import { a as createLazyRuntimeSurface, n as createLazyRuntimeMethodBinder, r as createLazyRuntimeModule, t as createLazyRuntimeMethod } from "./lazy-runtime-CgCh8H_K.js";
import { n as getRuntimeConfig } from "./io.runtime-B9iJRs3w.js";
import { c as resolveAgentConfig, m as resolveAgentWorkspaceDir, u as resolveAgentDir, y as resolveDefaultAgentId } from "./agent-scope-config-DcbEhP0R.js";
import { r as normalizeLogLevel } from "./levels-qpAN12Fm.js";
import { a as getChildLogger, c as isFileLogLevelEnabled } from "./logger-DK-iouVT.js";
import { t as VERSION } from "./version-v1kuAkGj.js";
import { a as expandToolGroups, c as normalizeToolPolicyName, u as resolveToolProfilePolicy } from "./tool-policy-shared-DIyS0iQC.js";
import { a as isToolAllowedByPolicies } from "./tool-policy-match-TnFxBs5z.js";
import { l as mergeAlsoAllowPolicy } from "./tool-policy-Wi0C45cX.js";
import { o as resolveSessionStorePathCore } from "./paths-CXdaYWF_.js";
import { i as buildModelAliasIndex, r as buildConfiguredModelCatalog, y as resolveModelRefFromString } from "./model-selection-shared-BlLyx1r2.js";
import { n as DEFAULT_MODEL, r as DEFAULT_PROVIDER } from "./defaults-CdX9UGcX.js";
import "./agent-scope-DbtJyKUL.js";
import { t as resolveDefaultModelForAgent } from "./model-selection-config-BrdmmqKD.js";
import { s as normalizeThinkLevel } from "./thinking.shared-bHYuuc1L.js";
import "./config-Cs0XXL3x.js";
import { i as shouldLogVerbose } from "./globals-CTaGxEqj.js";
import { d as onAgentEvent } from "./agent-events-CoxiItUi.js";
import { a as getPluginRuntimeGatewayRequestScope } from "./gateway-request-scope-BCMYlsDI.js";
import { o as mediaKindFromMime } from "./constants-DUxuqQz8.js";
import { n as detectMime } from "./mime-CVpcq9ju.js";
import { m as createRuntimeBase } from "./loader-DPiOPJjR.js";
import { c as normalizeDeliveryContext } from "./delivery-context.shared-CXmRgetN.js";
import "./logging-DB4bVraC.js";
import { c as getImageMetadata, p as resizeToJpeg } from "./image-ops-DU1SIRgh.js";
import { xt as updateSessionEntry } from "./session-accessor-YsytfDtG.js";
import { a as listSessionEntriesReadOnly, d as patchSessionEntryCore, h as replaceSessionEntry, u as loadSessionEntryReadOnly } from "./session-accessor.sqlite-entry-CWk3jL7s.js";
import { H as createSessionInitialization, V as captureSessionInitializationOwner } from "./session-accessor.sqlite-entry-store-BxYl0nro.js";
import { h as runExclusiveSessionLifecycleMutation, m as isSessionWorkAdmissionActive, n as beginSessionWorkAdmission } from "./session-lifecycle-admission-CS8v45tk.js";
import { i as onSessionTranscriptUpdate } from "./transcript-events-wgPr4ILk.js";
import { m as normalizeResolvedMaintenanceConfigInput } from "./disk-budget-BsDSCUGD.js";
import { t as listSessionEntriesCore } from "./session-accessor.entry-CQ2WPpfn.js";
import { a as rollbackAgentHarnessSessionEntryLifecycle, o as rollbackPluginOwnedSessionEntryLifecycle, r as deleteSessionEntryLifecycle } from "./session-accessor.sqlite-lifecycle-DBhNICvK.js";
import { c as resolveThinkingProfile } from "./thinking-DterdXhr.js";
import { o as resolveEffectiveAgentRuntime, t as concretizeAgentRuntime } from "./thinking-runtime-BiFbTVdI.js";
import { p as ensureAgentWorkspace } from "./workspace-ConDEamr.js";
import { t as resolveAllowedModelRefCore } from "./model-selection-resolve-DJs652CE.js";
import "./media-services-By-i0Drw.js";
import "./model-selection-di2kjKCB.js";
import { n as resolveThinkingDefault } from "./model-thinking-default-1g_x1V4J.js";
import { G as createManagedTaskFlow, Q as finishFlow, Y as failFlow, ct as resumeFlow, k as listTasksForFlowId, lt as setFlowWaiting, ot as requestFlowCancel } from "./task-registry-BP9SCk1B.js";
import "./runtime-internal-CdH7E8By.js";
import { _ as getTaskFlowByIdForOwner, d as getFlowTaskSummary, g as findLatestTaskFlowForOwner, p as runTaskInFlowForOwner, r as cancelFlowByIdForOwner, t as cancelDetachedTaskRunById, v as listTaskFlowsForOwner, y as resolveTaskFlowForLookupTokenForOwner } from "./task-executor-DHGV4r6b.js";
import { n as summarizeTaskRecords } from "./task-registry.summary-BwpoHlXv.js";
import { n as resolveAgentTimeoutMs } from "./timeout-Dm7mxETK.js";
import { f as resolveSessionWorkStartError, o as createSessionWorkStartChangedError } from "./lifecycle-BaroCBMc.js";
import { n as resolveAgentIdentity } from "./identity-L3YWE18q.js";
import { a as resolveSubagentToolPolicyForSession, i as resolveInheritedToolPolicyForSession, n as resolveEffectiveToolPolicy } from "./agent-tools.policy-NF_9Y4S4.js";
import { v as normalizeExecTarget } from "./exec-approvals-policy-CCFUzTzd.js";
import { i as resolveSandboxConfigForAgent } from "./config-RoLkL_H5.js";
import { n as resolveSandboxRuntimeStatus } from "./runtime-status-6c8Jb1Kg.js";
import "./exec-approvals-BSZ-fPIY.js";
import { a as listRuntimeMusicGenerationProviders, i as generateMusic } from "./openclaw-tools-CNOZOjlX.js";
import { a as getTaskByIdForOwner, o as listTasksForRelatedSessionKeyForOwner, r as findLatestTaskForRelatedSessionKeyForOwner, s as resolveTaskForLookupTokenForOwner } from "./task-owner-access-DYB7AnKI.js";
import { o as resolveEffectiveSessionToolsVisibility } from "./session-visibility-DNhpZ_1f.js";
import { n as resolveSessionModelRef } from "./session-model-ref-CPZiclLt.js";
import { n as loadWebMedia } from "./web-media-C9Ri3Aft.js";
import { n as listRuntimeImageGenerationProviders, t as generateImage } from "./runtime-Dyvgun2q.js";
import { n as listRuntimeVideoGenerationProviders, t as generateVideo } from "./runtime-CqR0MR1N.js";
import { i as listWebSearchProviders, o as runWebSearch } from "./runtime-CPS9j3kB.js";
import { t as RequestScopedSubagentRuntimeError } from "./error-runtime-Bz9Tw57Z.js";
import { t as resolveEmbeddedCliBackendDispatchEligibility } from "./cli-backend-dispatch-eligibility-42vj_OnX.js";
import { t as createRuntimeChannel } from "./runtime-channel-CJ1pBOhz.js";
import { n as isVoiceMessageCompatibleAudio } from "./audio-BbEPwbmc.js";
import { isDeepStrictEqual } from "node:util";
//#region src/agents/sandbox/workspace-authority.ts
