@tool-bridge/server 0.19.0 → 0.21.0

package/dist/{chunk-OKRZPQ3R.js → chunk-MZCIPUNQ.js}

@@ -1328,16 +1328,16 @@ function cleanEnum(obj) {
 }
 function base64ToUint8Array(base644) {
   const binaryString = atob(base644);
-  const bytes = new Uint8Array(binaryString.length);
+  const bytes2 = new Uint8Array(binaryString.length);
   for (let i = 0; i < binaryString.length; i++) {
-    bytes[i] = binaryString.charCodeAt(i);
+    bytes2[i] = binaryString.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToBase64(bytes) {
+function uint8ArrayToBase64(bytes2) {
   let binaryString = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binaryString += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.length; i++) {
+    binaryString += String.fromCharCode(bytes2[i]);
   }
   return btoa(binaryString);
 }
@@ -1346,22 +1346,22 @@ function base64urlToUint8Array(base64url3) {
   const padding = "=".repeat((4 - base644.length % 4) % 4);
   return base64ToUint8Array(base644 + padding);
 }
-function uint8ArrayToBase64url(bytes) {
-  return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function uint8ArrayToBase64url(bytes2) {
+  return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function hexToUint8Array(hex3) {
   const cleanHex = hex3.replace(/^0x/, "");
   if (cleanHex.length % 2 !== 0) {
     throw new Error("Invalid hex string length");
   }
-  const bytes = new Uint8Array(cleanHex.length / 2);
+  const bytes2 = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+    bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
-function uint8ArrayToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function uint8ArrayToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 var Class = class {
   constructor(..._args) {
@@ -14609,6 +14609,20 @@ function canonicalizePath(path) {
   if (norm === "") return "";
   return norm.split("/").map((seg) => canonicalizeSegment(seg)).join("/");
 }
+function assertNoCollision(names, context) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    const lower = name.toLowerCase();
+    const prev = seen.get(lower);
+    if (prev !== void 0 && prev !== name) {
+      throw new TBError(
+        "invalid_argument",
+        `${context}:\u6807\u8BC6\u7B26 '${prev}' \u4E0E '${name}' \u5C0F\u5199\u89C4\u8303\u5316\u540E\u51B2\u7A81`
+      );
+    }
+    seen.set(lower, name);
+  }
+}
 function segments(path) {
   const p = normalizePath(path);
   return p === "" ? [] : p.split("/");
@@ -14682,10 +14696,10 @@ function normalizeAnnotationPath(path) {
   return norm;
 }
 var AnnotationStore = class {
+  store;
   constructor(store) {
     this.store = store;
   }
-  store;
   keyOf(path) {
     return KEY_ANNOTATION + path;
   }
@@ -14823,7 +14837,7 @@ var SYSTEM_AUTO = "system:auto";
 var RESERVED_ROOTS = ["system", "ui"];
 
 // ../core/src/auth/registerPath.ts
-var segments3 = (path) => path.split("/").filter((s) => s.length > 0);
+var foldedSegments = (path) => segments(path).map((seg) => seg.toLowerCase());
 function isUnderPrefix(target, prefix) {
   if (prefix.length > target.length) return false;
   return prefix.every((seg, i) => seg === target[i]);
@@ -14834,7 +14848,7 @@ var deny = (message) => ({
 });
 function checkRegisterPath(input) {
   const { sk, targetPath, existing, reservedRoots = [] } = input;
-  const target = segments3(targetPath);
+  const target = foldedSegments(targetPath);
   if (target.some((seg) => seg.startsWith("~"))) {
     return {
       allow: false,
@@ -14842,12 +14856,12 @@ function checkRegisterPath(input) {
     };
   }
   if (sk.registerPaths !== void 0) {
-    const ok = sk.registerPaths.some((p) => isUnderPrefix(target, segments3(p)));
+    const ok = sk.registerPaths.some((p) => isUnderPrefix(target, foldedSegments(p)));
     if (!ok) {
       return deny(`path '${targetPath}' is outside declared registerPaths`);
