@reason-machines/cli-linux-x64 0.2.401 → 0.2.402

package/bin/vm-hands/{vm-hands-entry-lite-ht482g94.js → vm-hands-entry-lite-wtc8ebkr.js}

@@ -1,5 +1,5 @@
 // @bun
-import{ri as v}from"./vm-hands-entry-lite-x64d3bdx.js";import{Ci as g,Di as h,Ei as a,ti as r,zi as o}from"./vm-hands-entry-lite-923jmcs3.js";import{sj as V}from"./vm-hands-entry-lite-ecgyzbdp.js";import{pk as U}from"./vm-hands-entry-lite-18kfytsa.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
+import{ti as v}from"./vm-hands-entry-lite-399rn7a2.js";import{Bi as o,Ei as g,Fi as h,Gi as a,vi as r}from"./vm-hands-entry-lite-caxtg4j7.js";import{vj as V}from"./vm-hands-entry-lite-wsnr4fx8.js";import{sk as U}from"./vm-hands-entry-lite-ysk49bnz.js";import{createHmac as mQ,createPublicKey as CQ,randomBytes as LQ,randomUUID as t,verify as EQ}from"crypto";import{chmodSync as _,existsSync as e,mkdirSync as IQ,readFileSync as gQ,realpathSync as hQ,renameSync as vQ,statSync as yQ,unlinkSync as uQ,writeFileSync as pQ}from"fs";import{basename as cQ,dirname as F,isAbsolute as QQ,join as A,resolve as lQ}from"path";var WZ=[Object.freeze({family:"ara",channel:"stable",applicationId:"so.ara.desktop"}),Object.freeze({family:"ara",channel:"staging",applicationId:"so.ara.desktop.staging"}),Object.freeze({family:"reason",channel:"stable",applicationId:"com.reasonmachines.desktop"}),Object.freeze({family:"reason",channel:"staging",applicationId:"com.reasonmachines.desktop.staging"})];var zQ="REASON_DESKTOP_RUNTIME",UQ="REASON_DESKTOP_RUNTIME_CHANNEL",JQ="REASON_DESKTOP_RUNTIME_INSTANCE_ID",MQ="REASON_DESKTOP_RUNTIME_WORKSPACE_SCOPE",zZ={[zQ]:"ARA_DESKTOP_RUNTIME",[UQ]:"ARA_DESKTOP_RUNTIME_CHANNEL",[JQ]:"ARA_DESKTOP_RUNTIME_INSTANCE_ID",[MQ]:"ARA_DESKTOP_RUNTIME_WORKSPACE_SCOPE"};function m(Q){if(Q===void 0)return;if(!/^[a-f0-9]{64}$/.test(Q))throw Error("Invalid desktop workspace scope.");return Q}import{chmodSync as N,existsSync as z,mkdirSync as O,readFileSync as C,realpathSync as xQ,renameSync as wQ,unlinkSync as R,writeFileSync as f}from"fs";import{createPrivateKey as KQ,createPublicKey as VQ,generateKeyPairSync as AQ,randomUUID as NQ,sign as OQ}from"crypto";import{createRequire as RQ}from"module";import{homedir as fQ,platform as y}from"os";import{dirname as kQ,join as J}from"path";var L=1,BQ=16384,M=65536,_Q=128,TQ=128,u=65536;class q extends Error{code;nativeStatus;constructor(Q,Z){super(`Reason Device proof boundary failed (${Q}).${Z===void 0?"":` Native status: ${Z}.`}`);this.code=Q;this.nativeStatus=Z;this.name="LocalCredentialBoundaryError"}}function p(Q){if(Q.code==="proof_key_read_failed"&&Q.nativeStatus===-25300)return"proof_key_missing";switch(Q.nativeStatus){case-25308:return"keychain_interaction_required";case-25293:return"keychain_access_denied";case-25291:return"keychain_unavailable";default:return Q.code}}var k=null;function c(){if(!k)try{k=RQ(import.meta.url)("bun:ffi")}catch{throw new q("native_boundary_unavailable")}return k}function FQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost"&&Z.hostname!=="[::1]"&&Z.hostname!=="::1")return null;return Z.origin}catch{return null}}function PQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw new q("invalid_credential_record");let Z=Q,$=FQ(Z.apiOrigin);if(Z.version!==L||!$||typeof Z.orgId!=="string"||Z.orgId.length<1||Z.orgId.length>160||typeof Z.deviceId!=="string"||Z.deviceId.length<1||Z.deviceId.length>160||typeof Z.credential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.credential)||Z.credential.length>4096)throw new q("invalid_credential_record");return{version:L,apiOrigin:$,orgId:Z.orgId,deviceId:Z.deviceId,credential:Z.credential}}function DQ(Q=process.execPath){let Z=Q;try{Z=xQ(Q)}catch{}return v(kQ(Z))}function j(Q){return c().ptr(Q)}function bQ(Q){if(!z(Q))throw new q("native_boundary_unavailable");let{dlopen:Z,FFIType:$}=c();try{return Z(Q,{ara_device_configure_scope:{args:[$.ptr,$.u64],returns:$.i32},ara_device_key_load_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_create_fresh_public:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_sign:{args:[$.ptr,$.u64,$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_key_is_non_extractable:{args:[$.ptr],returns:$.i32},ara_device_key_delete:{args:[$.ptr],returns:$.i32},ara_device_binding_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_binding_create:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_update:{args:[$.ptr,$.u64],returns:$.i32},ara_device_binding_delete:{args:[$.ptr],returns:$.i32},ara_device_keychain_read:{args:[$.ptr,$.u64,$.ptr],returns:$.i32},ara_device_keychain_delete:{args:[$.ptr],returns:$.i32}})}catch(W){if(W instanceof q)throw W;throw new q("native_boundary_unavailable")}}function E(Q){return Buffer.from(Q).toString("base64url")}function x(Q){if(typeof Q!=="string"||!/^[A-Za-z0-9_-]{87}$/.test(Q))return!1;try{let Z=Buffer.from(Q,"base64url");return Z.byteLength===65&&Z[0]===4}catch{return!1}}function l(Q){if(Q.byteLength<8||Q.byteLength>72||Q[0]!==48)return!1;let Z=Q[1];return Z!==void 0&&Z<128&&Z+2===Q.byteLength}class d{libraryPath;runtimePlatform;workspaceScope;library=null;constructor(Q=DQ(),Z=y(),$){this.libraryPath=Q;this.runtimePlatform=Z;this.workspaceScope=$;m($)}symbols(){if(this.runtimePlatform!=="darwin")throw new q("unsupported_platform");this.library??=bQ(this.libraryPath);let Q=new TextEncoder().encode(this.workspaceScope??""),Z=this.library.symbols.ara_device_configure_scope(j(Q.length?Q:new Uint8Array(1)),BigInt(Q.length));if(Z!==0)throw new q("native_boundary_unavailable",Z);return this.library.symbols}publicKey(Q){let Z=new Uint8Array(_Q),$=new BigUint64Array(1),W=Q==="load"?this.symbols().ara_device_key_load_public(j(Z),BigInt(Z.byteLength),j($)):this.symbols().ara_device_key_create_fresh_public(j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q(Q==="load"?"proof_key_read_failed":"proof_key_generation_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X!==65)throw new q("invalid_public_key");let Y=E(Z.subarray(0,X));if(!x(Y))throw new q("invalid_public_key");return Y}loadPublicKey(){return this.publicKey("load")}createFreshPublicKey(){return this.publicKey("create_fresh")}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=new Uint8Array(TQ),$=new BigUint64Array(1),W=this.symbols().ara_device_key_sign(j(Q),BigInt(Q.byteLength),j(Z),BigInt(Z.byteLength),j($));if(W!==0)throw new q("proof_sign_failed",W);let X=Number($[0]);if(!Number.isSafeInteger(X)||X<1||X>Z.byteLength)throw new q("invalid_signature");let Y=Z.subarray(0,X);if(!l(Y))throw new q("invalid_signature");return E(Y)}privateKeyIsNonExtractable(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_is_non_extractable(j(Q));if(Z!==0||Q[0]!==1)throw new q("proof_key_read_failed",Z);return!0}deleteKey(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_key_delete(j(Q));if(Z!==0)throw new q("proof_key_delete_failed",Z);return Q[0]===1}loadBinding(){let Q=new Uint8Array(M),Z=new BigUint64Array(1),$=this.symbols().ara_device_binding_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("binding_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_binding");return Q.slice(0,W)}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_create(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_create_failed",Z)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");let Z=this.symbols().ara_device_binding_update(j(Q),BigInt(Q.byteLength));if(Z!==0)throw new q("binding_update_failed",Z)}deleteBinding(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_binding_delete(j(Q));if(Z!==0)throw new q("binding_delete_failed",Z);return Q[0]===1}loadLegacyCredential(){let Q=new Uint8Array(BQ),Z=new BigUint64Array(1),$=this.symbols().ara_device_keychain_read(j(Q),BigInt(Q.byteLength),j(Z));if($===1)return null;if($!==0)throw new q("legacy_credential_read_failed",$);let W=Number(Z[0]);if(!Number.isSafeInteger(W)||W<1||W>Q.byteLength)throw new q("invalid_credential_record");try{let X=new TextDecoder("utf-8",{fatal:!0}).decode(Q.subarray(0,W));return PQ(JSON.parse(X))}catch(X){if(X instanceof q)throw X;throw new q("invalid_credential_record")}}deleteLegacyCredential(){let Q=new Uint8Array(1),Z=this.symbols().ara_device_keychain_delete(j(Q));if(Z!==0)throw new q("legacy_credential_delete_failed",Z);return Q[0]===1}}function I(Q){let Z=Q.export({format:"jwk"});if(Z.crv!=="P-256"||typeof Z.x!=="string"||typeof Z.y!=="string")throw new q("invalid_public_key");let $=Buffer.from(Z.x,"base64url"),W=Buffer.from(Z.y,"base64url");if($.byteLength!==32||W.byteLength!==32)throw new q("invalid_public_key");let X=Buffer.concat([Buffer.of(4),$,W]).toString("base64url");if(!x(X))throw new q("invalid_public_key");return X}function SQ(){let Q=process.env.XDG_CONFIG_HOME?.trim()||J(fQ(),".config");h(Q);let Z=J(Q,"ara");return g(Z)?Z:J(Q,"reason")}class i{directory;constructor(Q=SQ()){this.directory=Q}keyPath(){return J(this.directory,"local-device.key")}bindingPath(){return J(this.directory,"local-device.binding")}loadPrivateKeyObject(){let Q=this.keyPath();if(!z(Q))throw new q("proof_key_read_failed");try{let Z=C(Q,"utf8");return KQ({key:Z,format:"pem"})}catch{throw new q("proof_key_read_failed")}}loadPublicKey(){let Q=this.loadPrivateKeyObject(),Z=VQ(Q);return I(Z)}createFreshPublicKey(){O(this.directory,{recursive:!0,mode:448});let{privateKey:Q,publicKey:Z}=AQ("ec",{namedCurve:"P-256"}),$=Q.export({type:"pkcs8",format:"pem"}),W=this.keyPath();return f(W,$,{mode:384}),N(W,384),I(Z)}sign(Q){if(Q.byteLength<1||Q.byteLength>u)throw new q("proof_sign_failed");let Z=this.loadPrivateKeyObject(),$;try{$=OQ("sha256",Q,Z)}catch{throw new q("proof_sign_failed")}if(!l($))throw new q("invalid_signature");return $.toString("base64url")}privateKeyIsNonExtractable(){return!1}deleteKey(){let Q=this.keyPath();if(!z(Q))return!1;return R(Q),!0}loadBinding(){let Q=this.bindingPath();if(!z(Q))return null;try{return new Uint8Array(C(Q))}catch{return null}}createBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(z(Z))throw new q("binding_create_failed");f(Z,Q,{mode:384}),N(Z,384)}updateBinding(Q){if(Q.byteLength<1||Q.byteLength>M)throw new q("invalid_binding");O(this.directory,{recursive:!0,mode:448});let Z=this.bindingPath();if(!z(Z))throw new q("binding_update_failed");let $=`${Z}.${NQ()}`;try{f($,Q,{mode:384,flag:"wx"}),N($,384),wQ($,Z)}finally{if(z($))R($)}}deleteBinding(){let Q=this.bindingPath();if(!z(Q))return!1;return R(Q),!0}loadLegacyCredential(){return null}deleteLegacyCredential(){return!1}}function B(){return y()==="darwin"?new d:new i}var w=U.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/),s=U.object({id:w,kind:U.literal("permission_denied"),operation:U.enum(["bash","read","write","edit"]),provenance:U.enum(["sandbox_policy","os_permission_unknown"]),occurredAt:U.string().datetime(),expiresAt:U.string().datetime(),sessionId:w,deviceId:w,organizationId:w}).strict();var P=4;var K="macos-keychain-p256-v1",ZQ=1,dQ=`ARA-DEVICE-BINDING-V1
