@xopcai/xopc 0.0.81 → 0.0.83

package/dist/src/gateway/hono/routes/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","names":["fsConstants"],"sources":["../../../../../src/gateway/hono/routes/workspace.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { randomUUID } from 'node:crypto';\nimport { constants as fsConstants } from 'node:fs';\nimport { copyFile, link, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';\nimport { basename, dirname, join, resolve } from 'node:path';\n\nimport { extractProfileAgentId } from '../../../config/agent-profile.js';\nimport { type Config, getWorkspacePath } from '../../../config/schema.js';\nimport { validateWritePath } from '../../../agent/sandbox/path-policy.js';\nimport { resolveSafeInboundFilePath } from '../../../channels/attachments/inbound-persist.js';\nimport { resolveSafeTtsFilePath } from '../../../channels/attachments/outbound-tts-persist.js';\nimport {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveAgentHomeDir,\n  resolveAgentWorkspaceDir,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport { createLogger } from '../../../utils/logger.js';\nimport { resolveHeartbeatMdPath } from '../../workspace-heartbeat-path.js';\nimport {\n  isPathUnderWorkspace,\n  resolveWorkspaceSafePath,\n  toWorkspaceRelativePosix,\n} from '../../workspace-editor-path.js';\nimport { listWorkspaceRelativeFilesFsFallback } from '../../workspace-fs-file-list.js';\nimport { runRipgrepInDirectory, runRipgrepListFiles } from '../../workspace-ripgrep.js';\nimport {\n  buildFilePathClassifierContext,\n  classifyFileLocation,\n  displayNameForPath,\n  fileRefSessionKeysMatch,\n  resolveFileReferenceCandidate,\n} from '../../file-path-classifier.js';\nimport {\n  fileReferenceRegistry,\n  type FileReferenceCapability,\n  type FileReferenceLocationKind,\n  type FileReferenceScope,\n} from '../../file-reference-registry.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport type { GatewayService } from '../../service.js';\n\nconst log = createLogger('HonoApp');\n\n/** Agent home for persisted `inbound/` and `tts/` attachments (matches `persistOutboundTtsAudio` / `prepareInboundAttachments`). */\nfunction resolvePersistedAttachmentAgentHome(cfg: Config, sessionKeyRaw: string | undefined): string {\n  const sk = typeof sessionKeyRaw === 'string' ? sessionKeyRaw.trim() : '';\n  const agentId = sk ? extractProfileAgentId(sk, cfg) : resolveDefaultAgentId(cfg);\n  return resolveAgentHomeDir(cfg, agentId);\n}\n\nconst FILE_SEARCH_MAX_LIMIT = 50;\n\n/** Subsequence fuzzy match: all query chars appear in order in `candidate` (case-insensitive). */\nfunction fuzzySubsequenceScore(query: string, candidate: string): number | null {\n  const q = query.toLowerCase();\n  const c = candidate.toLowerCase();\n  if (q.length === 0) return 0;\n  let qi = 0;\n  for (let ci = 0; ci < c.length && qi < q.length; ci++) {\n    if (c[ci] === q[qi]) qi++;\n  }\n  if (qi < q.length) return null;\n  const base = c.split('/').pop() ?? c;\n  let score = 10;\n  if (c.startsWith(q)) score += 40;\n  if (base.startsWith(q)) score += 35;\n  else if (base.includes(q)) score += 20;\n  else if (c.includes(q)) score += 10;\n  score -= c.length * 0.0001;\n  return score;\n}\n\nasync function fuzzySearchWorkspaceFiles(\n  workspaceRoot: string,\n  query: string,\n  limit: number,\n): Promise<Array<{ name: string; path: string; isDirectory: boolean }>> {\n  let files = await runRipgrepListFiles(workspaceRoot);\n  if (files.length === 0) {\n    files = await listWorkspaceRelativeFilesFsFallback(workspaceRoot, 120_000);\n    if (files.length > 0) {\n      log.debug(\n        { workspaceRoot, fileCount: files.length },\n        'workspace files/search: file list from fs walk (ripgrep unavailable or returned empty)',\n      );\n    }\n  }\n  const q = query.trim();\n  const capped = Math.min(Math.max(limit, 1), FILE_SEARCH_MAX_LIMIT);\n\n  type Row = { name: string; path: string; isDirectory: boolean; score: number };\n  const rows: Row[] = [];\n\n  if (!q) {\n    const sorted = [...files].sort((a, b) => a.localeCompare(b));\n    for (const rel of sorted.slice(0, capped)) {\n      const name = rel.split('/').pop() ?? rel;\n      rows.push({ name, path: rel, isDirectory: false, score: 0 });\n    }\n    return rows;\n  }\n\n  for (const rel of files) {\n    const name = rel.split('/').pop() ?? rel;\n    const scorePath = fuzzySubsequenceScore(q, rel);\n    const scoreName = fuzzySubsequenceScore(q, name);\n    const score = Math.max(scorePath ?? -Infinity, scoreName ?? -Infinity);\n    if (score === -Infinity) continue;\n    rows.push({ name, path: rel, isDirectory: false, score });\n  }\n\n  rows.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));\n  return rows.slice(0, capped).map(({ name, path, isDirectory }) => ({ name, path, isDirectory }));\n}\n\nfunction isKnownEditorAgentId(cfg: Config, id: string): boolean {\n  const n = normalizeAgentId(id);\n  if (n === resolveDefaultAgentId(cfg)) return true;\n  return listAgentEntries(cfg).some((e) => normalizeAgentId(e.id) === n);\n}\n\nfunction resolveEditorWorkspaceRoot(\n  cfg: Config,\n  agentIdRaw: string | undefined,\n): { ok: true; root: string } | { ok: false; message: string } {\n  const trimmed = typeof agentIdRaw === 'string' ? agentIdRaw.trim() : '';\n  if (!trimmed) {\n    const root = getWorkspacePath(cfg);\n    if (!root) return { ok: false, message: 'Workspace not configured' };\n    return { ok: true, root };\n  }\n  const id = normalizeAgentId(trimmed);\n  if (!isKnownEditorAgentId(cfg, id)) {\n    return { ok: false, message: 'Unknown agent' };\n  }\n  return { ok: true, root: resolveAgentWorkspaceDir(cfg, id) };\n}\n\n/** Prefer `sessionKey` (per-session workspace override) over `agentId`. */\nasync function resolveEditorWorkspaceRootAsync(\n  service: GatewayService,\n  cfg: Config,\n  sessionKeyRaw: string | undefined,\n  agentIdRaw: string | undefined,\n): Promise<{ ok: true; root: string } | { ok: false; message: string }> {\n  const sk = typeof sessionKeyRaw === 'string' ? sessionKeyRaw.trim() : '';\n  if (sk) {\n    try {\n      const root = await service.getEffectiveWorkspacePathForSession(sk);\n      return { ok: true, root };\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, sessionKey: sk }, 'Session workspace root resolution failed');\n      return { ok: false, message: em || 'Session workspace resolution failed' };\n    }\n  }\n  return resolveEditorWorkspaceRoot(cfg, agentIdRaw);\n}\n\ninterface ResolvedWorkspaceImportConfig {\n  targetDir: string;\n  maxBytes: number;\n  allowOverwrite: boolean;\n}\n\nfunction resolveWorkspaceImportConfig(cfg: Config): ResolvedWorkspaceImportConfig {\n  const raw = cfg.workspace?.import;\n  return {\n    targetDir: raw?.targetDir?.trim() || 'imports',\n    maxBytes: raw?.maxBytes ?? 104_857_600,\n    allowOverwrite: raw?.allowOverwrite ?? true,\n  };\n}\n\n/** Strip path separators, NULs and control chars from a basename so it stays in the destination dir. */\nfunction sanitizeImportBasename(name: string): string {\n  return name\n    .replace(/[\\\\/]/g, '')\n    .replace(/[\\x00-\\x1f\\x7f]/g, '')\n    .trim();\n}\n\n/**\n * Race-safe target picker for the `rename`-on-conflict strategy. Uses `link(tmp, target)`\n * which atomically fails with EEXIST when the candidate is taken; on success the tmp\n * file is left in place for the caller to unlink. Returns the linked target path.\n */\nasync function pickAvailableTargetWithLink(\n  tmpAbs: string,\n  initialDestAbs: string,\n  maxAttempts = 1000,\n): Promise<{ ok: true; path: string; attempts: number } | { ok: false; attempts: number }> {\n  const dir = dirname(initialDestAbs);\n  const original = basename(initialDestAbs);\n  const dotIdx = original.lastIndexOf('.');\n  const stem = dotIdx > 0 ? original.slice(0, dotIdx) : original;\n  const ext = dotIdx > 0 ? original.slice(dotIdx) : '';\n  for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n    const candidate = attempt === 1 ? initialDestAbs : join(dir, `${stem}-${attempt}${ext}`);\n    try {\n      await link(tmpAbs, candidate);\n      return { ok: true, path: candidate, attempts: attempt };\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException)?.code;\n      if (code !== 'EEXIST') {\n        throw err;\n      }\n    }\n  }\n  return { ok: false, attempts: maxAttempts };\n}\n\nfunction fileReferenceCapabilities(\n  scope: FileReferenceScope,\n  isDirectory: boolean,\n  locationKind?: FileReferenceLocationKind,\n): FileReferenceCapability[] {\n  if (scope === 'workspace') {\n    return isDirectory\n      ? ['openExternal', 'revealInFolder', 'copyPath']\n      : ['preview', 'edit', 'openExternal', 'revealInFolder', 'copyPath'];\n  }\n  if (scope === 'external' || scope === 'agent-profile' || scope === 'session-artifact') {\n    const base: FileReferenceCapability[] = ['openExternal', 'revealInFolder', 'copyPath'];\n    // v1: importToWorkspace for files only; exclude xopc-config to prevent copying\n    // app config into the workspace (semantically wrong).\n    if (!isDirectory && locationKind !== 'xopc-config') {\n      base.push('importToWorkspace');\n    }\n    return base;\n  }\n  if (scope === 'missing') return ['copyPath'];\n  return [];\n}\n\nfunction isFileReferenceAction(action: unknown): action is 'openExternal' | 'revealInFolder' {\n  return action === 'openExternal' || action === 'revealInFolder';\n}\n\nexport function registerWorkspaceRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  authenticated.get('/api/workspace/inbound-file', async (c) => {\n    const rel = c.req.query('rel');\n    if (!rel || typeof rel !== 'string') {\n      return c.json({ ok: false, error: { message: 'Missing rel' } }, 400);\n    }\n    const cfg = service.currentConfig;\n    const agentHome = resolvePersistedAttachmentAgentHome(cfg, c.req.query('sessionKey'));\n    const abs = resolveSafeInboundFilePath({ agentHome }, rel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Forbidden' } }, 403);\n    }\n    try {\n      const buf = await readFile(abs);\n      const ext = rel.split('.').pop()?.toLowerCase() ?? '';\n      const mimeByExt: Record<string, string> = {\n        pdf: 'application/pdf',\n        png: 'image/png',\n        jpg: 'image/jpeg',\n        jpeg: 'image/jpeg',\n        webp: 'image/webp',\n        gif: 'image/gif',\n        md: 'text/markdown',\n        txt: 'text/plain',\n        json: 'application/json',\n        html: 'text/html',\n        css: 'text/css',\n        js: 'text/javascript',\n        ts: 'text/typescript',\n        webm: 'audio/webm',\n        ogg: 'audio/ogg',\n        opus: 'audio/ogg',\n        mp3: 'audio/mpeg',\n        wav: 'audio/wav',\n        m4a: 'audio/mp4',\n      };\n      const contentType = mimeByExt[ext] || 'application/octet-stream';\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n  });\n\n  authenticated.get('/api/workspace/tts-file', async (c) => {\n    const rel = c.req.query('rel');\n    if (!rel || typeof rel !== 'string') {\n      return c.json({ ok: false, error: { message: 'Missing rel' } }, 400);\n    }\n    const cfg = service.currentConfig;\n    const agentHome = resolvePersistedAttachmentAgentHome(cfg, c.req.query('sessionKey'));\n    const abs = resolveSafeTtsFilePath({ agentHome }, rel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Forbidden' } }, 403);\n    }\n    try {\n      const buf = await readFile(abs);\n      const ext = rel.split('.').pop()?.toLowerCase() ?? '';\n      const mimeByExt: Record<string, string> = {\n        ogg: 'audio/ogg',\n        opus: 'audio/ogg',\n        mp3: 'audio/mpeg',\n        wav: 'audio/wav',\n        m4a: 'audio/mp4',\n      };\n      const contentType = mimeByExt[ext] || 'application/octet-stream';\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n  });\n\n  authenticated.get('/api/workspace/heartbeat-md', async (c) => {\n    const abs = resolveHeartbeatMdPath(service.currentConfig);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Workspace not configured' } }, 400);\n    }\n    try {\n      const content = await readFile(abs, 'utf-8');\n      return c.json({ ok: true, payload: { content: content, file: 'HEARTBEAT.md' } });\n    } catch {\n      return c.json({ ok: true, payload: { content: '', file: 'HEARTBEAT.md' } });\n    }\n  });\n\n  authenticated.put('/api/workspace/heartbeat-md', async (c) => {\n    const abs = resolveHeartbeatMdPath(service.currentConfig);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Workspace not configured' } }, 400);\n    }\n    let body: unknown;\n    try {\n      body = await c.req.json();\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const content =\n      typeof body === 'object' &&\n      body !== null &&\n      'content' in body &&\n      typeof (body as { content: unknown }).content === 'string'\n        ? (body as { content: string }).content\n        : '';\n    try {\n      await writeFile(abs, content, 'utf-8');\n      return c.json({ ok: true, payload: { file: 'HEARTBEAT.md' } });\n    } catch (err) {\n      log.error({ err, path: abs }, 'Failed to write HEARTBEAT.md');\n      return c.json({ ok: false, error: { message: 'Write failed' } }, 500);\n    }\n  });\n\n  authenticated.get('/api/workspace/editor/list', async (c) => {\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const dirRel = typeof c.req.query('dir') === 'string' ? c.req.query('dir')! : '';\n    const absDir = resolveWorkspaceSafePath(workspaceRoot, dirRel);\n    if (!absDir) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(absDir);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isDirectory()) {\n      return c.json({ ok: false, error: { message: 'Not a directory' } }, 400);\n    }\n    const dirents = await readdir(absDir, { withFileTypes: true });\n    const entries: { name: string; path: string; absolutePath: string; isDirectory: boolean }[] = [];\n    for (const entry of dirents) {\n      if (entry.name.startsWith('.')) continue;\n      const fullPath = join(absDir, entry.name);\n      if (entry.isDirectory()) {\n        entries.push({\n          name: entry.name,\n          path: toWorkspaceRelativePosix(workspaceRoot, fullPath),\n          absolutePath: fullPath,\n          isDirectory: true,\n        });\n      } else {\n        entries.push({\n          name: entry.name,\n          path: toWorkspaceRelativePosix(workspaceRoot, fullPath),\n          absolutePath: fullPath,\n          isDirectory: false,\n        });\n      }\n    }\n    entries.sort((a, b) => {\n      if (a.isDirectory !== b.isDirectory) return a.isDirectory ? -1 : 1;\n      return a.name.localeCompare(b.name);\n    });\n    return c.json({ ok: true, payload: { entries } });\n  });\n\n  authenticated.get('/api/workspace/editor/read', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      const content = await readFile(abs, 'utf-8');\n      return c.json({\n        ok: true,\n        payload: {\n          content,\n          path: toWorkspaceRelativePosix(workspaceRoot, abs),\n          absolutePath: abs,\n          mtimeMs: st.mtimeMs,\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  /** Read file as raw bytes and return base64 (for PDF/images in workspace preview — avoids UTF-8 corruption). */\n  authenticated.get('/api/workspace/editor/read-base64', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      const buf = await readFile(abs);\n      return c.json({\n        ok: true,\n        payload: {\n          contentBase64: buf.toString('base64'),\n          path: toWorkspaceRelativePosix(workspaceRoot, abs),\n          /** Host absolute path — Electron can open with the default app (shell.openPath). */\n          absolutePath: abs,\n          mtimeMs: st.mtimeMs,\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  /** Map an absolute host path to a workspace-relative path (if under this session’s workspace). */\n  authenticated.get('/api/workspace/editor/resolve-path', async (c) => {\n    const raw = c.req.query('absolutePath');\n    if (!raw || typeof raw !== 'string' || !raw.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing absolutePath' } }, 400);\n    }\n    const absolutePath = raw.trim();\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const normalized = resolve(absolutePath);\n    if (!isPathUnderWorkspace(workspaceRoot, normalized)) {\n      return c.json({ ok: false, error: { message: 'Path not under workspace' } }, 403);\n    }\n    const rel = toWorkspaceRelativePosix(workspaceRoot, normalized);\n    return c.json({ ok: true, payload: { workspaceRelativePath: rel } });\n  });\n\n  authenticated.get('/api/workspace/editor/resolve-reference', async (c) => {\n    const rawPath = typeof c.req.query('path') === 'string' ? c.req.query('path')!.trim() : '';\n    if (!rawPath) {\n      return c.json({ ok: false, error: { code: 'INVALID_PATH', message: 'Missing path' } }, 400);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      sessionKey,\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { code: 'WORKSPACE_RESOLUTION_FAILED', message: ws.message } }, 400);\n    }\n\n    const workspaceRoot = ws.root;\n    const classifierCtx = { ...buildFilePathClassifierContext(service.currentConfig, sessionKey), workspaceRoot };\n    const displayName = displayNameForPath(rawPath);\n    const { candidate, invalid } = await resolveFileReferenceCandidate(rawPath, workspaceRoot, classifierCtx);\n\n    if (!candidate || invalid) {\n      return c.json({\n        ok: true,\n        payload: {\n          inputPath: rawPath,\n          displayName,\n          scope: 'invalid' satisfies FileReferenceScope,\n          exists: false,\n          capabilities: [] as FileReferenceCapability[],\n          errorCode: 'INVALID_PATH',\n        },\n      });\n    }\n\n    let st: Awaited<ReturnType<typeof stat>> | null = null;\n    try {\n      st = await stat(candidate);\n    } catch {\n      st = null;\n    }\n\n    if (!st) {\n      // Always include the resolved candidate so the UI's \"Copy path\" yields\n      // something actionable (\"I looked here, no file\"). Without this, bare\n      // workspace-relative mentions fall back to the `rel:<path>` UI sentinel.\n      return c.json({\n        ok: true,\n        payload: {\n          inputPath: rawPath,\n          displayName,\n          scope: 'missing' satisfies FileReferenceScope,\n          exists: false,\n          absolutePath: candidate,\n          capabilities: fileReferenceCapabilities('missing', false),\n          errorCode: 'FILE_NOT_FOUND',\n        },\n      });\n    }\n\n    const classified = classifyFileLocation(candidate, classifierCtx);\n    const { scope, locationKind, manageRoute } = classified;\n    const inWorkspace = scope === 'workspace';\n    const isDirectory = st.isDirectory();\n    const capabilities = fileReferenceCapabilities(scope, isDirectory, locationKind);\n    const ref = fileReferenceRegistry.register({\n      absolutePath: candidate,\n      sessionKey: sessionKey || undefined,\n      scope,\n      locationKind,\n      capabilities,\n    });\n\n    return c.json({\n      ok: true,\n      payload: {\n        fileRefId: ref.id,\n        inputPath: rawPath,\n        displayName,\n        scope,\n        locationKind,\n        manageRoute,\n        exists: true,\n        isDirectory,\n        absolutePath: candidate,\n        workspaceRelativePath: inWorkspace ? toWorkspaceRelativePosix(workspaceRoot, candidate) : undefined,\n        capabilities,\n        mtimeMs: st.mtimeMs,\n      },\n    });\n  });\n\n  authenticated.post('/api/workspace/file-ref/:id/resolve-action', async (c) => {\n    const id = c.req.param('id')?.trim() ?? '';\n    if (!id) {\n      return c.json({ ok: false, error: { code: 'INVALID_FILE_REF', message: 'Missing file reference' } }, 400);\n    }\n\n    const ref = fileReferenceRegistry.resolve(id);\n    if (!ref) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_EXPIRED', message: 'File reference expired' } }, 404);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    if (!fileRefSessionKeysMatch(ref.sessionKey, sessionKey)) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_FORBIDDEN', message: 'File reference forbidden' } }, 403);\n    }\n\n    const body = (await c.req.json().catch(() => ({}))) as { action?: unknown };\n    const action = body.action;\n    if (!isFileReferenceAction(action)) {\n      return c.json({ ok: false, error: { code: 'INVALID_ACTION', message: 'Invalid action' } }, 400);\n    }\n    if (!ref.capabilities.includes(action)) {\n      return c.json({ ok: false, error: { code: 'ACTION_NOT_ALLOWED', message: 'Action not allowed' } }, 403);\n    }\n\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(ref.absolutePath);\n    } catch {\n      return c.json({ ok: false, error: { code: 'FILE_NOT_FOUND', message: 'File not found' } }, 404);\n    }\n\n    return c.json({\n      ok: true,\n      payload: {\n        absolutePath: ref.absolutePath,\n        isDirectory: st.isDirectory(),\n      },\n    });\n  });\n\n  authenticated.post('/api/workspace/import-file-ref/:id', async (c) => {\n    const id = c.req.param('id')?.trim() ?? '';\n    if (!id) {\n      return c.json({ ok: false, error: { code: 'INVALID_FILE_REF', message: 'Missing file reference' } }, 400);\n    }\n\n    const ref = fileReferenceRegistry.resolve(id);\n    if (!ref) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_EXPIRED', message: 'File reference expired' } }, 404);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    if (!fileRefSessionKeysMatch(ref.sessionKey, sessionKey)) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_FORBIDDEN', message: 'File reference forbidden' } }, 403);\n    }\n\n    if (!ref.capabilities.includes('importToWorkspace')) {\n      return c.json({ ok: false, error: { code: 'IMPORT_NOT_ALLOWED', message: 'Import not allowed for this file' } }, 403);\n    }\n\n    let sourceStat: Awaited<ReturnType<typeof stat>>;\n    try {\n      sourceStat = await stat(ref.absolutePath);\n    } catch {\n      fileReferenceRegistry.expireById(id);\n      return c.json({ ok: false, error: { code: 'SOURCE_NOT_FOUND', message: 'Source file no longer exists' } }, 404);\n    }\n    if (!sourceStat.isFile()) {\n      return c.json({ ok: false, error: { code: 'SOURCE_NOT_FILE', message: 'Source is not a regular file' } }, 400);\n    }\n\n    const importCfg = resolveWorkspaceImportConfig(service.currentConfig);\n    if (sourceStat.size > importCfg.maxBytes) {\n      return c.json(\n        {\n          ok: false,\n          error: {\n            code: 'SOURCE_TOO_LARGE',\n            message: `Source exceeds maximum import size (${importCfg.maxBytes} bytes)`,\n          },\n        },\n        413,\n      );\n    }\n\n    const ws = await resolveEditorWorkspaceRootAsync(service, service.currentConfig, sessionKey, undefined);\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { code: 'WORKSPACE_RESOLUTION_FAILED', message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n\n    let body: { destination?: unknown; onConflict?: unknown };\n    try {\n      body = (await c.req.json().catch(() => ({}))) as typeof body;\n    } catch {\n      body = {};\n    }\n    const requestedDestRaw = typeof body.destination === 'string' ? body.destination.trim() : '';\n    const onConflictRaw = typeof body.onConflict === 'string' ? body.onConflict : 'rename';\n    if (onConflictRaw !