@my-life-buddies/cli 0.22.0 → 0.23.0-dev.2

package/dist/bin/preview.js

@@ -269,7 +269,10 @@ var PreviewController = class {
       signal: controller.signal,
       onLifecycle: ({ phase, error }) => {
         if (controller.signal.aborted || !this.#handle || this.#state.phase === "stopping") return;
-        if (phase === "reloading") this.#stopOutputWatchers();
+        if (phase === "reloading") {
+          this.#stopOutputWatchers();
+          void this.#simulator?.resetWidgets?.();
+        }
         this.#record({ channel: "dev", type: `dev.${phase}`, summary: phase === "reloading" ? "\u672C\u5730\u6587\u4EF6\u5DF2\u4FEE\u6539\uFF0C\u6B63\u5728\u91CD\u8F7D\uFF1B\u5F53\u524D\u56DE\u590D\u53EF\u80FD\u4E2D\u65AD" : phase === "reload_failed" ? error?.message ?? "\u91CD\u8F7D\u5931\u8D25\uFF0C\u4FEE\u6B63\u6587\u4EF6\u540E\u81EA\u52A8\u91CD\u8BD5" : "\u91CD\u8F7D\u5B8C\u6210\uFF0CDEV \u5DF2\u5C31\u7EEA" });
         this.#setState({ phase, ready: this.#state.ready, ...error ? { error } : {} });
       },
@@ -294,6 +297,7 @@ var PreviewController = class {
         () => {
           if (this.#handle === handle) {
             this.#handle = void 0;
+            void this.#simulator?.disposeWidgets?.();
             this.#simulator = void 0;
             this.#stopOutputWatchers();
             this.#record({ channel: "dev", type: "dev.closed", summary: "DEV \u4F1A\u8BDD\u5DF2\u7ED3\u675F" });
@@ -303,6 +307,7 @@ var PreviewController = class {
         (cause) => {
           if (this.#handle === handle) {
             this.#handle = void 0;
+            void this.#simulator?.disposeWidgets?.();
             this.#simulator = void 0;
             this.#stopOutputWatchers();
             this.#record({ channel: "dev", type: "dev.failed", summary: "DEV \u4F1A\u8BDD\u5F02\u5E38\u7ED3\u675F" });
@@ -340,10 +345,12 @@ var PreviewController = class {
     this.#startController?.abort(new Error("Preview requested DEV stop"));
     const handle = this.#handle;
     this.#handle = void 0;
+    const widgetCleanup = this.#simulator?.disposeWidgets?.();
     this.#simulator = void 0;
     this.#stopOutputWatchers();
     try {
       if (handle) await handle.close();
+      await widgetCleanup;
       if (this.#startPromise) await this.#startPromise.catch(() => void 0);
       this.#record({ channel: "dev", type: "dev.stopped", summary: "DEV \u4F1A\u8BDD\u5DF2\u505C\u6B62" });
       return this.#setState({ phase: "idle" });
@@ -374,7 +381,7 @@ var PreviewController = class {
     const client = this.#requiredSimulator();
     const revision = this.#conversationRevision;
     let result;
-    if (action === "list" && client.widgets) result = { widgets: await client.widgets(), conversationRevision: revision, capabilities: { documentLifecycle: true, deleteWidget: Boolean(client.deleteWidget) } };
+    if (action === "list" && client.widgets) result = { widgets: await client.widgets(), conversationRevision: revision, capabilities: { documentLifecycle: true, widgetEditing: Boolean(client.widgetCommand) } };
     else if (action === "html" && client.widgetHtml) {
       let target;
       if (messageId !== void 0) {
@@ -385,9 +392,6 @@ var PreviewController = class {
       }
       if (this.#resetting || revision !== this.#conversationRevision || client !== this.#simulator) throw Object.assign(new Error("\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6"), { status: 409 });
       result = await client.widgetHtml(id, target);
-    } else if (action === "delete" && client.deleteWidget) {
-      await client.deleteWidget(id);
-      result = { ok: true };
     } else if (action === "image" && client.widgetImage) result = await client.widgetImage(id, mediaId);
     else if ((action === "pin" || action === "unpin") && client.pinWidget) {
       await client.pinWidget(id, action === "pin");
@@ -396,6 +400,17 @@ var PreviewController = class {
     if (this.#resetting || revision !== this.#conversationRevision || client !== this.#simulator) throw Object.assign(new Error("\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6"), { status: 409 });
     return result;
   }
+  async simulatorWidgetCommand(id, body) {
+    if (this.#resetting) throw Object.assign(new Error("\u4F1A\u8BDD\u6B63\u5728\u91CD\u7F6E"), { status: 409 });
+    const client = this.#requiredSimulator(), revision = this.#conversationRevision;
+    if (!body || typeof body !== "object" || body.conversationRevision !== revision)
+      throw Object.assign(new Error("\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6"), { status: 409 });
