@reason-machines/cli-linux-arm64-musl 0.2.381 → 0.2.382

package/bin/vm-hands/{vm-hands-entry-lite-9cgm6g8t.js → vm-hands-entry-lite-pk3q774c.js}

@@ -1,3 +1,3 @@
 // @bun
 var U=".reason/workspace",T="workspace_base",y="sessions",W="workspace_layout",g=".reason/workspace/sessions",B=/^[0-9a-f]{8}$/;function C(j){if(!J(j))return!1;let q=".reason/workspace/sessions/";if(!j.startsWith(q))return!1;let z=j.slice(q.length).split("/");return z.length===2&&B.test(z[0])}var G=4096,X="workspaces/pi";function J(j){if(typeof j!=="string"||!j||j.length>G)return!1;if(j.startsWith("/")||j.includes("\x00")||j.includes("\\"))return!1;return j.split("/").every((q)=>q!==""&&q!=="."&&q!=="..")}function Z(j){if(j.kind==="root"){if(j.path===void 0)return".";if(!J(j.path))throw Error("invalid_device_workspace_identity");return j.path}if(!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/.test(j.workspaceId)||j.workspaceId==="."||j.workspaceId==="..")throw Error("invalid_device_workspace_identity");let q=j.layout==="sessions"?"sessions":X;return`${j.base?`${j.base}/`:""}${q}/${j.workspaceId}/repo`}function L(j){if(!j||typeof j!=="object"||Array.isArray(j))return null;let q=j;if(q.kind==="root"&&Object.keys(q).length===1)return{kind:"root"};if(q.kind==="root"&&Object.keys(q).length===2&&J(q.path))return{kind:"root",path:q.path};if(q.kind!=="managed"||typeof q.workspaceId!=="string"||Object.keys(q).length!==2+(q.base===void 0?0:1)+(q.layout===void 0?0:1)||q.base!==void 0&&q.base!==".reason/workspace"||q.layout!==void 0&&q.layout!=="sessions")return null;let z={kind:"managed",workspaceId:q.workspaceId,...q.base===".reason/workspace"?{base:".reason/workspace"}:{},...q.layout==="sessions"?{layout:"sessions"}:{}};try{return Z(z),z}catch{return null}}var b="/home/runner",P=10001,x="/run/reason/sessions",f=/^(?:\/[A-Za-z0-9._-]+)+$/,M=/-sidechat-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/,H=/^(.+)-repository-[a-z0-9][a-z0-9._-]*-[0-9a-f]{12}$/;function K(j){return M.exec(j)?.[1]??H.exec(j)?.[1]??j}var $=/^((?:\/[A-Za-z0-9._-]+)+)\/\.reason\/workspace\/(workspaces\/pi|sessions)\/([^/]+)$/,A="*/.reason/workspace/workspaces/pi/*|*/.reason/workspace/sessions/*";function N(j,q=b,z="sessions"){if(!f.test(q)||q.split("/").some((V)=>V==="."||V===".."))throw Error("invalid_cloud_payload_home");let Q=`${q}/${Z({kind:"managed",workspaceId:j,base:".reason/workspace",...z?{layout:z}:{}})}`,F=`${x}/${K(j)}`;return{home:q,root:Q.slice(0,-5),checkout:Q,control:F,jobEnv:`${F}/job.env`,cloudAccess:`${F}/cloud-access`,logs:`${F}/logs`,pin:`${F}/ws`}}function Y(j){return $.exec(j.replace(/\/+$/,""))?.[2]==="sessions"?"sessions":null}function D(j){return{kind:"managed",workspaceId:j,layout:"sessions"}}function R(j){let q=$.exec(j.replace(/\/+$/,""));if(!q)return null;try{let z=N(q[3],q[1],Y(j));return z.root===j.replace(/\/+$/,"")?z:null}catch{return null}}
-export{U as bj,T as cj,y as dj,W as ej,g as fj,B as gj,C as hj,J as ij,Z as jj,L as kj,b as lj,P as mj,x as nj,M as oj,H as pj,$ as qj,A as rj,N as sj,Y as tj,D as uj,R as vj};
+export{U as qj,T as rj,y as sj,W as tj,g as uj,B as vj,C as wj,J as xj,Z as yj,L as zj,b as Aj,P as Bj,x as Cj,M as Dj,H as Ej,$ as Fj,A as Gj,N as Hj,Y as Ij,D as Jj,R as Kj};

package/bin/vm-hands/vm-hands-entry-lite-qef2ndkd.js

@@ -0,0 +1,6 @@
+// @bun
+import{Vi as I}from"./vm-hands-entry-lite-sex82vb1.js";import{Ak as g,sk as R,vk as U,yk as C,zk as O}from"./vm-hands-entry-lite-r8qg3wp1.js";import{spawn as S}from"child_process";import{existsSync as x,mkdirSync as T,readFileSync as w,writeFileSync as E}from"fs";import{homedir as H}from"os";import{basename as L,delimiter as D,join as G,win32 as $}from"path";var N=process.platform==="win32"?U("win32"):"/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",b=N.split(D),_=5000,j=65536,k=new Set(["zsh","bash"]),f=[[".local","bin"],[".bun","bin"],[".cargo","bin"],["go","bin"]],P=(z,J)=>new Promise((B,Q)=>{let K;try{K=S(z,[...J],{...C(),stdio:["ignore","pipe","ignore"]}),O(K)}catch(X){Q(X);return}let W=[],V=0,Z=null,q=(X)=>{Z??=Error(X);try{if(K.pid!==void 0)g(K.pid,"SIGKILL")}catch{}},F=setTimeout(()=>q("login_shell_timeout"),_);K.stdout?.on("data",(X)=>{if(V+=X.length,V>j)q("login_shell_output_too_large");else W.push(X)}),K.once("error",(X)=>{clearTimeout(F),Q(X)}),K.once("close",(X)=>{if(clearTimeout(F),Z)Q(Z);else if(X!==0)Q(Error("login_shell_exit_nonzero"));else B(Buffer.concat(W).toString("utf8"))})});function v(z){return typeof z==="string"&&z.startsWith("/")&&!z.includes("\x00")&&k.has(L(z))}function M(z){let J=new Set,B=[];for(let Q of z){if(J.has(Q))continue;J.add(Q),B.push(Q)}return B}function A(z,J=process.platform){let B=J==="win32",Q=z.split(`
+`).at(-1)??"",K=[];for(let W of Q.split(B?";":":")){let V=W.trim();if(B?!$.isAbsolute(V):!V.startsWith("/"))continue;if(V.includes("\x00"))continue;if(I(V))continue;K.push(V)}return M(K)}function y(z){let J=z?.home??H(),B=z?.directoryExists??x,Q=f.map((K)=>G(J,...K)).filter((K)=>{try{return B(K)}catch{return!1}});return M([...Q,...process.platform==="win32"?A(process.env.PATH??process.env.Path??""):[],...b]).join(D)}async function d(z){let J=z?.shell??process.env.SHELL,B=()=>({path:y({home:z?.home,directoryExists:z?.directoryExists}),source:"fallback"});if(process.platform==="win32"||!v(J))return B();let Q;try{Q=await(z?.runLoginShell??P)(J,["-lic",'printf %s "$PATH"'])}catch{return B()}if(Buffer.byteLength(Q,"utf8")>j)return B();let K=A(Q);if(K.length===0)return B();return{path:M([...K,...b]).join(":"),source:"login_shell"}}function n(z){let J=null;return()=>{return J??=d(z),J}}function Y(z){if(z===void 0||z.includes("\x00")||Buffer.byteLength(z,"utf8")>32768)return;return z}function r(z){let J=z.source??process.env,B={HOME:z.home,PATH:z.path??N,TMPDIR:z.temporaryDirectory,SHELL:Y(J.SHELL)??"/bin/zsh",LANG:Y(J.LANG)??"C.UTF-8",LC_ALL:Y(J.LC_ALL)??Y(J.LANG)??"C.UTF-8"},Q=Y(J.LC_CTYPE),K=Y(J.TERM),W=Y(J.COLORTERM);if(Q)B.LC_CTYPE=Q;if(K)B.TERM=K;if(W)B.COLORTERM=W;if(process.platform==="win32"){for(let V of h){let Z=Y(J[V]);if(Z)B[V]=Z}B.TEMP=B.TMP=z.temporaryDirectory,B.SHELL=R()??B.SHELL,B.PATH=m(B.PATH)}return B}function m(z,J=G(H(),".reason","python3")){let B=(W)=>z.split($.delimiter).filter((V)=>V&&!/[\\/]WindowsApps[\\/]?$/i.test(V)).map((V)=>$.join(V,W)).find((V)=>x(V)),Q=B("python.exe");if(B("python3.exe")||!Q)return z;let K=`#!/bin/sh
+exec "${Q.replaceAll("\\","/")}" "$@"
+`;try{let W=G(J,"python3");if(!x(W)||w(W,"utf8")!==K)T(J,{recursive:!0}),E(W,K)}catch{return z}return[J,z].join($.delimiter)}var h=["SystemRoot","SystemDrive","windir","ComSpec","PATHEXT","USERPROFILE","USERNAME","USERDOMAIN","APPDATA","LOCALAPPDATA","ProgramData","ProgramFiles","ProgramFiles(x86)","ProgramW6432","CommonProgramFiles","NUMBER_OF_PROCESSORS","PROCESSOR_ARCHITECTURE","OS"];
+export{N as Hc,A as Ic,y as Jc,n as Kc,r as Lc,m as Mc};