== 'rename' && onConflictRaw !== 'overwrite' && onConflictRaw !== 'error') {\n      return c.json({ ok: false, error: { code: 'INVALID_CONFLICT_MODE', message: 'Invalid onConflict value' } }, 400);\n    }\n    const onConflict = onConflictRaw as 'rename' | 'overwrite' | 'error';\n    if (onConflict === 'overwrite' && !importCfg.allowOverwrite) {\n      return c.json({ ok: false, error: { code: 'OVERWRITE_DISABLED', message: 'Overwrite is disabled by config' } }, 403);\n    }\n\n    const sourceBasename = sanitizeImportBasename(basename(ref.absolutePath)) || 'imported-file';\n    let requestedRel: string;\n    if (!requestedDestRaw) {\n      requestedRel = `${importCfg.targetDir}/${sourceBasename}`;\n    } else {\n      const trimmedDest = requestedDestRaw.replace(/\\\\/g, '/');\n      // Path ending with `/` is treated as a directory; append source basename.\n      requestedRel = trimmedDest.endsWith('/') ? `${trimmedDest}${sourceBasename}` : trimmedDest;\n    }\n\n    let initialDestAbs = resolveWorkspaceSafePath(workspaceRoot, requestedRel);\n    if (!initialDestAbs) {\n      return c.json({ ok: false, error: { code: 'INVALID_DESTINATION', message: 'Invalid destination path' } }, 400);\n    }\n\n    // Sandbox: blocks `.xopc/xopc.json`, `.env*`, etc.; canonical symlink resolution included.\n    const writePolicy = validateWritePath(initialDestAbs, workspaceRoot);\n    if (!writePolicy.allowed) {\n      return c.json({ ok: false, error: { code: 'DESTINATION_BLOCKED', message: writePolicy.reason ?? 'Destination blocked' } }, 403);\n    }\n\n    if (resolve(ref.absolutePath) === resolve(initialDestAbs)) {\n      return c.json({ ok: false, error: { code: 'SAME_LOCATION', message: 'Destination is the same as source' } }, 400);\n    }\n\n    const destDir = dirname(initialDestAbs);\n    try {\n      await mkdir(destDir, { recursive: true });\n    } catch (err) {\n      log.warn({ err, destDir }, 'Failed to create import destination directory');\n      return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to prepare destination' } }, 500);\n    }\n\n    // Stage source into a hidden tmp file inside the destination directory so we\n    // can atomically `link` (rename strategy) or `rename` (overwrite) to land it.\n    const tmpName = `.${basename(initialDestAbs)}.import-${randomUUID()}.tmp`;\n    const tmpAbs = join(destDir, tmpName);\n\n    const started = Date.now();\n    let renamed = false;\n    let overwrote = false;\n    let finalDestAbs = initialDestAbs;\n\n    try {\n      try {\n        await copyFile(ref.absolutePath, tmpAbs, fsConstants.COPYFILE_FICLONE);\n      } catch (err) {\n        await unlink(tmpAbs).catch(() => {});\n        log.warn({ err, source: ref.absolutePath, tmpAbs }, 'Failed to copy source into staging tmp');\n        return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to copy source file' } }, 500);\n      }\n\n      if (onConflict === 'overwrite') {\n        // Snapshot pre-rename existence for telemetry; the actual overwrite is unconditional.\n        overwrote = await stat(initialDestAbs).then(() => true).catch(() => false);\n        try {\n          await rename(tmpAbs, initialDestAbs);\n        } catch (err) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ err, target: initialDestAbs }, 'Atomic rename failed');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to finalize import' } }, 500);\n        }\n      } else if (onConflict === 'error') {\n        const exists = await stat(initialDestAbs).then(() => true).catch(() => false);\n        if (exists) {\n          await unlink(tmpAbs).catch(() => {});\n          return c.json({ ok: false, error: { code: 'DESTINATION_EXISTS', message: 'Destination already exists' } }, 409);\n        }\n        try {\n          await link(tmpAbs, initialDestAbs);\n          await unlink(tmpAbs).catch(() => {});\n        } catch (err) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ err, target: initialDestAbs }, 'Hard link to destination failed');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to finalize import' } }, 500);\n        }\n      } else {\n        // rename: race-safe loop using O_EXCL semantics of `link`.\n        const picked = await pickAvailableTargetWithLink(tmpAbs, initialDestAbs);\n        if (!picked.ok) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ target: initialDestAbs, attempts: picked.attempts }, 'Failed to find free import target name');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'No free destination name available' } }, 500);\n        }\n        await unlink(tmpAbs).catch(() => {});\n        finalDestAbs = picked.path;\n        renamed = picked.path !== initialDestAbs;\n      }\n    } catch (err) {\n      await unlink(tmpAbs).catch(() => {});\n      log.error({ err }, 'Import file unexpected failure');\n      return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Import failed' } }, 500);\n    }\n\n    let finalMtime: number;\n    try {\n      finalMtime = (await stat(finalDestAbs)).mtimeMs;\n    } catch {\n      finalMtime = Date.now();\n    }\n\n    const workspaceRel = toWorkspaceRelativePosix(workspaceRoot, finalDestAbs);\n\n    fileReferenceRegistry.expireById(id);\n    const newRef = fileReferenceRegistry.register({\n      absolutePath: finalDestAbs,\n      sessionKey: sessionKey || undefined,\n      scope: 'workspace',\n      capabilities: fileReferenceCapabilities('workspace', false),\n    });\n\n    const sourceScope = ref.scope;\n    const sourceLocationKind = ref.locationKind;\n\n    service.emit('workspace.file-imported', {\n      sessionKey: sessionKey || undefined,\n      workspaceRelativePath: workspaceRel,\n      absolutePath: finalDestAbs,\n      bytes: sourceStat.size,\n      sourceScope,\n      sourceLocationKind,\n    });\n\n    log.info(\n      {\n        sessionKey,\n        fileRefId: id,\n        sourceAbsolutePath: ref.absolutePath,\n        sourceScope,\n        sourceLocationKind,\n        destWorkspaceRelativePath: workspaceRel,\n        bytes: sourceStat.size,\n        renamed,\n        overwrote,\n        durationMs: Date.now() - started,\n      },\n      'Workspace file import succeeded',\n    );\n\n    return c.json({\n      ok: true,\n      payload: {\n        workspaceRelativePath: workspaceRel,\n        absolutePath: finalDestAbs,\n        bytesCopied: sourceStat.size,\n        sourceAbsolutePath: ref.absolutePath,\n        sourceScope,\n        sourceLocationKind,\n        renamed,\n        overwrote,\n        mtimeMs: finalMtime,\n        newFileRefId: newRef.id,\n      },\n    });\n  });\n\n  /**\n   * Serve a workspace file as raw bytes (e.g. <img> after auth fetch + blob URL).\n   * Path is workspace-relative; scope via sessionKey / agentId like other editor routes.\n   */\n  authenticated.get('/api/workspace/editor/raw', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    const ext = pathRel.split('.').pop()?.toLowerCase() ?? '';\n    const mimeByExt: Record<string, string> = {\n      png: 'image/png',\n      jpg: 'image/jpeg',\n      jpeg: 'image/jpeg',\n      gif: 'image/gif',\n      webp: 'image/webp',\n      bmp: 'image/bmp',\n      svg: 'image/svg+xml',\n      pdf: 'application/pdf',\n      docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n      xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',\n      pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',\n      txt: 'text/plain',\n      md: 'text/markdown',\n      json: 'application/json',\n      html: 'text/html',\n      css: 'text/css',\n      js: 'text/javascript',\n      ts: 'text/typescript',\n      mp3: 'audio/mpeg',\n      wav: 'audio/wav',\n      ogg: 'audio/ogg',\n      webm: 'video/webm',\n      mp4: 'video/mp4',\n      mov: 'video/quicktime',\n    };\n    const contentType = mimeByExt[ext] || 'application/octet-stream';\n    try {\n      const buf = await readFile(abs);\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  authenticated.put('/api/workspace/editor/write', async (c) => {\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    let body: unknown;\n    try {\n      body = await c.req.json();\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const pathRel =\n      typeof body === 'object' &&\n      body !== null &&\n      'path' in body &&\n      typeof (body as { path: unknown }).path === 'string'\n        ? (body as { path: string }).path\n        : '';\n    const content =\n      typeof body === 'object' &&\n      body !== null &&\n      'content' in body &&\n      typeof (body as { content: unknown }).content === 'string'\n        ? (body as { content: string }).content\n        : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>> | undefined;\n    try {\n      st = await stat(abs);\n    } catch {\n      st = undefined;\n    }\n    if (st && !st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      await writeFile(abs, content, 'utf-8');\n      let mtimeMs: number;\n      try {\n        mtimeMs = (await stat(abs)).mtimeMs;\n      } catch {\n        mtimeMs = Date.now();\n      }\n      return c.json({\n        ok: true,\n        payload: { path: toWorkspaceRelativePosix(workspaceRoot, abs), mtimeMs },\n      });\n    } catch (err) {\n      log.error({ err, path: abs }, 'workspace editor write failed');\n      return c.json({ ok: false, error: { message: 'Write failed' } }, 500);\n    }\n  });\n\n  authenticated.get('/api/workspace/editor/search', async (c) => {\n    const q = typeof c.req.query('q') === 'string' ? c.req.query('q')!.trim() : '';\n    const dirRel = typeof c.req.query('dir') === 'string' ? c.req.query('dir')! : '';\n    if (!q) {\n      return c.json({\n        ok: true,\n        payload: { results: [] as { filePath: string; lineNumber: number; lineContent: string; matchStart: number; matchEnd: number }[] },\n      });\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const absDir = resolveWorkspaceSafePath(workspaceRoot, dirRel);\n    if (!absDir) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(absDir);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isDirectory()) {\n      return c.json({ ok: false, error: { message: 'Not a directory' } }, 400);\n    }\n    const raw = await runRipgrepInDirectory(q, absDir);\n    const results = raw\n      .filter((r) => isPathUnderWorkspace(workspaceRoot, r.filePath))\n      .map((r) => ({\n        ...r,\n        filePath: toWorkspaceRelativePosix(workspaceRoot, resolve(r.filePath)),\n      }));\n    return c.json({ ok: true, payload: { results } });\n  });\n\n  /** Fuzzy filename / path search over the session workspace (ripgrep `--files` + subsequence scoring). */\n  authenticated.get('/api/workspace/editor/files/search', async (c) => {\n    const q = typeof c.req.query('q') === 'string' ? c.req.query('q')!.trim() : '';\n    const limitRaw = c.req.query('limit');\n    const limit = Math.min(\n      Math.max(parseInt(typeof limitRaw === 'string' ? limitRaw : '15', 10) || 15, 1),\n      FILE_SEARCH_MAX_LIMIT,\n    );\n\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n\n    const entries = await fuzzySearchWorkspaceFiles(ws.root, q, limit);\n    return c.json({ ok: true, payload: { entries } });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;aAO0E;kBAUnC;aACiB;AAyBxD,MAAM,MAAM,aAAa,UAAU;;AAGnC,SAAS,oCAAoC,KAAa,eAA2C;CACnG,MAAM,KAAK,OAAO,kBAAkB,WAAW,cAAc,MAAM,GAAG;AAEtE,QAAO,oBAAoB,KADX,KAAK,sBAAsB,IAAI,IAAI,GAAG,sBAAsB,IAAI,CACxC;;AAG1C,MAAM,wBAAwB;;AAG9B,SAAS,sBAAsB,OAAe,WAAkC;CAC9E,MAAM,IAAI,MAAM,aAAa;CAC7B,MAAM,IAAI,UAAU,aAAa;AACjC,KAAI,EAAE,WAAW,EAAG,QAAO;CAC3B,IAAI,KAAK;AACT,MAAK,IAAI,KAAK,GAAG,KAAK,EAAE,UAAU,KAAK,EAAE,QAAQ,KAC/C,KAAI,EAAE,QAAQ,EAAE,IAAK;AAEvB,KAAI,KAAK,EAAE,OAAQ,QAAO;CAC1B,MAAM,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,IAAI;CACnC,IAAI,QAAQ;AACZ,KAAI,EAAE,WAAW,EAAE,CAAE,UAAS;AAC9B,KAAI,KAAK,WAAW,EAAE,CAAE,UAAS;UACxB,KAAK,SAAS,EAAE,CAAE,UAAS;UAC3B,EAAE,SAAS,EAAE,CAAE,UAAS;AACjC,UAAS,EAAE,SAAS;AACpB,QAAO;;AAGT,eAAe,0BACb,eACA,OACA,OACsE;CACtE,IAAI,QAAQ,MAAM,oBAAoB,cAAc;AACpD,KAAI,MAAM,WAAW,GAAG;AACtB,UAAQ,MAAM,qCAAqC,eAAe,KAAQ;AAC1E,MAAI,MAAM,SAAS,EACjB,KAAI,MACF;GAAE;GAAe,WAAW,MAAM;GAAQ,EAC1C,yFACD;;CAGL,MAAM,IAAI,MAAM,MAAM;CACtB,MAAM,SAAS,KAAK,IAAI,KAAK,IAAI,OAAO,EAAE,EAAE,sBAAsB;CAGlE,MAAM,OAAc,EAAE;AAEtB,KAAI,CAAC,GAAG;EACN,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;AAC5D,OAAK,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,EAAE;GACzC,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;AACrC,QAAK,KAAK;IAAE;IAAM,MAAM;IAAK,aAAa;IAAO,OAAO;IAAG,CAAC;;AAE9D,SAAO;;AAGT,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;EACrC,MAAM,YAAY,sBAAsB,GAAG,IAAI;EAC/C,MAAM,YAAY,sBAAsB,GAAG,KAAK;EAChD,MAAM,QAAQ,KAAK,IAAI,aAAa,WAAW,aAAa,UAAU;AACtE,MAAI,UAAU,UAAW;AACzB,OAAK,KAAK;GAAE;GAAM,MAAM;GAAK,aAAa;GAAO;GAAO,CAAC;;AAG3D,MAAK,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;AACtE,QAAO,KAAK,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,MAAM,mBAAmB;EAAE;EAAM;EAAM;EAAa,EAAE;;AAGlG,SAAS,qBAAqB,KAAa,IAAqB;CAC9D,MAAM,IAAI,iBAAiB,GAAG;AAC9B,KAAI,MAAM,sBAAsB,IAAI,CAAE,QAAO;AAC7C,QAAO,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,EAAE;;AAGxE,SAAS,2BACP,KACA,YAC6D;CAC7D,MAAM,UAAU,OAAO,eAAe,WAAW,WAAW,MAAM,GAAG;AACrE,KAAI,CAAC,SAAS;EACZ,MAAM,OAAO,iBAAiB,IAAI;AAClC,MAAI,CAAC,KAAM,QAAO;GAAE,IAAI;GAAO,SAAS;GAA4B;AACpE,SAAO;GAAE,IAAI;GAAM;GAAM;;CAE3B,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,CAAC,qBAAqB,KAAK,GAAG,CAChC,QAAO;EAAE,IAAI;EAAO,SAAS;EAAiB;AAEhD,QAAO;EAAE,IAAI;EAAM,MAAM,yBAAyB,KAAK,GAAG;EAAE;;;AAI9D,eAAe,gCACb,SACA,KACA,eACA,YACsE;CACtE,MAAM,KAAK,OAAO,kBAAkB,WAAW,cAAc,MAAM,GAAG;AACtE,KAAI,GACF,KAAI;AAEF,SAAO;GAAE,IAAI;GAAM,MAAA,MADA,QAAQ,oCAAoC,GAAG;GACzC;UAClB,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KAAK;GAAE;GAAK,YAAY;GAAI,EAAE,2CAA2C;AAC7E,SAAO;GAAE,IAAI;GAAO,SAAS,MAAM;GAAuC;;AAG9E,QAAO,2BAA2B,KAAK,WAAW;;AASpD,SAAS,6BAA6B,KAA4C;CAChF,MAAM,MAAM,IAAI,WAAW;AAC3B,QAAO;EACL,WAAW,KAAK,WAAW,MAAM,IAAI;EACrC,UAAU,KAAK,YAAY;EAC3B,gBAAgB,KAAK,kBAAkB;EACxC;;;AAIH,SAAS,uBAAuB,MAAsB;AACpD,QAAO,KACJ,QAAQ,UAAU,GAAG,CACrB,QAAQ,oBAAoB,GAAG,CAC/B,MAAM;;;;;;;AAQX,eAAe,4BACb,QACA,gBACA,cAAc,KAC2E;CACzF,MAAM,MAAM,QAAQ,eAAe;CACnC,MAAM,WAAW,SAAS,eAAe;CACzC,MAAM,SAAS,SAAS,YAAY,IAAI;CACxC,MAAM,OAAO,SAAS,IAAI,SAAS,MAAM,GAAG,OAAO,GAAG;CACtD,MAAM,MAAM,SAAS,IAAI,SAAS,MAAM,OAAO,GAAG;AAClD,MAAK,IAAI,UAAU,GAAG,WAAW,aAAa,WAAW;EACvD,MAAM,YAAY,YAAY,IAAI,iBAAiB,KAAK,KAAK,GAAG,KAAK,GAAG,UAAU,MAAM;AACxF,MAAI;AACF,SAAM,KAAK,QAAQ,UAAU;AAC7B,UAAO;IAAE,IAAI;IAAM,MAAM;IAAW,UAAU;IAAS;WAChD,KAAK;AAEZ,OADc,KAA+B,SAChC,SACX,OAAM;;;AAIZ,QAAO;EAAE,IAAI;EAAO,UAAU;EAAa;;AAG7C,SAAS,0BACP,OACA,aACA,cAC2B;AAC3B,KAAI,UAAU,YACZ,QAAO,cACH;EAAC;EAAgB;EAAkB;EAAW,GAC9C;EAAC;EAAW;EAAQ;EAAgB;EAAkB;EAAW;AAEvE,KAAI,UAAU,cAAc,UAAU,mBAAmB,UAAU,oBAAoB;EACrF,MAAM,OAAkC;GAAC;GAAgB;GAAkB;GAAW;AAGtF,MAAI,CAAC,eAAe,iBAAiB,cACnC,MAAK,KAAK,oBAAoB;AAEhC,SAAO;;AAET,KAAI,UAAU,UAAW,QAAO,CAAC,WAAW;AAC5C,QAAO,EAAE;;AAGX,SAAS,sBAAsB,QAA8D;AAC3F,QAAO,WAAW,kBAAkB,WAAW;;AAGjD,SAAgB,wBAAwB,eAAqB,MAAoC;CAC/F,MAAM,EAAE,YAAY;AAEpB,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAC9B,MAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,eAAe;GAAE,EAAE,IAAI;EAEtE,MAAM,MAAM,QAAQ;EAEpB,MAAM,MAAM,2BAA2B,EAAE,WADvB,oCAAoC,KAAK,EAAE,IAAI,MAAM,aAAa,CAClC,EAAE,EAAE,IAAI;AAC1D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,aAAa;GAAE,EAAE,IAAI;AAEpE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;GAuB/B,MAAM,cAAc;IApBlB,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IAEsB,CAtBjB,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAsBb;AACtC,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;GAEpE;AAEF,eAAc,IAAI,2BAA2B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAC9B,MAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,eAAe;GAAE,EAAE,IAAI;EAEtE,MAAM,MAAM,QAAQ;EAEpB,MAAM,MAAM,uBAAuB,EAAE,WADnB,oCAAoC,KAAK,EAAE,IAAI,MAAM,aAAa,CACtC,EAAE,EAAE,IAAI;AACtD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,aAAa;GAAE,EAAE,IAAI;AAEpE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;GAS/B,MAAM,cAAc;IANlB,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IAEsB,CARjB,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAQb;AACtC,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;GAEpE;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,uBAAuB,QAAQ,cAAc;AACzD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;AAEnF,MAAI;GACF,MAAM,UAAU,MAAM,SAAS,KAAK,QAAQ;AAC5C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;KAAW;KAAS,MAAM;KAAgB;IAAE,CAAC;UAC1E;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;KAAE,SAAS;KAAI,MAAM;KAAgB;IAAE,CAAC;;GAE7E;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,uBAAuB,QAAQ,cAAc;AACzD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;EAEnF,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,MAAM;UACnB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,aAAa,QACb,OAAQ,KAA8B,YAAY,WAC7C,KAA6B,UAC9B;AACN,MAAI;AACF,SAAM,UAAU,KAAK,SAAS,QAAQ;AACtC,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS,EAAE,MAAM,gBAAgB;IAAE,CAAC;WACvD,KAAK;AACZ,OAAI,MAAM;IAAE;IAAK,MAAM;IAAK,EAAE,+BAA+B;AAC7D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;GAEvE;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EAEzB,MAAM,SAAS,yBAAyB,eADzB,OAAO,EAAE,IAAI,MAAM,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,MAAM,GAAI,GAChB;AAC9D,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,OAAO;UACjB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,aAAa,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mBAAmB;GAAE,EAAE,IAAI;EAE1E,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,MAAM,CAAC;EAC9D,MAAM,UAAwF,EAAE;AAChG,OAAK,MAAM,SAAS,SAAS;AAC3B,OAAI,MAAM,KAAK,WAAW,IAAI,CAAE;GAChC,MAAM,WAAW,KAAK,QAAQ,MAAM,KAAK;AACzC,OAAI,MAAM,aAAa,CACrB,SAAQ,KAAK;IACX,MAAM,MAAM;IACZ,MAAM,yBAAyB,eAAe,SAAS;IACvD,cAAc;IACd,aAAa;IACd,CAAC;OAEF,SAAQ,KAAK;IACX,MAAM,MAAM;IACZ,MAAM,yBAAyB,eAAe,SAAS;IACvD,cAAc;IACd,aAAa;IACd,CAAC;;AAGN,UAAQ,MAAM,GAAG,MAAM;AACrB,OAAI,EAAE,gBAAgB,EAAE,YAAa,QAAO,EAAE,cAAc,KAAK;AACjE,UAAO,EAAE,KAAK,cAAc,EAAE,KAAK;IACnC;AACF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;GACF,MAAM,UAAU,MAAM,SAAS,KAAK,QAAQ;AAC5C,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP;KACA,MAAM,yBAAyB,eAAe,IAAI;KAClD,cAAc;KACd,SAAS,GAAG;KACb;IACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;;AAGF,eAAc,IAAI,qCAAqC,OAAO,MAAM;EAClE,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;AAC/B,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,eAAe,IAAI,SAAS,SAAS;KACrC,MAAM,yBAAyB,eAAe,IAAI;;KAElD,cAAc;KACd,SAAS,GAAG;KACb;IACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;;AAGF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,eAAe;AACvC,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,IAAI,MAAM,CAChD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,wBAAwB;GAAE,EAAE,IAAI;EAE/E,MAAM,eAAe,IAAI,MAAM;EAC/B,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,aAAa,QAAQ,aAAa;AACxC,MAAI,CAAC,qBAAqB,eAAe,WAAW,CAClD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;EAEnF,MAAM,MAAM,yBAAyB,eAAe,WAAW;AAC/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,uBAAuB,KAAK;GAAE,CAAC;GACpE;AAEF,eAAc,IAAI,2CAA2C,OAAO,MAAM