@mcpjam/inspector 3.4.0 → 3.5.0

package/dist/server/chunk-RP4R2FQ5.js

@@ -0,0 +1,673 @@
+// server/utils/computers/browser-consent.ts
+import { watch } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+// server/utils/device-consent.ts
+import { lock } from "proper-lockfile";
+import { mkdir as mkdir2 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+import { readFile, unlink } from "fs/promises";
+
+// server/utils/local-capability.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { mkdir, writeFile, rename, chmod } from "fs/promises";
+import { dirname } from "path";
+function mintCapabilityToken() {
+  return randomBytes(32).toString("base64url");
+}
+function capabilityFingerprint(token) {
+  return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function capabilityMatches(token, hash) {
+  if (typeof token !== "string" || token.length < 16 || token.length > 256 || !/^[0-9a-f]{64}$/.test(hash))
+    return false;
+  return timingSafeEqual(
+    Buffer.from(capabilityFingerprint(token), "hex"),
+    Buffer.from(hash, "hex")
+  );
+}
+function createCapabilityMutationLock() {
+  let chain = Promise.resolve();
+  return function withLock(op) {
+    const run = chain.then(op, op);
+    chain = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  };
+}
+async function persistCapabilityState(file, state) {
+  await mkdir(dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp`;
+  await writeFile(tmp, JSON.stringify(state), { mode: 384 });
+  await chmod(tmp, 384);
+  await rename(tmp, file);
+}
+
+// server/utils/device-consent.ts
+function createDeviceConsent(consentFilePath) {
+  const serialize = createCapabilityMutationLock();
+  const withConsentMutationLock = (operation) => serialize(async () => {
+    const file = consentFilePath();
+    await mkdir2(dirname2(file), { recursive: true, mode: 448 });
+    const release = await lock(file, {
+      realpath: false,
+      retries: { retries: 40, minTimeout: 25, maxTimeout: 100 },
+      stale: 1e4
+    });
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  });
+  async function readPersistedConsent() {
+    try {
+      const raw = await readFile(consentFilePath(), "utf8");
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object") return null;
+      const record = parsed;
+      if (typeof record.tokenHash !== "string" || !/^[0-9a-f]{64}$/.test(record.tokenHash)) {
+        return null;
+      }
+      return {
+        tokenHash: record.tokenHash,
+        grantedAt: typeof record.grantedAt === "string" ? record.grantedAt : "unknown"
+      };
+    } catch {
+      return null;
+    }
+  }
+  function grant() {
+    return withConsentMutationLock(async () => {
+      const token = mintCapabilityToken();
+      const grantedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const body = { tokenHash: capabilityFingerprint(token), grantedAt };
+      await persistCapabilityState(consentFilePath(), body);
+      return { token, grantedAt };
+    });
+  }
+  async function verify(token) {
+    return await verifyAndFingerprint(token) !== null;
+  }
+  async function fingerprint() {
+    return (await readPersistedConsent())?.tokenHash ?? null;
+  }
+  async function verifyAndFingerprint(token) {
+    if (typeof token !== "string" || token.length < 16 || token.length > 256)
+      return null;
+    const persisted = await readPersistedConsent();
+    if (!persisted) return null;