package/bin/vm-hands/vm-hands-entry-lite-qnnfvm5r.js

@@ -0,0 +1,5 @@
+// @bun
+import{li as A,mi as x,ni as u,wi as y}from"./vm-hands-entry-lite-e2mjbqmr.js";import{Ci as c}from"./vm-hands-entry-lite-ma001vzh.js";import{randomUUID as m}from"crypto";import{chmodSync as l,existsSync as p,mkdirSync as jJ,readlinkSync as YJ,readFileSync as GJ,renameSync as OJ,unlinkSync as VJ,writeFileSync as FJ}from"fs";import{homedir as d}from"os";import{basename as P,dirname as H,isAbsolute as v,join as I,normalize as n,relative as HJ,resolve as LJ}from"path";import{unlinkSync as WJ}from"fs";import{dirname as XJ,join as ZJ}from"path";function $J(J){return ZJ(XJ(J),"future-device-grant.json")}function o(J){try{WJ($J(J))}catch(Q){if(!(Q instanceof Error&&("code"in Q)&&Q.code==="ENOENT"))throw Q}}var N=3,NJ=1,TJ=2,D=1,a=1,r="Reason may read and write files and run commands in this signed-in OS account, subject to saved restrictions and operating system permissions.",b="Reason may later execute on this computer inside a Reason sandbox, limited to folders explicitly attached by the user.",zJ=[b,"Ara may later execute on this computer inside an Ara sandbox, limited to folders explicitly attached by the user."];function i(J){return typeof J==="string"&&zJ.includes(J)}var BJ=["future_device","updates_only","cli_only"];function h(J){return typeof J==="string"&&BJ.some((Q)=>Q===J)}function SJ(J=process.env,Q=d()){return J.XDG_CONFIG_HOME?.trim()||I(Q,".config")}function K(J=process.env,Q=d()){let U=x({env:J}),W=SJ(J,Q);return I(W,y(W).state==="kept"?"ara":"reason",...U==="staging"?["staging"]:[],"installation.json")}function G(J){return typeof J==="string"&&J.trim().length>0}var _J=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function IJ(J){return typeof J==="string"&&_J.test(J)}function C(J){return G(J)&&v(J)&&n(J)===J}function t(J){if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return C(Q.path)&&(Q.role==="launcher"&&(Q.kind==="file"||Q.kind==="symlink")||Q.role==="worker_root"&&Q.kind==="directory"||Q.role==="alias"&&Q.kind==="symlink"&&C(Q.target))}function g(J){return J.owned_paths?.every((Q)=>Q.role!=="alias"||J.installer==="shell"&&Q.path===I(J.install_dir,J.channel==="staging"?"reason-staging":"reason")&&Q.target===I(J.install_dir,J.channel==="staging"?"ara-staging":"ara")&&J.owned_paths?.some((U)=>U.role==="launcher"&&U.path===Q.target))??!1}function e(J,Q){try{return LJ(H(J),YJ(J))===Q}catch{return!1}}function vJ(J){let Q=P(J),U=Q==="ara"?"reason":Q==="ara-staging"?"reason-staging":null;if(!U)return J;let W=I(H(J),U);return e(W,J)?W:J}function M(J,Q){let U=HJ(J,Q);return U.length>0&&!U.startsWith("..")&&!v(U)}function JJ(J){if(J===null)return!0;if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return(Q.kind==="shell_profile"||Q.kind==="windows_user_path")&&G(Q.location)&&G(Q.value)&&(typeof Q.added_by_installer==="boolean"||typeof Q.added_by_ara==="boolean")&&(Q.added_by_installer===void 0||typeof Q.added_by_installer==="boolean")&&(Q.added_by_ara===void 0||typeof Q.added_by_ara==="boolean")}function q(J){return J.added_by_installer??J.added_by_ara??!1}function QJ(J,Q){if(Q===null)return J==="cli_only";if(!Q||typeof Q!=="object"||Array.isArray(Q))return!1;let U=Q;if(U.version!==D||!G(U.recorded_at))return!1;if(J==="future_device")return U.decision==="authorized"&&i(U.scope);return U.scope===null&&U.decision===(J==="updates_only"?"ask":"disabled")}function AJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==NJ||!A.includes(Q.channel)||Q.install_method!=="curl"||Q.installer!=="shell"&&Q.installer!=="powershell"||!G(Q.installed_at)||!G(Q.version)||!G(Q.target)||!C(Q.install_dir)||!Array.isArray(Q.owned_paths)||!Q.owned_paths.every(t)||!Q.owned_paths.every((U)=>M(Q.install_dir,U.path))||!g(Q)||!JJ(Q.path_entry))return null;return{...Q,schema_version:N,installation_id:null,background_mode:"cli_only",device_consent:null}}function DJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==TJ||!UJ(Q)||!h(Q.background_mode)||!QJ(Q.background_mode,Q.device_consent))return null;return{...Q,schema_version:N,installation_id:null}}function UJ(J){return A.includes(J.channel)&&(J.install_method==="curl"&&(J.installer==="shell"||J.installer==="powershell")||J.install_method==="desktop"&&J.installer==="desktop"&&Array.isArray(J.owned_paths)&&J.owned_paths.length===0&&J.path_entry===null)&&G(J.installed_at)&&G(J.version)&&G(J.target)&&C(J.install_dir)&&Array.isArray(J.owned_paths)&&J.owned_paths.every(t)&&J.owned_paths.every((Q)=>M(J.install_dir,Q.path))&&g(J)&&JJ(J.path_entry)}function KJ(J){let Q=AJ(J);if(Q)return Q;let U=DJ(J);if(U)return U;if(!J||typeof J!=="object"||Array.isArray(J))return null;let W=J;if(W.schema_version!==N||!IJ(W.installation_id)||!UJ(W)||!h(W.background_mode)||!QJ(W.background_mode,W.device_consent)||W.desktop_account_access!==void 0&&(W.desktop_account_access===null||typeof W.desktop_account_access!=="object"||Array.isArray(W.desktop_account_access)||W.desktop_account_access.version!==a||W.desktop_account_access.scope!==r||!G(W.desktop_account_access.recorded_at)||!Number.isFinite(Date.parse(W.desktop_account_access.recorded_at))))return null;return W}function E(J=K()){if(!p(J))return null;try{return KJ(JSON.parse(GJ(J,"utf8")))}catch{return null}}function f(J){return Boolean(J?.installation_id&&J.background_mode==="future_device"&&J.device_consent?.version===D&&J.device_consent.decision==="authorized"&&i(J.device_consent.scope))}function s(J,Q){let U=E(Q);if(!(f(U)&&f(J)&&U.installation_id===J.installation_id&&U.channel===J.channel))o(Q);jJ(H(Q),{recursive:!0,mode:448}),l(H(Q),448);let X=`${Q}.${process.pid}.${m()}.tmp`;try{FJ(X,`${JSON.stringify(J,null,2)}
+`,{mode:384,flag:"wx"}),l(X,384),OJ(X,Q)}finally{if(p(X))VJ(X)}let Y=H(Q),$=P(Y)==="staging"?H(Y):Y;if(P($)==="reason")y(H($));return J}function RJ(J=K(),Q=new Date){let U=E(J);if(!U?.installation_id)throw Error("Reason installation ownership is missing; reinstall the current CLI before enabling Device execution");if(f(U))return U;let W={...U,background_mode:"future_device",device_consent:{version:D,decision:"authorized",scope:b,recorded_at:Q.toISOString()}};return delete W.desktop_account_access,s(W,J)}function hJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=_(J.installDir,"install directory"),X=E(Q);if(X?.installation_id&&!J.accountAccess)return RJ(Q,U);return s({...X??{schema_version:N,channel:J.channel,install_method:"desktop",installer:"desktop",installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:[],path_entry:null},schema_version:N,installation_id:X?.installation_id??m(),background_mode:"future_device",...J.accountAccess?{desktop_account_access:{version:a,scope:r,recorded_at:U.toISOString()}}:{},device_consent:{version:D,decision:"authorized",scope:b,recorded_at:U.toISOString()}},Q)}function qJ(J,Q){return J.kind===Q.kind&&J.location===Q.location&&J.value===Q.value}function _(J,Q){let U=n(J);if(!v(U))throw Error(`${Q} must be an absolute path`);return U}function CJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=_(J.install_dir,"install directory"),X=E(Q),Y=J.backgroundMode??"preserve",$=Y==="preserve"?X?.background_mode??"cli_only":Y,L=X?.channel===J.channel&&f(X)&&$==="future_device",T=Y==="preserve"&&!X||X?.channel===J.channel&&(Y==="preserve"||L),O={path:_(J.launcherPath,"launcher path"),kind:J.launcherKind,role:"launcher"};if(!M(W,O.path))throw Error("launcher path must be inside the install directory");let z=(J.workerRoots??[]).map((j)=>_(j,"worker root"));if(z.some((j)=>!M(W,j)))throw Error("worker root must be inside the install directory");let B=[];if(J.aliasPath){let j={path:_(J.aliasPath,"alias path"),kind:"symlink",role:"alias",target:O.path};if(!g({installer:J.installer,channel:J.channel,install_dir:W,owned_paths:[O,j]})||!e(j.path,j.target))throw Error("alias must be the channel's symlink to its canonical launcher");B.push(j)}let R=[...X?.channel===J.channel&&X.install_dir===W?X.owned_paths:[],O,...B,...z.map((j)=>({path:j,kind:"directory",role:"worker_root"}))],k=Array.from(new Map(R.map((j)=>[j.path,j])).values()),Z=J.pathEntry??null,F=Z?X?.path_entry&&qJ(Z,X.path_entry)?{...Z,added_by_installer:q(Z)||q(X.path_entry),added_by_ara:q(Z)||q(X.path_entry)}:Z:X?.path_entry??null,S={schema_version:N,installation_id:X?.installation_id??m(),channel:J.channel,install_method:"curl",installer:J.installer,installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:k,path_entry:F,background_mode:$,device_consent:T?X?.device_consent??null:{version:D,decision:$==="future_device"?"authorized":$==="updates_only"?"ask":"disabled",scope:$==="future_device"?b:null,recorded_at:U.toISOString()},...L&&X.desktop_account_access?{desktop_account_access:X.desktop_account_access}:{}};return s(S,Q)}function w(J,Q){let U=J.indexOf(Q);if(U===-1)return;let W=J[U+1];if(!W||W.startsWith("--"))throw Error(`${Q} needs a value`);return W}function V(J,Q){let U=w(J,Q);if(!U)throw Error(`${Q} is required`);return U}function gJ(J,Q={}){let U=Q.io??{stdout:process.stdout,stderr:process.stderr};try{let W=new Set(["--channel","--installer","--version","--target","--install-dir","--launcher-path","--launcher-kind","--worker-root","--path-kind","--path-location","--path-value","--background-mode"]);for(let Z=0;Z<J.length;Z+=1){let F=J[Z];if(F==="--path-added")continue;if(!W.has(F))throw Error(`unknown option: ${F}`);if(Z+=1,Z>=J.length)throw Error(`${F} needs a value`)}let X=Q.env??process.env,Y=V(J,"--channel"),$=x({env:X,executablePath:Q.executablePath});if(Y!==$)throw Error(`installer channel ${Y} does not match running ${$} CLI`);let L=V(J,"--installer");if(L!=="shell"&&L!=="powershell")throw Error("--installer must be shell or powershell");let T=V(J,"--launcher-kind");if(T!=="file"&&T!=="symlink")throw Error("--launcher-kind must be file or symlink");let O=w(J,"--path-kind"),z=null;if(O){if(O!=="shell_profile"&&O!=="windows_user_path")throw Error("--path-kind must be shell_profile or windows_user_path");z={kind:O,location:V(J,"--path-location"),value:V(J,"--path-value"),added_by_installer:J.includes("--path-added"),added_by_ara:J.includes("--path-added")}}else if(J.includes("--path-location")||J.includes("--path-value")||J.includes("--path-added"))throw Error("path entry flags require --path-kind");let B={channel:$,install_method:"curl",installer:L,version:V(J,"--version"),target:V(J,"--target"),install_dir:V(J,"--install-dir"),launcherPath:V(J,"--launcher-path"),launcherKind:T,workerRoots:J.flatMap((Z,F)=>{if(Z!=="--worker-root")return[];let S=J[F+1];if(!S||S.startsWith("--"))throw Error("--worker-root needs a value");return[S]}),pathEntry:z,backgroundMode:(()=>{let Z=w(J,"--background-mode")??"preserve";if(Z!=="preserve"&&!h(Z))throw Error("--background-mode must be future_device, updates_only, cli_only, or preserve");return Z})()},R=c(X,"REASON_INSTALL_ALIAS_PATH");if(R)B.aliasPath=R;let k=K(u(X,$),Q.home??d());return(Q.writeReceipt??CJ)(B,k,Q.now?.()??new Date),0}catch(W){return U.stderr.write(`Reason installer receipt: ${W instanceof Error?W.message:String(W)}
+`),1}}
+export{N as ge,D as he,a as ie,r as je,b as ke,BJ as le,SJ as me,K as ne,e as oe,vJ as pe,q as qe,KJ as re,E as se,f as te,RJ as ue,hJ as ve,CJ as we,gJ as xe};