 `;function iQ(Q){return Q===void 0||typeof Q==="number"&&Number.isInteger(Q)&&Q>=1&&Q<=4}function $Q(Q,Z=Date.now()){let $=s.safeParse(Q);if(!$.success)return!1;let W=$.data,X=typeof W.occurredAt==="string"?Date.parse(W.occurredAt):NaN,Y=typeof W.expiresAt==="string"?Date.parse(W.expiresAt):NaN;return W.kind==="permission_denied"&&["bash","read","write","edit"].includes(W.operation)&&["sandbox_policy","os_permission_unknown"].includes(W.provenance)&&Number.isFinite(X)&&X<=Z&&Y>Z&&Y>X&&Y-X<=600000}function LZ(Q,Z,$=Date.now()){if(!Q||!Z||Q.state!=="connected"||Q.deviceId!==Z.deviceId)return null;let W=Date.parse(Q.lastHeartbeatAt??""),X=Q.permissionRecovery;if(!($-W>=0&&$-W<30000)||!$Q(X,$)||X.deviceId!==Z.deviceId||X.organizationId!==Z.orgId)return null;try{process.kill(Q.pid,0)}catch{return null}return X}function WQ(Q={},Z=V()){let $=r({env:{...process.env,...Q}}),W=Q.XDG_CONFIG_HOME?.trim()||A(Z,".config");return a(W,...$==="staging"?["staging"]:[])}function D(Q={},Z=V()){return A(WQ(Q,Z),"local-device.json")}function qQ(Q={},Z=V()){return A(WQ(Q,Z),"local-daemon.json")}function b(Q,Z){IQ(F(Q),{recursive:!0,mode:448}),_(F(Q),448);let $=`${Q}.${process.pid}.${t()}.tmp`;try{pQ($,`${JSON.stringify(Z,null,2)}
 `,{mode:384,flag:"wx"}),_($,384),vQ($,Q),_(Q,384)}finally{if(e($))uQ($)}return Q}function S(Q){if(!e(Q))return null;try{return JSON.parse(gQ(Q,"utf8"))}catch{return null}}function T(Q,Z,$){try{Q.onCredentialLifecycle?.({event:Z,...$?{reasonCode:$}:{}})}catch{}}function sQ(Q){if(!Array.isArray(Q))return null;let Z=[];for(let $ of Q){if(!$||typeof $!=="object")return null;let W=$;if(typeof W.id!=="string"||typeof W.label!=="string"||typeof W.path!=="string"||typeof W.pathFingerprint!=="string"||!W.permissions||typeof W.permissions.read!=="boolean"||typeof W.permissions.write!=="boolean"||typeof W.permissions.execute!=="boolean"||typeof W.permissions.discover_environment!=="boolean"||typeof W.permissions.expose_mcp!=="boolean")return null;Z.push({id:W.id,label:W.label,path:W.path,pathFingerprint:W.pathFingerprint,permissions:W.permissions})}return Z}function XQ(Q,Z,$=[]){let W=Object.keys(Q);return Z.every((X)=>Object.hasOwn(Q,X))&&W.every((X)=>Z.includes(X)||$.includes(X))}function nQ(Q){if(typeof Q!=="string")return null;try{let Z=new URL(Q);if(Z.protocol!=="https:"&&Z.hostname!=="127.0.0.1"&&Z.hostname!=="localhost")return null;return Z.origin}catch{return null}}function YQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q,$=sQ(Z.roots),W=nQ(Z.apiOrigin);if(!W||typeof Z.orgId!=="string"||typeof Z.deviceId!=="string"||typeof Z.displayName!=="string"||typeof Z.registeredAt!=="string"||!iQ(Z.handsSlots)||Z.worker!==void 0&&(!Z.worker||!/^[a-f0-9]{64}$/.test(Z.worker.configDigest)||!["persistent","ephemeral"].includes(Z.worker.lifetime)||!Number.isFinite(Date.parse(Z.worker.expiresAt)))||!$)return null;return{apiOrigin:W,orgId:Z.orgId,deviceId:Z.deviceId,displayName:Z.displayName,registeredAt:Z.registeredAt,...Z.handsSlots!==void 0?{handsSlots:Z.handsSlots}:{},...Z.worker!==void 0?{worker:Z.worker}:{},roots:$}}function rQ(Q){return{...Q,credentialStorage:K}}function oQ(Q){return{version:P,apiOrigin:Q.apiOrigin,orgId:Q.orgId,deviceId:Q.deviceId,devicePublicKey:Q.devicePublicKey,displayName:Q.displayName,registeredAt:Q.registeredAt,...Q.handsSlots!==void 0?{handsSlots:Q.handsSlots}:{},...Q.worker!==void 0?{worker:Q.worker}:{},roots:Q.roots.map((Z)=>({id:Z.id,label:Z.label,path:Z.path,pathFingerprint:Z.pathFingerprint,permissions:{read:Z.permissions.read,write:Z.permissions.write,execute:Z.permissions.execute,discover_environment:Z.permissions.discover_environment,expose_mcp:Z.permissions.expose_mcp}})),credentialStorage:K}}function jQ(Q){if(!Q||typeof Q!=="object"||Array.isArray(Q))return null;let Z=Q;if(!XQ(Z,["version","apiOrigin","orgId","deviceId","devicePublicKey","displayName","registeredAt","roots","credentialStorage"],["handsSlots","worker"]))return null;let $=YQ(Z);if(!$||Z.version!==P||Z.credentialStorage!==K||!x(Z.devicePublicKey))return null;return{version:P,...$,devicePublicKey:Z.devicePublicKey,credentialStorage:K}}function GQ(Q){return new TextEncoder().encode(`${dQ}${JSON.stringify(oQ(Q))}`)}function aQ(Q){let Z=Buffer.from(Q,"base64url");return CQ({format:"jwk",key:{kty:"EC",crv:"P-256",x:Z.subarray(1,33).toString("base64url"),y:Z.subarray(33,65).toString("base64url")}})}function tQ(Q,Z){let $={version:ZQ,state:Q,signature:Z.sign(GQ(Q))};return new TextEncoder().encode(JSON.stringify($))}function HQ(Q){let Z;try{Z=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(Q))}catch{throw new q("invalid_binding")}if(!Z||typeof Z!=="object"||Array.isArray(Z))throw new q("invalid_binding");let $=Z;if(!XQ($,["version","state","signature"])||$.version!==ZQ||typeof $.signature!=="string"||!/^[A-Za-z0-9_-]{10,128}$/.test($.signature))throw new q("invalid_binding");let W=jQ($.state);if(!W)throw new q("invalid_binding");let X=!1;try{X=EQ("sha256",GQ(W),aQ(W.devicePublicKey),Buffer.from($.signature,"base64url"))}catch{X=!1}if(!X)throw new q("invalid_binding");return W}function eQ(Q){let{credentialStorage:Z,...$}=Q;return $}function QZ(Q){return Q instanceof q?p(Q):"credential_boundary_failed"}function EZ(Q=D(),Z={}){let $=S(Q),W=Z.proofStore??Z.credentialStore??B(),X=W.loadBinding();if(!X){if($&&typeof $==="object"&&!Array.isArray($)&&ZZ($))return null;if($!==null)throw new q("invalid_binding");return null}let Y=HQ(X),G=W.loadPublicKey();if(W.privateKeyIsNonExtractable(),G!==Y.devicePublicKey)throw new q("invalid_public_key");let H=jQ($);if(Z.repair!==!1&&(!H||JSON.stringify(H)!==JSON.stringify(Y)))b(Q,Y);return eQ(Y)}function ZZ(Q){let Z=Q,$=YQ(Q);if(!$)return null;if(Z.version===2){if(typeof Z.deviceCredential!=="string"||!/^(?:reason|ara)_dev_/.test(Z.deviceCredential)||Z.deviceCredential.length>4096)return null;return{state:$,credentialSource:"plaintext-v2"}}if(Z.version!==3||Z.credentialStorage!=="macos-keychain-v1"||"deviceCredential"in Z)return null;return{state:$,credentialSource:"keychain-v3"}}function IZ(Q,Z=D(),$={}){let W=$.proofStore??$.credentialStore??B();T($,"credential.store_started");try{if(!x(Q.devicePublicKey)||W.loadPublicKey()!==Q.devicePublicKey)throw new q("invalid_public_key");W.privateKeyIsNonExtractable();let X=rQ(Q),Y=W.loadBinding();if(Y){let H=HQ(Y);if(H.devicePublicKey!==Q.devicePublicKey||H.orgId!==Q.orgId||H.deviceId!==Q.deviceId||H.apiOrigin!==Q.apiOrigin&&!o(H.apiOrigin,Q.apiOrigin))throw new q("invalid_binding")}let G=tQ(X,W);if(Y)W.updateBinding(G);else W.createBinding(G);return b(Z,X),T($,"credential.store_completed"),Z}catch(X){throw T($,"credential.store_failed",QZ(X)),X}}function gZ(Q=qQ()){let Z=S(Q);if(!Z||typeof Z!=="object")return null;let $=Z;if($.version!==1||typeof $.pid!=="number"||!Number.isInteger($.pid)||!["starting","connected","stopped","error"].includes($.state??"")||typeof $.startedAt!=="string"||$.lastHeartbeatAt!==void 0&&typeof $.lastHeartbeatAt!=="string"||$.lastUsedAt!==void 0&&typeof $.lastUsedAt!=="string"||$.organizationId!==void 0&&typeof $.organizationId!=="string"||$.organizationName!==void 0&&typeof $.organizationName!=="string"||$.organizationSlug!==void 0&&typeof $.organizationSlug!=="string"||$.error!==void 0&&typeof $.error!=="string"||$.reconnectingSince!==void 0&&typeof $.reconnectingSince!=="string"||$.workspace!==void 0&&typeof $.workspace!=="string")return null;if($.permissionRecovery!==void 0&&!$Q($.permissionRecovery))delete $.permissionRecovery;return $}function hZ(Q,Z=qQ()){return b(Z,Q)}var n=1;function $Z(Q=D()){return A(F(Q),"local-device.proxy.json")}function vZ(Q=$Z()){let Z=S(Q);if(!Z||typeof Z!=="object"||Array.isArray(Z))return null;let $=Z;if($.version!==n||typeof $.url!=="string"||$.url.length===0||$.caFile!==void 0&&(typeof $.caFile!=="string"||!QQ($.caFile)))return null;return{version:n,url:$.url,...$.caFile?{caFile:$.caFile}:{}}}function yZ(Q,Z={read:!0,write:!1,execute:!1,discover_environment:!1,expose_mcp:!1},$=LQ(32)){let W=new Set,X=[];for(let Y of Q){let G=hQ(QQ(Y)?Y:lQ(Y));if(!yQ(G).isDirectory())throw Error(`Local execution root is not a directory: ${Y}`);if(W.has(G))continue;W.add(G),X.push({id:t(),label:cQ(G)||G,path:G,pathFingerprint:mQ("sha256",$).update(G).digest("hex"),permissions:{...Z}})}if(X.length===0)throw Error("At least one explicit local execution root is required.");return X}
-export{q as Eg,DQ as Fg,x as Gg,l as Hg,d as Ig,i as Jg,$Q as Kg,LZ as Lg,D as Mg,qQ as Ng,EZ as Og,IZ as Pg,gZ as Qg,hZ as Rg,n as Sg,vZ as Tg,yZ as Ug};
+export{q as Gg,DQ as Hg,x as Ig,l as Jg,d as Kg,i as Lg,$Q as Mg,LZ as Ng,D as Og,qQ as Pg,EZ as Qg,IZ as Rg,gZ as Sg,hZ as Tg,n as Ug,vZ as Vg,yZ as Wg};

package/bin/vm-hands/{vm-hands-entry-lite-39wk67c3.js → vm-hands-entry-lite-wts79wdn.js}

@@ -1,4 +1,4 @@
 // @bun
-import{Ik as N}from"./vm-hands-entry-lite-mkynexaq.js";import{randomUUID as K}from"crypto";import{closeSync as L,constants as V,fstatSync as M,lstatSync as Z,mkdirSync as $,openSync as O,readFileSync as T,realpathSync as b,renameSync as U,unlinkSync as X,writeFileSync as Y}from"fs";import{dirname as g,resolve as z}from"path";var A=65536;function J(j){try{return Z(j),!0}catch(q){if(q instanceof Error&&"code"in q&&q.code==="ENOENT")return!1;throw q}}function I(j,q=!1){if(!J(j)){if(!q)throw Error("worker_state_missing");D(j),$(j,{mode:448})}let C=Z(j);if(!C.isDirectory()||C.isSymbolicLink()||!N(C)||b(j)!==z(j))throw Error("worker_state_directory_not_private_or_canonical")}function D(j){let q=g(j);if(!J(q))D(q),$(q,{mode:448});if(b(q)!==z(q))throw Error("worker_parent_not_canonical")}function u(j,q=A){let C=O(j,V.O_RDONLY|V.O_NOFOLLOW);try{let G=M(C);if(!G.isFile()||G.nlink!==1||!N(G)||G.size>q)throw Error("worker_file_not_private");return T(C,"utf8")}finally{L(C)}}function f(j,q,C=A){let G=JSON.stringify(q);if(G===void 0)throw Error("worker_file_invalid");let Q=G+`
