@workerdeck/protocol 0.22.0 → 1.0.0

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["#store","#cache","#prune"],"sources":["../src/session-list.ts","../src/usage.ts","../src/watermarks.ts","../src/index.ts"],"sourcesContent":["import type { SessionInfo, SubagentInfo } from './index.ts'\n\n/**\n * How a sessions list is filtered, grouped and sorted — the whole of the view\n * config, kept pure and separate from the components so every surface renders\n * one derived list and nothing else decides what is visible.\n *\n * Framework-free like `transcript.ts`, and for the same reason: more than one\n * party has to agree. In the VS Code extension the webview renders the list and\n * the extension host counts the activity-bar badge over the same rows (a badge\n * that ignored the filter would announce work in sessions the list is\n * deliberately hiding); in the dashboard the list and its subset line derive\n * from it; on iOS it is mirrored to Swift the way the reducer is.\n *\n * Sessions are shown across ALL gateways by default; the gateway is a facet like\n * any other, not the frame the list lives in.\n */\n\n/** Coarse lifecycle bucket — what a person actually filters on. Raw statuses are\n * too many and too engine-shaped ('starting' vs 'running' is not a decision). */\nexport type SessionState = 'attention' | 'working' | 'idle' | 'ended'\n\nexport const STATE_ORDER: readonly SessionState[] = ['attention', 'working', 'idle', 'ended']\n\nexport const STATE_LABELS: Record<SessionState, string> = {\n  attention: 'Needs attention',\n  working: 'Working',\n  idle: 'Idle',\n  ended: 'Ended',\n}\n\nexport function sessionState(info: SessionInfo): SessionState {\n  // A pending approval outranks everything, a running background agent\n  // included: it is the one thing the person has to act on.\n  if (info.pendingPermissionCount > 0 || info.status === 'awaiting_approval') return 'attention'\n  // Terminal statuses are checked before the sub-agent arm, defensively: the\n  // `session_closed` sweep settles every sub-agent record (the process hosting\n  // them is gone), so a closed session carrying a `running` record should be\n  // unreachable — but a stale record must read `ended`, never `working`.\n  if (info.status === 'failed' || info.status === 'closed') return 'ended'\n  if (info.status === 'running' || info.status === 'starting') return 'working'\n  // A *background* agent outlives its turn by design (`task_started`, the\n  // async spawn): the turn ends, `status` comes to rest at `idle`, and the\n  // agent keeps burning tokens. Without this arm the row read Idle while an\n  // agent was actively working in it — the status alone cannot carry it,\n  // because the status is the turn's.\n  if (runningSubagents(info).length > 0) return 'working'\n  return 'idle'\n}\n\n/**\n * The sub-agents a list row draws as live.\n *\n * `sessionState` deliberately does **not** grow a `subagents` bucket — a fifth\n * state would split `working` in two for every client that filters by it,\n * including the ones that have not shipped this yet. Instead `working` *counts*\n * them: a synchronous `Task` keeps the turn in flight so the status already\n * says `working`, and a **background** agent — which outlives its turn on\n * purpose — is the carve-out the extra arm in `sessionState` exists for.\n * That is what makes \"sub-agents are an annotation on a working row\" true\n * rather than assumed: the row is in the working bucket whichever kind is\n * running, and this list only says more about it.\n */\nexport function runningSubagents(info: SessionInfo): SubagentInfo[] {\n  return (info.subagents ?? []).filter((sub) => sub.status === 'running')\n}\n\n/**\n * A sub-agent's identity on one line: `Explore · find the auth check`.\n *\n * The same two fields `taskLabel` builds its transcript row from, minus the\n * `Task(…)` wrapper — a list row is already inside a session, so naming the tool\n * spends the width that the description needs. Falls back to the bare agent type,\n * then to a generic word: a row with no label at all reads as a rendering bug,\n * and an engine is free to send neither field.\n */\n/**\n * Does this record name an **agent**, as opposed to a task the model merely\n * described?\n *\n * The tracker opens a record for every spawner call and for any nested event\n * whose parent it has not seen, so the list holds two different things wearing\n * one shape. One carries a `subagent_type` — a delegated agent with an identity\n * (`Explore`), whose own work is worth a surface of its own. The other carries\n * only a description, and there is no agent there to open: a row that offered a\n * screen and then showed a frame with nothing in it would be worse than a row\n * that offered nothing.\n *\n * Here rather than in a client because it decides two things a list must not\n * disagree about across surfaces — what is pressable, and what wears the\n * sub-agent colour.\n */\nexport function isAgentRecord(sub: SubagentInfo): boolean {\n  return (sub.agentType?.trim() ?? '') !== ''\n}\n\nexport function subagentLabel(sub: SubagentInfo): string {\n  const agent = sub.agentType?.trim()\n  const description = sub.description?.trim()\n  if (agent && description) return `${agent} · ${description}`\n  return agent || description || 'Sub-agent'\n}\n\n/** The facets a session can be grouped or sorted by. */\nexport type Facet = 'gateway' | 'adapter' | 'state' | 'project'\nexport type GroupBy = 'none' | Facet\nexport type SortBy = 'recent' | 'name' | Facet\n\nexport type ViewConfig = {\n  search: string\n  /** Empty = no filter. Ids, not names: names are editable. */\n  gateways: string[]\n  adapters: string[]\n  states: SessionState[]\n  /**\n   * Empty = no filter. Keys are {@link projectKey} output — never names, which\n   * are neither unique (two repos both called \"api\") nor stable (editing\n   * `.workerdeck.json` renames every session at once and must not empty a\n   * saved filter). Optional, unlike its three siblings, because stored view\n   * configs predate it: a config restored from `localStorage`/`globalState`\n   * without the key must keep filtering, so absent and empty mean the same\n   * thing.\n   */\n  projects?: string[]\n  /** Show only sessions inside the host's own folders. Inert where there is no\n   * such notion (no folder open, a dashboard with no workspace), which is why it\n   * can default on. */\n  scoped: boolean\n  groupBy: GroupBy\n  sortBy: SortBy\n}\n\nexport const DEFAULT_VIEW_CONFIG: ViewConfig = {\n  search: '',\n  gateways: [],\n  adapters: [],\n  states: [],\n  projects: [],\n  scoped: true,\n  groupBy: 'state',\n  sortBy: 'recent',\n}\n\n/**\n * One folder the surrounding host has open, as a place sessions can live in.\n *\n * `hostId` present = the folder belongs to exactly that gateway. Absent = a real\n * local folder, which only a loopback gateway's cwds can be inside: a remote\n * gateway's paths are on another machine, where an identical-looking path means\n * nothing.\n */\nexport type ScopeRoot = { hostId?: string; path: string }\n\n/** The host's own folders — the sessions list's intrinsic scope. */\nexport type WorkspaceScope = { label: string; roots: ScopeRoot[] }\n\n/** A session with everything the list needs to filter, group and label it. */\nexport type SessionRow = {\n  hostId: string\n  hostName: string\n  /** Its gateway is loopback — its cwds are paths on this machine. */\n  local: boolean\n  adapter: string\n  state: SessionState\n  info: SessionInfo\n  /** Transcript rows since this session was last on screen. 0 = nothing new (or\n   * never visited, which is not the same as unread). */\n  unseen: number\n}\n\nexport type SessionGroup = { key: string; label?: string; rows: SessionRow[] }\n\n/** The adapters actually present, for the filter chips — derived rather than\n * enumerated, so a new engine needs no change here. */\nexport function adaptersOf(rows: readonly SessionRow[]): string[] {\n  return [...new Set(rows.map((r) => r.adapter))].sort()\n}\n\n/**\n * The projects actually present, as `{ key, label }` for a filter control —\n * derived like {@link adaptersOf}, and paired because the two halves differ:\n * the *key* is what {@link ViewConfig.projects} holds (gateway-qualified root,\n * so a rename regroups nothing) and the *label* is what a person picks by.\n *\n * Sorted by label, deduped by key. Two projects with the same name on two\n * gateways therefore stay two entries wearing one word — which is honest: they\n * really are two different directories, and the alternative is a filter that\n * silently selects both.\n */\nexport function projectsOf(rows: readonly SessionRow[]): { key: string; label: string }[] {\n  const byKey = new Map<string, string>()\n  for (const row of rows) byKey.set(projectKey(row), projectLabel(row))\n  return [...byKey]\n    .map(([key, label]) => ({ key, label }))\n    .sort((a, b) => a.label.toLowerCase().localeCompare(b.label.toLowerCase()))\n}\n\nexport function sessionLabel(info: SessionInfo): string {\n  return info.title ?? info.id.slice(0, 8)\n}\n\n/**\n * The project facet's grouping key: gateway id + the project root, falling\n * back to the session's cwd when no project is declared.\n *\n * The root and not the name, because a name is not a key (two repos can both\n * be called \"api\", and a rename must regroup nothing); qualified by gateway,\n * because a remote gateway's identical-looking path is another machine's\n * directory — the same rule `ScopeRoot` states. The cwd fallback is what makes\n * grouping by project useful before anyone has written a `.workerdeck.json`:\n * undeclared sessions group by their folder, declared ones by their root, and\n * a session in `packages/ui` joins its repo's group the moment the file\n * exists. Sessions with no cwd at all (a filesystem-less engine) share one\n * per-gateway bucket — see {@link projectLabel}.\n */\nexport function projectKey(row: SessionRow): string {\n  return `${row.hostId}:${normalizePath(row.info.project?.root ?? row.info.cwd)}`\n}\n\n/**\n * What a project group (or a row's project slot) is called: the declared name,\n * else the cwd's basename — the exact string clients rendered before this\n * feature existed, so an undeclared project looks like today. 'No project' is\n * only ever the no-cwd case (a sandboxed provider session), where there is no\n * folder to name.\n *\n * Takes only the `info` it reads, so a surface holding a bare `SessionInfo` —\n * a row component, an iOS cell — can call it without inventing the rest of a\n * `SessionRow`. That matters more than it looks: this string is what a client\n * renders *in place of* the cwd basename it used to draw, and two spellings of\n * it would put the list and its group headers on different names.\n */\nexport function projectLabel(row: Pick<SessionRow, 'info'>): string {\n  const name = row.info.project?.name\n  if (name) return name\n  const dir = normalizePath(row.info.cwd)\n  return dir.slice(dir.lastIndexOf('/') + 1) || 'No project'\n}\n\n/**\n * Where inside its project a session actually sits — the cwd with the project\n * root taken off the front, or `undefined` when it sits at the root, has no\n * declared project, or has no cwd at all.\n *\n * The companion to {@link projectLabel}, and it exists for one situation: a list\n * **grouped by project**. There the header has already said the project's name,\n * so repeating it on every row spends the row's most valuable line on the one\n * fact the reader already has. What the header cannot say is which *part* of the\n * project a session is working in, and two sessions in the same repo are told\n * apart by exactly that.\n *\n * Undefined is the honest answer for a session at the project root, and callers\n * must render nothing rather than a `.` or a repeated name — the slot simply\n * goes away, which is the point.\n */\nexport function projectSubpath(row: Pick<SessionRow, 'info'>): string | undefined {\n  const root = row.info.project?.root\n  if (root === undefined || !row.info.cwd) return undefined\n  const base = normalizePath(root)\n  const dir = normalizePath(row.info.cwd)\n  if (dir === base) return undefined\n  // A prefix match is not containment: `/a/repo-two` starts with `/a/repo`.\n  if (!dir.startsWith(`${base}/`)) return undefined\n  return dir.slice(base.length + 1) || undefined\n}\n\n/**\n * This session is a job run — the queue created it, and `JobInfo.sessionId`\n * points at it.\n *\n * A job run is an ordinary registry session in every other respect, which is\n * what makes this worth spelling once: a client that renders jobs on their own\n * surface should not list them again among the sessions, and a client with no\n * jobs surface (the extension, the phone) should, or they would be invisible.\n * The queue stamps `meta.jobId`; nothing else may write that key.\n */\nexport function isJobRun(info: SessionInfo): boolean {\n  return typeof info.meta?.jobId === 'string'\n}\n\nfunction matchesSearch(row: SessionRow, needle: string): boolean {\n  if (!needle) return true\n  return (\n    sessionLabel(row.info).toLowerCase().includes(needle) ||\n    row.info.cwd.toLowerCase().includes(needle) ||\n    // The declared project name: the whole point of it is that a person knows\n    // the repo as \"WorkerDeck\", not by whatever the folder happens to be called.\n    (row.info.project?.name.toLowerCase().includes(needle) ?? false) ||\n    row.hostName.toLowerCase().includes(needle) ||\n    row.adapter.toLowerCase().includes(needle) ||\n    row.info.id.startsWith(needle)\n  )\n}\n\n/** Trailing separators dropped and separators unified, so containment is a\n * plain prefix test on both a posix and a Windows gateway. */\nfunction normalizePath(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+$/, '')\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  const base = normalizePath(root)\n  const dir = normalizePath(path)\n  // The separator matters: /a/project must not swallow /a/project-2.\n  return dir === base || dir.startsWith(`${base}/`)\n}\n\n/**\n * Is this session inside one of the host's folders? A gateway-tagged root only\n * ever matches its own gateway; an untagged one only matches a loopback gateway,\n * because a remote gateway's identical-looking path is a different machine's\n * directory.\n */\nexport function inScope(row: SessionRow, scope: WorkspaceScope): boolean {\n  return scope.roots.some(\n    (root) =>\n      (root.hostId ? root.hostId.toLowerCase() === row.hostId.toLowerCase() : row.local) &&\n      isWithin(root.path, row.info.cwd),\n  )\n}\n\n/** Whether the scope filter is actually hiding anything — it is inert with no\n * folder open, and that is the difference between a default and a filter. */\nexport function scopeActive(config: ViewConfig, scope: WorkspaceScope | undefined): boolean {\n  return config.scoped && scope !== undefined\n}\n\nexport function filterRows(\n  rows: readonly SessionRow[],\n  config: ViewConfig,\n  scope?: WorkspaceScope,\n): SessionRow[] {\n  const needle = config.search.trim().toLowerCase()\n  const scoping = scopeActive(config, scope) ? scope : undefined\n  return rows.filter(\n    (row) =>\n      (config.gateways.length === 0 || config.gateways.includes(row.hostId)) &&\n      (config.adapters.length === 0 || config.adapters.includes(row.adapter)) &&\n      (config.states.length === 0 || config.states.includes(row.state)) &&\n      // `?.` and not a default: see `ViewConfig.projects` — a stored config\n      // predating the field must behave as \"no filter\".\n      (!config.projects?.length || config.projects.includes(projectKey(row))) &&\n      (!scoping || inScope(row, scoping)) &&\n      matchesSearch(row, needle),\n  )\n}\n\nfunction facetKey(row: SessionRow, facet: Facet): string {\n  return facet === 'gateway'\n    ? row.hostId\n    : facet === 'adapter'\n      ? row.adapter\n      : facet === 'project'\n        ? projectKey(row)\n        : row.state\n}\n\nfunction facetLabel(row: SessionRow, facet: Facet): string {\n  return facet === 'gateway'\n    ? row.hostName\n    : facet === 'adapter'\n      ? row.adapter\n      : facet === 'project'\n        ? projectLabel(row)\n        : STATE_LABELS[row.state]\n}\n\n/** Comparable rank for a facet: states run worst-first (attention before ended),\n * the rest alphabetically by their visible label. */\nfunction facetRank(row: SessionRow, facet: Facet): string {\n  if (facet === 'state') return String(STATE_ORDER.indexOf(row.state))\n  return facetLabel(row, facet).toLowerCase()\n}\n\nconst byRecency = (a: SessionRow, b: SessionRow) =>\n  (b.info.lastActivityAt ?? b.info.createdAt) - (a.info.lastActivityAt ?? a.info.createdAt)\n\nfunction compare(a: SessionRow, b: SessionRow, sortBy: SortBy): number {\n  if (sortBy === 'recent') return byRecency(a, b)\n  if (sortBy === 'name') {\n    return (\n      sessionLabel(a.info).localeCompare(sessionLabel(b.info), undefined, {\n        sensitivity: 'base',\n      }) || byRecency(a, b)\n    )\n  }\n  return facetRank(a, sortBy).localeCompare(facetRank(b, sortBy)) || byRecency(a, b)\n}\n\n/**\n * The list as rendered: filtered, grouped, and sorted within each group. Groups\n * themselves come out in the sort's own order — grouping by state and sorting by\n * name should still put \"Needs attention\" first, so groups are ordered by their\n * facet rank, never by the row sort.\n */\nexport function groupRows(rows: readonly SessionRow[], config: ViewConfig): SessionGroup[] {\n  const sorted = [...rows].sort((a, b) => compare(a, b, config.sortBy))\n  if (config.groupBy === 'none') return sorted.length ? [{ key: 'all', rows: sorted }] : []\n  const facet = config.groupBy\n  const groups = new Map<string, SessionGroup & { rank: string }>()\n  for (const row of sorted) {\n    const key = facetKey(row, facet)\n    const group = groups.get(key)\n    if (group) group.rows.push(row)\n    else {\n      groups.set(key, {\n        key,\n        label: facetLabel(row, facet),\n        rank: facetRank(row, facet),\n        rows: [row],\n      })\n    }\n  }\n  return [...groups.values()].sort((a, b) => a.rank.localeCompare(b.rank))\n}\n\n/**\n * What the list is hiding, and why — the one \"you are seeing a subset\" signal.\n *\n * There used to be two: a dot on the funnel and a scope line above the list.\n * They competed (the scope line said one thing, the dot counted a superset of\n * it) and neither said how much was missing. This is the single rule both the\n * count and the wording come from: absent when nothing is hidden, and otherwise\n * naming every cause, so the line is never \"12 of 30\" with no way to guess why.\n *\n * Search is a cause like any other. Its box is visible, but the *consequence*\n * of it — rows gone from the list — is the thing being reported, and leaving it\n * out would make the arithmetic wrong.\n */\nexport type SubsetSummary = { shown: number; total: number; causes: string[] }\n\nexport function subsetSummary(\n  config: ViewConfig,\n  scope: WorkspaceScope | undefined,\n  shown: number,\n  total: number,\n): SubsetSummary | undefined {\n  if (shown >= total) return undefined\n  const causes: string[] = []\n  if (scope && scopeActive(config, scope)) causes.push(scope.label)\n  // The facets collapse to a count: naming three of them would wrap the line in\n  // a sidebar, and the funnel beside it is where their detail already lives.\n  const facets =\n    (config.gateways.length ? 1 : 0) +\n    (config.adapters.length ? 1 : 0) +\n    (config.states.length ? 1 : 0) +\n    (config.projects?.length ? 1 : 0)\n  if (facets > 0) causes.push(`${facets} filter${facets === 1 ? '' : 's'}`)\n  if (config.search.trim()) causes.push('search')\n  return { shown, total, causes }\n}\n\n/**\n * Is anything OTHER than the workspace scope narrowing the list?\n *\n * The distinction an empty list turns on: \"this project has no sessions\" wants a\n * different sentence, and a different way out, from \"your filters match none\".\n * Scope is excluded because it is on by default — it is the state, not a choice\n * someone made.\n */\nexport function hasFacetFilter(config: ViewConfig): boolean {\n  return (\n    config.search.trim().length > 0 ||\n    config.gateways.length > 0 ||\n    config.adapters.length > 0 ||\n    config.states.length > 0 ||\n    (config.projects?.length ?? 0) > 0\n  )\n}\n\n/** \"Show me everything\": every filter off, including scope. The group/sort\n * choices are a layout preference and survive. */\nexport function clearFilters(config: ViewConfig): ViewConfig {\n  return {\n    ...DEFAULT_VIEW_CONFIG,\n    scoped: false,\n    groupBy: config.groupBy,\n    sortBy: config.sortBy,\n  }\n}\n","import type { ProfileUsage, RateLimitInfo } from './index.ts'\n\n/**\n * What one session was last told about the plan's windows: the transcript's own\n * rate-limit state, and the event clock of the newest reading in it.\n *\n * Deliberately structural rather than `TranscriptState` — protocol may not\n * import a client — and it is exactly the two fields the reducer keeps.\n */\nexport type SessionUsage = {\n  /** Keyed by `rateLimitType`, as the reducer stores it. */\n  rateLimits?: Record<string, RateLimitInfo>\n  /** Epoch ms of the newest `rate_limit` event this session saw — one clock for\n   * the whole map, which is all the reducer records. */\n  updatedAt?: number\n}\n\n/**\n * The usage a client should render: the gateway's per-profile state where it has\n * the window, this session's own reading where it does not.\n *\n * Why the profile wins outright rather than by comparing timestamps: the\n * gateway's `ProfileUsageTracker` is fed from **every** session on the profile —\n * including this one, from seq 0 — and keeps the newest reading per window by\n * the event's own `ts`. So for any window it holds, it holds a reading at least\n * as new as the one in this transcript, and a timestamp comparison could only\n * ever go wrong: the reducer keeps a *single* `updatedAt` for the whole map, so\n * a `five_hour` reading from this morning is dated with the afternoon's\n * `seven_day` event and would beat a genuinely fresher profile entry.\n *\n * The session half is not a fallback for correctness but for *coverage*: the\n * profile map is in-memory, so a restarted gateway serves nothing until a\n * session reports again, and a session with no profile has no account state at\n * all. In both cases the transcript's reading is the only one there is, and it\n * is dated honestly (see {@link SessionUsage.updatedAt}) rather than as now.\n *\n * Absent stays absent throughout: a window nobody has reported is **unknown,\n * never 0%**, and this returns an empty map rather than inventing entries.\n */\nexport function mergeUsage(session: SessionUsage, profile: ProfileUsage | undefined): ProfileUsage {\n  const out: ProfileUsage = {}\n  for (const [key, info] of Object.entries(session.rateLimits ?? {})) {\n    out[key] = { info, updatedAt: session.updatedAt ?? 0 }\n  }\n  for (const [key, window] of Object.entries(profile ?? {})) out[key] = window\n  return out\n}\n\n/** One window as a surface draws it: the reading, its own date, and whether the\n * gateway is the one that zeroed it. */\nexport type UsageWindowRow = {\n  key: string\n  info: RateLimitInfo\n  /** Epoch ms of the reading. Absent only for a hand-built state with no clock. */\n  updatedAt?: number\n  inferredReset?: boolean\n}\n\n/**\n * The windows in reading order: the session window, the weekly one, then the\n * per-model weeklies alphabetically.\n *\n * Discovered rather than hardcoded — the engine's set of windows is an open\n * union and has grown before — but ordered, so the first two always mean the\n * same thing wherever they are drawn. A window with no `utilization` is\n * **unknown, not zero**, and is dropped entirely rather than rendered as an\n * empty bar that reads as \"plenty left\".\n *\n * Here rather than in a client because two surfaces now render the same windows\n * from different sources — the session panel from its merged state, the\n * dashboard's profile page straight off `ProfileInfo.usage` — and a list that\n * ordered or filtered differently would be the same account described two ways.\n */\nexport function orderUsageWindows(usage: ProfileUsage | undefined): UsageWindowRow[] {\n  const all = Object.entries(usage ?? {})\n    .filter(([, w]) => w.info.utilization !== undefined)\n    .map(([key, w]) => ({ key, info: w.info, updatedAt: w.updatedAt, inferredReset: w.inferredReset }))\n  const named = ['five_hour', 'seven_day'].flatMap((key) => all.filter((w) => w.key === key))\n  const perModel = all\n    .filter((w) => w.key.startsWith('seven_day_'))\n    .sort((a, b) => a.key.localeCompare(b.key))\n  return [...named, ...perModel]\n}\n\n/** The flat `rateLimitType → reading` map every existing renderer takes, out of\n * the dated form. Undefined in, undefined out — so a surface can keep telling\n * \"no reading\" apart from \"an empty one\". */\nexport function usageInfos(\n  usage: ProfileUsage | undefined,\n): Record<string, RateLimitInfo> | undefined {\n  if (!usage) return undefined\n  const out: Record<string, RateLimitInfo> = {}\n  for (const [key, window] of Object.entries(usage)) out[key] = window.info\n  return out\n}\n","/**\n * \"What had you seen, and when\" — per session, across reloads.\n *\n * Two numbers because two surfaces ask different questions. A session list has\n * only the REST rollup for sessions it isn't showing, so it compares **rows the\n * gateway counted**; a panel has the whole transcript, so it compares **rows it\n * rendered** and can put the mark in the right place. Keeping both means neither\n * surface has to attach to something it isn't rendering.\n *\n * A watermark is only written while a session is genuinely on screen. A surface\n * nobody can see is not being read, and marking it read is how an unread badge\n * silently stops working.\n *\n * Storage is a seam (`WatermarkStore`) rather than a dependency: the VS Code\n * extension backs it with `globalState`, the dashboard with `localStorage`, and\n * neither belongs in this package.\n */\nexport type Watermark = {\n  /** Transcript rows seen (`SessionVitals.itemCount`). */\n  itemCount: number\n  /** Rows the gateway had counted (`SessionInfo.activityCount`) — the same unit\n   * as `itemCount`, but from the rollup, so it is knowable for a session this\n   * client is not showing. */\n  activity: number\n  /** Completed turns seen. The fallback unit for a gateway too old to report\n   * `activityCount`; five tool calls in one turn count as one. */\n  turns: number\n  /** When this was last true. */\n  seenAt: number\n}\n\n/** Where the marks are kept. Reads happen once at construction; writes are\n * whole-map and may be async — nothing here awaits them. */\nexport type WatermarkStore = {\n  read(): Record<string, Watermark> | undefined\n  write(marks: Record<string, Watermark>): void\n}\n\n/** Entries older than this are dropped on write — a session deleted months ago\n * should not keep a row in storage forever. */\nconst MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000\n\n/** How stale \"last here\" is allowed to get before a write happens anyway. */\nconst TOUCH_MS = 60_000\n\nexport const watermarkKey = (hostId: string, sessionId: string) => `${hostId}:${sessionId}`\n\nexport class Watermarks {\n  readonly #store: WatermarkStore\n  #cache: Record<string, Watermark>\n\n  constructor(store: WatermarkStore) {\n    this.