const WORKSPACE_CONFINED_SANDBOX_TOOLS = /* @__PURE__ */ new Set([
	"apply_patch",
	"edit",
	"exec",
	"view_image",
	"process",
	"read",
	"session_status",
	"sessions_history",
	"sessions_list",
	"sessions_search",
	"sessions_yield",
	"progress_card",
	"web_fetch",
	"web_search",
	"write"
]);
function findUnconfinedAllowedTool(policies, confinedToolNames) {
	const candidatePolicy = policies.filter((policy) => Boolean(policy?.allow?.length)).toSorted((left, right) => left.allow.length - right.allow.length)[0];
	if (!candidatePolicy?.allow?.length) return "unbounded allow policy";
	for (const entry of candidatePolicy.allow) for (const candidate of expandToolGroups([entry])) {
		const normalized = normalizeToolPolicyName(candidate);
		if (!isToolAllowedByPolicies(normalized, policies)) continue;
		if (WORKSPACE_CONFINED_SANDBOX_TOOLS.has(normalized) || confinedToolNames.has(normalized)) continue;
		return entry;
	}
}
function resolveWorkspaceToolPolicies(params) {
	const effective = resolveEffectiveToolPolicy({
		config: params.config,
		agentId: params.agentId,
		sessionKey: params.sessionKey,
		modelProvider: params.modelProvider,
		modelId: params.modelId
	});
	return [
		mergeAlsoAllowPolicy(resolveToolProfilePolicy(effective.profile), effective.profileAlsoAllow),
		mergeAlsoAllowPolicy(resolveToolProfilePolicy(effective.providerProfile), effective.providerProfileAlsoAllow),
		effective.globalPolicy,
		effective.globalProviderPolicy,
		effective.agentPolicy,
		effective.agentProviderPolicy,
		params.sandboxPolicy,
		resolveSubagentToolPolicyForSession(params.config, params.sessionKey),
		resolveInheritedToolPolicyForSession(params.config, params.sessionKey)
	];
}
function resolveWorkspaceAuthorityModel(params) {
	const selected = resolveSessionModelRef(params.config, params.sessionEntry, params.agentId);
	const explicitProvider = params.modelProvider?.trim();
	const explicitModel = params.modelId?.trim();
	if (!explicitModel) return {
		provider: explicitProvider ?? selected.provider,
		model: selected.model
	};
	const defaultProvider = explicitProvider ?? selected.provider;
	const raw = explicitProvider && !explicitModel.includes("/") ? `${explicitProvider}/${explicitModel}` : explicitModel;
	return resolveModelRefFromString({
		cfg: params.config,
		raw,
		defaultProvider,
		aliasIndex: buildModelAliasIndex({
			cfg: params.config,
			defaultProvider
		})
	})?.ref ?? {
		provider: defaultProvider,
		model: explicitModel
	};
}
function resolveSandboxWorkspaceAuthority(params) {
	const runtime = resolveSandboxRuntimeStatus({
		cfg: params.config,
		agentId: params.agentId,
		sessionKey: params.sessionKey
	});
	const sandbox = resolveSandboxConfigForAgent(params.config, runtime.agentId);
	if (!runtime.sandboxed) return {
		sandboxed: false,
		workspaceAccess: sandbox.workspaceAccess
	};
	const backend = sandbox.backend.trim().toLowerCase();
	let confinementError;
	if (backend !== "docker" && backend !== "podman") confinementError = "target sandbox backend does not provide local workspace confinement.";
	else if (runtime.sandboxRequired || sandbox.scope !== "session") confinementError = "target sandbox is not exclusive to this worker session.";
	else if (sandbox.docker.dangerouslyAllowExternalBindSources === true || sandbox.docker.dangerouslyAllowReservedContainerTargets === true || sandbox.docker.dangerouslyAllowContainerNamespaceJoin === true) confinementError = "target sandbox enables dangerous Docker isolation overrides.";
	else {
		const elevated = resolveAgentConfig(params.config, runtime.agentId)?.tools?.elevated;
		if (params.config.tools?.elevated?.enabled === true && elevated?.enabled !== false) confinementError = "target agent can request host-level elevated execution.";
		const rawSessionExecHost = params.sessionEntry?.execHost?.trim();
		const sessionExecHost = normalizeExecTarget(rawSessionExecHost);
		const execHost = sessionExecHost ?? resolveAgentConfig(params.config, runtime.agentId)?.tools?.exec?.host ?? params.config.tools?.exec?.host ?? "auto";
		if (!confinementError && rawSessionExecHost && !sessionExecHost) confinementError = "target session has an invalid shell execution override.";
		else if (!confinementError && (Boolean(params.sessionEntry?.execNode?.trim()) || execHost !== "auto" && execHost !== "sandbox")) confinementError = "target sandbox routes shell execution outside the sandbox.";
		else if (!confinementError && sandbox.browser.allowHostControl) confinementError = "target sandbox allows host browser control.";
		else if (!confinementError && ["agent", "all"].includes(resolveEffectiveSessionToolsVisibility({
			cfg: params.config,
			sandboxed: true
		}))) confinementError = "target sandbox allows access to host-wide sessions.";
		else if (!confinementError) {
			const model = resolveWorkspaceAuthorityModel({
				config: params.config,
				agentId: runtime.agentId,
				sessionEntry: params.sessionEntry,
				modelProvider: params.modelProvider,
				modelId: params.modelId
			});
			const policies = resolveWorkspaceToolPolicies({
				config: params.config,
				agentId: runtime.agentId,
				sessionKey: params.sessionKey,
				modelProvider: model.provider,
				modelId: model.model,
				sandboxPolicy: sandbox.tools
			});
			const unavailableTool = (params.requiredToolNames ?? []).map(normalizeToolPolicyName).find((name) => !isToolAllowedByPolicies(name, policies));
			if (unavailableTool) confinementError = `target tool policy blocks required tool ${unavailableTool}.`;
			else {
				const unsafeTool = findUnconfinedAllowedTool(policies, new Set((params.confinedToolNames ?? []).map(normalizeToolPolicyName)));
				if (unsafeTool) confinementError = `target sandbox allows unclassified tool surface ${unsafeTool}.`;
			}
		}
	}
	return {
		sandboxed: true,
		workspaceAccess: runtime.sandboxRequired ? runtime.workspaceAccess : sandbox.workspaceAccess,
		...confinementError ? { confinementError } : {}
	};
}
//#endregion
//#region src/plugins/runtime/runtime-agent-session-catalog.ts
/**
* Resolve a synchronous catalog create target through the same model/runtime
* policy used by agent turns, without making plugins import that policy graph.