+import{Lk as N}from"./vm-hands-entry-lite-rbjky7rd.js";import{randomUUID as K}from"crypto";import{closeSync as L,constants as V,fstatSync as M,lstatSync as Z,mkdirSync as $,openSync as O,readFileSync as T,realpathSync as b,renameSync as U,unlinkSync as X,writeFileSync as Y}from"fs";import{dirname as g,resolve as z}from"path";var A=65536;function J(j){try{return Z(j),!0}catch(q){if(q instanceof Error&&"code"in q&&q.code==="ENOENT")return!1;throw q}}function I(j,q=!1){if(!J(j)){if(!q)throw Error("worker_state_missing");D(j),$(j,{mode:448})}let C=Z(j);if(!C.isDirectory()||C.isSymbolicLink()||!N(C)||b(j)!==z(j))throw Error("worker_state_directory_not_private_or_canonical")}function D(j){let q=g(j);if(!J(q))D(q),$(q,{mode:448});if(b(q)!==z(q))throw Error("worker_parent_not_canonical")}function u(j,q=A){let C=O(j,V.O_RDONLY|V.O_NOFOLLOW);try{let G=M(C);if(!G.isFile()||G.nlink!==1||!N(G)||G.size>q)throw Error("worker_file_not_private");return T(C,"utf8")}finally{L(C)}}function f(j,q,C=A){let G=JSON.stringify(q);if(G===void 0)throw Error("worker_file_invalid");let Q=G+`
 `;if(Buffer.byteLength(Q,"utf8")>C)throw Error("worker_file_too_large");if(I(g(j)),J(j))u(j,C);let H=`${j}.${K()}`;try{Y(H,Q,{mode:384,flag:"wx"}),U(H,j)}finally{if(J(H))X(H)}}
-export{J as $c,I as ad,u as bd,f as cd};
+export{J as bd,I as cd,u as dd,f as ed};

package/bin/vm-hands/{vm-hands-entry-lite-ajmxhzs9.js → vm-hands-entry-lite-x0x1t6gp.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Di as m,si as A,ti as y,ui as p}from"./vm-hands-entry-lite-923jmcs3.js";import{Ji as u}from"./vm-hands-entry-lite-shm5nhjk.js";import{randomUUID as d}from"crypto";import{chmodSync as c,existsSync as n,mkdirSync as YJ,readlinkSync as GJ,readFileSync as OJ,renameSync as VJ,unlinkSync as FJ,writeFileSync as HJ}from"fs";import{homedir as v}from"os";import{basename as C,dirname as H,isAbsolute as g,join as N,normalize as a,relative as TJ,resolve as zJ}from"path";import{unlinkSync as XJ}from"fs";import{dirname as ZJ,join as $J}from"path";function jJ(J){return $J(ZJ(J),"future-device-grant.json")}function l(J){try{XJ(jJ(J))}catch(Q){if(!(Q instanceof Error&&("code"in Q)&&Q.code==="ENOENT"))throw Q}}var z=3,BJ=1,SJ=2,D=1,i=1,r="Reason may read and write files and run commands in this signed-in OS account, subject to saved restrictions and operating system permissions.",E="Reason may later execute on this computer inside a Reason sandbox, limited to folders explicitly attached by the user.",_J=[E,"Ara may later execute on this computer inside an Ara sandbox, limited to folders explicitly attached by the user."];function t(J){return typeof J==="string"&&_J.includes(J)}var IJ=["future_device","updates_only","cli_only"];function h(J){return typeof J==="string"&&IJ.some((Q)=>Q===J)}function LJ(J=process.env,Q=v()){return J.XDG_CONFIG_HOME?.trim()||N(Q,".config")}function K(J=process.env,Q=v()){let U=y({env:J}),W=LJ(J,Q);return N(W,m(W).state==="kept"?"ara":"reason",...U==="staging"?["staging"]:[],"installation.json")}function G(J){return typeof J==="string"&&J.trim().length>0}var NJ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function AJ(J){return typeof J==="string"&&NJ.test(J)}function M(J){return G(J)&&g(J)&&a(J)===J}function e(J){if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return M(Q.path)&&(Q.role==="launcher"&&(Q.kind==="file"||Q.kind==="symlink")||Q.role==="worker_root"&&Q.kind==="directory"||Q.role==="alias"&&Q.kind==="symlink"&&M(Q.target))}function JJ(J){return J==="staging"?["reason-staging","ara-staging"]:["reason","ara"]}var gJ=/^\.(?:reason|ara)(?:-staging)?-worker-/,hJ=["reason","ara"];function oJ(J){let Q=J.owned_paths.filter((W)=>W.role==="launcher").map((W)=>W.path),[U]=JJ(J.channel);return Q.find((W)=>C(W)===U)??Q[0]??null}function o(J){let[Q,U]=JJ(J.channel==="staging"?"staging":"production"),W=[[Q,U],[U,Q]];return J.owned_paths?.every((X)=>X.role!=="alias"||J.installer==="shell"&&W.some(([$,j])=>X.path===N(J.install_dir,$)&&X.target===N(J.install_dir,j))&&J.owned_paths?.some(($)=>$.role==="launcher"&&$.path===X.target))??!1}function w(J,Q){try{return zJ(H(J),GJ(J))===Q}catch{return!1}}function sJ(J){let Q=C(J),U=Q==="ara"?"reason":Q==="ara-staging"?"reason-staging":null;if(!U)return J;let W=N(H(J),U);return w(W,J)||w(J,W)?W:J}function f(J,Q){let U=TJ(J,Q);return U.length>0&&!U.startsWith("..")&&!g(U)}function QJ(J){if(J===null)return!0;if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return(Q.kind==="shell_profile"||Q.kind==="windows_user_path")&&G(Q.location)&&G(Q.value)&&(typeof Q.added_by_installer==="boolean"||typeof Q.added_by_ara==="boolean")&&(Q.added_by_installer===void 0||typeof Q.added_by_installer==="boolean")&&(Q.added_by_ara===void 0||typeof Q.added_by_ara==="boolean")}function q(J){return J.added_by_installer??J.added_by_ara??!1}function UJ(J,Q){if(Q===null)return J==="cli_only";if(!Q||typeof Q!=="object"||Array.isArray(Q))return!1;let U=Q;if(U.version!==D||!G(U.recorded_at))return!1;if(J==="future_device")return U.decision==="authorized"&&t(U.scope);return U.scope===null&&U.decision===(J==="updates_only"?"ask":"disabled")}function DJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==BJ||!A.includes(Q.channel)||Q.install_method!=="curl"||Q.installer!=="shell"&&Q.installer!=="powershell"||!G(Q.installed_at)||!G(Q.version)||!G(Q.target)||!M(Q.install_dir)||!Array.isArray(Q.owned_paths)||!Q.owned_paths.every(e)||!Q.owned_paths.every((U)=>f(Q.install_dir,U.path))||!o(Q)||!QJ(Q.path_entry))return null;return{...Q,schema_version:z,installation_id:null,background_mode:"cli_only",device_consent:null}}function KJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==SJ||!WJ(Q)||!h(Q.background_mode)||!UJ(Q.background_mode,Q.device_consent))return null;return{...Q,schema_version:z,installation_id:null}}function WJ(J){return A.includes(J.channel)&&(J.install_method==="curl"&&(J.installer==="shell"||J.installer==="powershell")||J.install_method==="desktop"&&J.installer==="desktop"&&Array.isArray(J.owned_paths)&&J.owned_paths.length===0&&J.path_entry===null)&&G(J.installed_at)&&G(J.version)&&G(J.target)&&M(J.install_dir)&&Array.isArray(J.owned_paths)&&J.owned_paths.every(e)&&J.owned_paths.every((Q)=>f(J.install_dir,Q.path))&&o(J)&&QJ(J.path_entry)}function RJ(J){let Q=DJ(J);if(Q)return Q;let U=KJ(J);if(U)return U;if(!J||typeof J!=="object"||Array.isArray(J))return null;let W=J;if(W.schema_version!==z||!AJ(W.installation_id)||!WJ(W)||!h(W.background_mode)||!UJ(W.background_mode,W.device_consent)||W.desktop_account_access!==void 0&&(W.desktop_account_access===null||typeof W.desktop_account_access!=="object"||Array.isArray(W.desktop_account_access)||W.desktop_account_access.version!==i||W.desktop_account_access.scope!==r||!G(W.desktop_account_access.recorded_at)||!Number.isFinite(Date.parse(W.desktop_account_access.recorded_at))))return null;return W}function k(J=K()){if(!n(J))return null;try{return RJ(JSON.parse(OJ(J,"utf8")))}catch{return null}}function b(J){return Boolean(J?.installation_id&&J.background_mode==="future_device"&&J.device_consent?.version===D&&J.device_consent.decision==="authorized"&&t(J.device_consent.scope))}function s(J,Q){let U=k(Q);if(!(b(U)&&b(J)&&U.installation_id===J.installation_id&&U.channel===J.channel))l(Q);YJ(H(Q),{recursive:!0,mode:448}),c(H(Q),448);let X=`${Q}.${process.pid}.${d()}.tmp`;try{HJ(X,`${JSON.stringify(J,null,2)}
+import{Fi as m,ui as A,vi as y,wi as p}from"./vm-hands-entry-lite-caxtg4j7.js";import{Li as u}from"./vm-hands-entry-lite-26d4ttdx.js";import{randomUUID as d}from"crypto";import{chmodSync as c,existsSync as n,mkdirSync as YJ,readlinkSync as GJ,readFileSync as OJ,renameSync as VJ,unlinkSync as FJ,writeFileSync as HJ}from"fs";import{homedir as v}from"os";import{basename as C,dirname as H,isAbsolute as g,join as N,normalize as a,relative as TJ,resolve as zJ}from"path";import{unlinkSync as XJ}from"fs";import{dirname as ZJ,join as $J}from"path";function jJ(J){return $J(ZJ(J),"future-device-grant.json")}function l(J){try{XJ(jJ(J))}catch(Q){if(!(Q instanceof Error&&("code"in Q)&&Q.code==="ENOENT"))throw Q}}var z=3,BJ=1,SJ=2,D=1,i=1,r="Reason may read and write files and run commands in this signed-in OS account, subject to saved restrictions and operating system permissions.",E="Reason may later execute on this computer inside a Reason sandbox, limited to folders explicitly attached by the user.",_J=[E,"Ara may later execute on this computer inside an Ara sandbox, limited to folders explicitly attached by the user."];function t(J){return typeof J==="string"&&_J.includes(J)}var IJ=["future_device","updates_only","cli_only"];function h(J){return typeof J==="string"&&IJ.some((Q)=>Q===J)}function LJ(J=process.env,Q=v()){return J.XDG_CONFIG_HOME?.trim()||N(Q,".config")}function K(J=process.env,Q=v()){let U=y({env:J}),W=LJ(J,Q);return N(W,m(W).state==="kept"?"ara":"reason",...U==="staging"?["staging"]:[],"installation.json")}function G(J){return typeof J==="string"&&J.trim().length>0}var NJ=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;function AJ(J){return typeof J==="string"&&NJ.test(J)}function M(J){return G(J)&&g(J)&&a(J)===J}function e(J){if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return M(Q.path)&&(Q.role==="launcher"&&(Q.kind==="file"||Q.kind==="symlink")||Q.role==="worker_root"&&Q.kind==="directory"||Q.role==="alias"&&Q.kind==="symlink"&&M(Q.target))}function JJ(J){return J==="staging"?["reason-staging","ara-staging"]:["reason","ara"]}var gJ=/^\.(?:reason|ara)(?:-staging)?-worker-/,hJ=["reason","ara"];function oJ(J){let Q=J.owned_paths.filter((W)=>W.role==="launcher").map((W)=>W.path),[U]=JJ(J.channel);return Q.find((W)=>C(W)===U)??Q[0]??null}function o(J){let[Q,U]=JJ(J.channel==="staging"?"staging":"production"),W=[[Q,U],[U,Q]];return J.owned_paths?.every((X)=>X.role!=="alias"||J.installer==="shell"&&W.some(([$,j])=>X.path===N(J.install_dir,$)&&X.target===N(J.install_dir,j))&&J.owned_paths?.some(($)=>$.role==="launcher"&&$.path===X.target))??!1}function w(J,Q){try{return zJ(H(J),GJ(J))===Q}catch{return!1}}function sJ(J){let Q=C(J),U=Q==="ara"?"reason":Q==="ara-staging"?"reason-staging":null;if(!U)return J;let W=N(H(J),U);return w(W,J)||w(J,W)?W:J}function f(J,Q){let U=TJ(J,Q);return U.length>0&&!U.startsWith("..")&&!g(U)}function QJ(J){if(J===null)return!0;if(!J||typeof J!=="object"||Array.isArray(J))return!1;let Q=J;return(Q.kind==="shell_profile"||Q.kind==="windows_user_path")&&G(Q.location)&&G(Q.value)&&(typeof Q.added_by_installer==="boolean"||typeof Q.added_by_ara==="boolean")&&(Q.added_by_installer===void 0||typeof Q.added_by_installer==="boolean")&&(Q.added_by_ara===void 0||typeof Q.added_by_ara==="boolean")}function q(J){return J.added_by_installer??J.added_by_ara??!1}function UJ(J,Q){if(Q===null)return J==="cli_only";if(!Q||typeof Q!=="object"||Array.isArray(Q))return!1;let U=Q;if(U.version!==D||!G(U.recorded_at))return!1;if(J==="future_device")return U.decision==="authorized"&&t(U.scope);return U.scope===null&&U.decision===(J==="updates_only"?"ask":"disabled")}function DJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==BJ||!A.includes(Q.channel)||Q.install_method!