o.token,pid:o.pid,startIdentity:o.startIdentity,startedAt:(new Date).toISOString()})}\n`,{encoding:"utf8",mode:384,flag:"wx"}),UI(e,o),{lockPath:e,owner:o,updateDetails:t=>$I(e,o,t),release(){const t=LI(e);t?.token===o.token&&n.rmSync(e,{recursive:!0,force:!0})}}}catch(a){if("EEXIST"!==a.code)throw a;const o=LI(e);if(qI(o))throw new RI(e,o,s.error);if(!o&&(FI(e)||WI(e)<(s.incompleteLockStaleMs??2e3))){if(t+1<5){GI();continue}throw new RI(e,void 0,s.error)}const r=i.randomUUID();if(!VI(e,r)){if(t+1<5){GI();continue}throw new RI(e,LI(e),s.error)}const c=LI(e);if(qI(c))throw HI(PI(e)),new RI(e,c,s.error);if(o?.token&&c?.token!==o.token){HI(PI(e));continue}if(!YI(e,r))continue;n.rmSync(e,{recursive:!0,force:!0})}const r=LI(e);throw new RI(e,r,s.error)}(e,{...s,component:"control-plane",error:{label:"Control plane",code:"CONTROL_PLANE_ALREADY_RUNNING"}})}function QI(e){return e&&"object"==typeof e&&!Array.isArray(e)?e:{}}function ZI(e){return"string"==typeof e&&e.trim()?e.trim():void 0}function ex(e){return{kind:"node",nodeId:e}}async function tx(e,t,n){if(!n)return{kind:"instance-derived",nodeId:"",instanceId:t};const i=e.requireControlledInstanceForAuthorization(t);return{kind:"instance-derived",nodeId:i.nodeId,instanceId:i.id}}const nx=new WeakMap;function ix(e,t){nx.set(e,t)}function sx(e){return nx.get(e)}const ax=f.z.string().trim().min(1),ox=f.z.object({id:ax}).strict(),rx=f.z.object({id:ax,keyId:ax}).strict(),cx=f.z.object({id:ax,connectionId:ax}).strict(),dx=f.z.object({id:ax,runtimeId:ax}).strict(),lx=f.z.object({id:ax,folderId:ax}).strict(),px=f.z.object({id:ax,sessionId:ax}).strict(),ux=f.z.object({id:ax,sessionId:ax,turnId:ax}).strict(),mx=f.z.object({id:ax,sessionId:ax,messageId:ax,attachmentId:ax}).strict(),hx=f.z.object({id:ax,sessionId:ax,queueId:ax}).strict(),gx=f.z.object({configHash:ax}).strict(),fx=f.z.object({id:ax,configHash:ax}).strict(),yx=f.z.object({id:ax,sessionId:ax,configHash:ax}).strict(),bx=f.z.object({path:f.z.string().optional(),depth:f.z.coerce.number().int().min(0).max(32).optional()}).strict();async function vx(e,t,n){const i=new AbortController,s=()=>i.abort(),a=()=>{t.raw.writableEnded||s()};e.raw.once("aborted",s),t.raw.once("close",a);try{return await n(i.signal)}finally{e.raw.off("aborted",s),t.raw.off("close",a)}}function Ix(e,t){const n=sx(e);return"user"!==n?.type||"all"===n.nodeScope.kind||n.nodeScope.nodeIds.includes(t)}function xx(e,t,n){return t.filter(t=>Ix(e,n(t)))}function wx(e,t){const n=sx(e);return"user"!==n?.type||dl(n.nodeScope,n.instanceScope,t.id,t.nodeId)}function Sx(e,t,n){return t.filter(t=>wx(e,n(t)))}function Ax(e,t){return{...t,models:t.models.flatMap(t=>{const n=t.locations.filter(t=>"control-plane"===t.type||Ix(e,t.nodeId));return n.length?[{...t,locations:n,referenceCount:n.reduce((e,t)=>e+("node"===t.type?t.referenceCount:0),0)}]:[]}),nodeDiagnostics:xx(e,t.nodeDiagnostics,e=>e.nodeId)}}async function Ex(e,t){const n=await e.listControlledInstances();return new Set(n.filter(e=>wx(t,e)).map(e=>e.id))}async function _x(e,t,n){const i=await e.requireControlledInstance(n);if(wx(t,i))return i;throw Object.assign(new Error("The requested resource is not visible."),{statusCode:404,code:"CONTROL_PLANE_RESOURCE_NOT_VISIBLE"})}const Tx=f.z.object({ids:f.z.array(f.z.string().trim().min(1).max(120)).default([])}).strict(),zx=f.z.object({nodeId:f.z.string().trim().min(1).max(120),modelId:f.z.string().trim().min(1).max(120).optional()}).strict(),kx=f.z.object({progressive:f.z.enum(["true","false"]).optional()}).strict();function Nx(e,t){const n=e.body&&"object"==typeof e.body&&!Array.isArray(e.body)?e.body:void 0,i=n?.source&&"object"==typeof n.source&&!Array.isArray(n.source)?n.source:void 0,s=i?.auth&&"object"==typeof i.auth&&!Array.isArray(i.auth)?i.auth:void 0;if(!i||void 0===s?.secretId&&!t?.auth?.secretId)return;const a=sx(e);if(!a)throw Object.assign(new Error("Authentication is required."),{code:"CONTROL_PLANE_AUTH_REQUIRED",statusCode:401});pl(a,"manage-secrets",{type:"secret"})}const Cx=f.z.object({source:f.z.object({channel:Ud,bridgeId:f.z.string().trim().min(1).max(120).optional(),chatSessionId:f.z.string().trim().min(1).max(240),userId:f.z.string().trim().max(240).optional()}).strict(),action:f.z.discriminatedUnion("type",[f.z.object({type:f.z.literal("ai-session"),index:f.z.number().int().nonnegative()}).strict(),f.z.object({type:f.z.literal("instance-app-menu"),instanceId:f.z.string().trim().min(1).max(120)}).strict(),f.z.object({type:f.z.literal("launch-app"),instanceId:f.z.string().trim().min(1).max(120),appId:f.z.string().trim().min(1).max(120)}).strict(),f.z.object({type:f.z.literal("pending-decision"),routeId:f.z.string().trim().min(1).max(120),decision:f.z.enum(["allow","deny","skip"])}).strict()])}).strict();function Rx(e){const t=Cx.parse(e);if(!t.action)throw new Error("Chat gateway action is required.");return{source:t.source,action:t.action}}const Ox=f.z.object({path:f.z.string().trim().max(1e3).optional(),depth:f.z.coerce.number().int().min(0).max(2).optional()}).strict(),jx=f.z.object({id:f.z.string().trim().min(1),appId:f.z.string().trim().min(1)}).strict(),Px=f.z.object({id:f.z.string().trim().min(1),jobId:f.z.string().trim().min(1)}).strict(),Dx=f.z.object({projection:f.z.literal("directory").optional(),instanceId:f.z.string().trim().min(1).max(120).optional(),progressive:f.z.enum(["true","false"]).optional()}).strict();const Lx=f.z.object({id:f.z.string().trim().min(1).max(120)}).strict(),Mx=f.z.object({nodeId:f.z.string().trim().min(1).max(120),templateId:f.z.string().trim().min(1).max(120)}).strict(),qx=f.z.object({force:f.z.enum(["true","false"]).optional()}).strict(),Ux=f.z.object({projection:f.z.literal("directory").optional()}).strict(),$x=f.z.object({progressive:f.z.enum(["true","false"]).optional()}).strict();const Bx=f.z.object({cwdFolderId:f.z.string().trim().min(1).max(120).optional()}).strict(),Fx=f.z.object({revision:f.z.string().trim().min(1).max(64).optional()}).strict(),Hx=f.z.object({appId:f.z.string().trim().min(1).max(120).default("terminal-tty"),cwdFolderId:f.z.string().trim().min(1).max(120).optional(),options:f.z.record(f.z.string(),f.z.unknown()).default({})}).strict().default({appId:"terminal-tty",options:{}}),Gx=f.z.object({title:f.z.string().trim().min(1).max(120)}).strict(),Wx=f.z.object({token:f.z.string().trim().min(1).max(512)}).strict(),Vx=f.z.object({}).strict();function Kx(e,t){if(!e)return t;const n=/filename\*=UTF-8''([^;]+)/i.exec(e)?.[1];if(n)try{return decodeURIComponent(n)}catch{}const i=/filename="([^"]+)"/i.exec(e)?.[1];return i||t}async function Yx(e){let t={};if(e.body)try{t=await new Response(e.body).json()}catch{}if(e.status<200||e.status>=300)throw Object.assign(new Error(t.error?.message||`Controlled instance attachment request failed with HTTP ${e.status}.`),{statusCode:e.status,code:t.error?.code||"AI_SESSION_ATTACHMENT_UPLOAD_FAILED"});return t.data}function Xx(e,t,n){const i=e.safeParse(t);if(i.success)return i.data;throw Object.assign(new Error(`Controlled instance returned an invalid attachment ${n} response: ${i.error.issues.map(e=>`${e.path.join(".")||"response"}: ${e.message}`).join("; ")}`),{statusCode:502,code:"AI_SESSION_ATTACHMENT_PROTOCOL_INVALID"})}function Jx(e){const{app:t,service:s,events:a,appSessionAggregator:o,aiSessionAggregator:c,aiSessionUnread:d,chatGateway:l,aiSessionAttachments:p,aiSessionAttachmentCache:u,nodeAgentTunnel:m,nodeEventSubscriber:h,errorPayload:g,onInstanceDeleted:y}=e;!function({app:e,service:t,events:n}){e.get("/api/projects",async e=>({data:t.listProjects().filter(n=>"local-folder"!==n.source.type||Boolean(n.source.ownerNodeId&&t.nodes.get(n.source.ownerNodeId)&&Ix(e,n.source.ownerNodeId)))})),e.post("/api/projects",async(e,i)=>{Nx(e);const s=t.createProject(e.body);return n.publish("project.created",{projectId:s.id}),i.code(201).send({data:s})}),e.get("/api/projects/:id",async e=>({data:t.requireProject(ox.parse(e.params).id)})),e.patch("/api/projects/:id",async e=>{const i=ox.parse(e.params).id;Nx(e,t.requireProject(i).source);const s=t.updateProject(i,e.body);return n.publish("project.updated",{projectId:s.id}),{data:s}}),e.delete("/api/projects/:id",async e=>{const i=ox.parse(e.params).id,s=t.deleteProject(i);return n.publish("project.deleted",{projectId:i,deleted:s}),{data:{deleted:s}}}),e.get("/api/models",async(e,n)=>vx(e,n,async n=>{const i=kx.parse(e.query);return{data:Ax(e,await t.listFederatedModels(n,"true"===i.progressive))}})),e.post("/api/models",async(e,i)=>{const s=await t.createModel(e.body);return n.publish("model.created",{modelId:s.id}),i.code(201).send({data:s})}),e.post("/api/models/:id/copy",async(e,i)=>{const s=t.copyModel(ox.parse(e.params).id,e.body);return n.publish("model.created",{modelId:s.id}),i.code(201).send({data:s})}),e.post("/api/models/discover",async e=>({data:await t.discoverModels(e.body)})),e.post("/api/models/test",async e=>({data:await t.testModel(e.body)})),e.post("/api/models/reorder",async e=>{const i=Tx.parse(e.body),s=await t.reorderModels(i.ids);return n.publish("model.reordered",{ids:i.ids}),{data:s}}),e.get("/api/models/:id",async e=>({data:t.requireModel(ox.parse(e.params).id)})),e.patch("/api/models/:id",async e=>{const i=await t.updateModel(ox.parse(e.params).id,e.body);return n.publish("model.updated",{modelId:i.id}),{data:i}}),e.delete("/api/models/:id",async e=>{const i=ox.parse(e.params).id,s=await t.deleteModel(i);return n.publish("model.deleted",{modelId:i,deleted:s}),{data:{deleted:s}}}),e.post("/api/nodes/:nodeId/models",async(e,i)=>{const{nodeId:s}=zx.parse(e.params),a=await t.createNodeModel(s,e.body);return n.publish("model.created",{modelId:a.id,nodeId:s}),i.code(201).send({data:a})}),e.post("/api/nodes/:nodeId/models/discover",async e=>{const{nodeId:n}=zx.parse(e.params);return{data:await t.discoverNodeModels(n,e.body)}}),e.post("/api/nodes/:nodeId/models/test",async e=>{const{nodeId:n}=zx.parse(e.params);return{data:await t.testNodeModel(n,e.body)}}),e.patch("/api/nodes/:nodeId/models/:modelId",async e=>{const{nodeId:i,modelId:s}=zx.parse(e.params),a=await t.updateNodeModel(i,s,e.body);return n.publish("model.updated",{modelId:s,nodeId:i}),{data:a}}),e.delete("/api/nodes/:nodeId/models/:modelId",async e=>{const{nodeId:i,modelId:s}=zx.parse(e.params),a=await t.deleteNodeModel(i,s);return n.publish("model.deleted",{modelId:s,nodeId:i,deleted:a.deleted}),{data:a}}),e.get("/api/market/catalog",async()=>({data:t.getMarketCatalog()})),e.post("/api/market/refresh",async()=>{const e=await t.refreshMarketCatalog();return n.publish("market.catalog.updated",{revision:e.catalog.revision,source:e.catalog.source}),{data:e}}),e.get("/api/image-options",async()=>({data:t.listImageOptions()})),e.get("/api/images",async()=>({data:t.listImages()})),e.post("/api/images",async(e,i)=>{const s=t.createImage(e.body);return n.publish("image.created",{imageId:s.id}),i.code(201).send({data:s})}),e.get("/api/images/:id",async e=>({data:t.requireImage(ox.parse(e.params).id)})),e.patch("/api/images/:id",async e=>{const i=t.updateImage(ox.parse(e.params).id,e.body);return n.publish("image.updated",{imageId:i.id}),{data:i}}),e.delete("/api/images/:id",async e=>{const i=ox.parse(e.params).id,s=await t.deleteImage(i);return n.publish("image.deleted",{imageId:i,deleted:s}),{data:{deleted:s}}})}({app:t,service:s,events:a}),function({app:e,service:t,events:n,nodeAgentTunnel:i,nodeEventSubscriber:s,errorPayload:a}){const o=e=>{if(!e||"object"!=typeof e||Array.isArray(e)||!("target"in e))return;const t=e.target;if(!t||"object"!=typeof t||Array.isArray(t)||"controlled-instance"!==t.component)return;const n=new Error("Independent controlled-instance updates were retired; update the Node rollout instead.");throw Object.assign(n,{statusCode:404,code:"LEGACY_INSTANCE_UPDATE_RETIRED"}),n};e.get("/api/nodes",async e=>{const n=Ux.parse(e.query),i=xx(e,t.listNodes(),e=>e.id);return{data:"directory"===n.projection?i.map(e=>function(e){const t=e.proxyState?.lastError;return Ch.parse({id:e.id,name:e.name,status:e.status,health:e.health,connectionMode:e.connectionMode,connectionPhase:e.connectionPhase,lastSeenAt:e.lastSeenAt,observedAt:e.updatedAt,capabilities:Object.keys(e.capabilities).sort(),error:t?{code:t.code,message:"Node connection failed. Use the desktop Control Plane for diagnostics."}:void 0})}(t.projectNodeConnection(e))):i.map(e=>t.requirePublicNode(e.id))}}),e.post("/api/nodes/local/sync",async()=>{const e=await t.syncLocalNodeConnection();return s.syncNow(),n.publish("node.local-synced",{nodeId:e.id}),{data:t.requirePublicNode(e.id)}}),e.post("/api/nodes",async(e,i)=>{const a=await t.createNode(e.body);return s.syncNow(),n.publish("node.created",{nodeId:a.id}),i.code(201).send({data:t.requirePublicNode(a.id)})}),e.post("/api/nodes/:id/check",async e=>{const i=await t.checkNode(ox.parse(e.params).id);return n.publish("node.checked",{nodeId:i.id},{topic:"node.state",scope:{nodeId:i.id}}),{data:i}}),e.get("/api/nodes/:id/updates/jobs",async e=>({data:await t.listNodeUpdateJobs(ox.parse(e.params).id)})),e.get("/api/nodes/:id/settings/external-listener",async e=>({data:await t.getLocalNodeExternalListener(ox.parse(e.params).id)})),e.patch("/api/nodes/:id/settings/external-listener",async e=>{const i=ox.parse(e.params).id,s=await t.updateLocalNodeExternalListener(i,e.body);return n.publish("node.external-listener.updated",{nodeId:i,bindScope:s.bindScope,port:s.port}),{data:s}}),e.post("/api/nodes/:id/updates/check",async e=>{o(e.body);const i=ox.parse(e.params).id,s=await t.checkNodeUpdate(i,ec.parse(e.body));return n.publish("node.update.checked",{nodeId:i,availableVersion:s.availableVersion,impact:s.impact}),{data:s}}),e.post("/api/nodes/:id/updates/apply",async(e,i)=>{o(e.body);const s=ox.parse(e.params).id,a=await t.applyNodeUpdate(s,ic.parse(e.body));return n.publish("node.update.queued",{nodeId:s,updateJobId:a.id,desiredVersion:a.toVersion,impact:a.impact}),i.code(202).send({data:a})}),e.post("/api/nodes/:id/pairing/invites",async(e,i)=>{const s=ox.parse(e.params),a=await t.createNodePairingInvite(s.id,e.body);return n.publish("node.pairing-invite.created",{nodeId:s.id}),i.code(201).send({data:a})}),e.post("/api/nodes/:id/control-plane-connections",async e=>{const i=ox.parse(e.params),s=await t.connectNodeToControlPlane(i.id,e.body);return n.publish("node.remote-connect.requested",{nodeId:i.id}),{data:s}}),e.get("/api/nodes/:id/control-plane-pairings",async e=>{const n=ox.parse(e.params);return{data:await t.listNodeControlPlanePairings(n.id)}}),e.delete("/api/nodes/:id/control-plane-pairings/:keyId",async e=>{const i=rx.parse(e.params),s=await t.deleteNodeControlPlanePairing(i.id,i.keyId);return n.publish("node.control-plane-pairing.deleted",{nodeId:i.id,keyId:i.keyId}),{data:s}}),e.get("/api/nodes/:id/control-plane-connections",async e=>{const n=ox.parse(e.params);return{data:await t.listNodeControlPlaneConnections(n.id)}}),e.delete("/api/nodes/:id/control-plane-connections/:connectionId",async e=>{const i=cx.parse(e.params),s=await t.deleteNodeControlPlaneConnection(i.id,i.connectionId);return n.publish("node.control-plane-connection.deleted",{nodeId:i.id,connectionId:i.connectionId}),{data:s}}),e.post("/api/node-join/invites",async(e,i)=>{const s=t.createNodeJoinInvite(e.body);return n.publish("node-join.invite.created",{inviteId:s.id}),i.code(201).send({data:s})}),e.get("/api/node-join/invites/:id",async e=>({data:Qc.parse(t.getNodeJoinInviteStatus(ox.parse(e.params).id))})),e.post("/api/node-join/complete",{config:Zv},async(e,i)=>{const{node:a,inviteId:o}=t.completeNodeJoin(e.body);return s.syncNow(),n.publish("node.joined",{nodeId:a.id,inviteId:o}),i.code(201).send({data:t.requirePublicNode(a.id)})}),e.get("/api/nodes/:id/runtimes",async e=>({data:await t.listNodeRuntimes(ox.parse(e.params).id)})),e.post("/api/nodes/:id/runtimes",async(e,i)=>{const s=ox.parse(e.params),a=await t.createNodeRuntime(s.id,e.body);return n.publish("node.runtime.created",{nodeId:s.id,runtimeId:a.id}),i.code(201).send({data:a})}),e.patch("/api/nodes/:id/runtimes/:runtimeId",async e=>{const i=dx.parse(e.params),s=await t.updateNodeRuntime(i.id,i.runtimeId,e.body);return n.publish("node.runtime.updated",{nodeId:i.id,runtimeId:s.id}),{data:s}}),e.delete("/api/nodes/:id/runtimes/:runtimeId",async e=>{const i=dx.parse(e.params),s=await t.deleteNodeRuntime(i.id,i.runtimeId);return n.publish("node.runtime.deleted",{nodeId:i.id,runtimeId:i.runtimeId}),{data:s}}),e.post("/api/nodes/:id/runtimes/:runtimeId/check",async e=>{const i=dx.parse(e.params),s=await t.checkNodeRuntime(i.id,i.runtimeId);return n.publish("node.runtime.checked",{nodeId:i.id,runtimeId:s.id}),{data:s}}),e.get("/api/nodes/:id/docker/images",async e=>({data:await t.listNodeDockerImages(ox.parse(e.params).id)})),e.get("/api/nodes/:id/image-options",async e=>({data:await t.listNodeImageAvailability(ox.parse(e.params).id)})),e.get("/api/nodes/:id/local-folders",async(e,n)=>vx(e,n,async n=>({data:await t.listNodeLocalFolders(ox.parse(e.params).id,n)}))),e.get("/api/nodes/:id/folders/places",async e=>({data:await t.listNodeFolderPlaces(ox.parse(e.params).id)})),e.get("/api/nodes/:id/folders/tree",async e=>{const n=ox.parse(e.params),i=bx.parse(e.query);return{data:await t.listNodeFolderTree(n.id,{path:i.path,depth:i.depth})}}),e.post("/api/nodes/:id/local-folders",async(e,i)=>{const s=ox.parse(e.params),a=await t.createNodeLocalFolder(s.id,e.body);return n.publish("node.local-folder.created",{nodeId:s.id,folderId:a.id}),i.code(201).send({data:a})}),e.patch("/api/nodes/:id/local-folders/:folderId",async e=>{const i=lx.parse(e.params),s=await t.updateNodeLocalFolder(i.id,i.folderId,e.body);return n.publish("node.local-folder.updated",{nodeId:i.id,folderId:i.folderId}),{data:s}}),e.delete("/api/nodes/:id/local-folders/:folderId",async e=>{const i=lx.parse(e.params),s=await t.deleteNodeLocalFolder(i.id,i.folderId);return n.publish("node.local-folder.deleted",{nodeId:i.id,folderId:i.folderId}),{data:s}}),e.get("/api/nodes/:id",async e=>({data:t.requirePublicNode(ox.parse(e.params).id)})),e.patch("/api/nodes/:id",async e=>{const a=t.updateNode(ox.parse(e.params).id,e.body);return a.connectionEnabled||i.disconnect(a.id),s.syncNow(),n.publish("node.updated",{nodeId:a.id}),{data:t.requirePublicNode(a.id)}}),e.delete("/api/nodes/:id",async e=>{const i=ox.parse(e.params).id,a=qx.parse(e.query),o=await t.deleteNodeWithProxyLifecycle(i,"true"===a.force);return s.syncNow(),n.publish("node.deleted",{nodeId:i,deleted:o.deleted,revoke:o.revoke}),{data:o}}),e.get("/api/node-runtimes",async(e,n)=>vx(e,n,async n=>{const i=$x.parse(e.query),s=await t.listNodeRuntimesWithDiagnostics(n,"true"===i.progressive);return{data:xx(e,s.items,e=>e.nodeId),meta:{nodeErrors:xx(e,s.nodeErrors,e=>e.nodeId),nodeStates:xx(e,s.nodeStates,e=>e.nodeId)}}})),function(e){const{app:t,service:n,nodeAgentTunnel:i,errorPayload:s}=e,a=new pI(i),o=e=>{if(!1===e.connectionEnabled){const e=new Error("Node agent connection is disabled locally.");throw Object.assign(e,{statusCode:409,code:"NODE_AGENT_CONNECTION_DISABLED"}),e}};t.get(Ym,{websocket:!0,config:nI},(e,t)=>{try{const i=bI.parse(t.query),s=n.requireNode(i.nodeId);AI(s,t),o(s),a.attachMain(s.id,e)}catch(t){const n=s(t);e.send(JSON.stringify({type:"control-plane.error",code:n.code,message:n.message})),e.close(1008,n.message)}}),t.get(`${Ym}/streams/:streamId`,{websocket:!0,config:nI},(e,t)=>{try{const i=bI.parse(t.query),s=n.requireNode(i.nodeId);AI(s,t),o(s);const r=t.params.streamId;a.attachAuxiliary(s.id,r,e)}catch(t){const n=s(t);e.close(1008,n.message)}}),t.get(`${Ym}/channels/:channelId`,{websocket:!0,config:nI},(e,t)=>{try{const i=bI.parse(t.query),s=n.requireNode(i.nodeId);AI(s,t),o(s);const r=t.params.channelId;a.attachAuxiliary(s.id,r,e)}catch(t){const n=s(t);e.close(1008,n.message)}}),t.get(`${Ym}/http-streams/:streamId`,{websocket:!0,config:nI},(e,t)=>{try{const i=bI.parse(t.query),s=n.requireNode(i.nodeId);AI(s,t),o(s);const r=t.params.streamId;a.attachAuxiliary(s.id,r,e)}catch(t){const n=s(t);e.close(1008,n.message)}})}({app:e,service:t,nodeAgentTunnel:i,errorPayload:a})}({app:t,service:s,events:a,nodeAgentTunnel:m,nodeEventSubscriber:h,errorPayload:g}),function({app:e,service:t,events:n,onInstanceDeleted:i}){e.get("/api/controlled-instances",async e=>({data:Sx(e,await t.listControlledInstances(),e=>e)})),e.post("/api/controlled-instances",async(e,i)=>{if("instance-retained"===(e.body&&"object"==typeof e.body&&!Array.isArray(e.body)?e.body:{}).gitCredentialRetention){const t=sx(e);if(!t)throw Object.assign(new Error("Authentication is required."),{code:"CONTROL_PLANE_AUTH_REQUIRED",statusCode:401});pl(t,"manage-secrets",{type:"secret"})}const s=await t.createControlledInstance(e.body);return n.publish("instance.created",{instanceId:s.id}),i.code(201).send({data:s})}),e.get("/api/controlled-instances/:id",async e=>({data:await t.requireControlledInstance(ox.parse(e.params).id,!1,!0)})),e.get("/api/controlled-instances/:id/metrics",async e=>({data:await t.instanceResourceMetrics(ox.parse(e.params).id)})),e.get("/api/controlled-instances/:id/apps/management",async e=>({data:await t.instanceAppManagement(ox.parse(e.params).id)})),e.post("/api/controlled-instances/:id/apps/:appId/install",async e=>{const n=jx.parse(e.params),i=Hr.parse(e.body||{});return{data:await t.requestInstanceAppOperation(n.id,n.appId,"install",i)}}),e.post("/api/controlled-instances/:id/apps/:appId/uninstall",async e=>{const n=jx.parse(e.params),i=Hr.parse(e.body||{});return{data:await t.requestInstanceAppOperation(n.id,n.appId,"uninstall",i)}}),e.get("/api/controlled-instances/:id/apps/jobs/:jobId",async e=>{const n=Px.parse(e.params);return{data:await t.instanceAppManagementJob(n.id,n.jobId)}}),e.patch("/api/controlled-instances/:id",async e=>{const i=await t.updateControlledInstance(ox.parse(e.params).id,e.body);return n.publish("instance.updated",{instanceId:i.id}),{data:i}}),e.delete("/api/controlled-instances/:id",async e=>{const s=ox.parse(e.params).id,a=await t.deleteControlledInstance(s,Ir.parse(e.body));return a.completed&&(await(i?.(s)),n.publish("instance.deleted",{instanceId:s,result:a})),{data:a}}),e.post("/api/controlled-instances/:id/start",async e=>{const i=await t.startControlledInstance(ox.parse(e.params).id);return n.publish("instance.started",{instanceId:i.id}),{data:i}}),e.post("/api/controlled-instances/:id/stop",async e=>{const i=await t.stopControlledInstance(ox.parse(e.params).id);return n.publish("instance.stopped",{instanceId:i.id}),{data:i}}),e.post("/api/controlled-instances/:id/restart",async e=>{const i=await t.restartControlledInstance(ox.parse(e.params).id);return n.publish("instance.restarted",{instanceId:i.id}),{data:i}}),e.post("/api/controlled-instances/:id/image-provisioning/retry",async e=>{const i=await t.retryControlledInstanceImageProvisioning(ox.parse(e.params).id);return n.publish("instance.image-provisioning-retried",{instanceId:i.id}),{data:i}}),e.get("/api/controlled-instances/:id/config-sync",async e=>({data:await t.instanceConfigSyncState(ox.parse(e.params).id)})),e.get("/api/controlled-instances/:id/config-sync/folders",async e=>({data:await t.listInstanceConfigSyncFolders(ox.parse(e.params).id,Ox.parse(e.query))})),e.post("/api/controlled-instances/:id/config-sync",async e=>{const i=ox.parse(e.params).id,s=await t.syncInstanceConfigs(i,e.body);return n.publish("instance.config-synced",{instanceId:i}),{data:s}}),e.get("/api/instance-board",async(e,n)=>vx(e,n,async n=>{const i=Dx.parse(e.query),s=await t.boardWithDiagnostics(n,"true"===i.progressive);return{data:Sx(e,i.instanceId?s.items.filter(e=>e.id===i.instanceId):s.items,e=>e).map(e=>"directory"===i.projection?function(e){const t=e.runtimeVersion?.error,n=e.imageProvisioning?.error,i=e.workspace.error,s=t?{code:t.code,message:"Instance runtime convergence failed. Use the desktop Control Plane for diagnostics."}:n?{code:"IMAGE_PROVISIONING_FAILED",message:"Instance image provisioning failed. Use the desktop Control Plane for diagnostics."}:i?{code:"WORKSPACE_FAILED",message:"Instance workspace preparation failed. Use the desktop Control Plane for diagnostics."}:void 0,a=e.node?.capabilities.agent,o=a&&"object"==typeof a&&!Array.isArray(a)?a:void 0,r="string"==typeof o?.protocolVersion?o.protocolVersion:void 0,c=!r||r===qo,d=[e.protocolCompatible?void 0:`Instance protocol ${e.protocolVersion||"unknown"} differs from this Control Plane.`,c?void 0:`Node protocol ${r} differs from this Control Plane.`].filter(e=>Boolean(e)),l="running"===e.status||"online"===e.connectionStatus||"reachable"===e.access.status,p=!["failed","stopped","stopping","unhealthy"].includes(e.status)&&"online"!==e.connectionStatus&&["provisioning","starting","registering","registered"].includes(e.status),u=[l||["provisioning","starting","registering","registered","stopping"].includes(e.status)?void 0:"start",["failed","stopped","stopping","unhealthy"].includes(e.status)||!l&&!p?void 0:"stop",l?"restart":void 0,"failed"===e.status&&"failed"===e.imageProvisioning?.phase?"retry-image":void 0].filter(e=>Boolean(e));return jh.parse({id:e.id,name:e.name,nodeId:e.nodeId,status:e.status,health:e.health,connectionStatus:e.connectionStatus,ready:e.ready,capabilities:{aiSessionTimeline:e.capabilities.features.aiSessionTimeline,aiSessionConversationAttachments:e.capabilities.features.aiSessionConversationAttachments,aiSessionProviders:e.capabilities.features.aiSessionProviders,browserTunnel:e.capabilities.features.browserTunnel},config:{defaultCodexPermissionMode:e.config.defaultCodexPermissionMode,aiSessionMaxFileAttachmentBytes:e.config.aiSessionMaxFileAttachmentBytes},modelSelection:e.modelSelection,lastHeartbeatAt:e.lastHeartbeatAt,heartbeatAgeMs:e.heartbeatAgeMs,observedAt:e.updatedAt,runtime:{id:e.runtimeId,name:e.runtime?.name,type:e.runtime?.type},workspace:{status:e.workspace.status,path:e.workspace.path},protocol:{version:e.protocolVersion,compatible:e.protocolCompatible&&c,warning:d.length?d.join(" "):void 0},aiSessions:e.aiSessions,availableActions:u,availableApps:(e.appInventory?.items||[]).filter(e=>"available"===e.availability).map(e=>({id:e.id,name:e.name,kind:e.kind,supportsCwdSelection:e.capabilities.supportsCwdSelection})),availableAgents:(e.appInventory?.items||[]).filter(t=>"available"===t.availability&&e.capabilities.features.aiSessionProviders.some(e=>e.agent===t.id&&e.actions.create)).map(e=>({id:e.id,name:e.name,kind:e.kind,supportsCwdSelection:e.capabilities.supportsCwdSelection})),error:s})}(e):e),meta:{nodeErrors:xx(e,s.nodeErrors,e=>e.nodeId),nodeStates:xx(e,s.nodeStates,e=>e.nodeId)}}}))}({app:t,service:s,events:a,onInstanceDeleted:y}),function(e,t,n){e.get("/api/nodes/:id/environment-templates",async e=>({data:await t.listEnvironmentTemplates(Lx.parse(e.params).id)})),e.get("/api/nodes/:nodeId/environment-templates/:templateId",async e=>{const n=Mx.parse(e.params);return{data:await t.getEnvironmentTemplate(n.nodeId,n.templateId)}}),e.post("/api/controlled-instances/:id/environment-templates",async(e,i)=>{const s=Lx.parse(e.params).id,a=await t.createEnvironmentTemplate(s,e.body);return n.publish("environment-template.updated",{templateId:a.id,nodeId:a.nodeId,status:a.status}),i.code(201).send({data:a})}),e.delete("/api/nodes/:nodeId/environment-templates/:templateId",async e=>{const i=Mx.parse(e.params),s=await t.deleteEnvironmentTemplate(i.nodeId,i.templateId);return n.publish("environment-template.deleted",s),{data:s}})}(t,s,a),function({app:e,service:t,events:s,appSessionAggregator:a,aiSessionAggregator:o,aiSessionUnread:c,aiSessionAttachments:d,aiSessionAttachmentCache:l}){e.get("/api/app-sessions",async e=>{const n=f.z.object({refresh:f.z.string().optional(),instanceId:f.z.string().trim().min(1).optional(),streamId:f.z.string().trim().min(1).optional(),sinceRevision:f.z.string().optional()}).parse(e.query||{});if(n.instanceId&&await _x(t,e,n.instanceId),void 0!==n.sinceRevision){const e=Number(n.sinceRevision);if(!Number.isInteger(e)||e<0){const e=new Error("sinceRevision must be a non-negative integer.");throw Object.assign(e,{statusCode:400,code:"APP_SESSION_DELTA_INVALID"}),e}if(!n.streamId){const e=new Error("streamId is required with sinceRevision.");throw Object.assign(e,{statusCode:400,code:"APP_SESSION_DELTA_INVALID"}),e}return{data:await a.delta({instanceId:n.instanceId,streamId:n.streamId,sinceRevision:e})}}const i=await a.list({refresh:"true"===n.refresh||"1"===n.refresh,instanceId:n.instanceId}),s=await Ex(t,e);return{data:{...i,instances:i.instances.filter(e=>s.has(e.instanceId)&&(!n.instanceId||e.instanceId===n.instanceId))}}}),e.post("/api/controlled-instances/:id/apps/sessions",async e=>{const n=ox.parse(e.params),i=Hx.parse(e.body),a=await t.launchAppSession(n.id,i.appId,{...i.options,...i.cwdFolderId?{cwdFolderId:i.cwdFolderId}:{}});return s.publish("instance.app-session.launched",{instanceId:n.id,sessionId:"string"==typeof a.id?a.id:void 0,appId:i.appId}),{data:a}}),e.post("/api/controlled-instances/:id/apps/sessions/:sessionId/stop",async e=>{const n=px.parse(e.params),i=await t.stopAppSession(n.id,n.sessionId);return s.publish("instance.app-session.stopped",{instanceId:n.id,sessionId:n.sessionId}),{data:i}}),e.patch("/api/controlled-instances/:id/apps/sessions/:sessionId",async e=>{const n=px.parse(e.params),i=Gx.parse(e.body),a=await t.renameAppSession(n.id,n.sessionId,i.title);return s.publish("instance.app-session.renamed",{instanceId:n.id,sessionId:n.sessionId,title:i.title}),{data:a}}),e.post("/api/controlled-instances/:id/apps/sessions/:sessionId/access",async e=>{const n=px.parse(e.params);Vx.parse(e.body||{});const i=sx(e),s=await t.createAppSessionAccessToken({instanceId:n.id,sessionId:n.sessionId,..."user"===i?.type?{authorization:{userId:i.userId,authorizationRevision:i.authorizationRevision}}:{}});return{data:{mode:s.mode,url:`/apps/access/${s.mode}?token=${encodeURIComponent(s.token)}`,token:s.token,expiresAt:s.expiresAt}}}),e.delete("/api/controlled-instances/:id/apps/sessions/:sessionId/access",async e=>{const n=px.parse(e.params),i=Wx.parse(e.body||{});return t.revokeAppSessionAccessToken(i.token,{instanceId:n.id,sessionId:n.sessionId}),{data:{revoked:!0}}}),e.get("/api/controlled-instances/:id/app-sessions",async e=>{const t=ox.parse(e.params),n=(await a.list()).instances.find(e=>e.instanceId===t.id);return{data:n?.appSessions||{runningCount:0,problemCount:0,sessions:[],updatedAt:(new Date).toISOString()}}}),e.get("/api/controlled-instances/:id/ai-sessions/history",async e=>{const n=ox.parse(e.params),i=e.query.agents?.split(",").map(e=>e.trim()).filter(Boolean);return{data:await t.listAiSessionHistory(n.id,i)}}),e.get("/api/controlled-instances/:id/ai-sessions/history/:sessionId",async e=>{const n=px.parse(e.params);return{data:await t.getAiSessionHistoryDetail(n.id,n.sessionId)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId",async e=>{const n=px.parse(e.params),i=Fx.parse(e.query||{});return{data:await t.getAiSessionDetail(n.id,n.sessionId,i.revision)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/turns",async e=>{const n=px.parse(e.params),i=Fx.parse(e.query||{});return{data:await t.getAiSessionTurnIndex(n.id,n.sessionId,i.revision)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/turns/:turnId",async e=>{const n=ux.parse(e.params),i=Fx.parse(e.query||{});return{data:await t.getAiSessionTurnBody(n.id,n.sessionId,n.turnId,i.revision)}}),e.post("/api/controlled-instances/:id/ai-session-attachments/drafts",{bodyLimit:22020096},async(e,n)=>{const s=ox.parse(e.params),a=Cn.parse(e.query),o=(await t.requireControlledInstance(s.id,!0)).config.aiSessionMaxFileAttachmentBytes??fn;if("file"===a.kind&&a.size>=o)throw Object.assign(new Error(`File attachment must be smaller than ${o} bytes.`),{statusCode:413,code:"AI_SESSION_ATTACHMENTS_TOO_LARGE"});const r=`cia_${i.randomUUID().replace(/-/g,"").slice(0,24)}`,c="/api/ai-session-attachments/draft-streams",p=new AbortController,u=()=>p.abort();e.raw.once("aborted",u),n.raw.once("close",u);const m=l.beginBestEffortWrite({instanceId:s.id,scopeType:a.scopeType,scopeId:a.scopeId,attachmentId:r,kind:a.kind,name:a.name,mime:a.mime,size:a.size,cacheUntil:Date.now()+864e5});let h=0;try{const i=Xx(jn,await Yx(await t.proxyInstanceHttp(s.id,c,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(On.parse({attachmentId:r,...a})),signal:p.signal})),"start");if(i.attachmentId!==r||0!