@mario.andreschak/mcp-browser 3.46.1 → 3.47.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 mario-andreschak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,52 +1,52 @@
-# Browser MCP
-
-The browser MCP provides interactive Patchright sessions, deterministic PNG capture, and WebM recording.
-
-## Evidence artifacts
-
-`browser_screenshot` creates an immutable PNG by default under
-`screenshots/browser/<sessionId>/<artifactId>-viewport.png` (or
-`-full-page.png`). An optional `outputPath` is accepted only inside the
-FLUJO data directory or configured screenshot root. Existing destinations,
-root escapes, drive-relative/device/UNC paths, and symlink or junction escapes
-are rejected.
-
-Screenshot results include the artifact ID, SHA-256, capture timestamp, CSS
-viewport, DPR, encoded PNG dimensions, and page/session metadata. When the
-target is an active recording, the result also links the PNG to its
-`recordingId` and configured recording geometry. PNGs are lossless evidence;
-callers must still freeze application animation, timestamps, cursors, and
-changing overlays before exact comparisons.
-
-## Recording geometry
-
-Recording contexts use an explicit CSS viewport and device scale factor 1.
-The configured video surface matches that viewport. Recording sessions have a
-fixed viewport policy: resizing the MCP App or dock scales/letterboxes the live
-stream and never mutates the page used to produce evidence.
-
-Start, status, and stop results distinguish:
-
-- `requestedViewport`
-- `actualViewport`
-- `deviceScaleFactor`
-- `configuredVideoResolution`
-- `actualEncodedVideoResolution` (after finalization, or `null` with a warning)
-- content bounds, letterbox insets, and `geometryMismatch`
-
-WebM remains review/playback evidence; use recording-linked PNG screenshots for
-exact pixel evidence.
-
-## Session lifecycle and ownership
-
-The backend-provided `_meta.flujo.ownerScope` is authoritative. Calls without
-metadata use the process-local `legacy:anonymous` compatibility scope.
-Session IDs cannot be listed, used, attached, stopped, or closed across owner
-scopes. The live-view gateway additionally requires a private per-session
-capability delivered to the MCP App through result metadata.
-
-Capacity is reserved synchronously before browser creation, so concurrent opens
-cannot race above `FLUJO_BROWSER_MAX_SESSIONS`. Dead and expired entries are
-reclaimed before enforcing the cap. `browser_list_sessions` returns
-owner-filtered lifecycle/capacity diagnostics, and `browser_release_owner`
-idempotently finalizes recordings and releases sessions for the caller scope.
+# Browser MCP
+
+The browser MCP provides interactive Patchright sessions, deterministic PNG capture, and WebM recording.
+
+## Evidence artifacts
+
+`browser_screenshot` creates an immutable PNG by default under
+`screenshots/browser/<sessionId>/<artifactId>-viewport.png` (or
+`-full-page.png`). An optional `outputPath` is accepted only inside the
+FLUJO data directory or configured screenshot root. Existing destinations,
+root escapes, drive-relative/device/UNC paths, and symlink or junction escapes
+are rejected.
+
+Screenshot results include the artifact ID, SHA-256, capture timestamp, CSS
+viewport, DPR, encoded PNG dimensions, and page/session metadata. When the
+target is an active recording, the result also links the PNG to its
+`recordingId` and configured recording geometry. PNGs are lossless evidence;
+callers must still freeze application animation, timestamps, cursors, and
+changing overlays before exact comparisons.
+
+## Recording geometry
+
+Recording contexts use an explicit CSS viewport and device scale factor 1.
+The configured video surface matches that viewport. Recording sessions have a
+fixed viewport policy: resizing the MCP App or dock scales/letterboxes the live
+stream and never mutates the page used to produce evidence.
+
+Start, status, and stop results distinguish:
+
+- `requestedViewport`
+- `actualViewport`
+- `deviceScaleFactor`
+- `configuredVideoResolution`
+- `actualEncodedVideoResolution` (after finalization, or `null` with a warning)
+- content bounds, letterbox insets, and `geometryMismatch`
+
+WebM remains review/playback evidence; use recording-linked PNG screenshots for
+exact pixel evidence.
+
+## Session lifecycle and ownership
+
+The backend-provided `_meta.flujo.ownerScope` is authoritative. Calls without
+metadata use the process-local `legacy:anonymous` compatibility scope.
+Session IDs cannot be listed, used, attached, stopped, or closed across owner
+scopes. The live-view gateway additionally requires a private per-session
+capability delivered to the MCP App through result metadata.
+
+Capacity is reserved synchronously before browser creation, so concurrent opens
+cannot race above `FLUJO_BROWSER_MAX_SESSIONS`. Dead and expired entries are
+reclaimed before enforcing the cap. `browser_list_sessions` returns
+owner-filtered lifecycle/capacity diagnostics, and `browser_release_owner`
+idempotently finalizes recordings and releases sessions for the caller scope.