+    return capabilityMatches(token, persisted.tokenHash) ? persisted.tokenHash : null;
+  }
+  function revoke(token) {
+    return withConsentMutationLock(async () => {
+      if (token != null && !await verify(token)) {
+        return;
+      }
+      await unlink(consentFilePath()).catch(() => {
+      });
+    });
+  }
+  return {
+    grant,
+    verify,
+    fingerprint,
+    verifyAndFingerprint,
+    revoke
+  };
+}
+
+// server/utils/computers/browser-consent.ts
+var BROWSER_CONSENT_HEADER = "x-mcpjam-browser-consent";
+var consent = createDeviceConsent(
+  () => join(homedir(), ".mcpjam", "browser", "consent.json")
+);
+async function grantLocalBrowserConsent() {
+  const grant = await consent.grant();
+  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-YBODZG23.js");
+  await invalidateBrowserConsentLifetimes2(await consent.fingerprint());
+  return grant;
+}
+var verifyLocalBrowserConsent = consent.verify;
+var getBrowserConsentFingerprint = consent.fingerprint;
+var verifyAndFingerprintBrowserConsent = consent.verifyAndFingerprint;
+async function revokeLocalBrowserConsent(token) {
+  await consent.revoke(token);
+  const { invalidateBrowserConsentLifetimes: invalidateBrowserConsentLifetimes2 } = await import("./consent-lifetime-YBODZG23.js");
+  await invalidateBrowserConsentLifetimes2(await consent.fingerprint());
+}
+function watchBrowserConsentChanges(changed) {
+  try {
+    const watcher = watch(
+      join(homedir(), ".mcpjam", "browser"),
+      { persistent: false },
+      changed
+    );
+    watcher.on("error", () => watcher.close());
+    return () => watcher.close();
+  } catch {
+    return () => {
+    };
+  }
+}
+
+// server/services/browserd/local/security-policy.ts
+import { networkInterfaces } from "os";
+import { isIP } from "net";
+import { lookup } from "dns/promises";
+
+// shared/hosted-web-timeouts.ts
+var WEB_CONNECT_TIMEOUT_MS = 1e4;
+var WEB_CALL_TIMEOUT_MS = 3e4;
+var WEB_STREAM_TIMEOUT_MS = 12e4;
+
+// server/config.ts
+var SERVER_PORT = process.env.SERVER_PORT ? parseInt(process.env.SERVER_PORT, 10) : 6274;
+var SERVER_HOSTNAME = process.env.ENVIRONMENT === "dev" ? "localhost" : "127.0.0.1";
+var LOCAL_SERVER_ADDR = `http://localhost:${SERVER_PORT}`;
+var HOSTED_MODE = process.env.VITE_MCPJAM_HOSTED_MODE === "true";
+var LOCAL_BROWSER_ENABLED = !HOSTED_MODE && process.env.MCPJAM_LOCAL_BROWSER_ENABLED !== "false";
+var LOCAL_COMPUTER_ENABLED = !HOSTED_MODE && process.env.MCPJAM_LOCAL_COMPUTER_ENABLED !== "false";
+var LOCAL_HARNESS_ENABLED = !HOSTED_MODE && process.env.MCPJAM_LOCAL_HARNESS_ENABLED === "true";
+var SCHEDULED_EVALS_WRITE_ENABLED = process.env.MCPJAM_SCHEDULED_EVALS_WRITE_ENABLED === "true";
+var WEBMCP_INSPECTOR_ENABLED = process.env.MCPJAM_WEBMCP_INSPECTOR_ENABLED !== "false";
+function webmcpInspectorHostedEnabled(env = process.env) {
+  return HOSTED_MODE && env.MCPJAM_WEBMCP_INSPECTOR_HOSTED_ENABLED === "1";
+}
+function webmcpInspectorReachable(env = process.env) {
+  if (!WEBMCP_INSPECTOR_ENABLED) return false;
+  return !HOSTED_MODE || webmcpInspectorHostedEnabled(env);
+}
+function hostedBrowserEnabled(env = process.env) {
+  return env.HOSTED_BROWSER_TOOLS_ENABLED === "1";
+}
+function webmcpPageToolsMode(env = process.env) {
+  return env.MCPJAM_WEBMCP_PAGE_TOOLS === "verbs" ? "verbs" : "first_class";
+}
+var EVAL_WIDGET_MODEL_CONTEXT = process.env.MCPJAM_EVAL_WIDGET_MODEL_CONTEXT === "true";