*/
function resolveAgentCatalogCreateTarget(params) {
	const agentId = params.requestedAgentId ?? resolveDefaultAgentId(params.config);
	const defaultModel = resolveDefaultModelForAgent({
		cfg: params.config,
		agentId
	});
	for (const modelId of params.modelIds) {
		if (resolveEffectiveAgentRuntime({
			cfg: params.config,
			provider: params.provider,
			modelId,
			agentId
		}) !== params.agentRuntime) continue;
		const model = `${params.provider}/${modelId}`;
		if (!("error" in resolveAllowedModelRefCore({
			cfg: params.config,
			catalog: [],
			raw: model,
			defaultProvider: defaultModel.provider,
			defaultModel: defaultModel.model,
			agentId
		}))) return {
			model,
			agentRuntime: params.agentRuntime
		};
	}
}
//#endregion
//#region src/plugins/runtime/runtime-agent-thinking.ts
function resolveRuntimeThinkingCatalog(params, buildConfiguredCatalog) {
	if (params.catalog) return params.catalog;
	const configuredCatalog = buildConfiguredCatalog();
	return configuredCatalog.length > 0 ? configuredCatalog : void 0;
}
//#endregion
//#region src/plugins/runtime/runtime-cache.ts
/** Defines a lazily computed enumerable property on a runtime facade. */
function defineCachedValue(target, key, create) {
	let cached;
	let ready = false;
	Object.defineProperty(target, key, {
		configurable: true,
		enumerable: true,
		get() {
			if (!ready) {
				cached = create();
				ready = true;
			}
			return cached;
		}
	});
}
//#endregion
//#region src/plugins/runtime/runtime-agent.ts
const loadEmbeddedAgentRuntime = createLazyRuntimeModule(() => import("./runtime-embedded-agent.runtime.js"));
const loadAgentCommandRuntime = createLazyRuntimeModule(async () => {
	const [command, identity] = await Promise.all([import("./agent-command-l-SZvUiP.js"), import("./agent-command-execution-identity-D3T-29Xi.js")]);
	return {
		command,
		identity
	};
});
function toSessionAccessScope(params) {
	return {
		sessionKey: params.sessionKey,
		...params.agentId !== void 0 ? { agentId: params.agentId } : {},
		...params.env !== void 0 ? { env: params.env } : {},
		...params.hydrateSkillPromptRefs !== void 0 ? { hydrateSkillPromptRefs: params.hydrateSkillPromptRefs } : {},
		...params.readConsistency !== void 0 ? { readConsistency: params.readConsistency } : {},
		...params.storePath !== void 0 ? { storePath: params.storePath } : {}
	};
}
function getSessionEntry(params) {
	return loadSessionEntryReadOnly(toSessionAccessScope(params));
}
function listSessionEntries(params = {}) {
	return (params.readOnly ? listSessionEntriesReadOnly : listSessionEntriesCore)({
		...params.agentId !== void 0 ? { agentId: params.agentId } : {},
		...params.env !== void 0 ? { env: params.env } : {},
		...params.hydrateSkillPromptRefs !== void 0 ? { hydrateSkillPromptRefs: params.hydrateSkillPromptRefs } : {},
		...params.storePath !== void 0 ? { storePath: params.storePath } : {}
	});
}
async function patchSessionEntry(params) {
	return await patchSessionEntryCore(toSessionAccessScope(params), params.update, {
		assertCommitAllowed: params.assertCommitAllowed,
		fallbackEntry: params.fallbackEntry,
		maintenanceConfig: params.maintenanceConfig !== void 0 ? normalizeResolvedMaintenanceConfigInput(params.maintenanceConfig) : void 0,
		preserveActivity: params.preserveActivity,
		replaceEntry: params.replaceEntry
	});
}
async function updateSessionStoreEntry(params) {
	return await updateSessionEntry({
		sessionKey: params.sessionKey,
		storePath: params.storePath
	}, params.update, {
		skipMaintenance: params.skipMaintenance,
		takeCacheOwnership: params.takeCacheOwnership,
		requireWriteSuccess: params.requireWriteSuccess
	});
}
async function upsertSessionEntry(params) {
	await replaceSessionEntry(toSessionAccessScope(params), params.entry);
}
async function createSessionEntry(params) {
	const assertCreationOwner = captureSessionInitializationOwner("agentHarnessId" in params.initialEntry ? params.initialEntry.agentHarnessId : void 0);
	const [{ createGatewaySession }, { resolveGatewaySessionStoreTarget }, { readAcpSessionMetaForEntry, upsertAcpSessionMeta }, { resolveSandboxedSessionCreation }] = await Promise.all([
		import("./session-create-service-Cm_LtMN9.js"),
		import("./session-utils-BBUt1qHh.js"),
		import("./session-meta-yVoWd-p4.js"),
		import("./operator-role-policy-CI3GzIC5.js")
	]);
	assertCreationOwner();
	const requiredCreation = resolveSandboxedSessionCreation(getPluginRuntimeGatewayRequestScope()?.client, params.cfg);
	const target = resolveGatewaySessionStoreTarget({
		cfg: params.cfg,
		key: params.key,
		...params.agentId !== void 0 ? { agentId: params.agentId } : {}
	});
	const cliInitial = "cliBackendId" in params.initialEntry ? params.initialEntry : void 0;
	const acpInitial = "acpSessionBinding" in params.initialEntry ? params.initialEntry : void 0;
	const harnessInitial = "agentHarnessId" in params.initialEntry ? params.initialEntry : void 0;
	const pluginInitial = cliInitial ?? acpInitial;
	const acpBackendId = acpInitial?.acpBackendId.trim();
	const acpAgentId = acpInitial?.acpSessionBinding.acpAgentId.trim();
	const agentSessionId = acpInitial?.acpSessionBinding.agentSessionId.trim();
	if (acpInitial && (!acpBackendId || !acpAgentId || !agentSessionId)) throw new Error("initial ACP session binding fields must be non-empty");
	const initialAcpMeta = (now) => acpInitial ? {
		backend: acpBackendId,
		agent: acpAgentId,
		runtimeSessionName: target.canonicalKey,
		identity: {
			state: "resolved",
			agentSessionId,
			source: "ensure",
			lastUpdatedAt: now
		},
		mode: "persistent",
		...params.spawnedCwd?.trim() ? { cwd: params.spawnedCwd.trim() } : {},
		state: "idle",
		lastActivityAt: now
	} : void 0;
	const persistedAcpBinding = acpInitial ? {
		acpBackendId,
		acpAgentId,
		agentSessionId
	} : void 0;
	const acpMetaMatches = (meta) => Boolean(meta && meta.backend === acpBackendId && meta.agent === acpAgentId && meta.runtimeSessionName === target.canonicalKey && meta.identity?.state === "resolved" && meta.identity.agentSessionId === agentSessionId && meta.mode === "persistent" && meta.cwd === (params.spawnedCwd?.trim() || void 0));
	const initializesAfterCreate = Boolean(params.afterCreate || acpInitial);
	const matchesExceptUpdatedAt = (left, right) => {
		const { updatedAt: _leftUpdatedAt, ...leftStable } = left;
		const { updatedAt: _rightUpdatedAt, ...rightStable } = right;
		return isDeepStrictEqual(leftStable, rightStable);
	};
	const identities = /* @__PURE__ */ new Set([target.canonicalKey, ...target.storeKeys]);
	return await runExclusiveSessionLifecycleMutation({
		scope: target.storePath,
		identities,
		prepare: async () => {
			if (isSessionWorkAdmissionActive(target.storePath, identities)) throw new Error(`Session "${target.canonicalKey}" is still active; retry creation later.`);
		},
		run: async () => {
			assertCreationOwner();
			const afterCreate = params.afterCreate;
			let initialization;
			let callbackContext;
			let finalEntryPatch;
			let rollbackExpectedEntry;
			const runAfterCreate = async (context) => {
				callbackContext = context;
				if (acpInitial) {
					const meta = initialAcpMeta(Date.now());
					if (!(await upsertAcpSessionMeta({
						cfg: params.cfg,
						sessionKey: context.key,
						agentId: context.agentId,
						mutate: () => meta
					}))?.acp) throw new Error(`could not persist initial ACP binding for ${context.key}`);