#store = store\n    this.#cache = { ...store.read() }\n  }\n\n  get(hostId: string, sessionId: string): Watermark | undefined {\n    return this.#cache[watermarkKey(hostId, sessionId)]\n  }\n\n  /** Every mark, for a caller deriving unread counts over a whole list. */\n  all(): Readonly<Record<string, Watermark>> {\n    return this.#cache\n  }\n\n  /**\n   * Record what is on screen now. Monotonic on purpose: a transcript that\n   * *shrank* (a compaction, a fresh attach mid-replay) must not walk the mark\n   * backwards and resurrect rows the user already read.\n   *\n   * Returns whether the mark actually moved, because an unread badge is computed\n   * from it and nothing else will say so: rows read in a panel do not touch the\n   * sessions poll, so a caller that doesn't hear about this has no other way to\n   * learn the count is now wrong.\n   */\n  mark(\n    hostId: string,\n    sessionId: string,\n    seen: { itemCount?: number; activity?: number; turns?: number },\n    now = Date.now(),\n  ): boolean {\n    const id = watermarkKey(hostId, sessionId)\n    const previous = this.#cache[id]\n    const next: Watermark = {\n      itemCount: Math.max(previous?.itemCount ?? 0, seen.itemCount ?? 0),\n      activity: Math.max(previous?.activity ?? 0, seen.activity ?? 0),\n      turns: Math.max(previous?.turns ?? 0, seen.turns ?? 0),\n      seenAt: now,\n    }\n    if (\n      previous &&\n      previous.itemCount === next.itemCount &&\n      previous.activity === next.activity &&\n      previous.turns === next.turns &&\n      // Still worth a write once a minute so \"last here\" stays honest without\n      // hammering storage on every streamed row.\n      next.seenAt - previous.seenAt < TOUCH_MS\n    ) {\n      return false\n    }\n    this.#cache[id] = next\n    this.#store.write(this.#prune(now))\n    return true\n  }\n\n  /** Forget a session — it was deleted, and its mark is now noise. */\n  forget(hostId: string, sessionId: string): void {\n    const id = watermarkKey(hostId, sessionId)\n    if (!(id in this.#cache)) return\n    delete this.#cache[id]\n    this.#store.write(this.#cache)\n  }\n\n  #prune(now: number): Record<string, Watermark> {\n    const cutoff = now - MAX_AGE_MS\n    for (const [id, mark] of Object.entries(this.#cache)) {\n      if (mark.seenAt < cutoff) delete this.#cache[id]\n    }\n    return this.#cache\n  }\n}\n\n/**\n * Rows this client has not seen, from the rollup alone.\n *\n * `activityCount` is the unit that makes an honest badge: turns undercount badly\n * (five tool calls in one turn is one turn) and a stream sequence overcounts\n * absurdly (every delta). Turns stay the fallback for a gateway too old to\n * report it.\n *\n * A session never visited returns 0 — \"never opened\" is not \"unread\", and a\n * badge that counted every session's whole history on first launch would be\n * noise on the one day it should be quiet.\n */\nexport function unseenCount(\n  mark: Watermark | undefined,\n  info: { activityCount?: number; turns?: number },\n): number {\n  if (!mark) return 0\n  if (info.activityCount !== undefined) return Math.max(0, info.activityCount - mark.activity)\n  return Math.max(0, (info.turns ?? 0) - mark.turns)\n}\n","/**\n * @workerdeck/protocol — the wire protocol between a workerdeck server and its clients.\n *\n * One session = one ordered stream of {@link SessionEvent}s (each stamped with a monotonically\n * increasing `seq`) plus a small command set ({@link SessionCommand}). Clients attach over\n * WebSocket, optionally replaying from a known `seq`, and drive the session with commands.\n *\n * This package is dependency-free and browser-safe. Anthropic API message content is modeled\n * structurally (see {@link ApiMessage}) so clients don't need the Agent SDK to render transcripts.\n */\n\n/** Bumped on any breaking change to events, commands, or REST shapes. */\nexport const PROTOCOL_VERSION = 7\n\n// ---------------------------------------------------------------------------\n// Session lifecycle\n// ---------------------------------------------------------------------------\n\n/**\n * - `starting` — runner spawned, waiting for the SDK init handshake\n * - `running` — a turn is in progress\n * - `awaiting_approval` — blocked on at least one pending permission request\n * - `idle` — between turns; accepting user messages\n * - `parked` — waiting on a deferred tool execution. The live runner has been torn\n *   down and the session's state persisted; delivering the execution's result\n *   (`POST {basePath}/executions/:executionId/result`) rehydrates it under the same\n *   id and the run continues. Not terminal.\n * - `failed` — the underlying query errored; terminal\n * - `closed` — closed by a client or the host; terminal\n */\nexport type SessionStatus =\n  | 'starting'\n  | 'running'\n  | 'awaiting_approval'\n  | 'idle'\n  | 'parked'\n  | 'failed'\n  | 'closed'\n\nexport type PermissionMode =\n  | 'default'\n  | 'acceptEdits'\n  | 'bypassPermissions'\n  | 'plan'\n  | 'dontAsk'\n  | 'auto'\n\n// ---------------------------------------------------------------------------\n// API message content (structural mirror of Anthropic message shapes)\n// ---------------------------------------------------------------------------\n\nexport type TextBlock = { type: 'text'; text: string }\nexport type ThinkingBlock = { type: 'thinking'; thinking: string }\nexport type ToolUseBlock = { type: 'tool_use'; id: string; name: string; input: unknown }\nexport type ToolResultBlock = {\n  type: 'tool_result'\n  tool_use_id: string\n  content?: string | Array<{ type: string; text?: string; [key: string]: unknown }>\n  is_error?: boolean\n  /**\n   * This block carries only the **head** of the result: the replay truncated it\n   * (see {@link TOOL_RESULT_HEAD_CHARS}), and the whole thing is one fetch away\n   * at `GET /sessions/:id/events/:seq/result?toolUseId=`.\n   *\n   * On the **block**, never the event, and that is the same argument\n   * `user_message.patch` has to make in reverse: the patch sits on the event and\n   * its doc must therefore caveat \"only when the message carries exactly one\n   * `tool_result` block — with two, nothing says which one it belongs to\". A\n   * message answering three calls truncates whichever of them is large, so\n   * paying that caveat a second time would make the marker unusable exactly\n   * when it matters. {@link FilePatch.truncated} is the shipped precedent.\n   *\n   * Only ever set on a **replay** a client asked for (`truncateResults`), so a\n   * client that has never heard of this field cannot receive one — which is why\n   * this is additive at protocol 7 rather than a bump. Absent means the block is\n   * whole.\n   */\n  truncated?: boolean\n  /** How many characters the untruncated result had. Set iff `truncated`.\n   *\n   * A client cannot compute it — it holds the head — and the number is not\n   * cosmetic: a collapsed row spells \"… +N chars\", and `height.ts` sizes the row\n   * by wrapping **that exact string**, so a count derived from the head would be\n   * both a lie and a different pixel height. */\n  total_chars?: number\n}\n\n/**\n * How much of a tool result a truncating replay keeps.\n *\n * Chosen against the two clients' *own* budgets, and the relationship is the\n * whole point: the terminal theme shows ~400 characters collapsed and ~2,000\n * open, so at 8,000 the collapsed and open states are **byte-identical to an\n * untruncated attach** and only the uncapped \"show everything\" press ever\n * fetches. That collapses the entire feature to one press, and it is asserted\n * in a test rather than trusted — lowered below the open budget, this would\n * silently clip the open state with no marker, which is the one failure this\n * design must not have.\n *\n * Measured justification: on one 1,270-row session three `tool_result` frames\n * were 641 / 463 / 396 KB, 68% of a 3.1 MB attach. The cut is *structural* —\n * proportional to the thing that is actually large, wherever in the log it sits\n * — which a row window is not.\n */\nexport const TOOL_RESULT_HEAD_CHARS = 8_000\n\n/**\n * A base64 image part, delivered as an address instead of its bytes.\n *\n * The **seventh** rule of the family, and the first written *after* its\n * measurement rather than before it. Across 214 local sessions, 91% of all\n * tool-result payload is base64 image data — 489 MB against 44 MB of text — and\n * **no client renders a byte of it**: `blockText` in the reducer and\n * `joinedText` on iOS both fold a `tool_result` to its text parts, and both\n * clients draw a tool's picture from a host *path* (`savedPath` → `/produced`,\n * `/fs/read`), never from block content. So it is `replayRetains`' argument at\n * nine times the size of the case that rule was written for: bytes whose entire\n * effect on the reader is `return base`.\n *\n * A **new part type rather than a hollowed-out `image`**, and that is the one\n * judgement here worth stating. `headOf`'s shape-preservation rule — \"a\n * truncation is a shorter result, never a different kind of one\" — cuts the\n * other way for pixels: a head *is* a valid shorter text, but an image with no\n * bytes is not a smaller image, and spelling it `{ type: 'image', source }` with\n * no `data` invites precisely the failure shape-preservation exists to prevent,\n * a renderer that trusts `source.data` drawing `data:;base64,undefined`. An\n * unfamiliar type instead falls through every fold that already exists, exactly\n * as the CLI's own `tool_reference` part does: no `text`, so it contributes\n * nothing, and an unaware consumer renders what it renders today, which is\n * nothing. That is this family's safe failure.\n *\n * Only ever produced for a socket that asked (`imageRefs`), so a client that has\n * never heard of this type cannot receive one — which is why this is additive at\n * protocol 7, the same argument {@link ToolResultBlock.truncated} makes. Unlike\n * truncation it applies to **live events as well as replays**: the client's one\n * render path is ref-then-fetch, so bytes on a live event would either be\n * discarded (335 KB median, once per attached watcher) or need a second\n * decode-from-event path pinning megabytes inside the transcript cache — the\n * disease relocated rather than cured.\n */\nexport type ImageRefPart = {\n  type: 'image_ref'\n  /** The stored part's own media type (`image/png`, `image/jpeg` and\n   * `image/webp` are the three observed), or `application/octet-stream` when it\n   * had none. Never the membership test — that is `image` plus a base64 source. */\n  media_type: string\n  /** Decoded size, which a client cannot compute from an address it has not\n   * fetched yet. Not cosmetic: the placeholder spells it, and in the terminal\n   * theme a rendered string *is* a row height. */\n  bytes: number\n  /**\n   * Index of this part in the **stored** block's content array, and the address\n   * a fetch is made with.\n   *\n   * A stamped field rather than the position it arrives at, because that\n   * position is not stable: `headOf` builds a truncated head by keeping text\n   * parts up to budget and dropping every other part, so a block that is both\n   * over the text budget and image-bearing has its parts renumbered the moment\n   * the two rules compose. Stamped, the address survives any later reshaping —\n   * and the route verifies it against the stored block rather than trusting it.\n   */\n  part_index: number\n}\n\n/** How many bytes a base64 payload decodes to, without decoding it. */\nfunction base64Bytes(data: string): number {\n  const padding = data.endsWith('==') ? 2 : data.endsWith('=') ? 1 : 0\n  return Math.max(0, Math.floor((data.length * 3) / 4) - padding)\n}\n\n/**\n * Project one `tool_result` content part onto its {@link ImageRefPart}, or\n * `undefined` when the part is not a base64 image and must be delivered as it\n * stands.\n *\n * The rule's **one spelling**, shared by the transform that replaces parts\n * (core), the route that serves them back (server) and the property test that\n * proves the fold is otherwise unchanged (react) — the same reason every other\n * member of this family lives here rather than in whichever package applies it.\n *\n * Deliberately narrow. The corpus holds exactly two non-text part kinds: this\n * one, and the CLI's `tool_reference`, of which every instance across 214\n * sessions totals 122 KB. A \"drop non-text parts\" rule would sweep those in for\n * no measurable gain, and narrowness is this family's standing habit.\n */\nexport function imagePartRef(\n  part: { type?: string; [key: string]: unknown },\n  index: number,\n): ImageRefPart | undefined {\n  if (part.type !== 'image') return undefined\n  const source = part.source as { type?: string; data?: unknown; media_type?: unknown } | undefined\n  if (!source || source.type !== 'base64' || typeof source.data !== 'string') return undefined\n  return {\n    type: 'image_ref',\n    media_type:\n      typeof source.media_type === 'string' ? source.media_type : 'application/octet-stream',\n    bytes: base64Bytes(source.data),\n    part_index: index,\n  }\n}\n/** Forward-compatible fallback for block types this protocol version doesn't model. */\nexport type UnknownBlock = { type: string; [key: string]: unknown }\n\n/**\n * One hunk of a file edit, in unified-diff terms.\n *\n * The numbers are the engine's own, not the client's: `newStart` is where this\n * hunk begins in the file *after* the edit, which is what a reader needs to jump\n * to the change. A client cannot compute them — it has never seen the file — so\n * a diff rendered without this is a diff with no line numbers.\n */\nexport type PatchHunk = {\n  oldStart: number\n  oldLines: number\n  newStart: number\n  newLines: number\n  /** Body lines, each prefixed ' ' (context), '-' (removed) or '+' (added), as\n   * unified diff spells them. The prefix is part of the string. */\n  lines: string[]\n}\n\n/**\n * What a file-editing tool changed — the renderable half of an engine's edit\n * output, and deliberately only that half.\n *\n * Both engines can say far more: the Claude SDK's `FileEditOutput` carries\n * `originalFile`, the **entire** contents of the file before the edit. That must\n * not travel here. This log is replayed to every attaching client and captured\n * into parking snapshots, so a whole file on every edit is paid for again on\n * every attach, forever — the same reason attachment bytes are references (see\n * {@link MessageAttachment}) rather than inline base64.\n *\n * So the runner projects the engine's output down to the hunks, which is exactly\n * what a diff renders and nothing more.\n */\nexport type FilePatch = {\n  /** Absolute path the engine reported, when it named one. */\n  path?: string\n  /** `create` when the file did not exist before this edit. */\n  kind?: 'create' | 'update'\n  hunks: PatchHunk[]\n  /** Hunks were dropped to keep the event small. A renderer must say so rather\n   * than present a partial diff as the whole change. */\n  truncated?: boolean\n}\n\nexport type ContentBlock = TextBlock | ThinkingBlock | ToolUseBlock | ToolResultBlock | UnknownBlock\n\n/**\n * A file the user attached to a message — a photo, a screenshot, a document.\n *\n * The bytes never travel on this protocol. An attachment is uploaded first\n * (`POST {basePath}/sessions/:id/attachments`), and the command that sends the\n * message names it by id; what lands in the seq-numbered event log is this\n * reference. That is deliberate: the log is replayed to every attaching client\n * and captured into parking snapshots, so a few phone photos inlined as base64\n * would be paid for on every attach, forever. Clients render a thumbnail by\n * fetching `GET {basePath}/sessions/:id/attachments/:attachmentId`.\n *\n * Lifetime is the session's, like `/files` — the store is in-memory and an\n * attachment 404s after a server restart. The message itself is unaffected: the\n * model saw the bytes at send time.\n */\nexport type MessageAttachment = {\n  /** Server-assigned; the path segment of the download URL. */\n  id: string\n  /** Display name from the file the user picked. A leaf name, never a path. */\n  name: string\n  /** IANA media type, e.g. 'image/jpeg'. The server decides how it reaches the\n   * model (image block, document block, or inlined text) from this. */\n  mediaType: string\n  bytes: number\n}\n\nexport type ApiMessage = {\n  role: 'user' | 'assistant'\n  content: string | ContentBlock[]\n  model?: string\n  stop_reason?: string | null\n  /** Per-API-call token usage when the message carries it (assistant messages do).\n   * Enables mid-run token accounting; result-message usage stays authoritative. */\n  usage?: {\n    input_tokens?: number\n    output_tokens?: number\n    cache_creation_input_tokens?: number\n    cache_read_input_tokens?: number\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Permission requests\n// ---------------------------------------------------------------------------\n\n/** A tool call promoted into a pending approval by the runner's canUseTool hook\n * (Claude), or an engine ask-channel request surfaced by its runner (codex).\n * The two do not share a tense: Claude asks BEFORE a tool runs; codex's command\n * approval is usually an escalation AFTER its sandbox already ran and refused\n * the command (\"command failed; retry without sandbox?\"). The runner authors\n * `title`/`description`/`decisionReason` to say which — clients should render\n * those fields rather than composing their own \"X wants to run Y\" sentence. */\nexport type PermissionRequest = {\n  /** Server-assigned id; used by the `permission_decision` command. */\n  id: string\n  toolName: string\n  input: Record<string, unknown>\n  toolUseId: string\n  /** Full prompt sentence from the SDK, e.g. \"Claude wants to read foo.txt\". */\n  title?: string\n  /** Short noun phrase for the tool action, e.g. \"Read file\". */\n  displayName?: string\n  /** Human-readable subtitle, e.g. \"Claude will have read access to ~/x\". */\n  description?: string\n  /** Why this permission request was triggered. */\n  decisionReason?: string\n  /** If raised from within a subagent, that subagent's id. */\n  agentId?: string\n  /** Epoch ms after which the server resolves it via its timeout policy. */\n  expiresAt?: number\n}\n\nexport type PermissionDecisionSource = 'client' | 'timeout' | 'policy'\n\n// ---------------------------------------------------------------------------\n// User questions (the AskUserQuestion tool)\n// ---------------------------------------------------------------------------\n\n/** One choice of an AskUserQuestion question (SDK tool-input mirror). */\nexport type UserQuestionOption = {\n  label: string\n  description?: string\n  /** Optional preview content (markdown unless the session configures html)\n   * rendered when the option is focused. */\n  preview?: string\n}\n\n/** One question from the AskUserQuestion tool's input. By the tool's convention the\n * first option is the model's recommended choice. */\nexport type UserQuestion = {\n  question: string\n  /** Short chip/tag label (max ~12 chars), e.g. \"Auth method\". */\n  header: string\n  options: UserQuestionOption[]\n  multiSelect?: boolean\n}\n\n/** How a session treats the AskUserQuestion tool:\n * - 'ask' (default) — a pending permission like any other: interactive UIs render the\n *   question form; job webhooks carry the full request so a remote controller can\n *   answer over REST (POST /sessions/:id/permissions/:requestId).\n * - 'auto' — resolved immediately with each question's first (recommended) option.\n * - 'deny' — the tool is refused with guidance to decide autonomously (unattended runs).\n * Answers ride a permission allow as `updatedInput.answers`: question text → chosen\n * option label(s), multi-select labels comma-joined — the shape the CLI's own UI uses. */\nexport type QuestionBehavior = 'ask' | 'auto' | 'deny'\n\n// ---------------------------------------------------------------------------\n// Session capabilities (models / slash commands the CLI reports)\n// ---------------------------------------------------------------------------\n\n/** A model the session can switch to (SDK ModelInfo mirror; fields it may grow stay unknown). */\nexport type ModelOption = {\n  /** Model id for createSession.model / set_model. */\n  value: string\n  /** Wire model id this row resolves to ('sonnet' → 'claude-sonnet-5'). What a\n   * session actually reports as its model is the resolved form, so this is how a\n   * client matches the running model back to the row that names it. */\n  resolvedModel?: string\n  displayName: string\n  description?: string\n  /** Whether this belongs in a picker's main list rather than behind a \"more\n   * models\" step: the newest model of each family. Derived server-side — the CLI\n   * reports one flat list — so that every client groups it the same way. */\n  primary?: boolean\n  /** Reasoning efforts this model supports at create time (codex catalogs carry\n   * them, from the binary's own per-model list). Absent = the engine's default\n   * set ({@link EngineCapabilities.reasoningEfforts}) applies. Open strings —\n   * the binary's vocabulary outruns its SDK's union. */\n  reasoningEfforts?: readonly string[]\n}\n\n/**\n * A skill the engine can decide to use — **not** a command.\n *\n * The distinction is the whole point of this type existing beside\n * {@link SlashCommandInfo}. A slash command is wire syntax: the CLI parses\n * `/wrapup` out of the message and runs it. A skill is a capability the model\n * *chooses* from its description; there is no `/skillname` the engine would\n * recognise, and sending one reaches the model as literal text.\n *\n * So a client may list these, and may offer them as a **typing aid** that\n * inserts ordinary editable prose ({@link SkillInfo.defaultPrompt}) — but it\n * must never render them as command chips, and must never put them in\n * `capabilities.commands`, which means \"the CLI accepts these as commands\".\n */\nexport type SkillInfo = {\n  /** Directory name under the skills root — the identity the model refers to. */\n  name: string\n  /** What the skill is for, as its own manifest states it. This is the text the\n   * MODEL selects on, so it is also the most honest thing to show a human. */\n  description?: string\n  /** A one-liner where the skill declares one, for a list row too narrow for\n   * `description`. */\n  shortDescription?: string\n  /** Human-facing name from the skill's own interface block, when it differs\n   * from `name`. */\n  displayName?: string\n  /**\n   * The engine's own suggested opening message for this skill. A client that\n   * offers a picker INSERTS this as plain editable text for the user to finish\n   * and send; it is a draft, never something submitted on selection.\n   */\n  defaultPrompt?: string\n  /** Where the skill came from: 'user' | 'repo' | 'system' | 'admin' — kept as\n   * a string, the engine's set may grow. */\n  scope?: string\n  /** False when the operator has this skill switched off: still listed, because\n   * \"installed but off\" is a different answer from \"not installed\". */\n  enabled: boolean\n}\n\n/** A slash command the CLI accepts as user-message text (SDK SlashCommand mirror). */\nexport type SlashCommandInfo = {\n  /** Command name without the leading slash. */\n  name: string\n  description?: string\n  /** Hint for arguments, e.g. \"<file>\". */\n  argumentHint?: string\n  /** Alternate names resolving to this command. */\n  aliases?: string[]\n}\n\n// ---------------------------------------------------------------------------\n// Usage telemetry (context window + subscription rate limits)\n// ---------------------------------------------------------------------------\n\n/** One category row from the CLI's context-usage breakdown (system prompt, tools, ...). */\nexport type ContextUsageCategory = {\n  name: string\n  tokens: number\n  /** Color the CLI assigns the category. Often a CLI theme token name ('inactive',\n   * 'promptBorder', ...), not a CSS color — validate before styling with it. */\n  color: string\n}\n\n/** Context-window usage snapshot (SDK getContextUsage mirror), polled after each turn. */\nexport type ContextUsage = {\n  categories: ContextUsageCategory[]\n  totalTokens: number\n  maxTokens: number\n  /** Used share of the window, 0–100. */\n  percentage: number\n  /** Model the window sizing applies to. */\n  model?: string\n}\n\n/**\n * The context-window reading that rides the **sessions list**, as opposed to the\n * full {@link ContextUsage} that rides the event stream.\n *\n * Three numbers, and the omission is the design: `categories` is a breakdown for\n * a dialog that has a live session behind it, and this field is on every row of\n * `GET /sessions`, which a busy client polls at 1.2s. Same attachment-bytes\n * discipline as {@link SessionInfo.subagents}. `percentage` alone would size a\n * ring, but the token pair is what lets a row *say* `142k / 200k` on hover or\n * long-press without a second round trip, and it is two numbers.\n *\n * **Absent is a real state and is not zero.** A parked session, one that has\n * never run a turn, or an engine that reports no window has no reading — render\n * nothing, never an empty ring, which claims \"context is empty\" rather than \"no\n * answer\". Also absent on an older server.\n */\nexport type ContextReading = {\n  totalTokens: number\n  maxTokens: number\n  /** Used share of the window, 0–100. */\n  percentage: number\n}\n\n/**\n * One rate-limit window snapshot (SDK SDKRateLimitInfo mirror). Emitted only for\n * claude.ai subscription sessions — API-key sessions may never produce one, so\n * clients must render nothing (not 0%) until data arrives.\n */\nexport type RateLimitInfo = {\n  /** 'allowed' | 'allowed_warning' | 'rejected' — kept as string, the SDK union may grow. */\n  status: string\n  /** Which window: 'five_hour' (session), 'seven_day' (weekly), 'seven_day_opus',\n   * 'seven_day_sonnet', 'overage', ... — kept as string, the SDK union may grow. */\n  rateLimitType?: string\n  /** Used share of the window, 0–100. The CLI omits it on some updates — treat\n   * absent as unknown, not 0. */\n  utilization?: number\n  /** Epoch **seconds** when the window resets (render countdowns client-side). */\n  resetsAt?: number\n  isUsingOverage?: boolean\n}\n\n// ---------------------------------------------------------------------------\n// Tool execution (bridged, deferred, and remote)\n// ---------------------------------------------------------------------------\n\n/**\n * Lifecycle of one tool execution, correlated by `executionId` end to end.\n *\n * - `pending` — dispatched, result not in yet (bridged to a client, or queued).