@nimbus-sh/worker 0.1.5 → 0.1.6

package/dist/router/index.js

@@ -33,9 +33,10 @@
  */
 import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
-import { verifyRequestToken, authErrorResponse, NimbusAuthError, NimbusTokenMalformedError, } from '../auth/index.js';
+import { verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, NimbusAuthError, NimbusTokenMalformedError, } from '../auth/index.js';
 import { setCtxExports } from '../session/ctx-exports.js';
 import { handleNimbusRemoteApi, } from './remote-api.js';
+import { parseAgentOAuthStateParam } from '../session/agent.js';
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
@@ -98,11 +99,27 @@ export function createNimbusHandler(options = {}) {
             const sdkResponse = await handleNimbusRemoteApi(request, env, options.sdk);
             if (sdkResponse)
                 return sdkResponse;
+            if (url.pathname === '/api/nimbus/oauth/callback') {
+                const payload = parseAgentOAuthStateParam(url.searchParams.get('state'));
+                if (!payload || !isValidSessionId(payload.sessionId)) {
+                    return new Response('Invalid OAuth state', { status: 400 });
+                }
+                return forwardToSession(request, {
+                    sessionId: payload.sessionId,
+                    innerPath: '/api/agent/oauth/callback',
+                    basePath: `${SESSION_ROUTE_PREFIX}/${payload.sessionId}`,
+                }, env, { tenantSegment: payload.tenantSegment });
+            }
             // ── /new — spawn a fresh session and redirect ───────────────────
             if (url.pathname === '/new') {
                 if (request.method !== 'POST' && request.method !== 'GET') {
                     return new Response('Method not allowed', { status: 405 });
                 }
+                const auth = await resolveNimbusRouteAuth(request, env, explicitMode, {
+                    requiredScopes: ['session:create'],
+                });
+                if (auth instanceof Response)
+                    return auth;
                 const sessionId = generateSessionId();
                 return new Response(null, {
                     status: 302,
@@ -124,10 +141,16 @@ export function createNimbusHandler(options = {}) {
                         },
                     });
                 }
-                // Resolve tenant segment per auth mode.
-                const tenantSegment = await resolveTenantSegment(request, env, explicitMode);
-                if (tenantSegment instanceof Response)
-                    return tenantSegment;
+                // Resolve tenant segment per auth mode and enforce session attach
+                // semantics. In enforced mode a sid-pinned token can only attach
+                // to the exact session it was minted for.
+                const auth = await resolveNimbusRouteAuth(request, env, explicitMode, {
+                    requiredScopes: ['session:attach'],
+                    sessionId: route.sessionId,
+                });
+                if (auth instanceof Response)
+                    return auth;
+                const tenantSegment = auth.tenantSegment;
                 // `/s/<id>` and `/s/<id>/` (no inner path) → serve the xterm UI shell.
                 if (route.innerPath === '/' || route.innerPath === '') {
                     if (env.ASSETS) {
@@ -183,25 +206,17 @@ function isLegacyRootPath(pathname) {
     }
     return false;
 }
-/**
- * Decide which tenant segment to use for DO naming. Returns either the
- * segment string or a short-circuit Response (auth failure).
- *
- * Mode `'auto'`:
- *   - If JWT_SECRET is set AND legacy env var not "1" → enforce verify.
- *   - Otherwise → legacy public.
- *
- * Mode `'enforce'`: always verify; 401 on missing/invalid token.
- *
- * Mode `'legacy'`: always legacy public.
- */
-async function resolveTenantSegment(request, env, explicitMode) {
+async function resolveNimbusRouteAuth(request, env, explicitMode, options = {}) {
     const envLegacyFlag = (env?.NIMBUS_LEGACY_PUBLIC === '1' || env?.NIMBUS_LEGACY_PUBLIC === true);
     const hasSecret = typeof env?.JWT_SECRET === 'string' && env.JWT_SECRET.length > 0;
     const mode = explicitMode
         ?? (hasSecret && !envLegacyFlag ? 'enforce' : 'legacy');
-    if (mode === 'legacy')
-        return LEGACY_PUBLIC_DO_SEGMENT;
+    if (mode === 'legacy') {
+        return {
+            tenantSegment: LEGACY_PUBLIC_DO_SEGMENT,
+            verified: null,
+        };
+    }
     if (!hasSecret) {
         // Enforce mode but no secret — config error. 500, no info leak.
         console.error('[nimbus] auth.mode="enforce" but JWT_SECRET is missing');
@@ -209,7 +224,16 @@ async function resolveTenantSegment(request, env, explicitMode) {
     }
     try {
         const verified = await verifyRequestToken(request, env);
-        return verified.doInstanceName;
+        if (options.requiredScopes?.length) {
+            requireScopes(verified, options.requiredScopes);
+        }
+        if (options.sessionId) {
+            requireSessionPin(verified, options.sessionId);
+        }
+        return {
+            tenantSegment: verified.doInstanceName,
+            verified,
+        };
     }
     catch (e) {
         if (e instanceof NimbusAuthError) {