     }
   } else {
-    const roots = /* @__PURE__ */ new Set([...RESERVED_ROOTS, ...reservedRoots]);
+    const roots = /* @__PURE__ */ new Set([...RESERVED_ROOTS, ...reservedRoots.map((r) => r.toLowerCase())]);
     const head = target[0];
     if (head !== void 0 && roots.has(head)) {
       return deny(`cannot register under reserved root '${head}'`);
@@ -14893,25 +14907,29 @@ function assertSecretRefUse(scopes, config2) {
 
 // ../core/src/encoding/base64url.ts
 var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-function base64urlEncode(bytes) {
+function base64urlEncode(bytes2) {
   let out = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const a = bytes[i] ?? 0;
-    const b = bytes[i + 1] ?? 0;
-    const c = bytes[i + 2] ?? 0;
+  for (let i = 0; i < bytes2.length; i += 3) {
+    const a = bytes2[i] ?? 0;
+    const b = bytes2[i + 1] ?? 0;
+    const c = bytes2[i + 2] ?? 0;
     const n = a << 16 | b << 8 | c;
     out += ALPHABET[n >>> 18 & 63];
     out += ALPHABET[n >>> 12 & 63];
-    if (i + 1 < bytes.length) out += ALPHABET[n >>> 6 & 63];
-    if (i + 2 < bytes.length) out += ALPHABET[n & 63];
+    if (i + 1 < bytes2.length) out += ALPHABET[n >>> 6 & 63];
+    if (i + 2 < bytes2.length) out += ALPHABET[n & 63];
   }
   return out;
 }
+function base64Encode(bytes2) {
+  const url2 = base64urlEncode(bytes2).replaceAll("-", "+").replaceAll("_", "/");
+  return url2 + "=".repeat((4 - url2.length % 4) % 4);
+}
 function base64urlDecode(input) {
   if (input.length % 4 === 1 || !/^[A-Za-z0-9_-]*$/.test(input)) {
     throw new Error("base64urlDecode: malformed base64url input");
   }
-  const bytes = [];
+  const bytes2 = [];
   for (let i = 0; i < input.length; i += 4) {
     const chunk = input.slice(i, i + 4);
     const a = ALPHABET.indexOf(chunk[0] ?? "");
@@ -14919,13 +14937,19 @@ function base64urlDecode(input) {
     const c = chunk.length >= 3 ? ALPHABET.indexOf(chunk[2] ?? "") : 0;
     const d = chunk.length >= 4 ? ALPHABET.indexOf(chunk[3] ?? "") : 0;
     const n = a << 18 | b << 12 | c << 6 | d;
-    bytes.push(n >>> 16 & 255);
-    if (chunk.length >= 3) bytes.push(n >>> 8 & 255);
-    if (chunk.length >= 4) bytes.push(n & 255);
+    bytes2.push(n >>> 16 & 255);
+    if (chunk.length >= 3) bytes2.push(n >>> 8 & 255);
+    if (chunk.length >= 4) bytes2.push(n & 255);
   }
-  return new Uint8Array(bytes);
+  return new Uint8Array(bytes2);
 }
 
+// ../core/src/webGlobals.ts
+var g = globalThis;
+var crypto = g.crypto;
+var TextDecoder2 = g.TextDecoder;
+var TextEncoder = g.TextEncoder;
+
 // ../core/src/omit.ts
 function omit2(obj, ...keys) {
   const rest = { ...obj };
@@ -14942,8 +14966,8 @@ async function sha256Hex(text) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function generateSecret() {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  return `${SECRET_PREFIX}${base64urlEncode(bytes)}`;
+  const bytes2 = crypto.getRandomValues(new Uint8Array(16));
+  return `${SECRET_PREFIX}${base64urlEncode(bytes2)}`;
 }
 function normalizeExpiresAt(value) {
   const parsed = ISO_TIMESTAMP.safeParse(value);
@@ -15000,10 +15024,10 @@ function clampLimit(limit) {
   return Math.min(Math.max(1, limit), LIST_LIMIT_MAX);
 }
 var SKRegistryStore = class {
+  store;
   constructor(store) {
     this.store = store;
   }
-  store;
   async recordById(id) {
     const hash2 = await this.store.get(KEY_SK_ID + id);
     if (typeof hash2 !== "string") return null;
@@ -15014,10 +15038,17 @@ var SKRegistryStore = class {
     const listOpts = { limit: clampLimit(opts?.limit) };
     if (opts?.cursor !== void 0) listOpts.cursor = opts.cursor;
     const page = await this.store.list(KEY_SK_ID, listOpts);
+    const hashes = page.items.map(({ value }) => value).filter((value) => typeof value === "string");
+    const records = /* @__PURE__ */ new Map();