=="curl"||Q.installer!=="shell"&&Q.installer!=="powershell"||!G(Q.installed_at)||!G(Q.version)||!G(Q.target)||!M(Q.install_dir)||!Array.isArray(Q.owned_paths)||!Q.owned_paths.every(e)||!Q.owned_paths.every((U)=>f(Q.install_dir,U.path))||!o(Q)||!QJ(Q.path_entry))return null;return{...Q,schema_version:z,installation_id:null,background_mode:"cli_only",device_consent:null}}function KJ(J){if(!J||typeof J!=="object"||Array.isArray(J))return null;let Q=J;if(Q.schema_version!==SJ||!WJ(Q)||!h(Q.background_mode)||!UJ(Q.background_mode,Q.device_consent))return null;return{...Q,schema_version:z,installation_id:null}}function WJ(J){return A.includes(J.channel)&&(J.install_method==="curl"&&(J.installer==="shell"||J.installer==="powershell")||J.install_method==="desktop"&&J.installer==="desktop"&&Array.isArray(J.owned_paths)&&J.owned_paths.length===0&&J.path_entry===null)&&G(J.installed_at)&&G(J.version)&&G(J.target)&&M(J.install_dir)&&Array.isArray(J.owned_paths)&&J.owned_paths.every(e)&&J.owned_paths.every((Q)=>f(J.install_dir,Q.path))&&o(J)&&QJ(J.path_entry)}function RJ(J){let Q=DJ(J);if(Q)return Q;let U=KJ(J);if(U)return U;if(!J||typeof J!=="object"||Array.isArray(J))return null;let W=J;if(W.schema_version!==z||!AJ(W.installation_id)||!WJ(W)||!h(W.background_mode)||!UJ(W.background_mode,W.device_consent)||W.desktop_account_access!==void 0&&(W.desktop_account_access===null||typeof W.desktop_account_access!=="object"||Array.isArray(W.desktop_account_access)||W.desktop_account_access.version!==i||W.desktop_account_access.scope!==r||!G(W.desktop_account_access.recorded_at)||!Number.isFinite(Date.parse(W.desktop_account_access.recorded_at))))return null;return W}function k(J=K()){if(!n(J))return null;try{return RJ(JSON.parse(OJ(J,"utf8")))}catch{return null}}function b(J){return Boolean(J?.installation_id&&J.background_mode==="future_device"&&J.device_consent?.version===D&&J.device_consent.decision==="authorized"&&t(J.device_consent.scope))}function s(J,Q){let U=k(Q);if(!(b(U)&&b(J)&&U.installation_id===J.installation_id&&U.channel===J.channel))l(Q);YJ(H(Q),{recursive:!0,mode:448}),c(H(Q),448);let X=`${Q}.${process.pid}.${d()}.tmp`;try{HJ(X,`${JSON.stringify(J,null,2)}
 `,{mode:384,flag:"wx"}),c(X,384),VJ(X,Q)}finally{if(n(X))FJ(X)}let $=H(Q),j=C($)==="staging"?H($):$;if(C(j)==="reason")m(H(j));return J}function qJ(J=K(),Q=new Date){let U=k(J);if(!U?.installation_id)throw Error("Reason installation ownership is missing; reinstall the current CLI before enabling Device execution");if(b(U))return U;let W={...U,background_mode:"future_device",device_consent:{version:D,decision:"authorized",scope:E,recorded_at:Q.toISOString()}};return delete W.desktop_account_access,s(W,J)}function lJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=L(J.installDir,"install directory"),X=k(Q);if(X?.installation_id&&!J.accountAccess)return qJ(Q,U);return s({...X??{schema_version:z,channel:J.channel,install_method:"desktop",installer:"desktop",installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:[],path_entry:null},schema_version:z,installation_id:X?.installation_id??d(),background_mode:"future_device",...J.accountAccess?{desktop_account_access:{version:i,scope:r,recorded_at:U.toISOString()}}:{},device_consent:{version:D,decision:"authorized",scope:E,recorded_at:U.toISOString()}},Q)}function CJ(J,Q){return J.kind===Q.kind&&J.location===Q.location&&J.value===Q.value}function L(J,Q){let U=a(J);if(!g(U))throw Error(`${Q} must be an absolute path`);return U}function MJ(J,Q=K(),U=new Date){if(!A.includes(J.channel))throw Error("invalid installation channel");if(!J.version.trim())throw Error("installation version is required");if(!J.target.trim())throw Error("installation target is required");let W=L(J.install_dir,"install directory"),X=k(Q),$=J.backgroundMode??"preserve",j=$==="preserve"?X?.background_mode??"cli_only":$,T=X?.channel===J.channel&&b(X)&&j==="future_device",B=$==="preserve"&&!X||X?.channel===J.channel&&($==="preserve"||T),O={path:L(J.launcherPath,"launcher path"),kind:J.launcherKind,role:"launcher"};if(!f(W,O.path))throw Error("launcher path must be inside the install directory");let S=(J.workerRoots??[]).map((Y)=>L(Y,"worker root"));if(S.some((Y)=>!f(W,Y)))throw Error("worker root must be inside the install directory");let _=[];if(J.aliasPath){let Y={path:L(J.aliasPath,"alias path"),kind:"symlink",role:"alias",target:O.path};if(!o({installer:J.installer,channel:J.channel,install_dir:W,owned_paths:[O,Y]})||!w(Y.path,Y.target))throw Error("alias must be the channel's symlink to its canonical launcher");_.push(Y)}let R=[...X?.channel===J.channel&&X.install_dir===W?X.owned_paths:[],O,..._,...S.map((Y)=>({path:Y,kind:"directory",role:"worker_root"}))],P=Array.from(new Map(R.map((Y)=>[Y.path,Y])).values()),Z=J.pathEntry??null,F=Z?X?.path_entry&&CJ(Z,X.path_entry)?{...Z,added_by_installer:q(Z)||q(X.path_entry),added_by_ara:q(Z)||q(X.path_entry)}:Z:X?.path_entry??null,I={schema_version:z,installation_id:X?.installation_id??d(),channel:J.channel,install_method:"curl",installer:J.installer,installed_at:U.toISOString(),version:J.version.trim(),target:J.target.trim(),install_dir:W,owned_paths:P,path_entry:F,background_mode:j,device_consent:B?X?.device_consent??null:{version:D,decision:j==="future_device"?"authorized":j==="updates_only"?"ask":"disabled",scope:j==="future_device"?E:null,recorded_at:U.toISOString()},...T&&X.desktop_account_access?{desktop_account_access:X.desktop_account_access}:{}};return s(I,Q)}function x(J,Q){let U=J.indexOf(Q);if(U===-1)return;let W=J[U+1];if(!W||W.startsWith("--"))throw Error(`${Q} needs a value`);return W}function V(J,Q){let U=x(J,Q);if(!U)throw Error(`${Q} is required`);return U}function cJ(J,Q={}){let U=Q.io??{stdout:process.stdout,stderr:process.stderr};try{let W=new Set(["--channel","--installer","--version","--target","--install-dir","--launcher-path","--launcher-kind","--worker-root","--path-kind","--path-location","--path-value","--background-mode"]);for(let Z=0;Z<J.length;Z+=1){let F=J[Z];if(F==="--path-added")continue;if(!W.has(F))throw Error(`unknown option: ${F}`);if(Z+=1,Z>=J.length)throw Error(`${F} needs a value`)}let X=Q.env??process.env,$=V(J,"--channel"),j=y({env:X,executablePath:Q.executablePath});if($!==j)throw Error(`installer channel ${$} does not match running ${j} CLI`);let T=V(J,"--installer");if(T!=="shell"&&T!=="powershell")throw Error("--installer must be shell or powershell");let B=V(J,"--launcher-kind");if(B!=="file"&&B!=="symlink")throw Error("--launcher-kind must be file or symlink");let O=x(J,"--path-kind"),S=null;if(O){if(O!=="shell_profile"&&O!=="windows_user_path")throw Error("--path-kind must be shell_profile or windows_user_path");S={kind:O,location:V(J,"--path-location"),value:V(J,"--path-value"),added_by_installer:J.includes("--path-added"),added_by_ara:J.includes("--path-added")}}else if(J.includes("--path-location")||J.includes("--path-value")||J.includes("--path-added"))throw Error("path entry flags require --path-kind");let _={channel:j,install_method:"curl",installer:T,version:V(J,"--version"),target:V(J,"--target"),install_dir:V(J,"--install-dir"),launcherPath:V(J,"--launcher-path"),launcherKind:B,workerRoots:J.flatMap((Z,F)=>{if(Z!=="--worker-root")return[];let I=J[F+1];if(!I||I.startsWith("--"))throw Error("--worker-root needs a value");return[I]}),pathEntry:S,backgroundMode:(()=>{let Z=x(J,"--background-mode")??"preserve";if(Z!=="preserve"&&!h(Z))throw Error("--background-mode must be future_device, updates_only, cli_only, or preserve");return Z})()},R=u(X,"REASON_INSTALL_ALIAS_PATH");if(R)_.aliasPath=R;let P=K(p(X,j),Q.home??v());return(Q.writeReceipt??MJ)(_,P,Q.now?.()??new Date),0}catch(W){return U.stderr.write(`Reason installer receipt: ${W instanceof Error?W.message:String(W)}
 `),1}}
-export{z as ge,D as he,i as ie,r as je,E as ke,IJ as le,LJ as me,K as ne,JJ as oe,gJ as pe,hJ as qe,oJ as re,w as se,sJ as te,q as ue,RJ as ve,k as we,b as xe,qJ as ye,lJ as ze,MJ as Ae,cJ as Be};
+export{z as ie,D as je,i as ke,r as le,E as me,IJ as ne,LJ as oe,K as pe,JJ as qe,gJ as re,hJ as se,oJ as te,w as ue,sJ as ve,q as we,RJ as xe,k as ye,b as ze,qJ as Ae,lJ as Be,MJ as Ce,cJ as De};

package/bin/vm-hands/vm-hands-entry-lite-x914078k.js

@@ -0,0 +1,11 @@
+// @bun
+import{gd as hq,hd as lq}from"./vm-hands-entry-lite-nqvb7a2m.js";import{ci as Nq,di as vq,hi as Wq,ii as Xq,ji as X,mi as dq,oi as Aq,pi as cq,ri as c,si as P,ti as Bq}from"./vm-hands-entry-lite-399rn7a2.js";import{Li as Kq}from"./vm-hands-entry-lite-26d4ttdx.js";import{ej as oq,fj as sq,hj as uq,kj as pq,lj as rq,mj as nq,nj as Dq}from"./vm-hands-entry-lite-gp85aqkt.js";import{vj as d}from"./vm-hands-entry-lite-wsnr4fx8.js";import{Lk as Gq}from"./vm-hands-entry-lite-rbjky7rd.js";import{randomUUID as T}from"crypto";import{chmodSync as Jq,closeSync as u,constants as m,existsSync as E,fstatSync as iq,lstatSync as A,mkdirSync as n,openSync as aq,readFileSync as g,readdirSync as Oq,readlinkSync as I,realpathSync as S,renameSync as k,rmSync as v,statSync as x,symlinkSync as Qq,unlinkSync as C,writeFileSync as h}from"fs";import{basename as r,dirname as D,isAbsolute as BG,join as K,relative as DG,resolve as O,sep as eq}from"path";import{spawnSync as Eq}from"child_process";import{createRequire as tq}from"module";var Zq=1,qG=1,GG=128,OG=65536,EG="https://reasonmachines.com/api/runtime-manifest-v2",IG=30000,CG=600000,Vq=1e4,TG=60000,SG=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;var Pq=/^[a-z0-9_.-]{1,80}$/,FG=64,LG="so.ara.device-broker",JG=[LG,"com.reasonmachines.device-broker"],mJ=sq(JG),gq=["com.apple.security.cs.allow-jit","com.apple.security.cs.allow-unsigned-executable-memory"],wG=["service.install_started","service.install_completed","service.install_failed","service.launcher_adopted","service.launcher_conflict","service.started","service.reconnecting","service.reconnected","service.idle_sleep_held","service.idle_sleep_released","service.idle_sleep_failed","service.start_failed","service.stopped","service.exit_failed","service.singleton_rejected","credential.migration_started","credential.migration_completed","credential.migration_failed","credential.store_started","credential.store_completed","credential.store_failed","credential.delete_started","credential.delete_completed","credential.delete_failed","update.check_started","update.not_available","update.download_started","update.downloaded","update.verified","update.activated","update.rollback","update.failed","executor.update.check_started","executor.update.not_available","executor.update.download_started","executor.update.downloaded","executor.update.verified","executor.update.activated","executor.update.rollback","executor.update.failed","identity.refresh_completed","identity.refresh_failed","update.device_moved","update.components_installed","update.deferred","update.deferral_expired","worker.previous_exit","worker.capabilities_withheld","identity.computer_use_unavailable"];function t(q){if(q?.aborted)throw new X("update_cancelled","Managed runtime update request was cancelled.")