\n * - `deferred` — parked beyond this turn/process; may outlive the session's\n *   liveness and be applied on rehydration.\n * - `settled` / `failed` — terminal. Results are applied idempotently by id, so\n *   a duplicate delivery is a no-op rather than a second application.\n */\nexport type ToolExecutionStatus = 'pending' | 'deferred' | 'settled' | 'failed'\n\n/** Where a tool execution ran (or is running). Advisory: for display and routing. */\nexport type ToolExecutionBackend = 'server' | 'browser' | 'managed' | 'remote'\n\n/** Result payload of a tool execution, by value — never a live host reference. */\nexport type ToolExecutionOutput =\n  | { type: 'text'; value: string }\n  | { type: 'json'; value: unknown }\n\n// ---------------------------------------------------------------------------\n// Session events (server -> client)\n// ---------------------------------------------------------------------------\n\nexport type SessionEventBody =\n  /** SDK init handshake: what this session actually is. */\n  | {\n      type: 'system_init'\n      sdkSessionId: string\n      model: string\n      cwd: string\n      /** Where the session's Anthropic auth came from: 'oauth' means a claude.ai\n       * subscription login; other values ('user' | 'project' | 'org' | 'temporary')\n       * are API-key provenance. Kept as string — the SDK union may grow. */\n      apiKeySource: string\n      tools: string[]\n      skills: string[]\n      slashCommands: string[]\n      permissionMode: PermissionMode\n      claudeCodeVersion: string\n      mcpServers: Array<{ name: string; status: string }>\n    }\n  | { type: 'status_changed'; status: SessionStatus; detail?: string }\n  /** Models and slash commands available to this session; fetched from the CLI after\n   * init. Late attachers get it via replay like any other event. */\n  | {\n      type: 'capabilities'\n      models: ModelOption[]\n      commands: SlashCommandInfo[]\n      /** Wire id the session's *default* resolves to, from the CLI's own `default`\n       * row. Answers \"what will this session answer as\" before it has answered\n       * anything — `system_init` carries the model, but a promptless session gets\n       * no `system_init` until its first message. */\n      defaultModel?: string\n    }\n  /**\n   * The skills this session's engine can reach ({@link SkillInfo}) — a full\n   * replacement each time, not a delta, so a late attacher's replay of several\n   * of these converges on the last one. Emitted once the session's engine has\n   * enumerated them, and again whenever the engine reports the set changed\n   * (a skill added or edited on disk).\n   *\n   * Deliberately NOT folded into `capabilities.commands`: skills are not\n   * commands (see {@link SkillInfo}). Only engines whose record sets\n   * {@link EngineCapabilities.skillsList} ever emit it.\n   */\n  | { type: 'skills'; skills: SkillInfo[] }\n  /**\n   * The engine wrote a file on the **host filesystem** and handed over its path\n   * — codex's `image_gen` saving a PNG is the case that motivated it. The\n   * host-filesystem sibling of `file_delivered` (which is the scratch-VFS one).\n   *\n   * Fetch it at `GET {basePath}/sessions/:id/produced/:fileId` for as long as\n   * the session lives. That route has no root allowlist and no size cap, and\n   * that is sound *because of where the path came from*: this event is authored\n   * by the runner about a file the engine itself just wrote, not by the agent\n   * about a path it chose. `/fs/*` gates the second kind and must keep doing so\n   * — a file the agent merely *read* is not a produced file and does not belong\n   * here.\n   *\n   * Re-emitting the same file is a no-op: `fileId` is derived from the path, so\n   * a runner that learns the path twice (codex reports `savedPath` on both the\n   * progress and completed item) registers it once.\n   */\n  | {\n      type: 'file_produced'\n      /** Opaque, stable per session+path. The route's path segment. */\n      fileId: string\n      /** Absolute host path, as the engine reported it. Shown to the operator,\n       * and what a client matches against a tool card's own `savedPath`. */\n      path: string\n      /** Media type when the runner could determine one (usually from the\n       * extension). Absent = let the route's own sniffing decide. */\n      mediaType?: string\n      /** Size at the time it was reported, when the runner knew it. */\n      bytes?: number\n      /** The tool call that produced it, when one did. */\n      toolUseId?: string\n    }\n  /** The session's model changed via `set_model`. `model` undefined = back to default. */\n  | { type: 'model_changed'; model?: string }\n  /** The session's permission mode changed via `set_permission_mode`. */\n  | { type: 'permission_mode_changed'; mode: PermissionMode }\n  /** Context-window usage snapshot; the runner polls it after each turn. */\n  | { type: 'context_usage'; usage: ContextUsage }\n  /** Subscription rate-limit update for one window (see {@link RateLimitInfo}). */\n  | { type: 'rate_limit'; info: RateLimitInfo }\n  /** Which claude.ai plan the rate-limit windows belong to: 'pro' | 'max' | 'team' |\n   * 'enterprise' — kept as string, the set may grow. Emitted from the same poll as\n   * `rate_limit`, once per change, and never for an API-key session (which has no\n   * plan). It names the windows; it does not size them — the tier suffix a\n   * subscription page shows (\"Max 20x\") is not in the data. */\n  | { type: 'plan_info'; subscriptionType: string }\n  /**\n   * The engine started a **fresh conversation inside the same session** — the\n   * CLI's `/clear`, a plan-mode exit, and whatever fresh-conversation flows the\n   * SDK grows. The session id, registry row, workspace and scope are all\n   * unchanged; only the conversation is new. Clients empty the transcript and\n   * keep every session-scoped fact (models, commands, skills, produced files,\n   * rate limits, cwd, permission mode).\n   *\n   * The server's replay honours it too: an attach after a reset does not\n   * resurrect the cleared rows, because the runner skips *transcript content*\n   * below the latest reset (see {@link transcriptContent}) while still\n   * replaying every state-bearing event. `SessionInfo.activityCount` stays\n   * monotonic across a reset on purpose — it is an unread cursor, not an item\n   * count, and winding it back would kill every stored watermark above it.\n   */\n  | {\n      type: 'conversation_reset'\n      /** The engine session id the fresh conversation runs under (the SDK's\n       * `new_conversation_id`), when the engine reported one. The follow-up\n       * `system_init` remains authoritative. */\n      sdkSessionId?: string\n    }\n  | {\n      type: 'assistant_message'\n      message: ApiMessage\n      /** Set when the message was produced inside a subagent (Task tool). */\n      parentToolUseId: string | null\n      /** True when backfilled from a resumed session's history. */\n      replay?: boolean\n      uuid: string\n    }\n  | {\n      type: 'user_message'\n      message: ApiMessage\n      parentToolUseId: string | null\n      /** True when replayed from a resumed session's history. */\n      replay?: boolean\n      /** True for tool results and other synthetic user-role messages. */\n      synthetic?: boolean\n      /** Files sent with this message, by reference (see {@link MessageAttachment}).\n       * `message.content` carries the typed text only — the attachment bytes went\n       * to the model, not into this log. */\n      attachments?: MessageAttachment[]\n      /**\n       * What a file-editing tool changed, when this message carries that tool's\n       * result (see {@link FilePatch}). Set by the runner from the engine's own\n       * structured output — never derived by a client from the result text.\n       *\n       * Only when the message carries exactly one `tool_result` block, which is\n       * what both engines send: with two, there is nothing that says which one\n       * the patch belongs to, and guessing would attach a diff to the wrong call.\n       */\n      patch?: FilePatch\n      uuid?: string\n    }\n  /** Raw Anthropic streaming event (message_start/content_block_delta/...); emitted only\n   * when the session was created with `includePartialMessages`. */\n  | {\n      type: 'stream_delta'\n      event: { type: string; [key: string]: unknown }\n      parentToolUseId: string | null\n      uuid: string\n    }\n  | {\n      type: 'turn_result'\n      subtype:\n        | 'success'\n        | 'error_during_execution'\n        | 'error_max_turns'\n        | 'error_max_budget_usd'\n        | 'error_max_structured_output_retries'\n      isError: boolean\n      durationMs: number\n      numTurns: number\n      totalCostUsd: number\n      /** Final text of the turn (success only). */\n      result?: string\n      errors?: string[]\n      usage?: unknown\n    }\n  | { type: 'permission_requested'; request: PermissionRequest }\n  | {\n      type: 'permission_resolved'\n      requestId: string\n      behavior: 'allow' | 'deny'\n      resolvedBy: PermissionDecisionSource\n      /** Denial message, when denied. */\n      message?: string\n    }\n  /** A tool execution was dispatched to a backend. For bridged executions this\n   * precedes the `tool_call_request` frame; for deferred ones it is the record\n   * that survives a teardown. */\n  | {\n      type: 'execution_dispatched'\n      executionId: string\n      toolName: string\n      backend: ToolExecutionBackend\n      /** True when the execution may outlive this turn or process. */\n      deferred?: boolean\n      /** Epoch ms after which the server applies its timeout policy. */\n      expiresAt?: number\n    }\n  /** A dispatched execution produced a result. Applied idempotently by `executionId`. */\n  | {\n      type: 'execution_result'\n      executionId: string\n      output: ToolExecutionOutput\n      /** Guest/agent-visible logs, if the backend captured any. */\n      logs?: string[]\n      durationMs?: number\n    }\n  /** A dispatched execution failed, timed out, or was orphaned. The failure is fed\n   * back into the loop as tool output so the agent can adapt — it is not a session error. */\n  | {\n      type: 'execution_failed'\n      executionId: string\n      /** Machine-readable cause: 'timeout' | 'oom' | 'exception' | 'orphaned' | backend-specific. */\n      reason: string\n      error: string\n      logs?: string[]\n      durationMs?: number\n    }\n  /** The agent handed over a file from its session scratch filesystem (the\n   * `deliver_file` tool). Download it via `GET {basePath}/sessions/:id/files/<path>`\n   * for as long as the session lives (the VFS is in-memory). */\n  | { type: 'file_delivered'; path: string; bytes: number; description?: string }\n  /** Any SDKMessage this protocol version doesn't model first-class (task progress,\n   * compaction boundaries, auth status, ...). Payload is the raw SDK message. */\n  | { type: 'sdk_event'; payload: { type: string; [key: string]: unknown } }\n  | { type: 'session_error'; message: string }\n  | { type: 'session_closed'; reason: 'client' | 'server' | 'error' }\n\nexport type SessionEvent = SessionEventBody & {\n  /** Monotonic per-session sequence number, starting at 1. */\n  seq: number\n  /** Epoch ms when the server emitted the event. */\n  ts: number\n}\n\n// ---------------------------------------------------------------------------\n// Commands (client -> server)\n// ---------------------------------------------------------------------------\n\nexport type SessionCommand =\n  | {\n      type: 'user_message'\n      text: string\n      /** Ids from `POST {basePath}/sessions/:id/attachments`, in the order they\n       * should reach the model. Unknown ids fail the command rather than sending\n       * a message that quietly lost its picture. */\n      attachmentIds?: string[]\n    }\n  | {\n      type: 'permission_decision'\n      requestId: string\n      behavior: 'allow' | 'deny'\n      /** allow only: modified tool input to run instead of the original. */\n      updatedInput?: Record<string, unknown>\n      /** deny only: reason surfaced to the model. */\n      message?: string\n      /** deny only: also interrupt the running turn. */\n      interrupt?: boolean\n    }\n  | { type: 'interrupt' }\n  /**\n   * Reset the conversation in place — same session id, same watermarks, same\n   * row in the list, empty context. The server answers with a\n   * `conversation_reset` event, whose replay rules are what stop a later attach\n   * from resurrecting the cleared transcript.\n   *\n   * Send only where {@link EngineCapabilities.clearContext} says so: a server\n   * that predates this command rejects it as unknown, and an engine that cannot\n   * do it errors rather than quietly doing nothing.\n   *\n   * Sent while a turn is running, it **queues** behind that turn rather than\n   * cutting it short — a clear is not an interrupt, and one that landed in the\n   * middle of the turn it was clearing would be neither. Interrupt first if the\n   * intent was to stop the work as well as forget it.\n   */\n  | { type: 'clear_context' }\n  | { type: 'set_permission_mode'; mode: PermissionMode }\n  /** Switch the model for subsequent responses; omit `model` for the default. */\n  | { type: 'set_model'; model?: string }\n  /**\n   * Result of a tool execution the server bridged to this client (see\n   * {@link ToolCallRequestFrame}). Unknown or already-settled `executionId`s are\n   * ignored — delivery is idempotent, and a late result after a timeout must not\n   * re-open a settled call.\n   *\n   * Browser-returned results are UNTRUSTED input: acceptable for the user's own\n   * data, never a source for server-authoritative state.\n   */\n  | {\n      type: 'tool_call_result'\n      executionId: string\n      output: ToolExecutionOutput\n      logs?: string[]\n    }\n  /** The client could not execute a bridged call (unsupported tool, guest error,\n   * tab closing). Fed back to the agent as tool output. */\n  | {\n      type: 'tool_call_error'\n      executionId: string\n      reason: string\n      error: string\n      logs?: string[]\n    }\n  | { type: 'close' }\n\n// ---------------------------------------------------------------------------\n// WebSocket frames\n// ---------------------------------------------------------------------------\n\n/** First frame the server sends after a successful attach. */\nexport type AttachedFrame = {\n  type: 'attached'\n  protocolVersion: number\n  session: SessionInfo\n  /** Events with seq > the client's `afterSeq` follow as `event` frames. */\n  replayingFrom: number\n}\n\n/**\n * Ask the attached client to execute a tool call in its own sandbox (browser\n * bridge). The client answers with `tool_call_result` or `tool_call_error`\n * carrying the same `executionId`.\n *\n * Only sandbox-benefiting tools are ever bridged. Authenticated/authoritative\n * tools (MCP, secret-bearing APIs) execute server-side and never appear here.\n */\nexport type ToolCallRequestFrame = {\n  type: 'tool_call_request'\n  executionId: string\n  toolName: string\n  input: unknown\n  /** Files to seed the client's scratch VFS with, path → contents. */\n  vfsSeed?: Record<string, string>\n  limits?: { timeoutMs?: number; memoryLimitBytes?: number }\n  /** Epoch ms after which the server gives up and fails the execution. */\n  expiresAt?: number\n}\n\nexport type ServerFrame =\n  | AttachedFrame\n  | { type: 'event'; event: SessionEvent }\n  | ToolCallRequestFrame\n  /** A bridged execution no longer needs an answer (turn interrupted, timed out,\n   * or the session closed) — the client should abandon it. */\n  | { type: 'tool_call_canceled'; executionId: string; reason: string }\n  | { type: 'protocol_error'; message: string }\n\nexport type ClientFrame = SessionCommand\n\n// ---------------------------------------------------------------------------\n// Profiles (named Claude Code config directories)\n// ---------------------------------------------------------------------------\n\n/** Per-profile fallbacks filled into session/job requests that leave the field\n * unset. Defaults, not enforced caps — an explicit request value always wins. */\nexport type ProfileDefaults = {\n  model?: string\n  permissionMode?: PermissionMode\n}\n\n/**\n * A named Claude Code config directory sessions can run under: the session's CLI\n * process gets it as CLAUDE_CONFIG_DIR, so the profile carries that directory's\n * settings, memory, skills, and whatever credentials the SDK/CLI resolves from it.\n * Profiles are declared in server options at startup (or a 'default' one is\n * auto-created from the operator's own config dir) — the API only reads them.\n */\n/**\n * Which engine a profile runs on. A **closed union, deliberately**: both clients\n * switch exhaustively, the Swift mirror ships in lockstep, and a closed set is\n * what lets this package carry per-engine capability defaults\n * ({@link ENGINE_CAPABILITIES}) browser-safe, with no server round-trip. Adding a\n * member is a versioned protocol event.\n *\n * - `claude` (default) — Claude Code via the Agent SDK, configured by a config dir.\n * - `codex` — OpenAI Codex over the codex CLI binary's `app-server` JSON-RPC\n *   surface, configured by a CODEX_HOME (auth resolved by the binary itself,\n *   like claude).\n * - `provider` — a model-agnostic provider over the AI SDK, assembled by the\n *   host's `createEngineRunner` hook.\n */\nexport type ProfileEngine = 'claude' | 'codex' | 'provider'\n\n/**\n * What an engine does and does not do — one axis per real difference, each field\n * answering a concrete UI or gateway question. Clients render from this record\n * instead of switching on the engine name: an absent capability means the\n * affordance is *hidden*, never a control that silently does nothing.\n *\n * Reaches clients in two places, same shape: `ProfileInfo.capabilities` (stamped\n * by the server; the create form's source) and `SessionInfo.capabilities`\n * (reported by the runner; the session surface's source). When the field is\n * absent — an older server — {@link ENGINE_CAPABILITIES} keyed by the engine\n * name is the browser-safe default.\n */\nexport type EngineCapabilities = {\n  /** PermissionRequest / permission_resolved can occur; approval UI is live.\n   * False: hide approval affordances entirely (and `questionBehavior` on jobs). */\n  interactiveApprovals: boolean\n  /** Modes this engine can honor. A stored choice outside the set is coerced to\n   * {@link EngineCapabilities.defaultPermissionMode}, not submitted. */\n  permissionModes: readonly PermissionMode[]\n  /** Coercion target for a stored/unsupported mode choice (always ∈ permissionModes). */\n  defaultPermissionMode: PermissionMode\n  /** CreateSessionRequest.resume works (an engine session id continues). */\n  resume: boolean\n  /** Resume replays prior history into the transcript (Claude's backfill).\n   * False + resume: show a \"history predates this attach\" notice instead of\n   * treating an empty transcript as a bug. */\n  resumeBackfill: boolean\n  /** GET /sdk-sessions offers a resume picker for this engine. */\n  listSessions: boolean\n  /** context_usage events can occur. False: render nothing — never a 0% ring. */\n  contextUsage: boolean\n  /** rate_limit / plan_info events can occur. False: render nothing. */\n  rateLimits: boolean\n  /** GET /sessions/:id/mcp works (else 501) — the engine can *list* its MCP\n   * servers. Gates the MCP panel's existence. */\n  mcpStatus: boolean\n  /**\n   * POST /sessions/:id/mcp/:name works — the engine can reconnect, enable and\n   * disable a server. Separate from {@link EngineCapabilities.mcpStatus}\n   * because listing and acting are genuinely different powers: codex reports\n   * rich status but exposes no per-server action on this transport, and a panel\n   * that rendered the buttons anyway would present three controls that do\n   * nothing and then report success. False: render the panel read-only.\n   */\n  mcpServerActions: boolean\n  /** A session request may bring its own mcpServers. */\n  sessionMcpServers: boolean\n  /** capabilities events carry slash commands (composer popover). */\n  slashCommands: boolean\n  /**\n   * The `clear_context` command works — the engine can reset the conversation\n   * *in place*, keeping the session id, its watermarks and its place in the\n   * list, and announce it with {@link SessionEventBody} `conversation_reset`.\n   *\n   * Separate from {@link EngineCapabilities.slashCommands} because the two\n   * answer different questions and only one engine has both: Claude reaches a\n   * clear through the `/clear` its CLI already lists, codex has no command\n   * surface at all and needs the explicit operation, and a client that gated\n   * the control on `slashCommands` would offer it exactly where it was already\n   * offered and hide it where it is the only route.\n   *\n   * Absent = false, so an older gateway hides the control rather than\n   * presenting one that 501s.\n   */\n  clearContext?: boolean\n  /** `skills` events can occur — the engine can enumerate its skills. False:\n   * hide the skills panel entirely rather than showing an empty one. Orthogonal\n   * to `slashCommands`: an engine can have skills and no commands (codex), or\n   * commands and no skill listing (claude, whose skills reach clients only as\n   * `system_init.skills` names). */\n  skillsList: boolean\n  /** settingSources / allowDangerouslySkipPermissions-style CLI options apply. */\n  settingSources: boolean\n  /** maxTurns / maxBudgetUsd are honored (else the gateway 400s them). */\n  budgets: boolean\n  /** Attachment kinds sendMessage can deliver to the model. Filter the attach\n   * menu by kind; refuse locally before the server's 415. */\n  attachments: ReadonlyArray<'image' | 'pdf' | 'text'>\n  /** Efforts offerable at create time; absent = not settable (hide the control).\n   * Open strings — Codex's own binary already outruns its SDK's union. */\n  reasoningEfforts?: readonly string[]\n  /** Sessions expose a scratch VFS (GET /sessions/:id/files, deliverables panel). */\n  vfs: boolean\n  /**\n   * The engine runs against a host directory, so `CreateSessionRequest.cwd` is\n   * required and meaningful (and a create form should ask for it). False: the\n   * engine has no host filesystem — the gateway accepts a session with no\n   * `cwd`, `SessionInfo.cwd` reports `''`, and there is no path to validate.\n   *\n   * Absent = true, so a wire copy from an older gateway keeps the old\n   * always-required behaviour rather than silently relaxing it.\n   */\n  hostCwd?: boolean\n  /** stream_delta granularity: per-token, coarse item updates (no typing\n   * cursor), or none. */\n  streaming: 'token' | 'item' | 'none'\n}\n\n/**\n * The static capability record of each engine — the browser-safe default for\n * `ProfileInfo.capabilities` / `SessionInfo.capabilities`, and the single place\n * the values are written down. Core's adapters *reference* this record and a\n * conformance test compares runner behaviour against it, so it cannot silently\n * diverge from the code. When both a wire copy and this default exist, the wire\n * copy wins.\n */\nexport const ENGINE_CAPABILITIES: Record<ProfileEngine, EngineCapabilities> = {\n  claude: {\n    interactiveApprovals: true,\n    permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'plan', 'dontAsk', 'auto'],\n    defaultPermissionMode: 'default',\n    resume: true,\n    resumeBackfill: true,\n    listSessions: true,\n    contextUsage: true,\n    rateLimits: true,\n    mcpStatus: true,\n    mcpServerActions: true,\n    sessionMcpServers: true,\n    slashCommands: true,\n    // The route exists here too, and deliberately: it sends the `/clear` the\n    // CLI already honors, so the control and the command are one behaviour\n    // rather than two that can drift. The reset still arrives *from the SDK*.\n    clearContext: true,\n    // The CLI reports skill NAMES on `system_init` and nothing more — no\n    // descriptions, no scope, no suggested prompt. That is not enough to fill a\n    // picker honestly, and the SDK exposes no listing call, so the panel stays\n    // off here rather than rendering a list of bare words.\n    skillsList: false,\n    settingSources: true,\n    budgets: true,\n    attachments: ['image', 'pdf', 'text'],\n    // The engine-wide set (SDK Options.effort); per-model narrowing rides the\n    // catalog rows, and the CLI silently downgrades an effort a model lacks.\n    reasoningEfforts: ['low', 'medium', 'high', 'xhigh', 'max'],\n    vfs: false,\n    hostCwd: true,\n    streaming: 'token',\n  },\n  codex: {\n    // The app-server ask channels (server→client JSON-RPC requests: command\n    // escalations, file changes, permission grants, tool questions, MCP\n    // elicitations) are wired to the permission surface: they arrive as\n    // `permission_requested` and are answered by `permission_decision`.\n    // NOTE the semantic shift a client should not paper over: codex's command\n    // approval is usually an ESCALATION after the sandbox already refused the\n    // command (\"command failed; retry without sandbox?\"), not a gate before\n    // execution — the runner authors `title`/`decisionReason` from codex's own\n    // reason sentence, so render those rather than composing \"wants to use X\".\n    interactiveApprovals: true,\n    // 'default' = read-only sandbox + ask (a blocked action becomes a real\n    // question instead of a silent refusal); acceptEdits = workspace-write +\n    // ask (in-workspace writes sail through, escalations still ask); bypass =\n    // full access, asking nothing. plan/dontAsk name CLI workflows codex cannot\n    // deliver.\n    // 'auto' is codex's own \"Approve for me\": workspace-write + ask, with\n    // `approvalsReviewer: 'auto_review'` on thread/turn start routing every\n    // approval to codex's risk-assessing subagent instead of to the user. It is\n    // a THIRD axis (who reviews), independent of the sandbox and ask axes — see\n    // the tables in the codex runner.\n    // NOTE the semantic gap a client should not paper over: the Claude engine's\n    // 'auto' classifier is operator-configurable (`autoMode.environment`,\n    // allow/soft_deny/hard_deny); codex's reviewer is a fixed, OpenAI-prompted\n    // subagent with NO configuration surface. Same mode name, different\n    // tunability — say so wherever the mode is explained.\n    permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'auto'],\n    defaultPermissionMode: 'default',\n    resume: true,\n    // A resume replays the thread's prior turns from `thread/resume`'s\n    // `thread.turns` (topped up via `thread/read {includeTurns: true}` when the\n    // resume page is partial) as `replay: true` events — same contract as the\n    // Claude engine's backfill.\n    resumeBackfill: true,\n    // `GET /sdk-sessions?profile=<codex profile>` lists CODEX_HOME's threads\n    // over a short-lived `thread/list` connection; no live session required.