+    for (let i = 0; i < hashes.length; i += 100) {
+      const chunk = await this.store.getMany(
+        hashes.slice(i, i + 100).map((hash2) => KEY_SK_HASH + hash2)
+      );
+      for (const [key, value] of chunk) records.set(key, value);
+    }
     const items = [];
-    for (const { value } of page.items) {
-      if (typeof value !== "string") continue;
-      const rec = await this.store.get(KEY_SK_HASH + value);
+    for (const hash2 of hashes) {
+      const rec = records.get(KEY_SK_HASH + hash2);
       if (rec) items.push(projectKey(rec));
     }
     return page.cursor !== void 0 ? { items, cursor: page.cursor } : { items };
@@ -15115,6 +15146,7 @@ var OperationRegistry = class {
     const schema = spec.inputSchema !== void 0 ? normalizeSchema(spec.inputSchema) : void 0;
     const toolSpec = { name };
     if (spec.description !== void 0) toolSpec.description = spec.description;
+    if (spec.delivery !== void 0) toolSpec.delivery = spec.delivery;
     if (spec.effect !== void 0) toolSpec.effect = spec.effect;
     if (spec.confirm !== void 0) toolSpec.confirm = spec.confirm;
     if (schema !== void 0) toolSpec.inputSchema = toJsonSchema(schema);
@@ -15187,7 +15219,7 @@ var HtbpCommandRegistry = class {
   metadata = /* @__PURE__ */ new Map();
   operations = new OperationRegistry();
   register(name, spec, handler) {
-    const { h, returns, scope, ...operationSpec } = spec;
+    const { h, hostOnly, returns, scope, ...operationSpec } = spec;
     this.operations.register(
       name,
       { ...operationSpec, description: h },
@@ -15195,6 +15227,7 @@ var HtbpCommandRegistry = class {
     );
     this.metadata.set(name, {
       scope,
+      ...hostOnly !== void 0 ? { hostOnly } : {},
       ...returns !== void 0 ? { returns } : {}
     });
     return this;
@@ -15208,6 +15241,10 @@ var HtbpCommandRegistry = class {
   scopeFor(name) {
     return this.metadata.get(name)?.scope;
   }
+  /** 该命令是否宿主专属扩展(见 {@link HtbpCommandSpec.hostOnly});未注册按 false。 */
+  isHostOnly(name) {
+    return this.metadata.get(name)?.hostOnly === true;
+  }
   commandSpecs(nodePath) {
     return this.operations.list().map((operation) => {
       const metadata = this.metadata.get(operation.name);
@@ -15248,13 +15285,13 @@ var HtbpCommandRegistry = class {
 
 // ../core/src/builtin/commandRegistry.ts
 var BuiltinCommandRegistry = class extends HtbpCommandRegistry {
+  moduleName;
+  moduleDescription;
   constructor(moduleName, moduleDescription) {
     super();
     this.moduleName = moduleName;
     this.moduleDescription = moduleDescription;
   }
-  moduleName;
-  moduleDescription;
   help(nodePath) {
     return this.helpModel({
       path: nodePath,
@@ -15461,18 +15498,7 @@ function encodeForm(entries) {
   return [...entries].map(([key, value]) => `${encode3(key)}=${encode3(value)}`).join("&");
 }
 function base643(ascii) {
-  const table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  let out = "";
-  for (let i = 0; i < ascii.length; i += 3) {
-    const a = ascii.charCodeAt(i);
-    const b = i + 1 < ascii.length ? ascii.charCodeAt(i + 1) : Number.NaN;
-    const c = i + 2 < ascii.length ? ascii.charCodeAt(i + 2) : Number.NaN;
-    out += table[a >> 2];
-    out += table[(a & 3) << 4 | (Number.isNaN(b) ? 0 : b >> 4)];
-    out += Number.isNaN(b) ? "=" : table[(b & 15) << 2 | (Number.isNaN(c) ? 0 : c >> 6)];
-    out += Number.isNaN(c) ? "=" : table[c & 63];
-  }
-  return out;
+  return base64Encode(Uint8Array.from(ascii, (char) => char.charCodeAt(0)));
 }
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
@@ -15663,6 +15689,8 @@ var contextCommands = new HtbpCommandRegistry().register(
   "create_upload",
   {
     h: "create a short-lived, path-scoped direct-upload grant; persist the returned uri, not url",
+    // 宿主专属扩展:仅在底层具备直传签名能力时由宿主装配,不进基础动词表。
+    hostOnly: true,
