@workerdeck/server 0.6.0

package/build/index.mjs

@@ -0,0 +1,1876 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join, resolve, sep } from "node:path";
+import { WebSocketServer } from "ws";
+import { listSessions } from "@anthropic-ai/claude-agent-sdk";
+import { BrowserBridgeExecutor, SessionRunner, checkClaudeAuth } from "@workerdeck/core";
+import { JobQueue } from "@workerdeck/queue";
+import { PROTOCOL_VERSION, PROVIDER_PERMISSION_MODES, supportsPermissionMode } from "@workerdeck/protocol";
+import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+//#region src/registry.ts
+/** In-memory session table. Terminal sessions stay listed until removed or the process exits. */
+var SessionRegistry = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#options;
+	constructor(options = {}) {
+		this.#options = options;
+	}
+	create(config) {
+		return this.adopt(new SessionRunner(config));
+	}
+	/** Build and list a Claude-engine runner without starting it, so watchers can
+	* subscribe first. Call `start()` once they have. */
+	prepare(config) {
+		return this.register(new SessionRunner(config));
+	}
+	/** Register an already-built runner (a non-Claude engine) and start it. */
+	adopt(runner) {
+		this.register(runner);
+		runner.start();
+		return runner;
+	}
+	/** List a runner without starting it — for a rehydrated session, whose watchers
+	* must be subscribed before it comes back up. */
+	register(runner) {
+		const existing = this.#sessions.get(runner.id);
+		this.#sessions.set(runner.id, runner);
+		if (existing !== runner) this.#options.onRegister?.(runner);
+		return runner;
+	}
+	get(id) {
+		return this.#sessions.get(id);
+	}
+	list() {
+		return [...this.#sessions.values()].map((r) => r.info());
+	}
+	remove(id) {
+		const runner = this.#sessions.get(id);
+		if (!runner) return false;
+		runner.close("server");
+		return this.#sessions.delete(id);
+	}
+	/** Drop a runner WITHOUT closing it: the session isn't ending, it parked and
+	* lives on in its snapshot. Closing here would tell every client it was over. */
+	evict(id) {
+		return this.#sessions.delete(id);
+	}
+	closeAll() {
+		for (const runner of this.#sessions.values()) runner.close("server");
+	}
+};
+//#endregion
+//#region src/notifications.ts
+/**
+* Turns session events into the handful of notifications a human away from the
+* screen cares about, and delivers them to a webhook and/or a local observer.
+*
+* This is the *primitive*, deliberately transport-agnostic: the server stays
+* credential-free and knows nothing about APNs, Slack or email. Turning a
+* notification into a push is a forwarder's job (the turnkey CLI's), and one that
+* needs credentials, so it does not live here.
+*
+* Delivery is best-effort and ordered per session, mirroring the job queue's
+* webhook behaviour — a consumer that missed one can always attach to the session
+* WS with `afterSeq` and see the truth.
+*/
+var SessionNotifier = class {
+	#options;
+	/** Per-session delivery chain, so a session's notifications arrive in order. */
+	#chains = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#options = options;
+	}
+	/** True when nothing is listening — lets the caller skip subscribing at all. */
+	get idle() {
+		return !this.#options.webhook && !this.#options.onNotification;
+	}
+	/**
+	* Subscribe to a runner for its lifetime.
+	*
+	* `afterSeq` defaults to whatever the runner has already emitted, which is what
+	* makes this safe on a *rehydrated* session: `subscribe` replays the log from
+	* `afterSeq`, so subscribing at 0 to a session rebuilt from a park would
+	* re-announce every permission request it ever made.
+	*/
+	watch(runner, afterSeq = runner.info().lastSeq) {
+		if (this.idle) return;
+		runner.subscribe((event) => {
+			switch (event.type) {
+				case "permission_requested":
+					this.#emit(runner, event.seq, event.ts, {
+						type: "permission_requested",
+						preview: event.request.title ?? event.request.toolName,
+						request: event.request
+					});
+					return;
+				case "turn_result":
+					this.#emit(runner, event.seq, event.ts, {
+						type: "turn_completed",
+						preview: event.isError ? event.errors?.join("\n") : event.result,
+						result: {
+							isError: event.isError,
+							durationMs: event.durationMs,
+							numTurns: event.numTurns,
+							totalCostUsd: event.totalCostUsd
+						}
+					});
+					return;
+				case "session_error":
+					this.#emit(runner, event.seq, event.ts, {
+						type: "session_error",
+						preview: event.message
+					});
+					return;
+				case "session_closed":
+					this.#emit(runner, event.seq, event.ts, {
+						type: "session_closed",
+						reason: event.reason
+					});
+					return;
+				default: return;
+			}
+		}, afterSeq);
+	}
+	#emit(runner, seq, ts, body) {
+		queueMicrotask(() => this.#send(runner, seq, ts, body));
+	}
+	#send(runner, seq, ts, body) {
+		const webhook = this.#options.webhook;
+		const wanted = !webhook?.events || webhook.events.includes(body.type);
+		if (!webhook && !this.#options.onNotification) return;
+		const notification = {
+			...body,
+			sessionId: runner.id,
+			session: runner.info(),
+			seq,
+			ts
+		};
+		try {
+			this.#options.onNotification?.(notification);
+		} catch {}
+		if (!webhook || !wanted) return;
+		const next = (this.#chains.get(runner.id) ?? Promise.resolve()).then(() => this.#deliver(webhook, notification));
+		this.#chains.set(runner.id, next);
+		next.then(() => {
+			if (this.#chains.get(runner.id) === next) this.#chains.delete(runner.id);
+		});
+	}
+	/**
+	* Best-effort POST with exponential backoff. Deliberately a near-copy of the
+	* queue's job-webhook delivery rather than a shared helper: the two channels
+	* have different payloads and different consumers, and coupling them would mean
+	* a change to job deliveries silently changing session deliveries.
+	*/
+	async #deliver(webhook, notification) {
+		const attempts = this.#options.attempts ?? 3;
+		const baseDelay = this.#options.retryDelayMs ?? 500;
+		for (let attempt = 0; attempt < attempts; attempt++) {
+			try {
+				if ((await fetch(webhook.url, {
+					method: "POST",
+					headers: {
+						"content-type": "application/json",
+						...webhook.headers
+					},
+					body: JSON.stringify(notification)
+				})).ok) return;
+			} catch {}
+			if (attempt < attempts - 1) await new Promise((resolve) => setTimeout(resolve, baseDelay * 2 ** attempt));
+		}
+	}
+};
+//#endregion
+//#region src/bridge.ts
+/**
+* Routes tool executions between a session and the browser tabs attached to it.
+*
+* A session may have several clients attached (dashboard plus embedded panel);
+* the bridge asks the **first attached** one, which is the closest thing to "the
+* client driving this session". If none is attached, dispatch fails fast rather
+* than hanging — an autonomous job simply never bridges, it uses the server
+* executor instead.
+*/
+var BridgeHub = class {
+	#sessions = /* @__PURE__ */ new Map();
+	#options;
+	constructor(options = {}) {
+		this.#options = options;
+	}
+	/** The executor to hand a runner for this session. Created on first use and
+	* reused, so results routed back always reach the same pending table. */
+	executorFor(sessionId) {
+		return this.#bridge(sessionId).executor;
+	}
+	/** How many clients are watching this session. Parking consults it: a session
+	* someone is watching stays live. */
+	attachedCount(sessionId) {
+		return this.#sessions.get(sessionId)?.sockets.length ?? 0;
+	}
+	/** Register an attached client. Returns a detach function. */
+	attach(sessionId, send) {
+		const bridge = this.#bridge(sessionId);
+		bridge.sockets.push(send);
+		return () => {
+			const index = bridge.sockets.indexOf(send);
+			if (index >= 0) bridge.sockets.splice(index, 1);
+		};
+	}
+	/**
+	* Deliver a client's answer to a bridged call. Returns false when the id is
+	* unknown or already settled — late and duplicate answers are ignored.
+	*/
+	resolve(sessionId, executionId, answer) {
+		return this.#sessions.get(sessionId)?.executor.resolve(executionId, answer) ?? false;
+	}
+	/** Drop a session's bridge, failing anything still in flight. */
+	remove(sessionId) {
+		const bridge = this.#sessions.get(sessionId);
+		if (!bridge) return;
+		bridge.executor.registry.cancelAll("session_closed", "the session was closed");
+		this.#sessions.delete(sessionId);
+	}
+	#bridge(sessionId) {
+		const existing = this.#sessions.get(sessionId);
+		if (existing) return existing;
+		const bridge = {
+			sockets: [],
+			executor: new BrowserBridgeExecutor({
+				timeoutMs: this.#options.timeoutMs,
+				send: (frame) => {
+					const target = bridge.sockets[0];
+					if (!target) return false;
+					target(frame);
+					return true;
+				},
+				cancel: (executionId, reason) => {
+					for (const send of bridge.sockets) send({
+						type: "tool_call_canceled",
+						executionId,
+						reason
+					});
+				},
+				onResult: (executionId, result) => {
+					this.#options.onResult?.(sessionId, executionId, result);
+				}
+			})
+		};
+		this.#sessions.set(sessionId, bridge);
+		return bridge;
+	}
+};
+//#endregion
+//#region src/parking.ts
+/**
+* Deferred execution's other half: parking a session that is waiting on work no
+* process in this server is doing.