==i.offset)throw Object.assign(new Error("Controlled instance returned an invalid attachment upload offset."),{statusCode:502,code:"AI_SESSION_ATTACHMENT_OFFSET_MISMATCH"});for await(const n of e.body){const e=Buffer.isBuffer(n)?n:Buffer.from(n);for(let n=0;n<e.length;n+=vn){const i=e.subarray(n,Math.min(n+vn,e.length));m?.offer(i);const a=Xx(jn,await Yx(await t.proxyInstanceHttp(s.id,`${c}/${encodeURIComponent(r)}?offset=${h}`,{method:"PUT",headers:{"content-type":"application/octet-stream","content-length":String(i.length)},body:i,signal:p.signal})),"chunk"),o=h+i.length;if(a.attachmentId!==r||a.offset!==o)throw Object.assign(new Error("Controlled instance returned an invalid attachment upload offset."),{statusCode:502,code:"AI_SESSION_ATTACHMENT_OFFSET_MISMATCH"});h=a.offset}}const o=Xx(Pn,await Yx(await t.proxyInstanceHttp(s.id,`${c}/${encodeURIComponent(r)}/complete`,{method:"POST",headers:{"content-type":"application/json"},body:"{}",signal:p.signal})),"completion");return m?.finish(),n.code(201).send({data:o})}catch(i){if(m?.abort(),t.proxyInstanceHttp(s.id,`${c}/${encodeURIComponent(r)}`,{method:"DELETE"}).catch(()=>{}),0===h&&i&&"object"==typeof i&&"statusCode"in i&&404===i.statusCode&&(!("code"in i)||"AI_SESSION_NOT_FOUND"!==i.code)){const t=[];let i=0;for await(const n of e.body){const e=Buffer.isBuffer(n)?n:Buffer.from(n);if(i+=e.length,i>a.size)throw Object.assign(new Error("Attachment content exceeded its declared size."),{statusCode:400,code:"AI_SESSION_ATTACHMENT_SIZE_MISMATCH"});t.push(e)}if(i!==a.size)throw Object.assign(new Error("Attachment content did not match its declared size."),{statusCode:400,code:"AI_SESSION_ATTACHMENT_SIZE_MISMATCH"});return n.code(201).send({data:d.upload({instanceId:s.id,sessionId:a.scopeId,kind:a.kind,name:a.name,mime:a.mime,data:Buffer.concat(t).toString("base64")})})}throw i}finally{e.raw.off("aborted",u),n.raw.off("close",u)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/messages/:messageId/attachments/:attachmentId/content",async(e,i)=>{const s=mx.parse(e.params),a=l.get({instanceId:s.id,sessionId:s.sessionId,messageId:s.messageId,attachmentId:s.attachmentId});if(a)return i.header("Content-Type",a.mime),i.header("Content-Length",String(a.size)),a.etag&&i.header("ETag",a.etag),i.header("Cache-Control","private, max-age=0, must-revalidate"),i.header("X-Content-Type-Options","nosniff"),i.header("Accept-Ranges","none"),i.header("Content-Disposition",a.disposition||`${"image"===a.kind?"inline":"attachment"}; filename*=UTF-8''${encodeURIComponent(a.name)}`),a.etag&&e.headers["if-none-match"]===a.etag?i.code(304).send():i.send(n.createReadStream(a.path));const o=new AbortController;i.raw.once("close",()=>o.abort());const c=await t.proxyInstanceHttp(s.id,`/api/ai-sessions/${encodeURIComponent(s.sessionId)}/messages/${encodeURIComponent(s.messageId)}/attachments/${encodeURIComponent(s.attachmentId)}/content`,{method:"GET",signal:o.signal}),d=c.headers["x-task-handoff-attachment-cache-until"],p=c.headers["x-task-handoff-attachment-size"];for(const[e,t]of Object.entries(c.headers))["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","x-task-handoff-attachment-cache-until","x-task-handoff-attachment-size"].includes(e.toLowerCase())||i.header(e,t);if(!c.body)return i.code(c.status).send();const u=r.Readable.fromWeb(c.body),m=Number(p||c.headers["content-length"]);200===c.status&&Number.isInteger(m)&&m>0&&i.header("Content-Length",String(m));const h=Number(d),g=c.headers["content-type"]||"application/octet-stream",f=c.headers["content-disposition"],y=200===c.status&&Number.isInteger(m)&&m>0&&Number.isFinite(h)?l.beginBestEffortWrite({instanceId:s.id,scopeType:"session",scopeId:s.sessionId,attachmentId:s.attachmentId,sessionId:s.sessionId,messageId:s.messageId,kind:Dn(g)?"image":"file",name:Kx(f,s.attachmentId),mime:g,size:m,...f?{disposition:f}:{},...c.headers.etag?{etag:c.headers.etag}:{},cacheUntil:h}):void 0,b=new r.Transform({transform(e,t,n){y?.offer(e),n(null,e)},flush(e){y?.finish(),e()}});return i.raw.once("close",()=>{u.destroy(),u.readableEnded||y?.abort()}),i.code(c.status).send(u.pipe(b))}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/timeline",async e=>{const n=px.parse(e.params);return{data:await t.getAiSessionTimeline(n.id,n.sessionId)}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/turns/:turnId/timeline",async e=>{const n=ux.parse(e.params);return{data:await t.getAiSessionTurnTimeline(n.id,n.sessionId,n.turnId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/resume",async e=>{const n=px.parse(e.params);Vx.parse(e.body||{});const i=await t.resumeAiSession(n.id,n.sessionId);return s.publish("instance.ai-session.resumed",{instanceId:n.id,sessionId:i.aiSessionId,providerSessionId:i.providerSessionId,appSessionId:i.appSessionId,disposition:i.disposition}),{data:i}}),e.get("/api/controlled-instances/:id/ai-sessions/workspace",async e=>{const n=ox.parse(e.params),i=Bx.parse(e.query||{});return{data:await t.inspectAiSessionWorkspace(n.id,i.cwdFolderId)}}),e.post("/api/controlled-instances/:id/ai-sessions",async e=>{const n=ox.parse(e.params),i=Ni.parse(e.body||{}),a=i.attachments.filter(e=>"upload-ref"!==e.source.type||!e.id.startsWith("cia_")),o=d.resolveRefs(a,n.id,i.clientRequestId),r=new Map(o.map(e=>[e.id,e])),c=i.attachments.map(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")?e:r.get(e.id)).filter(Boolean),p=await t.createAiSession(n.id,{...i,attachments:c}),u=new Set(i.attachments.filter(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")).map(e=>e.id));if(u.size){const e=(await t.requireControlledInstance(n.id,!0)).config.aiSessionAttachmentRetentionDays??30;t.getAiSessionTurnIndex(n.id,p.aiSessionId).then(async s=>{if("updated"!==s.kind)return;const a=s.index.turns.at(-1);if(!a)return;const o=await t.getAiSessionTurnBody(n.id,p.aiSessionId,a.id);if("updated"!==o.kind)return;const r=o.body.turn.userMessages?.find(e=>e.attachments.some(e=>u.has(e.id)))?.id;if(r)for(const t of u)l.bind({instanceId:n.id,attachmentId:t,scopeId:i.clientRequestId,sessionId:p.aiSessionId,messageId:r,cacheUntil:Date.now()+24*e*60*60*1e3})}).catch(()=>{})}return s.publish("instance.ai-session.created",{instanceId:n.id,sessionId:p.aiSessionId,providerSessionId:p.providerSessionId,clientRequestId:i.clientRequestId}),{data:p}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/open-app",async e=>{const n=px.parse(e.params),i=qi.parse(e.body||{}),a=await t.openAiSessionApp(n.id,n.sessionId,i.clientRequestId);return s.publish("instance.ai-session.app-opened",{instanceId:n.id,sessionId:n.sessionId,appSessionId:a.appSessionId}),{data:a}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/fork",async e=>{const n=px.parse(e.params),i=Li.parse(e.body||{}),a=await t.forkAiSession(n.id,n.sessionId,i);return s.publish("instance.ai-session.forked",{instanceId:n.id,sourceSessionId:n.sessionId,sessionId:a.aiSessionId,providerSessionId:a.providerSessionId,clientRequestId:i.clientRequestId}),{data:a}}),e.put("/api/controlled-instances/:id/ai-sessions/:sessionId/model-selection",async e=>{const n=px.parse(e.params),i=Ci.parse(e.body||{});return{data:await t.updateAiSessionModelSelection(n.id,n.sessionId,i.clientRequestId,i.modelSelection)}}),e.put("/api/controlled-instances/:id/ai-sessions/:sessionId/reasoning-effort",async e=>{const n=px.parse(e.params),i=Oi.parse(e.body||{});return{data:await t.updateAiSessionReasoningEffort(n.id,n.sessionId,i.clientRequestId,i.reasoningEffort)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/close",async e=>{const n=px.parse(e.params),i=$i.parse(e.body||{}),a=await t.closeAiSession(n.id,n.sessionId,i.clientRequestId);return s.publish("instance.ai-session.closed",{instanceId:n.id,sessionId:n.sessionId,providerSessionId:a.providerSessionId}),{data:a}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/messages",async(e,n)=>{const i=performance.now(),a=function(e,t){const n=Array.isArray(e)?e[0]:e,i="string"==typeof n?n.trim():"";return/^[A-Za-z0-9._:-]{1,128}$/.test(i)?i:t}(e.headers[Au],String(e.id));let o;const r=t=>{const s=performance.now()-i,r=_u(o?.serverTiming,Eu("control_plane",s));n.header(Au,a),n.header("server-timing",r),e.log.info({traceId:a,instanceId:e.params.id,sessionId:e.params.sessionId,outcome:t,controlPlaneMs:s,nodeTransportMs:o?.nodeTransportMs,serverTiming:r},"AI session message request timing")},c=px.parse(e.params),p=Ai.parse(e.body||{}),u=p.attachments.filter(e=>"upload-ref"!==e.source.type||!e.id.startsWith("cia_")),m=d.resolveRefs(u,c.id,c.sessionId),h=new Map(m.map(e=>[e.id,e])),g=p.attachments.map(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")?e:h.get(e.id)).filter(Boolean);let f;try{f=await t.sendAiSessionMessage(c.id,c.sessionId,p.message,p.mode,g,p.references,p.permissionMode,{traceId:a,onTiming:e=>{o=e}})}catch(e){throw r("failed"),e}const y=new Set(p.attachments.filter(e=>"upload-ref"===e.source.type&&e.id.startsWith("cia_")).map(e=>e.id)),b=f.messageId;if(y.size&&b){const e=(await t.requireControlledInstance(c.id,!0)).config.aiSessionAttachmentRetentionDays??30,n=Date.now()+24*e*60*60*1e3;for(const e of y)l.bind({instanceId:c.id,attachmentId:e,scopeId:c.sessionId,sessionId:c.sessionId,messageId:b,cacheUntil:n})}return s.publish("instance.ai-session.message-sent",{instanceId:c.id,sessionId:c.sessionId}),r("completed"),{data:f}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/mentions",async e=>{const n=px.parse(e.params);return{data:await t.aiSessionMentionCatalog(n.id,n.sessionId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/mentions/files",async e=>{const n=px.parse(e.params),i=Ii.parse(e.body||{});return{data:await t.searchAiSessionMentionFiles(n.id,n.sessionId,i.query)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/commands",async e=>{const n=px.parse(e.params),i=pi.parse(e.body||{}),a=await t.executeAiSessionCommand(n.id,n.sessionId,i);return s.publish("instance.ai-session.command-executed",{instanceId:n.id,sessionId:n.sessionId,command:i.command}),{data:a}}),e.get("/api/controlled-instances/:id/ai-sessions/:sessionId/queue",async e=>{const n=px.parse(e.params);return{data:await t.aiSessionQueue(n.id,n.sessionId)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId/steer",async e=>{const n=hx.parse(e.params),i=await t.steerAiSessionQueuedMessage(n.id,n.sessionId,n.queueId);return s.publish("instance.ai-session.message-sent",{instanceId:n.id,sessionId:n.sessionId}),{data:i}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId/retry",async e=>{const n=hx.parse(e.params);return{data:await t.retryAiSessionQueuedMessage(n.id,n.sessionId,n.queueId)}}),e.delete("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId",async e=>{const n=hx.parse(e.params);return{data:await t.removeAiSessionQueuedMessage(n.id,n.sessionId,n.queueId)}}),e.patch("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/:queueId",async e=>{const n=hx.parse(e.params),i=Gi.parse(e.body||{});return{data:await t.editAiSessionQueuedMessage(n.id,n.sessionId,n.queueId,i)}}),e.patch("/api/controlled-instances/:id/ai-sessions/:sessionId/queue/reorder",async e=>{const n=px.parse(e.params),i=Hi.parse(e.body||{});return{data:await t.reorderAiSessionQueuedMessages(n.id,n.sessionId,i)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/interrupt",async e=>{const n=px.parse(e.params),i=await t.interruptAiSession(n.id,n.sessionId);return s.publish("instance.ai-session.interrupted",{instanceId:n.id,sessionId:n.sessionId}),{data:i}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/approval",async e=>{const n=px.parse(e.params),i=Fi.parse(e.body||{}),a=await t.resolveAiSessionApproval(n.id,n.sessionId,i.decision);return s.publish("instance.ai-session.approval-resolved",{instanceId:n.id,sessionId:n.sessionId,decision:i.decision}),{data:a}}),e.get("/api/ai-sessions",async(e,n)=>{const i=e.query;if(i.instanceId&&await _x(t,e,i.instanceId),void 0!==i.sinceRevision){const e=Number(i.sinceRevision);if(!Number.isInteger(e)||e<0)return n.code(400).send({error:"invalid_since_revision"});try{return i.streamId?{data:await o.delta({instanceId:i.instanceId,streamId:i.streamId,sinceRevision:e})}:n.code(400).send({error:"stream_id_required"})}catch(e){if("AI_SESSION_DELTA_INSTANCE_ID_REQUIRED"===e.message)return n.code(400).send({error:"instance_id_required"});throw e}}const s=await o.list({refresh:"true"===i.refresh||"1"===i.refresh,instanceId:i.instanceId}),a=await Ex(t,e),r={...s,instances:s.instances.filter(e=>a.has(e.instanceId)&&(!i.instanceId||e.instanceId===i.instanceId))};for(const e of r.instances)c.reconcile(e.instanceId,e.aiSessions);return{data:{...r,instances:r.instances.map(e=>({...e,aiSessions:c.decorate(e.instanceId,e.aiSessions)}))}}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/read",async(e,t)=>{const n=px.parse(e.params),i=f.z.object({sessionUpdatedAt:f.z.string().datetime()}).strict().parse(e.body||{}),a=(await o.list()).instances.find(e=>e.instanceId===n.id),r=a?.aiSessions.sessions.find(e=>e.id===n.sessionId);if(!a||!r)return t.code(404).send({error:{code:"AI_SESSION_NOT_FOUND",message:"AI session was not found."}});c.reconcile(n.id,a.aiSessions);const d=c.markRead(n.id,n.sessionId,i.sessionUpdatedAt);return d?(s.publish(_n,d,{topic:"ai.sessions",scope:{instanceId:n.id,sessionId:n.sessionId}}),{data:d}):t.code(404).send({error:{code:"AI_SESSION_NOT_FOUND",message:"AI session was not found."}})})}({app:t,service:s,events:a,appSessionAggregator:o,aiSessionAggregator:c,aiSessionUnread:d,aiSessionAttachments:p,aiSessionAttachmentCache:u}),function({app:e,service:t,events:n}){e.get("/api/triggers",async()=>({data:await t.listTriggers()})),e.post("/api/triggers",async(e,i)=>{const s=t.createTrigger(e.body);return n.publish("trigger.created",{configHash:s.configHash}),i.code(201).send({data:s})}),e.put("/api/triggers/:configHash",async e=>{const i=gx.parse(e.params),s=await t.updateTrigger(i.configHash,e.body);return n.publish("trigger.updated",{previousConfigHash:i.configHash,configHash:s.trigger.configHash}),{data:s}}),e.delete("/api/triggers/:configHash",async e=>{const i=gx.parse(e.params),s=await t.deleteTrigger(i.configHash);return n.publish("trigger.deleted",{configHash:i.configHash}),{data:s}}),e.post("/api/triggers/:configHash/apply",async e=>{const i=gx.parse(e.params),s=await t.applyTrigger(i.configHash,e.body||{});return n.publish("trigger.applied",{configHash:i.configHash}),{data:s}}),e.get("/api/controlled-instances/:id/triggers",async e=>{const n=ox.parse(e.params);return{data:await t.listInstanceTriggers(n.id)}}),e.post("/api/controlled-instances/:id/ai-sessions/:sessionId/triggers",async e=>{const i=px.parse(e.params),s=await t.bindAiSessionTrigger(i.id,i.sessionId,e.body||{});return n.publish("trigger.deployment.bound",{instanceId:i.id,sessionId:i.sessionId,mutation:s},{topic:"triggers",scope:{instanceId:i.id}}),{data:s}}),e.delete("/api/controlled-instances/:id/ai-sessions/:sessionId/triggers/:configHash",async e=>{const i=yx.parse(e.params),s=await t.unbindAiSessionTrigger(i.id,i.sessionId,i.configHash);return n.publish("trigger.deployment.unbound",{instanceId:i.id,sessionId:i.sessionId,configHash:i.configHash},{topic:"triggers",scope:{instanceId:i.id}}),{data:s}}),e.post("/api/controlled-instances/:id/triggers/:configHash/run",async e=>{const i=fx.parse(e.params),s=await t.runInstanceTrigger(i.id,i.configHash,e.body||{});return n.publish("trigger.run.requested",{instanceId:i.id,configHash:i.configHash},{topic:"triggers",scope:{instanceId:i.id}}),{data:s}})}({app:t,service:s,events:a}),function({app:e,service:t,chatGateway:n}){e.get("/api/chat/sessions",async()=>({data:t.listChatSessions()})),e.get("/api/chat/sessions/:id",async e=>({data:t.requireChatSession(ox.parse(e.params).id)})),e.get("/api/chat-gateway/status",async()=>({data:n.status()})),e.post("/api/chat-gateway/poll-ai-sessions",async()=>({data:await n.pollAiSessionsNow()})),e.get("/api/chat-gateway/bridges",async()=>({data:t.listChatBridges()})),e.post("/api/chat-gateway/bridges",async e=>({data:t.createChatBridge(e.body)})),e.patch("/api/chat-gateway/bridges/:id",async i=>{const s=ox.parse(i.params).id,a=t.requireChatBridge(s),o=ag.parse(i.body),r=t.updateChatBridge(s,i.body),c="boolean"==typeof o.enabled?o.enabled:void 0;return e.log.info({component:"control-plane-chat-gateway",action:"bridge-patch",bridgeId:s,hasEnabled:void 0!==c,requestedEnabled:c,previousEnabled:a.enabled,updatedEnabled:t.requireChatBridge(s).enabled},"chat gateway bridge state changed"),void 0!==c&&c!==a.enabled&&(c?n.startBridge(s):n.stopBridge(s)),{data:r}}),e.post("/api/chat-gateway/bridges/:id/start",async i=>{const s=ox.parse(i.params).id,a=t.requireChatBridge(s);return t.updateChatBridge(s,{enabled:!0}),e.log.info({component:"control-plane-chat-gateway",action:"bridge-start-request",bridgeId:s,previousEnabled:a.enabled,updatedEnabled:t.requireChatBridge(s).enabled},"chat gateway bridge state changed"),{data:n.startBridge(s)}}),e.post("/api/chat-gateway/bridges/:id/stop",async i=>{const s=ox.parse(i.params).id,a=t.requireChatBridge(s);return t.updateChatBridge(s,{enabled:!1}),e.log.info({component:"control-plane-chat-gateway",action:"bridge-stop-request",bridgeId:s,previousEnabled:a.enabled,updatedEnabled:t.requireChatBridge(s).enabled},"chat gateway bridge state changed"),{data:n.stopBridge(s)}}),e.delete("/api/chat-gateway/bridges/:id",async e=>{const i=ox.parse(e.params).id;return n.stopBridge(i),{data:{deleted:t.deleteChatBridge(i)}}}),e.post("/api/chat-gateway/messages",{bodyLimit:67108864},async e=>({data:await t.handleChatGatewayMessage(Fd.parse(e.body))})),e.post("/api/chat-gateway/actions",async e=>({data:await t.handleChatGatewayAction(Rx(e.body))})),e.get("/api/pending-routes",async()=>({data:await t.listPendingRoutes()}))}({app:t,service:s,chatGateway:l})}const Qx=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function Zx(e){const t=Object.entries(e).find(([e])=>"sec-websocket-protocol"===e.toLowerCase()),n=t?.[1],i=(Array.isArray(n)?n.join(","):"string"==typeof n?n:"").split(",").map(e=>e.trim()).filter(Boolean);return i.length?i:void 0}const ew=new Set(["content-encoding"]),tw=new Set(["host",...mn]);function nw(e){return Object.fromEntries(Object.entries(e).flatMap(([e,t])=>{const n=e.toLowerCase();if(Qx.has(n)||"authorization"===n||void 0===t)return[];const i=Array.isArray(t)?t.join(", "):String(t);if("cookie"!==n)return[[e,i]];const s=function(e){return e.split(";").map(e=>e.trim()).filter(e=>e&&e.slice(0,e.indexOf("=")).trim()!==mu).join("; ")}(i);return s?[[e,s]]:[]}))}function iw(e){return function(e,t={}){return Object.fromEntries(Object.entries(e).flatMap(([e,n])=>{const i=e.toLowerCase();return void 0===n||t.blockedHeaders?.has(i)||i.startsWith("sec-websocket-")&&"sec-websocket-origin"!==i?[]:[[e,Array.isArray(n)?n.join(", "):String(n)]]}))}(nw(e),{blockedHeaders:tw})}function sw(e,t,n,i,s={}){const a=new AbortController;return t.raw.once("close",()=>a.abort()),e.proxyInstanceHttp(n,i,{...s,signal:a.signal})}function aw(e,t,n){for(const[n,i]of Object.entries(t.headers)){const t=n.toLowerCase();Qx.has(t)||ew.has(t)||e.header(n,i)}if(!t.body)return e.code(t.status).send();const i=r.Readable.fromWeb(t.body);return e.raw.once("close",()=>i.destroy()),e.code(t.status).send(n?i.pipe(n):i)}function ow(e){return`/instances/${encodeURIComponent(e)}`}function rw(e,t,n,i){const s=function(e,t){const n=e.split("?",1)[0]||"/";return t.toLowerCase().includes("text/html")&&!n.startsWith("/api/")}(i,Object.entries(t.headers).find(([e])=>"content-type"===e.toLowerCase())?.[1]||"")?function(e){const t=[];let n=0,i=!1;const s=(s,a=!1)=>{if(i)return;const o=Buffer.concat(t,n).toString("utf8");!/<head(\s[^>]*)?>/i.exec(o)&&!a&&n<65536||(i=!0,s.push(function(e,t){if(e.includes("__TASK_HANDOFF_PUBLIC_BASE__"))return e;const n=`<script>window.__TASK_HANDOFF_PUBLIC_BASE__=${JSON.stringify(t)};<\/script>`;return/<head(\s[^>]*)?>/i.test(e)?e.replace(/<head(\s[^>]*)?>/i,e=>`${e}\n${n}`):`${n}\n${e}`}(o,e)),t.length=0,n=0)};return new r.Transform({transform(e,a,o){i?this.push(e):(t.push(Buffer.from(e)),n+=e.length,s(this)),o()},flush(e){s(this,!0),e()}})}(ow(n)):void 0;return aw(e,t,s)}async function cw(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(e instanceof URLSearchParams)return e.toString();if(e&&"object"==typeof e&&Symbol.asyncIterator in e){const t=[];let n=0;for await(const i of e){const e=Buffer.isBuffer(i)?i:Buffer.from(i);if(n+=e.length,n>67108864)throw Object.assign(new Error("Instance proxy request body exceeds the configured limit."),{statusCode:413,code:"INSTANCE_PROXY_REQUEST_TOO_LARGE"});t.push(e)}return Buffer.concat(t,n)}return"string"==typeof e?e:null==e?void 0:JSON.stringify(e)}function dw(e,t){if("string"!=typeof t||!e.hasContentTypeParser(t))try{e.addContentTypeParser(t,{parseAs:"buffer"},(e,t,n)=>n(null,t))}catch(e){if(e instanceof Error&&/Content type parser .* already present/i.test(e.message))return;throw e}}function lw(e){return new URL(e,"http://control-plane.local").searchParams.get("token")||""}function pw(e,t,n){const i=encodeURIComponent(e),s=encodeURIComponent(t),a=`apps/access/vnc/${i}/proxy`,o=n.vnc&&"object"==typeof n.vnc?n.vnc:{};return"kasmvnc"===("string"==typeof o.backend?o.backend:"")?`/${a}/api/apps/sessions/${s}/web/`:`/${a}/api/novnc/vnc.html?path=${encodeURIComponent(`${a}/api/apps/sessions/${s}/vnc`)}&autoconnect=1&resize=scale`}class uw{snapshots=new Map;history=new Map;advertisedStreams=new Map;recoveries=new Map;listeners=new Set;bootstrap;logger;recoverDelta;recoverSnapshot;onRecoveredEvent;recoveryCount=0;counters={streamResets:0,gaps:0,deltaRecoveries:0,snapshotRecoveries:0,recoveryFailures:0};constructor(e){this.bootstrap=e.bootstrap,this.logger=e.logger,this.recoverDelta=e.recoverDelta,this.recoverSnapshot=e.recoverSnapshot,this.onRecoveredEvent=e.onRecoveredEvent}handleEvent(e){if(e.type===An||e.type===En){const t=Pl(e.type===An?zs:Ns,e.payload);return!!t.success||(this.logger?.warn?.({eventType:e.type,issues:t.error.issues,errorCode:"AI_SESSION_TRANSIENT_EVENT_INVALID"},"ai-session.aggregator.transient-event.invalid"),!1)}const t=e.type===xn?Es:e.type===wn?_s:e.type===Sn?Ts:void 0;if(!t)return!1;const n=Pl(t,e.payload);return n.success?e.type===xn?this.applySnapshot(n.data):e.type===wn?this.applyPatch(n.data):this.applyRemoved(n.data):(this.logger?.warn?.({eventType:e.type,issues:n.error.issues,errorCode:"AI_SESSION_EVENT_INVALID"},"ai-session.aggregator.event.invalid"),!1)}onSnapshot(e){return this.listeners.add(e),()=>this.listeners.delete(e)}applySnapshot(e){const t=this.advertisedStreams.get(e.meta.instanceId)?.streamId;return t&&t!==e.meta.streamId?(this.logger?.warn?.({instanceId:e.meta.instanceId,advertisedStreamId:t,streamId:e.meta.streamId,revision:e.meta.revision},"ai-session.aggregator.snapshot.obsolete-stream"),!1):this.apply({type:xn,payload:e})}advertiseStream(e,t){return this.advertisedStreams.set(e,t),this.recoverStream(e,t.streamId,t.latestRevision).catch(n=>{this.counters.recoveryFailures+=1,this.logger?.warn?.({instanceId:e,streamId:t.streamId,error:n instanceof Error?n.message:String(n)},"ai-session.aggregator.recovery.failed")})}diagnostics(){return{...this.counters,recoveriesStarted:this.recoveryCount,activeRecoveries:this.recoveries.size}}removeInstance(e){this.snapshots.delete(e),this.history.delete(e),this.advertisedStreams.delete(e)}applyPatch(e){return this.apply({type:wn,payload:e})}applyRemoved(e){return this.apply({type:Sn,payload:e})}async list(e={}){return e.refresh&&e.instanceId&&this.recoverSnapshot?await this.refreshInstance(e.instanceId):(e.refresh||0===this.snapshots.size)&&await this.bootstrapFromInstances(),this.view(e.instanceId)}async streamDescriptors(){return 0===this.snapshots.size&&await this.bootstrapFromInstances(),[...this.snapshots.entries()].map(([e,t])=>({topic:"ai.sessions",instanceId:e,streamId:t.streamId,latestRevision:t.revision,earliestRetainedRevision:this.history.get(e)?.[0]?.payload.meta.revision??t.revision+1}))}async delta(e){0===this.snapshots.size&&await this.bootstrapFromInstances();const t=this.resolveDeltaInstanceId(e.instanceId);this.pruneHistory(t);const n=this.snapshots.get(t)?.revision??0,i=this.snapshots.get(t)?.streamId||"unavailable",s=this.history.get(t)?.[0]?.payload.meta.revision??n+1;if(e.streamId!==i||e.sinceRevision>n)return Cs.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:!0,events:[]});if(e.sinceRevision===n)return Cs.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:!1,events:[]});const a=(this.history.get(t)??[]).filter(t=>t.payload.meta.revision>e.sinceRevision),o=!a.length||a[0].payload.meta.revision!==e.sinceRevision+1;return Cs.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:o,events:o?[]:a.map(({type:e,payload:t})=>({type:e,payload:t}))})}apply(e,t=!1){const{meta:n}=e.payload,i=this.advertisedStreams.get(n.instanceId)?.streamId;if(i&&i!==n.streamId)return this.logger?.warn?.({instanceId:n.instanceId,advertisedStreamId:i,streamId:n.streamId,revision:n.revision},"ai-session.aggregator.event.obsolete-stream"),!1;const s=this.recoveries.get(n.instanceId);if(s&&!t)return s.streamId===n.streamId&&(s.highWater=Math.max(s.highWater,n.revision)),!1;const a=this.snapshots.get(n.instanceId);e.type===xn&&a&&a.streamId!==n.streamId&&(this.counters.streamResets+=1,this.logger?.info?.({instanceId:n.instanceId,previousStreamId:a.streamId,streamId:n.streamId,previousRevision:a.revision,revision:n.revision,traceId:n.traceId,resetCount:this.counters.streamResets},"ai-session.aggregator.stream-reset"));const o=function(e,t){const{meta:n}=t.payload;if(t.type===xn)return e?.streamId===n.streamId&&n.revision===e.revision?{kind:"duplicate",projection:e}:e?.streamId===n.streamId&&n.revision<e.revision?{kind:"stale",projection:e}:{kind:"applied",projection:Is.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:t.payload.snapshot})};if(!e||e.streamId!==n.streamId)return{kind:"snapshot-required",projection:e,streamId:n.streamId};if(n.revision===e.revision)return{kind:"duplicate",projection:e};if(n.revision<e.revision)return{kind:"stale",projection:e};if(n.revision!==e.revision+1||n.previousRevision!==e.revision)return{kind:"gap",projection:e,expectedRevision:e.revision+1,receivedRevision:n.revision};const i=new Map(e.snapshot.sessions.map(e=>[e.id,e]));if(t.type===wn){for(const e of t.payload.upserted)i.set(e.id,e);for(const e of t.payload.removed)i.delete(e)}else for(const e of t.payload.sessionIds)i.delete(e);const s=[...i.values()],a=vs.parse({runningCount:s.filter(e=>"running"===e.status).length,waitingCount:s.filter(e=>"waiting"===e.status).length,staleCount:e.snapshot.staleCount,sessions:s,updatedAt:n.generatedAt});return{kind:"applied",projection:Is.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:a})}}(a,e);if("applied"!==o.kind)return this.logger?.warn?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,currentRevision:a?.revision,revision:n.revision,outcome:o.kind},`ai-session.aggregator.event.${o.kind}`),"gap"!==o.kind&&"snapshot-required"!==o.kind||("gap"===o.kind&&(this.counters.gaps+=1),this.recoverStream(n.instanceId,n.streamId,n.revision).catch(e=>{this.logger?.warn?.({instanceId:n.instanceId,streamId:n.streamId,revision:n.revision,error:e instanceof Error?e.message:String(e)},"ai-session.aggregator.recovery.failed")})),!1;const r=o.projection;this.snapshots.set(n.instanceId,r),this.rememberEvent(n.instanceId,e);const c={instanceId:n.instanceId,streamId:r.streamId,aiSessions:r.snapshot,revision:r.revision,lastEventAt:r.lastEventAt};for(const e of this.listeners)try{e(c)}catch{this.listeners.delete(e)}return this.logger?.info?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,reason:n.reason,sessionCount:r.snapshot.sessions.length},"ai-session.aggregator.event.accepted"),!0}async bootstrapFromInstances(){this.logger?.info?.({},"ai-session.aggregator.bootstrap");const e=new Map(this.snapshots),t=await this.bootstrap(),n=new Set(t.instances.map(e=>e.instanceId));for(const[t,i]of e)n.has(t)||this.snapshots.get(t)!==i||(this.snapshots.delete(t),this.history.delete(t),this.advertisedStreams.delete(t));for(const n of t.instances){const t=this.snapshots.get(n.instanceId);if(t!==e.get(n.instanceId))continue;const i=this.advertisedStreams.get(n.instanceId)?.streamId;if(i&&i!==n.streamId)continue;if(t?.streamId===n.streamId&&t.revision>=n.revision)continue;const s={type:xn,payload:{meta:{streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,traceId:`ais_bootstrap_${Date.now().toString(36)}`,generatedAt:n.lastEventAt,reason:"startup"},snapshot:n.aiSessions}};this.apply(s)&&this.onRecoveredEvent?.(s)}}async refreshInstance(e){const t=this.snapshots.get(e),n=await this.recoverSnapshot(e);if(this.snapshots.get(e)!==t)return;const i=this.advertisedStreams.get(e)?.streamId;if(i&&i!==n.streamId)return;if(t?.streamId===n.streamId&&t.revision>=n.revision)return;const s={type:xn,payload:{meta:{streamId:n.streamId,instanceId:e,revision:n.revision,traceId:`ais_refresh_${Date.now().toString(36)}`,generatedAt:n.lastEventAt,reason:"startup"},snapshot:n.snapshot}};this.apply(s)&&this.onRecoveredEvent?.(s)}recoverStream(e,t,n){const i=this.recoveries.get(e);if(i)return i.streamId===t?i.highWater=Math.max(i.highWater,n):(i.streamId=t,i.highWater=n),i.promise;if(!this.recoverDelta||!this.recoverSnapshot)return Promise.resolve();const s={promise:Promise.resolve(),streamId:t,highWater:n},a=++this.recoveryCount;return this.logger?.info?.({instanceId:e,highWater:n,recoveryNumber:a},"ai-session.aggregator.recovery.started"),s.promise=(async()=>{for(;;){const t=this.advertisedStreams.get(e);if(!t)return;s.streamId!==t.streamId&&(s.streamId=t.streamId,s.highWater=t.latestRevision);const n=this.snapshots.get(e);if(n&&n.streamId===t.streamId){if(n.revision<Math.max(t.latestRevision,s.highWater)){const t=await this.recoverDelta(e,n.streamId,n.revision);if(this.advertisedStreams.get(e)?.streamId!==t.streamId||s.streamId!==t.streamId)continue;if(t.syncRequired){const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:xn,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`ais_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:a,outcome:"snapshot-fallback"},"ai-session.aggregator.recovery.snapshot")}else{for(const e of t.events)this.apply(e,!0)&&this.onRecoveredEvent?.(e);this.counters.deltaRecoveries+=1,s.highWater=Math.max(s.highWater,t.latestRevision),this.logger?.info?.({instanceId:e,streamId:t.streamId,sinceRevision:t.sinceRevision,latestRevision:t.latestRevision,eventCount:t.events.length,recoveryNumber:a,outcome:"delta"},"ai-session.aggregator.recovery.delta")}}}else{const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:xn,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`ais_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:a,outcome:"snapshot"},"ai-session.aggregator.recovery.snapshot")}const i=this.snapshots.get(e),o=this.advertisedStreams.get(e);if(i&&o&&i.streamId===o.streamId&&i.revision>=Math.max(o.latestRevision,s.highWater))return void this.logger?.info?.({instanceId:e,streamId:i.streamId,revision:i.revision,recoveryNumber:a,outcome:"success"},"ai-session.aggregator.recovery.completed")}})().finally(()=>this.recoveries.delete(e)),this.recoveries.set(e,s),s.promise}rememberEvent(e,t){const n=this.history.get(e)??[],i=n.length&&n[0].payload.meta.streamId!==t.payload.meta.streamId?[]:n;i.push({...t,createdAtMs:Date.now()}),this.history.set(e,i),this.pruneHistory(e)}pruneHistory(e){const t=this.history.get(e);if(!t?.length)return;const n=t.filter(e=>e.createdAtMs>=Date.now()-36e5);n.length?this.history.set(e,n):this.history.delete(e)}resolveDeltaInstanceId(e){if(e)return e;const t=[...this.snapshots.keys()];if(1===t.length)return t[0];throw new Error("AI_SESSION_DELTA_INSTANCE_ID_REQUIRED")}view(e){return{updatedAt:(new Date).toISOString(),instances:[...this.snapshots.entries()].filter(([t])=>!e||t===e).map(([e,t])=>({instanceId:e,streamId:t.streamId,aiSessions:t.snapshot,revision:t.revision,lastEventAt:t.lastEventAt}))}}}const mw=f.z.object({id:f.z.string().trim().min(1),instanceId:f.z.string().trim().min(1).max(160),sessionId:f.z.string().trim().min(1).max(120),unread:f.z.boolean(),lastStatus:f.z.enum(["running","waiting","idle","failed"]),sessionUpdatedAt:f.z.string().datetime(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict();class hw{records;bySession=new Map;listener;constructor(e,t={}){this.records=new wl(e.aiSessionUnreadDir,{schema:mw}),this.listener=t.onChanged}init(){this.records.init(),this.bySession.clear();for(const e of this.records.list())this.bySession.set(fw(e.instanceId,e.sessionId),e)}reconcile(e,t){const n=new Set;for(const i of t.sessions)n.add(i.id),this.reconcileSession(e,i);for(const t of[...this.bySession.values()])t.instanceId!