package/dist/router/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAqBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8D1B"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AA2BD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA+D1B"}

package/dist/router/remote-api.js

@@ -27,15 +27,15 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
     catch (e) {
         return remoteJson({ ok: false, error: `Invalid JSON body: ${e?.message || e}`, code: 'E_BAD_JSON' }, 400);
     }
-    const tenantSegment = await resolveRemoteTenantSegment(request, env, remote, match.sandboxId);
-    if (tenantSegment instanceof Response)
-        return tenantSegment;
+    const remoteAuth = await resolveRemoteAuth(request, env, remote, match.sandboxId);
+    if (remoteAuth instanceof Response)
+        return remoteAuth;
     const profileName = body.profile ?? 'default';
     const profile = sdk?.config?.sandboxes?.[profileName]
         ?? sdk?.config?.sandboxes?.default
         ?? {};
     const root = body.root ?? profile.root ?? '/home/user';
-    const doName = `${tenantSegment}:${match.sandboxId}`;
+    const doName = `${remoteAuth.tenantSegment}:${match.sandboxId}`;
     const id = env.NIMBUS_SESSION.idFromName(doName);
     const stub = env.NIMBUS_SESSION.get(id);
     const ctx = {
@@ -45,6 +45,7 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
         profileName,
         profile,
         root,
+        verified: remoteAuth.verified,
     };
     try {
         const result = await dispatchRemoteRpc(ctx);
@@ -81,11 +82,15 @@ function matchRemoteRpc(pathname, basePath) {
         return null;
     }
 }
-async function resolveRemoteTenantSegment(request, env, remote, sandboxId) {
+async function resolveRemoteAuth(request, env, remote, sandboxId) {
     const hasSecret = typeof env?.JWT_SECRET === 'string' && env.JWT_SECRET.length > 0;
     if (!hasSecret) {
-        if (remote.allowLegacy)
-            return LEGACY_PUBLIC_DO_SEGMENT;
+        if (remote.allowLegacy) {
+            return {
+                tenantSegment: LEGACY_PUBLIC_DO_SEGMENT,
+                verified: null,
+            };
+        }
         return remoteJson({
             ok: false,
             error: 'Remote Nimbus sandbox API requires JWT_SECRET',
@@ -96,7 +101,10 @@ async function resolveRemoteTenantSegment(request, env, remote, sandboxId) {
         const verified = await verifyRequestToken(request, env);
         requireScopes(verified, remote.requiredScopes);
         requireSessionPin(verified, sandboxId);
-        return verified.doInstanceName;
+        return {
+            tenantSegment: verified.doInstanceName,
+            verified,
+        };
     }
     catch (e) {
         if (e instanceof NimbusAuthError || e instanceof NimbusTokenMalformedError) {
@@ -133,6 +141,8 @@ async function dispatchRemoteRpc(ctx) {
             return ctx.stub._rpcReadFileBytes(stringArg(args[0], 'path'));
         case 'writeFile':
             return ctx.stub._rpcWriteFile(stringArg(args[0], 'path'), args[1]);
+        case 'stat':
+            return ctx.stub._rpcStat(stringArg(args[0], 'path'));
         case 'readdir':
             return ctx.stub._rpcReaddir(stringArg(args[0], 'path'));
         case 'exists':
@@ -166,10 +176,21 @@ async function dispatchRemoteRpc(ctx) {
             return ctx.stub._rpcExposePort(numberArg(args[0], 'port'));
         case 'unexposePort':
             return ctx.stub._rpcUnexposePort(numberArg(args[0], 'port'));
+        case 'destroy':
+            requireAnyScope(ctx, ['session:destroy', 'session:admin']);
+            return ctx.stub._rpcDestroy(objectArg(args[0]));
         default:
             throw apiError(`Unknown Nimbus sandbox operation: ${String(op)}`, 'E_REMOTE_OP', 400);
     }
 }
+function requireAnyScope(ctx, scopes) {
+    const explicit = ctx.verified?.claims.scopes;
+    if (explicit === undefined)
+        return;
+    if (scopes.some((scope) => explicit.includes(scope)))
+        return;
+    throw apiError(`Nimbus token missing required scope: ${scopes.join(' or ')}`, 'E_SCOPE_MISSING', 403);
+}
 function execOptions(ctx, value) {
     const options = objectArg(value);
     return {