;EACxE,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,CAAE,MAAM,GAAG;AACxF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAgB,SAAS;IAAgB;GAAE,EAAE,IAAI;EAG7F,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;EACvG,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,YACA,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAA+B,SAAS,GAAG;IAAS;GAAE,EAAE,IAAI;EAGxG,MAAM,gBAAgB,GAAG;EACzB,MAAM,gBAAgB;GAAE,GAAG,+BAA+B,QAAQ,eAAe,WAAW;GAAE;GAAe;EAC7G,MAAM,cAAc,mBAAmB,QAAQ;EAC/C,MAAM,EAAE,WAAW,YAAY,MAAM,8BAA8B,SAAS,eAAe,cAAc;AAEzG,MAAI,CAAC,aAAa,QAChB,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW;IACX;IACA,OAAO;IACP,QAAQ;IACR,cAAc,EAAE;IAChB,WAAW;IACZ;GACF,CAAC;EAGJ,IAAI,KAA8C;AAClD,MAAI;AACF,QAAK,MAAM,KAAK,UAAU;UACpB;AACN,QAAK;;AAGP,MAAI,CAAC,GAIH,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW;IACX;IACA,OAAO;IACP,QAAQ;IACR,cAAc;IACd,cAAc,0BAA0B,WAAW,MAAM;IACzD,WAAW;IACZ;GACF,CAAC;EAIJ,MAAM,EAAE,OAAO,cAAc,gBADV,qBAAqB,WAAW,cACI;EACvD,MAAM,cAAc,UAAU;EAC9B,MAAM,cAAc,GAAG,aAAa;EACpC,MAAM,eAAe,0BAA0B,OAAO,aAAa,aAAa;EAChF,MAAM,MAAM,sBAAsB,SAAS;GACzC,cAAc;GACd,YAAY,cAAc,KAAA;GAC1B;GACA;GACA;GACD,CAAC;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW,IAAI;IACf,WAAW;IACX;IACA;IACA;IACA;IACA,QAAQ;IACR;IACA,cAAc;IACd,uBAAuB,cAAc,yBAAyB,eAAe,UAAU,GAAG,KAAA;IAC1F;IACA,SAAS,GAAG;IACb;GACF,CAAC;GACF;AAEF,eAAc,KAAK,8CAA8C,OAAO,MAAM;EAC5E,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM,IAAI;AACxC,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,MAAM,sBAAsB,QAAQ,GAAG;AAC7C,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;AACvG,MAAI,CAAC,wBAAwB,IAAI,YAAY,WAAW,CACtD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAI/G,MAAM,UAAS,MADK,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EAC9B;AACpB,MAAI,CAAC,sBAAsB,OAAO,CAChC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAkB,SAAS;IAAkB;GAAE,EAAE,IAAI;AAEjG,MAAI,CAAC,IAAI,aAAa,SAAS,OAAO,CACpC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAsB;GAAE,EAAE,IAAI;EAGzG,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI,aAAa;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAkB,SAAS;KAAkB;IAAE,EAAE,IAAI;;AAGjG,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,cAAc,IAAI;IAClB,aAAa,GAAG,aAAa;IAC9B;GACF,CAAC;GACF;AAEF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM,IAAI;AACxC,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,MAAM,sBAAsB,QAAQ,GAAG;AAC7C,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;AACvG,MAAI,CAAC,wBAAwB,IAAI,YAAY,WAAW,CACtD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAA4B;GAAE,EAAE,IAAI;AAG/G,MAAI,CAAC,IAAI,aAAa,SAAS,oBAAoB,CACjD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAoC;GAAE,EAAE,IAAI;EAGvH,IAAI;AACJ,MAAI;AACF,gBAAa,MAAM,KAAK,IAAI,aAAa;UACnC;AACN,yBAAsB,WAAW,GAAG;AACpC,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAoB,SAAS;KAAgC;IAAE,EAAE,IAAI;;AAEjH,MAAI,CAAC,WAAW,QAAQ,CACtB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAmB,SAAS;IAAgC;GAAE,EAAE,IAAI;EAGhH,MAAM,YAAY,6BAA6B,QAAQ,cAAc;AACrE,MAAI,WAAW,OAAO,UAAU,SAC9B,QAAO,EAAE,KACP;GACE,IAAI;GACJ,OAAO;IACL,MAAM;IACN,SAAS,uCAAuC,UAAU,SAAS;IACpE;GACF,EACD,IACD;EAGH,MAAM,KAAK,MAAM,gCAAgC,SAAS,QAAQ,eAAe,YAAY,KAAA,EAAU;AACvG,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAA+B,SAAS,GAAG;IAAS;GAAE,EAAE,IAAI;EAExG,MAAM,gBAAgB,GAAG;EAEzB,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;UACtC;AACN,UAAO,EAAE;;EAEX,MAAM,mBAAmB,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;EAC1F,MAAM,gBAAgB,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC9E,MAAI,kBAAkB,YAAY,kBAAkB,eAAe,kBAAkB,QACnF,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAElH,MAAM,aAAa;AACnB,MAAI,eAAe,eAAe,CAAC,UAAU,eAC3C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAmC;GAAE,EAAE,IAAI;EAGtH,MAAM,iBAAiB,uBAAuB,SAAS,IAAI,aAAa,CAAC,IAAI;EAC7E,IAAI;AACJ,MAAI,CAAC,iBACH,gBAAe,GAAG,UAAU,UAAU,GAAG;OACpC;GACL,MAAM,cAAc,iBAAiB,QAAQ,OAAO,IAAI;AAExD,kBAAe,YAAY,SAAS,IAAI,GAAG,GAAG,cAAc,mBAAmB;;EAGjF,IAAI,iBAAiB,yBAAyB,eAAe,aAAa;AAC1E,MAAI,CAAC,eACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAIhH,MAAM,cAAc,kBAAkB,gBAAgB,cAAc;AACpE,MAAI,CAAC,YAAY,QACf,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAuB,SAAS,YAAY,UAAU;IAAuB;GAAE,EAAE,IAAI;AAGjI,MAAI,QAAQ,IAAI,aAAa,KAAK,QAAQ,eAAe,CACvD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAqC;GAAE,EAAE,IAAI;EAGnH,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI;AACF,SAAM,MAAM,SAAS,EAAE,WAAW,MAAM,CAAC;WAClC,KAAK;AACZ,OAAI,KAAK;IAAE;IAAK;IAAS,EAAE,gDAAgD;AAC3E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAiC;IAAE,EAAE,IAAI;;EAM/G,MAAM,SAAS,KAAK,SAAS,IADT,SAAS,eAAe,CAAC,UAAU,YAAY,CAAC,MAC/B;EAErC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,UAAU;EACd,IAAI,YAAY;EAChB,IAAI,eAAe;AAEnB,MAAI;AACF,OAAI;AACF,UAAM,SAAS,IAAI,cAAc,QAAQA,UAAY,iBAAiB;YAC/D,KAAK;AACZ,UAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,QAAI,KAAK;KAAE;KAAK,QAAQ,IAAI;KAAc;KAAQ,EAAE,yCAAyC;AAC7F,WAAO,EAAE,KAAK;KAAE,IAAI;KAAO,OAAO;MAAE,MAAM;MAAiB,SAAS;MAA8B;KAAE,EAAE,IAAI;;AAG5G,OAAI,eAAe,aAAa;AAE9B,gBAAY,MAAM,KAAK,eAAe,CAAC,WAAW,KAAK,CAAC,YAAY,MAAM;AAC1E,QAAI;AACF,WAAM,OAAO,QAAQ,eAAe;aAC7B,KAAK;AACZ,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE;MAAK,QAAQ;MAAgB,EAAE,uBAAuB;AACjE,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAA6B;MAAE,EAAE,IAAI;;cAElG,eAAe,SAAS;AAEjC,QAAI,MADiB,KAAK,eAAe,CAAC,WAAW,KAAK,CAAC,YAAY,MAAM,EACjE;AACV,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAsB,SAAS;OAA8B;MAAE,EAAE,IAAI;;AAEjH,QAAI;AACF,WAAM,KAAK,QAAQ,eAAe;AAClC,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;aAC7B,KAAK;AACZ,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE;MAAK,QAAQ;MAAgB,EAAE,kCAAkC;AAC5E,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAA6B;MAAE,EAAE,IAAI;;UAEtG;IAEL,MAAM,SAAS,MAAM,4BAA4B,QAAQ,eAAe;AACxE,QAAI,CAAC,OAAO,IAAI;AACd,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE,QAAQ;MAAgB,UAAU,OAAO;MAAU,EAAE,yCAAyC;AACzG,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAAsC;MAAE,EAAE,IAAI;;AAEpH,UAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,mBAAe,OAAO;AACtB,cAAU,OAAO,SAAS;;WAErB,KAAK;AACZ,SAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,OAAI,MAAM,EAAE,KAAK,EAAE,iCAAiC;AACpD,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAiB;IAAE,EAAE,IAAI;;EAG/F,IAAI;AACJ,MAAI;AACF,iBAAc,MAAM,KAAK,aAAa,EAAE;UAClC;AACN,gBAAa,KAAK,KAAK;;EAGzB,MAAM,eAAe,yBAAyB,eAAe,aAAa;AAE1E,wBAAsB,WAAW,GAAG;EACpC,MAAM,SAAS,sBAAsB,SAAS;GAC5C,cAAc;GACd,YAAY,cAAc,KAAA;GAC1B,OAAO;GACP,cAAc,0BAA0B,aAAa,MAAM;GAC5D,CAAC;EAEF,MAAM,cAAc,IAAI;EACxB,MAAM,qBAAqB,IAAI;AAE/B,UAAQ,KAAK,2BAA2B;GACtC,YAAY,cAAc,KAAA;GAC1B,uBAAuB;GACvB,cAAc;GACd,OAAO,WAAW;GAClB;GACA;GACD,CAAC;AAEF,MAAI,KACF;GACE;GACA,WAAW;GACX,oBAAoB,IAAI;GACxB;GACA;GACA,2BAA2B;GAC3B,OAAO,WAAW;GAClB;GACA;GACA,YAAY,KAAK,KAAK,GAAG;GAC1B,EACD,kCACD;AAED,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,uBAAuB;IACvB,cAAc;IACd,aAAa,WAAW;IACxB,oBAAoB,IAAI;IACxB;IACA;IACA;IACA;IACA,SAAS;IACT,cAAc,OAAO;IACtB;GACF,CAAC;GACF;;;;;AAMF,eAAc,IAAI,6BAA6B,OAAO,MAAM;EAC1D,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;EA6BrE,MAAM,cAAc;GAzBlB,KAAK;GACL,KAAK;GACL,MAAM;GACN,KAAK;GACL,MAAM;GACN,KAAK;GACL,KAAK;GACL,KAAK;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,KAAK;GACL,IAAI;GACJ,MAAM;GACN,MAAM;GACN,KAAK;GACL,IAAI;GACJ,IAAI;GACJ,KAAK;GACL,KAAK;GACL,KAAK;GACL,MAAM;GACN,KAAK;GACL,KAAK;GAEsB,CA3BjB,QAAQ,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OA2BjB;AACtC,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;AAC/B,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,MAAM;UACnB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACV,OAAQ,KAA2B,SAAS,WACvC,KAA0B,OAC3B;EACN,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,aAAa,QACb,OAAQ,KAA8B,YAAY,WAC7C,KAA6B,UAC9B;AACN,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,QAAK,KAAA;;AAEP,MAAI,MAAM,CAAC,GAAG,QAAQ,CACpB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;AACF,SAAM,UAAU,KAAK,SAAS,QAAQ;GACtC,IAAI;AACJ,OAAI;AACF,eAAW,MAAM,KAAK,IAAI,EAAE;WACtB;AACN,cAAU,KAAK,KAAK;;AAEtB,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KAAE,MAAM,yBAAyB,eAAe,IAAI;KAAE;KAAS;IACzE,CAAC;WACK,KAAK;AACZ,OAAI,MAAM;IAAE;IAAK,MAAM;IAAK,EAAE,gCAAgC;AAC9D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;GAEvE;AAEF,eAAc,IAAI,gCAAgC,OAAO,MAAM;EAC7D,MAAM,IAAI,OAAO,EAAE,IAAI,MAAM,IAAI,KAAK,WAAW,EAAE,IAAI,MAAM,IAAI,CAAE,MAAM,GAAG;EAC5E,MAAM,SAAS,OAAO,EAAE,IAAI,MAAM,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,MAAM,GAAI;AAC9E,MAAI,CAAC,EACH,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,SAAS,EAAE,EAA2G;GAClI,CAAC;EAEJ,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,SAAS,yBAAyB,eAAe,OAAO;AAC9D,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,OAAO;UACjB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,aAAa,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mBAAmB;GAAE,EAAE,IAAI;EAG1E,MAAM,WAAU,MADE,sBAAsB,GAAG,OAAO,EAE/C,QAAQ,MAAM,qBAAqB,eAAe,EAAE,SAAS,CAAC,CAC9D,KAAK,OAAO;GACX,GAAG;GACH,UAAU,yBAAyB,eAAe,QAAQ,EAAE,SAAS,CAAC;GACvE,EAAE;AACL,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;;AAGF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,IAAI,OAAO,EAAE,IAAI,MAAM,IAAI,KAAK,WAAW,EAAE,IAAI,MAAM,IAAI,CAAE,MAAM,GAAG;EAC5E,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,QAAQ,KAAK,IACjB,KAAK,IAAI,SAAS,OAAO,aAAa,WAAW,WAAW,MAAM,GAAG,IAAI,IAAI,EAAE,EAC/E,sBACD;EAED,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAGnE,MAAM,UAAU,MAAM,0BAA0B,GAAG,MAAM,GAAG,MAAM;AAClE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD"}
+{"version":3,"file":"workspace.js","names":["fsConstants"],"sources":["../../../../../src/gateway/hono/routes/workspace.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { randomUUID } from 'node:crypto';\nimport { constants as fsConstants } from 'node:fs';\nimport { copyFile, link, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';\nimport { basename, dirname, join, resolve } from 'node:path';\n\nimport { extractProfileAgentId } from '../../../config/agent-profile.js';\nimport { type Config } from '../../../config/schema.js';\nimport { getWorkspacePath } from '../../../config/workspace-path-helpers.js';\nimport { validateWritePath } from '../../../agent/sandbox/path-policy.js';\nimport { resolveSafeInboundFilePath } from '../../../channels/attachments/inbound-persist.js';\nimport { resolveSafeTtsFilePath } from '../../../channels/attachments/outbound-tts-persist.js';\nimport {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveAgentHomeDir,\n  resolveAgentWorkspaceDir,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport { createLogger } from '../../../utils/logger.js';\nimport { resolveHeartbeatMdPath } from '../../workspace-heartbeat-path.js';\nimport {\n  isPathUnderWorkspace,\n  resolveWorkspaceSafePath,\n  toWorkspaceRelativePosix,\n} from '../../workspace-editor-path.js';\nimport { listWorkspaceRelativeFilesFsFallback } from '../../workspace-fs-file-list.js';\nimport { runRipgrepInDirectory, runRipgrepListFiles } from '../../workspace-ripgrep.js';\nimport {\n  buildFilePathClassifierContext,\n  classifyFileLocation,\n  displayNameForPath,\n  fileRefSessionKeysMatch,\n  resolveFileReferenceCandidate,\n} from '../../file-path-classifier.js';\nimport {\n  fileReferenceRegistry,\n  type FileReferenceCapability,\n  type FileReferenceLocationKind,\n  type FileReferenceScope,\n} from '../../file-reference-registry.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport type { GatewayService } from '../../service.js';\n\nconst log = createLogger('HonoApp');\n\n/** Agent home for persisted `inbound/` and `tts/` attachments (matches `persistOutboundTtsAudio` / `prepareInboundAttachments`). */\nfunction resolvePersistedAttachmentAgentHome(cfg: Config, sessionKeyRaw: string | undefined): string {\n  const sk = typeof sessionKeyRaw === 'string' ? sessionKeyRaw.trim() : '';\n  const agentId = sk ? extractProfileAgentId(sk, cfg) : resolveDefaultAgentId(cfg);\n  return resolveAgentHomeDir(cfg, agentId);\n}\n\nconst FILE_SEARCH_MAX_LIMIT = 50;\n\n/** Subsequence fuzzy match: all query chars appear in order in `candidate` (case-insensitive). */\nfunction fuzzySubsequenceScore(query: string, candidate: string): number | null {\n  const q = query.toLowerCase();\n  const c = candidate.toLowerCase();\n  if (q.length === 0) return 0;\n  let qi = 0;\n  for (let ci = 0; ci < c.length && qi < q.length; ci++) {\n    if (c[ci] === q[qi]) qi++;\n  }\n  if (qi < q.length) return null;\n  const base = c.split('/').pop() ?? c;\n  let score = 10;\n  if (c.startsWith(q)) score += 40;\n  if (base.startsWith(q)) score += 35;\n  else if (base.includes(q)) score += 20;\n  else if (c.includes(q)) score += 10;\n  score -= c.length * 0.0001;\n  return score;\n}\n\nasync function fuzzySearchWorkspaceFiles(\n  workspaceRoot: string,\n  query: string,\n  limit: number,\n): Promise<Array<{ name: string; path: string; isDirectory: boolean }>> {\n  let files = await runRipgrepListFiles(workspaceRoot);\n  if (files.length === 0) {\n    files = await listWorkspaceRelativeFilesFsFallback(workspaceRoot, 120_000);\n    if (files.length > 0) {\n      log.debug(\n        { workspaceRoot, fileCount: files.length },\n        'workspace files/search: file list from fs walk (ripgrep unavailable or returned empty)',\n      );\n    }\n  }\n  const q = query.trim();\n  const capped = Math.min(Math.max(limit, 1), FILE_SEARCH_MAX_LIMIT);\n\n  type Row = { name: string; path: string; isDirectory: boolean; score: number };\n  const rows: Row[] = [];\n\n  if (!q) {\n    const sorted = [...files].sort((a, b) => a.localeCompare(b));\n    for (const rel of sorted.slice(0, capped)) {\n      const name = rel.split('/').pop() ?? rel;\n      rows.push({ name, path: rel, isDirectory: false, score: 0 });\n    }\n    return rows;\n  }\n\n  for (const rel of files) {\n    const name = rel.split('/').pop() ?? rel;\n    const scorePath = fuzzySubsequenceScore(q, rel);\n    const scoreName = fuzzySubsequenceScore(q, name);\n    const score = Math.max(scorePath ?? -Infinity, scoreName ?? -Infinity);\n    if (score === -Infinity) continue;\n    rows.push({ name, path: rel, isDirectory: false, score });\n  }\n\n  rows.sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));\n  return rows.slice(0, capped).map(({ name, path, isDirectory }) => ({ name, path, isDirectory }));\n}\n\nfunction isKnownEditorAgentId(cfg: Config, id: string): boolean {\n  const n = normalizeAgentId(id);\n  if (n === resolveDefaultAgentId(cfg)) return true;\n  return listAgentEntries(cfg).some((e) => normalizeAgentId(e.id) === n);\n}\n\nfunction resolveEditorWorkspaceRoot(\n  cfg: Config,\n  agentIdRaw: string | undefined,\n): { ok: true; root: string } | { ok: false; message: string } {\n  const trimmed = typeof agentIdRaw === 'string' ? agentIdRaw.trim() : '';\n  if (!trimmed) {\n    const root = getWorkspacePath(cfg);\n    if (!root) return { ok: false, message: 'Workspace not configured' };\n    return { ok: true, root };\n  }\n  const id = normalizeAgentId(trimmed);\n  if (!isKnownEditorAgentId(cfg, id)) {\n    return { ok: false, message: 'Unknown agent' };\n  }\n  return { ok: true, root: resolveAgentWorkspaceDir(cfg, id) };\n}\n\n/** Prefer `sessionKey` (per-session workspace override) over `agentId`. */\nasync function resolveEditorWorkspaceRootAsync(\n  service: GatewayService,\n  cfg: Config,\n  sessionKeyRaw: string | undefined,\n  agentIdRaw: string | undefined,\n): Promise<{ ok: true; root: string } | { ok: false; message: string }> {\n  const sk = typeof sessionKeyRaw === 'string' ? sessionKeyRaw.trim() : '';\n  if (sk) {\n    try {\n      const root = await service.sessions.getEffectiveWorkspacePath(sk);\n      return { ok: true, root };\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, sessionKey: sk }, 'Session workspace root resolution failed');\n      return { ok: false, message: em || 'Session workspace resolution failed' };\n    }\n  }\n  return resolveEditorWorkspaceRoot(cfg, agentIdRaw);\n}\n\ninterface ResolvedWorkspaceImportConfig {\n  targetDir: string;\n  maxBytes: number;\n  allowOverwrite: boolean;\n}\n\nfunction resolveWorkspaceImportConfig(cfg: Config): ResolvedWorkspaceImportConfig {\n  const raw = cfg.workspace?.import;\n  return {\n    targetDir: raw?.targetDir?.trim() || 'imports',\n    maxBytes: raw?.maxBytes ?? 104_857_600,\n    allowOverwrite: raw?.allowOverwrite ?? true,\n  };\n}\n\n/** Strip path separators, NULs and control chars from a basename so it stays in the destination dir. */\nfunction sanitizeImportBasename(name: string): string {\n  return name\n    .replace(/[\\\\/]/g, '')\n    .replace(/[\\x00-\\x1f\\x7f]/g, '')\n    .trim();\n}\n\n/**\n * Race-safe target picker for the `rename`-on-conflict strategy. Uses `link(tmp, target)`\n * which atomically fails with EEXIST when the candidate is taken; on success the tmp\n * file is left in place for the caller to unlink. Returns the linked target path.\n */\nasync function pickAvailableTargetWithLink(\n  tmpAbs: string,\n  initialDestAbs: string,\n  maxAttempts = 1000,\n): Promise<{ ok: true; path: string; attempts: number } | { ok: false; attempts: number }> {\n  const dir = dirname(initialDestAbs);\n  const original = basename(initialDestAbs);\n  const dotIdx = original.lastIndexOf('.');\n  const stem = dotIdx > 0 ? original.slice(0, dotIdx) : original;\n  const ext = dotIdx > 0 ? original.slice(dotIdx) : '';\n  for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n    const candidate = attempt === 1 ? initialDestAbs : join(dir, `${stem}-${attempt}${ext}`);\n    try {\n      await link(tmpAbs, candidate);\n      return { ok: true, path: candidate, attempts: attempt };\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException)?.code;\n      if (code !== 'EEXIST') {\n        throw err;\n      }\n    }\n  }\n  return { ok: false, attempts: maxAttempts };\n}\n\nfunction fileReferenceCapabilities(\n  scope: FileReferenceScope,\n  isDirectory: boolean,\n  locationKind?: FileReferenceLocationKind,\n): FileReferenceCapability[] {\n  if (scope === 'workspace') {\n    return isDirectory\n      ? ['openExternal', 'revealInFolder', 'copyPath']\n      : ['preview', 'edit', 'openExternal', 'revealInFolder', 'copyPath'];\n  }\n  if (scope === 'external' || scope === 'agent-profile' || scope === 'session-artifact') {\n    const base: FileReferenceCapability[] = ['openExternal', 'revealInFolder', 'copyPath'];\n    // v1: importToWorkspace for files only; exclude xopc-config to prevent copying\n    // app config into the workspace (semantically wrong).\n    if (!isDirectory && locationKind !== 'xopc-config') {\n      base.push('importToWorkspace');\n    }\n    return base;\n  }\n  if (scope === 'missing') return ['copyPath'];\n  return [];\n}\n\nfunction isFileReferenceAction(action: unknown): action is 'openExternal' | 'revealInFolder' {\n  return action === 'openExternal' || action === 'revealInFolder';\n}\n\nexport function registerWorkspaceRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  authenticated.get('/api/workspace/inbound-file', async (c) => {\n    const rel = c.req.query('rel');\n    if (!rel || typeof rel !== 'string') {\n      return c.json({ ok: false, error: { message: 'Missing rel' } }, 400);\n    }\n    const cfg = service.currentConfig;\n    const agentHome = resolvePersistedAttachmentAgentHome(cfg, c.req.query('sessionKey'));\n    const abs = resolveSafeInboundFilePath({ agentHome }, rel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Forbidden' } }, 403);\n    }\n    try {\n      const buf = await readFile(abs);\n      const ext = rel.split('.').pop()?.toLowerCase() ?? '';\n      const mimeByExt: Record<string, string> = {\n        pdf: 'application/pdf',\n        png: 'image/png',\n        jpg: 'image/jpeg',\n        jpeg: 'image/jpeg',\n        webp: 'image/webp',\n        gif: 'image/gif',\n        md: 'text/markdown',\n        txt: 'text/plain',\n        json: 'application/json',\n        html: 'text/html',\n        css: 'text/css',\n        js: 'text/javascript',\n        ts: 'text/typescript',\n        webm: 'audio/webm',\n        ogg: 'audio/ogg',\n        opus: 'audio/ogg',\n        mp3: 'audio/mpeg',\n        wav: 'audio/wav',\n        m4a: 'audio/mp4',\n      };\n      const contentType = mimeByExt[ext] || 'application/octet-stream';\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n  });\n\n  authenticated.get('/api/workspace/tts-file', async (c) => {\n    const rel = c.req.query('rel');\n    if (!rel || typeof rel !