+var WEB_ALLOWED_ORIGINS = (process.env.WEB_ALLOWED_ORIGINS ?? "").split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
+var CLIENT_PORT = process.env.CLIENT_PORT || "5173";
+var DEFAULT_CORS_ORIGINS = [
+  `http://localhost:${CLIENT_PORT}`,
+  // Vite dev server
+  "http://localhost:8080",
+  // Electron renderer dev server
+  `http://localhost:${SERVER_PORT}`,
+  // Hono server
+  `http://127.0.0.1:${SERVER_PORT}`,
+  // Hono server production
+  "https://staging.mcpjam.com"
+  // Hosted deployment
+];
+var CORS_ORIGINS = HOSTED_MODE && WEB_ALLOWED_ORIGINS.length > 0 ? WEB_ALLOWED_ORIGINS : Array.from(/* @__PURE__ */ new Set([...DEFAULT_CORS_ORIGINS, ...WEB_ALLOWED_ORIGINS]));
+var ELICITATION_FORM_TTL_MS = 5 * 6e4;
+var ELICITATION_URL_CONSENT_TTL_MS = 2 * 6e4;
+var ELICITATION_POLL_INTERVAL_MS = 1e3;
+var ELICITATION_POLL_JITTER_MS = 250;
+var ELICITATION_POLL_MAX_FAILURES = 5;
+var ELICITATION_SERVICE_ROUTE_TIMEOUT_MS = 1e4;
+var ELICITATION_TIMEOUT_EXTENSION_MS = ELICITATION_FORM_TTL_MS + 3e4;
+var MRTR_CONTINUATION_TTL_MS = 10 * 6e4;
+var MRTR_CONTINUATION_ROUTE_TIMEOUT_MS = 1e4;
+var MRTR_CONTINUATION_LEASE_TTL_MS = 4 * MRTR_CONTINUATION_ROUTE_TIMEOUT_MS + WEB_CALL_TIMEOUT_MS + 6e4;
+var MRTR_RESUME_STATE_MAX_BYTES = 128 * 1024;
+var MRTR_DISPLAY_FIELD_MAX_BYTES = 16 * 1024;
+var MRTR_RESPONSE_CONTENT_MAX_BYTES = 64 * 1024;
+var MRTR_TEARDOWN_TIMEOUT_MS = 5e3;
+var MCPJAM_HOSTED_ORIGIN = process.env.MCPJAM_HOSTED_ORIGIN?.replace(/\/+$/, "") || "https://app.mcpjam.com";
+function parseAllowedHosts(raw) {
+  return raw ? raw.split(",").map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0) : [];
+}
+var ALLOWED_HOSTS = parseAllowedHosts(
+  process.env.MCPJAM_ALLOWED_HOSTS
+);
+var CANIUSE_LANDING_HOSTS = new Set(
+  (process.env.CANIUSE_LANDING_HOSTS ?? "caniuse.dev,www.caniuse.dev").split(",").map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0)
+);
+var SCORE_LANDING_HOSTS = new Set(
+  (process.env.SCORE_LANDING_HOSTS ?? "score.mcpjam.com,www.score.mcpjam.com").split(",").map((h) => h.trim().toLowerCase()).filter((h) => h.length > 0)
+);
+var BARE_HOSTNAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+function parseSandboxHosts(raw) {
+  return new Set(
+    raw.split(",").map((h) => h.trim().toLowerCase()).filter((h) => BARE_HOSTNAME.test(h))
+  );
+}
+var SANDBOX_HOSTS = parseSandboxHosts(
+  process.env.SANDBOX_HOSTS ?? "sandbox.mcpjam.com,sandbox-staging.mcpjam.com"
+);
+function resolveSandboxIsolation(sandboxHosts = SANDBOX_HOSTS, hostedOrigin = MCPJAM_HOSTED_ORIGIN) {
+  if (sandboxHosts.size === 0) {
+    return "unset";
+  }
+  let appHost;
+  try {
+    appHost = new URL(hostedOrigin).hostname.toLowerCase();
+  } catch {
+    return "unset";
+  }
+  return sandboxHosts.has(appHost) ? "same-origin" : "ok";
+}
+
+// server/utils/inspector-frontend-url.ts
+function getInspectorFrontendUrl(options = {}) {
+  const explicitFrontendUrl = process.env.MCPJAM_INSPECTOR_FRONTEND_URL?.trim() || process.env.FRONTEND_URL?.trim();
+  if (explicitFrontendUrl) {
+    return explicitFrontendUrl;
+  }
+  const isElectron = options.isElectron ?? process.env.ELECTRON_APP === "true";
+  const isPackaged = options.isPackaged ?? process.env.IS_PACKAGED === "true";
+  const isProduction = options.isProduction ?? process.env.NODE_ENV === "production";
+  if (isProduction || isElectron && isPackaged) {
+    return process.env.BASE_URL?.trim() || `http://${SERVER_HOSTNAME}:${SERVER_PORT}`;
+  }
+  if (isElectron) {
+    return "http://localhost:8080";