\n    listSessions: true,\n    // From `thread/tokenUsage/updated.last` against `modelContextWindow`, after\n    // each turn. Its `categories` is always empty — codex publishes no\n    // breakdown — so a client must not draw an empty breakdown section.\n    contextUsage: true,\n    // From `account/rateLimits/updated`, which app-server pushes during a turn\n    // (no poll needed). Windows are positional there and named here by their\n    // measured duration — see `docs/GOTCHAS.md` §Codex.\n    rateLimits: true,\n    // `mcpServerStatus/list` answers with each server, its `serverInfo`, its\n    // auth status and — unlike the Agent SDK — the full JSON Schema of every\n    // tool. Live status rides the `mcpServer/startupStatus/updated`\n    // notification rather than the list response, so the runner tracks it.\n    mcpStatus: true,\n    // …but nothing on this transport reconnects or toggles ONE server. The\n    // reload RPC is server-wide, and enable/disable would mean writing the\n    // operator's config.toml — a different act from Claude's session-scoped\n    // switch. So the panel is read-only here instead of offering buttons that\n    // would lie.\n    mcpServerActions: false,\n    // MCP belongs to CODEX_HOME's config.toml; a session request cannot add servers.\n    sessionMcpServers: false,\n    // There is no command-listing RPC in the app-server surface at all: codex's\n    // own `/model`, `/approvals` etc. are TUI-local and never reach this\n    // transport. This is settled, not pending.\n    slashCommands: false,\n    // A clear has no RPC either — `thread/compact/start` summarises rather than\n    // empties, and `thread/fork` makes a second thread. So the codex analog is\n    // a **fresh thread on the same session**, which the runner starts itself.\n    // The old thread is not deleted: it stays in CODEX_HOME and stays resumable\n    // from the sessions list, which is a feature and worth saying out loud,\n    // because \"clear\" reads as \"gone\".\n    clearContext: true,\n    // …but `skills/list` does exist, and `skills/changed` says when to re-read\n    // it. What comes back is metadata rich enough to render (description,\n    // scope, and codex's own `defaultPrompt`) — see {@link SkillInfo} for why\n    // that is still not a command.\n    skillsList: true,\n    settingSources: false,\n    budgets: false,\n    // Images travel as localImage host paths, text is inlined into the prompt\n    // envelope; pdf has no representation and 415s at upload.\n    attachments: ['image', 'text'],\n    // The engine-wide floor; per-model supersets (max, ultra) ride\n    // ModelOption.reasoningEfforts from the catalog.\n    reasoningEfforts: ['minimal', 'low', 'medium', 'high', 'xhigh'],\n    vfs: false,\n    hostCwd: true,\n    // item/agentMessage/delta and the reasoning deltas arrive token-by-token.\n    streaming: 'token',\n  },\n  provider: {\n    interactiveApprovals: false,\n    permissionModes: ['default', 'bypassPermissions', 'dontAsk'],\n    defaultPermissionMode: 'default',\n    resume: false,\n    resumeBackfill: false,\n    listSessions: false,\n    contextUsage: false,\n    rateLimits: false,\n    // The one engine whose MCP is entirely host-wired, and so the one that can\n    // always answer: `AiSdkRunner` reports what the host assembled the session\n    // from (an empty list when that was nothing). Acting on a server is a\n    // different power and stays absent — the host owns those connections and\n    // this engine has no channel to renegotiate one.\n    mcpStatus: true,\n    mcpServerActions: false,\n    sessionMcpServers: false,\n    slashCommands: false,\n    // The transcript this engine reasons over is an in-process message array,\n    // so clearing it is the whole operation — no engine round trip at all.\n    clearContext: true,\n    skillsList: false,\n    settingSources: false,\n    budgets: false,\n    attachments: ['image', 'pdf', 'text'],\n    vfs: true,\n    // No host filesystem at all: the tools run against the in-memory VFS, and\n    // the runner never opens a path. A required `cwd` here would be a field\n    // nothing reads, and `allowedCwdRoots` would look like the sandbox boundary\n    // when the capability wiring is what actually bounds this engine.\n    hostCwd: false,\n    streaming: 'token',\n  },\n}\n\n/**\n * Permission modes the model-agnostic provider engine understands.\n * @deprecated Read `ENGINE_CAPABILITIES.provider.permissionModes` (this is an\n * alias of it, kept for protocol-5 consumers).\n */\nexport const PROVIDER_PERMISSION_MODES: readonly PermissionMode[] =\n  ENGINE_CAPABILITIES.provider.permissionModes\n\n/**\n * Whether a profile's engine can run a permission mode. The single source of\n * truth for the restriction: create forms filter what they offer with it, the\n * gateway rejects with it. An absent `engine` means 'claude' (every mode).\n */\nexport function supportsPermissionMode(\n  engine: ProfileEngine | undefined,\n  mode: PermissionMode,\n): boolean {\n  return ENGINE_CAPABILITIES[engine ?? 'claude'].permissionModes.includes(mode)\n}\n\n/**\n * A model provider a `provider` profile can run on. Credentials are ALWAYS\n * resolved from the operator's environment — never carried on the wire, never\n * stored here. `apiKeyEnv` names the variable to read, it does not hold a key.\n */\nexport type ProviderConfig = {\n  /** Provider adapter to use, e.g. 'anthropic' | 'openai' | 'moonshotai' |\n   * 'openai-compatible'. Kept as a string: the set is host-extensible. */\n  id: string\n  /** Default model id, e.g. 'kimi-k3'. Overridable per session. */\n  model?: string\n  /** Model ids this profile offers, for the dashboard's picker. Operator-declared\n   * rather than discovered: provider engines have no equivalent of the CLI's\n   * `supportedModels()`, and only the operator knows which ids their endpoint and\n   * key actually serve. Unset → the picker offers {@link ProviderConfig.model} alone. */\n  models?: string[]\n  /** Base URL for OpenAI-compatible providers. */\n  baseUrl?: string\n  /** Environment variable the operator put the key in. Never the key itself. */\n  apiKeyEnv?: string\n}\n\n/**\n * A grantable capability of the model-agnostic engine, named after the tool it\n * yields. The always-present tools (`fs_*`, `eval_script`) are not listed: they\n * are the engine's scratch filesystem and sandbox, not a grant.\n */\nexport type SessionCapability = 'web_search' | 'download' | 'web_fetch' | 'deliver_file'\n\n/**\n * What sessions under a `provider` profile get, declared by the operator. Meaning-\n * less for `claude` profiles, whose equivalents live in the config directory.\n *\n * MCP servers are named, never configured, here: a server's transport config can\n * carry credentials in its headers, and this type is served by `GET /profiles`.\n * The names refer to servers the host connected in `createEngineRunner`, which is\n * where the configs (and the credentials) stay.\n */\nexport type ProfileSessionDefaults = {\n  /** Capabilities granted to sessions under this profile. Absent = no\n   * declaration, so a session gets whatever backends the host wired. A session\n   * request may narrow this set, never widen it. */\n  capabilities?: SessionCapability[]\n  /** MCP servers, by name, whose tools sessions under this profile may use.\n   * Absent = no declaration (every server the host connected). */\n  mcpServers?: string[]\n  /** Prepended to the session's system prompt. */\n  instructions?: string\n}\n\n/**\n * One rate-limit window of a profile's plan, as the *gateway* last saw it — the\n * newest {@link RateLimitInfo} any session on the profile reported, across every\n * session, live or since closed. The profile is the account boundary (one config\n * dir / codex home / provider key = one plan), so this is the single usage state\n * per account, where a session's own transcript only knows what *it* was last\n * told.\n *\n * Two rules a client must keep:\n * - An absent window (or an absent {@link ProfileInfo.usage} entirely) is\n *   **unknown, not 0%** — render nothing, exactly as for session-level readings.\n *   The map is in-memory and starts empty on a cold server.\n * - `inferredReset` marks a reading the server zeroed at serve time because the\n *   reading's own `resetsAt` passed with nothing newer: the pre-reset number is\n *   then provably wrong, and 0 is the truthful *floor* (the account may have\n *   been used outside this gateway since). Distinguishable on the wire from an\n *   engine-reported 0, which carries no flag.\n */\nexport type ProfileUsageWindow = {\n  /** The reading, exactly as the session event carried it — except after an\n   * elapsed reset, when `utilization` is 0 and `resetsAt` is dropped (the old\n   * one names the *previous* window; a countdown from it would be nonsense). */\n  info: RateLimitInfo\n  /** Epoch ms of the event that carried the reading — honest for \"Updated …\"\n   * lines even when the served utilization is inferred. */\n  updatedAt: number\n  /** Present (true) only on the served-as-0 inference described above. */\n  inferredReset?: boolean\n}\n\n/** Per-window plan usage, keyed by `rateLimitType` ('five_hour', 'seven_day',\n * ...) — the same keying as a transcript's rate-limit state. */\nexport type ProfileUsage = Record<string, ProfileUsageWindow>\n\nexport type ProfileInfo = {\n  /** Unique name, used as {@link CreateSessionRequest.profile}. */\n  name: string\n  /** Engine this profile runs on. Defaults to 'claude' when absent, so profiles\n   * written before provider support keep working unchanged. */\n  engine?: ProfileEngine\n  /** Absolute path set as CLAUDE_CONFIG_DIR for the session's CLI process.\n   * Required for 'claude' profiles; meaningless for the other engines. */\n  configDir?: string\n  /** Codex profiles: absolute path set as CODEX_HOME for the session's codex\n   * process (auth, config.toml, thread storage) — the `configDir` analogue,\n   * request-writable like it. Unset = the binary's own `~/.codex`. */\n  codexHome?: string\n  /** Provider wiring for 'provider' profiles. */\n  provider?: ProviderConfig\n  description?: string\n  defaults?: ProfileDefaults\n  /** Provider-engine session grants (capabilities, MCP servers, instructions). */\n  session?: ProfileSessionDefaults\n  /** Response-only: the engine's model catalog, shipped with the release and\n   * served from the first request (no process spawned, no warm-up session).\n   * For provider profiles the ids come from `provider.models` instead. Never\n   * contains a 'default' sentinel row — forms add their own \"Profile default\"\n   * row mapping to an unset model. Ignored on the way in. */\n  models?: ModelOption[]\n  /** Response-only: what this profile's default model resolves to. For claude\n   * profiles this is the operator's CLI config — unknowable statically — so it\n   * is absent until a session on this profile reports it. */\n  defaultModel?: string\n  /** Response-only: the engine's capability record (see {@link EngineCapabilities}).\n   * Absent = use ENGINE_CAPABILITIES[engine]. Ignored on the way in. */\n  capabilities?: EngineCapabilities\n  /** Response-only: whether the profile's credentials probe as usable right now.\n   * Absent = unknown/unchecked — treat as available. **Display-only**: create\n   * against an unavailable profile still proceeds and fails with the engine's\n   * own error (the probe can be stale in both directions). */\n  available?: boolean\n  /** Response-only: one operator-actionable line, present only when\n   * `available === false`. */\n  unavailableReason?: string\n  /** Response-only: the plan's rate-limit windows as last reported by any\n   * session on this profile (see {@link ProfileUsageWindow}). Absent = unknown\n   * — no session has reported yet (API-key sessions never do), or the server\n   * restarted. **Display-only**, like `available`: never a gate. */\n  usage?: ProfileUsage\n  /** Response-only, computed by the server: this profile came from the profile\n   * store and can be edited or deleted through the API. Profiles declared in\n   * server options are absent/false — they are code. Ignored on the way in. */\n  managed?: boolean\n}\n\n/**\n * Curated, read-only snapshot of what a profile's config directory contains —\n * the parts relevant to running worker sessions. Values that could carry secrets\n * (env var values) never leave the server; only names are listed.\n */\nexport type ProfileConfigSnapshot = {\n  /** From the config dir's settings.json; absent when missing or unparseable. */\n  settings?: {\n    /** Configured default model. */\n    model?: string\n    /** permissions.defaultMode — the CLI's default permission mode. */\n    defaultPermissionMode?: string\n    /** Rule counts from permissions.allow / ask / deny. */\n    permissionRules?: { allow: number; ask: number; deny: number }\n    /** Env var NAMES declared in settings.json env (values never included). */\n    envKeys?: string[]\n    /** Hook event names with at least one hook configured. */\n    hooks?: string[]\n  }\n  /** CLAUDE.md (user memory) present in the config dir. */\n  hasUserMemory: boolean\n  /** Skill names (skills/<name>/). */\n  skills: string[]\n  /** Agent names (agents/<name>.md). */\n  agents: string[]\n  /** Custom slash-command names (commands/<name>.md). */\n  commands: string[]\n}\n\n// ---------------------------------------------------------------------------\n// REST shapes\n// ---------------------------------------------------------------------------\n\nexport type McpServerConfigWire =\n  | { type?: 'stdio'; command: string; args?: string[]; env?: Record<string, string> }\n  | { type: 'http'; url: string; headers?: Record<string, string> }\n  | { type: 'sse'; url: string; headers?: Record<string, string> }\n\n/** One tool an MCP server exposes, as the session's engine reports it.\n * Parameters are deliberately absent: the CLI's status payload names and\n * describes each tool but does not carry its input schema. */\nexport type McpServerToolInfo = {\n  name: string\n  description?: string\n  annotations?: { readOnly?: boolean; destructive?: boolean; openWorld?: boolean }\n  /**\n   * The tool's JSON Schema, where the engine reports one. **Engine-dependent,\n   * and that is not an oversight**: the Agent SDK's `McpServerStatus` names and\n   * describes each tool but carries no schema at all, while codex's\n   * `mcpServerStatus/list` returns the full one. So a client renders parameters\n   * where they exist and says they are unavailable where they don't — rather\n   * than either leaving a silent gap or claiming the absence is universal.\n   *\n   * Opaque on purpose: this is a JSON Schema document, not a shape this\n   * protocol models.\n   */\n  inputSchema?: unknown\n}\n\n/**\n * Live status of one MCP server on a session — what `GET\n * {basePath}/sessions/:id/mcp` answers with, and what the `/mcp` screens render.\n *\n * The connection *identity* is here (transport, command, url, scope) but never\n * its secrets: the engine's config carries `env` for stdio servers and `headers`\n * for HTTP/SSE ones, and both are dropped on the way out. A client that can read\n * this is not thereby entitled to the tokens the operator configured.\n */\nexport type McpServerStatusInfo = {\n  name: string\n  /** 'connected' | 'failed' | 'needs-auth' | 'pending' | 'disabled' — kept open,\n   * the engine's set may grow. */\n  status: string\n  /** Where the server was configured: 'project' | 'user' | 'local' | 'dynamic' | … */\n  scope?: string\n  /** Present when `status` is 'failed'. */\n  error?: string\n  /** Name and version the server announced on connect. */\n  serverInfo?: { name: string; version: string }\n  transport?: 'stdio' | 'http' | 'sse' | 'sdk'\n  /** stdio only. */\n  command?: string\n  /** stdio only. Secrets do occasionally ride argv; the operator's own client\n   * shows them, and hiding them here would only mislead. `env` is not exposed. */\n  args?: string[]\n  /** http/sse only. */\n  url?: string\n  /** Present when connected. */\n  tools?: McpServerToolInfo[]\n}\n\nexport type McpServersResponse = { servers: McpServerStatusInfo[] }\n\n/** `POST {basePath}/sessions/:id/mcp/:name` — answers with the refreshed status. */\nexport type McpServerActionRequest = { action: 'reconnect' | 'enable' | 'disable' }\n\n/** `POST {basePath}/sessions/:id/attachments?name=<name>` — the body is the raw\n * file, the `content-type` header its media type. Answers with the reference to\n * name on the next `user_message`. */\nexport type UploadAttachmentResponse = { attachment: MessageAttachment }\n\nexport type CreateSessionRequest = {\n  /** Directory the session is rooted at. Required for any engine whose\n   * capability record declares {@link EngineCapabilities.hostCwd} — `cwd` is\n   * per-query in the SDK and the server re-pins it on every call. Omittable for\n   * an engine that has no host filesystem at all (the provider engine, whose\n   * tools run against the in-memory VFS): there the field would be a required\n   * lie, and `allowedCwdRoots` would look like a sandbox boundary it is not. */\n  cwd?: string\n  /** Profile (named Claude Code config dir) to run under. Required when the server\n   * declares more than one profile; implicit when exactly one exists. */\n  profile?: string\n  /** Optional initial prompt (may be a skill invocation like \"/verify-content 123\"). */\n  prompt?: string\n  permissionMode?: PermissionMode\n  /** Pre-authorize 'bypassPermissions' (the CLI's --dangerously-skip-permissions\n   * capability) so the mode can be switched on mid-session. Without it the CLI\n   * rejects `set_permission_mode: 'bypassPermissions'` on a running session.\n   * Implied when `permissionMode` is already 'bypassPermissions'. */\n  allowDangerouslySkipPermissions?: boolean\n  allowedTools?: string[]\n  disallowedTools?: string[]\n  mcpServers?: Record<string, McpServerConfigWire>\n  /** Which filesystem settings the session loads. Include 'project' to pick up the\n   * target repo's skills and CLAUDE.md (\"close-to-real\" fidelity). */\n  settingSources?: Array<'user' | 'project' | 'local'>\n  model?: string\n  maxTurns?: number\n  maxBudgetUsd?: number\n  /** Resume an existing SDK session by id. */\n  resume?: string\n  /** With `resume`: fork to a new session id instead of continuing. */\n  forkSession?: boolean\n  /** Reasoning effort for the session's model (codex engine). Open string —\n   * offerable values come from the profile's catalog/capability record. The\n   * gateway 400s it when the engine's record declares no `reasoningEfforts`. */\n  reasoningEffort?: string\n  /** Emit `stream_delta` events for token-by-token rendering. Default true. */\n  includePartialMessages?: boolean\n  /** Per-session override of the server's permission-request timeout (ms). */\n  approvalTimeoutMs?: number\n  /** AskUserQuestion handling (see {@link QuestionBehavior}). Default 'ask'. */\n  questionBehavior?: QuestionBehavior\n  /** Provider engine only: run with fewer capabilities than the profile grants\n   * (see {@link ProfileSessionDefaults.capabilities}). Narrowing only — naming a\n   * capability the profile does not grant is a 400, not a silent upgrade. */\n  capabilities?: SessionCapability[]\n  /** Free-form metadata echoed back on SessionInfo (host app bookkeeping). */\n  meta?: Record<string, unknown>\n  /**\n   * Opaque string tags naming what this session *belongs to* — the gateway's\n   * only intra-deployment scoping primitive. Assigned at create, **immutable\n   * afterwards** (no route writes it), echoed on {@link SessionInfo}, and\n   * carried through parking/dormancy so a restart cannot un-scope a session.\n   *\n   * WorkerDeck never interprets a key: an embedder writes `{ space, user }` or\n   * `{ tenant }` or nothing at all. What the tags *mean* is the host's\n   * `authorizeSession` predicate; absent one, the default rule is that every\n   * key the authenticated principal pins must match here (an unset principal\n   * scope is unrestricted — the same \"unset means all\" rule `allowedProfiles`\n   * uses, so an operator's dashboard keeps working unchanged).\n   *\n   * NOT `meta`: `meta` is free-form, client-settable and echoed, and an\n   * enforcement rule whose input the caller supplies is not an enforcement\n   * rule. Values are visible to any principal the policy admits a session to,\n   * so use opaque ids rather than names you would not show that audience.\n   */\n  scope?: Record<string, string>\n}\n\n/**\n * One sub-agent (a `Task` call and the sidechain it spawned), as a *list* surface\n * sees it — without attaching.\n *\n * Sub-agent work is otherwise attach-only: it exists on the wire as\n * `parentToolUseId` on three event bodies, and is reconstructed into rows by the\n * react reducer and grouped per-Task by `terminalBlocks`. A sessions list never\n * attaches (one live attach per session, owned by the panel), so it reads\n * `SessionInfo` over REST and would otherwise have no way to know a session has\n * six agents running inside one turn.\n *\n * This is a **runner-owned rollup computed at read time**, exactly like\n * {@link SessionInfo.pendingPermissionCount}: it is not an event, it is not\n * persisted separately, and it therefore rides the REST list, the WS attach\n * snapshot and parking snapshots for free.\n *\n * **The claude and codex engines both produce it; the provider engine's absence\n * is the truth.** The AI SDK has no multi-agent primitive and no tool that runs\n * a nested agent loop, so `parentToolUseId: null` on every provider event is\n * honest. Codex's spawn signal is the `subAgentActivity` item, whose own `id` is\n * the model's `spawn_agent` call id — a genuine tool-use id — so `toolUseId`\n * keeps its documented meaning there: the codex runner authors the anchor\n * `tool_use` itself and keys every event of the agent's *thread* to it\n * (`engines/codex/subagents.ts`). The earlier version of this comment asserted\n * codex had no sidechains; that was true of the exec era and has not been true\n * for a while.\n *\n * It is deliberately **not** the input to `taskSummary`. That string is spelled\n * from the absorbed transcript items and must stay that way, so a transcript\n * replayed tomorrow spells the same line from the same items it holds today.\n */\nexport type SubagentInfo = {\n  /** The `tool_use` id of the `Task` call that spawned it — the same id its\n   * nested events carry as `parentToolUseId`, and therefore the handle a client\n   * uses to jump to that Task's row. */\n  toolUseId: string\n  /** The Task input's `subagent_type` (e.g. \"Explore\"), when it named one. */\n  agentType?: string\n  /** The Task input's short `description`, clipped by the runner. Together with\n   * `agentType` this is what makes two parallel sub-agents tell apart in a list;\n   * a row reading only `Task` answers nothing. */\n  description?: string\n  /**\n   * `running` until the Task's own `tool_result` arrives, then `done`/`failed`\n   * from that result's `is_error`. A turn that ends without that result — an\n   * interrupt, a session error, a turn or budget cap — settles what is still\n   * running as `failed`: the report never came, which is the one thing `done`\n   * could have claimed, and a `running` badge on an idle session would be a\n   * lie a list re-renders at every poll.\n   *\n   * Deliberately **narrower than `taskFailed`** in `@workerdeck/ui`'s\n   * `tool-run.ts`, which reddens a Task row when *any child call* failed. That is\n   * right for a transcript row the reader can expand — the failure is one press\n   * away and hiding it would be worse. It is wrong for a list: a grep that\n   * matched nothing inside an otherwise successful Explore agent would put\n   * `failed` beside the session's name with nothing to open. So this reports the\n   * sub-agent's own outcome. If you are here to \"fix\" the inconsistency, this is\n   * the reason it exists.\n   */\n  status: 'running' | 'done' | 'failed'\n  /** Epoch ms the `Task` call was emitted. */\n  startedAt: number\n  /** Tool calls the sub-agent has made so far — its progress reading while\n   * running, counted from nested `tool_use` blocks. */\n  toolCount: number\n}\n\n/**\n * How many *settled* sub-agents {@link SessionInfo.subagents} keeps behind the\n * running ones. Small on purpose: the point of the tail is that a list row does\n * not go blank the instant a run finishes, not that it is a history.\n */\nexport const SUBAGENT_HISTORY = 8\n\n/**\n * A project's icon, as declared by its `.workerdeck.json` — either a named\n * glyph or a reference to an image the gateway serves.\n *\n * A discriminated union rather than one stringly field, because the two arms\n * have opposite render paths: a glyph is looked up in the client's own icon\n * set with no I/O, an image is a fetch. Collapsing them would put \"is this a\n * name or an address\" back on every renderer, which is the inference this\n * family keeps refusing (`ImageRefPart` is a new part type, never a\n * hollowed-out `image`, for the same reason).\n *\n * `glyph.name` is a lucide icon name, validated by the gateway for *shape*\n * only (lowercase kebab-case): the gateway has no lucide catalog and must not\n * grow one — icon sets version independently of this protocol. A client whose\n * set lacks the name renders its no-project fallback rather than erroring;\n * an unknown name is a stale row, never withheld state.\n *\n * `image` carries an **address, never bytes** — the attachment-bytes rule.\n * `SessionInfo` rides every row of `GET /sessions`, which clients poll at 1.2s\n * while anything is working, so an inlined base64 icon would be paid for on\n * every poll of every session forever (the same argument that keeps\n * `originalFile` off {@link FilePatch} and message bytes off events). The\n * bytes come from `GET {basePath}/sessions/:id/project/icon` — session-scoped\n * on purpose, so the fetch rides the same `canSee` gate as every other\n * `/sessions/:id/*` route and a scoped principal's miss is the uniform 404. A\n * project-keyed route would need the project root in the URL, and a route\n * addressed by host paths is an existence oracle for the gateway's\n * filesystem. `hash` (sha256 hex of the bytes) is the cross-session cache\n * key: two sessions in one project serve identical bytes, so a client caches\n * by hash rather than by URL and fetches once per project, not once per\n * session. The route answers with `ETag: \"<hash>\"` and honors\n * `If-None-Match`.\n */\nexport type ProjectIcon =\n  | { type: 'glyph'; name: string }\n  | { type: 'image'; mediaType: 'image/png' | 'image/svg+xml'; hash: string }\n\n/**\n * Project identity for a session — what a `.workerdeck.json` in the session's\n * ancestry declares, resolved by the **gateway** and shipped on\n * {@link SessionInfo.project}.\n *\n * The gateway reads the file, not each client: the iOS app and a browser\n * pointed at a remote gateway have no access to that filesystem, so a\n * per-client reader would make the feature exist on exactly one client.