+    if (!client.widgetCommand) throw Object.assign(new Error("\u5F53\u524D\u6A21\u62DF\u5668\u4E0D\u652F\u6301 Widget \u7F16\u8F91"), { status: 501 });
+    const result = await client.widgetCommand(id, body);
+    if (this.#resetting || client !== this.#simulator || revision !== this.#conversationRevision)
+      throw Object.assign(new Error("\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6"), { status: 409 });
+    return result;
+  }
   async resetSimulator() {
     if (this.#resetting || this.#sendingMessage || this.#simulatorState.activeRun) {
       throw Object.assign(new Error("\u8BF7\u7B49\u5F85\u5F53\u524D\u56DE\u590D\u6216\u64CD\u4F5C\u5B8C\u6210\u540E\u518D\u6E05\u7A7A"), { status: 409, code: "SIMULATOR_BUSY" });
@@ -915,10 +930,10 @@ function safeEqual(left, right) {
   return a.length === b.length && timingSafeEqual(a, b);
 }
 function cookieValue(request, name) {
-  for (const part of request.headers.cookie?.split(";") ?? []) {
-    const separator = part.indexOf("=");
+  for (const part2 of request.headers.cookie?.split(";") ?? []) {
+    const separator = part2.indexOf("=");
     if (separator < 0) continue;
-    if (part.slice(0, separator).trim() === name) return part.slice(separator + 1).trim();
+    if (part2.slice(0, separator).trim() === name) return part2.slice(separator + 1).trim();
   }
   return void 0;
 }
@@ -952,9 +967,9 @@ function widgetDocument(response, html, render, state = "ready", status = 200) {
   response.setHeader("Content-Security-Policy", "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'");
   response.setHeader("Content-Type", "text/html; charset=utf-8");
   if (validWidgetRender(render)) {
-    const signal = `<script>window.addEventListener('load',()=>parent.postMessage({channel:'buddy-widget-document',render:${JSON.stringify(render)},state:${JSON.stringify(state)}},'*'),{once:true})</script>`;
-    if (/<head(?:\s[^>]*)?>/iu.test(html)) html = html.replace(/<head(?:\s[^>]*)?>/iu, (match) => match + signal);
-    else if (/<!doctype[^>]*>/iu.test(html)) html = html.replace(/<!doctype[^>]*>/iu, (match) => match + signal);
+    const script = state === "ready" ? readFileSync(new URL("../web/widget-document.js", import.meta.url), "utf8").replace("__WIDGET_RENDER__", JSON.stringify(render)) : `window.addEventListener('load',()=>parent.postMessage({channel:'buddy-widget-document',render:${JSON.stringify(render)},state:'error'},'*'),{once:true})`;
+    const signal = `<script>${script}</script>`;
+    if (/<!doctype[^>]*>/iu.test(html)) html = html.replace(/<!doctype[^>]*>/iu, (match) => match + signal);
     else html = signal + html;
   }
   response.end(html);
@@ -989,9 +1004,9 @@ async function readJsonBody(request, maximumBytes = 64 * 1024) {
 }
 function exactObject(value, keys) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const object2 = value;
+  const object3 = value;
   const expected = new Set(keys);
-  return Object.keys(object2).length === keys.length && Object.keys(object2).every((key) => expected.has(key)) ? object2 : null;
+  return Object.keys(object3).length === keys.length && Object.keys(object3).every((key) => expected.has(key)) ? object3 : null;
 }
 function safeIdentifier(value, maximumLength = 200) {
   return typeof value === "string" && value.length > 0 && value.length <= maximumLength && !/[\u0000-\u001f\u007f]/u.test(value);
@@ -1105,12 +1120,15 @@ data: ${JSON.stringify(value)}
         return apiError(response, failure.status, failure.code, failure.message);
       }
     }
-    const widgetRoute = /^\/api\/simulator\/widgets(?:\/([^/]+)(?:\/(image|pin))?)?$/u.exec(url.pathname);
+    const widgetRoute = /^\/api\/simulator\/widgets(?:\/([^/]+)(?:\/(image|pin|bridge))?)?$/u.exec(url.pathname);
     if (widgetRoute) {
       try {
         const id = widgetRoute[1] ? decodeURIComponent(widgetRoute[1]) : "";
         const suffix = widgetRoute[2];
-        if (id && !suffix && request.method === "DELETE") return json(response, 200, await options.controller.simulatorWidgets("delete", id));
+        if (id && suffix === "bridge" && request.method === "POST") {
+          const body = await readJsonBody(request, 7 * 1024 * 1024);
+          return json(response, 200, await options.controller.simulatorWidgetCommand(id, body));
+        }
         if (request.method === "GET" && !id) return json(response, 200, await options.controller.simulatorWidgets("list"));
         if (id && suffix === "pin" && (request.method === "PUT" || request.method === "DELETE")) return json(response, 200, await options.controller.simulatorWidgets(request.method === "PUT" ? "pin" : "unpin", id));
