@openclaw/imessage 0.0.0 → 2026.8.1-beta.2

package/dist/sanitize-outbound-CoTZLXMw.js

@@ -0,0 +1,896 @@
+import { u as expandIMessageUserPath } from "./accounts-D00Njxg2.js";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveUserPath } from "openclaw/plugin-sdk/text-utility-runtime";
+import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { FormatCapabilityProfile, findCodeRegions, isInsideCode, markdownToIR, renderMarkdownWithAttributedRanges, sanitizeAssistantVisibleText, stripMarkdown, tokenizeHtmlTags } from "openclaw/plugin-sdk/text-chunking";
+//#region extensions/imessage/src/constants.ts
+/** Default timeout for iMessage probe/RPC operations (10 seconds). */
+const DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS = 1e4;
+const DEFAULT_IMESSAGE_SEND_TIMEOUT_MS = 18e4;
+//#endregion
+//#region extensions/imessage/src/client.ts
+var IMessageRpcRequestError = class extends Error {
+	constructor(message, code, data) {
+		super(message);
+		this.code = code;
+		this.data = data;
+		this.name = "IMessageRpcRequestError";
+	}
+};
+const PUBLIC_IMESSAGE_FULL_DISK_ACCESS_ERROR = "imsg cannot access ~/Library/Messages/chat.db. Grant Full Disk Access to the Gateway/launcher process and restart Gateway.";
+const IMESSAGE_RPC_CLOSE_GRACE_MS = 500;
+function isTestEnv() {
+	const vitest = normalizeLowercaseStringOrEmpty(process.env.VITEST);
+	return Boolean(vitest);
+}
+function normalizeIMessageFullDiskAccessError(message) {
+	const normalized = normalizeLowercaseStringOrEmpty(message);
+	if (!normalized.includes("full disk access") || !normalized.includes("chat.db")) return;
+	return PUBLIC_IMESSAGE_FULL_DISK_ACCESS_ERROR;
+}
+var IMessageRpcClient = class {
+	constructor(opts = {}) {
+		this.pending = /* @__PURE__ */ new Map();
+		this.terminalResolve = null;
+		this.reapedResolve = null;
+		this.isReaped = false;
+		this.child = null;
+		this.stopPromise = null;
+		this.stdoutBuffer = "";
+		this.stdoutDecoder = new StringDecoder("utf8");
+		this.stderrBuffer = "";
+		this.stderrDecoder = new StringDecoder("utf8");
+		this.nextId = 1;
+		this.publicProcessError = null;
+		this.cliPath = expandIMessageUserPath(opts.cliPath?.trim() || "imsg");
+		const dbPath = opts.dbPath?.trim();
+		this.dbPath = dbPath ? opts.remoteHost?.trim() ? dbPath : resolveUserPath(dbPath) : void 0;
+		this.runtime = opts.runtime;
+		this.onNotification = opts.onNotification;
+		this.terminal = new Promise((resolve) => {
+			this.terminalResolve = resolve;
+		});
+		this.reaped = new Promise((resolve) => {
+			this.reapedResolve = resolve;
+		});
+	}
+	async start() {
+		if (this.child) return;
+		if (isTestEnv()) throw new Error("Refusing to start imsg rpc in test environment; mock iMessage RPC client");
+		const args = ["rpc", "--json"];
+		if (this.dbPath) args.push("--db", this.dbPath);
+		const child = spawn(this.cliPath, args, { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		this.child = child;
+		child.stdout.on("data", (chunk) => {
+			if (this.child !== child) return;
+			this.handleStdoutChunk(chunk);
+		});
+		child.stderr?.on("data", (chunk) => {
+			if (this.child !== child) return;
+			this.handleStderrChunk(chunk);
+		});
+		const failFromProcessError = (err) => this.failTransport(err, child);
+		child.on("error", failFromProcessError);
+		child.stdin.on("error", failFromProcessError);
+		child.stdout.on("error", failFromProcessError);
+		child.stderr.on("error", failFromProcessError);
+		child.on("close", (code, signal) => {
+			if (this.child === child) {
+				this.flushStdoutBuffer();
+				this.flushStderrBuffer();
+				this.child = null;
+			}
+			this.finish(this.buildCloseError(code, signal));
+			this.markReaped();
+		});
+	}
+	async stop() {
+		if (this.stopPromise) return await this.stopPromise;
+		const child = this.child;
+		if (!child) return;
+		this.stopPromise = this.stopChild(child);
+		return await this.stopPromise;
+	}
+	async waitForClose() {
+		throw await this.terminal;
+	}
+	async request(method, params, opts) {
+		if (!this.child || !this.child.stdin) throw new Error("imsg rpc not running");
+		const id = this.nextId++;
+		const line = `${JSON.stringify({
+			jsonrpc: "2.0",
+			id,
+			method,
+			params: params ?? {}
+		})}\n`;
+		const timeoutMs = opts?.timeoutMs ?? 1e4;
+		const response = new Promise((resolve, reject) => {
+			const key = String(id);
+			const timer = timeoutMs > 0 ? setTimeout(() => {
