@ljwei-stak/dsh-model-route-bot 0.66.3 → 0.67.0

package/remote-computer-agent/dist/cli-stdio-bridge.mjs

@@ -1,6 +1,6 @@
 // ../packages/capability-broker/src/cli-stdio-bridge.mjs
 import { createPublicKey, verify } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 import { setTimeout as delay } from "node:timers/promises";
 import { Server } from "@modelcontextprotocol/server";
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
@@ -9,10 +9,128 @@ import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/s
 import { spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { StringDecoder } from "node:string_decoder";
-import { isAbsolute, join } from "node:path";
+import { access, lstat, readFile, readdir, realpath, rmdir, unlink } from "node:fs/promises";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { fileURLToPath } from "node:url";
+
+// ../packages/cli-runtime/src/native-cli-output.mjs
+import { createHash } from "node:crypto";
+var FRAME = 262144;
+var RAW_FRAME = 18 * 1024 * 1024;
+var IMAGE = 6 * 1024 * 1024;
+var fail = () => {
+  throw new Error("CLI_FRAME_LIMIT");
+};
+function receipt(frame, rawBytes) {
+  const results = frame?.type === "user" && frame.message?.content;
+  const toolResult = Array.isArray(results) && results.length > 0 && results.every((block) => block?.type === "tool_result" && typeof block.tool_use_id === "string");
+  if (!toolResult) {
+    if (rawBytes > FRAME) fail();
+    return frame;
+  }
+  let imageBytes = 0, images = 0, nodes = 0;
+  const visit = (value, depth = 0) => {
+    if (++nodes > 3e4 || depth > 24) fail();
+    if (!value || typeof value !== "object") return value;
+    if (value.type === "image") {
+      const source = value.source;
+      const data = source?.type === "base64" ? source.data : value.data;
+      const mediaType = source?.type === "base64" ? source.media_type : value.mimeType;
+      if (typeof data !== "string" || data.length > IMAGE / 3 * 4 || !["image/png", "image/jpeg", "image/webp"].includes(mediaType)) fail();
+      const bytes = Buffer.from(data, "base64");
+      if (!bytes.length || bytes.length > IMAGE || bytes.toString("base64") !== data || ++images > 32 || (imageBytes += bytes.length) > IMAGE * 2) fail();
+      return { type: "image", mediaType, bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") };
+    }
+    if (Array.isArray(value)) return value.map((item) => visit(item, depth + 1));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, visit(item, depth + 1)]));
+  };
+  const result = visit(frame);
+  if (rawBytes > FRAME && !images || Buffer.byteLength(JSON.stringify(result)) > FRAME) fail();
+  return result;
+}
+var NativeCliOutput = class {
+  #buffer = "";
+  #bytes = 0;
+  push(text) {
+    this.#buffer += text;
+    const frames = [];
+    let end;
+    while ((end = this.#buffer.indexOf("\n")) >= 0) {
+      const line = this.#buffer.slice(0, end);
+      this.#buffer = this.#buffer.slice(end + 1);
+      const rawBytes = Buffer.byteLength(line);
+      if (rawBytes > RAW_FRAME) fail();
+      if (!line.trim()) continue;
+      const frame = receipt(JSON.parse(line), rawBytes);
+      this.#bytes += Buffer.byteLength(JSON.stringify(frame));
+      if (this.#bytes > 8 * 1024 * 1024) fail();
+      frames.push(frame);
+    }
+    if (Buffer.byteLength(this.#buffer) > RAW_FRAME) fail();
+    return frames;
+  }
+};
+
+// ../packages/cli-runtime/src/native-process.mjs
 var HERE = fileURLToPath(new URL(".", import.meta.url));
 var MAX_FRAME = 262144;
+var COMPILER_ROOT = "DSH_NATIVE_COMPILER_ROOT";
+var COMPILER_SCRATCH = "DSH_NATIVE_COMPILER_SCRATCH";
+var inheritedCompilerRoot = process.platform === "win32" ? process.env[COMPILER_ROOT] : void 0;
+var hostTemp = process.platform === "win32" ? tmpdir() : null;
+var compilerRoot = null;
+var compilerFailure = () => Object.assign(new Error("NATIVE_COMPILER_SCRATCH_UNAVAILABLE"), { code: "NATIVE_COMPILER_SCRATCH_UNAVAILABLE" });
+var sameDirectory = (info, expected) => info.isDirectory() && !info.isSymbolicLink() && info.dev === expected.dev && info.ino === expected.ino;
+var rootStamp = (path) => `dsh-native-compiler-v1:${basename(path)}
+`;
+function compilerDirectory() {
+  try {
+    if (!compilerRoot) {
+      if (inheritedCompilerRoot !== void 0) {
+        if (!isAbsolute(inheritedCompilerRoot) || inheritedCompilerRoot.length > 140 || !/^dshc-[a-f0-9]{16}$/.test(basename(inheritedCompilerRoot))) throw compilerFailure();
+        const info2 = lstatSync(inheritedCompilerRoot, { bigint: true });
+        if (!info2.isDirectory() || info2.isSymbolicLink() || realpathSync(inheritedCompilerRoot) !== inheritedCompilerRoot || readFileSync(join(inheritedCompilerRoot, ".dsh-root"), "utf8") !== rootStamp(inheritedCompilerRoot)) throw compilerFailure();
+        compilerRoot = { path: inheritedCompilerRoot, info: info2 };
+      } else {
+        const parent = realpathSync(hostTemp);
+        const path2 = join(parent, `dshc-${randomBytes(8).toString("hex")}`);
+        if (path2.length > 140) throw compilerFailure();
+        mkdirSync(path2);
+        writeFileSync(join(path2, ".dsh-root"), rootStamp(path2), { flag: "wx" });
+        compilerRoot = { path: path2, info: lstatSync(path2, { bigint: true }) };
+      }
+    }
+    if (!sameDirectory(lstatSync(compilerRoot.path, { bigint: true }), compilerRoot.info) || realpathSync(compilerRoot.path) !== compilerRoot.path) throw compilerFailure();
+    const path = mkdtempSync(join(compilerRoot.path, "c-"));
+    const info = lstatSync(path, { bigint: true }), owner = randomBytes(16).toString("hex");
+    writeFileSync(join(path, ".dsh-owner"), owner, { flag: "wx" });
+    const root = compilerRoot;
+    const cleanup = async () => {
+      try {
+        if (dirname(path) !== root.path || !/^c-[A-Za-z0-9]{6}$/.test(basename(path))) return false;
+        if (!sameDirectory(await lstat(root.path, { bigint: true }), root.info) || await realpath(root.path) !== root.path) return false;
+        if (!sameDirectory(await lstat(path, { bigint: true }), info) || await realpath(path) !== path || await readFile(join(path, ".dsh-owner"), "utf8") !== owner) return false;
+        const names = await readdir(path);
+        if (names.length > 128) return false;
+        for (const name of names) {
+          const entry = await lstat(join(path, name));
+          if (!entry.isFile() || entry.isSymbolicLink()) return false;
+        }
+        for (const name of names) await unlink(join(path, name));
+        await rmdir(path);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    return { root: root.path, path, cleanup };
+  } catch {
+    throw compilerFailure();
+  }
+}
 function privateEnvironment(home, source = process.env) {
   const env = {
     HOME: home,
@@ -32,30 +150,32 @@ function privateEnvironment(home, source = process.env) {
   };
   for (const key of ["SystemRoot", "windir", "ComSpec", "LANG", "LC_ALL"]) if (source[key]) env[key] = source[key];
   env.PATH = process.platform === "win32" ? join(source.SystemRoot ?? "C:\\Windows", "System32") : "/usr/bin:/bin";
+  if (process.platform === "win32" && (compilerRoot?.path ?? inheritedCompilerRoot)) env[COMPILER_ROOT] = compilerRoot?.path ?? inheritedCompilerRoot;
   return env;
 }
 function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {
   const events = new EventEmitter();
   const args = helper.platform === "win32" ? [...helper.prefix, "-Mode", mode] : [...helper.prefix, mode];
-  const child = spawn(helper.executable, args, { cwd: home, env, windowsHide: true, shell: false, stdio: ["pipe", "pipe", "pipe"] });
-  let tail = "", buffer = "", bytes = 0, closed = false;
+  const compiler = helper.platform === "win32" ? compilerDirectory() : null;
+  const helperEnv = compiler ? Object.fromEntries(Object.entries(env).filter(([key]) => ![COMPILER_ROOT, COMPILER_SCRATCH].includes(key.toUpperCase()))) : env;
+  if (compiler) {
+    helperEnv[COMPILER_ROOT] = compiler.root;
+    helperEnv[COMPILER_SCRATCH] = compiler.path;
+  }
+  const child = spawn(helper.executable, args, { cwd: home, env: helperEnv, windowsHide: true, shell: false, stdio: ["pipe", "pipe", "pipe"] });
+  let tail = "", buffer = "", bytes = 0, closed = false, treeStopped = false;
   const decoder = new StringDecoder("utf8"), cliDecoder = new StringDecoder("utf8");
-  let cliBuffer = "";
+  const cliOutput = new NativeCliOutput();
   const frame = (value) => {
+    if (mode === "supervise" && value.control === "stopped" && value.treeStopped === true) treeStopped = true;
     if (mode === "supervise" && value.type === "cli-output") {
       if (typeof value.data !== "string" || value.data.length > MAX_FRAME * 2) throw new Error("INVALID_CLI_FRAME");
-      cliBuffer += cliDecoder.write(Buffer.from(value.data, "base64"));
-      if (Buffer.byteLength(cliBuffer) > MAX_FRAME) throw new Error("CLI_FRAME_LIMIT");
-      let end;
-      while ((end = cliBuffer.indexOf("\n")) >= 0) {
-        const line = cliBuffer.slice(0, end);
-        cliBuffer = cliBuffer.slice(end + 1);
-        if (line.trim()) events.emit("message", JSON.parse(line));
-      }
+      for (const message of cliOutput.push(cliDecoder.write(Buffer.from(value.data, "base64")))) events.emit("message", message);
     } else events.emit(value.control ? "control" : "message", value);