+*
+* The runner announces the moment with `status_changed: 'parked'` — emitted only
+* once every dispatch of the batch has been handed over, so the snapshot can never
+* miss a call that was still being dispatched. From there this class snapshots,
+* evicts, and persists; delivering a result rebuilds the runner under the same id
+* and hands the result to it. The session's identity, event log, and seq numbering
+* survive intact, so a client reattaching with `afterSeq` sees one unbroken stream.
+*/
+var SessionParkManager = class {
+	#options;
+	/** executionId → sessionId, for routing a result to its session. Kept in memory
+	* across the park; rebuilt from the store by {@link hydrate}. */
+	#owners = /* @__PURE__ */ new Map();
+	/** Executions already settled, kept until their session ends so a late or
+	* duplicate delivery answers "already settled" instead of "never heard of it". */
+	#settled = /* @__PURE__ */ new Map();
+	#timers = /* @__PURE__ */ new Map();
+	/** One resume per session, ever: two results arriving together must not build
+	* two runners under the same id (the second would orphan the first, leaking the
+	* MCP connection the park existed to release). */
+	#resuming = /* @__PURE__ */ new Map();
+	#detachTimers = /* @__PURE__ */ new Map();
+	/** The config each live session was built from — what a rebuild needs, and the
+	* one thing a runner doesn't carry on its public surface. */
+	#configs = /* @__PURE__ */ new Map();
+	/**
+	* In-flight store work per session, so operations on one record run in order.
+	*
+	* Load-bearing with any store whose writes are real I/O. `#park` must evict the
+	* runner *before* the save completes (an attach between `park()` and `evict()`
+	* would bind a client to an inert runner), which leaves a window where the
+	* session is in neither the registry nor the store. A delivery arriving inside it
+	* would read past the write: `store.get` misses, the result is answered 404, the
+	* execution is filed as settled with its watchdog cleared — and then the record
+	* lands on disk with nothing left alive that could ever wake it. A `discard`
+	* inside the same window would delete nothing and leave the save to resurrect a
+	* session the caller was told was closed.
+	*/
+	#storeOps = /* @__PURE__ */ new Map();
+	#closed = false;
+	constructor(options) {
+		this.#options = options;
+	}
+	/** Record the config a session was created with. Only sessions the host
+	* remembers can be parked — there is no way to rebuild the others. */
+	remember(sessionId, config) {
+		this.#configs.set(sessionId, config);
+	}
+	/** Adopt the store's contents (a durable store after a restart): re-index the
+	* executions and re-arm their watchdogs, no deadline sooner than the grace
+	* window — nothing could have been delivered while the process was down. */
+	async hydrate() {
+		const floor = Date.now() + (this.#options.expiredGraceMs ?? 6e4);
+		for (const record of await this.#options.store.list()) for (const execution of record.executions) this.#track(record.id, execution, floor);
+	}
+	/**
+	* Follow a session's lifecycle: index its deferred executions, park it when the
+	* engine says the turn has come to rest on them, and clean up when it ends.
+	* `afterSeq` skips a rehydrated runner's replayed history (re-arming a watchdog
+	* from an event whose deadline already passed would fail the execution instantly).
+	*/
+	watch(runner, afterSeq = 0) {
+		return runner.subscribe((event) => {
+			switch (event.type) {
+				case "execution_dispatched":
+					if (!event.deferred) return;
+					this.#track(runner.id, {
+						executionId: event.executionId,
+						toolName: event.toolName,
+						expiresAt: event.expiresAt
+					});
+					return;
+				case "execution_result":
+				case "execution_failed":
+					this.#forget(event.executionId);
+					if (runner.info().status === "parked") this.#park(runner);
+					return;
+				case "status_changed":
+					if (event.status === "parked") this.#park(runner);
+					return;
+				case "session_closed":
+					this.discard(runner.id);
+					return;
+				default: return;
+			}
+		}, afterSeq);
+	}
+	/** A client detached: park the session if that was the last one watching. */
+	onDetach(sessionId) {
+		if (this.#closed) return;
+		const runner = this.#options.registry.get(sessionId);
+		if (!runner || runner.info().status !== "parked") return;
+		clearTimeout(this.#detachTimers.get(sessionId));
+		const timer = setTimeout(() => {
+			this.#detachTimers.delete(sessionId);
+			this.#park(runner);
+		}, this.#options.parkDelayMs ?? 2e3);
+		timer.unref?.();
+		this.#detachTimers.set(sessionId, timer);
+	}
+	/** Which session this execution belongs to — still waiting, or already settled. */
+	sessionFor(executionId) {
+		return this.#owners.get(executionId) ?? this.#settled.get(executionId);
+	}
+	/** The parked session's record, for the read paths (GET, list, attach). */
+	get(id) {
+		return this.#queue(id, () => this.#options.store.get(id));
+	}
+	/** Every parked session's info, to merge into `GET {basePath}/sessions`. */
+	async listInfo() {
+		await Promise.all(this.#storeOps.values());
+		return (await this.#options.store.list()).map((record) => record.info);
+	}
+	/** The live runner for a session, rehydrating a parked one on demand. Undefined
+	* when the session is neither live nor parked. */
+	async ensureLive(id) {
+		const live = this.#options.registry.get(id);
+		if (live) return live;
+		return this.#resume(id);
+	}
+	/**
+	* Deliver a deferred execution's result. Rehydrates the session if needed and
+	* folds the result into its agent loop.
+	*
+	* Undefined = no session is waiting on that id. `applied: false` = it was already
+	* settled: a duplicate delivery, or one racing the watchdog. Both are expected,
+	* neither is an error.
+	*/
+	async submitResult(executionId, result) {
+		const sessionId = this.#owners.get(executionId);
+		if (sessionId === void 0) {
+			const settled = this.#settled.get(executionId);
+			return settled === void 0 ? void 0 : {
+				applied: false,
+				sessionId: settled
+			};
+		}
+		const runner = await this.ensureLive(sessionId);
+		if (!runner) {
+			this.#forget(executionId);
+			return;
+		}
+		this.#clearTimer(executionId);
+		const applied = runner.settleExecution?.(executionId, result) ?? false;
+		if (applied) this.#forget(executionId);
+		return {
+			applied,
+			sessionId
+		};
+	}
+	/** Drop a parked session for good: the run is over (closed, canceled, killed). */
+	async discard(sessionId) {
+		clearTimeout(this.#detachTimers.get(sessionId));
+		this.#detachTimers.delete(sessionId);
+		this.#configs.delete(sessionId);
+		for (const [executionId, owner] of this.#owners) if (owner === sessionId) this.#forget(executionId);
+		for (const [executionId, owner] of this.#settled) if (owner === sessionId) this.#settled.delete(executionId);
+		await this.#queue(sessionId, () => this.#options.store.delete(sessionId));
+	}
+	close() {
+		this.#closed = true;
+		for (const timer of this.#timers.values()) clearTimeout(timer);
+		for (const timer of this.#detachTimers.values()) clearTimeout(timer);
+		this.#timers.clear();
+		this.#detachTimers.clear();
+	}
+	async #park(runner) {
+		if (this.#closed || !runner.park) return;
+		const id = runner.id;
+		if (this.#options.registry.get(id) !== runner) return;
+		if (runner.info().status !== "parked") return;
+		if (this.#options.attachedCount(id) > 0) return;
+		const executions = [...this.#owners].filter(([, owner]) => owner === id).map(([e]) => e);
+		if (executions.length === 0) return;
+		const config = this.#configs.get(id);
+		if (!config) return;
+		if (this.#options.onParking && !this.#options.onParking(id, executions[0])) return;
+		const snapshot = runner.park();
+		if (!snapshot) return;
+		const info = {
+			...runner.info(),
+			status: "parked"
+		};
+		this.#options.registry.evict(id);
+		const record = {
+			id,
+			info,
+			profile: info.profile,
+			config,
+			snapshot,
+			executions: snapshot.parked,
+			parkedAt: Date.now()
+		};
+		for (const execution of snapshot.parked) this.#track(id, execution);
+		try {
+			await this.#queue(id, () => this.#options.store.save(record));
+		} catch (error) {
+			this.#options.onError?.(error, {
+				sessionId: id,
+				phase: "park"
+			});
+		}
+	}
+	async #resume(id) {
+		const inFlight = this.#resuming.get(id);
+		if (inFlight) return inFlight;
+		const attempt = this.#rebuild(id);
+		this.#resuming.set(id, attempt);
+		try {
+			return await attempt;
+		} finally {
+			this.#resuming.delete(id);
+		}
+	}
+	async #rebuild(id) {
+		const record = await this.#queue(id, () => this.#options.store.get(id));
+		if (!record) return void 0;
+		let runner;
+		try {
+			runner = await this.#options.rebuild(record);
+		} catch (error) {
+			this.#options.onError?.(error, {
+				sessionId: id,
+				phase: "resume"
+			});
+			throw error;
+		}
+		if (runner.id !== id) {
+			runner.close("error");
+			const error = /* @__PURE__ */ new Error(`rebuilt session has id '${runner.id}', expected '${id}' — the engine factory must forward EngineRunnerContext.restore to the runner config`);
+			this.#options.onError?.(error, {
+				sessionId: id,
+				phase: "resume"
+			});
+			throw error;
+		}
+		this.#options.registry.register(runner);
+		this.remember(id, record.config);
+		this.watch(runner, record.snapshot.seq);
+		this.#options.onResumed?.(id, runner);
+		await this.#queue(id, () => this.#options.store.delete(id));
+		runner.start();
+		return runner;
+	}
+	/** Run a store operation after whatever is already in flight for this session.