\n * Discovery is an ancestor walk from the session's `cwd` upward — nearest\n * `.workerdeck.json` wins, so a session started in `packages/ui` still says\n * \"WorkerDeck\" — over the *realpath'd* cwd, which is what makes `root`\n * canonical below.\n *\n * The file's schema, stated here because this type is its wire projection\n * (clients never read the file; the gateway is its only parser):\n *\n * ```json\n * { \"name\": \"WorkerDeck\", \"icon\": \"layers\" }\n * { \"name\": \"WorkerDeck\", \"icon\": \"./docs/assets/icon.png\" }\n * ```\n *\n * Both keys optional, unknown keys ignored (forward compatibility). An empty\n * `{}` still marks its directory as the project root — grouping is the point,\n * and the name falls back to the root's basename. `icon` is one string with a\n * total classification rule: a value ending in `.png`/`.svg`\n * (case-insensitive) is a repo-relative image path — relative only, since the\n * file is checked into a repo that clones onto other machines, where an\n * absolute path is wrong by construction — and anything else must be a\n * lucide-shaped glyph name (`^[a-z0-9]+(-[a-z0-9]+)*$`) or it is ignored. The\n * two shapes cannot collide (a glyph name contains no dot), so the rule is a\n * classification, not a guess. Every degradation degrades *fieldwise and\n * silently*: a malformed or oversized file is skipped and the walk continues\n * to an ancestor (a broken nested file must not shadow the repo root's valid\n * one), a junk name falls back to the basename, a junk or escaping icon is\n * dropped — a session must never fail, or even warn, because of a display\n * declaration.\n *\n * `root` — the canonical (realpath'd) absolute directory holding the file, on\n * the **gateway's** filesystem — is the grouping key: two sessions are in the\n * same project iff same root *on the same gateway* (a remote gateway's\n * identical-looking path is another machine's directory — the `ScopeRoot`\n * argument). A *name* is not a key: two repos can both be called \"api\".\n * Canonicalizing at discovery is what makes two differently-spelled cwds of\n * one project agree on it.\n *\n * Resolved at **serve time** from a TTL cache, never persisted — the same\n * placement argument as the profile tracker's 0%-after-reset inference: it is\n * a function of the gateway's current filesystem, and a copy captured into a\n * parking record would replay a stale name forever. Editing the file shows up\n * on every session in the project within the TTL, with no migration and no\n * event.\n *\n * Additive at protocol **7**: an optional field on `SessionInfo`, where\n * absent means exactly what today's wire means (no project declared — render\n * the folder basename), an old client ignores it, and a new client against an\n * old gateway sees absent. The icon route is likewise unreachable by\n * accident: a client only fetches it when this gateway told it an image\n * exists.\n */\nexport type ProjectInfo = {\n  /** Display name — the file's `name`, else the root's basename. Never empty. */\n  name: string\n  /** Canonical absolute path of the directory holding `.workerdeck.json`, on\n   * the gateway's filesystem. The grouping key (per gateway); an opaque string\n   * to clients beyond equality and display. */\n  root: string\n  /** Absent = the file declared none (or declared one the gateway refused —\n   * malformed, escaping, oversized — which a client cannot and must not\n   * distinguish). */\n  icon?: ProjectIcon\n}\n\nexport type SessionInfo = {\n  /** Server-assigned id (stable across SDK session forks/resumes). */\n  id: string\n  /** Underlying Agent SDK session id, once known; use for `resume`. */\n  sdkSessionId?: string\n  status: SessionStatus\n  /** Empty string for a session whose engine has no host filesystem (see\n   * {@link CreateSessionRequest.cwd}). Deliberately not optional: every client\n   * renders and searches it, and a synthetic path would send the workspace and\n   * `@file` search probing a directory that does not exist. */\n  cwd: string\n  /** Profile the session runs under (resolved name, present even when implicit). */\n  profile?: string\n  /** Engine actually running this session, reported by the runner itself. Lets a\n   * session surface gate CLI-only affordances (permission modes, context usage,\n   * rate limits) without looking the profile back up. Absent = 'claude'. */\n  engine?: ProfileEngine\n  /** The engine's capability record, reported by the runner like `engine`. The\n   * attach snapshot is the session-level source (no event carries it). Absent =\n   * ENGINE_CAPABILITIES[engine]. */\n  capabilities?: EngineCapabilities\n  model?: string\n  permissionMode?: PermissionMode\n  /** Whether this session may be switched into `bypassPermissions`. The CLI only\n   * allows it when the process was spawned for it, so it is decided at creation\n   * and never changes: a session that did not ask for bypass up front cannot\n   * gain it later. Lets a picker disable the mode instead of offering a switch\n   * the engine will refuse. Absent = unknown (an older server). */\n  canBypassPermissions?: boolean\n  /** See the `system_init` event; 'oauth' = claude.ai subscription credentials. */\n  apiKeySource?: string\n  createdAt: number\n  /** Highest event seq emitted so far; attach with `afterSeq` to catch up. */\n  lastSeq: number\n  pendingPermissionCount: number\n  /**\n   * Sub-agents this session has running, plus a short tail of settled ones — see\n   * {@link SubagentInfo}. Absent on an engine that has no sidechains and on an\n   * older server; **absent and empty mean the same thing to a client**, so render\n   * nothing rather than \"0 sub-agents\".\n   *\n   * Bounded on purpose. This rides every row of `GET /sessions`, which a busy\n   * client polls at 1.2s, and it is captured into parking snapshots — the same\n   * attachment-bytes rule that keeps whole files off {@link FilePatch}. Every\n   * *running* sub-agent is always present (they are the live reading and there\n   * are never many at once); settled ones are kept newest-first to\n   * {@link SUBAGENT_HISTORY} and then dropped, so a day-long session with two\n   * hundred Tasks does not grow an unbounded field. A client must therefore not\n   * treat this as the session's full Task history — the transcript is that.\n   */\n  subagents?: SubagentInfo[]\n  meta?: Record<string, unknown>\n  /** Display title: `meta.title` if the host set one, else derived (e.g. first prompt). */\n  title?: string\n  /** Cumulative cost across all turns so far (sum of turn_result totals). */\n  totalCostUsd?: number\n  /** Cumulative turn count across the session. */\n  numTurns?: number\n  /**\n   * How many transcript rows this session has produced (see\n   * {@link transcriptActivity}) — a monotonic counter a client can diff against\n   * a remembered value to answer \"how much happened while I wasn't looking\",\n   * without attaching.\n   *\n   * `numTurns` cannot answer it: five tool calls inside one turn are one turn.\n   * `lastSeq` cannot either — it counts every event, and with token streaming on\n   * that is hundreds per reply. Absent on an older server; a client should fall\n   * back to `numTurns` rather than showing nothing.\n   *\n   * Monotonic for the session's whole life, **including across a\n   * `conversation_reset`**: after a `/clear` this deliberately exceeds the\n   * number of rows a fresh attach renders. It is an unread *cursor* diffed\n   * against stored monotonic watermarks (see `watermarks.ts`) — resetting it to\n   * the new row count would leave every stored mark above it, and that\n   * session's badge dead until the count caught back up.\n   */\n  activityCount?: number\n  /** Epoch ms of the most recent emitted event. */\n  lastActivityAt?: number\n  /**\n   * The session's latest context-window reading — see {@link ContextReading}.\n   *\n   * The same number the session screen draws, served on the list so a row can\n   * show where a session is bloating **without attaching to it**. That is the\n   * whole reason it is here: context fill is the one session metric you want\n   * across *all* sessions at once, and until now it existed only as an event on\n   * an attached socket.\n   *\n   * Retained by the runner from the last `context_usage` it emitted, so it is\n   * exactly what the transcript last showed — never recomputed on the serve\n   * path, which would be a second answer to a question that already has one.\n   * Absent until the first reading (a promptless session has none), and cleared\n   * by a `conversation_reset` for the same reason the transcript state clears\n   * it: the old window is not this conversation's.\n   */\n  contextUsage?: ContextReading\n  /** Opaque scope tags this session was created with — see\n   * {@link CreateSessionRequest.scope}. Echoed by the runner, re-stamped by the\n   * gateway, and never editable. */\n  scope?: Record<string, string>\n  /**\n   * Project identity discovered from the session's `cwd` — see\n   * {@link ProjectInfo}. Stamped by the **gateway at serve time** (runners\n   * never set it; a runner-echoed value would be persisted into parking\n   * records and replay a stale name forever). Absent = no `.workerdeck.json`\n   * in the cwd's ancestry, and also = an older gateway: both mean \"render the\n   * folder basename\", which is exactly today's behaviour.\n   */\n  project?: ProjectInfo\n}\n\n/**\n * The list-sized context reading an event carries, or `undefined` for the events\n * that carry none — the rule behind {@link SessionInfo.contextUsage}.\n *\n * Here rather than in each runner for the same reason {@link transcriptActivity}\n * is: it is one rule both sides have to agree on, and three copies of \"which\n * events move the reading\" is three chances to disagree. Runners fold it in\n * their emit path; **clearing on `conversation_reset` is the caller's half** —\n * this function answers \"what does this event say the reading is\", and a reset\n * says nothing about the window, it retires the conversation the window\n * described.\n */\nexport function contextReading(body: SessionEventBody): ContextReading | undefined {\n  if (body.type !== 'context_usage') return undefined\n  const { totalTokens, maxTokens, percentage } = body.usage\n  return { totalTokens, maxTokens, percentage }\n}\n\n/**\n * How many transcript rows an event materializes — the unit behind\n * {@link SessionInfo.activityCount}.\n *\n * Deliberately the *reducer's* rule (`@workerdeck/react`'s `transcript.ts`), not\n * a server-side approximation: one row per content block of an assistant\n * message (a text, a thought, each tool call), one for a user message, one per\n * turn result, delivered file or error. Everything else — status changes, usage\n * readings, stream deltas, permission bookkeeping — is state, not a row, and\n * counts zero.\n *\n * It lives in `protocol` because both sides need it and neither may import the\n * other: the runners count with it, and any client compares the totals. If the\n * reducer's row rule changes, change this with it.\n */\nexport function transcriptActivity(body: SessionEventBody): number {\n  // A subagent's own messages are not rows of *this* conversation: they render\n  // inside the `Task` call that spawned them, which is itself a row and already\n  // counted. Scoring them would make an unread badge announce dozens of rows a\n  // reader cannot see without expanding a block — and the badge is a promise\n  // about what is on screen. The claim is the same one `transcriptContent`\n  // declines to make: nested items still *mutate* items, so they must still\n  // replay; they merely do not add to the count.\n  if ('parentToolUseId' in body && body.parentToolUseId != null) return 0\n  switch (body.type) {\n    case 'assistant_message': {\n      const content = body.message.content\n      // A string body is one text row. Blocks are one row each, except tool\n      // results (which land inside the call's own row) and unknown blocks.\n      if (typeof content === 'string') return content.trim() === '' ? 0 : 1\n      const rows = content.filter(\n        (block) => block.type === 'text' || block.type === 'thinking' || block.type === 'tool_use',\n      ).length\n      return rows\n    }\n    case 'user_message':\n      // Tool results arrive as synthetic user messages; they are not rows.\n      return body.synthetic ? 0 : 1\n    case 'turn_result':\n    case 'file_delivered':\n    case 'session_error':\n      return 1\n    default:\n      return 0\n  }\n}\n\n/**\n * Whether an event is **transcript content** — whether the reducer\n * (`@workerdeck/react`'s `transcript.ts`, and its Swift mirror) mutates\n * `items` when it applies it. The rule behind `conversation_reset`'s replay\n * semantics: the runner keeps its whole event log, but `subscribe()` skips\n * content below the latest reset so an attaching client does not resurrect a\n * cleared conversation — while every *state-bearing* event (`system_init`,\n * `capabilities`, `skills`, `status_changed`, usage and rate-limit readings,\n * `file_produced`, permission bookkeeping) still replays, because a fresh\n * attacher with no model list and no cwd is broken, not cleared.\n *\n * Deliberately **broader than `transcriptActivity() > 0`**: stream deltas,\n * tool results (synthetic user messages) and execution lifecycle events count\n * zero rows but still mutate items — replaying them across a reset would leave\n * orphaned deltas and results with no parent message.\n *\n * `conversation_reset` itself is content under this rule, and that is load-\n * bearing twice: a *superseded* reset (below a newer one) is skipped with the\n * conversation it cleared, while the latest reset always replays (the skip is\n * strictly-below), which is what clears a reconnecting client that still holds\n * pre-reset rows.\n *\n * Lives here beside {@link transcriptActivity} for the same reason: the\n * reducer owns the rule and the runners filter with it, and the two sides may\n * not import each other. If the reducer's items-mutating set changes, change\n * this with it. Unknown/future event types are NOT content — the safe failure\n * is replaying a stale row, never withholding state.\n */\nexport function transcriptContent(body: SessionEventBody): boolean {\n  switch (body.type) {\n    case 'user_message':\n    case 'assistant_message':\n    case 'stream_delta':\n    case 'turn_result':\n    case 'execution_dispatched':\n    case 'execution_result':\n    case 'execution_failed':\n    case 'file_delivered':\n    case 'session_error':\n    case 'session_closed':\n    case 'conversation_reset':\n      return true\n    default:\n      return false\n  }\n}\n\n/**\n * The dedupe key for an event that is **last-write-wins** on replay, or\n * `undefined` for one that must always be delivered.\n *\n * The problem: the runner polls context usage and the plan's rate limits after\n * every turn, so a fifty-turn session's log holds fifty context readings and\n * fifty per rate-limit window. Replaying all of them is not merely wasteful —\n * it is *visible*. A client applies each in turn, so opening a session shows\n * the usage meters counting up from the session's first reading to its last\n * over the length of the replay, announcing history as if it were news.\n *\n * The fix is a backwards scan over the buffered log keeping the first\n * occurrence of each key, which is `staleReplaySeqs` in `@workerdeck/core`.\n * The key is per *window* for rate limits, not per event type: the reducer\n * stores them keyed by window (\"so five_hour and seven_day updates don't\n * clobber each other\"), so a single key would keep only the most recently\n * polled window and silently drop the others.\n *\n * **This is a claim about the reducer**, which is why it lives here rather\n * than in core: only the server coalesces, but only `@workerdeck/react` can\n * prove the rule correct, and neither package may import the other. The\n * property that must hold is that coalescing is *unobservable* — folding the\n * full log and the coalesced log through `applyEvent` yields identical state.\n * `packages/react/test/replay-coalesce.test.ts` asserts exactly that, over\n * every event kind. Extend the rule only with a case that test still passes.\n *\n * Three kinds are deliberately **excluded** despite looking eligible:\n *\n * - `capabilities` — `defaultModel: event.defaultModel ?? base.defaultModel`\n *   is a fallback *merge*, so a later event without one would erase an earlier\n *   event's. (It is also emitted once per session, so there is nothing to win.)\n * - `model_changed` — `undefined` means \"reset to the server default\" and the\n *   reducer *keeps* the last known model, so the last event alone is not the\n *   same as the fold.\n * - `system_init` — pure replace for the reducer, but the server's\n *   `watchAuthSource` reads the **first** one to decide an auth policy, and\n *   parking treats each as a resume point.\n *\n * Coalescing never drops the highest-seq event, and that is load-bearing\n * rather than incidental: the globally-last event is by definition the last of\n * its own key, so it always survives. `useClaudeSession`'s replay hold waits\n * for `state.lastSeq` to reach the attach's `session.lastSeq`, and would hang\n * on a blank panel forever if a coalescer could swallow the final event.\n */\nexport function replayCoalesceKey(body: SessionEventBody): string | undefined {\n  switch (body.type) {\n    case 'context_usage':\n      return 'context_usage'\n    case 'rate_limit':\n      // Per window. The reducer keys `rateLimits` by `rateLimitType`; an event\n      // without one is dropped by the reducer, so it has no key here either.\n      return body.info.rateLimitType ? `rate_limit:${body.info.rateLimitType}` : undefined\n    case 'status_changed':\n      // Pure replace in the reducer. Safe only because coalescing is opt-in at\n      // the WS attach: `parking.ts` subscribes from seq 0 and *branches* on\n      // this event (a `parked` status triggers a park), so a coalesced log\n      // handed to every subscriber would silently skip that side effect.\n      return 'status_changed'\n    case 'sdk_event':\n      // The CLI's own liveness chatter — `{ type: 'system', subtype: 'status' }`\n      // saying \"requesting\" — and it is the single most numerous thing in a real\n      // log: 1,363 of them over 388 KB in a measured session, a ninth of the\n      // whole attach payload, for a field describing what the runner was doing\n      // an hour ago. Last-write-wins is the *generous* reading: the honest one\n      // is that a replayed status is never true, since the only status that can\n      // be is the current one.\n      //\n      // Narrow on purpose. `sdk_event` is the escape hatch for SDK messages this\n      // protocol version does not model, and the family's standing rule is that\n      // the safe failure is replaying a stale row rather than withholding state\n      // — so a compaction boundary or an auth notice keeps arriving in full, and\n      // only the one payload that is *by nature* transient is folded.\n      return body.payload.type === 'system' && body.payload.subtype === 'status'\n        ? 'sdk_event:system:status'\n        : undefined\n    default:\n      return undefined\n  }\n}\n\n/**\n * Does a **replay** have to deliver this event, or may it be dropped outright?\n *\n * The fifth of the family, and the closest relative of {@link snapshotRetains} —\n * the same claim (\"no client can tell\") pointed at the wire instead of at a\n * store. The difference from {@link replayCoalesceKey} is that this is not\n * last-write-wins: there is nothing to keep. These are events the reducer reads\n * and *discards*, so a replay that sends them is spending the reader's network\n * on frames whose whole effect is `return base`.\n *\n * Today that is exactly one thing, and it is the second-largest item in a real\n * attach: the `stream_delta`s the reducer does not model. Measured over one\n * 1,270-row session, the delta run was 774 KB, and **~85% of it was frames the\n * reducer throws away** — `input_json_delta` (a tool call's arguments, streamed\n * character by character, 383 KB), `signature_delta` (encrypted-thinking\n * signatures, 153 KB) and the `message_start`/`content_block_start`/`_stop`\n * scaffolding (244 KB). The reducer models two delta kinds, `text_delta` and\n * `thinking_delta`; everything else falls through its switch untouched.\n *\n * What is deliberately **not** dropped, though the arithmetic would allow it:\n *\n * - `thinking_delta` — the Claude SDK delivers thinking blocks whose `thinking`\n *   is `''`, and the reducer backfills them from the accumulated streamed text\n *   (`streamedThinking`). Dropping these erases every thought from a replayed\n *   transcript. This is the same carve-out `snapshotRetains` documents, and it\n *   is the reason that rule is provider-engine-only.\n * - `text_delta` — superseded by the `assistant_message` that follows it, which\n *   filters the streaming id and rebuilds from the full content blocks. It could\n *   go, but only with a lookahead proving the message arrived, and at 24 KB in\n *   the measured session it is not worth a rule that has to be right about\n *   supersession. A merge is likewise not worth it: a *drop* needs no synthesized\n *   event and therefore no invented seq.\n *\n * A live event is never affected — this is about the buffered replay alone — and\n * the caller must never drop the log's highest-seq event whatever this says, for\n * the reason {@link replayCoalesceKey} gives: the replay hold waits for\n * `state.lastSeq` to reach the attach's `session.lastSeq` and would hang on a\n * blank panel forever.\n *\n * The property is the family's usual one and is a test rather than an argument:\n * folding the full log and the retained log through `applyEvent` yields\n * identical state (`packages/react/test/replay-retain.test.ts`).\n */\nexport function replayRetains(body: SessionEventBody): boolean {\n  if (body.type !== 'stream_delta') return true\n  const delta = body.event as { type?: string; delta?: { type?: string } }\n  if (delta.type !== 'content_block_delta') return false\n  return delta.delta?.type === 'text_delta' || delta.delta?.type === 'thinking_delta'\n}\n\n/**\n * Does a `RunnerSnapshot` keep this event in its persisted log?\n *\n * The fourth of the same family, and the same shape of claim as\n * {@link replayCoalesceKey}: which events a *store* may drop without any client\n * being able to tell. It exists because a snapshot embeds the whole event log,\n * and a log is mostly stream deltas — a four-character token rides a ~180-byte\n * JSON envelope, so the delta run is tens of times the size of the text it\n * spells, sitting on disk *beside* the `assistant_message` that respells it in\n * full. That was affordable while a snapshot was written once, at a park. It is\n * not affordable written after every turn, which is what restart-survival needs.\n *\n * So: everything is retained except `stream_delta`. The reason that is safe is\n * not that deltas are unimportant but that they are **superseded by\n * construction**. The reducer upserts them under one constant id and the\n * following `assistant_message` filters exactly that id out and rebuilds from\n * the full content blocks — and a snapshot may only be taken at a rest point,\n * where the stream loop has exited and flushed. Both exits flush, including the\n * error path: an interrupted turn pushes its half-finished buffers into a\n * durable `assistant_message` before it emits the failed `turn_result`. There is\n * no rest state in which a delta is the only record of anything.\n *\n * **Provider engine only**, and this is the carve-out that must not be lost:\n * against a *Claude* log the rule would be wrong. The Claude SDK delivers\n * thinking blocks whose text is `''`, with the human-readable summary existing\n * only in the delta stream, and the reducer carries the streamed text over to\n * fill them (`transcript.ts`, the `streamedThinking` backfill). Dropping deltas\n * there would silently erase every thought from a restored transcript. Today\n * that is unreachable rather than merely avoided — only the provider engine\n * implements `park()`/`snapshot()` at all, and `#restore` refuses a snapshot\n * from another engine — but an engine that gains one inherits this obligation.\n *\n * Two properties hold it up, both of which are tests rather than arguments:\n * folding the full log and the retained log through `applyEvent` yields\n * identical state (`packages/react/test/snapshot-retain.test.ts`, the same\n * property `replay-coalesce.test.ts` asserts), and the retained log's last event\n * still carries the snapshot's own `seq`. The second matters more than it looks:\n * `transcriptActivity(stream_delta)` is 0, so the count `#restore` recomputes\n * from the log is bit-identical — a client's unread cursor cannot move — and the\n * replay hold waits for `state.lastSeq` to reach the attach's `lastSeq`, which a\n * rule that could drop the final event would hang forever.\n */\nexport function snapshotRetains(body: SessionEventBody): boolean {\n  return body.type !== 'stream_delta'\n}\n\n/**\n * A session in an engine's on-disk store (independent of this server's registry):\n * the Agent SDK's session files, or a codex profile's CODEX_HOME threads. Listed\n * so hosts can offer \"resume\" across server restarts: feed `sessionId` to\n * CreateSessionRequest.resume — under a profile of the SAME engine, since the id\n * only means something to the store it came from. `GET {basePath}/sdk-sessions`\n * takes an optional `profile` query parameter naming whose store to list; absent,\n * the profile is resolved implicitly when the server declares exactly one, else\n * the Claude engine's store is listed (the pre-engine-aware behavior). Mirrors\n * the SDK's SDKSessionInfo shape, kept browser-safe.\n */\nexport type SdkSessionSummary = {\n  sessionId: string\n  /** Custom title, auto summary, or first prompt — whichever the SDK has. */\n  summary: string\n  /** Epoch ms of last modification. */\n  lastModified: number\n  createdAt?: number\n  customTitle?: string\n  firstPrompt?: string\n  gitBranch?: string\n  cwd?: string\n}\n\n/** One deliverable in the session's scratch filesystem (see the `file_delivered` event). */\nexport type SessionFileInfo = { path: string; bytes: number }\n/** `GET {basePath}/sessions/:id/files` — every file currently in the session's VFS.\n * `GET {basePath}/sessions/:id/files/<path>` downloads one (attachment disposition).\n * 404 when the session's engine exposes no VFS (Claude-engine sessions). */\nexport type ListSessionFilesResponse = { files: SessionFileInfo[] }\nexport type ListSessionsResponse = { sessions: SessionInfo[] }\nexport type CreateSessionResponse = { session: SessionInfo }\nexport type GetSessionResponse = { session: SessionInfo }\n\n/**\n * Body of `PATCH {basePath}/sessions/:id` — the host-facing edits to a live\n * session. Today that is only its display name: `title` writes `meta.title`,\n * which {@link SessionInfo.title} prefers over the derived one, and `null` (or\n * an empty string) clears the override so the derived title comes back. Nothing\n * here reaches the engine — renaming does not speak to the model.