@popmelt.com/core 0.27.0 → 0.27.1

package/dist/index.mjs

@@ -1,2 +1,2 @@
 "use client";
-export{b as PopmeltProvider}from"./chunk-MDJYUX5S.mjs";export{a as isPopmeltPreview}from"./chunk-EX63NVDN.mjs";import"./chunk-N2ZEZCHO.mjs";export{b as usePopmelt}from"./chunk-J3UIBBU2.mjs";import"./chunk-TFPKDKDO.mjs";import"./chunk-7YIQQYRU.mjs";import"./chunk-TSY2K45H.mjs";import"./chunk-D7HY2EDH.mjs";
+export{b as PopmeltProvider}from"./chunk-3PVLCKSV.mjs";export{a as isPopmeltPreview}from"./chunk-EX63NVDN.mjs";import"./chunk-N2ZEZCHO.mjs";export{b as usePopmelt}from"./chunk-J3UIBBU2.mjs";import"./chunk-YMCTJKYN.mjs";import"./chunk-7MGWRICI.mjs";import"./chunk-TSY2K45H.mjs";import"./chunk-D7HY2EDH.mjs";

package/dist/plugin-astro.mjs

@@ -1,4 +1,4 @@
-import{a as o}from"./chunk-C5Q6LDAS.mjs";import"./chunk-MTRUVFH7.mjs";import"./chunk-NOHXTT24.mjs";import{fileURLToPath as d}from"url";function c(t={}){return{name:"popmelt",hooks:{"astro:config:setup"({command:r,config:i,updateConfig:n,injectScript:p}){if(r!=="dev")return;let{client:e=!0,multiplayer:a=!1,...s}=t;n({vite:{plugins:[o({...s,projectRoot:t.projectRoot??d(i.root)})],optimizeDeps:{include:e?["react","react/jsx-runtime","react/jsx-dev-runtime","react-dom","react-dom/client","lucide-react"]:[]}}}),p("page",e?l(a):`
+import{a as o}from"./chunk-CLDWTCKX.mjs";import"./chunk-YC7B37F6.mjs";import"./chunk-NOHXTT24.mjs";import{fileURLToPath as d}from"url";function c(t={}){return{name:"popmelt",hooks:{"astro:config:setup"({command:r,config:i,updateConfig:n,injectScript:p}){if(r!=="dev")return;let{client:e=!0,multiplayer:a=!1,...s}=t;n({vite:{plugins:[o({...s,projectRoot:t.projectRoot??d(i.root)})],optimizeDeps:{include:e?["react","react/jsx-runtime","react/jsx-dev-runtime","react-dom","react-dom/client","lucide-react"]:[]}}}),p("page",e?l(a):`
 import { bridgeUrl, projectId } from 'virtual:popmelt/bridge';
 if (bridgeUrl) window.__POPMELT_BRIDGE_URL__ = bridgeUrl;
 if (projectId) window.__POPMELT_PROJECT_ID__ = projectId;

package/dist/plugin-nuxt.mjs

@@ -1,4 +1,4 @@
-import{a as s,b as l}from"./chunk-MTRUVFH7.mjs";import{b as i}from"./chunk-NOHXTT24.mjs";import{addPluginTemplate as d,defineNuxtModule as m}from"nuxt/kit";var a=m({meta:{name:"@popmelt.com/core/nuxt",configKey:"popmelt"},async setup(o,e){if(!e.options.dev)return;let n={config:{server:e.options.devServer},middlewares:{use(){}}},t=await s({...o,projectRoot:o.projectRoot??e.options.rootDir},n,3e3);if(t.port===null)return;e.hook("vite:extend",({config:p})=>{p.optimizeDeps??={},p.optimizeDeps.include=[...new Set([...p.optimizeDeps.include??[],"react","react/jsx-runtime","react/jsx-dev-runtime","react-dom","react-dom/client","lucide-react"])]});let r=await l(t,n),u=r?i(r):void 0;e.hook("close",async()=>{u?.(),await r?.release()}),d({filename:"popmelt.client.mjs",mode:"client",getContents:()=>`import { defineNuxtPlugin } from '#app';
+import{a as s,b as l}from"./chunk-YC7B37F6.mjs";import{b as i}from"./chunk-NOHXTT24.mjs";import{addPluginTemplate as d,defineNuxtModule as m}from"nuxt/kit";var a=m({meta:{name:"@popmelt.com/core/nuxt",configKey:"popmelt"},async setup(o,e){if(!e.options.dev)return;let n={config:{server:e.options.devServer},middlewares:{use(){}}},t=await s({...o,projectRoot:o.projectRoot??e.options.rootDir},n,3e3);if(t.port===null)return;e.hook("vite:extend",({config:p})=>{p.optimizeDeps??={},p.optimizeDeps.include=[...new Set([...p.optimizeDeps.include??[],"react","react/jsx-runtime","react/jsx-dev-runtime","react-dom","react-dom/client","lucide-react"])]});let r=await l(t,n),u=r?i(r):void 0;e.hook("close",async()=>{u?.(),await r?.release()}),d({filename:"popmelt.client.mjs",mode:"client",getContents:()=>`import { defineNuxtPlugin } from '#app';
 export default defineNuxtPlugin((nuxtApp) => {
   let disposed = false;
   let mounting;

package/dist/plugin-vite.mjs

@@ -1 +1 @@
-import{a}from"./chunk-C5Q6LDAS.mjs";import"./chunk-MTRUVFH7.mjs";import"./chunk-NOHXTT24.mjs";export{a as popmelt};
+import{a}from"./chunk-CLDWTCKX.mjs";import"./chunk-YC7B37F6.mjs";import"./chunk-NOHXTT24.mjs";export{a as popmelt};

package/dist/{server-MJF4KF26.mjs → server-J5NV3BMT.mjs}

@@ -1,4 +1,4 @@
-import{a as ja,b as $a}from"./chunk-NOHXTT24.mjs";import{spawn as rv}from"child_process";import{closeSync as iv,openSync as ov}from"fs";import{appendFile as sv,mkdir as av,readFile as cv,realpath as dv}from"fs/promises";import{dirname as lv,join as Pa}from"path";import{fileURLToPath as pv}from"url";function Sn(r){return Hp(r).slice(0,12)}var zp=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Hp(r){let e=typeof TextEncoder<"u"?Array.from(new TextEncoder().encode(r)):Gp(r),t=e.length*8;for(e.push(128);e.length%64!==56;)e.push(0);for(let w=7;w>=0;w--)e.push(t/Math.pow(2,w*8)&255);let n=1779033703,i=3144134277,o=1013904242,s=2773480762,a=1359893119,c=2600822924,d=528734635,p=1541459225,u=new Array(64);for(let w=0;w<e.length;w+=64){for(let b=0;b<16;b++){let y=w+b*4;u[b]=(e[y]<<24|e[y+1]<<16|e[y+2]<<8|e[y+3])>>>0}for(let b=16;b<64;b++){let y=At(u[b-15],7)^At(u[b-15],18)^u[b-15]>>>3,P=At(u[b-2],17)^At(u[b-2],19)^u[b-2]>>>10;u[b]=u[b-16]+y+u[b-7]+P>>>0}let x=n,v=i,m=o,f=s,I=a,h=c,g=d,A=p;for(let b=0;b<64;b++){let y=At(I,6)^At(I,11)^At(I,25),P=I&h^~I&g,_=A+y+P+zp[b]+u[b]>>>0,R=At(x,2)^At(x,13)^At(x,22),N=x&v^x&m^v&m,$=R+N>>>0;A=g,g=h,h=I,I=f+_>>>0,f=m,m=v,v=x,x=_+$>>>0}n=n+x>>>0,i=i+v>>>0,o=o+m>>>0,s=s+f>>>0,a=a+I>>>0,c=c+h>>>0,d=d+g>>>0,p=p+A>>>0}return[n,i,o,s,a,c,d,p].map(w=>w.toString(16).padStart(8,"0")).join("")}function At(r,e){return r>>>e|r<<32-e}function Gp(r){let e=[];for(let t=0;t<r.length;t++){let n=r.charCodeAt(t);n<128?e.push(n):n<2048?e.push(192|n>>6,128|n&63):e.push(224|n>>12,128|n>>6&63,128|n&63)}return e}var Oa={name:"@popmelt.com/core",version:"0.27.0",description:"A tiny, powerful design layer for humans and AI",license:"PolyForm-Shield-1.0.0",author:"Popmelt <reb@popmelt.com> (https://popmelt.com)",homepage:"https://github.com/popmelt/core",bugs:{url:"https://github.com/popmelt/core/issues"},repository:{type:"git",url:"git+https://github.com/popmelt/core.git"},keywords:["ai","annotations","collaboration","devtools","react","visual-feedback"],bin:{popmelt:"dist/cli.mjs"},sideEffects:!1,packageManager:"pnpm@9.12.0",engines:{node:">=18.0.0"},scripts:{build:"tsup",clean:"git clean -xdf .turbo node_modules dist",format:'prettier --check "**/*.{ts,tsx}"',lint:"eslint . && node scripts/check-eslint-suppressions.mjs","pack:smoke":"node scripts/pack-smoke.mjs","peer:smoke":"node scripts/peer-compat-smoke.mjs","vue:smoke":"pnpm run build && node scripts/vue-install-smoke.mjs","nuxt:smoke":"pnpm run build && node scripts/nuxt-install-smoke.mjs","astro:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs astro","svelte:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs svelte && node scripts/framework-install-smoke.mjs sveltekit",prepublishOnly:"pnpm run verify",test:"vitest run","test:coverage":"vitest run --coverage.enabled","test:browser":"pnpm run build && tsc --noEmit -p tsconfig.browser.json && vitest run --config vitest.browser.config.ts","test:browser:mutation":"node e2e/check-lifecycle-mutation.mjs","test:watch":"vitest",typecheck:"tsc --noEmit --incremental false",verify:"pnpm run typecheck && pnpm run format && pnpm run lint && pnpm run test:coverage && pnpm run build && pnpm run pack:smoke"},exports:{".":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./provider":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./browser":{types:"./dist/browser.d.mts",import:"./dist/browser.mjs"},"./server":{types:"./dist/server.d.mts",import:"./dist/server.mjs"},"./memory":{types:"./dist/memory.d.mts",import:"./dist/memory.mjs"},"./memory/legacy":{types:"./dist/memory-legacy.d.mts",import:"./dist/memory-legacy.mjs"},"./memory/store":{types:"./dist/memory-store.d.mts",import:"./dist/memory-store.mjs"},"./next":{types:"./dist/plugin-next.d.mts",import:"./dist/plugin-next.mjs",default:"./dist/plugin-next.mjs"},"./vite":{types:"./dist/plugin-vite.d.mts",import:"./dist/plugin-vite.mjs",default:"./dist/plugin-vite.mjs"},"./vite/client":{types:"./dist/vite-client.d.ts"},"./astro":{types:"./dist/plugin-astro.d.mts",import:"./dist/plugin-astro.mjs",default:"./dist/plugin-astro.mjs"},"./nuxt":{types:"./dist/plugin-nuxt.d.mts",import:"./dist/plugin-nuxt.mjs",default:"./dist/plugin-nuxt.mjs"},"./media":{types:"./dist/media.d.mts",import:"./dist/media.mjs"},"./three":{types:"./dist/adapter-three.d.mts",import:"./dist/adapter-three.mjs"},"./react-three-fiber":{types:"./dist/adapter-react-three-fiber.d.mts",import:"./dist/adapter-react-three-fiber.mjs"}},files:["dist","codex-plugin","claude-plugin","LICENSE","README.md","THIRD_PARTY_NOTICES.md"],dependencies:{"modern-screenshot":"4.7.0",ws:"8.21.3"},optionalDependencies:{"@napi-rs/keyring":"2.1.0"},peerDependencies:{nuxt:">=4.5.2 <5","lucide-react":">=1.23.0",next:">=14.0.0",react:">=18.0.0","react-dom":">=18.0.0","@react-three/fiber":">=8.0.0",three:">=0.150.0"},peerDependenciesMeta:{nuxt:{optional:!0},next:{optional:!0},"@react-three/fiber":{optional:!0},three:{optional:!0}},devDependencies:{nuxt:"4.5.2","@kit/eslint-config":"workspace:^","@react-three/fiber":"9.7.0","@tanstack/react-router":"1.120.5","@types/react":"19.1.0","@types/react-dom":"19.1.2","@types/three":"^0.185.4","@types/ws":"8.18.1","@vitejs/plugin-react":"^5.1.1","@vitejs/plugin-vue":"6.0.8","@vitest/coverage-v8":"3.2.4",eslint:"^9.24.0",geist:"1.7.2",jsdom:"26.1.0","lucide-react":"^1.23.0",next:"15.5.24",prettier:"3.5.3",react:"19.1.0","react-dom":"19.1.0",three:"^0.185.1",tsup:"^8.5.1",typescript:"^5.8.3",vite:"7.3.6",vitest:"3.2.4",vue:"3.5.42","vue-router":"5.3.1"}};var Et=Oa.version;import{execFileSync as gw,spawn as ap}from"child_process";import{createServer as uu}from"http";import{createHash as Kp,randomBytes as Da}from"crypto";var Wp={production:{issuer:"https://popmelt.com",resource:"https://mcp.popmelt.com"},staging:{issuer:"https://webapp-staging-1bed.up.railway.app",resource:"https://mcp-staging-8731.up.railway.app"}};function ai(r){if(r!=="production"&&r!=="staging")throw new Error("Unknown Popmelt cloud environment.");return Wp[r]}function Na(r,e){if(r===!1)return null;let t=r?.environment??e??"production";if(t==="off")return null;if(t!=="production"&&t!=="staging")throw new Error("POPMELT_CLOUD_TASTE must be production, staging, or off.");return t}var rn="directions:read offline_access",Qp="directions:read directions:write offline_access",Xp="tastes:read directions:read offline_access",Yp="tastes:read directions:read directions:write offline_access",La="tastes:read tastes:inspect directions:read directions:write offline_access",Fo=[rn,Qp,Xp,Yp,La],Zp=["imprint","principles","components","assets","content"];function ze(r){if(!r||typeof r!="object"||Array.isArray(r))throw new oe("invalid_response");return r}function Ve(r){if(typeof r!="string")throw new oe("invalid_response");return r}function mt(r){let e=Ve(r);if(!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(e))throw new oe("invalid_response");return e}function zt(r){return r===null?null:Ve(r)}var oe=class extends Error{constructor(t){super(`Cloud taste: ${t}`);this.code=t;this.name="CloudTasteError"}};function eu(r,e,t){let n=ze(r);if(n.schemaVersion!