+	* The chain is per session and drops itself once idle; a failed operation never
+	* poisons the ones behind it (each caller handles its own). */
+	#queue(sessionId, op) {
+		const result = (this.#storeOps.get(sessionId) ?? Promise.resolve()).then(op);
+		const settled = result.then(() => {}, () => {});
+		this.#storeOps.set(sessionId, settled);
+		settled.then(() => {
+			if (this.#storeOps.get(sessionId) === settled) this.#storeOps.delete(sessionId);
+		});
+		return result;
+	}
+	#track(sessionId, execution, notBefore = 0) {
+		this.#owners.set(execution.executionId, sessionId);
+		if (execution.expiresAt === void 0 || this.#timers.has(execution.executionId)) return;
+		const expiresAt = Math.max(execution.expiresAt, notBefore);
+		const timer = setTimeout(() => {
+			this.#timers.delete(execution.executionId);
+			this.submitResult(execution.executionId, {
+				status: "failed",
+				reason: "timeout",
+				error: `deferred execution '${execution.toolName}' produced no result before its deadline`
+			}).catch((error) => {
+				this.#options.onError?.(error, {
+					sessionId,
+					phase: "resume"
+				});
+			});
+		}, Math.max(0, expiresAt - Date.now()));
+		timer.unref?.();
+		this.#timers.set(execution.executionId, timer);
+	}
+	#forget(executionId) {
+		this.#clearTimer(executionId);
+		const owner = this.#owners.get(executionId);
+		if (owner !== void 0) this.#settled.set(executionId, owner);
+		this.#owners.delete(executionId);
+	}
+	#clearTimer(executionId) {
+		const timer = this.#timers.get(executionId);
+		if (timer === void 0) return;
+		clearTimeout(timer);
+		this.#timers.delete(executionId);
+	}
+};
+//#endregion
+//#region src/session-store.ts
+/** Single-process, no persistence: parks survive a client disconnect, not a restart. */
+var MemorySessionStore = class {
+	#records = /* @__PURE__ */ new Map();
+	save(record) {
+		this.#records.set(record.id, record);
+		return Promise.resolve();
+	}
+	get(id) {
+		return Promise.resolve(this.#records.get(id) ?? null);
+	}
+	list() {
+		return Promise.resolve([...this.#records.values()]);
+	}
+	delete(id) {
+		return Promise.resolve(this.#records.delete(id));
+	}
+};
+/**
+* Config fields that must not be written to durable storage: two are functions
+* (JSON drops them silently), `extraOptions` is SDK `Options` and may hold hooks
+* and callbacks, and `env` is a credential-bearing map — the same rule
+* `profile-store.ts` follows, for the same reason.
+*
+* Dropping them costs a rehydrated session nothing: all four are consumed by the
+* Claude engine alone, and the Claude engine cannot park (the CLI owns its process
+* state — `buildRunner` refuses a `restore` for it). A provider session's
+* credentials are resolved by `createEngineRunner` from the operator's environment
+* on every build, wake included.
+*/
+const EPHEMERAL_CONFIG_KEYS = [
+	"queryFn",
+	"historyFn",
+	"extraOptions",
+	"env"
+];
+/** The record as it may be persisted: same session, config narrowed to what is
+* safe and meaningful to keep (see {@link EPHEMERAL_CONFIG_KEYS}). */
+function toDurableRecord(record) {
+	const config = { ...record.config };
+	for (const key of EPHEMERAL_CONFIG_KEYS) delete config[key];
+	return {
+		...record,
+		config
+	};
+}
+/** Bump when the on-disk shape changes incompatibly; records written by another
+* version are ignored rather than half-read into a broken session. */
+const FORMAT_VERSION = 1;
+/**
+* Durable single-host store: one JSON file per parked session under `dir`, written
+* through a temp file and a rename so a crash mid-write cannot truncate a session.
+* `hydrate()` at `listen()` picks them up, re-indexes their executions, and re-arms
+* the watchdogs, so a restart no longer loses parked work.
+*
+* Know what is on that disk: **the record holds the session's entire transcript** —
+* prompts, model output, and tool I/O — in plaintext. Put it somewhere with the same
+* protection as the SDK's own transcripts (`~/.claude/projects`), not in a directory
+* that gets served, synced, or backed up somewhere looser.
+*
+* Single-process by design, exactly like the bundled queue adapter and profile
+* store: two servers sharing one directory would both hydrate the same records and
+* race to rebuild them. That is what the seam is for.
+*
+* Nothing here reaps: a record leaves only when its session wakes or is deleted.
+* An execution dispatched without a deadline (a `DeferredExecutor` with no
+* `timeoutMs`) has no watchdog to end the wait, so its record — and its transcript
+* — stays until `DELETE /sessions/:id`. Give deferred calls a deadline, or sweep.
+*/
+function createFileSessionStore(options = {}) {
+	const dir = options.dir ?? join(process.cwd(), ".workerdeck", "parked");
+	const fileFor = (id) => join(dir, `${encodeURIComponent(id)}.json`);
+	const read = async (path) => {
+		let raw;
+		try {
+			raw = await readFile(path, "utf8");
+		} catch (error) {
+			if (isMissing(error)) return null;
+			options.onError?.(error, {
+				path,
+				op: "read"
+			});
+			return null;
+		}
+		try {
+			return parseRecord(JSON.parse(raw));
+		} catch (error) {
+			options.onError?.(error, {
+				path,
+				op: "read"
+			});
+			return null;
+		}
+	};
+	return {
+		save: async (record) => {
+			const path = fileFor(record.id);
+			let payload;
+			try {
+				payload = JSON.stringify({
+					version: FORMAT_VERSION,
+					record: toDurableRecord(record)
+				});
+			} catch (error) {
+				options.onError?.(error, {
+					path,
+					op: "save"
+				});
+				throw new Error(`parked session '${record.id}' is not JSON-serializable — a host-injected value reached its config or snapshot: ${String(error)}`);
+			}
+			try {
+				await mkdir(dir, {
+					recursive: true,
+					mode: 448
+				});
+				const temp = `${path}.${process.pid}.tmp`;
+				await writeFile(temp, payload, { mode: 384 });
+				await rename(temp, path);
+			} catch (error) {
+				options.onError?.(error, {
+					path,
+					op: "save"
+				});
+				throw error;
+			}
+		},
+		get: (id) => read(fileFor(id)),
+		list: async () => {
+			let names;
+			try {
+				names = await readdir(dir);
+			} catch (error) {
+				if (isMissing(error)) return [];
+				options.onError?.(error, {
+					path: dir,
+					op: "read"
+				});
+				throw error;
+			}
+			return (await Promise.all(names.filter((name) => name.endsWith(".json")).map(async (name) => {
+				const record = await read(join(dir, name));
+				if (!record) return null;
+				if (`${encodeURIComponent(record.id)}.json` === name) return record;
+				options.onError?.(/* @__PURE__ */ new Error(`parked record '${record.id}' is stored as '${name}' and cannot be read back by id`), {
+					path: join(dir, name),
+					op: "read"
+				});
+				return null;
+			}))).filter((record) => record !== null);
+		},
+		delete: async (id) => {
+			const path = fileFor(id);
+			try {
+				await rm(path);
+				return true;
+			} catch (error) {
+				if (isMissing(error)) return false;
+				options.onError?.(error, {
+					path,
+					op: "delete"
+				});
+				return false;
+			}
+		}
+	};
+}
+const isMissing = (error) => error.code === "ENOENT";
+/** Shape-check a parsed file. A record missing any of these could not be rebuilt,
+* and half-restoring one is worse than skipping it. */
+function parseRecord(value) {
+	if (!value || typeof value !== "object") return null;
+	const envelope = value;
+	if (envelope.version !== FORMAT_VERSION) return null;
+	const record = envelope.record;
+	if (!record || typeof record !== "object") return null;
+	if (typeof record.id !== "string" || typeof record.parkedAt !== "number") return null;
+	if (!record.info || !record.config || !record.snapshot) return null;
+	if (!Array.isArray(record.executions)) return null;
+	return record;
+}
+//#endregion
+//#region src/server.ts
+const defaultSdkSessionLister = async (options) => {
+	return (await listSessions(options)).map((s) => ({
+		sessionId: s.sessionId,
+		summary: s.summary,
+		lastModified: s.lastModified,
+		createdAt: s.createdAt,
+		customTitle: s.customTitle,
+		firstPrompt: s.firstPrompt,
+		gitBranch: s.gitBranch,
+		cwd: s.cwd
+	}));
+};
+function json(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"content-length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+async function readJsonBody(req, maxBytes) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		size += chunk.length;
+		if (size > maxBytes) throw new Error("request body too large");
+		chunks.push(chunk);
+	}
+	if (size === 0) return {};
+	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+/**
+* Curated, view-only snapshot of a profile's config dir for GET /profiles/:name.