+  }
+  return `http://localhost:${process.env.CLIENT_PORT || "5173"}`;
+}
+
+// server/services/browserd/local/security-policy.ts
+var BrowserPolicyError = class extends Error {
+  constructor(message = "Browser access to this destination is not allowed.") {
+    super(`browser_policy_refused: ${message}`);
+    this.code = "browser_policy_refused";
+    this.name = "BrowserPolicyError";
+  }
+};
+var controllerPorts = /* @__PURE__ */ new Map();
+var controllerOrigins = /* @__PURE__ */ new Map();
+function registerBrowserController(url) {
+  const parsed = new URL(url);
+  const port = Number(parsed.port || (parsed.protocol === "https:" ? 443 : 80));
+  controllerOrigins.set(
+    parsed.origin,
+    (controllerOrigins.get(parsed.origin) ?? 0) + 1
+  );
+  const local = isMachineAddress(parsed.hostname);
+  if (local) controllerPorts.set(port, (controllerPorts.get(port) ?? 0) + 1);
+  let removed = false;
+  return () => {
+    if (removed) return;
+    removed = true;
+    for (const [map, key] of [
+      [controllerOrigins, parsed.origin],
+      [controllerPorts, port]
+    ]) {
+      if (map === controllerPorts && !local) continue;
+      const registry = map;
+      const count = registry.get(key) ?? 0;
+      if (count <= 1) registry.delete(key);
+      else registry.set(key, count - 1);
+    }
+  };
+}
+function host(raw) {
+  return raw.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function isMachineAddress(raw) {
+  const value = host(raw);
+  if (value === "localhost" || value.endsWith(".localhost") || value === "::1" || value === "::" || value === "0.0.0.0" || /^127\./.test(value))
+    return true;
+  if (value.startsWith("::ffff:")) {
+    const tail = value.slice(7);
+    if (tail.includes(".")) return isMachineAddress(tail);
+    const parts = tail.split(":");
+    if (parts.length === 2 && parts.every((p) => /^[\da-f]{1,4}$/.test(p))) {
+      const first = parseInt(parts[0], 16), last = parseInt(parts[1], 16);
+      return isMachineAddress(
+        `${first >> 8}.${first & 255}.${last >> 8}.${last & 255}`
+      );
+    }
+  }
+  return Object.values(networkInterfaces()).flat().some((a) => a && host(a.address) === value);
+}
+function createLocalBrowserSecurityPolicy(options = {}) {
+  const counts = {
+    navigationRefused: 0,
+    networkRefused: 0,
+    destinationRefused: 0
+  };
+  const increment = (key) => {
+    counts[key] = Math.min(1e6, counts[key] + 1);
+  };
+  const denyNetwork = () => {
+    increment("networkRefused");
+    return false;
+  };
+  const navigationError = (message) => {
+    increment("navigationRefused");
+    return new BrowserPolicyError(message);
+  };
+  const destinationError = () => {
+    increment("destinationRefused");
+    return new BrowserPolicyError();
+  };
+  let disposed = false;
+  const supplied = options.controllerUrls;
+  const registrations = [];
+  if (supplied)
+    for (const url of supplied)
+      registrations.push(registerBrowserController(url));
+  else {
+    registrations.push(
+      registerBrowserController(
+        `http://127.0.0.1:${process.env.SERVER_PORT || 6274}`
+      )
+    );
+    registrations.push(registerBrowserController(getInspectorFrontendUrl()));
+  }
+  const resolve = options.lookup ?? lookup;
+  const aliases = (process.env.MCPJAM_ALLOWED_HOSTS || "").split(",").map((v) => v.trim().toLowerCase()).filter(Boolean);
+  function deniedHost(name, port) {