   };
-  const exit = new Promise((resolve) => child.once("close", (code, signal) => {
+  const exit = new Promise((resolve) => child.once("close", async (code, signal) => {
     closed = true;
+    if (compiler && code === 0 && signal === null && (mode !== "supervise" || treeStopped)) await compiler.cleanup();
     events.emit("closed", { code, signal });
     resolve({ code, signal });
   }));
@@ -68,7 +188,8 @@ function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home
   child.stdout.on("data", (chunk) => {
     bytes += chunk.length;
     buffer += decoder.write(chunk);
-    if (bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) {
+    const boundedStream = mode === "client" || mode === "server" || mode === "supervise";
+    if (!boundedStream && bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) {
       events.emit("failure", new Error("OUTPUT_LIMIT"));
       child.stdin.end();
       return;
@@ -135,14 +256,71 @@ function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home
 }
 
 // ../packages/capability-broker/src/cli-stdio-bridge.mjs
-import { dirname, isAbsolute as isAbsolute2 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2 } from "node:path";
+
+// ../packages/capability-broker/src/cli-bridge-response.mjs
+import { createHash as createHash2 } from "node:crypto";
+var CHUNK_BYTES = 128 * 1024;
+var MAX_RESPONSE = 9 * 1024 * 1024;
+var MAX_BUFFERED = 16 * 1024 * 1024;
+var fail2 = () => {
+  throw new Error("INVALID_BRIDGE_RESPONSE");
+};
+var sha = (bytes) => createHash2("sha256").update(bytes).digest("hex");
+var BridgeResponseReader = class {
+  #parts = /* @__PURE__ */ new Map();
+  #buffered = 0;
+  drop(id) {
+    const state = this.#parts.get(id);
+    if (state) this.#buffered -= state.size;
+    this.#parts.delete(id);
+  }
+  clear() {
+    this.#parts.clear();
+    this.#buffered = 0;
+  }
+  accept(frame) {
+    if (!Number.isSafeInteger(frame?.id) || frame.id < 1) fail2();
+    if (frame.type === "response") {
+      this.drop(frame.id);
+      return frame;
+    }
+    if (frame.type === "response-start") {
+      if (this.#parts.has(frame.id) || this.#parts.size >= 16 || !Number.isSafeInteger(frame.bytes) || frame.bytes <= CHUNK_BYTES || frame.bytes > MAX_RESPONSE) fail2();
+      this.#parts.set(frame.id, { expected: frame.bytes, size: 0, chunks: [] });
+      return null;
+    }
+    const state = this.#parts.get(frame.id);
+    if (!state) fail2();
+    if (frame.type === "response-chunk") {
+      if (frame.index !== state.chunks.length || typeof frame.data !== "string" || frame.data.length > Math.ceil(CHUNK_BYTES / 3) * 4) fail2();
+      const bytes2 = Buffer.from(frame.data, "base64");
+      if (!bytes2.length || bytes2.length > CHUNK_BYTES || bytes2.toString("base64") !== frame.data || state.size + bytes2.length > state.expected || this.#buffered + bytes2.length > MAX_BUFFERED) fail2();
+      state.chunks.push(bytes2);
+      state.size += bytes2.length;
+      this.#buffered += bytes2.length;
+      return null;
+    }
+    if (frame.type !== "response-end" || state.size !== state.expected) fail2();
+    const bytes = Buffer.concat(state.chunks);
+    this.drop(frame.id);
+    if (frame.sha256 !== sha(bytes)) fail2();
+    const value = JSON.parse(bytes.toString("utf8"));
+    if (value.type !== "response" || value.id !== frame.id) fail2();
+    return value;
+  }
+};
+
+// ../packages/capability-broker/src/cli-stdio-bridge.mjs
 var relay;
 var handle;
 var pending = /* @__PURE__ */ new Map();
+var responses = new BridgeResponseReader();
 var sequence = 0;
 var finish = () => {
   for (const value of pending.values()) value.reject(new Error("BROKER_CLOSED"));
   pending.clear();
+  responses.clear();
   relay?.end();
 };
 try {
@@ -152,7 +330,7 @@ try {
   const deadline = Date.now() + 15e3;
   while (!descriptor && Date.now() < deadline) {
     try {
-      const wire = await readFile(path);
+      const wire = await readFile2(path);
       if (wire.length > 32768) throw new Error("DESCRIPTOR_LIMIT");
       descriptor = JSON.parse(wire);
     } catch (error) {
@@ -171,7 +349,7 @@ try {
     spec.helper,
     "client",
     { endpoint: spec.endpoint, serverPid: spec.serverPid, serverStart: spec.serverStart, ttlMs: remaining },
-    { home: dirname(path), env: privateEnvironment(dirname(path)) }
+    { home: dirname2(path), env: privateEnvironment(dirname2(path)) }
   );
   const ask = (op, payload, signal) => new Promise((resolve, reject) => {
     if (relay.closed || pending.size >= 16) {
@@ -182,6 +360,7 @@ try {
     const abort = () => {
       const value = pending.get(id);
       pending.delete(id);
+      responses.drop(id);
       void relay.send({ type: "cancel", id }).catch(() => {
       });
       value?.reject(new Error("REQUEST_CANCELLED"));
@@ -201,15 +380,25 @@ try {
     void relay.send({ type: "request", id, op, ...payload }).catch(() => {
       const value = pending.get(id);
       pending.delete(id);
+      responses.drop(id);
       value?.reject(new Error("BROKER_CLOSED"));
     });
   });
   relay.events.on("message", (message) => {
-    if (message?.type !== "response" || !Number.isSafeInteger(message.id)) return;
-    const value = pending.get(message.id);
-    pending.delete(message.id);
-    if (message.ok) value?.resolve(message.value);
-    else value?.reject(new Error(message.code ?? "BROKER_REFUSED"));
+    if (!Number.isSafeInteger(message?.id) || !pending.has(message.id)) return;
+    try {
+      const response = responses.accept(message);
+      if (!response) return;
+      const value = pending.get(response.id);
+      pending.delete(response.id);
+      if (response.ok) value?.resolve(response);
+      else value?.reject(new Error(response.code ?? "BROKER_REFUSED"));
+    } catch {
+      const value = pending.get(message.id);
+      pending.delete(message.id);
+      responses.drop(message.id);
+      value?.reject(new Error("INVALID_BRIDGE_RESPONSE"));
+    }
   });
   relay.events.on("failure", () => {
     finish();
@@ -221,10 +410,11 @@ try {
   });
   handle = serveStdio(() => {
     const server = new Server({ name: "dsh-task-capability-bridge", version: "0.0.0" }, { capabilities: { tools: {} } });
-    server.setRequestHandler("tools/list", async (_request, ctx) => ({ tools: await ask("list", {}, ctx.mcpReq.signal) }));
+    server.setRequestHandler("tools/list", async (_request, ctx) => ({ tools: (await ask("list", {}, ctx.mcpReq.signal)).value }));
     server.setRequestHandler("tools/call", async (request, ctx) => {
       try {
-        return { content: [{ type: "text", text: JSON.stringify(await ask("call", { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal)) }] };
+        const response = await ask("call", { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal);
+        return response.mcpResult ?? { content: [{ type: "text", text: JSON.stringify(response.value) }] };
       } catch (error) {
         return { isError: true, content: [{ type: "text", text: error.message }] };
       }

package/remote-computer-agent/dist/cli-stdio-bridge.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../../packages/capability-broker/src/cli-stdio-bridge.mjs", "../../packages/cli-runtime/src/native-process.mjs"],
-  "sourcesContent": ["import { createPublicKey, verify } from 'node:crypto'\nimport { readFile } from 'node:fs/promises'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { Server } from '@modelcontextprotocol/server'\nimport { serveStdio, StdioServerTransport } from '@modelcontextprotocol/server/stdio'\nimport { nativeProcess, privateEnvironment } from '../../cli-runtime/src/native-process.mjs'\nimport { dirname, isAbsolute } from 'node:path'\n\nlet relay, handle\nconst pending = new Map()\nlet sequence = 0\nconst finish = () => {\n  for (const value of pending.values()) value.reject(new Error('BROKER_CLOSED'))\n  pending.clear()\n  relay?.end()\n}\ntry {\n  const [path, publicSpki] = process.argv.slice(2)\n  if (process.argv.length !== 4 || !isAbsolute(path) || !/^[A-Za-z0-9_-]{40,256}$/.test(publicSpki)) throw new Error('PRIVATE_BOOTSTRAP_REQUIRED')\n  let descriptor\n  const deadline = Date.now() + 15_000\n  while (!descriptor && Date.now() < deadline) {\n    try { const wire = await readFile(path); if (wire.length > 32_768) throw new Error('DESCRIPTOR_LIMIT'); descriptor = JSON.parse(wire) }\n    catch (error) { if (error.code !== 'ENOENT') throw error; await delay(50) }\n  }\n  if (!descriptor || typeof descriptor.payload !== 'string' || typeof descriptor.signature !== 'string') throw new Error('INVALID_BOOTSTRAP')\n  const key = createPublicKey({ key: Buffer.from(publicSpki, 'base64url'), format: 'der', type: 'spki' })\n  if (!verify(null, Buffer.from(descriptor.payload), key, Buffer.from(descriptor.signature, 'base64url'))) throw new Error('BOOTSTRAP_SIGNATURE')\n  const spec = JSON.parse(descriptor.payload)\n  const handoffRemaining = Math.floor(spec.expiresAt - Date.now())\n  const remaining = Math.floor(spec.sessionExpiresAt - Date.now())\n  if (spec.version !