					const persistedEntry = getSessionEntry({
						sessionKey: context.key,
						storePath: context.storePath,
						readConsistency: "latest"
					});
					if (!persistedEntry || !matchesExceptUpdatedAt(persistedEntry, context.entry)) throw new Error(`created ACP session ${context.key} changed during initialization`);
					callbackContext = {
						...context,
						entry: persistedEntry
					};
				}
				rollbackExpectedEntry = structuredClone(callbackContext.entry);
				const captured = callbackContext;
				const expected = rollbackExpectedEntry;
				initialization = createSessionInitialization({
					storePath: captured.storePath,
					sessionKey: captured.key,
					sessionId: expected.sessionId,
					lifecycleRevision: expected.lifecycleRevision
				}, (deleted) => {
					assertCreationOwner();
					const current = getSessionEntry({
						sessionKey: captured.key,
						storePath: captured.storePath,
						readConsistency: "latest"
					});
					if (deleted ? current !== void 0 : current?.initializationPending !== true || !isDeepStrictEqual(current, expected)) throw new Error(`Session initialization owner changed: ${captured.key}`);
				}, {
					config: params.cfg,
					agentId: captured.agentId,
					entry: expected
				});
				initialization.handle.assertCurrent();
				if (!afterCreate) return;
				const finalPatch = await afterCreate({
					key: callbackContext.key,
					agentId: callbackContext.agentId,
					sessionId: callbackContext.entry.sessionId,
					entry: structuredClone(callbackContext.entry),
					initialization: initialization.handle
				});
				initialization.handle.assertCurrent();
				if (finalPatch !== void 0) {
					const patchKeys = Object.keys(finalPatch);
					if (patchKeys.length !== 1 || patchKeys[0] !== "pluginExtensions") throw new Error("session creation final patch may only contain pluginExtensions");
					finalEntryPatch = structuredClone(finalPatch);
				}
			};
			try {
				const matchingEntry = params.recoverMatchingInitialEntry === true ? getSessionEntry({
					sessionKey: target.canonicalKey,
					storePath: target.storePath,
					readConsistency: "latest"
				}) : void 0;
				let recovered = false;
				let created;
				if (matchingEntry) {
					const expectedSpawnedCwd = params.spawnedCwd?.trim() || void 0;
					const expectedSessionRoot = params.sessionRoot?.trim() || void 0;
					const expectedExecNode = params.execNode?.trim() || void 0;
					const expectedExecCwd = params.execCwd?.trim() || void 0;
					const matchingAcpMeta = acpInitial ? readAcpSessionMetaForEntry({
						sessionKey: target.canonicalKey,
						agentId: target.agentId,
						entry: matchingEntry
					}) : void 0;
					if (!(matchingEntry.initializationPending === true && matchingEntry.agentHarnessId === harnessInitial?.agentHarnessId && matchingEntry.pluginOwnerId === pluginInitial?.pluginOwnerId && matchingEntry.modelSelectionLocked === params.initialEntry.modelSelectionLocked && (!cliInitial || matchingEntry.providerOverride === cliInitial.cliBackendId && matchingEntry.modelOverride === cliInitial.model && isDeepStrictEqual(matchingEntry.cliSessionBindings?.[cliInitial.cliBackendId], cliInitial.cliSessionBinding)) && (!acpInitial || isDeepStrictEqual(matchingEntry.acpSessionBinding, persistedAcpBinding) && (matchingAcpMeta === void 0 || acpMetaMatches(matchingAcpMeta))) && matchingEntry.spawnedCwd === expectedSpawnedCwd && matchingEntry.sessionRoot === expectedSessionRoot && matchingEntry.permissionMode === params.permissionMode && matchingEntry.execNode === expectedExecNode && matchingEntry.execCwd === expectedExecCwd && isDeepStrictEqual(matchingEntry.pluginExtensions, params.initialEntry.pluginExtensions))) throw new Error(`Session "${target.canonicalKey}" does not match its trusted recovery state.`);
					if (!afterCreate) throw new Error("session creation recovery requires an initializer");
					recovered = true;
					created = {
						key: target.canonicalKey,
						agentId: target.agentId,
						entry: matchingEntry
					};
					await runAfterCreate({
						...created,
						storePath: target.storePath
					});
				} else {
					const result = await createGatewaySession({
						cfg: params.cfg,
						operatorRoleActor: requiredCreation ? void 0 : { kind: "system" },
						requestingOperatorProfileId: requiredCreation?.actor?.id,
						key: params.key,
						...params.agentId !== void 0 ? { agentId: params.agentId } : {},
						...params.label !== void 0 ? { label: params.label } : {},
						...params.displayName !== void 0 ? { displayName: params.displayName } : {},
						...params.spawnedCwd !== void 0 ? { spawnedCwd: params.spawnedCwd } : {},
						...params.sessionRoot !== void 0 ? { sessionRoot: params.sessionRoot } : {},
						...params.permissionMode !== void 0 ? { permissionMode: params.permissionMode } : {},
						...params.execNode !== void 0 ? { execNode: params.execNode } : {},
						...params.execCwd !== void 0 ? { execCwd: params.execCwd } : {},
						initialEntry: {
							color: params.initialEntry.color,
							...harnessInitial ? { agentHarnessId: harnessInitial.agentHarnessId } : {},
							...cliInitial ? {
								pluginOwnerId: cliInitial.pluginOwnerId,
								providerOverride: cliInitial.cliBackendId,
								modelOverride: cliInitial.model,
								modelOverrideRouteResolution: "resolved",
								cliSessionBindings: { [cliInitial.cliBackendId]: cliInitial.cliSessionBinding }
							} : {},
							...acpInitial ? {
								pluginOwnerId: acpInitial.pluginOwnerId,
								acpSessionBinding: persistedAcpBinding
							} : {},
							...params.initialEntry.modelSelectionLocked === true ? { modelSelectionLocked: true } : {},
							...params.initialEntry.pluginExtensions ? { pluginExtensions: params.initialEntry.pluginExtensions } : {},
							...initializesAfterCreate ? { initializationPending: true } : {}
						},
						...harnessInitial ? { authorizedAgentHarnessId: harnessInitial.agentHarnessId } : {},
						...pluginInitial?.pluginOwnerId ? { authorizedPluginId: pluginInitial.pluginOwnerId } : {},
						creation: requiredCreation ?? {
							via: "plugin",
							actor: {
								type: "system",
								...pluginInitial?.pluginOwnerId ? { id: pluginInitial.pluginOwnerId } : {}
							}
						},
						commandSource: "plugin-runtime",
						...initializesAfterCreate ? { afterCreate: runAfterCreate } : {}
					});
					if (!result.ok) throw new Error(result.error.message);
					if (result.postCommit.status === "failed") throw result.postCommit.error;
					created = result;
				}
				if (recovered && !finalEntryPatch) throw new Error("session creation recovery requires a final patch");
				let finalEntry = created.entry;
				if (initializesAfterCreate) {
					const patch = {
						...finalEntryPatch,
						initializationPending: void 0,
						...acpInitial ? { acpSessionBinding: void 0 } : {}
					};
					const expectedEntry = rollbackExpectedEntry;
					if (!callbackContext || !expectedEntry) throw new Error("session creation final patch is missing its created entry");
					const createdContext = callbackContext;
					const finalized = await patchSessionEntryCore({
						sessionKey: createdContext.key,
						storePath: createdContext.storePath
					}, (currentEntry) => {
