@poe-platform/safe-bash 0.1.800 → 0.1.801

package/dist/safe-bash-io-engine/commands/text-programs/shared.js

@@ -1,16 +1,15 @@
 import {
-  equalBytes,
   latin1Bytes,
   latin1Text
 } from "../../../safe-bash/command-chunks/chunk-ZMAFOEN7.js";
 import {
   requiredFileInput
-} from "../../../safe-bash/command-chunks/chunk-7FKUC34S.js";
+} from "../../../safe-bash/command-chunks/chunk-FPVUD6TH.js";
 import {
   RESOLVED_EXIT_ONE,
   RESOLVED_EXIT_ZERO,
   builtInDirectContextExecutors
-} from "../../../safe-bash/command-chunks/chunk-XAFSZDY2.js";
+} from "../../../safe-bash/command-chunks/chunk-XS72HTMA.js";
 import "../../../safe-bash/command-chunks/chunk-PM2PFWPC.js";
 import "../../../safe-bash/command-chunks/chunk-RHKBCQYQ.js";
 import {
@@ -36,7 +35,6 @@ function byteString(text) {
   }
   return text;
 }
-var sharedSmallWriteBuf = new Uint8Array(256);
 var RESOLVED_VOID_SYNC = (() => {
   const p = Promise.resolve();
   p[/* @__PURE__ */ Symbol.for("safe-bash.syncResolved")] = true;
@@ -53,10 +51,7 @@ function write(context, text) {
   const stdoutSink = context.stdout;
   if (!stdoutSink.isPipeStage) {
     if (len <= 256 && typeof stdoutSink.writeRangeSync === "function") {
-      for (let i = 0; i < len; i++) {
-        sharedSmallWriteBuf[i] = text.charCodeAt(i) & 255;
-      }
-      if (stdoutSink.writeRangeSync(sharedSmallWriteBuf, len) !== false) {
+      if (stdoutSink.writeRangeSync(latin1Bytes(text), len) !== false) {
         return RESOLVED_VOID_SYNC;
       }
     } else if (typeof stdoutSink.writeSync === "function") {
@@ -97,47 +92,41 @@ async function* lineRecords(context, files, budget) {
   }
 }
 var EMPTY_ENDS = new Int32Array(0);
-var latin1BatchCache = /* @__PURE__ */ new WeakMap();
 function getCachedLatin1Batch(chunk) {
   const cLen = chunk.byteLength;
   if (cLen < 256) return void 0;
-  let cached = latin1BatchCache.get(chunk);
-  if (!cached || cached.byteLength !== cLen || cached.b0 !== chunk[0] || cached.bMid !== chunk[cLen >> 1] || cached.bEnd !== chunk[cLen - 1] || !equalBytes(cached.rawBuf, chunk)) {
-    let batchEnds = new Int32Array(4096);
-    const rawBuf = new Uint8Array(chunk);
-    const cText = latin1Text(rawBuf);
-    let cStart = 0;
-    let cEnd;
-    let cEndsCount = 0;
-    let maxLineLen = 0;
-    while ((cEnd = cText.indexOf("\n", cStart)) >= 0) {
-      const lLen = cEnd - cStart;
-      if (lLen > maxLineLen) maxLineLen = lLen;
-      if (cEndsCount === batchEnds.length) {
-        const grown = new Int32Array(batchEnds.length * 2);
-        grown.set(batchEnds);
-        batchEnds = grown;
-      }
-      batchEnds[cEndsCount++] = cEnd;
-      cStart = cEnd + 1;
+  let batchEnds = new Int32Array(4096);
+  const rawBuf = new Uint8Array(chunk);
+  const cText = latin1Text(rawBuf);
+  let cStart = 0;
+  let cEnd;
+  let cEndsCount = 0;
+  let maxLineLen = 0;
+  while ((cEnd = cText.indexOf("\n", cStart)) >= 0) {
+    const lLen = cEnd - cStart;
+    if (lLen > maxLineLen) maxLineLen = lLen;
+    if (cEndsCount === batchEnds.length) {
+      const grown = new Int32Array(batchEnds.length * 2);
+      grown.set(batchEnds);
+      batchEnds = grown;
     }
-    const tailLen = cText.length - cStart;
-    if (tailLen > maxLineLen) maxLineLen = tailLen;
-    const ends = cEndsCount > 0 ? batchEnds.slice(0, cEndsCount) : EMPTY_ENDS;
-    cached = {
-      byteLength: cLen,
-      b0: chunk[0],
-      bMid: chunk[cLen >> 1],
-      bEnd: chunk[cLen - 1],
-      rawBuf,
-      text: cText,
-      ends,
-      maxLineLen,
-      lastLineStart: cStart
-    };
-    latin1BatchCache.set(chunk, cached);
+    batchEnds[cEndsCount++] = cEnd;
+    cStart = cEnd + 1;
   }
-  return cached;
+  const tailLen = cText.length - cStart;
+  if (tailLen > maxLineLen) maxLineLen = tailLen;
+  const ends = cEndsCount > 0 ? batchEnds.slice(0, cEndsCount) : EMPTY_ENDS;
+  return {
+    byteLength: cLen,
+    b0: chunk[0],
+    bMid: chunk[cLen >> 1],
+    bEnd: chunk[cLen - 1],
+    rawBuf,
+    text: cText,
+    ends,
+    maxLineLen,
+    lastLineStart: cStart
+  };
 }
 function getCachedLatin1Text(chunk) {
   const cached = getCachedLatin1Batch(chunk);