package/bin/vm-hands/vm-hands-entry-lite-qwf78yqr.js

@@ -0,0 +1,11 @@
+// @bun
+import{ed as hq,fd as lq}from"./vm-hands-entry-lite-g7h6wjqy.js";import{$h as Xq,Vh as Nq,Wh as vq,_h as Wq,ai as X,di as dq,fi as Aq,gi as cq,ii as c,ji as P,ki as Bq}from"./vm-hands-entry-lite-y2s2w174.js";import{Ci as Kq}from"./vm-hands-entry-lite-ma001vzh.js";import{Xi as oq,Zi as sq,aj as uq,bj as pq,cj as rq,dj as Dq}from"./vm-hands-entry-lite-8zawqa9q.js";import{lj as d}from"./vm-hands-entry-lite-fyvgav60.js";import{Bk as Gq}from"./vm-hands-entry-lite-r8qg3wp1.js";import{randomUUID as C}from"crypto";import{chmodSync as Jq,closeSync as u,constants as m,existsSync as E,fstatSync as nq,lstatSync as D,mkdirSync as n,openSync as iq,readFileSync as g,readdirSync as Oq,readlinkSync as T,realpathSync as S,renameSync as k,rmSync as v,statSync as x,symlinkSync as Qq,unlinkSync as I,writeFileSync as h}from"fs";import{basename as r,dirname as B,isAbsolute as MG,join as K,relative as NG,resolve as O,sep as aq}from"path";import{spawnSync as Eq}from"child_process";import{createRequire as eq}from"module";var Zq=1,tq=1,qG=128,AG=65536,BG="https://reasonmachines.com/api/runtime-manifest-v2",DG=30000,OG=600000,Vq=1e4,EG=60000,IG=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var Pq=/^[a-z0-9_.-]{1,80}$/,CG=64,TG="so.ara.device-broker",gq=["com.apple.security.cs.allow-jit","com.apple.security.cs.allow-unsigned-executable-memory"],SG=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function t(q){if(q?.aborted)throw new X("update_cancelled","Managed runtime update request was cancelled.")}function Iq(q){return Boolean(q)&&typeof q==="object"&&!Array.isArray(q)}function Cq(q,G,J=[]){let Q=new Set([...G,...J]);return G.every((R)=>(R in q))&&Object.keys(q).every((R)=>Q.has(R))}function A(q){return typeof q==="string"&&IG.test(q)}function GG(q){return typeof q==="string"&&!Number.isNaN(Date.parse(q))&&new Date(q).toISOString()===q}function FG(q){return Xq.includes(q)}function b(q){n(q,{recursive:!0,mode:448}),Jq(q,448)}function JG(q,G){b(B(q));let J=`${q}.${process.pid}.${C()}.tmp`;try{h(J,G,{mode:384,flag:"wx"}),Jq(J,384),k(J,q)}finally{if(E(J))I(J)}}function Tq(q={}){if((q.platform??process.platform)!=="darwin")throw new X("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let J=q.environment??process.env,Q=Kq(J,"REASON_CLI_CHANNEL")==="staging",R=Q?Kq(J,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,U=q.root!==void 0||Boolean(R&&MG(R))?null:K(q.home??d(),"Library","Application Support"),_=q.root??(U?K(U,Q?"Reason Staging":"Reason","CLI"):R);return{executableName:"reason",root:_,...U?{legacyRoot:K(U,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:K(_,"versions"),current:K(_,"current"),previous:K(_,"previous"),brokerLock:K(_,"broker.lock"),transitionLock:K(_,"transition.lock"),lifecycleEvents:K(_,"lifecycle-events")}}function gJ(q){let G=q.legacyRoot;if(!G)return null;return{root:G,versions:K(G,"versions"),current:K(G,"current"),previous:K(G,"previous"),brokerLock:K(G,"broker.lock"),transitionLock:K(G,"transition.lock"),lifecycleEvents:K(G,"lifecycle-events")}}function F(q,G){if(!A(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let J=K(q.versions,G,"ara");if(!q.executableName)return J;let Q=K(q.versions,G,q.executableName),R=(_)=>{try{return D(_),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}},W=R(J),U=R(Q);if(W&&U)throw new X("installed_artifact_mismatch","Ambiguous managed runtime executable layout.");return W?J:Q}function i(q,G){if(!A(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return Sq(F(q,G))}function Sq(q){return K(B(q),r(q)==="reason"?vq:Nq)}function QG(q,G){if(!A(q)||!A(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let[J,Q]=q.split("-",2),[R,W]=G.split("-",2),U=J.split(".").map(Number),_=R.split(".").map(Number);for(let H=0;H<3;H+=1){let j=U[H]-_[H];if(j!==0)return j<0?-1:1}if(Q===void 0||W===void 0){if(Q===W)return 0;return Q===void 0?1:-1}let Z=Q.split("."),$=W.split("."),Y=Math.max(Z.length,$.length);for(let H=0;H<Y;H+=1){let j=Z[H],z=$[H];if(j===void 0||z===void 0){if(j===z)return 0;return j===void 0?-1:1}if(j===z)continue;let M=/^\d+$/.test(j),w=/^\d+$/.test(z);if(M&&w)return Number(j)<Number(z)?-1:1;if(M!==w)return M?-1:1;return j<z?-1:1}return 0}function LG(q=process.arch){let G=`darwin-${q}`;if(!FG(G))throw new X("unsupported_architecture","The managed Reason runtime supports only Apple Silicon and Intel Macs.");return G}function bq(q){return[...q.matchAll(/<key>\s*([^<]+?)\s*<\/key>/g)].map((G)=>G[1].trim())}function yq(q){let G=q.match(/^CodeDirectory .*$/gm)??[];return G.length>0&&G.every((J)=>{return(/ flags=0x[0-9a-f]+\(([^)]*)\)(?: |$)/.exec(J)?.[1]?.split(/[ ,]+/).filter(Boolean)??[]).includes("runtime")})}function wG(q){let G=`TeamIdentifier=${oq}`,J=`Identifier=${TG}`,Q=bq(q.brokerEntitlements),R=bq(q.credentialLibraryEntitlements);if(!q.brokerDetail.split(`
+`).includes(G)||!q.brokerDetail.split(`
+`).includes(J)||!yq(q.brokerDetail)||Q.length!==gq.length||gq.some((W)=>!new RegExp(`<key>\\s*${W.replaceAll(".","\\.")}\\s*</key>\\s*<true\\s*/>`).test(q.brokerEntitlements)))throw new X("invalid_code_signature","Managed runtime broker has an invalid Reason signature, identifier, or entitlement set.");if(!q.credentialLibraryDetail.split(`
+`).includes(G)||!yq(q.credentialLibraryDetail)||R.length!==0)throw new X("invalid_code_signature","Managed runtime credential library has an invalid signature or entitlement.")}function y(q,G){let J=Eq("/usr/bin/codesign",q,{stdio:["ignore","pipe","pipe"]});if(J.status!==0)throw new X("invalid_code_signature",G);return[new TextDecoder().decode(J.stdout??new Uint8Array),new TextDecoder().decode(J.stderr??new Uint8Array)].join("")}var Fq=(q,G)=>{y(["--verify","--strict","--verbose=2",q],"Managed runtime broker code signature is invalid."),y(["--verify","--strict","--verbose=2",G],"Managed runtime credential library code signature is invalid."),wG({brokerDetail:y(["-d","--verbose=4",q],"Managed runtime broker signer could not be inspected."),brokerEntitlements:y(["-d","--entitlements",":-",q],"Managed runtime broker entitlements could not be inspected."),credentialLibraryDetail:y(["-d","--verbose=4",G],"Managed runtime credential library signer could not be inspected."),credentialLibraryEntitlements:y(["-d","--entitlements",":-",G],"Managed runtime credential library entitlements could not be inspected.")})};async function kG(q,G,J){let Q=q.headers.get("content-length");if(Q!==null){let Y=Number(Q);if(!Number.isSafeInteger(Y)||Y<0||Y>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.")}if(!q.body){let Y=new Uint8Array(await q.arrayBuffer());if(Y.byteLength>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.");return Y}let R=q.body.getReader(),W=[],U=0,_=()=>{if(!J)return R.read();return new Promise((Y,H)=>{let j=()=>{J.removeEventListener("abort",j),R.cancel(J.reason).catch(()=>{}),H(J.reason??new DOMException("Aborted","AbortError"))};if(J.aborted){j();return}J.addEventListener("abort",j,{once:!0}),R.read().then((z)=>{J.removeEventListener("abort",j),Y(z)},(z)=>{J.removeEventListener("abort",j),H(z)})})};try{while(!0){let Y=await _();if(Y.done)break;if(U+=Y.value.byteLength,U>G)throw await R.cancel(),new X("response_too_large","Managed runtime response exceeded its size limit.");W.push(Y.value)}}finally{try{R.releaseLock()}catch{}}let Z=new Uint8Array(U),$=0;for(let Y of W)Z.set(Y,$),$+=Y.byteLength;return Z}async function p(q){let G;try{G=new URL(q.url)}catch{throw new X("invalid_update_url","Managed runtime update URL is invalid.")}if(G.protocol!=="https:"||G.username||G.password||G.hash)throw new X("invalid_update_url","Managed runtime update URL must use HTTPS.");let J=new AbortController,Q,R=()=>{Q??="caller",J.abort(q.signal?.reason)};if(q.signal?.aborted)R();else q.signal?.addEventListener("abort",R,{once:!0});let W=setTimeout(()=>{Q??="timeout",J.abort(Error("managed runtime fetch timed out"))},q.timeoutMs),U=(_,Z)=>{if(_ instanceof X)return _;if(Q==="caller")return new X("update_cancelled","Managed runtime update request was cancelled.");if(Q==="timeout")return new X("update_fetch_timeout","Managed runtime update request timed out.");return new X("update_fetch_failed",Z)};try{let _;try{if(_=await q.fetchImpl(G,{headers:{accept:q.accept},signal:J.signal}),J.signal.aborted)throw U(J.signal.reason,"Managed runtime update request was cancelled.")}catch(Z){throw U(Z,"Managed runtime update request failed.")}if(!_.ok)throw new X("update_http_error","Managed runtime update request was rejected.");if(_.url&&new URL(_.url).protocol!=="https:")throw new X("insecure_redirect","Managed runtime update redirected to an insecure URL.");try{let Z=await kG(_,q.maximumBytes,J.signal);if(J.signal.aborted)throw U(J.signal.reason,"Managed runtime update response was cancelled.");return Z}catch(Z){throw U(Z,"Managed runtime update response failed.")}}finally{clearTimeout(W),q.signal?.removeEventListener("abort",R)}}async function RG(q,G,J=Vq,Q){let R=typeof J==="number"?J:Vq,W=typeof J==="number"?Q:J;if(W?.aborted)return!1;let U=await hq([q,"--version"],{timeoutMs:R,...W?{signal:W}:{}});return U.exitCode===0&&U.stdout.trim().replace(/^v/,"")===G}async function xG(q){let G=!1,J=null,Q=null,R=(W)=>{try{N(q.paths,W,{now:q.now})}catch{}};try{let W=q.home??d();if(!rq(q.manifest.version,W))return{status:"current"};Q=pq(W);let U=await p({url:new URL(dq,q.manifest.artifacts[q.target].broker.url).toString(),maximumBytes:Wq,fetchImpl:async(j,z)=>{let M=await q.fetchImpl(j,z);return G=M.status===404,M},timeoutMs:q.timeoutMs,accept:"application/json",signal:q.signal}),{manifest:_}=cq(new TextDecoder().decode(U),q.trustedKeys);if(_.version!==q.manifest.version||_.published_at!==q.manifest.published_at)throw new X("identity_manifest_mismatch","Background identity manifest names another release.");let Z=_.artifacts[q.target],$=await p({url:Z.url,maximumBytes:Z.size_bytes,fetchImpl:q.fetchImpl,timeoutMs:q.timeoutMs,accept:"application/octet-stream",signal:q.signal});P($,Z),b(q.workDirectory),J=K(q.workDirectory,`.identity-${process.pid}-${C()}`),n(J,{mode:448});let Y=K(J,"identity.tgz");if(h(Y,$,{mode:384,flag:"wx"}),Eq("/usr/bin/tar",["-xzf",Y,"-C",J],{stdio:"ignore",timeout:60000}).status!==0)throw new X("identity_extract_failed","Background identity archive could not be extracted.");return Dq({sourceApp:K(J,"Reason.app"),home:W,releaseSigned:!0,...q.command?{command:q.command}:{}}),R({event:"identity.refresh_completed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version}),{status:"installed"}}catch(W){if(G)return{status:"unpublished"};let U=W instanceof X||W instanceof sq?W.code:"identity_install_failed";return process.stderr.write(`Reason background identity: identity_update_failed (${U})