\n *\n * 409 when the session is parked: a parked session has no runner to carry the\n * change, and its snapshot is the host's to rewrite, not this route's.\n */\nexport type UpdateSessionRequest = { title?: string | null }\nexport type UpdateSessionResponse = { session: SessionInfo }\n\n/** Body of `POST {basePath}/sessions/:id/permissions/:requestId` — the REST counterpart\n * of the WS `permission_decision` command, for remote controllers without a socket\n * (e.g. answering a job's AskUserQuestion from a webhook consumer). 404 = the request\n * is unknown, already resolved, or expired. */\nexport type ResolvePermissionRequest =\n  | { behavior: 'allow'; updatedInput?: Record<string, unknown> }\n  | { behavior: 'deny'; message?: string; interrupt?: boolean }\nexport type ResolvePermissionResponse = { resolved: true }\n\n/**\n * Body of `POST {basePath}/executions/:executionId/result` — the way a deferred\n * executor (a remote worker, a batch job, a human) delivers the outcome of an\n * execution the session parked on. The session is rehydrated if its runner was\n * torn down, and the result is folded back into the agent loop; a `failed` result\n * is ordinary tool output the agent adapts to, not a session error.\n *\n * Applied **idempotently by `executionId`**: a duplicate or late delivery (one\n * racing the execution watchdog) answers 200 with `applied: false` rather than\n * erroring or applying twice. 404 means no session is parked on that id.\n */\nexport type SubmitExecutionResultRequest =\n  | { status: 'ok'; output: ToolExecutionOutput; logs?: string[] }\n  | { status: 'failed'; reason: string; error: string; logs?: string[] }\nexport type SubmitExecutionResultResponse = {\n  /** False when the id was already settled — the delivery was a no-op. */\n  applied: boolean\n  /** Session the execution belonged to. */\n  sessionId: string\n}\n\nexport type ListSdkSessionsResponse = { sdkSessions: SdkSessionSummary[] }\n/** `GET {basePath}/profiles` — filtered to the profiles the caller may use. */\nexport type ListProfilesResponse = {\n  profiles: ProfileInfo[]\n  /** Whether this caller may create profiles here — true only when the server has\n   * a profile store AND the principal carries `canManageProfiles`. Lets a UI hide\n   * controls that would always be refused. */\n  canManage?: boolean\n}\n\n/**\n * `POST {basePath}/profiles` — create a managed profile. Available only when the\n * server was given a profile store, and only to a principal with\n * `canManageProfiles`. Profiles declared in server options are code, not data:\n * they cannot be created, edited, or deleted through these routes.\n */\nexport type CreateProfileRequest = ProfileInfo\n\n/** `PATCH {basePath}/profiles/:name` — merge into a managed profile. The name is\n * the route, not the body; pass `null` to clear an optional field. */\nexport type UpdateProfileRequest = Omit<Partial<ProfileInfo>, 'name'>\n\n// ---------------------------------------------------------------------------\n// Host filesystem (`{basePath}/fs/*`)\n// ---------------------------------------------------------------------------\n\n/**\n * The **host's real project tree**, not a session's in-memory VFS — the two are\n * unrelated despite both being \"files\". {@link SessionFileInfo} is a deliverable\n * the agent produced inside a session; these routes read and write the operator's\n * actual disk.\n *\n * That makes them **operator-privileged**: they are authorized by the server's auth\n * key alone and deliberately sit outside the agent permission flow, because the\n * caller *is* the operator, not the model. A client holding the key can already\n * start a session with any allowed cwd; browsing that same tree grants it nothing\n * new. Writing does, which is why writes are separately enabled server-side.\n *\n * The whole surface is opt-in and root-scoped: with no roots configured every route\n * below 404s. There is no \"unset means anything\" default here — a phone on a tailnet\n * must never be one request away from `~/.ssh`.\n */\nexport type HostFileRoot = {\n  /** Absolute, canonical (symlinks resolved) path of the root. */\n  path: string\n  /** Last path segment, for display — roots are not named by the operator. */\n  name: string\n}\n\n/** `GET {basePath}/fs/roots` — where a client may start browsing. Empty `roots`\n * never happens: the routes are absent entirely when none are configured. */\nexport type ListHostRootsResponse = {\n  roots: HostFileRoot[]\n  /** Whether `PUT /fs/write` is enabled here; lets a UI hide an editor it can't save from. */\n  canWrite: boolean\n}\n\n/** One entry in a host directory listing. Classified with `lstat` semantics, so a\n * `symlink` is reported as itself and never silently resolved — following it is the\n * *next* request's problem, and that request is refused if it escapes the roots. */\nexport type HostDirEntry = {\n  name: string\n  /** Absolute path, ready to pass back as `?path=`. */\n  path: string\n  type: 'file' | 'dir' | 'symlink' | 'other'\n  /** Regular files only. */\n  bytes?: number\n  /** Epoch ms mtime. */\n  modifiedAt?: number\n}\n\n/** `GET {basePath}/fs/list?path=<abs>` — one directory, not recursive. */\nexport type ListHostDirResponse = {\n  /** Canonical path actually listed (the request's path after symlink resolution). */\n  path: string\n  /** Directories first, then files, each alphabetical. */\n  entries: HostDirEntry[]\n  /** Set when the directory held more entries than the server will return. */\n  truncated?: boolean\n}\n\n/** One hit from `GET {basePath}/fs/find`. */\nexport type HostFileMatch = {\n  /** Absolute path, for a follow-up read. */\n  path: string\n  /** Path relative to the searched directory — what a picker shows and inserts. */\n  relative: string\n}\n\n/**\n * `GET {basePath}/fs/find?path=<dir>&q=<query>&limit=<n>` — recursive fuzzy file\n * search under one directory, which is what an `@file` picker needs and\n * `/fs/list` is not: listing answers \"what is in this directory\", this answers\n * \"which file in this tree did you mean\".\n *\n * Subsequence matching (`seslist` finds `SessionListView.swift`), filename hits\n * ranked above path hits, shallow files above deep ones. An empty `q` returns the\n * shallowest files. Build directories (`.git`, `node_modules`, …) are skipped, as\n * is anything behind a symlink — so every path returned is one `/fs/read` will\n * accept.\n */\nexport type FindHostFilesResponse = {\n  /** Canonical directory the search ran under; `relative` paths are relative to it. */\n  base: string\n  matches: HostFileMatch[]\n  /** More matched, or the tree was larger than the server would walk. */\n  truncated: boolean\n}\n\n/** `GET {basePath}/fs/read?path=<abs>` — one file's contents. Binary files come back\n * base64; 413 rather than a truncated read when the file exceeds the server's cap. */\nexport type ReadHostFileResponse = {\n  path: string\n  content: string\n  encoding: 'utf8' | 'base64'\n  bytes: number\n  /** sha256 (hex) of the bytes on disk. Pass it back as `expectedHash` to write. */\n  hash: string\n  modifiedAt: number\n}\n\n/**\n * `PUT {basePath}/fs/write` — replace or create one file.\n *\n * The agent is editing this same tree, so a write is **conditional, always**:\n * `expectedHash` must be the hash from the read this edit is based on, and the\n * server 409s if the file has changed since. Omitting it means \"create\" and 409s\n * if the path already exists — there is no unconditional overwrite, by design.\n * Directories are never created implicitly: writing under a missing parent is a 404.\n */\nexport type WriteHostFileRequest = {\n  path: string\n  content: string\n  /** Default 'utf8'. */\n  encoding?: 'utf8' | 'base64'\n  /** Required to overwrite; omit only to create a new file. */\n  expectedHash?: string\n}\n\nexport type WriteHostFileResponse = {\n  path: string\n  bytes: number\n  /** Hash of what was just written — carry it into the next edit. */\n  hash: string\n  modifiedAt: number\n}\n\nexport type SaveProfileResponse = { profile: ProfileInfo }\n/** `GET {basePath}/profiles/:name` — the profile plus a fresh config snapshot. */\nexport type GetProfileResponse = { profile: ProfileInfo; config: ProfileConfigSnapshot }\nexport type ErrorResponse = { error: string }\n\n// ---------------------------------------------------------------------------\n// Session notifications (the out-of-band \"something wants you\" channel)\n// ---------------------------------------------------------------------------\n\n/**\n * The moments in an *interactive* session a person needs to hear about when they\n * are not watching it — the whole point being that a phone cannot hold a\n * WebSocket open in the background, so the server has to reach out.\n *\n * Deliberately four: this is a human-attention channel, not an event mirror. The\n * event log stays on the session WS (attach with `afterSeq` to catch up); if you\n * want every assistant message, subscribe there instead.\n */\nexport type SessionNotificationType =\n  /** The agent is blocked on an approval — the one that matters most. */\n  | 'permission_requested'\n  /** A turn finished; the session is idle and waiting for the human. */\n  | 'turn_completed'\n  /** The session failed (`session_error`). */\n  | 'session_error'\n  /** The session ended (`session_closed`), whoever ended it. */\n  | 'session_closed'\n\n/** One delivery on the session-notification channel (JSON body of a webhook POST). */\nexport type SessionNotification = {\n  type: SessionNotificationType\n  sessionId: string\n  /** Snapshot at notification time — status, title, cwd, cost, `lastSeq`. */\n  session: SessionInfo\n  /** Seq of the event behind this notification; attach with `afterSeq: seq - 1` to\n   * land on it. */\n  seq: number\n  ts: number\n  /** One line fit for a notification body: the permission title, the turn's final\n   * text, the error message. */\n  preview?: string\n  /** `permission_requested` only: the full request, so a consumer can answer it via\n   * `POST {basePath}/sessions/:id/permissions/:requestId` — which is what makes an\n   * Approve/Deny action on a lock-screen notification possible. */\n  request?: PermissionRequest\n  /** `turn_completed` only. */\n  result?: { isError: boolean; durationMs: number; numTurns: number; totalCostUsd: number }\n  /** `session_closed` only. */\n  reason?: 'client' | 'server' | 'error'\n}\n\n/** Where session notifications are POSTed (JSON body = {@link SessionNotification}).\n * Server-wide, not per session: the point is to hear about sessions you did not\n * create yourself and are not attached to. */\nexport type SessionWebhookConfig = {\n  url: string\n  /** Extra headers sent with every delivery (auth tokens etc.). */\n  headers?: Record<string, string>\n  /** Types to deliver. Default: all of them. */\n  events?: SessionNotificationType[]\n}\n\n// ---------------------------------------------------------------------------\n// Job queue (one-shot scheduled runs over the session runner)\n// ---------------------------------------------------------------------------\n\n/**\n * - `queued` — accepted, waiting for a concurrency slot (or the daily token budget)\n * - `running` — a session is executing the prompt\n * - `parked` — waiting on an external event (a deferred tool execution). Not\n *   terminal and not consuming a concurrency slot; resumes to `running` when the\n *   result arrives, or fails via the execution watchdog if it never does.\n * - `succeeded` / `failed` — terminal; `result` (and `error` on failure) are set\n * - `canceled` — terminal; canceled by a client before or during the run\n */\nexport type JobStatus = 'queued' | 'running' | 'parked' | 'succeeded' | 'failed' | 'canceled'\n\n/** Where job progress/completion deliveries are POSTed (JSON body = {@link JobEvent}). */\nexport type WebhookConfig = {\n  url: string\n  /** Extra headers sent with every delivery (auth tokens etc.). */\n  headers?: Record<string, string>\n  /** Delivery granularity: 'messages' also POSTs job_progress per assistant message /\n   * permission request; 'completion' only job_started + job_completed. Default 'messages'. */\n  progress?: 'messages' | 'completion'\n}\n\n/**\n * Schedule a one-shot run: the session executes `prompt` unattended and the job\n * completes with that run's result. `session.prompt` is the task and is required;\n * `resume`/`forkSession` are not supported for queued jobs.\n */\nexport type CreateJobRequest = {\n  session: CreateSessionRequest & { prompt: string }\n  webhook?: WebhookConfig\n  /** Per-job token cap; the effective cap is min(this, the server's sessionTokenLimit). */\n  maxTokens?: number\n  /** Per-job wall-clock cap; the effective cap is min(this, the server's maxJobDurationMs). */\n  maxDurationMs?: number\n  /** Total run attempts: failed (not canceled) runs re-queue until this many attempts\n   * have been made. Default 1 (no retries). */\n  attempts?: number\n  /** Delay before the first retry, doubled for each subsequent one. Default 5000. */\n  retryDelayMs?: number\n  /** Host bookkeeping echoed back on JobInfo. */\n  meta?: Record<string, unknown>\n}\n\n/** Cumulative resource usage of a job's run. `tokens` counts input + output +\n * cache-creation + cache-read tokens across all turns. */\nexport type JobUsage = {\n  tokens: number\n  totalCostUsd: number\n  numTurns: number\n}\n\n/** Terminal outcome of the job's run (mirrors the final turn_result). */\nexport type JobResult = {\n  subtype: string\n  isError: boolean\n  /** Final text of the run (success only). */\n  result?: string\n  errors?: string[]\n  durationMs: number\n}\n\nexport type JobInfo = {\n  id: string\n  status: JobStatus\n  /** `''` when the run's engine has no host filesystem (see\n   * {@link CreateSessionRequest.cwd}). */\n  cwd: string\n  /** Profile the run executes under (resolved name, present even when implicit). */\n  profile?: string\n  prompt: string\n  /** Server session id once started — attach via the sessions WS to watch the run live. */\n  sessionId?: string\n  sdkSessionId?: string\n  createdAt: number\n  startedAt?: number\n  finishedAt?: number\n  /** 1-based run attempt this info reflects. */\n  attempt?: number\n  /** Total attempts configured on the request (see CreateJobRequest.attempts). */\n  maxAttempts?: number\n  /** For a job re-queued by retry backoff: earliest time the next attempt may start. */\n  nextRunAt?: number\n  /** Set while `status` is 'parked': when the run parked, and the execution it is\n   * waiting on — the id to POST a result to. Cleared when it resumes. */\n  parkedAt?: number\n  parkedExecutionId?: string\n  /** Cumulative across attempts. */\n  usage: JobUsage\n  result?: JobResult\n  /** Failure or cancellation reason (for a queued retry: the previous attempt's error). */\n  error?: string\n  meta?: Record<string, unknown>\n  /** Scope tags of the session this job runs (see\n   * {@link CreateSessionRequest.scope}) — copied from the request at submit so\n   * the job routes can be gated by the same rule as the session routes. Without\n   * it the queue would be a side door into an unscoped session. */\n  scope?: Record<string, string>\n}\n\n/** Latest mid-run activity, carried on job_progress deliveries. */\nexport type JobProgress = {\n  kind: 'assistant_text' | 'tool_use' | 'permission_requested' | 'permission_resolved'\n  /** Short human-readable preview (message excerpt, tool name, permission title). */\n  preview?: string\n  /** 'permission_requested' only: the full request (including AskUserQuestion input) so\n   * webhook consumers can answer via POST /sessions/:sessionId/permissions/:requestId. */\n  request?: PermissionRequest\n}\n\n/** Webhook delivery payload (also the queue's local event shape). `job_submitted` goes\n * to local observers and the queue WS only — the submitter already has the POST\n * response, so webhooks start at `job_started`. `job_retrying` marks a failed run that\n * was re-queued (`job.nextRunAt` says when); `job_completed` is always terminal. */\nexport type JobEvent =\n  | { type: 'job_submitted'; job: JobInfo; ts: number }\n  | { type: 'job_started'; job: JobInfo; ts: number }\n  | { type: 'job_progress'; job: JobInfo; progress: JobProgress; ts: number }\n  /** The run parked on a deferred execution; `executionId` says what it waits on —\n   * the id to POST a result to. The *work itself* (tool name, input, VFS seed) went\n   * to the executor's own dispatch hook, not over this channel: a webhook consumer\n   * learns that a run is waiting, the worker learns what to do. */\n  | { type: 'job_parked'; job: JobInfo; executionId: string; ts: number }\n  /** A parked run resumed because its execution result arrived. */\n  | { type: 'job_resumed'; job: JobInfo; executionId: string; ts: number }\n  | { type: 'job_retrying'; job: JobInfo; ts: number }\n  | { type: 'job_completed'; job: JobInfo; ts: number }\n\nexport type QueueStats = {\n  maxConcurrency: number\n  running: number\n  queued: number\n  /** Jobs waiting on a deferred execution. They hold no concurrency slot and\n   * their wall-clock budget is not ticking. */\n  parked: number\n  sessionTokenLimit?: number\n  dailyTokenLimit?: number\n  /** Tokens consumed by queue jobs in the current UTC day. */\n  dailyTokensUsed: number\n  /** True when the daily budget is exhausted and queued jobs are being held. */\n  paused: boolean\n}\n\n/** Frames sent on the queue WS (`{basePath}/queue/ws`). The stream is one-way\n * (server→client): every job's lifecycle as it happens, plus refreshed stats after\n * lifecycle changes. Clients send nothing; job mutations stay on REST. */\nexport type QueueServerFrame =\n  | { type: 'queue_attached'; protocolVersion: number; stats: QueueStats }\n  | { type: 'job_event'; event: JobEvent }\n  | { type: 'queue_stats'; stats: QueueStats }\n\nexport type CreateJobResponse = { job: JobInfo }\nexport type GetJobResponse = { job: JobInfo }\nexport type ListJobsResponse = { jobs: JobInfo[] }\nexport type QueueStatsResponse = { stats: QueueStats }\n\nexport * from './session-list.ts'\nexport * from './usage.ts'\nexport * from './watermarks.ts'\n"],"mappings":";AAsBA,MAAa,cAAuC;CAAC;CAAa;CAAW;CAAQ;CAAQ;AAE7F,MAAa,eAA6C;CACxD,WAAW;CACX,SAAS;CACT,MAAM;CACN,OAAO;CACR;AAED,SAAgB,aAAa,MAAiC;AAG5D,KAAI,KAAK,yBAAyB,KAAK,KAAK,WAAW,oBAAqB,QAAO;AAKnF,KAAI,KAAK,WAAW,YAAY,KAAK,WAAW,SAAU,QAAO;AACjE,KAAI,KAAK,WAAW,aAAa,KAAK,WAAW,WAAY,QAAO;AAMpE,KAAI,iBAAiB,KAAK,CAAC,SAAS,EAAG,QAAO;AAC9C,QAAO;;;;;;;;;;;;;;;AAgBT,SAAgB,iBAAiB,MAAmC;AAClE,SAAQ,KAAK,aAAa,EAAE,EAAE,QAAQ,QAAQ,IAAI,WAAW,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BzE,SAAgB,cAAc,KAA4B;AACxD,SAAQ,IAAI,WAAW,MAAM,IAAI,QAAQ;;AAG3C,SAAgB,cAAc,KAA2B;CACvD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,MAAM,cAAc,IAAI,aAAa,MAAM;AAC3C,KAAI,SAAS,YAAa,QAAO,GAAG,MAAM,KAAK;AAC/C,QAAO,SAAS,eAAe;;AAgCjC,MAAa,sBAAkC;CAC7C,QAAQ;CACR,UAAU,EAAE;CACZ,UAAU,EAAE;CACZ,QAAQ,EAAE;CACV,UAAU,EAAE;CACZ,QAAQ;CACR,SAAS;CACT,QAAQ;CACT;;;AAiCD,SAAgB,WAAW,MAAuC;AAChE,QAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM;;;;;;;;;;;;;AAcxD,SAAgB,WAAW,MAA+D;CACxF,MAAM,wBAAQ,IAAI,KAAqB;AACvC,MAAK,MAAM,OAAO,KAAM,OAAM,IAAI,WAAW,IAAI,EAAE,aAAa,IAAI,CAAC;AACrE,QAAO,CAAC,GAAG,MAAM,CACd,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK;EAAO,EAAE,CACvC,MAAM,GAAG,MAAM,EAAE,MAAM,aAAa,CAAC,cAAc,EAAE,MAAM,aAAa,CAAC,CAAC;;AAG/E,SAAgB,aAAa,MAA2B;AACtD,QAAO,KAAK,SAAS,KAAK,GAAG,MAAM,GAAG,EAAE;;;;;;;;;;;;;;;;AAiB1C,SAAgB,WAAW,KAAyB;AAClD,QAAO,GAAG,IAAI,OAAO,GAAG,cAAc,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,IAAI;;;;;;;;;;;;;;;AAgB/E,SAAgB,aAAa,KAAuC;CAClE,MAAM,OAAO,IAAI,KAAK,SAAS;AAC/B,KAAI,KAAM,QAAO;CACjB,MAAM,MAAM,cAAc,IAAI,KAAK,IAAI;AACvC,QAAO,IAAI,MAAM,IAAI,YAAY,IAAI,GAAG,EAAE,IAAI;;;;;;;;;;;;;;;;;;AAmBhD,SAAgB,eAAe,KAAmD;CAChF,MAAM,OAAO,IAAI,KAAK,SAAS;AAC/B,KAAI,SAAS,KAAA,KAAa,CAAC,IAAI,KAAK,IAAK,QAAO,KAAA;CAChD,MAAM,OAAO,cAAc,KAAK;CAChC,MAAM,MAAM,cAAc,IAAI,KAAK,IAAI;AACvC,KAAI,QAAQ,KAAM,QAAO,KAAA;AAEzB,KAAI,CAAC,IAAI,WAAW,GAAG,KAAK,GAAG,CAAE,QAAO,KAAA;AACxC,QAAO,IAAI,MAAM,KAAK,SAAS,EAAE,IAAI,KAAA;;;;;;;;;;;;AAavC,SAAgB,SAAS,MAA4B;AACnD,QAAO,OAAO,KAAK,MAAM,UAAU;;AAGrC,SAAS,cAAc,KAAiB,QAAyB;AAC/D,KAAI,CAAC,OAAQ,QAAO;AACpB,QACE,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,SAAS,OAAO,IACrD,IAAI,KAAK,IAAI,aAAa,CAAC,SAAS,OAAO,KAG1C,IAAI,KAAK,SAAS,KAAK,aAAa,CAAC,SAAS,OAAO,IAAI,UAC1D,IAAI,SAAS,aAAa,CAAC,SAAS,OAAO,IAC3C,IAAI,QAAQ,aAAa,CAAC,SAAS,OAAO,IAC1C,IAAI,KAAK,GAAG,WAAW,OAAO;;;;AAMlC,SAAS,cAAc,MAAsB;AAC3C,QAAO,KAAK,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;;AAGrD,SAAS,SAAS,MAAc,MAAuB;CACrD,MAAM,OAAO,cAAc,KAAK;CAChC,MAAM,MAAM,cAAc,KAAK;AAE/B,QAAO,QAAQ,QAAQ,IAAI,WAAW,GAAG,KAAK,GAAG;;;;;;;;AASnD,SAAgB,QAAQ,KAAiB,OAAgC;AACvE,QAAO,MAAM,MAAM,MAChB,UACE,KAAK,SAAS,KAAK,OAAO,aAAa,KAAK,IAAI,OAAO,aAAa,GAAG,IAAI,UAC5E,SAAS,KAAK,MAAM,IAAI,KAAK,IAAI,CACpC;;;;AAKH,SAAgB,YAAY,QAAoB,OAA4C;AAC1F,QAAO,OAAO,UAAU,UAAU,KAAA;;AAGpC,SAAgB,WACd,MACA,QACA,OACc;CACd,MAAM,SAAS,OAAO,OAAO,MAAM,CAAC,aAAa;CACjD,MAAM,UAAU,YAAY,QAAQ,MAAM,GAAG,QAAQ,KAAA;AACrD,QAAO,KAAK,QACT,SACE,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,IAAI,OAAO,MACpE,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,IAAI,QAAQ,MACrE,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,IAAI,MAAM,MAG/D,CAAC,OAAO,UAAU,UAAU,OAAO,SAAS,SAAS,WAAW,IAAI,CAAC,MACrE,CAAC,WAAW,QAAQ,KAAK,QAAQ,KAClC,cAAc,KAAK,OAAO,CAC7B;;AAGH,SAAS,SAAS,KAAiB,OAAsB;AACvD,QAAO,UAAU,YACb,IAAI,SACJ,UAAU,YACR,IAAI,UACJ,UAAU,YACR,WAAW,IAAI,GACf,IAAI;;AAGd,SAAS,WAAW,KAAiB,OAAsB;AACzD,QAAO,UAAU,YACb,IAAI,WACJ,UAAU,YACR,IAAI,UACJ,UAAU,YACR,aAAa,IAAI,GACjB,aAAa,IAAI;;;;AAK3B,SAAS,UAAU,KAAiB,OAAsB;AACxD,KAAI,UAAU,QAAS,QAAO,OAAO,YAAY,QAAQ,IAAI,MAAM,CAAC;AACpE,QAAO,WAAW,KAAK,MAAM,CAAC,aAAa;;AAG7C,MAAM,aAAa,GAAe,OAC/B,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,KAAK;AAEjF,SAAS,QAAQ,GAAe,GAAe,QAAwB;AACrE,KAAI,WAAW,SAAU,QAAO,UAAU,GAAG,EAAE;AAC/C,KAAI,WAAW,OACb,QACE,aAAa,EAAE,KAAK,CAAC,cAAc,aAAa,EAAE,KAAK,EAAE,KAAA,GAAW,EAClE,aAAa,QACd,CAAC,IAAI,UAAU,GAAG,EAAE;AAGzB,QAAO,UAAU,GAAG,OAAO,CAAC,cAAc,UAAU,GAAG,OAAO,CAAC,IAAI,UAAU,GAAG,EAAE;;;;;;;;AASpF,SAAgB,UAAU,MAA6B,QAAoC;CACzF,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;AACrE,KAAI,OAAO,YAAY,OAAQ,QAAO,OAAO,SAAS,CAAC;EAAE,KAAK;EAAO,MAAM;EAAQ,CAAC,GAAG,EAAE;CACzF,MAAM,QAAQ,OAAO;CACrB,MAAM,yBAAS,IAAI,KAA8C;AACjE,MAAK,MAAM,OAAO,QAAQ;EACxB,MAAM,MAAM,SAAS,KAAK,MAAM;EAChC,MAAM,QAAQ,OAAO,IAAI,IAAI;AAC7B,MAAI,MAAO,OAAM,KAAK,KAAK,IAAI;MAE7B,QAAO,IAAI,KAAK;GACd;GACA,OAAO,WAAW,KAAK,MAAM;GAC7B,MAAM,UAAU,KAAK,MAAM;GAC3B,MAAM,CAAC,IAAI;GACZ,CAAC;;AAGN,QAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;;AAkB1E,SAAgB,cACd,QACA,OACA,OACA,OAC2B;AAC3B,KAAI,SAAS,MAAO,QAAO,KAAA;CAC3B,MAAM,SAAmB,EAAE;AAC3B,KAAI,SAAS,YAAY,QAAQ,MAAM,CAAE,QAAO,KAAK,MAAM,MAAM;CAGjE,MAAM,UACH,OAAO,SAAS,SAAS,IAAI,MAC7B,OAAO,SAAS,SAAS,IAAI,MAC7B,OAAO,OAAO,SAAS,IAAI,MAC3B,OAAO,UAAU,SAAS,IAAI;AACjC,KAAI,SAAS,EAAG,QAAO,KAAK,GAAG,OAAO,SAAS,WAAW,IAAI,KAAK,MAAM;AACzE,KAAI,OAAO,OAAO,MAAM,CAAE,QAAO,KAAK,SAAS;AAC/C,QAAO;EAAE;EAAO;EAAO;EAAQ;;;;;;;;;;AAWjC,SAAgB,eAAe,QAA6B;AAC1D,QACE,OAAO,OAAO,MAAM,CAAC,SAAS,KAC9B,OAAO,SAAS,SAAS,KACzB,OAAO,SAAS,SAAS,KACzB,OAAO,OAAO,SAAS,MACtB,OAAO,UAAU,UAAU,KAAK;;;;AAMrC,SAAgB,aAAa,QAAgC;AAC3D,QAAO;EACL,GAAG;EACH,QAAQ;EACR,SAAS,OAAO;EAChB,QAAQ,OAAO;EAChB;;;;;;;;;;;;;;;;;;;;;;;;;;ACvbH,SAAgB,WAAW,SAAuB,SAAiD;CACjG,MAAM,MAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,QAAQ,cAAc,EAAE,CAAC,CAChE,KAAI,OAAO;EAAE;EAAM,WAAW,QAAQ,aAAa;EAAG;AAExD,MAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,WAAW,EAAE,CAAC,CAAE,KAAI,OAAO;AACtE,QAAO;;;;;;;;;;;;;;;;;AA4BT,SAAgB,kBAAkB,OAAmD;CACnF,MAAM,MAAM,OAAO,QAAQ,SAAS,EAAE,CAAC,CACpC,QAAQ,GAAG,OAAO,EAAE,KAAK,gBAAgB,KAAA,EAAU,CACnD,KAAK,CAAC,KAAK,QAAQ;EAAE;EAAK,MAAM,EAAE;EAAM,WAAW,EAAE;EAAW,eAAe,EAAE;EAAe,EAAE;CACrG,MAAM,QAAQ,CAAC,aAAa,YAAY,CAAC,SAAS,QAAQ,IAAI,QAAQ,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3F,MAAM,WAAW,IACd,QAAQ,MAAM,EAAE,IAAI,WAAW,aAAa,CAAC,CAC7C,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,IAAI,CAAC;AAC7C,QAAO,CAAC,GAAG,OAAO,GAAG,SAAS;;;;;AAMhC,SAAgB,WACd,OAC2C;AAC3C,KAAI,CAAC,MAAO,QAAO,KAAA;CACnB,MAAM,MAAqC,EAAE;AAC7C,MAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,MAAM,CAAE,KAAI,OAAO,OAAO;AACrE,QAAO;;;;;;ACrDT,MAAM,aAAa,MAAU,KAAK,KAAK;;AAGvC,MAAM,WAAW;AAEjB,MAAa,gBAAgB,QAAgB,cAAsB,GAAG,OAAO,GAAG;AAEhF,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,OAAuB;AACjC,QAAA,QAAc;AACd,QAAA,QAAc,EAAE,GAAG,MAAM,MAAM,EAAE;;CAGnC,IAAI,QAAgB,WAA0C;AAC5D,SAAO,MAAA,MAAY,aAAa,QAAQ,UAAU;;;CAIpD,MAA2C;AACzC,SAAO,MAAA;;;;;;;;;;;;CAaT,KACE,QACA,WACA,MACA,MAAM,KAAK,KAAK,EACP;EACT,MAAM,KAAK,aAAa,QAAQ,UAAU;EAC1C,MAAM,WAAW,MAAA,MAAY;EAC7B,MAAM,OAAkB;GACtB,WAAW,KAAK,IAAI,UAAU,aAAa,GAAG,KAAK,aAAa,EAAE;GAClE,UAAU,KAAK,IAAI,UAAU,YAAY,GAAG,KAAK,YAAY,EAAE;GAC/D,OAAO,KAAK,IAAI,UAAU,SAAS,GAAG,KAAK,SAAS,EAAE;GACtD,QAAQ;GACT;AACD,MACE,YACA,SAAS,cAAc,KAAK,aAC5B,SAAS,aAAa,KAAK,YAC3B,SAAS,UAAU,KAAK,SAGxB,KAAK,SAAS,SAAS,SAAS,SAEhC,QAAO;AAET,QAAA,MAAY,MAAM;AAClB,QAAA,MAAY,MAAM,MAAA,MAAY,IAAI,CAAC;AACnC,SAAO;;;CAIT,OAAO,QAAgB,WAAyB;EAC9C,MAAM,KAAK,aAAa,QAAQ,UAAU;AAC1C,MAAI,EAAE,MAAM,MAAA,OAAc;AAC1B,SAAO,MAAA,MAAY;AACnB,QAAA,MAAY,MAAM,MAAA,MAAY;;CAGhC,OAAO,KAAwC;EAC7C,MAAM,SAAS,MAAM;AACrB,OAAK,MAAM,CAAC,IAAI,SAAS,OAAO,QAAQ,MAAA,MAAY,CAClD,KAAI,KAAK,SAAS,OAAQ,QAAO,MAAA,MAAY;AAE/C,SAAO,MAAA;;;;;;;;;;;;;;;AAgBX,SAAgB,YACd,MACA,MACQ;AACR,KAAI,CAAC,KAAM,QAAO;AAClB,KAAI,KAAK,kBAAkB,KAAA,EAAW,QAAO,KAAK,IAAI,GAAG,KAAK,gBAAgB,KAAK,SAAS;AAC5F,QAAO,KAAK,IAAI,IAAI,KAAK,SAAS,KAAK,KAAK,MAAM;;;;;;;;;;;;;;;AChIpD,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;AA4FhC,MAAa,yBAAyB;;AA6DtC,SAAS,YAAY,MAAsB;CACzC,MAAM,UAAU,KAAK,SAAS,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,GAAG,IAAI;AACnE,QAAO,KAAK,IAAI,GAAG,KAAK,MAAO,KAAK,SAAS,IAAK,EAAE,GAAG,QAAQ;;;;;;;;;;;;;;;;;AAkBjE,SAAgB,aACd,MACA,OAC0B;AAC1B,KAAI,KAAK,SAAS,QAAS,QAAO,KAAA;CAClC,MAAM,SAAS,KAAK;AACpB,KAAI,CAAC,UAAU,OAAO,SAAS,YAAY,OAAO,OAAO,SAAS,SAAU,QAAO,KAAA;AACnF,QAAO;EACL,MAAM;EACN,YACE,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;EAC9D,OAAO,YAAY,OAAO,KAAK;EAC/B,YAAY;EACb;;;;;;;;;;AAwyBH,MAAa,sBAAiE;CAC5E,QAAQ;EACN,sBAAsB;EACtB,iBAAiB;GAAC;GAAW;GAAe;GAAqB;GAAQ;GAAW;GAAO;EAC3F,uBAAuB;EACvB,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,YAAY;EACZ,WAAW;EACX,kBAAkB;EAClB,mBAAmB;EACnB,eAAe;EAIf,cAAc;EAKd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;GAAC;GAAS;GAAO;GAAO;EAGrC,kBAAkB;GAAC;GAAO;GAAU;GAAQ;GAAS;GAAM;EAC3D,KAAK;EACL,SAAS;EACT,WAAW;EACZ;CACD,OAAO;EAUL,sBAAsB;EAgBtB,iBAAiB;GAAC;GAAW;GAAe;GAAqB;GAAO;EACxE,uBAAuB;EACvB,QAAQ;EAKR,gBAAgB;EAGhB,cAAc;EAId,cAAc;EAId,YAAY;EAKZ,WAAW;EAMX,kBAAkB;EAElB,mBAAmB;EAInB,eAAe;EAOf,cAAc;EAKd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EAGT,aAAa,CAAC,SAAS,OAAO;EAG9B,kBAAkB;GAAC;GAAW;GAAO;GAAU;GAAQ;GAAQ;EAC/D,KAAK;EACL,SAAS;EAET,WAAW;EACZ;CACD,UAAU;EACR,sBAAsB;EACtB,iBAAiB;GAAC;GAAW;GAAqB;GAAU;EAC5D,uBAAuB;EACvB,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,YAAY;EAMZ,WAAW;EACX,kBAAkB;EAClB,mBAAmB;EACnB,eAAe;EAGf,cAAc;EACd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;GAAC;GAAS;GAAO;GAAO;EACrC,KAAK;EAKL,SAAS;EACT,WAAW;EACZ;CACF;;;;;;AAOD,MAAa,4BACX,oBAAoB,SAAS;;;;;;AAO/B,SAAgB,uBACd,QACA,MACS;AACT,QAAO,oBAAoB,UAAU,UAAU,gBAAgB,SAAS,KAAK;;;;;;;AA4X/E,MAAa,mBAAmB;;;;;;;;;;;;;AA0OhC,SAAgB,eAAe,MAAoD;AACjF,KAAI,KAAK,SAAS,gBAAiB,QAAO,KAAA;CAC1C,MAAM,EAAE,aAAa,WAAW,eAAe,KAAK;AACpD,QAAO;EAAE;EAAa;EAAW;EAAY;;;;;;;;;;;;;;;;;AAkB/C,SAAgB,mBAAmB,MAAgC;AAQjE,KAAI,qBAAqB,QAAQ,KAAK,mBAAmB,KAAM,QAAO;AACtE,SAAQ,KAAK,MAAb;EACE,KAAK,qBAAqB;GACxB,MAAM,UAAU,KAAK,QAAQ;AAG7B,OAAI,OAAO,YAAY,SAAU,QAAO,QAAQ,MAAM,KAAK,KAAK,IAAI;AAIpE,UAHa,QAAQ,QAClB,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS,cAAc,MAAM,SAAS,WACjF,CAAC;;EAGJ,KAAK,eAEH,QAAO,KAAK,YAAY,IAAI;EAC9B,KAAK;EACL,KAAK;EACL,KAAK,gBACH,QAAO;EACT,QACE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCb,SAAgB,kBAAkB,MAAiC;AACjE,SAAQ,KAAK,MAAb;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,qBACH,QAAO;EACT,QACE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDb,SAAgB,kBAAkB,MAA4C;AAC5E,SAAQ,KAAK,MAAb;EACE,KAAK,gBACH,QAAO;EACT,KAAK,aAGH,QAAO,KAAK,KAAK,gBAAgB,cAAc,KAAK,KAAK,kBAAkB,KAAA;EAC7E,KAAK,iBAKH,QAAO;EACT,KAAK,YAcH,QAAO,KAAK,QAAQ,SAAS,YAAY,KAAK,QAAQ,YAAY,WAC9D,4BACA,KAAA;EACN,QACE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CN,SAAgB,cAAc,MAAiC;AAC7D,KAAI,KAAK,SAAS,eAAgB,QAAO;CACzC,MAAM,QAAQ,KAAK;AACnB,KAAI,MAAM,SAAS,sBAAuB,QAAO;AACjD,QAAO,MAAM,OAAO,SAAS,gBAAgB,MAAM,OAAO,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CrE,SAAgB,gBAAgB,MAAiC;AAC/D,QAAO,KAAK,SAAS"}