==1||n.projectKey!==e||!Number.isInteger(n.generation)||Number(n.generation)<0||Number(n.generation)>2147483647)throw new oe("invalid_response");let i={schemaVersion:1,projectKey:e,generation:Number(n.generation)};if(n.direction===null)return{...i,direction:null};let o=ze(n.direction);if(!["public","private"].includes(Ve(o.sourceCollection))||!["reference","definitive"].includes(Ve(o.authority))||o.documentFormat!=="popmelt.taste.v1"||!/^[a-f0-9]{64}$/.test(Ve(o.contentHash)))throw new oe("invalid_response");let s=ze(o.sections),a={};for(let c of t){if(!Object.hasOwn(s,c))throw new oe("invalid_response");a[c]=s[c]}return{...i,direction:{revisionId:mt(o.revisionId),sourceModelId:mt(o.sourceModelId),sourceCollection:o.sourceCollection,authority:o.authority,name:Ve(o.name),description:zt(o.description),sourceVersion:zt(o.sourceVersion),sourceUpdatedAt:zt(o.sourceUpdatedAt),contentHash:Ve(o.contentHash),documentFormat:"popmelt.taste.v1",createdAt:Ve(o.createdAt),sections:a}}}function qa(r){if(r.environment!=="staging"&&r.environment!=="production"||!/^store-[A-Za-z0-9][A-Za-z0-9_.:-]{0,121}$/.test(r.storeId))throw new oe("invalid_input");let e=r.storeId,{issuer:t,resource:n}=ai(r.environment),i=r.environment==="staging"?"Popmelt Core (staging)":"Popmelt Core",o=`popmelt:taste:${t}:${n}:${e}`,s=r.fetch??fetch,a=r.now??Date.now,c=null,d=null,p=0,u=null;function w(I,h){let g=null;try{let A=ze(I.account_profile);if(A.subject===h.accountId){let b=typeof A.name=="string"&&A.name.trim().slice(0,120)||null,y=null;if(typeof A.avatarUrl=="string"&&A.avatarUrl.length<=2048)try{let P=new URL(A.avatarUrl);P.protocol==="https:"&&!P.username&&!P.password&&(y=P.href)}catch{}g={name:b,avatarUrl:y}}}catch{}u={clientId:h.clientId,accountId:h.accountId,profile:g}}let x=I=>r.vault.withLock(o,I).catch(h=>{throw h instanceof oe?h:new oe("storage_unavailable")});async function v(I,h,g={},A=!1){try{let b=await s(I,{method:"POST",headers:{"Content-Type":"application/json",...g},body:JSON.stringify(h),redirect:"error",signal:AbortSignal.timeout(15e3)});if(b.ok||await b.body?.cancel(),b.status===401||b.status===403)throw new oe("reconnect_required");if(!b.ok)throw new oe("unavailable");if(A){if(await b.body?.cancel(),b.status!==202)throw new oe("invalid_response");return{body:{},session:null}}if(!b.body)throw new oe("invalid_response");let y=b.body.getReader(),P=[],_=0;try{for(;;){let R=await y.read();if(R.done)break;if(_+=R.value.byteLength,_>256*1024)throw new oe("invalid_response");P.push(R.value)}}finally{await y.cancel()}return{body:ze(JSON.parse(Buffer.concat(P).toString("utf8"))),session:b.headers.get("mcp-session-id")}}catch(b){throw b instanceof oe?b:new oe("unavailable")}}function m(I,h,g,A=rn){try{let b=Ve(I.access_token),y=Ve(I.refresh_token);if(I.token_type!=="Bearer"||!/^[\w-]{43}$/.test(y)||Ve(I.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" "))throw new oe("invalid_response");let P=b.split(".");if(P.length!==3)throw new oe("invalid_response");let _=ze(JSON.parse(Buffer.from(P[1],"base64url").toString("utf8"))),R=mt(_.sub);if(_.iss!==t||_.aud!==n||_.client_id!==h||Ve(_.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" ")||g&&R!==g||typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp*1e3<=a()+3e4||_.exp*1e3>a()+36e5)throw new oe("invalid_response");return{credential:{clientId:h,accountId:R,refreshToken:y,...A!==rn?{scope:A}:{}},access:{token:b,expiresAt:_.exp*1e3,refreshToken:y,accountId:R}}}catch{throw new oe("invalid_response")}}async function f(I,h,g,A){return x(async b=>{let y=await b.read();if(!y)throw d=null,u=null,new oe("reconnect_required");let P=y.scope??rn;if(!Fo.includes(P)||!P.split(" ").includes(I))throw new oe("reconnect_required");if(!d||d.refreshToken!==y.refreshToken||d.expiresAt<=a()+3e4){d=null;let $=!u||u.clientId!==y.clientId||u.accountId!==y.accountId;try{await b.remove();let X=await v(`${t}/api/oauth/token`,{grant_type:"refresh_token",client_id:mt(y.clientId),refresh_token:Ve(y.refreshToken),scope:P,resource:n,...$?{include_account_profile:!0}:{}}),O=m(X.body,y.clientId,y.accountId,P);await b.write(O.credential),d=O.access,$&&w(X.body,O.credential)}catch{throw await b.remove(),new oe("reconnect_required")}}let _=d.token,R=null,N={Authorization:`Bearer ${_}`,Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"};try{let $=++p,X=await v(`${n}/mcp`,{jsonrpc:"2.0",id:$,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-taste",version:"1"}}},N);if(R=X.session,!R||X.body.jsonrpc!=="2.0"||X.body.id!==$||X.body.error||ze(X.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},{...N,"Mcp-Session-Id":R},!0);let O=++p,G=await v(`${n}/mcp`,{jsonrpc:"2.0",id:O,method:"tools/call",params:{name:h,arguments:g}},{...N,"Mcp-Session-Id":R});if(G.body.jsonrpc!=="2.0"||G.body.id!==O||G.body.error)throw new oe("invalid_response");let z=ze(ze(G.body.result).structuredContent);if(z.ok!==!0)throw new oe("unavailable");return A(z.data)}catch($){throw $ instanceof oe&&$.code==="reconnect_required"&&(d=null,await b.remove()),$}finally{R&&await s(`${n}/mcp`,{method:"DELETE",headers:{...N,"Mcp-Session-Id":R},redirect:"error",signal:AbortSignal.timeout(5e3)}).then($=>$.body?.cancel()).catch(()=>{})}})}return{async readTasteDefinition(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:inspect","get_taste_definition",{id:I,collection:h},g=>{let A=ze(g);if(A.id!==I||A.collection!==h||!/^[a-f0-9]{64}$/.test(String(A.hash)))throw new oe("invalid_response");let b=ze(A.sections),y=Array.isArray(A.versions)&&A.versions.length<=100?A.versions.map(P=>{let _=ze(P),R=zt(_.saved_at);if(R!==null&&!Number.isFinite(Date.parse(R)))throw new oe("invalid_response");return{version:Ve(_.version),saved_at:R}}):null;return{id:I,collection:h,name:Ve(A.name),version:zt(A.version),hash:String(A.hash),sections:b,versions:y}})},async readTasteSummary(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:read","get_taste_summary",{id:I,collection:h},g=>{let A=ze(g);if(!Array.isArray(A.facts)||A.facts.length>20)throw new oe("invalid_response");return{preview:A.preview,facts:A.facts.map(b=>{let y=ze(b);if(!(typeof y.value=="number"&&Number.isSafeInteger(y.value)&&y.value>=0)&&!(typeof y.value=="string"&&y.value.length<=100))throw new oe("invalid_response");return{key:Ve(y.key).slice(0,80),label:Ve(y.label).slice(0,100),value:y.value}})}})},async listPublicTastes(){let I={Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},h=null;try{let g=++p,A=await v(`${n}/mcp`,{jsonrpc:"2.0",id:g,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-catalog",version:"1"}}},I);if(h=A.session,!h||A.body.id!==g||A.body.error||ze(A.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");I["Mcp-Session-Id"]=h,await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},I,!0);let b=++p,y=await v(`${n}/mcp`,{jsonrpc:"2.0",id:b,method:"tools/call",params:{name:"discover",arguments:{type:"model",collection:"public",limit:100}}},I);if(y.body.id!==b||y.body.error)throw new oe("invalid_response");let P=ze(y.body.result);if(P.isError||!Array.isArray(P.content)||P.content.length!==1)throw new oe("invalid_response");let _=ze(P.content[0]),R=ze(JSON.parse(Ve(_.text)));if(R.type!=="model"||R.collection!=="public"||!Array.isArray(R.items)||R.items.length>100)throw new oe("invalid_response");return R.items.map(N=>{let $=ze(N);return{id:mt($.id),name:Ve($.name).slice(0,200),version:zt($.version)}})}finally{h&&await s(`${n}/mcp`,{method:"DELETE",headers:I,redirect:"error",signal:AbortSignal.timeout(5e3)}).then(g=>g.body?.cancel()).catch(()=>{})}},async beginSignIn(I){let h;try{h=new URL(I)}catch{throw new oe("invalid_input")}if(h.protocol!=="http:"||h.hostname!=="127.0.0.1"||!h.port||h.username||h.password||h.search||h.hash||h.pathname!=="/callback")throw new oe("invalid_input");return x(async g=>{let A=La;if(await g.read())throw new oe("already_connected");if(c&&c.until>a())throw new oe("sign_in_pending");c=null;let b=await v(`${t}/api/oauth/register`,{client_name:i,redirect_uris:[I],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",scope:A}),y=mt(b.body.client_id),P=Da(32).toString("base64url"),_=Da(32).toString("base64url");c={clientId:y,verifier:P,state:_,redirectUri:I,until:a()+3e5,scope:A};let R=new URL("/mcp/grant",t);return R.search=new URLSearchParams({client_id:y,redirect_uri:I,response_type:"code",code_challenge:Kp("sha256").update(P).digest("base64url"),code_challenge_method:"S256",state:_,scope:A,resource:n}).toString(),{authorizationUrl:R.href}})},async completeSignIn(I){return x(async h=>{let g;try{g=new URL(I)}catch{throw new oe("invalid_input")}let A=c;if(!A||A.until<=a()||g.origin+g.pathname!==A.redirectUri||g.username||g.password||g.hash||g.searchParams.getAll("state").length!==1||g.searchParams.get("state")!==A.state||g.searchParams.getAll("code").length!==1||!g.searchParams.get("code")||g.searchParams.has("error"))throw new oe("invalid_input");if(c=null,await h.read())throw new oe("already_connected");let b=await v(`${t}/api/oauth/token`,{grant_type:"authorization_code",client_id:A.clientId,redirect_uri:A.redirectUri,code:g.searchParams.get("code"),code_verifier:A.verifier,resource:n,include_account_profile:!0}),y=m(b.body,A.clientId,void 0,A.scope);await h.write(y.credential),d=y.access,w(b.body,y.credential)})},async status(){return x(async I=>{let h=await I.read();return(!h||u?.clientId!==h.clientId||u?.accountId!==h.accountId)&&(u=null),h?{state:"signed_in",accountId:mt(h.accountId),canWrite:(h.scope??rn).split(" ").includes("directions:write"),canInspect:(h.scope??rn).split(" ").includes("tastes:inspect"),canBrowsePrivate:(h.scope??rn).split(" ").includes("tastes:read"),...u?{profile:u.profile}:{}}:{state:"signed_out"}})},async disconnect(){return x(async I=>{c=null,d=null,u=null,await I.remove()})},async listPrivateTastes(){let I=[],h,g=new Set;for(let A=0;A<100;A++){let b=await f("tastes:read","list_private_tastes",h?{after:h}:{},y=>{let P=ze(y);if(!Array.isArray(P.items)||P.items.length>100)throw new oe("invalid_response");return{items:P.items.map(R=>{let N=ze(R),$=zt(N.thumbnailUrl),X=null;if($){let O=new URL($);O.protocol==="https:"&&!O.username&&!O.password&&(X=O.href)}return{id:mt(N.id),name:Ve(N.name).slice(0,200),version:zt(N.version),thumbnailUrl:X,preview:N.preview}}),nextCursor:P.nextCursor===null?null:mt(P.nextCursor)}});for(let y of b.items){if(g.has(y.id))throw new oe("invalid_response");g.add(y.id),I.push(y)}if(!b.nextCursor)return I;if(!b.items.length||b.nextCursor!==b.items.at(-1)?.id||h&&b.nextCursor<=h)throw new oe("invalid_response");h=b.nextCursor}throw new oe("invalid_response")},async readDirection(I=[],h){if(I.length>5||I.some(g=>!Zp.includes(g)))throw new oe("invalid_input");if(h&&(!Number.isInteger(h.expectedGeneration)||h.expectedGeneration<0||h.expectedGeneration>2147483647||h.sourceCollection!==void 0&&!["public","private"].includes(h.sourceCollection)||h.sourceCollection&&!h.sourceModelId))throw new oe("invalid_input");return h?.sourceModelId!==void 0&&mt(h.sourceModelId),f(h?"directions:write":"directions:read",h?h.sourceModelId?"adopt_project_design_direction":"clear_project_design_direction":"get_project_design_direction",h?