package/dist/audioTap.js

@@ -22,126 +22,126 @@
  */
 export function audioTapSource(binding, initiallyMuted = false) {
     const muted = initiallyMuted ? 'true' : 'false';
-    return `(function(){
-  if (window.__flujoAudioTap) { window.__flujoAudioMuted = ${muted}; return; }
-  var NativeCtx = window.AudioContext || window.webkitAudioContext;
-  if (!NativeCtx) return;
-  window.__flujoAudioTap = true;
-  window.__flujoAudioMuted = ${muted};
-  var CHUNK = 4096;
-  var SILENCE = 1 / 32768;
-
-  function encode(bytes){
-    var out = "", step = 0x8000;
-    for (var i = 0; i < bytes.length; i += step) {
-      out += String.fromCharCode.apply(null, bytes.subarray(i, i + step));
-    }
-    return btoa(out);
-  }
-
-  /** Insert a silent recorder between a context's graph and its real output. */
-  function tap(ctx, output){
-    var input = ctx.createGain();
-    var processor = ctx.createScriptProcessor(CHUNK, 2, 2);
-    processor.onaudioprocess = function(event){
-      var send = window.${binding};
-      if (window.__flujoAudioMuted || typeof send !== "function") return;
-      var buffer = event.inputBuffer;
-      var frames = buffer.length;
-      var left = buffer.getChannelData(0);
-      var right = buffer.numberOfChannels > 1 ? buffer.getChannelData(1) : left;
-      var pcm = new Int16Array(frames * 2);
-      var silent = true;
-      for (var i = 0; i < frames; i++) {
-        var a = left[i], b = right[i];
-        if (a > 1) a = 1; else if (a < -1) a = -1;
-        if (b > 1) b = 1; else if (b < -1) b = -1;
-        if (silent && (a > SILENCE || a < -SILENCE || b > SILENCE || b < -SILENCE)) silent = false;
-        pcm[i * 2] = a * 32767;
-        pcm[i * 2 + 1] = b * 32767;
-      }
-      // Digital silence is the common case on a normal page; never spend
-      // bandwidth or CDP round trips on it.
-      if (silent) return;
-      try {
-        send(JSON.stringify({ rate: ctx.sampleRate, pcm: encode(new Uint8Array(pcm.buffer)) }));
-      } catch (error) {
-        window.__flujoAudioMuted = true;
-      }
-    };
-    input.connect(processor);
-    // A ScriptProcessor only runs while it is reachable from the destination.
-    // Its own output stays silent because onaudioprocess never writes one.
-    processor.connect(output);
-    return input;
-  }
-
-  // 1) Pages with their own AudioContext.
-  function patch(Ctor){
-    if (typeof Ctor !== "function") return Ctor;
-    function Patched(){
-      var ctx = new (Function.prototype.bind.apply(Ctor, [null].concat([].slice.call(arguments))))();
-      try {
-        var input = tap(ctx, ctx.destination);
-        input.maxChannelCount = ctx.destination.maxChannelCount;
-        Object.defineProperty(ctx, "destination", {
-          configurable: true,
-          get: function(){ return input; }
-        });
-      } catch (error) { /* an untappable context still plays normally */ }
-      return ctx;
-    }
-    Patched.prototype = Ctor.prototype;
-    return Patched;
-  }
-  try {
-    if (window.AudioContext) window.AudioContext = patch(window.AudioContext);
-    if (window.webkitAudioContext) window.webkitAudioContext = patch(window.webkitAudioContext);
-  } catch (error) { /* frozen globals: media elements below still work */ }
-
-  // 2) Plain media elements, routed into one shared context on first play.
-  var mediaCtx, mediaTap, attached = new WeakSet();
-  function attach(element){