==e||n.has(t.sessionId)||this.deleteRecord(t)}decorate(e,t){return{...t,sessions:t.sessions.map(t=>({...t,unread:this.bySession.get(fw(e,t.id))?.unread||!1}))}}markRead(e,t,n){const i=this.bySession.get(fw(e,t));return i&&i.sessionUpdatedAt===n&&i.unread?gw(this.store({...i,unread:!1,updatedAt:(new Date).toISOString()},!1)):i?gw(i):void 0}removeInstance(e){for(const t of[...this.bySession.values()])t.instanceId===e&&this.deleteRecord(t)}reconcileSession(e,t){const n=fw(e,t.id),i=this.bySession.get(n),s=(new Date).toISOString();if(!i)return void this.store({id:yw(e,t.id),instanceId:e,sessionId:t.id,unread:!1,lastStatus:t.status,sessionUpdatedAt:t.updatedAt,createdAt:s,updatedAt:s},!1);const a=function(e,t,n){return"running"!==n&&"waiting"!==n&&("running"===t||"waiting"===t||e)}(i.unread,i.lastStatus,t.status),o=a!==i.unread;(o||i.lastStatus!==t.status||i.sessionUpdatedAt!==t.updatedAt)&&this.store({...i,unread:a,lastStatus:t.status,sessionUpdatedAt:t.updatedAt,updatedAt:s},o)}store(e,t){const n=this.records.put(e);return this.bySession.set(fw(n.instanceId,n.sessionId),n),t&&this.listener?.(gw(n)),n}deleteRecord(e){this.records.delete(e.id),this.bySession.delete(fw(e.instanceId,e.sessionId))}}function gw(e){return Bn.parse({instanceId:e.instanceId,sessionId:e.sessionId,unread:e.unread,sessionUpdatedAt:e.sessionUpdatedAt,updatedAt:e.updatedAt})}function fw(e,t){return`${e}\0${t}`}function yw(e,t){return`ais_unread_${i.createHash("sha256").update(fw(e,t)).digest("hex").slice(0,32)}`}class bw{snapshots=new Map;history=new Map;advertisedStreams=new Map;recoveries=new Map;bootstrap;logger;recoverDelta;recoverSnapshot;onRecoveredEvent;recoveryCount=0;counters={streamResets:0,gaps:0,deltaRecoveries:0,snapshotRecoveries:0,recoveryFailures:0};constructor(e){this.bootstrap=e.bootstrap,this.logger=e.logger,this.recoverDelta=e.recoverDelta,this.recoverSnapshot=e.recoverSnapshot,this.onRecoveredEvent=e.onRecoveredEvent}handleEvent(e){const t=e.type===Ds?Ks:e.type===Ls?Ys:e.type===Ms?Xs:void 0;if(!t)return!1;const n=Pl(t,e.payload);return n.success?e.type===Ds?this.applySnapshot(n.data):e.type===Ls?this.applyPatch(n.data):this.applyRemoved(n.data):(this.logger?.warn?.({eventType:e.type,issues:n.error.issues,errorCode:"APP_SESSION_EVENT_INVALID"},"app-session.aggregator.event.invalid"),!1)}applySnapshot(e){const t=this.advertisedStreams.get(e.meta.instanceId)?.streamId;return t&&t!==e.meta.streamId?(this.logger?.warn?.({instanceId:e.meta.instanceId,advertisedStreamId:t,streamId:e.meta.streamId,revision:e.meta.revision},"app-session.aggregator.snapshot.obsolete-stream"),!1):this.apply({type:Ds,payload:e})}advertiseStream(e,t){return this.advertisedStreams.set(e,t),this.recoverStream(e,t.streamId,t.latestRevision).catch(n=>{this.counters.recoveryFailures+=1,this.logger?.warn?.({instanceId:e,streamId:t.streamId,error:n instanceof Error?n.message:String(n)},"app-session.aggregator.recovery.failed")})}diagnostics(){return{...this.counters,recoveriesStarted:this.recoveryCount,activeRecoveries:this.recoveries.size}}removeInstance(e){this.snapshots.delete(e),this.history.delete(e),this.advertisedStreams.delete(e)}applyPatch(e){return this.apply({type:Ls,payload:e})}applyRemoved(e){return this.apply({type:Ms,payload:e})}async list(e={}){return e.refresh&&e.instanceId&&this.recoverSnapshot?await this.refreshInstance(e.instanceId):(e.refresh||0===this.snapshots.size)&&await this.bootstrapFromInstances(),this.view(e.instanceId)}async streamDescriptors(){return 0===this.snapshots.size&&await this.bootstrapFromInstances(),[...this.snapshots.entries()].map(([e,t])=>({topic:"app.sessions",instanceId:e,streamId:t.streamId,latestRevision:t.revision,earliestRetainedRevision:this.history.get(e)?.[0]?.payload.meta.revision??t.revision+1}))}async delta(e){0===this.snapshots.size&&await this.bootstrapFromInstances();const t=this.resolveDeltaInstanceId(e.instanceId);this.pruneHistory(t);const n=this.snapshots.get(t)?.revision??0,i=this.snapshots.get(t)?.streamId||"unavailable",s=this.history.get(t)?.[0]?.payload.meta.revision??n+1;if(e.streamId!==i||e.sinceRevision>n)return Js.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:!0,events:[]});if(e.sinceRevision===n)return Js.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:!1,events:[]});const a=(this.history.get(t)??[]).filter(t=>t.payload.meta.revision>e.sinceRevision),o=!a.length||a[0].payload.meta.revision!==e.sinceRevision+1;return Js.parse({streamId:i,instanceId:t,sinceRevision:e.sinceRevision,latestRevision:n,earliestRetainedRevision:s,syncRequired:o,events:o?[]:a.map(({type:e,payload:t})=>({type:e,payload:t}))})}apply(e,t=!1){const{meta:n}=e.payload,i=this.advertisedStreams.get(n.instanceId)?.streamId;if(i&&i!==n.streamId)return this.logger?.warn?.({instanceId:n.instanceId,advertisedStreamId:i,streamId:n.streamId,revision:n.revision},"app-session.aggregator.event.obsolete-stream"),!1;const s=this.recoveries.get(n.instanceId);if(s&&!t)return s.streamId===n.streamId&&(s.highWater=Math.max(s.highWater,n.revision)),!1;const a=this.snapshots.get(n.instanceId);e.type===Ds&&a&&a.streamId!==n.streamId&&(this.counters.streamResets+=1,this.logger?.info?.({instanceId:n.instanceId,previousStreamId:a.streamId,streamId:n.streamId,previousRevision:a.revision,revision:n.revision,traceId:n.traceId,resetCount:this.counters.streamResets},"app-session.aggregator.stream-reset"));const o=function(e,t){const{meta:n}=t.payload;if(t.type===Ds)return e?.streamId===n.streamId&&n.revision===e.revision?{kind:"duplicate",projection:e}:e?.streamId===n.streamId&&n.revision<e.revision?{kind:"stale",projection:e}:{kind:"applied",projection:Gs.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:Zs(t.payload.snapshot.sessions,t.payload.snapshot.updatedAt)})};if(!e||e.streamId!==n.streamId)return{kind:"snapshot-required",projection:e,streamId:n.streamId};if(n.revision===e.revision)return{kind:"duplicate",projection:e};if(n.revision<e.revision)return{kind:"stale",projection:e};if(n.revision!==e.revision+1||n.previousRevision!==e.revision)return{kind:"gap",projection:e,expectedRevision:e.revision+1,receivedRevision:n.revision};const i=[...e.snapshot.sessions];if(t.type===Ls){const e=i.findIndex(e=>e.id===t.payload.session.id);na(t.payload.session.status)?e<0?i.push(t.payload.session):i[e]=t.payload.session:e>=0&&i.splice(e,1)}else{const e=i.findIndex(e=>e.id===t.payload.sessionId);e>=0&&i.splice(e,1)}const s=Qs(i,n.generatedAt);return{kind:"applied",projection:Gs.parse({streamId:n.streamId,revision:n.revision,lastEventAt:n.generatedAt,snapshot:s})}}(a,e);if("applied"!==o.kind)return this.logger?.warn?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,currentRevision:a?.revision,revision:n.revision,outcome:o.kind},`app-session.aggregator.event.${o.kind}`),"gap"!==o.kind&&"snapshot-required"!==o.kind||("gap"===o.kind&&(this.counters.gaps+=1),this.recoverStream(n.instanceId,n.streamId,n.revision).catch(e=>{this.logger?.warn?.({instanceId:n.instanceId,streamId:n.streamId,revision:n.revision,error:e instanceof Error?e.message:String(e)},"app-session.aggregator.recovery.failed")})),!1;const r=o.projection;return this.snapshots.set(n.instanceId,r),this.rememberEvent(n.instanceId,e),this.logger?.info?.({traceId:n.traceId,streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,reason:n.reason,sessionCount:r.snapshot.sessions.length,runningCount:r.snapshot.runningCount,problemCount:r.snapshot.problemCount},"app-session.aggregator.event.accepted"),!0}async bootstrapFromInstances(){this.logger?.info?.({},"app-session.aggregator.bootstrap");const e=new Map(this.snapshots),t=await this.bootstrap(),n=new Set(t.instances.map(e=>e.instanceId));for(const[t,i]of e)n.has(t)||this.snapshots.get(t)!==i||(this.snapshots.delete(t),this.history.delete(t),this.advertisedStreams.delete(t));for(const n of t.instances){const t=this.snapshots.get(n.instanceId);if(t!==e.get(n.instanceId))continue;const i=this.advertisedStreams.get(n.instanceId)?.streamId;if(i&&i!==n.streamId)continue;if(t?.streamId===n.streamId&&t.revision>=n.revision)continue;const s={type:Ds,payload:{meta:{streamId:n.streamId,instanceId:n.instanceId,revision:n.revision,traceId:`aps_bootstrap_${Date.now().toString(36)}`,generatedAt:n.lastEventAt,reason:"startup"},snapshot:Zs(n.appSessions.sessions,n.appSessions.updatedAt)}};this.apply(s)&&this.onRecoveredEvent?.(s)}}async refreshInstance(e){const t=this.snapshots.get(e),n=await this.recoverSnapshot(e);if(this.snapshots.get(e)!==t)return;const i=this.advertisedStreams.get(e)?.streamId;if(i&&i!==n.streamId)return;if(t?.streamId===n.streamId&&t.revision>=n.revision)return;const s={type:Ds,payload:{meta:{streamId:n.streamId,instanceId:e,revision:n.revision,traceId:`aps_refresh_${Date.now().toString(36)}`,generatedAt:n.lastEventAt,reason:"startup"},snapshot:n.snapshot}};this.apply(s)&&this.onRecoveredEvent?.(s)}recoverStream(e,t,n){const i=this.recoveries.get(e);if(i)return i.streamId===t?i.highWater=Math.max(i.highWater,n):(i.streamId=t,i.highWater=n),i.promise;if(!this.recoverDelta||!this.recoverSnapshot)return Promise.resolve();const s={promise:Promise.resolve(),streamId:t,highWater:n},a=++this.recoveryCount;return this.logger?.info?.({instanceId:e,highWater:n,recoveryNumber:a},"app-session.aggregator.recovery.started"),s.promise=(async()=>{for(;;){const t=this.advertisedStreams.get(e);if(!t)return;s.streamId!==t.streamId&&(s.streamId=t.streamId,s.highWater=t.latestRevision);const n=this.snapshots.get(e);if(n&&n.streamId===t.streamId){if(n.revision<Math.max(t.latestRevision,s.highWater)){const t=await this.recoverDelta(e,n.streamId,n.revision);if(this.advertisedStreams.get(e)?.streamId!==t.streamId||s.streamId!==t.streamId)continue;if(t.syncRequired){const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:Ds,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`aps_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:a,outcome:"snapshot-fallback"},"app-session.aggregator.recovery.snapshot")}else{for(const e of t.events)this.apply(e,!0)&&this.onRecoveredEvent?.(e);this.counters.deltaRecoveries+=1,s.highWater=Math.max(s.highWater,t.latestRevision),this.logger?.info?.({instanceId:e,streamId:t.streamId,sinceRevision:t.sinceRevision,latestRevision:t.latestRevision,eventCount:t.events.length,recoveryNumber:a,outcome:"delta"},"app-session.aggregator.recovery.delta")}}}else{const t=await this.recoverSnapshot(e);if(this.advertisedStreams.get(e)?.streamId!==t.streamId)continue;const n={type:Ds,payload:{meta:{streamId:t.streamId,instanceId:e,revision:t.revision,traceId:`aps_recovery_${Date.now().toString(36)}`,generatedAt:t.lastEventAt,reason:"startup"},snapshot:t.snapshot}};this.apply(n,!0)&&this.onRecoveredEvent?.(n),this.counters.snapshotRecoveries+=1,this.logger?.info?.({instanceId:e,streamId:t.streamId,revision:t.revision,recoveryNumber:a,outcome:"snapshot"},"app-session.aggregator.recovery.snapshot")}const i=this.snapshots.get(e),o=this.advertisedStreams.get(e);if(i&&o&&i.streamId===o.streamId&&i.revision>=Math.max(o.latestRevision,s.highWater))return void this.logger?.info?.({instanceId:e,streamId:i.streamId,revision:i.revision,recoveryNumber:a,outcome:"success"},"app-session.aggregator.recovery.completed")}})().finally(()=>this.recoveries.delete(e)),this.recoveries.set(e,s),s.promise}rememberEvent(e,t){const n=this.history.get(e)??[],i=n.length&&n[0].payload.meta.streamId!==t.payload.meta.streamId?[]:n;i.push({...t,createdAtMs:Date.now()}),this.history.set(e,i),this.pruneHistory(e)}pruneHistory(e){const t=this.history.get(e);if(!t?.length)return;const n=t.filter(e=>e.createdAtMs>=Date.now()-36e5);n.length?this.history.set(e,n):this.history.delete(e)}resolveDeltaInstanceId(e){if(e)return e;const t=[...this.snapshots.keys()];if(1===t.length)return t[0];throw new Error("APP_SESSION_DELTA_INSTANCE_ID_REQUIRED")}view(e){return{updatedAt:(new Date).toISOString(),instances:[...this.snapshots.entries()].filter(([t])=>!e||t===e).map(([e,t])=>({instanceId:e,streamId:t.streamId,appSessions:t.snapshot,revision:t.revision,lastEventAt:t.lastEventAt}))}}}function vw(e){return e.raw[0].replace(/\\\$\{/g,"${")}class Iw{states=new Map;events;constructor(e){this.events=e}handle(e){if(e.type===Od){const t=Pl(jd,e.payload);return void(t.success&&this.reconcileLifecycle(t.data))}if("instance.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";return void(t&&this.deleteState(t))}if(e.type===Fc){const t=Pl(Wc,e.payload);return void(t.success&&this.applyOutput(t.data))}if(e.type===Hc){const t=Pl(Vc,e.payload);t.success&&this.applyFinished(t.data)}}snapshots(){return[...this.states.values()].filter(e=>e.progress).map(e=>Kc.parse({...e.progress,terminalTail:e.terminalTail,...e.terminalTruncated?{terminalTruncated:!0}:{}}))}close(){for(const e of this.states.values())e.timer&&clearTimeout(e.timer);this.states.clear()}deleteState(e){const t=this.states.get(e);t?.timer&&clearTimeout(t.timer),this.states.delete(e)}reconcileLifecycle(e){const t=this.states.get(e.instanceId),n=e.imageProvisioning;t&&(!n||n.generation>t.identity.generation||n.generation===t.identity.generation&&"ready"===n.phase)&&this.deleteState(e.instanceId)}applyOutput(e){const t=this.states.get(e.instanceId);if(t&&e.generation<t.identity.generation)return;if(t&&e.generation===t.identity.generation&&!e.replay&&e.sequence<=t.sequence)return;const n=this.requireState(e);e.replay&&(n.terminal=new Aw,n.terminalTail="",n.layers.clear(),n.terminalTruncated=!1),n.sequence=Math.max(n.sequence,e.sequence),n.observedAt=e.observedAt,n.terminal.write(e.data);const i=`${n.terminalTail}${e.data}`;n.terminalTruncated||=i.length>262144,n.terminalTail=i.slice(-262144),function(e,t){for(const n of t.split("\n")){const t=n.trim().match(/^([a-f0-9]{6,64}):\s+(.+)$/i);if(!t)continue;const[,i,s]=t,a=s.toLowerCase(),o=["pull complete","already exists","download complete","pulling fs layer","waiting","downloading","extracting"].find(e=>a.startsWith(e));if(!o)continue;const r=e.get(i)||{status:o},c=ww(s);e.set(i,{...r,status:o,...c||{}})}}(n.layers,n.terminal.text()),n.progress=xw(n),this.schedule(n)}applyFinished(e){const t=this.states.get(e.instanceId);if(t&&e.generation<t.identity.generation)return;if(t&&e.generation===t.identity.generation&&e.sequence<=t.sequence)return;const n=this.requireState(e);n.sequence=Math.max(n.sequence,e.sequence),n.observedAt=e.observedAt,n.outcome=e.outcome,n.progress=xw(n),this.publish(n,!0)}requireState(e){const t=this.states.get(e.instanceId);if(t&&t.identity.generation===e.generation)return t;t?.timer&&clearTimeout(t.timer);const n={identity:{instanceId:e.instanceId,generation:e.generation,requestedReference:e.requestedReference},sequence:e.sequence,observedAt:e.observedAt,terminal:new Aw,terminalTail:"",terminalTruncated:!1,layers:new Map};return this.states.set(e.instanceId,n),n}schedule(e){e.timer||(e.timer=setTimeout(()=>this.publish(e,!1),250),e.timer.unref?.())}publish(e,t){e.timer&&clearTimeout(e.timer),e.timer=void 0,e.progress&&(e.progress=xw(e),this.events.publish("image.pull.progress",e.progress,{topic:"instances",scope:{instanceId:e.identity.instanceId}}),t&&(e.progress=xw(e)))}}function xw(e){const t=[...e.layers.values()],n=t.filter(e=>["pull complete","already exists"].includes(e.status)).length,i=t.filter(e=>"download complete"===e.status).length,s=t.filter(e=>"downloading"===e.status).length,a=t.filter(e=>"extracting"===e.status).length;let o=0,r=0;for(const e of t)e.total&&(r+=e.total,o+=["pull complete","already exists","download complete"].includes(e.status)?e.total:Math.min(e.current||0,e.total));const c="failed"===e.outcome?"failed":"succeeded"===e.outcome?"complete":a>0?"extracting":t.length>0?"pulling":"connecting",d=t.filter(e=>"already exists"!==e.status),l=d.length>0&&d.every(e=>Boolean(e.total)),p=l&&r>0?Math.max(0,Math.min(100,o/r*100)):void 0,u="failed"===c?"Image pull failed":"complete"===c?"Image pull complete":t.length?`${n}/${t.length} layers ready${void 0===p?"":` · ${Math.round(p)}%`}`:"Connecting to image registry";return Kc.parse({...e.identity,sequence:e.sequence,observedAt:e.observedAt,status:c,layers:{total:t.length,completed:n,downloaded:i,downloading:s,extracting:a},...l&&r>0?{bytes:{current:o,total:r},percent:p}:{},message:u})}function ww(e){const t=e.match(/([\d.]+)\s*([kmgt]?i?b)\s*\/\s*([\d.]+)\s*([kmgt]?i?b)/i);if(t)return{current:Sw(t[1],t[2]),total:Sw(t[3],t[4])}}function Sw(e,t){return Number(e)*1024**({b:0,kb:1,kib:1,mb:2,mib:2,gb:3,gib:3,tb:4,tib:4}[t.toLowerCase()]||0)}class Aw{lines=[[]];row=0;col=0;pending="";write(e){const t=`${this.pending}${e}`;this.pending="";for(let e=0;e<t.length;){const n=t[e];if(""===n&&"["===t[e+1]){let n=e+2;for(;n<t.length&&!/[\x40-\x7e]/.test(t[n]);)n+=1;if(n>=t.length){this.pending=t.slice(e);break}this.csi(t.slice(e+2,n),t[n]),e=n+1;continue}"\r"===n?this.col=0:"\n"===n?(this.row+=1,this.col=0,this.ensureLine()):"\b"===n?this.col=Math.max(0,this.col-1):n>=" "&&(this.ensureLine(),this.lines[this.row][this.col]=n,this.col+=1),e+=1}this.trim()}text(){return this.lines.map(e=>e.join("").trimEnd()).join("\n")}csi(e,t){const n=e.replace(/^\?/,"").split(";").map(e=>Number(e||1)),i=n[0]||1;"A"===t?this.row=Math.max(0,this.row-i):"B"===t?(this.row+=i,this.ensureLine()):"C"===t?this.col+=i:"D"===t?this.col=Math.max(0,this.col-i):"G"===t?this.col=Math.max(0,i-1):"H"===t||"f"===t?(this.row=Math.max(0,i-1),this.col=Math.max(0,(n[1]||1)-1),this.ensureLine()):"K"===t?(this.ensureLine(),2===(n[0]||0)?this.lines[this.row]=[]:this.lines[this.row].splice(this.col)):"J"===t&&2===(n[0]||0)&&(this.lines=[[]],this.row=0,this.col=0)}ensureLine(){for(;this.lines.length<=this.row;)this.lines.push([])}trim(){if(this.lines.length<=500)return;const e=this.lines.length-500;this.lines.splice(0,e),this.row=Math.max(0,this.row-e)}}const Ew=Io.extend({credentialHash:f.z.string().trim().min(32).max(256)}).strict(),_w=f.z.object({revision:f.z.number().int().nonnegative(),invites:f.z.array(f.z.unknown()).length(0).default([]),bindings:f.z.array(Ew)}).strict(),Tw={binding:new Set(Object.keys(Ew.shape))};function zw(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e;return Object.fromEntries([...t].filter(e=>e in n).map(e=>[e,n[e]]))}function kw(e){const{tokenHash:t,...n}=e;return fo.parse(n)}function Nw(e){const{credentialHash:t,...n}=e;return Io.parse(n)}class Cw{authority;constructor(e,t){this.authority=new Sl(e,()=>({revision:0,invites:[],bindings:[]}),{schema:_w,sanitize:e=>function(e,t){if(!e||"object"!=typeof e||Array.isArray(e))return e;const n=e,i=new Set(["revision","invites","bindings"]),s=Object.keys(n).filter(e=>!i.has(e));return s.length>0&&t?.({kind:"authority",fields:s}),{...void 0===n.revision?{}:{revision:n.revision},invites:[],bindings:Array.isArray(n.bindings)?n.bindings.map(e=>function(e,t,n){if(!t||"object"!=typeof t||Array.isArray(t))return t;const i=t,s=Tw[e],a=Object.keys(i).filter(e=>!s.has(e));a.length>0&&n?.({kind:e,fields:a});const o=zw(i,s);return o.lastError&&(o.lastError=zw(o.lastError,Object.keys(ho.shape))),o}("binding",e,t)).filter(e=>!e||"object"!=typeof e||"revoked"!==e.status):n.bindings}}(e,e=>t?.("unknown stored control-plane proxy fields were ignored",e)),logger:t,directoryMode:448,fileMode:384})}init(){this.authority.init();const e=this.authority.get();this.authority.put(e)}snapshot(){return this.authority.get()}transaction(e){const t=this.authority.get(),n=structuredClone(t),i=e(n);return JSON.stringify(n)!==JSON.stringify(t)&&this.authority.put({...n,revision:t.revision+1}),i}listBindings(){return this.snapshot().bindings}getBinding(e){return this.snapshot().bindings.find(t=>t.id===e)}}class Rw extends Error{code;statusCode;retryable;details;constructor(e,t,n,i=!1,s={}){super(t),this.name="ControlPlaneProxyServiceError",this.code=e,this.statusCode=n,this.retryable=i,this.details=s}}const Ow=e=>i.createHash("sha256").update(e).digest("base64url"),jw=()=>i.randomBytes(32).toString("base64url");function Pw(e,t,n,i=!1,s={}){throw new Rw(e,t,n,i,s)}class Dw{store;targets;configuredProxyOrigin;proxyOriginProvider;now;createTokenValue;invites=new jg;constructor(e,t,n){this.store=e,this.targets=t,this.configuredProxyOrigin=n.proxyOrigin,this.proxyOriginProvider=n.proxyOriginProvider,this.now=n.now??(()=>new Date),this.createTokenValue=n.createToken??jw}init(){this.store.init()}createInvite(e,t){const n=this.resolveProxyOrigin();n||Pw(uo.Unavailable,"Configure an externally reachable HTTPS control-plane proxy origin before creating an invite.",409,!1);const i=yo.parse(e);this.requireManageableTarget(i.targetNodeId);const s=this.createTokenValue(),a=this.nowIso(),o={id:Il("proxy_invite"),targetNodeId:i.targetNodeId,tokenHash:Ow(s),status:"active",createdBy:t,expiresAt:new Date(this.now().getTime()+Math.min(1e3*i.expiresInSeconds,6e5)).toISOString(),createdAt:a,updatedAt:a},r=bo.parse({invite:kw(o),token:s,proxyOrigin:n,protocolVersion:Ja});return this.invites.put(o.tokenHash,o,this.now().getTime()),r}resolveProxyOrigin(){const e=this.configuredProxyOrigin??this.proxyOriginProvider?.();if(!e)return;const t=io.safeParse(e);return t.success?t.data:void 0}listInvites(){return this.invites.list(this.now().getTime()).map(kw)}revokeInvite(e){const t=this.listInviteRecords().find(t=>t.id===e);t||Pw(uo.InviteInvalid,"Proxy invite is unknown.",404,!1,{inviteId:e});const n=this.nowIso(),i={...t,status:"revoked",revokedAt:n,updatedAt:n};return this.invites.delete(t.tokenHash,this.now().getTime()),kw(i)}claimInvite(e){const t=xo.parse(e);this.requireCurrentProtocol(t.protocolVersion);const n=Ow(t.credential),i=this.store.listBindings().find(e=>e.claimId===t.claimId);if(i)return this.requireRecoveredIdentity(i,t,n),this.claimResult(i,this.requireKnownTarget(i.targetNodeId));t.inviteToken||Pw(uo.InviteInvalid,"Proxy invite token is required for the first claim.",401);const s=Ow(t.inviteToken),a=this.invites.peek(s,this.now().getTime());a||Pw(uo.InviteInvalid,"Proxy invite is invalid or expired.",401),t.targetNodeId&&t.targetNodeId!==a.targetNodeId&&Pw(uo.TargetMismatch,"Proxy invite is bound to a different target.",409,!1,{inviteId:a.id,targetNodeId:t.targetNodeId});const o=this.requireManageableTarget(a.targetNodeId),r=this.store.transaction(e=>{const i=(s=a.id,`proxy_binding_${Ow(s).slice(0,32)}`);var s;const r=this.nowIso(),c={id:i,claimId:t.claimId,sourceControlPlaneId:t.sourceControlPlaneId,targetNodeId:a.targetNodeId,bindingKeyId:t.bindingKeyId,credentialHash:n,status:"active",revision:1,createdAt:r,updatedAt:r};return e.bindings.push(c),this.claimResult(c,o)});return this.invites.delete(s,this.now().getTime()),r}listBindings(){return this.store.listBindings().map(Nw)}authenticateBinding(e,t){const n=wo.parse(t),s=this.store.getBinding(e);return s||Pw(uo.BindingUnknown,"Proxy binding is unknown.",404,!1,{bindingId:e}),"active"!==s.status&&Pw(uo.BindingRevoked,"Proxy binding is revoked.",403,!1,{bindingId:e}),s.sourceControlPlaneId===n.sourceControlPlaneId&&s.bindingKeyId===n.bindingKeyId&&function(e,t){const n=Ow(t),s=Buffer.from(e),a=Buffer.from(n);return s.length===a.length&&i.timingSafeEqual(s,a)}(s.credentialHash,n.credential)||Pw(uo.AuthenticationFailed,"Proxy binding authentication failed.",401,!1,{bindingId:e}),Nw(s)}revokeBinding(e){const t=this.requireBinding(e);if("revoked"===t.status)return Nw(t);const n=this.nowIso(),i={...t,status:"revoked",revision:t.revision+1,revokedAt:n,updatedAt:n};return this.store.transaction(t=>{t.bindings=t.bindings.filter(t=>t.id!==e)}),Nw(i)}revokeTarget(e){return this.store.transaction(t=>{const n=this.nowIso(),i=t.bindings.filter(t=>t.targetNodeId===e&&"active"===t.status).map(e=>Nw({...e,status:"revoked",revision:e.revision+1,revokedAt:n,updatedAt:n}));return t.bindings=t.bindings.filter(t=>t.targetNodeId!==e),{bindings:i,invites:this.revokeTargetInvites(e,n)}})}nowIso(){return this.now().toISOString()}requireCurrentProtocol(e){e!==Ja&&Pw(uo.ProtocolUnsupported,"Control-plane proxy protocol version is unsupported.",426,!1,{requestedVersion:e,supportedVersion:Ja})}requireKnownTarget(e){const t=this.targets.get(e);return t||Pw(uo.TargetUnavailable,"Proxy target no longer exists.",404,!1,{targetNodeId:e}),t}requireManageableTarget(e){const t=this.requireKnownTarget(e);return t.manageable&&"online"===t.status||Pw(uo.TargetUnavailable,"Proxy target is not currently manageable.",503,!0,{targetNodeId:e}),t}requireBinding(e){const t=this.store.getBinding(e);return t||Pw(uo.BindingUnknown,"Proxy binding is unknown.",404,!1,{bindingId:e}),t}requireRecoveredIdentity(e,t,n){(e.claimId!==t.claimId||e.sourceControlPlaneId!==t.sourceControlPlaneId||void 0!==t.targetNodeId&&e.targetNodeId!==t.targetNodeId||e.bindingKeyId!==t.bindingKeyId||e.credentialHash!==n)&&Pw(uo.BindingIdentityConflict,"Proxy claim conflicts with an existing binding identity.",409,!1,{claimId:t.claimId})}claimResult(e,t){const{manageable:n,...i}=t;return ko.parse({protocolVersion:Ja,binding:Nw(e),target:i})}listInviteRecords(){return this.invites.list(this.now().getTime())}revokeTargetInvites(e,t){const n=this.listInviteRecords().filter(t=>t.targetNodeId===e);for(const e of n)this.invites.delete(e.tokenHash,this.now().getTime());return n.map(e=>kw({...e,status:"revoked",revokedAt:t,updatedAt:t}))}}class Lw extends Error{statusCode=429;code=uo.ResourceLimit;retryable=!0;details;constructor(e,t){super(e),this.name="NodeProxyRuntimeError",this.details=t}}class Mw{maxRequestBodyBytes;maxConcurrentHttpPerBinding;maxConcurrentStreamsPerBinding;maxHttpRequestsPerMinutePerBinding;maxConcurrentWebSocketsPerBinding;maxHttpResponseBytes;httpStreamIdleTimeoutMs;maxWebSocketFrameBytes;maxWebSocketBytes;webSocketIdleTimeoutMs;httpRequestWindowMs;bindings=new Map;requestWindows=new Map;requestWindowTimers=new Map;constructor(e={}){this.maxConcurrentHttpPerBinding=e.maxConcurrentHttpPerBinding??32,this.maxConcurrentStreamsPerBinding=e.maxConcurrentStreamsPerBinding??16,this.maxHttpRequestsPerMinutePerBinding=e.maxHttpRequestsPerMinutePerBinding??600,this.maxConcurrentWebSocketsPerBinding=e.maxConcurrentWebSocketsPerBinding??16,this.maxRequestBodyBytes=e.maxRequestBodyBytes??8388608,this.maxHttpResponseBytes=e.maxHttpResponseBytes??268435456,this.httpStreamIdleTimeoutMs=e.httpStreamIdleTimeoutMs??12e4,this.maxWebSocketFrameBytes=e.maxWebSocketFrameBytes??8388608,this.maxWebSocketBytes=e.maxWebSocketBytes??268435456,this.webSocketIdleTimeoutMs=e.webSocketIdleTimeoutMs??3e5,this.httpRequestWindowMs=e.httpRequestWindowMs??6e4}reserveHttp(e){this.consumeRequestRate(e);const t=this.activity(e);if(t.controllers.size>=this.maxConcurrentHttpPerBinding)throw this.deleteIfEmpty(e,t),this.limit("Proxy HTTP concurrency limit exceeded.",e,"http-concurrency",this.maxConcurrentHttpPerBinding);const n=new AbortController;t.controllers.add(n);let i,s=!1,a=!1,o=0;const r=()=>{a&&!s&&(i&&clearTimeout(i),i=setTimeout(()=>{n.abort(Object.assign(new Error("Proxy HTTP stream idle timeout."),{code:uo.ResourceLimit}))},this.httpStreamIdleTimeoutMs),i.unref?.())};return{controller:n,acceptRequestBody:t=>{if(t>this.maxRequestBodyBytes)throw this.limit("Proxy request body limit exceeded.",e,"request-body",this.maxRequestBodyBytes)},beginResponseStream:()=>{if(!s&&!a){if(t.streams.size>=this.maxConcurrentStreamsPerBinding)throw this.limit("Proxy HTTP stream concurrency limit exceeded.",e,"stream-concurrency",this.maxConcurrentStreamsPerBinding);a=!0,t.streams.add(n),r()}},acceptResponseChunk:t=>{if(!s){if(o+=qw(t),o>this.maxHttpResponseBytes){const t=this.limit("Proxy HTTP response byte limit exceeded.",e,"response-bytes",this.maxHttpResponseBytes);throw n.abort(t),t}r()}},release:()=>{s||(s=!0,i&&clearTimeout(i),t.controllers.delete(n),t.streams.delete(n),this.deleteIfEmpty(e,t))}}}openHttp(e,t){const n=this.reserveHttp(e);try{return n.acceptRequestBody(t),n}catch(e){throw n.release(),e}}openWebSocket(e,t,n){const i=this.activity(e);if(i.sockets.size>=this.maxConcurrentWebSocketsPerBinding)throw this.limit("Proxy WebSocket concurrency limit exceeded.",e,"websocket-concurrency",this.maxConcurrentWebSocketsPerBinding);let s,a=!1,o=0;const r=()=>{a||(a=!0,s&&clearTimeout(s),i.sockets.delete(p),this.deleteIfEmpty(e,i),n?.())},c=e=>{r(),t.close(1009,e)},d=()=>{s&&clearTimeout(s),s=setTimeout(()=>{r(),t.close(1001,"Proxy WebSocket idle timeout.")},this.webSocketIdleTimeoutMs),s.unref?.()},l=e=>{const t=qw(e);return t>this.maxWebSocketFrameBytes?(c("Proxy WebSocket frame limit exceeded."),!1):(o+=t,o>this.maxWebSocketBytes?(c("Proxy WebSocket byte limit exceeded."),!1):(d(),!0))};d();const p={get readyState(){return t.readyState},send:(e,n)=>{!a&&l(e)&&t.send(e,n)},close:(e,n)=>{r(),t.close(e,n)},on:(e,n)=>{"message"!==e?"close"!==e&&"error"!==e?t.on(e,n):t.on(e,(...e)=>{r(),n(...e)}):t.on(e,(e,...t)=>{!a&&l(e)&&n(e,...t)})}};return i.sockets.add(p),p}closeBinding(e,t="Proxy binding was revoked."){const n=this.bindings.get(e);if(!n)return this.clearRequestWindow(e),{abortedRequests:0,closedSockets:0};const i=[...n.controllers],s=[...n.sockets],a=[...n.cleanup];this.bindings.delete(e);for(const e of i)e.abort(Object.assign(new Error(t),{code:uo.BindingRevoked}));for(const e of a)e();for(const e of s)e.close(1008,t);return n.controllers.clear(),n.streams.clear(),n.sockets.clear(),n.cleanup.clear(),this.clearRequestWindow(e),{abortedRequests:i.length,closedSockets:s.length}}diagnostics(e){if(e){const t=this.bindings.get(e);return{bindingId:e,activeHttp:t?.controllers.size??0,activeStreams:t?.streams.size??0,activeWebSockets:t?.sockets.size??0}}return[...this.bindings].map(([e,t])=>({bindingId:e,activeHttp:t.controllers.size,activeStreams:t.streams.size,activeWebSockets:t.sockets.size}))}registerBindingCleanup(e,t){const n=this.activity(e);return n.cleanup.add(t),()=>{n.cleanup.delete(t),this.deleteIfEmpty(e,n)}}activity(e){const t=this.bindings.get(e);if(t)return t;const n={controllers:new Set,streams:new Set,sockets:new Set,cleanup:new Set};return this.bindings.set(e,n),n}deleteIfEmpty(e,t){0===t.controllers.size&&0===t.streams.size&&0===t.sockets.size&&0===t.cleanup.size&&this.bindings.get(e)===t&&this.bindings.delete(e)}limit(e,t,n,i){return new Lw(e,{bindingId:t,resource:n,limit:i})}consumeRequestRate(e){const t=Date.now(),n=t-this.httpRequestWindowMs,i=(this.requestWindows.get(e)||[]).filter(e=>e>n);if(i.length>=this.maxHttpRequestsPerMinutePerBinding)throw this.limit("Proxy HTTP request rate limit exceeded.",e,"request-rate",this.maxHttpRequestsPerMinutePerBinding);i.push(t),this.requestWindows.set(e,i),this.scheduleRequestWindowCleanup(e)}scheduleRequestWindowCleanup(e){const t=this.requestWindowTimers.get(e);t&&clearTimeout(t);const n=this.requestWindows.get(e);if(!n?.length)return this.requestWindows.delete(e),void this.requestWindowTimers.delete(e);const i=Math.max(1,n[0]+this.httpRequestWindowMs-Date.now()+1),s=setTimeout(()=>{this.requestWindowTimers.delete(e);const t=Date.now()-this.httpRequestWindowMs,n=(this.requestWindows.get(e)||[]).filter(e=>e>t);n.length?(this.requestWindows.set(e,n),this.scheduleRequestWindowCleanup(e)):this.requestWindows.delete(e)},i);s.unref?.(),this.requestWindowTimers.set(e,s)}clearRequestWindow(e){this.requestWindows.delete(e);const t=this.requestWindowTimers.get(e);t&&clearTimeout(t),this.requestWindowTimers.delete(e)}}function qw(e){return Buffer.isBuffer(e)||e instanceof ArrayBuffer||ArrayBuffer.isView(e)?e.byteLength:Buffer.byteLength("string"==typeof e?e:String(e),"utf8")}class Uw{streams=new Map;historyLimit;maxEventBytes;maxHistoryBytes;createStreamId;projectTarget;unsubscribeBus;constructor(e,t){this.historyLimit=Math.max(1,t.historyLimit??256),this.maxEventBytes=Math.max(1024,t.maxEventBytes??524288),this.maxHistoryBytes=Math.max(this.maxEventBytes,t.maxHistoryBytes??16777216),this.createStreamId=t.createStreamId??(e=>`proxy_events_${e}_${i.randomUUID().replace(/-/g,"").slice(0,16)}`),this.projectTarget=t.projectTarget,this.unsubscribeBus=e.on(e=>this.accept(e))}stop(){this.unsubscribeBus();for(const e of this.streams.values())e.subscribers.clear();this.streams.clear()}cursor(e){const t=this.stream(e);return{streamId:t.streamId,revision:t.revision,earliestRetainedRevision:$w(t)}}subscribe(e,t,n,i=()=>{}){const{bindingId:s,sourceControlPlaneId:a,targetNodeId:o}=e,r=this.stream(o),c=$w(r);if(t>r.revision||t<c-1)return n(To.parse({type:"control-plane-proxy.snapshot-required",protocolVersion:Ja,streamId:r.streamId,bindingId:s,sourceControlPlaneId:a,targetNodeId:o,sinceRevision:t,latestRevision:r.revision,earliestRetainedRevision:c,error:{code:uo.SnapshotRequired,message:"Proxy target event history cannot continue from the requested revision; fetch a new snapshot.",retryable:!0,details:{targetNodeId:o}}})),{kind:"snapshot-required",close:()=>{}};n(_o.parse({type:"control-plane-proxy.events.ready",protocolVersion:Ja,streamId:r.streamId,bindingId:s,sourceControlPlaneId:a,targetNodeId:o,latestRevision:r.revision,earliestRetainedRevision:c}));for(const e of r.history)e.event.revision>t&&n(Bw(e.event,s,a));const d={bindingId:s,sourceControlPlaneId:a,send:n,onDeliveryFailure:i};r.subscribers.add(d);let l=!1;return{kind:"subscribed",close:()=>{l||(l=!0,r.subscribers.delete(d))}}}diagnostics(e){const t=this.stream(e);return{targetNodeId:e,streamId:t.streamId,revision:t.revision,earliestRetainedRevision:$w(t),historySize:t.history.length,historyBytes:t.historyBytes,subscribers:t.subscribers.size,subscriberBindings:[...t.subscribers].map(({bindingId:e,sourceControlPlaneId:t})=>({bindingId:e,sourceControlPlaneId:t}))}}accept(e){const t=e.scope?.nodeId;if("string"!