     inputSchema: external_exports.strictObject({
       path: external_exports.string().describe("target entry path inside the namespace"),
       contentType: external_exports.string().describe("media type signed into the PUT request"),
@@ -15686,14 +15714,14 @@ function contextScopeForCmd(command) {
 }
 function parseContextCmdArgs(command, args) {
   const normalized = command.toLowerCase();
-  if (!contextCommands.has(normalized) || normalized === "create_upload") {
+  if (!contextCommands.has(normalized) || contextCommands.isHostOnly(normalized)) {
     throw new TBError("invalid_argument", `unknown cmd '${command}'`);
   }
   return contextCommands.parse(normalized, args);
 }
 async function dispatchContextCmd(provider, command, args) {
   const normalized = command.toLowerCase();
-  if (!contextCommands.has(normalized) || normalized === "create_upload") {
+  if (!contextCommands.has(normalized) || contextCommands.isHostOnly(normalized)) {
     throw new TBError("invalid_argument", `unknown cmd '${command}'`);
   }
   const method = normalized;
@@ -15715,7 +15743,7 @@ async function dispatchContextUploadCmd(args, upload) {
 }
 
 // ../core/src/context/capabilities.ts
-var CONTEXT_METHODS = contextCommands.names().filter((name) => name !== "create_upload");
+var CONTEXT_METHODS = contextCommands.names().filter((name) => !contextCommands.isHostOnly(name));
 var CONTEXT_WRITE_METHODS = CONTEXT_METHODS.filter((method) => contextCommands.scopeFor(method) === "write");
 function contextMethodsOf(provider) {
   const methods = /* @__PURE__ */ new Set();
@@ -16502,10 +16530,10 @@ function normalizeAllowHost(raw) {
   return host;
 }
 var RemoteAllowlistStore = class {
+  store;
   constructor(store) {
     this.store = store;
   }
-  store;
   /** 读全部运行时条目(缺省/脏值 → 空数组);按 host 升序稳定输出。 */
   async list() {
     const raw = await this.store.get(KEY_REMOTE_ALLOWLIST);
@@ -16617,6 +16645,657 @@ function createFederationModule(deps) {
   return COMMANDS5.module(deps);
 }
 
+// ../core/src/device/mailbox.ts
+var KEY_DEVICE_OPERATION = "deviceop:";
+var DEVICE_OPERATION_STATES = [
+  "queued",
+  "claimed",
+  "succeeded",
+  "rejected",
+  "failed",
+  "result_unknown",
+  "cancelled",
+  "expired"
+];
+var DEFAULT_TTL_SECONDS = 24 * 60 * 60;
+var MAX_TTL_SECONDS = 7 * 24 * 60 * 60;
+var DEFAULT_LEASE_SECONDS = 60;
+var DEFAULT_MAX_PAYLOAD_BYTES = 256 * 1024;
+var DEFAULT_MAX_PENDING_PER_DEVICE = 1e3;
+var DEFAULT_TERMINAL_RETENTION_SECONDS = 7 * 24 * 60 * 60;
+var MAX_CAS_ATTEMPTS = 8;
+var LIST_LIMIT_DEFAULT2 = 50;
+var LIST_LIMIT_MAX2 = 200;
+var HKDF_SALT = new TextEncoder().encode("tool-bridge:device-mailbox:v1");
+var HKDF_INFO = new TextEncoder().encode("aes-256-gcm:operation-payload-and-result:v1");
+function mailboxUnavailable(message) {
+  return new TBError("unavailable", message, { retryable: false });
+}
+function finiteTimestamp(value) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value !== "";
+}
+function positiveInteger(value, fallback, field) {
+  const actual = value ?? fallback;
+  if (!Number.isSafeInteger(actual) || actual < 1) {
+    throw new TBError("invalid_argument", `${field} must be a positive integer`);
+  }
+  return actual;
+}
+function clampLimit3(value) {
+  if (value === void 0) return LIST_LIMIT_DEFAULT2;
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new TBError("invalid_argument", "limit must be a positive integer");
+  }
+  return Math.min(value, LIST_LIMIT_MAX2);
+}
+function isState(value) {
+  return typeof value === "string" && DEVICE_OPERATION_STATES.includes(value);
+}
+function isTerminal(state) {
+  return state !== "queued" && state !== "claimed";
+}
+function parseEncrypted(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("invalid encrypted value");
+  const raw = value;
+  if (raw.v !== 1 || !nonEmpty(raw.iv) || !nonEmpty(raw.ciphertext)) {