-    if (attached.has(element)) return;
-    try {
-      if (!mediaCtx) {
-        mediaCtx = new NativeCtx();
-        mediaTap = tap(mediaCtx, mediaCtx.destination);
-      }
-      attached.add(element);
-      mediaCtx.createMediaElementSource(element).connect(mediaTap);
-      if (mediaCtx.state === "suspended") mediaCtx.resume();
-    } catch (error) {
-      // Cross-origin media without CORS headers taints the graph; leave the
-      // element alone so at least the picture keeps playing.
-    }
-  }
-  document.addEventListener("play", function(event){
-    var target = event.target;
-    if (target && (target.tagName === "AUDIO" || target.tagName === "VIDEO")) attach(target);
-  }, true);
-
-  // Installing the tap after a session was opened must still recover media
-  // whose play event already fired. The pre-navigation install is the normal
-  // path; this scan is the fallback for reused sessions and dynamically added
-  // elements that began playing before they entered the document.
-  function attachPlaying(root){
-    if (!root) return;
-    if ((root.tagName === "AUDIO" || root.tagName === "VIDEO") && !root.paused && !root.ended) attach(root);
-    if (typeof root.querySelectorAll !== "function") return;
-    var media = root.querySelectorAll("audio,video");
-    for (var i = 0; i < media.length; i++) {
-      if (!media[i].paused && !media[i].ended) attach(media[i]);
-    }
-  }
-  attachPlaying(document);
-  if (window.MutationObserver) {
-    new MutationObserver(function(records){
-      for (var i = 0; i < records.length; i++) {
-        for (var j = 0; j < records[i].addedNodes.length; j++) attachPlaying(records[i].addedNodes[j]);
-      }
-    }).observe(document.documentElement || document, { childList: true, subtree: true });
-  }
+    return `(function(){
+  if (window.__flujoAudioTap) { window.__flujoAudioMuted = ${muted}; return; }
+  var NativeCtx = window.AudioContext || window.webkitAudioContext;
+  if (!NativeCtx) return;
+  window.__flujoAudioTap = true;
+  window.__flujoAudioMuted = ${muted};
+  var CHUNK = 4096;
+  var SILENCE = 1 / 32768;
+
+  function encode(bytes){
+    var out = "", step = 0x8000;
+    for (var i = 0; i < bytes.length; i += step) {
+      out += String.fromCharCode.apply(null, bytes.subarray(i, i + step));
+    }
+    return btoa(out);
+  }
+
+  /** Insert a silent recorder between a context's graph and its real output. */
+  function tap(ctx, output){
+    var input = ctx.createGain();
+    var processor = ctx.createScriptProcessor(CHUNK, 2, 2);
+    processor.onaudioprocess = function(event){
+      var send = window.${binding};
+      if (window.__flujoAudioMuted || typeof send !== "function") return;
+      var buffer = event.inputBuffer;
+      var frames = buffer.length;
+      var left = buffer.getChannelData(0);
+      var right = buffer.numberOfChannels > 1 ? buffer.getChannelData(1) : left;
+      var pcm = new Int16Array(frames * 2);
+      var silent = true;
+      for (var i = 0; i < frames; i++) {
+        var a = left[i], b = right[i];
+        if (a > 1) a = 1; else if (a < -1) a = -1;
+        if (b > 1) b = 1; else if (b < -1) b = -1;
+        if (silent && (a > SILENCE || a < -SILENCE || b > SILENCE || b < -SILENCE)) silent = false;
+        pcm[i * 2] = a * 32767;
+        pcm[i * 2 + 1] = b * 32767;
+      }
+      // Digital silence is the common case on a normal page; never spend
+      // bandwidth or CDP round trips on it.