package/dist/safe-bash-io-engine/internal.js

@@ -44,7 +44,7 @@ import {
   requireOperands,
   syncCommandEvaluators,
   value
-} from "../safe-bash/command-chunks/chunk-XAFSZDY2.js";
+} from "../safe-bash/command-chunks/chunk-XS72HTMA.js";
 import "../safe-bash/command-chunks/chunk-PM2PFWPC.js";
 import "../safe-bash/command-chunks/chunk-RHKBCQYQ.js";
 import "../safe-bash/command-chunks/chunk-773DWG4H.js";

package/dist/safe-bash-io-engine/shell/pattern.js

@@ -2,7 +2,7 @@ import {
   nextCodePointOffset,
   previousCodePointOffset,
   stringCheckpoint
-} from "../../safe-bash/command-chunks/chunk-52PCQXD2.js";
+} from "../../safe-bash/command-chunks/chunk-2NHI5F5S.js";
 import {
   init_buffer
 } from "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";

package/dist/safe-bash-io-engine/shell/string-operations.js

@@ -3,7 +3,7 @@ import {
   previousCodePointOffset,
   scanString,
   stringCheckpoint
-} from "../../safe-bash/command-chunks/chunk-52PCQXD2.js";
+} from "../../safe-bash/command-chunks/chunk-2NHI5F5S.js";
 import "../../safe-bash/command-chunks/chunk-HX3SHTCE.js";
 export {
   nextCodePointOffset,

package/dist/safe-bash-mcp/index.browser.d.ts

@@ -246,12 +246,12 @@ interface CreateSecretStoreInput {
     keychainStore?: KeychainStoreInput;
 }
 
