@rabbi696/ezrouter 0.6.14 → 0.6.15

package/app/public/CHANGELOG.md

@@ -1,40 +1,49 @@
-# v0.6.14 (2026-09-27)
-
-## Upstream Synchronization & Core Enhancements (decolua/9router #4375 - #4396)
-- **Streaming & SSE Protocol Integrity**:
-  - Terminate OpenAI SSE stream with `[DONE]` sentinel on clean completions (`#4375`).
-  - Forward SSE comment heartbeats (`: keep-alive`) in translate mode to prevent reverse-proxy timeouts (`#4376`).
-  - Populate complete `output` array in OpenAI Responses `response.completed` event (`#4380`).
-- **Structured Outputs & Tool Calling**:
-  - Carry structured outputs (`response_format` / `json_schema`) bi-directionally between OpenAI Responses and Chat Completions (`#4377`).
-  - Scope `tool_call_id` name lookup strictly to its own assistant turn to prevent cross-turn tool name contamination (`#4379`).
-  - Emit `custom_tool_call` instead of `function_call` for `type: "custom"` tools in Responses (`#4386`).
-  - Preserve message turns when input contains unknown or future content block types like `container_upload` (`#4383`).
-  - Keep function-tool `strict` semantics on all Responses routes (Chat->Responses maps omitted/null to `strict: false`, Claude->OpenAI carries boolean, executors preserve declared `null`/`false`/`true`) (`#4396`).
-- **Provider & Schema Compatibility**:
-  - Automatically rename tool parameters named `properties` to `tool_properties` to avoid Gemini 400 rejection (`#4382`).
-  - Strip `errorMessage` and other non-standard draft JSON schema keywords from Gemini tool declarations (`#4391`).
-  - Clamp `max_output_tokens` for OpenCode `muse-spark` to `[8000, 1M]` to prevent empty completion responses (`#4387`).
-  - Add DeepSeek v4.1 Flash vision capability alias and add Zed to live catalog providers (`#4392`).
-  - Add `codebuddy-intl` to OAuth test configuration with `tokenExists` strategy (`#4394`).
-- **Routing, Fallback & Error Handling**:
-  - Keep rotating connections on account-scoped 4xx errors (`#4378`).
-  - Fall through combos on model-scoped 400/410 errors and Codex SSE `response.failed` payloads (`#4381`).
-  - Reject disabled models at request time, not just in `/v1/models` listing (`#4388`).
-  - Reduce 500/502/503/504 connection cooldown from 30s to 5s to survive fast client retries (`#4393`).
-  - Keep upstream web search timeout armed until the entire response body is read (`#4385`).
-- **Storage, CLI Settings & UI Improvements**:
-  - Preserve active `modelLock_*` entries in database when connection status is marked active (`#4389`).
-  - Merge provider block and preserve custom `contextWindow` / `maxTokens` on Pi settings save (`#4390`).
-  - Sync `?provider=` URL parameter with provider filter on Quota page for bookmarkable deep links (`#4395`).
-  - Narrow auto-updater process whitelist and use `ps -eo` to avoid unintended SIGKILL of unrelated processes (`#4384`).
-- **Bug Fixes & Database Integrity**:
-  - **Usage Provider Map Test Node Leaks**: Fixed issue where automated test dummy connections (`seed-0`, `seed-1`, `seed-3`, etc.) leaked into the SQLite database and rendered as unwanted nodes in the `/dashboard/usage` topology map.
-  - **Topology Provider Guard**: Hardened `isLLMProvider` in `UsageStats.js` to strictly validate provider existence against `AI_PROVIDERS`, `FREE_PROVIDERS`, or user-registered custom provider nodes (`providerNodes`), preventing any unverified or orphaned connection names from appearing in the UI.
-  - **Database Migration 007**: Added automated migration `007-cleanup-test-connections` to automatically purge all residual test connection entries (`openai-compatible-*`, `seed-*`, `kimchi-nope`) from SQLite storage.
-  - **Test Isolation**: Isolated test databases in `provider-priority-insert-cost.test.js` and `api-key-policies.test.js` using temporary directories and set a global Vitest `DATA_DIR` fallback to completely safeguard the user's `~/.ezrouter` directory from being touched by test runs.
-  - **Grok CLI Tool Strict Preservation**: Enforced function tool strict preservation in `grok-cli-compat.js` via `readToolStrict` and `restoreToolStrict`.
-- **Branding & Invariants**:
+# v0.6.15 (2026-10-01)
+
+## Critical Security Fixes
+- **OS Command Injection & SSRF Hardening**: Fixed OS command injection vulnerability via the `--host` argument in browser launcher CLI, and eliminated authenticated SSRF risks via DNS rebinding and redirect following on provider-node validation routes and MCP probes (`#4455`).
