@dsh-remote/relay 3.1.3 → 3.1.5

package/dist/bundle/main.js

@@ -3726,7 +3726,7 @@ var require_websocket_server = __commonJS({
 // src/main.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
   $brand: () => $brand,
@@ -3989,7 +3989,7 @@ __export(external_exports, {
   xor: () => xor
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/index.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/index.js
 var core_exports2 = {};
 __export(core_exports2, {
   $ZodAny: () => $ZodAny,
@@ -4306,7 +4306,7 @@ __export(core_exports2, {
   withParser: () => withParser
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/util.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/util.js
 var util_exports = {};
 __export(util_exports, {
   BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
@@ -4377,6 +4377,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -4896,6 +4897,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -5149,7 +5162,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/core.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/core.js
 var _a;
 var NEVER = /* @__PURE__ */ Object.freeze({
   status: "aborted"
@@ -5271,7 +5284,7 @@ function config(newConfig) {
   return globalConfig;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -5463,7 +5476,7 @@ function prettifyError(error62) {
   return lines.join("\n");
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -5623,7 +5636,7 @@ var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 };
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/regexes.js
 var regexes_exports = {};
 __export(regexes_exports, {
   anyString: () => anyString,
@@ -5795,7 +5808,7 @@ var sha512_hex = /^[0-9a-fA-F]{128}$/;
 var sha512_base64 = /* @__PURE__ */ fixedBase64(86, "==");
 var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a3;
   inst._zod ?? (inst._zod = {});
@@ -6271,7 +6284,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/doc.js
 var Doc = class {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -6312,14 +6325,14 @@ ${content.join("\n")}
   }
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 6
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a3;
   inst ?? (inst = {});
@@ -7072,6 +7085,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -7115,6 +7153,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -8071,6 +8110,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -8137,6 +8177,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -8733,7 +8774,7 @@ function handleRefineResult(result, payload, input2, inst) {
   }
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -9010,7 +9051,7 @@ function isBackEdge(ctx, value) {
   return backEdges !== void 0 && isRef(value) && backEdges.has(value);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/index.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/index.js
 var locales_exports = {};
 __export(locales_exports, {
   ar: () => ar_default,
@@ -9078,7 +9119,7 @@ __export(locales_exports, {
   zhTW: () => zh_TW_default
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ar.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ar.js
 var error = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0641", verb: "\u0623\u0646 \u064A\u062D\u0648\u064A" },
@@ -9190,7 +9231,7 @@ function ar_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/az.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/az.js
 var error2 = () => {
   const Sizable = {
     string: { unit: "simvol", verb: "olmal\u0131d\u0131r" },
@@ -9301,7 +9342,7 @@ function az_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/be.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/be.js
 function getBelarusianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -9470,7 +9511,7 @@ function be_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bg.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/bg.js
 var error4 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0430", verb: "\u0434\u0430 \u0441\u044A\u0434\u044A\u0440\u0436\u0430" },
@@ -9596,7 +9637,7 @@ function bg_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/bn.js
 var error5 = () => {
   const Sizable = {
     string: { unit: "\u0985\u0995\u09CD\u09B7\u09B0", verb: "\u09A5\u09BE\u0995\u09A4\u09C7 \u09B9\u09AC\u09C7" },
@@ -9710,7 +9751,7 @@ function bn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ca.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ca.js
 var error6 = () => {
   const Sizable = {
     string: { unit: "car\xE0cters", verb: "contenir" },
@@ -9824,7 +9865,7 @@ function ca_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ckb.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ckb.js
 var error7 = () => {
   const Sizable = {
     string: { unit: "\u067E\u06CC\u062A", verb: "\u0628\u06CE\u062A" },
@@ -9957,7 +9998,7 @@ function ckb_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/cs.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/cs.js
 var error8 = () => {
   const Sizable = {
     string: { unit: "znak\u016F", verb: "m\xEDt" },
@@ -10074,7 +10115,7 @@ function cs_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/da.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/da.js
 var error9 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "havde" },
@@ -10195,7 +10236,7 @@ function da_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/de.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/de.js
 var error10 = () => {
   const Sizable = {
     string: { unit: "Zeichen", verb: "zu haben" },
@@ -10309,7 +10350,7 @@ function de_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/el.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/el.js
 var error11 = () => {
   const Sizable = {
     string: { unit: "\u03C7\u03B1\u03C1\u03B1\u03BA\u03C4\u03AE\u03C1\u03B5\u03C2", verb: "\u03BD\u03B1 \u03AD\u03C7\u03B5\u03B9" },
@@ -10422,7 +10463,7 @@ function el_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/en.js
 var error12 = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -10547,7 +10588,7 @@ function en_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/eo.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/eo.js
 var error13 = () => {
   const Sizable = {
     string: { unit: "karaktrojn", verb: "havi" },
@@ -10662,7 +10703,7 @@ function eo_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/es.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/es.js
 var error14 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "tener" },
@@ -10799,7 +10840,7 @@ function es_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fa.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fa.js
 var error15 = () => {
   const Sizable = {
     string: { unit: "\u06A9\u0627\u0631\u0627\u06A9\u062A\u0631", verb: "\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F" },
@@ -10919,7 +10960,7 @@ function fa_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fi.js
 var error16 = () => {
   const Sizable = {
     string: { unit: "merkki\xE4", subject: "merkkijonon" },
@@ -11037,7 +11078,7 @@ function fi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fr.js
 var error17 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11167,7 +11208,7 @@ function fr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr-CA.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/fr-CA.js