+    throw new Error("invalid encrypted value");
+  }
+  return { v: 1, iv: raw.iv, ciphertext: raw.ciphertext };
+}
+function parseRecord(value) {
+  try {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error();
+    const raw = value;
+    if (raw.v !== 1 || !Number.isSafeInteger(raw.revision) || raw.revision < 1 || !nonEmpty(raw.operationId) || !nonEmpty(raw.deviceId) || !nonEmpty(raw.deviceKeyId) || !nonEmpty(raw.mountPath) || !nonEmpty(raw.targetPath) || !nonEmpty(raw.path) || !nonEmpty(raw.callerKeyId) || !nonEmpty(raw.callerOwner) || !nonEmpty(raw.traceId) || !finiteTimestamp(raw.createdAt) || !finiteTimestamp(raw.updatedAt) || !finiteTimestamp(raw.expiresAt) || !isState(raw.state) || !Number.isSafeInteger(raw.attempt) || raw.attempt < 0 || typeof raw.executionMayHaveOccurred !== "boolean") throw new Error();
+    if (raw.leaseId === void 0 !== (raw.leaseUntil === void 0)) throw new Error();
+    if (raw.leaseId !== void 0 && (!nonEmpty(raw.leaseId) || !finiteTimestamp(raw.leaseUntil))) {
+      throw new Error();
+    }
+    if (raw.cancelRequestedAt !== void 0 && !finiteTimestamp(raw.cancelRequestedAt)) throw new Error();
+    if (raw.terminalAt !== void 0 && !finiteTimestamp(raw.terminalAt)) throw new Error();
+    if (isTerminal(raw.state) && raw.terminalAt === void 0) throw new Error();
+    return {
+      v: 1,
+      revision: raw.revision,
+      operationId: raw.operationId,
+      deviceId: raw.deviceId,
+      deviceKeyId: raw.deviceKeyId,
+      mountPath: raw.mountPath,
+      targetPath: raw.targetPath,
+      path: raw.path,
+      callerKeyId: raw.callerKeyId,
+      callerOwner: raw.callerOwner,
+      traceId: raw.traceId,
+      createdAt: raw.createdAt,
+      updatedAt: raw.updatedAt,
+      expiresAt: raw.expiresAt,
+      state: raw.state,
+      attempt: raw.attempt,
+      executionMayHaveOccurred: raw.executionMayHaveOccurred,
+      payload: parseEncrypted(raw.payload),
+      ...raw.leaseId === void 0 ? {} : { leaseId: raw.leaseId, leaseUntil: raw.leaseUntil },
+      ...raw.cancelRequestedAt === void 0 ? {} : { cancelRequestedAt: raw.cancelRequestedAt },
+      ...raw.completedLeaseId === void 0 ? {} : { completedLeaseId: String(raw.completedLeaseId) },
+      ...raw.terminalAt === void 0 ? {} : { terminalAt: raw.terminalAt },
+      ...raw.terminalData === void 0 ? {} : { terminalData: parseEncrypted(raw.terminalData) },
+      ...raw.idempotencyFingerprint === void 0 ? {} : { idempotencyFingerprint: String(raw.idempotencyFingerprint) }
+    };
+  } catch {
+    throw new TBError("internal", "device mailbox record is invalid", { retryable: false });
+  }
+}
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TBError("invalid_argument", "mailbox data must be valid JSON");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value !== "object") {
+    throw new TBError("invalid_argument", "mailbox data must be valid JSON");
+  }
+  const object2 = value;
+  const keys = Object.keys(object2).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(object2[key])}`).join(",")}}`;
+}
+function safeError(value) {
+  if (typeof value !== "object" || value === null || typeof value.code !== "string" || typeof value.message !== "string" || typeof value.retryable !== "boolean") throw new TBError("invalid_argument", "completion error is invalid");
+  return { code: value.code, message: value.message, retryable: value.retryable };
+}
+function normalizeCompletion(value) {
+  if (value.outcome === "succeeded") {
+    canonicalJson(value.result);
+    return { outcome: "succeeded", result: value.result };
+  }
+  if (value.outcome === "rejected" || value.outcome === "failed") {
+    return { outcome: value.outcome, error: safeError(value.error) };
+  }
+  return {
+    outcome: "result_unknown",
+    ...value.error === void 0 ? {} : { error: safeError(value.error) }