+
+## Upstream Synchronization & Core Enhancements (decolua/9router #4396 - #4518)
+- **Models & Provider Integrations**:
+  - **GLM**: Added Z.ai OAuth login to GLM Coding (`glm-coding`) with dual-auth (API key + OAuth) (`#4502`), and enabled thinking effort support on `glm-5.2` and `glm-5.3-flash`.
+  - **Claude**: Added Claude Sonnet 5.5 (`claude-sonnet-5.5`) (`#4489`) and `claude-opus-5.5` models in Kiro registry (`#4409`).
+  - **Codex**: Added GPT-6.1 Sol (`#4488`) with CLI identity refresh (`#4473`), 1M context variants for GPT-6 and GPT-5.6 (`#4423`), preserved hosted web search on GPT-6 Sol/Luna (`#4420`), added `gpt-daybreak` and `gpt-reserve` models, and routed bare `gpt-5.x`/`gpt-6.x` slugs to Codex (`#4418`).
+  - **Gemini**: Added Gemini 4 Argon (`gemini-4-argon`) (`#4507`), summed usage parts when Gemini omits `totalTokenCount` (`#4412`), and sanitized `$`-prefixed keys (`$ref`, `$defs`) in functionResponse results (`#4456`).
+  - **NVIDIA**: Refreshed NVIDIA NIM model catalog from 7 chat models to 33 chat models (`#4515`).
+  - **Meta Muse & System One**: Added Meta Muse provider with OAuth login and model catalog (`#4401`), and added v1m System One provider (`#4407`).
+  - **Capabilities**: Added capability patterns for `qwen3.8*` and `longcat-2.5*` (`#4514`), seeded Agnes 2.5/3.0 model IDs (`#4403`), and published real GPT-6 and GPT-5.4+ context windows and combo token limits (`#4478`).
+- **CLI Launcher (`ezrouter`)**:
+  - Added `ezrouter connect` command for connecting client CLI tools to remote EzRouter servers (`#4497`).
+  - Replaced `sk_9router` placeholder with the first active dashboard API key in CLI tools (`#4419`).
+- **Thinking & Reasoning Blocks**:
+  - Added `xhigh` thinking level to Claude adaptive thinking (`#4494`).
+  - Resolved Claude Sonnet 5.x to adaptive thinking to prevent forged thinking placeholder injection (`#4483`).
+  - Injected unsigned thinking placeholders for OpenCode Go DeepSeek `/messages` (`#4436`).
+  - Captured streaming reasoning chunks arriving as `delta.reasoning` / `delta.reasoning_details` (`#4457`).
+- **Streaming & Translation Protocols**:
+  - Forwarded Responses `input_image` tool outputs as user image blocks rather than massive stringified base64 text, preserving contiguous tool messages (`#4518`).
+  - Bounded deferred completion waits in Responses API with a 3s watchdog and ensured real usage is populated before emitting `response.completed` (`#4476`).
+  - Carried in-band stream errors across format translation (`#4477`).
+  - Converted forced-SSE JSON responses for Claude clients and shared completion converters (`#4466`).
+  - Echoed client-requested model in `message_start` for routed streams (`#4513`).
+  - Cached a tool loop's final tool results with the 4th breakpoint in Claude (`#4485`).
+  - Preserved trailing user turn to prevent accidental assistant prefill (`#4482`), and preserved intentional prefill from non-messages source formats (`#4481`).
+  - Preserved user turns containing only `container_upload` blocks (`#4404`).
+- **Tool Calling & Schema Robustness**:
+  - Coerced free-form property values and tuple items in tool schemas (`#4442`).
+  - Deduped same-name tools for DeepSeek models (`#4417`).
+  - Always emitted tool_result `is_error` for Zed Anthropic wire (`#4464`).
+- **Proxy & Reliability**:
+  - Added automatic fallback to insecure TLS on self-signed cert errors (`#4405`).
+  - Maintained strictProxy hold when no proxy resolves (`#4406`).
+  - Prevented Codex refresh-token reuse on auto-ping to eliminate unintended logouts (`#4425`).
+  - Extracted `resetsAtMs` from Codebuddy 6004 rate limit error and forwarded `recurring` for codebuddy-intl quota packs (`#4422`).
+  - Sent Grok CLI 1.0.44 user-agent and version headers to prevent HTTP 426 (`#4410`).
+- **Dashboard & Persistence**:
+  - Excluded hidden providers from usage stats provider dropdown (`#4411`).
+  - Supported per-provider custom header overrides from registry (`#4402`).
+  - Synchronized `?provider=` URL parameter with provider filter on Quota page for bookmarkable deep links (`#4395`).
+- **Branding & Local Invariants**:
   - Preserved default gateway port strictly at **20126**.
   - Maintained EzRouter package and CLI branding (`@rabbi696/ezrouter`, `ezrouter-app`, `ezrouter`, `sk_ezrouter`, `~/.ezrouter`).
 