         if (id && request.method === "GET" && suffix === "image") {
@@ -1269,17 +1287,204 @@ data: ${JSON.stringify({
 }
 
 // apps/preview/src/mlb-simulator.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
+
+// apps/preview/src/widget-bridge.ts
+import { createHash, randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+function widgetBridgeError(status, message2) {
+  return Object.assign(new Error(message2), { status, publicMessage: message2, code: "WIDGET_BRIDGE_FAILED" });
+}
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw widgetBridgeError(400, "\u9700\u8981\u6709\u6548\u7684\u64CD\u4F5C\u53C2\u6570");
+  return value;
+}
+function part(value) {
+  if (typeof value !== "string" || !value.trim() || value.length > 64 || /[\s/\\\u0000-\u001f\u007f]/u.test(value) || value === "." || value === "..") throw widgetBridgeError(400, "\u6A21\u5757\u6216\u8BB0\u5F55\u6807\u8BC6\u65E0\u6548");
+  return encodeURIComponent(value);
+}
+function retryable(error) {
+  const status = error?.status;
+  return status === void 0 || status >= 500 || status === 429;
+}
+async function retry(run) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await run();
+    } catch (error) {
+      if (attempt >= 2 || !retryable(error)) throw error;
+      await delay(100 * (attempt + 1));
+    }
+  }
+}
+var WidgetBridge = class {
+  #sessions = /* @__PURE__ */ new Map();
+  #transport;
+  #timer;
+  #disposed = false;
+  constructor(transport) {
+    this.#transport = transport;
+    this.#timer = setInterval(() => {
+      for (const [key, session] of this.#sessions) if (Date.now() - session.touched > 9e4) {
+        this.#sessions.delete(key);
+        void this.#close(session, "page_lost").catch(() => {
+        });
+      }
+    }, 15e3);
+    this.#timer.unref();
+  }
+  async call(widgetId2, conversationId, value) {
+    if (this.#disposed) throw widgetBridgeError(409, "\u8C03\u8BD5\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6");
+    const body = object(value), render = body.render, method = body.method, requestId = body.requestId;
+    if (typeof render !== "string" || !/^[a-zA-Z0-9-]{16,64}$/u.test(render) || typeof requestId !== "string" || !/^[a-zA-Z0-9-]{16,64}$/u.test(requestId) || typeof method !== "string") throw widgetBridgeError(400, "\u5C0F\u6302\u4EF6\u4EA4\u4E92\u6807\u8BC6\u65E0\u6548");
+    part(widgetId2);
+    let session = this.#sessions.get(render);
+    if (session && (session.widgetId !== widgetId2 || session.conversationId !== conversationId)) throw widgetBridgeError(409, "\u5C0F\u6302\u4EF6\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00");
+    if (method === "open") {
+      if (session?.closed) throw widgetBridgeError(409, "\u5C0F\u6302\u4EF6\u5DF2\u5173\u95ED\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00");
+      if (!session) {
+        if (this.#sessions.size >= 32) throw widgetBridgeError(429, "\u6253\u5F00\u7684\u5C0F\u6302\u4EF6\u8FC7\u591A\uFF0C\u8BF7\u5173\u95ED\u540E\u91CD\u8BD5");
+        session = {
+          widgetId: widgetId2,
+          conversationId,
+          interactionId: `wi_${randomUUID()}`,
+          deviceId: `preview_${randomUUID()}`,
+          sequence: 0,
+          touched: Date.now(),
+          closed: false,
+          pending: 0,
+          tail: Promise.resolve(),
+          calls: /* @__PURE__ */ new Map()
+        };
+        this.#sessions.set(render, session);
+        session.tail = this.#transport.request("GET", `/app/widgets/${encodeURIComponent(widgetId2)}/metadata?conversationId=${encodeURIComponent(conversationId)}`).catch((error) => {
+          session.closed = true;
+          throw error;
+        });
+        void session.tail.catch(() => {
+        });
+      }
+      await session.tail;
+      if (this.#disposed || session.closed) throw widgetBridgeError(409, "\u8C03\u8BD5\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6");
+      return { ready: true };
+    }
+    if (!session) throw widgetBridgeError(409, "\u5C0F\u6302\u4EF6\u8FDE\u63A5\u5DF2\u5931\u6548\uFF0C\u8BF7\u5173\u95ED\u540E\u91CD\u65B0\u6253\u5F00");
+    session.touched = Date.now();
+    const serialized = JSON.stringify([method, body.params ?? {}]);
+    if (method !== "media.upload" && Buffer.byteLength(serialized) > 300 * 1024) throw widgetBridgeError(413, "\u64CD\u4F5C\u53C2\u6570\u8FC7\u5927");
+    const signature = createHash("sha256").update(serialized).digest("hex");
+    const previous = session.calls.get(requestId);
