@mono-agent/agent-app 0.19.0 → 0.20.0

package/dist/mcp-apps.js

@@ -0,0 +1,1753 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants as fsConstants, fstatSync, lstatSync, openSync, realpathSync, renameSync, rmSync, writeSync, } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { CodedError, MCP_APP_RESOURCE_MIME_TYPE, MCP_APP_SUPPORTED_VERSIONS, } from "@mono-agent/agent-contracts";
+import { createReplyPartBudget, mergeReplyParts, } from "./reply-part-budget.js";
+import { DEFAULT_REPLY_ARTIFACT_STORAGE_MAX_BYTES, ReplyArtifactStorageFullError, replyArtifactStorageBudgetFor, } from "./reply-artifacts.js";
+const APP_ID = /^[0-9a-f]{8}-[0-9a-f-]{27,35}$/u;
+const MAX_HTML_BYTES = 2 * 1024 * 1024;
+const MAX_STATE_BYTES = 1024 * 1024;
+const MAX_BRIDGE_REQUEST_BYTES = 64 * 1024;
+const MAX_BRIDGE_RESULT_BYTES = 1024 * 1024;
+const MAX_MANIFEST_BYTES = 64 * 1024;
+const STATE_JSON_OVERHEAD_BYTES = Buffer.byteLength('{"toolInput":,"toolResult":}\n', "utf8");
+const MAX_STATE_VALUE_BYTES = Math.floor((MAX_STATE_BYTES - STATE_JSON_OVERHEAD_BYTES) / 2);
+const DEFAULT_RETENTION_DAYS = 30;
+const STAGING_NAMESPACE = ".staging";
+const DEFAULT_STAGING_GRACE_MS = 10 * 60 * 1000;
+const DEFAULT_MAX_RETAINED_CONNECTIONS = 8;
+const DEFAULT_CONNECTION_IDLE_MS = 10 * 60 * 1000;
+const DEFAULT_BRIDGE_RATE_LIMIT = 60;
+const DEFAULT_BRIDGE_RATE_WINDOW_MS = 60 * 1000;
+const DEFAULT_AUDIT_MAX_BYTES = 256 * 1024;
+const DEFAULT_AUDIT_RETAINED_FILES = 2;
+export const DEFAULT_MCP_APP_AUDIT_STORAGE_MAX_BYTES = 1024 * 1024;
+// Darwin's O_NOFOLLOW_ANY rejects symbolic links in every path component.
+// Node does not expose it, but openSync accepts the stable fcntl.h value.
+const DARWIN_O_NOFOLLOW_ANY = 0x20000000;
+const BIDI_CONTROL = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/gu;
+// Intentionally process-global: services sharing one root must share the same
+// append gate and exactly one initialization inventory. Disposing/re-creating a
+// service unregisters only its live/protected-owner predicate; clearing this
+// state would split serialization and repeat the bounded root inventory.
+const mcpAppAuditStorageStates = new Map();
+function mcpAppAuditStorageFor(root, options, beforeOperation, isOwnerProtected) {
+    const canonicalRoot = resolve(root);
+    const existing = mcpAppAuditStorageStates.get(canonicalRoot);
+    if (existing !== undefined
+        && (existing.maxBytes !== options.maxBytes
+            || existing.fileMaxBytes !== options.fileMaxBytes
+            || existing.retainedFiles !== options.retainedFiles
+            || existing.beforeOperation !== beforeOperation)) {
+        throw new RangeError("MCP App audit storage options must agree for one artifact root.");
+    }
+    const state = existing ?? {
+        root: canonicalRoot,
+        ...options,
+        beforeOperation,
+        owners: new Map(),
+        reservations: new Map(),
+        protectionPredicates: new Set(),
+        initialized: false,
+        gate: Promise.resolve(),
+    };
+    mcpAppAuditStorageStates.set(canonicalRoot, state);
+    state.protectionPredicates.add(isOwnerProtected);
+    let disposed = false;
+    return {
+        append: async (directory, line) => await runMcpAppAuditExclusive(state, async () => await appendMcpAppAudit(state, resolve(directory), line)),
+        reserveAppend: async (directory, line, reservedBytes) => {
+            if (!Number.isSafeInteger(reservedBytes) || reservedBytes < 0 || reservedBytes > state.fileMaxBytes) {
+                throw new RangeError("MCP App audit completion reservation is invalid.");
+            }
+            const canonicalDirectory = resolve(directory);
+            const token = Symbol("mcp-app-audit-completion");
+            await runMcpAppAuditExclusive(state, async () => {
+                await appendMcpAppAudit(state, canonicalDirectory, line, reservedBytes);
+                state.reservations.set(token, { directory: canonicalDirectory, bytes: reservedBytes });
+            });
+            let settled = false;
+            return {
+                append: async (completionLine) => {
+                    if (settled)
+                        throw new Error("MCP App audit completion reservation was already released.");
+                    settled = true;
+                    await runMcpAppAuditExclusive(state, async () => {
+                        const reservation = state.reservations.get(token);
+                        if (reservation === undefined) {
+                            throw new Error("MCP App audit completion reservation is unavailable.");
+                        }
+                        const incomingBytes = Buffer.byteLength(completionLine, "utf8");
+                        if (incomingBytes > reservation.bytes) {
+                            state.reservations.delete(token);
+                            throw new Error("MCP App audit completion exceeded its reserved bytes.");
+                        }
+                        state.reservations.delete(token);
+                        await appendMcpAppAudit(state, canonicalDirectory, completionLine);
+                    });
+                },
+                release: async () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    await runMcpAppAuditExclusive(state, async () => {
+                        state.reservations.delete(token);
+                    });
+                },
+            };
+        },
+        remove: async (directory) => await runMcpAppAuditExclusive(state, async () => {
+            const canonicalDirectory = resolve(directory);
+            assertMcpAppAuditDirectory(state, canonicalDirectory);
+            const tracked = state.owners.get(canonicalDirectory);
+            if (tracked?.poisoned === true) {
+                throw new Error("MCP App audit cleanup refused a poisoned owner.");
+            }
+            const initial = await lstat(canonicalDirectory);
+            if (!initial.isDirectory() || initial.isSymbolicLink()) {
+                throw new Error("MCP App audit cleanup refused an unsafe owner directory.");
+            }
+            const expectedIdentity = tracked?.identity ?? mcpAppAuditIdentity(initial);
+            if (!sameMcpAppAuditIdentity(mcpAppAuditIdentity(initial), expectedIdentity)) {
+                throw new Error("MCP App audit cleanup refused a replaced owner directory.");
+            }
+            await beforeMcpAppAuditOperation(state, "remove", canonicalDirectory);
+            const current = await lstat(canonicalDirectory);
+            if (!current.isDirectory()
+                || current.isSymbolicLink()
+                || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(current), expectedIdentity)) {
+                throw new Error("MCP App audit cleanup refused an unsafe owner directory.");
+            }
+            const opened = await openMcpAppAuditOwner(state, canonicalDirectory, expectedIdentity);
+            try {
+                assertOpenedMcpAppAuditOwnerSync(state, opened);
+                rmSync(mcpAppAuditChildPath(opened.root, basename(canonicalDirectory)), {
+                    recursive: true,
+                    force: true,
+                });
+                assertOpenedMcpAppAuditDirectorySync(state, opened.root);
+            }
+            finally {
+                await closeOpenedMcpAppAuditOwner(opened);
+            }
+            if (!state.initialized)
+                return;
+            replaceMcpAppAuditOwner(state, canonicalDirectory, undefined);
+        }),
+        dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
+            state.protectionPredicates.delete(isOwnerProtected);
+        },
+    };
+}
+/** Durable MCP Apps registry with live handles scoped to exact MCP connections. */
+export function createMcpAppService(options) {
+    const root = resolve(options.artifactDir, "mcp-apps");
+    const stagingRoot = join(root, STAGING_NAMESPACE);
+    const retentionDays = options.retentionDays ?? DEFAULT_RETENTION_DAYS;