+				this.pending.delete(key);
+				reject(/* @__PURE__ */ new Error(`imsg rpc timeout (${method})`));
+			}, timeoutMs) : void 0;
+			this.pending.set(key, {
+				resolve: (value) => resolve(value),
+				reject,
+				timer
+			});
+		});
+		try {
+			this.child.stdin.write(line, (err) => {
+				if (err) this.failTransport(err, this.child);
+			});
+		} catch (err) {
+			this.failTransport(err, this.child);
+		}
+		return await response;
+	}
+	async stopChild(child) {
+		try {
+			child.stdin.end();
+		} catch (err) {
+			this.failTransport(err, child);
+		}
+		if (await this.waitForReap(IMESSAGE_RPC_CLOSE_GRACE_MS)) return;
+		this.signalChild(child, "SIGTERM");
+		if (await this.waitForReap(IMESSAGE_RPC_CLOSE_GRACE_MS)) return;
+		this.signalChild(child, "SIGKILL");
+		if (!await this.waitForReap(IMESSAGE_RPC_CLOSE_GRACE_MS)) throw new Error("imsg rpc did not exit after SIGKILL");
+	}
+	async waitForReap(timeoutMs) {
+		if (this.isReaped) return true;
+		let timer;
+		try {
+			return await Promise.race([this.reaped.then(() => true), new Promise((resolve) => {
+				timer = setTimeout(() => resolve(false), timeoutMs);
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+	signalChild(child, signal) {
+		try {
+			child.kill(signal);
+		} catch {}
+	}
+	failTransport(err, child) {
+		if (!this.finish(err instanceof Error ? err : new Error(String(err)))) return;
+		if (child) this.signalChild(child, "SIGTERM");
+	}
+	handleStdoutChunk(chunk) {
+		const text = typeof chunk === "string" ? chunk : this.stdoutDecoder.write(chunk);
+		this.stdoutBuffer += text;
+		let newlineIndex = this.stdoutBuffer.indexOf("\n");
+		while (newlineIndex !== -1) {
+			const line = this.stdoutBuffer.slice(0, newlineIndex);
+			this.stdoutBuffer = this.stdoutBuffer.slice(newlineIndex + 1);
+			this.handleStdoutLine(line);
+			newlineIndex = this.stdoutBuffer.indexOf("\n");
+		}
+	}
+	flushStdoutBuffer() {
+		const tail = this.stdoutDecoder.end();
+		if (tail) this.stdoutBuffer += tail;
+		if (!this.stdoutBuffer) return;
+		const line = this.stdoutBuffer;
+		this.stdoutBuffer = "";
+		this.handleStdoutLine(line);
+	}
+	handleStdoutLine(line) {
+		const trimmed = line.trim();
+		if (!trimmed) return;
+		this.handleLine(trimmed);
+	}
+	handleStderrChunk(chunk) {
+		const text = typeof chunk === "string" ? chunk : this.stderrDecoder.write(chunk);
+		this.stderrBuffer += text;
+		let newlineIndex = this.stderrBuffer.indexOf("\n");
+		while (newlineIndex !== -1) {
+			const line = this.stderrBuffer.slice(0, newlineIndex);
+			this.stderrBuffer = this.stderrBuffer.slice(newlineIndex + 1);
+			this.handleStderrLine(line);
+			newlineIndex = this.stderrBuffer.indexOf("\n");
+		}
+	}
+	flushStderrBuffer() {
+		this.stderrBuffer += this.stderrDecoder.end();
+		if (!this.stderrBuffer) return;
+		const line = this.stderrBuffer;
+		this.stderrBuffer = "";
+		this.handleStderrLine(line);
+	}
+	handleStderrLine(line) {
+		const trimmed = line.trim();
+		if (!trimmed) return;
+		this.recordProcessDiagnostic(trimmed);
+		this.runtime?.error?.(`imsg rpc: ${trimmed}`);
+	}
+	handleLine(line) {
+		let parsed;
+		try {
+			parsed = JSON.parse(line);
+		} catch (err) {
+			this.recordProcessDiagnostic(line);
+			const detail = formatErrorMessage(err);
+			this.runtime?.error?.(`imsg rpc: failed to parse ${line}: ${detail}`);
+			return;
+		}
+		if (parsed.id !== void 0 && parsed.id !== null) {
+			const key = String(parsed.id);
+			const pending = this.pending.get(key);
+			if (!pending) return;
+			if (pending.timer) clearTimeout(pending.timer);
+			this.pending.delete(key);
+			if (parsed.error) {
+				const baseMessage = parsed.error.message ?? "imsg rpc error";
+				const details = parsed.error.data;
+				const code = parsed.error.code;
+				const suffixes = [];
+				if (typeof code === "number") suffixes.push(`code=${code}`);
+				if (details !== void 0) {
+					const detailText = typeof details === "string" ? details : JSON.stringify(details, null, 2);
+					if (detailText) suffixes.push(detailText);
+				}
+				const msg = suffixes.length > 0 ? `${baseMessage}: ${suffixes.join(" ")}` : baseMessage;
+				pending.reject(new IMessageRpcRequestError(msg, typeof code === "number" ? code : void 0, details));
+				return;
+			}
+			pending.resolve(parsed.result);
+			return;
+		}
+		if (parsed.method) this.onNotification?.({
+			method: parsed.method,
+			params: parsed.params
+		});
+	}
+	recordProcessDiagnostic(line) {