+    if (previous) {
+      if (previous.signature !== signature) throw widgetBridgeError(409, "\u4E0D\u80FD\u4F7F\u7528\u540C\u4E00\u8BF7\u6C42\u6807\u8BC6\u6267\u884C\u4E0D\u540C\u64CD\u4F5C");
+      return previous.result;
+    }
+    if (method === "close") return this.#close(session, "user_closed");
+    if (session.closed) throw widgetBridgeError(409, "\u5C0F\u6302\u4EF6\u5DF2\u5173\u95ED\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00");
+    if (session.calls.size >= 256) throw widgetBridgeError(429, "\u672C\u6B21\u7F16\u8F91\u64CD\u4F5C\u8F83\u591A\uFF0C\u8BF7\u5173\u95ED\u540E\u91CD\u65B0\u6253\u5F00");
+    if (session.pending >= 16) throw widgetBridgeError(429, "\u64CD\u4F5C\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7B49\u5F85\u5F53\u524D\u4FDD\u5B58\u5B8C\u6210");
+    const current = session;
+    current.pending++;
+    const result = current.tail.then(() => {
+      if (current.closed || this.#disposed) throw widgetBridgeError(409, "\u5C0F\u6302\u4EF6\u5DF2\u5173\u95ED\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00");
+      return this.#perform(current, method, object(body.params ?? {}), requestId);
+    });
+    current.tail = result.then(() => {
+      current.pending--;
+    }, () => {
+      current.pending--;
+    });
+    if (["records.create", "records.update", "records.delete", "media.upload"].includes(method)) current.calls.set(requestId, { signature, result });
+    return result;
+  }
+  async #perform(s, method, p, requestId) {
+    const base = `/app/widgets/${encodeURIComponent(s.widgetId)}`;
+    if (method === "heartbeat" || method === "resume") {
+      if (!s.sequence) return { active: true };
+      return this.#transport.command(`widget.interaction.${method}`, { interactionId: s.interactionId, widgetId: s.widgetId, lastAckedSequence: s.sequence });
+    }
+    if (method === "media.url") {
+      if (typeof p.mediaId !== "string" || !/^media_[A-Za-z0-9_-]+$/u.test(p.mediaId)) throw widgetBridgeError(400, "\u56FE\u7247\u6807\u8BC6\u65E0\u6548");
+      const image = await this.#transport.image(s.widgetId, p.mediaId);
+      if (!/^image\/(png|jpeg|webp|gif)(?:;|$)/u.test(image.contentType)) throw widgetBridgeError(415, "\u56FE\u7247\u683C\u5F0F\u4E0D\u652F\u6301");
+      return { url: `data:${image.contentType.split(";")[0]};base64,${Buffer.from(image.body).toString("base64")}` };
+    }
+    if (method === "media.upload") {
+      if (typeof p.mimeType !== "string" || !["image/png", "image/jpeg", "image/webp"].includes(p.mimeType) || typeof p.base64 !== "string" || p.base64.length > 7 * 1024 * 1024 || !/^[A-Za-z0-9+/]+={0,2}$/u.test(p.base64)) throw widgetBridgeError(400, "\u8BF7\u9009\u62E9 JPEG\u3001PNG \u6216 WebP \u56FE\u7247");
+      const bytes = Buffer.from(p.base64, "base64");
+      if (bytes.length > 5 * 1024 * 1024 || !bytes.length) throw widgetBridgeError(413, "\u56FE\u7247\u4E0D\u80FD\u8D85\u8FC7 5 MiB");
+      const result = object(await this.#transport.upload(s.conversationId, p.mimeType, bytes));
+      return { mediaId: result.mediaId, width: result.width, height: result.height, mimeType: result.mimeType, size: result.size };
+    }
+    if (!/^records\.(list|get|create|update|delete)$/u.test(method)) throw widgetBridgeError(400, "\u9875\u9762\u8BF7\u6C42\u4E86\u672A\u5F00\u653E\u7684\u80FD\u529B");
+    const path = `${base}/modules/${part(p.module)}/records`;
+    if (method === "records.list" || method === "records.get") {
+      return this.#transport.request("GET", `${path}${method === "records.get" ? `/${part(p.recordId)}` : ""}?conversationId=${encodeURIComponent(s.conversationId)}`);
+    }
+    if (s.uncertain) throw widgetBridgeError(409, "\u4E0A\u6B21\u4FDD\u5B58\u7ED3\u679C\u5C1A\u672A\u786E\u8BA4\uFF0C\u8BF7\u5173\u95ED\u540E\u91CD\u65B0\u6253\u5F00\u5E76\u6838\u5BF9\u6570\u636E");
+    const action = method.slice(8);
+    const mutation = { conversationId: s.conversationId };
+    if (action !== "delete") mutation.data = object(p.data);
+    if (p.expectedRevision !== void 0) {
+      if (!Number.isSafeInteger(p.expectedRevision) || p.expectedRevision < 0) throw widgetBridgeError(400, "\u8BB0\u5F55\u7248\u672C\u53F7\u65E0\u6548");
+      mutation.expectedRevision = p.expectedRevision;
+    }
+    if (Buffer.byteLength(JSON.stringify(mutation)) > 290 * 1024) throw widgetBridgeError(413, "\u8BB0\u5F55\u5185\u5BB9\u8FC7\u5927");
+    const target = action === "create" ? path : `${path}/${part(p.recordId)}`;
+    const sequence = s.sequence + 1;
+    const headers = {
+      "X-Widget-Interaction-Id": s.interactionId,