 var error18 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -11280,7 +11321,7 @@ function fr_CA_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/gu.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/gu.js
 var error19 = () => {
   const Sizable = {
     string: { unit: "\u0A85\u0A95\u0ACD\u0AB7\u0AB0", verb: "\u0AB9\u0ACB\u0AB5\u0ABE \u0A9C\u0ACB\u0A88\u0A8F" },
@@ -11394,7 +11435,7 @@ function gu_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/he.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/he.js
 var error20 = () => {
   const TypeNames = {
     string: { label: "\u05DE\u05D7\u05E8\u05D5\u05D6\u05EA", gender: "f" },
@@ -11596,7 +11637,7 @@ function he_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hi.js
 var error21 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0930\u0916\u0928\u0947 \u0915\u0947 \u0932\u093F\u090F" },
@@ -11708,7 +11749,7 @@ function hi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hr.js
 var error22 = () => {
   const Sizable = {
     string: { unit: "znakova", verb: "imati" },
@@ -11835,7 +11876,7 @@ function hr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hu.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hu.js
 var error23 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "legyen" },
@@ -11949,7 +11990,7 @@ function hu_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hy.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/hy.js
 function getArmenianPlural(count, one, many) {
   return Math.abs(count) === 1 ? one : many;
 }
@@ -12108,7 +12149,7 @@ function hy_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/id.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/id.js
 var error25 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "memiliki" },
@@ -12220,7 +12261,7 @@ function id_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/is.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/is.js
 var error26 = () => {
   const Sizable = {
     string: { unit: "stafi", verb: "a\xF0 hafa" },
@@ -12335,7 +12376,7 @@ function is_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/it.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/it.js
 var error27 = () => {
   const Sizable = {
     string: { unit: "caratteri", verb: "avere" },
@@ -12449,7 +12490,7 @@ function it_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ja.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ja.js
 var error28 = () => {
   const Sizable = {
     string: { unit: "\u6587\u5B57", verb: "\u3067\u3042\u308B" },
@@ -12562,7 +12603,7 @@ function ja_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ka.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ka.js
 var error29 = () => {
   const Sizable = {
     string: { unit: "\u10E1\u10D8\u10DB\u10D1\u10DD\u10DA\u10DD", verb: "\u10E3\u10DC\u10D3\u10D0 \u10E8\u10D4\u10D8\u10EA\u10D0\u10D5\u10D3\u10D4\u10E1" },
@@ -12680,7 +12721,7 @@ function ka_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/km.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/km.js
 var error30 = () => {
   const Sizable = {
     string: { unit: "\u178F\u17BD\u17A2\u1780\u17D2\u179F\u179A", verb: "\u1782\u17BD\u179A\u1798\u17B6\u1793" },
@@ -12796,12 +12837,12 @@ function km_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kh.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/kh.js
 function kh_default() {
   return km_default();
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/kn.js
 var error31 = () => {
   const Sizable = {
     string: { unit: "\u0C85\u0C95\u0CCD\u0CB7\u0CB0\u0C97\u0CB3\u0CC1", verb: "\u0CB9\u0CCA\u0C82\u0CA6\u0CB2\u0CC1" },
@@ -12917,7 +12958,7 @@ function kn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ko.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ko.js
 var error32 = () => {
   const Sizable = {
     string: { unit: "\uBB38\uC790", verb: "to have" },
@@ -13034,7 +13075,7 @@ function ko_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/lt.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/lt.js
 var capitalizeFirstCharacter = (text) => {
   return text.charAt(0).toUpperCase() + text.slice(1);
 };
@@ -13242,7 +13283,7 @@ function lt_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/mk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/mk.js
 var error34 = () => {
   const Sizable = {
     string: { unit: "\u0437\u043D\u0430\u0446\u0438", verb: "\u0434\u0430 \u0438\u043C\u0430\u0430\u0442" },
@@ -13357,7 +13398,7 @@ function mk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ms.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ms.js
 var error35 = () => {
   const Sizable = {
     string: { unit: "aksara", verb: "mempunyai" },
@@ -13470,7 +13511,7 @@ function ms_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ne.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ne.js
 var error36 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0939\u0941\u0928\u0941\u092A\u0930\u094D\u091B" },
@@ -13582,7 +13623,7 @@ function ne_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/nl.js
 var error37 = () => {
   const Sizable = {
     string: { unit: "tekens", verb: "heeft" },
@@ -13698,7 +13739,7 @@ function nl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nn.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/nn.js
 var error38 = () => {
   const Sizable = {
     string: { unit: "teikn", verb: "\xE5 ha" },
@@ -13812,7 +13853,7 @@ function nn_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/no.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/no.js
 var error39 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "\xE5 ha" },
@@ -13926,7 +13967,7 @@ function no_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ota.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ota.js
 var error40 = () => {
   const Sizable = {
     string: { unit: "harf", verb: "olmal\u0131d\u0131r" },
@@ -14041,7 +14082,7 @@ function ota_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ps.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ps.js
 var error41 = () => {
   const Sizable = {
     string: { unit: "\u062A\u0648\u06A9\u064A", verb: "\u0648\u0644\u0631\u064A" },
@@ -14161,7 +14202,7 @@ function ps_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pl.js
 var error42 = () => {
   const Sizable = {
     string: { unit: "znak\xF3w", verb: "mie\u0107" },
@@ -14276,7 +14317,7 @@ function pl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pt.js
 var error43 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14420,7 +14461,7 @@ function pt_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt-BR.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/pt-BR.js
 var error44 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -14565,7 +14606,7 @@ function pt_BR_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ro.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ro.js
 var error45 = () => {
   const Sizable = {
     string: { unit: "caractere", verb: "s\u0103 aib\u0103" },
@@ -14688,7 +14729,7 @@ function ro_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ru.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ru.js
 function getRussianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -14857,7 +14898,7 @@ function ru_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sk.js