+		this.publicProcessError ??= normalizeIMessageFullDiskAccessError(line) ?? null;
+	}
+	buildCloseError(code, signal) {
+		if (this.publicProcessError) return new Error(this.publicProcessError);
+		if (code !== 0 && code !== null) {
+			const reason = signal ? `signal ${signal}` : `code ${code}`;
+			return /* @__PURE__ */ new Error(`imsg rpc exited (${reason})`);
+		}
+		return /* @__PURE__ */ new Error("imsg rpc closed");
+	}
+	failAll(err) {
+		for (const [key, pending] of this.pending.entries()) {
+			if (pending.timer) clearTimeout(pending.timer);
+			pending.reject(err);
+			this.pending.delete(key);
+		}
+	}
+	finish(err) {
+		const resolve = this.terminalResolve;
+		if (!resolve) return false;
+		this.terminalResolve = null;
+		this.failAll(err);
+		resolve(err);
+		return true;
+	}
+	markReaped() {
+		if (this.isReaped) return;
+		this.isReaped = true;
+		const resolve = this.reapedResolve;
+		this.reapedResolve = null;
+		resolve?.();
+	}
+};
+async function createIMessageRpcClient(opts = {}) {
+	const client = new IMessageRpcClient(opts);
+	await client.start();
+	return client;
+}
+//#endregion
+//#region extensions/imessage/src/markdown-format.ts
+const IMESSAGE_FORMAT_PROFILE = FormatCapabilityProfile.define({
+	mechanism: "ranges",
+	constructs: {
+		spoiler: "strip",
+		codeInline: "fallback",
+		codeBlock: "fallback",
+		codeLanguage: "strip",
+		linkLabel: "fallback",
+		heading: "fallback",
+		bulletList: "fallback",
+		orderedList: "fallback",
+		taskList: "fallback",
+		table: "fallback",
+		blockquote: "fallback",
+		image: "fallback",
+		mention: "strip"
+	},
+	chunk: {
+		limit: 4e3,
+		unit: "utf16"
+	}
+});
+const IMESSAGE_CODE_PROFILE = FormatCapabilityProfile.define({
+	...IMESSAGE_FORMAT_PROFILE,
+	constructs: {
+		...IMESSAGE_FORMAT_PROFILE.constructs,
+		codeInline: "native"
+	}
+});
+const IMESSAGE_STYLE_MAP = {
+	bold: "bold",
+	italic: "italic",
+	underline: "underline",
+	strikethrough: "strikethrough"
+};
+function codeDelimiter(content) {
+	const longestRun = Math.max(0, ...[...content.matchAll(/`+/gu)].map((match) => match[0].length));
+	return "`".repeat(longestRun + 1);
+}
+function protectDunderIdentifiers(input) {
+	const protections = [];
+	let markdown = "";
+	let cursor = 0;
+	for (const match of input.matchAll(/__[\p{L}_][\p{L}\p{N}_]*__/gu)) {
+		const identifier = match[0];
+		const start = match.index ?? 0;
+		const end = start + identifier.length;
+		const before = input[start - 1];
+		const beforeBefore = input[start - 2];
+		const after = input[end];
+		const member = before === ".";
+		const call = after === "(";
+		const functionArgument = before === "(" && /[\p{L}\p{N}_]/u.test(beforeBefore ?? "");
+		if (!member && !call && !functionArgument && !(after === "[")) continue;
+		let token = `OCdunder${protections.length}token`;
+		while (input.includes(token)) token += "x";
+		markdown += input.slice(cursor, start) + token;
+		protections.push({
+			token,
+			identifier
+		});
+		cursor = end;
+	}
+	return {
+		markdown: markdown + input.slice(cursor),
+		protections
+	};
+}
+function applyTextEdits(text, edits) {
+	const ordered = edits.toSorted((left, right) => left.start - right.start);
+	let rendered = "";
+	let cursor = 0;
+	for (const edit of ordered) {
+		rendered += text.slice(cursor, edit.start) + edit.text;
+		cursor = edit.end;
+	}
+	rendered += text.slice(cursor);
+	return {
+		text: rendered,
+		mapOffset: (offset) => offset + ordered.reduce((delta, edit) => delta + (edit.end <= offset ? edit.text.length - edit.end + edit.start : 0), 0)
+	};
+}
+function restoreDunderIdentifiers(text, ranges, codeRanges, protections) {
+	const edited = applyTextEdits(text, protections.flatMap((protection) => {
+		const start = text.indexOf(protection.token);
+		return start === -1 ? [] : [{
+			start,
+			end: start + protection.token.length,
+			text: protection.identifier
+		}];
+	}));
+	const mapRange = (range) => ({
+		...range,
+		start: edited.mapOffset(range.start),
+		length: edited.mapOffset(range.start + range.length) - edited.mapOffset(range.start)
+	});
+	return {
+		text: edited.text,
+		ranges: ranges.map(mapRange),
+		codeRanges: codeRanges.map(mapRange)
+	};
+}
+function restoreCodeMarkers(text, ranges, codeRanges) {
+	const edited = applyTextEdits(text, codeRanges.map((range) => {
+		const end = range.start + range.length;
+		const content = text.slice(range.start, end);