}function Iq(q){return Boolean(q)&&typeof q==="object"&&!Array.isArray(q)}function Cq(q,G,J=[]){let Q=new Set([...G,...J]);return G.every((R)=>(R in q))&&Object.keys(q).every((R)=>Q.has(R))}function B(q){return typeof q==="string"&&SG.test(q)}function QG(q){return typeof q==="string"&&!Number.isNaN(Date.parse(q))&&new Date(q).toISOString()===q}function kG(q){return Xq.includes(q)}function b(q){n(q,{recursive:!0,mode:448}),Jq(q,448)}function RG(q,G){b(D(q));let J=`${q}.${process.pid}.${T()}.tmp`;try{h(J,G,{mode:384,flag:"wx"}),Jq(J,384),k(J,q)}finally{if(E(J))C(J)}}function Tq(q={}){if((q.platform??process.platform)!=="darwin")throw new X("unsupported_platform","The managed Reason runtime is currently available only on macOS.");let J=q.environment??process.env,Q=Kq(J,"REASON_CLI_CHANNEL")==="staging",R=Q?Kq(J,"REASON_MANAGED_RUNTIME_ROOT")?.trim():void 0,W=q.root!==void 0||Boolean(R&&BG(R))?null:K(q.home??d(),"Library","Application Support"),_=q.root??(W?K(W,Q?"Reason Staging":"Reason","CLI"):R);return{executableName:"reason",root:_,...W?{legacyRoot:K(W,"Ara",...Q?["staging","runtime"]:["runtime"])}:{},versions:K(_,"versions"),current:K(_,"current"),previous:K(_,"previous"),brokerLock:K(_,"broker.lock"),transitionLock:K(_,"transition.lock"),lifecycleEvents:K(_,"lifecycle-events")}}function vJ(q){let G=q.legacyRoot;if(!G)return null;return{root:G,versions:K(G,"versions"),current:K(G,"current"),previous:K(G,"previous"),brokerLock:K(G,"broker.lock"),transitionLock:K(G,"transition.lock"),lifecycleEvents:K(G,"lifecycle-events")}}function F(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let J=K(q.versions,G,"ara");if(!q.executableName)return J;let Q=K(q.versions,G,q.executableName),R=(_)=>{try{return A(_),!0}catch(Z){if(Z.code==="ENOENT")return!1;throw Z}},U=R(J),W=R(Q);if(U&&W)throw new X("installed_artifact_mismatch","Ambiguous managed runtime executable layout.");return U?J:Q}function i(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return Sq(F(q,G))}function Sq(q){return K(D(q),r(q)==="reason"?vq:Nq)}function UG(q,G){if(!B(q)||!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let[J,Q]=q.split("-",2),[R,U]=G.split("-",2),W=J.split(".").map(Number),_=R.split(".").map(Number);for(let H=0;H<3;H+=1){let j=W[H]-_[H];if(j!==0)return j<0?-1:1}if(Q===void 0||U===void 0){if(Q===U)return 0;return Q===void 0?1:-1}let Z=Q.split("."),$=U.split("."),Y=Math.max(Z.length,$.length);for(let H=0;H<Y;H+=1){let j=Z[H],z=$[H];if(j===void 0||z===void 0){if(j===z)return 0;return j===void 0?-1:1}if(j===z)continue;let M=/^\d+$/.test(j),w=/^\d+$/.test(z);if(M&&w)return Number(j)<Number(z)?-1:1;if(M!==w)return M?-1:1;return j<z?-1:1}return 0}function xG(q=process.arch){let G=`darwin-${q}`;if(!kG(G))throw new X("unsupported_architecture","The managed Reason runtime supports only Apple Silicon and Intel Macs.");return G}function bq(q){return[...q.matchAll(/<key>\s*([^<]+?)\s*<\/key>/g)].map((G)=>G[1].trim())}function yq(q){let G=q.match(/^CodeDirectory .*$/gm)??[];return G.length>0&&G.every((J)=>{return(/ flags=0x[0-9a-f]+\(([^)]*)\)(?: |$)/.exec(J)?.[1]?.split(/[ ,]+/).filter(Boolean)??[]).includes("runtime")})}function VG(q){let G=`TeamIdentifier=${oq}`,J=JG.map((U)=>`Identifier=${U}`),Q=bq(q.brokerEntitlements),R=bq(q.credentialLibraryEntitlements);if(!q.brokerDetail.split(`
+`).includes(G)||!q.brokerDetail.split(`
+`).some((U)=>J.includes(U))||!yq(q.brokerDetail)||Q.length!==gq.length||gq.some((U)=>!new RegExp(`<key>\\s*${U.replaceAll(".","\\.")}\\s*</key>\\s*<true\\s*/>`).test(q.brokerEntitlements)))throw new X("invalid_code_signature","Managed runtime broker has an invalid Reason signature, identifier, or entitlement set.");if(!q.credentialLibraryDetail.split(`
+`).includes(G)||!yq(q.credentialLibraryDetail)||R.length!==0)throw new X("invalid_code_signature","Managed runtime credential library has an invalid signature or entitlement.")}function y(q,G){let J=Eq("/usr/bin/codesign",q,{stdio:["ignore","pipe","pipe"]});if(J.status!==0)throw new X("invalid_code_signature",G);return[new TextDecoder().decode(J.stdout??new Uint8Array),new TextDecoder().decode(J.stderr??new Uint8Array)].join("")}var Fq=(q,G)=>{y(["--verify","--strict","--verbose=2",q],"Managed runtime broker code signature is invalid."),y(["--verify","--strict","--verbose=2",G],"Managed runtime credential library code signature is invalid."),VG({brokerDetail:y(["-d","--verbose=4",q],"Managed runtime broker signer could not be inspected."),brokerEntitlements:y(["-d","--entitlements",":-",q],"Managed runtime broker entitlements could not be inspected."),credentialLibraryDetail:y(["-d","--verbose=4",G],"Managed runtime credential library signer could not be inspected."),credentialLibraryEntitlements:y(["-d","--entitlements",":-",G],"Managed runtime credential library entitlements could not be inspected.")})};async function PG(q,G,J){let Q=q.headers.get("content-length");if(Q!==null){let Y=Number(Q);if(!Number.isSafeInteger(Y)||Y<0||Y>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.")}if(!q.body){let Y=new Uint8Array(await q.arrayBuffer());if(Y.byteLength>G)throw new X("response_too_large","Managed runtime response exceeded its size limit.");return Y}let R=q.body.getReader(),U=[],W=0,_=()=>{if(!J)return R.read();return new Promise((Y,H)=>{let j=()=>{J.removeEventListener("abort",j),R.cancel(J.reason).catch(()=>{}),H(J.reason??new DOMException("Aborted","AbortError"))};if(J.aborted){j();return}J.addEventListener("abort",j,{once:!0}),R.read().then((z)=>{J.removeEventListener("abort",j),Y(z)},(z)=>{J.removeEventListener("abort",j),H(z)})})};try{while(!0){let Y=await _();if(Y.done)break;if(W+=Y.value.byteLength,W>G)throw await R.cancel(),new X("response_too_large","Managed runtime response exceeded its size limit.");U.push(Y.value)}}finally{try{R.releaseLock()}catch{}}let Z=new Uint8Array(W),$=0;for(let Y of U)Z.set(Y,$),$+=Y.byteLength;return Z}async function p(q){let G;try{G=new URL(q.url)}catch{throw new X("invalid_update_url","Managed runtime update URL is invalid.")}if(G.protocol!=="https:"||G.username||G.password||G.hash)throw new X("invalid_update_url","Managed runtime update URL must use HTTPS.");let J=new AbortController,Q,R=()=>{Q??="caller",J.abort(q.signal?.reason)};if(q.signal?.aborted)R();else q.signal?.addEventListener("abort",R,{once:!0});let U=setTimeout(()=>{Q??="timeout",J.abort(Error("managed runtime fetch timed out"))},q.timeoutMs),W=(_,Z)=>{if(_ instanceof X)return _;if(Q==="caller")return new X("update_cancelled","Managed runtime update request was cancelled.");if(Q==="timeout")return new X("update_fetch_timeout","Managed runtime update request timed out.");return new X("update_fetch_failed",Z)};try{let _;try{if(_=await q.fetchImpl(G,{headers:{accept:q.accept},signal:J.signal}),J.signal.aborted)throw W(J.signal.reason,"Managed runtime update request was cancelled.")}catch(Z){throw W(Z,"Managed runtime update request failed.")}if(!_.ok)throw new X("update_http_error","Managed runtime update request was rejected.");if(_.url&&new URL(_.url).protocol!=="https:")throw new X("insecure_redirect","Managed runtime update redirected to an insecure URL.");try{let Z=await PG(_,q.maximumBytes,J.signal);if(J.signal.aborted)throw W(J.signal.reason,"Managed runtime update response was cancelled.");return Z}catch(Z){throw W(Z,"Managed runtime update response failed.")}}finally{clearTimeout(U),q.signal?.removeEventListener("abort",R)}}async function WG(q,G,J=Vq,Q){let R=typeof J==="number"?J:Vq,U=typeof J==="number"?Q:J;if(U?.aborted)return!1;let W=await hq([q,"--version"],{timeoutMs:R,...U?{signal:U}:{}});return W.exitCode===0&&W.stdout.trim().replace(/^v/,"")===G}async function gG(q){let G=!1,J=null,Q=null,R=(U)=>{try{N(q.paths,U,{now:q.now})}catch{}};try{let U=q.home??d();if(!nq(q.manifest.version,U))return{status:"current"};Q=rq(U);let W=await p({url:new URL(dq,q.manifest.artifacts[q.target].broker.url).toString(),maximumBytes:Wq,fetchImpl:async(j,z)=>{let M=await q.fetchImpl(j,z);return G=M.status===404,M},timeoutMs:q.timeoutMs,accept:"application/json",signal:q.signal}),{manifest:_}=cq(new TextDecoder().decode(W),q.trustedKeys);if(_.version!==q.manifest.version||_.published_at!==q.manifest.published_at)throw new X("identity_manifest_mismatch","Background identity manifest names another release.");let Z=_.artifacts[q.target],$=await p({url:Z.url,maximumBytes:Z.size_bytes,fetchImpl:q.fetchImpl,timeoutMs:q.timeoutMs,accept:"application/octet-stream",signal:q.signal});P($,Z),b(q.workDirectory),J=K(q.workDirectory,`.identity-${process.pid}-${T()}`),n(J,{mode:448});let Y=K(J,"identity.tgz");if(h(Y,$,{mode:384,flag:"wx"}),Eq("/usr/bin/tar",["-xzf",Y,"-C",J],{stdio:"ignore",timeout:60000}).status!==0)throw new X("identity_extract_failed","Background identity archive could not be extracted.");return Dq({sourceApp:K(J,"Reason.app"),home:U,releaseSigned:!0,...q.command?{command:q.command}:{}}),R({event:"identity.refresh_completed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version}),{status:"installed"}}catch(U){if(G)return{status:"unpublished"};let W=U instanceof X||U instanceof uq?U.code:"identity_install_failed";return process.stderr.write(`Reason background identity: identity_update_failed (${W})