=typeof t||!t)return;let n;try{n=this.projectTarget(t)}catch{return}if(!n)return;const i=this.stream(t),s=i.revision+1,a=Eo.safeParse({type:"control-plane-proxy.event",protocolVersion:Ja,streamId:i.streamId,bindingId:"proxy_projection",sourceControlPlaneId:"proxy_projection",targetNodeId:t,revision:s,source:{id:e.id,seq:e.seq},target:n,event:{type:e.type,topic:e.topic,createdAt:e.createdAt}});if(!a.success)return;const{bindingId:o,sourceControlPlaneId:r,...c}=a.data,d=Fw(c);if(!(void 0===d||d>this.maxEventBytes-512)){for(i.revision=s,i.history.push({event:c,bytes:d}),i.historyBytes+=d;i.history.length>this.historyLimit||i.historyBytes>this.maxHistoryBytes;){const e=i.history.shift();e&&(i.historyBytes-=e.bytes)}for(const e of[...i.subscribers])try{const t=Bw(c,e.bindingId,e.sourceControlPlaneId),n=Fw(t);if(void 0===n||n>this.maxEventBytes)throw new Error("Proxy event byte limit exceeded.");e.send(t)}catch{i.subscribers.delete(e);try{e.onDeliveryFailure()}catch{}}}}stream(e){const t=this.streams.get(e);if(t)return t;const n={streamId:this.createStreamId(e),revision:0,history:[],historyBytes:0,subscribers:new Set};return this.streams.set(e,n),n}}function $w(e){return e.history[0]?.event.revision??e.revision+1}function Bw(e,t,n){return Eo.parse({...e,bindingId:t,sourceControlPlaneId:n})}function Fw(e){try{return Buffer.byteLength(JSON.stringify(e),"utf8")}catch{return}}function Hw(e,t){const n=new WeakSet;let i=t,s=0;const a=e=>{if(i-=Buffer.byteLength(e,"utf8"),i<0)throw Gw("Proxy target projection byte limit exceeded.",{resource:"target-projection-bytes",limit:t})},o=(e,t)=>{if(s+=1,s>16384||t>24)throw Gw("Proxy target projection complexity limit exceeded.");if(null===e||"boolean"==typeof e)return e;if("string"==typeof e)return a(e),e;if("number"==typeof e)return Number.isFinite(e)?e:null;if("object"!=typeof e)return;if(n.has(e))throw Gw("Proxy target projection contains a cycle.",void 0,!1);if(n.add(e),Array.isArray(e)){const i=e.map(e=>o(e,t+1)??null);return n.delete(e),i}const i={};for(const[n,s]of Object.entries(e)){if("__proto__"===n||"constructor"===n||"prototype"===n)continue;a(n);const e=o(s,t+1);void 0!==e&&(i[n]=e)}return n.delete(e),i};return o(e,0)}function Gw(e,t,n=!0){return Object.assign(new Error(e),{code:"CONTROL_PLANE_PROXY_RESOURCE_LIMIT",statusCode:429,retryable:n,...t?{details:t}:{}})}function Ww(e){const{manageable:t,...n}=e;return n}const Vw=f.z.object({bindingId:f.z.string().trim().min(1).max(160)}).passthrough(),Kw=f.z.object({route:so}).strict(),Yw=f.z.object({sinceRevision:f.z.coerce.number().int().nonnegative()}).strict(),Xw=new Set(["connection","cookie","host","keep-alive","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),Jw=524288;function Qw(e,t,n){const i=aS(n.headers,ro);if(i!==Ja)throw sS(uo.ProtocolUnsupported,"Control-plane proxy protocol version is unsupported.",426,!1,{requestedVersion:i,supportedVersion:Ja});const s=aS(n.headers,co),a=aS(n.headers,lo),o=aS(n.headers,po);if(!s||!a||!o)throw sS(uo.AuthenticationFailed,"Proxy binding authentication headers are incomplete.",401);return e.authenticateBinding(t,{sourceControlPlaneId:s,bindingKeyId:a,credential:o})}function Zw(e,t,n){const i=Qw(e,t.id,n);if(i.id!==t.id||i.revision!==t.revision||i.sourceControlPlaneId!==t.sourceControlPlaneId||i.targetNodeId!==t.targetNodeId||i.bindingKeyId!==t.bindingKeyId||"active"!==i.status)throw sS(uo.BindingIdentityConflict,"Proxy binding changed while the request was being established.",409,!0,{bindingId:t.id,expectedRevision:t.revision,actualRevision:i.revision})}function eS(e,t){if(t.id!==e.targetNodeId)throw sS(uo.TargetMismatch,"Proxy target resolver returned another node.",409,!1,{bindingId:e.id,targetNodeId:e.targetNodeId})}function tS(e){for(const t of Object.keys(e)){const e=t.toLowerCase();if(e.startsWith("x-taskhandoff-node-")||e.startsWith("x-task-handoff-node-"))throw sS(uo.HeaderInvalid,"Caller-supplied node transport authentication headers are forbidden.",400,!1,{header:e})}const t=Object.fromEntries([...ao].flatMap(t=>{if(Xw.has(t))return[];const n=e[t];return void 0===n?[]:[[t,Array.isArray(n)?n.join(", "):String(n)]]}));if(void 0!==t["x-request-id"]){const e=no.safeParse(t["x-request-id"]);if(!e.success)throw sS(uo.HeaderInvalid,"Proxy request correlation id is invalid.",400,!1,{header:"x-request-id"});t["x-request-id"]=e.data}if(void 0!==t[Au]){const e=no.safeParse(t[Au]);if(!e.success)throw sS(uo.HeaderInvalid,"Proxy trace id is invalid.",400,!1,{header:Au});t[Au]=e.data}return t}function nS(e,t,n){const i=iS(t),s=oS(n?.headers);return s&&e.header("x-request-id",s),e.code(i.statusCode).send({error:{code:i.code,message:i.message,retryable:i.retryable,...i.details?{details:i.details}:{}}})}function iS(e){const t=e&&"object"==typeof e?e:{},n="number"==typeof t.statusCode?t.statusCode:502;return{statusCode:n,code:("string"==typeof t.code?t.code:void 0)||uo.TransportFailed,message:e instanceof Error?e.message:"Control-plane proxy transport failed.",retryable:"boolean"==typeof t.retryable?t.retryable:n>=500,details:t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?t.details:void 0}}function sS(e,t,n,i=!1,s){return Object.assign(new Error(t),{code:e,statusCode:n,retryable:i,...s?{details:s}:{}})}function aS(e,t){const n=e[t];return Array.isArray(n)?n.join(","):"string"==typeof n?n:""}function oS(e){if(!e)return;const t=no.safeParse(aS(e,"x-request-id"));return t.success?t.data:void 0}function rS(e){let t="";for(const n of e){if(Buffer.byteLength(t+n)>123)break;t+=n}return t}const cS=e=>ho.parse({code:uo.Unavailable,message:e,retryable:!0});class dS{service;subscriptions=new Map;fetchImpl;openWebSocket;onStateChanged;logger;running=!1;constructor(e,t={}){this.service=e,this.fetchImpl=t.fetchImpl??fetch,this.openWebSocket=t.openWebSocket??((e,t)=>new b.WebSocket(e,{headers:t})),this.onStateChanged=t.onStateChanged??(()=>{}),this.logger=t.logger}start(){this.running||(this.running=!0,this.syncNow())}syncNow(){if(!this.running)return;const e=new Map(this.service.listNodes().filter(e=>"control-plane-proxy"===e.connectionMode&&!1!==e.connectionEnabled).map(e=>[e.id,e]));for(const t of this.subscriptions.keys())e.has(t)||this.remove(t);for(const t of e.values()){const e=this.subscriptionIdentity(t),n=this.subscriptions.get(t.id);if(n?.identity===e)continue;n&&this.remove(t.id);const i={generation:1,identity:e,retry:new sI};this.subscriptions.set(t.id,i),this.connect(t.id,i.generation)}}stop(){this.running=!1;for(const e of[...this.subscriptions.keys()])this.remove(e)}remove(e){const t=this.subscriptions.get(e);t&&(t.generation+=1,t.reconnect&&clearTimeout(t.reconnect),t.socket?.close(),this.subscriptions.delete(e))}async connect(e,t){if(!this.current(e,t))return;const n=this.service.proxyPrivateStore.nodeCredential(e);if(n)try{const i=await this.fetchImpl(function(e){return new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/snapshot`,e.proxyOrigin)}(n),{headers:ph(n)});if(!this.current(e,t))return;const s=await i.json().catch(()=>{});if(!i.ok){const n=Pl(ho,s?.error),a=n.success?n.data:cS(`Proxy snapshot failed with HTTP ${i.status}.`);return a.code===uo.BindingRevoked||a.code===uo.BindingUnknown?void this.onStateChanged(this.service.markProxyBindingRevoked(e,a)):void this.fail(e,t,a,a.retryable)}const a=Dl(Ao,s?.data);if(this.validateIdentity(n,a.binding.id,a.binding.targetNodeId),this.onStateChanged(this.service.applyProxyTargetSnapshot(e,a)),"revoked"===a.binding.status)return void this.onStateChanged(this.service.markProxyBindingRevoked(e,{code:uo.BindingRevoked,message:"Control-plane proxy binding was revoked.",retryable:!1}));this.openEvents(e,t,n,a)}catch(n){if(!this.current(e,t))return;this.logger?.warn?.({nodeId:e,error:lS(n)},"control-plane proxy state bootstrap failed"),this.fail(e,t,cS("Trusted control-plane proxy is unavailable."),!0)}else this.fail(e,t,cS("Control-plane proxy credential is unavailable."),!1)}openEvents(e,t,n,i){const s=this.current(e,t);if(!s)return;const a=this.openWebSocket(function(e,t){const n=new URL(`/api/node-proxy/bindings/${encodeURIComponent(e.proxyBindingId)}/events`,e.proxyOrigin);return n.protocol="wss:",n.searchParams.set("sinceRevision",String(t)),n.toString()}(n,i.revision),ph(n));s.socket=a;let o=!1;const r=n=>{o||(o=!0,this.fail(e,t,cS(n),!0))};a.on("message",a=>{if(this.current(e,t))try{const o=Dl(zo,JSON.parse(String(a)));if(o.bindingId!==n.proxyBindingId||o.sourceControlPlaneId!==n.sourceControlPlaneId||o.targetNodeId!==n.targetNodeId||o.streamId!==i.streamId)throw new Error("Proxy event stream identity changed.");if("control-plane-proxy.snapshot-required"===o.type)return void this.restart(e,t);if("control-plane-proxy.events.ready"===o.type)return void s.retry.reset();this.onStateChanged(this.service.applyProxyTargetEvent(e,o))}catch(n){this.logger?.warn?.({nodeId:e,error:lS(n)},"control-plane proxy event requires a new snapshot"),this.restart(e,t)}}),a.on("error",()=>r("Control-plane proxy event stream failed.")),a.on("close",()=>r("Control-plane proxy event stream disconnected."))}restart(e,t){const n=this.current(e,t);n&&(n.generation+=1,n.socket?.close(),n.socket=void 0,this.connect(e,n.generation))}fail(e,t,n,i){const s=this.current(e,t);if(!s)return;if(this.onStateChanged(this.service.markProxyUnavailable(e,n)),!i)return s.generation+=1,s.socket?.close(),void this.subscriptions.delete(e);s.generation+=1,s.socket?.close(),s.socket=void 0;const a=s.retry.next();s.reconnect=setTimeout(()=>{s.reconnect=void 0,this.connect(e,s.generation)},a.delay),s.reconnect.unref?.()}current(e,t){const n=this.subscriptions.get(e);return this.running&&n?.generation===t?n:void 0}validateIdentity(e,t,n){if(t!==e.proxyBindingId||n!==e.targetNodeId){const e=new Error("Proxy snapshot identity does not match the private binding credential.");throw Object.assign(e,{code:uo.BindingIdentityConflict}),e}}subscriptionIdentity(e){const t=this.service.proxyPrivateStore.nodeCredential(e.id);return JSON.stringify({connectionMode:e.connectionMode,connectionPath:e.connectionPath,credential:t&&{id:t.id,proxyOrigin:t.proxyOrigin,proxyBindingId:t.proxyBindingId,targetNodeId:t.targetNodeId,sourceControlPlaneId:t.sourceControlPlaneId,bindingKeyId:t.bindingKeyId,updatedAt:t.updatedAt}})}}function lS(e){const t=e&&"object"==typeof e?e:{};return{name:e instanceof Error?e.name:"Error",message:e instanceof Error?e.message:String(e),..."string"==typeof t.code?{code:t.code}:{}}}const pS=f.z.object({id:f.z.string().trim().min(1).max(160)}).strict(),uS=f.z.object({}).strict(),mS=f.z.object({force:f.z.enum(["true","false"]).optional()}).strict(),hS=f.z.object({id:f.z.string().trim().min(1)}).strict();function gS(e){const t=sx(e);if(!t||"user"!==t.type)throw Object.assign(new Error("A Control Plane user is required."),{code:"CONTROL_PLANE_AUTH_REQUIRED",statusCode:401});return t}const fS=f.z.object({id:f.z.string().trim().min(1).max(120)}).strict(),yS=f.z.object({id:f.z.string().trim().min(1).max(120),credentialId:f.z.string().trim().min(1).max(120)}).strict();function bS(e){const t=sx(e);if(!t)throw Object.assign(new Error("Authentication is required."),{code:"CONTROL_PLANE_AUTH_REQUIRED",statusCode:401});pl(t,"manage-secrets",{type:"secret"})}const vS=f.z.object({algorithm:f.z.literal("Ed25519"),publicKey:f.z.string().regex(/^[A-Za-z0-9_-]{43}$/),privateKeyPkcs8:f.z.string().regex(/^[A-Za-z0-9_-]{64}$/)}).strip();function IS(){const{publicKey:e,privateKey:t}=i.generateKeyPairSync("ed25519"),n=e.export({format:"jwk"});if(!n.x)throw new Error("Generated Control Plane identity did not contain an Ed25519 public key.");return{algorithm:"Ed25519",publicKey:n.x,privateKeyPkcs8:t.export({format:"der",type:"pkcs8"}).toString("base64url")}}function xS(e){return`sha256:${i.createHash("sha256").update(Buffer.from(e,"base64url")).digest("base64url")}`}function wS(e){return Array.isArray(e)?`[${e.map(wS).join(",")}]`:e&&"object"==typeof e?`{${Object.entries(e).sort(([e],[t])=>e.localeCompare(t)).map(([e,t])=>`${JSON.stringify(e)}:${wS(t)}`).join(",")}}`:JSON.stringify(e)}class SS{identity;controlPlaneId;constructor(e,t,n){this.controlPlaneId=t,this.identity=new Sl(e,IS,{schema:vS,logger:n,directoryMode:448,fileMode:384})}init(){this.identity.init(),this.privateKey()}publicDocument(e,t=Date.now()){const n=this.identity.get(),s={authentication:e,aiSessions:!0,nodes:!0,instanceBoard:!0,triggers:!0,..."required"===e?{accessManagement:{userManagement:{users:!0,identities:!0,sessions:!0},authentication:{externalIdentity:{oidc:!0,oauthAdapters:["github"]}},authorization:{customRoles:!0,nodeScopes:!0,instanceScopes:!0,authorizationRevisions:!0}}}:{}},a=mp.parse({version:1,kind:"control-plane",controlPlaneId:this.controlPlaneId(),publicKey:{algorithm:"Ed25519",encoding:"base64url",value:n.publicKey,fingerprint:xS(n.publicKey)},capabilities:s,protocolVersion:"2026-08-23",issuedAt:new Date(t).toISOString(),expiresAt:new Date(t+3e5).toISOString()}),o=i.sign(null,Buffer.from((r=a,JSON.stringify(mp.parse(r)))),this.privateKey()).toString("base64url");var r;return hp.parse({data:{payload:a,signature:o}})}publicIdentity(){const e=this.identity.get();return{controlPlaneId:this.controlPlaneId(),algorithm:e.algorithm,publicKey:e.publicKey,fingerprint:xS(e.publicKey)}}signCloudBindingChallenge(e){return i.sign(null,Buffer.from(`task-handoff:cloud-binding-challenge:v1\n${wS(e)}`),this.privateKey()).toString("base64url")}signCloudOutboundRegistration(e){return i.sign(null,Buffer.from((t=e,`task-handoff:outbound-control-registration:v1\n${fa(Ta.parse(t))}`)),this.privateKey()).toString("base64url");var t}acceptCloudAccessHandshake(e,t){return function(e){const t=za.parse(e.ticket),n=Ca.parse(e.clientHello);if(t.ticketId!==n.ticketId||t.deviceSessionId!==n.deviceSessionId||t.targetPublicKeyFingerprint!==e.controlPlaneFingerprint)throw Ra();const s=i.generateKeyPairSync("x25519"),a=function(e){const t=e.export({format:"jwk"}).x;if(!t)throw Ra();return t}(s.publicKey),o=function(e,t,n){return i.createHash("sha256").update(fa({audience:e.audience,ticketId:e.ticketId,accountId:e.accountId,deviceSessionId:e.deviceSessionId,controlPlaneId:e.controlPlaneId,bindingId:e.bindingId,bindingRevision:e.bindingRevision,nonce:e.nonce,clientEphemeralPublicKey:t,serverEphemeralPublicKey:n})).digest("base64url")}(t,n.clientEphemeralPublicKey,a);var r;const c=function(e,t){return i.createHash("sha256").update(e).update(t).update("task-handoff:control-plane-access:e2e:v1").digest()}(i.diffieHellman({privateKey:s.privateKey,publicKey:(r=n.clientEphemeralPublicKey,i.createPublicKey({key:{kty:"OKP",crv:"X25519",x:r},format:"jwk"}))}),o);return{sessionKey:c,response:{serverEphemeralPublicKey:a,transcript:o,signature:i.sign(null,Buffer.from(o),e.controlPlanePrivateKey).toString("base64url")}}}({ticket:e,clientHello:t,controlPlaneFingerprint:this.publicIdentity().fingerprint,controlPlanePrivateKey:this.privateKey()})}privateKey(){const e=this.identity.get(),t=i.createPrivateKey({key:Buffer.from(e.privateKeyPkcs8,"base64url"),format:"der",type:"pkcs8"});if(i.createPublicKey(t).export({format:"jwk"}).x!==e.publicKey)throw new Error("Stored Control Plane signing identity public and private keys do not match.");return t}}class AS{observations=new Map;listeners=new Set;begin(e,t,n="connecting"){const i=this.observations.get(e),s={nodeId:e,transport:t,generation:(i?.generation||0)+1,phase:n,changedAt:(new Date).toISOString(),consecutiveFailures:i?.transport===t?i.consecutiveFailures:0,controlReachability:i?.transport===t?i.controlReachability:"unknown",controlChangedAt:i?.transport===t?i.controlChangedAt:void 0,controlError:i?.transport===t?i.controlError:void 0};return this.observations.set(e,s),this.publish(s),s.generation}update(e,t,n,i=!0){const s=this.observations.get(e);if(!s||s.generation!==t)return!1;const a={...s,...n,changedAt:(new Date).toISOString()};return this.observations.set(e,a),i&&this.publish(a),!0}connected(e,t){const n=(new Date).toISOString();return this.update(e,t,{phase:"healthy",connectedAt:n,lastSeenAt:n,nextRetryAt:void 0,error:void 0})}pong(e,t,n={}){const i=(new Date).toISOString();return this.update(e,t,{lastSeenAt:i,lastPongAt:i,...void 0===n.pingRttMs?{}:{pingRttMs:n.pingRttMs},...void 0===n.pingRttP95Ms?{}:{pingRttP95Ms:n.pingRttP95Ms}},!1)}stable(e,t){return this.update(e,t,{consecutiveFailures:0},!1)}observedReachable(e){if("control-plane-proxy"===e.connectionMode)return!1;const t="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http",n=this.observations.get(e.id),i=n?.transport===t?n.generation:this.begin(e.id,t,"handshaking");if("direct-http"===t){const t=(new Date).toISOString();return"reachable"===n?.controlReachability?this.update(e.id,i,{lastSeenAt:t},!1):this.update(e.id,i,{controlReachability:"reachable",controlChangedAt:t,controlError:void 0,lastSeenAt:t})}return"healthy"===n?.phase?this.update(e.id,i,{lastSeenAt:(new Date).toISOString()},!1):this.connected(e.id,i)}observedFailure(e,t){if("control-plane-proxy"===e.connectionMode)return!1;const n="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http",i=this.observations.get(e.id),s=i?.transport===n?i.generation:this.begin(e.id,n,"connecting");return"direct-http"===n?"unreachable"===i?.controlReachability?this.update(e.id,s,{controlError:t},!1):this.update(e.id,s,{controlReachability:"unreachable",controlChangedAt:(new Date).toISOString(),controlError:t}):this.disconnected(e.id,s,{error:t})}disconnected(e,t,n={}){const i=this.observations.get(e);return!(!i||i.generation!==t)&&this.update(e,t,{phase:n.nextRetryAt?"reconnecting":"offline",consecutiveFailures:i.consecutiveFailures+1,closeCode:n.closeCode,error:n.error,nextRetryAt:n.nextRetryAt})}observation(e){return this.observations.get(e)}onChange(e){return this.listeners.add(e),()=>this.listeners.delete(e)}project(e){if(!1===e.connectionEnabled)return{...e,status:"offline",health:"failed",connectionPhase:"offline"};if("direct-http"!==e.connectionMode&&"reverse-wss"!==e.connectionMode&&"local-ipc"!==e.connectionMode&&"local-loopback"!==e.connectionMode)return e;const t=this.observations.get(e.id),n="reverse-wss"===e.connectionMode?"reverse-wss":"direct-http";if(!t||t.transport!==n)return"direct-http"===n?{...e,status:"unknown",health:"unknown",connectionPhase:"connecting"}:e;const i={...void 0===t.pingRttMs?{}:{pingRttMs:t.pingRttMs},...void 0===t.pingRttP95Ms?{}:{pingRttP95Ms:t.pingRttP95Ms},consecutiveReconnects:t.consecutiveFailures,...t.nextRetryAt?{nextRetryAt:t.nextRetryAt}:{}};return"direct-http"===n?"reachable"===t.controlReachability?{...e,connectionDiagnostics:i,status:"online",health:"unknown"===e.health||"failed"===e.health?"ok":e.health,lastSeenAt:t.lastSeenAt||e.lastSeenAt,connectionPhase:"healthy"}:{...e,connectionDiagnostics:i,status:"unreachable"===t.controlReachability?"offline":"unknown",health:"unreachable"===t.controlReachability?"failed":"unknown",lastSeenAt:t.lastSeenAt,connectionPhase:"unreachable"===t.controlReachability?"offline":"connecting"}:"healthy"===t.phase?{...e,connectionDiagnostics:i,status:"online",health:"unknown"===e.health?"ok":e.health,lastSeenAt:t.lastSeenAt||t.connectedAt,connectionPhase:t.phase}:"connecting"===t.phase||"handshaking"===t.phase||"reconnecting"===t.phase||"suspect"===t.phase?{...e,connectionDiagnostics:i,status:"offline",health:"degraded",lastSeenAt:t.lastSeenAt,connectionPhase:t.phase}:{...e,connectionDiagnostics:i,status:"offline",health:"failed",lastSeenAt:t.lastSeenAt,connectionPhase:t.phase}}diagnostics(){return[...this.observations.values()].map(e=>({...e}))}publish(e){for(const t of this.listeners)t({...e})}}function ES(e,n){const i=t.extname(e);return`${i?e.slice(0,-i.length):e}.${n}${i}`}const _S=1048576,TS=52428800;function zS(e){return e instanceof Error?{name:e.name,message:e.message,stack:e.stack}:e}function kS(e){const i=[],s=e=>{if(n.existsSync(e))for(const a of n.readdirSync(e,{withFileTypes:!0})){const n=t.join(e,a.name);a.isSymbolicLink()||(a.isDirectory()?s(n):a.isFile()&&(a.name.endsWith(".log")||a.name.endsWith(".jsonl"))&&i.push(n))}};return s(e),i.sort()}function NS(e,i,s){const a=n.statSync(e),o=Math.min(a.size,_S,s);if(o<=0)return 0;const r=Buffer.allocUnsafe(o),c=n.openSync(e,"r");try{n.readSync(c,r,0,o,Math.max(0,a.size-o))}finally{n.closeSync(c)}return n.mkdirSync(t.dirname(i),{recursive:!0,mode:448}),n.writeFileSync(i,r,{mode:384}),o}const CS=f.z.object({version:f.z.literal(1),serviceOrigin:f.z.string().url(),status:f.z.enum(["unbound","pending-claim","active","pending-revocation","clone-conflict"]),remoteAccessEnabled:f.z.boolean(),accountId:f.z.string().optional(),bindingId:f.z.string().optional(),bindingRevision:f.z.number().int().positive().optional(),backgroundCredential:f.z.string().min(32).optional(),updatedAt:f.z.string().datetime(),connectionEpoch:f.z.number().int().nonnegative().default(0)}).strip();class RS{state;challenges=new Map;identity;serviceOrigin;clock;constructor(e){this.identity=e.identity,this.serviceOrigin=new URL(e.serviceOrigin).origin,this.clock=e.clock??Date.now,this.state=new Sl(e.statePath,()=>({version:1,serviceOrigin:this.serviceOrigin,status:"unbound",remoteAccessEnabled:!0,updatedAt:new Date(this.clock()).toISOString(),connectionEpoch:0}),{schema:CS,directoryMode:448,fileMode:384})}init(){if(this.state.init(),this.state.get().serviceOrigin!==this.serviceOrigin)throw jS("CLOUD_SERVICE_ORIGIN_CHANGED","Cloud service origin does not match persisted binding authority.")}snapshot(){const{backgroundCredential:e,connectionEpoch:t,...n}=this.state.get();return{...n,identity:this.identity.publicIdentity(),hasBackgroundCredential:Boolean(e)}}createChallenge(){const e=this.state.get();if(["active","pending-revocation","clone-conflict"].includes(e.status))throw jS("active"===e.status?"CONTROL_PLANE_ALREADY_BOUND":"BINDING_STATE_CONFLICT","Existing cloud binding must be resolved first.");this.prune();const t=Il("binding_challenge"),n=i.randomBytes(32).toString("base64url"),s=this.challengePayload(t);return this.challenges.set(t,{digest:OS(n),payload:s,expiresAtMs:Date.parse(s.expiresAt)}),this.state.put({...e,status:"pending-claim",updatedAt:new Date(this.clock()).toISOString()}),{challengeCode:`${t}.${n}`,authorizationUrl:`${this.serviceOrigin}/bindings/authorize`,payload:s,signature:this.identity.signCloudBindingChallenge(s)}}consumeChallenge(e){const t=e.challengeCode.indexOf("."),n=e.challengeCode.slice(0,t),s=e.challengeCode.slice(t+1),a=this.challenges.get(n);if(a&&this.challenges.delete(n),!a||a.expiresAtMs<=this.clock()||(o=a.digest,r=OS(s),o.length!==r.length||!i.timingSafeEqual(o,r)))throw jS("BINDING_CHALLENGE_INVALID_OR_CONSUMED","Binding challenge is invalid, expired, or consumed.");var o,r;if(a.payload.controlPlaneId!==e.controlPlaneId||a.payload.publicKeyFingerprint!==e.fingerprint)throw jS("BINDING_IDENTITY_CONFLICT","Binding challenge identity does not match.");return a.payload}activate(e){const t=this.state.get();if("active"===t.status){if(t.accountId===e.accountId&&t.bindingId===e.bindingId&&t.bindingRevision===e.bindingRevision)return this.snapshot();throw jS("CONTROL_PLANE_ALREADY_BOUND","Control Plane is already bound to another account.")}if("pending-claim"!==t.status)throw jS("BINDING_STATE_CONFLICT","Control Plane has no pending binding claim.");return this.state.put({...t,status:"active",remoteAccessEnabled:!0,...e,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}setRemoteAccess(e){const t=this.state.get();return this.state.put({...t,remoteAccessEnabled:e,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}beginRevocation(){const e=this.state.get();return"unbound"===e.status||(this.challenges.clear(),this.state.put({...e,status:"pending-revocation",remoteAccessEnabled:!1,updatedAt:new Date(this.clock()).toISOString()})),this.snapshot()}confirmRevocation(){const e=this.state.get();return this.state.put({version:1,serviceOrigin:e.serviceOrigin,status:"unbound",remoteAccessEnabled:!1,updatedAt:new Date(this.clock()).toISOString(),connectionEpoch:e.connectionEpoch}),this.snapshot()}markCloneConflict(){const e=this.state.get();return this.challenges.clear(),this.state.put({...e,status:"clone-conflict",remoteAccessEnabled:!1,backgroundCredential:void 0,updatedAt:new Date(this.clock()).toISOString()}),this.snapshot()}backgroundCredential(){const e=this.state.get();return"active"===e.status&&e.remoteAccessEnabled?e.backgroundCredential:void 0}nextConnectionEpoch(){const e=this.state.get(),t=e.connectionEpoch+1;return this.state.put({...e,connectionEpoch:t,updatedAt:new Date(this.clock()).toISOString()}),t}challengePayload(e){const t=this.identity.publicIdentity(),n=this.clock();return{protocolVersion:"2026-08-10",audience:"task-handoff:binding",serviceOrigin:this.serviceOrigin,challengeId:e,controlPlaneId:t.controlPlaneId,publicKey:t.publicKey,publicKeyFingerprint:t.fingerprint,nonce:i.randomBytes(24).toString("base64url"),issuedAt:new Date(n).toISOString(),expiresAt:new Date(n+3e5).toISOString()}}prune(){const e=this.clock();for(const[t,n]of this.challenges)n.expiresAtMs<=e&&this.challenges.delete(t)}}function OS(e){return i.createHash("sha256").update(e).digest()}function jS(e,t){return Object.assign(new Error(t),{code:e,statusCode:e.includes("CONFLICT")||e.includes("BOUND")?409:400})}class PS{revision=0;options;constructor(e){this.options=e}async apply(e){if(!Number.isSafeInteger(e.bindingRevision)||e.bindingRevision<this.revision)return{applied:!1,reason:"stale-revision"};if(this.revision=e.bindingRevision,"binding-revoked"===e.type||"account-disabled"===e.type||"background-credential-revoked"===e.type)this.options.state.beginRevocation(),await Promise.all([this.options.connections.stop(e.type),this.options.dataConnections.closeAll(e.type)]),this.options.state.confirmRevocation();else if("remote-access-changed"===e.type)this.options.state.setRemoteAccess(!0===e.enabled),e.enabled||await Promise.all([this.options.connections.stop("remote-access-disabled"),this.options.dataConnections.closeAll("remote-access-disabled")]);else{if("identity-clone-detected"!==e.type)return{applied:!1,reason:"unsupported-event"};this.options.state.markCloneConflict(),await Promise.all([this.options.connections.stop(e.type),this.options.dataConnections.closeAll(e.type)])}return{applied:!0}}}class DS{connection;processInstanceId=`control_plane_process_${i.randomUUID().replaceAll("-","_")}`;backoff;options;constructor(e){this.options=e,this.backoff=e.backoff??new sI}async connectOnce(){const e=this.options.state.backgroundCredential(),t=this.options.state.snapshot();if(!t.remoteAccessEnabled||!("pending-claim"===t.status||"active"===t.status&&Boolean(e)))return{status:"disabled"};if(this.connection)return{status:"connected",reused:!0};const n=this.options.state.nextConnectionEpoch(),i=this.connection;return this.connection=await this.options.connector.connect({serviceOrigin:t.serviceOrigin,credential:e,bindingId:t.bindingId,bindingRevision:t.bindingRevision,controlPlaneId:t.identity.controlPlaneId,processInstanceId:this.processInstanceId,epoch:n,onEvent:this.options.onEvent}),await(i?.close("replaced-by-new-epoch")),this.backoff.reset(),{status:"connected",epoch:n}}reconnectDelay(){return this.backoff.next().delay}disconnected(){this.connection=void 0}async stop(e){const t=this.connection;this.connection=void 0,await(t?.close(e))}}class LS{connections=new Map;options;constructor(e){this.options=e}async attach(e){const t=await this.options.verifyAllocation(e),n=this.connections.get(t.allocationId);if(n&&t.epoch<=n.epoch)throw Object.assign(new Error("Cloud connection state is invalid."),{code:"STALE_CONNECTION_EPOCH"});const i=await this.options.connector.connect({relayUrl:t.relayUrl,allocation:e,epoch:t.epoch});return await(n?.connection.close("replaced-by-new-epoch")),this.connections.set(t.allocationId,{epoch:t.epoch,connection:i}),{status:"attached",allocationId:t.allocationId,epoch:t.epoch}}async closeAll(e){const t=[...this.connections.values()];this.connections.clear(),await Promise.allSettled(t.map(({connection:t})=>t.close(e)))}}class MS{options;constructor(e){this.options=e}async disconnect(){const e=this.options.state.snapshot();if(!e.bindingId)return e;this.options.state.beginRevocation(),await this.options.connections.stop("binding-pending-revocation");try{if("revoked"===(await this.options.remote.revoke({bindingId:e.bindingId})).status)return this.options.state.confirmRevocation()}catch{}return this.options.state.snapshot()}async setRemoteAccess(e){const t=this.options.state.snapshot();if(this.options.state.setRemoteAccess(e),e||await this.options.connections.stop("remote-access-disabled"),t.bindingId)try{await this.options.remote.setRemoteAccess({bindingId:t.bindingId,enabled:e})}catch{return{...this.options.state.snapshot(),remoteResult:"unknown"}}return{...this.options.state.snapshot(),remoteResult:"confirmed"}}}class qS{options;constructor(e){this.options=e}async connect(e){const t=e.allocation,n=Na.parse(t.attach),i=za.parse(t.ticket),s=new(this.options.webSocket??b)(e.relayUrl,{followRedirects:!1,handshakeTimeout:1e4,perMessageDeflate:!1});return await function(e){return new Promise((t,n)=>{e.once("open",t),e.once("error",n),e.once("close",()=>n(FS("RELAY_SOCKET_CLOSED")))})}(s),s.send(JSON.stringify({type:"attach",capability:n})),async function(e,t,n,i,s){const a=await $S(e,e=>"frame"===e?.type&&"handshake"===e.frame?.kind);if(a.frame.channelId!==t||0!==a.frame.sequence)throw FS("RELAY_HANDSHAKE_SEQUENCE_INVALID");const o=JSON.parse(Buffer.from(a.frame.ciphertext,"base64url").toString("utf8")),r=i.acceptCloudAccessHandshake(n,o),c={...r.response,controlPlanePublicKey:i.publicIdentity().publicKey};e.send(JSON.stringify({type:"frame",frame:{protocolVersion:"2026-08-10",channelId:t,sequence:0,kind:"handshake",ciphertext:Buffer.from(JSON.stringify(c)).toString("base64url")}}));const d={type:"cloud-account",accountId:n.accountId,deviceSessionId:n.deviceSessionId,bindingId:n.bindingId,bindingRevision:n.bindingRevision},l=new US(e,t,r.sessionKey,d,s);return l.start(),{close:(e="normal")=>l.close(e)}}(s,(await $S(s,e=>"attached"===e?.type)).channelId,i,this.options.identity,this.options.bridge)}}class US{receiveSequence=1;sendSequence=1;receiveCounter=0;sendCounter=0;unsubscribe;ttys=new Map;socket;channelId;key;actor;bridge;constructor(e,t,n,i,s){this.socket=e,this.channelId=t,this.key=n,this.actor=i,this.bridge=s}start(){this.socket.on("message",e=>{this.receive(e).catch(()=>this.socket.close(4400,"encrypted-protocol-error"))}),this.socket.once("close",()=>{this.unsubscribe?.();for(const e of this.ttys.values())e.close();this.ttys.clear()})}async close(e){this.unsubscribe?.();for(const e of this.ttys.values())e.close();this.ttys.clear(),this.socket.readyState<b.CLOSING&&this.socket.close(1e3,e.slice(0,120))}async receive(e){const t=JSON.parse(e.toString()),n=t?.frame;if("frame"!==t?.type||n?.channelId!==this.channelId||n.sequence!==this.receiveSequence++)throw FS("RELAY_FRAME_SEQUENCE_INVALID");const i=T.secretbox.open(Buffer.from(n.ciphertext,"base64url"),BS(1,this.receiveCounter++),this.key);if(!i)throw FS("RELAY_E2E_DECRYPT_FAILED");const s=JSON.parse(Buffer.from(i).toString("utf8"));await this.dispatch(s)}async dispatch(e){if("request"===e.type&&e.id){try{const t=await this.bridge.request(this.actor,e.body);this.send({type:"response",id:e.id,status:t.status,body:t.body})}catch(t){this.send({type:"response",id:e.id,status:Number(t?.statusCode)||500,body:{error:{code:t?.code??"CONTROL_PLANE_ERROR",message:"Control Plane request failed."}}})}return}if("event-subscribe"===e.type){this.unsubscribe?.();const t=Array.isArray(e.body?.topics)?e.body.topics.map(String):["*"],n=tl.safeParse(e.body?.aiSessionTransient),i=e.body?.eventEnvelopeVersion===Yd;return void(this.unsubscribe=this.bridge.subscribe(this.actor,t,e=>this.send({type:"event",event:i?Uv(e):e}),n.success?n.data:void 0))}if("tty-open"===e.type&&e.streamId&&this.bridge.openTty){const t=e.streamId,n=await this.bridge.openTty(this.actor,e.body,e=>this.send({...e,streamId:t}));return this.ttys.set(t,n),void this.send({type:"tty-opened",streamId:t})}const t=e.streamId?this.ttys.get(e.streamId):void 0;if(t&&"tty-input"===e.type)return t.send(String(e.data??""));if(t&&"tty-resize"===e.type)return t.resize(Number(e.body?.cols),Number(e.body?.rows));if(t&&"tty-close"===e.type)return t.close(),this.ttys.delete(e.streamId),void this.send({type:"tty-closed",streamId:e.streamId});if("cancel"!