{projectKey:e,expectedGeneration:h.expectedGeneration,...h.sourceModelId?{sourceModelId:h.sourceModelId,sourceCollection:h.sourceCollection??"public",authority:"reference"}:{}}:{projectKey:e,sections:[...new Set(I)]},g=>eu(g,e,I))}}}import{createHash as cu}from"crypto";import{mkdir as du,lstat as lu}from"fs/promises";import{homedir as pu}from"os";import{join as za}from"path";import{randomUUID as tu}from"crypto";import{mkdir as Fa,readdir as Ja,rmdir as nu,stat as ru,unlink as iu,writeFile as ou}from"fs/promises";import{dirname as su,join as Ba}from"path";import{setTimeout as au}from"timers/promises";var di=r=>r.code==="ENOENT";async function Ua(r){await nu(r).catch(e=>{if(e.code!=="ENOENT"&&e.code!=="ENOTEMPTY"&&e.code!=="EEXIST")throw e})}async function ci(r,e){await iu(Ba(r,e)).catch(t=>{if(!di(t))throw t}),await Ua(r)}async function li(r,e,t=1e4){await Fa(su(r),{recursive:!0});let n=`${process.pid}-${tu()}`,i=Date.now()+t;for(;;){let o=!1;try{await Fa(r),o=!0}catch(s){if(s.code!=="EEXIST")throw s}if(o){let s=!1;try{await ou(Ba(r,n),"",{flag:"wx",mode:384});let a=await Ja(r);s=a.length===1&&a[0]===n}catch(a){if(!di(a))throw await ci(r,n),a}if(s)try{return await e()}finally{await ci(r,n)}await ci(r,n)}else{let s=await Ja(r).catch(a=>{if(di(a))return[];throw a});for(let a of s){let c=/^(\d+)-[a-f0-9-]{36}$/.exec(a);if(!(!c||Number(c[1])<1))try{process.kill(Number(c[1]),0)}catch(d){d.code==="ESRCH"&&await ci(r,a)}}if(s.length===0){let a=await ru(r).catch(c=>{if(di(c))return null;throw c});a&&Date.now()-a.mtimeMs>1e3&&await Ua(r)}}if(Date.now()>=i)throw new Error("Thread storage is busy with another writer; retry the operation.");await au(15+Math.floor(Math.random()*15))}}function Ha(r="production"){ai(r);let e=`com.popmelt.taste.${r}`;return{async withLock(t,n){try{let i=za(pu(),".popmelt-cloud-locks");await du(i,{mode:448,recursive:!0});let o=await lu(i);if(!o.isDirectory()||o.isSymbolicLink()||process.platform!=="win32"&&((o.mode&63)!==0||o.uid!==process.getuid?.()))throw new oe("storage_unavailable");let s=cu("sha256").update(t).digest("hex");return await li(za(i,s),async()=>{let{AsyncEntry:a}=await import("@napi-rs/keyring"),c=new a(e,s,{linux:{store:"secret-service"}});return n({async read(){let d=await c.getSecret(),p=d==null?null:Buffer.from(d).toString("utf8");if(p==null)return null;let u=JSON.parse(p);if(!u||typeof u.clientId!="string"||typeof u.accountId!="string"||typeof u.refreshToken!="string"||u.scope!==void 0&&!Fo.includes(u.scope))throw new oe("storage_unavailable");return{clientId:u.clientId,accountId:u.accountId,refreshToken:u.refreshToken,...u.scope?{scope:u.scope}:{}}},async write(d){await c.setSecret(Buffer.from(JSON.stringify(d)))},async remove(){await c.deleteCredential()}})},6e4)}catch(i){throw i instanceof oe?i:new oe("storage_unavailable")}}}}function Ga(r){let e=r?"You\u2019re connected":"Sign-in didn\u2019t complete";return`<!doctype html>
+import{a as ja,b as $a}from"./chunk-NOHXTT24.mjs";import{spawn as rv}from"child_process";import{closeSync as iv,openSync as ov}from"fs";import{appendFile as sv,mkdir as av,readFile as cv,realpath as dv}from"fs/promises";import{dirname as lv,join as Pa}from"path";import{fileURLToPath as pv}from"url";function Sn(r){return Hp(r).slice(0,12)}var zp=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Hp(r){let e=typeof TextEncoder<"u"?Array.from(new TextEncoder().encode(r)):Gp(r),t=e.length*8;for(e.push(128);e.length%64!==56;)e.push(0);for(let w=7;w>=0;w--)e.push(t/Math.pow(2,w*8)&255);let n=1779033703,i=3144134277,o=1013904242,s=2773480762,a=1359893119,c=2600822924,d=528734635,p=1541459225,u=new Array(64);for(let w=0;w<e.length;w+=64){for(let b=0;b<16;b++){let y=w+b*4;u[b]=(e[y]<<24|e[y+1]<<16|e[y+2]<<8|e[y+3])>>>0}for(let b=16;b<64;b++){let y=At(u[b-15],7)^At(u[b-15],18)^u[b-15]>>>3,P=At(u[b-2],17)^At(u[b-2],19)^u[b-2]>>>10;u[b]=u[b-16]+y+u[b-7]+P>>>0}let x=n,v=i,m=o,f=s,I=a,h=c,g=d,A=p;for(let b=0;b<64;b++){let y=At(I,6)^At(I,11)^At(I,25),P=I&h^~I&g,_=A+y+P+zp[b]+u[b]>>>0,R=At(x,2)^At(x,13)^At(x,22),N=x&v^x&m^v&m,$=R+N>>>0;A=g,g=h,h=I,I=f+_>>>0,f=m,m=v,v=x,x=_+$>>>0}n=n+x>>>0,i=i+v>>>0,o=o+m>>>0,s=s+f>>>0,a=a+I>>>0,c=c+h>>>0,d=d+g>>>0,p=p+A>>>0}return[n,i,o,s,a,c,d,p].map(w=>w.toString(16).padStart(8,"0")).join("")}function At(r,e){return r>>>e|r<<32-e}function Gp(r){let e=[];for(let t=0;t<r.length;t++){let n=r.charCodeAt(t);n<128?e.push(n):n<2048?e.push(192|n>>6,128|n&63):e.push(224|n>>12,128|n>>6&63,128|n&63)}return e}var Oa={name:"@popmelt.com/core",version:"0.27.1",description:"A tiny, powerful design layer for humans and AI",license:"PolyForm-Shield-1.0.0",author:"Popmelt <reb@popmelt.com> (https://popmelt.com)",homepage:"https://github.com/popmelt/core",bugs:{url:"https://github.com/popmelt/core/issues"},repository:{type:"git",url:"git+https://github.com/popmelt/core.git"},keywords:["ai","annotations","collaboration","devtools","react","visual-feedback"],bin:{popmelt:"dist/cli.mjs"},sideEffects:!1,packageManager:"pnpm@9.12.0",engines:{node:">=18.0.0"},scripts:{build:"tsup",clean:"git clean -xdf .turbo node_modules dist",format:'prettier --check "**/*.{ts,tsx}"',lint:"eslint . && node scripts/check-eslint-suppressions.mjs","pack:smoke":"node scripts/pack-smoke.mjs","peer:smoke":"node scripts/peer-compat-smoke.mjs","vue:smoke":"pnpm run build && node scripts/vue-install-smoke.mjs","nuxt:smoke":"pnpm run build && node scripts/nuxt-install-smoke.mjs","astro:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs astro","svelte:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs svelte && node scripts/framework-install-smoke.mjs sveltekit",prepublishOnly:"pnpm run verify",test:"vitest run","test:coverage":"vitest run --coverage.enabled","test:browser":"pnpm run build && tsc --noEmit -p tsconfig.browser.json && vitest run --config vitest.browser.config.ts","test:browser:mutation":"node e2e/check-lifecycle-mutation.mjs","test:watch":"vitest",typecheck:"tsc --noEmit --incremental false",verify:"pnpm run typecheck && pnpm run format && pnpm run lint && pnpm run test:coverage && pnpm run build && pnpm run pack:smoke"},exports:{".":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./provider":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./browser":{types:"./dist/browser.d.mts",import:"./dist/browser.mjs"},"./server":{types:"./dist/server.d.mts",import:"./dist/server.mjs"},"./memory":{types:"./dist/memory.d.mts",import:"./dist/memory.mjs"},"./memory/legacy":{types:"./dist/memory-legacy.d.mts",import:"./dist/memory-legacy.mjs"},"./memory/store":{types:"./dist/memory-store.d.mts",import:"./dist/memory-store.mjs"},"./next":{types:"./dist/plugin-next.d.mts",import:"./dist/plugin-next.mjs",default:"./dist/plugin-next.mjs"},"./vite":{types:"./dist/plugin-vite.d.mts",import:"./dist/plugin-vite.mjs",default:"./dist/plugin-vite.mjs"},"./vite/client":{types:"./dist/vite-client.d.ts"},"./astro":{types:"./dist/plugin-astro.d.mts",import:"./dist/plugin-astro.mjs",default:"./dist/plugin-astro.mjs"},"./nuxt":{types:"./dist/plugin-nuxt.d.mts",import:"./dist/plugin-nuxt.mjs",default:"./dist/plugin-nuxt.mjs"},"./media":{types:"./dist/media.d.mts",import:"./dist/media.mjs"},"./three":{types:"./dist/adapter-three.d.mts",import:"./dist/adapter-three.mjs"},"./react-three-fiber":{types:"./dist/adapter-react-three-fiber.d.mts",import:"./dist/adapter-react-three-fiber.mjs"}},files:["dist","codex-plugin","claude-plugin","LICENSE","README.md","THIRD_PARTY_NOTICES.md"],dependencies:{"modern-screenshot":"4.7.0",ws:"8.21.3"},optionalDependencies:{"@napi-rs/keyring":"2.1.0"},peerDependencies:{nuxt:">=4.5.2 <5","lucide-react":">=1.23.0",next:">=14.0.0",react:">=18.0.0","react-dom":">=18.0.0","@react-three/fiber":">=8.0.0",three:">=0.150.0"},peerDependenciesMeta:{nuxt:{optional:!0},next:{optional:!0},"@react-three/fiber":{optional:!0},three:{optional:!0}},devDependencies:{nuxt:"4.5.2","@kit/eslint-config":"workspace:^","@react-three/fiber":"9.7.0","@tanstack/react-router":"1.120.5","@types/react":"19.1.0","@types/react-dom":"19.1.2","@types/three":"^0.185.4","@types/ws":"8.18.1","@vitejs/plugin-react":"^5.1.1","@vitejs/plugin-vue":"6.0.8","@vitest/coverage-v8":"3.2.4",eslint:"^9.24.0",geist:"1.7.2",jsdom:"26.1.0","lucide-react":"^1.23.0",next:"15.5.24",prettier:"3.5.3",react:"19.1.0","react-dom":"19.1.0",three:"^0.185.1",tsup:"^8.5.1",typescript:"^5.8.3",vite:"7.3.6",vitest:"3.2.4",vue:"3.5.42","vue-router":"5.3.1"}};var Et=Oa.version;import{execFileSync as gw,spawn as ap}from"child_process";import{createServer as uu}from"http";import{createHash as Kp,randomBytes as Da}from"crypto";var Wp={production:{issuer:"https://popmelt.com",resource:"https://mcp.popmelt.com"},staging:{issuer:"https://webapp-staging-1bed.up.railway.app",resource:"https://mcp-staging-8731.up.railway.app"}};function ai(r){if(r!=="production"&&r!=="staging")throw new Error("Unknown Popmelt cloud environment.");return Wp[r]}function Na(r,e){if(r===!1)return null;let t=r?.environment??e??"production";if(t==="off")return null;if(t!=="production"&&t!=="staging")throw new Error("POPMELT_CLOUD_TASTE must be production, staging, or off.");return t}var rn="directions:read offline_access",Qp="directions:read directions:write offline_access",Xp="tastes:read directions:read offline_access",Yp="tastes:read directions:read directions:write offline_access",La="tastes:read tastes:inspect directions:read directions:write offline_access",Fo=[rn,Qp,Xp,Yp,La],Zp=["imprint","principles","components","assets","content"];function ze(r){if(!r||typeof r!="object"||Array.isArray(r))throw new oe("invalid_response");return r}function Ve(r){if(typeof r!="string")throw new oe("invalid_response");return r}function mt(r){let e=Ve(r);if(!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(e))throw new oe("invalid_response");return e}function zt(r){return r===null?null:Ve(r)}var oe=class extends Error{constructor(t){super(`Cloud taste: ${t}`);this.code=t;this.name="CloudTasteError"}};function eu(r,e,t){let n=ze(r);if(n.schemaVersion!==1||n.projectKey!==e||!Number.isInteger(n.generation)||Number(n.generation)<0||Number(n.generation)>2147483647)throw new oe("invalid_response");let i={schemaVersion:1,projectKey:e,generation:Number(n.generation)};if(n.direction===null)return{...i,direction:null};let o=ze(n.direction);if(!["public","private"].includes(Ve(o.sourceCollection))||!["reference","definitive"].includes(Ve(o.authority))||o.documentFormat!=="popmelt.taste.v1"||!/^[a-f0-9]{64}$/.test(Ve(o.contentHash)))throw new oe("invalid_response");let s=ze(o.sections),a={};for(let c of t){if(!Object.hasOwn(s,c))throw new oe("invalid_response");a[c]=s[c]}return{...i,direction:{revisionId:mt(o.revisionId),sourceModelId:mt(o.sourceModelId),sourceCollection:o.sourceCollection,authority:o.authority,name:Ve(o.name),description:zt(o.description),sourceVersion:zt(o.sourceVersion),sourceUpdatedAt:zt(o.sourceUpdatedAt),contentHash:Ve(o.contentHash),documentFormat:"popmelt.taste.v1",createdAt:Ve(o.createdAt),sections:a}}}function qa(r){if(r.environment!=="staging"&&r.environment!=="production"||!