== 1 || handoffRemaining < 1 || handoffRemaining > 15_000 || remaining < 1 || remaining > 7_200_000) throw new Error('BOOTSTRAP_EXPIRED')\n  relay = nativeProcess(spec.helper, 'client', { endpoint: spec.endpoint, serverPid: spec.serverPid, serverStart: spec.serverStart, ttlMs: remaining },\n    { home: dirname(path), env: privateEnvironment(dirname(path)) })\n  const ask = (op, payload, signal) => new Promise((resolve, reject) => {\n    if (relay.closed || pending.size >= 16) { reject(new Error('BROKER_UNAVAILABLE')); return }\n    const id = ++sequence\n    const abort = () => { const value = pending.get(id); pending.delete(id); void relay.send({ type: 'cancel', id }).catch(() => {}); value?.reject(new Error('REQUEST_CANCELLED')) }\n    if (signal?.aborted) { reject(new Error('REQUEST_CANCELLED')); return }\n    const timer = setTimeout(abort, Math.min(remaining, 30_000))\n    signal?.addEventListener('abort', abort, { once: true })\n    const settle = fn => value => { clearTimeout(timer); signal?.removeEventListener('abort', abort); fn(value) }\n    pending.set(id, { resolve: settle(resolve), reject: settle(reject) })\n    void relay.send({ type: 'request', id, op, ...payload }).catch(() => { const value = pending.get(id); pending.delete(id); value?.reject(new Error('BROKER_CLOSED')) })\n  })\n  relay.events.on('message', message => {\n    if (message?.type !== 'response' || !Number.isSafeInteger(message.id)) return\n    const value = pending.get(message.id); pending.delete(message.id)\n    if (message.ok) value?.resolve(message.value)\n    else value?.reject(new Error(message.code ?? 'BROKER_REFUSED'))\n  })\n  relay.events.on('failure', () => { finish(); void handle?.close() })\n  relay.events.once('closed', () => { finish(); void handle?.close() })\n  handle = serveStdio(() => {\n    const server = new Server({ name: 'dsh-task-capability-bridge', version: '0.0.0' }, { capabilities: { tools: {} } })\n    server.setRequestHandler('tools/list', async (_request, ctx) => ({ tools: await ask('list', {}, ctx.mcpReq.signal) }))\n    server.setRequestHandler('tools/call', async (request, ctx) => {\n      try { return { content: [{ type: 'text', text: JSON.stringify(await ask('call', { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal)) }] } }\n      catch (error) { return { isError: true, content: [{ type: 'text', text: error.message }] } }\n    })\n    server.onclose = finish\n    return server\n  }, { transport: new StdioServerTransport(process.stdin, process.stdout, { maxBufferSize: 262_144 }) })\n  const timer = setTimeout(() => { finish(); void handle.close() }, remaining); timer.unref()\n  process.stdin.once('end', () => { clearTimeout(timer); finish(); void handle.close() })\n} catch (error) {\n  process.stderr.write(`Private broker bootstrap refused: ${error.message}\\n`)\n  finish(); process.exitCode = 2\n}\n", "import { spawn } from 'node:child_process'\nimport { EventEmitter } from 'node:events'\nimport { StringDecoder } from 'node:string_decoder'\nimport { access, realpath } from 'node:fs/promises'\nimport { isAbsolute, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst HERE = fileURLToPath(new URL('.', import.meta.url))\nconst MAX_FRAME = 262_144\n\n/** Deliberately small environment: profiles, credentials and proxy secrets are never inherited. */\nexport function privateEnvironment(home, source = process.env) {\n  const env = { HOME: home, USERPROFILE: home, APPDATA: join(home, 'appdata'), LOCALAPPDATA: join(home, 'local'),\n    CODEX_HOME: home, XDG_CACHE_HOME: join(home, 'cache'), XDG_CONFIG_HOME: join(home, 'config'),\n    XDG_DATA_HOME: join(home, 'data'), TEMP: join(home, 'tmp'), TMP: join(home, 'tmp'), TMPDIR: join(home, 'tmp'),\n    NO_COLOR: '1', PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1' }\n  for (const key of ['SystemRoot', 'windir', 'ComSpec', 'LANG', 'LC_ALL']) if (source[key]) env[key] = source[key]\n  // Fixed executable paths remove PATH lookup from both supervisor and bridge.\n  env.PATH = process.platform === 'win32' ? join(source.SystemRoot ?? 'C:\\\\Windows', 'System32') : '/usr/bin:/bin'\n  return env\n}\n\nexport async function resolveNativeHelper({ python = '/usr/bin/python3' } = {}) {\n  if (process.platform === 'win32') {\n    const executable = join(process.env.SystemRoot ?? 'C:\\\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe')\n    await access(executable)\n    return Object.freeze({ executable: await realpath(executable), prefix: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(HERE, 'native-peer.ps1')], platform: 'win32' })\n  }\n  if (process.platform !== 'linux' || !isAbsolute(python)) throw new Error('NATIVE_PEER_UNAVAILABLE')\n  await access(python)\n  return Object.freeze({ executable: await realpath(python), prefix: ['-u', join(HERE, 'native-peer.py')], platform: 'linux' })\n}\n\n/** Spawn a packaged native helper. It accepts one bounded JSON configuration on stdin. */\nexport function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {\n  const events = new EventEmitter()\n  const args = helper.platform === 'win32' ? [...helper.prefix, '-Mode', mode] : [...helper.prefix, mode]\n  const child = spawn(helper.executable, args, { cwd: home, env, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })\n  let tail = '', buffer = '', bytes = 0, closed = false\n  const decoder = new StringDecoder('utf8'), cliDecoder = new StringDecoder('utf8')\n  let cliBuffer = ''\n  const frame = value => {\n    if (mode === 'supervise' && value.type === 'cli-output') {\n      if (typeof value.data !== 'string' || value.data.length > MAX_FRAME * 2) throw new Error('INVALID_CLI_FRAME')\n      cliBuffer += cliDecoder.write(Buffer.from(value.data, 'base64'))\n      if (Buffer.byteLength(cliBuffer) > MAX_FRAME) throw new Error('CLI_FRAME_LIMIT')\n      let end\n      while ((end = cliBuffer.indexOf('\\n')) >= 0) {\n        const line = cliBuffer.slice(0, end); cliBuffer = cliBuffer.slice(end + 1)\n        if (line.trim()) events.emit('message', JSON.parse(line))\n      }\n    } else events.emit(value.control ? 'control' : 'message', value)\n  }\n  const exit = new Promise(resolve => child.once('close', (code, signal) => { closed = true; events.emit('closed', { code, signal }); resolve({ code, signal }) }))\n  child.on('error', error => events.emit('failure', error))\n  child.stdin.on('error', () => {})\n  child.stderr.on('data', data => { tail = (tail + data.toString('utf8')).slice(-4096) })\n  child.stdout.on('data', chunk => {\n    bytes += chunk.length\n    buffer += decoder.write(chunk)\n    if (bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }\n    let end\n    while ((end = buffer.indexOf('\\n')) >= 0) {\n      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)\n      if (!line.trim()) continue\n      try { frame(JSON.parse(line)) }\n      catch { events.emit('failure', new Error('INVALID_NATIVE_FRAME')); child.stdin.end() }\n    }\n  })\n  const send = value => new Promise((resolve, reject) => {\n    const wire = JSON.stringify(value) + '\\n'\n    if (closed || Buffer.byteLength(wire) > MAX_FRAME) { reject(new Error(closed ? 'NATIVE_CLOSED' : 'INPUT_LIMIT')); return }\n    child.stdin.write(wire, error => error ? reject(error) : resolve())\n  })\n  if (spec) void send(spec).catch(error => events.emit('failure', error))\n  function waitControl(name, timeoutMs = 15_000) {\n    return new Promise((resolve, reject) => {\n      const clean = () => { clearTimeout(timer); events.off('control', control); events.off('closed', ended); events.off('failure', failed) }\n      const control = value => { if (value.control === name) { clean(); resolve(value) } }\n      const ended = () => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_FAILED: ${tail.slice(-256)}`)) }\n      const failed = error => { clean(); reject(error) }\n      const timer = setTimeout(() => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_TIMEOUT`)) }, timeoutMs)\n      events.on('control', control); events.once('closed', ended); events.once('failure', failed)\n      if (closed) ended()\n    })\n  }\n  return Object.freeze({ child, events, exit, send, waitControl, end: () => child.stdin.end(), get stderr() { return tail }, get closed() { return closed } })\n}\n\nexport async function capabilityProbe({ home, python } = {}) {\n  let proc\n  try {\n    const helper = await resolveNativeHelper({ python })\n    proc = nativeProcess(helper, 'probe', null, { home })\n    const value = await new Promise((resolve, reject) => {\n      proc.events.once('message', resolve)\n      proc.events.once('failure', reject)\n      proc.events.once('closed', () => reject(new Error('NATIVE_PROBE_FAILED')))\n    })\n    await proc.exit\n    return { ...value, helper, limitations: helper.platform === 'linux' ? ['Process groups are not an OS sandbox; adversarial unobserved daemon escape requires a cgroup/container boundary'] : [] }\n  } catch (error) { return { available: false, code: 'NATIVE_PEER_UNAVAILABLE', reason: error.message } }\n  finally { if (proc && !proc.closed) proc.end() }\n}\n\nexport async function protectProfile(helper, home) {\n  if (helper.platform !== 'win32') return\n  const proc = nativeProcess(helper, 'protect', { path: home }, { home })\n  const protectedValue = await new Promise((resolve, reject) => {\n    proc.events.once('message', resolve)\n    proc.events.once('failure', reject)\n    proc.events.once('closed', () => reject(new Error('PROFILE_ACL_FAILED')))\n  })\n  proc.end()\n  const exit = await proc.exit\n  if (!protectedValue.protected || exit.code !== 0) throw new Error('PROFILE_ACL_FAILED')\n}\n"],