-type OAuthMetadataFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
-interface OAuthProtectedResourceMetadata extends Record<string, unknown> {
+type OAuthMetadataFetch$1 = (input: string | URL, init?: RequestInit) => Promise<Response>;
+interface OAuthProtectedResourceMetadata$1 extends Record<string, unknown> {
     resource: string;
     authorization_servers: string[];
 }
-interface OAuthAuthorizationServerMetadata extends Record<string, unknown> {
+interface OAuthAuthorizationServerMetadata$1 extends Record<string, unknown> {
     issuer: string;
     authorization_endpoint: string;
     token_endpoint: string;
@@ -260,13 +260,13 @@ interface OAuthAuthorizationServerMetadata extends Record<string, unknown> {
     code_challenge_methods_supported: string[];
     authorization_response_iss_parameter_supported?: boolean;
 }
-interface OAuthDiscoveryResult {
+interface OAuthDiscoveryResult$1 {
     resource: string;
     resourceMetadataUrl: string;
-    resourceMetadata: OAuthProtectedResourceMetadata;
+    resourceMetadata: OAuthProtectedResourceMetadata$1;
     authorizationServer: string;
     authorizationServerMetadataUrl: string;
-    authorizationServerMetadata: OAuthAuthorizationServerMetadata;
+    authorizationServerMetadata: OAuthAuthorizationServerMetadata$1;
 }
 interface OAuthUnauthorizedChallenge {
     scheme: "Bearer";
@@ -277,31 +277,31 @@ interface OAuthClientProvider {
     /** Establish a grant explicitly, including when resource initialization is public. */
     authenticate?(input: {
         requestUrl: URL;
-        fetch: OAuthMetadataFetch;
+        fetch: OAuthMetadataFetch$1;
         /** Lazy validated discovery. Without it, recover/reuse known grants only. */
-        discover?: () => Promise<OAuthDiscoveryResult>;
+        discover?: () => Promise<OAuthDiscoveryResult$1>;
         signal?: AbortSignal;
-    }): Promise<StoredOAuthTokens | void>;
+    }): Promise<StoredOAuthTokens$1 | void>;
     authorizeRequest?(input: {
         requestUrl: URL;
         headers: Headers;
-        fetch: OAuthMetadataFetch;
+        fetch: OAuthMetadataFetch$1;
         signal?: AbortSignal;
-    }): Promise<StoredOAuthTokens | void> | StoredOAuthTokens | void;
+    }): Promise<StoredOAuthTokens$1 | void> | StoredOAuthTokens$1 | void;
     handleUnauthorized(input: {
         requestUrl: URL;
         response: Response;
         challenge: OAuthUnauthorizedChallenge | null;
         /** Validated metadata supplied by direct callers, if already available. */
-        discovery?: OAuthDiscoveryResult;
+        discovery?: OAuthDiscoveryResult$1;
         /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
-        discover?: () => Promise<OAuthDiscoveryResult>;
-        fetch: OAuthMetadataFetch;
+        discover?: () => Promise<OAuthDiscoveryResult$1>;
+        fetch: OAuthMetadataFetch$1;
         signal?: AbortSignal;
         /** Headers actually attached to this rejected request. */
         requestHeaders?: Headers;
         /** Owned snapshot returned when this request was authorized, or null if absent. */
-        presentedTokens?: StoredOAuthTokens | null;
+        presentedTokens?: StoredOAuthTokens$1 | null;
     }): Promise<{
         action: "retry";
     } | {
@@ -320,7 +320,7 @@ interface OAuthClientMetadata {
     softwareId?: string;
     softwareVersion?: string;
 }
-interface StoredOAuthTokens {
+interface StoredOAuthTokens$1 {
     accessToken: string;
     refreshToken?: string;
     tokenType: "Bearer";
@@ -328,7 +328,7 @@ interface StoredOAuthTokens {
     scope?: string;
 }
 /** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
-interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens$1, "expiresAt"> {
     expiresAt?: number | null;
     /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
     expiresIn?: number;
@@ -336,7 +336,7 @@ interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
     issuedAt?: number;
 }
 /** Full RFC 7591 response, including JSON provider extensions. */
-interface OAuthClientRegistration extends Record<string, unknown> {
+interface OAuthClientRegistration$1 extends Record<string, unknown> {
     client_id: string;
     client_secret?: string | null;
     redirect_uris?: string[] | null;
@@ -347,22 +347,22 @@ interface OAuthClientRegistration extends Record<string, unknown> {
     client_secret_expires_at?: number | null;
     token_endpoint_auth_method?: string | null;
 }
-interface StoredOAuthClient {
+interface StoredOAuthClient$1 {
     clientId: string;
     /** Externally registered apps must never be replaced by native DCR on reload. */
     registrationOwnership?: "caller";
     /** Actual listener URI submitted when this native client was registered. */
     requestedRedirectUri?: string;
     clientSecret?: string;
-    registration?: OAuthClientRegistration;
-    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+    registration?: OAuthClientRegistration$1;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod$1;
 }
-type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
-interface StoredOAuthSession {
+type OAuthTokenEndpointAuthMethod$1 = "none" | "client_secret_post" | "client_secret_basic";
+interface StoredOAuthSession$1 {
     resource: string;
     authorizationServer: string;
-    client: StoredOAuthClient;
-    tokens?: StoredOAuthTokens;
+    client: StoredOAuthClient$1;
+    tokens?: StoredOAuthTokens$1;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
     /** Canonical explicitly requested scope set when the server omits token scope. */
@@ -374,8 +374,8 @@ interface StoredOAuthSession {
     };
 }
 interface OAuthSessionStore {
-    load(resource: string): Promise<StoredOAuthSession | null>;
-    save(resource: string, session: StoredOAuthSession): Promise<void>;
+    load(resource: string): Promise<StoredOAuthSession$1 | null>;
+    save(resource: string, session: StoredOAuthSession$1): Promise<void>;
     clear(resource: string): Promise<void>;
     /** Backend-wide lock covering a complete read/redeem/write transaction. */
     withLock?<T>(resource: string, operation: () => Promise<T>, options: {
@@ -391,15 +391,15 @@ interface DefaultOAuthClientProviderOptions {
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
         /** Import a complete registration owned by the caller. */
-        registration?: OAuthClientRegistration;
-        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+        registration?: OAuthClientRegistration$1;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod$1;
     } | {
         mode: "static";
         clientId: string;
         clientSecret?: string;
         metadata?: OAuthClientMetadata;
-        registration?: OAuthClientRegistration;
-        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+        registration?: OAuthClientRegistration$1;
+        tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod$1;
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
@@ -442,8 +442,8 @@ type OAuthClientProviderOptions = {
 } | DefaultOAuthClientProviderOptions;
 