						if (JSON.stringify(currentEntry) !== JSON.stringify(expectedEntry)) throw new Error(`created session ${createdContext.key} changed before finalization`);
						return patch;
					}, {
						preserveActivity: true,
						requireWriteSuccess: true,
						assertCommitAllowed: () => initialization?.handle.assertCurrent()
					});
					if (!finalized) throw new Error(`created session ${createdContext.key} disappeared before finalization`);
					finalEntry = finalized;
					initialization?.close();
				}
				return {
					key: created.key,
					agentId: created.agentId,
					sessionId: finalEntry.sessionId,
					entry: finalEntry
				};
			} catch (error) {
				if (!callbackContext) throw error;
				const current = getSessionEntry({
					sessionKey: callbackContext.key,
					storePath: callbackContext.storePath,
					readConsistency: "latest"
				});
				if (current?.sessionId === callbackContext.entry.sessionId && current.lifecycleRevision === callbackContext.entry.lifecycleRevision && current.initializationPending !== true) throw error;
				try {
					let expectedEntry = rollbackExpectedEntry ?? callbackContext.entry;
					if (acpInitial && !rollbackExpectedEntry) {
						const currentEntry = getSessionEntry({
							sessionKey: callbackContext.key,
							storePath: callbackContext.storePath,
							readConsistency: "latest"
						});
						if (currentEntry && matchesExceptUpdatedAt(currentEntry, callbackContext.entry)) expectedEntry = currentEntry;
					}
					const rollbackParams = {
						agentId: callbackContext.agentId,
						archiveTranscript: true,
						expectedEntry,
						expectedSessionId: callbackContext.entry.sessionId,
						expectedUpdatedAt: expectedEntry.updatedAt,
						storePath: callbackContext.storePath,
						target: {
							canonicalKey: callbackContext.key,
							storeKeys: [callbackContext.key]
						}
					};
					const rollback = async () => expectedEntry.modelSelectionLocked === true ? expectedEntry.agentHarnessId ? await rollbackAgentHarnessSessionEntryLifecycle(rollbackParams) : await rollbackPluginOwnedSessionEntryLifecycle({
						...rollbackParams,
						expectedPluginOwnerId: pluginInitial?.pluginOwnerId ?? ""
					}) : await deleteSessionEntryLifecycle(rollbackParams);
					if (!(initialization ? await initialization.rollback(rollback) : await rollback()).deleted) throw new Error(`created session ${callbackContext.key} changed before rollback`, { cause: error });
					if (acpInitial) await upsertAcpSessionMeta({
						cfg: params.cfg,
						sessionKey: callbackContext.key,
						agentId: callbackContext.agentId,
						mutate: () => null
					});
				} catch (rollbackError) {
					throw new AggregateError([error, rollbackError], `Session initialization failed and guarded rollback did not complete for ${callbackContext.key}.`, { cause: rollbackError });
				}
				throw error;
			} finally {
				initialization?.close();
			}
		}
	});
}
async function runWithSessionWorkAdmission(params, run) {
	const initialEntry = getSessionEntry({
		storePath: params.storePath,
		sessionKey: params.sessionKey,
		readConsistency: "latest"
	});
	const lifecycleAbortController = new AbortController();
	const admission = await beginSessionWorkAdmission({
		scope: params.storePath,
		identities: [params.sessionKey, initialEntry?.sessionId],
		signal: params.signal,
		onInterrupt: () => lifecycleAbortController.abort(/* @__PURE__ */ new Error("Agent work interrupted by a session lifecycle change.")),
		assertAllowed: () => {
			const currentEntry = getSessionEntry({
				storePath: params.storePath,
				sessionKey: params.sessionKey,
				readConsistency: "latest"
			});
			if (initialEntry ? !currentEntry || currentEntry.sessionId !== initialEntry.sessionId : Boolean(currentEntry)) throw createSessionWorkStartChangedError(params.sessionKey);
			const startError = resolveSessionWorkStartError(params.sessionKey, currentEntry);
			if (startError) throw new Error(startError);
		}
	});
	try {
		const signal = params.signal ? AbortSignal.any([params.signal, lifecycleAbortController.signal]) : lifecycleAbortController.signal;
		return await admission.run(async () => await run(signal));
	} finally {
		admission.release();
	}
}
/** Creates the plugin runtime agent facade with lazy embedded-agent/session helpers. */
function createRuntimeAgent() {
	const agentRuntime = {
		defaults: {
			model: DEFAULT_MODEL,
			provider: DEFAULT_PROVIDER
		},
		resolveAgentDir,
		resolveAgentWorkspaceDir,
		resolveAgentIdentity,
		resolveSessionCatalogCreateTarget: resolveAgentCatalogCreateTarget,
		resolveThinkingDefault,
		normalizeThinkingLevel: normalizeThinkLevel,
		resolveThinkingPolicy: (params) => {
			const cfg = getRuntimeConfig();
			const effectiveRuntime = params.agentRuntime ? concretizeAgentRuntime(params.agentRuntime) : params.provider && params.model ? resolveEffectiveAgentRuntime({
				cfg,
				provider: params.provider,
				modelId: params.model
			}) : void 0;
			const profile = resolveThinkingProfile({
				...params,
				agentRuntime: effectiveRuntime,
				catalog: resolveRuntimeThinkingCatalog(params, () => buildConfiguredModelCatalog({ cfg: getRuntimeConfig() }))
			});
			const policy = { levels: profile.levels.map(({ id, label }) => ({
				id,
				label
			})) };
			return profile.defaultLevel ? {
				...policy,
				defaultLevel: profile.defaultLevel
			} : policy;
		},
		resolveAgentTimeoutMs,
		resolveCliBackendDispatchEligibility: resolveEmbeddedCliBackendDispatchEligibility,
		ensureAgentWorkspace
	};
	defineCachedValue(agentRuntime, "runCommandFromIngress", () => createLazyRuntimeMethod(loadAgentCommandRuntime, ({ command, identity }) => async (opts, runtime) => await command.agentCommandFromGatewayIngress({
		...identity.sanitizePublicAgentCommandIngressOpts(opts),
		senderIsOwner: opts.senderIsOwner === true
	}, runtime, void 0, {})));
	defineCachedValue(agentRuntime, "runEmbeddedAgent", () => createLazyRuntimeMethod(loadEmbeddedAgentRuntime, (runtime) => runtime.runPluginEmbeddedAgent));
	defineCachedValue(agentRuntime, "session", () => ({
		resolveStorePath: resolveSessionStorePathCore,
		createSessionEntry,
		getSessionEntry,
		listSessionEntries,
		patchSessionEntry,
		upsertSessionEntry,
		runWithWorkAdmission: runWithSessionWorkAdmission,
		updateSessionStoreEntry
	}));
	return agentRuntime;
}
//#endregion
//#region src/plugins/runtime/runtime-events.ts
/** Creates the plugin runtime event subscription facade. */
function createRuntimeEvents() {
	return {
		onAgentEvent,
		onSessionTranscriptUpdate
	};
}
//#endregion
//#region src/plugins/runtime/runtime-logging.ts
function writeRuntimeLog(log, message, meta) {
	if (meta && Object.keys(meta).length > 0) {
		log(meta, message);
		return;
	}
	log(message);
}
/** Creates the plugin runtime logging facade. */
function createRuntimeLogging() {
	return {
		shouldLogVerbose,
		getChildLogger: (bindings, opts) => {
			const overrideLevel = opts?.level ? normalizeLogLevel(opts.level) : void 0;
			const childOpts = overrideLevel ? { level: overrideLevel } : void 0;
			const emit = (level) => (message, meta) => {
				if (!overrideLevel && !isFileLogLevelEnabled(level)) return;
				const logger = getChildLogger(bindings, childOpts);
				writeRuntimeLog(logger[level].bind(logger), message, meta);
			};
			return {
				debug: emit("debug"),
				info: emit("info"),
				warn: emit("warn"),
				error: emit("error")
			};
		}
	};
}