==e.type)throw FS("RELAY_ENVELOPE_UNSUPPORTED")}send(e){if(this.socket.readyState!==b.OPEN||this.socket.bufferedAmount>2097152)throw FS("RELAY_BACKPRESSURE_LIMIT");const t=T.secretbox(Buffer.from(JSON.stringify(e)),BS(2,this.sendCounter++),this.key);this.socket.send(JSON.stringify({type:"frame",frame:{protocolVersion:"2026-08-10",channelId:this.channelId,sequence:this.sendSequence++,kind:"cancel"===e.type?"cancel":"data",ciphertext:Buffer.from(t).toString("base64url")}}))}}function $S(e,t){return new Promise((n,i)=>{const s=e=>{try{const i=JSON.parse(e.toString());t(i)&&(o(),n(i))}catch(e){o(),i(e)}},a=()=>{o(),i(FS("RELAY_SOCKET_CLOSED"))},o=()=>{e.off("message",s),e.off("close",a)};e.on("message",s),e.once("close",a)})}function BS(e,t){const n=new Uint8Array(24);return n[0]=e,new DataView(n.buffer).setBigUint64(16,BigInt(t),!1),n}function FS(e){return Object.assign(new Error("Cloud Relay session is invalid."),{code:e,retryable:!0})}class HS{current;options;constructor(e){this.options=e}async connect(e){const t=this.options.identity.publicIdentity(),n=Date.now(),s={protocolVersion:"2026-08-10",audience:"task-handoff:coordinator-control",connectionId:`connection_${i.randomUUID().replaceAll("-","_")}`,processInstanceId:e.processInstanceId,controlPlaneId:t.controlPlaneId,publicKey:t.publicKey,publicKeyFingerprint:t.fingerprint,...e.bindingId?{bindingId:e.bindingId,bindingRevision:e.bindingRevision}:{},epoch:e.epoch,capabilities:["request","stream","websocket"],issuedAt:new Date(n).toISOString(),expiresAt:new Date(n+3e5).toISOString()},a=new URL("/api/v1/control-plane/connect",e.serviceOrigin);a.protocol="https:"===a.protocol?"wss:":"ws:";const o=new(this.options.webSocket??b)(a.href,{followRedirects:!1,handshakeTimeout:1e4});let r;return r=await function(e,t){return new Promise((n,s)=>{const a=new Map;let o,r=!1,c=!1;const d=e=>{for(const t of a.values())t.reject(e);a.clear(),r||s(e)},l={request(t,n){if(e.readyState!==b.OPEN)return Promise.reject(WS("CLOUD_CONTROL_CONNECTION_UNAVAILABLE"));const s=`request_${i.randomUUID().replaceAll("-","_")}`;return e.send(JSON.stringify({type:"request",requestId:s,operation:t,payload:n})),new Promise((e,t)=>a.set(s,{resolve:e,reject:t}))},async close(t="normal"){c=!0,o&&clearInterval(o),e.close(1e3,t.slice(0,120))}};e.on("open",()=>e.send(JSON.stringify(t.register))),e.on("message",async i=>{let s;try{s=JSON.parse(i.toString())}catch{return e.close(1002,"invalid-json")}if("registered"===s.type)return r=!0,o=setInterval(()=>e.readyState===b.OPEN&&e.send(JSON.stringify({type:"heartbeat"})),1e4),o.unref(),n(l);if("event"===s.type)return t.onEvent(s.event);if("response"===s.type){const e=a.get(s.requestId);if(!e)return;return a.delete(s.requestId),s.error?e.reject(Object.assign(new Error(s.error.message),{code:s.error.code})):e.resolve(s.data)}if("request"===s.type&&t.onRequest)try{e.send(JSON.stringify({type:"response",requestId:s.requestId,data:await t.onRequest(s.operation,s.payload)}))}catch(t){e.send(JSON.stringify({type:"response",requestId:s.requestId,error:{code:t?.code??"REQUEST_FAILED",message:t instanceof Error?t.message:String(t)}}))}}),e.on("error",e=>d(e)),e.on("close",()=>{o&&clearInterval(o),d(WS("CLOUD_CONTROL_CONNECTION_CLOSED")),c||t.onDisconnected()})})}(o,{register:{type:"register",registration:{...s,signature:this.options.identity.signCloudOutboundRegistration(s)},backgroundCredential:e.credential},onEvent:e.onEvent,onRequest:this.options.onRequest,onDisconnected:()=>{this.current===r&&(this.current=void 0),this.options.onDisconnected()}}),this.current=r,r}async request(e,t){if(!this.current)throw WS("CLOUD_CONTROL_CONNECTION_UNAVAILABLE");return this.current.request(e,t)}}class GS{lifecycle;dataConnections;connector;control;events;timer;running=!1;connecting;options;constructor(e){this.options=e,this.connector=new HS({identity:e.identity,webSocket:e.webSocket,onDisconnected:()=>{this.control.disconnected(),this.schedule()},onRequest:(e,t)=>this.handleRequest(e,t)});const t=e.relayConnector??(e.relayBridge?new qS({identity:e.identity,bridge:e.relayBridge,webSocket:e.webSocket}):{async connect(){throw WS("CLOUD_RELAY_CONNECTOR_UNAVAILABLE")}});this.dataConnections=new LS({verifyAllocation:e.verifyAllocation??(t=>function(e,t){const n=e,i=Na.parse(n?.attach),s=za.parse(n?.ticket),a=t.snapshot(),o=new URL(String(n?.relayUrl));if("relay-allocation"!==n?.type||n?.allocationId!==i.allocationId||"control-plane"!==i.role||i.ticketId!==s.ticketId||i.controlPlaneId!==s.controlPlaneId||i.accountId!==s.accountId||i.deviceSessionId!==s.deviceSessionId||i.bindingId!==s.bindingId||i.bindingRevision!==s.bindingRevision||"active"!==a.status||!a.remoteAccessEnabled||a.identity.controlPlaneId!==s.controlPlaneId||a.accountId!==s.accountId||a.bindingId!==s.bindingId||a.bindingRevision!==s.bindingRevision||s.targetPublicKeyFingerprint!==a.identity.fingerprint||Date.parse(i.expiresAt)<=Date.now())throw FS("RELAY_ALLOCATION_AUTHORITY_INVALID");if(!function(e,t){if("wss:"!==e.protocol)return!1;if("relay.thandoff.com"===e.hostname||e.hostname.endsWith(".relay.thandoff.com"))return!0;const n=new URL(t);return"cloud.thandoff.com"!==n.hostname&&e.hostname===n.hostname}(o,a.serviceOrigin))throw FS("UNTRUSTED_RELAY_URL");return{allocationId:i.allocationId,relayUrl:o.href,epoch:Date.parse(i.issuedAt),attach:i,ticket:s}}(t,e.state)),connector:t}),this.events=new PS({state:e.state,connections:{stop:e=>this.control.stop(e)},dataConnections:this.dataConnections}),this.control=new DS({state:e.state,connector:this.connector,onEvent:async e=>{await this.events.apply(e)}}),this.lifecycle=new MS({state:e.state,connections:this.control,remote:{revoke:async({bindingId:e})=>this.connector.request("revoke-binding",{bindingId:e}),setRemoteAccess:async({bindingId:e,enabled:t})=>{await this.connector.request("set-remote-access",{bindingId:e,enabled:t})}}})}start(){this.running=!0,"active"===this.options.state.snapshot().status&&this.schedule(0)}async stop(){this.running=!1,this.timer&&clearTimeout(this.timer),await Promise.all([this.control.stop("control-plane-stopping"),this.dataConnections.closeAll("control-plane-stopping")])}async publishBindingChallenge(e){await this.ensureConnected(),await this.connector.request("publish-binding-challenge",{payload:e.payload,signature:e.signature})}async request(e,t){return await this.ensureConnected(),this.connector.request(e,t)}async handleRequest(e,t){if("consume-binding-challenge"===e){const e=this.options.identity.publicIdentity();return this.options.state.consumeChallenge({challengeCode:t?.challengeCode,controlPlaneId:e.controlPlaneId,fingerprint:e.fingerprint})}if("deliver-binding-credential"===e)return this.options.state.activate(t);if("relay-allocation"===e)return this.dataConnections.attach(t);throw WS("CLOUD_CONTROL_OPERATION_UNSUPPORTED")}async ensureConnected(){if(this.connecting||(this.connecting=this.control.connectOnce().finally(()=>{this.connecting=void 0})),"connected"!==(await this.connecting).status)throw WS("CLOUD_CONTROL_CONNECTION_DISABLED")}schedule(e=this.control.reconnectDelay()){if(!this.running||this.timer)return;const t=this.options.state.snapshot();"active"===t.status&&t.remoteAccessEnabled&&(this.timer=setTimeout(()=>{this.timer=void 0,this.ensureConnected().catch(()=>this.schedule())},e),this.timer.unref())}}function WS(e){return Object.assign(new Error("Cloud background connection is unavailable."),{code:e,retryable:!0})}class VS{connections=new Set;track(e,t){const n={...e,close:t};return this.connections.add(n),()=>this.connections.delete(n)}invalidate(e,t){let n=0;for(const i of[...this.connections])if(i.userId===e&&i.authorizationRevision!==t){this.connections.delete(i);try{i.close()}catch{}n+=1}return n}size(){return this.connections.size}}const KS=f.z.object({accessId:f.z.string().trim().min(1).max(120),token:f.z.string().trim().min(32).max(512),expiresAt:f.z.string().datetime(),relayPath:f.z.literal("/browser-relay")}).strict();class YS{pending=new Map;active=new Map;ttlMs;issued=0;consumed=0;rejected=0;expired=0;closed=0;constructor(e=3e4){this.ttlMs=e}create(e){const t=i.randomBytes(32).toString("base64url"),n={accessId:`browser_${i.randomUUID().replace(/-/g,"")}`,token:t,instanceId:e.instanceId,authorization:e.authorization,expiresAt:new Date(Date.now()+this.ttlMs).toISOString()},s=setTimeout(()=>{this.pending.delete(t)&&(this.expired+=1)},this.ttlMs);return s.unref?.(),this.pending.set(t,{...n,timer:s}),this.issued+=1,n}consume(e){const t=this.pending.get(e);if(!t||t.expiresAt<=(new Date).toISOString())throw this.rejected+=1,t&&clearTimeout(t.timer),this.pending.delete(e)&&(this.expired+=1),Object.assign(new Error("Browser access token is invalid, expired, or already consumed."),{statusCode:401,code:"BROWSER_ACCESS_TOKEN_INVALID"});this.pending.delete(e),clearTimeout(t.timer);const{timer:n,...i}=t;return this.consumed+=1,i}track(e,t){return this.closeAccess(e.accessId),this.active.set(e.accessId,{...e,close:t}),()=>{const n=this.active.get(e.accessId);n?.close===t&&this.active.delete(e.accessId)}}closeAccess(e){const t=this.active.get(e);if(!t)return!1;this.active.delete(e),this.closed+=1;try{t.close()}catch{}return!0}closeInstance(e){let t=0;for(const n of[...this.active.values()])n.instanceId===e&&this.closeAccess(n.accessId)&&(t+=1);for(const[t,n]of this.pending)n.instanceId===e&&(clearTimeout(n.timer),this.pending.delete(t));return t}activeCount(){return this.active.size}pendingCount(){return this.pending.size}diagnostics(){return{pending:this.pending.size,active:this.active.size,issued:this.issued,consumed:this.consumed,rejected:this.rejected,expired:this.expired,closed:this.closed}}}const XS="x-task-handoff-cloud-internal-actor",JS=f.z.object({code:f.z.string().trim().min(1),message:f.z.string(),details:f.z.record(f.z.string(),f.z.unknown()).optional(),retryable:f.z.boolean().optional()}).strict(),QS=f.z.object({error:JS}).strict(),ZS="https://cloud.thandoff.com";function eA(e,t={}){const n=new URL(e||ZS).origin;if(n===ZS)return n;if(t.production||!0!==t.allowNonProduction)throw Object.assign(new Error("Non-production cloud service origin is not trusted by this build."),{code:"UNTRUSTED_CLOUD_SERVICE_ORIGIN"});return n}function tA(e){return td.parse({nodeId:e.id,status:e.status,health:e.health,lastSeenAt:e.lastSeenAt??null,connectionPhase:e.connectionPhase??null,connectionDiagnostics:e.connectionDiagnostics??null,proxyState:e.proxyState??null})}function nA(e){const t=process.env[e]?.trim();return t||void 0}const iA=function(e,t=process.env,n=e){let i;return()=>{const s=t.TASK_HANDOFF_VERSION?.trim();return s||(i||=q(e,t,n),i)}}("@task-handoff/control-plane");function sA(){return{component:"control-plane",packageName:"@task-handoff/control-plane",packageVersion:iA(),protocolVersion:qo,buildId:nA("TASK_HANDOFF_BUILD_ID"),builtAt:nA("TASK_HANDOFF_BUILT_AT"),gitCommit:nA("TASK_HANDOFF_GIT_COMMIT"),imageRef:nA("TASK_HANDOFF_IMAGE_REF"),imageDigest:nA("TASK_HANDOFF_IMAGE_DIGEST")}}const aA={".css":"text/css; charset=utf-8",".html":"text/html; charset=utf-8",".ico":"image/x-icon",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".map":"application/json; charset=utf-8",".png":"image/png",".svg":"image/svg+xml",".webp":"image/webp"};function oA(e,i){const s=t.resolve(e),a=t.resolve(s,i);if(a===s||a.startsWith(`${s}${t.sep}`))return n.existsSync(a)&&n.statSync(a).isFile()?a:void 0}function rA(e,i,s){const a=oA(i,s);return a?(e.header("cache-control","no-store"),e.type(aA[t.extname(a).toLowerCase()]||"application/octet-stream"),e.send(n.createReadStream(a))):e.code(404).send({error:{code:"STATIC_FILE_NOT_FOUND",message:`${s} was not found in the Control Plane UI static directory.`}})}function cA(e){if(e instanceof f.z.ZodError)return{statusCode:400,code:"VALIDATION_ERROR",message:e.issues.map(e=>`${e.path.join(".")||"body"}: ${e.message}`).join("; ")};const t=e&&"object"==typeof e?e:{};return{statusCode:"number"==typeof t.statusCode?t.statusCode:500,code:"string"==typeof t.code?t.code:"CONTROL_PLANE_ERROR",message:e instanceof Error?e.message:String(e),...t.details&&"object"==typeof t.details&&!Array.isArray(t.details)?{details:t.details}:{},..."boolean"==typeof t.retryable?{retryable:t.retryable}:{},..."number"==typeof t.retryAfterSeconds?{retryAfterSeconds:t.retryAfterSeconds}:{}}}function dA(e){const t=e.headers.authorization;if(void 0!==t){const e=/^Bearer ([^\s]+)$/.exec(t);return{token:e?.[1],clientType:"mobile"}}return{token:e.cookies[mu],clientType:"web"}}async function lA(e,t){return e.enabled()?e.authorizationForSessionToken(t.token,t.clientType):{type:"system",reason:"auth-disabled"}}const pA=new Set(["/api/auth/session","/api/auth/bootstrap-admin","/api/auth/login","/api/auth/logout","/api/auth/mobile/login","/api/control-plane/identity","/api/health","/api/events","/api/access/me","/api/auth/external/callback"]);function uA(e,t){const n=t.split("?")[0]||"/";if(!n.startsWith("/api/"))return;if(pA.has(n))return;const i=function(e){return"GET"===e||"HEAD"===e?"read":"POST"===e?"create":"PATCH"===e||"PUT"===e?"update":"DELETE"===e?"delete":"read"}(e);return"/api/control-plane/diagnostic-logs/export"===n||"/api/session-streams/diagnostics"===n?{action:"manage-settings",resource:{type:"control-plane-settings"}}:n.startsWith("/api/control-plane/settings")?{action:"GET"===e?"read":"manage-settings",resource:{type:"control-plane-settings"}}:"/api/auth/mobile/logout"===n||n.startsWith("/api/auth/mobile/sessions")||"/api/auth/password"===n||n.startsWith("/api/auth/external/")?void 0:n.startsWith("/api/users")?{action:"GET"===e?"read":"manage-members",resource:{type:n.includes("/sessions")?"user-session":"user"}}:n.startsWith("/api/roles")||"/api/permissions"===n?{action:"GET"===e?"read":"update",resource:{type:"role"}}:n.startsWith("/api/identity-providers")?{action:"GET"===e?"read":"update",resource:{type:"identity-provider"}}:n.startsWith("/api/external-identity-approvals")?{action:"GET"===e?"read":"manage-members",resource:{type:"identity-approval"}}:n.startsWith("/api/models")?{action:"GET"===e?"read":"manage-secrets",resource:{type:"model"}}:n.startsWith("/api/git-credentials")?{action:"manage-secrets",resource:{type:"secret"}}:n.startsWith("/api/chat-gateway/bridges")?{action:"GET"===e?"read":"manage-secrets",resource:{type:"chat-bridge"}}:"/api/chat-gateway/messages"===n||"/api/chat-gateway/actions"===n?{action:"send-message",resource:{type:"ai-session"}}:"/api/chat-gateway/poll-ai-sessions"===n?{action:"manage-settings",resource:{type:"chat-bridge"}}:"/api/ai-session-attachments"===n?{action:"send-message",resource:{type:"ai-session"}}:"/api/node-join/invites"===n?{action:"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/control-plane-proxy")?{action:"GET"===e?"read":"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/nodes")?/\/(runtimes|local-folders)(\/|$)/.test(n)?{action:i,resource:{type:"runtime"}}:{action:"GET"===e?"read":"manage-node-auth",resource:{type:"node"}}:n.startsWith("/api/controlled-instances")?/\/apps\/sessions\/[^/]+\/access$/.test(n)?{action:"interactive-access",resource:{type:"app-session"}}:n.includes("/ai-sessions")?n.includes("/triggers")?{action:i,resource:{type:"trigger-deployment"}}:/\/messages\/[^/]+\/attachments\/[^/]+\/content$/.test(n)?{action:"read-file-content",resource:{type:"attachment"}}:"POST"===e&&/\/ai-sessions$/.test(n)?{action:"send-message",resource:{type:"ai-session"}}:n.endsWith("/approval")?{action:"approve",resource:{type:"ai-session"}}:n.endsWith("/interrupt")?{action:"interrupt",resource:{type:"ai-session"}}:n.endsWith("/resume")||n.endsWith("/fork")||n.endsWith("/commands")||n.includes("/messages")||n.includes("/queue/")?{action:"send-message",resource:{type:"ai-session"}}:n.endsWith("/read")||n.endsWith("/mentions/files")?{action:"read",resource:{type:"ai-session"}}:n.endsWith("/open-app")||n.endsWith("/close")?{action:"update",resource:{type:"ai-session"}}:"GET"===e||"HEAD"===e?{action:"read",resource:{type:"ai-session"}}:{action:"manage-settings",resource:{type:"control-plane-settings"}}:n.includes("/start")?{action:"start",resource:{type:"instance"}}:n.includes("/stop")?{action:"stop",resource:{type:"instance"}}:n.includes("/restart")?{action:"restart",resource:{type:"instance"}}:/\/config-sync(?:\/|$)/.test(n)?{action:"update",resource:{type:"instance"}}:{action:i,resource:{type:"instance"}}:n.startsWith("/api/projects")?{action:i,resource:{type:"project"}}:n.startsWith("/api/images")||n.startsWith("/api/image-options")||n.startsWith("/api/market")?{action:i,resource:{type:"image"}}:n.startsWith("/api/triggers")?n.endsWith("/apply")?{action:"create",resource:{type:"trigger-deployment"}}:{action:i,resource:{type:"trigger-template"}}:"GET"===e||"HEAD"===e?{action:"read",resource:{type:"public-directory"}}:{action:i,resource:{type:"control-plane-settings"}}}async function mA(e={}){const a=zI(e.dataDir),o=s({logger:e.logger??!0});await o.register(an,{encodings:["br","gzip","deflate"],globalDecompression:!1,threshold:1024}),o.addContentTypeParser("application/octet-stream",(e,t,n)=>n(null,t));const c=new Nv,d=new VS,l=new YS,p=e.cloudConnectivityEnabled??"0"!==process.env.TASK_HANDOFF_CLOUD_CONNECTIVITY_ENABLED;let u=(y=process.env.TASK_HANDOFF_DIAGNOSTIC_LOGS,["1","true","yes","on"].includes(String(y||"").trim().toLowerCase()));var y;const b=function(e,i,s,a={}){const o=(o,r,c)=>{if(i()){s[o]?.(r,c);try{!function(e,i,s=10485760,a=2){const o=Buffer.isBuffer(i)?i:Buffer.from(i),r=o.byteLength>s?o.subarray(o.byteLength-s):o;if(n.mkdirSync(t.dirname(e),{recursive:!0,mode:448}),n.existsSync(e)){const t=n.lstatSync(e);if(!t.isFile()||t.isSymbolicLink())throw new Error(`Managed log path must be a regular file: ${e}`);t.size+r.byteLength>s&&(function(e,t){if(!(t<=0)){n.rmSync(ES(e,t),{force:!0});for(let i=t-1;i>=1;i-=1){const t=ES(e,i);n.existsSync(t)&&n.renameSync(t,ES(e,i+1))}}}(e,a),a>0?t.size>s?(n.writeFileSync(ES(e,1),function(e,t){const i=n.statSync(e),s=Math.min(i.size,t),a=Buffer.allocUnsafe(s),o=n.openSync(e,"r");let r=0;try{for(;r<s;){const e=n.readSync(o,a,r,s-r,i.size-s+r);if(0===e)break;r+=e}}finally{n.closeSync(o)}return r===s?a:a.subarray(0,r)}(e,s),{mode:384}),n.rmSync(e,{force:!0})):n.renameSync(e,ES(e,1)):n.rmSync(e,{force:!0}))}n.appendFileSync(e,r,{mode:384}),n.chmodSync(e,384)}(t.join(e,"control-plane.log"),`${JSON.stringify({time:(new Date).toISOString(),level:o,message:c,data:zS(r)},(e,t)=>zS(t))}\n`,a.maxBytes??10485760,a.backupCount??2)}catch{}}};return{info:(e,t)=>o("info",e,t),warn:(e,t)=>o("warn",e,t),error:(e,t)=>o("error",e,t)}}(a.logsDir,()=>u,o.log),v=new AS,I=new Ey(a,{...e.service,logger:b,nodeConnectionRuntime:v,onFleetStateChanged:t=>{e.service?.onFleetStateChanged?.(t),c.publish("node.fleet.updated",t,{topic:"instances"===t.resource?"instances":"models"===t.resource?"models":"node.runtime",scope:{nodeId:t.nodeId}})}});v.onChange(e=>c.publish("node.connection.updated",tA(I.requirePublicNode(e.nodeId)),{topic:"node.state",scope:{nodeId:e.nodeId}}));const x=new gu(a,{...e.auth,onUserAuthorizationChanged:t=>{c.invalidateUserAuthorization(t.userId,t.authorizationRevision),d.invalidate(t.userId,t.authorizationRevision),e.auth?.onUserAuthorizationChanged?.(t)}}),w=new SS(a.identitySigningPath,()=>I.proxyPrivateStore.controlPlaneId(),(e,t)=>o.log.warn(t,e)),S=new RS({statePath:a.cloudConnectivityPath,identity:w,serviceOrigin:eA(e.cloudServiceOrigin||process.env.TASK_HANDOFF_CLOUD_SERVICE_ORIGIN,{production:"production"===process.env.NODE_ENV,allowNonProduction:!0===e.allowNonProductionCloudOrigin||"staging"===process.env.TASK_HANDOFF_CLOUD_ENV})}),A=new Map,E=new GS({state:S,identity:w,relayBridge:{async request(e,t){const n=String(t?.method||"GET").toUpperCase(),s=String(t?.path||""),a=uA(n,s);if(!s.startsWith("/api/")||!a||pA.has(s.split("?")[0]))throw Object.assign(new Error("Cloud access route is not available."),{code:"CLOUD_ROUTE_FORBIDDEN",statusCode:403});pl(e,a.action,a.resource);const r=i.randomBytes(32).toString("base64url");A.set(r,e);try{const e=Object.fromEntries(Object.entries(t.headers??{}).filter(([e])=>{const t=e.toLowerCase();return!function(e){return mn.has(e.toLowerCase())}(t)&&!["host","connection","upgrade",XS].includes(t)}).map(([e,t])=>[e,String(t)])),i=await o.inject({method:n,url:s,headers:{...e,[XS]:r},...void 0===t.body?{}:{payload:t.body}});let a;try{a=i.json()}catch{a=i.body}return{status:i.statusCode,body:a}}finally{A.delete(r)}},subscribe(e,t,n,i){if("cloud-account"!==e.type)throw Object.assign(new Error("Cloud account actor required."),{code:"CLOUD_ACTOR_REQUIRED"});const s=new Set(t);if(!s.size)return()=>{};const a=c.on(e=>{(s.has("*")||s.has(e.topic)||s.has(e.type))&&nl(i,e)&&n(e)}),o=i?c.registerAiSessionTransientDemand(i):c.registerLegacyAiSessionTransientDemand(s);return()=>{a(),o()}},async openTty(e,t,n){const i=String(t?.instanceId||""),s=String(t?.sessionId||"");if(pl(e,"proxy",{type:"instance",id:i}),!i||!s)throw Object.assign(new Error("TTY target is required."),{code:"TTY_TARGET_REQUIRED",statusCode:400});const a=new Map,o=(e,...t)=>{for(const n of a.get(e)??[])n(...t)};let r=!1;const c={readyState:1,on(e,t){const n=a.get(e)??new Set;n.add(t),a.set(e,n)},send(e){try{const t=JSON.parse(String(e));if("snapshot"===t.type){const e=Ps.parse(t);n(_a.parse({type:"tty-snapshot",data:e.data,pendingEscape:e.pendingEscape,cols:e.cols,rows:e.rows}))}else"output"===t.type?n({type:"tty-output",data:t.data}):"resize"===t.type?n({type:"tty-resize",body:{cols:t.cols,rows:t.rows}}):"exit"===t.type?n({type:"tty-exit",code:t.code,signal:t.signal}):"error"===t.type&&n({type:"tty-error"})}catch{n({type:"tty-error"})}},close(){r||(r=!0,o("close"),n({type:"tty-closed"}))}};return await I.proxyInstanceWebSocket(i,c,`/api/apps/sessions/${encodeURIComponent(s)}/tty`,[],{}),{send(e){r||o("message",Buffer.from(JSON.stringify({type:"input",data:e})))},resize(e,t){!r&&Number.isInteger(e)&&Number.isInteger(t)&&e>0&&t>0&&o("message",Buffer.from(JSON.stringify({type:"resize",cols:e,rows:t})))},close(){c.close()}}}}}),_=e.cloudConnectivityLifecycle?.(S)??E.lifecycle,T=e.publishCloudBindingChallenge??(e=>E.publishBindingChallenge(e)),z=new Iw(c),k=new hw(a,{onChanged:e=>queueMicrotask(()=>c.publish(_n,e,{topic:"ai.sessions",scope:{instanceId:e.instanceId,sessionId:e.sessionId}}))});k.init();const N=new uw({bootstrap:()=>I.bootstrapAiSessionsFromInstances(),logger:b,recoverDelta:(e,t,n)=>I.recoverAiSessionDelta(e,t,n),recoverSnapshot:e=>I.recoverAiSessionSnapshot(e),onRecoveredEvent:e=>c.publish(e.type,e.payload)});N.onSnapshot(e=>k.reconcile(e.instanceId,e.aiSessions));const C=new bw({bootstrap:()=>I.bootstrapAppSessionsFromInstances(),logger:b,recoverDelta:(e,t,n)=>I.recoverAppSessionDelta(e,t,n),recoverSnapshot:e=>I.recoverAppSessionSnapshot(e),onRecoveredEvent:e=>c.publish(e.type,e.payload)});I.setAppSessionSnapshotProvider(e=>C.list(e)),I.setAiSessionSnapshotProvider(e=>N.list(e));const R=new Xv(a.dataDir,{onWarning:e=>o.log.warn(e)});c.on(e=>{if(z.handle(e),"instance.deleted"===e.type||"instance.updated"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";t&&("instance.deleted"===e.type&&(C.removeInstance(t),N.removeInstance(t),k.removeInstance(t)),R.removeInstance(t))}});const O=new Vv;o.addHook("onClose",async()=>{O.dispose()});const j=new _I(c,{connectionRuntime:v,validateInstanceScope:(e,t)=>I.nodeOwnsInstance(e,t),onInstanceLifecycle:(e,t)=>I.applyInstanceLifecycle(e,t),onStreamsHello:(e,t)=>{for(const n of t.streams)"ai.sessions"===n.topic&&N.advertiseStream(e,n),"app.sessions"===n.topic&&C.advertiseStream(e,n)},onSessionEvent:e=>e.type.startsWith("app-session.")?C.handleEvent(e):N.handleEvent(e)}),P=e.proxyOrigin||process.env.TASK_HANDOFF_CONTROL_PLANE_PROXY_ORIGIN,L=e=>{const t=I.nodes.get(e);return t?function(e,t){const n="reverse-wss"===e.connectionMode&&t,i=n?"online":e.status;return{id:e.id,name:e.name||e.id,status:i,health:e.health,...e.lastSeenAt?{lastSeenAt:e.lastSeenAt}:{},capabilities:Hw(e.capabilities||{},262144),manageable:!1!==e.connectionEnabled&&(n||"online"===i)}}(t,j.connected(t.id)):void 0},M=new Dw(new Cw(a.proxyAuthorityPath,(e,t)=>o.log.warn(t,e)),{get:L},{proxyOrigin:P,proxyOriginProvider:()=>I.getSettings().publicBaseUrl}),q=new Mw,U=new Uw(c,{projectTarget:e=>{const t=L(e);return t?Ww(t):void 0}}),$=new dS(I,{fetchImpl:e.service?.fetchImpl,logger:b,onStateChanged:e=>c.publish("node.proxy-state.updated",tA(e),{topic:"node.state",scope:{nodeId:e.id}})});let B,F,H;c.on(e=>{if("node.created"!==e.type&&"node.updated"!==e.type&&"node.deleted"!==e.type||$.syncNow(),"instance.created"===e.type||"instance.updated"===e.type||"instance.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"instanceId"in e.payload?String(e.payload.instanceId||""):"";t&&j.invalidateInstanceScope({instanceId:t})}if("node.deleted"===e.type){const t=e.payload&&"object"==typeof e.payload&&"nodeId"in e.payload?String(e.payload.nodeId||""):"";if(t){j.invalidateInstanceScope({nodeId:t});const e=M.revokeTarget(t);for(const n of e.bindings)q.closeBinding(n.id,"Proxy target was deleted."),c.publish("control-plane-proxy.binding.updated",{binding:n},{topic:"control-plane-proxy",scope:{nodeId:t}})}}}),I.setNodeAgentTransport(j),await x.init(),I.init(),u=I.diagnosticLogsEnabled(),w.init(),S.init(),p&&E.start();const G=()=>{if(B)return B;const e=I.recoverPendingPairingRevokes().then(()=>{});return B=e,e.then(()=>{B===e&&(B=void 0)},()=>{B===e&&(B=void 0)}),e};await G().catch(e=>o.log.warn({error:e},"pending node pairing recovery failed")),M.init(),$.start(),await I.syncLocalNodeConnection().catch(()=>{});const W=new Zb(I,e.service?.fetchImpl,{aiSessions:N,logger:b,diagnosticLogsEnabled:()=>u});W.startEnabled();const V=new TI(I,j,{safetyIntervalMs:Number(process.env.TASK_HANDOFF_EVENT_CONNECTION_SAFETY_INTERVAL_MS)||void 0,logger:b,connectionRuntime:v}),K=c.onAiSessionTransientDemand(e=>{V.setAiSessionTransientDemand(e)});V.start(),await o.register(h),await o.register(g,{options:on}),o.addHook("onClose",async()=>{await E.stop(),F&&clearInterval(F),H&&clearInterval(H),await(B?.catch(()=>{})),z.close(),U.stop(),$.stop(),V.stop(),K(),W.stopAll(),I.dispose(),await x.close()}),o.setErrorHandler((e,t,n)=>{const i=cA(e);void 0!==i.retryAfterSeconds&&n.header("retry-after",String(i.retryAfterSeconds)),(u||i.statusCode>=500)&&(i.statusCode>=500?o.log.error.bind(o.log):o.log.warn.bind(o.log))({method:t.method,url:t.url,statusCode:i.statusCode,errorCode:i.code,error:i.message},"control plane request failed"),n.code(i.statusCode).send(QS.parse({error:{code:i.code,message:i.message,...i.details?{details:i.details}:{},...void 0!==i.retryable?{retryable:i.retryable}:{}}}))}),o.addHook("preHandler",async(e,t)=>{const n=e.routeOptions.url,i=n&&"*"!==n?n:e.url,s=e.routeOptions.config.controlPlaneAuthBoundary,a=e.headers[XS],o="string"==typeof a?A.get(a):void 0;if(o){A.delete(a),ix(e,o);const t=uA(e.method,i);if(!t)throw Object.assign(new Error("Cloud access route is not authorized."),{code:"CLOUD_ROUTE_FORBIDDEN",statusCode:403});return void pl(o,t.action,t.resource)}if("proxy-binding"===s||"node-tunnel"===s)return;const r="public"===s||"public-ui"===s&&function(e){const t=e.split("?")[0]||"/";return!t.startsWith("/api/")&&"/api"!==t&&!t.startsWith("/instances/")&&"/instances"!==t}(e.url);if(!x.enabled()||r){const t=await lA(x,dA(e));ix(e,t||{type:"system",reason:"auth-disabled"});const n=uA(e.method,i);return void(n&&pl(t||{type:"system",reason:"auth-disabled"},n.action,n.resource))}const c=await lA(x,dA(e));if(!c)return t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to access the Control Plane."}});if(ix(e,c),"user"===c.type&&c.requiresPasswordChange&&"/api/auth/password"!==i)throw Object.assign(new Error("Change the temporary password before accessing the Control Plane."),{code:"AUTH_PASSWORD_CHANGE_REQUIRED",statusCode:403});const d=uA(e.method,i);if(d)if("user"===c.type){let t;pl(c,d.action,d.resource);try{t=await async function(e,t,n,i,s,a){const o=QI(t.params),r=QI(t.body);if(["user","role","identity-provider","user-session","identity-approval","user-audit","secret","chat-bridge","control-plane-settings"].includes(i.type))return[{kind:"global-admin"}];if("trigger-template"===i.type)return[{kind:"global-shared"}];if("public-directory"===i.type)return[{kind:"global-public"}];if("image"===i.type)return[{kind:"global-public"}];if("model"===i.type&&!n.startsWith("/api/nodes/"))return[{kind:"global-public"}];const c=ZI(o.nodeId)||(n.startsWith("/api/nodes/")?ZI(o.id):void 0);if(c&&["node","runtime","template","model"].includes(i.type))return e.requireNode(c),[ex(c)];if("project"===i.type){const t=ZI(o.id);if(!t)return;const n=e.requireProject(t);if("local-folder"!==n.source.type)return[{kind:"global-public"}];if(!n.source.ownerNodeId)throw Object.assign(new Error("The requested resource is not visible."),{code:"CONTROL_PLANE_RESOURCE_NOT_VISIBLE",statusCode:404});return e.requireNode(n.source.ownerNodeId),[ex(n.source.ownerNodeId)]}if("instance"===i.type&&"/api/controlled-instances"===n&&"create"===a){const t=e.resolveControlledInstanceTargetNodeId(r);return e.requireNode(t),[ex(t)]}if("trigger-deployment"===i.type&&n.endsWith("/apply")){const t=Array.isArray(r.instanceIds)?r.instanceIds.map(ZI).filter(e=>Boolean(e)):[];if(!t.length)return;return Promise.all([...new Set(t)].map(t=>tx(e,t,s)))}const d=n.startsWith("/api/controlled-instances/")?ZI(o.id):ZI(r.instanceId);return d&&["instance","app-session","ai-session","trigger-deployment","repository","attachment","template"].includes(i.type)?[await tx(e,d,s)]:["node","runtime","template"].includes(i.type)&&c?[ex(c)]:void 0}(I,e,i,d.resource,c,d.action)}catch(e){if(e&&"object"==typeof e&&404===e.statusCode)throw Object.assign(new Error("The requested resource is not visible."),{statusCode:404,code:"CONTROL_PLANE_RESOURCE_NOT_VISIBLE"});throw e}if(t?.length)for(const e of t)ul(c,d.action,d.resource,e)}else pl(c,d.action,d.resource)});const Y=t.resolve(e.staticDir||process.env.TASK_HANDOFF_CONTROL_PLANE_STATIC_DIR||t.resolve(process.cwd(),"packages","control-plane-ui","dist"));n.existsSync(Y)&&(o.get("/assets/*",{config:Zv},async(e,n)=>{const i=e.params["*"];return rA(n,Y,t.join("assets",i||""))}),o.get("/favicon.ico",{config:Zv},async(e,t)=>oA(Y,"favicon.ico")?rA(t,Y,"favicon.ico"):t.code(204).send())),o.get("/api/health",{config:Zv},async()=>Vr.parse({data:{ok:!0,role:"control-plane",protocolVersion:qo,build:sA(),serverTime:(new Date).toISOString()}})),o.get("/api/control-plane/identity",{config:Zv},async()=>w.publicDocument(x.enabled()?"required":"disabled"));const X=async e=>{if(!p)throw Object.assign(new Error("Cloud connectivity is disabled by feature flag."),{code:"CLOUD_CONNECTIVITY_DISABLED",statusCode:503});pl(await lA(x,dA(e))||{type:"system",reason:"auth-disabled"},"manage-settings",{type:"control-plane-settings"})};return o.get("/api/cloud-connectivity",async e=>(await X(e),{data:S.snapshot()})),o.post("/api/cloud-connectivity/challenges",async(e,t)=>{await X(e),t.header("cache-control","no-store");const n=S.createChallenge();return await T(n),{data:n}}),o.post("/api/cloud-connectivity/remote-access",async e=>{await X(e);const t=f.z.object({enabled:f.z.boolean()}).strict().parse(e.body);return{data:_?await _.setRemoteAccess(t.enabled):S.setRemoteAccess(t.enabled)}}),o.post("/api/cloud-connectivity/disconnect",async e=>(await X(e),{data:_?await _.disconnect():S.beginRevocation()})),o.get("/api/session-streams/diagnostics",async()=>({data:{aiSessions:N.diagnostics(),aiSessionActions:I.aiSessionActionDiagnostics(),appSessions:C.diagnostics(),nodeConnections:{...V.diagnostics(),runtime:v.diagnostics()},eventAuthorization:c.authorizationDiagnostics(),browserRelay:l.diagnostics()}})),o.get("/install-node-agent.sh",{config:Zv},async(e,t)=>(t.header("cache-control","no-store"),t.type("text/x-shellscript; charset=utf-8"),vw`#!/bin/sh
 set -eu
 
+MIN_NODE_VERSION="24.15.0"
 CONTROL_PLANE_URL=""
 JOIN_TOKEN=""
 SERVICE_USER="root"
@@ -33,9 +34,18 @@ Options:
   --service-user <user>       systemd service user
   --host <host>               Node-agent HTTP bind host, default 127.0.0.1
   --port <port>               Node-agent HTTP port, default 8091
+
+On Debian, Ubuntu, RHEL 8/9, and compatible dnf-based hosts, the installer
+can also install a compatible Node.js 24 and npm. Existing compatible Node.js
+and npm installations are used without invoking a system package manager.