 var error47 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "ma\u0165" },
@@ -14974,7 +15015,7 @@ function sk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sl.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sl.js
 var error48 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "imeti" },
@@ -15089,7 +15130,7 @@ function sl_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sv.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/sv.js
 var error49 = () => {
   const Sizable = {
     string: { unit: "tecken", verb: "att ha" },
@@ -15205,7 +15246,7 @@ function sv_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ta.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ta.js
 var error50 = () => {
   const Sizable = {
     string: { unit: "\u0B8E\u0BB4\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1\u0B95\u0BCD\u0B95\u0BB3\u0BCD", verb: "\u0B95\u0BCA\u0BA3\u0BCD\u0B9F\u0BBF\u0BB0\u0BC1\u0B95\u0BCD\u0B95 \u0BB5\u0BC7\u0BA3\u0BCD\u0B9F\u0BC1\u0BAE\u0BCD" },
@@ -15321,7 +15362,7 @@ function ta_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tg.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tg.js
 var error51 = () => {
   const Sizable = {
     string: { unit: "\u0430\u043B\u043E\u043C\u0430\u0442", verb: "\u0434\u043E\u0448\u0442\u0430 \u0431\u043E\u0448\u0430\u0434" },
@@ -15438,7 +15479,7 @@ function tg_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/th.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/th.js
 var error52 = () => {
   const Sizable = {
     string: { unit: "\u0E15\u0E31\u0E27\u0E2D\u0E31\u0E01\u0E29\u0E23", verb: "\u0E04\u0E27\u0E23\u0E21\u0E35" },
@@ -15554,7 +15595,7 @@ function th_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tk.js
 var error53 = () => {
   const Sizable = {
     string: { unit: "simwol", verb: "bolmaly" },
@@ -15662,7 +15703,7 @@ function tk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tr.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/tr.js
 var error54 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "olmal\u0131" },
@@ -15773,7 +15814,7 @@ function tr_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uk.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/uk.js
 var error55 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0456\u0432", verb: "\u043C\u0430\u0442\u0438\u043C\u0435" },
@@ -15887,12 +15928,12 @@ function uk_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ua.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ua.js
 function ua_default() {
   return uk_default();
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ur.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/ur.js
 var error56 = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0648\u0641", verb: "\u06C1\u0648\u0646\u0627" },
@@ -16008,7 +16049,7 @@ function ur_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uz.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/uz.js
 var error57 = () => {
   const Sizable = {
     string: { unit: "belgi", verb: "bo\u2018lishi kerak" },
@@ -16122,7 +16163,7 @@ function uz_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/vi.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/vi.js
 var error58 = () => {
   const Sizable = {
     string: { unit: "k\xFD t\u1EF1", verb: "c\xF3" },
@@ -16236,7 +16277,7 @@ function vi_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-CN.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/zh-CN.js
 var error59 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u7B26", verb: "\u5305\u542B" },
@@ -16351,7 +16392,7 @@ function zh_CN_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-TW.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/zh-TW.js
 var error60 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u5143", verb: "\u64C1\u6709" },
@@ -16464,7 +16505,7 @@ function zh_TW_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/yo.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/locales/yo.js
 var error61 = () => {
   const Sizable = {
     string: { unit: "\xE0mi", verb: "n\xED" },
@@ -16577,7 +16618,7 @@ function yo_default() {
   };
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/registries.js
 var _a2;
 var $output = /* @__PURE__ */ Symbol("ZodOutput");
 var $input = /* @__PURE__ */ Symbol("ZodInput");
@@ -16627,7 +16668,7 @@ function registry() {
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/compile.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/compile.js
 var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
 var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
@@ -17667,9 +17708,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -18069,6 +18116,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -18085,6 +18133,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -18229,7 +18278,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
   return accessor;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/api.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -19288,7 +19337,7 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
   return inst;
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -19818,7 +19867,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   return finalize(ctx, schema);
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === void 0 || value > agg[key])
     agg[key] = value;
@@ -20566,7 +20615,7 @@ function toJSONSchema(input2, params) {
   return finalize(ctx, input2);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-generator.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema-generator.js
 var JSONSchemaGenerator = class {
   /** @deprecated Access via ctx instead */
   get metadataRegistry() {
@@ -20644,10 +20693,10 @@ var JSONSchemaGenerator = class {
   }
 };
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/json-schema.js
 var json_schema_exports = {};
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/schemas.js
 var schemas_exports2 = {};
 __export(schemas_exports2, {
   ZodAny: () => ZodAny,
@@ -20828,7 +20877,7 @@ __export(schemas_exports2, {
   xor: () => xor
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/checks.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/checks.js
 var checks_exports2 = {};
 __export(checks_exports2, {
   endsWith: () => _endsWith,
@@ -20863,7 +20912,7 @@ __export(checks_exports2, {
   uppercase: () => _uppercase
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -20909,7 +20958,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, void 0
   Parent: Error
 });
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -20923,7 +20972,7 @@ var safeDecode2 = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync2 = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config(en_default());
@@ -22388,7 +22437,7 @@ function preprocess(fn, schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/compat.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/compat.js
 var ZodIssueCode = {
   invalid_type: "invalid_type",
   too_big: "too_big",
@@ -22414,7 +22463,7 @@ var ZodFirstPartyTypeKind;
 /* @__PURE__ */ (function(ZodFirstPartyTypeKind2) {
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/iso.js
 var iso_exports = {};
 __export(iso_exports, {
   ZodISODate: () => ZodISODate,