+{"version":3,"file":"index.mjs","names":["#store","#cache","#prune"],"sources":["../src/session-list.ts","../src/usage.ts","../src/watermarks.ts","../src/index.ts"],"sourcesContent":["import type { SessionInfo, SubagentInfo } from './index.ts'\n\nexport type SessionState = 'attention' | 'working' | 'idle' | 'ended'\n\nexport const STATE_ORDER: readonly SessionState[] = ['attention', 'working', 'idle', 'ended']\n\nexport const STATE_LABELS: Record<SessionState, string> = {\n  attention: 'Needs attention',\n  working: 'Working',\n  idle: 'Idle',\n  ended: 'Ended',\n}\n\nexport function sessionState(info: SessionInfo): SessionState {\n  if (info.pendingPermissionCount > 0 || info.status === 'awaiting_approval') {\n    return 'attention'\n  }\n  if (info.status === 'failed' || info.status === 'closed') {\n    return 'ended'\n  }\n  if (info.status === 'running' || info.status === 'starting') {\n    return 'working'\n  }\n  if (runningSubagents(info).length > 0) {\n    return 'working'\n  }\n  return 'idle'\n}\n\nexport function runningSubagents(info: SessionInfo): SubagentInfo[] {\n  return (info.subagents ?? []).filter((sub) => sub.status === 'running')\n}\n\nexport function isAgentRecord(sub: SubagentInfo): boolean {\n  return (sub.agentType?.trim() ?? '') !== ''\n}\n\nexport function subagentLabel(sub: SubagentInfo): string {\n  const agent = sub.agentType?.trim()\n  const description = sub.description?.trim()\n  if (agent && description) {\n    return `${agent} · ${description}`\n  }\n  return agent || description || 'Sub-agent'\n}\n\nexport type Facet = 'gateway' | 'adapter' | 'state' | 'project'\nexport type GroupBy = 'none' | Facet\nexport type SortBy = 'recent' | 'name' | Facet\n\nexport type ViewConfig = {\n  search: string\n  gateways: string[]\n  adapters: string[]\n  states: SessionState[]\n  projects?: string[]\n  scoped: boolean\n  groupBy: GroupBy\n  sortBy: SortBy\n}\n\nexport const DEFAULT_VIEW_CONFIG: ViewConfig = {\n  search: '',\n  gateways: [],\n  adapters: [],\n  states: [],\n  projects: [],\n  scoped: true,\n  groupBy: 'state',\n  sortBy: 'recent',\n}\n\nexport type ScopeRoot = { hostId?: string; path: string }\n\nexport type WorkspaceScope = { label: string; roots: ScopeRoot[] }\n\nexport type SessionRow = {\n  hostId: string\n  hostName: string\n  local: boolean\n  adapter: string\n  state: SessionState\n  info: SessionInfo\n  /**\n   * Messages this client has not read — `unseenCount` against its watermark, so the\n   * unit is prose (`SessionInfo.proseCount`) wherever the gateway reports it. A session\n   * that is only running tools contributes 0: the badge answers \"is there something to\n   * read\", not \"is anything happening\", which is what `state` is for.\n   */\n  unseen: number\n}\n\nexport type SessionGroup = { key: string; label?: string; rows: SessionRow[] }\n\nexport function adaptersOf(rows: readonly SessionRow[]): string[] {\n  return [...new Set(rows.map((r) => r.adapter))].sort()\n}\n\nexport function projectsOf(rows: readonly SessionRow[]): { key: string; label: string }[] {\n  const byKey = new Map<string, string>()\n  for (const row of rows) {\n    byKey.set(projectKey(row), projectLabel(row))\n  }\n  return [...byKey].map(([key, label]) => ({ key, label })).sort((a, b) => a.label.toLowerCase().localeCompare(b.label.toLowerCase()))\n}\n\nexport function sessionLabel(info: SessionInfo): string {\n  return info.title ?? info.id.slice(0, 8)\n}\n\nexport function projectKey(row: SessionRow): string {\n  return `${row.hostId}:${normalizePath(row.info.project?.root ?? row.info.cwd)}`\n}\n\nexport function projectLabel(row: Pick<SessionRow, 'info'>): string {\n  const name = row.info.project?.name\n  if (name) {\n    return name\n  }\n  const dir = normalizePath(row.info.cwd)\n  return dir.slice(dir.lastIndexOf('/') + 1) || 'No project'\n}\n\nexport function projectSubpath(row: Pick<SessionRow, 'info'>): string | undefined {\n  const root = row.info.project?.root\n  if (root === undefined || !row.info.cwd) {\n    return undefined\n  }\n  const base = normalizePath(root)\n  const dir = normalizePath(row.info.cwd)\n  if (dir === base) {\n    return undefined\n  }\n  if (!dir.startsWith(`${base}/`)) {\n    return undefined\n  }\n  return dir.slice(base.length + 1) || undefined\n}\n\nexport function isJobRun(info: SessionInfo): boolean {\n  return typeof info.meta?.jobId === 'string'\n}\n\nfunction matchesSearch(row: SessionRow, needle: string): boolean {\n  if (!needle) {\n    return true\n  }\n  return (\n    sessionLabel(row.info).toLowerCase().includes(needle) ||\n    row.info.cwd.toLowerCase().includes(needle) ||\n    (row.info.project?.name.toLowerCase().includes(needle) ?? false) ||\n    row.hostName.toLowerCase().includes(needle) ||\n    row.adapter.toLowerCase().includes(needle) ||\n    row.info.id.startsWith(needle)\n  )\n}\n\nfunction normalizePath(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+$/, '')\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  const base = normalizePath(root)\n  const dir = normalizePath(path)\n  // The separator matters: /a/project must not swallow /a/project-2.\n  return dir === base || dir.startsWith(`${base}/`)\n}\n\nexport function inScope(row: SessionRow, scope: WorkspaceScope): boolean {\n  return scope.roots.some(\n    (root) => (root.hostId ? root.hostId.toLowerCase() === row.hostId.toLowerCase() : row.local) && isWithin(root.path, row.info.cwd),\n  )\n}\n\nexport function scopeActive(config: ViewConfig, scope: WorkspaceScope | undefined): boolean {\n  return config.scoped && scope !== undefined\n}\n\nexport function filterRows(rows: readonly SessionRow[], config: ViewConfig, scope?: WorkspaceScope): SessionRow[] {\n  const needle = config.search.trim().toLowerCase()\n  const scoping = scopeActive(config, scope) ? scope : undefined\n  return rows.filter(\n    (row) =>\n      (config.gateways.length === 0 || config.gateways.includes(row.hostId)) &&\n      (config.adapters.length === 0 || config.adapters.includes(row.adapter)) &&\n      (config.states.length === 0 || config.states.includes(row.state)) &&\n      (!config.projects?.length || config.projects.includes(projectKey(row))) &&\n      (!scoping || inScope(row, scoping)) &&\n      matchesSearch(row, needle),\n  )\n}\n\nfunction facetKey(row: SessionRow, facet: Facet): string {\n  return facet === 'gateway' ? row.hostId : facet === 'adapter' ? row.adapter : facet === 'project' ? projectKey(row) : row.state\n}\n\nfunction facetLabel(row: SessionRow, facet: Facet): string {\n  return facet === 'gateway'\n    ? row.hostName\n    : facet === 'adapter'\n      ? row.adapter\n      : facet === 'project'\n        ? projectLabel(row)\n        : STATE_LABELS[row.state]\n}\n\nfunction facetRank(row: SessionRow, facet: Facet): string {\n  if (facet === 'state') {\n    return String(STATE_ORDER.indexOf(row.state))\n  }\n  return facetLabel(row, facet).toLowerCase()\n}\n\nfunction byRecency(a: SessionRow, b: SessionRow) {\n  return (b.info.lastActivityAt ?? b.info.createdAt) - (a.info.lastActivityAt ?? a.info.createdAt)\n}\n\nfunction compare(a: SessionRow, b: SessionRow, sortBy: SortBy): number {\n  if (sortBy === 'recent') {\n    return byRecency(a, b)\n  }\n  if (sortBy === 'name') {\n    return (\n      sessionLabel(a.info).localeCompare(sessionLabel(b.info), undefined, {\n        sensitivity: 'base',\n      }) || byRecency(a, b)\n    )\n  }\n  return facetRank(a, sortBy).localeCompare(facetRank(b, sortBy)) || byRecency(a, b)\n}\n\nexport function groupRows(rows: readonly SessionRow[], config: ViewConfig): SessionGroup[] {\n  const sorted = [...rows].sort((a, b) => compare(a, b, config.sortBy))\n  if (config.groupBy === 'none') {\n    return sorted.length ? [{ key: 'all', rows: sorted }] : []\n  }\n  const facet = config.groupBy\n  const groups = new Map<string, SessionGroup & { rank: string }>()\n  for (const row of sorted) {\n    const key = facetKey(row, facet)\n    const group = groups.get(key)\n    if (group) {\n      group.rows.push(row)\n    } else {\n      groups.set(key, {\n        key,\n        label: facetLabel(row, facet),\n        rank: facetRank(row, facet),\n        rows: [row],\n      })\n    }\n  }\n  return [...groups.values()].sort((a, b) => a.rank.localeCompare(b.rank))\n}\n\nexport type SubsetSummary = { shown: number; total: number; causes: string[] }\n\nexport function subsetSummary(\n  config: ViewConfig,\n  scope: WorkspaceScope | undefined,\n  shown: number,\n  total: number,\n): SubsetSummary | undefined {\n  if (shown >= total) {\n    return undefined\n  }\n  const causes: string[] = []\n  if (scope && scopeActive(config, scope)) {\n    causes.push(scope.label)\n  }\n  const facets =\n    (config.gateways.length ? 1 : 0) + (config.adapters.length ? 1 : 0) + (config.states.length ? 1 : 0) + (config.projects?.length ? 1 : 0)\n  if (facets > 0) {\n    causes.push(`${facets} filter${facets === 1 ? '' : 's'}`)\n  }\n  if (config.search.trim()) {\n    causes.push('search')\n  }\n  return { shown, total, causes }\n}\n\nexport function hasFacetFilter(config: ViewConfig): boolean {\n  return (\n    config.search.trim().length > 0 ||\n    config.gateways.length > 0 ||\n    config.adapters.length > 0 ||\n    config.states.length > 0 ||\n    (config.projects?.length ?? 0) > 0\n  )\n}\n\nexport function clearFilters(config: ViewConfig): ViewConfig {\n  return {\n    ...DEFAULT_VIEW_CONFIG,\n    scoped: false,\n    groupBy: config.groupBy,\n    sortBy: config.sortBy,\n  }\n}\n","import type { ProfileUsage, RateLimitInfo } from './index.ts'\n\nexport type SessionUsage = {\n  rateLimits?: Record<string, RateLimitInfo>\n  updatedAt?: number\n}\n\nexport function mergeUsage(session: SessionUsage, profile: ProfileUsage | undefined): ProfileUsage {\n  const out: ProfileUsage = {}\n  for (const [key, info] of Object.entries(session.rateLimits ?? {})) {\n    out[key] = { info, updatedAt: session.updatedAt ?? 0 }\n  }\n  for (const [key, window] of Object.entries(profile ?? {})) {\n    out[key] = window\n  }\n  return out\n}\n\nexport type UsageWindowRow = {\n  key: string\n  info: RateLimitInfo\n  updatedAt?: number\n  inferredReset?: boolean\n}\n\nexport function orderUsageWindows(usage: ProfileUsage | undefined): UsageWindowRow[] {\n  const all = Object.entries(usage ?? {})\n    .filter(([, w]) => w.info.utilization !== undefined)\n    .map(([key, w]) => ({ key, info: w.info, updatedAt: w.updatedAt, inferredReset: w.inferredReset }))\n  const named = ['five_hour', 'seven_day'].flatMap((key) => all.filter((w) => w.key === key))\n  const perModel = all.filter((w) => w.key.startsWith('seven_day_')).sort((a, b) => a.key.localeCompare(b.key))\n  return [...named, ...perModel]\n}\n\nexport function usageInfos(usage: ProfileUsage | undefined): Record<string, RateLimitInfo> | undefined {\n  if (!usage) {\n    return undefined\n  }\n  const out: Record<string, RateLimitInfo> = {}\n  for (const [key, window] of Object.entries(usage)) {\n    out[key] = window.info\n  }\n  return out\n}\n","export type Watermark = {\n  itemCount: number\n  activity: number\n  /**\n   * Prose rows read (`SessionInfo.proseCount`). Optional because a mark stored before\n   * prose counting existed cannot say — see `unseenCount`, which reads that absence as\n   * \"caught up\" rather than badging a whole history the operator has already seen.\n   */\n  prose?: number\n  turns: number\n  seenAt: number\n}\n\nexport type WatermarkStore = {\n  read(): Record<string, Watermark> | undefined\n  write(marks: Record<string, Watermark>): void\n}\n\nconst MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000\n\nconst TOUCH_MS = 60_000\n\nexport function watermarkKey(hostId: string, sessionId: string) {\n  return `${hostId}:${sessionId}`\n}\n\nexport class Watermarks {\n  readonly #store: WatermarkStore\n  #cache: Record<string, Watermark>\n\n  constructor(store: WatermarkStore) {\n    this.#store = store\n    this.#cache = { ...store.read() }\n  }\n\n  get(hostId: string, sessionId: string): Watermark | undefined {\n    return this.#cache[watermarkKey(hostId, sessionId)]\n  }\n\n  all(): Readonly<Record<string, Watermark>> {\n    return this.#cache\n  }\n\n  mark(\n    hostId: string,\n    sessionId: string,\n    seen: { itemCount?: number; activity?: number; prose?: number; turns?: number },\n    now = Date.now(),\n  ): boolean {\n    const id = watermarkKey(hostId, sessionId)\n    const previous = this.#cache[id]\n    const next: Watermark = {\n      itemCount: Math.max(previous?.itemCount ?? 0, seen.itemCount ?? 0),\n      activity: Math.max(previous?.activity ?? 0, seen.activity ?? 0),\n      // A caller with nothing to say about prose (an older gateway reports no `proseCount`)\n      // must not overwrite a real mark with 0, which would re-badge everything already read.\n      prose: seen.prose === undefined ? previous?.prose : Math.max(previous?.prose ?? 0, seen.prose),\n      turns: Math.max(previous?.turns ?? 0, seen.turns ?? 0),\n      seenAt: now,\n    }\n    if (\n      previous &&\n      previous.itemCount === next.itemCount &&\n      previous.activity === next.activity &&\n      previous.prose === next.prose &&\n      previous.turns === next.turns &&\n      next.seenAt - previous.seenAt < TOUCH_MS\n    ) {\n      return false\n    }\n    this.#cache[id] = next\n    this.#store.write(this.#prune(now))\n    return true\n  }\n\n  forget(hostId: string, sessionId: string): void {\n    const id = watermarkKey(hostId, sessionId)\n    if (!(id in this.#cache)) {\n      return\n    }\n    delete this.#cache[id]\n    this.#store.write(this.#cache)\n  }\n\n  #prune(now: number): Record<string, Watermark> {\n    const cutoff = now - MAX_AGE_MS\n    for (const [id, mark] of Object.entries(this.#cache)) {\n      if (mark.seenAt < cutoff) {\n        delete this.#cache[id]\n      }\n    }\n    return this.#cache\n  }\n}\n\n/**\n * The badge's number, in the best unit the pair can agree on: prose the human has not\n * read, else rows, else turns. The ladder is what keeps an older gateway (no `proseCount`\n * on the wire) badging exactly as it did before rather than going silent.\n */\nexport function unseenCount(mark: Watermark | undefined, info: { proseCount?: number; activityCount?: number; turns?: number }): number {\n  if (!mark) {\n    return 0\n  }\n  if (info.proseCount !== undefined) {\n    // `mark.prose` absent = a mark written before prose counting. Reading it as\n    // \"caught up\" costs one missed badge on a session already visited; reading it as 0\n    // would badge every such session with its entire history the first time it polls.\n    return Math.max(0, info.proseCount - (mark.prose ?? info.proseCount))\n  }\n  if (info.activityCount !== undefined) {\n    return Math.max(0, info.activityCount - mark.activity)\n  }\n  return Math.max(0, (info.turns ?? 0) - mark.turns)\n}\n","export const PROTOCOL_VERSION = 1\n\nexport type SessionStatus = 'starting' | 'running' | 'awaiting_approval' | 'idle' | 'parked' | 'failed' | 'closed'\n\nexport type PermissionMode = 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan' | 'dontAsk' | 'auto'\n\nexport type TextBlock = { type: 'text'; text: string }\nexport type ThinkingBlock = { type: 'thinking'; thinking: string }\nexport type ToolUseBlock = { type: 'tool_use'; id: string; name: string; input: unknown }\nexport type ToolResultBlock = {\n  type: 'tool_result'\n  tool_use_id: string\n  content?: string | Array<{ type: string; text?: string; [key: string]: unknown }>\n  is_error?: boolean\n  truncated?: boolean\n  total_chars?: number\n}\n\nexport const TOOL_RESULT_HEAD_CHARS = 8_000\n\nexport type ImageRefPart = {\n  type: 'image_ref'\n  media_type: string\n  bytes: number\n  part_index: number\n}\n\nfunction base64Bytes(data: string): number {\n  const padding = data.endsWith('==') ? 2 : data.endsWith('=') ? 1 : 0\n  return Math.max(0, Math.floor((data.length * 3) / 4) - padding)\n}\n\nexport function imagePartRef(part: { type?: string; [key: string]: unknown }, index: number): ImageRefPart | undefined {\n  if (part.type !== 'image') {\n    return undefined\n  }\n  const source = part.source as { type?: string; data?: unknown; media_type?: unknown } | undefined\n  if (!source || source.type !== 'base64' || typeof source.data !== 'string') {\n    return undefined\n  }\n  return {\n    type: 'image_ref',\n    media_type: typeof source.media_type === 'string' ? source.media_type : 'application/octet-stream',\n    bytes: base64Bytes(source.data),\n    part_index: index,\n  }\n}\n\nexport type UnknownBlock = { type: string; [key: string]: unknown }\n\nexport type PatchHunk = {\n  oldStart: number\n  oldLines: number\n  newStart: number\n  newLines: number\n  lines: string[]\n}\n\nexport type FilePatch = {\n  path?: string\n  kind?: 'create' | 'update'\n  hunks: PatchHunk[]\n  truncated?: boolean\n}\n\nexport type ContentBlock = TextBlock | ThinkingBlock | ToolUseBlock | ToolResultBlock | UnknownBlock\n\nexport type MessageAttachment = {\n  id: string\n  name: string\n  mediaType: string\n  bytes: number\n}\n\nexport type ApiMessage = {\n  role: 'user' | 'assistant'\n  content: string | ContentBlock[]\n  model?: string\n  stop_reason?: string | null\n  usage?: {\n    input_tokens?: number\n    output_tokens?: number\n    cache_creation_input_tokens?: number\n    cache_read_input_tokens?: number\n  }\n}\n\nexport type PermissionRequest = {\n  id: string\n  toolName: string\n  input: Record<string, unknown>\n  toolUseId: string\n  title?: string\n  displayName?: string\n  description?: string\n  decisionReason?: string\n  agentId?: string\n  expiresAt?: number\n}\n\nexport type PermissionDecisionSource = 'client' | 'timeout' | 'policy'\n\nexport type UserQuestionOption = {\n  label: string\n  description?: string\n  preview?: string\n}\n\nexport type UserQuestion = {\n  question: string\n  header: string\n  options: UserQuestionOption[]\n  multiSelect?: boolean\n}\n\nexport type QuestionBehavior = 'ask' | 'auto' | 'deny'\n\nexport type ModelOption = {\n  value: string\n  resolvedModel?: string\n  displayName: string\n  description?: string\n  primary?: boolean\n  reasoningEfforts?: readonly string[]\n}\n\nexport type SkillInfo = {\n  name: string\n  description?: string\n  shortDescription?: string\n  displayName?: string\n  defaultPrompt?: string\n  scope?: string\n  enabled: boolean\n}\n\nexport type SlashCommandInfo = {\n  name: string\n  description?: string\n  argumentHint?: string\n  aliases?: string[]\n}\n\nexport type ContextUsageCategory = {\n  name: string\n  tokens: number\n  color: string\n}\n\nexport type ContextUsage = {\n  categories: ContextUsageCategory[]\n  totalTokens: number\n  maxTokens: number\n  percentage: number\n  model?: string\n}\n\nexport type ContextReading = {\n  totalTokens: number\n  maxTokens: number\n  percentage: number\n}\n\nexport type RateLimitInfo = {\n  status: string\n  rateLimitType?: string\n  utilization?: number\n  resetsAt?: number\n  isUsingOverage?: boolean\n}\n\nexport type ToolExecutionStatus = 'pending' | 'deferred' | 'settled' | 'failed'\n\nexport type ToolExecutionBackend = 'server' | 'browser' | 'managed' | 'remote'\n\nexport type ToolExecutionOutput = { type: 'text'; value: string } | { type: 'json'; value: unknown }\n\nexport type SessionEventBody =\n  | {\n      type: 'system_init'\n      sdkSessionId: string\n      model: string\n      cwd: string\n      apiKeySource: string\n      tools: string[]\n      skills: string[]\n      slashCommands: string[]\n      permissionMode: PermissionMode\n      claudeCodeVersion: string\n      mcpServers: Array<{ name: string; status: string }>\n    }\n  | { type: 'status_changed'; status: SessionStatus; detail?: string }\n  | {\n      type: 'capabilities'\n      models: ModelOption[]\n      commands: SlashCommandInfo[]\n      defaultModel?: string\n    }\n  | { type: 'skills'; skills: SkillInfo[] }\n  | {\n      type: 'file_produced'\n      fileId: string\n      path: string\n      mediaType?: string\n      bytes?: number\n      toolUseId?: string\n    }\n  | { type: 'model_changed'; model?: string }\n  | { type: 'permission_mode_changed'; mode: PermissionMode }\n  | { type: 'context_usage'; usage: ContextUsage }\n  | { type: 'rate_limit'; info: RateLimitInfo }\n  | { type: 'plan_info'; subscriptionType: string }\n  | {\n      type: 'conversation_reset'\n      sdkSessionId?: string\n    }\n  | {\n      type: 'assistant_message'\n      message: ApiMessage\n      parentToolUseId: string | null\n      replay?: boolean\n      uuid: string\n    }\n  | {\n      type: 'user_message'\n      message: ApiMessage\n      parentToolUseId: string | null\n      replay?: boolean\n      synthetic?: boolean\n      attachments?: MessageAttachment[]\n      patch?: FilePatch\n      uuid?: string\n    }\n  | {\n      type: 'stream_delta'\n      event: { type: string; [key: string]: unknown }\n      parentToolUseId: string | null\n      uuid: string\n    }\n  | {\n      type: 'turn_result'\n      subtype: 'success' | 'error_during_execution' | 'error_max_turns' | 'error_max_budget_usd' | 'error_max_structured_output_retries'\n      isError: boolean\n      durationMs: number\n      numTurns: number\n      totalCostUsd: number\n      result?: string\n      errors?: string[]\n      usage?: unknown\n    }\n  | { type: 'permission_requested'; request: PermissionRequest }\n  | {\n      type: 'permission_resolved'\n      requestId: string\n      behavior: 'allow' | 'deny'\n      resolvedBy: PermissionDecisionSource\n      message?: string\n    }\n  | {\n      type: 'execution_dispatched'\n      executionId: string\n      toolName: string\n      backend: ToolExecutionBackend\n      deferred?: boolean\n      expiresAt?: number\n    }\n  | {\n      type: 'execution_result'\n      executionId: string\n      output: ToolExecutionOutput\n      logs?: string[]\n      durationMs?: number\n    }\n  | {\n      type: 'execution_failed'\n      executionId: string\n      reason: string\n      error: string\n      logs?: string[]\n      durationMs?: number\n    }\n  | { type: 'file_delivered'; path: string; bytes: number; description?: string }\n  | { type: 'sdk_event'; payload: { type: string; [key: string]: unknown } }\n  | { type: 'session_error'; message: string }\n  | { type: 'session_closed'; reason: 'client' | 'server' | 'error' }\n\nexport type SessionEvent = SessionEventBody & {\n  seq: number\n  ts: number\n}\n\nexport type SessionCommand =\n  | {\n      type: 'user_message'\n      text: string\n      attachmentIds?: string[]\n    }\n  | {\n      type: 'permission_decision'\n      requestId: string\n      behavior: 'allow' | 'deny'\n      updatedInput?: Record<string, unknown>\n      message?: string\n      interrupt?: boolean\n    }\n  | { type: 'interrupt' }\n  | { type: 'clear_context' }\n  | { type: 'set_permission_mode'; mode: PermissionMode }\n  | { type: 'set_model'; model?: string }\n  | {\n      type: 'tool_call_result'\n      executionId: string\n      output: ToolExecutionOutput\n      logs?: string[]\n    }\n  | {\n      type: 'tool_call_error'\n      executionId: string\n      reason: string\n      error: string\n      logs?: string[]\n    }\n  | { type: 'close' }\n\nexport type AttachedFrame = {\n  type: 'attached'\n  protocolVersion: number\n  session: SessionInfo\n  replayingFrom: number\n}\n\nexport type ToolCallRequestFrame = {\n  type: 'tool_call_request'\n  executionId: string\n  toolName: string\n  input: unknown\n  vfsSeed?: Record<string, string>\n  limits?: { timeoutMs?: number; memoryLimitBytes?: number }\n  expiresAt?: number\n}\n\nexport type ServerFrame =\n  | AttachedFrame\n  | { type: 'event'; event: SessionEvent }\n  | ToolCallRequestFrame\n  | { type: 'tool_call_canceled'; executionId: string; reason: string }\n  | { type: 'protocol_error'; message: string }\n\nexport type ClientFrame = SessionCommand\n\nexport type ProfileDefaults = {\n  model?: string\n  permissionMode?: PermissionMode\n}\n\nexport type ProfileEngine = 'claude' | 'codex' | 'provider'\n\nexport type EngineCapabilities = {\n  interactiveApprovals: boolean\n  permissionModes: readonly PermissionMode[]\n  defaultPermissionMode: PermissionMode\n  resume: boolean\n  resumeBackfill: boolean\n  listSessions: boolean\n  contextUsage: boolean\n  rateLimits: boolean\n  mcpStatus: boolean\n  mcpServerActions: boolean\n  sessionMcpServers: boolean\n  slashCommands: boolean\n  clearContext?: boolean\n  skillsList: boolean\n  settingSources: boolean\n  budgets: boolean\n  attachments: ReadonlyArray<'image' | 'pdf' | 'text'>\n  reasoningEfforts?: readonly string[]\n  vfs: boolean\n  hostCwd?: boolean\n  streaming: 'token' | 'item' | 'none'\n}\n\nexport const ENGINE_CAPABILITIES: Record<ProfileEngine, EngineCapabilities> = {\n  claude: {\n    interactiveApprovals: true,\n    permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'plan', 'dontAsk', 'auto'],\n    defaultPermissionMode: 'default',\n    resume: true,\n    resumeBackfill: true,\n    listSessions: true,\n    contextUsage: true,\n    rateLimits: true,\n    mcpStatus: true,\n    mcpServerActions: true,\n    sessionMcpServers: true,\n    slashCommands: true,\n    clearContext: true,\n    skillsList: false,\n    settingSources: true,\n    budgets: true,\n    attachments: ['image', 'pdf', 'text'],\n    reasoningEfforts: ['low', 'medium', 'high', 'xhigh', 'max'],\n    vfs: false,\n    hostCwd: true,\n    streaming: 'token',\n  },\n  codex: {\n    interactiveApprovals: true,\n    permissionModes: ['default', 'acceptEdits', 'bypassPermissions', 'auto'],\n    defaultPermissionMode: 'default',\n    resume: true,\n    resumeBackfill: true,\n    listSessions: true,\n    contextUsage: true,\n    rateLimits: true,\n    mcpStatus: true,\n    mcpServerActions: false,\n    sessionMcpServers: false,\n    slashCommands: false,\n    clearContext: true,\n    skillsList: true,\n    settingSources: false,\n    budgets: false,\n    attachments: ['image', 'text'],\n    reasoningEfforts: ['minimal', 'low', 'medium', 'high', 'xhigh'],\n    vfs: false,\n    hostCwd: true,\n    streaming: 'token',\n  },\n  provider: {\n    interactiveApprovals: false,\n    permissionModes: ['default', 'bypassPermissions', 'dontAsk'],\n    defaultPermissionMode: 'default',\n    resume: false,\n    resumeBackfill: false,\n    listSessions: false,\n    contextUsage: false,\n    rateLimits: false,\n    mcpStatus: true,\n    mcpServerActions: false,\n    sessionMcpServers: false,\n    slashCommands: false,\n    clearContext: true,\n    skillsList: false,\n    settingSources: false,\n    budgets: false,\n    attachments: ['image', 'pdf', 'text'],\n    vfs: true,\n    hostCwd: false,\n    streaming: 'token',\n  },\n}\n\nexport function supportsPermissionMode(engine: ProfileEngine | undefined, mode: PermissionMode): boolean {\n  return ENGINE_CAPABILITIES[engine ?? 