package/cli.js

@@ -94,6 +94,19 @@ if (args[0] === "xai" && args[1] === "video") {
   return;
 }
 
+// `ezrouter connect <url>` configures local CLI tools against a remote server —
+// no local server, no runtime deps. Usable via `npx @rabbi696/ezrouter connect …`.
+if (args[0] === "connect") {
+  const { run } = require("./src/cli/commands/connect");
+  run(args.slice(1))
+    .then((code) => process.exit(code))
+    .catch((err) => {
+      console.error(`❌ ${err?.message || err}`);
+      process.exit(1);
+    });
+  return;
+}
+
 const homebrewManaged = isHomebrewManaged();
 
 if (!homebrewManaged) {
@@ -175,6 +188,8 @@ Options:
   -v, --version       Show version
 
 Commands:
+  connect <server-url> Configure CLI tools for a remote EzRouter server
+                      (npx @rabbi696/ezrouter connect http://host:20126 — no install needed)
   codex auth-token     Print the provider-scoped Codex bridge token
   xai video --prompt "..." --output video.mp4
                       Generate a Grok Imagine video via the running gateway
@@ -585,21 +600,17 @@ function checkForUpdate() {
 // Open browser
 function openBrowser(url) {
   const platform = process.platform;
-  let cmd;
-
-  if (platform === "darwin") {
-    cmd = `open "${url}"`;
-  } else if (platform === "win32") {
-    cmd = `start "" "${url}"`;
-  } else {
-    cmd = `xdg-open "${url}"`;
-  }
-
-  exec(cmd, { windowsHide: true }, (err) => {
-    if (err) {
-      console.log(`Open browser manually: ${url}`);
+  try {
+    if (platform === "darwin") {
+      spawn("open", [url], { stdio: "ignore", detached: true, windowsHide: true }).unref();
+    } else if (platform === "win32") {
+      spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true, windowsHide: true }).unref();
+    } else {
+      spawn("xdg-open", [url], { stdio: "ignore", detached: true, windowsHide: true }).unref();
     }
-  });
+  } catch {
+    console.log(`Open browser manually: ${url}`);
+  }
 }
 
 // Find standalone server (bundled in bin/app for published package).

package/hooks/postinstall.js

@@ -3,6 +3,10 @@
 // Postinstall: warm-up SQLite deps into ~/.9router/runtime so the first
 // `9router` start doesn't need network. Failure here is non-fatal —
 // cli.js will retry at runtime if anything is missing.
+// `npx 9router …` (npm_command=exec) is typically a one-shot `connect` — skip
+// the runtime warm-up; cli.js self-heals it if the server is started later.
+if (process.env.npm_command === "exec") process.exit(0);
+
 const { ensureSqliteRuntime } = require("./sqliteRuntime");
 const { ensureTrayRuntime } = require("./trayRuntime");
 const { isHomebrewManaged } = require("./packageManager");

package/node_modules/confbox/LICENSE

@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Third-Party Licenses
+
+This software includes bundled third-party dependencies. The licenses and
+copyright notices for these dependencies are available in
+`dist/THIRD-PARTY-LICENSES.md` within the distributed package.