/^store-[A-Za-z0-9][A-Za-z0-9_.:-]{0,121}$/.test(r.storeId))throw new oe("invalid_input");let e=r.storeId,{issuer:t,resource:n}=ai(r.environment),i=r.environment==="staging"?"Popmelt Core (staging)":"Popmelt Core",o=`popmelt:taste:${t}:${n}:${e}`,s=r.fetch??fetch,a=r.now??Date.now,c=null,d=null,p=0,u=null;function w(I,h){let g=null;try{let A=ze(I.account_profile);if(A.subject===h.accountId){let b=typeof A.name=="string"&&A.name.trim().slice(0,120)||null,y=null;if(typeof A.avatarUrl=="string"&&A.avatarUrl.length<=2048)try{let P=new URL(A.avatarUrl);P.protocol==="https:"&&!P.username&&!P.password&&(y=P.href)}catch{}g={name:b,avatarUrl:y}}}catch{}u={clientId:h.clientId,accountId:h.accountId,profile:g}}let x=I=>r.vault.withLock(o,I).catch(h=>{throw h instanceof oe?h:new oe("storage_unavailable")});async function v(I,h,g={},A=!1){try{let b=await s(I,{method:"POST",headers:{"Content-Type":"application/json",...g},body:JSON.stringify(h),redirect:"error",signal:AbortSignal.timeout(15e3)});if(b.ok||await b.body?.cancel(),b.status===401||b.status===403)throw new oe("reconnect_required");if(!b.ok)throw new oe("unavailable");if(A){if(await b.body?.cancel(),b.status!==202)throw new oe("invalid_response");return{body:{},session:null}}if(!b.body)throw new oe("invalid_response");let y=b.body.getReader(),P=[],_=0;try{for(;;){let R=await y.read();if(R.done)break;if(_+=R.value.byteLength,_>256*1024)throw new oe("invalid_response");P.push(R.value)}}finally{await y.cancel()}return{body:ze(JSON.parse(Buffer.concat(P).toString("utf8"))),session:b.headers.get("mcp-session-id")}}catch(b){throw b instanceof oe?b:new oe("unavailable")}}function m(I,h,g,A=rn){try{let b=Ve(I.access_token),y=Ve(I.refresh_token);if(I.token_type!=="Bearer"||!/^[\w-]{43}$/.test(y)||Ve(I.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" "))throw new oe("invalid_response");let P=b.split(".");if(P.length!==3)throw new oe("invalid_response");let _=ze(JSON.parse(Buffer.from(P[1],"base64url").toString("utf8"))),R=mt(_.sub);if(_.iss!==t||_.aud!==n||_.client_id!==h||Ve(_.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" ")||g&&R!==g||typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp*1e3<=a()+3e4||_.exp*1e3>a()+36e5)throw new oe("invalid_response");return{credential:{clientId:h,accountId:R,refreshToken:y,...A!==rn?{scope:A}:{}},access:{token:b,expiresAt:_.exp*1e3,refreshToken:y,accountId:R}}}catch{throw new oe("invalid_response")}}async function f(I,h,g,A){return x(async b=>{let y=await b.read();if(!y)throw d=null,u=null,new oe("reconnect_required");let P=y.scope??rn;if(!Fo.includes(P)||!P.split(" ").includes(I))throw new oe("reconnect_required");if(!d||d.refreshToken!==y.refreshToken||d.expiresAt<=a()+3e4){d=null;let $=!u||u.clientId!==y.clientId||u.accountId!==y.accountId;try{await b.remove();let X=await v(`${t}/api/oauth/token`,{grant_type:"refresh_token",client_id:mt(y.clientId),refresh_token:Ve(y.refreshToken),scope:P,resource:n,...$?{include_account_profile:!0}:{}}),O=m(X.body,y.clientId,y.accountId,P);await b.write(O.credential),d=O.access,$&&w(X.body,O.credential)}catch{throw await b.remove(),new oe("reconnect_required")}}let _=d.token,R=null,N={Authorization:`Bearer ${_}`,Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"};try{let $=++p,X=await v(`${n}/mcp`,{jsonrpc:"2.0",id:$,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-taste",version:"1"}}},N);if(R=X.session,!R||X.body.jsonrpc!=="2.0"||X.body.id!==$||X.body.error||ze(X.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},{...N,"Mcp-Session-Id":R},!0);let O=++p,G=await v(`${n}/mcp`,{jsonrpc:"2.0",id:O,method:"tools/call",params:{name:h,arguments:g}},{...N,"Mcp-Session-Id":R});if(G.body.jsonrpc!=="2.0"||G.body.id!==O||G.body.error)throw new oe("invalid_response");let z=ze(ze(G.body.result).structuredContent);if(z.ok!==!0)throw new oe("unavailable");return A(z.data)}catch($){throw $ instanceof oe&&$.code==="reconnect_required"&&(d=null,await b.remove()),$}finally{R&&await s(`${n}/mcp`,{method:"DELETE",headers:{...N,"Mcp-Session-Id":R},redirect:"error",signal:AbortSignal.timeout(5e3)}).then($=>$.body?.cancel()).catch(()=>{})}})}return{async readTasteDefinition(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:inspect","get_taste_definition",{id:I,collection:h},g=>{let A=ze(g);if(A.id!==I||A.collection!==h||!/^[a-f0-9]{64}$/.test(String(A.hash)))throw new oe("invalid_response");let b=ze(A.sections),y=Array.isArray(A.versions)&&A.versions.length<=100?A.versions.map(P=>{let _=ze(P),R=zt(_.saved_at);if(R!==null&&!Number.isFinite(Date.parse(R)))throw new oe("invalid_response");return{version:Ve(_.version),saved_at:R}}):null;return{id:I,collection:h,name:Ve(A.name),version:zt(A.version),hash:String(A.hash),sections:b,versions:y}})},async readTasteSummary(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:read","get_taste_summary",{id:I,collection:h},g=>{let A=ze(g);if(!Array.isArray(A.facts)||A.facts.length>20)throw new oe("invalid_response");return{preview:A.preview,facts:A.facts.map(b=>{let y=ze(b);if(!(typeof y.value=="number"&&Number.isSafeInteger(y.value)&&y.value>=0)&&!(typeof y.value=="string"&&y.value.length<=100))throw new oe("invalid_response");return{key:Ve(y.key).slice(0,80),label:Ve(y.label).slice(0,100),value:y.value}})}})},async listPublicTastes(){let I={Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},h=null;try{let g=++p,A=await v(`${n}/mcp`,{jsonrpc:"2.0",id:g,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-catalog",version:"1"}}},I);if(h=A.session,!h||A.body.id!==g||A.body.error||ze(A.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");I["Mcp-Session-Id"]=h,await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},I,!0);let b=++p,y=await v(`${n}/mcp`,{jsonrpc:"2.0",id:b,method:"tools/call",params:{name:"discover",arguments:{type:"model",collection:"public",limit:100}}},I);if(y.body.id!==b||y.body.error)throw new oe("invalid_response");let P=ze(y.body.result);if(P.isError||!Array.isArray(P.content)||P.content.length!==1)throw new oe("invalid_response");let _=ze(P.content[0]),R=ze(JSON.parse(Ve(_.text)));if(R.type!=="model"||R.collection!=="public"||!Array.isArray(R.items)||R.items.length>100)throw new oe("invalid_response");return R.items.map(N=>{let $=ze(N);return{id:mt($.id),name:Ve($.name).slice(0,200),version:zt($.version)}})}finally{h&&await s(`${n}/mcp`,{method:"DELETE",headers:I,redirect:"error",signal:AbortSignal.timeout(5e3)}).then(g=>g.body?.cancel()).catch(()=>{})}},async beginSignIn(I){let h;try{h=new URL(I)}catch{throw new oe("invalid_input")}if(h.protocol!=="http:"||h.hostname!=="127.0.0.1"||!h.port||h.username||h.password||h.search||h.hash||h.pathname!=="/callback")throw new oe("invalid_input");return x(async g=>{let A=La;if(await g.read())throw new oe("already_connected");if(c&&c.until>a())throw new oe("sign_in_pending");c=null;let b=await v(`${t}/api/oauth/register`,{client_name:i,redirect_uris:[I],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",scope:A}),y=mt(b.body.client_id),P=Da(32).toString("base64url"),_=Da(32).toString("base64url");c={clientId:y,verifier:P,state:_,redirectUri:I,until:a()+3e5,scope:A};let R=new URL("/mcp/grant",t);return R.search=new URLSearchParams({client_id:y,redirect_uri:I,response_type:"code",code_challenge:Kp("sha256").update(P).digest("base64url"),code_challenge_method:"S256",state:_,scope:A,resource:n}).toString(),{authorizationUrl:R.href}})},async completeSignIn(I){return x(async h=>{let g;try{g=new URL(I)}catch{throw new oe("invalid_input")}let A=c;if(!A||A.until<=a()||g.origin+g.pathname!==A.redirectUri||g.username||g.password||g.hash||g.searchParams.getAll("state").length!==1||g.searchParams.get("state")!==A.state||g.searchParams.getAll("code").length!==1||!g.searchParams.get("code")||g.searchParams.has("error"))throw new oe("invalid_input");if(c=null,await h.read())throw new oe("already_connected");let b=await v(`${t}/api/oauth/token`,{grant_type:"authorization_code",client_id:A.clientId,redirect_uri:A.redirectUri,code:g.searchParams.get("code"),code_verifier:A.verifier,resource:n,include_account_profile:!0}),y=m(b.body,A.clientId,void 0,A.scope);await h.write(y.credential),d=y.access,w(b.body,y.credential)})},async status(){return x(async I=>{let h=await I.read();return(!h||u?.clientId!==h.clientId||u?.accountId!==h.accountId)&&(u=null),h?{state:"signed_in",accountId:mt(h.accountId),canWrite:(h.scope??rn).split(" ").includes("directions:write"),canInspect:(h.scope??rn).split(" ").includes("tastes:inspect"),canBrowsePrivate:(h.scope??rn).split(" ").includes("tastes:read"),...u?{profile:u.profile}:{}}:{state:"signed_out"}})},async disconnect(){return x(async I=>{c=null,d=null,u=null,await I.remove()})},async listPrivateTastes(){let I=[],h,g=new Set;for(let A=0;A<100;A++){let b=await f("tastes:read","list_private_tastes",h?{after:h}:{},y=>{let P=ze(y);if(!Array.isArray(P.items)||P.items.length>100)throw new oe("invalid_response");return{items:P.items.map(R=>{let N=ze(R),$=zt(N.thumbnailUrl),X=null;if($){let O=new URL($);O.protocol==="https:"&&!O.username&&!O.password&&(X=O.href)}return{id:mt(N.id),name:Ve(N.name).slice(0,200),version:zt(N.version),thumbnailUrl:X,preview:N.preview}}),nextCursor:P.nextCursor===null?null:mt(P.nextCursor)}});for(let y of b.items){if(g.has(y.id))throw new oe("invalid_response");g.add(y.id),I.push(y)}if(!b.nextCursor)return I;if(!b.items.length||b.nextCursor!==b.items.at(-1)?.id||h&&b.nextCursor<=h)throw new oe("invalid_response");h=b.nextCursor}throw new oe("invalid_response")},async readDirection(I=[],h){if(I.length>5||I.some(g=>!Zp.includes(g)))throw new oe("invalid_input");if(h&&(!Number.isInteger(h.expectedGeneration)||h.expectedGeneration<0||h.expectedGeneration>2147483647||h.sourceCollection!==void 0&&!["public","private"].includes(h.sourceCollection)||h.sourceCollection&&!h.sourceModelId))throw new oe("invalid_input");return h?.sourceModelId!==void 0&&mt(h.sourceModelId),f(h?"directions:write":"directions:read",h?h.sourceModelId?"adopt_project_design_direction":"clear_project_design_direction":"get_project_design_direction",h?{projectKey:e,expectedGeneration:h.expectedGeneration,...h.sourceModelId?{sourceModelId:h.sourceModelId,sourceCollection:h.sourceCollection??"public",authority:"reference"}:{}}:{projectKey:e,sections:[...new Set(I)]},g=>eu(g,e,I))}}}import{createHash as cu}from"crypto";import{mkdir as du,lstat as lu}from"fs/promises";import{homedir as pu}from"os";import{join as za}from"path";import{randomUUID as tu}from"crypto";import{mkdir as Fa,readdir as Ja,rmdir as nu,stat as ru,unlink as iu,writeFile as ou}from"fs/promises";import{dirname as su,join as Ba}from"path";import{setTimeout as au}from"timers/promises";var di=r=>r.code==="ENOENT";async function Ua(r){await nu(r).catch(e=>{if(e.code!=="ENOENT"&&e.code!=="ENOTEMPTY"&&e.code!=="EEXIST")throw e})}async function ci(r,e){await iu(Ba(r,e)).catch(t=>{if(!di(t))throw t}),await Ua(r)}async function li(r,e,t=1e4){await Fa(su(r),{recursive:!0});let n=`${process.pid}-${tu()}`,i=Date.now()+t;for(;;){let o=!1;try{await Fa(r),o=!0}catch(s){if(s.code!