@@ -22439,7 +22488,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/from-json-schema.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/from-json-schema.js
 var z = {
   ...schemas_exports2,
   ...checks_exports2,
@@ -23172,7 +23221,7 @@ function fromJSONSchema(schema, params) {
   return convertSchema(normalized, ctx);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/visit.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/core/visit.js
 var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
@@ -23327,7 +23376,7 @@ function visit(schema, fnOrHandlers) {
   return run(schema);
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/deep-partial.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/deep-partial.js
 function deepPartial(schema) {
   return visit(schema, {
     object: (s) => s.partial(),
@@ -23339,7 +23388,7 @@ function deepPartial(schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/in-out.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/in-out.js
 function withChecks(side, checks) {
   if (!checks?.length)
     return side;
@@ -23369,7 +23418,7 @@ function output(schema) {
   });
 }
 
-// node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/coerce.js
+// node_modules/.pnpm/zod@4.6.6/node_modules/zod/v4/classic/coerce.js
 var coerce_exports = {};
 __export(coerce_exports, {
   bigint: () => bigint3,
@@ -23394,7 +23443,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
 var MAX_RELAY_MESSAGE_BYTES = 1024 * 1024;
 var MAX_CIPHERTEXT_BYTES = MAX_RELAY_MESSAGE_BYTES - 8 * 1024;
 var MAX_IMAGE_ATTACHMENTS = 4;
@@ -23403,13 +23452,11 @@ var MAX_ATTACHMENT_BYTES = 512 * 1024;
 var MAX_ATTACHMENT_TOTAL_BYTES = 512 * 1024;
 var IDEMPOTENCY_WINDOW_MS = 5 * 60 * 1e3;
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
 var PROTOCOL_VERSION = 1;
-var MIN_SUPPORTED_PROTOCOL = 1;
 var PAIRING_TOKEN_RE = /^\d{6}$/;
 var nonEmpty = external_exports.string().min(1);
 var pairingToken = external_exports.string().regex(PAIRING_TOKEN_RE);
-var capabilityList = external_exports.array(external_exports.string().min(1).max(64)).max(64);
 var base64Text = external_exports.string().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
 var clientMeta = external_exports.object({
   /**
@@ -23424,12 +23471,8 @@ var clientMeta = external_exports.object({
 var helloFrame = external_exports.object({
   t: external_exports.literal("hello"),
   role: external_exports.enum(["host", "client"]),
-  protocol: external_exports.number().int().positive().optional(),
-  /**
-   * 本端支持的能力（规范 §5.3）。**可选**：老对端不带，老中继也照旧工作——
-   * 缺省按"只支持基线"处理，而不是按"什么都不支持"拒绝。
-   */
-  capabilities: capabilityList.optional(),
+  /** **必填**：两端必须同版本（单版本制，见 `negotiate.ts`）。 */
+  protocol: external_exports.number().int().positive(),
   /** host 的出站认证凭据，与中继的 `DRC_HOST_TOKEN` 定时安全比较。上限防超长串白占内存。 */
   token: external_exports.string().min(1).max(512).optional(),
   hostId: nonEmpty.optional(),
@@ -23494,9 +23537,7 @@ var helloOkFrame = external_exports.object({
   /** 权威 clientId：小程序会采纳它并覆盖本地安装 id（F2/§3.6）。 */
   clientId: external_exports.string().min(1).max(128).optional(),
   hostId: nonEmpty.optional(),
-  protocol: external_exports.number().int().positive().optional(),
-  /** 中继自己支持的能力（规范 §5.3）。端点据此知道自己能向它要什么。 */
-  capabilities: capabilityList.optional()
+  protocol: external_exports.number().int().positive()
 });
 var pairReadyFrame = external_exports.object({
   t: external_exports.literal("pair-ready"),
@@ -23541,11 +23582,11 @@ var pairFailFrame = external_exports.object({
    * 症状不是"多扫一次码"：B 的 PSK 被丢弃意味着那条配对通道作废，
    * 而这正是文件头引用的那起「取错 PSK 全线解不开」事故的前置条件。
    *
-   * ## 兼容
+   * ## 为什么可选
    *
-   * **可选**：更老的中继不发它，主机侧必须继续按"当前展示的那张"兜底
-   * （`onPairFail` 的注释里写着这条兜底的原因）。发它的是中继、读它的是主机，
-   * 同一时刻两端版本必然一致——所以"新主机 + 老中继"才是需要兜底的那一侧。
+   * **中继不总能知道是哪一张**：帧本身坏掉那条分支（`server.ts` 里 `bad_frame` 那条）
+   * 手上没有 token 可点名。缺省时主机按"当前展示的那张"兜底
+   * （`onPairFail` 的注释里写着这条兜底的原因）。
    */
   pairingToken: external_exports.string().min(1).max(16).optional()
 });
@@ -23568,11 +23609,12 @@ var peerLeftFrame = external_exports.object({
    *     **再也不会带这个 convId 回来**。主机留着这条会话就是一条永远清不掉的幽灵。
    *   - 手机 socket 断了（切后台、断网）：D3 要求会话留着，回前台还要用它。
    *
-   * 不带这个标记 = 断线（老中继行为，保持 D3）；带 true = 主动解配，主机应当把
-   * 会话一并作废，于是 pill 从「手机离线」回到「未配对」（2026-10-05 用户报：
-   * 「mp 端解除配对，dsh 端执行的是手机离线」）。
+   * 不带这个标记 = **断线**（D3：会话留着，回前台还要用）；带 true = 主动解配，
+   * 主机应当把会话一并作废，于是 pill 从「手机离线」回到「未配对」
+   * （2026-10-05 用户报：「mp 端解除配对，dsh 端执行的是手机离线」）。
    *
-   * 可选是刻意的：老中继不会带这个字段，主机必须仍按「断线」处理，不能假定。
+   * 可选是**语义**上的：它表达"这次离开是断线还是解配"，缺省必须是断线
+   * （主机不许假定是解配 —— 那会把用户的一条会话凭空作废）。
    */
   unpaired: external_exports.boolean().optional()
 });
@@ -23609,12 +23651,12 @@ var errorCodes = [
    */
   "history_window_exceeded",
   /**
-   * 对端的对端版本落在 `[MIN_SUPPORTED_PROTOCOL, 本端]` 之外（规范 §5.2 V3）。
+   * 对端报的协议版本与本端**不相等**（含没报，规范 §5.2 V3）。
    *
    * 为什么不复用 `bad_frame`：它是**版本问题**而不是形状问题，而它唯一该触发的
    * 动作是"把版本说清楚"——一句"帧形状非法"会让用户去查一个根本不存在的问题。
-   * 加它不破坏任何老实现：老 client 见到不认识的码会走兜底展示（`message || code`），
-   * 所以中继 MUST 同时带上一句中文 message（规范 §12.3 E1）。
+   * 不认识的码在客户端会走兜底展示（`message || code`），所以中继 MUST 同时带上一句
+   * 中文 message（规范 §12.3 E1）—— 反过来，"没带 message"就是把英文码弹给用户。
    */
   "unsupported_protocol",
   "internal"
@@ -23660,11 +23702,14 @@ var Budget = class {
   windowMs;
   windowAt = 0;
   left = 0;
+  /** 有没有真的开过窗口（见 `take` 的第 ② 条）。 */
+  armed = false;
   /** 取一个配额；成功 true，用尽 false。 */
   take(now) {
-    if (now - this.windowAt >= this.windowMs || now < this.windowAt) {
+    if (!this.armed || now - this.windowAt >= this.windowMs || now < this.windowAt) {
       this.windowAt = now;
       this.left = this.perWindow;
+      this.armed = true;
     }
     if (this.left <= 0) return false;
     this.left -= 1;
@@ -23818,6 +23863,9 @@ function loadConfig(env, version2) {
     pairStatusBudgetPerSec: integer2(env.DRC_PAIR_STATUS_PER_SEC, 5, "DRC_PAIR_STATUS_PER_SEC", problems),
     maxPendingPairs: integer2(env.DRC_MAX_PENDING_PAIRS, 1e3, "DRC_MAX_PENDING_PAIRS", problems),
     maxHostTokens: integer2(env.DRC_MAX_HOST_TOKENS, 500, "DRC_MAX_HOST_TOKENS", problems),
+    // D6：会话表是唯一曾经没有上界的一张表，而每次认领都要同步写它（成本 ∝ 表大小）。
+    // 默认与依据见 `RelayConfig.maxConversations` 的注释。
+    maxConversations: integer2(env.DRC_MAX_CONVERSATIONS, 5e3, "DRC_MAX_CONVERSATIONS", problems),
     claimMinIntervalMs: claimMinIntervalMs(env, problems),
     conversationIdleTtlMs: integer2(env.DRC_CONV_IDLE_TTL_MS, 7 * 24 * 3600 * 1e3, "DRC_CONV_IDLE_TTL_MS", problems),
     // P2-⑤（2026-10-04 用户拍板 30 分钟）：远小于 7 天的空闲 TTL。
@@ -23882,7 +23930,7 @@ var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
 import { randomBytes, randomUUID } from "node:crypto";
 var CONVERSATION_ID_PREFIX = "c_";
 function newConversationId() {
@@ -23892,10 +23940,52 @@ function newHostId() {
   return randomBytes(4).toString("hex");
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
+function negotiateProtocol(peerProtocol, own2 = PROTOCOL_VERSION) {
+  if (peerProtocol === void 0 || peerProtocol === null) {
+    return {
+      ok: false,
+      reason: "missing",
+      peer: peerProtocol,
+      message: `\u5BF9\u65B9\u6CA1\u6709\u62A5\u534F\u8BAE\u7248\u672C\uFF08\u672C\u7AEF\u4E3A ${own2}\uFF09\uFF1A\u628A\u5BF9\u7AEF\u5347\u5230\u540C\u4E00\u7248\u672C\u518D\u8BD5`
+    };