== 'string') {\n      return c.json({ ok: false, error: { message: 'Missing rel' } }, 400);\n    }\n    const cfg = service.currentConfig;\n    const agentHome = resolvePersistedAttachmentAgentHome(cfg, c.req.query('sessionKey'));\n    const abs = resolveSafeTtsFilePath({ agentHome }, rel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Forbidden' } }, 403);\n    }\n    try {\n      const buf = await readFile(abs);\n      const ext = rel.split('.').pop()?.toLowerCase() ?? '';\n      const mimeByExt: Record<string, string> = {\n        ogg: 'audio/ogg',\n        opus: 'audio/ogg',\n        mp3: 'audio/mpeg',\n        wav: 'audio/wav',\n        m4a: 'audio/mp4',\n      };\n      const contentType = mimeByExt[ext] || 'application/octet-stream';\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n  });\n\n  authenticated.get('/api/workspace/heartbeat-md', async (c) => {\n    const abs = resolveHeartbeatMdPath(service.currentConfig);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Workspace not configured' } }, 400);\n    }\n    try {\n      const content = await readFile(abs, 'utf-8');\n      return c.json({ ok: true, payload: { content: content, file: 'HEARTBEAT.md' } });\n    } catch {\n      return c.json({ ok: true, payload: { content: '', file: 'HEARTBEAT.md' } });\n    }\n  });\n\n  authenticated.put('/api/workspace/heartbeat-md', async (c) => {\n    const abs = resolveHeartbeatMdPath(service.currentConfig);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Workspace not configured' } }, 400);\n    }\n    let body: unknown;\n    try {\n      body = await c.req.json();\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const content =\n      typeof body === 'object' &&\n      body !== null &&\n      'content' in body &&\n      typeof (body as { content: unknown }).content === 'string'\n        ? (body as { content: string }).content\n        : '';\n    try {\n      await writeFile(abs, content, 'utf-8');\n      return c.json({ ok: true, payload: { file: 'HEARTBEAT.md' } });\n    } catch (err) {\n      log.error({ err, path: abs }, 'Failed to write HEARTBEAT.md');\n      return c.json({ ok: false, error: { message: 'Write failed' } }, 500);\n    }\n  });\n\n  authenticated.get('/api/workspace/editor/list', async (c) => {\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const dirRel = typeof c.req.query('dir') === 'string' ? c.req.query('dir')! : '';\n    const absDir = resolveWorkspaceSafePath(workspaceRoot, dirRel);\n    if (!absDir) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(absDir);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isDirectory()) {\n      return c.json({ ok: false, error: { message: 'Not a directory' } }, 400);\n    }\n    const dirents = await readdir(absDir, { withFileTypes: true });\n    const entries: { name: string; path: string; absolutePath: string; isDirectory: boolean }[] = [];\n    for (const entry of dirents) {\n      if (entry.name.startsWith('.')) continue;\n      const fullPath = join(absDir, entry.name);\n      if (entry.isDirectory()) {\n        entries.push({\n          name: entry.name,\n          path: toWorkspaceRelativePosix(workspaceRoot, fullPath),\n          absolutePath: fullPath,\n          isDirectory: true,\n        });\n      } else {\n        entries.push({\n          name: entry.name,\n          path: toWorkspaceRelativePosix(workspaceRoot, fullPath),\n          absolutePath: fullPath,\n          isDirectory: false,\n        });\n      }\n    }\n    entries.sort((a, b) => {\n      if (a.isDirectory !== b.isDirectory) return a.isDirectory ? -1 : 1;\n      return a.name.localeCompare(b.name);\n    });\n    return c.json({ ok: true, payload: { entries } });\n  });\n\n  authenticated.get('/api/workspace/editor/read', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      const content = await readFile(abs, 'utf-8');\n      return c.json({\n        ok: true,\n        payload: {\n          content,\n          path: toWorkspaceRelativePosix(workspaceRoot, abs),\n          absolutePath: abs,\n          mtimeMs: st.mtimeMs,\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  /** Read file as raw bytes and return base64 (for PDF/images in workspace preview — avoids UTF-8 corruption). */\n  authenticated.get('/api/workspace/editor/read-base64', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      const buf = await readFile(abs);\n      return c.json({\n        ok: true,\n        payload: {\n          contentBase64: buf.toString('base64'),\n          path: toWorkspaceRelativePosix(workspaceRoot, abs),\n          /** Host absolute path — Electron can open with the default app (shell.openPath). */\n          absolutePath: abs,\n          mtimeMs: st.mtimeMs,\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  /** Map an absolute host path to a workspace-relative path (if under this session’s workspace). */\n  authenticated.get('/api/workspace/editor/resolve-path', async (c) => {\n    const raw = c.req.query('absolutePath');\n    if (!raw || typeof raw !== 'string' || !raw.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing absolutePath' } }, 400);\n    }\n    const absolutePath = raw.trim();\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const normalized = resolve(absolutePath);\n    if (!isPathUnderWorkspace(workspaceRoot, normalized)) {\n      return c.json({ ok: false, error: { message: 'Path not under workspace' } }, 403);\n    }\n    const rel = toWorkspaceRelativePosix(workspaceRoot, normalized);\n    return c.json({ ok: true, payload: { workspaceRelativePath: rel } });\n  });\n\n  authenticated.get('/api/workspace/editor/resolve-reference', async (c) => {\n    const rawPath = typeof c.req.query('path') === 'string' ? c.req.query('path')!.trim() : '';\n    if (!rawPath) {\n      return c.json({ ok: false, error: { code: 'INVALID_PATH', message: 'Missing path' } }, 400);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      sessionKey,\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { code: 'WORKSPACE_RESOLUTION_FAILED', message: ws.message } }, 400);\n    }\n\n    const workspaceRoot = ws.root;\n    const classifierCtx = { ...buildFilePathClassifierContext(service.currentConfig, sessionKey), workspaceRoot };\n    const displayName = displayNameForPath(rawPath);\n    const { candidate, invalid } = await resolveFileReferenceCandidate(rawPath, workspaceRoot, classifierCtx);\n\n    if (!candidate || invalid) {\n      return c.json({\n        ok: true,\n        payload: {\n          inputPath: rawPath,\n          displayName,\n          scope: 'invalid' satisfies FileReferenceScope,\n          exists: false,\n          capabilities: [] as FileReferenceCapability[],\n          errorCode: 'INVALID_PATH',\n        },\n      });\n    }\n\n    let st: Awaited<ReturnType<typeof stat>> | null = null;\n    try {\n      st = await stat(candidate);\n    } catch {\n      st = null;\n    }\n\n    if (!st) {\n      // Always include the resolved candidate so the UI's \"Copy path\" yields\n      // something actionable (\"I looked here, no file\"). Without this, bare\n      // workspace-relative mentions fall back to the `rel:<path>` UI sentinel.\n      return c.json({\n        ok: true,\n        payload: {\n          inputPath: rawPath,\n          displayName,\n          scope: 'missing' satisfies FileReferenceScope,\n          exists: false,\n          absolutePath: candidate,\n          capabilities: fileReferenceCapabilities('missing', false),\n          errorCode: 'FILE_NOT_FOUND',\n        },\n      });\n    }\n\n    const classified = classifyFileLocation(candidate, classifierCtx);\n    const { scope, locationKind, manageRoute } = classified;\n    const inWorkspace = scope === 'workspace';\n    const isDirectory = st.isDirectory();\n    const capabilities = fileReferenceCapabilities(scope, isDirectory, locationKind);\n    const ref = fileReferenceRegistry.register({\n      absolutePath: candidate,\n      sessionKey: sessionKey || undefined,\n      scope,\n      locationKind,\n      capabilities,\n    });\n\n    return c.json({\n      ok: true,\n      payload: {\n        fileRefId: ref.id,\n        inputPath: rawPath,\n        displayName,\n        scope,\n        locationKind,\n        manageRoute,\n        exists: true,\n        isDirectory,\n        absolutePath: candidate,\n        workspaceRelativePath: inWorkspace ? toWorkspaceRelativePosix(workspaceRoot, candidate) : undefined,\n        capabilities,\n        mtimeMs: st.mtimeMs,\n      },\n    });\n  });\n\n  authenticated.post('/api/workspace/file-ref/:id/resolve-action', async (c) => {\n    const id = c.req.param('id')?.trim() ?? '';\n    if (!id) {\n      return c.json({ ok: false, error: { code: 'INVALID_FILE_REF', message: 'Missing file reference' } }, 400);\n    }\n\n    const ref = fileReferenceRegistry.resolve(id);\n    if (!ref) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_EXPIRED', message: 'File reference expired' } }, 404);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    if (!fileRefSessionKeysMatch(ref.sessionKey, sessionKey)) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_FORBIDDEN', message: 'File reference forbidden' } }, 403);\n    }\n\n    const body = (await c.req.json().catch(() => ({}))) as { action?: unknown };\n    const action = body.action;\n    if (!isFileReferenceAction(action)) {\n      return c.json({ ok: false, error: { code: 'INVALID_ACTION', message: 'Invalid action' } }, 400);\n    }\n    if (!ref.capabilities.includes(action)) {\n      return c.json({ ok: false, error: { code: 'ACTION_NOT_ALLOWED', message: 'Action not allowed' } }, 403);\n    }\n\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(ref.absolutePath);\n    } catch {\n      return c.json({ ok: false, error: { code: 'FILE_NOT_FOUND', message: 'File not found' } }, 404);\n    }\n\n    return c.json({\n      ok: true,\n      payload: {\n        absolutePath: ref.absolutePath,\n        isDirectory: st.isDirectory(),\n      },\n    });\n  });\n\n  authenticated.post('/api/workspace/import-file-ref/:id', async (c) => {\n    const id = c.req.param('id')?.trim() ?? '';\n    if (!id) {\n      return c.json({ ok: false, error: { code: 'INVALID_FILE_REF', message: 'Missing file reference' } }, 400);\n    }\n\n    const ref = fileReferenceRegistry.resolve(id);\n    if (!ref) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_EXPIRED', message: 'File reference expired' } }, 404);\n    }\n\n    const sessionKey = typeof c.req.query('sessionKey') === 'string' ? c.req.query('sessionKey')!.trim() : '';\n    if (!fileRefSessionKeysMatch(ref.sessionKey, sessionKey)) {\n      return c.json({ ok: false, error: { code: 'FILE_REF_FORBIDDEN', message: 'File reference forbidden' } }, 403);\n    }\n\n    if (!ref.capabilities.includes('importToWorkspace')) {\n      return c.json({ ok: false, error: { code: 'IMPORT_NOT_ALLOWED', message: 'Import not allowed for this file' } }, 403);\n    }\n\n    let sourceStat: Awaited<ReturnType<typeof stat>>;\n    try {\n      sourceStat = await stat(ref.absolutePath);\n    } catch {\n      fileReferenceRegistry.expireById(id);\n      return c.json({ ok: false, error: { code: 'SOURCE_NOT_FOUND', message: 'Source file no longer exists' } }, 404);\n    }\n    if (!sourceStat.isFile()) {\n      return c.json({ ok: false, error: { code: 'SOURCE_NOT_FILE', message: 'Source is not a regular file' } }, 400);\n    }\n\n    const importCfg = resolveWorkspaceImportConfig(service.currentConfig);\n    if (sourceStat.size > importCfg.maxBytes) {\n      return c.json(\n        {\n          ok: false,\n          error: {\n            code: 'SOURCE_TOO_LARGE',\n            message: `Source exceeds maximum import size (${importCfg.maxBytes} bytes)`,\n          },\n        },\n        413,\n      );\n    }\n\n    const ws = await resolveEditorWorkspaceRootAsync(service, service.currentConfig, sessionKey, undefined);\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { code: 'WORKSPACE_RESOLUTION_FAILED', message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n\n    let body: { destination?: unknown; onConflict?: unknown };\n    try {\n      body = (await c.req.json().catch(() => ({}))) as typeof body;\n    } catch {\n      body = {};\n    }\n    const requestedDestRaw = typeof body.destination === 'string' ? body.destination.trim() : '';\n    const onConflictRaw = typeof body.onConflict === 'string' ? body.onConflict : 'rename';\n    if (onConflictRaw !== 'rename' && onConflictRaw !== 'overwrite' && onConflictRaw !== 'error') {\n      return c.json({ ok: false, error: { code: 'INVALID_CONFLICT_MODE', message: 'Invalid onConflict value' } }, 400);\n    }\n    const onConflict = onConflictRaw as 'rename' | 'overwrite' | 'error';\n    if (onConflict === 'overwrite' && !importCfg.allowOverwrite) {\n      return c.json({ ok: false, error: { code: 'OVERWRITE_DISABLED', message: 'Overwrite is disabled by config' } }, 403);\n    }\n\n    const sourceBasename = sanitizeImportBasename(basename(ref.absolutePath)) || 'imported-file';\n    let requestedRel: string;\n    if (!requestedDestRaw) {\n      requestedRel = `${importCfg.targetDir}/${sourceBasename}`;\n    } else {\n      const trimmedDest = requestedDestRaw.replace(/\\\\/g, '/');\n      // Path ending with `/` is treated as a directory; append source basename.\n      requestedRel = trimmedDest.endsWith('/') ? `${trimmedDest}${sourceBasename}` : trimmedDest;\n    }\n\n    let initialDestAbs = resolveWorkspaceSafePath(workspaceRoot, requestedRel);\n    if (!initialDestAbs) {\n      return c.json({ ok: false, error: { code: 'INVALID_DESTINATION', message: 'Invalid destination path' } }, 400);\n    }\n\n    // Sandbox: blocks `.xopc/xopc.json`, `.env*`, etc.; canonical symlink resolution included.\n    const writePolicy = validateWritePath(initialDestAbs, workspaceRoot);\n    if (!writePolicy.allowed) {\n      return c.json({ ok: false, error: { code: 'DESTINATION_BLOCKED', message: writePolicy.reason ?? 'Destination blocked' } }, 403);\n    }\n\n    if (resolve(ref.absolutePath) === resolve(initialDestAbs)) {\n      return c.json({ ok: false, error: { code: 'SAME_LOCATION', message: 'Destination is the same as source' } }, 400);\n    }\n\n    const destDir = dirname(initialDestAbs);\n    try {\n      await mkdir(destDir, { recursive: true });\n    } catch (err) {\n      log.warn({ err, destDir }, 'Failed to create import destination directory');\n      return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to prepare destination' } }, 500);\n    }\n\n    // Stage source into a hidden tmp file inside the destination directory so we\n    // can atomically `link` (rename strategy) or `rename` (overwrite) to land it.\n    const tmpName = `.${basename(initialDestAbs)}.import-${randomUUID()}.tmp`;\n    const tmpAbs = join(destDir, tmpName);\n\n    const started = Date.now();\n    let renamed = false;\n    let overwrote = false;\n    let finalDestAbs = initialDestAbs;\n\n    try {\n      try {\n        await copyFile(ref.absolutePath, tmpAbs, fsConstants.COPYFILE_FICLONE);\n      } catch (err) {\n        await unlink(tmpAbs).catch(() => {});\n        log.warn({ err, source: ref.absolutePath, tmpAbs }, 'Failed to copy source into staging tmp');\n        return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to copy source file' } }, 500);\n      }\n\n      if (onConflict === 'overwrite') {\n        // Snapshot pre-rename existence for telemetry; the actual overwrite is unconditional.\n        overwrote = await stat(initialDestAbs).then(() => true).catch(() => false);\n        try {\n          await rename(tmpAbs, initialDestAbs);\n        } catch (err) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ err, target: initialDestAbs }, 'Atomic rename failed');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to finalize import' } }, 500);\n        }\n      } else if (onConflict === 'error') {\n        const exists = await stat(initialDestAbs).then(() => true).catch(() => false);\n        if (exists) {\n          await unlink(tmpAbs).catch(() => {});\n          return c.json({ ok: false, error: { code: 'DESTINATION_EXISTS', message: 'Destination already exists' } }, 409);\n        }\n        try {\n          await link(tmpAbs, initialDestAbs);\n          await unlink(tmpAbs).catch(() => {});\n        } catch (err) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ err, target: initialDestAbs }, 'Hard link to destination failed');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Failed to finalize import' } }, 500);\n        }\n      } else {\n        // rename: race-safe loop using O_EXCL semantics of `link`.\n        const picked = await pickAvailableTargetWithLink(tmpAbs, initialDestAbs);\n        if (!picked.ok) {\n          await unlink(tmpAbs).catch(() => {});\n          log.warn({ target: initialDestAbs, attempts: picked.attempts }, 'Failed to find free import target name');\n          return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'No free destination name available' } }, 500);\n        }\n        await unlink(tmpAbs).catch(() => {});\n        finalDestAbs = picked.path;\n        renamed = picked.path !== initialDestAbs;\n      }\n    } catch (err) {\n      await unlink(tmpAbs).catch(() => {});\n      log.error({ err }, 'Import file unexpected failure');\n      return c.json({ ok: false, error: { code: 'IMPORT_FAILED', message: 'Import failed' } }, 500);\n    }\n\n    let finalMtime: number;\n    try {\n      finalMtime = (await stat(finalDestAbs)).mtimeMs;\n    } catch {\n      finalMtime = Date.now();\n    }\n\n    const workspaceRel = toWorkspaceRelativePosix(workspaceRoot, finalDestAbs);\n\n    fileReferenceRegistry.expireById(id);\n    const newRef = fileReferenceRegistry.register({\n      absolutePath: finalDestAbs,\n      sessionKey: sessionKey || undefined,\n      scope: 'workspace',\n      capabilities: fileReferenceCapabilities('workspace', false),\n    });\n\n    const sourceScope = ref.scope;\n    const sourceLocationKind = ref.locationKind;\n\n    service.emit('workspace.file-imported', {\n      sessionKey: sessionKey || undefined,\n      workspaceRelativePath: workspaceRel,\n      absolutePath: finalDestAbs,\n      bytes: sourceStat.size,\n      sourceScope,\n      sourceLocationKind,\n    });\n\n    log.info(\n      {\n        sessionKey,\n        fileRefId: id,\n        sourceAbsolutePath: ref.absolutePath,\n        sourceScope,\n        sourceLocationKind,\n        destWorkspaceRelativePath: workspaceRel,\n        bytes: sourceStat.size,\n        renamed,\n        overwrote,\n        durationMs: Date.now() - started,\n      },\n      'Workspace file import succeeded',\n    );\n\n    return c.json({\n      ok: true,\n      payload: {\n        workspaceRelativePath: workspaceRel,\n        absolutePath: finalDestAbs,\n        bytesCopied: sourceStat.size,\n        sourceAbsolutePath: ref.absolutePath,\n        sourceScope,\n        sourceLocationKind,\n        renamed,\n        overwrote,\n        mtimeMs: finalMtime,\n        newFileRefId: newRef.id,\n      },\n    });\n  });\n\n  /**\n   * Serve a workspace file as raw bytes (e.g. <img> after auth fetch + blob URL).\n   * Path is workspace-relative; scope via sessionKey / agentId like other editor routes.\n   */\n  authenticated.get('/api/workspace/editor/raw', async (c) => {\n    const pathRel = typeof c.req.query('path') === 'string' ? c.req.query('path')! : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(abs);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    const ext = pathRel.split('.').pop()?.toLowerCase() ?? '';\n    const mimeByExt: Record<string, string> = {\n      png: 'image/png',\n      jpg: 'image/jpeg',\n      jpeg: 'image/jpeg',\n      gif: 'image/gif',\n      webp: 'image/webp',\n      bmp: 'image/bmp',\n      svg: 'image/svg+xml',\n      pdf: 'application/pdf',\n      docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n      xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',\n      pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',\n      txt: 'text/plain',\n      md: 'text/markdown',\n      json: 'application/json',\n      html: 'text/html',\n      css: 'text/css',\n      js: 'text/javascript',\n      ts: 'text/typescript',\n      mp3: 'audio/mpeg',\n      wav: 'audio/wav',\n      ogg: 'audio/ogg',\n      webm: 'video/webm',\n      mp4: 'video/mp4',\n      mov: 'video/quicktime',\n    };\n    const contentType = mimeByExt[ext] || 'application/octet-stream';\n    try {\n      const buf = await readFile(abs);\n      return new Response(buf, {\n        headers: {\n          'Content-Type': contentType,\n          'Cache-Control': 'private, max-age=3600',\n        },\n      });\n    } catch {\n      return c.json({ ok: false, error: { message: 'Read failed' } }, 500);\n    }\n  });\n\n  authenticated.put('/api/workspace/editor/write', async (c) => {\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    let body: unknown;\n    try {\n      body = await c.req.json();\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const pathRel =\n      typeof body === 'object' &&\n      body !== null &&\n      'path' in body &&\n      typeof (body as { path: unknown }).path === 'string'\n        ? (body as { path: string }).path\n        : '';\n    const content =\n      typeof body === 'object' &&\n      body !