package/dist/runtime/barrel-synthesizer.d.ts

@@ -62,6 +62,13 @@ import type { SliceEntry } from '../npm/pre-bundle-facet.js';
  * directly without barrel pressure.
  */
 export type NamedImportMap = Map<string, Set<string>>;
+/**
+ * Stable signature for a barrel bundle's source import set. Stored in
+ * pkg_esm_bundles.input_hash so a synthetic bundle generated for
+ * `{ Home }` is never reused after the project starts importing
+ * `{ Home, AlertTriangle }`.
+ */
+export declare function namedImportSignature(pkgName: string, names: ReadonlySet<string> | null | undefined): string | null;
 /**
  * Static-import scanner. Walks the user's source tree under projDir
  * and extracts named-import sets. Returns a map keyed by package name.

package/dist/runtime/barrel-synthesizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"barrel-synthesizer.d.ts","sourceRoot":"","sources":["../../src/runtime/barrel-synthesizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,GACd,cAAc,CAgFhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,oBAAoB,GAAG,IAAI,CAmL7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,SAAM,GAClB;IAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiE/C;AA0DD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG3E"}
+{"version":3,"file":"barrel-synthesizer.d.ts","sourceRoot":"","sources":["../../src/runtime/barrel-synthesizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGlH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,GACd,cAAc,CAgFhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,oBAAoB,GAAG,IAAI,CAmL7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,SAAM,GAClB;IAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiE/C;AA0DD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG3E"}

package/dist/runtime/barrel-synthesizer.js

@@ -53,6 +53,17 @@
  * dynamically-referenced icon."
  */
 import { packageNameFromSpecifier } from './barrel-detect.js';
+/**
+ * Stable signature for a barrel bundle's source import set. Stored in
+ * pkg_esm_bundles.input_hash so a synthetic bundle generated for
+ * `{ Home }` is never reused after the project starts importing
+ * `{ Home, AlertTriangle }`.
+ */
+export function namedImportSignature(pkgName, names) {
+    if (!names || names.size === 0)
+        return null;
+    return `barrel:${pkgName}:${Array.from(names).sort().join(',')}`;
+}
 /**
  * Static-import scanner. Walks the user's source tree under projDir
  * and extracts named-import sets. Returns a map keyed by package name.

package/dist/runtime/clang-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clang-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/clang-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAyShC;AAgcD,eAAO,MAAM,qBAAqB,imXA4UjC,CAAC"}
+{"version":3,"file":"clang-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/clang-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIzD,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAyShC;AAybD,eAAO,MAAM,qBAAqB,imXA4UjC,CAAC"}

package/dist/runtime/clang-runner.js

@@ -25,6 +25,7 @@
  * Dispatch stays direct: no sleeps, no caller-side retries, and no
  * catch-and-continue around loader failures.
  */
+import { resolveVfsPath } from '../vfs/path.js';
 /** Build the runner factory. Closes over facetMgr + vfs. */
 export function makeClangRunnerFactory(deps) {
     const { facetMgr, vfs } = deps;
@@ -399,14 +400,6 @@ function parseUserArgv(argv) {
         outputPath, compileOnly, exitCode: 0,
     };
 }
-function resolveVfsPath(rel, cwd) {
-    const cwdN = cwd.replace(/^\/+/, '').replace(/\/+$/, '');
-    if (rel.startsWith('/'))
-        return rel.replace(/^\/+/, '');
-    if (rel === '.')
-        return cwdN;
-    return `${cwdN}/${rel}`;
-}
 /**
  * Recognise headers / inline-include files. The compile facet ships
  * these alongside the .c sources so `#include "foo.h"` (quote-form)