+  }
+  if (typeof peerProtocol !== "number" || !Number.isInteger(peerProtocol) || peerProtocol <= 0) {
+    return {
+      ok: false,
+      reason: "invalid",
+      peer: peerProtocol,
+      message: `\u5BF9\u65B9\u62A5\u544A\u7684\u534F\u8BAE\u7248\u672C\u4E0D\u662F\u6B63\u6574\u6570\uFF08\u6536\u5230 ${JSON.stringify(peerProtocol) ?? "undefined"}\uFF09`
+    };
+  }
+  if (peerProtocol !== own2) {
+    return {
+      ok: false,
+      reason: "mismatch",
+      peer: peerProtocol,
+      /**
+       * ⚠️ 这句话**会被原样弹到用户手机上**（中继 `acceptProtocol` 显式带 message，
+       * 而客户端的处理是 `f.message || f.code`）。所以人称必须从**读它的人**出发：
+       * 收这条错的那端才是要被升级的那端。写"请把本端升级"时，手机用户读到的是
+       * "请升级我的手机"，而真正落后的是中继/主机那一侧 —— 两个方向都试过，
+       * 都会指错人。⇒ 只陈述事实（本端 X、对方 Y），由人来判断升哪一端。
+       */
+      message: `\u534F\u8BAE\u7248\u672C\u5BF9\u4E0D\u4E0A\uFF1A\u8FD9\u4E00\u7AEF\u662F ${own2}\uFF0C\u5BF9\u65B9\u662F ${peerProtocol}\u3002\u4E24\u7AEF\u5FC5\u987B\u662F\u540C\u4E00\u7248\u672C`
+    };
+  }
+  return { ok: true, version: peerProtocol };
+}
+
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
+var WAIT_HINTABLE = /* @__PURE__ */ new Set(["rate_limited", "pair_table_full"]);
+function wantsRetryAfter(code) {
+  return typeof code === "string" && WAIT_HINTABLE.has(code);
+}
+
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
 var SLEEP_BACKENDS = ["caffeinate", "systemd-inhibit", "unsupported"];
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
 var SESSION_STATES = [
   "idle",
   "running",
@@ -23965,9 +24055,18 @@ var evPermissionRequest = external_exports.object({
 var evPermissionResolved = external_exports.object({
   t: external_exports.literal("ev.permission_resolved"),
   requestId: nonEmpty2,
-  sessionId: nonEmpty2.optional(),
-  /** 谁收的场。手机只按"要不要收掉这张卡"读它，所以不做必填。 */
-  by: external_exports.enum(["desktop", "cancelled"]).optional()
+  /**
+   * ⚠️ **必填**（2026-10-11 晚）：句柄在生产端（`runtime.ts` 的 `voidStaleCard`）
+   * 从来都是给全的，而"可选"在这里只有一个后果 —— 一次串台的收场会把别的会话的卡收掉。
+   */
+  sessionId: nonEmpty2,
+  /**
+   * 谁收的场。
+   *
+   * ⚠️ **必填**（2026-10-11 晚）：原来写的是"手机只按'要不要收掉这张卡'读它，所以不做必填"，
+   * 而生产端一直都给 —— 形状只有一种，那就不留"缺了也算合法"的第二条路。
+   */
+  by: external_exports.enum(["desktop", "cancelled"])
 });
 var questionItem = external_exports.object({
   id: nonEmpty2,
@@ -23984,19 +24083,26 @@ var evQuestionRequest = external_exports.object({
   /**
    * 这张提问卡什么时候作废（ISO 字符串）。
    *
-   * 为什么审批有而提问没有过：主机侧的提问等待本来就带超时（`questionTimeoutMs`，默认 300s），
-   * 但手机上那张卡**没有任何倒计时**——用户看不见自己按的按钮什么时候失效，
-   * 而这违反伞仓 `docs/PRODUCT.md` §3 第 3 条「超时必须可见」。
-   * 与审批那条同一个形状：可选、ISO 字符串、由主机每次发问时现算。
+   * ⚠️ **2026-10-11 起：这个字段由宿主决定，我们不自己算。**
+   *
+   * 主机侧追问题时**带不带期限，由那一代内核说了算**（实测它给的是"不带"）。
+   * 带来就填、不带就**省掉这个键** —— 手机据此决定要不要起倒计时，
+   * 而它只在主机真的会到点结算时才有意义。
+   *
+   * 曾经这里写的是"主机侧的提问等待本来就带超时（默认 300s）"，而那个上限是
+   * **插件自己加的**（`approvalTimeoutSec` 那个旋钮同批删除）。
+   * 它造成过真实故障：页面退后台 → 事件退订 → 卡帧到了 client 没到界面 →
+   * 用户回到页面时主机早已判超时，于是"手机上点不动"。
    */
   expiresAt: external_exports.string().optional()
 });
 var evQuestionResolved = external_exports.object({
   t: external_exports.literal("ev.question_resolved"),
   requestId: nonEmpty2,
-  sessionId: nonEmpty2.optional(),
-  /** 谁收的场。手机只按"要不要收掉这张卡"读它，所以不做必填。 */
-  by: external_exports.enum(["desktop", "cancelled"]).optional()
+  /** 必填，理由同 `evPermissionResolved.sessionId`（收场必须精确到会话）。 */
+  sessionId: nonEmpty2,
+  /** 必填，理由同 `evPermissionResolved.by`。 */
+  by: external_exports.enum(["desktop", "cancelled"])
 });
 var evRunState = external_exports.object({
   t: external_exports.literal("ev.run_state"),
@@ -24054,8 +24160,8 @@ var evHostInfo = external_exports.object({
   t: external_exports.literal("ev.host_info"),
   /**
    * 主机自述。这里**没有** `sessionId`，将来也不许加（与 `ev.session_changed` /
-   * `ev.keep_awake_state` 同一条 F11）：能力面是主机级的，按会话分装会把
-   * "这台主机支持什么"变成"这条通道支持什么"，而手机只想知道前者。
+   * `ev.keep_awake_state` 同一条 F11）：限额是主机级的，按会话分装会把
+   * "这台主机能收多少"变成"这条通道能收多少"，而手机只想知道前者。
    */
   host: external_exports.object({
     platform: nonEmpty2,
@@ -24066,8 +24172,6 @@ var evHostInfo = external_exports.object({
     carrier: external_exports.string().optional(),
     dshVersion: external_exports.string().optional()
   }),
-  /** §17.4 的能力 id 列表。生产端取自 `CAPABILITY_IDS`（L1）。 */
-  caps: capabilityList,
   limits: hostLimits,
   state: external_exports.object({
     /** 防休眠走哪条系统后端；`unsupported` 是如实上报，不是错误。 */
@@ -24091,7 +24195,8 @@ var evModel = external_exports.object({
    * 模型是**按会话**的，不带 sessionId 就无法过滤——任何一条别的会话的
    * 模型帧都会覆盖本会话的显示。
    *
-   * 必填：老主机不带这个字段时 mp 端宁可忽略这一帧，也不显示错的。
+   * **必填**（2026-10-11 晚）：不带会话归属的模型帧在 mp 端一律丢弃 ——
+   * 宁可这一帧不算数，也不能把别的会话的模型名显示到本会话顶栏。
    */
   sessionId: nonEmpty2,
   provider: nonEmpty2.optional(),
@@ -24126,8 +24231,9 @@ var evSessionHistory = external_exports.object({
    * 而空页没有任何 seq 可取——于是手机要么记一个陈旧的值（下次重复收到已看过的条目），
    * 要么记 0（下次把整段历史重拉一遍）。这个字段让"你现在到哪了"始终有答案。
    *
-   * ⚠️ 它**不是**能力位那样的"可选支持"：老主机不发这个字段时，手机看到 `undefined`
-   * 就退回 v2 的重拉一页（能力位 `drc.payload.resume` 决定走哪条路）。
+   * ⚠️ 可选的含义是"**这一页报不出游标**"（内核这一代给不出来），不是"对端可能不支持"：
+   * 手机拿到 `undefined` 就按"已经到顶"收工（`client.js` 的 `next === null` 那一支），
+   * 不记一个错的游标。（原来这里还提能力位 `drc.payload.resume` —— 那套机制已删除。）
    */
   latestSeq: external_exports.number().int().nonnegative().optional()
 });
@@ -24174,8 +24280,7 @@ var cmdSendPrompt = external_exports.object({
   sessionId: nonEmpty2,
   text: external_exports.string(),
   /**
-   * 随消息的图片附件。**可选**：老版本手机不带这个字段，老主机看到也不认
-   * （zod 默认 strip 未知键，而 text 照旧）——所以这是向后兼容的增补，不升协议版本。
+   * 随消息的图片附件。**可选**：不带 = 这条消息没有图片（一个真实状态）。
    * 上限取 `limits.ts` 的 `MAX_IMAGE_ATTACHMENTS`（4）：再多对"看清楚这张图"没有帮助，
    * 只是把帧撑爆。**同一个数**还在小程序（`MAX_ATTACH`）与主机侧（`uploads.ts`）各写一遍，
    * 靠 `e2e/wire-surface.test.mjs` 逐处比对钉住——改动必须三处同时发生。
@@ -24306,145 +24411,7 @@ var PAYLOAD_TYPES = {
   evSessionHistory: "ev.session_history"
 };
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
-var ENDPOINT_FRAME_NAMES = [
-  "hello",
-  "pair-begin",
-  "pair-begin-client",
-  "resync",
-  "enc",
-  "enc-batch",
-  "session-leave",
-  "ping"
-];
-var RELAY_FRAME_NAMES = [
-  "hello-ok",
-  "pair-ready",
-  "paired",
-  "pair-fail",
-  "peer-joined",
-  "peer-left",
-  "error",
-  "pong",
-  "enc",
-  "enc-batch"
-];
-var FRAME_TYPES = [
-  .../* @__PURE__ */ new Set([...ENDPOINT_FRAME_NAMES, ...RELAY_FRAME_NAMES])
-];
-var FRAME_TYPE_SET = new Set(FRAME_TYPES);
-function isKnownFrameType(name) {
-  return typeof name === "string" && FRAME_TYPE_SET.has(name);
-}
-var CMD_TYPES = [
-  PAYLOAD_TYPES.cmdSendPrompt,
-  PAYLOAD_TYPES.cmdAnswer,
-  PAYLOAD_TYPES.cmdResolvePermission,
-  PAYLOAD_TYPES.cmdInterrupt,
-  PAYLOAD_TYPES.cmdListSessions,
-  PAYLOAD_TYPES.cmdKeepAwake,
-  PAYLOAD_TYPES.cmdSessionHistory,
-  PAYLOAD_TYPES.cmdNewSession,
-  PAYLOAD_TYPES.cmdGetPending,
-  PAYLOAD_TYPES.cmdArchiveSession
-];
-var EV_TYPES = [
-  PAYLOAD_TYPES.evSessionChanged,
-  PAYLOAD_TYPES.evMessageDelta,
-  PAYLOAD_TYPES.evToolEvent,
-  PAYLOAD_TYPES.evPermissionRequest,
-  PAYLOAD_TYPES.evPermissionResolved,
-  PAYLOAD_TYPES.evQuestionRequest,
-  PAYLOAD_TYPES.evQuestionResolved,
-  PAYLOAD_TYPES.evRunState,
-  PAYLOAD_TYPES.evTodo,
-  PAYLOAD_TYPES.evRetry,
-  PAYLOAD_TYPES.evCompaction,
-  PAYLOAD_TYPES.evKeepAwakeState,
-  PAYLOAD_TYPES.evHostInfo,
-  PAYLOAD_TYPES.evModel,