+    const stagingGraceMs = options.stagingGraceMs ?? DEFAULT_STAGING_GRACE_MS;
+    const maxRetainedConnections = options.maxRetainedConnections ?? DEFAULT_MAX_RETAINED_CONNECTIONS;
+    const connectionIdleMs = options.connectionIdleMs ?? DEFAULT_CONNECTION_IDLE_MS;
+    const bridgeRateLimit = options.bridgeRateLimit ?? DEFAULT_BRIDGE_RATE_LIMIT;
+    const bridgeRateWindowMs = options.bridgeRateWindowMs ?? DEFAULT_BRIDGE_RATE_WINDOW_MS;
+    const auditMaxBytes = options.auditMaxBytes ?? DEFAULT_AUDIT_MAX_BYTES;
+    const auditRetainedFiles = options.auditRetainedFiles ?? DEFAULT_AUDIT_RETAINED_FILES;
+    const auditStorageMaxBytes = options.auditStorageMaxBytes ?? DEFAULT_MCP_APP_AUDIT_STORAGE_MAX_BYTES;
+    const now = options.now ?? (() => new Date());
+    const budget = options.replyPartBudget ?? createReplyPartBudget();
+    const partsByRun = new Map();
+    const partsByIdentityByRun = new Map();
+    const invocationIdsByRun = new Map();
+    const invocationProtectionsByRun = new Map();
+    const liveByInvocation = new Map();
+    const connections = new Map();
+    const auditProtectionCounts = new Map();
+    const responseContext = new AsyncLocalStorage();
+    const runOwners = new Map();
+    const bridgeRates = new Map();
+    const auditQueues = new Map();
+    const pendingAuditCompletions = new Set();
+    let idleTimer;
+    if (!Number.isFinite(retentionDays) || retentionDays <= 0) {
+        throw new RangeError("MCP App retentionDays must be positive.");
+    }
+    for (const [name, value] of [
+        ["stagingGraceMs", stagingGraceMs],
+        ["maxRetainedConnections", maxRetainedConnections],
+        ["connectionIdleMs", connectionIdleMs],
+        ["bridgeRateLimit", bridgeRateLimit],
+        ["bridgeRateWindowMs", bridgeRateWindowMs],
+        ["auditRetainedFiles", auditRetainedFiles],
+        ["auditStorageMaxBytes", auditStorageMaxBytes],
+    ]) {
+        if (!Number.isSafeInteger(value) || value < 1) {
+            throw new RangeError(`MCP App ${name} must be a positive safe integer.`);
+        }
+    }
+    if (!Number.isSafeInteger(auditMaxBytes) || auditMaxBytes < 1_024) {
+        throw new RangeError("MCP App auditMaxBytes must be a safe integer of at least 1024.");
+    }
+    if (auditMaxBytes > Math.floor(auditStorageMaxBytes / (auditRetainedFiles + 1))) {
+        throw new RangeError("MCP App auditStorageMaxBytes must hold the active audit file and every retained rotation.");
+    }
+    if (auditStorageMaxBytes >= DEFAULT_REPLY_ARTIFACT_STORAGE_MAX_BYTES) {
+        throw new RangeError("MCP App auditStorageMaxBytes must be smaller than the aggregate storage ceiling.");
+    }
+    const contentStorageMaxBytes = DEFAULT_REPLY_ARTIFACT_STORAGE_MAX_BYTES - auditStorageMaxBytes;
+    const storage = options.storageBudget
+        ?? replyArtifactStorageBudgetFor(options.artifactDir, contentStorageMaxBytes);
+    if (storage.maxBytes > contentStorageMaxBytes) {
+        throw new RangeError("MCP App content and audit storage budgets must fit the aggregate storage ceiling.");
+    }
+    const auditStorage = mcpAppAuditStorageFor(root, {
+        maxBytes: auditStorageMaxBytes,
+        fileMaxBytes: auditMaxBytes,
+        retainedFiles: auditRetainedFiles,
+    }, options.beforeAuditStorageOperation, (directory) => {
+        const invocationId = basename(directory);
+        if (liveByInvocation.has(invocationId) || auditProtectionCounts.has(invocationId))
+            return true;
+        for (const protections of invocationProtectionsByRun.values()) {
+            if (protections.has(invocationId))
+                return true;
+        }
+        return false;
+    });
+    const createExtension = async ({ request, runId }) => {
+        await mkdir(stagingRoot, { recursive: true, mode: 0o700 });
+        const owner = responseContext.getStore();
+        owner?.runIds.add(runId);
+        runOwners.set(runId, owner);
+        await cleanupExpired().catch(() => undefined);
+        const host = {
+            protocolVersions: MCP_APP_SUPPORTED_VERSIONS,
+            mimeTypes: [MCP_APP_RESOURCE_MIME_TYPE],
+            register: async (registration) => await register(runId, request.conversationId, registration),
+            recordFailure: async (failure) => recordFailure(runId, failure),
+        };
+        return {
+            runtimeOptions: { mcpApps: host },
+            cleanup: async () => { },
+            settleCleanup: async () => {
+                if (runOwners.get(runId) === undefined)
+                    await discardRun(runId);
+            },
+        };
+    };
+    async function register(runId, conversationId, registration) {
+        const fail = (message) => {
+            const part = recordFailure(runId, {
+                serverName: registration.serverName,
+                toolName: registration.toolName,
+                toolCallId: registration.toolCallId,
+                code: "app_resource_invalid",
+                message,
+            });
+            return { part, retainConnection: false };
+        };
+        if (!isSupportedProtocolVersion(registration.protocolVersion)
+            || registration.connection.connectionId.length === 0
+            || !registration.resourceUri.startsWith("ui://")) {
+            return fail("The MCP App registration is incompatible with this host.");
+        }
+        const resource = appResource(registration.resource, registration.resourceUri);
+        if (resource === undefined)
+            return fail("The MCP App resource is invalid or oversized.");
+        const identity = stableAppIdentity(registration);
+        const claim = budget.claim(runId, identity);
+        if (claim === "limit")
+            return { part: capacityFailure(runId), retainConnection: false };
+        if (claim === "duplicate") {
+            const existing = partsByIdentityByRun.get(runId)?.get(identity);
+            return {
+                part: existing?.type === "mcp_app" ? existing : capacityFailure(runId),
+                retainConnection: false,
+            };
+        }
+        const invocationId = randomUUID();
+        const createdAt = now();
+        const manifest = {
+            schema: 1,
+            invocationId,
+            connectionId: registration.connection.connectionId,
+            runId,
+            conversationId,
+            serverName: registration.serverName,
+            toolName: registration.toolName,
+            toolCallId: registration.toolCallId,
+            resourceUri: registration.resourceUri,
+            protocolVersion: registration.protocolVersion,
+            mediaType: MCP_APP_RESOURCE_MIME_TYPE,
+            ...(registration.title === undefined ? {} : { title: boundedText(registration.title, 240) }),
+            ...(registration.description === undefined ? {} : { description: boundedText(registration.description, 1_000) }),
+            appVisibleTools: [...new Set(registration.appVisibleTools.filter(safeToolName))].slice(0, 256),
+            appVisibleResources: [registration.resourceUri],
+            ...(resource.metadata === undefined ? {} : { resourceMetadata: resource.metadata }),
+            createdAt: createdAt.toISOString(),
+            expiresAt: new Date(createdAt.getTime() + retentionDays * 86_400_000).toISOString(),
+        };
+        const state = {
+            toolInput: boundedJsonValue(registration.toolInput, MAX_STATE_VALUE_BYTES),
+            toolResult: boundedJsonValue(registration.toolResult, MAX_STATE_VALUE_BYTES),
+        };
+        const storageProtection = await storage.protect("mcp-apps", invocationId);
+        let persisted = false;
+        try {
+            await writeAppAtomically(root, stagingRoot, manifest, resource.html, state, storage, options.beforePublicationCommit);
+            persisted = true;
+        }
+        catch (error) {
+            budget.unclaim(runId, identity);
+            return fail(error instanceof ReplyArtifactStorageFullError
+                ? "Reply artifact storage is full; this MCP App was not retained."