//#endregion
//#region src/plugins/runtime/runtime-media.ts
/** Creates the plugin runtime media facade. */
function createRuntimeMedia() {
	return {
		loadWebMedia,
		detectMime,
		mediaKindFromMime,
		isVoiceCompatibleAudio: isVoiceMessageCompatibleAudio,
		getImageMetadata,
		resizeToJpeg
	};
}
//#endregion
//#region src/plugins/runtime/runtime-taskflow.ts
function assertSessionKey$1(sessionKey, errorMessage) {
	const normalized = sessionKey?.trim();
	if (!normalized) throw new Error(errorMessage);
	return normalized;
}
function asManagedTaskFlowRecord(flow) {
	if (!flow || flow.syncMode !== "managed" || !flow.controllerId) return;
	return flow;
}
function mapFlowUpdateResult(result) {
	if (result.applied) {
		const managed = asManagedTaskFlowRecord(result.flow);
		if (!managed) return {
			applied: false,
			code: "not_managed",
			current: result.flow
		};
		return {
			applied: true,
			flow: managed
		};
	}
	return {
		applied: false,
		code: result.reason,
		...result.current ? { current: result.current } : {}
	};
}
function applyManagedFlowMutationForOwner(params) {
	const flow = getTaskFlowByIdForOwner({
		flowId: params.flowId,
		callerOwnerKey: params.ownerKey
	});
	if (!flow) return {
		applied: false,
		code: "not_found"
	};
	const managed = asManagedTaskFlowRecord(flow);
	if (!managed) return {
		applied: false,
		code: "not_managed",
		current: flow
	};
	return mapFlowUpdateResult(params.mutate(managed.flowId));
}
function createBoundTaskFlowRuntime(params) {
	const ownerKey = assertSessionKey$1(params.sessionKey, "TaskFlow runtime requires a bound sessionKey.");
	const requesterOrigin = params.requesterOrigin ? normalizeDeliveryContext(params.requesterOrigin) : void 0;
	const tryCreateManaged = (input) => {
		return asManagedTaskFlowRecord(createManagedTaskFlow({
			ownerKey,
			controllerId: input.controllerId,
			requesterOrigin,
			status: input.status,
			notifyPolicy: input.notifyPolicy,
			goal: input.goal,
			currentStep: input.currentStep,
			stateJson: input.stateJson,
			waitJson: input.waitJson,
			cancelRequestedAt: input.cancelRequestedAt,
			createdAt: input.createdAt,
			updatedAt: input.updatedAt,
			endedAt: input.endedAt
		}) ?? void 0) ?? null;
	};
	return {
		sessionKey: ownerKey,
		...requesterOrigin ? { requesterOrigin } : {},
		createManaged: (input) => {
			const flow = tryCreateManaged(input);
			if (!flow) throw new Error("TaskFlow persistence failed.");
			return flow;
		},
		tryCreateManaged,
		get: (flowId) => getTaskFlowByIdForOwner({
			flowId,
			callerOwnerKey: ownerKey
		}),
		list: () => listTaskFlowsForOwner({ callerOwnerKey: ownerKey }),
		findLatest: () => findLatestTaskFlowForOwner({ callerOwnerKey: ownerKey }),
		resolve: (token) => resolveTaskFlowForLookupTokenForOwner({
			token,
			callerOwnerKey: ownerKey
		}),
		getTaskSummary: (flowId) => {
			const flow = getTaskFlowByIdForOwner({
				flowId,
				callerOwnerKey: ownerKey
			});
			return flow ? getFlowTaskSummary(flow.flowId) : void 0;
		},
		setWaiting: (input) => applyManagedFlowMutationForOwner({
			flowId: input.flowId,
			ownerKey,
			mutate: (flowId) => setFlowWaiting({
				flowId,
				expectedRevision: input.expectedRevision,
				currentStep: input.currentStep,
				stateJson: input.stateJson,
				waitJson: input.waitJson,
				blockedTaskId: input.blockedTaskId,
				blockedSummary: input.blockedSummary,
				updatedAt: input.updatedAt
			})
		}),
		resume: (input) => applyManagedFlowMutationForOwner({
			flowId: input.flowId,
			ownerKey,
			mutate: (flowId) => resumeFlow({
				flowId,
				expectedRevision: input.expectedRevision,
				status: input.status,
				currentStep: input.currentStep,
				stateJson: input.stateJson,
				updatedAt: input.updatedAt
			})
		}),
		finish: (input) => applyManagedFlowMutationForOwner({
			flowId: input.flowId,
			ownerKey,
			mutate: (flowId) => finishFlow({
				flowId,
				expectedRevision: input.expectedRevision,
				stateJson: input.stateJson,
				updatedAt: input.updatedAt,
				endedAt: input.endedAt
			})
		}),
		fail: (input) => applyManagedFlowMutationForOwner({
			flowId: input.flowId,
			ownerKey,
			mutate: (flowId) => failFlow({
				flowId,
				expectedRevision: input.expectedRevision,
				stateJson: input.stateJson,
				blockedTaskId: input.blockedTaskId,
				blockedSummary: input.blockedSummary,
				updatedAt: input.updatedAt,
				endedAt: input.endedAt
			})
		}),
		requestCancel: (input) => applyManagedFlowMutationForOwner({
			flowId: input.flowId,
			ownerKey,
			mutate: (flowId) => requestFlowCancel({
				flowId,
				expectedRevision: input.expectedRevision,
				cancelRequestedAt: input.cancelRequestedAt
			})
		}),
		cancel: ({ flowId, cfg }) => cancelFlowByIdForOwner({
			cfg,
			flowId,
			callerOwnerKey: ownerKey
		}),
		runTask: (input) => {
			const created = runTaskInFlowForOwner({
				flowId: input.flowId,
				callerOwnerKey: ownerKey,
				runtime: input.runtime,
				sourceId: input.sourceId,
				childSessionKey: input.childSessionKey,
				parentTaskId: input.parentTaskId,
				agentId: input.agentId,
				runId: input.runId,
				label: input.label,
				task: input.task,
				preferMetadata: input.preferMetadata,
				notifyPolicy: input.notifyPolicy,
				deliveryStatus: input.deliveryStatus,
				status: input.status,
				startedAt: input.startedAt,
				lastEventAt: input.lastEventAt,
				progressSummary: input.progressSummary
			});
			if (!created.created) return {
				created: false,
				found: created.found,
				reason: created.reason ?? "Task was not created.",
				...created.flow ? { flow: created.flow } : {}
			};
			const managed = asManagedTaskFlowRecord(created.flow);
			if (!managed) return {
				created: false,
				found: true,
				reason: "TaskFlow does not accept managed child tasks.",
				flow: created.flow
			};
			if (!created.task) return {
				created: false,
				found: true,
				reason: "Task was not created.",
				flow: created.flow
			};
			return {
				created: true,
				flow: managed,
				task: created.task
			};
		}
	};
}
function createRuntimeTaskFlow() {
	return {
		bindSession: (params) => createBoundTaskFlowRuntime({
			sessionKey: params.sessionKey,
			requesterOrigin: params.requesterOrigin
		}),
		fromToolContext: (ctx) => createBoundTaskFlowRuntime({
			sessionKey: assertSessionKey$1(ctx.sessionKey, "TaskFlow runtime requires tool context with a sessionKey."),
			requesterOrigin: ctx.deliveryContext
		})
	};
}
//#endregion
//#region src/tasks/task-domain-views.ts
/** Maps internal task summary counts to the plugin task-domain view contract. */
function mapTaskRunAggregateSummary(summary) {
	return {
		total: summary.total,
		active: summary.active,
		terminal: summary.terminal,
		failures: summary.failures,
		byStatus: { ...summary.byStatus },
		byRuntime: { ...summary.byRuntime }
	};
}
function mapTaskRunView(task) {
	return {
		id: task.taskId,
		runtime: task.runtime,
		...task.sourceId ? { sourceId: task.sourceId } : {},
		sessionKey: task.requesterSessionKey,
		ownerKey: task.ownerKey,
		scope: task.scopeKind,
		...task.childSessionKey ? { childSessionKey: task.childSessionKey } : {},
		...task.parentFlowId ? { flowId: task.parentFlowId } : {},
		...task.parentTaskId ? { parentTaskId: task.parentTaskId } : {},
		...task.agentId ? { agentId: task.agentId } : {},
		...task.runId ? { runId: task.runId } : {},