-  PAYLOAD_TYPES.evResult,
-  PAYLOAD_TYPES.evSessionHistory
-];
-var PAYLOAD_TYPE_SET = /* @__PURE__ */ new Set([...CMD_TYPES, ...EV_TYPES]);
-var CAPABILITY_IDS = [
-  "drc.v1",
-  "drc.pairing.qr",
-  "drc.pairing.token",
-  "drc.payload.attachments",
-  "drc.payload.history",
-  /**
-   * 支持 `cmd.session_history.since` 向前补差量 + `ev.session_history.latestSeq`。
-   *
-   * **为什么是能力位而不是版本号**：协议 v1 的帧名与载荷名冻结（规范 §5.2 V1），
-   * 加这个字段属"加性变更"；而手机要知道**对端是否真的会回 `latestSeq`**，
-   * 才能决定走补差量还是退回重拉一页。版本号表达不了"这一项有没有"。
-   *
-   * 老主机缺这一位时，手机**必须**退回重拉一页而不是发 `since`——
-   * 那是可验证的降级路径（反向判据见 `tests/resume-capability.test.ts`）。
-   */
-  "drc.payload.resume",
-  "drc.payload.new-session.workspace",
-  "drc.payload.get-pending",
-  "drc.payload.keep-awake",
-  "drc.payload.archive-session",
-  "drc.payload.model",
-  "drc.payload.retry-compaction",
-  "drc.cmd.idempotency",
-  "drc.data.enc-batch",
-  "drc.host.resync",
-  "drc.host.info",
-  "drc.crypto.v2"
-];
-var CAPABILITY_SET = new Set(CAPABILITY_IDS);
-
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
-function negotiateProtocol(peerProtocol, own2 = PROTOCOL_VERSION, min = MIN_SUPPORTED_PROTOCOL) {
-  if (peerProtocol === void 0 || peerProtocol === null) {
-    return verdictFor(1, own2, min, true);
-  }
-  if (typeof peerProtocol !== "number" || !Number.isInteger(peerProtocol) || peerProtocol <= 0) {
-    return {
-      ok: false,
-      reason: "invalid",
-      peer: peerProtocol,
-      message: `\u5BF9\u65B9\u62A5\u544A\u7684\u534F\u8BAE\u7248\u672C\u4E0D\u662F\u6B63\u6574\u6570\uFF08\u6536\u5230 ${JSON.stringify(peerProtocol) ?? "undefined"}\uFF09`
-    };
-  }
-  return verdictFor(peerProtocol, own2, min, false);
-}
-function verdictFor(peer, own2, min, missing) {
-  if (peer < min) {
-    return {
-      ok: false,
-      reason: "too_old",
-      peer,
-      message: `\u5BF9\u65B9\u534F\u8BAE\u7248\u672C ${peer} \u592A\u65E7\uFF0C\u672C\u7AEF\u6700\u4F4E\u652F\u6301 ${min}\uFF1B\u8BF7\u628A\u5BF9\u7AEF\u5347\u7EA7\u540E\u518D\u8BD5`
-    };
-  }
-  if (peer > own2) {
-    return {
-      ok: false,
-      reason: "too_new",
-      peer,
-      // ⚠️ 这句话**会被原样弹到用户手机上**（中继 `acceptProtocol` 显式带 message，
-      // 而客户端的处理是 `f.message || f.code`）。所以人称必须从**读它的人**出发：
-      // 收这条错的一端是"对方"，而被要求升级的是它自己 —— 写"请把本端升级"时，
-      // 手机用户读到的是"请升级我的手机"，而真正要升级的是中继/主机那一侧。
-      // 同理"对方"在中继的日志里指的是手机。两个方向都试过，读起来都指错了人。
-      message: `\u672C\u7AEF\u534F\u8BAE\u7248\u672C ${own2} \u6BD4\u5BF9\u65B9\u65E7\uFF08\u5BF9\u65B9\u4E3A ${peer}\uFF09\uFF1B\u8BF7\u628A\u672C\u7AEF\u5347\u7EA7\u5230 ${peer} \u6216\u66F4\u9AD8\u540E\u518D\u8BD5`
-    };
-  }
-  return { ok: true, version: peer, missing };
-}
-
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
-var WAIT_HINTABLE = /* @__PURE__ */ new Set(["rate_limited", "pair_table_full"]);
-function wantsRetryAfter(code) {
-  return typeof code === "string" && WAIT_HINTABLE.has(code);
-}
-
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
 function helloOkForClient(clientId, protocol) {
   return { t: "hello-ok", role: "client", clientId, ...protocol === void 0 ? {} : { protocol } };
 }
@@ -24522,7 +24489,69 @@ function encBatchToRelay(sessionId, items) {
   return { t: "enc-batch", sessionId, items: items.map((item) => ({ ...item })) };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.7/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
+var ENDPOINT_FRAME_NAMES = [
+  "hello",
+  "pair-begin",
+  "pair-begin-client",
+  "resync",
+  "enc",
+  "enc-batch",
+  "session-leave",
+  "ping"
+];
+var RELAY_FRAME_NAMES = [
+  "hello-ok",
+  "pair-ready",
+  "paired",
+  "pair-fail",
+  "peer-joined",
+  "peer-left",
+  "error",
+  "pong",
+  "enc",
+  "enc-batch"
+];
+var FRAME_TYPES = [
+  .../* @__PURE__ */ new Set([...ENDPOINT_FRAME_NAMES, ...RELAY_FRAME_NAMES])
+];
+var FRAME_TYPE_SET = new Set(FRAME_TYPES);
+function isKnownFrameType(name) {
+  return typeof name === "string" && FRAME_TYPE_SET.has(name);
+}
+var CMD_TYPES = [
+  PAYLOAD_TYPES.cmdSendPrompt,
+  PAYLOAD_TYPES.cmdAnswer,
+  PAYLOAD_TYPES.cmdResolvePermission,
+  PAYLOAD_TYPES.cmdInterrupt,
+  PAYLOAD_TYPES.cmdListSessions,
+  PAYLOAD_TYPES.cmdKeepAwake,
+  PAYLOAD_TYPES.cmdSessionHistory,
+  PAYLOAD_TYPES.cmdNewSession,
+  PAYLOAD_TYPES.cmdGetPending,
+  PAYLOAD_TYPES.cmdArchiveSession
+];
+var EV_TYPES = [
+  PAYLOAD_TYPES.evSessionChanged,
+  PAYLOAD_TYPES.evMessageDelta,
+  PAYLOAD_TYPES.evToolEvent,
+  PAYLOAD_TYPES.evPermissionRequest,
+  PAYLOAD_TYPES.evPermissionResolved,
+  PAYLOAD_TYPES.evQuestionRequest,
+  PAYLOAD_TYPES.evQuestionResolved,
+  PAYLOAD_TYPES.evRunState,
+  PAYLOAD_TYPES.evTodo,
+  PAYLOAD_TYPES.evRetry,
+  PAYLOAD_TYPES.evCompaction,
+  PAYLOAD_TYPES.evKeepAwakeState,
+  PAYLOAD_TYPES.evHostInfo,
+  PAYLOAD_TYPES.evModel,
+  PAYLOAD_TYPES.evResult,
+  PAYLOAD_TYPES.evSessionHistory
+];
+var PAYLOAD_TYPE_SET = /* @__PURE__ */ new Set([...CMD_TYPES, ...EV_TYPES]);
+
+// node_modules/.pnpm/@dsh-remote+protocol@3.1.4/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
 function frameTypeOf(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return void 0;
@@ -24615,12 +24644,11 @@ import {
   writeFileSync
 } from "node:fs";
 import { dirname } from "node:path";
-var STATE_FILE_VERSION = 1;
+var STATE_FILE_VERSION = 2;
 var CONVERSATION_ID_RE = new RegExp(`^${CONVERSATION_ID_PREFIX}[0-9a-f]{12}$`);
 var HOST_TOKEN_RE = /^[0-9a-f]{48}$/;
 var MAX_HOST_ID_LEN = 200;
 function sanitizeHostTokens(raw) {
-  if (!Array.isArray(raw)) return { hostTokens: [], dropped: 0 };
   const hostTokens = [];
   const seen = /* @__PURE__ */ new Set();
   for (const item of raw) {
@@ -24628,7 +24656,10 @@ function sanitizeHostTokens(raw) {
       continue;
     }
     const entry = item;
-    if (typeof entry.hostId !== "string" || entry.hostId.length > MAX_HOST_ID_LEN || entry.hostId !== "" && entry.hostId.trim() !== entry.hostId || !isNonEmptyString(entry.token) || !HOST_TOKEN_RE.test(entry.token) || !isTimestamp(entry.issuedAt) || !isTimestamp(entry.lastUsedAt) || seen.has(entry.hostId)) {
+    if (typeof entry.hostId !== "string" || // ⚠️ **空 hostId 一律丢**（2026-10-11 晚）：那曾是"未绑定槽位"的键，而它的令牌
+    // 对任意主机都算数。旧状态文件里可能真有一条这样的记录 —— 读进来就等于把
+    // 那把万能钥匙又装回内存，所以在这一层直接筛掉（不是靠 `hostTokenAccepted` 单独兜）。
+    entry.hostId === "" || entry.hostId.length > MAX_HOST_ID_LEN || entry.hostId.trim() !== entry.hostId || !isNonEmptyString(entry.token) || !HOST_TOKEN_RE.test(entry.token) || !isTimestamp(entry.issuedAt) || !isTimestamp(entry.lastUsedAt) || seen.has(entry.hostId)) {
       continue;
     }
     seen.add(entry.hostId);
@@ -24697,12 +24728,12 @@ function readStateFile(path, log) {
     return void 0;
   }
   const file2 = parsed;
-  if (file2.version !== STATE_FILE_VERSION) {
-    log.warn("state file version mismatch, starting empty", { path, found: String(file2.version) });
-    return void 0;
-  }
   const { conversations, dropped } = sanitize(file2.conversations);
   if (dropped > 0) log.warn("state file entries dropped", { path, dropped, kept: conversations.length });
+  if (!Array.isArray(file2.hostTokens)) {
+    log.warn("state file has no hostTokens array, starting empty", { path });
+    return void 0;
+  }
   const hostTokenResult = sanitizeHostTokens(file2.hostTokens);