+`),R({event:"identity.refresh_failed",runtime_version:q.manifest.version,...Q?{from_version:Q}:{},to_version:q.manifest.version,reason_code:W}),{status:"failed",code:W}}finally{if(J)v(J,{recursive:!0,force:!0})}}async function dJ(q){if(!B(q.currentVersion))throw new X("invalid_version","Invalid current managed runtime version.");let G=q.paths??Tq(),J=q.target??xG(),Q=q.fetchImpl??fetch,R=q.timeoutMs??IG,U=q.timeoutMs??CG,W=q.healthCheck??((H,j,z)=>WG(H,j,TG,z)),_=q.verifyCodeSignatures??Fq,Z=q.now?.()??new Date,$,Y=!1;N(G,{event:"update.check_started",runtime_version:q.currentVersion,from_version:q.currentVersion},{now:()=>Z});try{await sG({paths:G,verifyCodeSignatures:_,healthCheck:W});let H=await p({url:q.manifestUrl??EG,maximumBytes:Wq,fetchImpl:Q,timeoutMs:R,accept:"application/json",signal:q.signal}),j=Aq(new TextDecoder().decode(H),q.trustedKeys);$=j.manifest.version;let z=()=>gG({paths:G,...q.now?{now:q.now}:{},manifest:j.manifest,target:J,trustedKeys:q.trustedKeys,fetchImpl:Q,timeoutMs:U,workDirectory:G.versions,...q.home?{home:q.home}:{},...q.identityCommand?{command:q.identityCommand}:{},...q.signal?{signal:q.signal}:{}});if(UG($,q.currentVersion)<=0)return N(G,{event:"update.not_available",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),Yq(G),{status:"not_available",currentVersion:q.currentVersion,offeredVersion:$,...$===q.currentVersion?{identity:await z()}:{}};let M=j.manifest.artifacts[J];N(G,{event:"update.download_started",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now});let w=await p({url:M.broker.url,maximumBytes:M.broker.size_bytes,fetchImpl:Q,timeoutMs:U,accept:"application/octet-stream",signal:q.signal});P(w,M.broker),t(q.signal);let e=await p({url:M.credential_library.url,maximumBytes:M.credential_library.size_bytes,fetchImpl:Q,timeoutMs:U,accept:"application/octet-stream",signal:q.signal});P(e,M.credential_library),N(G,{event:"update.downloaded",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),N(G,{event:"update.verified",runtime_version:q.currentVersion,from_version:q.currentVersion,to_version:$},{now:q.now}),t(q.signal);let kq=XG({paths:G,version:$,artifact:M.broker,bytes:w,credentialLibraryArtifact:M.credential_library,credentialLibraryBytes:e,verifyCodeSignatures:_}),xq;try{xq=await W(kq.executablePath,$,q.signal)}catch(l){throw t(q.signal),l}if(t(q.signal),!xq)throw new X("pre_activation_health_failed","Managed runtime preflight failed.");let V=cG(G,$);if(!V.changed&&V.toVersion!==$)return N(G,{event:"update.not_available",runtime_version:V.toVersion,from_version:V.toVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"not_available",currentVersion:V.toVersion,offeredVersion:$};if(Y=V.changed,!await W(G.current,$)){if(V.fromVersion){let l=jG(G,$);N(G,{event:"update.rollback",runtime_version:l.toVersion,from_version:l.fromVersion,to_version:l.toVersion,reason_code:"post_activation_health_failed"},{now:q.now})}else HG(G,$);throw f(G),Y=!1,new X("post_activation_health_failed","Managed runtime activation failed.")}return f(G),Yq(G),N(G,{event:"update.activated",runtime_version:$,from_version:q.currentVersion,to_version:$,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),{status:"activated",fromVersion:q.currentVersion,toVersion:$,installed:kq.installed,identity:await z()}}catch(H){throw N(G,{event:"update.failed",runtime_version:Y?$??q.currentVersion:q.currentVersion,from_version:q.currentVersion,...$?{to_version:$}:{},reason_code:H instanceof X?H.code:"update_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-Z.getTime())},{now:q.now}),H}}function fq(q,G,J){try{let Q=A(D(q));if(!Q.isDirectory()||Q.isSymbolicLink())return!1;let R=A(q);if(!R.isFile()||R.isSymbolicLink()||R.size!==G.size_bytes)return!1;let U=Sq(q),W=A(U);return W.isFile()&&!W.isSymbolicLink()&&W.size===J.size_bytes&&c(g(q))===G.sha256&&c(g(U))===J.sha256}catch{return!1}}function XG(q){let G=F(q.paths,q.version);P(q.bytes,q.artifact),P(q.credentialLibraryBytes,q.credentialLibraryArtifact);let J=q.verifyCodeSignatures??Fq;if(b(q.paths.root),b(q.paths.versions),E(D(G))){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw new X("installed_artifact_mismatch","The installed runtime version does not match the verified artifact.");return J(G,i(q.paths,q.version)),{installed:!1,executablePath:G}}let Q=K(q.paths.versions,`.install-${q.version}-${process.pid}-${T()}`),R=K(Q,r(G)),U=Sq(R);n(Q,{mode:448});try{h(R,q.bytes,{mode:448,flag:"wx"}),Jq(R,448),h(U,q.credentialLibraryBytes,{mode:448,flag:"wx"}),Jq(U,448),J(R,U);try{k(Q,D(G))}catch(W){if(!fq(G,q.artifact,q.credentialLibraryArtifact))throw W;return{installed:!1,executablePath:G}}return{installed:!0,executablePath:G}}finally{v(Q,{recursive:!0,force:!0})}}function bG(q,G){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");return`versions/${G}/${r(F(q,G))}`}function Rq(q,G){b(D(q));let J=`${q}.${process.pid}.${T()}.tmp`;try{Qq(G,J),k(J,q)}finally{if(E(J))C(J)}}var yG=/^\.(?:ara|reason)-worker-(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)-(darwin-(?:arm64|x64))\.([0-9A-Za-z]{6})$/,fG=new Set(["reason","ara"]);function ZG(q,G){let J=D(q),Q=O(J,G),R=D(Q),U=yG.exec(r(R));if(!fG.has(r(Q))||D(R)!==J||!U||!B(U[1])||!Xq.includes(U[2]))return!1;try{return A(R).isDirectory()&&D(S(R))===S(J)&&A(Q).isFile()&&A(Bq(R)).isFile()}catch(W){if(W.code==="ENOENT")return!1;throw W}}function _G(q,G,J){try{if(I(q)!==G)return!1;C(q)}catch(Q){if(Q.code==="ENOENT")return!1;throw Q}try{return Qq(J,q),!0}catch(Q){if(Q.code==="EEXIST")return!1;try{Qq(G,q)}catch(R){if(R.code!=="EEXIST")throw R}throw Q}}function $G(q,G){if(!q.legacyRoot)return!1;let J;try{if(!A(G).isSymbolicLink())return!1;J=I(G)}catch(R){if(R.code==="ENOENT")return!1;throw R}if(O(D(G),J)!==K(q.legacyRoot,"current"))return!1;if(!_G(G,J,q.current))return!1;let Q=L(q);if(Q)N(q,{event:"service.launcher_adopted",runtime_version:Q,to_version:Q,reason_code:"legacy_runtime_root"});return!0}function mG(q,G){let J=K(q,".local","bin"),Q=K(J,"ara"),R=K(J,"reason"),U=A(Q,{throwIfNoEntry:!1});if(U?.isSymbolicLink()&&I(Q)==="reason")return R;if(U||!A(R,{throwIfNoEntry:!1})?.isSymbolicLink())return Q;let W=I(R);return W===G.current||ZG(R,W)?R:Q}function vG(q){let G=q.launcherPath??mG(q.home??d(),q.paths);try{if(A(G).isSymbolicLink()){let Q=I(G);if(Q===q.paths.current)return"managed";if(ZG(G,Q)&&_G(G,Q,q.paths.current)){let R=_q(q.paths.current,q.paths.executableName)??"unknown";return N(q.paths,{event:"service.launcher_adopted",runtime_version:R,to_version:R,reason_code:"legacy_curl_entrypoint"}),"adopted"}if($G(q.paths,G))return"adopted"}return"conflict"}catch(J){if(J.code!=="ENOENT")throw J}n(D(G),{recursive:!0,mode:448});for(let J=0;J<4;J+=1)try{return Qq(q.paths.current,G),"created"}catch(Q){if(Q.code!=="EEXIST")throw Q;try{return A(G).isSymbolicLink()&&I(G)===q.paths.current?"managed":"conflict"}catch(R){if(R.code!=="ENOENT")throw R}}return"conflict"}function _q(q,G){let J;try{if(!A(q).isSymbolicLink())return null;J=I(q)}catch{return null}let Q=J.match(/^versions\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\/(ara|Reason|reason)$/);return Q&&(Q[2]==="ara"||Q[2]===G)?Q[1]:null}function L(q){return _q(q.current,q.executableName)}function cJ(q,G=process.execPath){try{return S(q.current)===S(G)}catch{return!1}}function Uq(q,G,J){let R=DG(G,q).split(eq);return R.length===2&&B(R[0])&&(R[1]==="ara"||J!==void 0&&R[1]===J)?R[0]:null}function KG(q,G){try{return A(G).isSymbolicLink()&&O(D(G),I(G))===O(q.current)}catch{return!1}}function hJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)!==null}catch{let J=O(G);return J===O(q.current)||KG(q,J)||Uq(J,O(q.versions),q.executableName)!==null}}function lJ(q,G=process.execPath){try{return Uq(S(G),S(q.versions),q.executableName)}catch{let J=O(G);if(J===O(q.current)||KG(q,J))return L(q);return Uq(J,O(q.versions),q.executableName)}}function dG(q,G,J={}){let Q=F(q,G),R=i(q,G);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");let U=Lq(q,G,J.allowDowngrade);if(U)return U;return a(q,G,()=>{return YG(q,G,void 0,J.allowDowngrade)})}function Lq(q,G,J=!1){let Q=L(q);if(!Q)return null;if(Q===G)return{changed:!1,fromVersion:Q,toVersion:Q};if(!J&&UG(G,Q)<=0&&!(/^\d+\.\d+\.\d+-desktop\.v1\.\d+\.\d+\.\d+$/.test(G)&&/^\d+\.\d+\.\d+-desktopdev\./.test(Q)))return{changed:!1,fromVersion:Q,toVersion:Q};return null}function YG(q,G,J,Q=!1){let R=Lq(q,G,Q);if(R)return R;let U=L(q);if(J?.(U),U)Rq(q.previous,I(q.current));else if(E(q.previous))C(q.previous);return Rq(q.current,bG(q,G)),{changed:!0,fromVersion:U,toVersion:G}}function cG(q,G){let J=F(q,G),Q=i(q,G);if(!E(J)||!x(J).isFile()||!E(Q)||!x(Q).isFile())throw new X("runtime_not_installed","Managed Reason runtime version is not installed.");return a(q,G,()=>YG(q,G,(R)=>{oG(q,{schema_version:Zq,from_version:R,to_version:G})}))}function jG(q,G){return a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");let J=_q(q.previous,q.executableName);if(!J||J===G)throw new X("rollback_unavailable","No previous managed runtime is available.");let Q=F(q,J),R=i(q,J);if(!E(Q)||!x(Q).isFile()||!E(R)||!x(R).isFile())throw new X("rollback_unavailable","Previous managed runtime is not installed.");let U=I(q.previous),W=I(q.current);if(O(D(q.previous),U)!==O(Q))throw new X("rollback_fence_failed","Previous runtime pointer does not match its installed layout.");return Rq(q.current,U),Rq(q.previous,W),{fromVersion:G,toVersion:J}})}function hG(){let q=Eq("/bin/ps",["-axww","-o","args="],{encoding:"utf8",stdio:["ignore","pipe","ignore"],timeout:5000,maxBuffer:16777216});return q.status===0&&typeof q.stdout==="string"?q.stdout:null}function Yq(q){let G=[];try{let J=L(q);if(!J||jq(q))return G;let Q=Oq(q.versions).filter((U)=>B(U));if(Q.length<=2)return G;let R=hG();if(R===null)return G;a(q,J,()=>{let U=new Set([L(q),_q(q.previous,q.executableName)]);if(jq(q))return;for(let W of Q){if(U.has(W))continue;let _=K(q.versions,W);if(R.includes(`${_}${eq}`))continue;try{v(_,{recursive:!0,force:!0}),G.push(W)}catch{}}})}catch{}return G}function HG(q,G){a(q,G,()=>{if(L(q)!==G)throw new X("rollback_fence_failed","Managed runtime changed before rollback could be applied.");C(q.current)})}function wq(q){return q.activationState??K(q.root,"activation.json")}function lG(q){return Iq(q)&&Cq(q,["schema_version","from_version","to_version"])&&q.schema_version===Zq&&(q.from_version===null||B(q.from_version))&&B(q.to_version)}function jq(q){try{let G=wq(q),J=A(G);if(!J.isFile()||J.isSymbolicLink()||J.nlink!==1||(J.mode&63)!==0||J.size>4096)throw new X("invalid_activation_state","Managed runtime activation state is invalid.");let Q=JSON.parse(g(G,"utf8"));if(!lG(Q))throw new X("invalid_activation_state","Managed runtime activation state is invalid.");return Q}catch(G){if(G instanceof X)throw G;if(G.code==="ENOENT")return null;throw new X("invalid_activation_state","Managed runtime activation state is invalid.")}}function oG(q,G){RG(wq(q),JSON.stringify(G)+`