== null &&\n      'content' in body &&\n      typeof (body as { content: unknown }).content === 'string'\n        ? (body as { content: string }).content\n        : '';\n    if (!pathRel.trim()) {\n      return c.json({ ok: false, error: { message: 'Missing path' } }, 400);\n    }\n    const abs = resolveWorkspaceSafePath(workspaceRoot, pathRel);\n    if (!abs) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>> | undefined;\n    try {\n      st = await stat(abs);\n    } catch {\n      st = undefined;\n    }\n    if (st && !st.isFile()) {\n      return c.json({ ok: false, error: { message: 'Not a file' } }, 400);\n    }\n    try {\n      await writeFile(abs, content, 'utf-8');\n      let mtimeMs: number;\n      try {\n        mtimeMs = (await stat(abs)).mtimeMs;\n      } catch {\n        mtimeMs = Date.now();\n      }\n      return c.json({\n        ok: true,\n        payload: { path: toWorkspaceRelativePosix(workspaceRoot, abs), mtimeMs },\n      });\n    } catch (err) {\n      log.error({ err, path: abs }, 'workspace editor write failed');\n      return c.json({ ok: false, error: { message: 'Write failed' } }, 500);\n    }\n  });\n\n  authenticated.get('/api/workspace/editor/search', async (c) => {\n    const q = typeof c.req.query('q') === 'string' ? c.req.query('q')!.trim() : '';\n    const dirRel = typeof c.req.query('dir') === 'string' ? c.req.query('dir')! : '';\n    if (!q) {\n      return c.json({\n        ok: true,\n        payload: { results: [] as { filePath: string; lineNumber: number; lineContent: string; matchStart: number; matchEnd: number }[] },\n      });\n    }\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n    const workspaceRoot = ws.root;\n    const absDir = resolveWorkspaceSafePath(workspaceRoot, dirRel);\n    if (!absDir) {\n      return c.json({ ok: false, error: { message: 'Invalid path' } }, 400);\n    }\n    let st: Awaited<ReturnType<typeof stat>>;\n    try {\n      st = await stat(absDir);\n    } catch {\n      return c.json({ ok: false, error: { message: 'Not found' } }, 404);\n    }\n    if (!st.isDirectory()) {\n      return c.json({ ok: false, error: { message: 'Not a directory' } }, 400);\n    }\n    const raw = await runRipgrepInDirectory(q, absDir);\n    const results = raw\n      .filter((r) => isPathUnderWorkspace(workspaceRoot, r.filePath))\n      .map((r) => ({\n        ...r,\n        filePath: toWorkspaceRelativePosix(workspaceRoot, resolve(r.filePath)),\n      }));\n    return c.json({ ok: true, payload: { results } });\n  });\n\n  /** Fuzzy filename / path search over the session workspace (ripgrep `--files` + subsequence scoring). */\n  authenticated.get('/api/workspace/editor/files/search', async (c) => {\n    const q = typeof c.req.query('q') === 'string' ? c.req.query('q')!.trim() : '';\n    const limitRaw = c.req.query('limit');\n    const limit = Math.min(\n      Math.max(parseInt(typeof limitRaw === 'string' ? limitRaw : '15', 10) || 15, 1),\n      FILE_SEARCH_MAX_LIMIT,\n    );\n\n    const ws = await resolveEditorWorkspaceRootAsync(\n      service,\n      service.currentConfig,\n      c.req.query('sessionKey'),\n      c.req.query('agentId'),\n    );\n    if (ws.ok === false) {\n      return c.json({ ok: false, error: { message: ws.message } }, 400);\n    }\n\n    const entries = await fuzzySearchWorkspaceFiles(ws.root, q, limit);\n    return c.json({ ok: true, payload: { entries } });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;kBAkBuC;aACiB;AAyBxD,MAAM,MAAM,aAAa,UAAU;;AAGnC,SAAS,oCAAoC,KAAa,eAA2C;CACnG,MAAM,KAAK,OAAO,kBAAkB,WAAW,cAAc,MAAM,GAAG;AAEtE,QAAO,oBAAoB,KADX,KAAK,sBAAsB,IAAI,IAAI,GAAG,sBAAsB,IAAI,CACxC;;AAG1C,MAAM,wBAAwB;;AAG9B,SAAS,sBAAsB,OAAe,WAAkC;CAC9E,MAAM,IAAI,MAAM,aAAa;CAC7B,MAAM,IAAI,UAAU,aAAa;AACjC,KAAI,EAAE,WAAW,EAAG,QAAO;CAC3B,IAAI,KAAK;AACT,MAAK,IAAI,KAAK,GAAG,KAAK,EAAE,UAAU,KAAK,EAAE,QAAQ,KAC/C,KAAI,EAAE,QAAQ,EAAE,IAAK;AAEvB,KAAI,KAAK,EAAE,OAAQ,QAAO;CAC1B,MAAM,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,IAAI;CACnC,IAAI,QAAQ;AACZ,KAAI,EAAE,WAAW,EAAE,CAAE,UAAS;AAC9B,KAAI,KAAK,WAAW,EAAE,CAAE,UAAS;UACxB,KAAK,SAAS,EAAE,CAAE,UAAS;UAC3B,EAAE,SAAS,EAAE,CAAE,UAAS;AACjC,UAAS,EAAE,SAAS;AACpB,QAAO;;AAGT,eAAe,0BACb,eACA,OACA,OACsE;CACtE,IAAI,QAAQ,MAAM,oBAAoB,cAAc;AACpD,KAAI,MAAM,WAAW,GAAG;AACtB,UAAQ,MAAM,qCAAqC,eAAe,KAAQ;AAC1E,MAAI,MAAM,SAAS,EACjB,KAAI,MACF;GAAE;GAAe,WAAW,MAAM;GAAQ,EAC1C,yFACD;;CAGL,MAAM,IAAI,MAAM,MAAM;CACtB,MAAM,SAAS,KAAK,IAAI,KAAK,IAAI,OAAO,EAAE,EAAE,sBAAsB;CAGlE,MAAM,OAAc,EAAE;AAEtB,KAAI,CAAC,GAAG;EACN,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;AAC5D,OAAK,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,EAAE;GACzC,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;AACrC,QAAK,KAAK;IAAE;IAAM,MAAM;IAAK,aAAa;IAAO,OAAO;IAAG,CAAC;;AAE9D,SAAO;;AAGT,MAAK,MAAM,OAAO,OAAO;EACvB,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI;EACrC,MAAM,YAAY,sBAAsB,GAAG,IAAI;EAC/C,MAAM,YAAY,sBAAsB,GAAG,KAAK;EAChD,MAAM,QAAQ,KAAK,IAAI,aAAa,WAAW,aAAa,UAAU;AACtE,MAAI,UAAU,UAAW;AACzB,OAAK,KAAK;GAAE;GAAM,MAAM;GAAK,aAAa;GAAO;GAAO,CAAC;;AAG3D,MAAK,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;AACtE,QAAO,KAAK,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,MAAM,mBAAmB;EAAE;EAAM;EAAM;EAAa,EAAE;;AAGlG,SAAS,qBAAqB,KAAa,IAAqB;CAC9D,MAAM,IAAI,iBAAiB,GAAG;AAC9B,KAAI,MAAM,sBAAsB,IAAI,CAAE,QAAO;AAC7C,QAAO,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,EAAE;;AAGxE,SAAS,2BACP,KACA,YAC6D;CAC7D,MAAM,UAAU,OAAO,eAAe,WAAW,WAAW,MAAM,GAAG;AACrE,KAAI,CAAC,SAAS;EACZ,MAAM,OAAO,iBAAiB,IAAI;AAClC,MAAI,CAAC,KAAM,QAAO;GAAE,IAAI;GAAO,SAAS;GAA4B;AACpE,SAAO;GAAE,IAAI;GAAM;GAAM;;CAE3B,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,CAAC,qBAAqB,KAAK,GAAG,CAChC,QAAO;EAAE,IAAI;EAAO,SAAS;EAAiB;AAEhD,QAAO;EAAE,IAAI;EAAM,MAAM,yBAAyB,KAAK,GAAG;EAAE;;;AAI9D,eAAe,gCACb,SACA,KACA,eACA,YACsE;CACtE,MAAM,KAAK,OAAO,kBAAkB,WAAW,cAAc,MAAM,GAAG;AACtE,KAAI,GACF,KAAI;AAEF,SAAO;GAAE,IAAI;GAAM,MAAA,MADA,QAAQ,SAAS,0BAA0B,GAAG;GACxC;UAClB,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KAAK;GAAE;GAAK,YAAY;GAAI,EAAE,2CAA2C;AAC7E,SAAO;GAAE,IAAI;GAAO,SAAS,MAAM;GAAuC;;AAG9E,QAAO,2BAA2B,KAAK,WAAW;;AASpD,SAAS,6BAA6B,KAA4C;CAChF,MAAM,MAAM,IAAI,WAAW;AAC3B,QAAO;EACL,WAAW,KAAK,WAAW,MAAM,IAAI;EACrC,UAAU,KAAK,YAAY;EAC3B,gBAAgB,KAAK,kBAAkB;EACxC;;;AAIH,SAAS,uBAAuB,MAAsB;AACpD,QAAO,KACJ,QAAQ,UAAU,GAAG,CACrB,QAAQ,oBAAoB,GAAG,CAC/B,MAAM;;;;;;;AAQX,eAAe,4BACb,QACA,gBACA,cAAc,KAC2E;CACzF,MAAM,MAAM,QAAQ,eAAe;CACnC,MAAM,WAAW,SAAS,eAAe;CACzC,MAAM,SAAS,SAAS,YAAY,IAAI;CACxC,MAAM,OAAO,SAAS,IAAI,SAAS,MAAM,GAAG,OAAO,GAAG;CACtD,MAAM,MAAM,SAAS,IAAI,SAAS,MAAM,OAAO,GAAG;AAClD,MAAK,IAAI,UAAU,GAAG,WAAW,aAAa,WAAW;EACvD,MAAM,YAAY,YAAY,IAAI,iBAAiB,KAAK,KAAK,GAAG,KAAK,GAAG,UAAU,MAAM;AACxF,MAAI;AACF,SAAM,KAAK,QAAQ,UAAU;AAC7B,UAAO;IAAE,IAAI;IAAM,MAAM;IAAW,UAAU;IAAS;WAChD,KAAK;AAEZ,OADc,KAA+B,SAChC,SACX,OAAM;;;AAIZ,QAAO;EAAE,IAAI;EAAO,UAAU;EAAa;;AAG7C,SAAS,0BACP,OACA,aACA,cAC2B;AAC3B,KAAI,UAAU,YACZ,QAAO,cACH;EAAC;EAAgB;EAAkB;EAAW,GAC9C;EAAC;EAAW;EAAQ;EAAgB;EAAkB;EAAW;AAEvE,KAAI,UAAU,cAAc,UAAU,mBAAmB,UAAU,oBAAoB;EACrF,MAAM,OAAkC;GAAC;GAAgB;GAAkB;GAAW;AAGtF,MAAI,CAAC,eAAe,iBAAiB,cACnC,MAAK,KAAK,oBAAoB;AAEhC,SAAO;;AAET,KAAI,UAAU,UAAW,QAAO,CAAC,WAAW;AAC5C,QAAO,EAAE;;AAGX,SAAS,sBAAsB,QAA8D;AAC3F,QAAO,WAAW,kBAAkB,WAAW;;AAGjD,SAAgB,wBAAwB,eAAqB,MAAoC;CAC/F,MAAM,EAAE,YAAY;AAEpB,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAC9B,MAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,eAAe;GAAE,EAAE,IAAI;EAEtE,MAAM,MAAM,QAAQ;EAEpB,MAAM,MAAM,2BAA2B,EAAE,WADvB,oCAAoC,KAAK,EAAE,IAAI,MAAM,aAAa,CAClC,EAAE,EAAE,IAAI;AAC1D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,aAAa;GAAE,EAAE,IAAI;AAEpE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;GAuB/B,MAAM,cAAc;IApBlB,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IAEsB,CAtBjB,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAsBb;AACtC,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;GAEpE;AAEF,eAAc,IAAI,2BAA2B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAC9B,MAAI,CAAC,OAAO,OAAO,QAAQ,SACzB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,eAAe;GAAE,EAAE,IAAI;EAEtE,MAAM,MAAM,QAAQ;EAEpB,MAAM,MAAM,uBAAuB,EAAE,WADnB,oCAAoC,KAAK,EAAE,IAAI,MAAM,aAAa,CACtC,EAAE,EAAE,IAAI;AACtD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,aAAa;GAAE,EAAE,IAAI;AAEpE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;GAS/B,MAAM,cAAc;IANlB,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IAEsB,CARjB,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAQb;AACtC,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;GAEpE;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,uBAAuB,QAAQ,cAAc;AACzD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;AAEnF,MAAI;GACF,MAAM,UAAU,MAAM,SAAS,KAAK,QAAQ;AAC5C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;KAAW;KAAS,MAAM;KAAgB;IAAE,CAAC;UAC1E;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;KAAE,SAAS;KAAI,MAAM;KAAgB;IAAE,CAAC;;GAE7E;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,uBAAuB,QAAQ,cAAc;AACzD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;EAEnF,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,MAAM;UACnB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,aAAa,QACb,OAAQ,KAA8B,YAAY,WAC7C,KAA6B,UAC9B;AACN,MAAI;AACF,SAAM,UAAU,KAAK,SAAS,QAAQ;AACtC,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS,EAAE,MAAM,gBAAgB;IAAE,CAAC;WACvD,KAAK;AACZ,OAAI,MAAM;IAAE;IAAK,MAAM;IAAK,EAAE,+BAA+B;AAC7D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;GAEvE;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EAEzB,MAAM,SAAS,yBAAyB,eADzB,OAAO,EAAE,IAAI,MAAM,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,MAAM,GAAI,GAChB;AAC9D,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,OAAO;UACjB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,aAAa,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mBAAmB;GAAE,EAAE,IAAI;EAE1E,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,MAAM,CAAC;EAC9D,MAAM,UAAwF,EAAE;AAChG,OAAK,MAAM,SAAS,SAAS;AAC3B,OAAI,MAAM,KAAK,WAAW,IAAI,CAAE;GAChC,MAAM,WAAW,KAAK,QAAQ,MAAM,KAAK;AACzC,OAAI,MAAM,aAAa,CACrB,SAAQ,KAAK;IACX,MAAM,MAAM;IACZ,MAAM,yBAAyB,eAAe,SAAS;IACvD,cAAc;IACd,aAAa;IACd,CAAC;OAEF,SAAQ,KAAK;IACX,MAAM,MAAM;IACZ,MAAM,yBAAyB,eAAe,SAAS;IACvD,cAAc;IACd,aAAa;IACd,CAAC;;AAGN,UAAQ,MAAM,GAAG,MAAM;AACrB,OAAI,EAAE,gBAAgB,EAAE,YAAa,QAAO,EAAE,cAAc,KAAK;AACjE,UAAO,EAAE,KAAK,cAAc,EAAE,KAAK;IACnC;AACF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;GACF,MAAM,UAAU,MAAM,SAAS,KAAK,QAAQ;AAC5C,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP;KACA,MAAM,yBAAyB,eAAe,IAAI;KAClD,cAAc;KACd,SAAS,GAAG;KACb;IACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;;AAGF,eAAc,IAAI,qCAAqC,OAAO,MAAM;EAClE,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;AAC/B,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,eAAe,IAAI,SAAS,SAAS;KACrC,MAAM,yBAAyB,eAAe,IAAI;;KAElD,cAAc;KACd,SAAS,GAAG;KACb;IACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;;AAGF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,eAAe;AACvC,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,IAAI,MAAM,CAChD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,wBAAwB;GAAE,EAAE,IAAI;EAE/E,MAAM,eAAe,IAAI,MAAM;EAC/B,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,aAAa,QAAQ,aAAa;AACxC,MAAI,CAAC,qBAAqB,eAAe,WAAW,CAClD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;EAEnF,MAAM,MAAM,yBAAyB,eAAe,WAAW;AAC/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,uBAAuB,KAAK;GAAE,CAAC;GACpE;AAEF,eAAc,IAAI,2CAA2C,OAAO,MAAM;EACxE,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,CAAE,MAAM,GAAG;AACxF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAgB,SAAS;IAAgB;GAAE,EAAE,IAAI;EAG7F,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;EACvG,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,YACA,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAA+B,SAAS,GAAG;IAAS;GAAE,EAAE,IAAI;EAGxG,MAAM,gBAAgB,GAAG;EACzB,MAAM,gBAAgB;GAAE,GAAG,+BAA+B,QAAQ,eAAe,WAAW;GAAE;GAAe;EAC7G,MAAM,cAAc,mBAAmB,QAAQ;EAC/C,MAAM,EAAE,WAAW,YAAY,MAAM,8BAA8B,SAAS,eAAe,cAAc;AAEzG,MAAI,CAAC,aAAa,QAChB,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW;IACX;IACA,OAAO;IACP,QAAQ;IACR,cAAc,EAAE;IAChB,WAAW;IACZ;GACF,CAAC;EAGJ,IAAI,KAA8C;AAClD,MAAI;AACF,QAAK,MAAM,KAAK,UAAU;UACpB;AACN,QAAK;;AAGP,MAAI,CAAC,GAIH,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW;IACX;IACA,OAAO;IACP,QAAQ;IACR,cAAc;IACd,cAAc,0BAA0B,WAAW,MAAM;IACzD,WAAW;IACZ;GACF,CAAC;EAIJ,MAAM,EAAE,OAAO,cAAc,gBADV,qBAAqB,WAAW,cACI;EACvD,MAAM,cAAc,UAAU;EAC9B,MAAM,cAAc,GAAG,aAAa;EACpC,MAAM,eAAe,0BAA0B,OAAO,aAAa,aAAa;EAChF,MAAM,MAAM,sBAAsB,SAAS;GACzC,cAAc;GACd,YAAY,cAAc,KAAA;GAC1B;GACA;GACA;GACD,CAAC;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW,IAAI;IACf,WAAW;IACX;IACA;IACA;IACA;IACA,QAAQ;IACR;IACA,cAAc;IACd,uBAAuB,cAAc,yBAAyB,eAAe,UAAU,GAAG,KAAA;IAC1F;IACA,SAAS,GAAG;IACb;GACF,CAAC;GACF;AAEF,eAAc,KAAK,8CAA8C,OAAO,MAAM;EAC5E,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM,IAAI;AACxC,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,MAAM,sBAAsB,QAAQ,GAAG;AAC7C,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;AACvG,MAAI,CAAC,wBAAwB,IAAI,YAAY,WAAW,CACtD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAI/G,MAAM,UAAS,MADK,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EAC9B;AACpB,MAAI,CAAC,sBAAsB,OAAO,CAChC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAkB,SAAS;IAAkB;GAAE,EAAE,IAAI;AAEjG,MAAI,CAAC,IAAI,aAAa,SAAS,OAAO,CACpC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAsB;GAAE,EAAE,IAAI;EAGzG,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI,aAAa;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAkB,SAAS;KAAkB;IAAE,EAAE,IAAI;;AAGjG,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,cAAc,IAAI;IAClB,aAAa,GAAG,aAAa;IAC9B;GACF,CAAC;GACF;AAEF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM,IAAI;AACxC,MAAI,CAAC,GACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,MAAM,sBAAsB,QAAQ,GAAG;AAC7C,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAoB,SAAS;IAA0B;GAAE,EAAE,IAAI;EAG3G,MAAM,aAAa,OAAO,EAAE,IAAI,MAAM,aAAa,KAAK,WAAW,EAAE,IAAI,MAAM,aAAa,CAAE,MAAM,GAAG;AACvG,MAAI,CAAC,wBAAwB,IAAI,YAAY,WAAW,CACtD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAA4B;GAAE,EAAE,IAAI;AAG/G,MAAI,CAAC,IAAI,aAAa,SAAS,oBAAoB,CACjD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAoC;GAAE,EAAE,IAAI;EAGvH,IAAI;AACJ,MAAI;AACF,gBAAa,MAAM,KAAK,IAAI,aAAa;UACnC;AACN,yBAAsB,WAAW,GAAG;AACpC,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAoB,SAAS;KAAgC;IAAE,EAAE,IAAI;;AAEjH,MAAI,CAAC,WAAW,QAAQ,CACtB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAmB,SAAS;IAAgC;GAAE,EAAE,IAAI;EAGhH,MAAM,YAAY,6BAA6B,QAAQ,cAAc;AACrE,MAAI,WAAW,OAAO,UAAU,SAC9B,QAAO,EAAE,KACP;GACE,IAAI;GACJ,OAAO;IACL,MAAM;IACN,SAAS,uCAAuC,UAAU,SAAS;IACpE;GACF,EACD,IACD;EAGH,MAAM,KAAK,MAAM,gCAAgC,SAAS,QAAQ,eAAe,YAAY,KAAA,EAAU;AACvG,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAA+B,SAAS,GAAG;IAAS;GAAE,EAAE,IAAI;EAExG,MAAM,gBAAgB,GAAG;EAEzB,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;UACtC;AACN,UAAO,EAAE;;EAEX,MAAM,mBAAmB,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;EAC1F,MAAM,gBAAgB,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC9E,MAAI,kBAAkB,YAAY,kBAAkB,eAAe,kBAAkB,QACnF,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAyB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAElH,MAAM,aAAa;AACnB,MAAI,eAAe,eAAe,CAAC,UAAU,eAC3C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAsB,SAAS;IAAmC;GAAE,EAAE,IAAI;EAGtH,MAAM,iBAAiB,uBAAuB,SAAS,IAAI,aAAa,CAAC,IAAI;EAC7E,IAAI;AACJ,MAAI,CAAC,iBACH,gBAAe,GAAG,UAAU,UAAU,GAAG;OACpC;GACL,MAAM,cAAc,iBAAiB,QAAQ,OAAO,IAAI;AAExD,kBAAe,YAAY,SAAS,IAAI,GAAG,GAAG,cAAc,mBAAmB;;EAGjF,IAAI,iBAAiB,yBAAyB,eAAe,aAAa;AAC1E,MAAI,CAAC,eACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAuB,SAAS;IAA4B;GAAE,EAAE,IAAI;EAIhH,MAAM,cAAc,kBAAkB,gBAAgB,cAAc;AACpE,MAAI,CAAC,YAAY,QACf,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAuB,SAAS,YAAY,UAAU;IAAuB;GAAE,EAAE,IAAI;AAGjI,MAAI,QAAQ,IAAI,aAAa,KAAK,QAAQ,eAAe,CACvD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAiB,SAAS;IAAqC;GAAE,EAAE,IAAI;EAGnH,MAAM,UAAU,QAAQ,eAAe;AACvC,MAAI;AACF,SAAM,MAAM,SAAS,EAAE,WAAW,MAAM,CAAC;WAClC,KAAK;AACZ,OAAI,KAAK;IAAE;IAAK;IAAS,EAAE,gDAAgD;AAC3E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAiC;IAAE,EAAE,IAAI;;EAM/G,MAAM,SAAS,KAAK,SAAS,IADT,SAAS,eAAe,CAAC,UAAU,YAAY,CAAC,MAC/B;EAErC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,UAAU;EACd,IAAI,YAAY;EAChB,IAAI,eAAe;AAEnB,MAAI;AACF,OAAI;AACF,UAAM,SAAS,IAAI,cAAc,QAAQA,UAAY,iBAAiB;YAC/D,KAAK;AACZ,UAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,QAAI,KAAK;KAAE;KAAK,QAAQ,IAAI;KAAc;KAAQ,EAAE,yCAAyC;AAC7F,WAAO,EAAE,KAAK;KAAE,IAAI;KAAO,OAAO;MAAE,MAAM;MAAiB,SAAS;MAA8B;KAAE,EAAE,IAAI;;AAG5G,OAAI,eAAe,aAAa;AAE9B,gBAAY,MAAM,KAAK,eAAe,CAAC,WAAW,KAAK,CAAC,YAAY,MAAM;AAC1E,QAAI;AACF,WAAM,OAAO,QAAQ,eAAe;aAC7B,KAAK;AACZ,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE;MAAK,QAAQ;MAAgB,EAAE,uBAAuB;AACjE,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAA6B;MAAE,EAAE,IAAI;;cAElG,eAAe,SAAS;AAEjC,QAAI,MADiB,KAAK,eAAe,CAAC,WAAW,KAAK,CAAC,YAAY,MAAM,EACjE;AACV,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAsB,SAAS;OAA8B;MAAE,EAAE,IAAI;;AAEjH,QAAI;AACF,WAAM,KAAK,QAAQ,eAAe;AAClC,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;aAC7B,KAAK;AACZ,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE;MAAK,QAAQ;MAAgB,EAAE,kCAAkC;AAC5E,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAA6B;MAAE,EAAE,IAAI;;UAEtG;IAEL,MAAM,SAAS,MAAM,4BAA4B,QAAQ,eAAe;AACxE,QAAI,CAAC,OAAO,IAAI;AACd,WAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,SAAI,KAAK;MAAE,QAAQ;MAAgB,UAAU,OAAO;MAAU,EAAE,yCAAyC;AACzG,YAAO,EAAE,KAAK;MAAE,IAAI;MAAO,OAAO;OAAE,MAAM;OAAiB,SAAS;OAAsC;MAAE,EAAE,IAAI;;AAEpH,UAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,mBAAe,OAAO;AACtB,cAAU,OAAO,SAAS;;WAErB,KAAK;AACZ,SAAM,OAAO,OAAO,CAAC,YAAY,GAAG;AACpC,OAAI,MAAM,EAAE,KAAK,EAAE,iCAAiC;AACpD,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAiB,SAAS;KAAiB;IAAE,EAAE,IAAI;;EAG/F,IAAI;AACJ,MAAI;AACF,iBAAc,MAAM,KAAK,aAAa,EAAE;UAClC;AACN,gBAAa,KAAK,KAAK;;EAGzB,MAAM,eAAe,yBAAyB,eAAe,aAAa;AAE1E,wBAAsB,WAAW,GAAG;EACpC,MAAM,SAAS,sBAAsB,SAAS;GAC5C,cAAc;GACd,YAAY,cAAc,KAAA;GAC1B,OAAO;GACP,cAAc,0BAA0B,aAAa,MAAM;GAC5D,CAAC;EAEF,MAAM,cAAc,IAAI;EACxB,MAAM,qBAAqB,IAAI;AAE/B,UAAQ,KAAK,2BAA2B;GACtC,YAAY,cAAc,KAAA;GAC1B,uBAAuB;GACvB,cAAc;GACd,OAAO,WAAW;GAClB;GACA;GACD,CAAC;AAEF,MAAI,KACF;GACE;GACA,WAAW;GACX,oBAAoB,IAAI;GACxB;GACA;GACA,2BAA2B;GAC3B,OAAO,WAAW;GAClB;GACA;GACA,YAAY,KAAK,KAAK,GAAG;GAC1B,EACD,kCACD;AAED,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,uBAAuB;IACvB,cAAc;IACd,aAAa,WAAW;IACxB,oBAAoB,IAAI;IACxB;IACA;IACA;IACA;IACA,SAAS;IACT,cAAc,OAAO;IACtB;GACF,CAAC;GACF;;;;;AAMF,eAAc,IAAI,6BAA6B,OAAO,MAAM;EAC1D,MAAM,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,KAAK,WAAW,EAAE,IAAI,MAAM,OAAO,GAAI;AACjF,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,QAAQ,CACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;EA6BrE,MAAM,cAAc;GAzBlB,KAAK;GACL,KAAK;GACL,MAAM;GACN,KAAK;GACL,MAAM;GACN,KAAK;GACL,KAAK;GACL,KAAK;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,KAAK;GACL,IAAI;GACJ,MAAM;GACN,MAAM;GACN,KAAK;GACL,IAAI;GACJ,IAAI;GACJ,KAAK;GACL,KAAK;GACL,KAAK;GACL,MAAM;GACN,KAAK;GACL,KAAK;GAEsB,CA3BjB,QAAQ,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OA2BjB;AACtC,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,IAAI;AAC/B,UAAO,IAAI,SAAS,KAAK,EACvB,SAAS;IACP,gBAAgB;IAChB,iBAAiB;IAClB,EACF,CAAC;UACI;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,eAAe;IAAE,EAAE,IAAI;;GAEtE;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,IAAI;AACJ,MAAI;AACF,UAAO,MAAM,EAAE,IAAI,MAAM;UACnB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,UAAU,QACV,OAAQ,KAA2B,SAAS,WACvC,KAA0B,OAC3B;EACN,MAAM,UACJ,OAAO,SAAS,YAChB,SAAS,QACT,aAAa,QACb,OAAQ,KAA8B,YAAY,WAC7C,KAA6B,UAC9B;AACN,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,MAAM,MAAM,yBAAyB,eAAe,QAAQ;AAC5D,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,IAAI;UACd;AACN,QAAK,KAAA;;AAEP,MAAI,MAAM,CAAC,GAAG,QAAQ,CACpB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,cAAc;GAAE,EAAE,IAAI;AAErE,MAAI;AACF,SAAM,UAAU,KAAK,SAAS,QAAQ;GACtC,IAAI;AACJ,OAAI;AACF,eAAW,MAAM,KAAK,IAAI,EAAE;WACtB;AACN,cAAU,KAAK,KAAK;;AAEtB,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KAAE,MAAM,yBAAyB,eAAe,IAAI;KAAE;KAAS;IACzE,CAAC;WACK,KAAK;AACZ,OAAI,MAAM;IAAE;IAAK,MAAM;IAAK,EAAE,gCAAgC;AAC9D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;GAEvE;AAEF,eAAc,IAAI,gCAAgC,OAAO,MAAM;EAC7D,MAAM,IAAI,OAAO,EAAE,IAAI,MAAM,IAAI,KAAK,WAAW,EAAE,IAAI,MAAM,IAAI,CAAE,MAAM,GAAG;EAC5E,MAAM,SAAS,OAAO,EAAE,IAAI,MAAM,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,MAAM,GAAI;AAC9E,MAAI,CAAC,EACH,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,SAAS,EAAE,EAA2G;GAClI,CAAC;EAEJ,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAEnE,MAAM,gBAAgB,GAAG;EACzB,MAAM,SAAS,yBAAyB,eAAe,OAAO;AAC9D,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gBAAgB;GAAE,EAAE,IAAI;EAEvE,IAAI;AACJ,MAAI;AACF,QAAK,MAAM,KAAK,OAAO;UACjB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,aAAa;IAAE,EAAE,IAAI;;AAEpE,MAAI,CAAC,GAAG,aAAa,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mBAAmB;GAAE,EAAE,IAAI;EAG1E,MAAM,WAAU,MADE,sBAAsB,GAAG,OAAO,EAE/C,QAAQ,MAAM,qBAAqB,eAAe,EAAE,SAAS,CAAC,CAC9D,KAAK,OAAO;GACX,GAAG;GACH,UAAU,yBAAyB,eAAe,QAAQ,EAAE,SAAS,CAAC;GACvE,EAAE;AACL,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;;AAGF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,IAAI,OAAO,EAAE,IAAI,MAAM,IAAI,KAAK,WAAW,EAAE,IAAI,MAAM,IAAI,CAAE,MAAM,GAAG;EAC5E,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,QAAQ,KAAK,IACjB,KAAK,IAAI,SAAS,OAAO,aAAa,WAAW,WAAW,MAAM,GAAG,IAAI,IAAI,EAAE,EAC/E,sBACD;EAED,MAAM,KAAK,MAAM,gCACf,SACA,QAAQ,eACR,EAAE,IAAI,MAAM,aAAa,EACzB,EAAE,IAAI,MAAM,UAAU,CACvB;AACD,MAAI,GAAG,OAAO,MACZ,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,GAAG,SAAS;GAAE,EAAE,IAAI;EAGnE,MAAM,UAAU,MAAM,0BAA0B,GAAG,MAAM,GAAG,MAAM;AAClE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD"}