+      if (silent) return;
+      try {
+        send(JSON.stringify({ rate: ctx.sampleRate, pcm: encode(new Uint8Array(pcm.buffer)) }));
+      } catch (error) {
+        window.__flujoAudioMuted = true;
+      }
+    };
+    input.connect(processor);
+    // A ScriptProcessor only runs while it is reachable from the destination.
+    // Its own output stays silent because onaudioprocess never writes one.
+    processor.connect(output);
+    return input;
+  }
+
+  // 1) Pages with their own AudioContext.
+  function patch(Ctor){
+    if (typeof Ctor !== "function") return Ctor;
+    function Patched(){
+      var ctx = new (Function.prototype.bind.apply(Ctor, [null].concat([].slice.call(arguments))))();
+      try {
+        var input = tap(ctx, ctx.destination);
+        input.maxChannelCount = ctx.destination.maxChannelCount;
+        Object.defineProperty(ctx, "destination", {
+          configurable: true,
+          get: function(){ return input; }
+        });
+      } catch (error) { /* an untappable context still plays normally */ }
+      return ctx;
+    }
+    Patched.prototype = Ctor.prototype;
+    return Patched;
+  }
+  try {
+    if (window.AudioContext) window.AudioContext = patch(window.AudioContext);
+    if (window.webkitAudioContext) window.webkitAudioContext = patch(window.webkitAudioContext);
+  } catch (error) { /* frozen globals: media elements below still work */ }
+
+  // 2) Plain media elements, routed into one shared context on first play.
+  var mediaCtx, mediaTap, attached = new WeakSet();
+  function attach(element){
+    if (attached.has(element)) return;
+    try {
+      if (!mediaCtx) {
+        mediaCtx = new NativeCtx();
+        mediaTap = tap(mediaCtx, mediaCtx.destination);
+      }
+      attached.add(element);
+      mediaCtx.createMediaElementSource(element).connect(mediaTap);
+      if (mediaCtx.state === "suspended") mediaCtx.resume();
+    } catch (error) {
+      // Cross-origin media without CORS headers taints the graph; leave the
+      // element alone so at least the picture keeps playing.
+    }
+  }
+  document.addEventListener("play", function(event){
+    var target = event.target;
+    if (target && (target.tagName === "AUDIO" || target.tagName === "VIDEO")) attach(target);
+  }, true);
+
+  // Installing the tap after a session was opened must still recover media
+  // whose play event already fired. The pre-navigation install is the normal
+  // path; this scan is the fallback for reused sessions and dynamically added
+  // elements that began playing before they entered the document.
+  function attachPlaying(root){
+    if (!root) return;
+    if ((root.tagName === "AUDIO" || root.tagName === "VIDEO") && !root.paused && !root.ended) attach(root);
+    if (typeof root.querySelectorAll !== "function") return;
+    var media = root.querySelectorAll("audio,video");
+    for (var i = 0; i < media.length; i++) {
+      if (!media[i].paused && !media[i].ended) attach(media[i]);
+    }
+  }
+  attachPlaying(document);
+  if (window.MutationObserver) {
+    new MutationObserver(function(records){
+      for (var i = 0; i < records.length; i++) {
+        for (var j = 0; j < records[i].addedNodes.length; j++) attachPlaying(records[i].addedNodes[j]);
+      }
+    }).observe(document.documentElement || document, { childList: true, subtree: true });
+  }
 })();`;
 }
 //# sourceMappingURL=audioTap.js.map