+                : "The MCP App resource could not be persisted safely.");
+        }
+        finally {
+            if (!persisted)
+                await storageProtection.release();
+        }
+        const part = partFromManifest(manifest);
+        acceptClaimedPart(runId, identity, part);
+        const invocationIds = invocationIdsByRun.get(runId) ?? new Set();
+        invocationIds.add(invocationId);
+        invocationIdsByRun.set(runId, invocationIds);
+        const protections = invocationProtectionsByRun.get(runId)
+            ?? new Map();
+        protections.set(invocationId, storageProtection);
+        invocationProtectionsByRun.set(runId, protections);
+        liveByInvocation.set(invocationId, {
+            connectionId: registration.connection.connectionId,
+            appVisibleTools: new Set(manifest.appVisibleTools),
+            appVisibleResources: new Set(manifest.appVisibleResources),
+        });
+        await retainConnection(invocationId, registration.connection);
+        return { part, retainConnection: true };
+    }
+    function capacityFailure(runId) {
+        return {
+            type: "failure",
+            id: stablePartId("mcp-app-limit", runId),
+            code: "app_capability_mismatch",
+            message: "This reply already reached the maximum number of rich parts.",
+        };
+    }
+    function recordFailure(runId, input) {
+        const identity = `mcp-app-failure:${stableDigest(input)}`;
+        const part = {
+            type: "failure",
+            id: stablePartId(`mcp-app-${safeIdSegment(input.toolCallId)}`, identity),
+            code: input.code,
+            message: boundedText(input.message, 1_000),
+        };
+        const claim = budget.claim(runId, identity);
+        if (claim === "limit")
+            return capacityFailure(runId);
+        if (claim === "duplicate") {
+            const existing = partsByIdentityByRun.get(runId)?.get(identity);
+            return existing?.type === "failure" ? existing : capacityFailure(runId);
+        }
+        acceptClaimedPart(runId, identity, part);
+        return part;
+    }
+    function acceptClaimedPart(runId, identity, part) {
+        const current = partsByRun.get(runId) ?? [];
+        const byIdentity = partsByIdentityByRun.get(runId) ?? new Map();
+        current.push(part);
+        byIdentity.set(identity, part);
+        partsByRun.set(runId, current);
+        partsByIdentityByRun.set(runId, byIdentity);
+    }
+    function protectAuditInvocation(invocationId) {
+        auditProtectionCounts.set(invocationId, (auditProtectionCounts.get(invocationId) ?? 0) + 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const count = auditProtectionCounts.get(invocationId) ?? 0;
+            if (count <= 1)
+                auditProtectionCounts.delete(invocationId);
+            else
+                auditProtectionCounts.set(invocationId, count - 1);
+        };
+    }
+    async function load(request) {
+        const releaseAuditProtection = protectAuditInvocation(request.invocationId);
+        let protection;
+        try {
+            protection = await storage.protect("mcp-apps", request.invocationId);
+            await evictIdleConnections();
+            const manifest = await readManifest(root, request.invocationId);
+            authorizeApp(manifest, request);
+            if (Date.parse(manifest.expiresAt) <= now().getTime()) {
+                throw new CodedError("app_expired", "The MCP App has expired.");
+            }
+            const directory = join(root, manifest.invocationId);
+            const [html, state] = await Promise.all([
+                readBoundedText(join(directory, "resource.html"), MAX_HTML_BYTES),
+                readBoundedJson(join(directory, "state.json"), MAX_STATE_BYTES),
+            ]);
+            const live = liveByInvocation.get(manifest.invocationId);
+            const retained = live === undefined ? undefined : connections.get(live.connectionId);
+            const connected = retained?.connection.connectionId === manifest.connectionId;
+            if (connected)
+                touchConnection(manifest.connectionId);
+            return {
+                app: partFromManifest(manifest),
+                html,
+                toolInput: state.toolInput,
+                toolResult: state.toolResult,
+                ...(manifest.resourceMetadata === undefined ? {} : { resourceMetadata: manifest.resourceMetadata }),
+                connected,
+            };
+        }
+        finally {
+            await protection?.release();
+            releaseAuditProtection();
+        }
+    }
+    async function request(input) {
+        const releaseAuditProtection = protectAuditInvocation(input.invocationId);
+        let protection;
+        try {
+            protection = await storage.protect("mcp-apps", input.invocationId);
+            await evictIdleConnections();
+            const manifest = await readManifest(root, input.invocationId);
+            authorizeApp(manifest, input);
+            if (Date.parse(manifest.expiresAt) <= now().getTime()) {
+                throw new CodedError("app_expired", "The MCP App has expired.");
+            }
+            if (serializedBytes(input.params) > MAX_BRIDGE_REQUEST_BYTES) {
+                throw new CodedError("app_request_too_large", "The MCP App bridge request is too large.");
+            }
+            const live = liveByInvocation.get(manifest.invocationId);
+            const retained = live === undefined ? undefined : connections.get(live.connectionId);
+            if (live === undefined
+                || retained === undefined
+                || retained.connection.connectionId !== manifest.connectionId) {
+                throw new CodedError("app_connection_closed", "The originating MCP connection is no longer available.");
+            }
+            consumeBridgeRate(manifest.connectionId);
+            touchConnection(manifest.connectionId);
+            if (input.method === "tools/call") {
+                requireConfirmation(input);
+                const params = record(input.params);
+                const name = typeof params?.name === "string" ? params.name : undefined;
+                if (name === undefined || !live.appVisibleTools.has(name)) {
+                    throw new CodedError("app_tool_forbidden", "The MCP App requested a tool that is not visible to apps.");
+                }
+                const completionAudit = await reserveAuditCompletion(manifest, input.method);
+                let result;
+                try {
+                    result = await retained.connection.callTool(name, params?.arguments ?? {});
+                }
+                catch {
+                    await completionAudit.release().catch(() => undefined);
+                    await closeConnection(manifest.connectionId);
+                    throw new CodedError("app_connection_closed", "The originating MCP connection closed during the tool call.");
+                }
+                touchConnection(manifest.connectionId);
+                try {
+                    await completionAudit.complete();
+                }
+                catch {
+                    throw new CodedError("app_audit_incomplete", "The MCP App tool ran, but completion could not be recorded safely; do not retry automatically.");
+                }
+                return boundedJsonValue(result, MAX_BRIDGE_RESULT_BYTES);
+            }
+            if (input.method === "resources/read") {
+                const params = record(input.params);
+                const uri = typeof params?.uri === "string" ? params.uri : undefined;
+                if (uri === undefined || Buffer.byteLength(uri, "utf8") > 4_096) {
+                    throw new CodedError("app_resource_invalid", "The MCP App requested an invalid resource URI.");
+                }
+                if (!live.appVisibleResources.has(uri)) {
+                    throw new CodedError("app_resource_forbidden", "The MCP App requested a resource that was not declared for this app invocation.");
+                }
+                await appendAudit(manifest, input.method, "requested");
+                try {
+                    const result = await retained.connection.readResource(uri);
+                    touchConnection(manifest.connectionId);
+                    return boundedJsonValue(result, MAX_BRIDGE_RESULT_BYTES);
+                }
+                catch {
+                    await closeConnection(manifest.connectionId);
+                    throw new CodedError("app_connection_closed", "The originating MCP connection closed during resource access.");
+                }
+            }
+            if (input.method === "ui/open-link") {
+                requireConfirmation(input);
+                const params = record(input.params);
+                const url = typeof params?.url === "string" ? safeExternalUrl(params.url) : undefined;
+                if (url === undefined)
+                    throw new CodedError("app_open_link_forbidden", "Only HTTP(S) links can be opened.");
+                await appendAudit(manifest, input.method, "confirmed");
+                return { allowed: true, url };
+            }
+            requireConfirmation(input);
+            await appendAudit(manifest, input.method, "rejected");
+            return {
+                accepted: false,
+                reason: "Model-context updates require a new user-authorized turn and are not applied to a completed run.",
+            };
+        }
+        finally {
+            await protection?.release();
+            releaseAuditProtection();
+        }
+    }
+    async function cleanupExpired() {
+        await storage.runExclusive(async (isProtected) => {
+            let entries;
+            try {
+                entries = await readdir(root);
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return;
+                throw error;
+            }
+            const cutoff = now().getTime();
+            for (const entry of entries.filter((value) => APP_ID.test(value))) {
+                if (isProtected("mcp-apps", entry))
+                    continue;
+                try {
+                    const manifest = await readManifest(root, entry);
+                    if (Date.parse(manifest.expiresAt) > cutoff)
+                        continue;
+                }
+                catch { }
+                await dropInvocation(entry);
+                await auditStorage.remove(join(root, entry)).catch(() => undefined);
+            }
+            await cleanupStaging(stagingRoot, cutoff - stagingGraceMs, (id) => isProtected("mcp-apps", id));
+        });
+        await evictIdleConnections();