+* Best-effort: a missing or unparseable settings.json just omits the settings block.
+* Env var VALUES are never read into the response — names only.
+*
+* Provider profiles have no config dir, so the snapshot is empty for them: their
+* configuration is the `provider` block already on ProfileInfo.
+*/
+function readProfileConfig(profile) {
+	const dir = profile.configDir;
+	if (!dir) return {
+		hasUserMemory: false,
+		skills: [],
+		agents: [],
+		commands: []
+	};
+	const listDirs = (path) => {
+		try {
+			return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+		} catch {
+			return [];
+		}
+	};
+	const listMd = (path) => {
+		try {
+			return readdirSync(path).filter((file) => file.endsWith(".md")).map((file) => file.slice(0, -3)).sort();
+		} catch {
+			return [];
+		}
+	};
+	const snapshot = {
+		hasUserMemory: existsSync(join(dir, "CLAUDE.md")),
+		skills: listDirs(join(dir, "skills")),
+		agents: listMd(join(dir, "agents")),
+		commands: listMd(join(dir, "commands"))
+	};
+	try {
+		const raw = JSON.parse(readFileSync(join(dir, "settings.json"), "utf8"));
+		const permissions = raw.permissions ?? {};
+		const count = (rules) => Array.isArray(rules) ? rules.length : 0;
+		snapshot.settings = {
+			model: typeof raw.model === "string" ? raw.model : void 0,
+			defaultPermissionMode: typeof permissions.defaultMode === "string" ? permissions.defaultMode : void 0,
+			permissionRules: {
+				allow: count(permissions.allow),
+				ask: count(permissions.ask),
+				deny: count(permissions.deny)
+			},
+			envKeys: raw.env && typeof raw.env === "object" ? Object.keys(raw.env).sort() : void 0,
+			hooks: raw.hooks && typeof raw.hooks === "object" ? Object.keys(raw.hooks).sort() : void 0
+		};
+	} catch {}
+	return snapshot;
+}
+/** Conservative content types for VFS downloads: text formats the agent actually
+* produces; anything unrecognized ships as plain text (the VFS is string-backed). */
+const CONTENT_TYPES = {
+	json: "application/json; charset=utf-8",
+	md: "text/markdown; charset=utf-8",
+	html: "text/html; charset=utf-8",
+	csv: "text/csv; charset=utf-8",
+	xml: "application/xml; charset=utf-8",
+	svg: "image/svg+xml; charset=utf-8"
+};
+function contentTypeFor(filename) {
+	return CONTENT_TYPES[filename.includes(".") ? filename.split(".").pop().toLowerCase() : ""] ?? "text/plain; charset=utf-8";
+}
+/** A profile runs the model-agnostic engine rather than Claude Code. `engine` is
+* optional so profiles written before provider support keep meaning 'claude'. */
+function isProviderProfile(profile) {
+	return profile.engine === "provider";
+}
+/** Where the CLI's own resolution lands for a given environment: an explicit
+* CLAUDE_CONFIG_DIR, else ~/.claude. */
+function cliConfigDir(env) {
+	return env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+}
+/** Auto-created profile when none are declared: the operator's own config dir. */
+function detectDefaultProfiles() {
+	const dir = cliConfigDir(process.env);
+	return existsSync(dir) ? [{
+		name: "default",
+		configDir: dir
+	}] : [];
+}
+/** Compare config dirs by what they name on disk: declared paths arrive with
+* trailing slashes or symlinked prefixes (`/var` vs `/private/var` on macOS); a
+* path that doesn't exist falls back to plain normalization. */
+function canonicalDir(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/**
+* The env a Claude session under `profile` is spawned with, starting from
+* `base` (the host hook's env, else the server's own). The pin is skipped when
+* `base` would already land the CLI in the profile's dir, and that skip is
+* load-bearing, not an optimisation: CLAUDE_CONFIG_DIR *set at all* switches
+* the CLI's credential source to `<dir>/.credentials.json` — on macOS a
+* claude.ai login lives in the login Keychain, consulted only while the
+* variable is UNSET, so pinning even the CLI's own default `~/.claude` turns a
+* working login into "Not logged in". When `base` names a *different* dir than
+* the profile, the pin stands: the profile must win over hook- or operator-set
+* env, or sessions under two profiles quietly collapse into one identity.
+*/
+function claudeSessionEnv(profile, base) {
+	return canonicalDir(profile.configDir) === canonicalDir(cliConfigDir(base)) ? base : {
+		...base,
+		CLAUDE_CONFIG_DIR: profile.configDir
+	};
+}
+function cwdAllowed(cwd, roots) {
+	if (!roots || roots.length === 0) return true;
+	const resolved = resolve(cwd);
+	return roots.some((root) => {
+		const r = resolve(root);
+		return resolved === r || resolved.startsWith(r + sep);
+	});
+}
+function createWorkerServer(options = {}) {
+	if (!options.authenticate && !options.allowUnauthenticated) throw new Error("createWorkerServer: provide `authenticate` or explicitly set `allowUnauthenticated: true`");
+	const basePath = options.basePath ?? "/v1";
+	const fallback = options.fallback;
+	const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
+	const hostBuildRunnerConfig = options.buildRunnerConfig ?? ((req) => req);
+	const declared = options.profiles ?? detectDefaultProfiles();
+	const declaredByName = new Map(declared.map((p) => [p.name, p]));
+	if (declaredByName.size !== declared.length) throw new Error("createWorkerServer: duplicate profile names in `profiles`");
+	/**
+	* Everything wrong with a profile that the server can tell without running it.
+	* Shared by startup (where it throws) and the management routes (where it 400s),
+	* so a profile created over HTTP can never be one startup would have refused.
+	*/
+	const validateProfile = (p) => {
+		if (isProviderProfile(p)) {
+			if (!p.provider?.id) return `provider profile '${p.name}' is missing provider.id`;
+			if (!options.createEngineRunner) return `profile '${p.name}' uses engine 'provider' but no \`createEngineRunner\` was provided to build one`;
+		} else if (!p.configDir || !existsSync(p.configDir)) return `profile '${p.name}' configDir does not exist: ${p.configDir}`;
+		if (options.disableBypassPermissions && p.defaults?.permissionMode === "bypassPermissions") return `profile '${p.name}' defaults to bypassPermissions but disableBypassPermissions is set`;
+		const fallbackMode = p.defaults?.permissionMode;
+		if (fallbackMode && !supportsPermissionMode(p.engine, fallbackMode)) return `profile '${p.name}' defaults to permission mode '${fallbackMode}', which engine '${p.engine}' does not support (supported: ${PROVIDER_PERMISSION_MODES.join(", ")})`;
+		return null;
+	};
+	for (const p of options.profiles ?? []) {
+		const invalid = validateProfile(p);
+		if (invalid) throw new Error(`createWorkerServer: ${invalid}`);
+	}
+	/**
+	* Store-managed profiles, mirrored in memory so every lookup on the request path
+	* stays synchronous. Loaded once at `listen()` and refreshed after each mutation
+	* — single-process, exactly like the bundled queue adapter.