+  };
+}
+function bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function randomId(randomBytes) {
+  const value = randomBytes(18);
+  if (!(value instanceof Uint8Array) || value.length !== 18) {
+    throw mailboxUnavailable("device mailbox randomness is unavailable");
+  }
+  return `dop_${base64urlEncode(value)}`;
+}
+async function digestBytes(value) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+}
+async function deterministicOperationId(binding) {
+  return `dop_${base64urlEncode((await digestBytes(binding)).slice(0, 18))}`;
+}
+async function devicePrefix(deviceId) {
+  return `${KEY_DEVICE_OPERATION}${await sha256Hex(deviceId)}:`;
+}
+async function stateKey(deviceId, operationId) {
+  if (!/^dop_[A-Za-z0-9_-]{24}$/.test(operationId)) {
+    throw new TBError("invalid_argument", "operationId is invalid");
+  }
+  return await devicePrefix(deviceId) + operationId;
+}
+var DeviceMailboxCipher = class {
+  root;
+  keyPromise;
+  constructor(masterKey) {
+    let decoded;
+    try {
+      decoded = base64urlDecode(masterKey);
+    } catch {
+      throw mailboxUnavailable("device mailbox encryption key is invalid");
+    }
+    if (decoded.length !== 32) {
+      throw mailboxUnavailable("device mailbox encryption key is invalid");
+    }
+    this.root = decoded;
+  }
+  key() {
+    this.keyPromise ??= (async () => {
+      const rootKey = await crypto.subtle.importKey("raw", this.root, "HKDF", false, ["deriveKey"]);
+      return await crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: HKDF_SALT, info: HKDF_INFO },
+        rootKey,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+    })();
+    return this.keyPromise;
+  }
+  async encrypt(operationId, field, value) {
+    const plaintext = canonicalJson(value);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const additionalData = new TextEncoder().encode(`tool-bridge:device-mailbox:v1:${operationId}:${field}`);
+    const ciphertext = await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv, additionalData },
+      await this.key(),
+      new TextEncoder().encode(plaintext)
+    );
+    return {
+      v: 1,
+      iv: base64urlEncode(iv),
+      ciphertext: base64urlEncode(new Uint8Array(ciphertext))
+    };
+  }
+  async decrypt(operationId, field, value) {
+    try {
+      const iv = base64urlDecode(value.iv);
+      const ciphertext = base64urlDecode(value.ciphertext);
+      if (iv.length !== 12) throw new Error("invalid iv");
+      const additionalData = new TextEncoder().encode(`tool-bridge:device-mailbox:v1:${operationId}:${field}`);
+      const plaintext = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv, additionalData },
+        await this.key(),
+        ciphertext
+      );
+      return JSON.parse(new TextDecoder2().decode(plaintext));
+    } catch {
+      throw new TBError("internal", "device mailbox data cannot be decrypted", { retryable: false });
+    }
+  }
+};
+var DeviceMailboxService = class {
+  cas;
+  cipher;
+  defaultTtlSeconds;
+  leaseSeconds;
+  maxPayloadBytes;
+  maxPendingPerDevice;
+  maxTtlSeconds;
+  now;
+  randomBytes;
+  state;
+  terminalRetentionSeconds;
+  constructor(state, encryptionRoot, opts = {}) {
+    if (state.compareAndSwap === void 0) {
+      throw mailboxUnavailable("device mailbox requires StateStore.compareAndSwap");
+    }
+    if (encryptionRoot === void 0) {
+      throw mailboxUnavailable("device mailbox requires TB_SECRET_ENCRYPTION_KEY");
+    }
+    this.cas = state.compareAndSwap.bind(state);
+    this.state = state;
+    this.cipher = new DeviceMailboxCipher(encryptionRoot);
+    this.defaultTtlSeconds = positiveInteger(
+      opts.defaultTtlSeconds,
+      DEFAULT_TTL_SECONDS,
+      "defaultTtlSeconds"
+    );
+    this.maxTtlSeconds = positiveInteger(opts.maxTtlSeconds, MAX_TTL_SECONDS, "maxTtlSeconds");