+    if (!controllerPorts.has(port)) return false;
+    return isMachineAddress(name) || aliases.some(
+      (pattern) => new RegExp(
+        `^${pattern.split("*").map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`,
+        "i"
+      ).test(name)
+    );
+  }
+  const active = options.isActive ?? (() => true);
+  const assertActive = options.assertActive ?? (async () => {
+  });
+  const policy = {
+    discoveryBudget: { entries: /* @__PURE__ */ new Map() },
+    dispose: () => {
+      if (disposed) return;
+      disposed = true;
+      try {
+        options.onAudit?.({ ...counts });
+      } catch {
+      }
+      registrations.forEach((remove) => remove());
+      options.dispose?.();
+    },
+    assertActive,
+    isActive: active,
+    onRevoked: options.onRevoked ?? (() => () => {
+    }),
+    assertNavigation(raw) {
+      let url;
+      try {
+        url = new URL(raw);
+      } catch {
+        throw navigationError(
+          "Browser navigation requires an HTTP or HTTPS URL."
+        );
+      }
+      if (!["http:", "https:"].includes(url.protocol) || !policy.allowsRequest(url.href))
+        throw navigationError(
+          "Browser navigation requires an allowed HTTP or HTTPS website."
+        );
+    },
+    allowsRequest(raw) {
+      if (!active()) return denyNetwork();
+      let url;
+      try {
+        url = new URL(raw);
+      } catch {
+        return denyNetwork();
+      }
+      if ([
+        "file:",
+        "javascript:",
+        "chrome:",
+        "chrome-extension:",
+        "devtools:"
+      ].includes(url.protocol))
+        return denyNetwork();
+      if (!["http:", "https:", "ws:", "wss:"].includes(url.protocol))
+        return ["about:", "blob:", "data:"].includes(url.protocol) || denyNetwork();
+      const port = Number(
+        url.port || (["https:", "wss:"].includes(url.protocol) ? 443 : 80)
+      );
+      const origin = `${url.protocol === "ws:" ? "http:" : url.protocol === "wss:" ? "https:" : url.protocol}//${url.host}`;
+      return !controllerOrigins.has(origin) && !deniedHost(host(url.hostname), port) || denyNetwork();
+    },
+    async resolveDestination(name, port) {
+      await assertActive();
+      if (!Number.isInteger(port) || port < 1 || port > 65535 || deniedHost(host(name), port))
+        throw destinationError();
+      const addresses = isIP(host(name)) ? [{ address: host(name), family: isIP(host(name)) }] : await resolve(host(name), { all: true, verbatim: true });
+      if (!addresses.length || addresses.some((a) => deniedHost(a.address, port)))
+        throw destinationError();
+      await assertActive();
+      return addresses;
+    }
+  };
+  return policy;
+}
+function secureDriverContext(context, policy) {
+  const pages = /* @__PURE__ */ new WeakMap();
+  let closed = false;
+  let stop;
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    stop?.();
+    try {
+      await context.close();
+    } finally {
+      policy.dispose?.();
+    }
+  };
+  stop = policy.onRevoked(close);
+  function guard(page) {
+    const existing = pages.get(page);
+    if (existing) return existing;
+    const synchronous = /* @__PURE__ */ new Set([
+      "url",
+      "isClosed",
+      "consoleEntries",
+      "consoleCursor",
+      "dropConsoleSince",
+      "networkEntries",
+      "networkCursor",
+      "dropNetworkSince",
+      "pendingDialog"
+    ]);
+    const wrapped = new Proxy(page, {