+		const marker = codeDelimiter(content);
+		const padding = content.startsWith("`") || content.endsWith("`") ? " " : "";
+		return {
+			start: range.start,
+			end,
+			text: `${marker}${padding}${content}${padding}${marker}`
+		};
+	}));
+	return {
+		text: edited.text,
+		ranges: ranges.map((range) => ({
+			...range,
+			start: edited.mapOffset(range.start),
+			length: edited.mapOffset(range.start + range.length) - edited.mapOffset(range.start)
+		}))
+	};
+}
+function extractMarkdownFormatRuns(input) {
+	const protectedDunders = protectDunderIdentifiers(input);
+	const ir = markdownToIR(protectedDunders.markdown, {
+		autolink: false,
+		enableHtmlUnderline: true,
+		headingStyle: "rich",
+		linkify: false,
+		preserveSourceBlockSpacing: true
+	});
+	const rendered = renderMarkdownWithAttributedRanges(ir, { styleMap: IMESSAGE_STYLE_MAP }, IMESSAGE_FORMAT_PROFILE);
+	const code = renderMarkdownWithAttributedRanges(ir, { styleMap: { code: "code" } }, IMESSAGE_CODE_PROFILE);
+	const dunders = restoreDunderIdentifiers(rendered.text, rendered.ranges.map(({ start, length, style }) => ({
+		start,
+		length,
+		styles: [style]
+	})), code.ranges, protectedDunders.protections);
+	return restoreCodeMarkers(dunders.text, dunders.ranges, dunders.codeRanges);
+}
+//#endregion
+//#region extensions/imessage/src/monitor/sanitize-outbound.ts
+/**
+* Patterns that indicate assistant-internal metadata leaked into text.
+* These must never reach a user-facing channel.
+*/
+const INTERNAL_SEPARATOR_RE = /(?:#\+){2,}#?/g;
+const ASSISTANT_ROLE_MARKER_RE = /\bassistant\s+to\s*=\s*\w+/gi;
+const ROLE_TURN_MARKER_RE = /^[ \t]*(?:>[ \t]*)*(?:user|system|assistant)[ \t]*:[ \t]*(?=\r?$)/gim;
+const FENCED_ROLE_MARKER_RE = /^[ \t]*(user|system|assistant)[ \t]*:[ \t]*(?=\r?$)/gim;
+const FINAL_PRIVATE_MARKER_RE = /(?:#\+){2,}#?|\bassistant\s+to\s*=\s*\w+|^[ \t]*(?:user|system|assistant)[ \t]*:[ \t]*(?=\r?$)/gim;
+const PRIVATE_USE_START = 57344;
+const PRIVATE_USE_END = 63743;
+const MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES = 32;
+const PLAIN_TEXT_HTML_TAG_RE = /<\/?[a-z][a-z0-9_-]*\b[^>]*>/gi;
+const PRIVATE_PROVIDER_TAG_NAMES = [
+	"think",
+	"thinking",
+	"thought",
+	"reasoning",
+	"antthinking",
+	"antml:think",
+	"antml:thinking",
+	"antml:thought",
+	"antml:reasoning",
+	"mm:think",
+	"mm:thinking",
+	"mm:thought",
+	"mm:reasoning",
+	"relevant_memories",
+	"relevant-memories",
+	"tool_call",
+	"tool_result",
+	"function_call",
+	"function_calls",
+	"function_response",
+	"function",
+	"tool_calls",
+	"antml:invoke",
+	"antml:parameter",
+	"invoke",
+	"parameter"
+];
+const PRIVATE_PROVIDER_TAG_NAME_SET = new Set(PRIVATE_PROVIDER_TAG_NAMES);
+const OPAQUE_PRIVATE_RUNTIME_CONTEXT_BLOCK_RE = /^<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>(?:(?!<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>)[\s\S])*<<<END_OPENCLAW_INTERNAL_CONTEXT>>>/;
+const PRIVATE_RUNTIME_CONTEXT_BLOCK_RE = /<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>(?:(?!<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>)[\s\S])*<<<END_OPENCLAW_INTERNAL_CONTEXT>>>/g;
+const NESTED_PRIVATE_MARKUP_START_RE = /<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>|<\s*\/?\s*[A-Za-z][A-Za-z0-9_.:-]*(?=\s|\/?>)/g;
+const OUTER_PRIVATE_TAG_FRAGMENT_RE = /^\s*\/?\s*([a-z][a-z0-9_.:-]*)?$/i;
+const OPAQUE_PRIVATE_MARKUP_BLOCK_RE = /^<\s*(system-reminder|previous_response|details|summary)\b[^>]*>[\s\S]*?<\s*\/\s*\1\s*>/i;
+const REMOVABLE_PRIVATE_MARKUP_TAG_RE = /^<\s*\/?\s*[a-z][a-z0-9_.:-]*(?=\s|\/?>)[^>]*>/i;
+const PRIVATE_PROVIDER_TAG_FRAGMENT_RE = /^[a-z0-9_.:-]*/i;
+const PRIVATE_RUNTIME_SCAFFOLDING_TAG_TOKEN_RE = /<\s*(\/?)\s*(system-reminder|previous_response)\b/gi;
+function assertSafeIMessageOutboundMarkup(text) {
+	for (const nested of text.matchAll(NESTED_PRIVATE_MARKUP_START_RE)) {
+		const nestedStart = nested.index ?? 0;
+		const outerStart = text.lastIndexOf("<", nestedStart - 1);
+		if (outerStart < 0) continue;
+		const outer = OUTER_PRIVATE_TAG_FRAGMENT_RE.exec(text.slice(outerStart + 1, nestedStart));
+		if (!outer) continue;
+		let candidate = (outer[1] ?? "").toLowerCase();
+		if (!PRIVATE_PROVIDER_TAG_NAMES.some((name) => name.startsWith(candidate))) continue;
+		let cursor = nestedStart;
+		for (let depth = 0; depth < MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES; depth += 1) {
+			const remaining = text.slice(cursor);