+`)}function f(q){try{C(wq(q))}catch(G){if(G.code!=="ENOENT")throw G}}async function sG(q){let G=jq(q.paths);if(!G)return"none";let J=L(q.paths);if(J===G.from_version)return f(q.paths),"cleared";if(J!==G.to_version)throw new X("rollback_fence_failed","Managed runtime changed before activation recovery could be applied.");let Q=q.verifyCodeSignatures??Fq,R=q.healthCheck??WG,U=!1;try{let W=F(q.paths,G.to_version);Q(W,i(q.paths,G.to_version)),U=await R(W,G.to_version)}catch{U=!1}if(U)return f(q.paths),N(q.paths,{event:"update.activated",runtime_version:G.to_version,...G.from_version?{from_version:G.from_version}:{},to_version:G.to_version,reason_code:"restart_recovery"}),"committed";if(G.from_version){let W=jG(q.paths,G.to_version);return f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:W.toVersion,from_version:W.fromVersion,to_version:W.toVersion,reason_code:"restart_recovery"}),"rolled_back"}return HG(q.paths,G.to_version),f(q.paths),N(q.paths,{event:"update.rollback",runtime_version:G.to_version,from_version:G.to_version,reason_code:"restart_recovery"}),"rolled_back"}function uG(q){return Iq(q)&&Cq(q,["schema_version","pid","nonce","started_at","runtime_version"])&&q.schema_version===Zq&&typeof q.pid==="number"&&Number.isSafeInteger(q.pid)&&q.pid>0&&typeof q.nonce==="string"&&/^[0-9a-f-]{36}$/.test(q.nonce)&&QG(q.started_at)&&B(q.runtime_version)}function zG(q,G){try{let J=A(q);if(!J.isDirectory()||!Gq(J))return null;let Q=aq(K(q,G),m.O_RDONLY|m.O_NOFOLLOW|m.O_NONBLOCK);try{let R=iq(Q);if(!R.isFile()||R.nlink!==1||!Gq(R)||R.size>4096)return null;return g(Q,"utf8")}finally{u(Q)}}catch{return null}}function Hq(q){try{let G=JSON.parse(zG(q,"owner.json")??"null");return uG(G)?G:null}catch{return null}}function MG(q){try{return process.kill(q,0),!0}catch(G){return!(G instanceof Error&&("code"in G)&&G.code==="ESRCH")}}var mq="lease",pG=2,rG=4,o;function nG(){if(o!==void 0)return o;if(o=null,process.platform!=="linux"&&process.platform!=="darwin")return null;let q;try{q=tq(import.meta.url)("bun:ffi")}catch{return null}let G=process.platform==="darwin"?"__error":"__errno_location",J=process.platform==="darwin"?["/usr/lib/libSystem.B.dylib"]:["libc.so.6",`libc.musl-${process.arch==="arm64"?"aarch64":"x86_64"}.so.1`];for(let Q of J)try{let R=q.dlopen(Q,{flock:{args:[q.FFIType.i32,q.FFIType.i32],returns:q.FFIType.i32},[G]:{args:[],returns:q.FFIType.ptr}}),U=R.symbols[G]();if(U===null)continue;return o={flock:(W,_)=>R.symbols.flock(W,_),errno:()=>q.read.i32(U),wouldBlock:process.platform==="darwin"?35:11},o}catch{}return null}var s,iG=3221225472,aG=4,eG=128,tG=32;function qJ(q){if(s===void 0){s=null;try{let U=tq(import.meta.url)("bun:ffi"),{FFIType:W}=U;s={kernel:U.dlopen("kernel32.dll",{CreateFileW:{args:[W.ptr,W.u32,W.u32,W.ptr,W.u32,W.u32,W.ptr],returns:W.i64_fast},CloseHandle:{args:[W.i64_fast],returns:W.i32},GetLastError:{args:[],returns:W.u32}}).symbols,ptr:(Z)=>U.ptr(Z)}}catch{return null}}if(!s)return null;let{kernel:G,ptr:J}=s,Q=Buffer.from(`${q}\x00`,"utf16le"),R=G.CreateFileW(J(Q),iG,0,null,aG,eG,null);if(Number(R)===-1)return G.GetLastError()===tG?"busy":null;return{release:()=>{G.CloseHandle(R)}}}function GJ(q){if(process.platform==="win32")return qJ(`${q}.lease`);let G=nG();if(!G)return null;let J=aq(`${q}.lease`,m.O_RDWR|m.O_CREAT|m.O_NOFOLLOW,384);try{let Q=iq(J);if(!Q.isFile()||Q.nlink!==1||!Gq(Q))return u(J),"busy";if(G.flock(J,pG|rG)===0)return{release:()=>u(J)};let R=G.errno();return u(J),R===G.wouldBlock?"busy":null}catch(Q){throw u(J),Q}}function zq(q){b(D(q.path));let G=GJ(q.path);if(G==="busy")return{acquired:!1,owner:Hq(q.path),recoveredStaleOwner:!1};let J=G!==null;try{let Q=JJ(q,G);if(Q.acquired)J=!1;return Q}finally{if(J)G.release()}}function JJ(q,G){let J=q.alive??MG,Q=!1;for(let R=0;R<4;R+=1){let U={schema_version:Zq,pid:q.pid??process.pid,nonce:q.nonce?.()??T(),started_at:(q.now?.()??new Date).toISOString(),runtime_version:q.runtimeVersion},W=`${q.path}.init-${process.pid}-${T()}`,_=!1;try{if(n(W,{mode:448}),h(K(W,"owner.json"),`${JSON.stringify(U)}
+`,{mode:384,flag:"wx"}),G!==null)h(K(W,mq),`flock
+`,{mode:384,flag:"wx"});q.beforePublish?.();try{throw A(q.path),Object.assign(Error("Managed runtime lock exists."),{code:"EEXIST"})}catch($){if($.code!=="ENOENT")throw $}k(W,q.path),_=!0;let Z=!1;return{acquired:!0,owner:U,recoveredStaleOwner:Q,release(){if(Z)return;if(Z=!0,Hq(q.path)?.nonce===U.nonce)v(q.path,{recursive:!0,force:!0});G?.release()}}}catch(Z){let $=Z.code;if(!["EEXIST","ENOTEMPTY"].includes($??""))throw Z;let Y=Hq(q.path),H=(q.now?.()??new Date).getTime(),j=Y&&q.staleAfterMs!==void 0?H-Date.parse(Y.started_at)<q.staleAfterMs:!1,z=Y!==null&&!(G!==null&&zG(q.path,mq)!==null)&&J(Y.pid);if(!Y||z||j)return{acquired:!1,owner:Y,recoveredStaleOwner:!1};let M=`${q.path}.stale-${process.pid}-${T()}`;try{k(q.path,M),v(M,{recursive:!0,force:!0}),Q=!0}catch(w){let e=w.code;if(!["ENOENT","EEXIST"].includes(e??""))throw w}}finally{if(!_)v(W,{recursive:!0,force:!0})}}throw new X("lock_unavailable","Could not acquire the managed Reason runtime lock.")}var QJ=20000;function a(q,G,J){if(!B(G))throw new X("invalid_version","Invalid managed Reason runtime version.");let Q=Date.now()+QJ,R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});while(!R.acquired&&Date.now()<Q)lq(100),R=zq({path:q.transitionLock,runtimeVersion:G,staleAfterMs:60000});if(!R.acquired)throw new X("transition_busy","Another managed Reason runtime transition is in progress.");try{return J()}finally{R.release()}}function oJ(q){if(!B(q.runtimeVersion))throw new X("invalid_version","Invalid managed Reason runtime version.");let G=q.paths??Tq();return zq({path:G.brokerLock,runtimeVersion:q.runtimeVersion,...q.pid===void 0?{}:{pid:q.pid},...q.now===void 0?{}:{now:q.now},...q.nonce===void 0?{}:{nonce:q.nonce},...q.alive===void 0?{}:{alive:q.alive},...q.beforePublish===void 0?{}:{beforePublish:q.beforePublish}})}function NG(q){return Iq(q)&&Cq(q,["schema_version","event_id","occurred_at","event","runtime_version"],["from_version","to_version","reason_code","duration_ms","attempt_count","retry_in_ms","capabilities"])&&q.schema_version===qG&&typeof q.event_id==="string"&&/^[0-9a-f-]{36}$/.test(q.event_id)&&QG(q.occurred_at)&&typeof q.event==="string"&&wG.includes(q.event)&&B(q.runtime_version)&&(q.from_version===void 0||B(q.from_version))&&(q.to_version===void 0||B(q.to_version))&&(q.reason_code===void 0||typeof q.reason_code==="string"&&Pq.test(q.reason_code))&&(q.duration_ms===void 0||typeof q.duration_ms==="number"&&Number.isSafeInteger(q.duration_ms)&&q.duration_ms>=0&&q.duration_ms<=86400000)&&(q.attempt_count===void 0||typeof q.attempt_count==="number"&&Number.isSafeInteger(q.attempt_count)&&q.attempt_count>=1&&q.attempt_count<=1e5)&&(q.retry_in_ms===void 0||typeof q.retry_in_ms==="number"&&Number.isSafeInteger(q.retry_in_ms)&&q.retry_in_ms>=0&&q.retry_in_ms<=30000)&&(q.capabilities===void 0||Array.isArray(q.capabilities)&&q.capabilities.length<=FG&&q.capabilities.every((G)=>typeof G==="string"&&Pq.test(G)))}var RJ=/^(\d{22}-[0-9a-f-]{36}\.json)$/,UJ=/^(\d{22}-[0-9a-f-]{36}\.json)\.sending-(\d+)-[0-9a-f-]{36}$/,WJ=300000,qq=0n;function XJ(q){let G=BigInt(new Date(q.occurred_at).getTime())*1000000n;return qq=G>qq?G:qq+1n,`${String(qq).padStart(22,"0")}-${q.event_id}.json`}function $q(q){try{return Oq(q.lifecycleEvents).filter((G)=>RJ.test(G)).sort()}catch{return[]}}function Mq(q){try{let G=JSON.parse(g(q,"utf8"));return NG(G)?G:null}catch{return null}}function AG(q,G=MG,J=Date.now()){let Q;try{Q=Oq(q.lifecycleEvents)}catch{return}for(let R of Q){let U=R.match(UJ);if(!U)continue;let W=K(q.lifecycleEvents,R),_=K(q.lifecycleEvents,U[1]),Z=!G(Number(U[2]));if(!Z)try{Z=J-x(W).mtimeMs>=WJ}catch{continue}if(!Z)continue;try{k(W,_)}catch($){let Y=$.code;if(Y==="EEXIST")C(W);else if(Y!=="ENOENT")throw $}}}function ZJ(q){let J=$q(q).flatMap((R)=>{try{return[{name:R,size:x(K(q.lifecycleEvents,R)).size}]}catch{return[]}}),Q=J.reduce((R,U)=>R+U.size,0);while(J.length>GG||Q>OG){let R=J.shift();if(!R)break;try{C(K(q.lifecycleEvents,R.name)),Q-=R.size}catch(U){if(U.code!=="ENOENT")throw U}}}function sJ(q){return AG(q),$q(q).map((G)=>Mq(K(q.lifecycleEvents,G))).filter((G)=>G!==null).slice(-GG)}function N(q,G,J={}){let Q={schema_version:qG,event_id:J.eventId?.()??T(),occurred_at:(J.now?.()??new Date).toISOString(),...G};if(!NG(Q))throw new X("invalid_lifecycle_event","Managed runtime lifecycle event is invalid.");return b(q.lifecycleEvents),RG(K(q.lifecycleEvents,XJ(Q)),`${JSON.stringify(Q)}
+`),ZJ(q),Q}function uJ(q,G){if(G.length===0)return 0;let J=new Set(G),Q=0;for(let R of $q(q)){let U=R.slice(23,-5);if(!J.has(U))continue;try{C(K(q.lifecycleEvents,R)),Q+=1}catch(W){if(W.code!=="ENOENT")throw W}}return Q}async function pJ(q,G,J){AG(q);let Q=0;for(let R of $q(q)){let U=K(q.lifecycleEvents,R);if(J){let Z=Mq(U);if(!Z||!J(Z))continue}let W=`${U}.sending-${process.pid}-${T()}`;try{k(U,W)}catch(Z){if(Z.code==="ENOENT")continue;throw Z}let _=Mq(W);if(!_){C(W);continue}try{await G(_),C(W),Q+=1}catch{try{k(W,U)}catch(Z){if(Z.code!=="ENOENT")throw Z}break}}return Q}function rJ(q){let G=q.paths??Tq(),J=q.sourceExecutable??process.execPath,Q=q.sourceCredentialLibrary??Bq(D(S(J))),R=q.now?.()??new Date,U=E(F(G,q.version))&&Lq(G,q.version,q.allowDowngrade)!==null;if(!U)N(G,{event:"service.install_started",runtime_version:q.version,to_version:q.version},{now:()=>R});try{let W=g(J),_;try{_=g(Q)}catch{throw new X("credential_boundary_unavailable","Managed runtime credential boundary is unavailable.")}let Z={url:"https://bootstrap.invalid/ara",sha256:c(W),size_bytes:W.byteLength},$={url:`https://bootstrap.invalid/${Nq}`,sha256:c(_),size_bytes:_.byteLength},Y=XG({paths:G,version:q.version,artifact:Z,bytes:W,credentialLibraryArtifact:$,credentialLibraryBytes:_,...q.verifyCodeSignatures?{verifyCodeSignatures:q.verifyCodeSignatures}:{}}),H=pq(J);if(E(H))Dq({sourceApp:H,home:q.home??d()});let j=dG(G,q.version,{allowDowngrade:q.allowDowngrade});if(!U)Yq(G);let z=q.home??d(),M=q.installLauncher===!1?"skipped":vG({paths:G,...q.launcherPath?{launcherPath:q.launcherPath}:{home:z}});if(q.installLauncher!==!1&&!q.launcherPath)$G(G,K(z,".local","bin","reason"));if(M==="conflict")N(G,{event:"service.launcher_conflict",runtime_version:q.version,to_version:q.version,reason_code:"existing_entrypoint"},{now:q.now});if(!U)N(G,{event:"service.install_completed",runtime_version:q.version,to_version:q.version,duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now});return{installed:Y.installed,activated:j.changed,activeVersion:j.toVersion,executablePath:F(G,j.toVersion),launcher:M}}catch(W){throw N(G,{event:"service.install_failed",runtime_version:q.version,to_version:q.version,reason_code:W instanceof X?W.code:"install_failed",duration_ms:Math.max(0,(q.now?.()??new Date).getTime()-R.getTime())},{now:q.now}),W}}
+export{Zq as L,qG as M,GG as N,OG as O,EG as P,IG as Q,CG as R,Vq as S,TG as T,LG as U,mJ as V,wG as W,Tq as X,vJ as Y,F as Z,i as _,UG as $,xG as aa,VG as ba,Fq as ca,p as da,WG as ea,dJ as fa,XG as ga,vG as ha,_q as ia,L as ja,cJ as ka,hJ as la,lJ as ma,dG as na,jG as oa,sG as pa,zq as qa,oJ as ra,sJ as sa,N as ta,uJ as ua,pJ as va,rJ as wa};

package/bin/vm-hands/{vm-hands-entry-lite-0a1ch6wx.js → vm-hands-entry-lite-x96qadgp.js}

@@ -64,4 +64,4 @@ var e=String.raw`(function(require) {
     },
   };
 })`;