package/node_modules/confbox/README.md

@@ -0,0 +1,191 @@
+# confbox
+
+<!-- automd:badges color=yellow bundlephobia packagephobia -->
+
+[![npm version](https://img.shields.io/npm/v/confbox?color=yellow)](https://npmjs.com/package/confbox)
+[![npm downloads](https://img.shields.io/npm/dm/confbox?color=yellow)](https://npm.chart.dev/confbox)
+[![bundle size](https://img.shields.io/bundlephobia/minzip/confbox?color=yellow)](https://bundlephobia.com/package/confbox)
+[![install size](https://badgen.net/packagephobia/install/confbox?color=yellow)](https://packagephobia.com/result?p=confbox)
+
+<!-- /automd -->
+
+Parsing and serialization utils for [YAML](https://yaml.org/) ([js-yaml](https://github.com/nodeca/js-yaml)), [TOML](https://toml.io/) ([smol-toml](https://github.com/squirrelchat/smol-toml)), [JSONC](https://github.com/microsoft/node-jsonc-parser) ([jsonc-parser](https://github.com/microsoft/node-jsonc-parser)), [JSON5](https://json5.org/) ([json5](https://github.com/json5/json5)), [INI](https://en.wikipedia.org/wiki/INI_file) ([ini](https://www.npmjs.com/package/ini)) and [JSON](https://www.json.org/json-en.html).
+
+✨ Zero dependency and tree-shakable
+
+✨ Types exported out of the box
+
+✨ Preserves code style (indentation and whitespace)
+
+> [!TIP]
+> Use [unjs/c12](https://github.com/unjs/c12) for a full featured configuration loader!
+
+## Usage
+
+Install package:
+
+<!-- automd:pm-i no-version -->
+
+```sh
+# ✨ Auto-detect
+npx nypm install confbox
+
+# npm
+npm install confbox
+
+# yarn
+yarn add confbox
+
+# pnpm
+pnpm add confbox
+
+# bun
+bun install confbox
+
+# deno
+deno install npm:confbox
+```
+
+<!-- /automd -->
+
+Import:
+
+<!-- automd:jsimport cdn src="./src/index.ts" -->
+
+**ESM** (Node.js, Bun, Deno)
+
+```js
+import {
+  parseJSON5,
+  stringifyJSON5,
+  parseJSONC,
+  stringifyJSONC,
+  parseYAML,
+  stringifyYAML,
+  parseJSON,
+  stringifyJSON,
+  parseTOML,
+  stringifyTOML,
+  parseINI,
+  stringifyINI,
+} from "confbox";
+```
+
+**CDN** (Deno and Browsers)
+
+```js
+import {
+  parseJSON5,
+  stringifyJSON5,
+  parseJSONC,
+  stringifyJSONC,
+  parseYAML,
+  stringifyYAML,
+  parseJSON,
+  stringifyJSON,
+  parseTOML,
+  stringifyTOML,
+  parseINI,
+  stringifyINI,
+} from "https://esm.sh/confbox";
+```
+
+<!-- /automd -->
+
+<!-- automd:jsdocs src="./src/index" -->
+
+### `parseINI(text, options?)`
+
+Converts an [INI](https://www.ini.org/ini-en.html) string into an object.
+
+**Note:** Style and indentation are not preserved currently.
+
+### `parseJSON(text, options?)`
+
+Converts a [JSON](https://www.json.org/json-en.html) string into an object.
+
+Indentation status is auto-detected and preserved when stringifying back using `stringifyJSON`
+
+### `parseJSON5(text, options?)`
+
+Converts a [JSON5](https://json5.org/) string into an object.
+
+### `parseJSONC(text, options?)`
+
+Converts a [JSONC](https://github.com/microsoft/node-jsonc-parser) string into an object.
+
+### `parseTOML(text)`
+
+Converts a [TOML](https://toml.io/) string into an object.
+
+### `parseYAML(text, options?)`
+
+Converts a [YAML](https://yaml.org/) string into an object.
+
+### `stringifyINI(value, options?)`
+
+Converts a JavaScript value to an [INI](https://www.ini.org/ini-en.html) string.
+
+**Note:** Style and indentation are not preserved currently.
+
+### `stringifyJSON(value, options?)`
+
+Converts a JavaScript value to a [JSON](https://www.json.org/json-en.html) string.
+
+Indentation status is auto detected and preserved when using value from parseJSON.
+
+### `stringifyJSON5(value, options?)`
+
+Converts a JavaScript value to a [JSON5](https://json5.org/) string.
+
+### `stringifyJSONC(value, options?)`
+
+Converts a JavaScript value to a [JSONC](https://github.com/microsoft/node-jsonc-parser) string.
+
+### `stringifyTOML(value)`
+
+Converts a JavaScript value to a [TOML](https://toml.io/) string.
+
+### `stringifyYAML(value, options?)`
+
+Converts a JavaScript value to a [YAML](https://yaml.org/) string.
+
+<!-- /automd -->
+
+<!-- automd:fetch url="gh:unjs/.github/main/snippets/readme-contrib-node-pnpm.md" -->
+
+## Contribution
+
+<details>
+  <summary>Local development</summary>
+
+- Clone this repository
+- Install the latest LTS version of [Node.js](https://nodejs.org/en/)
+- Enable [Corepack](https://github.com/nodejs/corepack) using `corepack enable`
+- Install dependencies using `pnpm install`
+- Run tests using `pnpm dev` or `pnpm test`
+
+</details>
+
+<!-- /automd -->
+
+## License
+
+<!-- automd:contributors license=MIT author=pi0 -->
+
+Published under the [MIT](https://github.com/unjs/confbox/blob/main/LICENSE) license.
+Made by [@pi0](https://github.com/pi0) and [community](https://github.com/unjs/confbox/graphs/contributors) 💛
+<br><br>
+<a href="https://github.com/unjs/confbox/graphs/contributors">
+<img src="https://contrib.rocks/image?repo=unjs/confbox" />
+</a>
+
+<!-- /automd -->
+
+<!-- automd:with-automd -->
+
+---
+
+_🤖 auto updated with [automd](https://automd.unjs.io)_
+
+<!-- /automd -->