+`),R({event:"identity.refresh_failed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version,reason_code:U}),{status:"failed",code:U}}finally{if(J)v(J,{recursive:!0,force:!0})}}async function bJ(q){if(!A(q.currentVersion))throw new X("invalid_version","Invalid current managed runtime version.");let G=q.paths??Tq(),J=q.target??LG(),Q=q.fetchImpl??fetch,R=q.timeoutMs??DG,W=q.timeoutMs??OG,U=q.healthCheck??((H,j,z)=>RG(H,j,EG,z)),_=q.verifyCodeSignatures??Fq,Z=q.now?.()??new Date,$,Y=!1;N(G,{event:"update.check_started",runtime_version:q.currentVersion,from_version:q.currentVersion},{now:()=>Z});try{await cG({paths:G,verifyCodeSignatures:_,healthCheck:U});let H=await p({url:q.manifestUrl??BG,maximumBytes:Wq,fetchImpl:Q,timeoutMs:R,accept:"application/json",signal:q.signal}),j=Aq(new TextDecoder().decode(H),q.trustedKeys);$=j.manifest.version;let z=()=>xG({paths:G,...q.now?{now:q.now}:{},manifest:j.manifest,target:J,trustedKeys:q.trustedKeys,fetchImpl:Q,timeoutMs:W,workDirectory:G.versions,...q.home?{home:q.home}:{},...q.identityCommand?{command:q.identityCommand}:{},...q.signal?{signal:q.signal}:{}});if(QG($,q.currentVersion)<=0)return N(G,{event:"update.not_available",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),Yq(G),{status:"not_available",currentVersion:q.currentVersion,offeredVersion:$,...$===q.currentVersion?{identity:await z()}:{}};let M=j.manifest.artifacts[J];N(G,{event:"update.download_started",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now});let w=await p({url:M.broker.url,maximumBytes:M.broker.size_bytes,fetchImpl:Q,timeoutMs:W,accept:"application/octet-stream",signal:q.signal});P(w,M.broker),t(q.signal);let e=await p({url:M.credential_library.url,maximumBytes:M.credential_library.size_bytes,fetchImpl:Q,timeoutMs:W,accept:"application/octet-stream",signal:q.signal});P(e,M.credential_library),N(G,{event:"update.downloaded",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),N(G,{event:"update.verified",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),t(q.signal);let kq=UG({paths:G,version:$,artifact:M.broker,bytes:w,credentialLibraryArtifact:M.credential_library,credentialLibraryBytes:e,verifyCodeSignatures:_}),xq;try{xq=await U(kq.executablePath,$,q.signal)}catch(l){throw t(q.signal),l}if(t(q.signal),!xq)throw new X("pre_activation_health_failed","Managed runtime preflight failed.");let V=fG(G,$);if(!V.changed&&V.toVersion!==$)return N(G,{event:"update.not_available",runtime_version:V.toVersion,from_version:V.toVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"not_available",currentVersion:V.toVersion,offeredVersion:$};if(Y=V.changed,!await U(G.current,$)){if(V.fromVersion){let l=$G(G,$);N(G,{event:"update.rollback",runtime_version:l.toVersion,from_version:l.fromVersion,to_version:l.toVersion,reason_code:"post_activation_health_failed"},{now:q.now})}else KG(G,$);throw f(G),Y=!1,new X("post_activation_health_failed","Managed runtime activation failed.")}return f(G),Yq(G),N(G,{event:"update.activated",runtime_version:$,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"activated",fromVersion:q.currentVersion,toVersion:$,installed:kq.installed,identity:await z()}}catch(H){throw N(G,{event:"update.failed",runtime_version:Y?$??q.currentVersion:q.currentVersion,from_version:q.currentVersion,...$?{to_version:$}:{},reason_code:H instanceof X?H.code:"update_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),H}}function fq(q,G,J){try{let Q=D(B(q));if(!Q.isDirectory()||Q.isSymbolicLink())return!1;let R=D(q);if(!R.isFile()||R.isSymbolicLink()||R.size!==G.size_bytes)return!1;let W=Sq(q),U=D(W);return U.isFile()&&!U.isSymbolicLink()&&U.size===J.size_bytes&&c(g(q))===G.sha256&&c(g(W))===J.sha256}catch{return!1}}function UG(q){let G=F(q.paths,q.version);P(q.bytes,q.artifact),P(q.credentialLibraryBytes,q.credentialLibraryArtifact);let J=q.verifyCodeSignatures??Fq;if(b(q.paths.root),b(q.paths.versions),E(B(G))){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw new X("installed_artifact_mismatch","The installed runtime version does not match the verified artifact.");return J(G,i(q.paths,q.version)),{installed:!1,executablePath:G}}let Q=K(q.paths.versions,`.install-${q.version}-${process.pid}-${C()}`),R=K(Q,r(G)),W=Sq(R);n(Q,{mode:448});try{h(R,q.bytes,{mode:448,flag:"wx"}),Jq(R,448),h(W,q.credentialLibraryBytes,{mode:448,flag:"wx"}),Jq(W,448),J(R,W);try{k(Q,B(G))}catch(U){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw U;return{installed:!1,executablePath:G}}return{installed:!0,executablePath:G}}finally{v(Q,{recursive:!0,force:!0})}}function VG(q,G){if(!A(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return`versions/${G}/${r(F(q,G))}`}function Rq(q,G){b(B(q));let J=`${q}.${process.pid}.${C()}.tmp`;try{Qq(G,J),k(J,q)}finally{if(E(J))I(J)}}var PG=/^\.ara-worker-(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)-(darwin-(?:arm64|x64))\.([0-9A-Za-z]{6})$/;function gG(q,G){let J=B(q),Q=O(J,G),R=B(Q),W=PG.exec(r(R));if(r(Q)!=="ara"||B(R)!==J||!W||!A(W[1])||!Xq.includes(W[2]))return!1;try{return D(R).isDirectory()&&B(S(R))===S(J)&&D(Q).isFile()&&D(Bq(R)).isFile()}catch(U){if(U.code==="ENOENT")return!1;throw U}}function WG(q,G,J){try{if(T(q)!==G)return!1;I(q)}catch(Q){if(Q.code==="ENOENT")return!1;throw Q}try{return Qq(J,q),!0}catch(Q){if(Q.code==="EEXIST")return!1;try{Qq(G,q)}catch(R){if(R.code!=="EEXIST")throw R}throw Q}}function XG(q,G){if(!q.legacyRoot)return!1;let J;try{if(!D(G).isSymbolicLink())return!1;J=T(G)}catch(R){if(R.code==="ENOENT")return!1;throw R}if(O(B(G),J)!==K(q.legacyRoot,"current"))return!1;if(!WG(G,J,q.current))return!1;let Q=L(q);if(Q)N(q,{event:"service.launcher_adopted",runtime_version:Q,to_version:Q,reason_code:"legacy_runtime_root"});return!0}function bG(q){let G=q.launcherPath??K(q.home??d(),".local","bin","ara");try{if(D(G).isSymbolicLink()){let Q=T(G);if(Q===q.paths.current)return"managed";if(gG(G,Q)&&WG(G,Q,q.paths.current)){let R=_q(q.paths.current,q.paths.executableName)??"unknown";return N(q.paths,{event:"service.launcher_adopted",runtime_version:R,to_version:R,reason_code:"legacy_curl_entrypoint"}),"adopted"}if(XG(q.paths,G))return"adopted"}return"conflict"}catch(J){if(J.code!=="ENOENT")throw J}n(B(G),{recursive:!0,mode:448});for(let J=0;J<4;J+=1)try{return Qq(q.paths.current,G),"created"}catch(Q){if(Q.code!=="EEXIST")throw Q;try{return D(G).isSymbolicLink()&&T(G)===q.paths.current?"managed":"conflict"}catch(R){if(R.code!=="ENOENT")throw R}}return"conflict"}function _q(q,G){let J;try{if(!D(q).isSymbolicLink())return null;J=T(q)}catch{return null}let Q=J.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return Q&&(Q[2]==="ara"||Q[2]===G)?Q[1]:null}function L(q){return _q(q.current,q.executableName)}function yJ(q,G=process.execPath){try{return S(q.current)===S(G)}catch{return!1}}function Uq(q,G,J){let R=NG(G,q).split(aq);return R.length===2&&A(R[0])&&(R[1]==="ara"||J!==void 0&&R[1]===J)?R[0]:null}function ZG(q,G){try{return D(G).isSymbolicLink()&&O(B(G),T(G))===O(q.current)}catch{return!1}}function fJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)!==null}catch{let J=O(G);return J===O(q.current)||ZG(q,J)||Uq(J,O(q.versions),q.executableName)!==null}}function mJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)}catch{let J=O(G);if(J===O(q.current)||ZG(q,J))return L(q);return Uq(J,O(q.versions),q.executableName)}}function yG(q,G,J={}){let Q=F(q,G),R=i(q,G);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");let W=Lq(q,G,J.allowDowngrade);if(W)return W;return a(q,G,()=>{return _G(q,G,void 0,J.allowDowngrade)})}function Lq(q,G,J=!1){let Q=L(q);if(!Q)return null;if(Q===G)return{changed:!1,fromVersion:Q,toVersion:Q};if(!J&&QG(G,Q)<=0&&!(/^\d+\.\d+\.\d+-desktop\.v1\.\d+\.\d+\.\d+$/.test(G)&&/^\d+\.\d+\.\d+-desktopdev\./.test(Q)))return{changed:!1,fromVersion:Q,toVersion:Q};return null}function _G(q,G,J,Q=!1){let R=Lq(q,G,Q);if(R)return R;let W=L(q);if(J?.(W),W)Rq(q.previous,T(q.current));else if(E(q.previous))I(q.previous);return Rq(q.current,VG(q,G)),{changed:!0,fromVersion:W,toVersion:G}}function fG(q,G){let J=F(q,G),Q=i(q,G);if(!E(J)||!x(J).isFile()||!E(Q)||!x(Q).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");return a(q,G,()=>_G(q,G,(R)=>{dG(q,{schema_version:Zq,from_version:R,to_version:G})}))}function $G(q,G){return a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");let J=_q(q.previous,q.executableName);if(!J||J===G)throw new X("rollback_unavailable","No previous managed runtime is available.");let Q=F(q,J),R=i(q,J);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("rollback_unavailable","Previous managed runtime is not installed.");let W=T(q.previous),U=T(q.current);if(O(B(q.previous),W)!==O(Q))throw new X("rollback_fence_failed","Previous runtime pointer does not match its installed layout.");return Rq(q.current,W),Rq(q.previous,U),{fromVersion:G,toVersion:J}})}function mG(){let q=Eq("/bin/ps",["-axww","-o","args="],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:5000,maxBuffer:16777216});return q.status===0&&typeof q.stdout==="string"?q.stdout:null}function Yq(q){let G=[];try{let J=L(q);if(!J||jq(q))return G;let Q=Oq(q.versions).filter((W)=>A(W));if(Q.length<=2)return G;let R=mG();if(R===null)return G;a(q,J,()=>{let W=new Set([L(q),_q(q.previous,q.executableName)]);if(jq(q))return;for(let U of Q){if(W.has(U))continue;let _=K(q.versions,U);if(R.includes(`${_}${aq}`))continue;try{v(_,{recursive:!0,force:!0}),G.push(U)}catch{}}})}catch{}return G}function KG(q,G){a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");I(q.current)})}function wq(q){return q.activationState??K(q.root,"activation.json")}function vG(q){return Iq(q)&&Cq(q,["schema_version","from_version","to_version"])&&q.schema_version===Zq&&(q.from_version===null||A(q.from_version))&&A(q.to_version)}function jq(q){try{let G=wq(q),J=D(G);if(!J.isFile()||J.isSymbolicLink()||J.nlink!==1||(J.mode&63)!==0||J.size>4096)throw new X("invalid_activation_state","Managed runtime activation state is invalid.");let Q=JSON.parse(g(G,"utf8"));if(!vG(Q))throw new X("invalid_activation_state","Managed runtime activation state is invalid.");return Q}catch(G){if(G instanceof X)throw G;if(G.code==="ENOENT")return null;throw new X("invalid_activation_state","Managed runtime activation state is invalid.")}}function dG(q,G){JG(wq(q),JSON.stringify(G)+`