+			const removed = OPAQUE_PRIVATE_RUNTIME_CONTEXT_BLOCK_RE.exec(remaining)?.[0] ?? OPAQUE_PRIVATE_MARKUP_BLOCK_RE.exec(remaining)?.[0] ?? REMOVABLE_PRIVATE_MARKUP_TAG_RE.exec(remaining)?.[0];
+			if (!removed) break;
+			cursor += removed.length;
+			const suffix = PRIVATE_PROVIDER_TAG_FRAGMENT_RE.exec(text.slice(cursor))?.[0] ?? "";
+			candidate += suffix.toLowerCase();
+			cursor += suffix.length;
+			if (PRIVATE_PROVIDER_TAG_NAME_SET.has(candidate) && /[\s/>]/.test(text.charAt(cursor))) throw new Error("iMessage outbound ambiguous nested HTML is not allowed");
+			if (!PRIVATE_PROVIDER_TAG_NAMES.some((name) => name.startsWith(candidate))) break;
+			if (depth + 1 >= MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES && (OPAQUE_PRIVATE_RUNTIME_CONTEXT_BLOCK_RE.test(text.slice(cursor)) || REMOVABLE_PRIVATE_MARKUP_TAG_RE.test(text.slice(cursor)))) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+		}
+	}
+}
+function stripIMessageBalancedPrivateRuntimeBlocks(text, verifyProtectedRoles) {
+	const openBlocks = [];
+	const completedBlocks = [];
+	const codeRegions = findCodeRegions(text);
+	const parsedHtmlTags = [...tokenizeHtmlTags(text)];
+	const htmlTags = parsedHtmlTags.map(({ start, end }) => ({
+		start,
+		end,
+		terminated: true
+	}));
+	const rawTextHtml = [];
+	const rawTextTagNames = /* @__PURE__ */ new Set([
+		"script",
+		"style",
+		"textarea",
+		"title",
+		"xmp",
+		"iframe",
+		"noembed",
+		"noframes",
+		"noscript",
+		"plaintext"
+	]);
+	for (const [index, opener] of parsedHtmlTags.entries()) {
+		if (opener.closing || !rawTextTagNames.has(opener.name)) continue;
+		const closing = opener.name === "plaintext" ? void 0 : parsedHtmlTags.slice(index + 1).find((candidate) => {
+			return candidate.closing && candidate.name === opener.name;
+		});
+		rawTextHtml.push({
+			start: opener.start,
+			end: closing?.end ?? text.length,
+			terminated: Boolean(closing)
+		});
+		if (rawTextHtml.length > MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 2) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+	}
+	const opaqueHtml = [];
+	for (let cursor = 0; cursor < text.length;) {
+		const start = text.indexOf("<", cursor);
+		if (start < 0) break;
+		const enclosingTag = htmlTags.find((tag) => tag.start < start && start < tag.end);
+		if (enclosingTag) {
+			cursor = enclosingTag.end;
+			continue;
+		}
+		let end = -1;
+		let delimiterLength = 0;
+		if (text.startsWith("<!--", start)) {
+			end = text.indexOf("-->", start + 4);
+			delimiterLength = 3;
+		} else if (/^<!\[CDATA\[/i.test(text.slice(start, start + 9))) {
+			end = text.indexOf("]]>", start + 9);
+			delimiterLength = 3;
+		} else if (text.startsWith("<?", start)) {
+			let quote;
+			for (let index = start + 2; index < text.length - 1; index += 1) {
+				const character = text[index];
+				if (quote) {
+					if (character === quote) quote = void 0;
+				} else if (character === "'" || character === "\"") quote = character;
+				else if (character === "?" && text[index + 1] === ">") {
+					end = index;
+					delimiterLength = 2;
+					break;
+				}
+			}
+		} else if (/^<![a-z][a-z0-9_.:-]*\b/i.test(text.slice(start))) {
+			let quote;
+			let bracketDepth = 0;
+			for (let index = start + 2; index < text.length; index += 1) {
+				const character = text[index];
+				if (quote) {
+					if (character === quote) quote = void 0;
+				} else if (character === "'" || character === "\"") quote = character;
+				else if (character === "[") bracketDepth += 1;
+				else if (character === "]" && bracketDepth > 0) bracketDepth -= 1;
+				else if (character === ">" && bracketDepth === 0) {
+					end = index;
+					delimiterLength = 1;
+					break;
+				}
+			}
+		} else if (text.startsWith("<!", start) || text.startsWith("</", start) && start + 2 < text.length && !/[A-Za-z>]/.test(text[start + 2] ?? "")) {
+			end = text.indexOf(">", start + 2);
+			delimiterLength = 1;
+		} else {
+			cursor = start + 1;
+			continue;
+		}
+		if (opaqueHtml.length >= MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 2) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+		const terminated = end >= 0;
+		const regionEnd = terminated ? end + delimiterLength : text.length;
+		opaqueHtml.push({
+			start,
+			end: regionEnd,
+			terminated
+		});
+		cursor = regionEnd;
+	}
+	htmlTags.push(...opaqueHtml);
+	htmlTags.sort((left, right) => left.start - right.start || right.end - left.end);
+	let htmlTagIndex = 0;