package/dist/capture.js

@@ -280,46 +280,46 @@ export async function captureRegionPng(page, source, region, timeoutMs) {
  * passed as *data* arguments only — never string-concatenated into code — so
  * this cannot become a general JS-evaluate primitive (D4).
  */
-const ELEMENT_METRICS_SCRIPT = `(function(selectors){
-  function overflowClass(value, scrollSize, clientSize){
-    if (value === "visible") return "visible";
-    if (scrollSize > clientSize) return value === "scroll" ? "scroll" : "clipped";
-    return value;
-  }
-  return selectors.map(function(selector){
-    var el = document.querySelector(selector);
-    if (!el) return { selector: selector, found: false };
-    var rect = el.getBoundingClientRect();
-    var style = window.getComputedStyle(el);
-    var viewportW = window.innerWidth, viewportH = window.innerHeight;
-    var isVisible = style.visibility !== "hidden" && style.display !== "none" && rect.width > 0 && rect.height > 0;
-    var isInViewport = rect.top < viewportH && rect.bottom > 0 && rect.left < viewportW && rect.right > 0;
-    return {
-      selector: selector,
-      found: true,
-      boundingBox: { x: rect.x, y: rect.y, width: rect.width, height: rect.height },
-      clientRect: { top: rect.top, left: rect.left, right: rect.right, bottom: rect.bottom, width: rect.width, height: rect.height },
-      scrollWidth: el.scrollWidth,
-      scrollHeight: el.scrollHeight,
-      isVisible: isVisible,
-      isInViewport: isInViewport,
-      overflowX: overflowClass(style.overflowX, el.scrollWidth, el.clientWidth),
-      overflowY: overflowClass(style.overflowY, el.scrollHeight, el.clientHeight),
-      textOverflow: el.scrollWidth > el.clientWidth || el.scrollHeight > el.clientHeight,
-      actionSafe: isVisible && isInViewport,
-      computed: {
-        fontSize: style.fontSize,
-        lineHeight: style.lineHeight,
-        color: style.color,
-        backgroundColor: style.backgroundColor,
-        opacity: style.opacity,
-        zIndex: style.zIndex,
-        transform: style.transform,
-        display: style.display,
-        position: style.position,
-      },
-    };
-  });
+const ELEMENT_METRICS_SCRIPT = `(function(selectors){
+  function overflowClass(value, scrollSize, clientSize){
+    if (value === "visible") return "visible";
+    if (scrollSize > clientSize) return value === "scroll" ? "scroll" : "clipped";
+    return value;
+  }
+  return selectors.map(function(selector){
+    var el = document.querySelector(selector);
+    if (!el) return { selector: selector, found: false };
+    var rect = el.getBoundingClientRect();
+    var style = window.getComputedStyle(el);
+    var viewportW = window.innerWidth, viewportH = window.innerHeight;
+    var isVisible = style.visibility !== "hidden" && style.display !== "none" && rect.width > 0 && rect.height > 0;
+    var isInViewport = rect.top < viewportH && rect.bottom > 0 && rect.left < viewportW && rect.right > 0;
+    return {
+      selector: selector,
+      found: true,
+      boundingBox: { x: rect.x, y: rect.y, width: rect.width, height: rect.height },
+      clientRect: { top: rect.top, left: rect.left, right: rect.right, bottom: rect.bottom, width: rect.width, height: rect.height },
+      scrollWidth: el.scrollWidth,
+      scrollHeight: el.scrollHeight,
+      isVisible: isVisible,
+      isInViewport: isInViewport,
+      overflowX: overflowClass(style.overflowX, el.scrollWidth, el.clientWidth),
+      overflowY: overflowClass(style.overflowY, el.scrollHeight, el.clientHeight),
+      textOverflow: el.scrollWidth > el.clientWidth || el.scrollHeight > el.clientHeight,
+      actionSafe: isVisible && isInViewport,
+      computed: {
+        fontSize: style.fontSize,
+        lineHeight: style.lineHeight,
+        color: style.color,
+        backgroundColor: style.backgroundColor,
+        opacity: style.opacity,
+        zIndex: style.zIndex,
+        transform: style.transform,
+        display: style.display,
+        position: style.position,
+      },
+    };
+  });
 })`;
 export async function evaluateElementMetrics(page, selectors) {
     return page.evaluate(ELEMENT_METRICS_SCRIPT, selectors);

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './node-runtime-preflight.mjs';
 export * from './tools.js';
 export * from './resources.js';
 export * from './runtime.js';