+`)}function f(q){try{I(wq(q))}catch(G){if(G.code!=="ENOENT")throw G}}async function cG(q){let G=jq(q.paths);if(!G)return"none";let J=L(q.paths);if(J===G.from_version)return f(q.paths),"cleared";if(J!==G.to_version)throw new X("rollback_fence_failed","Managed runtime changed before activation recovery could be applied.");let Q=q.verifyCodeSignatures??Fq,R=q.healthCheck??RG,W=!1;try{let U=F(q.paths,G.to_version);Q(U,i(q.paths,G.to_version)),W=await R(U,G.to_version)}catch{W=!1}if(W)return f(q.paths),N(q.paths,{event:"update.activated",runtime_version:G.to_version,...G.from_version?{from_version:G.from_version}:{},to_version:G.to_version,reason_code:"restart_recovery"}),"committed";if(G.from_version){let U=$G(q.paths,G.to_version);return f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:U.toVersion,from_version:U.fromVersion,to_version:U.toVersion,reason_code:"restart_recovery"}),"rolled_back"}return KG(q.paths,G.to_version),f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:G.to_version,from_version:G.to_version,reason_code:"restart_recovery"}),"rolled_back"}function hG(q){return Iq(q)&&Cq(q,["schema_version","pid","nonce","started_at","runtime_version"])&&q.schema_version===Zq&&typeof q.pid==="number"&&Number.isSafeInteger(q.pid)&&q.pid>0&&typeof q.nonce==="string"&&/^[0-9a-f-]{36}$/.test(q.nonce)&&GG(q.started_at)&&A(q.runtime_version)}function YG(q,G){try{let J=D(q);if(!J.isDirectory()||!Gq(J))return null;let Q=iq(K(q,G),m.O_RDONLY|m.O_NOFOLLOW|m.O_NONBLOCK);try{let R=nq(Q);if(!R.isFile()||R.nlink!==1||!Gq(R)||R.size>4096)return null;return g(Q,"utf8")}finally{u(Q)}}catch{return null}}function Hq(q){try{let G=JSON.parse(YG(q,"owner.json")??"null");return hG(G)?G:null}catch{return null}}function jG(q){try{return process.kill(q,0),!0}catch(G){return!(G instanceof Error&&("code"in G)&&G.code==="ESRCH")}}var mq="lease",lG=2,oG=4,o;function sG(){if(o!==void 0)return o;if(o=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let q;try{q=eq(import.meta.url)("bun:ffi")}catch{return null}let G=process.platform==="darwin"?"__error":"__errno_location",J=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of J)try{let R=q.dlopen(Q,{flock:{args:[q.FFIType.i32,q.FFIType.i32],returns:q.FFIType.i32},[G]:{args:[],returns:q.FFIType.ptr}}),W=R.symbols[G]();if(W===null)continue;return o={flock:(U,_)=>R.symbols.flock(U,_),errno:()=>q.read.i32(W),wouldBlock:process.platform==="darwin"?35:11},o}catch{}return null}var s,uG=3221225472,pG=4,rG=128,nG=32;function iG(q){if(s===void 0){s=null;try{let W=eq(import.meta.url)("bun:ffi"),{FFIType:U}=W;s={kernel:W.dlopen("kernel32.dll",{CreateFileW:{args:[U.ptr,U.u32,U.u32,U.ptr,U.u32,U.u32,U.ptr],returns:U.i64_fast},CloseHandle:{args:[U.i64_fast],returns:U.i32},GetLastError:{args:[],returns:U.u32}}).symbols,ptr:(Z)=>W.ptr(Z)}}catch{return null}}if(!s)return null;let{kernel:G,ptr:J}=s,Q=Buffer.from(`${q}\x00`,"utf16le"),R=G.CreateFileW(J(Q),uG,0,null,pG,rG,null);if(Number(R)===-1)return G.GetLastError()===nG?"busy":null;return{release:()=>{G.CloseHandle(R)}}}function aG(q){if(process.platform==="win32")return iG(`${q}.lease`);let G=sG();if(!G)return null;let J=iq(`${q}.lease`,m.O_RDWR|m.O_CREAT|m.O_NOFOLLOW,384);try{let Q=nq(J);if(!Q.isFile()||Q.nlink!==1||!Gq(Q))return u(J),"busy";if(G.flock(J,lG|oG)===0)return{release:()=>u(J)};let R=G.errno();return u(J),R===G.wouldBlock?"busy":null}catch(Q){throw u(J),Q}}function zq(q){b(B(q.path));let G=aG(q.path);if(G==="busy")return{acquired:!1,owner:Hq(q.path),recoveredStaleOwner:!1};let J=G!==null;try{let Q=eG(q,G);if(Q.acquired)J=!1;return Q}finally{if(J)G.release()}}function eG(q,G){let J=q.alive??jG,Q=!1;for(let R=0;R<4;R+=1){let W={schema_version:Zq,pid:q.pid??process.pid,nonce:q.nonce?.()??C(),started_at:(q.now?.()??new Date).toISOString(),runtime_version:q.runtimeVersion},U=`${q.path}.init-${process.pid}-${C()}`,_=!1;try{if(n(U,{mode:448}),h(K(U,"owner.json"),`${JSON.stringify(W)}
+`,{mode:384,flag:"wx"}),G!==null)h(K(U,mq),`flock
+`,{mode:384,flag:"wx"});q.beforePublish?.();try{throw D(q.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch($){if($.code!=="ENOENT")throw $}k(U,q.path),_=!0;let Z=!1;return{acquired:!0,owner:W,recoveredStaleOwner:Q,release(){if(Z)return;if(Z=!0,Hq(q.path)?.nonce===W.nonce)v(q.path,{recursive:!0,force:!0});G?.release()}}}catch(Z){let $=Z.code;if(!["EEXIST","ENOTEMPTY"].includes($??""))throw Z;let Y=Hq(q.path),H=(q.now?.()??new Date).getTime(),j=Y&&q.staleAfterMs!==void 0?H-Date.parse(Y.started_at)<q.staleAfterMs:!1,z=Y!==null&&!(G!==null&&YG(q.path,mq)!==null)&&J(Y.pid);if(!Y||z||j)return{acquired:!1,owner:Y,recoveredStaleOwner:!1};let M=`${q.path}.stale-${process.pid}-${C()}`;try{k(q.path,M),v(M,{recursive:!0,force:!0}),Q=!0}catch(w){let e=w.code;if(!["ENOENT","EEXIST"].includes(e??""))throw w}}finally{if(!_)v(U,{recursive:!0,force:!0})}}throw new X("lock_unavailable","Could not acquire the managed Reason runtime lock.")}var tG=20000;function a(q,G,J){if(!A(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let Q=Date.now()+tG,R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});while(!R.acquired&&Date.now()<Q)lq(100),R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});if(!R.acquired)throw new X("transition_busy","Another managed Reason runtime transition is in progress.");try{return J()}finally{R.release()}}function vJ(q){if(!A(q.runtimeVersion))throw new X("invalid_version","Invalid managed Reason runtime version.");let G=q.paths??Tq();return zq({path:G.brokerLock,runtimeVersion:q.runtimeVersion,...q.pid===void 0?{}:{pid:q.pid},...q.now===void 0?{}:{now:q.now},...q.nonce===void 0?{}:{nonce:q.nonce},...q.alive===void 0?{}:{alive:q.alive},...q.beforePublish===void 0?{}:{beforePublish:q.beforePublish}})}function HG(q){return Iq(q)&&Cq(q,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&q.schema_version===tq&&typeof q.event_id==="string"&&/^[0-9a-f-]{36}$/.test(q.event_id)&&GG(q.occurred_at)&&typeof q.event==="string"&&SG.includes(q.event)&&A(q.runtime_version)&&(q.from_version===void 0||A(q.from_version))&&(q.to_version===void 0||A(q.to_version))&&(q.reason_code===void 0||typeof q.reason_code==="string"&&Pq.test(q.reason_code))&&(q.duration_ms===void 0||typeof q.duration_ms==="number"&&Number.isSafeInteger(q.duration_ms)&&q.duration_ms>=0&&q.duration_ms<=86400000)&&(q.attempt_count===void 0||typeof q.attempt_count==="number"&&Number.isSafeInteger(q.attempt_count)&&q.attempt_count>=1&&q.attempt_count<=1e5)&&(q.retry_in_ms===void 0||typeof q.retry_in_ms==="number"&&Number.isSafeInteger(q.retry_in_ms)&&q.retry_in_ms>=0&&q.retry_in_ms<=30000)&&(q.capabilities===void 0||Array.isArray(q.capabilities)&&q.capabilities.length<=CG&&q.capabilities.every((G)=>typeof G==="string"&&Pq.test(G)))}var qJ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,GJ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,JJ=300000,qq=0n;function QJ(q){let G=BigInt(new Date(q.occurred_at).getTime())*1000000n;return qq=G>qq?G:qq+1n,`${String(qq).padStart(22,"0")}-${q.event_id}.json`}function $q(q){try{return Oq(q.lifecycleEvents).filter((G)=>qJ.test(G)).sort()}catch{return[]}}function Mq(q){try{let G=JSON.parse(g(q,"utf8"));return HG(G)?G:null}catch{return null}}function zG(q,G=jG,J=Date.now()){let Q;try{Q=Oq(q.lifecycleEvents)}catch{return}for(let R of Q){let W=R.match(GJ);if(!W)continue;let U=K(q.lifecycleEvents,R),_=K(q.lifecycleEvents,W[1]),Z=!G(Number(W[2]));if(!Z)try{Z=J-x(U).mtimeMs>=JJ}catch{continue}if(!Z)continue;try{k(U,_)}catch($){let Y=$.code;if(Y==="EEXIST")I(U);else if(Y!=="ENOENT")throw $}}}function RJ(q){let J=$q(q).flatMap((R)=>{try{return[{name:R,size:x(K(q.lifecycleEvents,R)).size}]}catch{return[]}}),Q=J.reduce((R,W)=>R+W.size,0);while(J.length>qG||Q>AG){let R=J.shift();if(!R)break;try{I(K(q.lifecycleEvents,R.name)),Q-=R.size}catch(W){if(W.code!=="ENOENT")throw W}}}function dJ(q){return zG(q),$q(q).map((G)=>Mq(K(q.lifecycleEvents,G))).filter((G)=>G!==null).slice(-qG)}function N(q,G,J={}){let Q={schema_version:tq,event_id:J.eventId?.()??C(),occurred_at:(J.now?.()??new Date).toISOString(),...G};if(!HG(Q))throw new X("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return b(q.lifecycleEvents),JG(K(q.lifecycleEvents,QJ(Q)),`${JSON.stringify(Q)}
+`),RJ(q),Q}function cJ(q,G){if(G.length===0)return 0;let J=new Set(G),Q=0;for(let R of $q(q)){let W=R.slice(23,-5);if(!J.has(W))continue;try{I(K(q.lifecycleEvents,R)),Q+=1}catch(U){if(U.code!=="ENOENT")throw U}}return Q}async function hJ(q,G,J){zG(q);let Q=0;for(let R of $q(q)){let W=K(q.lifecycleEvents,R);if(J){let Z=Mq(W);if(!Z||!J(Z))continue}let U=`${W}.sending-${process.pid}-${C()}`;try{k(W,U)}catch(Z){if(Z.code==="ENOENT")continue;throw Z}let _=Mq(U);if(!_){I(U);continue}try{await G(_),I(U),Q+=1}catch{try{k(U,W)}catch(Z){if(Z.code!=="ENOENT")throw Z}break}}return Q}function lJ(q){let G=q.paths??Tq(),J=q.sourceExecutable??process.execPath,Q=q.sourceCredentialLibrary??Bq(B(S(J))),R=q.now?.()??new Date,W=E(F(G,q.version))&&Lq(G,q.version,q.allowDowngrade)!==null;if(!W)N(G,{event:"service.install_started",runtime_version:q.version,to_version:q.version},{now:()=>R});try{let U=g(J),_;try{_=g(Q)}catch{throw new X("credential_boundary_unavailable","Managed runtime credential boundary is unavailable.")}let Z={url:"https://bootstrap.invalid/ara",sha256:c(U),size_bytes:U.byteLength},$={url:`https://bootstrap.invalid/${Nq}`,sha256:c(_),size_bytes:_.byteLength},Y=UG({paths:G,version:q.version,artifact:Z,bytes:U,credentialLibraryArtifact:$,credentialLibraryBytes:_,...q.verifyCodeSignatures?{verifyCodeSignatures:q.verifyCodeSignatures}:{}}),H=uq(J);if(E(H))Dq({sourceApp:H,home:q.home??d()});let j=yG(G,q.version,{allowDowngrade:q.allowDowngrade});if(!W)Yq(G);let z=q.home??d(),M=q.installLauncher===!1?"skipped":bG({paths:G,...q.launcherPath?{launcherPath:q.launcherPath}:{home:z}});if(q.installLauncher!==!1&&!q.launcherPath)XG(G,K(z,".local","bin","reason"));if(M==="conflict")N(G,{event:"service.launcher_conflict",runtime_version:q.version,to_version:q.version,reason_code:"existing_entrypoint"},{now:q.now});if(!W)N(G,{event:"service.install_completed",runtime_version:q.version,to_version:q.version,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now});return{installed:Y.installed,activated:j.changed,activeVersion:j.toVersion,executablePath:F(G,j.toVersion),launcher:M}}catch(U){throw N(G,{event:"service.install_failed",runtime_version:q.version,to_version:q.version,reason_code:U instanceof X?U.code:"install_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now}),U}}
+export{Zq as L,tq as M,qG as N,AG as O,BG as P,DG as Q,OG as R,Vq as S,EG as T,SG as U,Tq as V,gJ as W,F as X,i as Y,QG as Z,LG as _,wG as $,Fq as aa,p as ba,RG as ca,bJ as da,UG as ea,bG as fa,_q as ga,L as ha,yJ as ia,fJ as ja,mJ as ka,yG as la,$G as ma,cG as na,zq as oa,vJ as pa,dJ as qa,N as ra,cJ as sa,hJ as ta,lJ as ua};