+	let scannedTags = 0;
+	let scannedThrough = 0;
+	for (const token of text.matchAll(PRIVATE_RUNTIME_SCAFFOLDING_TAG_TOKEN_RE)) {
+		const start = token.index ?? 0;
+		if (start < scannedThrough) continue;
+		while ((htmlTags[htmlTagIndex]?.end ?? 0) <= start && htmlTagIndex < htmlTags.length) htmlTagIndex += 1;
+		const enclosingHtmlTag = htmlTags[htmlTagIndex];
+		if (enclosingHtmlTag && enclosingHtmlTag.start < start && start < enclosingHtmlTag.end) continue;
+		const codeRegion = codeRegions.find((region) => isInsideCode(start, [region]));
+		const enclosingBlock = openBlocks.at(-1);
+		const enclosingRawText = rawTextHtml.find((region) => {
+			return region.start < start && start < region.end;
+		});
+		if (enclosingBlock && enclosingRawText && enclosingBlock.start < enclosingRawText.start) {
+			enclosingBlock.sawNested = true;
+			continue;
+		}
+		if (enclosingBlock && codeRegion && enclosingBlock.codeRegion !== codeRegion) {
+			enclosingBlock.sawNested = true;
+			continue;
+		}
+		if (enclosingBlock?.codeRegion && enclosingBlock.codeRegion !== codeRegion) throw new Error("iMessage outbound runtime scaffolding is malformed");
+		if (++scannedTags > MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 2) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+		let quote;
+		let end = start + token[0].length;
+		for (; end < text.length; end += 1) {
+			if (end - start > MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 2) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+			const character = text[end];
+			if (quote) {
+				if (character === quote) quote = void 0;
+			} else if (character === "'" || character === "\"") quote = character;
+			else if (character === "<") throw new Error("iMessage outbound runtime scaffolding is malformed");
+			else if (character === ">") break;
+		}
+		if (end >= text.length || quote) throw new Error("iMessage outbound runtime scaffolding is malformed");
+		end += 1;
+		if (enclosingBlock?.codeRegion && enclosingBlock.codeRegion === codeRegion) {
+			if (!enclosingBlock.nestedCodeRegions) {
+				if (codeRegion.end - enclosingBlock.end > MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 3) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+				enclosingBlock.nestedCodeRegions = findCodeRegions(text.slice(enclosingBlock.end, codeRegion.end));
+				if (enclosingBlock.nestedCodeRegions.length > MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES ** 2) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+			}
+			if (isInsideCode(start - enclosingBlock.end, enclosingBlock.nestedCodeRegions)) {
+				enclosingBlock.sawNested = true;
+				continue;
+			}
+		}
+		scannedThrough = end;
+		const markup = text.slice(start, end);
+		const closing = token[1] === "/";
+		if (!closing && /\/\s*>$/.test(markup)) {
+			const parent = openBlocks.at(-1);
+			if (parent) parent.sawNested = true;
+			else completedBlocks.push({
+				start,
+				end
+			});
+			continue;
+		}
+		const name = (token[2] ?? "").toLowerCase();
+		if (!closing) {
+			if (openBlocks.length >= MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES) throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+			const parent = openBlocks.at(-1);
+			if (parent) parent.sawNested = true;
+			openBlocks.push({
+				name,
+				start,
+				end,
+				sawNested: false,
+				codeRegion
+			});
+			continue;
+		}
+		const opening = openBlocks.at(-1);
+		if (!opening) {
+			completedBlocks.push({
+				start,
+				end
+			});
+			continue;
+		}
+		if (opening.name !== name) throw new Error("iMessage outbound runtime scaffolding is malformed");
+		openBlocks.pop();
+		completedBlocks.push({
+			start: opening.start,
+			end
+		});
+	}
+	if (openBlocks.length > 1 || openBlocks[0]?.sawNested || openBlocks[0] && [...opaqueHtml, ...rawTextHtml].some((region) => !region.terminated && openBlocks[0].start < region.start)) throw new Error("iMessage outbound runtime scaffolding is malformed");
+	const orphan = openBlocks[0];
+	if (orphan) completedBlocks.push({
+		start: orphan.start,
+		end: orphan.end
+	});
+	completedBlocks.sort((left, right) => left.start - right.start || right.end - left.end);
+	const outermost = [];
+	for (const block of completedBlocks) {
+		const previous = outermost.at(-1);
+		if (!previous || block.start >= previous.end) outermost.push(block);
+	}
+	let current = text;
+	for (const block of outermost.toReversed()) {
+		verifyProtectedRoles?.(current);