-  "mappings": ";AAAA,SAAS,iBAAiB,cAAc;AACxC,SAAS,gBAAgB;AACzB,SAAS,cAAc,aAAa;AACpC,SAAS,cAAc;AACvB,SAAS,YAAY,4BAA4B;;;ACJjD,SAAS,aAAa;AACtB,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAE9B,SAAS,YAAY,YAAY;AACjC,SAAS,qBAAqB;AAE9B,IAAM,OAAO,cAAc,IAAI,IAAI,KAAK,YAAY,GAAG,CAAC;AACxD,IAAM,YAAY;AAGX,SAAS,mBAAmB,MAAM,SAAS,QAAQ,KAAK;AAC7D,QAAM,MAAM;AAAA,IAAE,MAAM;AAAA,IAAM,aAAa;AAAA,IAAM,SAAS,KAAK,MAAM,SAAS;AAAA,IAAG,cAAc,KAAK,MAAM,OAAO;AAAA,IAC3G,YAAY;AAAA,IAAM,gBAAgB,KAAK,MAAM,OAAO;AAAA,IAAG,iBAAiB,KAAK,MAAM,QAAQ;AAAA,IAC3F,eAAe,KAAK,MAAM,MAAM;AAAA,IAAG,MAAM,KAAK,MAAM,KAAK;AAAA,IAAG,KAAK,KAAK,MAAM,KAAK;AAAA,IAAG,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC5G,UAAU;AAAA,IAAK,kBAAkB;AAAA,IAAS,YAAY;AAAA,EAAI;AAC5D,aAAW,OAAO,CAAC,cAAc,UAAU,WAAW,QAAQ,QAAQ,EAAG,KAAI,OAAO,GAAG,EAAG,KAAI,GAAG,IAAI,OAAO,GAAG;AAE/G,MAAI,OAAO,QAAQ,aAAa,UAAU,KAAK,OAAO,cAAc,eAAe,UAAU,IAAI;AACjG,SAAO;AACT;AAcO,SAAS,cAAc,QAAQ,MAAM,MAAM,EAAE,MAAM,MAAM,mBAAmB,IAAI,EAAE,IAAI,CAAC,GAAG;AAC/F,QAAM,SAAS,IAAI,aAAa;AAChC,QAAM,OAAO,OAAO,aAAa,UAAU,CAAC,GAAG,OAAO,QAAQ,SAAS,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,IAAI;AACtG,QAAM,QAAQ,MAAM,OAAO,YAAY,MAAM,EAAE,KAAK,MAAM,KAAK,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AACjI,MAAI,OAAO,IAAI,SAAS,IAAI,QAAQ,GAAG,SAAS;AAChD,QAAM,UAAU,IAAI,cAAc,MAAM,GAAG,aAAa,IAAI,cAAc,MAAM;AAChF,MAAI,YAAY;AAChB,QAAM,QAAQ,WAAS;AACrB,QAAI,SAAS,eAAe,MAAM,SAAS,cAAc;AACvD,UAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAC5G,mBAAa,WAAW,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAC/D,UAAI,OAAO,WAAW,SAAS,IAAI,UAAW,OAAM,IAAI,MAAM,iBAAiB;AAC/E,UAAI;AACJ,cAAQ,MAAM,UAAU,QAAQ,IAAI,MAAM,GAAG;AAC3C,cAAM,OAAO,UAAU,MAAM,GAAG,GAAG;AAAG,oBAAY,UAAU,MAAM,MAAM,CAAC;AACzE,YAAI,KAAK,KAAK,EAAG,QAAO,KAAK,WAAW,KAAK,MAAM,IAAI,CAAC;AAAA,MAC1D;AAAA,IACF,MAAO,QAAO,KAAK,MAAM,UAAU,YAAY,WAAW,KAAK;AAAA,EACjE;AACA,QAAM,OAAO,IAAI,QAAQ,aAAW,MAAM,KAAK,SAAS,CAAC,MAAM,WAAW;AAAE,aAAS;AAAM,WAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAAG,YAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,EAAE,CAAC,CAAC;AAChK,QAAM,GAAG,SAAS,WAAS,OAAO,KAAK,WAAW,KAAK,CAAC;AACxD,QAAM,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAChC,QAAM,OAAO,GAAG,QAAQ,UAAQ;AAAE,YAAQ,OAAO,KAAK,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,EAAE,CAAC;AACtF,QAAM,OAAO,GAAG,QAAQ,WAAS;AAC/B,aAAS,MAAM;AACf,cAAU,QAAQ,MAAM,KAAK;AAC7B,QAAI,QAAQ,IAAI,OAAO,QAAQ,OAAO,WAAW,MAAM,IAAI,WAAW;AAAE,aAAO,KAAK,WAAW,IAAI,MAAM,cAAc,CAAC;AAAG,YAAM,MAAM,IAAI;AAAG;AAAA,IAAO;AACrJ,QAAI;AACJ,YAAQ,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AACxC,YAAM,OAAO,OAAO,MAAM,GAAG,GAAG;AAAG,eAAS,OAAO,MAAM,MAAM,CAAC;AAChE,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AAAE,cAAM,KAAK,MAAM,IAAI,CAAC;AAAA,MAAE,QACxB;AAAE,eAAO,KAAK,WAAW,IAAI,MAAM,sBAAsB,CAAC;AAAG,cAAM,MAAM,IAAI;AAAA,MAAE;AAAA,IACvF;AAAA,EACF,CAAC;AACD,QAAM,OAAO,WAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AACrD,UAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAI,UAAU,OAAO,WAAW,IAAI,IAAI,WAAW;AAAE,aAAO,IAAI,MAAM,SAAS,kBAAkB,aAAa,CAAC;AAAG;AAAA,IAAO;AACzH,UAAM,MAAM,MAAM,MAAM,WAAS,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,KAAM,MAAK,KAAK,IAAI,EAAE,MAAM,WAAS,OAAO,KAAK,WAAW,KAAK,CAAC;AACtE,WAAS,YAAY,MAAM,YAAY,MAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,QAAQ,MAAM;AAAE,qBAAa,KAAK;AAAG,eAAO,IAAI,WAAW,OAAO;AAAG,eAAO,IAAI,UAAU,KAAK;AAAG,eAAO,IAAI,WAAW,MAAM;AAAA,MAAE;AACtI,YAAM,UAAU,WAAS;AAAE,YAAI,MAAM,YAAY,MAAM;AAAE,gBAAM;AAAG,kBAAQ,KAAK;AAAA,QAAE;AAAA,MAAE;AACnF,YAAM,QAAQ,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;AAAA,MAAE;AAC7G,YAAM,SAAS,WAAS;AAAE,cAAM;AAAG,eAAO,KAAK;AAAA,MAAE;AACjD,YAAM,QAAQ,WAAW,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,UAAU,CAAC;AAAA,MAAE,GAAG,SAAS;AAChH,aAAO,GAAG,WAAW,OAAO;AAAG,aAAO,KAAK,UAAU,KAAK;AAAG,aAAO,KAAK,WAAW,MAAM;AAC1F,UAAI,OAAQ,OAAM;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,QAAQ,MAAM,MAAM,aAAa,KAAK,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAK,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAO,EAAE,CAAC;AAC7J;;;ADjFA,SAAS,SAAS,cAAAA,mBAAkB;AAEpC,IAAI;AAAJ,IAAW;AACX,IAAM,UAAU,oBAAI,IAAI;AACxB,IAAI,WAAW;AACf,IAAM,SAAS,MAAM;AACnB,aAAW,SAAS,QAAQ,OAAO,EAAG,OAAM,OAAO,IAAI,MAAM,eAAe,CAAC;AAC7E,UAAQ,MAAM;AACd,SAAO,IAAI;AACb;AACA,IAAI;AACF,QAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC;AAC/C,MAAI,QAAQ,KAAK,WAAW,KAAK,CAACA,YAAW,IAAI,KAAK,CAAC,0BAA0B,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,4BAA4B;AAC/I,MAAI;AACJ,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,CAAC,cAAc,KAAK,IAAI,IAAI,UAAU;AAC3C,QAAI;AAAE,YAAM,OAAO,MAAM,SAAS,IAAI;AAAG,UAAI,KAAK,SAAS,MAAQ,OAAM,IAAI,MAAM,kBAAkB;AAAG,mBAAa,KAAK,MAAM,IAAI;AAAA,IAAE,SAC/H,OAAO;AAAE,UAAI,MAAM,SAAS,SAAU,OAAM;AAAO,YAAM,MAAM,EAAE;AAAA,IAAE;AAAA,EAC5E;AACA,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY,OAAO,WAAW,cAAc,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAC1I,QAAM,MAAM,gBAAgB,EAAE,KAAK,OAAO,KAAK,YAAY,WAAW,GAAG,QAAQ,OAAO,MAAM,OAAO,CAAC;AACtG,MAAI,CAAC,OAAO,MAAM,OAAO,KAAK,WAAW,OAAO,GAAG,KAAK,OAAO,KAAK,WAAW,WAAW,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAC9I,QAAM,OAAO,KAAK,MAAM,WAAW,OAAO;AAC1C,QAAM,mBAAmB,KAAK,MAAM,KAAK,YAAY,KAAK,IAAI,CAAC;AAC/D,QAAM,YAAY,KAAK,MAAM,KAAK,mBAAmB,KAAK,IAAI,CAAC;AAC/D,MAAI,KAAK,YAAY,KAAK,mBAAmB,KAAK,mBAAmB,QAAU,YAAY,KAAK,YAAY,KAAW,OAAM,IAAI,MAAM,mBAAmB;AAC1J,UAAQ;AAAA,IAAc,KAAK;AAAA,IAAQ;AAAA,IAAU,EAAE,UAAU,KAAK,UAAU,WAAW,KAAK,WAAW,aAAa,KAAK,aAAa,OAAO,UAAU;AAAA,IACjJ,EAAE,MAAM,QAAQ,IAAI,GAAG,KAAK,mBAAmB,QAAQ,IAAI,CAAC,EAAE;AAAA,EAAC;AACjE,QAAM,MAAM,CAAC,IAAI,SAAS,WAAW,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpE,QAAI,MAAM,UAAU,QAAQ,QAAQ,IAAI;AAAE,aAAO,IAAI,MAAM,oBAAoB,CAAC;AAAG;AAAA,IAAO;AAC1F,UAAM,KAAK,EAAE;AACb,UAAM,QAAQ,MAAM;AAAE,YAAM,QAAQ,QAAQ,IAAI,EAAE;AAAG,cAAQ,OAAO,EAAE;AAAG,WAAK,MAAM,KAAK,EAAE,MAAM,UAAU,GAAG,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAG,aAAO,OAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,IAAE;AAChL,QAAI,QAAQ,SAAS;AAAE,aAAO,IAAI,MAAM,mBAAmB,CAAC;AAAG;AAAA,IAAO;AACtE,UAAMC,SAAQ,WAAW,OAAO,KAAK,IAAI,WAAW,GAAM,CAAC;AAC3D,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,UAAM,SAAS,QAAM,WAAS;AAAE,mBAAaA,MAAK;AAAG,cAAQ,oBAAoB,SAAS,KAAK;AAAG,SAAG,KAAK;AAAA,IAAE;AAC5G,YAAQ,IAAI,IAAI,EAAE,SAAS,OAAO,OAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpE,SAAK,MAAM,KAAK,EAAE,MAAM,WAAW,IAAI,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAE,YAAM,QAAQ,QAAQ,IAAI,EAAE;AAAG,cAAQ,OAAO,EAAE;AAAG,aAAO,OAAO,IAAI,MAAM,eAAe,CAAC;AAAA,IAAE,CAAC;AAAA,EACvK,CAAC;AACD,QAAM,OAAO,GAAG,WAAW,aAAW;AACpC,QAAI,SAAS,SAAS,cAAc,CAAC,OAAO,cAAc,QAAQ,EAAE,EAAG;AACvE,UAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;AAAG,YAAQ,OAAO,QAAQ,EAAE;AAChE,QAAI,QAAQ,GAAI,QAAO,QAAQ,QAAQ,KAAK;AAAA,QACvC,QAAO,OAAO,IAAI,MAAM,QAAQ,QAAQ,gBAAgB,CAAC;AAAA,EAChE,CAAC;AACD,QAAM,OAAO,GAAG,WAAW,MAAM;AAAE,WAAO;AAAG,SAAK,QAAQ,MAAM;AAAA,EAAE,CAAC;AACnE,QAAM,OAAO,KAAK,UAAU,MAAM;AAAE,WAAO;AAAG,SAAK,QAAQ,MAAM;AAAA,EAAE,CAAC;AACpE,WAAS,WAAW,MAAM;AACxB,UAAM,SAAS,IAAI,OAAO,EAAE,MAAM,8BAA8B,SAAS,QAAQ,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;AACnH,WAAO,kBAAkB,cAAc,OAAO,UAAU,SAAS,EAAE,OAAO,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,OAAO,MAAM,EAAE,EAAE;AACrH,WAAO,kBAAkB,cAAc,OAAO,SAAS,QAAQ;AAC7D,UAAI;AAAE,eAAO,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,MAAM,IAAI,QAAQ,EAAE,MAAM,QAAQ,OAAO,MAAM,MAAM,QAAQ,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE;AAAA,MAAE,SACvK,OAAO;AAAE,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC,EAAE;AAAA,MAAE;AAAA,IAC7F,CAAC;AACD,WAAO,UAAU;AACjB,WAAO;AAAA,EACT,GAAG,EAAE,WAAW,IAAI,qBAAqB,QAAQ,OAAO,QAAQ,QAAQ,EAAE,eAAe,OAAQ,CAAC,EAAE,CAAC;AACrG,QAAM,QAAQ,WAAW,MAAM;AAAE,WAAO;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,GAAG,SAAS;AAAG,QAAM,MAAM;AAC1F,UAAQ,MAAM,KAAK,OAAO,MAAM;AAAE,iBAAa,KAAK;AAAG,WAAO;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,CAAC;AACxF,SAAS,OAAO;AACd,UAAQ,OAAO,MAAM,qCAAqC,MAAM,OAAO;AAAA,CAAI;AAC3E,SAAO;AAAG,UAAQ,WAAW;AAC/B;",
-  "names": ["isAbsolute", "timer"]
+  "sources": ["../../packages/capability-broker/src/cli-stdio-bridge.mjs", "../../packages/cli-runtime/src/native-process.mjs", "../../packages/cli-runtime/src/native-cli-output.mjs", "../../packages/capability-broker/src/cli-bridge-response.mjs"],