package/bin/vm-hands/vm-hands-entry-lite-r8qg3wp1.js

@@ -0,0 +1,3 @@
+// @bun
+import{Dk as D}from"./vm-hands-entry-lite-f5230h6t.js";import{execFileSync as M}from"child_process";import{realpathSync as C,statSync as N}from"fs";import{tmpdir as U}from"os";import{createRequire as F}from"module";import{win32 as Z}from"path";var j=["/bin/bash","/usr/bin/bash"],I="Git Bash was not found. Install Git for Windows (https://git-scm.com/download/win), then run `reason connect`.";function k(K){try{return N(K).isFile()}catch{return!1}}var q=(K)=>[Z.join(K,"bin","bash.exe"),Z.join(K,"usr","bin","bash.exe")];function J(K,Q){let L=Z.normalize(K).toLowerCase(),Y=(Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows").toLowerCase();return L.startsWith(Z.join(Y,"system32").toLowerCase()+"\\")||L.startsWith(Z.join(Y,"sysnative").toLowerCase()+"\\")||L.includes("\\windowsapps\\")}function u(K=process.env,Q=k){let L=[];for(let Y of(K.PATH??K.Path??"").split(";"))if(Y&&Z.isAbsolute(Y))L.push(Z.join(Y,"git.exe"));for(let Y of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if(Y)L.push(Z.join(Y,"Git","cmd","git.exe"));if(K.LOCALAPPDATA)L.push(Z.join(K.LOCALAPPDATA,"Programs","Git","cmd","git.exe"));return L.find(Q)??null}var T;function S(K=process.platform){if(K!=="win32")return"git";return T??=u(),T}function O(K){let Q=process.platform==="win32"?u(K):"git";if(!Q)return null;try{return M(Q,["--exec-path"],{encoding:"utf8",timeout:5000,windowsHide:!0,stdio:["ignore","pipe","ignore"],env:K}).trim()||null}catch{return null}}function P(K=process.env,Q=O,L=k){let Y=[],H=Q(K);if(H)Y.push(...q(Z.resolve(H,"..","..","..")));for(let $ of[K.ProgramW6432,K.ProgramFiles,K["ProgramFiles(x86)"]])if($)Y.push(...q(Z.join($,"Git")));if(K.LOCALAPPDATA)Y.push(...q(Z.join(K.LOCALAPPDATA,"Programs","Git")));for(let $ of(K.PATH??K.Path??"").split(";"))if($&&Z.isAbsolute($))Y.push(Z.join($,"bash.exe"));return Y.find(($)=>!J($,K)&&L($))??null}var z;function G(K=process.platform){if(K!=="win32")return j.find(k)??null;return z??=P(),z}function y(K=process.platform){let Q=G(K);if(!Q)throw Error(K==="win32"?I:"bash_unavailable");return Q}function w(K=process.platform){return C(K==="win32"?U():"/tmp")}function X(K=process.platform,Q=process.env){if(K!=="win32")return"/usr/bin:/bin";let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return[Z.join(L,"System32"),L,Z.join(L,"System32","Wbem"),Z.join(L,"System32","WindowsPowerShell","v1.0")].join(";")}function W(K,Q=process.platform){if(Q!=="win32"||/[\\/]/.test(K))return K;let L=/\.exe$/i.test(K)?K:`${K}.exe`,Y=X(Q).split(";");return Z.join(L.toLowerCase()==="powershell.exe"?Y[3]:Y[0],L)}function f(K=process.platform,Q=process.env){if(K!=="win32")return{PATH:X(K)};let L=Q.SystemRoot??Q.SYSTEMROOT??"C:\\Windows";return{PATH:X(K,Q),SystemRoot:L,WINDIR:L}}function h(K=process.platform){return K==="win32"?{windowsHide:!0}:{detached:!0}}var V;function A(){if(V===void 0)V=Function("require",`return ${D}(require)`)(F(import.meta.url));return V}function v(K,Q=process.platform){let L=K.pid;if(Q!=="win32"||L===void 0)return;let Y=A();if(Y?.track(L))K.once("close",()=>Y.release(L))}function c(K,Q="SIGTERM",L=process.platform){if(L!=="win32"){process.kill(-K,Q);return}if(Q===0){process.kill(K,0);return}if(A()?.terminate(K))return;M(W("taskkill",L),["/PID",String(K),"/T","/F"],{stdio:"ignore",timeout:1e4,windowsHide:!0})}function p(K,Q=63,L=process.platform){return L==="win32"||K.uid===process.getuid?.()&&(K.mode&Q)===0}var _=/^(?:con|prn|aux|nul|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3]|conin\$|conout\$)(?:\..*)?$|:|[. ]$/i;function l(K){return K!=="."&&K!==".."&&_.test(K)}
+export{I as qk,S as rk,G as sk,y as tk,w as uk,X as vk,W as wk,f as xk,h as yk,v as zk,c as Ak,p as Bk,l as Ck};

package/bin/vm-hands/vm-hands-entry-lite-rd0ak4ye.js

@@ -0,0 +1,4 @@
+// @bun
+import{wk as b}from"./vm-hands-entry-lite-r8qg3wp1.js";import{Ek as W}from"./vm-hands-entry-lite-51hmj6am.js";import{execFileSync as C}from"child_process";import{mkdirSync as f,readdirSync as K,readFileSync as k,rmSync as G,statSync as A,writeFileSync as F}from"fs";import{join as $,sep as R}from"path";import{setTimeout as L}from"timers/promises";var O=3000,Y=null;function x(z){return $(z,"users")}function I(z){if(Y?.root===z.root)return;let H=x(z.root);f(H,{recursive:!0,mode:448}),F($(H,String(process.pid)),"",{mode:384}),Y=z}function w(){if(!Y)return;G($(x(Y.root),String(process.pid)),{force:!0}),Y=null}function B(z){try{return process.kill(z,0),!0}catch(H){return H instanceof Error&&"code"in H&&H.code==="EPERM"}}function j(){let z=process.getuid?.();if(process.platform==="linux")return K("/proc").flatMap((N)=>{if(!/^\d+$/.test(N))return[];try{if(A(`/proc/${N}`).uid!==z)return[];let Q=k(`/proc/${N}/cmdline`).toString("utf8").split("\x00").join(" ").trim();return Q?[{pid:Number(N),command:Q}]:[]}catch{return[]}});if(process.platform==="win32")return C(b("powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-Command",'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }'],{encoding:"utf8",maxBuffer:16777216,windowsHide:!0}).split(/\r?\n/).flatMap((Q)=>{let V=/^(\d+) (.+)$/.exec(Q.trim());return V?[{pid:Number(V[1]),command:V[2]}]:[]});return C("/bin/ps",["-axww","-o","pid=,uid=,command="],{encoding:"utf8",maxBuffer:16777216}).split(`
+`).flatMap((N)=>{let Q=/^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(N);return Q&&Number(Q[2])===z?[{pid:Number(Q[1]),command:Q[3]}]:[]})}async function h(){let z=Y;if(!z)return{released:"unused",stopped:0};let H=x(z.root);G($(H,String(process.pid)),{force:!0}),Y=null;let N=!1;for(let J of K(H)){let U=Number(J);if(Number.isSafeInteger(U)&&U>0&&B(U))N=!0;else G($(H,J),{force:!0})}if(N)return{released:"shared",stopped:0};let Q=j().filter((J)=>J.pid!==process.pid&&(J.command.includes(`${z.root}${R}`)||J.command.includes(`${z.automation}${R}`)||J.command.includes(z.extensionDir))),V=(J,U)=>{try{process.kill(J,U)}catch{}};for(let J of Q)V(J.pid,"SIGTERM");for(let J=Date.now()+O;Date.now()<J&&Q.some((U)=>B(U.pid));)await new Promise((U)=>setTimeout(U,100));for(let J of Q)if(B(J.pid))V(J.pid,"SIGKILL");return{released:"stopped",stopped:Q.length}}var v=20000,M=30000,P=100,Z=new Map,X=null,q=[];function y(z){Z.set(z,(Z.get(z)??0)+1);let H=!1;return()=>{if(H)return;H=!0;let N=(Z.get(z)??1)-1;if(N>0){Z.set(z,N);return}if(Z.delete(z),X?.run===z)X.idleUntil=0}}function D(){return new W("automation_desktop_busy","Another Session, or another agent of this Session, is using this worker's desktop. Retry after it finishes.")}function E(z,H){return X!==null&&X.run!==z&&(X.calls>0||H<X.idleUntil)}async function u(z,H,N=Date.now){let Q=Symbol(z);q.push(Q);try{let U=N()+M;for(;;){if(!E(z,N())&&(X?.run===z||q[0]===Q))break;if(N()>=U)throw D();await L(P,void 0,{signal:H}).catch(()=>H.throwIfAborted())}}finally{q.splice(q.indexOf(Q),1)}if(X?.run!==z)X={run:z,calls:0,idleUntil:0};let V=X;V.calls+=1;let J=!1;return()=>{if(J)return;J=!0,V.calls-=1,V.idleUntil=N()+v}}
+export{I as jk,w as kk,h as lk,v as mk,M as nk,y as ok,u as pk};

package/bin/vm-hands/{vm-hands-entry-lite-00qsbphw.js → vm-hands-entry-lite-rpn0frzb.js}