package/node_modules/confbox/dist/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,171 @@
+# Licenses of Bundled Dependencies
+
+The published artifact additionally contains code with the following licenses:
+BSD-3-Clause, ISC, MIT
+
+# Bundled Dependencies
+
+## detect-indent
+
+License: MIT
+By: Sindre Sorhus
+Repository: https://github.com/sindresorhus/detect-indent
+
+> MIT License
+> 
+> Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
+## ini
+
+License: ISC
+By: GitHub Inc.
+Repository: https://github.com/npm/ini
+
+> The ISC License
+> 
+> Copyright (c) Isaac Z. Schlueter and Contributors
+> 
+> Permission to use, copy, modify, and/or distribute this software for any
+> purpose with or without fee is hereby granted, provided that the above
+> copyright notice and this permission notice appear in all copies.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+> WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+> MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+> ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+> WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+> ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+> IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+---------------------------------------
+
+## js-yaml
+
+License: MIT
+By: Vladimir Zapparov, Aleksey V Zapparov, Vitaly Puzrin, Martin Grenfell
+Repository: https://github.com/nodeca/js-yaml
+
+> (The MIT License)
+> 
+> Copyright (C) 2011-2015 by Vitaly Puzrin
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in
+> all copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+> THE SOFTWARE.
+
+---------------------------------------
+
+## json5
+
+License: MIT
+By: Aseem Kishore, Max Nanasy, Andrew Eisenberg, Jordan Tucker
+Repository: https://github.com/json5/json5
+
+> MIT License
+> 
+> Copyright (c) 2012-2018 Aseem Kishore, and [others].
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+> 
+> [others]: https://github.com/json5/json5/contributors
+
+---------------------------------------
+
+## jsonc-parser
+
+License: MIT
+By: Microsoft Corporation
+Repository: https://github.com/microsoft/node-jsonc-parser
+
+> The MIT License (MIT)
+> 
+> Copyright (c) Microsoft
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
+---------------------------------------
+
+## smol-toml
+
+License: BSD-3-Clause
+By: Cynthia
+Repository: https://github.com/squirrelchat/smol-toml
+
+> Copyright (c) Squirrel Chat et al., All rights reserved.
+> 
+> Redistribution and use in source and binary forms, with or without
+> modification, are permitted provided that the following conditions are met:
+> 
+> 1. Redistributions of source code must retain the above copyright notice, this
+>    list of conditions and the following disclaimer.
+> 2. Redistributions in binary form must reproduce the above copyright notice,
+>    this list of conditions and the following disclaimer in the
+>    documentation and/or other materials provided with the distribution.
+> 3. Neither the name of the copyright holder nor the names of its contributors
+>    may be used to endorse or promote products derived from this software without
+>    specific prior written permission.
+> 
+> THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+> ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+> WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+> DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+> FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+> DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+> SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+> CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+> OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+> OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/node_modules/confbox/dist/_chunks/_format.d.mts