 USAGE
 }
 
+die() {
+  echo "Error: $*" >&2
+  exit 1
+}
+
 need_root() {
   if [ "$(id -u)" != "0" ]; then
     echo "This installer must run as root. Re-run with sudo." >&2
@@ -50,6 +60,81 @@ require_command() {
   fi
 }
 
+node_is_compatible() {
+  command -v node >/dev/null 2>&1 || return 1
+  current_node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
+  case "$current_node_version" in
+    24.*) version_is_at_least "$current_node_version" "$MIN_NODE_VERSION" ;;
+    *) return 1 ;;
+  esac
+}
+
+version_is_at_least() {
+  awk -v current="$1" -v minimum="$2" 'BEGIN {
+    split(current, left, "."); split(minimum, right, ".");
+    for (i = 1; i <= 3; i++) {
+      if ((left[i] + 0) > (right[i] + 0)) exit 0;
+      if ((left[i] + 0) < (right[i] + 0)) exit 1;
+    }
+    exit 0;
+  }'
+}
+
+install_node_prerequisites() {
+  if command -v apt-get >/dev/null 2>&1; then
+    export DEBIAN_FRONTEND=noninteractive
+    echo "Refreshing apt package metadata"
+    apt-get update
+    apt-get install -y ca-certificates curl xz-utils
+  elif command -v dnf >/dev/null 2>&1; then
+    echo "Installing Node.js archive prerequisites with dnf"
+    dnf install -y ca-certificates curl tar xz
+  else
+    die "automatic Node.js installation requires apt-get or dnf; install Node.js $MIN_NODE_VERSION with npm manually"
+  fi
+}
+
+ensure_supported_linux_runtime() {
+  for command in awk getconf uname; do require_command "$command"; done
+  [ "$(uname -s)" = "Linux" ] || die "runtime packages support Linux hosts only"
+  case "$(uname -m)" in
+    x86_64|amd64) node_arch="x64" ;;
+    aarch64|arm64) node_arch="arm64" ;;
+    *) die "runtime packages support x86_64 and arm64 Linux hosts only" ;;
+  esac
+  glibc_version="$(getconf GNU_LIBC_VERSION 2>/dev/null | awk '{ print $2 }')"
+  [ -n "$glibc_version" ] && version_is_at_least "$glibc_version" "2.28" \
+    || die "runtime packages require glibc 2.28 or newer; found \${glibc_version:-unknown}"
+}
+
+ensure_node_environment() {
+  if node_is_compatible && command -v npm >/dev/null 2>&1; then
+    ensure_supported_linux_runtime
+    echo "Using existing Node.js $(node --version) and npm $(npm --version)"
+    return
+  fi
+
+  echo "Installing the current official Node.js 24 build with its bundled npm."
+  install_node_prerequisites
+  for command in awk curl getconf mktemp sha256sum tar uname; do require_command "$command"; done
+  ensure_supported_linux_runtime
+  node_tmp="$(mktemp -d)"
+  trap 'rm -rf "$node_tmp"' EXIT HUP INT TERM
+  curl -fsSL https://nodejs.org/dist/latest-v24.x/SHASUMS256.txt -o "$node_tmp/SHASUMS256.txt"
+  node_archive="$(awk -v suffix="linux-$node_arch.tar.xz" '$2 ~ suffix "$" { print $2; exit }' "$node_tmp/SHASUMS256.txt")"
+  [ -n "$node_archive" ] || die "could not find the official Node.js 24 archive for $node_arch"
+  curl -fsSL "https://nodejs.org/dist/latest-v24.x/$node_archive" -o "$node_tmp/$node_archive"
+  expected_checksum="$(awk -v archive="$node_archive" '$2 == archive { print $1; exit }' "$node_tmp/SHASUMS256.txt")"
+  actual_checksum="$(sha256sum "$node_tmp/$node_archive" | awk '{ print $1 }')"
+  [ "$actual_checksum" = "$expected_checksum" ] || die "Node.js archive checksum verification failed"
+  tar -xJf "$node_tmp/$node_archive" --strip-components=1 -C /usr/local
+  rm -rf "$node_tmp"
+  trap - EXIT HUP INT TERM
+
+  node_is_compatible || die "Node.js $MIN_NODE_VERSION or newer within the Node.js 24 release line is required; found $(node --version 2>/dev/null || echo none)"
+  command -v npm >/dev/null 2>&1 || die "npm was not installed with Node.js"
+}
+
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --control-plane) CONTROL_PLANE_URL="\${2:-}"; shift 2 ;;
@@ -70,7 +155,6 @@ while [ "$#" -gt 0 ]; do
 done
 
 need_root
-require_command curl
 
 if [ -z "$CONTROL_PLANE_URL" ]; then
   echo "--control-plane is required." >&2
@@ -84,6 +168,9 @@ if ! command -v systemctl >/dev/null 2>&1; then
   exit 1
 fi
 
+ensure_node_environment
+require_command curl
+
 if [ "$SERVICE_USER" != "root" ] && ! id "$SERVICE_USER" >/dev/null 2>&1; then
   useradd --system --create-home --home-dir /var/lib/task-handoff --shell /usr/sbin/nologin "$SERVICE_USER"
 fi
@@ -186,14 +273,18 @@ WantedBy=multi-user.target
 EOF
 
 systemctl daemon-reload
-systemctl enable --now task-handoff-node-agent.service
+# Compatibility for v0.0.24: enable --now left an already-running process on
+# the old package, environment, and unit after a repeated installation.
+systemctl enable task-handoff-node-agent.service
+systemctl restart task-handoff-node-agent.service
 
 for i in $(seq 1 30); do
-  if curl -fsS "http://$HOST:$PORT/api/node-agent/health" >/dev/null 2>&1; then
+  if [ -S "$IPC_PATH" ] && curl --unix-socket "$IPC_PATH" -fsS "http://localhost/api/node-agent/health" >/dev/null 2>&1; then
     break
   fi
   if [ "$i" = "30" ]; then
     systemctl status --no-pager task-handoff-node-agent.service || true
+    curl --unix-socket "$IPC_PATH" -sS "http://localhost/api/node-agent/health" >&2 || true
     echo "Node agent did not become healthy." >&2
     exit 1
   fi
@@ -203,9 +294,10 @@ done
 if [ -n "$JOIN_TOKEN" ]; then
   payload="$(mktemp)"
   status="$(curl -sS -o "$payload" -w '%{http_code}' \
+    --unix-socket "$IPC_PATH" \
     -H 'content-type: application/json' \
     -d "{\"controlPlaneUrl\":\"$CONTROL_PLANE_URL\",\"joinToken\":\"$JOIN_TOKEN\",\"controlPlaneName\":\"TaskHandoff Control Plane\",\"activate\":true}" \
-    "http://$HOST:$PORT/api/node-agent/control-plane-connections")"
+    "http://localhost/api/node-agent/control-plane-connections")"
   if [ "$status" != "201" ]; then
     cat "$payload" >&2 || true
     rm -f "$payload"
@@ -220,4 +312,5 @@ fi
 echo "TaskHandoff node-agent is installed and running."
 echo "Service: task-handoff-node-agent.service"
 echo "Pairing token: sudo task-handoff-node-agent invite --ipc-path $IPC_PATH"
-`)),l.get("/api/events",{websocket:!0},async(e,t)=>{const n=t.query,s="string"==typeof n.instanceId?n.instanceId.trim():"",i=[];let r=!1;const o={get readyState(){return e.readyState},get bufferedAmount(){return e.bufferedAmount},OPEN:e.OPEN,send(t){r?e.send(t):i.push(t)},on(t,n){e.on(t,n)},close(t,n){e.close(t,n)}};p.connect(o,{instanceIds:s?[s]:void 0,expectsTransientSubscription:"1"===n.aiSessionTransient});const[a,d]=await Promise.all([R.streamDescriptors(),O.streamDescriptors()]);p.send(e,"streams.hello",{protocolVersion:1,streams:[...a,...d].filter(e=>!s||e.instanceId===s)}),r=!0;for(const t of i)e.send(t);for(const t of x.snapshots().filter(e=>!s||e.instanceId===s))p.send(e,"image.pull.snapshot",t,{topic:"instances",scope:{instanceId:t.instanceId}})}),l.get("/api/auth/session",{config:em},async e=>{const t=$f(e);return{data:await v.currentSession(t.token,t.clientType)}}),l.post("/api/auth/bootstrap-admin",{config:em},async(e,t)=>{const n=await v.bootstrapAdmin(e.body);return t.code(201).send({data:n})}),l.post("/api/auth/login",{config:em},async(e,t)=>{const n=await v.login(e.body,{sourceId:e.ip});return t.setCookie(qo,n.sessionToken,{path:"/",httpOnly:!0,sameSite:"lax",expires:new Date(n.expiresAt)}),{data:{user:n.user}}}),l.post("/api/auth/mobile/login",{config:em},async e=>({data:await v.loginMobile(e.body,{sourceId:e.ip})})),l.patch("/api/auth/password",async(e,t)=>{const n=await v.changePassword(e.cookies[qo],e.body,{sourceId:e.ip});return t.setCookie(qo,n.sessionToken,{path:"/",httpOnly:!0,sameSite:"lax",expires:new Date(n.expiresAt)}),{data:{user:n.user}}}),l.post("/api/auth/mobile/logout",async e=>{const t=$f(e);return{data:v.logout("mobile"===t.clientType?t.token:void 0)}}),l.get("/api/auth/mobile/sessions",async(e,t)=>{const n=v.mobileSessions($f(e).token);return n?{data:n}:t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to access mobile sessions."}})}),l.delete("/api/auth/mobile/sessions/:id",async(e,t)=>{const n=d.z.object({id:d.z.string().trim().min(1)}).parse(e.params),s=v.revokeMobileSession($f(e).token,n.id);return void 0===s?t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to revoke mobile sessions."}}):{data:{revoked:s}}}),l.post("/api/auth/logout",{config:em},async(e,t)=>{const n=v.logout(e.cookies[qo]);return t.clearCookie(qo,{path:"/"}),{data:n}}),l.get("/api/control-plane/status",async()=>({data:{protocolVersion:ks,build:jf(),storage:c}})),l.get("/api/control-plane/settings",async()=>({data:b.getSettings()})),l.patch("/api/control-plane/settings",async e=>{const t=b.updateSettings(e.body||{});return h=t.diagnosticLogs,{data:t}}),l.get("/api/control-plane/diagnostic-logs/export",async(e,s)=>{const i=await async function(e){const s=n.mkdtempSync(t.join(f.tmpdir(),"task-handoff-diagnostic-logs-")),i=t.resolve(e.nodeAgentDataDir||t.join(e.dataDir,"node-agent")),r=t.join(i,"local-instances"),o=n.existsSync(r)?n.readdirSync(r,{withFileTypes:!0}).filter(e=>e.isDirectory()&&!e.isSymbolicLink()).map(e=>({label:t.join("local-instances",e.name),root:t.join(r,e.name,"logs")})):[],a=[{label:"control-plane",root:t.join(e.dataDir,"logs")},{label:"desktop",root:t.join(e.dataDir,"log")},{label:"node-agent",root:t.join(i,"logs")},...o],d=[];let c=0;for(const e of a)for(const i of lf(e.root)){if(c>=df)break;const r=t.relative(e.root,i);if(!r||r.startsWith("..")||t.isAbsolute(r))continue;const o=t.join("logs",e.label,r),a=n.statSync(i).size,l=pf(i,t.join(s,o),df-c);l&&(c+=l,d.push({source:i,archivePath:o,bytes:l,originalBytes:a}))}n.writeFileSync(t.join(s,"manifest.json"),`${JSON.stringify({createdAt:(new Date).toISOString(),diagnosticLogsEnabled:e.diagnosticLogsEnabled,limits:{perFileBytes:af,totalBytes:df},files:d.map(({archivePath:e,bytes:t,originalBytes:n})=>({archivePath:e,bytes:t,originalBytes:n,truncated:t<n}))},null,2)}\n`,{mode:384});const l=["manifest.json",...n.existsSync(t.join(s,"logs"))?["logs"]:[]],p=z.create({cwd:s,gzip:!0,portable:!0,noMtime:!0},l),u=()=>n.rmSync(s,{recursive:!0,force:!0});return p.once("close",u),p.once("error",u),{filename:`task-handoff-diagnostic-logs-${(new Date).toISOString().replace(/[:.]/g,"-")}.tar.gz`,stream:p}}({dataDir:c.dataDir,nodeAgentDataDir:process.env.TASK_HANDOFF_DESKTOP_NODE_AGENT_DATA_DIR||process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR,diagnosticLogsEnabled:h});return s.header("content-type","application/gzip"),s.header("content-disposition",`attachment; filename="${i.filename}"`),s.send(i.stream)}),l.post("/api/ai-session-attachments",{bodyLimit:33554432},async(e,t)=>{try{return t.code(201).send({data:P.upload(e.body)})}catch(e){return t.code(400).send({error:{code:"AI_SESSION_ATTACHMENT_INVALID",message:e instanceof Error?e.message:String(e)}})}}),Dg({app:l,service:b,events:p,appSessionAggregator:O,aiSessionAggregator:R,aiSessionUnread:N,chatGateway:V,aiSessionAttachments:P,aiSessionAttachmentCache:_,nodeAgentTunnel:j,nodeEventSubscriber:K,errorPayload:qf}),function(e){const{app:t,authority:n,resolveTarget:s,projectTarget:i,eventHub:r}=e,o=e.runtime??new Ay,a=new WeakMap,d=(e,t)=>{const n=a.get(e);n&&(a.delete(e),n.tracked.release(),e.raw.removeListener("aborted",n.abort),t.raw.removeListener("close",n.abort))};t.all("/api/node-proxy/bindings/:bindingId/http/*",{config:nm,bodyLimit:o.maxRequestBodyBytes,logLevel:"silent",async onRequest(e,t){try{const s=Oy.parse(e.params).bindingId,i=My(n,s,e),r=function(e){const t=e.raw.url||e.url,n=/^\/api\/node-proxy\/bindings\/[^/]+\/http(\/[^#]*)$/.exec(t);if(!n||/%(?:2f|5c)/i.test(n[1]))throw Uy(rs.RouteInvalid,"Proxy route is invalid.",400);const s=Xn.safeParse(n[1]);if(!s.success)throw Uy(rs.RouteInvalid,s.error.issues[0]?.message||"Proxy route is invalid.",400);return s.data}(e),c=$y(e.headers),l=o.reserveHttp(i.id),p=()=>{l.controller.abort(Object.assign(new Error("Proxy HTTP consumer disconnected."),{name:"AbortError",code:"ABORT_ERR"})),d(e,t)};a.set(e,{binding:i,route:r,forwardedHeaders:c,tracked:l,abort:p,startedAt:performance.now()}),e.raw.once("aborted",p),t.raw.once("close",p)}catch(n){return By(t,n,e)}},async onError(e,t){d(e,t);const n=Wy(e.headers);n&&t.header("x-request-id",n)},async onResponse(e,t){d(e,t)}},async(e,i)=>{try{const o=a.get(e);if(!o)throw Uy(rs.TransportFailed,"Proxy request context is unavailable.",500,!0);const{binding:c,route:l,forwardedHeaders:p,tracked:u,abort:h,startedAt:g}=o;!function(e,t,n){const s=new URL(t,"https://node-agent.invalid").searchParams,i=[s.get("nodeId"),s.get("targetNodeId")];if(n&&"object"==typeof n&&!Array.isArray(n)){const e=n;"string"==typeof e.nodeId&&i.push(e.nodeId),"string"==typeof e.targetNodeId&&i.push(e.targetNodeId)}const r=i.find(t=>null!==t&&t!==e.targetNodeId);if(void 0!==r)throw Uy(rs.TargetMismatch,"Proxy request attempts to select a target outside its binding.",409,!1,{bindingId:e.id,targetNodeId:e.targetNodeId})}(c,l,e.body);const y=null==(r=e.body)?void 0:Buffer.isBuffer(r)?r:r instanceof Uint8Array||"string"==typeof r?Buffer.from(r):Buffer.from(JSON.stringify(r));u.acceptRequestBody(y?.byteLength??0);try{const{node:r,transport:o}=await s(c.targetNodeId);Ly(n,c,e),qy(c,r);const a=await o.requestStream(r,l,{method:e.method,headers:p,...y?{body:y}:{},signal:u.controller.signal}),d=performance.now()-g;return t.log.info({traceId:p[ba],requestId:p["x-request-id"],bindingId:c.id,targetNodeId:c.targetNodeId,routePath:new URL(l,"https://node-agent.invalid").pathname,statusCode:a.status,proxyForwardMs:d},"control-plane proxy request timing"),function(e,t,n,s,i,r,o,a){t.body&&n.beginResponseStream();const d=function(e,t){const n=Object.fromEntries([...es].flatMap(t=>{const n=e.headers.get(t);return null===n?[]:[[t,n]]}));return t&&(n["x-request-id"]=t),n}(t,r);d["server-timing"]=Sa(d["server-timing"],va("proxy_forward",a??0)),o&&!d[ba]&&(d[ba]=o);for(const[t,n]of Object.entries(d))e.header(t,n);const c=()=>{n.release(),i.raw.removeListener("aborted",s),e.raw.removeListener("close",s)};if(!t.body)return c(),e.code(t.status).send();const l=m.Readable.fromWeb(t.body);return n.controller.signal.addEventListener("abort",()=>{const e=n.controller.signal.reason;l.destroy(e instanceof Error?e:new Error("Proxy HTTP stream aborted."))},{once:!0}),l.on("data",e=>{try{n.acceptResponseChunk(e)}catch(e){l.destroy(e)}}),l.once("end",c),l.once("error",c),l.once("close",c),e.raw.once("close",()=>l.destroy()),e.code(t.status).send(l)}(i,a,u,h,e,p["x-request-id"],p[ba],d)}catch(t){throw d(e,i),t}}catch(t){return d(e,i),By(i,t,e)}var r}),t.get("/api/node-proxy/bindings/:bindingId/websocket",{websocket:!0,logLevel:"silent",config:nm},async(e,t)=>{let i;try{const r=Oy.parse(t.params).bindingId,a=My(n,r,t),d=_y.parse(t.query).route,{node:c,transport:l}=await s(a.targetNodeId);Ly(n,a,t),qy(a,c),i=o.openWebSocket(a.id,e),l.proxyWebSocket(c,i,d,function(e){const t=Hy(e,"sec-websocket-protocol").split(",").map(e=>e.trim()).filter(Boolean);return t.length?t:void 0}(t.headers),$y(t.headers))}catch(t){const n=Fy(t);i?.close(1008,n.message),i||e.close(429===n.statusCode?1013:n.statusCode<500?1008:1011,Gy(n.message))}}),t.get("/api/node-proxy/bindings/:bindingId/snapshot",{config:nm},async(e,t)=>{try{const t=Oy.parse(e.params).bindingId,a=My(n,t,e),{node:d}=await s(a.targetNodeId);Ly(n,a,e),qy(a,d);const c=i(a.targetNodeId);if(!c)throw Uy(rs.TargetUnavailable,"Proxy target no longer exists.",404,!1,{targetNodeId:a.targetNodeId});const l=r.cursor(a.targetNodeId),p=fs.parse({protocolVersion:Wn,binding:a,streamId:l.streamId,revision:l.revision,observedAt:(new Date).toISOString(),target:Ry(c)});if(o=p,Buffer.byteLength(JSON.stringify(o),"utf8")>Dy)throw Uy(rs.ResourceLimit,"Proxy target snapshot byte limit exceeded.",429,!0,{bindingId:a.id,resource:"snapshot-bytes",limit:Dy});return{data:p}}catch(n){return By(t,n,e)}var o}),t.get("/api/node-proxy/bindings/:bindingId/events",{websocket:!0,logLevel:"silent",config:nm},async(e,t)=>{let i,a,d;try{const c=Oy.parse(t.params).bindingId,l=My(n,c,t),p=Py.parse(t.query),{node:u}=await s(l.targetNodeId);Ly(n,l,t),qy(l,u),i=o.openWebSocket(l.id,e,()=>a?.()),i.on("message",()=>i?.close(1008,"Proxy event streams do not accept client messages."));const h=r.subscribe({bindingId:l.id,sourceControlPlaneId:l.sourceControlPlaneId,targetNodeId:l.targetNodeId},p.sinceRevision,e=>{i?.send(JSON.stringify(e))},()=>{i?.close(1011,"Proxy event delivery failed.")});a=h.close,d=o.registerBindingCleanup(l.id,a);const m=()=>{a?.(),d?.()};i.on("close",m),i.on("error",m),"snapshot-required"===h.kind?(a(),i.close(1008,"Proxy target snapshot is required.")):1!==i.readyState&&a()}catch(t){a?.(),d?.();const n=Fy(t);i?.close(1008,n.message),i||e.close(429===n.statusCode?1013:n.statusCode<500?1008:1011,Gy(n.message))}}),t.delete("/api/node-proxy/bindings/:bindingId",{config:nm},async(t,s)=>{try{const s=Oy.parse(t.params).bindingId;My(n,s,t);const i=n.revokeBinding(s),r=o.closeBinding(s);return e.onBindingRevoked?.(i),{data:{binding:i,closed:r}}}catch(e){return By(s,e,t)}})}({app:l,authority:L,resolveTarget:e=>{const t=b.requireNode(e);return{node:t,transport:b.resolveNodeAgentTransport(t)}},projectTarget:M,runtime:$,eventHub:B,onBindingRevoked:e=>p.publish("control-plane-proxy.binding.updated",{binding:e,audit:{action:"binding.revoke",actor:`control-plane:${e.sourceControlPlaneId}`}},{topic:"control-plane-proxy",scope:{nodeId:e.targetNodeId}})}),function(e){const{app:t,service:n,proxy:s,runtime:i,events:r,syncNodeEvents:o,actorId:a}=e;t.get("/api/control-plane-proxy/invites",async()=>({data:s.listInvites()})),t.post("/api/control-plane-proxy/invites",async(e,t)=>{const n=await a(e),i=s.createInvite(e.body,n);return r.publish("control-plane-proxy.invite.created",{invite:i.invite,audit:{action:"invite.create",actor:n}},{topic:"control-plane-proxy",scope:{nodeId:i.invite.targetNodeId}}),t.code(201).send({data:i})}),t.delete("/api/control-plane-proxy/invites/:id",async e=>{const t=await a(e),n=s.revokeInvite(Yy.parse(e.params).id);return r.publish("control-plane-proxy.invite.updated",{invite:n,audit:{action:"invite.revoke",actor:t}},{topic:"control-plane-proxy",scope:{nodeId:n.targetNodeId}}),{data:n}}),t.get("/api/control-plane-proxy/bindings",async()=>({data:s.listBindings()})),t.delete("/api/control-plane-proxy/bindings/:id",async e=>{const t=await a(e),n=Yy.parse(e.params).id,o=s.revokeBinding(n),d=i.closeBinding(n);return r.publish("control-plane-proxy.binding.updated",{binding:o,audit:{action:"binding.revoke",actor:t}},{topic:"control-plane-proxy",scope:{nodeId:o.targetNodeId}}),{data:{binding:o,closed:d}}}),t.get("/api/control-plane-proxy/diagnostics",async()=>({data:i.diagnostics()})),t.post("/api/node-proxy/claims",{config:em},async(e,t)=>{const n=s.claimInvite(e.body);return r.publish("control-plane-proxy.binding.created",{binding:n.binding,audit:{action:"binding.claim",actor:`control-plane:${n.binding.sourceControlPlaneId}`}},{topic:"control-plane-proxy",scope:{nodeId:n.binding.targetNodeId}}),t.code(201).send({data:n})}),t.get("/api/control-plane-proxy/pending-claims",async()=>({data:n.listPendingProxyClaims()})),t.post("/api/control-plane-proxy/claims",async(e,t)=>{const s=await n.claimProxyNode(e.body);return o?.(),r.publish("node.created",{nodeId:s.node.id}),t.code(201).send({data:s})}),t.post("/api/control-plane-proxy/pending-claims/:id/resume",async e=>{const t=Yy.parse(e.params).id;Qy.parse(e.body||{});const s=await n.resumeProxyClaim(t);return o?.(),r.publish("node.created",{nodeId:s.node.id}),{data:s}}),t.delete("/api/control-plane-proxy/pending-claims/:id",async e=>{const t=Xy.parse(e.query||{});return{data:await n.cancelProxyClaim(Yy.parse(e.params).id,"true"===t.force)}})}({app:l,service:b,proxy:L,runtime:$,events:p,syncNodeEvents:()=>K.syncNow(),actorId:async e=>{const t=await Bf(v,$f(e));return t?"user"===t.type?`user:${t.userId}`:"system"===t.type?`system:${t.reason}`:"cloud-account"===t.type?`cloud-account:${t.accountId}:${t.deviceSessionId}`:`chat-bridge:${t.bridgeId}`:"system:unknown"}}),function({app:e,service:t}){!function(e){for(const t of["application/octet-stream","application/x-www-form-urlencoded"])Kg(e,t);Kg(e,/^multipart\/form-data(?:;.*)?$/i)}(e),e.get("/api/app-access/session",{config:em},async e=>{const n=Jg(e.url),s="vnc"===e.query.mode?"vnc":"web"===e.query.mode?"web":"tty",i=await t.appAccessProxyTarget(n,s);return{data:{mode:s,instance:{id:i.instance.id,name:i.instance.name,projectId:i.instance.projectId,projectName:"string"==typeof i.instance.sourceSnapshot.name?i.instance.sourceSnapshot.name:void 0},session:i.session,expiresAt:i.access.expiresAt,ttySocketPath:"tty"===s?`/apps/access/tty/ws?token=${encodeURIComponent(n)}`:void 0,vncFramePath:"vnc"===s?Yg(n,i.access.sessionId,i.session):void 0}}}),e.get("/apps/access/tty/ws",{websocket:!0,config:em},async(e,n)=>{try{const s=await t.appAccessProxyTarget(Jg(n.url),"tty");await t.proxyInstanceWebSocket(s.instance.id,e,s.path,Lg(n.headers),Fg(n.headers))}catch{e.close(1011,"TTY access link is invalid or expired.")}});const n=async(e,n)=>{const s=n.params;try{const i=await t.appAccessProxyTarget(s.token||Jg(n.url),"vnc",s["*"]||"");await t.proxyInstanceWebSocket(i.instance.id,e,i.path,Lg(n.headers),Fg(n.headers))}catch{e.close(1011,"VNC access link is invalid or expired.")}};e.route({method:"GET",url:"/apps/access/vnc/proxy/*",config:em,wsHandler:n,handler:async(e,n)=>{const s=e.params,i=await t.appAccessProxyTarget(Jg(e.url),"vnc",s["*"]||"");return Gg(n,await Ug(t,n,i.instance.id,i.path,{method:e.method,headers:Bg(e.headers)}),i.instance.id,i.path)}}),e.route({method:"GET",url:"/apps/access/vnc/:token/proxy/*",config:em,wsHandler:n,handler:async(e,n)=>{const s=e.params,i=await t.appAccessProxyTarget(s.token,"vnc",s["*"]||"");return Gg(n,await Ug(t,n,i.instance.id,i.path,{method:e.method,headers:Bg(e.headers)}),i.instance.id,i.path)}}),e.all("/instances/:id",{bodyLimit:67108864},async(e,n)=>{const s=e.params;return"GET"===e.method||"HEAD"===e.method?n.redirect(`${Wg(s.id)}/`):Gg(n,await Ug(t,n,s.id,"/",{method:e.method,headers:Bg(e.headers),body:Vg(e.body)}),s.id,"/")}),e.route({method:"GET",url:"/instances/:id/*",wsHandler:async(e,n)=>{const s=n.params,i=s["*"]||"",r=n.url.indexOf("?"),o=r>=0?n.url.slice(r):"";try{await t.proxyInstanceWebSocket(s.id,e,`/${i}${o}`,Lg(n.headers),Fg(n.headers))}catch{e.close(1011,"Instance websocket endpoint is not reachable.")}},handler:async(e,n)=>{const s=e.params,i=s["*"]||"",r=e.url.indexOf("?"),o=`/${i}${r>=0?e.url.slice(r):""}`;return Gg(n,await Ug(t,n,s.id,o,{method:e.method,headers:Bg(e.headers)}),s.id,o)}}),e.route({method:["POST","PUT","PATCH","DELETE","OPTIONS"],url:"/instances/:id/*",bodyLimit:67108864,handler:async(e,n)=>{const s=e.params,i=s["*"]||"",r=e.url.indexOf("?"),o=r>=0?e.url.slice(r):"";return Hg(n,await Ug(t,n,s.id,`/${i}${o}`,{method:e.method,headers:Bg(e.headers),body:Vg(e.body)}))}})}({app:l,service:b}),l.get("*",{config:tm},async(e,t)=>n.existsSync(Y)?Lf(t,Y,"index.html"):t.code(404).send({error:{code:"CONTROL_PLANE_UI_NOT_BUILT",message:"Control plane API is running, but the Web UI static directory was not found."}})),H=setInterval(()=>{G().catch(e=>l.log.warn({error:e},"pending node pairing recovery failed"))},3e4),H.unref(),W=setInterval(()=>{b.runPersistenceMaintenance()},216e5),W.unref(),l}function Wf(e){const t=Number(e);if(!Number.isInteger(t)||t<=0||t>65535)throw new Error("Port must be a valid TCP port.");return t}function Gf(e){if("disabled"!==e&&"password"!==e)throw new Error("Auth mode must be disabled or password.");return e}(async function(){const n=new e.Command;n.name("task-handoff-control-plane").description("Run the TaskHandoff control plane.").version(C("@task-handoff/cli")).option("--host <host>","Control plane host",process.env.TASK_HANDOFF_CONTROL_PLANE_HOST||"127.0.0.1").option("-p, --port <port>","Control plane port",Wf,Number(process.env.TASK_HANDOFF_CONTROL_PLANE_PORT)||8081).option("--data-dir <path>","Control plane data directory").option("--static-dir <path>","Control plane Web UI static directory",process.env.TASK_HANDOFF_CONTROL_PLANE_STATIC_DIR||t.resolve(__dirname,"..","ui")).option("--auth-mode <mode>","Control plane auth mode: disabled or password",Gf,process.env.TASK_HANDOFF_CONTROL_PLANE_AUTH_MODE||"password").action(async e=>{await async function(e){const t=Cm(e.dataDir),n=Ym(Jm(),{dataDir:t.dataDir,host:e.host,port:e.port});try{const t=await Hf(e);t.addHook("onClose",async()=>{n.release()}),await t.listen({host:e.host,port:e.port})}catch(t){if(n.release(),t&&"object"==typeof t&&"EADDRINUSE"===t.code)throw Object.assign(new Error(`Control plane port ${e.host}:${e.port} is already in use.`),{statusCode:409,code:"CONTROL_PLANE_PORT_IN_USE",cause:t});throw t}}({host:e.host,port:e.port,dataDir:e.dataDir,staticDir:e.staticDir,auth:{mode:e.authMode}})}),n.command("credentials").description("Initialize or replace Control Plane administrator credentials while the service is stopped.").requiredOption("--username <username>","New administrator username").requiredOption("--password-stdin","Read the new password from standard input").option("--initialize-if-needed","Create the administrator only when none exists").option("--data-dir <path>","Control plane data directory").action(async e=>{if(process.stdin.isTTY)throw new Error("Pipe the new password to standard input when using --password-stdin.");const t=[];for await(const e of process.stdin)t.push(Buffer.isBuffer(e)?e:Buffer.from(e));const n=Buffer.concat(t).toString("utf8").replace(/\r?\n$/,"");if(e.initializeIfNeeded){const t=await async function(e,t,n={}){const s=Cm(e),i=Ym(n.lockPath||Jm(),{dataDir:s.dataDir});try{const e=new ia(s,{mode:"password"});return e.init(),e.state().requiresBootstrap?{created:!0,user:await e.bootstrapAdmin(t)}:{created:!1}}finally{i.release()}}(e.dataDir,{username:e.username,password:n});return void console.log(t.created?"created":"unchanged")}const s=await async function(e,t,n={}){const s=Cm(e),i=Ym(n.lockPath||Jm(),{dataDir:s.dataDir});try{const e=new ia(s,{mode:"password"});return e.init(),await e.replaceCredentials(t)}finally{i.release()}}(e.dataDir,{username:e.username,password:n});console.log(`Updated Control Plane credentials for ${s.username}. Existing sessions were revoked.`)}),await n.parseAsync(process.argv)})().catch(e=>{console.error(e instanceof Error?e.message:String(e)),process.exitCode=1});
+echo "Uninstall: sudo task-handoff-node-agent uninstall"