+      get(target, key) {
+        const value = Reflect.get(target, key);
+        if (typeof value !== "function") return value;
+        if (key === "close" || key === "isClosed") return value.bind(target);
+        if (synchronous.has(String(key)))
+          return (...args) => {
+            if (!policy.isActive())
+              throw new BrowserPolicyError("Browser permission was revoked.");
+            return value.apply(target, args);
+          };
+        return async (...args) => {
+          await policy.assertActive();
+          if (key === "goto") policy.assertNavigation(args[0]);
+          if (key !== "goto" && !policy.allowsRequest(target.url()))
+            throw new BrowserPolicyError();
+          const result = await value.apply(target, args);
+          await policy.assertActive();
+          if ((key === "cdp" || key === "webmcp") && result) {
+            return new Proxy(result, {
+              get(rpc, method) {
+                const member = Reflect.get(rpc, method);
+                if (typeof member !== "function") return member;
+                if (!["send", "invoke"].includes(String(method)))
+                  return member.bind(rpc);
+                return async (...params) => {
+                  await policy.assertActive();
+                  if (!policy.allowsRequest(target.url()))
+                    throw new BrowserPolicyError();
+                  if (method === "send" && params[0] === "Page.navigate")
+                    policy.assertNavigation(params[1].url);
+                  const response = await member.apply(rpc, params);
+                  await policy.assertActive();
+                  return response;
+                };
+              }
+            });
+          }
+          return result;
+        };
+      }
+    });
+    pages.set(page, wrapped);
+    return wrapped;
+  }
+  return {
+    async newPage() {
+      await policy.assertActive();
+      const page = await context.newPage();
+      await policy.assertActive();
+      return guard(page);
+    },
+    ...context.onPageCreated ? {
+      onPageCreated: (listener) => context.onPageCreated(
+        (event) => listener({
+          ...event,
+          page: guard(event.page),
+          opener: guard(event.opener)
+        })
+      )
+    } : {},
+    isConnected: () => !closed && policy.isActive() && context.isConnected(),
+    close
+  };
+}
+
+// server/services/browserd/local/consent-lifetime.ts
+async function createBrowserConsentLifetime(expected, read = getBrowserConsentFingerprint, admission) {
+  const fingerprint = expected ?? await read();
+  let valid = Boolean(fingerprint);
+  const callbacks = /* @__PURE__ */ new Set();
+  let disposal;
+  let checking;
+  let stopWatching;
+  let timer;
+  const revoke = () => {
+    if (disposal) return disposal;
+    valid = false;
+    clearInterval(timer);
+    stopWatching?.();
+    const current = [...callbacks];
+    callbacks.clear();
+    disposal = Promise.allSettled(
+      current.map((callback) => Promise.resolve().then(callback))
+    ).then(() => {
+    });
+    return disposal;
+  };
+  const assertActive = async () => {
+    if (!valid || !fingerprint || await read().catch(() => null) !== fingerprint || admission && !await admission().catch(() => false)) {
+      void revoke();
+      throw new BrowserPolicyError(
+        "Browser permission was revoked or changed. Allow Browser again to start a new session."