+	*/
+	const stored = /* @__PURE__ */ new Map();
+	const refreshStored = async () => {
+		if (!options.profileStore) return;
+		stored.clear();
+		for (const p of await options.profileStore.list()) stored.set(p.name, p);
+	};
+	/** Response-only marker so a UI knows which rows it may edit. Declared profiles
+	* are code; only store-backed ones can be changed over the API. */
+	const withManagedFlag = (p) => declaredByName.has(p.name) ? p : {
+		...p,
+		managed: true
+	};
+	/** Declared profiles first: a name collision means the code wins, and the stored
+	* one is unreachable rather than silently overriding server options. */
+	const allProfiles = () => [...declared, ...[...stored.values()].filter((p) => !declaredByName.has(p.name))];
+	const profileFor = (name) => declaredByName.get(name) ?? stored.get(name);
+	/** Profile management is doubly opt-in: the operator wires a store, and the host
+	* marks the principal. Neither on its own is enough. */
+	const manageGuard = (auth) => {
+		if (!options.profileStore) return {
+			status: 404,
+			error: "profile management is not enabled on this server"
+		};
+		if (!auth.canManageProfiles) return {
+			status: 403,
+			error: "not allowed to manage profiles"
+		};
+		return null;
+	};
+	/** Startup-declared profiles are code. Editing one over HTTP would make the
+	* server options lie about what is actually running. */
+	const declaredGuard = (profile) => declaredByName.has(profile.name) ? {
+		status: 403,
+		error: `profile '${profile.name}' is declared in server options and cannot be changed over the API — edit the \`profiles\` option instead`
+	} : null;
+	/**
+	* A managed Claude profile names a config directory, and that directory is a
+	* credential store. Bound it to operator-declared roots; unset roots means the
+	* management routes create provider profiles only.
+	*/
+	const configDirGuard = (profile) => {
+		if (isProviderProfile(profile)) return null;
+		const roots = options.allowedConfigDirRoots;
+		if (!roots || roots.length === 0) return {
+			status: 403,
+			error: "managed Claude profiles are disabled: set `allowedConfigDirRoots` to the directories they may point at"
+		};
+		return profile.configDir && cwdAllowed(profile.configDir, roots) ? null : {
+			status: 403,
+			error: "configDir is outside the allowed roots"
+		};
+	};
+	/** Validate, persist, and re-read: shared by create and update so a PATCH can
+	* never leave behind a profile a POST would have refused. */
+	const saveManagedProfile = async (res, incoming) => {
+		const { managed: _clientClaim, ...profile } = incoming;
+		const refused = configDirGuard(profile);
+		if (refused) {
+			json(res, refused.status, { error: refused.error });
+			return;
+		}
+		const invalid = validateProfile(profile);
+		if (invalid) {
+			json(res, 400, { error: invalid });
+			return;
+		}
+		await options.profileStore.save(profile);
+		await refreshStored();
+		json(res, 200, { profile: withManagedFlag(profile) });
+	};
+	/** Enforce the server's bypass policy on a create request. Returns a 403 message
+	* for an explicit bypass-mode request; strips the pre-authorization capability
+	* silently (see the option's doc for why). */
+	const applyBypassPolicy = (req) => {
+		if (!options.disableBypassPermissions) return null;
+		if (req.permissionMode === "bypassPermissions") return "bypassPermissions is disabled on this server (disableBypassPermissions)";
+		delete req.allowDangerouslySkipPermissions;
+		return null;
+	};
+	/** Reject a permission mode the resolved profile's engine has no meaning for.
+	* The create form already filters what it offers, but the API is the boundary:
+	* a provider session asked for 'plan' should be told so, not silently coerced
+	* into 'default' by whatever assembles its runner. Returns an error message. */
+	const checkPermissionMode = (mode, profile) => {
+		if (mode === void 0 || supportsPermissionMode(profile?.engine, mode)) return null;
+		return `permission mode '${mode}' is not supported by profile '${profile.name}' (engine '${profile.engine}') — supported: ${PROVIDER_PERMISSION_MODES.join(", ")}`;
+	};
+	/**
+	* Enforce the provider engine's grant rules on a create request. Two of them:
+	*
+	* - Capabilities narrow, never widen. A request may run with fewer than the
+	*   profile grants; naming one it doesn't is refused rather than quietly
+	*   downgraded, so a caller learns instead of wondering where the tool went.
+	* - MCP servers are the profile's to declare. MCP tools are authoritative —
+	*   server-side, with server credentials, never bridged — so honoring a
+	*   client-supplied server would let a caller point an authoritative tool
+	*   anywhere it liked. The profile names servers; the host holds their configs.
+	*/
+	const checkEngineGrants = (req, profile) => {
+		if (!profile || !isProviderProfile(profile)) return null;
+		if (req.mcpServers && Object.keys(req.mcpServers).length > 0) return `profile '${profile.name}' runs the provider engine, whose MCP servers are declared on the profile (session.mcpServers) — a session request cannot add its own`;
+		const granted = profile.session?.capabilities;
+		if (!req.capabilities || !granted) return null;
+		const ungranted = req.capabilities.filter((c) => !granted.includes(c));
+		if (ungranted.length === 0) return null;
+		return `profile '${profile.name}' does not grant: ${ungranted.join(", ")} (granted: ${granted.join(", ") || "none"}) — a request may narrow capabilities, not widen them`;
+	};
+	/** Profile-aware config hook: fill the profile's defaults into unset request fields,
+	* run the host hook, then pin CLAUDE_CONFIG_DIR — the profile wins even when the
+	* host hook set its own env (see `claudeSessionEnv` for the one case the pin is
+	* skipped, and why). Handed to the queue too, so jobs inherit profiles. */
+	const buildRunnerConfig = (req) => {
+		const profile = req.profile !== void 0 ? profileFor(req.profile) : void 0;
+		if (!profile) return hostBuildRunnerConfig(req);
+		const config = hostBuildRunnerConfig({
+			...req,
+			model: req.model ?? profile.defaults?.model ?? profile.provider?.model,
+			permissionMode: req.permissionMode ?? profile.defaults?.permissionMode
+		});
+		if (isProviderProfile(profile)) return config;
+		const base = config.env ?? process.env;
+		const env = claudeSessionEnv(profile, base);
+		return env === base ? config : {
+			...config,
+			env
+		};
+	};
+	/** Build a runner for a session, choosing the engine from its profile. Async
+	* because the engine factory may be: a provider session can need an awaited
+	* assembly step (per-session MCP connect) before it has a runner at all.
+	*
+	* `restore` rebuilds a parked session rather than creating a new one — same id,
+	* same log, mid-task. */
+	const buildRunner = async (config, restore) => {
+		const name = config.profile;
+		const profile = name !== void 0 ? profileFor(name) : void 0;
+		if (name !== void 0 && !profile) throw new Error(`unknown profile: ${name}`);
+		if (profile && isProviderProfile(profile)) return options.createEngineRunner({
+			config,
+			profile,
+			bridge,
+			restore
+		});
+		if (restore) throw new Error("the Claude engine cannot rebuild a parked session");
+		return new Promise((resolve) => resolve(registry.prepare(config)));
+	};
+	const createRunner = async (config) => {
+		const runner = registry.register(await buildRunner(config));
+		parking.remember(runner.id, config);
+		parking.watch(runner);
+		runner.start();
+		return runner;
+	};
+	/** Resolve a request's profile: required when several are declared, implicit with
+	* exactly one, scoped by the principal's allowedProfiles. Returns the resolved
+	* profile (undefined when the server declares none) or a response-ready error. */
+	const resolveProfile = (name, allowedProfiles) => {
+		if (name !== void 0 && typeof name !== "string") return {
+			ok: false,
+			status: 400,
+			error: "profile must be a string"
+		};
+		const profiles = allProfiles();
+		if (profiles.length === 0) return name !== void 0 ? {
+			ok: false,
+			status: 400,
+			error: "no profiles are configured on this server"
+		} : { ok: true };
+		const effective = name ?? (profiles.length === 1 ? profiles[0].name : void 0);
+		if (effective === void 0) return {
+			ok: false,
+			status: 400,
+			error: `profile is required (available: ${profiles.map((p) => p.name).join(", ")})`
+		};
+		const profile = profileFor(effective);
+		if (!profile) return {
+			ok: false,
+			status: 400,
+			error: `unknown profile: ${effective}`
+		};
+		if (allowedProfiles && !allowedProfiles.includes(profile.name)) return {
+			ok: false,
+			status: 403,
+			error: `profile not allowed: ${profile.name}`
+		};
+		return {
+			ok: true,
+			profile
+		};
+	};
+	const notifier = new SessionNotifier(options.notifications ?? {});
+	const registry = new SessionRegistry({ onRegister: (runner) => notifier.watch(runner) });
+	const bridge = new BridgeHub({
+		...options.bridge,
+		onResult: (sessionId, executionId, result) => {
+			registry.get(sessionId)?.settleExecution?.(executionId, result);
+			options.bridge?.onResult?.(sessionId, executionId, result);
+		}
+	});
+	const parking = new SessionParkManager({
+		registry,
+		store: options.parking?.store ?? new MemorySessionStore(),
+		parkDelayMs: options.parking?.parkDelayMs,
+		expiredGraceMs: options.parking?.expiredGraceMs,