package/dist/src/gateway/hono/sse.d.ts

@@ -13,6 +13,7 @@ export interface SSEHandlerConfig {
  *
  * SSE events:
  *   event: status   — { status, runId }
+ *   event: user_message — { timestamp, content?, attachments? } (user turn accepted, before agent tokens)
  *   event: user_transcript — { text, attachments? } (voice STT complete, before agent tokens)
  *   event: token    — { content }
  *   event: error    — { content }

package/dist/src/gateway/hono/sse.js

@@ -1,8 +1,8 @@
-import { buildSessionKey, init_session_key, parseSessionKey } from "../../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { updateAsyncLogContext } from "../../utils/logger/context.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { buildSessionKey, init_session_key, parseSessionKey } from "../../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../chat-limits.js";
 import { stringifySSEData } from "./sse-json.js";
 import { randomUUID } from "node:crypto";
@@ -33,6 +33,7 @@ function maxBase64CharsForBinary(maxBinaryBytes) {
 *
 * SSE events:
 *   event: status   — { status, runId }
+*   event: user_message — { timestamp, content?, attachments? } (user turn accepted, before agent tokens)
 *   event: user_transcript — { text, attachments? } (voice STT complete, before agent tokens)
 *   event: token    — { content }
 *   event: error    — { content }