   if (hostTokenResult.dropped > 0) {
     log.warn("state file host tokens dropped", {
@@ -24717,13 +24748,12 @@ function readStateFile(path, log) {
     dropped,
     hostTokens: hostTokenResult.hostTokens.length
   });
-  const restored = {
+  return {
     version: STATE_FILE_VERSION,
     savedAt: isTimestamp(file2.savedAt) ? file2.savedAt : 0,
-    conversations
+    conversations,
+    hostTokens: hostTokenResult.hostTokens
   };
-  if (hostTokenResult.hostTokens.length > 0) restored.hostTokens = hostTokenResult.hostTokens;
-  return restored;
 }
 function snapshotState(state, now) {
   const conversations = [];
@@ -24742,9 +24772,7 @@ function snapshotState(state, now) {
   for (const [hostId, entry] of state.hostTokens) {
     hostTokens.push({ hostId, token: entry.token, issuedAt: entry.issuedAt, lastUsedAt: entry.lastUsedAt });
   }
-  const snapshot = { version: STATE_FILE_VERSION, savedAt: now, conversations };
-  if (hostTokens.length > 0) snapshot.hostTokens = hostTokens;
-  return snapshot;
+  return { version: STATE_FILE_VERSION, savedAt: now, conversations, hostTokens };
 }
 function restoreState(path, state, log, now) {
   const file2 = readStateFile(path, log);
@@ -24766,7 +24794,7 @@ function restoreState(path, state, log, now) {
   if (clamped > 0) {
     log.warn("state file timestamps in the future, clamped to now", { path, clamped });
   }
-  for (const entry of file2.hostTokens ?? []) {
+  for (const entry of file2.hostTokens) {
     state.hostTokens.set(entry.hostId, {
       token: entry.token,
       issuedAt: entry.issuedAt,
@@ -24826,20 +24854,25 @@ function writeStateFile(path, snapshot, log) {
 
 // src/state.ts
 var WS_OPEN = 1;
-var UNBOUND_HOST_TOKEN_KEY = "";
 var RelayState = class {
   hosts = /* @__PURE__ */ new Map();
   clients = /* @__PURE__ */ new Map();
   pendingPairs = /* @__PURE__ */ new Map();
   conversations = /* @__PURE__ */ new Map();
-  /** 按 hostId 一机一枚（外加 `UNBOUND_HOST_TOKEN_KEY` 那个未绑定槽位）。 */
+  /** 按 hostId 一机一枚（键一定是非空 hostId，见 `HostTokenEntry`）。 */
   hostTokens = /* @__PURE__ */ new Map();
   /** 测试可注入固定时钟；默认用真实时间。 */
   clock;
   maxPendingPairsValue;
+  /**
+   * 会话表上界（D6）。见 `RelayConfig.maxConversations` 的注释：这是"每次认领同步整表写"
+   * 那条成本链的**唯一**封口。
+   */
+  maxConversationsValue;
   constructor(options = {}) {
     this.clock = options.now ?? (() => Date.now());
     this.maxPendingPairsValue = options.maxPendingPairs ?? 1e3;
+    this.maxConversationsValue = options.maxConversations ?? 5e3;
   }
   now() {
     return this.clock();
@@ -24904,6 +24937,27 @@ var RelayState = class {
     });
     return { ok: true, replaced: existing !== void 0, full: false };
   }
+  /**
+   * 回收**已空**的会话，从最旧的一条开始，直到表回到上界以下（D6）。
+   *
+   * "最旧"按 `emptySince ?? lastActivityAt` 算——即"它被放弃得有多久"，
+   * 而不是"会话建立得有多早"：一条建立了很久但直到刚才才被放弃的会话，
+   * 比一条刚建立就被放弃的更该回收。
+   *
+   * 返回回收了几条（调用方拿它写日志／计数——回收这件事必须留痕，
+   * 否则"表为什么突然小了一截"只能靠猜）。
+   */
+  evictAbandonedConversations() {
+    if (this.conversations.size < this.maxConversationsValue) return 0;
+    const abandoned = [...this.conversations.entries()].filter(([, conv]) => conv.clients.size === 0).sort((a, b) => (a[1].emptySince ?? a[1].lastActivityAt) - (b[1].emptySince ?? b[1].lastActivityAt));
+    let dropped = 0;
+    for (const [conversationId] of abandoned) {
+      if (this.conversations.size < this.maxConversationsValue) break;
+      this.conversations.delete(conversationId);
+      dropped += 1;
+    }
+    return dropped;
+  }
   /** 还能被认领的码数（`/api/pair-status` 与主机侧「还有没有码可发」问的都是它）。 */
   countClaimablePairs() {
     let n = 0;
@@ -24918,6 +24972,12 @@ var RelayState = class {
     if (pending.used) return { ok: false, reason: "already_used" };
     const host = this.hosts.get(pending.hostId);
     if (!host || host.ws.readyState !== WS_OPEN) return { ok: false, reason: "host_offline" };
+    if (this.conversations.size >= this.maxConversationsValue) {
+      this.evictAbandonedConversations();
+      if (this.conversations.size >= this.maxConversationsValue) {
+        return { ok: false, reason: "table_full" };
+      }
+    }
     pending.used = true;
     const detached = this.leaveAll(clientId);
     const conversationId = newConversationId();
@@ -25271,11 +25331,16 @@ function tokenMatches(expected, got) {
   return timingSafeEqual(a, b);
 }
 var CLAIM_TRACK_MAX = 1e4;
+var PERSIST_COALESCE_MS = 200;
 var MAX_HOST_ID_LEN2 = 200;
 var HOST_ID_RE = /^[A-Za-z0-9._:-]+$/;
 function createRelay(config2) {
   const log = new Log(config2.logLevel);
-  const state = new RelayState({ maxPendingPairs: config2.maxPendingPairs });
+  const state = new RelayState({
+    maxPendingPairs: config2.maxPendingPairs,
+    // D6：会话表上界（缺了它，每次认领的同步整表写就成了无界的成本放大）。
+    maxConversations: config2.maxConversations
+  });
   const startedAt = Date.now();
   const pairBudget = new Budget(config2.pairGlobalBudgetPerSec);
   const pairStatusBudget = new Budget(config2.pairStatusBudgetPerSec);
@@ -25284,6 +25349,8 @@ function createRelay(config2) {
   const lastClaimAt = /* @__PURE__ */ new Map();
   let sweepTimer;
   let pingTimer;
+  let persistPending = false;
+  let persistTimer;
   let lastPingAt = 0;
   let lastCountersAt = 0;
   function newHostToken() {
@@ -25301,15 +25368,9 @@ function createRelay(config2) {
   }
   function hostTokenAccepted(hostId, got) {
     if (!got) return false;
-    const now = Date.now();
     const perHost = state.hostTokens.get(hostId);
     if (perHost && tokenMatches(perHost.token, got)) {
-      state.markHostTokenUsed(hostId, now);
-      return true;
-    }
-    const unbound = state.hostTokens.get(UNBOUND_HOST_TOKEN_KEY);
-    if (unbound && tokenMatches(unbound.token, got)) {
-      state.markHostTokenUsed(UNBOUND_HOST_TOKEN_KEY, now);
+      state.markHostTokenUsed(hostId, Date.now());
       return true;
     }
     return config2.hostToken !== "" && tokenMatches(config2.hostToken, got);
@@ -25325,6 +25386,11 @@ function createRelay(config2) {
     }
   }
   function persistNow() {
+    persistPending = false;
+    if (persistTimer !== void 0) {
+      clearTimeout(persistTimer);
+      persistTimer = void 0;
+    }
     if (!persistence.enabled) return false;
     const ok = writeStateFile(config2.stateFile, snapshotState(state, Date.now()), log);
     if (ok) {
@@ -25336,6 +25402,17 @@ function createRelay(config2) {
     return ok;
   }
   function markStateChanged() {
+    if (!persistence.enabled) return;
+    persistPending = true;
+    if (persistTimer !== void 0) return;
+    persistTimer = setTimeout(() => {
+      persistTimer = void 0;
+      flushPendingPersist();
+    }, PERSIST_COALESCE_MS);
+    persistTimer.unref?.();
+  }
+  function flushPendingPersist() {
+    if (!persistPending) return;
     persistNow();
   }
   const MAX_PING_BUCKETS = 1024;
@@ -25423,21 +25500,6 @@ function createRelay(config2) {
     peer.hostId = void 0;
   }
   function handleHello(peer, frame) {
-    if (peer.protocol === void 0 && !peer.countedProtocol) {
-      peer.countedProtocol = true;
-      if (frame.protocol === void 0) peersWithoutProtocol++;
-      else peerProtocols.set(frame.protocol, (peerProtocols.get(frame.protocol) ?? 0) + 1);
-    } else if (peer.protocol !== frame.protocol) {