+      "X-Widget-Operation-Id": `op_${requestId}`,
+      "X-Widget-Sequence": String(sequence),
+      "X-Widget-Entry-Point": "conversation_detail",
+      "X-Device-Id": s.deviceId
+    };
+    try {
+      const result = await retry(() => this.#transport.request(action === "create" ? "POST" : action === "update" ? "PUT" : "DELETE", target, mutation, headers));
+      s.sequence = sequence;
+      return result;
+    } catch (error) {
+      if (retryable(error)) s.uncertain = requestId;
+      throw error;
+    }
+  }
+  async #close(s, reason) {
+    if (s.closed) return s.tail;
+    s.closed = true;
+    const pending = s.tail;
+    const closing = pending.catch(() => {
+    }).then(() => retry(() => this.#transport.request(
+      "POST",
+      `/app/widgets/${encodeURIComponent(s.widgetId)}/interactions/${s.interactionId}/close`,
+      { conversationId: s.conversationId, lastIssuedSequence: s.sequence + (s.uncertain ? 1 : 0), closeReason: reason }
+    )));
+    s.tail = closing;
+    void closing.catch(() => {
+    });
+    return closing;
+  }
+  async closeAll() {
+    const sessions = [...this.#sessions.values()];
+    this.#sessions.clear();
+    await Promise.allSettled(sessions.map((s) => this.#close(s, "preview_stopped")));
+  }
+  async dispose() {
+    this.#disposed = true;
+    clearInterval(this.#timer);
+    await this.closeAll();
+  }
+};
+
+// apps/preview/src/mlb-simulator.ts
 import { normalizePlatformUrl } from "./core.js";
 
 // apps/preview/src/mlb-events.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { WebSocket } from "ws";
 var MlbEventStreamError = class extends Error {
-  constructor(message2, status = 502, retryable = true) {
+  constructor(message2, status = 502, retryable2 = true) {
     super(message2);
     this.status = status;
-    this.retryable = retryable;
+    this.retryable = retryable2;
     this.publicMessage = message2;
   }
   status;
@@ -1308,7 +1513,7 @@ function appSocket(url, token) {
 }
 async function mlbAppCommand(url, token, method, params, options = {}) {
   if (options.signal?.aborted) throw options.signal.reason;
-  const requestId = randomUUID();
+  const requestId = randomUUID2();
   const socket = appSocket(url, token);
   return await new Promise((resolve, reject) => {
     let settled = false;
@@ -1515,11 +1720,11 @@ function safeText(value, name, maximum = 4096) {
 function endpoint(base, path) {
   return new URL(path.replace(/^\//u, ""), base);
 }
-function object(value) {
+function object2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function httpError(status, value) {
-  const serverMessage = object(value)?.error;
+  const serverMessage = object2(value)?.error;
   const message2 = typeof serverMessage === "string" && serverMessage.trim() ? serverMessage.slice(0, 512) : status >= 500 ? "MLB Server \u6682\u65F6\u4E0D\u53EF\u7528" : "\u6A21\u62DF\u5668\u8BF7\u6C42\u672A\u80FD\u5B8C\u6210";
   return Object.assign(new Error(message2), {
     code: "MLB_REQUEST_FAILED",
@@ -1528,7 +1733,7 @@ function httpError(status, value) {
   });
 }
 function message(value, index) {
-  const input = object(value);
+  const input = object2(value);
   if (!input || typeof input.author !== "string") return null;
   const role = input.author === "buddy" ? "assistant" : input.author === "user" || input.author === "owner" ? "user" : void 0;
   if (!role) return null;
@@ -1542,7 +1747,7 @@ function message(value, index) {
     throw new Error(`messages[${index}].timestamp is invalid`);
   }
   if (role === "assistant" && input.type === "question") {
-    const options = object(input.question)?.options;
+    const options = object2(input.question)?.options;
     if (!Array.isArray(options) || options.length < 2 || options.length > 4 || options.some((option) => typeof option !== "string" || !option.trim() || option.length > 30)) {
       throw new Error(`messages[${index}].question is invalid`);
     }
@@ -1553,7 +1758,7 @@ ${options.map((option, i) => `${i + 1}. ${option}`).join("\n")}
 \u8BF7\u76F4\u63A5\u56DE\u590D\u4F60\u7684\u9009\u62E9\uFF0C\u4E5F\u53EF\u4EE5\u8865\u5145\u8BF4\u660E\u3002`;
   }
   if (role === "assistant" && input.type === "permissionRequest") {
-    const request = object(input.permissionRequest);
+    const request = object2(input.permissionRequest);
     text2 += request?.status === "pending" ? "\n\n\u8BF7\u5728\u642D\u642D App \u4E2D\u5904\u7406\u8FD9\u5F20\u6388\u6743\u5361\uFF1B\u6D4F\u89C8\u5668\u9884\u89C8\u4E0D\u4EE3\u66FF\u7CFB\u7EDF\u6388\u6743\u3002" : "\n\n\u6388\u6743\u5361\u7684\u5904\u7406\u7ED3\u679C\u8BF7\u4EE5\u642D\u642D App \u4E2D\u7684\u72B6\u6001\u4E3A\u51C6\u3002";