+  "sourcesContent": ["import { createPublicKey, verify } from 'node:crypto'\nimport { readFile } from 'node:fs/promises'\nimport { setTimeout as delay } from 'node:timers/promises'\nimport { Server } from '@modelcontextprotocol/server'\nimport { serveStdio, StdioServerTransport } from '@modelcontextprotocol/server/stdio'\nimport { nativeProcess, privateEnvironment } from '../../cli-runtime/src/native-process.mjs'\nimport { dirname, isAbsolute } from 'node:path'\nimport { BridgeResponseReader } from './cli-bridge-response.mjs'\n\nlet relay, handle\nconst pending = new Map()\nconst responses = new BridgeResponseReader()\nlet sequence = 0\nconst finish = () => {\n  for (const value of pending.values()) value.reject(new Error('BROKER_CLOSED'))\n  pending.clear()\n  responses.clear()\n  relay?.end()\n}\ntry {\n  const [path, publicSpki] = process.argv.slice(2)\n  if (process.argv.length !== 4 || !isAbsolute(path) || !/^[A-Za-z0-9_-]{40,256}$/.test(publicSpki)) throw new Error('PRIVATE_BOOTSTRAP_REQUIRED')\n  let descriptor\n  const deadline = Date.now() + 15_000\n  while (!descriptor && Date.now() < deadline) {\n    try { const wire = await readFile(path); if (wire.length > 32_768) throw new Error('DESCRIPTOR_LIMIT'); descriptor = JSON.parse(wire) }\n    catch (error) { if (error.code !== 'ENOENT') throw error; await delay(50) }\n  }\n  if (!descriptor || typeof descriptor.payload !== 'string' || typeof descriptor.signature !== 'string') throw new Error('INVALID_BOOTSTRAP')\n  const key = createPublicKey({ key: Buffer.from(publicSpki, 'base64url'), format: 'der', type: 'spki' })\n  if (!verify(null, Buffer.from(descriptor.payload), key, Buffer.from(descriptor.signature, 'base64url'))) throw new Error('BOOTSTRAP_SIGNATURE')\n  const spec = JSON.parse(descriptor.payload)\n  const handoffRemaining = Math.floor(spec.expiresAt - Date.now())\n  const remaining = Math.floor(spec.sessionExpiresAt - Date.now())\n  if (spec.version !== 1 || handoffRemaining < 1 || handoffRemaining > 15_000 || remaining < 1 || remaining > 7_200_000) throw new Error('BOOTSTRAP_EXPIRED')\n  relay = nativeProcess(spec.helper, 'client', { endpoint: spec.endpoint, serverPid: spec.serverPid, serverStart: spec.serverStart, ttlMs: remaining },\n    { home: dirname(path), env: privateEnvironment(dirname(path)) })\n  const ask = (op, payload, signal) => new Promise((resolve, reject) => {\n    if (relay.closed || pending.size >= 16) { reject(new Error('BROKER_UNAVAILABLE')); return }\n    const id = ++sequence\n    const abort = () => { const value = pending.get(id); pending.delete(id); responses.drop(id); void relay.send({ type: 'cancel', id }).catch(() => {}); value?.reject(new Error('REQUEST_CANCELLED')) }\n    if (signal?.aborted) { reject(new Error('REQUEST_CANCELLED')); return }\n    const timer = setTimeout(abort, Math.min(remaining, 30_000))\n    signal?.addEventListener('abort', abort, { once: true })\n    const settle = fn => value => { clearTimeout(timer); signal?.removeEventListener('abort', abort); fn(value) }\n    pending.set(id, { resolve: settle(resolve), reject: settle(reject) })\n    void relay.send({ type: 'request', id, op, ...payload }).catch(() => { const value = pending.get(id); pending.delete(id); responses.drop(id); value?.reject(new Error('BROKER_CLOSED')) })\n  })\n  relay.events.on('message', message => {\n    if (!Number.isSafeInteger(message?.id) || !pending.has(message.id)) return\n    try {\n      const response = responses.accept(message)\n      if (!response) return\n      const value = pending.get(response.id); pending.delete(response.id)\n      if (response.ok) value?.resolve(response)\n      else value?.reject(new Error(response.code ?? 'BROKER_REFUSED'))\n    } catch {\n      const value = pending.get(message.id); pending.delete(message.id); responses.drop(message.id)\n      value?.reject(new Error('INVALID_BRIDGE_RESPONSE'))\n    }\n  })\n  relay.events.on('failure', () => { finish(); void handle?.close() })\n  relay.events.once('closed', () => { finish(); void handle?.close() })\n  handle = serveStdio(() => {\n    const server = new Server({ name: 'dsh-task-capability-bridge', version: '0.0.0' }, { capabilities: { tools: {} } })\n    server.setRequestHandler('tools/list', async (_request, ctx) => ({ tools: (await ask('list', {}, ctx.mcpReq.signal)).value }))\n    server.setRequestHandler('tools/call', async (request, ctx) => {\n      try {\n        const response = await ask('call', { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal)\n        return response.mcpResult ?? { content: [{ type: 'text', text: JSON.stringify(response.value) }] }\n      }\n      catch (error) { return { isError: true, content: [{ type: 'text', text: error.message }] } }\n    })\n    server.onclose = finish\n    return server\n  }, { transport: new StdioServerTransport(process.stdin, process.stdout, { maxBufferSize: 262_144 }) })\n  const timer = setTimeout(() => { finish(); void handle.close() }, remaining); timer.unref()\n  process.stdin.once('end', () => { clearTimeout(timer); finish(); void handle.close() })\n} catch (error) {\n  process.stderr.write(`Private broker bootstrap refused: ${error.message}\\n`)\n  finish(); process.exitCode = 2\n}\n", "import { spawn } from 'node:child_process'\nimport { EventEmitter } from 'node:events'\nimport { StringDecoder } from 'node:string_decoder'\nimport { access, lstat, readFile, readdir, realpath, rmdir, unlink } from 'node:fs/promises'\nimport { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'\nimport { randomBytes } from 'node:crypto'\nimport { tmpdir } from 'node:os'\nimport { basename, dirname, isAbsolute, join } from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport { NativeCliOutput } from './native-cli-output.mjs'\n\nconst HERE = fileURLToPath(new URL('.', import.meta.url))\nconst MAX_FRAME = 262_144\nconst COMPILER_ROOT = 'DSH_NATIVE_COMPILER_ROOT'\nconst COMPILER_SCRATCH = 'DSH_NATIVE_COMPILER_SCRATCH'\n// Capture only the trusted Host launch environment, never a model's spec or an\n// env argument. A packaged bridge inherits this one non-secret root hint so its\n// compiler does not start a new root beneath an ever-deeper private TEMP.\nconst inheritedCompilerRoot = process.platform === 'win32' ? process.env[COMPILER_ROOT] : undefined\nconst hostTemp = process.platform === 'win32' ? tmpdir() : null\nlet compilerRoot = null\nconst compilerFailure = () => Object.assign(new Error('NATIVE_COMPILER_SCRATCH_UNAVAILABLE'), { code: 'NATIVE_COMPILER_SCRATCH_UNAVAILABLE' })\nconst sameDirectory = (info, expected) => info.isDirectory() && !info.isSymbolicLink() && info.dev === expected.dev && info.ino === expected.ino\nconst rootStamp = path => `dsh-native-compiler-v1:${basename(path)}\\n`\n\nfunction compilerDirectory() {\n  try {\n    if (!compilerRoot) {\n      if (inheritedCompilerRoot !== undefined) {\n        if (!isAbsolute(inheritedCompilerRoot) || inheritedCompilerRoot.length > 140 || !/^dshc-[a-f0-9]{16}$/.test(basename(inheritedCompilerRoot))) throw compilerFailure()\n        const info = lstatSync(inheritedCompilerRoot, { bigint: true })\n        if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(inheritedCompilerRoot) !== inheritedCompilerRoot || readFileSync(join(inheritedCompilerRoot, '.dsh-root'), 'utf8') !== rootStamp(inheritedCompilerRoot)) throw compilerFailure()\n        compilerRoot = { path: inheritedCompilerRoot, info }\n      } else {\n        const parent = realpathSync(hostTemp)\n        const path = join(parent, `dshc-${randomBytes(8).toString('hex')}`)\n        if (path.length > 140) throw compilerFailure()\n        mkdirSync(path)\n        writeFileSync(join(path, '.dsh-root'), rootStamp(path), { flag: 'wx' })\n        compilerRoot = { path, info: lstatSync(path, { bigint: true }) }\n      }\n    }\n    if (!sameDirectory(lstatSync(compilerRoot.path, { bigint: true }), compilerRoot.info) || realpathSync(compilerRoot.path) !== compilerRoot.path) throw compilerFailure()\n    const path = mkdtempSync(join(compilerRoot.path, 'c-'))\n    const info = lstatSync(path, { bigint: true }), owner = randomBytes(16).toString('hex')\n    writeFileSync(join(path, '.dsh-owner'), owner, { flag: 'wx' })\n    const root = compilerRoot\n    // Never recursively remove a path obtained from the environment. Only this\n    // allocated child, after confirmed helper exit, with unchanged filesystem\n    // identity and no links/subdirectories, is eligible for flat cleanup.\n    const cleanup = async () => {\n      try {\n        if (dirname(path) !== root.path || !/^c-[A-Za-z0-9]{6}$/.test(basename(path))) return false\n        if (!sameDirectory(await lstat(root.path, { bigint: true }), root.info) || await realpath(root.path) !== root.path) return false\n        if (!sameDirectory(await lstat(path, { bigint: true }), info) || await realpath(path) !== path || await readFile(join(path, '.dsh-owner'), 'utf8') !== owner) return false\n        const names = await readdir(path)\n        if (names.length > 128) return false\n        for (const name of names) { const entry = await lstat(join(path, name)); if (!entry.isFile() || entry.isSymbolicLink()) return false }\n        for (const name of names) await unlink(join(path, name))\n        await rmdir(path)\n        return true\n      } catch { return false } // Busy, replaced or unknown resources remain.\n    }\n    return { root: root.path, path, cleanup }\n  } catch { throw compilerFailure() }\n}\n\n/** Deliberately small environment: profiles, credentials and proxy secrets are never inherited. */\nexport function privateEnvironment(home, source = process.env) {\n  const env = { HOME: home, USERPROFILE: home, APPDATA: join(home, 'appdata'), LOCALAPPDATA: join(home, 'local'),\n    CODEX_HOME: home, XDG_CACHE_HOME: join(home, 'cache'), XDG_CONFIG_HOME: join(home, 'config'),\n    XDG_DATA_HOME: join(home, 'data'), TEMP: join(home, 'tmp'), TMP: join(home, 'tmp'), TMPDIR: join(home, 'tmp'),\n    NO_COLOR: '1', PYTHONIOENCODING: 'utf-8', PYTHONUTF8: '1' }\n  for (const key of ['SystemRoot', 'windir', 'ComSpec', 'LANG', 'LC_ALL']) if (source[key]) env[key] = source[key]\n  // Fixed executable paths remove PATH lookup from both supervisor and bridge.\n  env.PATH = process.platform === 'win32' ? join(source.SystemRoot ?? 