+`)),o.get("/api/events",{websocket:!0},async(e,t)=>{const n=t.query,i="string"==typeof n.instanceId?n.instanceId.trim():"",s=sx(t),a="user"===s?.type?(await I.listControlledInstances()).filter(e=>dl(s.nodeScope,s.instanceScope,e.id,e.nodeId)):void 0,o=a?new Set(a.map(e=>e.id)):void 0;if(i&&o&&!o.has(i))return void e.close(4003,"The requested event scope is not visible.");const r=[];let d=!1;const l={get readyState(){return e.readyState},get bufferedAmount(){return e.bufferedAmount},OPEN:e.OPEN,send(t){d?e.send(t):r.push(t)},ping(){e.ping()},on(t,n){e.on(t,n)},close(t,n){e.close(t,n)}};c.connect(l,{instanceIds:i?[i]:void 0,expectsTransientSubscription:"1"===n.aiSessionTransient,expectsMetricSubscription:"1"===n.resourceMetricsScope,..."user"===s?.type?{authorization:{userId:s.userId,authorizationRevision:s.authorizationRevision,permissionIds:s.permissionIds,..."selected"===s.nodeScope.kind?{allowedNodeIds:new Set(s.nodeScope.nodeIds)}:{},..."selected"===s.instanceScope?.kind||"selected"===s.nodeScope.kind?{allowedInstanceIds:o}:{}}}:{}});const[p,u]=await Promise.all([N.streamDescriptors(),C.streamDescriptors()]);c.send(e,"streams.hello",{protocolVersion:1,streams:[...p,...u].filter(e=>(!o||o.has(e.instanceId))&&(!i||e.instanceId===i))}),d=!0;for(const t of r)e.send(t);for(const t of z.snapshots().filter(e=>(!o||o.has(e.instanceId))&&(!i||e.instanceId===i)))c.send(e,"image.pull.snapshot",t,{topic:"instances",scope:{instanceId:t.instanceId}})}),o.get("/api/auth/session",{config:Zv},async e=>{const t=dA(e);return{data:await x.currentSession(t.token,t.clientType)}}),o.post("/api/auth/bootstrap-admin",{config:Zv},async(e,t)=>{const n=await x.bootstrapAdmin(e.body);return t.code(201).send({data:n})}),o.post("/api/auth/login",{config:Zv},async(e,t)=>{const n=await x.login(e.body,{sourceId:e.ip});return t.setCookie(mu,n.sessionToken,{path:"/",httpOnly:!0,sameSite:"lax",expires:new Date(n.expiresAt)}),{data:{user:n.user}}}),o.post("/api/auth/mobile/login",{config:Zv},async e=>({data:await x.loginMobile(e.body,{sourceId:e.ip})})),o.patch("/api/auth/password",async(e,t)=>{const n=await x.changePassword(e.cookies[mu],e.body);return t.setCookie(mu,n.sessionToken,{path:"/",httpOnly:!0,sameSite:"lax",expires:new Date(n.expiresAt)}),{data:{user:n.user}}}),o.post("/api/auth/mobile/logout",async e=>{const t=dA(e);return{data:await x.logout("mobile"===t.clientType?t.token:void 0)}}),o.get("/api/auth/mobile/sessions",async(e,t)=>{const n=await x.mobileSessions(dA(e).token);return n?{data:n}:t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to access mobile sessions."}})}),o.delete("/api/auth/mobile/sessions/:id",async(e,t)=>{const n=f.z.object({id:f.z.string().trim().min(1)}).parse(e.params),i=await x.revokeMobileSession(dA(e).token,n.id);return void 0===i?t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to revoke mobile sessions."}}):{data:{revoked:i}}}),o.post("/api/auth/logout",{config:Zv},async(e,t)=>{const n=await x.logout(e.cookies[mu]);return t.clearCookie(mu,{path:"/"}),{data:n}}),o.get("/api/access/me",async(e,t)=>{const n=dA(e),i=await x.currentAccess(n.token,n.clientType);return i?{data:i}:t.code(401).send({error:{code:"CONTROL_PLANE_AUTH_REQUIRED",message:"Sign in to read Control Plane access."}})}),function(e,t){e.get("/api/users",async e=>{const n=f.z.object({search:f.z.string().trim().max(160).optional(),includeArchived:f.z.coerce.boolean().optional()}).strict().parse(e.query);return{data:await t.users.list(n)}}),e.post("/api/users",async(e,n)=>n.code(201).send({data:await t.users.createLocalUser(e.body)})),e.get("/api/users/:id",async e=>({data:await t.users.detail(hS.parse(e.params).id)})),e.patch("/api/users/:id",async e=>{const n=hS.parse(e.params).id,i=await t.users.updateUser(n,e.body);return await t.notifyAuthorizationChanged(n),{data:i}}),e.put("/api/users/:id/access",async e=>{const n=hS.parse(e.params).id,i=await t.users.setAccess(n,e.body);return await t.notifyAuthorizationChanged(n),{data:i}}),e.post("/api/users/:id/password-reset",async e=>{const n=f.z.object({password:f.z.string().min(8).max(4096),requirePasswordChange:f.z.boolean().optional()}).strict().parse(e.body),i=hS.parse(e.params).id,s=await t.users.resetLocalPassword(i,n.password,!1!==n.requirePasswordChange);return await t.notifyAuthorizationChanged(i),{data:s}}),e.get("/api/users/:id/sessions",async e=>{const n=gS(e);return{data:await t.sessions.listSessions(n.userId,hS.parse(e.params).id)}}),e.delete("/api/users/:id/sessions",async e=>{const n=hS.parse(e.params).id;return{data:{revokedSessions:await t.users.revokeSessions(n)}}}),e.delete("/api/users/:id/sessions/:sessionId",async e=>{const n=gS(e),i=f.z.object({id:f.z.string().trim().min(1),sessionId:f.z.string().trim().min(1)}).strict().parse(e.params);return{data:{revoked:await t.sessions.revokeSession(n.userId,i.sessionId)}}}),e.delete("/api/users/:id/identities/:identityId",async e=>{const n=f.z.object({id:f.z.string().trim().min(1),identityId:f.z.string().trim().min(1)}).strict().parse(e.params),i=await t.users.unbindExternalIdentity(n.id,n.identityId);return await t.notifyAuthorizationChanged(n.id),{data:i}}),e.get("/api/roles",async()=>({data:await t.users.roleSummaries()})),e.get("/api/permissions",async()=>({data:ep})),e.post("/api/roles",async(e,n)=>n.code(201).send({data:await t.users.createRole(e.body)})),e.patch("/api/roles/:id",async e=>{const n=hS.parse(e.params).id,i=(await t.users.store.grants.listByRole(n)).map(e=>e.userId),s=await t.users.updateRole(n,e.body);for(const e of i)await t.notifyAuthorizationChanged(e);return{data:s}}),e.delete("/api/roles/:id",async e=>({data:await t.users.archiveRole(hS.parse(e.params).id)})),e.get("/api/identity-providers",async()=>({data:await t.identityProviders.list()})),e.post("/api/identity-providers",async(e,n)=>n.code(201).send({data:await t.identityProviders.create(e.body)})),e.patch("/api/identity-providers/:id",async e=>({data:await t.identityProviders.update(hS.parse(e.params).id,e.body)})),e.delete("/api/identity-providers/:id",async e=>({data:{deleted:await t.identityProviders.remove(hS.parse(e.params).id)}})),e.get("/api/external-identity-approvals",async()=>({data:await t.users.store.approvals.list()})),e.post("/api/external-identity-approvals/:id/approve",async e=>{const n=gS(e);return{data:await t.users.approveExternalIdentity(n.userId,hS.parse(e.params).id,e.body)}}),e.post("/api/external-identity-approvals/:id/reject",async e=>{const n=gS(e);return{data:await t.users.rejectExternalIdentity(n.userId,hS.parse(e.params).id)}}),e.post("/api/auth/external/:id/begin",{config:Zv},async(e,n)=>(n.header("cache-control","no-store"),{data:await t.external.begin(hS.parse(e.params).id)})),e.post("/api/auth/external/callback",{config:Zv},async(e,n)=>{n.header("cache-control","no-store");const i=await t.external.callback(e.body);return"session"===i.kind?(n.setCookie(mu,i.sessionToken,{path:"/",httpOnly:!0,sameSite:"lax",expires:new Date(i.expiresAt)}),{data:{kind:i.kind,user:i.user,authorization:i.authorization}}):{data:i}})}(o,x),function(e,t){e.get("/api/git-credentials",async()=>({data:{items:t.gitCredentials.list()}})),e.post("/api/git-credentials",async(e,n)=>{const i=t.gitCredentials.create(e.body);return n.code(201).send({data:i})}),e.get("/api/git-credentials/:id",async e=>{const n=fS.parse(e.params).id,i=t.gitCredentials.get(n);if(!i)throw Object.assign(new Error(`Git credential ${n} was not found.`),{code:"GIT_CREDENTIAL_NOT_FOUND",statusCode:404});return{data:i}}),e.patch("/api/git-credentials/:id",async e=>({data:await t.updateGitCredential(fS.parse(e.params).id,e.body)})),e.delete("/api/git-credentials/:id",async e=>({data:{deleted:t.gitCredentials.remove(fS.parse(e.params).id)}})),e.get("/api/controlled-instances/:id/git-credential-assignments",async e=>{bS(e);const n=fS.parse(e.params).id;return await t.requireControlledInstance(n,!0),{data:t.listInstanceGitCredentialAssignments(n)}}),e.post("/api/controlled-instances/:id/git-credential-assignments",async(e,n)=>{bS(e);const i=fS.parse(e.params).id,s=f.z.object({credentialId:f.z.string().trim().min(1).max(120)}).strict().parse(e.body);return n.code(201).send({data:await t.authorizeInstanceGitCredential(i,s.credentialId)})}),e.delete("/api/controlled-instances/:id/git-credential-assignments/:credentialId",async e=>{bS(e);const n=yS.parse(e.params);return{data:{revoked:await t.revokeInstanceGitCredential(n.id,n.credentialId)}}})}(o,I),o.get("/api/control-plane/status",async()=>({data:{protocolVersion:qo,build:sA(),storage:a}})),o.get("/api/control-plane/settings",async()=>({data:I.getSettings()})),o.patch("/api/control-plane/settings",async e=>{const t=I.updateSettings(e.body||{});return u=t.diagnosticLogs,{data:t}}),o.get("/api/control-plane/diagnostic-logs/export",async(e,i)=>{const s=await async function(e){const i=n.mkdtempSync(t.join(m.tmpdir(),"task-handoff-diagnostic-logs-")),s=t.resolve(e.nodeAgentDataDir||t.join(e.dataDir,"node-agent")),a=t.join(s,"local-instances"),o=n.existsSync(a)?n.readdirSync(a,{withFileTypes:!0}).filter(e=>e.isDirectory()&&!e.isSymbolicLink()).map(e=>({label:t.join("local-instances",e.name),root:t.join(a,e.name,"logs")})):[],r=[{label:"control-plane",root:t.join(e.dataDir,"logs")},{label:"desktop",root:t.join(e.dataDir,"log")},{label:"node-agent",root:t.join(s,"logs")},...o],c=[];let d=0;for(const e of r)for(const s of kS(e.root)){if(d>=TS)break;const a=t.relative(e.root,s);if(!a||a.startsWith("..")||t.isAbsolute(a))continue;const o=t.join("logs",e.label,a),r=n.statSync(s).size,l=NS(s,t.join(i,o),TS-d);l&&(d+=l,c.push({source:s,archivePath:o,bytes:l,originalBytes:r}))}n.writeFileSync(t.join(i,"manifest.json"),`${JSON.stringify({createdAt:(new Date).toISOString(),diagnosticLogsEnabled:e.diagnosticLogsEnabled,limits:{perFileBytes:_S,totalBytes:TS},files:c.map(({archivePath:e,bytes:t,originalBytes:n})=>({archivePath:e,bytes:t,originalBytes:n,truncated:t<n}))},null,2)}\n`,{mode:384});const l=["manifest.json",...n.existsSync(t.join(i,"logs"))?["logs"]:[]],p=D.create({cwd:i,gzip:!0,portable:!0,noMtime:!0},l),u=()=>n.rmSync(i,{recursive:!0,force:!0});return p.once("close",u),p.once("error",u),{filename:`task-handoff-diagnostic-logs-${(new Date).toISOString().replace(/[:.]/g,"-")}.tar.gz`,stream:p}}({dataDir:a.dataDir,nodeAgentDataDir:process.env.TASK_HANDOFF_DESKTOP_NODE_AGENT_DATA_DIR||process.env.TASK_HANDOFF_NODE_AGENT_DATA_DIR,diagnosticLogsEnabled:u});return i.header("content-type","application/gzip"),i.header("content-disposition",`attachment; filename="${s.filename}"`),i.send(s.stream)}),o.post("/api/ai-session-attachments",{bodyLimit:33554432},async(e,t)=>{try{return t.code(201).send({data:O.upload(e.body)})}catch(e){return t.code(400).send({error:{code:"AI_SESSION_ATTACHMENT_INVALID",message:e instanceof Error?e.message:String(e)}})}}),Jx({app:o,service:I,events:c,appSessionAggregator:C,aiSessionAggregator:N,aiSessionUnread:k,chatGateway:W,aiSessionAttachments:O,aiSessionAttachmentCache:R,nodeAgentTunnel:j,nodeEventSubscriber:V,errorPayload:cA,onInstanceDeleted:async e=>{if(!x.enabled())return;const t=await x.users.removeInstanceFromAccessScopes(e);for(const e of t)await x.notifyAuthorizationChanged(e)}}),function(e){const{app:t,authority:n,resolveTarget:i,projectTarget:s,eventHub:a}=e,o=e.runtime??new Mw,c=new WeakMap,d=(e,t)=>{const n=c.get(e);n&&(c.delete(e),n.tracked.release(),e.raw.removeListener("aborted",n.abort),t.raw.removeListener("close",n.abort))};t.all("/api/node-proxy/bindings/:bindingId/http/*",{config:tI,bodyLimit:o.maxRequestBodyBytes,logLevel:"silent",async onRequest(e,t){try{const i=Vw.parse(e.params).bindingId,s=Qw(n,i,e),a=function(e){const t=e.raw.url||e.url,n=/^\/api\/node-proxy\/bindings\/[^/]+\/http(\/[^#]*)$/.exec(t);if(!n||/%(?:2f|5c)/i.test(n[1]))throw sS(uo.RouteInvalid,"Proxy route is invalid.",400);const i=so.safeParse(n[1]);if(!i.success)throw sS(uo.RouteInvalid,i.error.issues[0]?.message||"Proxy route is invalid.",400);return i.data}(e),r=tS(e.headers),l=o.reserveHttp(s.id),p=()=>{l.controller.abort(Object.assign(new Error("Proxy HTTP consumer disconnected."),{name:"AbortError",code:"ABORT_ERR"})),d(e,t)};c.set(e,{binding:s,route:a,forwardedHeaders:r,tracked:l,abort:p,startedAt:performance.now()}),e.raw.once("aborted",p),t.raw.once("close",p)}catch(n){return nS(t,n,e)}},async onError(e,t){d(e,t);const n=oS(e.headers);n&&t.header("x-request-id",n)},async onResponse(e,t){d(e,t)}},async(e,s)=>{try{const o=c.get(e);if(!o)throw sS(uo.TransportFailed,"Proxy request context is unavailable.",500,!0);const{binding:l,route:p,forwardedHeaders:u,tracked:m,abort:h,startedAt:g}=o;!function(e,t,n){const i=new URL(t,"https://node-agent.invalid").searchParams,s=[i.get("nodeId"),i.get("targetNodeId")];if(n&&"object"==typeof n&&!Array.isArray(n)){const e=n;"string"==typeof e.nodeId&&s.push(e.nodeId),"string"==typeof e.targetNodeId&&s.push(e.targetNodeId)}const a=s.find(t=>null!==t&&t!==e.targetNodeId);if(void 0!==a)throw sS(uo.TargetMismatch,"Proxy request attempts to select a target outside its binding.",409,!1,{bindingId:e.id,targetNodeId:e.targetNodeId})}(l,p,e.body);const f=null==(a=e.body)?void 0:Buffer.isBuffer(a)?a:a instanceof Uint8Array||"string"==typeof a?Buffer.from(a):Buffer.from(JSON.stringify(a));m.acceptRequestBody(f?.byteLength??0);try{const{node:a,transport:o}=await i(l.targetNodeId);Zw(n,l,e),eS(l,a);const c=await o.requestStream(a,p,{method:e.method,headers:u,...f?{body:f}:{},signal:m.controller.signal}),d=performance.now()-g;return t.log.info({traceId:u[Au],requestId:u["x-request-id"],bindingId:l.id,targetNodeId:l.targetNodeId,routePath:new URL(p,"https://node-agent.invalid").pathname,statusCode:c.status,proxyForwardMs:d},"control-plane proxy request timing"),function(e,t,n,i,s,a,o,c){t.body&&n.beginResponseStream();const d=function(e,t){const n=Object.fromEntries([...oo].flatMap(t=>{const n=e.headers.get(t);return null===n?[]:[[t,n]]}));return t&&(n["x-request-id"]=t),n}(t,a);d["server-timing"]=_u(d["server-timing"],Eu("proxy_forward",c??0)),o&&!d[Au]&&(d[Au]=o);for(const[t,n]of Object.entries(d))e.header(t,n);const l=()=>{n.release(),s.raw.removeListener("aborted",i),e.raw.removeListener("close",i)};if(!t.body)return l(),e.code(t.status).send();const p=r.Readable.fromWeb(t.body);return n.controller.signal.addEventListener("abort",()=>{const e=n.controller.signal.reason;p.destroy(e instanceof Error?e:new Error("Proxy HTTP stream aborted."))},{once:!0}),p.on("data",e=>{try{n.acceptResponseChunk(e)}catch(e){p.destroy(e)}}),p.once("end",l),p.once("error",l),p.once("close",l),e.raw.once("close",()=>p.destroy()),e.code(t.status).send(p)}(s,c,m,h,e,u["x-request-id"],u[Au],d)}catch(t){throw d(e,s),t}}catch(t){return d(e,s),nS(s,t,e)}var a}),t.get("/api/node-proxy/bindings/:bindingId/websocket",{websocket:!0,logLevel:"silent",config:tI},async(e,t)=>{let s;try{const a=Vw.parse(t.params).bindingId,r=Qw(n,a,t),c=Kw.parse(t.query).route,{node:d,transport:l}=await i(r.targetNodeId);Zw(n,r,t),eS(r,d),s=o.openWebSocket(r.id,e),l.proxyWebSocket(d,s,c,function(e){const t=aS(e,"sec-websocket-protocol").split(",").map(e=>e.trim()).filter(Boolean);return t.length?t:void 0}(t.headers),tS(t.headers))}catch(t){const n=iS(t);s?.close(1008,n.message),s||e.close(429===n.statusCode?1013:n.statusCode<500?1008:1011,rS(n.message))}}),t.get("/api/node-proxy/bindings/:bindingId/snapshot",{config:tI},async(e,t)=>{try{const t=Vw.parse(e.params).bindingId,r=Qw(n,t,e),{node:c}=await i(r.targetNodeId);Zw(n,r,e),eS(r,c);const d=s(r.targetNodeId);if(!d)throw sS(uo.TargetUnavailable,"Proxy target no longer exists.",404,!1,{targetNodeId:r.targetNodeId});const l=a.cursor(r.targetNodeId),p=Ao.parse({protocolVersion:Ja,binding:r,streamId:l.streamId,revision:l.revision,observedAt:(new Date).toISOString(),target:Ww(d)});if(o=p,Buffer.byteLength(JSON.stringify(o),"utf8")>Jw)throw sS(uo.ResourceLimit,"Proxy target snapshot byte limit exceeded.",429,!0,{bindingId:r.id,resource:"snapshot-bytes",limit:Jw});return{data:p}}catch(n){return nS(t,n,e)}var o}),t.get("/api/node-proxy/bindings/:bindingId/events",{websocket:!0,logLevel:"silent",config:tI},async(e,t)=>{let s,r,c;try{const d=Vw.parse(t.params).bindingId,l=Qw(n,d,t),p=Yw.parse(t.query),{node:u}=await i(l.targetNodeId);Zw(n,l,t),eS(l,u),s=o.openWebSocket(l.id,e,()=>r?.()),s.on("message",()=>s?.close(1008,"Proxy event streams do not accept client messages."));const m=a.subscribe({bindingId:l.id,sourceControlPlaneId:l.sourceControlPlaneId,targetNodeId:l.targetNodeId},p.sinceRevision,e=>{s?.send(JSON.stringify(e))},()=>{s?.close(1011,"Proxy event delivery failed.")});r=m.close,c=o.registerBindingCleanup(l.id,r);const h=()=>{r?.(),c?.()};s.on("close",h),s.on("error",h),"snapshot-required"===m.kind?(r(),s.close(1008,"Proxy target snapshot is required.")):1!==s.readyState&&r()}catch(t){r?.(),c?.();const n=iS(t);s?.close(1008,n.message),s||e.close(429===n.statusCode?1013:n.statusCode<500?1008:1011,rS(n.message))}}),t.delete("/api/node-proxy/bindings/:bindingId",{config:tI},async(t,i)=>{try{const i=Vw.parse(t.params).bindingId;Qw(n,i,t);const s=n.revokeBinding(i),a=o.closeBinding(i);return e.onBindingRevoked?.(s),{data:{binding:s,closed:a}}}catch(e){return nS(i,e,t)}})}({app:o,authority:M,resolveTarget:e=>{const t=I.requireNode(e);return{node:t,transport:I.resolveNodeAgentTransport(t)}},projectTarget:L,runtime:q,eventHub:U,onBindingRevoked:e=>c.publish("control-plane-proxy.binding.updated",{binding:e,audit:{action:"binding.revoke",actor:`control-plane:${e.sourceControlPlaneId}`}},{topic:"control-plane-proxy",scope:{nodeId:e.targetNodeId}})}),function(e){const{app:t,service:n,proxy:i,runtime:s,events:a,syncNodeEvents:o,actorId:r}=e;t.get("/api/control-plane-proxy/invites",async()=>({data:i.listInvites()})),t.post("/api/control-plane-proxy/invites",async(e,t)=>{const n=await r(e),s=i.createInvite(e.body,n);return a.publish("control-plane-proxy.invite.created",{invite:s.invite,audit:{action:"invite.create",actor:n}},{topic:"control-plane-proxy",scope:{nodeId:s.invite.targetNodeId}}),t.code(201).send({data:s})}),t.delete("/api/control-plane-proxy/invites/:id",async e=>{const t=await r(e),n=i.revokeInvite(pS.parse(e.params).id);return a.publish("control-plane-proxy.invite.updated",{invite:n,audit:{action:"invite.revoke",actor:t}},{topic:"control-plane-proxy",scope:{nodeId:n.targetNodeId}}),{data:n}}),t.get("/api/control-plane-proxy/bindings",async()=>({data:i.listBindings()})),t.delete("/api/control-plane-proxy/bindings/:id",async e=>{const t=await r(e),n=pS.parse(e.params).id,o=i.revokeBinding(n),c=s.closeBinding(n);return a.publish("control-plane-proxy.binding.updated",{binding:o,audit:{action:"binding.revoke",actor:t}},{topic:"control-plane-proxy",scope:{nodeId:o.targetNodeId}}),{data:{binding:o,closed:c}}}),t.get("/api/control-plane-proxy/diagnostics",async()=>({data:s.diagnostics()})),t.post("/api/node-proxy/claims",{config:Zv},async(e,t)=>{const n=i.claimInvite(e.body);return a.publish("control-plane-proxy.binding.created",{binding:n.binding,audit:{action:"binding.claim",actor:`control-plane:${n.binding.sourceControlPlaneId}`}},{topic:"control-plane-proxy",scope:{nodeId:n.binding.targetNodeId}}),t.code(201).send({data:n})}),t.get("/api/control-plane-proxy/pending-claims",async()=>({data:n.listPendingProxyClaims()})),t.post("/api/control-plane-proxy/claims",async(e,t)=>{const i=await n.claimProxyNode(e.body);return o?.(),a.publish("node.created",{nodeId:i.node.id}),t.code(201).send({data:i})}),t.post("/api/control-plane-proxy/pending-claims/:id/resume",async e=>{const t=pS.parse(e.params).id;uS.parse(e.body||{});const i=await n.resumeProxyClaim(t);return o?.(),a.publish("node.created",{nodeId:i.node.id}),{data:i}}),t.delete("/api/control-plane-proxy/pending-claims/:id",async e=>{const t=mS.parse(e.query||{});return{data:await n.cancelProxyClaim(pS.parse(e.params).id,"true"===t.force)}})}({app:o,service:I,proxy:M,runtime:q,events:c,syncNodeEvents:()=>V.syncNow(),actorId:async e=>{const t=await lA(x,dA(e));return t?"user"===t.type?`user:${t.userId}`:"system"===t.type?`system:${t.reason}`:"cloud-account"===t.type?`cloud-account:${t.accountId}:${t.deviceSessionId}`:`chat-bridge:${t.bridgeId}`:"system:unknown"}}),function({app:e,service:t,auth:n,authorizationConnections:i}){!function(e){for(const t of["application/octet-stream","application/x-www-form-urlencoded"])dw(e,t);dw(e,/^multipart\/form-data(?:;.*)?$/i)}(e);const s=async(e,i,s="")=>{const a=await t.appAccessProxyTarget(e,i,s);return a.access.authorization&&await n.assertAppAccessAuthorization({...a.access.authorization,instanceId:a.instance.id,nodeId:a.instance.nodeId}),a},a=(e,t)=>{if(!t)return;const n=i.track(t,()=>e.close(4001,"Authorization changed."));e.on("close",n)};e.get("/api/app-access/session",{config:Zv},async e=>{const t=lw(e.url),n="vnc"===e.query.mode?"vnc":"web"===e.query.mode?"web":"tty",i=await s(t,n);return{data:{mode:n,instance:{id:i.instance.id,name:i.instance.name,projectId:i.instance.projectId,projectName:"string"==typeof i.instance.sourceSnapshot.name?i.instance.sourceSnapshot.name:void 0},session:i.session,expiresAt:i.access.expiresAt,ttySocketPath:"tty"===n?`/apps/access/tty/ws?token=${encodeURIComponent(t)}`:void 0,vncFramePath:"vnc"===n?pw(t,i.access.sessionId,i.session):void 0}}}),e.get("/apps/access/tty/ws",{websocket:!0,config:Zv},async(e,n)=>{try{const i=await s(lw(n.url),"tty");a(e,i.access.authorization),await t.proxyInstanceWebSocket(i.instance.id,e,i.path,Zx(n.headers),iw(n.headers))}catch{e.close(1011,"TTY access link is invalid or expired.")}});const o=async(e,n)=>{const i=n.params;try{const o=await s(i.token||lw(n.url),"vnc",i["*"]||"");a(e,o.access.authorization),await t.proxyInstanceWebSocket(o.instance.id,e,o.path,Zx(n.headers),iw(n.headers))}catch{e.close(1011,"VNC access link is invalid or expired.")}};e.route({method:"GET",url:"/apps/access/vnc/proxy/*",config:Zv,wsHandler:o,handler:async(e,n)=>{const i=e.params,a=await s(lw(e.url),"vnc",i["*"]||"");return rw(n,await sw(t,n,a.instance.id,a.path,{method:e.method,headers:nw(e.headers)}),a.instance.id,a.path)}}),e.route({method:"GET",url:"/apps/access/vnc/:token/proxy/*",config:Zv,wsHandler:o,handler:async(e,n)=>{const i=e.params,a=await s(i.token,"vnc",i["*"]||"");return rw(n,await sw(t,n,a.instance.id,a.path,{method:e.method,headers:nw(e.headers)}),a.instance.id,a.path)}}),e.all("/instances/:id",{bodyLimit:67108864},async(e,n)=>{const i=e.params;return"GET"===e.method||"HEAD"===e.method?n.redirect(`${ow(i.id)}/`):rw(n,await sw(t,n,i.id,"/",{method:e.method,headers:nw(e.headers),body:await cw(e.body)}),i.id,"/")}),e.route({method:"GET",url:"/instances/:id/*",wsHandler:async(e,n)=>{const i=n.params,s=i["*"]||"",o=n.url.indexOf("?"),r=o>=0?n.url.slice(o):"";try{const o=sx(n);a(e,"user"===o?.type?o:void 0),await t.proxyInstanceWebSocket(i.id,e,`/${s}${r}`,Zx(n.headers),iw(n.headers))}catch{e.close(1011,"Instance websocket endpoint is not reachable.")}},handler:async(e,n)=>{const i=e.params,s=i["*"]||"",a=e.url.indexOf("?"),o=`/${s}${a>=0?e.url.slice(a):""}`;return rw(n,await sw(t,n,i.id,o,{method:e.method,headers:nw(e.headers)}),i.id,o)}}),e.route({method:["POST","PUT","PATCH","DELETE","OPTIONS"],url:"/instances/:id/*",bodyLimit:67108864,handler:async(e,n)=>{const i=e.params,s=i["*"]||"",a=e.url.indexOf("?"),o=a>=0?e.url.slice(a):"";return aw(n,await sw(t,n,i.id,`/${s}${o}`,{method:e.method,headers:nw(e.headers),body:await cw(e.body)}))}})}({app:o,service:I,auth:x,authorizationConnections:d}),function(e){const{app:t,service:n,auth:i,authorizationConnections:s,events:a}=e,o=e.browserAccess||new YS;t.post("/api/controlled-instances/:id/browser-access",async e=>{const{id:t}=ox.parse(e.params),s=function(e,t){const n=sx(e);if("user"===n?.type)return n;if(!1===t.enabled?.())return{type:"system",reason:"auth-disabled",userId:"system:auth-disabled",authorizationRevision:0};throw Object.assign(new Error("A signed-in Control Plane user is required."),{statusCode:403,code:"BROWSER_ACCESS_USER_REQUIRED"})}(e,i),a=await _x(n,e,t);if(pl(s,"interactive-access",{type:"instance",id:t,nodeId:a.nodeId}),!Ko(a.capabilities).features.browserTunnel)throw Object.assign(new Error("The controlled instance does not support Browser Tunnel."),{statusCode:409,code:"BROWSER_TUNNEL_UNSUPPORTED"});const r=o.create({instanceId:t,authorization:{userId:s.userId,authorizationRevision:s.authorizationRevision}});return{data:KS.parse({accessId:r.accessId,token:r.token,expiresAt:r.expiresAt,relayPath:"/browser-relay"})}}),t.get("/browser-relay",{websocket:!0,config:Zv},async(e,t)=>{let a,r;const c=[],d=(e,t=!1)=>c.push([e,Boolean(t)]);e.on("message",d);try{const p=o.consume("string"==typeof(l=t.headers.authorization)&&l.startsWith("Browser ")?l.slice(8).trim():"");!1!==i.enabled?.()&&await i.assertAppAccessAuthorization({...p.authorization,instanceId:p.instanceId,nodeId:(await n.requireControlledInstance(p.instanceId,!0)).nodeId});const u=()=>e.close(4001,"Browser access authorization ended.");a=o.track(p,u),r=s.track(p.authorization,u),e.on("close",()=>{a?.(),r?.()}),await n.proxyInstanceWebSocket(p.instanceId,e,"/api/browser-tunnel",[],{}),e.off("message",d);for(const[t,n]of c.splice(0))e.emit("message",t,n)}catch{e.off("message",d),c.length=0,a?.(),r?.(),e.close(1008,"Browser access is invalid or unavailable.")}var l}),a.on(e=>{if(!["instance.stopped","instance.deleted","instance.restarted"].includes(e.type))return;const t=e.payload&&"object"==typeof e.payload?e.payload:{};"string"==typeof t.instanceId&&o.closeInstance(t.instanceId)})}({app:o,service:I,auth:x,authorizationConnections:d,events:c,browserAccess:l}),o.get("*",{config:eI},async(e,t)=>n.existsSync(Y)?rA(t,Y,"index.html"):t.code(404).send({error:{code:"CONTROL_PLANE_UI_NOT_BUILT",message:"Control plane API is running, but the Web UI static directory was not found."}})),F=setInterval(()=>{G().catch(e=>o.log.warn({error:e},"pending node pairing recovery failed"))},3e4),F.unref(),H=setInterval(()=>{I.runPersistenceMaintenance()},216e5),H.unref(),o}function hA(e){const t=Number(e);if(!Number.isInteger(t)||t<=0||t>65535)throw new Error("Port must be a valid TCP port.");return t}function gA(e){if("disabled"!==e&&"password"!==e)throw new Error("Auth mode must be disabled or password.");return e}function fA(e,t){return{id:e,sql:t,checksum:i.createHash("sha256").update(t).digest("hex")}}(async function(){const n=new e.Command;n.name("task-handoff-control-plane").description("Run the TaskHandoff control plane.").version(q("@task-handoff/cli")).option("--host <host>","Control plane host",process.env.TASK_HANDOFF_CONTROL_PLANE_HOST||"127.0.0.1").option("-p, --port <port>","Control plane port",hA,Number(process.env.TASK_HANDOFF_CONTROL_PLANE_PORT)||8081).option("--data-dir <path>","Control plane data directory").option("--static-dir <path>","Control plane Web UI static directory",process.env.TASK_HANDOFF_CONTROL_PLANE_STATIC_DIR||t.resolve(__dirname,"..","ui")).option("--auth-mode <mode>","Control plane auth mode: disabled or password",gA,process.env.TASK_HANDOFF_CONTROL_PLANE_AUTH_MODE||"password").action(async e=>{await async function(e){const t=zI(e.dataDir),n=JI(XI(),{dataDir:t.dataDir,host:e.host,port:e.port});try{const t=await mA(e);t.addHook("onClose",async()=>{n.release()}),await t.listen({host:e.host,port:e.port})}catch(t){if(n.release(),t&&"object"==typeof t&&"EADDRINUSE"===t.code)throw Object.assign(new Error(`Control plane port ${e.host}:${e.port} is already in use.`),{statusCode:409,code:"CONTROL_PLANE_PORT_IN_USE",cause:t});throw t}}({host:e.host,port:e.port,dataDir:e.dataDir,staticDir:e.staticDir,auth:{mode:e.authMode}})}),n.command("credentials").description("Initialize or replace Control Plane administrator credentials while the service is stopped.").requiredOption("--username <username>","New administrator username").requiredOption("--password-stdin","Read the new password from standard input").option("--user-id <userId>","Select the account by its local user ID").option("--target-username <username>","Select the account by its current username").option("--initialize-if-needed","Create the administrator only when none exists").option("--data-dir <path>","Control plane data directory").action(async e=>{if(process.stdin.isTTY)throw new Error("Pipe the new password to standard input when using --password-stdin.");const t=[];for await(const e of process.stdin)t.push(Buffer.isBuffer(e)?e:Buffer.from(e));const n=Buffer.concat(t).toString("utf8").replace(/\r?\n$/,"");if(e.initializeIfNeeded){const t=await async function(e,t,n={}){const i=zI(e),s=JI(n.lockPath||XI(),{dataDir:i.dataDir}),a=new uu(i);try{return await a.init(),a.store.state().initialized&&(await a.store.users.list()).length>0?{created:!1}:{created:!0,user:await a.bootstrapAdmin(t)}}finally{try{await a.store.close()}finally{s.release()}}}(e.dataDir,{username:e.username,password:n});return void console.log(t.created?"created":"unchanged")}const i=await async function(e,t,n={}){const i=zI(e),s=JI(n.lockPath||XI(),{dataDir:i.dataDir}),a=new uu(i);try{return await a.init(),await a.recoverLocalCredentials(t)}finally{try{await a.store.close()}finally{s.release()}}}(e.dataDir,{username:e.username,password:n,userId:e.userId,targetUsername:e.targetUsername});console.log(`Updated Control Plane credentials for ${i.primaryUsername||i.displayName}. Existing sessions were revoked.