=="EEXIST")throw s}if(o){let s=!1;try{await ou(Ba(r,n),"",{flag:"wx",mode:384});let a=await Ja(r);s=a.length===1&&a[0]===n}catch(a){if(!di(a))throw await ci(r,n),a}if(s)try{return await e()}finally{await ci(r,n)}await ci(r,n)}else{let s=await Ja(r).catch(a=>{if(di(a))return[];throw a});for(let a of s){let c=/^(\d+)-[a-f0-9-]{36}$/.exec(a);if(!(!c||Number(c[1])<1))try{process.kill(Number(c[1]),0)}catch(d){d.code==="ESRCH"&&await ci(r,a)}}if(s.length===0){let a=await ru(r).catch(c=>{if(di(c))return null;throw c});a&&Date.now()-a.mtimeMs>1e3&&await Ua(r)}}if(Date.now()>=i)throw new Error("Thread storage is busy with another writer; retry the operation.");await au(15+Math.floor(Math.random()*15))}}function Ha(r="production"){ai(r);let e=`com.popmelt.taste.${r}`;return{async withLock(t,n){try{let i=za(pu(),".popmelt-cloud-locks");await du(i,{mode:448,recursive:!0});let o=await lu(i);if(!o.isDirectory()||o.isSymbolicLink()||process.platform!=="win32"&&((o.mode&63)!==0||o.uid!==process.getuid?.()))throw new oe("storage_unavailable");let s=cu("sha256").update(t).digest("hex");return await li(za(i,s),async()=>{let{AsyncEntry:a}=await import("@napi-rs/keyring"),c=new a(e,s,{linux:{store:"secret-service"}});return n({async read(){let d=await c.getSecret(),p=d==null?null:Buffer.from(d).toString("utf8");if(p==null)return null;let u=JSON.parse(p);if(!u||typeof u.clientId!="string"||typeof u.accountId!="string"||typeof u.refreshToken!="string"||u.scope!==void 0&&!Fo.includes(u.scope))throw new oe("storage_unavailable");return{clientId:u.clientId,accountId:u.accountId,refreshToken:u.refreshToken,...u.scope?{scope:u.scope}:{}}},async write(d){await c.setSecret(Buffer.from(JSON.stringify(d)))},async remove(){await c.deleteCredential()}})},6e4)}catch(i){throw i instanceof oe?i:new oe("storage_unavailable")}}}}function Ga(r){let e=r?"You\u2019re connected":"Sign-in didn\u2019t complete";return`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${e} \xB7 Popmelt</title>
 <style>

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import{spawn as av}from"child_process";import{closeSync as cv,openSync as dv}from"fs";import{appendFile as lv,mkdir as pv,readFile as uv,realpath as mv}from"fs/promises";import{dirname as fv,join as Ta}from"path";import{fileURLToPath as hv}from"url";function Sn(r){return Gp(r).slice(0,12)}var Hp=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Gp(r){let e=typeof TextEncoder<"u"?Array.from(new TextEncoder().encode(r)):Vp(r),t=e.length*8;for(e.push(128);e.length%64!==56;)e.push(0);for(let w=7;w>=0;w--)e.push(t/Math.pow(2,w*8)&255);let n=1779033703,i=3144134277,o=1013904242,s=2773480762,a=1359893119,c=2600822924,d=528734635,p=1541459225,u=new Array(64);for(let w=0;w<e.length;w+=64){for(let b=0;b<16;b++){let y=w+b*4;u[b]=(e[y]<<24|e[y+1]<<16|e[y+2]<<8|e[y+3])>>>0}for(let b=16;b<64;b++){let y=At(u[b-15],7)^At(u[b-15],18)^u[b-15]>>>3,P=At(u[b-2],17)^At(u[b-2],19)^u[b-2]>>>10;u[b]=u[b-16]+y+u[b-7]+P>>>0}let x=n,v=i,m=o,f=s,I=a,h=c,g=d,A=p;for(let b=0;b<64;b++){let y=At(I,6)^At(I,11)^At(I,25),P=I&h^~I&g,_=A+y+P+Hp[b]+u[b]>>>0,R=At(x,2)^At(x,13)^At(x,22),N=x&v^x&m^v&m,$=R+N>>>0;A=g,g=h,h=I,I=f+_>>>0,f=m,m=v,v=x,x=_+$>>>0}n=n+x>>>0,i=i+v>>>0,o=o+m>>>0,s=s+f>>>0,a=a+I>>>0,c=c+h>>>0,d=d+g>>>0,p=p+A>>>0}return[n,i,o,s,a,c,d,p].map(w=>w.toString(16).padStart(8,"0")).join("")}function At(r,e){return r>>>e|r<<32-e}function Vp(r){let e=[];for(let t=0;t<r.length;t++){let n=r.charCodeAt(t);n<128?e.push(n):n<2048?e.push(192|n>>6,128|n&63):e.push(224|n>>12,128|n>>6&63,128|n&63)}return e}var $a={name:"@popmelt.com/core",version:"0.27.0",description:"A tiny, powerful design layer for humans and AI",license:"PolyForm-Shield-1.0.0",author:"Popmelt <reb@popmelt.com> (https://popmelt.com)",homepage:"https://github.com/popmelt/core",bugs:{url:"https://github.com/popmelt/core/issues"},repository:{type:"git",url:"git+https://github.com/popmelt/core.git"},keywords:["ai","annotations","collaboration","devtools","react","visual-feedback"],bin:{popmelt:"dist/cli.mjs"},sideEffects:!1,packageManager:"pnpm@9.12.0",engines:{node:">=18.0.0"},scripts:{build:"tsup",clean:"git clean -xdf .turbo node_modules dist",format:'prettier --check "**/*.{ts,tsx}"',lint:"eslint . && node scripts/check-eslint-suppressions.mjs","pack:smoke":"node scripts/pack-smoke.mjs","peer:smoke":"node scripts/peer-compat-smoke.mjs","vue:smoke":"pnpm run build && node scripts/vue-install-smoke.mjs","nuxt:smoke":"pnpm run build && node scripts/nuxt-install-smoke.mjs","astro:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs astro","svelte:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs svelte && node scripts/framework-install-smoke.mjs sveltekit",prepublishOnly:"pnpm run verify",test:"vitest run","test:coverage":"vitest run --coverage.enabled","test:browser":"pnpm run build && tsc --noEmit -p tsconfig.browser.json && vitest run --config vitest.browser.config.ts","test:browser:mutation":"node e2e/check-lifecycle-mutation.mjs","test:watch":"vitest",typecheck:"tsc --noEmit --incremental false",verify:"pnpm run typecheck && pnpm run format && pnpm run lint && pnpm run test:coverage && pnpm run build && pnpm run pack:smoke"},exports:{".":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./provider":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./browser":{types:"./dist/browser.d.mts",import:"./dist/browser.mjs"},"./server":{types:"./dist/server.d.mts",import:"./dist/server.mjs"},"./memory":{types:"./dist/memory.d.mts",import:"./dist/memory.mjs"},"./memory/legacy":{types:"./dist/memory-legacy.d.mts",import:"./dist/memory-legacy.mjs"},"./memory/store":{types:"./dist/memory-store.d.mts",import:"./dist/memory-store.mjs"},"./next":{types:"./dist/plugin-next.d.mts",import:"./dist/plugin-next.mjs",default:"./dist/plugin-next.mjs"},"./vite":{types:"./dist/plugin-vite.d.mts",import:"./dist/plugin-vite.mjs",default:"./dist/plugin-vite.mjs"},"./vite/client":{types:"./dist/vite-client.d.ts"},"./astro":{types:"./dist/plugin-astro.d.mts",import:"./dist/plugin-astro.mjs",default:"./dist/plugin-astro.mjs"},"./nuxt":{types:"./dist/plugin-nuxt.d.mts",import:"./dist/plugin-nuxt.mjs",default:"./dist/plugin-nuxt.mjs"},"./media":{types:"./dist/media.d.mts",import:"./dist/media.mjs"},"./three":{types:"./dist/adapter-three.d.mts",import:"./dist/adapter-three.mjs"},"./react-three-fiber":{types:"./dist/adapter-react-three-fiber.d.mts",import:"./dist/adapter-react-three-fiber.mjs"}},files:["dist","codex-plugin","claude-plugin","LICENSE","README.md","THIRD_PARTY_NOTICES.md"],dependencies:{"modern-screenshot":"4.7.0",ws:"8.21.3"},optionalDependencies:{"@napi-rs/keyring":"2.1.0"},peerDependencies:{nuxt:">=4.5.2 <5","lucide-react":">=1.23.0",next:">=14.0.0",react:">=18.0.0","react-dom":">=18.0.0","@react-three/fiber":">=8.0.0",three:">=0.150.0"},peerDependenciesMeta:{nuxt:{optional:!0},next:{optional:!0},"@react-three/fiber":{optional:!0},three:{optional:!0}},devDependencies:{nuxt:"4.5.2","@kit/eslint-config":"workspace:^","@react-three/fiber":"9.7.0","@tanstack/react-router":"1.120.5","@types/react":"19.1.0","@types/react-dom":"19.1.2","@types/three":"^0.185.4","@types/ws":"8.18.1","@vitejs/plugin-react":"^5.1.1","@vitejs/plugin-vue":"6.0.8","@vitest/coverage-v8":"3.2.4",eslint:"^9.24.0",geist:"1.7.2",jsdom:"26.1.0","lucide-react":"^1.23.0",next:"15.5.24",prettier:"3.5.3",react:"19.1.0","react-dom":"19.1.0",three:"^0.185.1",tsup:"^8.5.1",typescript:"^5.8.3",vite:"7.3.6",vitest:"3.2.4",vue:"3.5.42","vue-router":"5.3.1"}};var Et=$a.version;import{execFileSync as yw,spawn as sp}from"child_process";import{createServer as mu}from"http";import{createHash as Qp,randomBytes as Na}from"crypto";var Kp={production:{issuer:"https://popmelt.com",resource:"https://mcp.popmelt.com"},staging:{issuer:"https://webapp-staging-1bed.up.railway.app",resource:"https://mcp-staging-8731.up.railway.app"}};function ai(r){if(r!=="production"&&r!=="staging")throw new Error("Unknown Popmelt cloud environment.");return Kp[r]}function Oa(r,e){if(r===!1)return null;let t=r?.environment??e??"production";if(t==="off")return null;if(t!=="production"&&t!=="staging")throw new Error("POPMELT_CLOUD_TASTE must be production, staging, or off.");return t}var rn="directions:read offline_access",Xp="directions:read directions:write offline_access",Yp="tastes:read directions:read offline_access",Zp="tastes:read directions:read directions:write offline_access",Da="tastes:read tastes:inspect directions:read directions:write offline_access",Jo=[rn,Xp,Yp,Zp,Da],eu=["imprint","principles","components","assets","content"];function ze(r){if(!r||typeof r!="object"||Array.isArray(r))throw new oe("invalid_response");return r}function Ve(r){if(typeof r!="string")throw new oe("invalid_response");return r}function mt(r){let e=Ve(r);if(!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(e))throw new oe("invalid_response");return e}function zt(r){return r===null?null:Ve(r)}var oe=class extends Error{constructor(t){super(`Cloud taste: ${t}`);this.code=t;this.name="CloudTasteError"}};function tu(r,e,t){let n=ze(r);if(n.schemaVersion!==1||n.projectKey!==e||!Number.isInteger(n.generation)||Number(n.generation)<0||Number(n.generation)>2147483647)throw new oe("invalid_response");let i={schemaVersion:1,projectKey:e,generation:Number(n.generation)};if(n.direction===null)return{...i,direction:null};let o=ze(n.direction);if(!["public","private"].includes(Ve(o.sourceCollection))||!["reference","definitive"].includes(Ve(o.authority))||o.documentFormat!=="popmelt.taste.v1"||!/^[a-f0-9]{64}$/.test(Ve(o.contentHash)))throw new oe("invalid_response");let s=ze(o.sections),a={};for(let c of t){if(!Object.hasOwn(s,c))throw new oe("invalid_response");a[c]=s[c]}return{...i,direction:{revisionId:mt(o.revisionId),sourceModelId:mt(o.sourceModelId),sourceCollection:o.sourceCollection,authority:o.authority,name:Ve(o.name),description:zt(o.description),sourceVersion:zt(o.sourceVersion),sourceUpdatedAt:zt(o.sourceUpdatedAt),contentHash:Ve(o.contentHash),documentFormat:"popmelt.taste.v1",createdAt:Ve(o.createdAt),sections:a}}}function La(r){if(r.environment!=="staging"&&r.environment!=="production"||!/^store-[A-Za-z0-9][A-Za-z0-9_.:-]{0,121}$/.test(r.storeId))throw new oe("invalid_input");let e=r.storeId,{issuer:t,resource:n}=ai(r.environment),i=r.environment==="staging"?"Popmelt Core (staging)":"Popmelt Core",o=`popmelt:taste:${t}:${n}:${e}`,s=r.fetch??fetch,a=r.now??Date.now,c=null,d=null,p=0,u=null;function w(I,h){let g=null;try{let A=ze(I.account_profile);if(A.subject===h.accountId){let b=typeof A.name=="string"&&A.name.trim().slice(0,120)||null,y=null;if(typeof A.avatarUrl=="string"&&A.avatarUrl.length<=2048)try{let P=new URL(A.avatarUrl);P.protocol==="https:"&&!P.username&&!P.password&&(y=P.href)}catch{}g={name:b,avatarUrl:y}}}catch{}u={clientId:h.clientId,accountId:h.accountId,profile:g}}let x=I=>r.vault.withLock(o,I).catch(h=>{throw h instanceof oe?h:new oe("storage_unavailable")});async function v(I,h,g={},A=!1){try{let b=await s(I,{method:"POST",headers:{"Content-Type":"application/json",...g},body:JSON.stringify(h),redirect:"error",signal:AbortSignal.timeout(15e3)});if(b.ok||await b.body?.cancel(),b.status===401||b.status===403)throw new oe("reconnect_required");if(!b.ok)throw new oe("unavailable");if(A){if(await b.body?.cancel(),b.status!