+    }
+    async function closeConnection(connectionId) {
+        const retained = connections.get(connectionId);
+        connections.delete(connectionId);
+        bridgeRates.delete(connectionId);
+        for (const [invocationId, live] of liveByInvocation) {
+            if (live.connectionId === connectionId)
+                liveByInvocation.delete(invocationId);
+        }
+        await retained?.connection.close().catch(() => undefined);
+        scheduleIdleEviction();
+    }
+    async function dropInvocation(invocationId) {
+        const live = liveByInvocation.get(invocationId);
+        liveByInvocation.delete(invocationId);
+        auditQueues.delete(invocationId);
+        if (live === undefined)
+            return;
+        const retained = connections.get(live.connectionId);
+        retained?.invocationIds.delete(invocationId);
+        if (retained?.invocationIds.size === 0)
+            await closeConnection(live.connectionId);
+    }
+    async function retainConnection(invocationId, connection) {
+        await evictIdleConnections();
+        const retained = connections.get(connection.connectionId) ?? {
+            connection,
+            invocationIds: new Set(),
+            lastUsedAtMs: now().getTime(),
+        };
+        retained.invocationIds.add(invocationId);
+        retained.lastUsedAtMs = now().getTime();
+        connections.delete(connection.connectionId);
+        connections.set(connection.connectionId, retained);
+        while (connections.size > maxRetainedConnections) {
+            const oldest = connections.keys().next().value;
+            if (oldest === undefined)
+                break;
+            await closeConnection(oldest);
+        }
+        scheduleIdleEviction();
+    }
+    function touchConnection(connectionId) {
+        const retained = connections.get(connectionId);
+        if (retained === undefined)
+            return;
+        retained.lastUsedAtMs = now().getTime();
+        connections.delete(connectionId);
+        connections.set(connectionId, retained);
+        scheduleIdleEviction();
+    }
+    async function evictIdleConnections() {
+        const cutoff = now().getTime() - connectionIdleMs;
+        const idle = [...connections]
+            .filter(([, retained]) => retained.lastUsedAtMs <= cutoff)
+            .map(([connectionId]) => connectionId);
+        await Promise.allSettled(idle.map(async (connectionId) => await closeConnection(connectionId)));
+        scheduleIdleEviction();
+    }
+    function scheduleIdleEviction() {
+        if (idleTimer !== undefined)
+            clearTimeout(idleTimer);
+        idleTimer = undefined;
+        if (connections.size === 0)
+            return;
+        const nextExpiry = Math.min(...[...connections.values()]
+            .map((retained) => retained.lastUsedAtMs + connectionIdleMs));
+        const delay = Math.max(1, Math.min(2_147_483_647, nextExpiry - now().getTime()));
+        idleTimer = setTimeout(() => {
+            idleTimer = undefined;
+            void evictIdleConnections();
+        }, delay);
+        idleTimer.unref?.();
+    }
+    function consumeBridgeRate(connectionId) {
+        const at = now().getTime();
+        const current = bridgeRates.get(connectionId);
+        const bucket = current === undefined || at - current.startedAtMs >= bridgeRateWindowMs
+            ? { startedAtMs: at, count: 0 }
+            : current;
+        if (bucket.count >= bridgeRateLimit) {
+            throw new CodedError("app_rate_limited", "The MCP App bridge request rate limit was exceeded.");
+        }
+        bucket.count += 1;
+        bridgeRates.set(connectionId, bucket);
+    }
+    async function appendAudit(manifest, method, phase) {
+        const line = mcpAppAuditLine(manifest, method, phase);
+        await enqueueAudit(manifest.invocationId, async () => {
+            await auditStorage.append(join(root, manifest.invocationId), line);
+        });
+    }
+    async function reserveAuditCompletion(manifest, method) {
+        const confirmedLine = mcpAppAuditLine(manifest, method, "confirmed");
+        const completionBytes = Buffer.byteLength(mcpAppAuditLine(manifest, method, "completed"), "utf8");
+        const storageReservation = await enqueueAudit(manifest.invocationId, async () => (await auditStorage.reserveAppend(join(root, manifest.invocationId), confirmedLine, completionBytes)));
+        let settled = false;
+        let reservation;
+        reservation = {
+            complete: async () => {
+                if (settled)
+                    throw new Error("MCP App audit completion was already settled.");
+                settled = true;
+                try {
+                    const line = mcpAppAuditLine(manifest, method, "completed");
+                    await enqueueAudit(manifest.invocationId, async () => await storageReservation.append(line));
+                }
+                catch (error) {
+                    await storageReservation.release().catch(() => undefined);
+                    throw error;
+                }
+                finally {
+                    pendingAuditCompletions.delete(reservation);
+                }
+            },
+            release: async () => {
+                if (settled)
+                    return;
+                settled = true;
+                try {
+                    await storageReservation.release();
+                }
+                finally {
+                    pendingAuditCompletions.delete(reservation);
+                }
+            },
+        };
+        pendingAuditCompletions.add(reservation);
+        return reservation;
+    }
+    function mcpAppAuditLine(manifest, method, phase) {
+        const line = `${JSON.stringify({
+            at: now().toISOString(),
+            invocationId: manifest.invocationId,
+            connectionId: manifest.connectionId,
+            method,
+            details: { phase },
+        })}\n`;
+        if (Buffer.byteLength(line, "utf8") > auditMaxBytes) {
+            throw new Error("MCP App audit entry exceeded its configured file ceiling.");
+        }
+        return line;
+    }
+    async function enqueueAudit(invocationId, operation) {
+        const previous = auditQueues.get(invocationId) ?? Promise.resolve();
+        let result;
+        const next = previous.catch(() => undefined).then(async () => {
+            result = await operation();
+        });
+        auditQueues.set(invocationId, next);
+        try {
+            await next;
+            return result;
+        }
+        catch {
+            throw new CodedError("app_audit_failed", "The MCP App action could not be recorded safely.");
+        }
+        finally {
+            if (auditQueues.get(invocationId) === next)
+                auditQueues.delete(invocationId);
+        }
+    }
+    async function dispose() {
+        if (idleTimer !== undefined)
+            clearTimeout(idleTimer);
+        idleTimer = undefined;
+        await Promise.allSettled([...pendingAuditCompletions].map(async (reservation) => {
+            await reservation.release();
+        }));
+        await Promise.allSettled([...connections.keys()].map(async (id) => await closeConnection(id)));
+        await Promise.allSettled([...invocationProtectionsByRun.values()].flatMap((protections) => ([...protections.values()].map(async (protection) => await protection.release()))));
+        liveByInvocation.clear();
+        partsByRun.clear();
+        partsByIdentityByRun.clear();
+        invocationIdsByRun.clear();
+        invocationProtectionsByRun.clear();
+        auditProtectionCounts.clear();
+        runOwners.clear();
+        bridgeRates.clear();
+        auditQueues.clear();
+        pendingAuditCompletions.clear();
+        auditStorage.dispose();
+    }
+    function wrapResponder(responder) {
+        const originalDispose = responder.dispose;
+        return {
+            ...responder,
+            async respond(request, stream) {
+                const context = { runIds: new Set() };
+                let retainedRunId;
+                try {
+                    const response = await responseContext.run(context, async () => await responder.respond(request, stream));
+                    const runId = typeof response.metadata?.runId === "string" ? response.metadata.runId : undefined;
+                    if (runId === undefined || (context.runIds.size > 0 && !context.runIds.has(runId)))
+                        return response;
+                    const parts = partsByRun.get(runId) ?? [];
+                    if (parts.length === 0) {
+                        await retainRun(runId);
+                        retainedRunId = runId;
+                        return response;
+                    }
+                    const finalized = await finalizeDeliveryParts(runId, parts, request.conversationId);
+                    const merged = mergeReplyParts(response.parts, finalized);
+                    await retainRun(runId);
+                    retainedRunId = runId;
+                    return { ...response, parts: merged };
+                }
+                finally {
+                    await Promise.all([...context.runIds]
+                        .filter((runId) => runId !== retainedRunId)
+                        .map(async (runId) => await discardRun(runId)));
+                }
+            },
+            loadMcpApp: load,
+            requestMcpApp: request,
+            ...(responder.openReplyArtifact === undefined
+                ? {}
+                : { openReplyArtifact: responder.openReplyArtifact.bind(responder) }),
+            async dispose() {
+                await Promise.allSettled([
+                    ...(originalDispose === undefined ? [] : [originalDispose.call(responder)]),
+                    dispose(),
+                ]);
+            },
+        };
+    }
+    async function retainRun(runId) {
+        const protections = [...(invocationProtectionsByRun.get(runId)?.values() ?? [])];
+        partsByRun.delete(runId);
+        partsByIdentityByRun.delete(runId);
+        invocationIdsByRun.delete(runId);
+        invocationProtectionsByRun.delete(runId);
+        runOwners.delete(runId);
+        budget.release(runId);
+        await Promise.all(protections.map(async (protection) => await protection.release()));
+    }
+    async function finalizeDeliveryParts(runId, parts, conversationId) {
+        const finalized = [];
+        for (const part of parts) {
+            if (part.type !== "mcp_app") {
+                finalized.push(part);
+                continue;
+            }
+            const protection = await storage.protect("mcp-apps", part.invocationId);