 interface OAuthDiscoveryCache {
-    get(resourceUrl: string): OAuthDiscoveryResult | null | undefined | Promise<OAuthDiscoveryResult | null | undefined>;
-    set(resourceUrl: string, value: OAuthDiscoveryResult): void | Promise<void>;
+    get(resourceUrl: string): OAuthDiscoveryResult$1 | null | undefined | Promise<OAuthDiscoveryResult$1 | null | undefined>;
+    set(resourceUrl: string, value: OAuthDiscoveryResult$1): void | Promise<void>;
     delete?(resourceUrl: string): void | Promise<void>;
 }
 
@@ -877,5 +877,125 @@ type RemoteMcpResourceResult = Awaited<ReturnType<McpClient["listResources"]>> |
 /** Access a remote resource directly, preserving one page/result without tool discovery. */
 declare function accessRemoteMcpResources(server: RemoteMcpServer, request: RemoteMcpResourceRequest, options?: RemoteMcpResourceOptions): Promise<RemoteMcpResourceResult>;
 
-export { accessRemoteMcpResources, compileToolArguments, createRemoteMcpCommands, fetchRemoteMcpSchema, remoteMcpCommands, resolveRemoteMcpSchemas };
-export type { RemoteMcpCommandOptions, RemoteMcpElicitationContext, RemoteMcpElicitationHandler, RemoteMcpResourceOptions, RemoteMcpResourceRequest, RemoteMcpResourceResult, RemoteMcpSchema, RemoteMcpServer, SchemaFetchOptions, ToolArgumentParseOptions, ToolArgumentParser, ToolParameter };
+type OAuthMetadataFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+interface OAuthProtectedResourceMetadata extends Record<string, unknown> {
+    resource: string;
+    authorization_servers: string[];
+}
+interface OAuthAuthorizationServerMetadata extends Record<string, unknown> {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    response_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+}
+interface OAuthDiscoveryResult {
+    resource: string;
+    resourceMetadataUrl: string;
+    resourceMetadata: OAuthProtectedResourceMetadata;
+    authorizationServer: string;
+    authorizationServerMetadataUrl: string;
+    authorizationServerMetadata: OAuthAuthorizationServerMetadata;
+}
+interface StoredOAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: "Bearer";
+    expiresAt: number | null;
+    scope?: string;
+}
+/** Full RFC 7591 response, including JSON provider extensions. */
+interface OAuthClientRegistration extends Record<string, unknown> {
+    client_id: string;
+    client_secret?: string | null;
+    redirect_uris?: string[] | null;
+    grant_types?: string[] | null;
+    response_types?: string[] | null;
+    contacts?: string[] | null;
+    client_id_issued_at?: number | null;
+    client_secret_expires_at?: number | null;
+    token_endpoint_auth_method?: string | null;
+}
+interface StoredOAuthClient {
+    clientId: string;
+    /** Externally registered apps must never be replaced by native DCR on reload. */
+    registrationOwnership?: "caller";
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
+    clientSecret?: string;
+    registration?: OAuthClientRegistration;
+    tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
+}
+type OAuthTokenEndpointAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
+interface StoredOAuthSession {
+    resource: string;
+    authorizationServer: string;
+    client: StoredOAuthClient;
+    tokens?: StoredOAuthTokens;
+    /** A refresh was begun; its winning response may not have been persisted. */
+    refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
+    discovery: {
+        resourceMetadataUrl: string;