==202)throw new oe("invalid_response");return{body:{},session:null}}if(!b.body)throw new oe("invalid_response");let y=b.body.getReader(),P=[],_=0;try{for(;;){let R=await y.read();if(R.done)break;if(_+=R.value.byteLength,_>256*1024)throw new oe("invalid_response");P.push(R.value)}}finally{await y.cancel()}return{body:ze(JSON.parse(Buffer.concat(P).toString("utf8"))),session:b.headers.get("mcp-session-id")}}catch(b){throw b instanceof oe?b:new oe("unavailable")}}function m(I,h,g,A=rn){try{let b=Ve(I.access_token),y=Ve(I.refresh_token);if(I.token_type!=="Bearer"||!/^[\w-]{43}$/.test(y)||Ve(I.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" "))throw new oe("invalid_response");let P=b.split(".");if(P.length!==3)throw new oe("invalid_response");let _=ze(JSON.parse(Buffer.from(P[1],"base64url").toString("utf8"))),R=mt(_.sub);if(_.iss!==t||_.aud!==n||_.client_id!==h||Ve(_.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" ")||g&&R!==g||typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp*1e3<=a()+3e4||_.exp*1e3>a()+36e5)throw new oe("invalid_response");return{credential:{clientId:h,accountId:R,refreshToken:y,...A!==rn?{scope:A}:{}},access:{token:b,expiresAt:_.exp*1e3,refreshToken:y,accountId:R}}}catch{throw new oe("invalid_response")}}async function f(I,h,g,A){return x(async b=>{let y=await b.read();if(!y)throw d=null,u=null,new oe("reconnect_required");let P=y.scope??rn;if(!Jo.includes(P)||!P.split(" ").includes(I))throw new oe("reconnect_required");if(!d||d.refreshToken!==y.refreshToken||d.expiresAt<=a()+3e4){d=null;let $=!u||u.clientId!==y.clientId||u.accountId!==y.accountId;try{await b.remove();let X=await v(`${t}/api/oauth/token`,{grant_type:"refresh_token",client_id:mt(y.clientId),refresh_token:Ve(y.refreshToken),scope:P,resource:n,...$?{include_account_profile:!0}:{}}),O=m(X.body,y.clientId,y.accountId,P);await b.write(O.credential),d=O.access,$&&w(X.body,O.credential)}catch{throw await b.remove(),new oe("reconnect_required")}}let _=d.token,R=null,N={Authorization:`Bearer ${_}`,Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"};try{let $=++p,X=await v(`${n}/mcp`,{jsonrpc:"2.0",id:$,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-taste",version:"1"}}},N);if(R=X.session,!R||X.body.jsonrpc!=="2.0"||X.body.id!==$||X.body.error||ze(X.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},{...N,"Mcp-Session-Id":R},!0);let O=++p,G=await v(`${n}/mcp`,{jsonrpc:"2.0",id:O,method:"tools/call",params:{name:h,arguments:g}},{...N,"Mcp-Session-Id":R});if(G.body.jsonrpc!=="2.0"||G.body.id!==O||G.body.error)throw new oe("invalid_response");let z=ze(ze(G.body.result).structuredContent);if(z.ok!==!0)throw new oe("unavailable");return A(z.data)}catch($){throw $ instanceof oe&&$.code==="reconnect_required"&&(d=null,await b.remove()),$}finally{R&&await s(`${n}/mcp`,{method:"DELETE",headers:{...N,"Mcp-Session-Id":R},redirect:"error",signal:AbortSignal.timeout(5e3)}).then($=>$.body?.cancel()).catch(()=>{})}})}return{async readTasteDefinition(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:inspect","get_taste_definition",{id:I,collection:h},g=>{let A=ze(g);if(A.id!==I||A.collection!==h||!/^[a-f0-9]{64}$/.test(String(A.hash)))throw new oe("invalid_response");let b=ze(A.sections),y=Array.isArray(A.versions)&&A.versions.length<=100?A.versions.map(P=>{let _=ze(P),R=zt(_.saved_at);if(R!==null&&!Number.isFinite(Date.parse(R)))throw new oe("invalid_response");return{version:Ve(_.version),saved_at:R}}):null;return{id:I,collection:h,name:Ve(A.name),version:zt(A.version),hash:String(A.hash),sections:b,versions:y}})},async readTasteSummary(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:read","get_taste_summary",{id:I,collection:h},g=>{let A=ze(g);if(!Array.isArray(A.facts)||A.facts.length>20)throw new oe("invalid_response");return{preview:A.preview,facts:A.facts.map(b=>{let y=ze(b);if(!(typeof y.value=="number"&&Number.isSafeInteger(y.value)&&y.value>=0)&&!(typeof y.value=="string"&&y.value.length<=100))throw new oe("invalid_response");return{key:Ve(y.key).slice(0,80),label:Ve(y.label).slice(0,100),value:y.value}})}})},async listPublicTastes(){let I={Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},h=null;try{let g=++p,A=await v(`${n}/mcp`,{jsonrpc:"2.0",id:g,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-catalog",version:"1"}}},I);if(h=A.session,!h||A.body.id!==g||A.body.error||ze(A.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");I["Mcp-Session-Id"]=h,await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},I,!0);let b=++p,y=await v(`${n}/mcp`,{jsonrpc:"2.0",id:b,method:"tools/call",params:{name:"discover",arguments:{type:"model",collection:"public",limit:100}}},I);if(y.body.id!==b||y.body.error)throw new oe("invalid_response");let P=ze(y.body.result);if(P.isError||!Array.isArray(P.content)||P.content.length!==1)throw new oe("invalid_response");let _=ze(P.content[0]),R=ze(JSON.parse(Ve(_.text)));if(R.type!=="model"||R.collection!=="public"||!Array.isArray(R.items)||R.items.length>100)throw new oe("invalid_response");return R.items.map(N=>{let $=ze(N);return{id:mt($.id),name:Ve($.name).slice(0,200),version:zt($.version)}})}finally{h&&await s(`${n}/mcp`,{method:"DELETE",headers:I,redirect:"error",signal:AbortSignal.timeout(5e3)}).then(g=>g.body?.cancel()).catch(()=>{})}},async beginSignIn(I){let h;try{h=new URL(I)}catch{throw new oe("invalid_input")}if(h.protocol!=="http:"||h.hostname!=="127.0.0.1"||!h.port||h.username||h.password||h.search||h.hash||h.pathname!=="/callback")throw new oe("invalid_input");return x(async g=>{let A=Da;if(await g.read())throw new oe("already_connected");if(c&&c.until>a())throw new oe("sign_in_pending");c=null;let b=await v(`${t}/api/oauth/register`,{client_name:i,redirect_uris:[I],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",scope:A}),y=mt(b.body.client_id),P=Na(32).toString("base64url"),_=Na(32).toString("base64url");c={clientId:y,verifier:P,state:_,redirectUri:I,until:a()+3e5,scope:A};let R=new URL("/mcp/grant",t);return R.search=new URLSearchParams({client_id:y,redirect_uri:I,response_type:"code",code_challenge:Qp("sha256").update(P).digest("base64url"),code_challenge_method:"S256",state:_,scope:A,resource:n}).toString(),{authorizationUrl:R.href}})},async completeSignIn(I){return x(async h=>{let g;try{g=new URL(I)}catch{throw new oe("invalid_input")}let A=c;if(!A||A.until<=a()||g.origin+g.pathname!==A.redirectUri||g.username||g.password||g.hash||g.searchParams.getAll("state").length!==1||g.searchParams.get("state")!==A.state||g.searchParams.getAll("code").length!==1||!g.searchParams.get("code")||g.searchParams.has("error"))throw new oe("invalid_input");if(c=null,await h.read())throw new oe("already_connected");let b=await v(`${t}/api/oauth/token`,{grant_type:"authorization_code",client_id:A.clientId,redirect_uri:A.redirectUri,code:g.searchParams.get("code"),code_verifier:A.verifier,resource:n,include_account_profile:!0}),y=m(b.body,A.clientId,void 0,A.scope);await h.write(y.credential),d=y.access,w(b.body,y.credential)})},async status(){return x(async I=>{let h=await I.read();return(!h||u?.clientId!==h.clientId||u?.accountId!==h.accountId)&&(u=null),h?{state:"signed_in",accountId:mt(h.accountId),canWrite:(h.scope??rn).split(" ").includes("directions:write"),canInspect:(h.scope??rn).split(" ").includes("tastes:inspect"),canBrowsePrivate:(h.scope??rn).split(" ").includes("tastes:read"),...u?{profile:u.profile}:{}}:{state:"signed_out"}})},async disconnect(){return x(async I=>{c=null,d=null,u=null,await I.remove()})},async listPrivateTastes(){let I=[],h,g=new Set;for(let A=0;A<100;A++){let b=await f("tastes:read","list_private_tastes",h?{after:h}:{},y=>{let P=ze(y);if(!Array.isArray(P.items)||P.items.length>100)throw new oe("invalid_response");return{items:P.items.map(R=>{let N=ze(R),$=zt(N.thumbnailUrl),X=null;if($){let O=new URL($);O.protocol==="https:"&&!O.username&&!O.password&&(X=O.href)}return{id:mt(N.id),name:Ve(N.name).slice(0,200),version:zt(N.version),thumbnailUrl:X,preview:N.preview}}),nextCursor:P.nextCursor===null?null:mt(P.nextCursor)}});for(let y of b.items){if(g.has(y.id))throw new oe("invalid_response");g.add(y.id),I.push(y)}if(!b.nextCursor)return I;if(!b.items.length||b.nextCursor!==b.items.at(-1)?.id||h&&b.nextCursor<=h)throw new oe("invalid_response");h=b.nextCursor}throw new oe("invalid_response")},async readDirection(I=[],h){if(I.length>5||I.some(g=>!eu.includes(g)))throw new oe("invalid_input");if(h&&(!Number.isInteger(h.expectedGeneration)||h.expectedGeneration<0||h.expectedGeneration>2147483647||h.sourceCollection!==void 0&&!["public","private"].includes(h.sourceCollection)||h.sourceCollection&&!h.sourceModelId))throw new oe("invalid_input");return h?.sourceModelId!==void 0&&mt(h.sourceModelId),f(h?"directions:write":"directions:read",h?h.sourceModelId?"adopt_project_design_direction":"clear_project_design_direction":"get_project_design_direction",h?{projectKey:e,expectedGeneration:h.expectedGeneration,...h.sourceModelId?{sourceModelId:h.sourceModelId,sourceCollection:h.sourceCollection??"public",authority:"reference"}:{}}:{projectKey:e,sections:[...new Set(I)]},g=>tu(g,e,I))}}}import{createHash as du}from"crypto";import{mkdir as lu,lstat as pu}from"fs/promises";import{homedir as uu}from"os";import{join as Ua}from"path";import{randomUUID as nu}from"crypto";import{mkdir as qa,readdir as Ja,rmdir as ru,stat as iu,unlink as ou,writeFile as su}from"fs/promises";import{dirname as au,join as Fa}from"path";import{setTimeout as cu}from"timers/promises";var di=r=>r.code==="ENOENT";async function Ba(r){await ru(r).catch(e=>{if(e.code!=="ENOENT"&&e.code!=="ENOTEMPTY"&&e.code!=="EEXIST")throw e})}async function ci(r,e){await ou(Fa(r,e)).catch(t=>{if(!di(t))throw t}),await Ba(r)}async function li(r,e,t=1e4){await qa(au(r),{recursive:!0});let n=`${process.pid}-${nu()}`,i=Date.now()+t;for(;;){let o=!1;try{await qa(r),o=!0}catch(s){if(s.code!=="EEXIST")throw s}if(o){let s=!1;try{await su(Fa(r,n),"",{flag:"wx",mode:384});let a=await Ja(r);s=a.length===1&&a[0]===n}catch(a){if(!di(a))throw await ci(r,n),a}if(s)try{return await e()}finally{await ci(r,n)}await ci(r,n)}else{let s=await Ja(r).catch(a=>{if(di(a))return[];throw a});for(let a of s){let c=/^(\d+)-[a-f0-9-]{36}$/.exec(a);if(!(!c||Number(c[1])<1))try{process.kill(Number(c[1]),0)}catch(d){d.code==="ESRCH"&&await ci(r,a)}}if(s.length===0){let a=await iu(r).catch(c=>{if(di(c))return null;throw c});a&&Date.now()-a.mtimeMs>1e3&&await Ba(r)}}if(Date.now()>=i)throw new Error("Thread storage is busy with another writer; retry the operation.");await cu(15+Math.floor(Math.random()*15))}}function za(r="production"){ai(r);let e=`com.popmelt.taste.${r}`;return{async withLock(t,n){try{let i=Ua(uu(),".popmelt-cloud-locks");await lu(i,{mode:448,recursive:!0});let o=await pu(i);if(!o.isDirectory()||o.isSymbolicLink()||process.platform!=="win32"&&((o.mode&63)!==0||o.uid!==process.getuid?.()))throw new oe("storage_unavailable");let s=du("sha256").update(t).digest("hex");return await li(Ua(i,s),async()=>{let{AsyncEntry:a}=await import("@napi-rs/keyring"),c=new a(e,s,{linux:{store:"secret-service"}});return n({async read(){let d=await c.getSecret(),p=d==null?null:Buffer.from(d).toString("utf8");if(p==null)return null;let u=JSON.parse(p);if(!u||typeof u.clientId!="string"||typeof u.accountId!="string"||typeof u.refreshToken!="string"||u.scope!==void 0&&!Jo.includes(u.scope))throw new oe("storage_unavailable");return{clientId:u.clientId,accountId:u.accountId,refreshToken:u.refreshToken,...u.scope?{scope:u.scope}:{}}},async write(d){await c.setSecret(Buffer.from(JSON.stringify(d)))},async remove(){await c.deleteCredential()}})},6e4)}catch(i){throw i instanceof oe?i:new oe("storage_unavailable")}}}}function Ha(r){let e=r?"You\u2019re connected":"Sign-in didn\u2019t complete";return`<!doctype html>