'C:\\\\Windows', 'System32') : '/usr/bin:/bin'\n  if (process.platform === 'win32' && (compilerRoot?.path ?? inheritedCompilerRoot)) env[COMPILER_ROOT] = compilerRoot?.path ?? inheritedCompilerRoot\n  return env\n}\n\nexport async function resolveNativeHelper({ python = '/usr/bin/python3' } = {}) {\n  if (process.platform === 'win32') {\n    const executable = join(process.env.SystemRoot ?? 'C:\\\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe')\n    await access(executable)\n    return Object.freeze({ executable: await realpath(executable), prefix: ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', join(HERE, 'native-peer.ps1')], platform: 'win32' })\n  }\n  if (process.platform !== 'linux' || !isAbsolute(python)) throw new Error('NATIVE_PEER_UNAVAILABLE')\n  await access(python)\n  return Object.freeze({ executable: await realpath(python), prefix: ['-u', join(HERE, 'native-peer.py')], platform: 'linux' })\n}\n\n/** Spawn a packaged native helper. It accepts one bounded JSON configuration on stdin. */\nexport function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {\n  const events = new EventEmitter()\n  const args = helper.platform === 'win32' ? [...helper.prefix, '-Mode', mode] : [...helper.prefix, mode]\n  const compiler = helper.platform === 'win32' ? compilerDirectory() : null\n  const helperEnv = compiler ? Object.fromEntries(Object.entries(env).filter(([key]) => ![COMPILER_ROOT, COMPILER_SCRATCH].includes(key.toUpperCase()))) : env\n  if (compiler) { helperEnv[COMPILER_ROOT] = compiler.root; helperEnv[COMPILER_SCRATCH] = compiler.path }\n  const child = spawn(helper.executable, args, { cwd: home, env: helperEnv, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })\n  let tail = '', buffer = '', bytes = 0, closed = false, treeStopped = false\n  const decoder = new StringDecoder('utf8'), cliDecoder = new StringDecoder('utf8')\n  const cliOutput = new NativeCliOutput()\n  const frame = value => {\n    if (mode === 'supervise' && value.control === 'stopped' && value.treeStopped === true) treeStopped = true\n    if (mode === 'supervise' && value.type === 'cli-output') {\n      if (typeof value.data !== 'string' || value.data.length > MAX_FRAME * 2) throw new Error('INVALID_CLI_FRAME')\n      for (const message of cliOutput.push(cliDecoder.write(Buffer.from(value.data, 'base64')))) events.emit('message', message)\n    } else events.emit(value.control ? 'control' : 'message', value)\n  }\n  const exit = new Promise(resolve => child.once('close', async (code, signal) => {\n    closed = true\n    if (compiler && code === 0 && signal === null && (mode !== 'supervise' || treeStopped)) await compiler.cleanup()\n    events.emit('closed', { code, signal }); resolve({ code, signal })\n  }))\n  child.on('error', error => events.emit('failure', error))\n  child.stdin.on('error', () => {})\n  child.stderr.on('data', data => { tail = (tail + data.toString('utf8')).slice(-4096) })\n  child.stdout.on('data', chunk => {\n    bytes += chunk.length\n    buffer += decoder.write(chunk)\n    // MCP responses and CLI image echoes have their own bounded readers. Their\n    // retained connections can carry several screenshots without a raw lifetime cap.\n    const boundedStream = mode === 'client' || mode === 'server' || mode === 'supervise'\n    if (!boundedStream && bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }\n    let end\n    while ((end = buffer.indexOf('\\n')) >= 0) {\n      const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)\n      if (!line.trim()) continue\n      try { frame(JSON.parse(line)) }\n      catch { events.emit('failure', new Error('INVALID_NATIVE_FRAME')); child.stdin.end() }\n    }\n  })\n  const send = value => new Promise((resolve, reject) => {\n    const wire = JSON.stringify(value) + '\\n'\n    if (closed || Buffer.byteLength(wire) > MAX_FRAME) { reject(new Error(closed ? 'NATIVE_CLOSED' : 'INPUT_LIMIT')); return }\n    child.stdin.write(wire, error => error ? reject(error) : resolve())\n  })\n  if (spec) void send(spec).catch(error => events.emit('failure', error))\n  function waitControl(name, timeoutMs = 15_000) {\n    return new Promise((resolve, reject) => {\n      const clean = () => { clearTimeout(timer); events.off('control', control); events.off('closed', ended); events.off('failure', failed) }\n      const control = value => { if (value.control === name) { clean(); resolve(value) } }\n      const ended = () => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_FAILED: ${tail.slice(-256)}`)) }\n      const failed = error => { clean(); reject(error) }\n      const timer = setTimeout(() => { clean(); reject(new Error(`NATIVE_${name.toUpperCase()}_TIMEOUT`)) }, timeoutMs)\n      events.on('control', control); events.once('closed', ended); events.once('failure', failed)\n      if (closed) ended()\n    })\n  }\n  return Object.freeze({ child, events, exit, send, waitControl, end: () => child.stdin.end(), get stderr() { return tail }, get closed() { return closed } })\n}\n\nexport async function capabilityProbe({ home, python } = {}) {\n  let proc\n  try {\n    const helper = await resolveNativeHelper({ python })\n    proc = nativeProcess(helper, 'probe', null, { home })\n    const value = await new Promise((resolve, reject) => {\n      proc.events.once('message', resolve)\n      proc.events.once('failure', reject)\n      proc.events.once('closed', () => reject(new Error('NATIVE_PROBE_FAILED')))\n    })\n    await proc.exit\n    return { ...value, helper, limitations: helper.platform === 'linux' ? ['Process groups are not an OS sandbox; adversarial unobserved daemon escape requires a cgroup/container boundary'] : [] }\n  } catch (error) { return { available: false, code: 'NATIVE_PEER_UNAVAILABLE', reason: error.message } }\n  finally { if (proc && !proc.closed) proc.end() }\n}\n\nexport async function protectProfile(helper, home) {\n  if (helper.platform !== 'win32') return\n  const proc = nativeProcess(helper, 'protect', { path: home }, { home })\n  const protectedValue = await new Promise((resolve, reject) => {\n    proc.events.once('message', resolve)\n    proc.events.once('failure', reject)\n    proc.events.once('closed', () => reject(new Error('PROFILE_ACL_FAILED')))\n  })\n  proc.end()\n  const exit = await proc.exit\n  if (!protectedValue.protected || exit.code !== 0) throw new Error('PROFILE_ACL_FAILED')\n}\n", "import { createHash } from 'node:crypto'\n\nconst FRAME = 262_144\nconst RAW_FRAME = 18 * 1024 * 1024\nconst IMAGE = 6 * 1024 * 1024\nconst fail = () => { throw new Error('CLI_FRAME_LIMIT') }\n\n// Claude's verbose user/tool_result events can echo the image already delivered over MCP.\n// Keep bounded receipts for those echoes; the model has received the original pixels itself.\nfunction receipt(frame, rawBytes) {\n  const results = frame?.type === 'user' && frame.message?.content\n  const toolResult = Array.isArray(results) && results.length > 0 && results.every(block => block?.type === 'tool_result' && typeof block.tool_use_id === 'string')\n  if (!toolResult) { if (rawBytes > FRAME) fail(); return frame }\n  let imageBytes = 0, images = 0, nodes = 0\n  const visit = (value, depth = 0) => {\n    if (++nodes > 30000 || depth > 24) fail()\n    if (!value || typeof value !== 'object') return value\n    if (value.type === 'image') {\n      const source = value.source\n      const data = source?.type === 'base64' ? source.data : value.data\n      const mediaType = source?.type === 'base64' ? source.media_type : value.mimeType\n      if (typeof data !== 'string' || data.length > IMAGE / 3 * 4 || !['image/png', 'image/jpeg', 'image/webp'].includes(mediaType)) fail()\n      const bytes = Buffer.from(data, 'base64')\n      if (!bytes.length || bytes.length > IMAGE || bytes.toString('base64') !== data || ++images > 32 || (imageBytes += bytes.length) > IMAGE * 2) fail()\n      return { type: 'image', mediaType, bytes: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex') }\n    }\n    if (Array.isArray(value)) return value.map(item => visit(item, depth + 1))\n    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, visit(item, depth + 1)]))\n  }\n  const result = visit(frame)\n  if (rawBytes > FRAME && !images || Buffer.byteLength(JSON.stringify(result)) > FRAME) fail()\n  return result\n}\n\n/** Bound raw JSON lines separately from the non-image session output budget. */\nexport class NativeCliOutput {\n  #buffer = ''\n  #bytes = 0\n  push(text) {\n    this.#buffer += text\n    const frames = []\n    let end\n    while ((end = this.#buffer.indexOf('\\n')) >= 0) {\n      const line = this.#buffer.slice(0, end)\n      this.#buffer = this.#buffer.slice(end + 1)\n      const rawBytes = Buffer.byteLength(line)\n      if (rawBytes > RAW_FRAME) fail()\n      if (!line.trim()) continue\n      const frame = receipt(JSON.parse(line), rawBytes)\n      this.#bytes += Buffer.byteLength(JSON.stringify(frame))\n      if (this.#bytes > 8 * 1024 * 1024) fail()\n      frames.push(frame)\n    }\n    if (Buffer.byteLength(this.