@@ -0,0 +1,25 @@
+//#region src/_format.d.ts
+interface FormatOptions {
+  /**
+   * A String or Number object that's used to insert white space into the output JSON string for readability purposes.
+   *
+   * When provided, identation won't be auto detected anymore.
+   */
+  indent?: string | number;
+  /**
+   * Set to `false` to skip indentation preservation.
+   */
+  preserveIndentation?: boolean;
+  /**
+   * Set to `false` to skip whitespace preservation.
+   */
+  preserveWhitespace?: boolean;
+  /**
+   * The number of characters to sample from the start of the text.
+   *
+   * Default: 1024
+   */
+  sampleSize?: number;
+}
+//#endregion
+export { FormatOptions as t };

package/node_modules/confbox/dist/_chunks/_format.mjs

@@ -0,0 +1 @@
+import{t as e}from"./libs/detect-indent.mjs";const t=Symbol.for(`__confbox_fmt__`),n=/^(\s+)/,r=/(\s+)$/;function i(e,t={}){return{sample:t.indent===void 0&&t.preserveIndentation!==!1&&e.slice(0,t?.sampleSize||1024),whiteSpace:t.preserveWhitespace===!1?void 0:{start:n.exec(e)?.[0]||``,end:r.exec(e)?.[0]||``}}}function a(e,n,r){!n||typeof n!=`object`||Object.defineProperty(n,t,{enumerable:!1,configurable:!0,writable:!0,value:i(e,r)})}function o(n,r){if(!n||typeof n!=`object`||!(t in n))return{indent:r?.indent??2,whitespace:{start:``,end:``}};let i=n[t];return{indent:r?.indent||e(i.sample||``).indent,whitespace:i.whiteSpace||{start:``,end:``}}}export{a as n,o as t};

package/node_modules/confbox/dist/_chunks/json.mjs

@@ -0,0 +1 @@
+import{n as e,t}from"./_format.mjs";function n(t,n){let r=JSON.parse(t,n?.reviver);return e(t,r,n),r}function r(e,n){let r=t(e,n),i=JSON.stringify(e,n?.replacer,r.indent);return r.whitespace.start+i+r.whitespace.end}export{r as n,n as t};

package/node_modules/confbox/dist/_chunks/libs/detect-indent.mjs

@@ -0,0 +1 @@
+const e=/^(?:( )+|\t+)/,t=`space`;function n(e,n,r){return e&&n===t&&r===1}function r(r,a){let o=new Map,s=0,c,l;for(let u of r.split(/\n/g)){if(!u)continue;let r=u.match(e);if(r===null)s=0,c=``;else{let e=r[0].length,u=r[1]?t:`tab`;if(n(a,u,e))continue;u!==c&&(s=0),c=u;let d=1,f=0,p=e-s;if(s=e,p===0)d=0,f=1;else{let e=Math.abs(p);if(n(a,u,e))continue;l=i(u,e)}let m=o.get(l);o.set(l,m===void 0?[1,0]:[m[0]+d,m[1]+f])}}return o}function i(e,n){return(e===t?`s`:`t`)+String(n)}function a(e){return{type:e[0]===`s`?t:`tab`,amount:Number(e.slice(1))}}function o(e){let t,n=0,r=0;for(let[i,[a,o]]of e)(a>n||a===n&&o>r)&&(n=a,r=o,t=i);return t}function s(e,n){return(e===t?` `:`	`).repeat(n)}function c(e){if(typeof e!=`string`)throw TypeError(`Expected a string`);let t=r(e,!0);t.size===0&&(t=r(e,!1));let n=o(t),i,c=0,l=``;return n!==void 0&&({type:i,amount:c}=a(n),l=s(i,c)),{amount:c,type:i,indent:l}}export{c as t};