'claude'].permissionModes.includes(mode)\n}\n\nexport type ProviderConfig = {\n  id: string\n  model?: string\n  models?: string[]\n  baseUrl?: string\n  apiKeyEnv?: string\n}\n\nexport type SessionCapability = 'web_search' | 'download' | 'web_fetch' | 'deliver_file'\n\nexport type ProfileSessionDefaults = {\n  capabilities?: SessionCapability[]\n  mcpServers?: string[]\n  instructions?: string\n}\n\nexport type ProfileUsageWindow = {\n  info: RateLimitInfo\n  updatedAt: number\n  inferredReset?: boolean\n}\n\nexport type ProfileUsage = Record<string, ProfileUsageWindow>\n\nexport type ProfileInfo = {\n  name: string\n  engine?: ProfileEngine\n  configDir?: string\n  codexHome?: string\n  provider?: ProviderConfig\n  description?: string\n  defaults?: ProfileDefaults\n  session?: ProfileSessionDefaults\n  models?: ModelOption[]\n  defaultModel?: string\n  capabilities?: EngineCapabilities\n  available?: boolean\n  unavailableReason?: string\n  usage?: ProfileUsage\n  managed?: boolean\n}\n\nexport type ProfileConfigSnapshot = {\n  settings?: {\n    model?: string\n    defaultPermissionMode?: string\n    permissionRules?: { allow: number; ask: number; deny: number }\n    envKeys?: string[]\n    hooks?: string[]\n  }\n  hasUserMemory: boolean\n  skills: string[]\n  agents: string[]\n  commands: string[]\n}\n\nexport type McpServerConfigWire =\n  | { type?: 'stdio'; command: string; args?: string[]; env?: Record<string, string> }\n  | { type: 'http'; url: string; headers?: Record<string, string> }\n  | { type: 'sse'; url: string; headers?: Record<string, string> }\n\nexport type McpServerToolInfo = {\n  name: string\n  description?: string\n  annotations?: { readOnly?: boolean; destructive?: boolean; openWorld?: boolean }\n  inputSchema?: unknown\n}\n\nexport type McpServerStatusInfo = {\n  name: string\n  status: string\n  scope?: string\n  error?: string\n  serverInfo?: { name: string; version: string }\n  transport?: 'stdio' | 'http' | 'sse' | 'sdk'\n  command?: string\n  args?: string[]\n  url?: string\n  tools?: McpServerToolInfo[]\n}\n\nexport type McpServersResponse = { servers: McpServerStatusInfo[] }\n\nexport type McpServerActionRequest = { action: 'reconnect' | 'enable' | 'disable' }\n\nexport type UploadAttachmentResponse = { attachment: MessageAttachment }\n\nexport type CreateSessionRequest = {\n  cwd?: string\n  profile?: string\n  prompt?: string\n  permissionMode?: PermissionMode\n  allowDangerouslySkipPermissions?: boolean\n  allowedTools?: string[]\n  disallowedTools?: string[]\n  mcpServers?: Record<string, McpServerConfigWire>\n  settingSources?: Array<'user' | 'project' | 'local'>\n  model?: string\n  maxTurns?: number\n  maxBudgetUsd?: number\n  resume?: string\n  forkSession?: boolean\n  reasoningEffort?: string\n  includePartialMessages?: boolean\n  approvalTimeoutMs?: number\n  questionBehavior?: QuestionBehavior\n  capabilities?: SessionCapability[]\n  meta?: Record<string, unknown>\n  scope?: Record<string, string>\n}\n\nexport type SubagentInfo = {\n  toolUseId: string\n  agentType?: string\n  description?: string\n  status: 'running' | 'done' | 'failed'\n  startedAt: number\n  toolCount: number\n}\n\nexport const SUBAGENT_HISTORY = 8\n\nexport type ProjectIcon = { type: 'glyph'; name: string } | { type: 'image'; mediaType: 'image/png' | 'image/svg+xml'; hash: string }\n\nexport type ProjectInfo = {\n  name: string\n  root: string\n  icon?: ProjectIcon\n}\n\nexport type SessionInfo = {\n  id: string\n  sdkSessionId?: string\n  status: SessionStatus\n  cwd: string\n  profile?: string\n  engine?: ProfileEngine\n  capabilities?: EngineCapabilities\n  model?: string\n  permissionMode?: PermissionMode\n  canBypassPermissions?: boolean\n  apiKeySource?: string\n  createdAt: number\n  lastSeq: number\n  pendingPermissionCount: number\n  subagents?: SubagentInfo[]\n  meta?: Record<string, unknown>\n  title?: string\n  totalCostUsd?: number\n  numTurns?: number\n  activityCount?: number\n  /**\n   * Rows of the kind a person is actually waiting to read — see `transcriptProse`.\n   * Absent from a gateway that predates it — additive, so no `PROTOCOL_VERSION` bump —\n   * which is why every reader falls back to `activityCount`. This is the badge's number; `activityCount` stays the \"has\n   * anything happened at all\" measure that sorting and dormancy read.\n   */\n  proseCount?: number\n  lastActivityAt?: number\n  contextUsage?: ContextReading\n  scope?: Record<string, string>\n  project?: ProjectInfo\n}\n\nexport function contextReading(body: SessionEventBody): ContextReading | undefined {\n  if (body.type !== 'context_usage') {\n    return undefined\n  }\n  const { totalTokens, maxTokens, percentage } = body.usage\n  return { totalTokens, maxTokens, percentage }\n}\n\nexport function transcriptActivity(body: SessionEventBody): number {\n  if ('parentToolUseId' in body && body.parentToolUseId != null) {\n    return 0\n  }\n  switch (body.type) {\n    case 'assistant_message': {\n      const content = body.message.content\n      if (typeof content === 'string') {\n        return content.trim() === '' ? 0 : 1\n      }\n      const rows = content.filter((block) => block.type === 'text' || block.type === 'thinking' || block.type === 'tool_use').length\n      return rows\n    }\n    case 'user_message': {\n      return body.synthetic ? 0 : 1\n    }\n    case 'turn_result':\n    case 'file_delivered':\n    case 'session_error': {\n      return 1\n    }\n    default: {\n      return 0\n    }\n  }\n}\n\n/**\n * The unread badge's unit: output **addressed to the human**, not evidence of work.\n *\n * `transcriptActivity` counts a tool call and a paragraph alike, which is honest as\n * \"how much has happened\" and wrong as \"how much is there to read\" — a session that\n * tool-loops for a minute ticks 6, 7, 8 with nothing said yet. This scores the same\n * events through a narrower door:\n *\n * - assistant `text` blocks only — `thinking` is not addressed to anyone and `tool_use`\n *   is the noise being filtered out;\n * - the **sub-agent carve-out is inherited** (`parentToolUseId != null` scores 0): prose a\n *   sub-agent wrote to its parent is not addressed to the human either;\n * - a `turn_result` counts only when it **failed**, an interrupt or an error being a thing\n *   the human is owed; a successful turn already carried its own prose and would otherwise\n *   double-count every answer;\n * - `session_error` and `file_delivered` count — both are output, not work;\n * - `stream_delta` scores 0, exactly as in `transcriptActivity`. The badge is therefore\n *   correct within one poll of a message *completing*, never mid-stream, which is the\n *   deliberate price of leaving the streaming path alone.\n */\nexport function transcriptProse(body: SessionEventBody): number {\n  if ('parentToolUseId' in body && body.parentToolUseId != null) {\n    return 0\n  }\n  switch (body.type) {\n    case 'assistant_message': {\n      const content = body.message.content\n      if (typeof content === 'string') {\n        return content.trim() === '' ? 0 : 1\n      }\n      return content.filter((block) => block.type === 'text' && typeof block.text === 'string' && block.text.trim() !== '').length\n    }\n    case 'user_message': {\n      return body.synthetic ? 0 : 1\n    }\n    case 'turn_result': {\n      return body.isError ? 1 : 0\n    }\n    case 'file_delivered':\n    case 'session_error': {\n      return 1\n    }\n    default: {\n      return 0\n    }\n  }\n}\n\nexport function transcriptContent(body: SessionEventBody): boolean {\n  switch (body.type) {\n    case 'user_message':\n    case 'assistant_message':\n    case 'stream_delta':\n    case 'turn_result':\n    case 'execution_dispatched':\n    case 'execution_result':\n    case 'execution_failed':\n    case 'file_delivered':\n    case 'session_error':\n    case 'session_closed':\n    case 'conversation_reset': {\n      return true\n    }\n    default: {\n      return false\n    }\n  }\n}\n\nexport function replayCoalesceKey(body: SessionEventBody): string | undefined {\n  switch (body.type) {\n    case 'context_usage': {\n      return 'context_usage'\n    }\n    case 'rate_limit': {\n      return body.info.rateLimitType ? `rate_limit:${body.info.rateLimitType}` : undefined\n    }\n    case 'status_changed': {\n      return 'status_changed'\n    }\n    case 'sdk_event': {\n      return body.payload.type === 'system' && body.payload.subtype === 'status' ? 'sdk_event:system:status' : undefined\n    }\n    default: {\n      return undefined\n    }\n  }\n}\n\nexport function replayRetains(body: SessionEventBody): boolean {\n  if (body.type !== 'stream_delta') {\n    return true\n  }\n  const delta = body.event as { type?: string; delta?: { type?: string } }\n  if (delta.type !== 'content_block_delta') {\n    return false\n  }\n  return delta.delta?.type === 'text_delta' || delta.delta?.type === 'thinking_delta'\n}\n\nexport function snapshotRetains(body: SessionEventBody): boolean {\n  return body.type !== 'stream_delta'\n}\n\nexport type SdkSessionSummary = {\n  sessionId: string\n  summary: string\n  lastModified: number\n  createdAt?: number\n  customTitle?: string\n  firstPrompt?: string\n  gitBranch?: string\n  cwd?: string\n}\n\nexport type SessionFileInfo = { path: string; bytes: number }\nexport type ListSessionFilesResponse = { files: SessionFileInfo[] }\nexport type ListSessionsResponse = { sessions: SessionInfo[] }\nexport type CreateSessionResponse = { session: SessionInfo }\nexport type GetSessionResponse = { session: SessionInfo }\n\nexport type UpdateSessionRequest = { title?: string | null }\nexport type UpdateSessionResponse = { session: SessionInfo }\n\nexport type ResolvePermissionRequest =\n  | { behavior: 'allow'; updatedInput?: Record<string, unknown> }\n  | { behavior: 'deny'; message?: string; interrupt?: boolean }\nexport type ResolvePermissionResponse = { resolved: true }\n\nexport type SubmitExecutionResultRequest =\n  | { status: 'ok'; output: ToolExecutionOutput; logs?: string[] }\n  | { status: 'failed'; reason: string; error: string; logs?: string[] }\nexport type SubmitExecutionResultResponse = {\n  applied: boolean\n  sessionId: string\n}\n\nexport type ListSdkSessionsResponse = { sdkSessions: SdkSessionSummary[] }\nexport type ListProfilesResponse = {\n  profiles: ProfileInfo[]\n  canManage?: boolean\n}\n\nexport type CreateProfileRequest = ProfileInfo\n\nexport type UpdateProfileRequest = Omit<Partial<ProfileInfo>, 'name'>\n\nexport type HostFileRoot = {\n  path: string\n  name: string\n}\n\nexport type ListHostRootsResponse = {\n  roots: HostFileRoot[]\n  canWrite: boolean\n}\n\nexport type HostDirEntry = {\n  name: string\n  path: string\n  type: 'file' | 'dir' | 'symlink' | 'other'\n  bytes?: number\n  modifiedAt?: number\n}\n\nexport type ListHostDirResponse = {\n  path: string\n  entries: HostDirEntry[]\n  truncated?: boolean\n}\n\nexport type HostFileMatch = {\n  path: string\n  relative: string\n}\n\nexport type FindHostFilesResponse = {\n  base: string\n  matches: HostFileMatch[]\n  truncated: boolean\n}\n\nexport type ReadHostFileResponse = {\n  path: string\n  content: string\n  encoding: 'utf8' | 'base64'\n  bytes: number\n  hash: string\n  modifiedAt: number\n}\n\nexport type WriteHostFileRequest = {\n  path: string\n  content: string\n  encoding?: 'utf8' | 'base64'\n  expectedHash?: string\n}\n\nexport type WriteHostFileResponse = {\n  path: string\n  bytes: number\n  hash: string\n  modifiedAt: number\n}\n\nexport type SaveProfileResponse = { profile: ProfileInfo }\nexport type GetProfileResponse = { profile: ProfileInfo; config: ProfileConfigSnapshot }\nexport type ErrorResponse = { error: string }\n\nexport type SessionNotificationType = 'permission_requested' | 'turn_completed' | 'session_error' | 'session_closed'\n\nexport type SessionNotification = {\n  type: SessionNotificationType\n  sessionId: string\n  session: SessionInfo\n  seq: number\n  ts: number\n  preview?: string\n  request?: PermissionRequest\n  result?: { isError: boolean; durationMs: number; numTurns: number; totalCostUsd: number }\n  reason?: 'client' | 'server' | 'error'\n}\n\nexport type SessionWebhookConfig = {\n  url: string\n  headers?: Record<string, string>\n  events?: SessionNotificationType[]\n}\n\nexport type JobStatus = 'queued' | 'running' | 'parked' | 'succeeded' | 'failed' | 'canceled'\n\nexport type WebhookConfig = {\n  url: string\n  headers?: Record<string, string>\n  progress?: 'messages' | 'completion'\n}\n\nexport type CreateJobRequest = {\n  session: CreateSessionRequest & { prompt: string }\n  webhook?: WebhookConfig\n  maxTokens?: number\n  maxDurationMs?: number\n  attempts?: number\n  retryDelayMs?: number\n  meta?: Record<string, unknown>\n}\n\nexport type JobUsage = {\n  tokens: number\n  totalCostUsd: number\n  numTurns: number\n}\n\nexport type JobResult = {\n  subtype: string\n  isError: boolean\n  result?: string\n  errors?: string[]\n  durationMs: number\n}\n\nexport type JobInfo = {\n  id: string\n  status: JobStatus\n  cwd: string\n  profile?: string\n  prompt: string\n  sessionId?: string\n  sdkSessionId?: string\n  createdAt: number\n  startedAt?: number\n  finishedAt?: number\n  attempt?: number\n  maxAttempts?: number\n  nextRunAt?: number\n  parkedAt?: number\n  parkedExecutionId?: string\n  usage: JobUsage\n  result?: JobResult\n  error?: string\n  meta?: Record<string, unknown>\n  scope?: Record<string, string>\n}\n\nexport type JobProgress = {\n  kind: 'assistant_text' | 'tool_use' | 'permission_requested' | 'permission_resolved'\n  preview?: string\n  request?: PermissionRequest\n}\n\nexport type JobEvent =\n  | { type: 'job_submitted'; job: JobInfo; ts: number }\n  | { type: 'job_started'; job: JobInfo; ts: number }\n  | { type: 'job_progress'; job: JobInfo; progress: JobProgress; ts: number }\n  | { type: 'job_parked'; job: JobInfo; executionId: string; ts: number }\n  | { type: 'job_resumed'; job: JobInfo; executionId: string; ts: number }\n  | { type: 'job_retrying'; job: JobInfo; ts: number }\n  | { type: 'job_completed'; job: JobInfo; ts: number }\n\nexport type QueueStats = {\n  maxConcurrency: number\n  running: number\n  queued: number\n  parked: number\n  sessionTokenLimit?: number\n  dailyTokenLimit?: number\n  dailyTokensUsed: number\n  paused: boolean\n}\n\nexport type QueueServerFrame =\n  | { type: 'queue_attached'; protocolVersion: number; stats: QueueStats }\n  | { type: 'job_event'; event: JobEvent }\n  | { type: 'queue_stats'; stats: QueueStats }\n\nexport type CreateJobResponse = { job: JobInfo }\nexport type GetJobResponse = { job: JobInfo }\nexport type ListJobsResponse = { jobs: JobInfo[] }\nexport type QueueStatsResponse = { stats: QueueStats }\n\nexport * from './session-list.ts'\nexport * from './usage.ts'\nexport * from './watermarks.ts'\n"],"mappings":";AAIA,MAAa,cAAuC;CAAC;CAAa;CAAW;CAAQ;CAAQ;AAE7F,MAAa,eAA6C;CACxD,WAAW;CACX,SAAS;CACT,MAAM;CACN,OAAO;CACR;AAED,SAAgB,aAAa,MAAiC;AAC5D,KAAI,KAAK,yBAAyB,KAAK,KAAK,WAAW,oBACrD,QAAO;AAET,KAAI,KAAK,WAAW,YAAY,KAAK,WAAW,SAC9C,QAAO;AAET,KAAI,KAAK,WAAW,aAAa,KAAK,WAAW,WAC/C,QAAO;AAET,KAAI,iBAAiB,KAAK,CAAC,SAAS,EAClC,QAAO;AAET,QAAO;;AAGT,SAAgB,iBAAiB,MAAmC;AAClE,SAAQ,KAAK,aAAa,EAAE,EAAE,QAAQ,QAAQ,IAAI,WAAW,UAAU;;AAGzE,SAAgB,cAAc,KAA4B;AACxD,SAAQ,IAAI,WAAW,MAAM,IAAI,QAAQ;;AAG3C,SAAgB,cAAc,KAA2B;CACvD,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,MAAM,cAAc,IAAI,aAAa,MAAM;AAC3C,KAAI,SAAS,YACX,QAAO,GAAG,MAAM,KAAK;AAEvB,QAAO,SAAS,eAAe;;AAkBjC,MAAa,sBAAkC;CAC7C,QAAQ;CACR,UAAU,EAAE;CACZ,UAAU,EAAE;CACZ,QAAQ,EAAE;CACV,UAAU,EAAE;CACZ,QAAQ;CACR,SAAS;CACT,QAAQ;CACT;AAwBD,SAAgB,WAAW,MAAuC;AAChE,QAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM;;AAGxD,SAAgB,WAAW,MAA+D;CACxF,MAAM,wBAAQ,IAAI,KAAqB;AACvC,MAAK,MAAM,OAAO,KAChB,OAAM,IAAI,WAAW,IAAI,EAAE,aAAa,IAAI,CAAC;AAE/C,QAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK;EAAO,EAAE,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,aAAa,CAAC,cAAc,EAAE,MAAM,aAAa,CAAC,CAAC;;AAGtI,SAAgB,aAAa,MAA2B;AACtD,QAAO,KAAK,SAAS,KAAK,GAAG,MAAM,GAAG,EAAE;;AAG1C,SAAgB,WAAW,KAAyB;AAClD,QAAO,GAAG,IAAI,OAAO,GAAG,cAAc,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,IAAI;;AAG/E,SAAgB,aAAa,KAAuC;CAClE,MAAM,OAAO,IAAI,KAAK,SAAS;AAC/B,KAAI,KACF,QAAO;CAET,MAAM,MAAM,cAAc,IAAI,KAAK,IAAI;AACvC,QAAO,IAAI,MAAM,IAAI,YAAY,IAAI,GAAG,EAAE,IAAI;;AAGhD,SAAgB,eAAe,KAAmD;CAChF,MAAM,OAAO,IAAI,KAAK,SAAS;AAC/B,KAAI,SAAS,KAAA,KAAa,CAAC,IAAI,KAAK,IAClC;CAEF,MAAM,OAAO,cAAc,KAAK;CAChC,MAAM,MAAM,cAAc,IAAI,KAAK,IAAI;AACvC,KAAI,QAAQ,KACV;AAEF,KAAI,CAAC,IAAI,WAAW,GAAG,KAAK,GAAG,CAC7B;AAEF,QAAO,IAAI,MAAM,KAAK,SAAS,EAAE,IAAI,KAAA;;AAGvC,SAAgB,SAAS,MAA4B;AACnD,QAAO,OAAO,KAAK,MAAM,UAAU;;AAGrC,SAAS,cAAc,KAAiB,QAAyB;AAC/D,KAAI,CAAC,OACH,QAAO;AAET,QACE,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,SAAS,OAAO,IACrD,IAAI,KAAK,IAAI,aAAa,CAAC,SAAS,OAAO,KAC1C,IAAI,KAAK,SAAS,KAAK,aAAa,CAAC,SAAS,OAAO,IAAI,UAC1D,IAAI,SAAS,aAAa,CAAC,SAAS,OAAO,IAC3C,IAAI,QAAQ,aAAa,CAAC,SAAS,OAAO,IAC1C,IAAI,KAAK,GAAG,WAAW,OAAO;;AAIlC,SAAS,cAAc,MAAsB;AAC3C,QAAO,KAAK,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;;AAGrD,SAAS,SAAS,MAAc,MAAuB;CACrD,MAAM,OAAO,cAAc,KAAK;CAChC,MAAM,MAAM,cAAc,KAAK;AAE/B,QAAO,QAAQ,QAAQ,IAAI,WAAW,GAAG,KAAK,GAAG;;AAGnD,SAAgB,QAAQ,KAAiB,OAAgC;AACvE,QAAO,MAAM,MAAM,MAChB,UAAU,KAAK,SAAS,KAAK,OAAO,aAAa,KAAK,IAAI,OAAO,aAAa,GAAG,IAAI,UAAU,SAAS,KAAK,MAAM,IAAI,KAAK,IAAI,CAClI;;AAGH,SAAgB,YAAY,QAAoB,OAA4C;AAC1F,QAAO,OAAO,UAAU,UAAU,KAAA;;AAGpC,SAAgB,WAAW,MAA6B,QAAoB,OAAsC;CAChH,MAAM,SAAS,OAAO,OAAO,MAAM,CAAC,aAAa;CACjD,MAAM,UAAU,YAAY,QAAQ,MAAM,GAAG,QAAQ,KAAA;AACrD,QAAO,KAAK,QACT,SACE,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,IAAI,OAAO,MACpE,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,SAAS,IAAI,QAAQ,MACrE,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,IAAI,MAAM,MAC/D,CAAC,OAAO,UAAU,UAAU,OAAO,SAAS,SAAS,WAAW,IAAI,CAAC,MACrE,CAAC,WAAW,QAAQ,KAAK,QAAQ,KAClC,cAAc,KAAK,OAAO,CAC7B;;AAGH,SAAS,SAAS,KAAiB,OAAsB;AACvD,QAAO,UAAU,YAAY,IAAI,SAAS,UAAU,YAAY,IAAI,UAAU,UAAU,YAAY,WAAW,IAAI,GAAG,IAAI;;AAG5H,SAAS,WAAW,KAAiB,OAAsB;AACzD,QAAO,UAAU,YACb,IAAI,WACJ,UAAU,YACR,IAAI,UACJ,UAAU,YACR,aAAa,IAAI,GACjB,aAAa,IAAI;;AAG3B,SAAS,UAAU,KAAiB,OAAsB;AACxD,KAAI,UAAU,QACZ,QAAO,OAAO,YAAY,QAAQ,IAAI,MAAM,CAAC;AAE/C,QAAO,WAAW,KAAK,MAAM,CAAC,aAAa;;AAG7C,SAAS,UAAU,GAAe,GAAe;AAC/C,SAAQ,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,KAAK;;AAGxF,SAAS,QAAQ,GAAe,GAAe,QAAwB;AACrE,KAAI,WAAW,SACb,QAAO,UAAU,GAAG,EAAE;AAExB,KAAI,WAAW,OACb,QACE,aAAa,EAAE,KAAK,CAAC,cAAc,aAAa,EAAE,KAAK,EAAE,KAAA,GAAW,EAClE,aAAa,QACd,CAAC,IAAI,UAAU,GAAG,EAAE;AAGzB,QAAO,UAAU,GAAG,OAAO,CAAC,cAAc,UAAU,GAAG,OAAO,CAAC,IAAI,UAAU,GAAG,EAAE;;AAGpF,SAAgB,UAAU,MAA6B,QAAoC;CACzF,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,QAAQ,GAAG,GAAG,OAAO,OAAO,CAAC;AACrE,KAAI,OAAO,YAAY,OACrB,QAAO,OAAO,SAAS,CAAC;EAAE,KAAK;EAAO,MAAM;EAAQ,CAAC,GAAG,EAAE;CAE5D,MAAM,QAAQ,OAAO;CACrB,MAAM,yBAAS,IAAI,KAA8C;AACjE,MAAK,MAAM,OAAO,QAAQ;EACxB,MAAM,MAAM,SAAS,KAAK,MAAM;EAChC,MAAM,QAAQ,OAAO,IAAI,IAAI;AAC7B,MAAI,MACF,OAAM,KAAK,KAAK,IAAI;MAEpB,QAAO,IAAI,KAAK;GACd;GACA,OAAO,WAAW,KAAK,MAAM;GAC7B,MAAM,UAAU,KAAK,MAAM;GAC3B,MAAM,CAAC,IAAI;GACZ,CAAC;;AAGN,QAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;;AAK1E,SAAgB,cACd,QACA,OACA,OACA,OAC2B;AAC3B,KAAI,SAAS,MACX;CAEF,MAAM,SAAmB,EAAE;AAC3B,KAAI,SAAS,YAAY,QAAQ,MAAM,CACrC,QAAO,KAAK,MAAM,MAAM;CAE1B,MAAM,UACH,OAAO,SAAS,SAAS,IAAI,MAAM,OAAO,SAAS,SAAS,IAAI,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,OAAO,UAAU,SAAS,IAAI;AACxI,KAAI,SAAS,EACX,QAAO,KAAK,GAAG,OAAO,SAAS,WAAW,IAAI,KAAK,MAAM;AAE3D,KAAI,OAAO,OAAO,MAAM,CACtB,QAAO,KAAK,SAAS;AAEvB,QAAO;EAAE;EAAO;EAAO;EAAQ;;AAGjC,SAAgB,eAAe,QAA6B;AAC1D,QACE,OAAO,OAAO,MAAM,CAAC,SAAS,KAC9B,OAAO,SAAS,SAAS,KACzB,OAAO,SAAS,SAAS,KACzB,OAAO,OAAO,SAAS,MACtB,OAAO,UAAU,UAAU,KAAK;;AAIrC,SAAgB,aAAa,QAAgC;AAC3D,QAAO;EACL,GAAG;EACH,QAAQ;EACR,SAAS,OAAO;EAChB,QAAQ,OAAO;EAChB;;;;AClSH,SAAgB,WAAW,SAAuB,SAAiD;CACjG,MAAM,MAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,QAAQ,cAAc,EAAE,CAAC,CAChE,KAAI,OAAO;EAAE;EAAM,WAAW,QAAQ,aAAa;EAAG;AAExD,MAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,WAAW,EAAE,CAAC,CACvD,KAAI,OAAO;AAEb,QAAO;;AAUT,SAAgB,kBAAkB,OAAmD;CACnF,MAAM,MAAM,OAAO,QAAQ,SAAS,EAAE,CAAC,CACpC,QAAQ,GAAG,OAAO,EAAE,KAAK,gBAAgB,KAAA,EAAU,CACnD,KAAK,CAAC,KAAK,QAAQ;EAAE;EAAK,MAAM,EAAE;EAAM,WAAW,EAAE;EAAW,eAAe,EAAE;EAAe,EAAE;CACrG,MAAM,QAAQ,CAAC,aAAa,YAAY,CAAC,SAAS,QAAQ,IAAI,QAAQ,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3F,MAAM,WAAW,IAAI,QAAQ,MAAM,EAAE,IAAI,WAAW,aAAa,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,IAAI,CAAC;AAC7G,QAAO,CAAC,GAAG,OAAO,GAAG,SAAS;;AAGhC,SAAgB,WAAW,OAA4E;AACrG,KAAI,CAAC,MACH;CAEF,MAAM,MAAqC,EAAE;AAC7C,MAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,MAAM,CAC/C,KAAI,OAAO,OAAO;AAEpB,QAAO;;;;ACxBT,MAAM,aAAa,MAAU,KAAK,KAAK;AAEvC,MAAM,WAAW;AAEjB,SAAgB,aAAa,QAAgB,WAAmB;AAC9D,QAAO,GAAG,OAAO,GAAG;;AAGtB,IAAa,aAAb,MAAwB;CACtB;CACA;CAEA,YAAY,OAAuB;AACjC,QAAA,QAAc;AACd,QAAA,QAAc,EAAE,GAAG,MAAM,MAAM,EAAE;;CAGnC,IAAI,QAAgB,WAA0C;AAC5D,SAAO,MAAA,MAAY,aAAa,QAAQ,UAAU;;CAGpD,MAA2C;AACzC,SAAO,MAAA;;CAGT,KACE,QACA,WACA,MACA,MAAM,KAAK,KAAK,EACP;EACT,MAAM,KAAK,aAAa,QAAQ,UAAU;EAC1C,MAAM,WAAW,MAAA,MAAY;EAC7B,MAAM,OAAkB;GACtB,WAAW,KAAK,IAAI,UAAU,aAAa,GAAG,KAAK,aAAa,EAAE;GAClE,UAAU,KAAK,IAAI,UAAU,YAAY,GAAG,KAAK,YAAY,EAAE;GAG/D,OAAO,KAAK,UAAU,KAAA,IAAY,UAAU,QAAQ,KAAK,IAAI,UAAU,SAAS,GAAG,KAAK,MAAM;GAC9F,OAAO,KAAK,IAAI,UAAU,SAAS,GAAG,KAAK,SAAS,EAAE;GACtD,QAAQ;GACT;AACD,MACE,YACA,SAAS,cAAc,KAAK,aAC5B,SAAS,aAAa,KAAK,YAC3B,SAAS,UAAU,KAAK,SACxB,SAAS,UAAU,KAAK,SACxB,KAAK,SAAS,SAAS,SAAS,SAEhC,QAAO;AAET,QAAA,MAAY,MAAM;AAClB,QAAA,MAAY,MAAM,MAAA,MAAY,IAAI,CAAC;AACnC,SAAO;;CAGT,OAAO,QAAgB,WAAyB;EAC9C,MAAM,KAAK,aAAa,QAAQ,UAAU;AAC1C,MAAI,EAAE,MAAM,MAAA,OACV;AAEF,SAAO,MAAA,MAAY;AACnB,QAAA,MAAY,MAAM,MAAA,MAAY;;CAGhC,OAAO,KAAwC;EAC7C,MAAM,SAAS,MAAM;AACrB,OAAK,MAAM,CAAC,IAAI,SAAS,OAAO,QAAQ,MAAA,MAAY,CAClD,KAAI,KAAK,SAAS,OAChB,QAAO,MAAA,MAAY;AAGvB,SAAO,MAAA;;;;;;;;AASX,SAAgB,YAAY,MAA6B,MAA+E;AACtI,KAAI,CAAC,KACH,QAAO;AAET,KAAI,KAAK,eAAe,KAAA,EAItB,QAAO,KAAK,IAAI,GAAG,KAAK,cAAc,KAAK,SAAS,KAAK,YAAY;AAEvE,KAAI,KAAK,kBAAkB,KAAA,EACzB,QAAO,KAAK,IAAI,GAAG,KAAK,gBAAgB,KAAK,SAAS;AAExD,QAAO,KAAK,IAAI,IAAI,KAAK,SAAS,KAAK,KAAK,MAAM;;;;ACjHpD,MAAa,mBAAmB;AAkBhC,MAAa,yBAAyB;AAStC,SAAS,YAAY,MAAsB;CACzC,MAAM,UAAU,KAAK,SAAS,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,GAAG,IAAI;AACnE,QAAO,KAAK,IAAI,GAAG,KAAK,MAAO,KAAK,SAAS,IAAK,EAAE,GAAG,QAAQ;;AAGjE,SAAgB,aAAa,MAAiD,OAAyC;AACrH,KAAI,KAAK,SAAS,QAChB;CAEF,MAAM,SAAS,KAAK;AACpB,KAAI,CAAC,UAAU,OAAO,SAAS,YAAY,OAAO,OAAO,SAAS,SAChE;AAEF,QAAO;EACL,MAAM;EACN,YAAY,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;EACxE,OAAO,YAAY,OAAO,KAAK;EAC/B,YAAY;EACb;;AAgVH,MAAa,sBAAiE;CAC5E,QAAQ;EACN,sBAAsB;EACtB,iBAAiB;GAAC;GAAW;GAAe;GAAqB;GAAQ;GAAW;GAAO;EAC3F,uBAAuB;EACvB,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,YAAY;EACZ,WAAW;EACX,kBAAkB;EAClB,mBAAmB;EACnB,eAAe;EACf,cAAc;EACd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;GAAC;GAAS;GAAO;GAAO;EACrC,kBAAkB;GAAC;GAAO;GAAU;GAAQ;GAAS;GAAM;EAC3D,KAAK;EACL,SAAS;EACT,WAAW;EACZ;CACD,OAAO;EACL,sBAAsB;EACtB,iBAAiB;GAAC;GAAW;GAAe;GAAqB;GAAO;EACxE,uBAAuB;EACvB,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,YAAY;EACZ,WAAW;EACX,kBAAkB;EAClB,mBAAmB;EACnB,eAAe;EACf,cAAc;EACd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa,CAAC,SAAS,OAAO;EAC9B,kBAAkB;GAAC;GAAW;GAAO;GAAU;GAAQ;GAAQ;EAC/D,KAAK;EACL,SAAS;EACT,WAAW;EACZ;CACD,UAAU;EACR,sBAAsB;EACtB,iBAAiB;GAAC;GAAW;GAAqB;GAAU;EAC5D,uBAAuB;EACvB,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,cAAc;EACd,YAAY;EACZ,WAAW;EACX,kBAAkB;EAClB,mBAAmB;EACnB,eAAe;EACf,cAAc;EACd,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;GAAC;GAAS;GAAO;GAAO;EACrC,KAAK;EACL,SAAS;EACT,WAAW;EACZ;CACF;AAED,SAAgB,uBAAuB,QAAmC,MAA+B;AACvG,QAAO,oBAAoB,UAAU,UAAU,gBAAgB,SAAS,KAAK;;AA2H/E,MAAa,mBAAmB;AA4ChC,SAAgB,eAAe,MAAoD;AACjF,KAAI,KAAK,SAAS,gBAChB;CAEF,MAAM,EAAE,aAAa,WAAW,eAAe,KAAK;AACpD,QAAO;EAAE;EAAa;EAAW;EAAY;;AAG/C,SAAgB,mBAAmB,MAAgC;AACjE,KAAI,qBAAqB,QAAQ,KAAK,mBAAmB,KACvD,QAAO;AAET,SAAQ,KAAK,MAAb;EACE,KAAK,qBAAqB;GACxB,MAAM,UAAU,KAAK,QAAQ;AAC7B,OAAI,OAAO,YAAY,SACrB,QAAO,QAAQ,MAAM,KAAK,KAAK,IAAI;AAGrC,UADa,QAAQ,QAAQ,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS,cAAc,MAAM,SAAS,WAAW,CAAC;;EAG1H,KAAK,eACH,QAAO,KAAK,YAAY,IAAI;EAE9B,KAAK;EACL,KAAK;EACL,KAAK,gBACH,QAAO;EAET,QACE,QAAO;;;;;;;;;;;;;;;;;;;;;;;AAyBb,SAAgB,gBAAgB,MAAgC;AAC9D,KAAI,qBAAqB,QAAQ,KAAK,mBAAmB,KACvD,QAAO;AAET,SAAQ,KAAK,MAAb;EACE,KAAK,qBAAqB;GACxB,MAAM,UAAU,KAAK,QAAQ;AAC7B,OAAI,OAAO,YAAY,SACrB,QAAO,QAAQ,MAAM,KAAK,KAAK,IAAI;AAErC,UAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,MAAM,KAAK,GAAG,CAAC;;EAExH,KAAK,eACH,QAAO,KAAK,YAAY,IAAI;EAE9B,KAAK,cACH,QAAO,KAAK,UAAU,IAAI;EAE5B,KAAK;EACL,KAAK,gBACH,QAAO;EAET,QACE,QAAO;;;AAKb,SAAgB,kBAAkB,MAAiC;AACjE,SAAQ,KAAK,MAAb;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,qBACH,QAAO;EAET,QACE,QAAO;;;AAKb,SAAgB,kBAAkB,MAA4C;AAC5E,SAAQ,KAAK,MAAb;EACE,KAAK,gBACH,QAAO;EAET,KAAK,aACH,QAAO,KAAK,KAAK,gBAAgB,cAAc,KAAK,KAAK,kBAAkB,KAAA;EAE7E,KAAK,iBACH,QAAO;EAET,KAAK,YACH,QAAO,KAAK,QAAQ,SAAS,YAAY,KAAK,QAAQ,YAAY,WAAW,4BAA4B,KAAA;EAE3G,QACE;;;AAKN,SAAgB,cAAc,MAAiC;AAC7D,KAAI,KAAK,SAAS,eAChB,QAAO;CAET,MAAM,QAAQ,KAAK;AACnB,KAAI,MAAM,SAAS,sBACjB,QAAO;AAET,QAAO,MAAM,OAAO,SAAS,gBAAgB,MAAM,OAAO,SAAS;;AAGrE,SAAgB,gBAAgB,MAAiC;AAC/D,QAAO,KAAK,SAAS"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workerdeck/protocol",
-  "version": "0.22.0",
+  "version": "1.0.0",
   "type": "module",
   "description": "The WorkerDeck wire protocol: typed session events, commands, and REST shapes shared by server and clients. Dependency-free, browser-safe. This protocol is the product boundary — versioned from day one.",
   "license": "MIT",
@@ -44,6 +44,7 @@
   "scripts": {
     "clean": "rimraf build",
     "build": "tsdown",
-    "typecheck": "tsgo -p tsconfig.json"
+    "typecheck": "tsgo -p tsconfig.json",
+    "test": "echo \"@workerdeck/protocol has no tests of its own — its rules (transcriptActivity, replayCoalesceKey, snapshotRetains/replayRetains, result truncation, image refs) are proven against real consumers in packages/react/test and packages/core/test.\""
   }
 }