+      );
+    }
+  };
+  await assertActive();
+  const check = () => {
+    if (checking) return;
+    checking = assertActive().catch(() => {
+    }).finally(() => {
+      checking = void 0;
+    });
+  };
+  timer = setInterval(check, 1e3);
+  if (read === getBrowserConsentFingerprint)
+    stopWatching = watchBrowserConsentChanges(check);
+  timer.unref?.();
+  const lifetime = {
+    fingerprint,
+    assertActive,
+    isActive: () => valid,
+    onRevoked(callback) {
+      if (!valid) {
+        void Promise.resolve().then(callback);
+        return () => {
+        };
+      }
+      callbacks.add(callback);
+      return () => callbacks.delete(callback);
+    },
+    revoke,
+    dispose() {
+      valid = false;
+      clearInterval(timer);
+      stopWatching?.();
+      callbacks.clear();
+      activeLifetimes.delete(lifetime);
+    }
+  };
+  activeLifetimes.add(lifetime);
+  return lifetime;
+}
+var activeLifetimes = /* @__PURE__ */ new Set();
+async function invalidateBrowserConsentLifetimes(current) {
+  await Promise.allSettled(
+    [...activeLifetimes].filter((lifetime) => lifetime.fingerprint !== current).map(async (lifetime) => {
+      await lifetime.revoke();
+      lifetime.dispose();
+    })
+  );
+}
+
+export {
+  WEB_CONNECT_TIMEOUT_MS,
+  WEB_CALL_TIMEOUT_MS,
+  WEB_STREAM_TIMEOUT_MS,
+  SERVER_PORT,
+  LOCAL_SERVER_ADDR,
+  HOSTED_MODE,
+  LOCAL_BROWSER_ENABLED,
+  LOCAL_COMPUTER_ENABLED,
+  LOCAL_HARNESS_ENABLED,
+  SCHEDULED_EVALS_WRITE_ENABLED,
+  WEBMCP_INSPECTOR_ENABLED,
+  webmcpInspectorHostedEnabled,
+  webmcpInspectorReachable,
+  hostedBrowserEnabled,
+  webmcpPageToolsMode,
+  EVAL_WIDGET_MODEL_CONTEXT,
+  CORS_ORIGINS,
+  ELICITATION_FORM_TTL_MS,
+  ELICITATION_URL_CONSENT_TTL_MS,
+  ELICITATION_POLL_INTERVAL_MS,
+  ELICITATION_POLL_JITTER_MS,
+  ELICITATION_POLL_MAX_FAILURES,
+  ELICITATION_SERVICE_ROUTE_TIMEOUT_MS,
+  ELICITATION_TIMEOUT_EXTENSION_MS,
+  MRTR_CONTINUATION_TTL_MS,
+  MRTR_CONTINUATION_ROUTE_TIMEOUT_MS,
+  MRTR_CONTINUATION_LEASE_TTL_MS,
+  MRTR_RESUME_STATE_MAX_BYTES,
+  MRTR_DISPLAY_FIELD_MAX_BYTES,
+  MRTR_RESPONSE_CONTENT_MAX_BYTES,
+  MRTR_TEARDOWN_TIMEOUT_MS,
+  MCPJAM_HOSTED_ORIGIN,
+  parseAllowedHosts,
+  ALLOWED_HOSTS,
+  CANIUSE_LANDING_HOSTS,
+  SCORE_LANDING_HOSTS,
+  SANDBOX_HOSTS,
+  resolveSandboxIsolation,
+  getInspectorFrontendUrl,
+  registerBrowserController,
+  createLocalBrowserSecurityPolicy,
+  secureDriverContext,
+  mintCapabilityToken,
+  capabilityFingerprint,
+  capabilityMatches,
+  persistCapabilityState,
+  createDeviceConsent,
+  BROWSER_CONSENT_HEADER,
+  grantLocalBrowserConsent,
+  verifyLocalBrowserConsent,
+  getBrowserConsentFingerprint,
+  verifyAndFingerprintBrowserConsent,
+  revokeLocalBrowserConsent,
+  createBrowserConsentLifetime,
+  invalidateBrowserConsentLifetimes
+};
+//# sourceMappingURL=chunk-RP4R2FQ5.js.map

package/dist/server/consent-lifetime-YBODZG23.js

@@ -0,0 +1,9 @@
+import {
+  createBrowserConsentLifetime,
+  invalidateBrowserConsentLifetimes
+} from "./chunk-RP4R2FQ5.js";
+export {
+  createBrowserConsentLifetime,
+  invalidateBrowserConsentLifetimes
+};
+//# sourceMappingURL=consent-lifetime-YBODZG23.js.map

package/dist/server/harness-install-cli.js

@@ -1,7 +1,7 @@
 import {
   installRuntimePack,
   readRuntimeInstallStatus
-} from "./chunk-BLGJ4PIK.js";
+} from "./chunk-IIQQS3FK.js";
 
 // server/harness-install-cli.ts
 async function harnessStatus() {