package/dist/src/gateway/hono/sse.js.map

@@ -1 +1 @@
-{"version":3,"file":"sse.js","names":[],"sources":["../../../../src/gateway/hono/sse.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { streamSSE } from 'hono/streaming';\nimport type { Context } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from '../chat-limits.js';\nimport { createLogger, updateAsyncLogContext } from '../../utils/logger.js';\nimport { stringifySSEData } from './sse-json.js';\nimport { buildSessionKey, parseSessionKey } from '../../routing/session-key.js';\nimport { getDefaultAgentId } from '../../routing/resolve-route.js';\n\nconst log = createLogger('Hono:SSE');\n\n// Active SSE connections tracking for connection limiting\nconst activeConnections = new Map<string, AbortController>();\n\nexport interface SSEHandlerConfig {\n  service: GatewayService;\n  maxSseConnections?: number;\n}\n\n// Type validation for agent request body\ninterface AgentRequestBody {\n  message: string;\n  channel?: string;\n  chatId?: string;\n  /** Alias for `chatId` (gateway console + extension clients). */\n  sessionKey?: string;\n  /** Epoch ms when the client started this send (abort cutoff / stale POST drop). */\n  clientCreatedAtMs?: number;\n  /** When true and `channel` is `webchat`, start a new peer id (new session). */\n  newSession?: boolean;\n  thinking?: string;\n  attachments?: Array<{\n    type: string;\n    mimeType?: string;\n    data?: string;\n    name?: string;\n    size?: number;\n  }>;\n}\n\nfunction isValidAgentRequest(body: unknown): body is AgentRequestBody {\n  if (!body || typeof body !== 'object') return false;\n  const b = body as Record<string, unknown>;\n  // Allow empty message if attachments are provided\n  const hasMessage = typeof b.message === 'string';\n  const hasAttachments = Array.isArray(b.attachments) && b.attachments.length > 0;\n  return hasMessage || hasAttachments;\n}\n\n/** Max base64 character length that can decode to `MAX_WEBCHAT_ATTACHMENT_FILE_BYTES`. */\nfunction maxBase64CharsForBinary(maxBinaryBytes: number): number {\n  return 4 * Math.ceil(maxBinaryBytes / 3);\n}\n\n/**\n * POST /api/agent — Send a message to the agent, stream response via SSE.\n *\n * Request body: { message, channel?, chatId?, attachments? }\n * Accept: text/event-stream → SSE stream\n * Accept: application/json → wait for full response, return JSON\n *\n * SSE events:\n *   event: status   — { status, runId }\n *   event: user_transcript — { text, attachments? } (voice STT complete, before agent tokens)\n *   event: token    — { content }\n *   event: error    — { content }\n *   event: result   — { ok, payload: { status, summary } }\n */\nexport function createAgentSSEHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => null);\n\n    // Input validation\n    if (!isValidAgentRequest(body)) {\n      return c.json({\n        ok: false,\n        error: { code: 'BAD_REQUEST', message: 'Missing required field: message or attachments' }\n      }, 400);\n    }\n\n    const { message, channel = 'webchat', attachments, thinking } = body;\n    const clientCreatedAtMs =\n      typeof body.clientCreatedAtMs === 'number' && Number.isFinite(body.clientCreatedAtMs)\n        ? body.clientCreatedAtMs\n        : undefined;\n    const newSession = Boolean(body.newSession);\n    let chatId = 'default';\n    if (newSession && channel === 'webchat') {\n      chatId = `chat_${randomUUID()}`;\n    } else {\n      const sk = typeof body.sessionKey === 'string' && body.sessionKey.trim() ? body.sessionKey.trim() : '';\n      const cid = typeof body.chatId === 'string' && body.chatId.trim() ? body.chatId.trim() : '';\n      const rawChatId = sk || cid || 'default';\n\n      // Validate sessionKey / chatId format to prevent cross-session access\n      if (rawChatId !== 'default' && !/^[a-zA-Z0-9][a-zA-Z0-9._:@\\-]{0,255}$/.test(rawChatId)) {\n        log.warn({ rawChatId: rawChatId.slice(0, 64) }, 'Rejected invalid chatId format');\n        return c.json({\n          ok: false,\n          error: { code: 'BAD_REQUEST', message: 'Invalid session key format' },\n        }, 400);\n      }\n      chatId = rawChatId;\n    }\n\n    updateAsyncLogContext({ sessionId: String(chatId) });\n\n    if (Array.isArray(attachments)) {\n      const maxDataChars = maxBase64CharsForBinary(MAX_WEBCHAT_ATTACHMENT_FILE_BYTES);\n      for (const a of attachments) {\n        if (!a || typeof a !== 'object') continue;\n        const data = (a as { data?: unknown }).data;\n        if (typeof data === 'string' && data.length > maxDataChars) {\n          return c.json(\n            {\n              ok: false,\n              error: {\n                code: 'BAD_REQUEST',\n                message: `Attachment exceeds maximum size (${MAX_WEBCHAT_ATTACHMENT_FILE_BYTES} bytes)`,\n              },\n            },\n            400,\n          );\n        }\n      }\n    }\n\n    const accept = c.req.header('Accept') || '';\n    const wantSSE = accept.includes('text/event-stream');\n\n    const clientAbort = new AbortController();\n    const raw = c.req.raw;\n    // Keep webchat runs alive across transient disconnects (page refresh / tab route switch)\n    // so the client can reattach via /api/agent/resume using runId from `status`.\n    // Explicit cancellation still goes through /api/agent/abort.\n    if (channel !== 'webchat') {\n      if (raw.signal.aborted) {\n        clientAbort.abort();\n      } else {\n        raw.signal.addEventListener('abort', () => clientAbort.abort(), { once: true });\n      }\n    }\n\n    // --- Non-streaming fallback: collect everything, return JSON ---\n    if (!wantSSE) {\n      let jsonSessionKey: string | undefined;\n      if (channel === 'webchat') {\n        const cfg = service.currentConfig;\n        const parsedKey = parseSessionKey(chatId);\n        jsonSessionKey = parsedKey\n          ? chatId\n          : buildSessionKey({\n              agentId: getDefaultAgentId(cfg),\n              source: 'webchat',\n              accountId: 'default',\n              peerKind: 'direct',\n              peerId: chatId,\n            });\n      }\n\n      const generator = service.runAgent(message, channel, chatId, attachments, thinking, {\n        signal: clientAbort.signal,\n        ...(clientCreatedAtMs !== undefined ? { clientCreatedAtMs } : {}),\n      });\n      try {\n        let finalResult: { status: string; summary: string } | undefined;\n        const tokens: string[] = [];\n\n        while (true) {\n          const { done, value } = await generator.next();\n          if (done) {\n            finalResult = value as { status: string; summary: string };\n            break;\n          }\n          const chunk = value as { type: string; content?: string; status?: string; runId?: string };\n          if (chunk.type === 'token' && chunk.content) {\n            tokens.push(chunk.content);\n          }\n        }\n\n        return c.json({\n          ok: true,\n          payload: {\n            ...finalResult,\n            content: tokens.join(''),\n            ...(jsonSessionKey !== undefined\n              ? { sessionKey: jsonSessionKey, key: jsonSessionKey }\n              : {}),\n          },\n        });\n      } catch (error) {\n        log.error({ err: error }, 'Agent run failed (JSON mode)');\n        return c.json({\n          ok: false,\n          error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n        }, 500);\n      }\n    }\n\n    // --- SSE streaming ---\n    c.header('X-Accel-Buffering', 'no');\n    return streamSSE(c, async (stream) => {\n      if (channel !== 'webchat') {\n        stream.onAbort(() => {\n          clientAbort.abort();\n        });\n      }\n\n      const generator = service.runAgent(message, channel, chatId, attachments, thinking, {\n        signal: clientAbort.signal,\n        ...(clientCreatedAtMs !== undefined ? { clientCreatedAtMs } : {}),\n      });\n\n      let eventId = 0;\n\n      try {\n        while (true) {\n          const { done, value } = await generator.next();\n\n          if (done) {\n            // Final result\n            await stream.writeSSE({\n              id: String(++eventId),\n              event: 'result',\n              data: JSON.stringify({ ok: true, payload: value }),\n            });\n            break;\n          }\n\n          const chunk = value as { type: string; content?: string; status?: string; runId?: string };\n\n          // Intermediate events: status / token / error\n          await stream.writeSSE({\n            id: String(++eventId),\n            event: chunk.type || 'message',\n            data: stringifySSEData(chunk),\n          });\n        }\n      } catch (error) {\n        log.error({ err: error }, 'Agent run failed (SSE mode)');\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'error',\n          data: JSON.stringify({\n            ok: false,\n            error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n          }),\n        });\n      }\n    });\n  };\n}\n\n/**\n * POST /api/agent/resume — Re-attach to an in-progress agent run via SSE.\n *\n * Request body: { runId, chatId }\n * The relay replays all buffered events from the beginning and then live-tails\n * until the run completes.\n *\n * SSE events are identical to those from POST /api/agent.\n */\nexport function createAgentResumeHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => null);\n    if (!body || typeof body !== 'object') {\n      return c.json({ ok: false, error: { code: 'BAD_REQUEST', message: 'Invalid JSON body' } }, 400);\n    }\n\n    const { runId, chatId: resumeChatId } = body as { runId?: string; chatId?: string };\n    if (typeof resumeChatId === 'string' && resumeChatId.trim()) {\n      updateAsyncLogContext({ sessionId: resumeChatId.trim() });\n    }\n    if (!runId || typeof runId !== 'string') {\n      return c.json({ ok: false, error: { code: 'BAD_REQUEST', message: 'Missing required field: runId' } }, 400);\n    }\n\n    if (!service.runRelay.hasRun(runId)) {\n      return c.json({ ok: false, error: { code: 'NOT_FOUND', message: 'Run not found or already expired' } }, 404);\n    }\n\n    c.header('X-Accel-Buffering', 'no');\n    return streamSSE(c, async (stream) => {\n      let eventId = 0;\n      try {\n        for await (const event of service.runRelay.subscribe(runId)) {\n          await stream.writeSSE({\n            id: String(++eventId),\n            event: event.type || 'message',\n            data: stringifySSEData(event),\n          });\n        }\n        // Run completed — send a final result event\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'result',\n          data: JSON.stringify({ ok: true, payload: { status: 'ok', summary: 'Resumed run completed' } }),\n        });\n      } catch (error) {\n        log.error({ err: error, runId }, 'Resume stream failed');\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'error',\n          data: JSON.stringify({\n            ok: false,\n            error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n          }),\n        });\n      }\n    });\n  };\n}\n\n/**\n * POST /api/send — Send a message through a channel (non-streaming).\n */\nexport function createSendHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => ({}));\n    const channel = body.channel as string;\n    const chatId = body.chatId as string;\n    const content = body.content as string;\n\n    if (!channel || !chatId || !content) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing required fields: channel, chatId, content' } },\n        400,\n      );\n    }\n\n    updateAsyncLogContext({ sessionId: String(chatId) });\n\n    try {\n      const result = await service.sendMessage(channel, chatId, content);\n      return c.json({ ok: true, payload: result });\n    } catch (error) {\n      log.error({ err: error }, 'Send failed');\n      return c.json(\n        { ok: false, error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' } },\n        500,\n      );\n    }\n  };\n}\n\n/**\n * GET /api/events — Server-pushed event stream (SSE).\n *\n * The client opens this long-lived connection to receive:\n *   - channel status changes\n *   - config reload notifications\n *   - cron execution results\n *   - any other server-initiated events\n *\n * Supports Last-Event-ID for reconnection.\n * Enforces maximum connection limit to prevent DoS.\n */\nexport function createEventsSSEHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n  const maxConnections = config.maxSseConnections ?? 100;\n\n  return async (c: Context) => {\n    // Check maximum connections limit\n    if (activeConnections.size >= maxConnections) {\n      log.warn({ current: activeConnections.size, max: maxConnections }, 'SSE connection limit reached');\n      return c.json({\n        ok: false,\n        error: { code: 'TOO_MANY_CONNECTIONS', message: 'Maximum SSE connections exceeded' }\n      }, 503);\n    }\n\n    const lastEventId = c.req.header('Last-Event-ID') || undefined;\n    const sessionId = c.req.header('X-Session-Id')\n      || c.req.query('sessionId')\n      || crypto.randomUUID();\n\n    updateAsyncLogContext({ sessionId: String(sessionId) });\n\n    const abortController = new AbortController();\n    activeConnections.set(sessionId, abortController);\n\n    return streamSSE(c, async (stream) => {\n      let aborted = false;\n\n      // Send a hello event so the client knows the stream is established\n      await stream.writeSSE({\n        id: '0',\n        event: 'connected',\n        data: JSON.stringify({ sessionId }),\n      });\n\n      // Subscribe to service events\n      const cleanup = service.subscribe(sessionId, async (event) => {\n        if (aborted) return;\n        try {\n          await stream.writeSSE({\n            id: event.id,\n            event: event.type,\n            data: JSON.stringify(event.payload),\n          });\n        } catch {\n          // Stream closed, will be cleaned up by onAbort\n        }\n      });\n\n      // Replay missed events on reconnect\n      if (lastEventId) {\n        const missed = service.getEventsSince(sessionId, lastEventId);\n        for (const event of missed) {\n          await stream.writeSSE({\n            id: event.id,\n            event: event.type,\n            data: JSON.stringify(event.payload),\n          });\n        }\n      }\n\n      // Keep alive with periodic comments (every 30s)\n      const keepAlive = setInterval(async () => {\n        if (aborted) { clearInterval(keepAlive); return; }\n        try {\n          await stream.writeSSE({ event: 'ping', data: '' });\n        } catch {\n          clearInterval(keepAlive);\n        }\n      }, 30_000);\n\n      // Block until aborted — streamSSE closes when the callback returns\n      await new Promise<void>((resolve) => {\n        stream.onAbort(() => {\n          aborted = true;\n          clearInterval(keepAlive);\n          cleanup();\n          activeConnections.delete(sessionId);\n          log.debug({ sessionId }, 'Event stream disconnected');\n          resolve();\n        });\n      });\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;aAK4E;kBAEI;oBACb;AAEnE,MAAM,MAAM,aAAa,WAAW;AAGpC,MAAM,oCAAoB,IAAI,KAA8B;AA4B5D,SAAS,oBAAoB,MAAyC;AACpE,KAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;CAC9C,MAAM,IAAI;CAEV,MAAM,aAAa,OAAO,EAAE,YAAY;CACxC,MAAM,iBAAiB,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,YAAY,SAAS;AAC9E,QAAO,cAAc;;;AAIvB,SAAS,wBAAwB,gBAAgC;AAC/D,QAAO,IAAI,KAAK,KAAK,iBAAiB,EAAE;;;;;;;;;;;;;;;;AAiB1C,SAAgB,sBAAsB,QAA0B;CAC9D,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAGjD,MAAI,CAAC,oBAAoB,KAAK,CAC5B,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,OAAO;IAAE,MAAM;IAAe,SAAS;IAAkD;GAC1F,EAAE,IAAI;EAGT,MAAM,EAAE,SAAS,UAAU,WAAW,aAAa,aAAa;EAChE,MAAM,oBACJ,OAAO,KAAK,sBAAsB,YAAY,OAAO,SAAS,KAAK,kBAAkB,GACjF,KAAK,oBACL,KAAA;EACN,MAAM,aAAa,QAAQ,KAAK,WAAW;EAC3C,IAAI,SAAS;AACb,MAAI,cAAc,YAAY,UAC5B,UAAS,QAAQ,YAAY;OACxB;GACL,MAAM,KAAK,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,MAAM,GAAG,KAAK,WAAW,MAAM,GAAG;GACpG,MAAM,MAAM,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG;GACzF,MAAM,YAAY,MAAM,OAAO;AAG/B,OAAI,cAAc,aAAa,CAAC,wCAAwC,KAAK,UAAU,EAAE;AACvF,QAAI,KAAK,EAAE,WAAW,UAAU,MAAM,GAAG,GAAG,EAAE,EAAE,iCAAiC;AACjF,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,OAAO;MAAE,MAAM;MAAe,SAAS;MAA8B;KACtE,EAAE,IAAI;;AAET,YAAS;;AAGX,wBAAsB,EAAE,WAAW,OAAO,OAAO,EAAE,CAAC;AAEpD,MAAI,MAAM,QAAQ,YAAY,EAAE;GAC9B,MAAM,eAAe,wBAAwB,kCAAkC;AAC/E,QAAK,MAAM,KAAK,aAAa;AAC3B,QAAI,CAAC,KAAK,OAAO,MAAM,SAAU;IACjC,MAAM,OAAQ,EAAyB;AACvC,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,aAC5C,QAAO,EAAE,KACP;KACE,IAAI;KACJ,OAAO;MACL,MAAM;MACN,SAAS,oCAAoC,kCAAkC;MAChF;KACF,EACD,IACD;;;EAMP,MAAM,WADS,EAAE,IAAI,OAAO,SAAS,IAAI,IAClB,SAAS,oBAAoB;EAEpD,MAAM,cAAc,IAAI,iBAAiB;EACzC,MAAM,MAAM,EAAE,IAAI;AAIlB,MAAI,YAAY,UACd,KAAI,IAAI,OAAO,QACb,aAAY,OAAO;MAEnB,KAAI,OAAO,iBAAiB,eAAe,YAAY,OAAO,EAAE,EAAE,MAAM,MAAM,CAAC;AAKnF,MAAI,CAAC,SAAS;GACZ,IAAI;AACJ,OAAI,YAAY,WAAW;IACzB,MAAM,MAAM,QAAQ;AAEpB,qBADkB,gBAAgB,OACR,GACtB,SACA,gBAAgB;KACd,SAAS,kBAAkB,IAAI;KAC/B,QAAQ;KACR,WAAW;KACX,UAAU;KACV,QAAQ;KACT,CAAC;;GAGR,MAAM,YAAY,QAAQ,SAAS,SAAS,SAAS,QAAQ,aAAa,UAAU;IAClF,QAAQ,YAAY;IACpB,GAAI,sBAAsB,KAAA,IAAY,EAAE,mBAAmB,GAAG,EAAE;IACjE,CAAC;AACF,OAAI;IACF,IAAI;IACJ,MAAM,SAAmB,EAAE;AAE3B,WAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,UAAU,MAAM;AAC9C,SAAI,MAAM;AACR,oBAAc;AACd;;KAEF,MAAM,QAAQ;AACd,SAAI,MAAM,SAAS,WAAW,MAAM,QAClC,QAAO,KAAK,MAAM,QAAQ;;AAI9B,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,SAAS;MACP,GAAG;MACH,SAAS,OAAO,KAAK,GAAG;MACxB,GAAI,mBAAmB,KAAA,IACnB;OAAE,YAAY;OAAgB,KAAK;OAAgB,GACnD,EAAE;MACP;KACF,CAAC;YACK,OAAO;AACd,QAAI,MAAM,EAAE,KAAK,OAAO,EAAE,+BAA+B;AACzD,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,OAAO;MAAE,MAAM;MAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;MAAiB;KACrG,EAAE,IAAI;;;AAKX,IAAE,OAAO,qBAAqB,KAAK;AACnC,SAAO,UAAU,GAAG,OAAO,WAAW;AACpC,OAAI,YAAY,UACd,QAAO,cAAc;AACnB,gBAAY,OAAO;KACnB;GAGJ,MAAM,YAAY,QAAQ,SAAS,SAAS,SAAS,QAAQ,aAAa,UAAU;IAClF,QAAQ,YAAY;IACpB,GAAI,sBAAsB,KAAA,IAAY,EAAE,mBAAmB,GAAG,EAAE;IACjE,CAAC;GAEF,IAAI,UAAU;AAEd,OAAI;AACF,WAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,UAAU,MAAM;AAE9C,SAAI,MAAM;AAER,YAAM,OAAO,SAAS;OACpB,IAAI,OAAO,EAAE,QAAQ;OACrB,OAAO;OACP,MAAM,KAAK,UAAU;QAAE,IAAI;QAAM,SAAS;QAAO,CAAC;OACnD,CAAC;AACF;;KAGF,MAAM,QAAQ;AAGd,WAAM,OAAO,SAAS;MACpB,IAAI,OAAO,EAAE,QAAQ;MACrB,OAAO,MAAM,QAAQ;MACrB,MAAM,iBAAiB,MAAM;MAC9B,CAAC;;YAEG,OAAO;AACd,QAAI,MAAM,EAAE,KAAK,OAAO,EAAE,8BAA8B;AACxD,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MACnB,IAAI;MACJ,OAAO;OAAE,MAAM;OAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;OAAiB;MACrG,CAAC;KACH,CAAC;;IAEJ;;;;;;;;;;;;AAaN,SAAgB,yBAAyB,QAA0B;CACjE,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqB;GAAE,EAAE,IAAI;EAGjG,MAAM,EAAE,OAAO,QAAQ,iBAAiB;AACxC,MAAI,OAAO,iBAAiB,YAAY,aAAa,MAAM,CACzD,uBAAsB,EAAE,WAAW,aAAa,MAAM,EAAE,CAAC;AAE3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAiC;GAAE,EAAE,IAAI;AAG7G,MAAI,CAAC,QAAQ,SAAS,OAAO,MAAM,CACjC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAAoC;GAAE,EAAE,IAAI;AAG9G,IAAE,OAAO,qBAAqB,KAAK;AACnC,SAAO,UAAU,GAAG,OAAO,WAAW;GACpC,IAAI,UAAU;AACd,OAAI;AACF,eAAW,MAAM,SAAS,QAAQ,SAAS,UAAU,MAAM,CACzD,OAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO,MAAM,QAAQ;KACrB,MAAM,iBAAiB,MAAM;KAC9B,CAAC;AAGJ,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MAAE,IAAI;MAAM,SAAS;OAAE,QAAQ;OAAM,SAAS;OAAyB;MAAE,CAAC;KAChG,CAAC;YACK,OAAO;AACd,QAAI,MAAM;KAAE,KAAK;KAAO;KAAO,EAAE,uBAAuB;AACxD,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MACnB,IAAI;MACJ,OAAO;OAAE,MAAM;OAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;OAAiB;MACrG,CAAC;KACH,CAAC;;IAEJ;;;;;;AAON,SAAgB,kBAAkB,QAA0B;CAC1D,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,KAAK;EACrB,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU,KAAK;AAErB,MAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAC1B,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqD;GAAE,EAC3G,IACD;AAGH,wBAAsB,EAAE,WAAW,OAAO,OAAO,EAAE,CAAC;AAEpD,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,YAAY,SAAS,QAAQ,QAAQ;AAClE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;IAAQ,CAAC;WACrC,OAAO;AACd,OAAI,MAAM,EAAE,KAAK,OAAO,EAAE,cAAc;AACxC,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;KAAiB;IAAE,EACnH,IACD;;;;;;;;;;;;;;;;AAiBP,SAAgB,uBAAuB,QAA0B;CAC/D,MAAM,EAAE,YAAY;CACpB,MAAM,iBAAiB,OAAO,qBAAqB;AAEnD,QAAO,OAAO,MAAe;AAE3B,MAAI,kBAAkB,QAAQ,gBAAgB;AAC5C,OAAI,KAAK;IAAE,SAAS,kBAAkB;IAAM,KAAK;IAAgB,EAAE,+BAA+B;AAClG,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO;KAAE,MAAM;KAAwB,SAAS;KAAoC;IACrF,EAAE,IAAI;;EAGT,MAAM,cAAc,EAAE,IAAI,OAAO,gBAAgB,IAAI,KAAA;EACrD,MAAM,YAAY,EAAE,IAAI,OAAO,eAAe,IACzC,EAAE,IAAI,MAAM,YAAY,IACxB,OAAO,YAAY;AAExB,wBAAsB,EAAE,WAAW,OAAO,UAAU,EAAE,CAAC;EAEvD,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,oBAAkB,IAAI,WAAW,gBAAgB;AAEjD,SAAO,UAAU,GAAG,OAAO,WAAW;GACpC,IAAI,UAAU;AAGd,SAAM,OAAO,SAAS;IACpB,IAAI;IACJ,OAAO;IACP,MAAM,KAAK,UAAU,EAAE,WAAW,CAAC;IACpC,CAAC;GAGF,MAAM,UAAU,QAAQ,UAAU,WAAW,OAAO,UAAU;AAC5D,QAAI,QAAS;AACb,QAAI;AACF,WAAM,OAAO,SAAS;MACpB,IAAI,MAAM;MACV,OAAO,MAAM;MACb,MAAM,KAAK,UAAU,MAAM,QAAQ;MACpC,CAAC;YACI;KAGR;AAGF,OAAI,aAAa;IACf,MAAM,SAAS,QAAQ,eAAe,WAAW,YAAY;AAC7D,SAAK,MAAM,SAAS,OAClB,OAAM,OAAO,SAAS;KACpB,IAAI,MAAM;KACV,OAAO,MAAM;KACb,MAAM,KAAK,UAAU,MAAM,QAAQ;KACpC,CAAC;;GAKN,MAAM,YAAY,YAAY,YAAY;AACxC,QAAI,SAAS;AAAE,mBAAc,UAAU;AAAE;;AACzC,QAAI;AACF,WAAM,OAAO,SAAS;MAAE,OAAO;MAAQ,MAAM;MAAI,CAAC;YAC5C;AACN,mBAAc,UAAU;;MAEzB,IAAO;AAGV,SAAM,IAAI,SAAe,YAAY;AACnC,WAAO,cAAc;AACnB,eAAU;AACV,mBAAc,UAAU;AACxB,cAAS;AACT,uBAAkB,OAAO,UAAU;AACnC,SAAI,MAAM,EAAE,WAAW,EAAE,4BAA4B;AACrD,cAAS;MACT;KACF;IACF"}
+{"version":3,"file":"sse.js","names":[],"sources":["../../../../src/gateway/hono/sse.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { streamSSE } from 'hono/streaming';\nimport type { Context } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from '../chat-limits.js';\nimport { createLogger, updateAsyncLogContext } from '../../utils/logger.js';\nimport { stringifySSEData } from './sse-json.js';\nimport { buildSessionKey, parseSessionKey } from '../../routing/session-key.js';\nimport { getDefaultAgentId } from '../../routing/resolve-route.js';\n\nconst log = createLogger('Hono:SSE');\n\n// Active SSE connections tracking for connection limiting\nconst activeConnections = new Map<string, AbortController>();\n\nexport interface SSEHandlerConfig {\n  service: GatewayService;\n  maxSseConnections?: number;\n}\n\n// Type validation for agent request body\ninterface AgentRequestBody {\n  message: string;\n  channel?: string;\n  chatId?: string;\n  /** Alias for `chatId` (gateway console + extension clients). */\n  sessionKey?: string;\n  /** Epoch ms when the client started this send (abort cutoff / stale POST drop). */\n  clientCreatedAtMs?: number;\n  /** When true and `channel` is `webchat`, start a new peer id (new session). */\n  newSession?: boolean;\n  thinking?: string;\n  attachments?: Array<{\n    type: string;\n    mimeType?: string;\n    data?: string;\n    name?: string;\n    size?: number;\n  }>;\n}\n\nfunction isValidAgentRequest(body: unknown): body is AgentRequestBody {\n  if (!body || typeof body !== 'object') return false;\n  const b = body as Record<string, unknown>;\n  // Allow empty message if attachments are provided\n  const hasMessage = typeof b.message === 'string';\n  const hasAttachments = Array.isArray(b.attachments) && b.attachments.length > 0;\n  return hasMessage || hasAttachments;\n}\n\n/** Max base64 character length that can decode to `MAX_WEBCHAT_ATTACHMENT_FILE_BYTES`. */\nfunction maxBase64CharsForBinary(maxBinaryBytes: number): number {\n  return 4 * Math.ceil(maxBinaryBytes / 3);\n}\n\n/**\n * POST /api/agent — Send a message to the agent, stream response via SSE.\n *\n * Request body: { message, channel?, chatId?, attachments? }\n * Accept: text/event-stream → SSE stream\n * Accept: application/json → wait for full response, return JSON\n *\n * SSE events:\n *   event: status   — { status, runId }\n *   event: user_message — { timestamp, content?, attachments? } (user turn accepted, before agent tokens)\n *   event: user_transcript — { text, attachments? } (voice STT complete, before agent tokens)\n *   event: token    — { content }\n *   event: error    — { content }\n *   event: result   — { ok, payload: { status, summary } }\n */\nexport function createAgentSSEHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => null);\n\n    // Input validation\n    if (!isValidAgentRequest(body)) {\n      return c.json({\n        ok: false,\n        error: { code: 'BAD_REQUEST', message: 'Missing required field: message or attachments' }\n      }, 400);\n    }\n\n    const { message, channel = 'webchat', attachments, thinking } = body;\n    const clientCreatedAtMs =\n      typeof body.clientCreatedAtMs === 'number' && Number.isFinite(body.clientCreatedAtMs)\n        ? body.clientCreatedAtMs\n        : undefined;\n    const newSession = Boolean(body.newSession);\n    let chatId = 'default';\n    if (newSession && channel === 'webchat') {\n      chatId = `chat_${randomUUID()}`;\n    } else {\n      const sk = typeof body.sessionKey === 'string' && body.sessionKey.trim() ? body.sessionKey.trim() : '';\n      const cid = typeof body.chatId === 'string' && body.chatId.trim() ? body.chatId.trim() : '';\n      const rawChatId = sk || cid || 'default';\n\n      // Validate sessionKey / chatId format to prevent cross-session access\n      if (rawChatId !== 'default' && !/^[a-zA-Z0-9][a-zA-Z0-9._:@\\-]{0,255}$/.test(rawChatId)) {\n        log.warn({ rawChatId: rawChatId.slice(0, 64) }, 'Rejected invalid chatId format');\n        return c.json({\n          ok: false,\n          error: { code: 'BAD_REQUEST', message: 'Invalid session key format' },\n        }, 400);\n      }\n      chatId = rawChatId;\n    }\n\n    updateAsyncLogContext({ sessionId: String(chatId) });\n\n    if (Array.isArray(attachments)) {\n      const maxDataChars = maxBase64CharsForBinary(MAX_WEBCHAT_ATTACHMENT_FILE_BYTES);\n      for (const a of attachments) {\n        if (!a || typeof a !== 'object') continue;\n        const data = (a as { data?: unknown }).data;\n        if (typeof data === 'string' && data.length > maxDataChars) {\n          return c.json(\n            {\n              ok: false,\n              error: {\n                code: 'BAD_REQUEST',\n                message: `Attachment exceeds maximum size (${MAX_WEBCHAT_ATTACHMENT_FILE_BYTES} bytes)`,\n              },\n            },\n            400,\n          );\n        }\n      }\n    }\n\n    const accept = c.req.header('Accept') || '';\n    const wantSSE = accept.includes('text/event-stream');\n\n    const clientAbort = new AbortController();\n    const raw = c.req.raw;\n    // Keep webchat runs alive across transient disconnects (page refresh / tab route switch)\n    // so the client can reattach via /api/agent/resume using runId from `status`.\n    // Explicit cancellation still goes through /api/agent/abort.\n    if (channel !== 'webchat') {\n      if (raw.signal.aborted) {\n        clientAbort.abort();\n      } else {\n        raw.signal.addEventListener('abort', () => clientAbort.abort(), { once: true });\n      }\n    }\n\n    // --- Non-streaming fallback: collect everything, return JSON ---\n    if (!wantSSE) {\n      let jsonSessionKey: string | undefined;\n      if (channel === 'webchat') {\n        const cfg = service.currentConfig;\n        const parsedKey = parseSessionKey(chatId);\n        jsonSessionKey = parsedKey\n          ? chatId\n          : buildSessionKey({\n              agentId: getDefaultAgentId(cfg),\n              source: 'webchat',\n              accountId: 'default',\n              peerKind: 'direct',\n              peerId: chatId,\n            });\n      }\n\n      const generator = service.runAgent(message, channel, chatId, attachments, thinking, {\n        signal: clientAbort.signal,\n        ...(clientCreatedAtMs !== undefined ? { clientCreatedAtMs } : {}),\n      });\n      try {\n        let finalResult: { status: string; summary: string } | undefined;\n        const tokens: string[] = [];\n\n        while (true) {\n          const { done, value } = await generator.next();\n          if (done) {\n            finalResult = value as { status: string; summary: string };\n            break;\n          }\n          const chunk = value as { type: string; content?: string; status?: string; runId?: string };\n          if (chunk.type === 'token' && chunk.content) {\n            tokens.push(chunk.content);\n          }\n        }\n\n        return c.json({\n          ok: true,\n          payload: {\n            ...finalResult,\n            content: tokens.join(''),\n            ...(jsonSessionKey !== undefined\n              ? { sessionKey: jsonSessionKey, key: jsonSessionKey }\n              : {}),\n          },\n        });\n      } catch (error) {\n        log.error({ err: error }, 'Agent run failed (JSON mode)');\n        return c.json({\n          ok: false,\n          error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n        }, 500);\n      }\n    }\n\n    // --- SSE streaming ---\n    c.header('X-Accel-Buffering', 'no');\n    return streamSSE(c, async (stream) => {\n      if (channel !== 'webchat') {\n        stream.onAbort(() => {\n          clientAbort.abort();\n        });\n      }\n\n      const generator = service.runAgent(message, channel, chatId, attachments, thinking, {\n        signal: clientAbort.signal,\n        ...(clientCreatedAtMs !== undefined ? { clientCreatedAtMs } : {}),\n      });\n\n      let eventId = 0;\n\n      try {\n        while (true) {\n          const { done, value } = await generator.next();\n\n          if (done) {\n            // Final result\n            await stream.writeSSE({\n              id: String(++eventId),\n              event: 'result',\n              data: JSON.stringify({ ok: true, payload: value }),\n            });\n            break;\n          }\n\n          const chunk = value as { type: string; content?: string; status?: string; runId?: string };\n\n          // Intermediate events: status / token / error\n          await stream.writeSSE({\n            id: String(++eventId),\n            event: chunk.type || 'message',\n            data: stringifySSEData(chunk),\n          });\n        }\n      } catch (error) {\n        log.error({ err: error }, 'Agent run failed (SSE mode)');\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'error',\n          data: JSON.stringify({\n            ok: false,\n            error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n          }),\n        });\n      }\n    });\n  };\n}\n\n/**\n * POST /api/agent/resume — Re-attach to an in-progress agent run via SSE.\n *\n * Request body: { runId, chatId }\n * The relay replays all buffered events from the beginning and then live-tails\n * until the run completes.\n *\n * SSE events are identical to those from POST /api/agent.\n */\nexport function createAgentResumeHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => null);\n    if (!body || typeof body !== 'object') {\n      return c.json({ ok: false, error: { code: 'BAD_REQUEST', message: 'Invalid JSON body' } }, 400);\n    }\n\n    const { runId, chatId: resumeChatId } = body as { runId?: string; chatId?: string };\n    if (typeof resumeChatId === 'string' && resumeChatId.trim()) {\n      updateAsyncLogContext({ sessionId: resumeChatId.trim() });\n    }\n    if (!runId || typeof runId !== 'string') {\n      return c.json({ ok: false, error: { code: 'BAD_REQUEST', message: 'Missing required field: runId' } }, 400);\n    }\n\n    if (!service.runRelay.hasRun(runId)) {\n      return c.json({ ok: false, error: { code: 'NOT_FOUND', message: 'Run not found or already expired' } }, 404);\n    }\n\n    c.header('X-Accel-Buffering', 'no');\n    return streamSSE(c, async (stream) => {\n      let eventId = 0;\n      try {\n        for await (const event of service.runRelay.subscribe(runId)) {\n          await stream.writeSSE({\n            id: String(++eventId),\n            event: event.type || 'message',\n            data: stringifySSEData(event),\n          });\n        }\n        // Run completed — send a final result event\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'result',\n          data: JSON.stringify({ ok: true, payload: { status: 'ok', summary: 'Resumed run completed' } }),\n        });\n      } catch (error) {\n        log.error({ err: error, runId }, 'Resume stream failed');\n        await stream.writeSSE({\n          id: String(++eventId),\n          event: 'error',\n          data: JSON.stringify({\n            ok: false,\n            error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' },\n          }),\n        });\n      }\n    });\n  };\n}\n\n/**\n * POST /api/send — Send a message through a channel (non-streaming).\n */\nexport function createSendHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n\n  return async (c: Context) => {\n    const body = await c.req.json().catch(() => ({}));\n    const channel = body.channel as string;\n    const chatId = body.chatId as string;\n    const content = body.content as string;\n\n    if (!channel || !chatId || !content) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing required fields: channel, chatId, content' } },\n        400,\n      );\n    }\n\n    updateAsyncLogContext({ sessionId: String(chatId) });\n\n    try {\n      const result = await service.sendMessage(channel, chatId, content);\n      return c.json({ ok: true, payload: result });\n    } catch (error) {\n      log.error({ err: error }, 'Send failed');\n      return c.json(\n        { ok: false, error: { code: 'INTERNAL_ERROR', message: error instanceof Error ? error.message : 'Unknown error' } },\n        500,\n      );\n    }\n  };\n}\n\n/**\n * GET /api/events — Server-pushed event stream (SSE).\n *\n * The client opens this long-lived connection to receive:\n *   - channel status changes\n *   - config reload notifications\n *   - cron execution results\n *   - any other server-initiated events\n *\n * Supports Last-Event-ID for reconnection.\n * Enforces maximum connection limit to prevent DoS.\n */\nexport function createEventsSSEHandler(config: SSEHandlerConfig) {\n  const { service } = config;\n  const maxConnections = config.maxSseConnections ?? 100;\n\n  return async (c: Context) => {\n    // Check maximum connections limit\n    if (activeConnections.size >= maxConnections) {\n      log.warn({ current: activeConnections.size, max: maxConnections }, 'SSE connection limit reached');\n      return c.json({\n        ok: false,\n        error: { code: 'TOO_MANY_CONNECTIONS', message: 'Maximum SSE connections exceeded' }\n      }, 503);\n    }\n\n    const lastEventId = c.req.header('Last-Event-ID') || undefined;\n    const sessionId = c.req.header('X-Session-Id')\n      || c.req.query('sessionId')\n      || crypto.randomUUID();\n\n    updateAsyncLogContext({ sessionId: String(sessionId) });\n\n    const abortController = new AbortController();\n    activeConnections.set(sessionId, abortController);\n\n    return streamSSE(c, async (stream) => {\n      let aborted = false;\n\n      // Send a hello event so the client knows the stream is established\n      await stream.writeSSE({\n        id: '0',\n        event: 'connected',\n        data: JSON.stringify({ sessionId }),\n      });\n\n      // Subscribe to service events\n      const cleanup = service.subscribe(sessionId, async (event) => {\n        if (aborted) return;\n        try {\n          await stream.writeSSE({\n            id: event.id,\n            event: event.type,\n            data: JSON.stringify(event.payload),\n          });\n        } catch {\n          // Stream closed, will be cleaned up by onAbort\n        }\n      });\n\n      // Replay missed events on reconnect\n      if (lastEventId) {\n        const missed = service.getEventsSince(sessionId, lastEventId);\n        for (const event of missed) {\n          await stream.writeSSE({\n            id: event.id,\n            event: event.type,\n            data: JSON.stringify(event.payload),\n          });\n        }\n      }\n\n      // Keep alive with periodic comments (every 30s)\n      const keepAlive = setInterval(async () => {\n        if (aborted) { clearInterval(keepAlive); return; }\n        try {\n          await stream.writeSSE({ event: 'ping', data: '' });\n        } catch {\n          clearInterval(keepAlive);\n        }\n      }, 30_000);\n\n      // Block until aborted — streamSSE closes when the callback returns\n      await new Promise<void>((resolve) => {\n        stream.onAbort(() => {\n          aborted = true;\n          clearInterval(keepAlive);\n          cleanup();\n          activeConnections.delete(sessionId);\n          log.debug({ sessionId }, 'Event stream disconnected');\n          resolve();\n        });\n      });\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;aAK4E;kBAEI;oBACb;AAEnE,MAAM,MAAM,aAAa,WAAW;AAGpC,MAAM,oCAAoB,IAAI,KAA8B;AA4B5D,SAAS,oBAAoB,MAAyC;AACpE,KAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;CAC9C,MAAM,IAAI;CAEV,MAAM,aAAa,OAAO,EAAE,YAAY;CACxC,MAAM,iBAAiB,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,YAAY,SAAS;AAC9E,QAAO,cAAc;;;AAIvB,SAAS,wBAAwB,gBAAgC;AAC/D,QAAO,IAAI,KAAK,KAAK,iBAAiB,EAAE;;;;;;;;;;;;;;;;;AAkB1C,SAAgB,sBAAsB,QAA0B;CAC9D,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAGjD,MAAI,CAAC,oBAAoB,KAAK,CAC5B,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,OAAO;IAAE,MAAM;IAAe,SAAS;IAAkD;GAC1F,EAAE,IAAI;EAGT,MAAM,EAAE,SAAS,UAAU,WAAW,aAAa,aAAa;EAChE,MAAM,oBACJ,OAAO,KAAK,sBAAsB,YAAY,OAAO,SAAS,KAAK,kBAAkB,GACjF,KAAK,oBACL,KAAA;EACN,MAAM,aAAa,QAAQ,KAAK,WAAW;EAC3C,IAAI,SAAS;AACb,MAAI,cAAc,YAAY,UAC5B,UAAS,QAAQ,YAAY;OACxB;GACL,MAAM,KAAK,OAAO,KAAK,eAAe,YAAY,KAAK,WAAW,MAAM,GAAG,KAAK,WAAW,MAAM,GAAG;GACpG,MAAM,MAAM,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG;GACzF,MAAM,YAAY,MAAM,OAAO;AAG/B,OAAI,cAAc,aAAa,CAAC,wCAAwC,KAAK,UAAU,EAAE;AACvF,QAAI,KAAK,EAAE,WAAW,UAAU,MAAM,GAAG,GAAG,EAAE,EAAE,iCAAiC;AACjF,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,OAAO;MAAE,MAAM;MAAe,SAAS;MAA8B;KACtE,EAAE,IAAI;;AAET,YAAS;;AAGX,wBAAsB,EAAE,WAAW,OAAO,OAAO,EAAE,CAAC;AAEpD,MAAI,MAAM,QAAQ,YAAY,EAAE;GAC9B,MAAM,eAAe,wBAAwB,kCAAkC;AAC/E,QAAK,MAAM,KAAK,aAAa;AAC3B,QAAI,CAAC,KAAK,OAAO,MAAM,SAAU;IACjC,MAAM,OAAQ,EAAyB;AACvC,QAAI,OAAO,SAAS,YAAY,KAAK,SAAS,aAC5C,QAAO,EAAE,KACP;KACE,IAAI;KACJ,OAAO;MACL,MAAM;MACN,SAAS,oCAAoC,kCAAkC;MAChF;KACF,EACD,IACD;;;EAMP,MAAM,WADS,EAAE,IAAI,OAAO,SAAS,IAAI,IAClB,SAAS,oBAAoB;EAEpD,MAAM,cAAc,IAAI,iBAAiB;EACzC,MAAM,MAAM,EAAE,IAAI;AAIlB,MAAI,YAAY,UACd,KAAI,IAAI,OAAO,QACb,aAAY,OAAO;MAEnB,KAAI,OAAO,iBAAiB,eAAe,YAAY,OAAO,EAAE,EAAE,MAAM,MAAM,CAAC;AAKnF,MAAI,CAAC,SAAS;GACZ,IAAI;AACJ,OAAI,YAAY,WAAW;IACzB,MAAM,MAAM,QAAQ;AAEpB,qBADkB,gBAAgB,OACR,GACtB,SACA,gBAAgB;KACd,SAAS,kBAAkB,IAAI;KAC/B,QAAQ;KACR,WAAW;KACX,UAAU;KACV,QAAQ;KACT,CAAC;;GAGR,MAAM,YAAY,QAAQ,SAAS,SAAS,SAAS,QAAQ,aAAa,UAAU;IAClF,QAAQ,YAAY;IACpB,GAAI,sBAAsB,KAAA,IAAY,EAAE,mBAAmB,GAAG,EAAE;IACjE,CAAC;AACF,OAAI;IACF,IAAI;IACJ,MAAM,SAAmB,EAAE;AAE3B,WAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,UAAU,MAAM;AAC9C,SAAI,MAAM;AACR,oBAAc;AACd;;KAEF,MAAM,QAAQ;AACd,SAAI,MAAM,SAAS,WAAW,MAAM,QAClC,QAAO,KAAK,MAAM,QAAQ;;AAI9B,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,SAAS;MACP,GAAG;MACH,SAAS,OAAO,KAAK,GAAG;MACxB,GAAI,mBAAmB,KAAA,IACnB;OAAE,YAAY;OAAgB,KAAK;OAAgB,GACnD,EAAE;MACP;KACF,CAAC;YACK,OAAO;AACd,QAAI,MAAM,EAAE,KAAK,OAAO,EAAE,+BAA+B;AACzD,WAAO,EAAE,KAAK;KACZ,IAAI;KACJ,OAAO;MAAE,MAAM;MAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;MAAiB;KACrG,EAAE,IAAI;;;AAKX,IAAE,OAAO,qBAAqB,KAAK;AACnC,SAAO,UAAU,GAAG,OAAO,WAAW;AACpC,OAAI,YAAY,UACd,QAAO,cAAc;AACnB,gBAAY,OAAO;KACnB;GAGJ,MAAM,YAAY,QAAQ,SAAS,SAAS,SAAS,QAAQ,aAAa,UAAU;IAClF,QAAQ,YAAY;IACpB,GAAI,sBAAsB,KAAA,IAAY,EAAE,mBAAmB,GAAG,EAAE;IACjE,CAAC;GAEF,IAAI,UAAU;AAEd,OAAI;AACF,WAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,UAAU,MAAM;AAE9C,SAAI,MAAM;AAER,YAAM,OAAO,SAAS;OACpB,IAAI,OAAO,EAAE,QAAQ;OACrB,OAAO;OACP,MAAM,KAAK,UAAU;QAAE,IAAI;QAAM,SAAS;QAAO,CAAC;OACnD,CAAC;AACF;;KAGF,MAAM,QAAQ;AAGd,WAAM,OAAO,SAAS;MACpB,IAAI,OAAO,EAAE,QAAQ;MACrB,OAAO,MAAM,QAAQ;MACrB,MAAM,iBAAiB,MAAM;MAC9B,CAAC;;YAEG,OAAO;AACd,QAAI,MAAM,EAAE,KAAK,OAAO,EAAE,8BAA8B;AACxD,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MACnB,IAAI;MACJ,OAAO;OAAE,MAAM;OAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;OAAiB;MACrG,CAAC;KACH,CAAC;;IAEJ;;;;;;;;;;;;AAaN,SAAgB,yBAAyB,QAA0B;CACjE,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqB;GAAE,EAAE,IAAI;EAGjG,MAAM,EAAE,OAAO,QAAQ,iBAAiB;AACxC,MAAI,OAAO,iBAAiB,YAAY,aAAa,MAAM,CACzD,uBAAsB,EAAE,WAAW,aAAa,MAAM,EAAE,CAAC;AAE3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAiC;GAAE,EAAE,IAAI;AAG7G,MAAI,CAAC,QAAQ,SAAS,OAAO,MAAM,CACjC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAAoC;GAAE,EAAE,IAAI;AAG9G,IAAE,OAAO,qBAAqB,KAAK;AACnC,SAAO,UAAU,GAAG,OAAO,WAAW;GACpC,IAAI,UAAU;AACd,OAAI;AACF,eAAW,MAAM,SAAS,QAAQ,SAAS,UAAU,MAAM,CACzD,OAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO,MAAM,QAAQ;KACrB,MAAM,iBAAiB,MAAM;KAC9B,CAAC;AAGJ,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MAAE,IAAI;MAAM,SAAS;OAAE,QAAQ;OAAM,SAAS;OAAyB;MAAE,CAAC;KAChG,CAAC;YACK,OAAO;AACd,QAAI,MAAM;KAAE,KAAK;KAAO;KAAO,EAAE,uBAAuB;AACxD,UAAM,OAAO,SAAS;KACpB,IAAI,OAAO,EAAE,QAAQ;KACrB,OAAO;KACP,MAAM,KAAK,UAAU;MACnB,IAAI;MACJ,OAAO;OAAE,MAAM;OAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;OAAiB;MACrG,CAAC;KACH,CAAC;;IAEJ;;;;;;AAON,SAAgB,kBAAkB,QAA0B;CAC1D,MAAM,EAAE,YAAY;AAEpB,QAAO,OAAO,MAAe;EAC3B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,KAAK;EACrB,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU,KAAK;AAErB,MAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAC1B,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqD;GAAE,EAC3G,IACD;AAGH,wBAAsB,EAAE,WAAW,OAAO,OAAO,EAAE,CAAC;AAEpD,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,YAAY,SAAS,QAAQ,QAAQ;AAClE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,SAAS;IAAQ,CAAC;WACrC,OAAO;AACd,OAAI,MAAM,EAAE,KAAK,OAAO,EAAE,cAAc;AACxC,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO;KAAE,MAAM;KAAkB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;KAAiB;IAAE,EACnH,IACD;;;;;;;;;;;;;;;;AAiBP,SAAgB,uBAAuB,QAA0B;CAC/D,MAAM,EAAE,YAAY;CACpB,MAAM,iBAAiB,OAAO,qBAAqB;AAEnD,QAAO,OAAO,MAAe;AAE3B,MAAI,kBAAkB,QAAQ,gBAAgB;AAC5C,OAAI,KAAK;IAAE,SAAS,kBAAkB;IAAM,KAAK;IAAgB,EAAE,+BAA+B;AAClG,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO;KAAE,MAAM;KAAwB,SAAS;KAAoC;IACrF,EAAE,IAAI;;EAGT,MAAM,cAAc,EAAE,IAAI,OAAO,gBAAgB,IAAI,KAAA;EACrD,MAAM,YAAY,EAAE,IAAI,OAAO,eAAe,IACzC,EAAE,IAAI,MAAM,YAAY,IACxB,OAAO,YAAY;AAExB,wBAAsB,EAAE,WAAW,OAAO,UAAU,EAAE,CAAC;EAEvD,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,oBAAkB,IAAI,WAAW,gBAAgB;AAEjD,SAAO,UAAU,GAAG,OAAO,WAAW;GACpC,IAAI,UAAU;AAGd,SAAM,OAAO,SAAS;IACpB,IAAI;IACJ,OAAO;IACP,MAAM,KAAK,UAAU,EAAE,WAAW,CAAC;IACpC,CAAC;GAGF,MAAM,UAAU,QAAQ,UAAU,WAAW,OAAO,UAAU;AAC5D,QAAI,QAAS;AACb,QAAI;AACF,WAAM,OAAO,SAAS;MACpB,IAAI,MAAM;MACV,OAAO,MAAM;MACb,MAAM,KAAK,UAAU,MAAM,QAAQ;MACpC,CAAC;YACI;KAGR;AAGF,OAAI,aAAa;IACf,MAAM,SAAS,QAAQ,eAAe,WAAW,YAAY;AAC7D,SAAK,MAAM,SAAS,OAClB,OAAM,OAAO,SAAS;KACpB,IAAI,MAAM;KACV,OAAO,MAAM;KACb,MAAM,KAAK,UAAU,MAAM,QAAQ;KACpC,CAAC;;GAKN,MAAM,YAAY,YAAY,YAAY;AACxC,QAAI,SAAS;AAAE,mBAAc,UAAU;AAAE;;AACzC,QAAI;AACF,WAAM,OAAO,SAAS;MAAE,OAAO;MAAQ,MAAM;MAAI,CAAC;YAC5C;AACN,mBAAc,UAAU;;MAEzB,IAAO;AAGV,SAAM,IAAI,SAAe,YAAY;AACnC,WAAO,cAAc;AACnB,eAAU;AACV,mBAAc,UAAU;AACxB,cAAS;AACT,uBAAkB,OAAO,UAAU;AACnC,SAAI,MAAM,EAAE,WAAW,EAAE,4BAA4B;AACrD,cAAS;MACT;KACF;IACF"}