+		onError: options.parking?.onError,
+		rebuild: (record) => buildRunner(record.config, record.snapshot),
+		attachedCount: (sessionId) => bridge.attachedCount(sessionId),
+		onParking: (sessionId, executionId) => queue?.onSessionParking(sessionId, executionId) ?? true,
+		onResumed: (sessionId, runner) => queue?.onSessionResumed(sessionId, runner)
+	});
+	const wss = new WebSocketServer({ noServer: true });
+	/** Profiles (by name; '' = none) whose oauth notice has been logged. */
+	const subscriptionNoticeShown = /* @__PURE__ */ new Set();
+	const queueSockets = /* @__PURE__ */ new Set();
+	const sendQueueFrame = (ws, frame) => {
+		if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(frame));
+	};
+	const broadcastJobEvent = (event) => {
+		if (queueSockets.size === 0) return;
+		for (const ws of queueSockets) sendQueueFrame(ws, {
+			type: "job_event",
+			event
+		});
+		if (event.type !== "job_progress") queue?.stats().then((stats) => {
+			for (const ws of queueSockets) sendQueueFrame(ws, {
+				type: "queue_stats",
+				stats
+			});
+		}).catch(() => {});
+	};
+	const queue = options.queue ? new JobQueue({
+		...options.queue,
+		onEvent: (event) => {
+			try {
+				options.queue?.onEvent?.(event);
+			} finally {
+				broadcastJobEvent(event);
+			}
+		},
+		createRunner: async (config) => {
+			const runner = await createRunner(config);
+			watchAuthSource(runner);
+			return runner;
+		},
+		buildRunnerConfig,
+		discardSession: (sessionId) => parking.discard(sessionId)
+	}) : void 0;
+	const watchAuthSource = (runner) => {
+		let seen = false;
+		runner.subscribe((event) => {
+			if (seen || event.type !== "system_init") return;
+			seen = true;
+			if (event.apiKeySource !== "oauth") return;
+			if (options.requireApiKey) runner.fail("This server requires API-key auth (requireApiKey), but the session initialized with claude.ai subscription credentials (apiKeySource 'oauth'). Set ANTHROPIC_API_KEY (or Bedrock/Vertex auth) in the server environment.");
+			else {
+				const profileName = runner.info().profile ?? "";
+				if (subscriptionNoticeShown.has(profileName)) return;
+				subscriptionNoticeShown.add(profileName);
+				const scope = profileName ? `Sessions under profile '${profileName}'` : "Sessions";
+				console.warn(`[workerdeck] ${scope} are using claude.ai subscription credentials (apiKeySource 'oauth'), not an API key. That is only appropriate for personal, single-user use of your own account. Unattended/scheduled or multi-user use requires an API key under Anthropic's terms — set ANTHROPIC_API_KEY in the server environment, or set requireApiKey: true to fail closed.`);
+			}
+		});
+	};
+	/**
+	* Probe each Claude profile's credentials the way its sessions will actually
+	* experience them: the env the real assembly path produces, so anything the
+	* host hook injects (a CLAUDE_CODE_OAUTH_TOKEN, say) counts as logged in.
+	* Provider profiles resolve credentials in the engine factory and are not
+	* probed. Fire-and-forget by design — see the `checkCredentials` option doc.
+	*/
+	const preflightCredentials = () => {
+		if (!options.checkCredentials) return;
+		const conf = options.checkCredentials === true ? {} : options.checkCredentials;
+		const probe = conf.probe ?? ((env) => checkClaudeAuth(env, { timeoutMs: conf.timeoutMs }));
+		for (const profile of allProfiles()) {
+			if (isProviderProfile(profile)) continue;
+			let env;
+			try {
+				env = buildRunnerConfig({
+					cwd: process.cwd(),
+					profile: profile.name
+				}).env ?? process.env;
+			} catch {
+				env = claudeSessionEnv(profile, process.env);
+			}
+			probe(env).then((status) => {
+				if (status !== "logged_out") return;
+				console.warn(`[workerdeck] Profile '${profile.name}' (${profile.configDir}) has no usable Claude credentials: \`claude auth status\` reports logged out for the environment its sessions run with, so they will fail with "Not logged in". Log in under that dir (CLAUDE_CONFIG_DIR=${profile.configDir} claude auth login), inject a long-lived token via buildRunnerConfig (CLAUDE_CODE_OAUTH_TOKEN), or set ANTHROPIC_API_KEY. \`checkCredentials: false\` disables this check.`);
+			}).catch(() => {});
+		}
+	};
+	const authenticate = async (req) => {
+		if (!options.authenticate) return { ok: true };
+		const principal = await options.authenticate(req);
+		if (principal === null || principal === void 0 || principal === false) return { ok: false };
+		const allowed = principal.allowedProfiles;
+		return {
+			ok: true,
+			allowedProfiles: Array.isArray(allowed) && allowed.every((p) => typeof p === "string") ? allowed : void 0,
+			canManageProfiles: principal.canManageProfiles === true
+		};
+	};
+	const parseRoute = (url) => {
+		const pathname = new URL(url, "http://internal").pathname;
+		if (!pathname.startsWith(basePath + "/sessions")) return null;
+		const rest = pathname.slice((basePath + "/sessions").length);
+		if (rest === "" || rest === "/") return {};
+		const parts = rest.replace(/^\//, "").split("/");
+		if (parts.length === 1) return { id: decodeURIComponent(parts[0]) };
+		if (parts.length === 2 && parts[1] === "ws") return {
+			id: decodeURIComponent(parts[0]),
+			ws: true
+		};
+		if (parts.length === 3 && parts[1] === "permissions") return {
+			id: decodeURIComponent(parts[0]),
+			permissionId: decodeURIComponent(parts[2])
+		};
+		if (parts.length >= 2 && parts[1] === "files") {
+			const filePath = parts.slice(2).map(decodeURIComponent).join("/");
+			return {
+				id: decodeURIComponent(parts[0]),
+				files: true,
+				filePath: filePath === "" ? void 0 : "/" + filePath
+			};
+		}
+		return null;
+	};
+	const listSdkSessions = options.listSdkSessions ?? defaultSdkSessionLister;
+	const handleSdkSessions = async (req, res) => {
+		if (req.method !== "GET") {
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		const url = new URL(req.url ?? "/", "http://internal");
+		const dir = url.searchParams.get("dir") ?? void 0;
+		const roots = options.allowedCwdRoots;
+		if (roots && roots.length > 0) {
+			if (!dir) {
+				json(res, 400, { error: "dir is required when allowedCwdRoots is set" });
+				return;
+			}
+			if (!cwdAllowed(dir, roots)) {
+				json(res, 403, { error: "dir is outside the allowed roots" });
+				return;
+			}
+		}
+		json(res, 200, { sdkSessions: await listSdkSessions({
+			dir,
+			limit: Number(url.searchParams.get("limit") ?? "") || void 0,
+			offset: Number(url.searchParams.get("offset") ?? "") || void 0
+		}) });
+	};
+	const handleJobs = async (req, res, pathname, auth) => {
+		if (!queue) {
+			json(res, 404, { error: "job queue not configured" });
+			return;
+		}
+		if (pathname === basePath + "/queue") {
+			if (req.method !== "GET") {
+				json(res, 405, { error: "method not allowed" });
+				return;
+			}
+			json(res, 200, { stats: await queue.stats() });
+			return;
+		}
+		const rest = pathname.slice((basePath + "/jobs").length).replace(/^\//, "");
+		if (rest === "") {
+			if (req.method === "GET") {
+				json(res, 200, { jobs: await queue.list() });
+				return;
+			}
+			if (req.method === "POST") {
+				const body = await readJsonBody(req, maxBodyBytes);
+				if (!body.session || typeof body.session !== "object") {
+					json(res, 400, { error: "session is required" });
+					return;
+				}
+				if (!body.session.cwd || typeof body.session.cwd !== "string") {
+					json(res, 400, { error: "session.cwd is required" });
+					return;
+				}
+				if (!body.session.prompt || typeof body.session.prompt !== "string") {
+					json(res, 400, { error: "session.prompt is required" });
+					return;
+				}
+				if (!cwdAllowed(body.session.cwd, options.allowedCwdRoots)) {
+					json(res, 403, { error: "cwd is outside the allowed roots" });
+					return;
+				}
+				const refused = applyBypassPolicy(body.session);
+				if (refused) {
+					json(res, 403, { error: refused });
+					return;
+				}
+				const resolved = resolveProfile(body.session.profile, auth.allowedProfiles);
+				if (!resolved.ok) {
+					json(res, resolved.status, { error: resolved.error });
+					return;
+				}
+				const badRequest = checkPermissionMode(body.session.permissionMode, resolved.profile) ?? checkEngineGrants(body.session, resolved.profile);
+				if (badRequest) {
+					json(res, 400, { error: badRequest });
+					return;
+				}
+				body.session.profile = resolved.profile?.name;
+				try {
+					json(res, 201, { job: await queue.submit(body) });
+				} catch (error) {
+					json(res, 400, { error: error instanceof Error ? error.message : "invalid job" });
+				}
+				return;
+			}
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		const id = decodeURIComponent(rest);
+		if (id.includes("/")) {
+			json(res, 404, { error: "not found" });
+			return;
+		}
+		if (req.method === "GET") {
+			const job = await queue.get(id);
+			if (job) json(res, 200, { job });
+			else json(res, 404, { error: "job not found" });
+			return;
+		}
+		if (req.method === "DELETE") {
+			const job = await queue.cancel(id);
+			if (job) json(res, 200, { job });
+			else json(res, 404, { error: "job not found" });
+			return;
+		}
+		json(res, 405, { error: "method not allowed" });
+	};
+	/**
+	* `POST {basePath}/executions/:executionId/result` — a deferred executor
+	* delivering its outcome. Wakes the parked session, applies the result to its
+	* agent loop, and lets the run continue.