		...task.label ? { label: task.label } : {},
		title: task.task,
		status: task.status,
		deliveryStatus: task.deliveryStatus,
		notifyPolicy: task.notifyPolicy,
		createdAt: task.createdAt,
		...task.startedAt !== void 0 ? { startedAt: task.startedAt } : {},
		...task.endedAt !== void 0 ? { endedAt: task.endedAt } : {},
		...task.lastEventAt !== void 0 ? { lastEventAt: task.lastEventAt } : {},
		...task.cleanupAfter !== void 0 ? { cleanupAfter: task.cleanupAfter } : {},
		...task.error ? { error: task.error } : {},
		...task.progressSummary ? { progressSummary: task.progressSummary } : {},
		...task.terminalSummary ? { terminalSummary: task.terminalSummary } : {},
		...task.terminalOutcome ? { terminalOutcome: task.terminalOutcome } : {}
	};
}
function mapTaskRunDetail(task) {
	return mapTaskRunView(task);
}
function mapTaskFlowView(flow) {
	return {
		id: flow.flowId,
		ownerKey: flow.ownerKey,
		...flow.requesterOrigin ? { requesterOrigin: { ...flow.requesterOrigin } } : {},
		status: flow.status,
		notifyPolicy: flow.notifyPolicy,
		goal: flow.goal,
		...flow.currentStep ? { currentStep: flow.currentStep } : {},
		...flow.cancelRequestedAt !== void 0 ? { cancelRequestedAt: flow.cancelRequestedAt } : {},
		createdAt: flow.createdAt,
		updatedAt: flow.updatedAt,
		...flow.endedAt !== void 0 ? { endedAt: flow.endedAt } : {}
	};
}
function mapTaskFlowDetail(params) {
	const summary = params.summary ?? summarizeTaskRecords(params.tasks);
	return {
		...mapTaskFlowView(params.flow),
		...params.flow.stateJson !== void 0 ? { state: params.flow.stateJson } : {},
		...params.flow.waitJson !== void 0 ? { wait: params.flow.waitJson } : {},
		...params.flow.blockedTaskId || params.flow.blockedSummary ? { blocked: {
			...params.flow.blockedTaskId ? { taskId: params.flow.blockedTaskId } : {},
			...params.flow.blockedSummary ? { summary: params.flow.blockedSummary } : {}
		} } : {},
		tasks: params.tasks.map((task) => mapTaskRunView(task)),
		taskSummary: mapTaskRunAggregateSummary(summary)
	};
}
//#endregion
//#region src/plugins/runtime/runtime-tasks.ts
function assertSessionKey(sessionKey, errorMessage) {
	const normalized = sessionKey?.trim();
	if (!normalized) throw new Error(errorMessage);
	return normalized;
}
function mapCancelledTaskResult(result) {
	return {
		found: result.found,
		cancelled: result.cancelled,
		...result.reason ? { reason: result.reason } : {},
		...result.task ? { task: mapTaskRunDetail(result.task) } : {}
	};
}
function createBoundTaskRunsRuntime(params) {
	const ownerKey = assertSessionKey(params.sessionKey, "Tasks runtime requires a bound sessionKey.");
	const requesterOrigin = params.requesterOrigin ? normalizeDeliveryContext(params.requesterOrigin) : void 0;
	return {
		sessionKey: ownerKey,
		...requesterOrigin ? { requesterOrigin } : {},
		get: (taskId) => {
			const task = getTaskByIdForOwner({
				taskId,
				callerOwnerKey: ownerKey,
				callerAgentId: params.agentId
			});
			return task ? mapTaskRunDetail(task) : void 0;
		},
		list: () => listTasksForRelatedSessionKeyForOwner({
			relatedSessionKey: ownerKey,
			callerOwnerKey: ownerKey,
			callerAgentId: params.agentId
		}).map((task) => mapTaskRunView(task)),
		findLatest: () => {
			const task = findLatestTaskForRelatedSessionKeyForOwner({
				relatedSessionKey: ownerKey,
				callerOwnerKey: ownerKey,
				callerAgentId: params.agentId
			});
			return task ? mapTaskRunDetail(task) : void 0;
		},
		resolve: (token) => {
			const task = resolveTaskForLookupTokenForOwner({
				token,
				callerOwnerKey: ownerKey,
				callerAgentId: params.agentId
			});
			return task ? mapTaskRunDetail(task) : void 0;
		},
		cancel: async ({ taskId, cfg }) => {
			const task = getTaskByIdForOwner({
				taskId,
				callerOwnerKey: ownerKey,
				callerAgentId: params.agentId
			});
			if (!task) return {
				found: false,
				cancelled: false,
				reason: "Task not found."
			};
			return mapCancelledTaskResult(await cancelDetachedTaskRunById({
				cfg,
				taskId: task.taskId
			}));
		}
	};
}
function createBoundTaskFlowsRuntime(params) {
	const ownerKey = assertSessionKey(params.sessionKey, "TaskFlow runtime requires a bound sessionKey.");
	const requesterOrigin = params.requesterOrigin ? normalizeDeliveryContext(params.requesterOrigin) : void 0;
	const getDetail = (flowId) => {
		const flow = getTaskFlowByIdForOwner({
			flowId,
			callerOwnerKey: ownerKey
		});
		if (!flow) return;
		return mapTaskFlowDetail({
			flow,
			tasks: listTasksForFlowId(flow.flowId),
			summary: getFlowTaskSummary(flow.flowId)
		});
	};
	return {
		sessionKey: ownerKey,
		...requesterOrigin ? { requesterOrigin } : {},
		get: (flowId) => getDetail(flowId),
		list: () => listTaskFlowsForOwner({ callerOwnerKey: ownerKey }).map((flow) => mapTaskFlowView(flow)),
		findLatest: () => {
			const flow = findLatestTaskFlowForOwner({ callerOwnerKey: ownerKey });
			return flow ? getDetail(flow.flowId) : void 0;
		},
		resolve: (token) => {
			const flow = resolveTaskFlowForLookupTokenForOwner({
				token,
				callerOwnerKey: ownerKey
			});
			return flow ? getDetail(flow.flowId) : void 0;
		},
		getTaskSummary: (flowId) => {
			const flow = getTaskFlowByIdForOwner({
				flowId,
				callerOwnerKey: ownerKey
			});
			return flow ? mapTaskRunAggregateSummary(getFlowTaskSummary(flow.flowId)) : void 0;
		}
	};
}
function createRuntimeTaskRuns() {
	return {
		bindSession: (params) => createBoundTaskRunsRuntime({
			sessionKey: params.sessionKey,
			agentId: params.agentId,
			requesterOrigin: params.requesterOrigin
		}),
		fromToolContext: (ctx) => createBoundTaskRunsRuntime({
			sessionKey: assertSessionKey(ctx.sessionKey, "Tasks runtime requires tool context with a sessionKey."),
			agentId: ctx.agentId,
			requesterOrigin: ctx.deliveryContext
		})
	};
}
function createRuntimeTaskFlows() {
	return {
		bindSession: (params) => createBoundTaskFlowsRuntime({
			sessionKey: params.sessionKey,
			requesterOrigin: params.requesterOrigin
		}),
		fromToolContext: (ctx) => createBoundTaskFlowsRuntime({
			sessionKey: assertSessionKey(ctx.sessionKey, "TaskFlow runtime requires tool context with a sessionKey."),
			requesterOrigin: ctx.deliveryContext
		})
	};
}
function createRuntimeTasks(params) {
	return {
		runs: createRuntimeTaskRuns(),
		flows: createRuntimeTaskFlows(),
		managedFlows: params.managedTaskFlow
	};
}
//#endregion
//#region src/plugins/runtime/index.ts
const loadTtsRuntime = createLazyRuntimeModule(() => import("./plugin-sdk/tts-runtime.js"));
const loadTtsRequestRuntime = createLazyRuntimeModule(() => import("./runtime-tts-request-C30wB6t-.js"));
const loadMediaUnderstandingRuntime = createLazyRuntimeModule(() => import("./runtime-CMmAc9pz.js"));
const loadModelAuthRuntime = createLazyRuntimeModule(() => import("./runtime-model-auth.runtime.js"));
const loadGatewayPluginRuntime = createLazyRuntimeModule(() => import("./server-plugins-BuBdDzy0.js"));
function createRuntimeGateway() {
	return {
		isAvailable: async () => {
			return (await loadGatewayPluginRuntime()).hasInProcessGatewayContext();
		},
		request: async (method, params, options) => {
			return (await loadGatewayPluginRuntime()).dispatchTrustedPluginGatewayMethod(method, params, options);
		}
	};
}
function createRuntimeTts() {
	const bindTtsRuntime = createLazyRuntimeMethodBinder(loadTtsRuntime);
	return {