-      if (peer.protocol === void 0) peersWithoutProtocol = Math.max(0, peersWithoutProtocol - 1);
-      else {
-        const left = (peerProtocols.get(peer.protocol) ?? 1) - 1;
-        if (left > 0) peerProtocols.set(peer.protocol, left);
-        else peerProtocols.delete(peer.protocol);
-      }
-      if (frame.protocol === void 0) peersWithoutProtocol++;
-      else peerProtocols.set(frame.protocol, (peerProtocols.get(frame.protocol) ?? 0) + 1);
-    }
-    peer.protocol = frame.protocol;
     if (frame.role === "host") {
       const hostId = frame.hostId?.trim() || newHostId();
       if (!config2.hostToken && state.hostTokens.size === 0) {
@@ -25520,9 +25582,24 @@ function createRelay(config2) {
     }
     const claimed = state.claim(frame.pairingToken, peer.clientId);
     if (!claimed.ok) {
+      const wireReason = claimed.reason === "table_full" ? "invalid_or_expired" : claimed.reason;
+      if (claimed.reason === "table_full") {
+        counters.rejectedPairs += 1;
+        const now = Date.now();
+        if (now - peer.tableFullWarnedAt >= 1e3) {
+          peer.tableFullWarnedAt = now;
+          log.warn("conversation table full, refusing new pairings (D6)", {
+            clientId: peer.clientId,
+            conversations: state.conversations.size,
+            max: config2.maxConversations
+          });
+        }
+        sendToPeer(peer, pairFail(wireReason, frame.pairingToken));
+        return;
+      }
       peer.pairAttempts += 1;
       counters.rejectedPairs += 1;
-      sendToPeer(peer, pairFail(claimed.reason, frame.pairingToken));
+      sendToPeer(peer, pairFail(wireReason, frame.pairingToken));
       log.info("pair failed", {
         clientId: peer.clientId,
         reason: claimed.reason,
@@ -25607,8 +25684,6 @@ function createRelay(config2) {
     for (const sock of clients) sendTo(sock, encBatchToClient(frame.sessionId, items));
   }
   let lastResyncPersistAt = 0;
-  const peerProtocols = /* @__PURE__ */ new Map();
-  let peersWithoutProtocol = 0;
   function acceptProtocol(peer, peerProtocol) {
     const verdict = negotiateProtocol(peerProtocol);
     if (verdict.ok) return true;
@@ -25722,10 +25797,9 @@ function createRelay(config2) {
       notedNonMember: false,
       notedPairTableFull: false,
       pairBudgetWarnedAt: 0,
+      tableFullWarnedAt: 0,
       backpressure: new BackpressureGate(),
       alive: true,
-      // 观测面计数的闩锁（见 Peer.countedProtocol）：连接为单位，不是 hello 为单位。
-      countedProtocol: false,
       // 轮转序号取模分配：**均匀是刻意的**。哪怕重启风暴里 10k 条连接在几十秒内
       // 全建起来，它们也会摊到所有桶上；若改成"分给下一个将要轮到的桶"，
       // 风暴会把它们全塞进同一两个桶，等于把刚拆掉的突发又造回来（C7 的场景）。
@@ -25800,12 +25874,6 @@ function createRelay(config2) {
     });
     ws.on("close", () => {
       peers.delete(ws);
-      if (peer.protocol === void 0) peersWithoutProtocol = Math.max(0, peersWithoutProtocol - 1);
-      else {
-        const left = (peerProtocols.get(peer.protocol) ?? 1) - 1;
-        if (left > 0) peerProtocols.set(peer.protocol, left);
-        else peerProtocols.delete(peer.protocol);
-      }
       bucketAt(peer.pingBucket).delete(peer);
       if (peer.role === "client" && peer.clientId) {
         for (const notice of state.clientGone(peer.clientId, ws)) {
@@ -25899,18 +25967,12 @@ function createRelay(config2) {
       stateWriteFailures: persistence.failures,
       lastPingAgo: lastPingAt === 0 ? -1 : Math.round((Date.now() - lastPingAt) / 1e3),
       shuttingDown,
-      // 协议版本协商的观测面（2026-10-07）。有了版本闸之后，"为什么这个对端连不上"
-      // 就成了新的排障问题，而没有这一项时它只能去翻日志。
-      //
-      // 报的是**对端报的最小/最大版本**与"没报过版本"的连接数，两个方向缺一不可：
-      // 只报最大值的话，一个全是老小程序的环境看起来与新版本一样正常。
-      protocolSelf: PROTOCOL_VERSION,
-      protocolMin: MIN_SUPPORTED_PROTOCOL,
-      peerProtocolMin: peerProtocols.size === 0 ? -1 : Math.min(...peerProtocols.keys()),
-      peerProtocolMax: peerProtocols.size === 0 ? -1 : Math.max(...peerProtocols.keys()),
-      peersNoProtocol: peersWithoutProtocol
+      // 本端说的协议版本（单版本制：它是一个常量，但排障时要能一眼看到"这一个中继
+      // 说的是哪一版"——版本对不上的现场表现是"连上了、什么都不发生"，没有任何一层会报错）。
+      protocolSelf: PROTOCOL_VERSION
     };
   }
+  const BODY_TOO_LARGE = "body_too_large";
   function readBody(req, limit) {
     return new Promise((resolve, reject) => {
       const chunks = [];
@@ -25918,8 +25980,8 @@ function createRelay(config2) {
       req.on("data", (chunk) => {
         size += chunk.length;
         if (size > limit) {
-          reject(new Error("body_too_large"));
-          req.destroy();
+          req.pause();
+          reject(Object.assign(new Error(BODY_TOO_LARGE), { code: BODY_TOO_LARGE }));
           return;
         }
         chunks.push(chunk);
@@ -25950,7 +26012,18 @@ function createRelay(config2) {
     }
     rememberClaim(ip, now);
     let body = {};
-    const raw = await readBody(req, CLAIM_BODY_MAX_BYTES);
+    let raw;
+    try {
+      raw = await readBody(req, CLAIM_BODY_MAX_BYTES);
+    } catch (error62) {
+      if (error62?.code === BODY_TOO_LARGE) {
+        res.statusCode = 413;
+        res.setHeader("connection", "close");
+        res.end(JSON.stringify({ error: "body_too_large", limitBytes: CLAIM_BODY_MAX_BYTES }));
+        return;
+      }
+      throw error62;
+    }
     if (raw.trim() !== "") {
       try {
         const parsed = JSON.parse(raw);
@@ -25961,24 +26034,29 @@ function createRelay(config2) {
       }
     }
     const rawHostId = typeof body.hostId === "string" ? body.hostId.trim() : "";
-    if (rawHostId !== "" && (rawHostId.length > MAX_HOST_ID_LEN2 || !HOST_ID_RE.test(rawHostId))) {
+    if (rawHostId === "") {
+      res.statusCode = 400;
+      res.end(
+        JSON.stringify({
+          error: "host_id_required",
+          hint: 'POST {"hostId":"<\u672C\u673A\u8EAB\u4EFD>"} \u2014\u2014 2026-10-11 \u8D77\u4EE4\u724C\u6309 hostId \u4E00\u673A\u4E00\u679A\uFF0C\u6CA1\u6709\u8EAB\u4EFD\u5C31\u4E0D\u7B7E'
+        })
+      );
+      return;
+    }
+    if (rawHostId.length > MAX_HOST_ID_LEN2 || !HOST_ID_RE.test(rawHostId)) {
       res.statusCode = 400;
       res.end(
         JSON.stringify({ error: "bad_host_id", hint: `hostId \u6700\u591A ${MAX_HOST_ID_LEN2} \u5B57\u7B26\uFF0C\u53EA\u5141\u8BB8\u5B57\u6BCD\u6570\u5B57\u4E0E ._:-` })
       );
       return;
     }
-    const slot = rawHostId === "" ? UNBOUND_HOST_TOKEN_KEY : rawHostId;
     const token = newHostToken();
-    state.issueHostToken(slot, token, now);
+    state.issueHostToken(rawHostId, token, now);
     const pruned = state.pruneHostTokens(config2.maxHostTokens);
     if (pruned > 0) log.warn("host tokens pruned", { dropped: pruned, kept: state.hostTokens.size });
     markStateChanged();
-    log.info(rawHostId === "" ? "host token claimed (unbound)" : "host token claimed", {
-      ip,
-      hostId: rawHostId,
-      hostTokens: state.hostTokens.size
-    });
+    log.info("host token claimed", { ip, hostId: rawHostId, hostTokens: state.hostTokens.size });
     res.end(JSON.stringify({ token, hostId: rawHostId, rotatedAt: new Date(now).toISOString() }));
   }
   function httpHandler(req, res) {
@@ -26186,7 +26264,7 @@ function registerSignalHandlers(shutdown) {
 
 // src/main.ts
 function readVersion() {
-  if ("3.1.3") return "3.1.3";
+  if ("3.1.5") return "3.1.5";
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string") return pkg.version;