+import{spawn as av}from"child_process";import{closeSync as cv,openSync as dv}from"fs";import{appendFile as lv,mkdir as pv,readFile as uv,realpath as mv}from"fs/promises";import{dirname as fv,join as Ta}from"path";import{fileURLToPath as hv}from"url";function Sn(r){return Gp(r).slice(0,12)}var Hp=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298];function Gp(r){let e=typeof TextEncoder<"u"?Array.from(new TextEncoder().encode(r)):Vp(r),t=e.length*8;for(e.push(128);e.length%64!==56;)e.push(0);for(let w=7;w>=0;w--)e.push(t/Math.pow(2,w*8)&255);let n=1779033703,i=3144134277,o=1013904242,s=2773480762,a=1359893119,c=2600822924,d=528734635,p=1541459225,u=new Array(64);for(let w=0;w<e.length;w+=64){for(let b=0;b<16;b++){let y=w+b*4;u[b]=(e[y]<<24|e[y+1]<<16|e[y+2]<<8|e[y+3])>>>0}for(let b=16;b<64;b++){let y=At(u[b-15],7)^At(u[b-15],18)^u[b-15]>>>3,P=At(u[b-2],17)^At(u[b-2],19)^u[b-2]>>>10;u[b]=u[b-16]+y+u[b-7]+P>>>0}let x=n,v=i,m=o,f=s,I=a,h=c,g=d,A=p;for(let b=0;b<64;b++){let y=At(I,6)^At(I,11)^At(I,25),P=I&h^~I&g,_=A+y+P+Hp[b]+u[b]>>>0,R=At(x,2)^At(x,13)^At(x,22),N=x&v^x&m^v&m,$=R+N>>>0;A=g,g=h,h=I,I=f+_>>>0,f=m,m=v,v=x,x=_+$>>>0}n=n+x>>>0,i=i+v>>>0,o=o+m>>>0,s=s+f>>>0,a=a+I>>>0,c=c+h>>>0,d=d+g>>>0,p=p+A>>>0}return[n,i,o,s,a,c,d,p].map(w=>w.toString(16).padStart(8,"0")).join("")}function At(r,e){return r>>>e|r<<32-e}function Vp(r){let e=[];for(let t=0;t<r.length;t++){let n=r.charCodeAt(t);n<128?e.push(n):n<2048?e.push(192|n>>6,128|n&63):e.push(224|n>>12,128|n>>6&63,128|n&63)}return e}var $a={name:"@popmelt.com/core",version:"0.27.1",description:"A tiny, powerful design layer for humans and AI",license:"PolyForm-Shield-1.0.0",author:"Popmelt <reb@popmelt.com> (https://popmelt.com)",homepage:"https://github.com/popmelt/core",bugs:{url:"https://github.com/popmelt/core/issues"},repository:{type:"git",url:"git+https://github.com/popmelt/core.git"},keywords:["ai","annotations","collaboration","devtools","react","visual-feedback"],bin:{popmelt:"dist/cli.mjs"},sideEffects:!1,packageManager:"pnpm@9.12.0",engines:{node:">=18.0.0"},scripts:{build:"tsup",clean:"git clean -xdf .turbo node_modules dist",format:'prettier --check "**/*.{ts,tsx}"',lint:"eslint . && node scripts/check-eslint-suppressions.mjs","pack:smoke":"node scripts/pack-smoke.mjs","peer:smoke":"node scripts/peer-compat-smoke.mjs","vue:smoke":"pnpm run build && node scripts/vue-install-smoke.mjs","nuxt:smoke":"pnpm run build && node scripts/nuxt-install-smoke.mjs","astro:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs astro","svelte:smoke":"pnpm run build && node scripts/framework-install-smoke.mjs svelte && node scripts/framework-install-smoke.mjs sveltekit",prepublishOnly:"pnpm run verify",test:"vitest run","test:coverage":"vitest run --coverage.enabled","test:browser":"pnpm run build && tsc --noEmit -p tsconfig.browser.json && vitest run --config vitest.browser.config.ts","test:browser:mutation":"node e2e/check-lifecycle-mutation.mjs","test:watch":"vitest",typecheck:"tsc --noEmit --incremental false",verify:"pnpm run typecheck && pnpm run format && pnpm run lint && pnpm run test:coverage && pnpm run build && pnpm run pack:smoke"},exports:{".":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./provider":{types:"./dist/index.d.mts",import:"./dist/index.mjs"},"./browser":{types:"./dist/browser.d.mts",import:"./dist/browser.mjs"},"./server":{types:"./dist/server.d.mts",import:"./dist/server.mjs"},"./memory":{types:"./dist/memory.d.mts",import:"./dist/memory.mjs"},"./memory/legacy":{types:"./dist/memory-legacy.d.mts",import:"./dist/memory-legacy.mjs"},"./memory/store":{types:"./dist/memory-store.d.mts",import:"./dist/memory-store.mjs"},"./next":{types:"./dist/plugin-next.d.mts",import:"./dist/plugin-next.mjs",default:"./dist/plugin-next.mjs"},"./vite":{types:"./dist/plugin-vite.d.mts",import:"./dist/plugin-vite.mjs",default:"./dist/plugin-vite.mjs"},"./vite/client":{types:"./dist/vite-client.d.ts"},"./astro":{types:"./dist/plugin-astro.d.mts",import:"./dist/plugin-astro.mjs",default:"./dist/plugin-astro.mjs"},"./nuxt":{types:"./dist/plugin-nuxt.d.mts",import:"./dist/plugin-nuxt.mjs",default:"./dist/plugin-nuxt.mjs"},"./media":{types:"./dist/media.d.mts",import:"./dist/media.mjs"},"./three":{types:"./dist/adapter-three.d.mts",import:"./dist/adapter-three.mjs"},"./react-three-fiber":{types:"./dist/adapter-react-three-fiber.d.mts",import:"./dist/adapter-react-three-fiber.mjs"}},files:["dist","codex-plugin","claude-plugin","LICENSE","README.md","THIRD_PARTY_NOTICES.md"],dependencies:{"modern-screenshot":"4.7.0",ws:"8.21.3"},optionalDependencies:{"@napi-rs/keyring":"2.1.0"},peerDependencies:{nuxt:">=4.5.2 <5","lucide-react":">=1.23.0",next:">=14.0.0",react:">=18.0.0","react-dom":">=18.0.0","@react-three/fiber":">=8.0.0",three:">=0.150.0"},peerDependenciesMeta:{nuxt:{optional:!0},next:{optional:!0},"@react-three/fiber":{optional:!0},three:{optional:!0}},devDependencies:{nuxt:"4.5.2","@kit/eslint-config":"workspace:^","@react-three/fiber":"9.7.0","@tanstack/react-router":"1.120.5","@types/react":"19.1.0","@types/react-dom":"19.1.2","@types/three":"^0.185.4","@types/ws":"8.18.1","@vitejs/plugin-react":"^5.1.1","@vitejs/plugin-vue":"6.0.8","@vitest/coverage-v8":"3.2.4",eslint:"^9.24.0",geist:"1.7.2",jsdom:"26.1.0","lucide-react":"^1.23.0",next:"15.5.24",prettier:"3.5.3",react:"19.1.0","react-dom":"19.1.0",three:"^0.185.1",tsup:"^8.5.1",typescript:"^5.8.3",vite:"7.3.6",vitest:"3.2.4",vue:"3.5.42","vue-router":"5.3.1"}};var Et=$a.version;import{execFileSync as yw,spawn as sp}from"child_process";import{createServer as mu}from"http";import{createHash as Qp,randomBytes as Na}from"crypto";var Kp={production:{issuer:"https://popmelt.com",resource:"https://mcp.popmelt.com"},staging:{issuer:"https://webapp-staging-1bed.up.railway.app",resource:"https://mcp-staging-8731.up.railway.app"}};function ai(r){if(r!=="production"&&r!=="staging")throw new Error("Unknown Popmelt cloud environment.");return Kp[r]}function Oa(r,e){if(r===!1)return null;let t=r?.environment??e??"production";if(t==="off")return null;if(t!=="production"&&t!=="staging")throw new Error("POPMELT_CLOUD_TASTE must be production, staging, or off.");return t}var rn="directions:read offline_access",Xp="directions:read directions:write offline_access",Yp="tastes:read directions:read offline_access",Zp="tastes:read directions:read directions:write offline_access",Da="tastes:read tastes:inspect directions:read directions:write offline_access",Jo=[rn,Xp,Yp,Zp,Da],eu=["imprint","principles","components","assets","content"];function ze(r){if(!r||typeof r!="object"||Array.isArray(r))throw new oe("invalid_response");return r}function Ve(r){if(typeof r!="string")throw new oe("invalid_response");return r}function mt(r){let e=Ve(r);if(!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(e))throw new oe("invalid_response");return e}function zt(r){return r===null?null:Ve(r)}var oe=class extends Error{constructor(t){super(`Cloud taste: ${t}`);this.code=t;this.name="CloudTasteError"}};function tu(r,e,t){let n=ze(r);if(n.schemaVersion!==1||n.projectKey!==e||!Number.isInteger(n.generation)||Number(n.generation)<0||Number(n.generation)>2147483647)throw new oe("invalid_response");let i={schemaVersion:1,projectKey:e,generation:Number(n.generation)};if(n.direction===null)return{...i,direction:null};let o=ze(n.direction);if(!["public","private"].includes(Ve(o.sourceCollection))||!["reference","definitive"].includes(Ve(o.authority))||o.documentFormat!=="popmelt.taste.v1"||!/^[a-f0-9]{64}$/.test(Ve(o.contentHash)))throw new oe("invalid_response");let s=ze(o.sections),a={};for(let c of t){if(!Object.hasOwn(s,c))throw new oe("invalid_response");a[c]=s[c]}return{...i,direction:{revisionId:mt(o.revisionId),sourceModelId:mt(o.sourceModelId),sourceCollection:o.sourceCollection,authority:o.authority,name:Ve(o.name),description:zt(o.description),sourceVersion:zt(o.sourceVersion),sourceUpdatedAt:zt(o.sourceUpdatedAt),contentHash:Ve(o.contentHash),documentFormat:"popmelt.taste.v1",createdAt:Ve(o.createdAt),sections:a}}}function La(r){if(r.environment!=="staging"&&r.environment!=="production"||!/^store-[A-Za-z0-9][A-Za-z0-9_.:-]{0,121}$/.test(r.storeId))throw new oe("invalid_input");let e=r.storeId,{issuer:t,resource:n}=ai(r.environment),i=r.environment==="staging"?"Popmelt Core (staging)":"Popmelt Core",o=`popmelt:taste:${t}:${n}:${e}`,s=r.fetch??fetch,a=r.now??Date.now,c=null,d=null,p=0,u=null;function w(I,h){let g=null;try{let A=ze(I.account_profile);if(A.subject===h.accountId){let b=typeof A.name=="string"&&A.name.trim().slice(0,120)||null,y=null;if(typeof A.avatarUrl=="string"&&A.avatarUrl.length<=2048)try{let P=new URL(A.avatarUrl);P.protocol==="https:"&&!P.username&&!P.password&&(y=P.href)}catch{}g={name:b,avatarUrl:y}}}catch{}u={clientId:h.clientId,accountId:h.accountId,profile:g}}let x=I=>r.vault.withLock(o,I).catch(h=>{throw h instanceof oe?h:new oe("storage_unavailable")});async function v(I,h,g={},A=!1){try{let b=await s(I,{method:"POST",headers:{"Content-Type":"application/json",...g},body:JSON.stringify(h),redirect:"error",signal:AbortSignal.timeout(15e3)});if(b.ok||await b.body?.cancel(),b.status===401||b.status===403)throw new oe("reconnect_required");if(!b.ok)throw new oe("unavailable");if(A){if(await b.body?.cancel(),b.status!==202)throw new oe("invalid_response");return{body:{},session:null}}if(!b.body)throw new oe("invalid_response");let y=b.body.getReader(),P=[],_=0;try{for(;;){let R=await y.read();if(R.done)break;if(_+=R.value.byteLength,_>256*1024)throw new oe("invalid_response");P.push(R.value)}}finally{await y.cancel()}return{body:ze(JSON.parse(Buffer.concat(P).toString("utf8"))),session:b.headers.get("mcp-session-id")}}catch(b){throw b instanceof oe?b:new oe("unavailable")}}function m(I,h,g,A=rn){try{let b=Ve(I.access_token),y=Ve(I.refresh_token);if(I.token_type!=="Bearer"||!/^[\w-]{43}$/.test(y)||Ve(I.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" "))throw new oe("invalid_response");let P=b.split(".");if(P.length!==3)throw new oe("invalid_response");let _=ze(JSON.parse(Buffer.from(P[1],"base64url").toString("utf8"))),R=mt(_.sub);if(_.iss!==t||_.aud!==n||_.client_id!==h||Ve(_.scope).split(" ").sort().join(" ")!==A.split(" ").sort().join(" ")||g&&R!==g||typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp*1e3<=a()+3e4||_.exp*1e3>a()+36e5)throw new oe("invalid_response");return{credential:{clientId:h,accountId:R,refreshToken:y,...A!==rn?