-export{e as Lk};
+export{e as Ok};

package/bin/vm-hands/{vm-hands-entry-lite-saemagkr.js → vm-hands-entry-lite-xaaxvbk8.js}

@@ -1,3 +1,3 @@
 // @bun
-import{pk as w}from"./vm-hands-entry-lite-18kfytsa.js";var S="inference.custom.v1",K=32768,P=67108864,Q=16384,T=204800,z=600000,U=["content-type","anthropic-version","user-agent"],L=w.enum(["openai-completions","openai-responses","anthropic-messages"]),V=new Set(U),W=w.record(w.string(),w.string().max(2048)).refine((j)=>Object.keys(j).every((A)=>V.has(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)),"Only non-secret custom endpoint request headers are permitted");function F(j){try{let A=new URL(j);return["http:","https:"].includes(A.protocol)&&!A.username&&!A.password&&!A.search&&!A.hash?A:null}catch{return null}}function X(j,A){let B=F(j.baseUrl),H=F(A.baseUrl),D=F(j.url);if(!B||!H||!D||j.method!=="POST"||A.execution!=="device")return!1;let I=(J)=>J.origin+J.pathname.replace(/\/+$/,"");if(I(B)!==I(H)||D.origin!==B.origin)return!1;let O=A.api==="openai-completions"?"/chat/completions":A.api==="openai-responses"?"/responses":"/v1/messages";return D.pathname===B.pathname.replace(/\/+$/,"")+O}var b=w.object({baseUrl:w.string().max(2048),url:w.string().max(4096),method:w.literal("POST"),body:w.string().refine((j)=>new TextEncoder().encode(j).byteLength<=T).optional(),headers:W,credentialOrganizationId:w.string().uuid(),accountKey:w.string().min(1).max(256).optional()}).strict().refine((j)=>L.options.some((A)=>X(j,{baseUrl:j.baseUrl,api:A,execution:"device"})),"Invalid custom endpoint inference URL"),k=w.object({status:w.number().int().min(200).max(599),statusText:w.string().max(256).refine((j)=>!/[\r\n\0]/.test(j)),headers:w.record(w.string(),w.string().max(4096)).refine((j)=>Object.keys(j).every((A)=>["content-type","retry-after","x-request-id","request-id"].includes(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)))}).strict(),y=w.union([w.object({eof:w.literal(!0)}).strict(),w.object({eof:w.literal(!1),data:w.string().max(Math.ceil(K/3)*4).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((j)=>j.length>0&&j.length*3/4-(j.endsWith("==")?2:j.endsWith("=")?1:0)<=K)}).strict()]),M=w.object({bytes:w.number().int().min(0).max(P),chunks:w.number().int().min(0).max(Q)}).strict(),p=w.object({apiKey:w.string().min(1).max(16384).refine((j)=>!/[\r\n\0]/.test(j)),api:L}).strict(),Y=["custom_endpoint_host_not_found","custom_endpoint_connection_failed","custom_endpoint_tls_failed"];function c(j){return typeof j==="string"&&Y.includes(j)}var Z="Ollama listens only on 127.0.0.1 unless it is started with OLLAMA_HOST=0.0.0.0.",G={custom_endpoint_host_not_found:"Your computer couldn't resolve your model server's hostname. Check the hostname in the Base URL, and that this computer is on the network or tailnet that resolves it.",custom_endpoint_connection_failed:`Your computer's connection to your model server was refused or timed out. Check that the server is running and listening on the Base URL's address and port. ${Z}`,custom_endpoint_tls_failed:"Your computer couldn't make a secure (TLS) connection to your model server. Check the server's https certificate, or use an http:// Base URL for a server on your computer or private network.",401:"Your model server refused the request (HTTP 401). Check the API key saved for it in Models.",403:"Your model server refused the request (HTTP 403). Ollama refuses requests addressed to a hostname other than localhost, such as a *.ts.net name from tailscale serve or funnel: restart it with OLLAMA_HOST=0.0.0.0, or use http://localhost:11434/v1 when it runs on the session's computer. For another server, check the API key and its access rules.",404:"Your model server answered HTTP 404 (not found). Check that the Base URL is the API root (for Ollama, http://localhost:11434/v1) and that each model ID is one the server lists."},q="Local custom endpoints require a session on your connected computer. This custom endpoint's Execution location is Your computer, so Reason cloud never calls it. Connect your computer with the Reason desktop app or CLI and run this session there, or set the endpoint's Execution location to Reason cloud with a public https Base URL in Models, or choose another model.";function _(j){return typeof j==="string"&&j.startsWith("Local custom endpoints require a session on your connected computer.")}var $=new Set(Object.values(G));function h(j){return Object.hasOwn(G,j)?G[j]:null}function v(j){return typeof j==="string"&&($.has(j)||_(j))}var N="returned HTTP 403: its firewall blocked Reason cloud",x=/^Your model endpoint \S+ (?:returned HTTP 40[34]|returned HTTP 403: its firewall blocked Reason cloud|was unreachable: it refused the connection)\.$/,C=/Attention Required! \| Cloudflare|Sorry, you have been blocked|cf-error-details/i;function n(j,A,B){if(!/^[a-z0-9.-]+$/i.test(j))return null;if(A==="connection_refused")return`Your model endpoint ${j} was unreachable: it refused the connection.`;if(A===403&&B&&C.test(B))return`Your model endpoint ${j} ${N}.`;return A===403||A===404?`Your model endpoint ${j} returned HTTP ${A}.`:null}function E(j){return typeof j==="string"&&x.test(j)}function d(j){return E(j)&&j.includes(N)}
-export{S as gd,K as hd,P as id,Q as jd,T as kd,z as ld,U as md,X as nd,b as od,k as pd,y as qd,M as rd,p as sd,Y as td,c as ud,q as vd,_ as wd,h as xd,v as yd,n as zd,E as Ad,d as Bd};
+import{sk as w}from"./vm-hands-entry-lite-ysk49bnz.js";var S="inference.custom.v1",K=32768,P=67108864,Q=16384,T=204800,z=600000,U=["content-type","anthropic-version","user-agent"],L=w.enum(["openai-completions","openai-responses","anthropic-messages"]),V=new Set(U),W=w.record(w.string(),w.string().max(2048)).refine((j)=>Object.keys(j).every((A)=>V.has(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)),"Only non-secret custom endpoint request headers are permitted");function F(j){try{let A=new URL(j);return["http:","https:"].includes(A.protocol)&&!A.username&&!A.password&&!A.search&&!A.hash?A:null}catch{return null}}function X(j,A){let B=F(j.baseUrl),H=F(A.baseUrl),D=F(j.url);if(!B||!H||!D||j.method!=="POST"||A.execution!=="device")return!1;let I=(J)=>J.origin+J.pathname.replace(/\/+$/,"");if(I(B)!==I(H)||D.origin!==B.origin)return!1;let O=A.api==="openai-completions"?"/chat/completions":A.api==="openai-responses"?"/responses":"/v1/messages";return D.pathname===B.pathname.replace(/\/+$/,"")+O}var b=w.object({baseUrl:w.string().max(2048),url:w.string().max(4096),method:w.literal("POST"),body:w.string().refine((j)=>new TextEncoder().encode(j).byteLength<=T).optional(),headers:W,credentialOrganizationId:w.string().uuid(),accountKey:w.string().min(1).max(256).optional()}).strict().refine((j)=>L.options.some((A)=>X(j,{baseUrl:j.baseUrl,api:A,execution:"device"})),"Invalid custom endpoint inference URL"),k=w.object({status:w.number().int().min(200).max(599),statusText:w.string().max(256).refine((j)=>!/[\r\n\0]/.test(j)),headers:w.record(w.string(),w.string().max(4096)).refine((j)=>Object.keys(j).every((A)=>["content-type","retry-after","x-request-id","request-id"].includes(A))&&Object.values(j).every((A)=>!/[\r\n\0]/.test(A)))}).strict(),y=w.union([w.object({eof:w.literal(!0)}).strict(),w.object({eof:w.literal(!1),data:w.string().max(Math.ceil(K/3)*4).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/).refine((j)=>j.length>0&&j.length*3/4-(j.endsWith("==")?2:j.endsWith("=")?1:0)<=K)}).strict()]),M=w.object({bytes:w.number().int().min(0).max(P),chunks:w.number().int().min(0).max(Q)}).strict(),p=w.object({apiKey:w.string().min(1).max(16384).refine((j)=>!/[\r\n\0]/.test(j)),api:L}).strict(),Y=["custom_endpoint_host_not_found","custom_endpoint_connection_failed","custom_endpoint_tls_failed"];function c(j){return typeof j==="string"&&Y.includes(j)}var Z="Ollama listens only on 127.0.0.1 unless it is started with OLLAMA_HOST=0.0.0.0.",G={custom_endpoint_host_not_found:"Your computer couldn't resolve your model server's hostname. Check the hostname in the Base URL, and that this computer is on the network or tailnet that resolves it.",custom_endpoint_connection_failed:`Your computer's connection to your model server was refused or timed out. Check that the server is running and listening on the Base URL's address and port. ${Z}`,custom_endpoint_tls_failed:"Your computer couldn't make a secure (TLS) connection to your model server. Check the server's https certificate, or use an http:// Base URL for a server on your computer or private network.",401:"Your model server refused the request (HTTP 401). Check the API key saved for it in Models.",403:"Your model server refused the request (HTTP 403). Ollama refuses requests addressed to a hostname other than localhost, such as a *.ts.net name from tailscale serve or funnel: restart it with OLLAMA_HOST=0.0.0.0, or use http://localhost:11434/v1 when it runs on the session's computer. For another server, check the API key and its access rules.",404:"Your model server answered HTTP 404 (not found). Check that the Base URL is the API root (for Ollama, http://localhost:11434/v1) and that each model ID is one the server lists."},q="Local custom endpoints require a session on your connected computer. This custom endpoint's Execution location is Your computer, so Reason cloud never calls it. Connect your computer with the Reason desktop app or CLI and run this session there, or set the endpoint's Execution location to Reason cloud with a public https Base URL in Models, or choose another model.";function _(j){return typeof j==="string"&&j.startsWith("Local custom endpoints require a session on your connected computer.")}var $=new Set(Object.values(G));function h(j){return Object.hasOwn(G,j)?G[j]:null}function v(j){return typeof j==="string"&&($.has(j)||_(j))}var N="returned HTTP 403: its firewall blocked Reason cloud",x=/^Your model endpoint \S+ (?:returned HTTP 40[34]|returned HTTP 403: its firewall blocked Reason cloud|was unreachable: it refused the connection)\.$/,C=/Attention Required! \| Cloudflare|Sorry, you have been blocked|cf-error-details/i;function n(j,A,B){if(!/^[a-z0-9.-]+$/i.test(j))return null;if(A==="connection_refused")return`Your model endpoint ${j} was unreachable: it refused the connection.`;if(A===403&&B&&C.test(B))return`Your model endpoint ${j} ${N}.`;return A===403||A===404?`Your model endpoint ${j} returned HTTP ${A}.`:null}function E(j){return typeof j==="string"&&x.test(j)}function d(j){return E(j)&&j.includes(N)}
+export{S as id,K as jd,P as kd,Q as ld,T as md,z as nd,U as od,X as pd,b as qd,k as rd,y as sd,M as td,p as ud,Y as vd,c as wd,q as xd,_ as yd,h as zd,v as Ad,n as Bd,E as Cd,d as Dd};