package/dist/runtime/esbuild-service.d.ts

@@ -39,8 +39,12 @@ import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
  *        esbuild's entry-point external check rejected the externals when
  *        passed at the top level. v5 cache entries are wrong (contain
  *        embedded react copies) and must be invalidated.
+ *   v7 — barrel-package bundles include a named-import signature in
+ *        pkg_esm_bundles.input_hash. Prevents reusing a lucide-react
+ *        bundle synthesized for one icon set after user source imports
+ *        additional icons.
  */
-export declare const BUNDLER_VERSION = "v6";
+export declare const BUNDLER_VERSION = "v7";
 /**
  * Returns the list of specifiers that must be marked `external` when bundling
  * `specifier` so that React / React-DOM / Scheduler share a single instance
@@ -118,13 +122,16 @@ export declare class EsbuildService {
      * fix this without rewriting upstream.
      *
      * Fix: when caller asks for format 'cjs' AND the source has a
-     * top-level await, wrap the source in an async IIFE:
+     * top-level await, wrap the source in an async IIFE and return its
+     * Promise to the facet runner:
      *
-     *     ;(async () => {
+     *     return (async () => {
      *       <original-source>
      *     })();
      *
-     * Inside the IIFE, await is legal.
+     * Inside the IIFE, await is legal. Returning the Promise is required:
+     * the facet runner awaits promise-returning entry functions so
+     * sequential TLA execution cannot race process teardown or VFS flushes.
      *
      * ESM-imports-in-CJS note (nuxt-esm-in-cjs wave):
      * ─────────────────────────────────────────────────
@@ -145,7 +152,7 @@ export declare class EsbuildService {
      *   2. Extract top-level imports from the pass-1 output and rewrite
      *      them as `const X = require(...)` shims (see
      *      `convertEsmImportsToRequire` for the contract / shape).
-     *   3. Wrap the remaining body in the async IIFE.
+     *   3. Wrap the remaining body in a returned async IIFE.
      *   4. Return the assembled string as the transform result.
      *
      * The require-shim emits the standard `__esModule` interop check

package/dist/runtime/esbuild-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-service.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA4DrE;AA0qBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IAC3C,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAA+B;gBAEnC,GAAG,EAAE,SAAS;IAI1B;;;;;;OAMG;YACW,UAAU;IAmExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;QACtD,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,eAAe,CAAC;IAqF3B;;OAEG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC;IA0CvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA4UrB,IAAI,aAAa,YAA+B;CACjD"}
+{"version":3,"file":"esbuild-service.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA4DrE;AAgrBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IAC3C,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAA+B;gBAEnC,GAAG,EAAE,SAAS;IAI1B;;;;;;OAMG;YACW,UAAU;IAmExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6DG;IACG,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;QACtD,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,eAAe,CAAC;IAsF3B;;OAEG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC;IA0CvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA4UrB,IAAI,aAAa,YAA+B;CACjD"}