+            try {
+                await bindDeliveryConversation(root, part, conversationId, storage);
+                finalized.push(part);
+            }
+            catch {
+                const failure = replaceAppWithDeliveryFailure(runId, part);
+                invocationIdsByRun.get(runId)?.delete(part.invocationId);
+                await dropInvocation(part.invocationId);
+                await auditStorage.remove(join(root, part.invocationId)).catch(() => undefined);
+                finalized.push(failure);
+            }
+            finally {
+                await protection.release();
+            }
+        }
+        return finalized;
+    }
+    function replaceAppWithDeliveryFailure(runId, part) {
+        const failureIdentity = `mcp-app-delivery-failure:${part.invocationId}`;
+        const failure = {
+            type: "failure",
+            id: stablePartId("mcp-app-delivery-failure", failureIdentity),
+            code: "app_resource_invalid",
+            message: "The MCP App could not be finalized for delivery.",
+            relatedPartId: part.id,
+        };
+        const byIdentity = partsByIdentityByRun.get(runId) ?? new Map();
+        const oldIdentity = [...byIdentity].find(([, current]) => current === part)?.[0];
+        if (oldIdentity !== undefined) {
+            byIdentity.delete(oldIdentity);
+            budget.unclaim(runId, oldIdentity);
+        }
+        if (budget.claim(runId, failureIdentity) === "accepted")
+            byIdentity.set(failureIdentity, failure);
+        const current = partsByRun.get(runId) ?? [];
+        const index = current.indexOf(part);
+        if (index >= 0)
+            current[index] = failure;
+        partsByRun.set(runId, current);
+        partsByIdentityByRun.set(runId, byIdentity);
+        return failure;
+    }
+    async function discardRun(runId) {
+        const invocationIds = [...(invocationIdsByRun.get(runId) ?? [])];
+        await retainRun(runId);
+        await Promise.all(invocationIds.map(async (invocationId) => {
+            await dropInvocation(invocationId);
+            await auditStorage.remove(join(root, invocationId)).catch(() => undefined);
+        }));
+    }
+    return { createExtension, wrapResponder, load, request, cleanupExpired, dispose };
+}
+function appResource(value, expectedUri) {
+    const resource = record(value);
+    if (resource?.uri !== expectedUri
+        || resource.mimeType !== MCP_APP_RESOURCE_MIME_TYPE
+        || typeof resource.text !== "string"
+        || Buffer.byteLength(resource.text, "utf8") > MAX_HTML_BYTES)
+        return undefined;
+    const metadata = record(resource._meta);
+    return {
+        html: resource.text,
+        ...(metadata === undefined ? {} : { metadata: boundedJsonValue(metadata, 32 * 1024) }),
+    };
+}
+async function writeAppAtomically(root, stagingRoot, manifest, html, state, storage, beforeCommit) {
+    const directory = join(root, manifest.invocationId);
+    const stagingDirectory = join(stagingRoot, manifest.invocationId);
+    const stateJson = serializeBoundedJsonLine(state, MAX_STATE_BYTES);
+    const manifestJson = serializeBoundedJsonLine(manifest, MAX_MANIFEST_BYTES);
+    const reservation = await storage.reserve(Buffer.byteLength(html, "utf8")
+        + Buffer.byteLength(stateJson, "utf8")
+        + Buffer.byteLength(manifestJson, "utf8"));
+    if (reservation === undefined)
+        throw new ReplyArtifactStorageFullError();
+    try {
+        await mkdir(stagingRoot, { recursive: true, mode: 0o700 });
+        await mkdir(stagingDirectory, { mode: 0o700 });
+        let complete = false;
+        try {
+            await writeFile(join(stagingDirectory, "resource.html"), html, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            await writeFile(join(stagingDirectory, "state.json"), stateJson, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            await writeFile(join(stagingDirectory, "manifest.json"), manifestJson, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            await beforeCommit?.();
+            await rename(stagingDirectory, directory);
+            complete = true;
+        }
+        finally {
+            if (!complete)
+                await rm(stagingDirectory, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+    finally {
+        await reservation.release();
+    }
+}
+async function readManifest(root, invocationId) {
+    if (!APP_ID.test(invocationId))
+        throw new CodedError("app_missing", "The MCP App reference is invalid.");
+    let value;
+    try {
+        value = await readBoundedJson(join(root, invocationId, "manifest.json"), MAX_MANIFEST_BYTES);
+    }
+    catch {
+        throw new CodedError("app_missing", "The MCP App is unavailable.");
+    }
+    if (!isManifest(value) || value.invocationId !== invocationId) {
+        throw new CodedError("app_missing", "The MCP App metadata is invalid.");
+    }
+    return value;
+}
+function isManifest(value) {
+    const manifest = record(value);
+    return manifest?.schema === 1
+        && typeof manifest.invocationId === "string"
+        && typeof manifest.connectionId === "string"
+        && typeof manifest.runId === "string"
+        && typeof manifest.conversationId === "string"
+        && (manifest.deliveryConversationId === undefined || typeof manifest.deliveryConversationId === "string")
+        && typeof manifest.serverName === "string"
+        && typeof manifest.toolName === "string"
+        && typeof manifest.toolCallId === "string"
+        && typeof manifest.resourceUri === "string"
+        && isSupportedProtocolVersion(manifest.protocolVersion)
+        && manifest.mediaType === MCP_APP_RESOURCE_MIME_TYPE
+        && Array.isArray(manifest.appVisibleTools)
+        && manifest.appVisibleTools.every(safeToolName)
+        && Array.isArray(manifest.appVisibleResources)
+        && manifest.appVisibleResources.length > 0
+        && manifest.appVisibleResources.every((uri) => typeof uri === "string" && uri.startsWith("ui://"))
+        && typeof manifest.createdAt === "string"
+        && Number.isFinite(Date.parse(manifest.createdAt))
+        && typeof manifest.expiresAt === "string"
+        && Number.isFinite(Date.parse(manifest.expiresAt));
+}
+function partFromManifest(manifest) {
+    return {
+        type: "mcp_app",
+        id: manifest.invocationId,
+        invocationId: manifest.invocationId,
+        connectionId: manifest.connectionId,
+        serverName: manifest.serverName,
+        toolName: manifest.toolName,
+        resourceUri: manifest.resourceUri,
+        mediaType: manifest.mediaType,
+        protocolVersion: manifest.protocolVersion,
+        ...(manifest.title === undefined ? {} : { title: manifest.title }),
+        ...(manifest.description === undefined ? {} : { description: manifest.description }),
+        expiresAt: manifest.expiresAt,
+    };
+}
+function authorizeApp(manifest, request) {
+    if (request.connectionId !== manifest.connectionId
+        || (request.conversationId !== manifest.conversationId
+            && request.conversationId !== manifest.deliveryConversationId)) {
+        throw new CodedError("app_forbidden", "The MCP App does not belong to this conversation or connection.");
+    }
+}
+async function bindDeliveryConversation(root, part, conversationId, storage) {
+    const manifest = await readManifest(root, part.invocationId);
+    if (manifest.deliveryConversationId === conversationId)
+        return;
+    const directory = join(root, manifest.invocationId);
+    const temp = join(directory, `manifest.${randomUUID()}.partial`);
+    const manifestJson = serializeBoundedJsonLine({ ...manifest, deliveryConversationId: conversationId }, MAX_MANIFEST_BYTES);
+    const reservation = await storage.reserve(Buffer.byteLength(manifestJson, "utf8"));
+    if (reservation === undefined)
+        throw new ReplyArtifactStorageFullError();
+    let committed = false;
+    try {
+        await writeFile(temp, manifestJson, {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "wx",
+        });
+        await rename(temp, join(directory, "manifest.json"));
+        committed = true;
+    }
+    finally {
+        if (!committed)
+            await rm(temp, { force: true }).catch(() => undefined);
+        await reservation.release();
+    }
+}
+function requireConfirmation(input) {
+    if (input.confirmed !== true)
+        throw new CodedError("app_confirmation_required", "This MCP App action requires confirmation.");
+}
+function safeExternalUrl(input) {
+    if (Buffer.byteLength(input, "utf8") > 8_192)
+        return undefined;
+    try {
+        const url = new URL(input);
+        return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeToolName(value) {
+    return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,255}$/u.test(value);
+}
+function stableAppIdentity(registration) {
+    return `mcp_app:${stableDigest({
+        serverName: registration.serverName,
+        toolName: registration.toolName,
+        toolCallId: registration.toolCallId,
+        resourceUri: registration.resourceUri,
+    })}`;
+}
+function stableDigest(value) {
+    return createHash("sha256").update(JSON.stringify(value) ?? "null").digest("hex");
+}
+function safeIdSegment(value) {
+    return value.replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 80) || "failure";
+}
+function stablePartId(prefix, identity) {
+    return `${prefix.slice(0, 120)}-${stableDigest(identity).slice(0, 24)}`;
+}
+async function cleanupStaging(stagingRoot, staleBeforeMs, isProtected) {
+    let entries;
+    try {
+        entries = await readdir(stagingRoot);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    await Promise.all(entries.filter((entry) => APP_ID.test(entry) && !isProtected(entry)).map(async (entry) => {
+        const path = join(stagingRoot, entry);
+        try {
+            const entryStat = await lstat(path);
+            if (entryStat.mtimeMs > staleBeforeMs)
+                return;
+            await rm(path, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }));
+}
+async function appendMcpAppAudit(state, directory, line, additionalReservedBytes = 0) {
+    assertMcpAppAuditDirectory(state, directory);
+    const incomingBytes = Buffer.byteLength(line, "utf8");
+    if (incomingBytes > state.fileMaxBytes) {
+        throw new Error("MCP App audit entry exceeded its file ceiling.");
+    }
+    await initializeMcpAppAuditStorage(state, directory);
+    let owner = await reconcileTargetMcpAppAuditOwner(state, directory);
+    // Foreign poisoned owners retain their bounded reservation for this process.
+    // Only a fresh service process may inventory their filesystem paths again.