@@ -1,3 +1,3 @@
 // @bun
-import{Vj as w}from"./vm-hands-entry-lite-hc3p6r9p.js";var S="inference.custom.v1",K=32768,P=67108864,Q=16384,T=204800,z=600000,U=["content-type","anthropic-version","user-agent"],L=w.enum(["openai-completions","openai-responses","anthropic-messages"]),V=new Set(U),W=w.record(w.string(),w.string().max(2048)).refine((j)=>Object.keys(j).every((A)=>V.has(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)),"Only non-secret custom endpoint request headers are permitted");function F(j){try{let A=new URL(j);return["http:","https:"].includes(A.protocol)&&!A.username&&!A.password&&!A.search&&!A.hash?A:null}catch{return null}}function X(j,A){let B=F(j.baseUrl),H=F(A.baseUrl),D=F(j.url);if(!B||!H||!D||j.method!=="POST"||A.execution!=="device")return!1;let I=(J)=>J.origin+J.pathname.replace(/\/+$/,"");if(I(B)!==I(H)||D.origin!==B.origin)return!1;let O=A.api==="openai-completions"?"/chat/completions":A.api==="openai-responses"?"/responses":"/v1/messages";return D.pathname===B.pathname.replace(/\/+$/,"")+O}var b=w.object({baseUrl:w.string().max(2048),url:w.string().max(4096),method:w.literal("POST"),body:w.string().refine((j)=>new TextEncoder().encode(j).byteLength<=T).optional(),headers:W,credentialOrganizationId:w.string().uuid(),accountKey:w.string().min(1).max(256).optional()}).strict().refine((j)=>L.options.some((A)=>X(j,{baseUrl:j.baseUrl,api:A,execution:"device"})),"Invalid custom endpoint inference URL"),k=w.object({status:w.number().int().min(200).max(599),statusText:w.string().max(256).refine((j)=>!/[\r\n\0]/.test(j)),headers:w.record(w.string(),w.string().max(4096)).refine((j)=>Object.keys(j).every((A)=>["content-type","retry-after","x-request-id","request-id"].includes(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)))}).strict(),y=w.union([w.object({eof:w.literal(!0)}).strict(),w.object({eof:w.literal(!1),data:w.string().max(Math.ceil(K/3)*4).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((j)=>j.length>0&&j.length*3/4-(j.endsWith("==")?2:j.endsWith("=")?1:0)<=K)}).strict()]),M=w.object({bytes:w.number().int().min(0).max(P),chunks:w.number().int().min(0).max(Q)}).strict(),p=w.object({apiKey:w.string().min(1).max(16384).refine((j)=>!/[\r\n\0]/.test(j)),api:L}).strict(),Y=["custom_endpoint_host_not_found","custom_endpoint_connection_failed","custom_endpoint_tls_failed"];function c(j){return typeof j==="string"&&Y.includes(j)}var Z="Ollama listens only on 127.0.0.1 unless it is started with OLLAMA_HOST=0.0.0.0.",G={custom_endpoint_host_not_found:"Your computer couldn't resolve your model server's hostname. Check the hostname in the Base URL, and that this computer is on the network or tailnet that resolves it.",custom_endpoint_connection_failed:`Your computer's connection to your model server was refused or timed out. Check that the server is running and listening on the Base URL's address and port. ${Z}`,custom_endpoint_tls_failed:"Your computer couldn't make a secure (TLS) connection to your model server. Check the server's https certificate, or use an http:// Base URL for a server on your computer or private network.",401:"Your model server refused the request (HTTP 401). Check the API key saved for it in Models.",403:"Your model server refused the request (HTTP 403). Ollama refuses requests addressed to a hostname other than localhost, such as a *.ts.net name from tailscale serve or funnel: restart it with OLLAMA_HOST=0.0.0.0, or use http://localhost:11434/v1 when it runs on the session's computer. For another server, check the API key and its access rules.",404:"Your model server answered HTTP 404 (not found). Check that the Base URL is the API root (for Ollama, http://localhost:11434/v1) and that each model ID is one the server lists."},q="Local custom endpoints require a session on your connected computer. This custom endpoint's Execution location is Your computer, so Reason cloud never calls it. Connect your computer with the Reason desktop app or CLI and run this session there, or set the endpoint's Execution location to Reason cloud with a public https Base URL in Models, or choose another model.";function _(j){return typeof j==="string"&&j.startsWith("Local custom endpoints require a session on your connected computer.")}var $=new Set(Object.values(G));function h(j){return Object.hasOwn(G,j)?G[j]:null}function v(j){return typeof j==="string"&&($.has(j)||_(j))}var N="returned HTTP 403: its firewall blocked Reason cloud",x=/^Your model endpoint \S+ (?:returned HTTP 40[34]|returned HTTP 403: its firewall blocked Reason cloud|was unreachable: it refused the connection)\.$/,C=/Attention Required! \| Cloudflare|Sorry, you have been blocked|cf-error-details/i;function n(j,A,B){if(!/^[a-z0-9.-]+$/i.test(j))return null;if(A==="connection_refused")return`Your model endpoint ${j} was unreachable: it refused the connection.`;if(A===403&&B&&C.test(B))return`Your model endpoint ${j} ${N}.`;return A===403||A===404?`Your model endpoint ${j} returned HTTP ${A}.`:null}function E(j){return typeof j==="string"&&x.test(j)}function d(j){return E(j)&&j.includes(N)}
-export{S as Wc,K as Xc,P as Yc,Q as Zc,T as _c,z as $c,U as ad,X as bd,b as cd,k as dd,y as ed,M as fd,p as gd,Y as hd,c as id,q as jd,_ as kd,h as ld,v as md,n as nd,E as od,d as pd};
+import{ik as w}from"./vm-hands-entry-lite-zjfr0zh8.js";var S="inference.custom.v1",K=32768,P=67108864,Q=16384,T=204800,z=600000,U=["content-type","anthropic-version","user-agent"],L=w.enum(["openai-completions","openai-responses","anthropic-messages"]),V=new Set(U),W=w.record(w.string(),w.string().max(2048)).refine((j)=>Object.keys(j).every((A)=>V.has(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)),"Only non-secret custom endpoint request headers are permitted");function F(j){try{let A=new URL(j);return["http:","https:"].includes(A.protocol)&&!A.username&&!A.password&&!A.search&&!A.hash?A:null}catch{return null}}function X(j,A){let B=F(j.baseUrl),H=F(A.baseUrl),D=F(j.url);if(!B||!H||!D||j.method!=="POST"||A.execution!=="device")return!1;let I=(J)=>J.origin+J.pathname.replace(/\/+$/,"");if(I(B)!==I(H)||D.origin!==B.origin)return!1;let O=A.api==="openai-completions"?"/chat/completions":A.api==="openai-responses"?"/responses":"/v1/messages";return D.pathname===B.pathname.replace(/\/+$/,"")+O}var b=w.object({baseUrl:w.string().max(2048),url:w.string().max(4096),method:w.literal("POST"),body:w.string().refine((j)=>new TextEncoder().encode(j).byteLength<=T).optional(),headers:W,credentialOrganizationId:w.string().uuid(),accountKey:w.string().min(1).max(256).optional()}).strict().refine((j)=>L.options.some((A)=>X(j,{baseUrl:j.baseUrl,api:A,execution:"device"})),"Invalid custom endpoint inference URL"),k=w.object({status:w.number().int().min(200).max(599),statusText:w.string().max(256).refine((j)=>!/[\r\n\0]/.test(j)),headers:w.record(w.string(),w.string().max(4096)).refine((j)=>Object.keys(j).every((A)=>["content-type","retry-after","x-request-id","request-id"].includes(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)))}).strict(),y=w.union([w.object({eof:w.literal(!0)}).strict(),w.object({eof:w.literal(!1),data:w.string().max(Math.ceil(K/3)*4).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((j)=>j.length>0&&j.length*3/4-(j.endsWith("==")?2:j.endsWith("=")?1:0)<=K)}).strict()]),M=w.object({bytes:w.number().int().min(0).max(P),chunks:w.number().int().min(0).max(Q)}).strict(),p=w.object({apiKey:w.string().min(1).max(16384).refine((j)=>!/[\r\n\0]/.test(j)),api:L}).strict(),Y=["custom_endpoint_host_not_found","custom_endpoint_connection_failed","custom_endpoint_tls_failed"];function c(j){return typeof j==="string"&&Y.includes(j)}var Z="Ollama listens only on 127.0.0.1 unless it is started with OLLAMA_HOST=0.0.0.0.",G={custom_endpoint_host_not_found:"Your computer couldn't resolve your model server's hostname. Check the hostname in the Base URL, and that this computer is on the network or tailnet that resolves it.",custom_endpoint_connection_failed:`Your computer's connection to your model server was refused or timed out. Check that the server is running and listening on the Base URL's address and port. ${Z}`,custom_endpoint_tls_failed:"Your computer couldn't make a secure (TLS) connection to your model server. Check the server's https certificate, or use an http:// Base URL for a server on your computer or private network.",401:"Your model server refused the request (HTTP 401). Check the API key saved for it in Models.",403:"Your model server refused the request (HTTP 403). Ollama refuses requests addressed to a hostname other than localhost, such as a *.ts.net name from tailscale serve or funnel: restart it with OLLAMA_HOST=0.0.0.0, or use http://localhost:11434/v1 when it runs on the session's computer. For another server, check the API key and its access rules.",404:"Your model server answered HTTP 404 (not found). Check that the Base URL is the API root (for Ollama, http://localhost:11434/v1) and that each model ID is one the server lists."},q="Local custom endpoints require a session on your connected computer. This custom endpoint's Execution location is Your computer, so Reason cloud never calls it. Connect your computer with the Reason desktop app or CLI and run this session there, or set the endpoint's Execution location to Reason cloud with a public https Base URL in Models, or choose another model.";function _(j){return typeof j==="string"&&j.startsWith("Local custom endpoints require a session on your connected computer.")}var $=new Set(Object.values(G));function h(j){return Object.hasOwn(G,j)?G[j]:null}function v(j){return typeof j==="string"&&($.has(j)||_(j))}var N="returned HTTP 403: its firewall blocked Reason cloud",x=/^Your model endpoint \S+ (?:returned HTTP 40[34]|returned HTTP 403: its firewall blocked Reason cloud|was unreachable: it refused the connection)\.$/,C=/Attention Required! \| Cloudflare|Sorry, you have been blocked|cf-error-details/i;function n(j,A,B){if(!/^[a-z0-9.-]+$/i.test(j))return null;if(A==="connection_refused")return`Your model endpoint ${j} was unreachable: it refused the connection.`;if(A===403&&B&&C.test(B))return`Your model endpoint ${j} ${N}.`;return A===403||A===404?`Your model endpoint ${j} returned HTTP ${A}.`:null}function E(j){return typeof j==="string"&&x.test(j)}function d(j){return E(j)&&j.includes(N)}
+export{S as gd,K as hd,P as id,Q as jd,T as kd,z as ld,U as md,X as nd,b as od,k as pd,y as qd,M as rd,p as sd,Y as td,c as ud,q as vd,_ as wd,h as xd,v as yd,n as zd,E as Ad,d as Bd};

package/bin/vm-hands/{vm-hands-entry-lite-g9rvf5qk.js → vm-hands-entry-lite-rtt2w6c6.js}

@@ -1,3 +1,3 @@
 // @bun
 function r(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}
-export{r as Sc};
+export{r as _c};

package/bin/vm-hands/vm-hands-entry-lite-sex82vb1.js

@@ -0,0 +1,3 @@
+// @bun
+import{resolve as H,sep as J}from"path";var K=[[".ssh"],[".gnupg"],[".aws"],[".azure"],[".kube"],[".docker"],[".infisical"],[".password-store"],[".terraform.d"],[".config","ara"],[".config","reason"],[".config","gh"],[".config","gcloud"],[".config","infisical"],[".config","op"],[".config","1password"],[".config","pass"],[".local","share","keyrings"],["library","keychains"],["library","application support","so.ara.desktop"],["appdata","roaming","github cli"],["appdata","roaming","gcloud"],["appdata","roaming","microsoft","credentials"],["appdata","local","microsoft","credentials"],["appdata","roaming","microsoft","protect"],["appdata","roaming","1password"],["appdata","local","1password"],["appdata","roaming","microsoft","windows","start menu","programs","startup"],["documents","windowspowershell"],["documents","powershell"],["appdata","local","reason"]],V=[[".codex","config.toml"],[".cursor","mcp.json"],[".claude","settings.json"],[".claude","settings.local.json"],[".cargo","credentials"],[".cargo","credentials.toml"],[".gem","credentials"],[".config","git","config"],[".config","git","credentials"],[".config","pip","pip.conf"]],Z=new Set([".bash_login",".bash_profile",".bashrc",".bunfig.toml",".claude.json",".env",".envrc",".git-credentials",".gitconfig",".mcp.json",".netrc",".npmrc",".profile",".pypirc",".terraformrc",".yarnrc",".yarnrc.yml",".zlogin",".zlogout",".zprofile",".zshenv",".zshrc","auth.json","credentials.json","credentials.tfrc.json","local-daemon.json","local-device.json","mcp.json"]),$=[".key",".p12",".pfx",".pem"];function B(z,j){if(z.length<j.length)return!1;for(let k=0;k<=z.length-j.length;k+=1)if(j.every((b,G)=>z[k+G]===b))return!0;return!1}function A(z){let j=H(z).split(J).filter(Boolean).map((b)=>b.toLowerCase());if(K.some((b)=>B(j,b)))return!0;if(V.some((b)=>B(j,b)))return!0;let k=j.at(-1)??"";return Z.has(k)||k.startsWith(".env.")||$.some((b)=>k.endsWith(b))}
+export{K as Ri,V as Si,Z as Ti,$ as Ui,A as Vi};