package/dist/runtime/esbuild-service.js

@@ -40,8 +40,12 @@ import { normalizeVfsPath, stripLeadingSlashes } from '../vfs/path.js';
  *        esbuild's entry-point external check rejected the externals when
  *        passed at the top level. v5 cache entries are wrong (contain
  *        embedded react copies) and must be invalidated.
+ *   v7 — barrel-package bundles include a named-import signature in
+ *        pkg_esm_bundles.input_hash. Prevents reusing a lucide-react
+ *        bundle synthesized for one icon set after user source imports
+ *        additional icons.
  */
-export const BUNDLER_VERSION = 'v6';
+export const BUNDLER_VERSION = 'v7';
 // ── Shared-runtime externals ────────────────────────────────────────────
 /**
  * Returns the list of specifiers that must be marked `external` when bundling
@@ -277,6 +281,12 @@ function hasEsmImports(src) {
     const re = /^[ \t]*import\b(?!\s*\()/m;
     return re.test(stripped);
 }
+function hasEsmExports(src) {
+    if (!src || src.indexOf('export') === -1)
+        return false;
+    const stripped = stripCommentsAndStrings(src);
+    return /^[ \t]*export\b/m.test(stripped);
+}
 /**
  * Strip `//` and `/* * /` comments and string / template literals from
  * source, replacing each with a single space. The result is byte-aligned
@@ -929,13 +939,16 @@ export class EsbuildService {
      * fix this without rewriting upstream.
      *
      * Fix: when caller asks for format 'cjs' AND the source has a
-     * top-level await, wrap the source in an async IIFE:
+     * top-level await, wrap the source in an async IIFE and return its
+     * Promise to the facet runner:
      *
-     *     ;(async () => {
+     *     return (async () => {
      *       <original-source>
      *     })();
      *
-     * Inside the IIFE, await is legal.
+     * Inside the IIFE, await is legal. Returning the Promise is required:
+     * the facet runner awaits promise-returning entry functions so
+     * sequential TLA execution cannot race process teardown or VFS flushes.
      *
      * ESM-imports-in-CJS note (nuxt-esm-in-cjs wave):
      * ─────────────────────────────────────────────────
@@ -956,7 +969,7 @@ export class EsbuildService {
      *   2. Extract top-level imports from the pass-1 output and rewrite
      *      them as `const X = require(...)` shims (see
      *      `convertEsmImportsToRequire` for the contract / shape).
-     *   3. Wrap the remaining body in the async IIFE.
+     *   3. Wrap the remaining body in a returned async IIFE.
      *   4. Return the assembled string as the transform result.
      *
      * The require-shim emits the standard `__esModule` interop check
@@ -974,11 +987,12 @@ export class EsbuildService {
         await this.ensureInit();
         const format = options?.format || 'esm';
         const loader = options?.loader || 'ts';
-        // ── CJS + TLA + ESM imports: two-pass with import rewrite ──
-        // This precedes the simple TLA-only IIFE wrap. We test ESM imports
-        // first because the IIFE wrap is incompatible with them; if both
-        // conditions hold we MUST go through the rewrite path.
-        if (format === 'cjs' && hasTopLevelAwait(code) && hasEsmImports(code)) {
+        // ── CJS + TLA + ESM module syntax: two-pass with module rewrite ──
+        // This precedes the simple TLA-only IIFE wrap. We test ESM module
+        // syntax first because the IIFE wrap is incompatible with import
+        // and export statements; if both conditions hold we MUST go through
+        // the rewrite path.
+        if (format === 'cjs' && hasTopLevelAwait(code) && (hasEsmImports(code) || hasEsmExports(code))) {
             // Pass 1: emit ESM so esbuild accepts TLA + imports without complaint.
             // We use the same loader/target so TS/JSX is handled here too.
             const pass1 = await this._esbuild.transform(code, {
@@ -1005,9 +1019,9 @@ export class EsbuildService {
             });
             const { requires, body } = convertEsmImportsToRequire(pass1.code);
             const assembled = requires + '\n' +
-                ';(async () => {\n' +
+                'return (async () => {\n' +
                 body +
-                '\n})().catch((e) => { console.error(e && e.stack || e); });\n';
+                '\n})();\n';
             return {
                 code: assembled,
                 map: '',
@@ -1021,9 +1035,9 @@ export class EsbuildService {
         let sourceToTransform = code;
         if (format === 'cjs' && hasTopLevelAwait(code)) {
             sourceToTransform =
-                ';(async () => {\n' +
+                'return (async () => {\n' +
                     code +
-                    '\n})().catch((e) => { console.error(e && e.stack || e); });\n';
+                    '\n})();\n';
         }
         const result = await this._esbuild.transform(sourceToTransform, {
             loader,

package/dist/runtime/node-runner.d.ts

@@ -81,6 +81,8 @@ export interface RunFreshOpts {
     cwd?: string;
     filename?: string;
     dirname?: string;
+    stdin?: string;
+    captureOutput?: boolean;
     /** Display label for the long-running spawn. Defaults to the
      *  command + filename. Surfaced in the [started (long-running)]
      *  notice + /api/processes listing. */

package/dist/runtime/node-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/node-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,sBAAsB,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAO/D;AAED,mCAAmC;AACnC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;2CAEuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6CD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CA8DzB;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,iBAAW,CAAC"}
+{"version":3,"file":"node-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/node-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,sBAAsB,CAAC;AAG1E;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAO/D;AAED,mCAAmC;AACnC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;2CAEuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6CD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CA8DzB;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,iBAAW,CAAC"}

package/dist/runtime/node-shims.d.ts

@@ -17,8 +17,10 @@
  *   - child_process: ChildProcess objects (execution requires supervisor RPC)
  *   - assert, util, url, querystring, string_decoder, readline, tty, timers
  *
- * VFS access: reads from __vfsBundle (pre-bundled by FacetManager),
- * writes to __vfsWrites (flushed back to VFS on completion).
+ * VFS access: sync reads use __vfsBundle (pre-bundled by FacetManager);
+ * async reads and common async mutations can use the supervisor bridge for
+ * live SQLite VFS coherence. Sync writes stay in __vfsWrites and flush on
+ * completion.
  */
 export declare function generateShimsCode(): string;
 //# sourceMappingURL=node-shims.d.ts.map

package/dist/runtime/node-shims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA2BH,wBAAgB,iBAAiB,IAAI,MAAM,CAu4F1C"}
+{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA2BH,wBAAgB,iBAAiB,IAAI,MAAM,CAkuG1C"}