+		const stripped = current.slice(0, block.start) + current.slice(block.end);
+		assertSafeIMessageOutboundMarkup(stripped);
+		verifyProtectedRoles?.(stripped);
+		current = stripped;
+	}
+	return current;
+}
+function stripIMessagePrivateRuntimeScaffolding(text, verifyProtectedRoles) {
+	assertSafeIMessageOutboundMarkup(text);
+	let current = text;
+	for (let depth = 0; depth < MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES; depth += 1) {
+		let changed = false;
+		for (const strip of [(value) => value.replace(PRIVATE_RUNTIME_CONTEXT_BLOCK_RE, ""), (value) => stripIMessageBalancedPrivateRuntimeBlocks(value, verifyProtectedRoles)]) {
+			verifyProtectedRoles?.(current);
+			const stripped = strip(current);
+			assertSafeIMessageOutboundMarkup(stripped);
+			verifyProtectedRoles?.(stripped);
+			if (stripped !== current) {
+				current = stripped;
+				changed = true;
+			}
+		}
+		if (!changed) return current;
+	}
+	throw new Error("iMessage outbound runtime scaffolding exceeded its limit");
+}
+function sanitizeIMessageAssistantVisibleText(text, verifyProtectedRoles) {
+	const cleaned = stripIMessagePrivateRuntimeScaffolding(text, verifyProtectedRoles);
+	if (!text.trim()) return text;
+	const leadingWhitespace = /^\s*/u.exec(text)?.[0] ?? "";
+	const trailingWhitespace = /\s*$/u.exec(text)?.[0] ?? "";
+	verifyProtectedRoles?.(cleaned);
+	const canonical = cleaned.trim();
+	verifyProtectedRoles?.(canonical);
+	const visible = sanitizeAssistantVisibleText(canonical);
+	verifyProtectedRoles?.(visible);
+	return visible ? `${leadingWhitespace}${visible}${trailingWhitespace}` : "";
+}
+function isClosedFencedCodeRegion(text, region) {
+	const lineStart = text.lastIndexOf("\n", region.start - 1) + 1;
+	if (!/^ {0,3}$/.test(text.slice(lineStart, region.start))) return false;
+	const source = text.slice(region.start, region.end);
+	const openingFence = /^ {0,3}(`{3,}|~{3,})[^\r\n]*\r?\n/.exec(source)?.[1];
+	if (!openingFence) return false;
+	const closingFence = new RegExp(`\r?\n {0,3}${openingFence[0]}{${openingFence.length},}[\t ]*(?:\r?\n)?$`);
+	const lineEnd = text.indexOf("\n", region.end);
+	return closingFence.test(source) && /^[\t ]*\r?$/.test(text.slice(region.end, lineEnd < 0 ? text.length : lineEnd));
+}
+/** Preserve authenticated fenced role mappings through the final native-render scrub. */
+function protectIMessageFencedRoleMarkers(text) {
+	const source = stripIMessagePrivateRuntimeScaffolding(text);
+	const closedFencedRegions = findCodeRegions(source).filter((region) => isClosedFencedCodeRegion(source, region));
+	const protectedRoles = /* @__PURE__ */ new Map();
+	let privateUseCodePoint = PRIVATE_USE_START;
+	const protectedText = source.replace(FENCED_ROLE_MARKER_RE, (marker, role, offset) => {
+		if (!isInsideCode(offset, closedFencedRegions)) return marker;
+		while (privateUseCodePoint <= PRIVATE_USE_END) {
+			const protectedGlyph = String.fromCharCode(privateUseCodePoint++);
+			const token = protectedGlyph.repeat(role.length);
+			if (text.includes(protectedGlyph) || protectedRoles.has(token)) continue;
+			protectedRoles.set(token, role);
+			return marker.replace(role, token);
+		}
+		throw new Error("iMessage outbound role protection is unavailable");
+	});
+	const verifyProtectedRoles = (visible) => {
+		assertSafeIMessageOutboundMarkup(visible);
+		let previous = -1;
+		for (const token of protectedRoles.keys()) {
+			const first = visible.indexOf(token);
+			if (first < 0 || first < previous || visible.includes(token, first + token.length)) throw new Error("iMessage outbound role protection failed");
+			for (let offset = visible.indexOf(token[0] ?? ""); offset >= 0;) {
+				if (offset < first || offset >= first + token.length) throw new Error("iMessage outbound role protection failed");
+				offset = visible.indexOf(token[0] ?? "", offset + 1);
+			}
+			previous = first + token.length;
+		}
+	};
+	return {
+		text: protectedText,
+		verifyProtectedRoles,
+		sanitizeFormatted: (formatted) => {
+			verifyProtectedRoles(formatted.text);
+			let visible = formatted.text;
+			let ranges = formatted.ranges;
+			for (let remainingPasses = visible.length;; remainingPasses--) {
+				verifyProtectedRoles(visible);
+				const assistantVisible = sanitizeIMessageAssistantVisibleText(visible, verifyProtectedRoles);
+				const assistantTextChanged = assistantVisible !== visible;
+				if (assistantTextChanged) {