package/node_modules/confbox/dist/_chunks/libs/ini.mjs

@@ -0,0 +1,3 @@
+import{t as e}from"../rolldown-runtime.mjs";var t=e(((e,t)=>{let{hasOwnProperty:n}=Object.prototype,r=(e,t={})=>{typeof t==`string`&&(t={section:t}),t.align=t.align===!0,t.newline=t.newline===!0,t.sort=t.sort===!0,t.whitespace=t.whitespace===!0||t.align===!0,t.platform=t.platform||typeof process<`u`&&process.platform,t.bracketedArray=t.bracketedArray!==!1;let n=t.platform===`win32`?`\r
+`:`
+`,a=t.whitespace?` = `:`=`,o=[],c=t.sort?Object.keys(e).sort():Object.keys(e),l=0;t.align&&(l=s(c.filter(t=>e[t]===null||Array.isArray(e[t])||typeof e[t]!=`object`).map(t=>Array.isArray(e[t])?`${t}[]`:t).concat([``]).reduce((e,t)=>s(e).length>=s(t).length?e:t)).length);let u=``,d=t.bracketedArray?`[]`:``;for(let t of c){let r=e[t];if(r&&Array.isArray(r))for(let e of r)u+=s(`${t}${d}`).padEnd(l,` `)+a+s(e)+n;else r&&typeof r==`object`?o.push(t):u+=s(t).padEnd(l,` `)+a+s(r)+n}t.section&&u.length&&(u=`[`+s(t.section)+`]`+(t.newline?n+n:n)+u);for(let a of o){let o=i(a,`.`).join(`\\.`),s=(t.section?t.section+`.`:``)+o,c=r(e[a],{...t,section:s});u.length&&c.length&&(u+=n),u+=c}return u};function i(e,t){var n=0,r=0,i=0,a=[];do if(i=e.indexOf(t,n),i!==-1){if(n=i+t.length,i>0&&e[i-1]===`\\`)continue;a.push(e.slice(r,i)),r=i+t.length}while(i!==-1);return a.push(e.slice(r)),a}let a=(e,t={})=>{t.bracketedArray=t.bracketedArray!==!1;let r=Object.create(null),a=r,o=null,s=/^\[([^\]]*)\]\s*$|^([^=]+)(=(.*))?$/i,l=e.split(/[\r\n]+/g),u={};for(let e of l){if(!e||e.match(/^\s*[;#]/)||e.match(/^\s*$/))continue;let i=e.match(s);if(!i)continue;if(i[1]!==void 0){if(o=c(i[1]),o===`__proto__`){a=Object.create(null);continue}a=r[o]=r[o]||Object.create(null);continue}let l=c(i[2]),d;t.bracketedArray?d=l.length>2&&l.slice(-2)===`[]`:(u[l]=(u?.[l]||0)+1,d=u[l]>1);let f=d&&l.endsWith(`[]`)?l.slice(0,-2):l;if(f===`__proto__`)continue;let p=i[3]?c(i[4]):!0,m=p===`true`||p===`false`||p===`null`?JSON.parse(p):p;d&&(n.call(a,f)?Array.isArray(a[f])||(a[f]=[a[f]]):a[f]=[]),Array.isArray(a[f])?a[f].push(m):a[f]=m}let d=[];for(let e of Object.keys(r)){if(!n.call(r,e)||typeof r[e]!=`object`||Array.isArray(r[e]))continue;let t=i(e,`.`);a=r;let o=t.pop(),s=o.replace(/\\\./g,`.`);for(let e of t)e!==`__proto__`&&((!n.call(a,e)||typeof a[e]!=`object`)&&(a[e]=Object.create(null)),a=a[e]);a===r&&s===o||(a[s]=r[e],d.push(e))}for(let e of d)delete r[e];return r},o=e=>e.startsWith(`"`)&&e.endsWith(`"`)||e.startsWith(`'`)&&e.endsWith(`'`),s=e=>typeof e!=`string`||e.match(/[=\r\n]/)||e.match(/^\[/)||e.length>1&&o(e)||e!==e.trim()?JSON.stringify(e):e.split(`;`).join(`\\;`).split(`#`).join(`\\#`),c=e=>{if(e=(e||``).trim(),o(e)){e.charAt(0)===`'`&&(e=e.slice(1,-1));try{e=JSON.parse(e)}catch{}}else{let t=!1,n=``;for(let r=0,i=e.length;r<i;r++){let i=e.charAt(r);if(t)`\\;#`.indexOf(i)===-1?n+=`\\`+i:n+=i,t=!1;else if(`;#`.indexOf(i)!==-1)break;else i===`\\`?t=!0:n+=i}return t&&(n+=`\\`),n.trim()}return e};t.exports={parse:a,decode:a,stringify:r,encode:r,safe:s,unsafe:c}}));export{t};