+        resourceMetadata: Record<string, unknown>;
+        authorizationServerMetadata: Record<string, unknown>;
+    };
+}
+
+/** Sensitive, JSON-serializable record. Store only in private, authenticated host storage. */
+interface RemoteMcpAuthorizationTransaction {
+    readonly state: string;
+    readonly expiresAt: number;
+    readonly redirectUri: string;
+    readonly codeVerifier: string;
+    readonly requireIssuer: boolean;
+    readonly session: StoredOAuthSession;
+}
+/** Bind each store instance to the authenticated user and logical server. */
+interface RemoteMcpAuthorizationStore {
+    /** Atomically insert a unique state and capture the current credential generation. Never overwrite a state. */
+    create(transaction: RemoteMcpAuthorizationTransaction): Promise<void>;
+    /** Atomically remove/mark consumed, returning at most once across all workers. Preserve the commit fence. */
+    consume(state: string): Promise<RemoteMcpAuthorizationTransaction | null>;
+    /** Atomically persist only if the consumed transaction's generation is still current.
+     * Reset, deletion, reconfiguration and a superseding grant must invalidate the fence.
+     * Return false if stale. Never implement as an unconditional credential save.
+     */
+    commit(transaction: RemoteMcpAuthorizationTransaction, session: StoredOAuthSession): Promise<boolean>;
+}
+interface BeginRemoteMcpAuthorizationOptions {
+    readonly resource: string;
+    readonly redirectUri: string;
+    readonly client: StoredOAuthClient;
+    readonly scope?: string;
+    readonly store: RemoteMcpAuthorizationStore;
+    /** Host-validated discovery, including issuer trust and network policy. No implicit network access. */
+    readonly discover: (resource: string, signal?: AbortSignal) => Promise<OAuthDiscoveryResult>;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+    /** Transaction lifetime, at most ten minutes. */
+    readonly ttlMs?: number;
+}
+interface CompleteRemoteMcpAuthorizationOptions {
+    readonly callbackUrl: string;
+    readonly store: RemoteMcpAuthorizationStore;
+    /** Required host network policy. Redirects are rejected, including at the token endpoint. */
+    readonly fetch: OAuthMetadataFetch;
+    readonly signal?: AbortSignal;
+    readonly now?: () => number;
+}
+/** Start consent without a listener or a pending callback promise. Only the URL leaves private storage. */
+declare function beginRemoteMcpAuthorization(options: BeginRemoteMcpAuthorizationOptions): Promise<{
+    authorizationUrl: string;
+    expiresAt: number;
+}>;
+/** Redeem once after any process restart, then conditionally persist. Returns no tokens or callback secrets. */
+declare function completeRemoteMcpAuthorization(options: CompleteRemoteMcpAuthorizationOptions): Promise<{
+    resource: string;
+}>;
+
+export { accessRemoteMcpResources, beginRemoteMcpAuthorization, compileToolArguments, completeRemoteMcpAuthorization, createRemoteMcpCommands, fetchRemoteMcpSchema, remoteMcpCommands, resolveRemoteMcpSchemas };
+export type { BeginRemoteMcpAuthorizationOptions, CompleteRemoteMcpAuthorizationOptions, RemoteMcpAuthorizationStore, RemoteMcpAuthorizationTransaction, RemoteMcpCommandOptions, RemoteMcpElicitationContext, RemoteMcpElicitationHandler, RemoteMcpResourceOptions, RemoteMcpResourceRequest, RemoteMcpResourceResult, RemoteMcpSchema, RemoteMcpServer, SchemaFetchOptions, ToolArgumentParseOptions, ToolArgumentParser, ToolParameter };