+    const currentBytes = owner.files.get(0)?.size ?? 0;
+    const rotates = currentBytes > 0 && currentBytes > state.fileMaxBytes - incomingBytes;
+    const releasedFile = rotates ? owner.files.get(state.retainedFiles) : undefined;
+    await admitMcpAppAuditAppend(state, directory, releasedFile, incomingBytes, additionalReservedBytes);
+    if (rotates)
+        await rotateTrackedMcpAppAuditFiles(state, directory);
+    owner = state.owners.get(directory) ?? emptyMcpAppAuditOwner(directory);
+    if (owner.identity === undefined) {
+        throw new Error("MCP App audit owner identity is unavailable.");
+    }
+    const active = owner.files.get(0);
+    const expectedBytes = active?.size ?? 0;
+    let committed;
+    try {
+        committed = await appendMcpAppAuditLine(state, owner, join(directory, "audit.jsonl"), line, expectedBytes, active);
+    }
+    catch (error) {
+        quarantineMcpAppAuditOwner(state, directory, addMcpAppAuditBytes(mcpAppAuditOwnerBytes(owner), incomingBytes));
+        throw error;
+    }
+    const files = new Map(owner.files);
+    files.set(0, {
+        directory,
+        index: 0,
+        size: committed.size,
+        path: join(directory, "audit.jsonl"),
+        modifiedAtMs: committed.modifiedAtMs,
+        identity: committed.identity,
+        reclaimable: true,
+    });
+    replaceMcpAppAuditOwner(state, directory, {
+        directory,
+        identity: owner.identity,
+        files,
+        reservedBytes: 0,
+        poisoned: false,
+    });
+    if (projectedMcpAppAuditBytes(state, undefined, 0, additionalReservedBytes) > state.maxBytes) {
+        throw new Error("MCP App audit storage exceeded its aggregate ceiling.");
+    }
+}
+async function admitMcpAppAuditAppend(state, targetDirectory, naturallyReleased, incomingBytes, additionalReservedBytes) {
+    if (projectedMcpAppAuditBytes(state, naturallyReleased, incomingBytes, additionalReservedBytes) <= state.maxBytes)
+        return;
+    const attempted = new Set();
+    while (projectedMcpAppAuditBytes(state, naturallyReleased, incomingBytes, additionalReservedBytes) > state.maxBytes) {
+        const reclaimablePaths = mcpAppAuditReclaimablePaths(state, targetDirectory, naturallyReleased, attempted);
+        if (projectedMcpAppAuditBytes(state, naturallyReleased, incomingBytes, additionalReservedBytes, reclaimablePaths) > state.maxBytes) {
+            throw new Error("MCP App audit storage is full.");
+        }
+        const candidate = nextMcpAppAuditReclamationCandidate(state, targetDirectory, naturallyReleased, incomingBytes, attempted);
+        if (candidate === undefined)
+            break;
+        attempted.add(candidate.path);
+        try {
+            const removed = await removeMcpAppAuditPathUnlessProtected(state, candidate, { force: true });
+            if (!removed)
+                continue;
+            removeTrackedMcpAppAuditFile(state, candidate);
+        }
+        catch {
+            markMcpAppAuditFileUnreclaimable(state, candidate);
+            if (candidate.directory === targetDirectory) {
+                throw new Error("MCP App audit history could not be reclaimed safely.");
+            }
+        }
+    }
+    if (projectedMcpAppAuditBytes(state, naturallyReleased, incomingBytes, additionalReservedBytes) > state.maxBytes) {
+        throw new Error("MCP App audit storage is full.");
+    }
+}
+async function initializeMcpAppAuditStorage(state, targetDirectory) {
+    if (state.initialized)
+        return;
+    let root;
+    let entries;
+    try {
+        root = await openMcpAppAuditRoot(state);
+        entries = await readMcpAppAuditDirectory(state, state.root, async () => await assertOpenedMcpAppAuditDirectory(state, root));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            state.initialized = true;
+            return;
+        }
+        throw error;
+    }
+    finally {
+        await root?.handle.close().catch(() => undefined);
+    }
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        if (!entry.isDirectory() || !APP_ID.test(entry.name))
+            continue;
+        const directory = join(state.root, entry.name);
+        const owner = await inventoryMcpAppAuditOwner(state, directory, directory === targetDirectory);
+        if (directory === targetDirectory || mcpAppAuditOwnerBytes(owner) > 0) {
+            replaceMcpAppAuditOwner(state, directory, owner);
+        }
+    }
+    state.initialized = true;
+}
+async function reconcileTargetMcpAppAuditOwner(state, directory) {
+    const tracked = state.owners.get(directory);
+    if (tracked?.poisoned === true) {
+        throw new Error("MCP App audit target is quarantined for this process.");
+    }
+    const owner = await inventoryMcpAppAuditOwner(state, directory, true, tracked?.identity);
+    replaceMcpAppAuditOwner(state, directory, owner);
+    return owner;
+}
+async function inventoryMcpAppAuditOwner(state, directory, strict, expectedIdentity) {
+    let observedIdentity = expectedIdentity;
+    let opened;
+    let entries;
+    try {
+        const initial = await lstatMcpAppAuditPath(state, directory);
+        if (!initial.isDirectory() || initial.isSymbolicLink()) {
+            throw new Error("MCP App audit target is not a safe invocation directory.");
+        }
+        const initialIdentity = mcpAppAuditIdentity(initial);
+        if (expectedIdentity !== undefined && !sameMcpAppAuditIdentity(initialIdentity, expectedIdentity)) {
+            throw new Error("MCP App audit invocation directory identity changed.");
+        }
+        observedIdentity = initialIdentity;
+        opened = await openMcpAppAuditOwner(state, directory, expectedIdentity ?? initialIdentity);
+        entries = await readMcpAppAuditDirectory(state, directory, async () => await assertOpenedMcpAppAuditOwner(state, opened));
+    }
+    catch (error) {
+        if (opened !== undefined)
+            await closeOpenedMcpAppAuditOwner(opened);
+        if (error.code === "ENOENT" && expectedIdentity === undefined) {
+            return emptyMcpAppAuditOwner(directory);
+        }
+        if (strict)
+            throw error;
+        return poisonedMcpAppAuditOwner(state, directory, 0, observedIdentity);
+    }
+    const identity = opened.owner.identity;
+    const files = new Map();
+    try {
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+            const index = mcpAppAuditFileIndex(entry.name);
+            if (index === undefined)
+                continue;
+            const path = join(directory, entry.name);
+            let fileStat;
+            try {
+                fileStat = await lstatMcpAppAuditPath(state, path, async () => await assertOpenedMcpAppAuditOwner(state, opened));
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    continue;
+                if (strict)
+                    throw error;
+                return poisonedMcpAppAuditOwner(state, directory, mcpAppAuditFilesBytes(files), identity);
+            }
+            if (!fileStat.isFile() || fileStat.isSymbolicLink() || fileStat.nlink !== 1) {
+                if (strict)
+                    throw new Error("MCP App audit storage contains an unsafe file.");
+                return poisonedMcpAppAuditOwner(state, directory, addMcpAppAuditBytes(mcpAppAuditFilesBytes(files), fileStat.isFile() && Number.isSafeInteger(fileStat.size) ? fileStat.size : 0), identity);
+            }
+            const file = {
+                directory,
+                index,
+                size: fileStat.size,
+                path,
+                modifiedAtMs: fileStat.mtimeMs,
+                identity: mcpAppAuditIdentity(fileStat),
+                reclaimable: true,
+            };
+            if (index === 0 && fileStat.size > state.fileMaxBytes) {
+                if (strict) {
+                    throw new Error("MCP App audit file exceeded its configured ceiling.");
+                }
+                files.set(index, file);
+                continue;
+            }
+            if (index > state.retainedFiles || fileStat.size > state.fileMaxBytes) {
+                try {
+                    await removeMcpAppAuditPath(state, file, { force: true }, opened);
+                }
+                catch {
+                    if (strict)
+                        throw new Error("MCP App audit history could not be bounded safely.");
+                    return poisonedMcpAppAuditOwner(state, directory, addMcpAppAuditBytes(mcpAppAuditFilesBytes(files), fileStat.size), identity);
+                }
+                continue;
+            }
+            files.set(index, {
+                ...file,
+            });
+        }
+        await assertOpenedMcpAppAuditOwner(state, opened);
+        return { directory, identity, files, reservedBytes: 0, poisoned: false };
+    }
+    finally {
+        await closeOpenedMcpAppAuditOwner(opened);
+    }
+}
+function nextMcpAppAuditReclamationCandidate(state, targetDirectory, naturallyReleased, incomingBytes, attempted) {
+    const fairShare = Math.floor(state.maxBytes / Math.max(1, state.owners.size));
+    const eligible = [...state.owners.values()].flatMap((owner) => [...owner.files.values()])
+        .filter((candidate) => isMcpAppAuditReclamationCandidate(state, candidate, targetDirectory, naturallyReleased, attempted));
+    const tier = eligible.some((candidate) => candidate.index > 0) ? "rotated" : "inactive-active";
+    const candidates = [...state.owners.entries()].flatMap(([directory, owner]) => {
+        const file = [...owner.files.values()]
+            .filter((candidate) => (isMcpAppAuditReclamationCandidate(state, candidate, targetDirectory, naturallyReleased, attempted)
+            && (tier === "rotated" ? candidate.index > 0 : candidate.index === 0)))
+            .sort(compareMcpAppAuditAge)[0];
+        if (file === undefined)
+            return [];
+        const bytes = addMcpAppAuditBytes(Math.max(0, mcpAppAuditOwnerBytes(owner) - (directory === targetDirectory ? naturallyReleased?.size ?? 0 : 0)), directory === targetDirectory ? incomingBytes : 0);
+        return [{ directory, bytes, file }];
+    });
+    if (candidates.length === 0)
+        return undefined;
+    const aboveShare = candidates.filter((candidate) => candidate.bytes > fairShare);
+    const pool = aboveShare.length > 0 ? aboveShare : candidates;
+    pool.sort((left, right) => (right.bytes - left.bytes
+        || compareMcpAppAuditAge(left.file, right.file)
+        || left.directory.localeCompare(right.directory)));
+    return pool[0].file;
+}
+function mcpAppAuditReclaimablePaths(state, targetDirectory, naturallyReleased, attempted) {
+    return new Set([...state.owners.values()].flatMap((owner) => [...owner.files.values()])
+        .filter((candidate) => isMcpAppAuditReclamationCandidate(state, candidate, targetDirectory, naturallyReleased, attempted))
+        .map((candidate) => candidate.path));
+}
+function isMcpAppAuditReclamationCandidate(state, candidate, targetDirectory, naturallyReleased, attempted) {
+    if (!candidate.reclaimable
+        || candidate.path === naturallyReleased?.path
+        || attempted.has(candidate.path))
+        return false;
+    if (candidate.index > 0)
+        return true;
+    return candidate.directory !== targetDirectory
+        && !isMcpAppAuditOwnerProtected(state, candidate.directory);
+}
+function isMcpAppAuditOwnerProtected(state, directory) {
+    for (const reservation of state.reservations.values()) {
+        if (reservation.directory === directory)
+            return true;
+    }
+    for (const predicate of state.protectionPredicates) {
+        try {
+            if (predicate(directory))
+                return true;
+        }
+        catch {
+            return true;
+        }
+    }
+    return false;
+}
+function projectedMcpAppAuditBytes(state, naturallyReleased, incomingBytes, additionalReservedBytes = 0, excludedPaths = new Set()) {
+    const ceiling = state.maxBytes + 1;
+    let total = 0;
+    const add = (bytes) => {
+        total = Math.min(ceiling, addMcpAppAuditBytes(total, bytes));
+    };
+    for (const owner of state.owners.values()) {
+        if (owner.poisoned)
+            add(Math.min(state.maxBytes, owner.reservedBytes));
+        for (const file of owner.files.values()) {
+            if (file.path === naturallyReleased?.path || excludedPaths.has(file.path))
+                continue;
+            add(file.size);
+        }
+    }
+    for (const reservation of state.reservations.values())
+        add(reservation.bytes);
+    add(incomingBytes);
+    add(additionalReservedBytes);
+    return total;
+}
+function emptyMcpAppAuditOwner(directory) {
+    return { directory, files: new Map(), reservedBytes: 0, poisoned: false };
+}
+function poisonedMcpAppAuditOwner(state, directory, minimumBytes = 0, identity) {
+    const ownerCapacity = state.fileMaxBytes * (state.retainedFiles + 1);
+    return {
+        directory,
+        ...(identity === undefined ? {} : { identity }),
+        files: new Map(),
+        // Unknown owners consume their full safe owner capacity, while the
+        // aggregate projection saturates just above maxBytes. More poisoned owners
+        // can therefore never overflow accounting or create admission headroom.