   }
   return Object.freeze({
@@ -1561,7 +1766,7 @@ ${options.map((option, i) => `${i + 1}. ${option}`).join("\n")}
     role,
     text: text2,
     createdAt: new Date(input.timestamp).toISOString(),
-    ...input.type === "widget" && object(input.widget) ? { widget: parseWidget(input.widget) } : {}
+    ...input.type === "widget" && object2(input.widget) ? { widget: parseWidget(input.widget) } : {}
   });
 }
 function widgetId(value) {
@@ -1570,7 +1775,7 @@ function widgetId(value) {
   return id;
 }
 function parseWidget(value) {
-  const item = object(value);
+  const item = object2(value);
   const openTarget = parseOpenTarget(item?.openTarget);
   return Object.freeze({
     id: widgetId(item?.id),
@@ -1586,20 +1791,20 @@ function parseWidget(value) {
 }
 function parseOpenTarget(value) {
   if (value === void 0) return void 0;
-  const target = object(value), resource = object(target?.resource);
+  const target = object2(value), resource = object2(target?.resource);
   const name = (input) => typeof input === "string" && /^[^\s/\u0000-\u001f\u007f]{1,64}$/u.test(input);
-  if (!target || target.version !== 1 || !name(target.entry) || target.resource !== void 0 && (!resource || !name(resource.module) || !name(resource.recordId)) || target.state !== void 0 && !object(target.state)) throw new TypeError("Widget \u6253\u5F00\u76EE\u6807\u683C\u5F0F\u65E0\u6548");
+  if (!target || target.version !== 1 || !name(target.entry) || target.resource !== void 0 && (!resource || !name(resource.module) || !name(resource.recordId)) || target.state !== void 0 && !object2(target.state)) throw new TypeError("Widget \u6253\u5F00\u76EE\u6807\u683C\u5F0F\u65E0\u6548");
   const normalized = {
     version: 1,
     entry: target.entry,
     ...resource ? { resource: { module: resource.module, recordId: resource.recordId } } : {},
-    ...target.state !== void 0 ? { state: object(target.state) } : {}
+    ...target.state !== void 0 ? { state: object2(target.state) } : {}
   };
   if (Buffer.byteLength(JSON.stringify(normalized), "utf8") > 8 * 1024) throw new TypeError("Widget \u6253\u5F00\u76EE\u6807\u8D85\u8FC7 8 KiB");
   return Object.freeze(normalized);
 }
 function localReceipt(prefix, value) {
-  return `${prefix}-${createHash("sha256").update(value).digest("hex").slice(0, 20)}`;
+  return `${prefix}-${createHash2("sha256").update(value).digest("hex").slice(0, 20)}`;
 }
 function waitForRetry(milliseconds, signal) {
   if (signal?.aborted) return Promise.reject(signal.reason);
@@ -1620,6 +1825,7 @@ var MlbSimulatorClient = class {
   #buddyId;
   #accessToken;
   #fetch;
+  #widgetBridge;
   #sending = false;
   #resetTarget;
   #resetArchived = false;
@@ -1639,6 +1845,28 @@ var MlbSimulatorClient = class {
     this.#accessToken = safeText(options.auth.developerAccessToken, "developerAccessToken", 16384);
     this.#fetch = options.fetch ?? globalThis.fetch;
     if (typeof this.#fetch !== "function") throw new TypeError("A Fetch API implementation is required");
+    this.#widgetBridge = new WidgetBridge({
+      request: (method, path, body, headers) => this.#request(method, path, { body, headers }),
+      command: (method, params) => {
+        const url = endpoint(this.#baseUrl, "/app/ws");
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        return mlbAppCommand(url, this.#accessToken, method, params);
+      },
+      image: (id, mediaId) => this.widgetImage(id, mediaId),
+      upload: async (conversationId, mime, bytes) => {
+        const response = await this.#fetch(endpoint(this.#baseUrl, `/app/media/uploads?conversationId=${encodeURIComponent(conversationId)}`), {
+          method: "POST",
+          headers: { Authorization: `Bearer ${this.#accessToken}`, "Content-Type": mime },
+          body: new Uint8Array(bytes),
+          redirect: "error",
+          credentials: "omit",
+          signal: AbortSignal.timeout(25e3)
+        });
+        const value = await response.json().catch(() => void 0);
+        if (!response.ok) throw httpError(response.status, value);
+        return value;
+      }
+    });
   }
   /** Reading a profile must not add the Buddy or trigger a welcome message. */
   async details(options = {}) {
@@ -1661,7 +1889,7 @@ var MlbSimulatorClient = class {
   async widgets() {
     this.#assertResetComplete();
     const id = await this.#ensurePrivate();
-    const body = object(await this.#request("GET", `/app/privates/${encodeURIComponent(id)}/widgets`, {}));