package/dist/src/gateway/index.d.ts

@@ -12,4 +12,4 @@ export { isLoopbackHost, isAllInterfacesHost, buildDefaultCorsOrigins, resolveEf
 export { resolveGatewayListenHost, resolveGatewayListenPlan, } from './listen.js';
 export { resolveGatewayBindMode, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayEffectiveHost, defaultGatewayBindMode, isContainerEnvironment, } from '../config/gateway-bind.js';
 export { isSecureWebSocketUrl, assertSecureWebSocketUrl, assertSecureGatewayHttpUrl, isInsecurePrivateWsAllowed, } from './ws-security.js';
-export { isGatewayStrictSecurityEnabled, buildBrowserOriginRateLimitKey, resolveAuthRateLimitTracking, resetAuthRateLimitersForTests, } from './auth-rate-limit.js';
+export { isGatewayStrictSecurityEnabled, buckets } from './rate-limit/index.js';

package/dist/src/gateway/index.js

@@ -1,8 +1,10 @@
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
-import { buildBrowserOriginRateLimitKey, isGatewayStrictSecurityEnabled, resetAuthRateLimitersForTests, resolveAuthRateLimitTracking } from "./auth-rate-limit.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
+import { buckets } from "./rate-limit/buckets.js";
+import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";
@@ -15,4 +17,4 @@ import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofO
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
-export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buildBrowserOriginRateLimitKey, buildDefaultCorsOrigins, checkPortAvailable, createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createHonoApp, createSendHandler, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resetAuthRateLimitersForTests, resolveAuthRateLimitTracking, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };
+export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buckets, buildDefaultCorsOrigins, checkPortAvailable, createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createHonoApp, createSendHandler, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/lock.js

@@ -1,9 +1,9 @@
-import path from "node:path";
-import fsSync from "node:fs";
 import { createHash } from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
-import net from "node:net";
+import path from "node:path";
 import { homedir } from "os";
+import net from "node:net";
 //#region src/gateway/lock.ts
 /**
 * Gateway Lock - Prevents multiple gateway instances from running simultaneously

package/dist/src/gateway/rate-limit/auth-policy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Auth-failure rate-limit policy: how to derive a tracking key from a request,
+ * and whether a given client should be exempted before counting.
+ *
+ * The {@link FailureLimiter} primitive is intentionally policy-free — this
+ * module is the only place that knows about IPs, browser origins, and the
+ * loopback exemption. Adding a new exemption rule (e.g. private CIDRs) means
+ * editing this file alone; the limiter primitive does not change.
+ */
+export type AuthRateLimitPolicyConfig = {
+    enabled: boolean;
+    exemptLoopback: boolean;
+};
+/**
+ * `key` is `''` when `exempt` is true. We use a flat shape rather than a
+ * tagged union because the project's tsconfig has `strict: false`, which
+ * disables boolean-discriminator narrowing.
+ */
+export type AuthRateLimitTracking = {
+    exempt: boolean;
+    key: string;
+};
+/**
+ * Decide whether to track this client and, if so, what key identifies them.
+ * Browser clients are tracked separately (origin + IP) so a rogue `<iframe>`
+ * cannot piggyback on a CLI client's bucket and DoS it.
+ */
+export declare function resolveAuthTracking(params: {
+    clientIp: string;
+    origin?: string | null;
+    cfg: AuthRateLimitPolicyConfig;
+}): AuthRateLimitTracking;
+/** Browser-tracking key format. Stable across reloads — survives state replay. */
+export declare function buildBrowserOriginKey(origin: string, clientIp: string): string;

package/dist/src/gateway/rate-limit/auth-policy.js

@@ -0,0 +1,49 @@
+import { isLoopbackClientIp, isLoopbackEmbeddedBrowserClient } from "../security/loopback.js";
+//#region src/gateway/rate-limit/auth-policy.ts
+/**
+* Auth-failure rate-limit policy: how to derive a tracking key from a request,
+* and whether a given client should be exempted before counting.
+*
+* The {@link FailureLimiter} primitive is intentionally policy-free — this
+* module is the only place that knows about IPs, browser origins, and the
+* loopback exemption. Adding a new exemption rule (e.g. private CIDRs) means
+* editing this file alone; the limiter primitive does not change.
+*/
+/**
+* Decide whether to track this client and, if so, what key identifies them.
+* Browser clients are tracked separately (origin + IP) so a rogue `<iframe>`
+* cannot piggyback on a CLI client's bucket and DoS it.
+*/
+function resolveAuthTracking(params) {
+	if (!params.cfg.enabled) return {
+		exempt: true,
+		key: ""
+	};
+	const origin = params.origin?.trim();
+	if (origin) {
+		if (isLoopbackEmbeddedBrowserClient(origin, params.clientIp) && params.cfg.exemptLoopback) return {
+			exempt: true,
+			key: ""
+		};
+		return {
+			exempt: false,
+			key: buildBrowserOriginKey(origin, params.clientIp)
+		};
+	}
+	if (params.cfg.exemptLoopback && isLoopbackClientIp(params.clientIp)) return {
+		exempt: true,
+		key: ""
+	};
+	return {
+		exempt: false,
+		key: params.clientIp
+	};
+}
+/** Browser-tracking key format. Stable across reloads — survives state replay. */
+function buildBrowserOriginKey(origin, clientIp) {
+	return `browser-origin:${origin.trim().toLowerCase()}|${clientIp.trim()}`;
+}
+//#endregion
+export { buildBrowserOriginKey, resolveAuthTracking };
+
+//# sourceMappingURL=auth-policy.js.map

package/dist/src/gateway/rate-limit/auth-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.js","names":[],"sources":["../../../../src/gateway/rate-limit/auth-policy.ts"],"sourcesContent":["/**\n * Auth-failure rate-limit policy: how to derive a tracking key from a request,\n * and whether a given client should be exempted before counting.\n *\n * The {@link FailureLimiter} primitive is intentionally policy-free — this\n * module is the only place that knows about IPs, browser origins, and the\n * loopback exemption. Adding a new exemption rule (e.g. private CIDRs) means\n * editing this file alone; the limiter primitive does not change.\n */\n\nimport {\n  isLoopbackClientIp,\n  isLoopbackEmbeddedBrowserClient,\n} from '../security/loopback.js';\n\nexport type AuthRateLimitPolicyConfig = {\n  enabled: boolean;\n  exemptLoopback: boolean;\n};\n\n/**\n * `key` is `''` when `exempt` is true. We use a flat shape rather than a\n * tagged union because the project's tsconfig has `strict: false`, which\n * disables boolean-discriminator narrowing.\n */\nexport type AuthRateLimitTracking = {\n  exempt: boolean;\n  key: string;\n};\n\n/**\n * Decide whether to track this client and, if so, what key identifies them.\n * Browser clients are tracked separately (origin + IP) so a rogue `<iframe>`\n * cannot piggyback on a CLI client's bucket and DoS it.\n */\nexport function resolveAuthTracking(params: {\n  clientIp: string;\n  origin?: string | null;\n  cfg: AuthRateLimitPolicyConfig;\n}): AuthRateLimitTracking {\n  if (!params.cfg.enabled) return { exempt: true, key: '' };\n\n  const origin = params.origin?.trim();\n  if (origin) {\n    const isLocal = isLoopbackEmbeddedBrowserClient(origin, params.clientIp);\n    if (isLocal && params.cfg.exemptLoopback) return { exempt: true, key: '' };\n    return {\n      exempt: false,\n      key: buildBrowserOriginKey(origin, params.clientIp),\n    };\n  }\n\n  if (params.cfg.exemptLoopback && isLoopbackClientIp(params.clientIp)) {\n    return { exempt: true, key: '' };\n  }\n  return { exempt: false, key: params.clientIp };\n}\n\n/** Browser-tracking key format. Stable across reloads — survives state replay. */\nexport function buildBrowserOriginKey(origin: string, clientIp: string): string {\n  return `browser-origin:${origin.trim().toLowerCase()}|${clientIp.trim()}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmCA,SAAgB,oBAAoB,QAIV;AACxB,KAAI,CAAC,OAAO,IAAI,QAAS,QAAO;EAAE,QAAQ;EAAM,KAAK;EAAI;CAEzD,MAAM,SAAS,OAAO,QAAQ,MAAM;AACpC,KAAI,QAAQ;AAEV,MADgB,gCAAgC,QAAQ,OAAO,SACpD,IAAI,OAAO,IAAI,eAAgB,QAAO;GAAE,QAAQ;GAAM,KAAK;GAAI;AAC1E,SAAO;GACL,QAAQ;GACR,KAAK,sBAAsB,QAAQ,OAAO,SAAS;GACpD;;AAGH,KAAI,OAAO,IAAI,kBAAkB,mBAAmB,OAAO,SAAS,CAClE,QAAO;EAAE,QAAQ;EAAM,KAAK;EAAI;AAElC,QAAO;EAAE,QAAQ;EAAO,KAAK,OAAO;EAAU;;;AAIhD,SAAgB,sBAAsB,QAAgB,UAA0B;AAC9E,QAAO,kBAAkB,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,SAAS,MAAM"}