		prepareTtsRequest: createLazyRuntimeMethodBinder(loadTtsRequestRuntime)((runtime) => runtime.prepareTtsRequest),
		textToSpeech: bindTtsRuntime((runtime) => runtime.textToSpeech),
		textToSpeechStream: bindTtsRuntime((runtime) => runtime.textToSpeechStream),
		textToSpeechTelephony: bindTtsRuntime((runtime) => runtime.textToSpeechTelephony),
		listVoices: bindTtsRuntime((runtime) => runtime.listSpeechVoices)
	};
}
function createRuntimeMediaUnderstandingFacade() {
	const bindMediaUnderstandingRuntime = createLazyRuntimeMethodBinder(loadMediaUnderstandingRuntime);
	return {
		resolveAudioInputBudget: bindMediaUnderstandingRuntime((runtime) => runtime.resolveAudioInputBudget),
		runFile: bindMediaUnderstandingRuntime((runtime) => runtime.runMediaUnderstandingFile),
		describeImageFile: bindMediaUnderstandingRuntime((runtime) => runtime.describeImageFile),
		describeImageFileWithModel: bindMediaUnderstandingRuntime((runtime) => runtime.describeImageFileWithModel),
		extractStructuredWithModel: bindMediaUnderstandingRuntime((runtime) => runtime.extractStructuredWithModel),
		describeVideoFile: bindMediaUnderstandingRuntime((runtime) => runtime.describeVideoFile),
		transcribeAudioFile: bindMediaUnderstandingRuntime((runtime) => runtime.transcribeAudioFile)
	};
}
function createRuntimeImageGeneration() {
	return {
		generate: (params) => generateImage(params),
		listProviders: (params) => listRuntimeImageGenerationProviders(params)
	};
}
function createRuntimeVideoGeneration() {
	return {
		generate: (params) => generateVideo(params),
		listProviders: (params) => listRuntimeVideoGenerationProviders(params)
	};
}
function createRuntimeMusicGeneration() {
	return {
		generate: (params) => generateMusic(params),
		listProviders: (params) => listRuntimeMusicGenerationProviders(params)
	};
}
function createRuntimeLlmFacade() {
	const loadAcquireLocalService = createLazyRuntimeMethod(() => import("./provider-local-service-CoYFmCjk.js"), (runtime) => runtime.createConfiguredProviderLocalServiceAcquirer(getRuntimeConfig));
	const loadLlm = createLazyRuntimeSurface(() => import("./runtime-llm.runtime.js"), (m) => m.createRuntimeLlm({
		getConfig: getRuntimeConfig,
		authority: { allowComplete: true }
	}));
	return {
		acquireLocalService: (...args) => loadAcquireLocalService(...args),
		complete: async (params) => {
			return (await loadLlm()).complete(params);
		}
	};
}
function createRuntimeModelAuth() {
	const getApiKeyForModel = createLazyRuntimeMethod(loadModelAuthRuntime, (runtime) => runtime.getApiKeyForModel);
	const getRuntimeAuthForModel = createLazyRuntimeMethod(loadModelAuthRuntime, (runtime) => runtime.getRuntimeAuthForModelCore);
	const resolveApiKeyForProvider = createLazyRuntimeMethod(loadModelAuthRuntime, (runtime) => runtime.resolveProviderRuntimeApiKey);
	return {
		getApiKeyForModel: (params) => getApiKeyForModel({
			model: params.model,
			cfg: params.cfg,
			workspaceDir: params.workspaceDir
		}),
		getRuntimeAuthForModel: (params) => getRuntimeAuthForModel({
			model: params.model,
			cfg: params.cfg,
			workspaceDir: params.workspaceDir
		}),
		resolveApiKeyForProvider: (params) => resolveApiKeyForProvider({
			provider: params.provider,
			cfg: params.cfg,
			workspaceDir: params.workspaceDir
		})
	};
}
function createUnavailableSubagentRuntime() {
	const unavailable = () => {
		throw new RequestScopedSubagentRuntimeError();
	};
	return {
		complete: unavailable,
		run: unavailable,
		waitForRun: unavailable,
		getSessionMessages: unavailable,
		deleteSession: unavailable
	};
}
function createUnavailableNodesRuntime() {
	const unavailable = () => {
		throw new Error("Plugin node runtime is only available inside the Gateway.");
	};
	return {
		list: unavailable,
		invoke: unavailable,
		openDuplex: unavailable
	};
}
function createRuntimeWorktrees() {
	const loadService = () => import("./service-Chz8JfM5.js");
	return {
		async resolveCheckoutRoot(params) {
			const { findGitCheckoutRoot } = await import("./git-DwgBtAjR.js");
			return findGitCheckoutRoot(params.path) ?? void 0;
		},
		async hasSelfContainedCheckoutMetadata(params) {
			const { hasSelfContainedGitMetadata } = await import("./git-DwgBtAjR.js");
			return await hasSelfContainedGitMetadata(params.path);
		},
		async create(params) {
			const { managedWorktrees } = await loadService();
			const record = await managedWorktrees.create(params);
			await managedWorktrees.acquire(record.id);
			return {
				id: record.id,
				path: record.path,
				branch: record.branch
			};
		},
		async release(params) {
			const { managedWorktrees } = await loadService();
			await managedWorktrees.releaseByPath(params.path);
		},
		async removeIfLossless(params) {
			const { managedWorktrees } = await loadService();
			return managedWorktrees.removeIfLosslessByPath(params.path, {
				ownerKind: params.ownerKind,
				ownerId: params.ownerId
			});
		}
	};
}
function createRuntimeSandbox(agent) {
	const resolveWorkspaceAuthority = (params) => resolveSandboxWorkspaceAuthority({
		...params,
		sessionEntry: agent.session.getSessionEntry({
			agentId: params.agentId,
			sessionKey: params.sessionKey
		})
	});
	return {
		resolveWorkspaceAuthority,
		async prepareWorkspaceAuthority(params) {
			const authority = resolveWorkspaceAuthority(params);
			if (!authority.sandboxed || authority.confinementError) return authority;
			const { resolveSandboxContext } = await import("./context-D3q8VdVo.js");
			await resolveSandboxContext({
				config: params.config,
				agentId: params.agentId,
				sessionKey: params.sessionKey,
				workspaceDir: params.workspaceDir,
				requireCurrentConfig: true
			});
			return authority;
		}
	};
}
const createPluginRuntime = (_options = {}, base = createRuntimeBase()) => {
	const mediaUnderstanding = createRuntimeMediaUnderstandingFacade();
	const tasks = createRuntimeTasks({ managedTaskFlow: createRuntimeTaskFlow() });
	const agent = createRuntimeAgent();
	const runtime = {
		version: VERSION,
		gateway: _options.gateway ?? createRuntimeGateway(),
		config: base.config,
		agent,
		hooks: _options.hooks ?? { dispatchHookAgentTurn: async () => {
			throw new Error("Plugin hook runtime is only available inside the Gateway.");
		} },
		subagent: _options.subagent ?? createUnavailableSubagentRuntime(),
		nodes: _options.nodes ?? createUnavailableNodesRuntime(),
		sandbox: createRuntimeSandbox(agent),
		worktrees: createRuntimeWorktrees(),
		system: base.system,
		media: createRuntimeMedia(),
		webSearch: {
			listProviders: listWebSearchProviders,
			search: runWebSearch
		},
		channel: createRuntimeChannel(_options.dispatchReplyFromConfig ? { dispatchReplyFromConfig: _options.dispatchReplyFromConfig } : void 0),
		events: createRuntimeEvents(),
		logging: createRuntimeLogging(),
		state: base.state,
		tasks
	};
	defineCachedValue(runtime, "tts", createRuntimeTts);
	defineCachedValue(runtime, "mediaUnderstanding", () => mediaUnderstanding);
	defineCachedValue(runtime, "modelAuth", createRuntimeModelAuth);
	defineCachedValue(runtime, "imageGeneration", createRuntimeImageGeneration);
	defineCachedValue(runtime, "videoGeneration", createRuntimeVideoGeneration);
	defineCachedValue(runtime, "musicGeneration", createRuntimeMusicGeneration);
	defineCachedValue(runtime, "llm", createRuntimeLlmFacade);
	return runtime;
};
//#endregion
export { createPluginRuntime as t };