+    const body = object2(await this.#request("GET", `/app/privates/${encodeURIComponent(id)}/widgets`, {}));
     if (!Array.isArray(body?.widgets)) throw httpError(502, { error: "\u65E0\u6CD5\u8BFB\u53D6\u4F1A\u8BDD\u5C0F\u6302\u4EF6" });
     return body.widgets.map(parseWidget).filter((item) => item.type !== void 0);
   }
@@ -1680,15 +1908,20 @@ var MlbSimulatorClient = class {
     const privateId = await this.#ensurePrivate();
     await this.#request(pinned ? "PUT" : "DELETE", `/app/widgets/${encodeURIComponent(widgetId(id))}/pin`, { ...pinned ? { body: { sourceConversationId: privateId } } : {} });
   }
-  async deleteWidget(id) {
+  async widgetCommand(id, body) {
     this.#assertResetComplete();
-    const privateId = await this.#ensurePrivate();
-    await this.#request("DELETE", `/app/widgets/${encodeURIComponent(widgetId(id))}?conversationId=${encodeURIComponent(privateId)}`, {});
+    return this.#widgetBridge.call(widgetId(id), await this.#ensurePrivate(), body);
+  }
+  async disposeWidgets() {
+    await this.#widgetBridge.dispose();
+  }
+  async resetWidgets() {
+    await this.#widgetBridge.closeAll();
   }
   async widgetImage(id, mediaId) {
     this.#assertResetComplete();
     if (!/^media_[a-zA-Z0-9_-]+$/u.test(mediaId)) throw new TypeError("Invalid media ID");
-    const access = object(await this.#request("GET", `/app/media/${encodeURIComponent(mediaId)}?widgetId=${encodeURIComponent(widgetId(id))}`, {}));
+    const access = object2(await this.#request("GET", `/app/media/${encodeURIComponent(mediaId)}?widgetId=${encodeURIComponent(widgetId(id))}`, {}));
     const url = new URL(String(access?.url));
     if (url.protocol !== "https:" || url.username || url.password || access?.mediaId !== mediaId || typeof access.expiresAt !== "number" || access.expiresAt <= Date.now()) throw new Error("\u56FE\u7247\u94FE\u63A5\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5");
     return this.#widgetResource(url.href, false);
@@ -1705,11 +1938,11 @@ var MlbSimulatorClient = class {
     let size = 0;
     try {
       while (true) {
-        const part = await reader.read();
-        if (part.done) break;
-        size += part.value.byteLength;
+        const part2 = await reader.read();
+        if (part2.done) break;
+        size += part2.value.byteLength;
         if (size > 4 * 1024 * 1024) throw new Error("\u5C0F\u6302\u4EF6\u5185\u5BB9\u8FC7\u5927\uFF0C\u6682\u65F6\u65E0\u6CD5\u6253\u5F00");
-        chunks.push(part.value);
+        chunks.push(part2.value);
       }
     } finally {
       await reader.cancel();
@@ -1722,8 +1955,8 @@ var MlbSimulatorClient = class {
     const value = await this.#request("GET", `/app/privates/${encodeURIComponent(privateId)}`, {
       signal: options.signal
     });
-    const body = object(value);
-    const conversation = object(body?.private);
+    const body = object2(value);
+    const conversation = object2(body?.private);
     if (!body || conversation?.id !== privateId || conversation?.buddyId !== this.#buddyId || !Array.isArray(body.messages) || typeof body.replying !== "boolean") {
       throw httpError(502, { error: "MLB Server \u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u79C1\u804A\u72B6\u6001" });
     }
@@ -1786,9 +2019,9 @@ var MlbSimulatorClient = class {
           messages: [{ type: "text", text: input.text }],
           clientMessageId
         }, { signal: options.signal });
-        const receipt2 = object(value);
+        const receipt2 = object2(value);
         const items = Array.isArray(receipt2?.items) ? receipt2.items : [];
-        const item2 = object(items[0]);
+        const item2 = object2(items[0]);
         if (receipt2?.ok !== true || receipt2.clientMessageId !== clientMessageId || items.length !== 1 || item2?.index !== 0 || typeof item2.messageId !== "string" || !item2.messageId.trim() || !Number.isSafeInteger(item2.timestamp) || item2.timestamp < 0 || typeof receipt2.shouldReply !== "boolean") {
           throw httpError(502, { error: "MLB \u6D88\u606F\u56DE\u6267\u65E0\u6548" });
         }
@@ -1801,8 +2034,8 @@ var MlbSimulatorClient = class {
           publicMessage: "\u53D1\u9001\u7ED3\u679C\u5C1A\u672A\u786E\u8BA4\uFF0C\u8BF7\u5237\u65B0\u804A\u5929\u8BB0\u5F55\u540E\u518D\u91CD\u8BD5"
         });
       }
-      const receipt = object(value);
-      const item = object(receipt.items[0]);
+      const receipt = object2(value);
+      const item = object2(receipt.items[0]);
       const runId = this.#active?.runId ?? localReceipt("turn", idempotencyKey);