+	*
+	* Scoped like every other session route: a principal restricted to certain
+	* profiles cannot settle an execution belonging to a session outside them —
+	* a result is trusted tool input, and injecting one into another tenant's loop
+	* would be a way to steer it.
+	*/
+	const handleExecutionResult = async (req, res, pathname, auth) => {
+		const rest = pathname.slice((basePath + "/executions/").length).split("/");
+		if (rest.length !== 2 || rest[1] !== "result" || !rest[0]) {
+			json(res, 404, { error: "not found" });
+			return;
+		}
+		if (req.method !== "POST") {
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		const executionId = decodeURIComponent(rest[0]);
+		const body = await readJsonBody(req, maxBodyBytes);
+		let result;
+		if (body?.status === "ok") {
+			if (!body.output || typeof body.output !== "object") {
+				json(res, 400, { error: "output is required for status 'ok'" });
+				return;
+			}
+			result = {
+				status: "ok",
+				output: body.output.value,
+				logs: body.logs
+			};
+		} else if (body?.status === "failed") {
+			if (typeof body.reason !== "string" || typeof body.error !== "string") {
+				json(res, 400, { error: "reason and error are required for status 'failed'" });
+				return;
+			}
+			result = {
+				status: "failed",
+				reason: body.reason,
+				error: body.error,
+				logs: body.logs
+			};
+		} else {
+			json(res, 400, { error: "status must be 'ok' or 'failed'" });
+			return;
+		}
+		if (auth.allowedProfiles) {
+			const owner = parking.sessionFor(executionId);
+			const profile = owner === void 0 ? void 0 : registry.get(owner)?.info().profile ?? (await parking.get(owner))?.profile;
+			if (owner === void 0 || profile !== void 0 && !auth.allowedProfiles.includes(profile)) {
+				json(res, 404, { error: "execution not found" });
+				return;
+			}
+		}
+		const applied = await parking.submitResult(executionId, result);
+		if (!applied) {
+			json(res, 404, { error: "execution not found (unknown id, or its session has ended)" });
+			return;
+		}
+		json(res, 200, applied);
+	};
+	const handleRequest = async (req, res) => {
+		const pathname = new URL(req.url ?? "/", "http://internal").pathname;
+		if (fallback && pathname !== basePath && !pathname.startsWith(basePath + "/")) {
+			await fallback(req, res);
+			return;
+		}
+		if (pathname === basePath + "/jobs" || pathname.startsWith(basePath + "/jobs/") || pathname === basePath + "/queue") {
+			const auth = await authenticate(req);
+			if (!auth.ok) {
+				json(res, 401, { error: "unauthorized" });
+				return;
+			}
+			await handleJobs(req, res, pathname, auth);
+			return;
+		}
+		if (pathname === basePath + "/profiles" || pathname.startsWith(basePath + "/profiles/")) {
+			const auth = await authenticate(req);
+			if (!auth.ok) {
+				json(res, 401, { error: "unauthorized" });
+				return;
+			}
+			const rest = pathname.slice((basePath + "/profiles").length).replace(/^\//, "");
+			if (rest === "") {
+				if (req.method === "GET") {
+					json(res, 200, {
+						profiles: (auth.allowedProfiles ? allProfiles().filter((p) => auth.allowedProfiles.includes(p.name)) : allProfiles()).map(withManagedFlag),
+						canManage: manageGuard(auth) === null
+					});
+					return;
+				}
+				if (req.method === "POST") {
+					const refused = manageGuard(auth);
+					if (refused) {
+						json(res, refused.status, { error: refused.error });
+						return;
+					}
+					const body = await readJsonBody(req, maxBodyBytes);
+					if (!body.name || typeof body.name !== "string") {
+						json(res, 400, { error: "name is required" });
+						return;
+					}
+					if (profileFor(body.name)) {
+						json(res, 409, { error: `profile already exists: ${body.name}` });
+						return;
+					}
+					await saveManagedProfile(res, body);
+					return;
+				}
+				json(res, 405, { error: "method not allowed" });
+				return;
+			}
+			const name = decodeURIComponent(rest);
+			const profile = name.includes("/") ? void 0 : profileFor(name);
+			if (!profile) {
+				json(res, 404, { error: "profile not found" });
+				return;
+			}
+			if (auth.allowedProfiles && !auth.allowedProfiles.includes(profile.name)) {
+				json(res, 403, { error: `profile not allowed: ${profile.name}` });
+				return;
+			}
+			if (req.method === "GET") {
+				json(res, 200, {
+					profile: withManagedFlag(profile),
+					config: readProfileConfig(profile)
+				});
+				return;
+			}
+			if (req.method === "PATCH" || req.method === "DELETE") {
+				const refused = manageGuard(auth) ?? declaredGuard(profile);
+				if (refused) {
+					json(res, refused.status, { error: refused.error });
+					return;
+				}
+				if (req.method === "DELETE") {
+					await options.profileStore.delete(profile.name);
+					await refreshStored();
+					res.writeHead(204).end();
+					return;
+				}
+				const patch = await readJsonBody(req, maxBodyBytes);
+				await saveManagedProfile(res, {
+					...profile,
+					...patch,
+					name: profile.name
+				});
+				return;
+			}
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (pathname.startsWith(basePath + "/executions/")) {
+			const auth = await authenticate(req);
+			if (!auth.ok) {
+				json(res, 401, { error: "unauthorized" });
+				return;
+			}
+			await handleExecutionResult(req, res, pathname, auth);
+			return;
+		}
+		if (pathname === basePath + "/sdk-sessions") {
+			if (!(await authenticate(req)).ok) {
+				json(res, 401, { error: "unauthorized" });
+				return;
+			}
+			await handleSdkSessions(req, res);
+			return;
+		}
+		const route = parseRoute(req.url ?? "/");
+		if (!route || route.ws) {
+			json(res, 404, { error: "not found" });
+			return;
+		}
+		const auth = await authenticate(req);
+		if (!auth.ok) {
+			json(res, 401, { error: "unauthorized" });
+			return;
+		}
+		if (!route.id) {
+			if (req.method === "GET") {
+				json(res, 200, { sessions: [...registry.list(), ...await parking.listInfo()] });
+				return;
+			}
+			if (req.method === "POST") {
+				const body = await readJsonBody(req, maxBodyBytes);
+				if (!body.cwd || typeof body.cwd !== "string") {
+					json(res, 400, { error: "cwd is required" });
+					return;
+				}
+				if (!cwdAllowed(body.cwd, options.allowedCwdRoots)) {
+					json(res, 403, { error: "cwd is outside the allowed roots" });
+					return;
+				}
+				const refused = applyBypassPolicy(body);
+				if (refused) {
+					json(res, 403, { error: refused });
+					return;
+				}
+				const resolved = resolveProfile(body.profile, auth.allowedProfiles);
+				if (!resolved.ok) {
+					json(res, resolved.status, { error: resolved.error });
+					return;
+				}
+				const badRequest = checkPermissionMode(body.permissionMode, resolved.profile) ?? checkEngineGrants(body, resolved.profile);
+				if (badRequest) {
+					json(res, 400, { error: badRequest });
+					return;
+				}
+				body.profile = resolved.profile?.name;
+				const runner = await createRunner(buildRunnerConfig(body));
+				watchAuthSource(runner);
+				json(res, 201, { session: runner.info() });
+				return;
+			}
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		const runner = registry.get(route.id);
+		const parked = runner ? null : await parking.get(route.id);
+		if (!runner && !parked) {
+			json(res, 404, { error: "session not found" });
+			return;
+		}
+		if (route.files) {
+			if (req.method !== "GET") {
+				json(res, 405, { error: "method not allowed" });
+				return;
+			}
+			const snapshotFiles = parked?.snapshot.vfs;
+			const vfs = runner?.vfs ?? (snapshotFiles && {
+				list: () => Object.keys(snapshotFiles).sort(),
+				read: (path) => snapshotFiles[path]
+			});
+			if (!vfs) {
+				json(res, 404, { error: "session has no file store" });
+				return;
+			}
+			if (route.filePath === void 0) {
+				json(res, 200, { files: vfs.list().map((path) => ({
+					path,
+					bytes: vfs.read(path)?.length ?? 0
+				})) });
+				return;
+			}
+			const content = vfs.read(route.filePath);
+			if (content === void 0) {
+				json(res, 404, { error: `no such file: ${route.filePath}` });
+				return;
+			}
+			const filename = route.filePath.split("/").pop() || "file";