+					visible = assistantVisible;
+					ranges = [];
+					verifyProtectedRoles(visible);
+				}
+				const removed = [];
+				const cleaned = visible.replace(FINAL_PRIVATE_MARKER_RE, (marker, offset) => {
+					removed.push({
+						start: offset,
+						end: offset + marker.length
+					});
+					return "";
+				});
+				if (removed.length > 0) {
+					const mapOffset = (offset) => offset - removed.reduce((total, edit) => total + Math.max(0, Math.min(offset, edit.end) - edit.start), 0);
+					ranges = ranges.flatMap((range) => {
+						const start = mapOffset(range.start);
+						const length = mapOffset(range.start + range.length) - start;
+						return length > 0 ? [{
+							...range,
+							start,
+							length
+						}] : [];
+					});
+					visible = cleaned;
+					verifyProtectedRoles(visible);
+				}
+				if (removed.length === 0) {
+					let projection = visible;
+					for (let depth = 0;; depth += 1) {
+						verifyProtectedRoles(projection);
+						const renderedProjection = extractMarkdownFormatRuns(projection).text;
+						verifyProtectedRoles(renderedProjection);
+						const unwrappedProjection = stripMarkdown(renderedProjection);
+						verifyProtectedRoles(unwrappedProjection);
+						let htmlProjection = unwrappedProjection;
+						for (let htmlDepth = 0;; htmlDepth += 1) {
+							verifyProtectedRoles(htmlProjection);
+							const assistantProjection = sanitizeIMessageAssistantVisibleText(htmlProjection, verifyProtectedRoles);
+							verifyProtectedRoles(assistantProjection);
+							if (assistantProjection !== htmlProjection) throw new Error("iMessage outbound hidden assistant content is not allowed");
+							const htmlRemoved = htmlProjection.replace(PLAIN_TEXT_HTML_TAG_RE, "");
+							verifyProtectedRoles(htmlRemoved);
+							if (htmlRemoved === htmlProjection) break;
+							if (htmlDepth + 1 >= MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES) throw new Error("iMessage outbound HTML security projection exceeded its limit");
+							htmlProjection = htmlRemoved;
+						}
+						if (unwrappedProjection === projection) break;
+						if (depth + 1 >= MAX_PRIVATE_MARKDOWN_UNWRAP_PASSES) throw new Error("iMessage outbound Markdown security projection exceeded its limit");
+						projection = unwrappedProjection;
+					}
+					if (!assistantTextChanged) break;
+				}
+				if (remainingPasses <= 0) throw new Error("iMessage outbound role sanitization failed");
+			}
+			verifyProtectedRoles(visible);
+			for (const [token, role] of protectedRoles) visible = visible.replace(token, role);
+			return {
+				text: visible,
+				ranges
+			};
+		}
+	};
+}
+/** Keep each transport's existing rendered or raw wire contract behind one final security gate. */
+function sanitizeIMessageFinalOutboundText(text, options = {}) {
+	const protection = options.protection ?? protectIMessageFencedRoleMarkers(text);
+	const source = options.protection ? text : protection.text;
+	protection.verifyProtectedRoles(source);
+	const protectedText = sanitizeIMessageAssistantVisibleText(source, protection.verifyProtectedRoles);
+	protection.verifyProtectedRoles(protectedText);
+	const formatted = options.formatMarkdown && protectedText.trim() ? extractMarkdownFormatRuns(protectedText) : {
+		text: protectedText,
+		ranges: []
+	};
+	return protection.sanitizeFormatted(formatted);
+}
+/**
+* Strip all assistant-internal scaffolding from outbound text before delivery.
+* Applies reasoning/thinking tag removal, memory tag removal, and
+* model-specific internal separator stripping.
+*/
+function sanitizeOutboundText(text) {
+	if (!text) return text;
+	let cleaned = sanitizeIMessageAssistantVisibleText(text);
+	cleaned = cleaned.replace(INTERNAL_SEPARATOR_RE, "");
+	cleaned = cleaned.replace(ASSISTANT_ROLE_MARKER_RE, "");
+	const closedFencedRegions = findCodeRegions(cleaned).filter((region) => isClosedFencedCodeRegion(cleaned, region));
+	cleaned = cleaned.replace(ROLE_TURN_MARKER_RE, (marker, offset) => isInsideCode(offset, closedFencedRegions) ? marker : "");
+	cleaned = cleaned.replace(/\n{3,}/g, "\n\n").trim();
+	return cleaned;
+}
+//#endregion
+export { IMessageRpcRequestError as a, DEFAULT_IMESSAGE_SEND_TIMEOUT_MS as c, extractMarkdownFormatRuns as i, sanitizeIMessageFinalOutboundText as n, createIMessageRpcClient as o, sanitizeOutboundText as r, DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS as s, protectIMessageFencedRoleMarkers as t };