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './node-runtime-preflight.mjs';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,kCAAkC,EAClC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAE/B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAC5D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAC/C,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAI,IAAgC,CAAC,KAAK,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,UAAU,GAAI,KAAiC,CAAC,UAAU,CAAC;IACjE,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;AACpG,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvE,eAAe,CACb,OAAO,CAAC,MAAM,CAAC,IAAI,EACnB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAC9B,KAAK,CAAC,MAAM,EACZ,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CACnC,CACF,CAAC;AACF,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACzF,MAAM,CAAC,iBAAiB,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACtG,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,KAAK,UAAU,QAAQ;IACrB,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AACD,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,uCAAuC;AACvC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAElD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;IACzH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,yCAAyC,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,kCAAkC,EAClC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAE/B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,QAAQ,EAAE,EAC5D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAC/C,CAAC;AAEF,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAI,IAAgC,CAAC,KAAK,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,UAAU,GAAI,KAAiC,CAAC,UAAU,CAAC;IACjE,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC;AACpG,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvE,eAAe,CACb,OAAO,CAAC,MAAM,CAAC,IAAI,EACnB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAC9B,KAAK,CAAC,MAAM,EACZ,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CACnC,CACF,CAAC;AACF,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACzF,MAAM,CAAC,iBAAiB,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACtG,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,KAAK,UAAU,QAAQ;IACrB,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AACD,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,uCAAuC;AACvC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAElD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;IACzH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/node-runtime-preflight.d.mts

@@ -0,0 +1 @@
+export {};

package/dist/node-runtime-preflight.mjs

@@ -0,0 +1,11 @@
+import { assertSupportedNodeRuntime } from './node-runtime.mjs';
+
+// Entry points import this before dependencies can initialize private state.
+try {
+  assertSupportedNodeRuntime();
+} catch (error) {
+  if (error.code !== 'UNSUPPORTED_NODE_RUNTIME') throw error;
+  // MCP stdout belongs to the protocol. Never prompt or emit a stack trace here.
+  console.error(`[FLUJO] ${error.code}: ${error.message}`);
+  process.exit(1);
+}

package/dist/node-runtime.mjs

@@ -0,0 +1,39 @@
+/** The public app and MCP packages share the October 2026 security runtime floor. */
+export const SUPPORTED_NODE_RANGE = '^22.23.4 || ^24.22.1';
+
+export function nodeRuntimeDiagnostic(version = process.versions.node, executable = process.execPath) {
+  const displayVersion = typeof version === 'string' && /^v?\d+\.\d+\.\d+$/.test(version)
+    ? `v${version.replace(/^v/, '').slice(0, 64)}` : 'an unrecognized version';
+  const displayPath = String(executable).replace(/[\x00-\x1f\x7f-\x9f]/g, '?').slice(0, 512);
+  return `FLUJO cannot start with Node.js ${displayVersion}.\nActive executable: ${displayPath}\n`
+    + 'Use a current patched release of Node.js 22.x (22.23.4+) or 24.x (24.22.1+) to include the October 2026 security fixes.';
+}
+
+export function nodeRuntimeManualSteps(platform = process.platform) {
+  return [
+    'Manual update:',
+    '  1. Install a current patched Node.js 22.x or 24.x from https://nodejs.org/en/download.',
+    ...(platform === 'win32'
+      ? ['     With Windows Package Manager: winget install --id OpenJS.NodeJS.22 --exact --source winget']
+      : ['     If you use nvm: nvm install 22 && nvm use 22']),
+    '  2. Close and reopen your terminal, then check: node --version',
+    platform === 'win32' ? '     Check the active executable: Get-Command node -All' : '     Check the active executable: command -v node',
+    '  3. If the old version is still active, put the new installation first on PATH or activate it with your Node version manager.',
+    '     Retry the same FLUJO or MCP command after a supported version is active.',
+  ].join('\n');
+}
+
+export function isSupportedNodeRuntime(version) {
+  if (typeof version !== 'string' || !/^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version)) return false;
+  const [major, minor, patch] = version.replace(/^v/, '').split('.').map(Number);
+  if (![major, minor, patch].every((part) => Number.isSafeInteger(part) && part <= 2_147_483_647)) return false;
+  return (major === 22 && (minor > 23 || (minor === 23 && patch >= 4)))
+    || (major === 24 && (minor > 22 || (minor === 22 && patch >= 1)));
+}
+
+export function assertSupportedNodeRuntime(version = process.versions.node) {
+  if (isSupportedNodeRuntime(version)) return;
+  const error = new Error(`${nodeRuntimeDiagnostic(version)}\n\n${nodeRuntimeManualSteps()}`);
+  error.code = 'UNSUPPORTED_NODE_RUNTIME';
+  throw error;
+}