{scope:A}:{}},access:{token:b,expiresAt:_.exp*1e3,refreshToken:y,accountId:R}}}catch{throw new oe("invalid_response")}}async function f(I,h,g,A){return x(async b=>{let y=await b.read();if(!y)throw d=null,u=null,new oe("reconnect_required");let P=y.scope??rn;if(!Jo.includes(P)||!P.split(" ").includes(I))throw new oe("reconnect_required");if(!d||d.refreshToken!==y.refreshToken||d.expiresAt<=a()+3e4){d=null;let $=!u||u.clientId!==y.clientId||u.accountId!==y.accountId;try{await b.remove();let X=await v(`${t}/api/oauth/token`,{grant_type:"refresh_token",client_id:mt(y.clientId),refresh_token:Ve(y.refreshToken),scope:P,resource:n,...$?{include_account_profile:!0}:{}}),O=m(X.body,y.clientId,y.accountId,P);await b.write(O.credential),d=O.access,$&&w(X.body,O.credential)}catch{throw await b.remove(),new oe("reconnect_required")}}let _=d.token,R=null,N={Authorization:`Bearer ${_}`,Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"};try{let $=++p,X=await v(`${n}/mcp`,{jsonrpc:"2.0",id:$,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-taste",version:"1"}}},N);if(R=X.session,!R||X.body.jsonrpc!=="2.0"||X.body.id!==$||X.body.error||ze(X.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},{...N,"Mcp-Session-Id":R},!0);let O=++p,G=await v(`${n}/mcp`,{jsonrpc:"2.0",id:O,method:"tools/call",params:{name:h,arguments:g}},{...N,"Mcp-Session-Id":R});if(G.body.jsonrpc!=="2.0"||G.body.id!==O||G.body.error)throw new oe("invalid_response");let z=ze(ze(G.body.result).structuredContent);if(z.ok!==!0)throw new oe("unavailable");return A(z.data)}catch($){throw $ instanceof oe&&$.code==="reconnect_required"&&(d=null,await b.remove()),$}finally{R&&await s(`${n}/mcp`,{method:"DELETE",headers:{...N,"Mcp-Session-Id":R},redirect:"error",signal:AbortSignal.timeout(5e3)}).then($=>$.body?.cancel()).catch(()=>{})}})}return{async readTasteDefinition(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:inspect","get_taste_definition",{id:I,collection:h},g=>{let A=ze(g);if(A.id!==I||A.collection!==h||!/^[a-f0-9]{64}$/.test(String(A.hash)))throw new oe("invalid_response");let b=ze(A.sections),y=Array.isArray(A.versions)&&A.versions.length<=100?A.versions.map(P=>{let _=ze(P),R=zt(_.saved_at);if(R!==null&&!Number.isFinite(Date.parse(R)))throw new oe("invalid_response");return{version:Ve(_.version),saved_at:R}}):null;return{id:I,collection:h,name:Ve(A.name),version:zt(A.version),hash:String(A.hash),sections:b,versions:y}})},async readTasteSummary(I,h){if(mt(I),h!=="public"&&h!=="private")throw new oe("invalid_input");return f("tastes:read","get_taste_summary",{id:I,collection:h},g=>{let A=ze(g);if(!Array.isArray(A.facts)||A.facts.length>20)throw new oe("invalid_response");return{preview:A.preview,facts:A.facts.map(b=>{let y=ze(b);if(!(typeof y.value=="number"&&Number.isSafeInteger(y.value)&&y.value>=0)&&!(typeof y.value=="string"&&y.value.length<=100))throw new oe("invalid_response");return{key:Ve(y.key).slice(0,80),label:Ve(y.label).slice(0,100),value:y.value}})}})},async listPublicTastes(){let I={Accept:"application/json, text/event-stream","MCP-Protocol-Version":"2025-03-26"},h=null;try{let g=++p,A=await v(`${n}/mcp`,{jsonrpc:"2.0",id:g,method:"initialize",params:{protocolVersion:"2025-03-26",capabilities:{},clientInfo:{name:"popmelt-core-catalog",version:"1"}}},I);if(h=A.session,!h||A.body.id!==g||A.body.error||ze(A.body.result).protocolVersion!=="2025-03-26")throw new oe("invalid_response");I["Mcp-Session-Id"]=h,await v(`${n}/mcp`,{jsonrpc:"2.0",method:"notifications/initialized"},I,!0);let b=++p,y=await v(`${n}/mcp`,{jsonrpc:"2.0",id:b,method:"tools/call",params:{name:"discover",arguments:{type:"model",collection:"public",limit:100}}},I);if(y.body.id!==b||y.body.error)throw new oe("invalid_response");let P=ze(y.body.result);if(P.isError||!Array.isArray(P.content)||P.content.length!==1)throw new oe("invalid_response");let _=ze(P.content[0]),R=ze(JSON.parse(Ve(_.text)));if(R.type!=="model"||R.collection!=="public"||!Array.isArray(R.items)||R.items.length>100)throw new oe("invalid_response");return R.items.map(N=>{let $=ze(N);return{id:mt($.id),name:Ve($.name).slice(0,200),version:zt($.version)}})}finally{h&&await s(`${n}/mcp`,{method:"DELETE",headers:I,redirect:"error",signal:AbortSignal.timeout(5e3)}).then(g=>g.body?.cancel()).catch(()=>{})}},async beginSignIn(I){let h;try{h=new URL(I)}catch{throw new oe("invalid_input")}if(h.protocol!=="http:"||h.hostname!=="127.0.0.1"||!h.port||h.username||h.password||h.search||h.hash||h.pathname!=="/callback")throw new oe("invalid_input");return x(async g=>{let A=Da;if(await g.read())throw new oe("already_connected");if(c&&c.until>a())throw new oe("sign_in_pending");c=null;let b=await v(`${t}/api/oauth/register`,{client_name:i,redirect_uris:[I],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none",scope:A}),y=mt(b.body.client_id),P=Na(32).toString("base64url"),_=Na(32).toString("base64url");c={clientId:y,verifier:P,state:_,redirectUri:I,until:a()+3e5,scope:A};let R=new URL("/mcp/grant",t);return R.search=new URLSearchParams({client_id:y,redirect_uri:I,response_type:"code",code_challenge:Qp("sha256").update(P).digest("base64url"),code_challenge_method:"S256",state:_,scope:A,resource:n}).toString(),{authorizationUrl:R.href}})},async completeSignIn(I){return x(async h=>{let g;try{g=new URL(I)}catch{throw new oe("invalid_input")}let A=c;if(!A||A.until<=a()||g.origin+g.pathname!==A.redirectUri||g.username||g.password||g.hash||g.searchParams.getAll("state").length!==1||g.searchParams.get("state")!==A.state||g.searchParams.getAll("code").length!==1||!g.searchParams.get("code")||g.searchParams.has("error"))throw new oe("invalid_input");if(c=null,await h.read())throw new oe("already_connected");let b=await v(`${t}/api/oauth/token`,{grant_type:"authorization_code",client_id:A.clientId,redirect_uri:A.redirectUri,code:g.searchParams.get("code"),code_verifier:A.verifier,resource:n,include_account_profile:!0}),y=m(b.body,A.clientId,void 0,A.scope);await h.write(y.credential),d=y.access,w(b.body,y.credential)})},async status(){return x(async I=>{let h=await I.read();return(!h||u?.clientId!==h.clientId||u?.accountId!==h.accountId)&&(u=null),h?{state:"signed_in",accountId:mt(h.accountId),canWrite:(h.scope??rn).split(" ").includes("directions:write"),canInspect:(h.scope??rn).split(" ").includes("tastes:inspect"),canBrowsePrivate:(h.scope??rn).split(" ").includes("tastes:read"),...u?{profile:u.profile}:{}}:{state:"signed_out"}})},async disconnect(){return x(async I=>{c=null,d=null,u=null,await I.remove()})},async listPrivateTastes(){let I=[],h,g=new Set;for(let A=0;A<100;A++){let b=await f("tastes:read","list_private_tastes",h?{after:h}:{},y=>{let P=ze(y);if(!Array.isArray(P.items)||P.items.length>100)throw new oe("invalid_response");return{items:P.items.map(R=>{let N=ze(R),$=zt(N.thumbnailUrl),X=null;if($){let O=new URL($);O.protocol==="https:"&&!O.username&&!O.password&&(X=O.href)}return{id:mt(N.id),name:Ve(N.name).slice(0,200),version:zt(N.version),thumbnailUrl:X,preview:N.preview}}),nextCursor:P.nextCursor===null?null:mt(P.nextCursor)}});for(let y of b.items){if(g.has(y.id))throw new oe("invalid_response");g.add(y.id),I.push(y)}if(!b.nextCursor)return I;if(!b.items.length||b.nextCursor!==b.items.at(-1)?.id||h&&b.nextCursor<=h)throw new oe("invalid_response");h=b.nextCursor}throw new oe("invalid_response")},async readDirection(I=[],h){if(I.length>5||I.some(g=>!eu.includes(g)))throw new oe("invalid_input");if(h&&(!Number.isInteger(h.expectedGeneration)||h.expectedGeneration<0||h.expectedGeneration>2147483647||h.sourceCollection!==void 0&&!["public","private"].includes(h.sourceCollection)||h.sourceCollection&&!h.sourceModelId))throw new oe("invalid_input");return h?.sourceModelId!==void 0&&mt(h.sourceModelId),f(h?"directions:write":"directions:read",h?h.sourceModelId?"adopt_project_design_direction":"clear_project_design_direction":"get_project_design_direction",h?{projectKey:e,expectedGeneration:h.expectedGeneration,...h.sourceModelId?{sourceModelId:h.sourceModelId,sourceCollection:h.sourceCollection??"public",authority:"reference"}:{}}:{projectKey:e,sections:[...new Set(I)]},g=>tu(g,e,I))}}}import{createHash as du}from"crypto";import{mkdir as lu,lstat as pu}from"fs/promises";import{homedir as uu}from"os";import{join as Ua}from"path";import{randomUUID as nu}from"crypto";import{mkdir as qa,readdir as Ja,rmdir as ru,stat as iu,unlink as ou,writeFile as su}from"fs/promises";import{dirname as au,join as Fa}from"path";import{setTimeout as cu}from"timers/promises";var di=r=>r.code==="ENOENT";async function Ba(r){await ru(r).catch(e=>{if(e.code!=="ENOENT"&&e.code!=="ENOTEMPTY"&&e.code!=="EEXIST")throw e})}async function ci(r,e){await ou(Fa(r,e)).catch(t=>{if(!di(t))throw t}),await Ba(r)}async function li(r,e,t=1e4){await qa(au(r),{recursive:!0});let n=`${process.pid}-${nu()}`,i=Date.now()+t;for(;;){let o=!1;try{await qa(r),o=!0}catch(s){if(s.code!=="EEXIST")throw s}if(o){let s=!1;try{await su(Fa(r,n),"",{flag:"wx",mode:384});let a=await Ja(r);s=a.length===1&&a[0]===n}catch(a){if(!di(a))throw await ci(r,n),a}if(s)try{return await e()}finally{await ci(r,n)}await ci(r,n)}else{let s=await Ja(r).catch(a=>{if(di(a))return[];throw a});for(let a of s){let c=/^(\d+)-[a-f0-9-]{36}$/.exec(a);if(!(!c||Number(c[1])<1))try{process.kill(Number(c[1]),0)}catch(d){d.code==="ESRCH"&&await ci(r,a)}}if(s.length===0){let a=await iu(r).catch(c=>{if(di(c))return null;throw c});a&&Date.now()-a.mtimeMs>1e3&&await Ba(r)}}if(Date.now()>=i)throw new Error("Thread storage is busy with another writer; retry the operation.");await cu(15+Math.floor(Math.random()*15))}}function za(r="production"){ai(r);let e=`com.popmelt.taste.${r}`;return{async withLock(t,n){try{let i=Ua(uu(),".popmelt-cloud-locks");await lu(i,{mode:448,recursive:!0});let o=await pu(i);if(!o.isDirectory()||o.isSymbolicLink()||process.platform!=="win32"&&((o.mode&63)!==0||o.uid!==process.getuid?.()))throw new oe("storage_unavailable");let s=du("sha256").update(t).digest("hex");return await li(Ua(i,s),async()=>{let{AsyncEntry:a}=await import("@napi-rs/keyring"),c=new a(e,s,{linux:{store:"secret-service"}});return n({async read(){let d=await c.getSecret(),p=d==null?null:Buffer.from(d).toString("utf8");if(p==null)return null;let u=JSON.parse(p);if(!u||typeof u.clientId!="string"||typeof u.accountId!="string"||typeof u.refreshToken!="string"||u.scope!==void 0&&!Jo.includes(u.scope))throw new oe("storage_unavailable");return{clientId:u.clientId,accountId:u.accountId,refreshToken:u.refreshToken,...u.scope?{scope:u.scope}:{}}},async write(d){await c.setSecret(Buffer.from(JSON.stringify(d)))},async remove(){await c.deleteCredential()}})},6e4)}catch(i){throw i instanceof oe?i:new oe("storage_unavailable")}}}}function Ha(r){let e=r?"You\u2019re connected":"Sign-in didn\u2019t complete";return`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${e} \xB7 Popmelt</title>
 <style>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popmelt.com/core",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "A tiny, powerful design layer for humans and AI",
   "license": "PolyForm-Shield-1.0.0",
   "author": "Popmelt <reb@popmelt.com> (https://popmelt.com)",