package/bin/vm-hands/{vm-hands-entry-lite-dgxxsdwb.js → vm-hands-entry-lite-xrthfx3q.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Xh as v}from"./vm-hands-entry-lite-kxdw4myj.js";import{Zh as r,di as o,gi as g,hi as h,ii as a}from"./vm-hands-entry-lite-5kgvss4p.js";import{Yi as V}from"./vm-hands-entry-lite-c01eyep6.js";import{Vj as U}from"./vm-hands-entry-lite-hc3p6r9p.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
+import{ki as v}from"./vm-hands-entry-lite-y2s2w174.js";import{mi as r,si as o,vi as g,wi as h,xi as a}from"./vm-hands-entry-lite-e2mjbqmr.js";import{lj as V}from"./vm-hands-entry-lite-fyvgav60.js";import{ik as U}from"./vm-hands-entry-lite-zjfr0zh8.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
 `;function iQ(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function $Q(Q,Z=Date.now()){let $=s.safeParse(Q);if(!$.success)return!1;let W=$.data,X=typeof W.occurredAt==="string"?Date.parse(W.occurredAt):NaN,Y=typeof W.expiresAt==="string"?Date.parse(W.expiresAt):NaN;return W.kind==="permission_denied"&&["bash","read","write","edit"].includes(W.operation)&&["sandbox_policy","os_permission_unknown"].includes(W.provenance)&&Number.isFinite(X)&&X<=Z&&Y>Z&&Y>X&&Y-X<=600000}function LZ(Q,Z,$=Date.now()){if(!Q||!Z||Q.state!=="connected"||Q.deviceId!==Z.deviceId)return null;let W=Date.parse(Q.lastHeartbeatAt??""),X=Q.permissionRecovery;if(!($-W>=0&&$-W<30000)||!$Q(X,$)||X.deviceId!==Z.deviceId||X.organizationId!==Z.orgId)return null;try{process.kill(Q.pid,0)}catch{return null}return X}function WQ(Q={},Z=V()){let $=r({env:{...process.env,...Q}}),W=Q.XDG_CONFIG_HOME?.trim()||A(Z,".config");return a(W,...$==="staging"?["staging"]:[])}function D(Q={},Z=V()){return A(WQ(Q,Z),"local-device.json")}function qQ(Q={},Z=V()){return A(WQ(Q,Z),"local-daemon.json")}function b(Q,Z){IQ(F(Q),{recursive:!0,mode:448}),_(F(Q),448);let $=`${Q}.${process.pid}.${t()}.tmp`;try{pQ($,`${JSON.stringify(Z,null,2)}
 `,{mode:384,flag:"wx"}),_($,384),vQ($,Q),_(Q,384)}finally{if(e($))uQ($)}return Q}function S(Q){if(!e(Q))return null;try{return JSON.parse(gQ(Q,"utf8"))}catch{return null}}function T(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function sQ(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let W=$;if(typeof W.id!=="string"||typeof W.label!=="string"||typeof W.path!=="string"||typeof W.pathFingerprint!=="string"||!W.permissions||typeof W.permissions.read!=="boolean"||typeof W.permissions.write!=="boolean"||typeof W.permissions.execute!=="boolean"||typeof W.permissions.discover_environment!=="boolean"||typeof W.permissions.expose_mcp!=="boolean")return null;Z.push({id:W.id,label:W.label,path:W.path,pathFingerprint:W.pathFingerprint,permissions:W.permissions})}return Z}function XQ(Q,Z,$=[]){let W=Object.keys(Q);return Z.every((X)=>Object.hasOwn(Q,X))&&W.every((X)=>Z.includes(X)||$.includes(X))}function nQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function YQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=sQ(Z.roots),W=nQ(Z.apiOrigin);if(!W||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!iQ(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:W,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function rQ(Q){return{...Q,credentialStorage:K}}function oQ(Q){return{version:P,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:K}}function jQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!XQ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=YQ(Z);if(!$||Z.version!==P||Z.credentialStorage!==K||!x(Z.devicePublicKey))return null;return{version:P,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:K}}function GQ(Q){return new TextEncoder().encode(`${dQ}${JSON.stringify(oQ(Q))}`)}function aQ(Q){let Z=Buffer.from(Q,"base64url");return CQ({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function tQ(Q,Z){let $={version:ZQ,state:Q,signature:Z.sign(GQ(Q))};return new TextEncoder().encode(JSON.stringify($))}function HQ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new q("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new q("invalid_binding");let $=Z;if(!XQ($,["version","state","signature"])||$.version!==ZQ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new q("invalid_binding");let W=jQ($.state);if(!W)throw new q("invalid_binding");let X=!1;try{X=EQ("sha256",GQ(W),aQ(W.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{X=!1}if(!X)throw new q("invalid_binding");return W}function eQ(Q){let{credentialStorage:Z,...$}=Q;return $}function QZ(Q){return Q instanceof q?p(Q):"credential_boundary_failed"}function EZ(Q=D(),Z={}){let $=S(Q),W=Z.proofStore??Z.credentialStore??B(),X=W.loadBinding();if(!X){if($&&typeof $==="object"&&!Array.isArray($)&&ZZ($))return null;if($!==null)throw new q("invalid_binding");return null}let Y=HQ(X),G=W.loadPublicKey();if(W.privateKeyIsNonExtractable(),G!==Y.devicePublicKey)throw new q("invalid_public_key");let H=jQ($);if(Z.repair!==!1&&(!H||JSON.stringify(H)!==JSON.stringify(Y)))b(Q,Y);return eQ(Y)}function ZZ(Q){let Z=Q,$=YQ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function IZ(Q,Z=D(),$={}){let W=$.proofStore??$.credentialStore??B();T($,"credential.store_started");try{if(!x(Q.devicePublicKey)||W.loadPublicKey()!==Q.devicePublicKey)throw new q("invalid_public_key");W.privateKeyIsNonExtractable();let X=rQ(Q),Y=W.loadBinding();if(Y){let H=HQ(Y);if(H.devicePublicKey!==Q.devicePublicKey||H.orgId!==Q.orgId||H.deviceId!==Q.deviceId||H.apiOrigin!==Q.apiOrigin&&!o(H.apiOrigin,Q.apiOrigin))throw new q("invalid_binding")}let G=tQ(X,W);if(Y)W.updateBinding(G);else W.createBinding(G);return b(Z,X),T($,"credential.store_completed"),Z}catch(X){throw T($,"credential.store_failed",QZ(X)),X}}function gZ(Q=qQ()){let Z=S(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;if($.permissionRecovery!==void 0&&!$Q($.permissionRecovery))delete $.permissionRecovery;return $}function hZ(Q,Z=qQ()){return b(Z,Q)}var n=1;function $Z(Q=D()){return A(F(Q),"local-device.proxy.json")}function vZ(Q=$Z()){let Z=S(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==n||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!QQ($.caFile)))return null;return{version:n,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function yZ(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=LQ(32)){let W=new Set,X=[];for(let Y of Q){let G=hQ(QQ(Y)?Y:lQ(Y));if(!yQ(G).isDirectory())throw Error(`Local execution root is not a directory: ${Y}`);if(W.has(G))continue;W.add(G),X.push({id:t(),label:cQ(G)||G,path:G,pathFingerprint:mQ("sha256",$).update(G).digest("hex"),permissions:{...Z}})}if(X.length===0)throw Error("At least one explicit local execution root is required.");return X}
-export{q as jg,DQ as kg,x as lg,l as mg,d as ng,i as og,$Q as pg,LZ as qg,D as rg,qQ as sg,EZ as tg,IZ as ug,gZ as vg,hZ as wg,n as xg,vZ as yg,yZ as zg};
+export{q as xg,DQ as yg,x as zg,l as Ag,d as Bg,i as Cg,$Q as Dg,LZ as Eg,D as Fg,qQ as Gg,EZ as Hg,IZ as Ig,gZ as Jg,hZ as Kg,n as Lg,vZ as Mg,yZ as Ng};

package/bin/vm-hands/{vm-hands-entry-lite-kxdw4myj.js → vm-hands-entry-lite-y2s2w174.js}

@@ -1,3 +1,3 @@
 // @bun
 import{createHash as f,createPublicKey as V,verify as G}from"crypto";var H="libara_device_keychain.dylib",Y="libreason_device_keychain.dylib",k=1,x=2,h=536870912,p=262144;var U=["darwin-arm64","darwin-x64"];class J extends Error{code;constructor(z,F){super(F);this.code=z;this.name="ManagedRuntimeError"}}var C=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,N=/^[a-f0-9]{64}$/;function X(z){return Boolean(z)&&typeof z==="object"&&!Array.isArray(z)}function $(z,F,Q=[]){let Z=new Set([...F,...Q]);return F.every((W)=>(W in z))&&Object.keys(z).every((W)=>Z.has(W))}function B(z){return typeof z==="string"&&C.test(z)}function O(z){return typeof z==="string"&&!Number.isNaN(Date.parse(z))&&new Date(z).toISOString()===z}function c(z){return U.includes(z)}function I(z,F){if(!B(z)||!c(F))throw new J("invalid_release_asset","Invalid managed runtime release asset.");return`ara-runtime-v${z}-${F}`}function m(z,F){return`${I(z,F)}-${H}`}var R="managed-runtime-identity.json",D="reason-macos-background-identity-v1";function q(z){if(z===null)return"null";if(typeof z==="string"||typeof z==="boolean")return JSON.stringify(z);if(typeof z==="number"){if(!Number.isFinite(z))throw new J("invalid_manifest","Manifest numbers must be finite.");return JSON.stringify(z)}if(Array.isArray(z))return`[${z.map((F)=>q(F)).join(",")}]`;if(X(z))return`{${Object.keys(z).sort().map((F)=>`${JSON.stringify(F)}:${q(z[F])}`).join(",")}}`;throw new J("invalid_manifest","Manifest contains an unsupported value.")}function j(z){if(!X(z)||!$(z,["url","sha256","size_bytes"])||typeof z.url!=="string"||typeof z.sha256!=="string"||!N.test(z.sha256)||typeof z.size_bytes!=="number"||!Number.isSafeInteger(z.size_bytes)||z.size_bytes<=0||z.size_bytes>h)throw new J("invalid_manifest","Manifest contains an invalid runtime artifact.");let F;try{F=new URL(z.url)}catch{throw new J("invalid_manifest","Runtime artifact URL is invalid.")}if(F.protocol!=="https:"||F.username||F.password||F.hash)throw new J("invalid_manifest","Runtime artifact URL must be an HTTPS URL without credentials or a fragment.");return{url:F.toString(),sha256:z.sha256,size_bytes:z.size_bytes}}function b(z){if(!X(z)||!$(z,["broker","credential_library"]))throw new J("invalid_manifest","Manifest must bind the broker and credential library as one runtime.");return{broker:j(z.broker),credential_library:j(z.credential_library)}}function K(z){if(!X(z)||!$(z,["schema_version","version","published_at","artifacts"])||z.schema_version!==x||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Managed Reason runtime manifest is invalid.");return{schema_version:x,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":b(z.artifacts["darwin-arm64"]),"darwin-x64":b(z.artifacts["darwin-x64"])}}}function _(z){if(!X(z)||!$(z,["schema_version","version","published_at","artifacts"])||z.schema_version!==k||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Legacy managed runtime manifest is invalid.");return{schema_version:k,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":j(z.artifacts["darwin-arm64"]),"darwin-x64":j(z.artifacts["darwin-x64"])}}}function M(z){if(!X(z)||!$(z,["schema","version","published_at","artifacts"])||z.schema!==D||!B(z.version)||!O(z.published_at)||!X(z.artifacts)||!$(z.artifacts,[...U]))throw new J("invalid_manifest","Reason background identity manifest is invalid.");return{schema:D,version:z.version,published_at:z.published_at,artifacts:{"darwin-arm64":j(z.artifacts["darwin-arm64"]),"darwin-x64":j(z.artifacts["darwin-x64"])}}}function S(z){if(typeof z!=="string"||!/^[A-Za-z0-9+/]+={0,2}$/.test(z))throw new J("invalid_signature","Runtime manifest signature is invalid.");let F=Buffer.from(z,"base64");if(F.length!==64||F.toString("base64")!==z)throw new J("invalid_signature","Runtime manifest signature is invalid.");return F}function L(z){let F=z;if(typeof z==="string")try{F=JSON.parse(z)}catch{throw new J("invalid_manifest","Managed Reason runtime manifest is not valid JSON.")}if(!X(F)||!$(F,["key_id","manifest","signature"])||typeof F.key_id!=="string"||!/^[A-Za-z0-9._-]{1,80}$/.test(F.key_id)||typeof F.signature!=="string")throw new J("invalid_manifest","Signed managed Reason runtime manifest is invalid.");return F}function o(z,F){let Q=L(z),Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Runtime manifest was signed by an unknown key.");let W=K(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Runtime manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Runtime manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function E(z,F){let Q=L(z),Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Background identity manifest was signed by an unknown key.");let W=M(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Background identity manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Background identity manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function d(z,F){let Q=z;if(typeof z==="string")try{Q=JSON.parse(z)}catch{throw new J("invalid_manifest","Legacy managed runtime manifest is not valid JSON.")}if(!X(Q)||!$(Q,["key_id","manifest","signature"])||typeof Q.key_id!=="string"||!/^[A-Za-z0-9._-]{1,80}$/.test(Q.key_id)||typeof Q.signature!=="string")throw new J("invalid_manifest","Signed legacy managed runtime manifest is invalid.");let Z=F[Q.key_id];if(!Z)throw new J("untrusted_key","Legacy runtime manifest was signed by an unknown key.");let W=_(Q.manifest),w=S(Q.signature),P=!1;try{P=G(null,Buffer.from(q(W)),V(Z),w)}catch{throw new J("invalid_signature","Legacy runtime manifest signature could not be verified.")}if(!P)throw new J("invalid_signature","Legacy runtime manifest signature did not match.");return{key_id:Q.key_id,manifest:W,signature:Q.signature}}function A(z){return f("sha256").update(z).digest("hex")}function i(z,F){if(z.byteLength!==F.size_bytes)throw new J("artifact_size_mismatch","Runtime artifact size did not match its manifest.");if(A(z)!==F.sha256)throw new J("artifact_checksum_mismatch","Runtime artifact checksum did not match its manifest.")}import{existsSync as y}from"fs";import{join as T}from"path";function v(z){let F=T(z,Y);return y(F)?F:T(z,H)}
-export{H as Gh,Y as Hh,k as Ih,x as Jh,h as Kh,p as Lh,U as Mh,J as Nh,I as Oh,m as Ph,R as Qh,q as Rh,o as Sh,E as Th,d as Uh,A as Vh,i as Wh,v as Xh};
+export{H as Vh,Y as Wh,k as Xh,x as Yh,h as Zh,p as _h,U as $h,J as ai,I as bi,m as ci,R as di,q as ei,o as fi,E as gi,d as hi,A as ii,i as ji,v as ki};