+        reservedBytes: Math.min(state.maxBytes, Math.max(ownerCapacity, minimumBytes)),
+        poisoned: true,
+    };
+}
+function quarantineMcpAppAuditOwner(state, directory, minimumBytes) {
+    replaceMcpAppAuditOwner(state, directory, poisonedMcpAppAuditOwner(state, directory, minimumBytes, state.owners.get(directory)?.identity));
+}
+function mcpAppAuditFilesBytes(files) {
+    let total = 0;
+    for (const file of files.values())
+        total = addMcpAppAuditBytes(total, file.size);
+    return total;
+}
+function mcpAppAuditOwnerBytes(owner) {
+    return addMcpAppAuditBytes(owner.reservedBytes, mcpAppAuditFilesBytes(owner.files));
+}
+function replaceMcpAppAuditOwner(state, directory, owner) {
+    if (owner === undefined) {
+        state.owners.delete(directory);
+        return;
+    }
+    state.owners.set(directory, owner);
+}
+function removeTrackedMcpAppAuditFile(state, file) {
+    const owner = state.owners.get(file.directory);
+    const tracked = owner?.files.get(file.index);
+    if (owner === undefined || tracked?.path !== file.path)
+        return;
+    const files = new Map(owner.files);
+    files.delete(file.index);
+    replaceMcpAppAuditOwner(state, file.directory, {
+        ...owner,
+        files,
+    });
+}
+function markMcpAppAuditFileUnreclaimable(state, file) {
+    const owner = state.owners.get(file.directory);
+    const tracked = owner?.files.get(file.index);
+    if (owner === undefined || tracked?.path !== file.path)
+        return;
+    const files = new Map(owner.files);
+    files.set(file.index, { ...tracked, reclaimable: false });
+    replaceMcpAppAuditOwner(state, file.directory, { ...owner, files });
+}
+async function rotateTrackedMcpAppAuditFiles(state, directory) {
+    let owner = state.owners.get(directory) ?? emptyMcpAppAuditOwner(directory);
+    const released = owner.files.get(state.retainedFiles);
+    if (released !== undefined) {
+        await removeMcpAppAuditPath(state, released, { force: true });
+        removeTrackedMcpAppAuditFile(state, released);
+    }
+    for (let index = state.retainedFiles; index >= 1; index -= 1) {
+        owner = state.owners.get(directory) ?? emptyMcpAppAuditOwner(directory);
+        const source = owner.files.get(index - 1);
+        if (source === undefined)
+            continue;
+        const destinationPath = join(directory, `audit.${index}.jsonl`);
+        await renameMcpAppAuditPath(state, source, destinationPath);
+        const files = new Map(owner.files);
+        files.delete(index - 1);
+        files.set(index, {
+            ...source,
+            index,
+            path: destinationPath,
+        });
+        replaceMcpAppAuditOwner(state, directory, { ...owner, files });
+    }
+}
+async function appendMcpAppAuditLine(state, owner, path, line, expectedBytes, expectedFile) {
+    if (owner.identity === undefined)
+        throw new Error("MCP App audit owner identity is unavailable.");
+    await beforeMcpAppAuditOperation(state, "append", path);
+    const opened = await openMcpAppAuditOwner(state, owner.directory, owner.identity);
+    const childPath = mcpAppAuditChildPath(opened.owner, basename(path));
+    const flags = fsConstants.O_APPEND
+        | fsConstants.O_WRONLY
+        | (expectedFile === undefined ? fsConstants.O_CREAT | fsConstants.O_EXCL : 0)
+        | (process.platform === "darwin" ? DARWIN_O_NOFOLLOW_ANY : (fsConstants.O_NOFOLLOW ?? 0));
+    let descriptor;
+    try {
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        descriptor = openSync(childPath, flags, 0o600);
+        const before = fstatSync(descriptor);
+        const current = lstatSync(childPath);
+        if (!before.isFile()
+            || before.nlink !== 1
+            || before.size !== expectedBytes
+            || !sameMcpAppAuditFileIdentity(before, current)
+            || (expectedFile !== undefined && !sameMcpAppAuditIdentity(mcpAppAuditIdentity(before), expectedFile.identity))) {
+            throw new Error("MCP App audit storage changed during append admission.");
+        }
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        const lineBuffer = Buffer.from(line, "utf8");
+        let written = 0;
+        while (written < lineBuffer.length) {
+            const bytesWritten = writeSync(descriptor, lineBuffer, written, lineBuffer.length - written, null);
+            if (bytesWritten === 0)
+                throw new Error("MCP App audit append made no forward progress.");
+            written += bytesWritten;
+        }
+        const after = fstatSync(descriptor);
+        const currentAfter = lstatSync(childPath);
+        const lineBytes = lineBuffer.length;
+        if (written !== lineBytes
+            || !after.isFile()
+            || after.nlink !== 1
+            || after.size !== expectedBytes + lineBytes
+            || after.size > state.fileMaxBytes
+            || !sameMcpAppAuditFileIdentity(after, currentAfter)) {
+            throw new Error("MCP App audit append did not preserve its physical file ceiling.");
+        }
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        return {
+            size: after.size,
+            modifiedAtMs: after.mtimeMs,
+            identity: mcpAppAuditIdentity(after),
+        };
+    }
+    finally {
+        try {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+        }
+        finally {
+            await closeOpenedMcpAppAuditOwner(opened);
+        }
+    }
+}
+function assertMcpAppAuditDirectory(state, directory) {
+    if (resolve(directory, "..") !== state.root || !APP_ID.test(basename(directory))) {
+        throw new Error("MCP App audit target escaped its owned invocation directory.");
+    }
+}
+async function beforeMcpAppAuditOperation(state, operation, path) {
+    await state.beforeOperation?.(operation, path);
+}
+async function readMcpAppAuditDirectory(state, path, assertParent) {
+    await beforeMcpAppAuditOperation(state, "readdir", path);
+    await assertParent?.();
+    const entries = await readdir(path, { withFileTypes: true });
+    await assertParent?.();
+    return entries;
+}
+async function lstatMcpAppAuditPath(state, path, assertParent) {
+    await beforeMcpAppAuditOperation(state, "lstat", path);
+    await assertParent?.();
+    const details = await lstat(path);
+    await assertParent?.();
+    return details;
+}
+async function removeMcpAppAuditPath(state, file, options, existingOwner) {
+    await removeMcpAppAuditFile(state, file, options, false, existingOwner);
+}
+async function removeMcpAppAuditPathUnlessProtected(state, file, options) {
+    return await removeMcpAppAuditFile(state, file, options, true);
+}
+async function renameMcpAppAuditPath(state, source, destination) {
+    const owner = state.owners.get(source.directory);
+    if (owner?.identity === undefined)
+        throw new Error("MCP App audit owner identity is unavailable.");
+    await beforeMcpAppAuditOperation(state, "rename", source.path);
+    const opened = await openMcpAppAuditOwner(state, source.directory, owner.identity);
+    try {
+        const sourcePath = mcpAppAuditChildPath(opened.owner, basename(source.path));
+        const destinationPath = mcpAppAuditChildPath(opened.owner, basename(destination));
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        const currentSource = lstatSync(sourcePath);
+        assertMcpAppAuditFileSnapshot(currentSource, source);
+        try {
+            lstatSync(destinationPath);
+            throw new Error("MCP App audit rotation destination changed unexpectedly.");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        renameSync(sourcePath, destinationPath);
+        const currentDestination = lstatSync(destinationPath);
+        assertMcpAppAuditFileSnapshot(currentDestination, source);
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+    }
+    finally {
+        await closeOpenedMcpAppAuditOwner(opened);
+    }
+}
+async function removeMcpAppAuditFile(state, file, options, respectProtection, existingOwner) {
+    if (options.recursive === true) {
+        throw new Error("MCP App audit reclamation never recursively removes an owner entry.");
+    }
+    const trackedOwner = state.owners.get(file.directory);
+    const identity = existingOwner?.owner.identity ?? trackedOwner?.identity;
+    if (identity === undefined)
+        throw new Error("MCP App audit owner identity is unavailable.");
+    await beforeMcpAppAuditOperation(state, "remove", file.path);
+    const opened = existingOwner ?? await openMcpAppAuditOwner(state, file.directory, identity);
+    try {
+        const childPath = mcpAppAuditChildPath(opened.owner, basename(file.path));
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        const current = lstatSync(childPath);
+        assertMcpAppAuditFileSnapshot(current, file);
+        if (respectProtection && file.index === 0 && isMcpAppAuditOwnerProtected(state, file.directory)) {
+            return false;
+        }
+        // Keep the final validation and unlink in one synchronous critical section:
+        // no in-process task can swap the parent between check and use. Linux child
+        // paths are descriptor-relative; Darwin append opens also use NOFOLLOW_ANY.