       const messageId = safeText(item.messageId, "receipt.items[0].messageId", 256);
       if (!this.#active) {
@@ -1832,17 +2065,18 @@ var MlbSimulatorClient = class {
     if (this.#sending) throw httpError(409, { error: "\u6D88\u606F\u6B63\u5728\u53D1\u9001\uFF0C\u8BF7\u7A0D\u540E\u6E05\u7A7A" });
     if (!this.#resetTarget) {
       const privateId = await this.#ensurePrivate(options.signal);
-      const current = object(await this.#request("GET", `/app/privates/${encodeURIComponent(privateId)}`, options));
-      const conversation = object(current?.private);
+      const current = object2(await this.#request("GET", `/app/privates/${encodeURIComponent(privateId)}`, options));
+      const conversation = object2(current?.private);
       if (conversation?.id !== privateId || conversation?.buddyId !== this.#buddyId || typeof current?.replying !== "boolean") {
         throw httpError(502, { error: "\u65E0\u6CD5\u786E\u8BA4\u5F53\u524D\u79C1\u804A\u72B6\u6001\uFF0C\u672A\u6E05\u7A7A\u5BF9\u8BDD" });
       }
       if (current.replying) throw httpError(409, { error: "\u8BF7\u7B49\u5F85\u5F53\u524D\u56DE\u590D\u5B8C\u6210\u540E\u518D\u6E05\u7A7A" });
       this.#resetTarget = privateId;
+      await this.#widgetBridge.closeAll();
     }
     try {
       if (!this.#resetArchived) {
-        const receipt = object(await this.#request("DELETE", `/app/privates/${encodeURIComponent(this.#resetTarget)}`, options));
+        const receipt = object2(await this.#request("DELETE", `/app/privates/${encodeURIComponent(this.#resetTarget)}`, options));
         if (receipt?.ok !== true) throw httpError(502, { error: "\u65E0\u6CD5\u786E\u8BA4\u65E7\u4F1A\u8BDD\u5DF2\u7ED3\u675F" });
         this.#resetArchived = true;
         this.#privateId = void 0;
@@ -1853,7 +2087,7 @@ var MlbSimulatorClient = class {
         throw httpError(502, { error: "MLB \u672A\u8FD4\u56DE\u65B0\u7684\u4F1A\u8BDD\u8EAB\u4EFD" });
       }
     } catch (cause) {
-      const detail = object(cause)?.publicMessage;
+      const detail = object2(cause)?.publicMessage;
       throw Object.assign(new Error("\u4F1A\u8BDD\u91CD\u7F6E\u5C1A\u672A\u5B8C\u6210", { cause }), {
         code: "RESET_INCOMPLETE",
         status: 502,
@@ -1927,7 +2161,7 @@ var MlbSimulatorClient = class {
       } catch (cause) {
         if (options.signal?.aborted) return;
         await reset();
-        const status = object(cause)?.status;
+        const status = object2(cause)?.status;
         if (cause instanceof MlbEventStreamError && !cause.retryable || typeof status === "number" && status >= 400 && status < 500 && status !== 429 || reconnects >= 4) throw cause;
       }
       await waitForRetry(Math.min(1e3, (reconnects + 1) * 150), options.signal);
@@ -1941,7 +2175,7 @@ var MlbSimulatorClient = class {
         "/app/privates",
         { signal, body: { buddyId: this.#buddyId } }
       ).then((value) => {
-        const body = object(value);
+        const body = object2(value);
         if (body?.ok !== true || typeof body.id !== "string" || !/^p_[a-zA-Z0-9_-]{1,253}$/u.test(body.id)) {
           throw httpError(502, { error: "MLB \u521B\u5EFA\u79C1\u804A\u54CD\u5E94\u7F3A\u5C11\u6709\u6548\u7684 privateId" });
         }
@@ -1957,7 +2191,8 @@ var MlbSimulatorClient = class {
   async #request(method, path, options) {
     const headers = new Headers({
       Accept: "application/json",
-      Authorization: `Bearer ${this.#accessToken}`
+      Authorization: `Bearer ${this.#accessToken}`,
+      ...options.headers
     });
     if (options.body !== void 0) headers.set("Content-Type", "application/json");
     const response = await this.#fetch(endpoint(this.#baseUrl, path), {
@@ -1976,7 +2211,7 @@ var MlbSimulatorClient = class {
 // apps/preview/src/bridge.ts
 import { hostname } from "node:os";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { setTimeout as delay } from "node:timers/promises";
+import { setTimeout as delay2 } from "node:timers/promises";
 async function connectPreviewBridge(options) {
   const connectionId = randomBytes2(32).toString("base64url");
   const shutdown = new AbortController();
@@ -2139,7 +2374,7 @@ async function connectPreviewBridge(options) {
             break;
           } else if (status && status >= 400 && status < 500 && status !== 429) throw cause;
         }
-        await delay(replies.size ? 20 : 500, void 0, { signal }).catch(() => void 0);
+        await delay2(replies.size ? 20 : 500, void 0, { signal }).catch(() => void 0);
       }
     } finally {
       clearInterval(watchdog);