#buffer) > RAW_FRAME) fail()\n    return frames\n  }\n}\n", "import { createHash } from 'node:crypto'\n\nconst CHUNK_BYTES = 128 * 1024\nconst MAX_RESPONSE = 9 * 1024 * 1024\nconst MAX_BUFFERED = 16 * 1024 * 1024\nconst fail = () => { throw new Error('INVALID_BRIDGE_RESPONSE') }\nconst sha = bytes => createHash('sha256').update(bytes).digest('hex')\n\n/** Large MCP pictures cross the existing bounded native pipe in small frames. */\nexport function* bridgeResponseFrames(id, value) {\n  let bytes = Buffer.from(JSON.stringify({ type: 'response', id, ...value }))\n  if (bytes.length > MAX_RESPONSE) bytes = Buffer.from(JSON.stringify({ type: 'response', id, ok: false, code: 'OUTPUT_LIMIT' }))\n  if (bytes.length <= CHUNK_BYTES) { yield JSON.parse(bytes.toString('utf8')); return }\n  yield { type: 'response-start', id, bytes: bytes.length }\n  for (let offset = 0, index = 0; offset < bytes.length; offset += CHUNK_BYTES, index++) {\n    yield { type: 'response-chunk', id, index, data: bytes.subarray(offset, offset + CHUNK_BYTES).toString('base64') }\n  }\n  yield { type: 'response-end', id, sha256: sha(bytes) }\n}\n\n/** Reassembly is bounded across all pending calls and releases on cancellation. */\nexport class BridgeResponseReader {\n  #parts = new Map()\n  #buffered = 0\n\n  drop(id) {\n    const state = this.#parts.get(id)\n    if (state) this.#buffered -= state.size\n    this.#parts.delete(id)\n  }\n\n  clear() { this.#parts.clear(); this.#buffered = 0 }\n\n  accept(frame) {\n    if (!Number.isSafeInteger(frame?.id) || frame.id < 1) fail()\n    if (frame.type === 'response') { this.drop(frame.id); return frame }\n    if (frame.type === 'response-start') {\n      if (this.#parts.has(frame.id) || this.#parts.size >= 16 || !Number.isSafeInteger(frame.bytes)\n        || frame.bytes <= CHUNK_BYTES || frame.bytes > MAX_RESPONSE) fail()\n      this.#parts.set(frame.id, { expected: frame.bytes, size: 0, chunks: [] })\n      return null\n    }\n    const state = this.#parts.get(frame.id)\n    if (!state) fail()\n    if (frame.type === 'response-chunk') {\n      if (frame.index !== state.chunks.length || typeof frame.data !== 'string' || frame.data.length > Math.ceil(CHUNK_BYTES / 3) * 4) fail()\n      const bytes = Buffer.from(frame.data, 'base64')\n      if (!bytes.length || bytes.length > CHUNK_BYTES || bytes.toString('base64') !== frame.data\n        || state.size + bytes.length > state.expected || this.#buffered + bytes.length > MAX_BUFFERED) fail()\n      state.chunks.push(bytes); state.size += bytes.length; this.#buffered += bytes.length\n      return null\n    }\n    if (frame.type !== 'response-end' || state.size !== state.expected) fail()\n    const bytes = Buffer.concat(state.chunks)\n    this.drop(frame.id)\n    if (frame.sha256 !== sha(bytes)) fail()\n    const value = JSON.parse(bytes.toString('utf8'))\n    if (value.type !== 'response' || value.id !== frame.id) fail()\n    return value\n  }\n}\n\n/** Only a trusted handler can render MCP text or pictures. */\nexport function normalizeBridgeMcpResult(value) {\n  if (!value || !Array.isArray(value.content) || value.content.length > 32\n    || Object.keys(value).some(key => !['content', 'isError'].includes(key))\n    || value.isError !== undefined && typeof value.isError !== 'boolean') fail()\n  for (const block of value.content) {\n    if (block?.type === 'text') {\n      if (Object.keys(block).some(key => !['type', 'text'].includes(key)) || typeof block.text !== 'string') fail()\n    } else if (block?.type === 'image') {\n      if (Object.keys(block).some(key => !['type', 'data', 'mimeType'].includes(key))\n        || !['image/png', 'image/jpeg', 'image/webp'].includes(block.mimeType) || typeof block.data !== 'string'\n        || block.data.length > 8 * 1024 * 1024) fail()\n      const bytes = Buffer.from(block.data, 'base64')\n      if (!bytes.length || bytes.toString('base64') !== block.data || bytes.length > 6 * 1024 * 1024) fail()\n    } else fail()\n  }\n  return value\n}\n"],
+  "mappings": ";AAAA,SAAS,iBAAiB,cAAc;AACxC,SAAS,YAAAA,iBAAgB;AACzB,SAAS,cAAc,aAAa;AACpC,SAAS,cAAc;AACvB,SAAS,YAAY,4BAA4B;;;ACJjD,SAAS,aAAa;AACtB,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,QAAQ,OAAO,UAAU,SAAS,UAAU,OAAO,cAAc;AAC1E,SAAS,WAAW,WAAW,aAAa,cAAc,cAAc,qBAAqB;AAC7F,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,UAAU,SAAS,YAAY,YAAY;AACpD,SAAS,qBAAqB;;;ACR9B,SAAS,kBAAkB;AAE3B,IAAM,QAAQ;AACd,IAAM,YAAY,KAAK,OAAO;AAC9B,IAAM,QAAQ,IAAI,OAAO;AACzB,IAAM,OAAO,MAAM;AAAE,QAAM,IAAI,MAAM,iBAAiB;AAAE;AAIxD,SAAS,QAAQ,OAAO,UAAU;AAChC,QAAM,UAAU,OAAO,SAAS,UAAU,MAAM,SAAS;AACzD,QAAM,aAAa,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,KAAK,QAAQ,MAAM,WAAS,OAAO,SAAS,iBAAiB,OAAO,MAAM,gBAAgB,QAAQ;AAChK,MAAI,CAAC,YAAY;AAAE,QAAI,WAAW,MAAO,MAAK;AAAG,WAAO;AAAA,EAAM;AAC9D,MAAI,aAAa,GAAG,SAAS,GAAG,QAAQ;AACxC,QAAM,QAAQ,CAAC,OAAO,QAAQ,MAAM;AAClC,QAAI,EAAE,QAAQ,OAAS,QAAQ,GAAI,MAAK;AACxC,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAI,MAAM,SAAS,SAAS;AAC1B,YAAM,SAAS,MAAM;AACrB,YAAM,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO,MAAM;AAC7D,YAAM,YAAY,QAAQ,SAAS,WAAW,OAAO,aAAa,MAAM;AACxE,UAAI,OAAO,SAAS,YAAY,KAAK,SAAS,QAAQ,IAAI,KAAK,CAAC,CAAC,aAAa,cAAc,YAAY,EAAE,SAAS,SAAS,EAAG,MAAK;AACpI,YAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ;AACxC,UAAI,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,MAAM,SAAS,QAAQ,MAAM,QAAQ,EAAE,SAAS,OAAO,cAAc,MAAM,UAAU,QAAQ,EAAG,MAAK;AAClJ,aAAO,EAAE,MAAM,SAAS,WAAW,OAAO,MAAM,QAAQ,QAAQ,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE;AAAA,IACnH;AACA,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,UAAQ,MAAM,MAAM,QAAQ,CAAC,CAAC;AACzE,WAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;AAAA,EACrG;AACA,QAAM,SAAS,MAAM,KAAK;AAC1B,MAAI,WAAW,SAAS,CAAC,UAAU,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,IAAI,MAAO,MAAK;AAC3F,SAAO;AACT;AAGO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,UAAU;AAAA,EACV,SAAS;AAAA,EACT,KAAK,MAAM;AACT,SAAK,WAAW;AAChB,UAAM,SAAS,CAAC;AAChB,QAAI;AACJ,YAAQ,MAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,GAAG;AAC9C,YAAM,OAAO,KAAK,QAAQ,MAAM,GAAG,GAAG;AACtC,WAAK,UAAU,KAAK,QAAQ,MAAM,MAAM,CAAC;AACzC,YAAM,WAAW,OAAO,WAAW,IAAI;AACvC,UAAI,WAAW,UAAW,MAAK;AAC/B,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,YAAM,QAAQ,QAAQ,KAAK,MAAM,IAAI,GAAG,QAAQ;AAChD,WAAK,UAAU,OAAO,WAAW,KAAK,UAAU,KAAK,CAAC;AACtD,UAAI,KAAK,SAAS,IAAI,OAAO,KAAM,MAAK;AACxC,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,QAAI,OAAO,WAAW,KAAK,OAAO,IAAI,UAAW,MAAK;AACtD,WAAO;AAAA,EACT;AACF;;;AD7CA,IAAM,OAAO,cAAc,IAAI,IAAI,KAAK,YAAY,GAAG,CAAC;AACxD,IAAM,YAAY;AAClB,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AAIzB,IAAM,wBAAwB,QAAQ,aAAa,UAAU,QAAQ,IAAI,aAAa,IAAI;AAC1F,IAAM,WAAW,QAAQ,aAAa,UAAU,OAAO,IAAI;AAC3D,IAAI,eAAe;AACnB,IAAM,kBAAkB,MAAM,OAAO,OAAO,IAAI,MAAM,qCAAqC,GAAG,EAAE,MAAM,sCAAsC,CAAC;AAC7I,IAAM,gBAAgB,CAAC,MAAM,aAAa,KAAK,YAAY,KAAK,CAAC,KAAK,eAAe,KAAK,KAAK,QAAQ,SAAS,OAAO,KAAK,QAAQ,SAAS;AAC7I,IAAM,YAAY,UAAQ,0BAA0B,SAAS,IAAI,CAAC;AAAA;AAElE,SAAS,oBAAoB;AAC3B,MAAI;AACF,QAAI,CAAC,cAAc;AACjB,UAAI,0BAA0B,QAAW;AACvC,YAAI,CAAC,WAAW,qBAAqB,KAAK,sBAAsB,SAAS,OAAO,CAAC,sBAAsB,KAAK,SAAS,qBAAqB,CAAC,EAAG,OAAM,gBAAgB;AACpK,cAAMC,QAAO,UAAU,uBAAuB,EAAE,QAAQ,KAAK,CAAC;AAC9D,YAAI,CAACA,MAAK,YAAY,KAAKA,MAAK,eAAe,KAAK,aAAa,qBAAqB,MAAM,yBAAyB,aAAa,KAAK,uBAAuB,WAAW,GAAG,MAAM,MAAM,UAAU,qBAAqB,EAAG,OAAM,gBAAgB;AAChP,uBAAe,EAAE,MAAM,uBAAuB,MAAAA,MAAK;AAAA,MACrD,OAAO;AACL,cAAM,SAAS,aAAa,QAAQ;AACpC,cAAMC,QAAO,KAAK,QAAQ,QAAQ,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE;AAClE,YAAIA,MAAK,SAAS,IAAK,OAAM,gBAAgB;AAC7C,kBAAUA,KAAI;AACd,sBAAc,KAAKA,OAAM,WAAW,GAAG,UAAUA,KAAI,GAAG,EAAE,MAAM,KAAK,CAAC;AACtE,uBAAe,EAAE,MAAAA,OAAM,MAAM,UAAUA,OAAM,EAAE,QAAQ,KAAK,CAAC,EAAE;AAAA,MACjE;AAAA,IACF;AACA,QAAI,CAAC,cAAc,UAAU,aAAa,MAAM,EAAE,QAAQ,KAAK,CAAC,GAAG,aAAa,IAAI,KAAK,aAAa,aAAa,IAAI,MAAM,aAAa,KAAM,OAAM,gBAAgB;AACtK,UAAM,OAAO,YAAY,KAAK,aAAa,MAAM,IAAI,CAAC;AACtD,UAAM,OAAO,UAAU,MAAM,EAAE,QAAQ,KAAK,CAAC,GAAG,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AACtF,kBAAc,KAAK,MAAM,YAAY,GAAG,OAAO,EAAE,MAAM,KAAK,CAAC;AAC7D,UAAM,OAAO;AAIb,UAAM,UAAU,YAAY;AAC1B,UAAI;AACF,YAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,EAAG,QAAO;AACtF,YAAI,CAAC,cAAc,MAAM,MAAM,KAAK,MAAM,EAAE,QAAQ,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,MAAM,SAAS,KAAK,IAAI,MAAM,KAAK,KAAM,QAAO;AAC3H,YAAI,CAAC,cAAc,MAAM,MAAM,MAAM,EAAE,QAAQ,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,SAAS,IAAI,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,YAAY,GAAG,MAAM,MAAM,MAAO,QAAO;AACrK,cAAM,QAAQ,MAAM,QAAQ,IAAI;AAChC,YAAI,MAAM,SAAS,IAAK,QAAO;AAC/B,mBAAW,QAAQ,OAAO;AAAE,gBAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,IAAI,CAAC;AAAG,cAAI,CAAC,MAAM,OAAO,KAAK,MAAM,eAAe,EAAG,QAAO;AAAA,QAAM;AACrI,mBAAW,QAAQ,MAAO,OAAM,OAAO,KAAK,MAAM,IAAI,CAAC;AACvD,cAAM,MAAM,IAAI;AAChB,eAAO;AAAA,MACT,QAAQ;AAAE,eAAO;AAAA,MAAM;AAAA,IACzB;AACA,WAAO,EAAE,MAAM,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC1C,QAAQ;AAAE,UAAM,gBAAgB;AAAA,EAAE;AACpC;AAGO,SAAS,mBAAmB,MAAM,SAAS,QAAQ,KAAK;AAC7D,QAAM,MAAM;AAAA,IAAE,MAAM;AAAA,IAAM,aAAa;AAAA,IAAM,SAAS,KAAK,MAAM,SAAS;AAAA,IAAG,cAAc,KAAK,MAAM,OAAO;AAAA,IAC3G,YAAY;AAAA,IAAM,gBAAgB,KAAK,MAAM,OAAO;AAAA,IAAG,iBAAiB,KAAK,MAAM,QAAQ;AAAA,IAC3F,eAAe,KAAK,MAAM,MAAM;AAAA,IAAG,MAAM,KAAK,MAAM,KAAK;AAAA,IAAG,KAAK,KAAK,MAAM,KAAK;AAAA,IAAG,QAAQ,KAAK,MAAM,KAAK;AAAA,IAC5G,UAAU;AAAA,IAAK,kBAAkB;AAAA,IAAS,YAAY;AAAA,EAAI;AAC5D,aAAW,OAAO,CAAC,cAAc,UAAU,WAAW,QAAQ,QAAQ,EAAG,KAAI,OAAO,GAAG,EAAG,KAAI,GAAG,IAAI,OAAO,GAAG;AAE/G,MAAI,OAAO,QAAQ,aAAa,UAAU,KAAK,OAAO,cAAc,eAAe,UAAU,IAAI;AACjG,MAAI,QAAQ,aAAa,YAAY,cAAc,QAAQ,uBAAwB,KAAI,aAAa,IAAI,cAAc,QAAQ;AAC9H,SAAO;AACT;AAcO,SAAS,cAAc,QAAQ,MAAM,MAAM,EAAE,MAAM,MAAM,mBAAmB,IAAI,EAAE,IAAI,CAAC,GAAG;AAC/F,QAAM,SAAS,IAAI,aAAa;AAChC,QAAM,OAAO,OAAO,aAAa,UAAU,CAAC,GAAG,OAAO,QAAQ,SAAS,IAAI,IAAI,CAAC,GAAG,OAAO,QAAQ,IAAI;AACtG,QAAM,WAAW,OAAO,aAAa,UAAU,kBAAkB,IAAI;AACrE,QAAM,YAAY,WAAW,OAAO,YAAY,OAAO,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,eAAe,gBAAgB,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI;AACzJ,MAAI,UAAU;AAAE,cAAU,aAAa,IAAI,SAAS;AAAM,cAAU,gBAAgB,IAAI,SAAS;AAAA,EAAK;AACtG,QAAM,QAAQ,MAAM,OAAO,YAAY,MAAM,EAAE,KAAK,MAAM,KAAK,WAAW,aAAa,MAAM,OAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAC5I,MAAI,OAAO,IAAI,SAAS,IAAI,QAAQ,GAAG,SAAS,OAAO,cAAc;AACrE,QAAM,UAAU,IAAI,cAAc,MAAM,GAAG,aAAa,IAAI,cAAc,MAAM;AAChF,QAAM,YAAY,IAAI,gBAAgB;AACtC,QAAM,QAAQ,WAAS;AACrB,QAAI,SAAS,eAAe,MAAM,YAAY,aAAa,MAAM,gBAAgB,KAAM,eAAc;AACrG,QAAI,SAAS,eAAe,MAAM,SAAS,cAAc;AACvD,UAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,YAAY,EAAG,OAAM,IAAI,MAAM,mBAAmB;AAC5G,iBAAW,WAAW,UAAU,KAAK,WAAW,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAG,QAAO,KAAK,WAAW,OAAO;AAAA,IAC3H,MAAO,QAAO,KAAK,MAAM,UAAU,YAAY,WAAW,KAAK;AAAA,EACjE;AACA,QAAM,OAAO,IAAI,QAAQ,aAAW,MAAM,KAAK,SAAS,OAAO,MAAM,WAAW;AAC9E,aAAS;AACT,QAAI,YAAY,SAAS,KAAK,WAAW,SAAS,SAAS,eAAe,aAAc,OAAM,SAAS,QAAQ;AAC/G,WAAO,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;AAAG,YAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,EACnE,CAAC,CAAC;AACF,QAAM,GAAG,SAAS,WAAS,OAAO,KAAK,WAAW,KAAK,CAAC;AACxD,QAAM,MAAM,GAAG,SAAS,MAAM;AAAA,EAAC,CAAC;AAChC,QAAM,OAAO,GAAG,QAAQ,UAAQ;AAAE,YAAQ,OAAO,KAAK,SAAS,MAAM,GAAG,MAAM,KAAK;AAAA,EAAE,CAAC;AACtF,QAAM,OAAO,GAAG,QAAQ,WAAS;AAC/B,aAAS,MAAM;AACf,cAAU,QAAQ,MAAM,KAAK;AAG7B,UAAM,gBAAgB,SAAS,YAAY,SAAS,YAAY,SAAS;AACzE,QAAI,CAAC,iBAAiB,QAAQ,IAAI,OAAO,QAAQ,OAAO,WAAW,MAAM,IAAI,WAAW;AAAE,aAAO,KAAK,WAAW,IAAI,MAAM,cAAc,CAAC;AAAG,YAAM,MAAM,IAAI;AAAG;AAAA,IAAO;AACvK,QAAI;AACJ,YAAQ,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AACxC,YAAM,OAAO,OAAO,MAAM,GAAG,GAAG;AAAG,eAAS,OAAO,MAAM,MAAM,CAAC;AAChE,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AAAE,cAAM,KAAK,MAAM,IAAI,CAAC;AAAA,MAAE,QACxB;AAAE,eAAO,KAAK,WAAW,IAAI,MAAM,sBAAsB,CAAC;AAAG,cAAM,MAAM,IAAI;AAAA,MAAE;AAAA,IACvF;AAAA,EACF,CAAC;AACD,QAAM,OAAO,WAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AACrD,UAAM,OAAO,KAAK,UAAU,KAAK,IAAI;AACrC,QAAI,UAAU,OAAO,WAAW,IAAI,IAAI,WAAW;AAAE,aAAO,IAAI,MAAM,SAAS,kBAAkB,aAAa,CAAC;AAAG;AAAA,IAAO;AACzH,UAAM,MAAM,MAAM,MAAM,WAAS,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,KAAM,MAAK,KAAK,IAAI,EAAE,MAAM,WAAS,OAAO,KAAK,WAAW,KAAK,CAAC;AACtE,WAAS,YAAY,MAAM,YAAY,MAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,QAAQ,MAAM;AAAE,qBAAa,KAAK;AAAG,eAAO,IAAI,WAAW,OAAO;AAAG,eAAO,IAAI,UAAU,KAAK;AAAG,eAAO,IAAI,WAAW,MAAM;AAAA,MAAE;AACtI,YAAM,UAAU,WAAS;AAAE,YAAI,MAAM,YAAY,MAAM;AAAE,gBAAM;AAAG,kBAAQ,KAAK;AAAA,QAAE;AAAA,MAAE;AACnF,YAAM,QAAQ,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC;AAAA,MAAE;AAC7G,YAAM,SAAS,WAAS;AAAE,cAAM;AAAG,eAAO,KAAK;AAAA,MAAE;AACjD,YAAM,QAAQ,WAAW,MAAM;AAAE,cAAM;AAAG,eAAO,IAAI,MAAM,UAAU,KAAK,YAAY,CAAC,UAAU,CAAC;AAAA,MAAE,GAAG,SAAS;AAChH,aAAO,GAAG,WAAW,OAAO;AAAG,aAAO,KAAK,UAAU,KAAK;AAAG,aAAO,KAAK,WAAW,MAAM;AAC1F,UAAI,OAAQ,OAAM;AAAA,IACpB,CAAC;AAAA,EACH;AACA,SAAO,OAAO,OAAO,EAAE,OAAO,QAAQ,MAAM,MAAM,aAAa,KAAK,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAK,GAAG,IAAI,SAAS;AAAE,WAAO;AAAA,EAAO,EAAE,CAAC;AAC7J;;;ADhJA,SAAS,WAAAC,UAAS,cAAAC,mBAAkB;;;AGNpC,SAAS,cAAAC,mBAAkB;AAE3B,IAAM,cAAc,MAAM;AAC1B,IAAM,eAAe,IAAI,OAAO;AAChC,IAAM,eAAe,KAAK,OAAO;AACjC,IAAMC,QAAO,MAAM;AAAE,QAAM,IAAI,MAAM,yBAAyB;AAAE;AAChE,IAAM,MAAM,WAASD,YAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAe7D,IAAM,uBAAN,MAA2B;AAAA,EAChC,SAAS,oBAAI,IAAI;AAAA,EACjB,YAAY;AAAA,EAEZ,KAAK,IAAI;AACP,UAAM,QAAQ,KAAK,OAAO,IAAI,EAAE;AAChC,QAAI,MAAO,MAAK,aAAa,MAAM;AACnC,SAAK,OAAO,OAAO,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAE,SAAK,OAAO,MAAM;AAAG,SAAK,YAAY;AAAA,EAAE;AAAA,EAElD,OAAO,OAAO;AACZ,QAAI,CAAC,OAAO,cAAc,OAAO,EAAE,KAAK,MAAM,KAAK,EAAG,CAAAE,MAAK;AAC3D,QAAI,MAAM,SAAS,YAAY;AAAE,WAAK,KAAK,MAAM,EAAE;AAAG,aAAO;AAAA,IAAM;AACnE,QAAI,MAAM,SAAS,kBAAkB;AACnC,UAAI,KAAK,OAAO,IAAI,MAAM,EAAE,KAAK,KAAK,OAAO,QAAQ,MAAM,CAAC,OAAO,cAAc,MAAM,KAAK,KACvF,MAAM,SAAS,eAAe,MAAM,QAAQ,aAAc,CAAAA,MAAK;AACpE,WAAK,OAAO,IAAI,MAAM,IAAI,EAAE,UAAU,MAAM,OAAO,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC;AACxE,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,EAAE;AACtC,QAAI,CAAC,MAAO,CAAAA,MAAK;AACjB,QAAI,MAAM,SAAS,kBAAkB;AACnC,UAAI,MAAM,UAAU,MAAM,OAAO,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,KAAK,KAAK,cAAc,CAAC,IAAI,EAAG,CAAAA,MAAK;AACtI,YAAMC,SAAQ,OAAO,KAAK,MAAM,MAAM,QAAQ;AAC9C,UAAI,CAACA,OAAM,UAAUA,OAAM,SAAS,eAAeA,OAAM,SAAS,QAAQ,MAAM,MAAM,QACjF,MAAM,OAAOA,OAAM,SAAS,MAAM,YAAY,KAAK,YAAYA,OAAM,SAAS,aAAc,CAAAD,MAAK;AACtG,YAAM,OAAO,KAAKC,MAAK;AAAG,YAAM,QAAQA,OAAM;AAAQ,WAAK,aAAaA,OAAM;AAC9E,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,MAAM,SAAU,CAAAD,MAAK;AACzE,UAAM,QAAQ,OAAO,OAAO,MAAM,MAAM;AACxC,SAAK,KAAK,MAAM,EAAE;AAClB,QAAI,MAAM,WAAW,IAAI,KAAK,EAAG,CAAAA,MAAK;AACtC,UAAM,QAAQ,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;AAC/C,QAAI,MAAM,SAAS,cAAc,MAAM,OAAO,MAAM,GAAI,CAAAA,MAAK;AAC7D,WAAO;AAAA,EACT;AACF;;;AHnDA,IAAI;AAAJ,IAAW;AACX,IAAM,UAAU,oBAAI,IAAI;AACxB,IAAM,YAAY,IAAI,qBAAqB;AAC3C,IAAI,WAAW;AACf,IAAM,SAAS,MAAM;AACnB,aAAW,SAAS,QAAQ,OAAO,EAAG,OAAM,OAAO,IAAI,MAAM,eAAe,CAAC;AAC7E,UAAQ,MAAM;AACd,YAAU,MAAM;AAChB,SAAO,IAAI;AACb;AACA,IAAI;AACF,QAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC;AAC/C,MAAI,QAAQ,KAAK,WAAW,KAAK,CAACE,YAAW,IAAI,KAAK,CAAC,0BAA0B,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,4BAA4B;AAC/I,MAAI;AACJ,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,SAAO,CAAC,cAAc,KAAK,IAAI,IAAI,UAAU;AAC3C,QAAI;AAAE,YAAM,OAAO,MAAMC,UAAS,IAAI;AAAG,UAAI,KAAK,SAAS,MAAQ,OAAM,IAAI,MAAM,kBAAkB;AAAG,mBAAa,KAAK,MAAM,IAAI;AAAA,IAAE,SAC/H,OAAO;AAAE,UAAI,MAAM,SAAS,SAAU,OAAM;AAAO,YAAM,MAAM,EAAE;AAAA,IAAE;AAAA,EAC5E;AACA,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY,OAAO,WAAW,cAAc,SAAU,OAAM,IAAI,MAAM,mBAAmB;AAC1I,QAAM,MAAM,gBAAgB,EAAE,KAAK,OAAO,KAAK,YAAY,WAAW,GAAG,QAAQ,OAAO,MAAM,OAAO,CAAC;AACtG,MAAI,CAAC,OAAO,MAAM,OAAO,KAAK,WAAW,OAAO,GAAG,KAAK,OAAO,KAAK,WAAW,WAAW,WAAW,CAAC,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAC9I,QAAM,OAAO,KAAK,MAAM,WAAW,OAAO;AAC1C,QAAM,mBAAmB,KAAK,MAAM,KAAK,YAAY,KAAK,IAAI,CAAC;AAC/D,QAAM,YAAY,KAAK,MAAM,KAAK,mBAAmB,KAAK,IAAI,CAAC;AAC/D,MAAI,KAAK,YAAY,KAAK,mBAAmB,KAAK,mBAAmB,QAAU,YAAY,KAAK,YAAY,KAAW,OAAM,IAAI,MAAM,mBAAmB;AAC1J,UAAQ;AAAA,IAAc,KAAK;AAAA,IAAQ;AAAA,IAAU,EAAE,UAAU,KAAK,UAAU,WAAW,KAAK,WAAW,aAAa,KAAK,aAAa,OAAO,UAAU;AAAA,IACjJ,EAAE,MAAMC,SAAQ,IAAI,GAAG,KAAK,mBAAmBA,SAAQ,IAAI,CAAC,EAAE;AAAA,EAAC;AACjE,QAAM,MAAM,CAAC,IAAI,SAAS,WAAW,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpE,QAAI,MAAM,UAAU,QAAQ,QAAQ,IAAI;AAAE,aAAO,IAAI,MAAM,oBAAoB,CAAC;AAAG;AAAA,IAAO;AAC1F,UAAM,KAAK,EAAE;AACb,UAAM,QAAQ,MAAM;AAAE,YAAM,QAAQ,QAAQ,IAAI,EAAE;AAAG,cAAQ,OAAO,EAAE;AAAG,gBAAU,KAAK,EAAE;AAAG,WAAK,MAAM,KAAK,EAAE,MAAM,UAAU,GAAG,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAG,aAAO,OAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,IAAE;AACpM,QAAI,QAAQ,SAAS;AAAE,aAAO,IAAI,MAAM,mBAAmB,CAAC;AAAG;AAAA,IAAO;AACtE,UAAMC,SAAQ,WAAW,OAAO,KAAK,IAAI,WAAW,GAAM,CAAC;AAC3D,YAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACvD,UAAM,SAAS,QAAM,WAAS;AAAE,mBAAaA,MAAK;AAAG,cAAQ,oBAAoB,SAAS,KAAK;AAAG,SAAG,KAAK;AAAA,IAAE;AAC5G,YAAQ,IAAI,IAAI,EAAE,SAAS,OAAO,OAAO,GAAG,QAAQ,OAAO,MAAM,EAAE,CAAC;AACpE,SAAK,MAAM,KAAK,EAAE,MAAM,WAAW,IAAI,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,MAAM;AAAE,YAAM,QAAQ,QAAQ,IAAI,EAAE;AAAG,cAAQ,OAAO,EAAE;AAAG,gBAAU,KAAK,EAAE;AAAG,aAAO,OAAO,IAAI,MAAM,eAAe,CAAC;AAAA,IAAE,CAAC;AAAA,EAC3L,CAAC;AACD,QAAM,OAAO,GAAG,WAAW,aAAW;AACpC,QAAI,CAAC,OAAO,cAAc,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,EAAG;AACpE,QAAI;AACF,YAAM,WAAW,UAAU,OAAO,OAAO;AACzC,UAAI,CAAC,SAAU;AACf,YAAM,QAAQ,QAAQ,IAAI,SAAS,EAAE;AAAG,cAAQ,OAAO,SAAS,EAAE;AAClE,UAAI,SAAS,GAAI,QAAO,QAAQ,QAAQ;AAAA,UACnC,QAAO,OAAO,IAAI,MAAM,SAAS,QAAQ,gBAAgB,CAAC;AAAA,IACjE,QAAQ;AACN,YAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;AAAG,cAAQ,OAAO,QAAQ,EAAE;AAAG,gBAAU,KAAK,QAAQ,EAAE;AAC5F,aAAO,OAAO,IAAI,MAAM,yBAAyB,CAAC;AAAA,IACpD;AAAA,EACF,CAAC;AACD,QAAM,OAAO,GAAG,WAAW,MAAM;AAAE,WAAO;AAAG,SAAK,QAAQ,MAAM;AAAA,EAAE,CAAC;AACnE,QAAM,OAAO,KAAK,UAAU,MAAM;AAAE,WAAO;AAAG,SAAK,QAAQ,MAAM;AAAA,EAAE,CAAC;AACpE,WAAS,WAAW,MAAM;AACxB,UAAM,SAAS,IAAI,OAAO,EAAE,MAAM,8BAA8B,SAAS,QAAQ,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;AACnH,WAAO,kBAAkB,cAAc,OAAO,UAAU,SAAS,EAAE,QAAQ,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,OAAO,MAAM,GAAG,MAAM,EAAE;AAC7H,WAAO,kBAAkB,cAAc,OAAO,SAAS,QAAQ;AAC7D,UAAI;AACF,cAAM,WAAW,MAAM,IAAI,QAAQ,EAAE,MAAM,QAAQ,OAAO,MAAM,MAAM,QAAQ,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,OAAO,MAAM;AACzH,eAAO,SAAS,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,SAAS,KAAK,EAAE,CAAC,EAAE;AAAA,MACnG,SACO,OAAO;AAAE,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC,EAAE;AAAA,MAAE;AAAA,IAC7F,CAAC;AACD,WAAO,UAAU;AACjB,WAAO;AAAA,EACT,GAAG,EAAE,WAAW,IAAI,qBAAqB,QAAQ,OAAO,QAAQ,QAAQ,EAAE,eAAe,OAAQ,CAAC,EAAE,CAAC;AACrG,QAAM,QAAQ,WAAW,MAAM;AAAE,WAAO;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,GAAG,SAAS;AAAG,QAAM,MAAM;AAC1F,UAAQ,MAAM,KAAK,OAAO,MAAM;AAAE,iBAAa,KAAK;AAAG,WAAO;AAAG,SAAK,OAAO,MAAM;AAAA,EAAE,CAAC;AACxF,SAAS,OAAO;AACd,UAAQ,OAAO,MAAM,qCAAqC,MAAM,OAAO;AAAA,CAAI;AAC3E,SAAO;AAAG,UAAQ,WAAW;AAC/B;",
+  "names": ["readFile", "info", "path", "dirname", "isAbsolute", "createHash", "fail", "fail", "bytes", "isAbsolute", "readFile", "dirname", "timer"]
 }