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        rmSync(childPath, options);
+        assertOpenedMcpAppAuditOwnerSync(state, opened);
+        return true;
+    }
+    finally {
+        if (existingOwner === undefined)
+            await closeOpenedMcpAppAuditOwner(opened);
+    }
+}
+async function openMcpAppAuditRoot(state) {
+    const opened = await openVerifiedMcpAppAuditDirectory(state.root, state.rootIdentity, state.rootRealPath);
+    if (state.rootIdentity === undefined) {
+        state.rootIdentity = opened.identity;
+        state.rootRealPath = opened.realPath;
+    }
+    return opened;
+}
+async function openMcpAppAuditOwner(state, directory, expectedIdentity) {
+    assertMcpAppAuditDirectory(state, directory);
+    const root = await openMcpAppAuditRoot(state);
+    try {
+        const owner = await openVerifiedMcpAppAuditDirectory(directory, expectedIdentity, join(root.realPath, basename(directory)));
+        const opened = { root, owner };
+        await assertOpenedMcpAppAuditOwner(state, opened);
+        return opened;
+    }
+    catch (error) {
+        await root.handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function openVerifiedMcpAppAuditDirectory(path, expectedIdentity, expectedRealPath) {
+    const initial = await lstat(path);
+    if (!initial.isDirectory() || initial.isSymbolicLink()) {
+        throw new Error("MCP App audit storage traversed an unsafe directory entry.");
+    }
+    const handle = await open(path, fsConstants.O_RDONLY
+        | (fsConstants.O_DIRECTORY ?? 0)
+        | (fsConstants.O_NOFOLLOW ?? 0)
+        | (fsConstants.O_NONBLOCK ?? 0));
+    try {
+        const [opened, current, currentRealPath] = await Promise.all([
+            handle.stat(),
+            lstat(path),
+            realpath(path),
+        ]);
+        const identity = mcpAppAuditIdentity(opened);
+        if (!opened.isDirectory()
+            || !current.isDirectory()
+            || current.isSymbolicLink()
+            || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(initial), identity)
+            || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(current), identity)
+            || (expectedIdentity !== undefined && !sameMcpAppAuditIdentity(identity, expectedIdentity))
+            || (expectedRealPath !== undefined && currentRealPath !== expectedRealPath)) {
+            throw new Error("MCP App audit directory identity changed during verification.");
+        }
+        return { path, identity, realPath: currentRealPath, handle };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function assertOpenedMcpAppAuditDirectory(state, opened) {
+    assertOpenedMcpAppAuditDirectorySync(state, opened);
+}
+async function assertOpenedMcpAppAuditOwner(state, opened) {
+    assertOpenedMcpAppAuditOwnerSync(state, opened);
+}
+function assertOpenedMcpAppAuditDirectorySync(state, opened) {
+    const retained = fstatSync(opened.handle.fd);
+    const current = lstatSync(opened.path);
+    const currentRealPath = realpathSync(opened.path);
+    const rootIdentityChanged = opened.path === state.root
+        && state.rootIdentity !== undefined
+        && !sameMcpAppAuditIdentity(opened.identity, state.rootIdentity);
+    const rootRealPathChanged = opened.path === state.root
+        && state.rootRealPath !== undefined
+        && opened.realPath !== state.rootRealPath;
+    if (!retained.isDirectory()
+        || !current.isDirectory()
+        || current.isSymbolicLink()
+        || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(retained), opened.identity)
+        || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(current), opened.identity)
+        || currentRealPath !== opened.realPath
+        || rootIdentityChanged
+        || rootRealPathChanged) {
+        throw new Error("MCP App audit directory changed while in use.");
+    }
+}
+function assertOpenedMcpAppAuditOwnerSync(state, opened) {
+    assertOpenedMcpAppAuditDirectorySync(state, opened.root);
+    assertOpenedMcpAppAuditDirectorySync(state, opened.owner);
+    if (dirname(opened.owner.realPath) !== opened.root.realPath
+        || basename(opened.owner.path) !== basename(opened.owner.realPath)) {
+        throw new Error("MCP App audit owner escaped its verified audit root.");
+    }
+}
+function mcpAppAuditChildPath(opened, name) {
+    if (basename(name) !== name || name === "." || name === "..") {
+        throw new Error("MCP App audit child name is unsafe.");
+    }
+    return process.platform === "linux"
+        ? `/proc/self/fd/${String(opened.handle.fd)}/${name}`
+        : join(opened.realPath, name);
+}
+async function closeOpenedMcpAppAuditOwner(opened) {
+    await Promise.all([
+        opened.owner.handle.close().catch(() => undefined),
+        opened.root.handle.close().catch(() => undefined),
+    ]);
+}
+function mcpAppAuditIdentity(details) {
+    return { dev: details.dev, ino: details.ino };
+}
+function sameMcpAppAuditIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function sameMcpAppAuditFileIdentity(opened, current) {
+    return opened.isFile()
+        && opened.nlink === 1
+        && current.isFile()
+        && !current.isSymbolicLink()
+        && current.nlink === 1
+        && sameMcpAppAuditIdentity(mcpAppAuditIdentity(opened), mcpAppAuditIdentity(current));
+}
+function assertMcpAppAuditFileSnapshot(current, expected) {
+    if (!current.isFile()
+        || current.isSymbolicLink()
+        || current.nlink !== 1
+        || current.size !== expected.size
+        || !sameMcpAppAuditIdentity(mcpAppAuditIdentity(current), expected.identity)) {
+        throw new Error("MCP App audit file identity changed before mutation.");
+    }
+}
+function compareMcpAppAuditAge(left, right) {
+    return left.modifiedAtMs - right.modifiedAtMs
+        || (left.directory === right.directory ? right.index - left.index : left.path.localeCompare(right.path));
+}
+function mcpAppAuditFileIndex(name) {
+    if (name === "audit.jsonl")
+        return 0;
+    const matched = /^audit\.([1-9][0-9]*)\.jsonl$/u.exec(name);
+    if (matched === null)
+        return undefined;
+    const index = Number(matched[1]);
+    return Number.isSafeInteger(index) ? index : undefined;
+}
+function addMcpAppAuditBytes(left, right) {
+    return left > Number.MAX_SAFE_INTEGER - right ? Number.MAX_SAFE_INTEGER : left + right;
+}
+async function runMcpAppAuditExclusive(state, operation) {
+    const previous = state.gate;
+    let release;
+    state.gate = new Promise((resolveGate) => { release = resolveGate; });
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+    }
+}
+function isSupportedProtocolVersion(value) {
+    return typeof value === "string"
+        && MCP_APP_SUPPORTED_VERSIONS.includes(value);
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function boundedText(value, maxBytes) {
+    const text = wellFormed(value).normalize("NFC")
+        .replace(BIDI_CONTROL, "")
+        .replace(/[\u0000-\u001f\u007f]/gu, " ")
+        .trim();
+    let bounded = "";
+    let bytes = 0;
+    for (const codePoint of text) {
+        const codePointBytes = Buffer.byteLength(codePoint, "utf8");
+        if (bytes + codePointBytes > maxBytes)
+            break;
+        bounded += codePoint;
+        bytes += codePointBytes;
+    }
+    return bounded;
+}
+function wellFormed(input) {
+    let output = "";
+    for (const codePoint of input) {
+        const unit = codePoint.charCodeAt(0);
+        output += codePoint.length === 1 && unit >= 0xd800 && unit <= 0xdfff ? "\ufffd" : codePoint;
+    }
+    return output;
+}
+function serializedBytes(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value) ?? "null", "utf8");
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+}
+function serializeBoundedJsonLine(value, maxBytes) {
+    const serialized = `${JSON.stringify(value) ?? "null"}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > maxBytes) {
+        throw new RangeError("MCP App persisted metadata exceeded its byte limit.");
+    }
+    return serialized;
+}
+function boundedJsonValue(value, maxBytes) {
+    try {
+        const serialized = JSON.stringify(value) ?? "null";
+        if (Buffer.byteLength(serialized, "utf8") <= maxBytes)
+            return JSON.parse(serialized);
+    }
+    catch {
+        // Fall through to a deterministic omission marker.
+    }
+    return { truncated: true, reason: "value exceeded the MCP App host limit" };
+}
+async function readBoundedText(path, maxBytes) {
+    const fileStat = await stat(path);
+    if (!fileStat.isFile() || fileStat.size > maxBytes)
+        throw new CodedError("app_missing", "The MCP App resource is unavailable.");
+    return await readFile(path, "utf8");
+}
+async function readBoundedJson(path, maxBytes) {
+    return JSON.parse(await readBoundedText(path, maxBytes));
+}
+//# sourceMappingURL=mcp-apps.js.map