`)}),await n.parseAsync(process.argv)})().catch(e=>{console.error(e instanceof Error?e.message:String(e)),process.exitCode=1});const yA=[fA("0001_user_access","\nCREATE TABLE cp_metadata (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);\nCREATE TABLE cp_users (\n  id TEXT PRIMARY KEY NOT NULL, display_name TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('active','disabled','archived')),\n  last_login_at TEXT, archived_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_login_identities (\n  id TEXT PRIMARY KEY NOT NULL, user_id TEXT NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  kind TEXT NOT NULL CHECK(kind IN ('local-password','oidc','oauth')), normalized_login_name TEXT, password_hash TEXT,\n  requires_password_change INTEGER, provider_id TEXT, subject TEXT, verified_email TEXT, last_used_at TEXT,\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_login_identities_login_name_uq ON cp_login_identities(normalized_login_name);\nCREATE UNIQUE INDEX cp_login_identities_provider_subject_uq ON cp_login_identities(provider_id, subject);\nCREATE INDEX cp_login_identities_user_idx ON cp_login_identities(user_id);\nCREATE TABLE cp_roles (\n  id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, description TEXT, system INTEGER NOT NULL,\n  status TEXT NOT NULL CHECK(status IN ('active','archived')), permission_ids TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_roles_active_name_uq ON cp_roles(lower(name)) WHERE status = 'active';\nCREATE TABLE cp_user_access_grants (\n  user_id TEXT PRIMARY KEY NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  node_scope TEXT NOT NULL,\n  instance_scope TEXT NOT NULL, authorization_revision INTEGER NOT NULL CHECK(authorization_revision > 0),\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_user_roles (\n  user_id TEXT NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES cp_roles(id) ON DELETE RESTRICT,\n  PRIMARY KEY (user_id, role_id)\n);\nCREATE INDEX cp_user_roles_role_idx ON cp_user_roles(role_id);\nCREATE TABLE cp_user_sessions (\n  id TEXT PRIMARY KEY NOT NULL, identity_id TEXT NOT NULL REFERENCES cp_login_identities(id) ON DELETE CASCADE,\n  authorization_revision INTEGER NOT NULL,\n  token_hash TEXT NOT NULL, expires_at TEXT NOT NULL, last_seen_at TEXT, client_type TEXT NOT NULL CHECK(client_type IN ('web','mobile')),\n  device TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_user_sessions_token_hash_uq ON cp_user_sessions(token_hash);\nCREATE INDEX cp_user_sessions_identity_idx ON cp_user_sessions(identity_id);\nCREATE INDEX cp_user_sessions_expiry_idx ON cp_user_sessions(expires_at);\nCREATE TABLE cp_identity_providers (\n  id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, kind TEXT NOT NULL CHECK(kind IN ('oidc','github')),\n  status TEXT NOT NULL CHECK(status IN ('enabled','disabled')), login_policy TEXT NOT NULL,\n  issuer TEXT, client_id TEXT NOT NULL, client_secret_ciphertext TEXT NOT NULL, callback_url TEXT NOT NULL,\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_external_identity_approvals (\n  id TEXT PRIMARY KEY NOT NULL, provider_id TEXT NOT NULL REFERENCES cp_identity_providers(id) ON DELETE CASCADE,\n  subject TEXT NOT NULL, verified_email TEXT, display_name TEXT, status TEXT NOT NULL, expires_at TEXT NOT NULL,\n  decided_at TEXT, decided_by_user_id TEXT REFERENCES cp_users(id), created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE INDEX cp_external_identity_approvals_lookup_idx ON cp_external_identity_approvals(provider_id, subject, status);\nCREATE TABLE cp_user_audit (\n  id TEXT PRIMARY KEY NOT NULL, action TEXT NOT NULL, actor_user_id TEXT, target_type TEXT NOT NULL,\n  target_id TEXT, details TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE INDEX cp_user_audit_created_idx ON cp_user_audit(created_at);\n")],bA=[fA("0001_user_access","\nCREATE TABLE cp_metadata (key TEXT PRIMARY KEY NOT NULL, value JSONB NOT NULL);\nCREATE TABLE cp_users (\n  id TEXT PRIMARY KEY NOT NULL, display_name TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('active','disabled','archived')),\n  last_login_at TEXT, archived_at TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_login_identities (\n  id TEXT PRIMARY KEY NOT NULL, user_id TEXT NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  kind TEXT NOT NULL CHECK(kind IN ('local-password','oidc','oauth')), normalized_login_name TEXT, password_hash TEXT,\n  requires_password_change BOOLEAN, provider_id TEXT, subject TEXT, verified_email TEXT, last_used_at TEXT,\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_login_identities_login_name_uq ON cp_login_identities(normalized_login_name);\nCREATE UNIQUE INDEX cp_login_identities_provider_subject_uq ON cp_login_identities(provider_id, subject);\nCREATE INDEX cp_login_identities_user_idx ON cp_login_identities(user_id);\nCREATE TABLE cp_roles (\n  id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, description TEXT, system BOOLEAN NOT NULL,\n  status TEXT NOT NULL CHECK(status IN ('active','archived')), permission_ids JSONB NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_roles_active_name_uq ON cp_roles(lower(name)) WHERE status = 'active';\nCREATE TABLE cp_user_access_grants (\n  user_id TEXT PRIMARY KEY NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  node_scope JSONB NOT NULL,\n  instance_scope JSONB NOT NULL, authorization_revision INTEGER NOT NULL CHECK(authorization_revision > 0),\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_user_roles (\n  user_id TEXT NOT NULL REFERENCES cp_users(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES cp_roles(id) ON DELETE RESTRICT,\n  PRIMARY KEY (user_id, role_id)\n);\nCREATE INDEX cp_user_roles_role_idx ON cp_user_roles(role_id);\nCREATE TABLE cp_user_sessions (\n  id TEXT PRIMARY KEY NOT NULL, identity_id TEXT NOT NULL REFERENCES cp_login_identities(id) ON DELETE CASCADE,\n  authorization_revision INTEGER NOT NULL,\n  token_hash TEXT NOT NULL, expires_at TEXT NOT NULL, last_seen_at TEXT, client_type TEXT NOT NULL CHECK(client_type IN ('web','mobile')),\n  device JSONB, created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX cp_user_sessions_token_hash_uq ON cp_user_sessions(token_hash);\nCREATE INDEX cp_user_sessions_identity_idx ON cp_user_sessions(identity_id);\nCREATE INDEX cp_user_sessions_expiry_idx ON cp_user_sessions(expires_at);\nCREATE TABLE cp_identity_providers (\n  id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, kind TEXT NOT NULL CHECK(kind IN ('oidc','github')),\n  status TEXT NOT NULL CHECK(status IN ('enabled','disabled')), login_policy TEXT NOT NULL,\n  issuer TEXT, client_id TEXT NOT NULL, client_secret_ciphertext TEXT NOT NULL, callback_url TEXT NOT NULL,\n  created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE TABLE cp_external_identity_approvals (\n  id TEXT PRIMARY KEY NOT NULL, provider_id TEXT NOT NULL REFERENCES cp_identity_providers(id) ON DELETE CASCADE,\n  subject TEXT NOT NULL, verified_email TEXT, display_name TEXT, status TEXT NOT NULL, expires_at TEXT NOT NULL,\n  decided_at TEXT, decided_by_user_id TEXT REFERENCES cp_users(id), created_at TEXT NOT NULL, updated_at TEXT NOT NULL\n);\nCREATE INDEX cp_external_identity_approvals_lookup_idx ON cp_external_identity_approvals(provider_id, subject, status);\nCREATE TABLE cp_user_audit (\n  id TEXT PRIMARY KEY NOT NULL, action TEXT NOT NULL, actor_user_id TEXT, target_type TEXT NOT NULL,\n  target_id TEXT, details JSONB NOT NULL, created_at TEXT NOT NULL\n);\nCREATE INDEX cp_user_audit_created_idx ON cp_user_audit(created_at);\n")],vA=f.z.object({id:f.z.string().trim().min(1),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}),IA={users:vA.extend({displayName:f.z.string().trim().min(1).max(160),status:Fl,lastLoginAt:f.z.string().datetime().optional(),archivedAt:f.z.string().datetime().optional()}).strict().superRefine((e,t)=>{"archived"!==e.status||e.archivedAt||t.addIssue({code:"custom",path:["archivedAt"],message:"Archived users require archivedAt."}),"archived"!==e.status&&e.archivedAt&&t.addIssue({code:"custom",path:["archivedAt"],message:"Only archived users can have archivedAt."})}),identities:vA.extend({userId:f.z.string().trim().min(1),kind:Hl,normalizedLoginName:f.z.string().trim().min(1).max(160).optional(),passwordHash:f.z.string().trim().min(1).optional(),requiresPasswordChange:f.z.boolean().optional(),providerId:f.z.string().trim().min(1).optional(),subject:f.z.string().trim().min(1).max(500).optional(),verifiedEmail:f.z.string().email().optional(),lastUsedAt:f.z.string().datetime().optional()}).strict().superRefine((e,t)=>{"local-password"===e.kind?(e.normalizedLoginName||t.addIssue({code:"custom",path:["normalizedLoginName"],message:"Local identity requires normalizedLoginName."}),e.passwordHash||t.addIssue({code:"custom",path:["passwordHash"],message:"Local identity requires passwordHash."}),(e.providerId||e.subject)&&t.addIssue({code:"custom",path:["providerId"],message:"Local identity cannot reference a provider."})):(e.providerId&&e.subject||t.addIssue({code:"custom",path:["providerId"],message:"External identity requires providerId and subject."}),(e.passwordHash||e.normalizedLoginName)&&t.addIssue({code:"custom",path:["passwordHash"],message:"External identity cannot contain local credentials."}))}),roles:vA.extend({name:f.z.string().trim().min(1).max(120),description:f.z.string().trim().max(500).optional(),system:f.z.boolean(),status:Gl,permissionIds:f.z.array(Bl)}).strict(),grants:f.z.object({userId:f.z.string().trim().min(1),roleIds:f.z.array(f.z.string().trim().min(1)).min(1).max(100),nodeScope:Xl,instanceScope:Jl.default({kind:"inherit-node-scope"}),authorizationRevision:f.z.number().int().positive(),createdAt:f.z.string().datetime(),updatedAt:f.z.string().datetime()}).strict(),sessions:vA.extend({userId:f.z.string().trim().min(1),identityId:f.z.string().trim().min(1),authorizationRevision:f.z.number().int().positive(),tokenHash:f.z.string().trim().min(1),expiresAt:f.z.string().datetime(),lastSeenAt:f.z.string().datetime().optional(),clientType:f.z.enum(["web","mobile"]),device:f.z.object({id:f.z.string().trim().min(1),name:f.z.string().trim().min(1),platform:f.z.enum(["ios","android"]),appVersion:f.z.string().trim().min(1).optional()}).strict().optional()}).strict().refine(e=>"mobile"!==e.clientType||Boolean(e.device),{path:["device"],message:"Mobile sessions require device metadata."}),providers:vA.extend({name:f.z.string().trim().min(1).max(120),kind:Wl,status:Vl,loginPolicy:Kl,issuer:f.z.string().url().optional(),clientId:f.z.string().trim().min(1).max(500),clientSecretCiphertext:f.z.string().trim().min(1),callbackUrl:f.z.string().url()}).strict().superRefine((e,t)=>{"oidc"!==e.kind||e.issuer||t.addIssue({code:"custom",path:["issuer"],message:"OIDC provider requires issuer."})}),approvals:vA.extend({providerId:f.z.string().trim().min(1),subject:f.z.string().trim().min(1).max(500),verifiedEmail:f.z.string().email().optional(),displayName:f.z.string().trim().min(1).max(160).optional(),status:f.z.enum(["pending","approved","rejected","expired"]),expiresAt:f.z.string().datetime(),decidedAt:f.z.string().datetime().optional(),decidedByUserId:f.z.string().trim().min(1).optional()}).strict(),audit:f.z.object({id:f.z.string().trim().min(1),action:f.z.string().trim().min(1).max(160),actorUserId:f.z.string().trim().min(1).optional(),targetType:f.z.string().trim().min(1).max(120),targetId:f.z.string().trim().min(1).optional(),details:f.z.record(f.z.string(),f.z.unknown()),createdAt:f.z.string().datetime()}).strict()};function xA(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,void 0===t?null:t]))}function wA(e,t){return e.parse(Object.fromEntries(Object.entries(t).filter(([,e])=>null!==e)))}function SA(e,t,n){const i=n instanceof Error?n:new Error(String(n));return Object.assign(new Error(`Control Plane ${e} database ${t} failed: ${i.message}`,{cause:i}),{code:`CONTROL_PLANE_DATABASE_${t.toUpperCase()}_FAILED`,dialect:e,phase:t})}const AA={createdAt:C.text("created_at").notNull(),updatedAt:C.text("updated_at").notNull()},EA=C.pgTable("cp_metadata",{key:C.text("key").primaryKey(),value:C.jsonb("value").notNull()}),_A=C.pgTable("cp_users",{id:C.text("id").primaryKey(),displayName:C.text("display_name").notNull(),status:C.text("status").notNull(),lastLoginAt:C.text("last_login_at"),archivedAt:C.text("archived_at"),...AA}),TA=C.pgTable("cp_login_identities",{id:C.text("id").primaryKey(),userId:C.text("user_id").notNull().references(()=>_A.id,{onDelete:"cascade"}),kind:C.text("kind").notNull(),normalizedLoginName:C.text("normalized_login_name"),passwordHash:C.text("password_hash"),requiresPasswordChange:C.boolean("requires_password_change"),providerId:C.text("provider_id"),subject:C.text("subject"),verifiedEmail:C.text("verified_email"),lastUsedAt:C.text("last_used_at"),...AA},e=>[C.uniqueIndex("cp_login_identities_login_name_uq").on(e.normalizedLoginName),C.uniqueIndex("cp_login_identities_provider_subject_uq").on(e.providerId,e.subject),C.index("cp_login_identities_user_idx").on(e.userId)]),zA=C.pgTable("cp_roles",{id:C.text("id").primaryKey(),name:C.text("name").notNull(),description:C.text("description"),system:C.boolean("system").notNull(),status:C.text("status").notNull(),permissionIds:C.jsonb("permission_ids").$type().notNull(),...AA},e=>[C.uniqueIndex("cp_roles_active_name_uq").on(z.sql`lower(${e.name})`).where(z.sql`${e.status} = 'active'`)]),kA=C.pgTable("cp_user_access_grants",{userId:C.text("user_id").primaryKey().references(()=>_A.id,{onDelete:"cascade"}),nodeScope:C.jsonb("node_scope").$type().notNull(),instanceScope:C.jsonb("instance_scope").$type().notNull(),authorizationRevision:C.integer("authorization_revision").notNull(),...AA}),NA=C.pgTable("cp_user_roles",{userId:C.text("user_id").notNull().references(()=>_A.id,{onDelete:"cascade"}),roleId:C.text("role_id").notNull().references(()=>zA.id,{onDelete:"restrict"})},e=>[C.primaryKey({columns:[e.userId,e.roleId]}),C.index("cp_user_roles_role_idx").on(e.roleId)]),CA=C.pgTable("cp_user_sessions",{id:C.text("id").primaryKey(),identityId:C.text("identity_id").notNull().references(()=>TA.id,{onDelete:"cascade"}),authorizationRevision:C.integer("authorization_revision").notNull(),tokenHash:C.text("token_hash").notNull(),expiresAt:C.text("expires_at").notNull(),lastSeenAt:C.text("last_seen_at"),clientType:C.text("client_type").notNull(),device:C.jsonb("device").$type(),...AA},e=>[C.uniqueIndex("cp_user_sessions_token_hash_uq").on(e.tokenHash),C.index("cp_user_sessions_identity_idx").on(e.identityId),C.index("cp_user_sessions_expiry_idx").on(e.expiresAt)]),RA=C.pgTable("cp_identity_providers",{id:C.text("id").primaryKey(),name:C.text("name").notNull(),kind:C.text("kind").notNull(),status:C.text("status").notNull(),loginPolicy:C.text("login_policy").notNull(),issuer:C.text("issuer"),clientId:C.text("client_id").notNull(),clientSecretCiphertext:C.text("client_secret_ciphertext").notNull(),callbackUrl:C.text("callback_url").notNull(),...AA}),OA=C.pgTable("cp_external_identity_approvals",{id:C.text("id").primaryKey(),providerId:C.text("provider_id").notNull().references(()=>RA.id,{onDelete:"cascade"}),subject:C.text("subject").notNull(),verifiedEmail:C.text("verified_email"),displayName:C.text("display_name"),status:C.text("status").notNull(),expiresAt:C.text("expires_at").notNull(),decidedAt:C.text("decided_at"),decidedByUserId:C.text("decided_by_user_id").references(()=>_A.id),...AA},e=>[C.index("cp_external_identity_approvals_lookup_idx").on(e.providerId,e.subject,e.status)]),jA=C.pgTable("cp_user_audit",{id:C.text("id").primaryKey(),action:C.text("action").notNull(),actorUserId:C.text("actor_user_id"),targetType:C.text("target_type").notNull(),targetId:C.text("target_id"),details:C.jsonb("details").$type().notNull(),createdAt:C.text("created_at").notNull()},e=>[C.index("cp_user_audit_created_idx").on(e.createdAt)]),PA=C.pgTable("cp_migration_ledger",{id:C.text("id").primaryKey(),checksum:C.text("checksum").notNull(),appliedAt:C.text("applied_at").notNull(),details:C.jsonb("details").$type().notNull()});function DA(e){return`"${e.replaceAll('"','""')}"`}function LA(e,t,n){return{list:async()=>(await e.select().from(t)).map(e=>wA(n,e)),async get(i){const s=await e.select().from(t).where(z.eq(t.id,i)).limit(1);return s[0]?wA(n,s[0]):void 0},async put(i){const s=xA(n.parse(i)),a=Object.fromEntries(Object.entries(s).filter(([e])=>"id"!==e));return await e.insert(t).values(s).onConflictDoUpdate({target:t.id,set:a}),wA(n,s)},delete:async n=>(await e.delete(t).where(z.eq(t.id,n)).returning({id:t.id})).length>0}}function MA(e){const t=LA(e,TA,IA.identities),n=async t=>{const n=await e.select().from(TA).where(t).limit(1);return n[0]?wA(IA.identities,n[0]):void 0};return{...t,findByLoginName:e=>n(z.eq(TA.normalizedLoginName,e)),findByProviderSubject:(e,t)=>n(z.and(z.eq(TA.providerId,e),z.eq(TA.subject,t))),listByUser:async t=>(await e.select().from(TA).where(z.eq(TA.userId,t))).map(e=>wA(IA.identities,e)),existsForProvider:async t=>(await e.select({id:TA.id}).from(TA).where(z.eq(TA.providerId,t)).limit(1)).length>0}}function qA(e){const t=new Map;for(const n of e){const e=n.grant.userId,i=t.get(e)||{grant:n.grant,roleIds:[]};i.roleIds.push(n.roleId),t.set(e,i)}return[...t.values()].map(({grant:e,roleIds:t})=>IA.grants.parse({...e,roleIds:t.sort()}))}function UA(e,t,n){const i=t=>{const n=e.select({grant:kA,roleId:NA.roleId}).from(kA).innerJoin(NA,z.eq(kA.userId,NA.userId));return t?n.where(z.inArray(kA.userId,t)):n};return{list:async()=>qA(await i()),get:async e=>qA(await i([e]))[0],async listByRole(t){const n=(await e.select({userId:NA.userId}).from(NA).where(z.eq(NA.roleId,t))).map(e=>e.userId);return 0===n.length?[]:qA(await i(n))},put:i=>n?(async t=>{const n=IA.grants.parse(t),{roleIds:i,...s}=n;return await e.insert(kA).values(s).onConflictDoUpdate({target:kA.userId,set:Object.fromEntries(Object.entries(s).filter(([e])=>"userId"!==e))}),await e.delete(NA).where(z.eq(NA.userId,n.userId)),await e.insert(NA).values(i.map(e=>({userId:n.userId,roleId:e}))),n})(i):t(e=>e.grants.put(i)),delete:async t=>(await e.delete(kA).where(z.eq(kA.userId,t)).returning({userId:kA.userId})).length>0}}function $A(e){const t=e=>e.map(e=>wA(IA.sessions,{...e.session,userId:e.userId})),n=()=>e.select({session:CA,userId:TA.userId}).from(CA).innerJoin(TA,z.eq(CA.identityId,TA.id));return{list:async()=>t(await n()),get:async e=>t(await n().where(z.eq(CA.id,e)).limit(1))[0],listByUser:async e=>t(await n().where(z.eq(TA.userId,e))),async put(t){const n=IA.sessions.parse(t),i=await e.select({userId:TA.userId}).from(TA).where(z.eq(TA.id,n.identityId)).limit(1);if(i[0]?.userId!==n.userId)throw new Error("Session identity does not belong to the requested user.");const{userId:s,...a}=n;return await e.insert(CA).values(a).onConflictDoUpdate({target:CA.id,set:Object.fromEntries(Object.entries(a).filter(([e])=>"id"!==e))}),n},delete:async t=>(await e.delete(CA).where(z.eq(CA.id,t)).returning({id:CA.id})).length>0}}function BA(e){return{...LA(e,OA,IA.approvals),async findActivePending(t,n,i){const s=await e.select().from(OA).where(z.and(z.eq(OA.providerId,t),z.eq(OA.subject,n),z.eq(OA.status,"pending"),z.gt(OA.expiresAt,i))).limit(1);return s[0]?wA(IA.approvals,s[0]):void 0},hasActivePendingForProvider:async(t,n)=>(await e.select({id:OA.id}).from(OA).where(z.and(z.eq(OA.providerId,t),z.eq(OA.status,"pending"),z.gt(OA.expiresAt,n))).limit(1)).length>0}}function FA(e,t,n=!1){let i;const s=async t=>n?t(i):e.transaction(async e=>t(FA(e,async()=>{},!0)));return i={dialect:"postgresql",users:LA(e,_A,IA.users),identities:MA(e),roles:LA(e,zA,IA.roles),grants:UA(e,s,n),sessions:$A(e),providers:LA(e,RA,IA.providers),approvals:BA(e),audit:LA(e,jA,IA.audit),async metadata(){const t=await e.select().from(EA).where(z.eq(EA.key,"user_store")).limit(1);return t[0]?.value||{schemaVersion:1}},async putMetadata(t){await e.insert(EA).values({key:"user_store",value:t}).onConflictDoUpdate({target:EA.key,set:{value:t}})},migration:async t=>(await e.select().from(PA).where(z.eq(PA.id,t)).limit(1))[0],async putMigration(t){await e.insert(PA).values(t).onConflictDoUpdate({target:PA.id,set:{checksum:t.checksum,appliedAt:t.appliedAt,details:t.details}})},transaction:s,close:t},i}var HA=Object.freeze({__proto__:null,createPostgresqlUserRepository:async function(e){const t=new N.Pool({connectionString:e.connectionString,options:`-c search_path=${e.schema}`,application_name:"task-handoff-control-plane"});try{await t.query("SELECT 1")}catch(e){throw await t.end().catch(()=>{}),SA("postgresql","connect",e)}try{return await async function(e,t){const n=await e.connect();try{await n.query("BEGIN"),await n.query("SELECT pg_advisory_xact_lock(hashtext($1))",[`task-handoff:user-access:${t}`]),await n.query(`CREATE SCHEMA IF NOT EXISTS ${DA(t)}`),await n.query(`SET LOCAL search_path TO ${DA(t)}`),await n.query("CREATE TABLE IF NOT EXISTS cp_migration_ledger (\n      id TEXT PRIMARY KEY NOT NULL, checksum TEXT NOT NULL, applied_at TEXT NOT NULL, details JSONB NOT NULL\n    )");for(const e of bA){const t=await n.query("SELECT checksum FROM cp_migration_ledger WHERE id = $1",[e.id]);if(t.rows[0]){if(t.rows[0].checksum!==e.checksum)throw new Error(`Migration checksum mismatch for ${e.id}.`)}else await n.query(e.sql),await n.query("INSERT INTO cp_migration_ledger (id, checksum, applied_at, details) VALUES ($1, $2, $3, $4)",[e.id,e.checksum,(new Date).toISOString(),{dialect:"postgresql"}])}await n.query("COMMIT")}catch(e){throw await n.query("ROLLBACK"),e}finally{n.release()}}(t,e.schema),FA(k.drizzle({client:t}),()=>t.end())}catch(e){throw await t.end().catch(()=>{}),SA("postgresql","migrate",e)}}});const GA={createdAt:j.text("created_at").notNull(),updatedAt:j.text("updated_at").notNull()},WA=j.sqliteTable("cp_metadata",{key:j.text("key").primaryKey(),value:j.text("value",{mode:"json"}).notNull()}),VA=j.sqliteTable("cp_users",{id:j.text("id").primaryKey(),displayName:j.text("display_name").notNull(),status:j.text("status",{enum:["active","disabled","archived"]}).notNull(),lastLoginAt:j.text("last_login_at"),archivedAt:j.text("archived_at"),...GA}),KA=j.sqliteTable("cp_login_identities",{id:j.text("id").primaryKey(),userId:j.text("user_id").notNull().references(()=>VA.id,{onDelete:"cascade"}),kind:j.text("kind",{enum:["local-password","oidc","oauth"]}).notNull(),normalizedLoginName:j.text("normalized_login_name"),passwordHash:j.text("password_hash"),requiresPasswordChange:j.integer("requires_password_change",{mode:"boolean"}),providerId:j.text("provider_id"),subject:j.text("subject"),verifiedEmail:j.text("verified_email"),lastUsedAt:j.text("last_used_at"),...GA},e=>[j.uniqueIndex("cp_login_identities_login_name_uq").on(e.normalizedLoginName),j.uniqueIndex("cp_login_identities_provider_subject_uq").on(e.providerId,e.subject),j.index("cp_login_identities_user_idx").on(e.userId)]),YA=j.sqliteTable("cp_roles",{id:j.text("id").primaryKey(),name:j.text("name").notNull(),description:j.text("description"),system:j.integer("system",{mode:"boolean"}).notNull(),status:j.text("status",{enum:["active","archived"]}).notNull(),permissionIds:j.text("permission_ids",{mode:"json"}).$type().notNull(),...GA},e=>[j.uniqueIndex("cp_roles_active_name_uq").on(z.sql`lower(${e.name})`).where(z.sql`${e.status} = 'active'`)]),XA=j.sqliteTable("cp_user_access_grants",{userId:j.text("user_id").primaryKey().references(()=>VA.id,{onDelete:"cascade"}),nodeScope:j.text("node_scope",{mode:"json"}).$type().notNull(),instanceScope:j.text("instance_scope",{mode:"json"}).$type().notNull(),authorizationRevision:j.integer("authorization_revision").notNull(),...GA}),JA=j.sqliteTable("cp_user_roles",{userId:j.text("user_id").notNull().references(()=>VA.id,{onDelete:"cascade"}),roleId:j.text("role_id").notNull().references(()=>YA.id,{onDelete:"restrict"})},e=>[j.primaryKey({columns:[e.userId,e.roleId]}),j.index("cp_user_roles_role_idx").on(e.roleId)]),QA=j.sqliteTable("cp_user_sessions",{id:j.text("id").primaryKey(),identityId:j.text("identity_id").notNull().references(()=>KA.id,{onDelete:"cascade"}),authorizationRevision:j.integer("authorization_revision").notNull(),tokenHash:j.text("token_hash").notNull(),expiresAt:j.text("expires_at").notNull(),lastSeenAt:j.text("last_seen_at"),clientType:j.text("client_type",{enum:["web","mobile"]}).notNull(),device:j.text("device",{mode:"json"}).$type(),...GA},e=>[j.uniqueIndex("cp_user_sessions_token_hash_uq").on(e.tokenHash),j.index("cp_user_sessions_identity_idx").on(e.identityId),j.index("cp_user_sessions_expiry_idx").on(e.expiresAt)]),ZA=j.sqliteTable("cp_identity_providers",{id:j.text("id").primaryKey(),name:j.text("name").notNull(),kind:j.text("kind",{enum:["oidc","github"]}).notNull(),status:j.text("status",{enum:["enabled","disabled"]}).notNull(),loginPolicy:j.text("login_policy",{enum:["existing-only","admin-approved-create"]}).notNull(),issuer:j.text("issuer"),clientId:j.text("client_id").notNull(),clientSecretCiphertext:j.text("client_secret_ciphertext").notNull(),callbackUrl:j.text("callback_url").notNull(),...GA}),eE=j.sqliteTable("cp_external_identity_approvals",{id:j.text("id").primaryKey(),providerId:j.text("provider_id").notNull().references(()=>ZA.id,{onDelete:"cascade"}),subject:j.text("subject").notNull(),verifiedEmail:j.text("verified_email"),displayName:j.text("display_name"),status:j.text("status",{enum:["pending","approved","rejected","expired"]}).notNull(),expiresAt:j.text("expires_at").notNull(),decidedAt:j.text("decided_at"),decidedByUserId:j.text("decided_by_user_id").references(()=>VA.id),...GA},e=>[j.index("cp_external_identity_approvals_lookup_idx").on(e.providerId,e.subject,e.status)]),tE=j.sqliteTable("cp_user_audit",{id:j.text("id").primaryKey(),action:j.text("action").notNull(),actorUserId:j.text("actor_user_id"),targetType:j.text("target_type").notNull(),targetId:j.text("target_id"),details:j.text("details",{mode:"json"}).$type().notNull(),createdAt:j.text("created_at").notNull()},e=>[j.index("cp_user_audit_created_idx").on(e.createdAt)]),nE=j.sqliteTable("cp_migration_ledger",{id:j.text("id").primaryKey(),checksum:j.text("checksum").notNull(),appliedAt:j.text("applied_at").notNull(),details:j.text("details",{mode:"json"}).$type().notNull()});class iE{tail=Promise.resolve();run(e){const t=this.tail.then(e,e);return this.tail=t.then(()=>{},()=>{}),t}}function sE(e,t,n,i){return{list:async()=>(await e.select().from(t)).map(e=>wA(n,e)),async get(i){const s=await e.select().from(t).where(z.eq(t.id,i)).limit(1);return s[0]?wA(n,s[0]):void 0},put:async s=>i(async()=>{const i=xA(n.parse(s)),a=Object.fromEntries(Object.entries(i).filter(([e])=>"id"!==e));return await e.insert(t).values(i).onConflictDoUpdate({target:t.id,set:a}),wA(n,i)}),delete:async n=>i(async()=>{const i=await e.delete(t).where(z.eq(t.id,n));return Number(i.changes)>0})}}function aE(e,t){const n=sE(e,KA,IA.identities,t),i=async t=>{const n=await e.select().from(KA).where(t).limit(1);return n[0]?wA(IA.identities,n[0]):void 0};return{...n,findByLoginName:e=>i(z.eq(KA.normalizedLoginName,e)),findByProviderSubject:(e,t)=>i(z.and(z.eq(KA.providerId,e),z.eq(KA.subject,t))),listByUser:async t=>(await e.select().from(KA).where(z.eq(KA.userId,t))).map(e=>wA(IA.identities,e)),existsForProvider:async t=>(await e.select({id:KA.id}).from(KA).where(z.eq(KA.providerId,t)).limit(1)).length>0}}function oE(e){const t=new Map;for(const n of e){const e=n.grant.userId,i=t.get(e)||{grant:n.grant,roleIds:[]};i.roleIds.push(n.roleId),t.set(e,i)}return[...t.values()].map(({grant:e,roleIds:t})=>IA.grants.parse({...e,roleIds:t.sort()}))}function rE(e,t,n,i){const s=t=>{const n=e.select({grant:XA,roleId:JA.roleId}).from(XA).innerJoin(JA,z.eq(XA.userId,JA.userId));return t?n.where(z.inArray(XA.userId,t)):n};return{list:async()=>oE(await s()),get:async e=>oE(await s([e]))[0],async listByRole(t){const n=(await e.select({userId:JA.userId}).from(JA).where(z.eq(JA.roleId,t))).map(e=>e.userId);return 0===n.length?[]:oE(await s(n))},put:n=>i?(async t=>{const n=IA.grants.parse(t),{roleIds:i,...s}=n;return await e.insert(XA).values(s).onConflictDoUpdate({target:XA.userId,set:Object.fromEntries(Object.entries(s).filter(([e])=>"userId"!==e))}),await e.delete(JA).where(z.eq(JA.userId,n.userId)),await e.insert(JA).values(i.map(e=>({userId:n.userId,roleId:e}))),n})(n):t(e=>e.grants.put(n)),delete:async t=>n(async()=>{const n=await e.delete(XA).where(z.eq(XA.userId,t));return Number(n.changes)>0})}}function cE(e,t){const n=e=>e.map(e=>wA(IA.sessions,{...e.session,userId:e.userId})),i=()=>e.select({session:QA,userId:KA.userId}).from(QA).innerJoin(KA,z.eq(QA.identityId,KA.id));return{list:async()=>n(await i()),get:async e=>n(await i().where(z.eq(QA.id,e)).limit(1))[0],listByUser:async e=>n(await i().where(z.eq(KA.userId,e))),put:async n=>t(async()=>{const t=IA.sessions.parse(n),i=await e.select({userId:KA.userId}).from(KA).where(z.eq(KA.id,t.identityId)).limit(1);if(i[0]?.userId!==t.userId)throw new Error("Session identity does not belong to the requested user.");const{userId:s,...a}=t;return await e.insert(QA).values(a).onConflictDoUpdate({target:QA.id,set:Object.fromEntries(Object.entries(a).filter(([e])=>"id"!==e))}),t}),delete:async n=>t(async()=>{const t=await e.delete(QA).where(z.eq(QA.id,n));return Number(t.changes)>0})}}function dE(e,t){return{...sE(e,eE,IA.approvals,t),async findActivePending(t,n,i){const s=await e.select().from(eE).where(z.and(z.eq(eE.providerId,t),z.eq(eE.subject,n),z.eq(eE.status,"pending"),z.gt(eE.expiresAt,i))).limit(1);return s[0]?wA(IA.approvals,s[0]):void 0},hasActivePendingForProvider:async(t,n)=>(await e.select({id:eE.id}).from(eE).where(z.and(z.eq(eE.providerId,t),z.eq(eE.status,"pending"),z.gt(eE.expiresAt,n))).limit(1)).length>0}}function lE(e,t,n,i=!1,s=new iE){let a;const o=e=>i?e():s.run(e),r=async t=>i?t(a):o(async()=>{n.exec("BEGIN IMMEDIATE");try{const i=await t(lE(e,async()=>{},n,!0,s));return n.exec("COMMIT"),i}catch(e){throw n.exec("ROLLBACK"),e}});return a={dialect:"sqlite",users:sE(e,VA,IA.users,o),identities:aE(e,o),roles:sE(e,YA,IA.roles,o),grants:rE(e,r,o,i),sessions:cE(e,o),providers:sE(e,ZA,IA.providers,o),approvals:dE(e,o),audit:sE(e,tE,IA.audit,o),async metadata(){const t=await e.select().from(WA).where(z.eq(WA.key,"user_store")).limit(1);return t[0]?.value||{schemaVersion:1}},async putMetadata(t){await o(()=>e.insert(WA).values({key:"user_store",value:t}).onConflictDoUpdate({target:WA.key,set:{value:t}}))},migration:async t=>(await e.select().from(nE).where(z.eq(nE.id,t)).limit(1))[0],async putMigration(t){await o(()=>e.insert(nE).values(t).onConflictDoUpdate({target:nE.id,set:{checksum:t.checksum,appliedAt:t.appliedAt,details:t.details}}))},transaction:r,close:t},a}var pE=Object.freeze({__proto__:null,createSqliteUserRepository:async function(e){try{n.mkdirSync(t.dirname(e),{recursive:!0});const i=new R.DatabaseSync(e);try{!function(e){e.exec("PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 5000;"),e.exec("CREATE TABLE IF NOT EXISTS cp_migration_ledger (\n    id TEXT PRIMARY KEY NOT NULL, checksum TEXT NOT NULL, applied_at TEXT NOT NULL, details TEXT NOT NULL\n  )"),e.exec("BEGIN IMMEDIATE");try{const t=e.prepare("SELECT checksum FROM cp_migration_ledger WHERE id = ?"),n=e.prepare("INSERT INTO cp_migration_ledger (id, checksum, applied_at, details) VALUES (?, ?, ?, ?)");for(const i of yA){const s=t.get(i.id);if(s){if(s.checksum!==i.checksum)throw new Error(`Migration checksum mismatch for ${i.id}.`)}else e.exec(i.sql),n.run(i.id,i.checksum,(new Date).toISOString(),JSON.stringify({dialect:"sqlite"}))}e.exec("COMMIT")}catch(t){throw e.exec("ROLLBACK"),t}}(i)}catch(e){throw i.close(),SA("sqlite","migrate",e)}return lE(O.drizzle({client:i}),async()=>i.close(),i)}catch(e){if("CONTROL_PLANE_DATABASE_MIGRATE_FAILED"===e.code)throw e;throw SA("sqlite","connect",e)}}});