+			res.writeHead(200, {
+				"content-type": contentTypeFor(filename),
+				"content-length": Buffer.byteLength(content),
+				"content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,
+				"x-content-type-options": "nosniff"
+			});
+			res.end(content);
+			return;
+		}
+		if (route.permissionId) {
+			if (req.method !== "POST") {
+				json(res, 405, { error: "method not allowed" });
+				return;
+			}
+			const body = await readJsonBody(req, maxBodyBytes);
+			if (body?.behavior !== "allow" && body?.behavior !== "deny") {
+				json(res, 400, { error: "behavior must be 'allow' or 'deny'" });
+				return;
+			}
+			if (!runner) {
+				json(res, 409, { error: "session is parked (it has no pending permission requests)" });
+				return;
+			}
+			if (!runner.resolvePermission(route.permissionId, body)) {
+				json(res, 404, { error: "permission request not found (already resolved or expired)" });
+				return;
+			}
+			json(res, 200, { resolved: true });
+			return;
+		}
+		if (req.method === "GET") {
+			json(res, 200, { session: runner?.info() ?? parked.info });
+			return;
+		}
+		if (req.method === "DELETE") {
+			registry.remove(route.id);
+			bridge.remove(route.id);
+			await parking.discard(route.id);
+			json(res, 200, { session: runner?.info() ?? {
+				...parked.info,
+				status: "closed"
+			} });
+			return;
+		}
+		json(res, 405, { error: "method not allowed" });
+	};
+	const server = createServer((req, res) => {
+		handleRequest(req, res).catch((error) => {
+			const message = error instanceof Error ? error.message : "internal error";
+			if (!res.headersSent) json(res, error instanceof SyntaxError ? 400 : 500, { error: message });
+			else res.end();
+		});
+	});
+	server.on("upgrade", (req, socket, head) => {
+		(async () => {
+			if (new URL(req.url ?? "/", "http://internal").pathname === basePath + "/queue/ws") {
+				if (!queue) {
+					socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				if (!(await authenticate(req)).ok) {
+					socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				wss.handleUpgrade(req, socket, head, (ws) => {
+					queueSockets.add(ws);
+					ws.on("close", () => queueSockets.delete(ws));
+					queue.stats().then((stats) => sendQueueFrame(ws, {
+						type: "queue_attached",
+						protocolVersion: PROTOCOL_VERSION,
+						stats
+					})).catch(() => {});
+				});
+				return;
+			}
+			const route = parseRoute(req.url ?? "/");
+			if (!route?.ws || !route.id) {
+				socket.destroy();
+				return;
+			}
+			if (!(await authenticate(req)).ok) {
+				socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+				socket.destroy();
+				return;
+			}
+			const runner = await parking.ensureLive(route.id).catch(() => void 0);
+			if (!runner) {
+				socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
+				socket.destroy();
+				return;
+			}
+			wss.handleUpgrade(req, socket, head, (ws) => {
+				attachClient(ws, runner, req);
+			});
+		})().catch(() => socket.destroy());
+	});
+	const attachClient = (ws, runner, req) => {
+		const url = new URL(req.url ?? "/", "http://internal");
+		const afterSeq = Number(url.searchParams.get("afterSeq") ?? "0") || 0;
+		const send = (frame) => {
+			if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(frame));
+		};
+		send({
+			type: "attached",
+			protocolVersion: PROTOCOL_VERSION,
+			session: runner.info(),
+			replayingFrom: afterSeq
+		});
+		const unsubscribe = runner.subscribe((event) => send({
+			type: "event",
+			event
+		}), afterSeq);
+		const detachBridge = bridge.attach(runner.id, send);
+		ws.on("message", (data) => {
+			let frame;
+			try {
+				frame = JSON.parse(data.toString("utf8"));
+			} catch {
+				send({
+					type: "protocol_error",
+					message: "invalid JSON frame"
+				});
+				return;
+			}
+			handleCommand(frame, runner).catch((error) => {
+				send({
+					type: "protocol_error",
+					message: error instanceof Error ? error.message : "command failed"
+				});
+			});
+		});
+		ws.on("close", () => {
+			unsubscribe();
+			detachBridge();
+			parking.onDetach(runner.id);
+		});
+	};
+	const handleCommand = async (frame, runner) => {
+		switch (frame.type) {
+			case "user_message":
+				runner.sendMessage(frame.text);
+				return;
+			case "permission_decision":
+				if (frame.behavior === "allow") runner.resolvePermission(frame.requestId, {
+					behavior: "allow",
+					updatedInput: frame.updatedInput
+				});
+				else runner.resolvePermission(frame.requestId, {
+					behavior: "deny",
+					message: frame.message,
+					interrupt: frame.interrupt
+				});
+				return;
+			case "interrupt":
+				await runner.interrupt();
+				return;
+			case "set_permission_mode":
+				if (frame.mode === "bypassPermissions" && options.disableBypassPermissions) throw new Error("bypassPermissions is disabled on this server (disableBypassPermissions)");
+				await runner.setPermissionMode(frame.mode);
+				return;
+			case "set_model":
+				await runner.setModel(frame.model);
+				return;
+			case "tool_call_result":
+				bridge.resolve(runner.id, frame.executionId, {
+					output: frame.output,
+					logs: frame.logs
+				});
+				return;
+			case "tool_call_error":
+				bridge.resolve(runner.id, frame.executionId, {
+					reason: frame.reason,
+					error: frame.error,
+					logs: frame.logs
+				});
+				return;
+			case "close":
+				runner.close("client");
+				return;
+			default: throw new Error(`unknown command: ${frame.type}`);
+		}
+	};
+	return {
+		server,
+		registry,
+		queue,
+		bridge,
+		parking,
+		listen: async (port, host) => {
+			await refreshStored();
+			await parking.hydrate();
+			return new Promise((resolve, reject) => {
+				server.once("error", reject);
+				server.listen(port, host, () => {
+					preflightCredentials();
+					const address = server.address();
+					resolve({ port: typeof address === "object" && address ? address.port : port });
+				});
+			});
+		},
+		close: () => new Promise((resolve) => {
+			queue?.close();
+			parking.close();
+			registry.closeAll();
+			for (const ws of queueSockets) ws.close();
+			queueSockets.clear();
+			wss.close();
+			server.close(() => resolve());
+			server.closeAllConnections();
+		})
+	};
+}
+//#endregion
+//#region src/profile-store.ts
+/** Non-durable store for tests and ephemeral deployments. */
+function createMemoryProfileStore(seed = []) {
+	const profiles = new Map(seed.map((p) => [p.name, p]));
+	return {
+		list: () => [...profiles.values()],
+		save: (profile) => void profiles.set(profile.name, profile),
+		delete: (name) => void profiles.delete(name)
+	};
+}
+/**
+* JSON-file store: one array of profiles at `path` (default
+* `<cwd>/.workerdeck/profiles.json`). Writes go through a temp file and a
+* rename so a crash mid-write cannot truncate the operator's profile list.
+*
+* Single-process by design, exactly like the bundled queue adapter — two servers
+* sharing one file would race. That is what the seam is for.
+*/
+function createFileProfileStore(path = join(process.cwd(), ".workerdeck", "profiles.json")) {
+	const read = () => {
+		try {
+			const parsed = JSON.parse(readFileSync(path, "utf8"));
+			if (!Array.isArray(parsed)) return /* @__PURE__ */ new Map();
+			return new Map(parsed.filter((p) => p && typeof p.name === "string").map((p) => [p.name, p]));
+		} catch {
+			return /* @__PURE__ */ new Map();
+		}
+	};
+	const write = (profiles) => {
+		mkdirSync(dirname(path), { recursive: true });
+		const temp = `${path}.${process.pid}.tmp`;
+		writeFileSync(temp, JSON.stringify([...profiles.values()], null, 2));
+		renameSync(temp, path);
+	};
+	return {
+		list: () => [...read().values()],
+		save: (profile) => {
+			const profiles = read();
+			profiles.set(profile.name, profile);
+			write(profiles);
+		},
+		delete: (name) => {
+			const profiles = read();
+			if (profiles.delete(name)) write(profiles);
+		}
+	};
+}
+//#endregion
+export { BridgeHub, MemorySessionStore, SessionNotifier, SessionParkManager, SessionRegistry, createFileProfileStore, createFileSessionStore, createMemoryProfileStore, createWorkerServer, toDurableRecord };
+
+//# sourceMappingURL=index.mjs.map