+    if (this.defaultTtlSeconds > this.maxTtlSeconds) {
+      throw new TBError("invalid_argument", "defaultTtlSeconds cannot exceed maxTtlSeconds");
+    }
+    this.leaseSeconds = positiveInteger(opts.leaseSeconds, DEFAULT_LEASE_SECONDS, "leaseSeconds");
+    this.maxPayloadBytes = positiveInteger(
+      opts.maxPayloadBytes,
+      DEFAULT_MAX_PAYLOAD_BYTES,
+      "maxPayloadBytes"
+    );
+    this.maxPendingPerDevice = positiveInteger(
+      opts.maxPendingPerDevice,
+      DEFAULT_MAX_PENDING_PER_DEVICE,
+      "maxPendingPerDevice"
+    );
+    this.terminalRetentionSeconds = positiveInteger(
+      opts.terminalRetentionSeconds,
+      DEFAULT_TERMINAL_RETENTION_SECONDS,
+      "terminalRetentionSeconds"
+    );
+    this.now = opts.now ?? (() => Date.now());
+    this.randomBytes = opts.randomBytes ?? ((length) => crypto.getRandomValues(new Uint8Array(length)));
+  }
+  nowIso() {
+    return new Date(this.now()).toISOString();
+  }
+  async read(deviceId, operationId) {
+    const key = await stateKey(deviceId, operationId);
+    const value = await this.state.get(key);
+    if (value === null) throw TBError.notFound("device operation not found");
+    const record2 = parseRecord(value);
+    if (record2.deviceId !== deviceId || record2.operationId !== operationId) {
+      throw new TBError("internal", "device mailbox record identity mismatch", { retryable: false });
+    }
+    return { key, record: record2 };
+  }
+  summary(record2) {
+    return {
+      operationId: record2.operationId,
+      deviceId: record2.deviceId,
+      mountPath: record2.mountPath,
+      targetPath: record2.targetPath,
+      caller: { keyId: record2.callerKeyId, owner: record2.callerOwner },
+      traceId: record2.traceId,
+      createdAt: record2.createdAt,
+      updatedAt: record2.updatedAt,
+      expiresAt: record2.expiresAt,
+      state: record2.state,
+      attempt: record2.attempt,
+      executionMayHaveOccurred: record2.executionMayHaveOccurred,
+      ...record2.leaseUntil === void 0 ? {} : { leaseUntil: record2.leaseUntil },
+      ...record2.cancelRequestedAt === void 0 ? {} : { cancelRequestedAt: record2.cancelRequestedAt },
+      ...record2.terminalAt === void 0 ? {} : { terminalAt: record2.terminalAt }
+    };
+  }
+  async detail(record2) {
+    const summary = this.summary(record2);
+    if (record2.terminalData === void 0) return summary;
+    const terminal = await this.cipher.decrypt(
+      record2.operationId,
+      "terminal",
+      record2.terminalData
+    );
+    if (record2.state === "succeeded") return { ...summary, result: terminal.result };
+    const error51 = terminal.error;
+    if (error51 === void 0) return summary;
+    return { ...summary, error: safeError(error51) };
+  }
+  async expireRecord(key, record2) {
+    let current = record2;
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+      if (isTerminal(current.state) || Date.parse(current.expiresAt) > this.now()) return current;
+      const now = this.nowIso();
+      const next = {
+        ...current,
+        revision: current.revision + 1,
+        state: "expired",
+        updatedAt: now,
+        terminalAt: now,
+        executionMayHaveOccurred: current.state === "claimed"
+      };
+      if (await this.cas(key, current.revision, next)) return next;
+      const winner = await this.state.get(key);
+      if (winner === null) throw TBError.notFound("device operation not found");
+      current = parseRecord(winner);
+    }
+    throw new TBError("unavailable", "device operation expiry is busy", { retryable: true });
+  }
+  async enforcePendingCap(deviceId) {
+    const prefix = await devicePrefix(deviceId);
+    let cursor;
+    let pending = 0;
+    do {
+      const page = await this.state.list(prefix, {
+        limit: LIST_LIMIT_MAX2,
+        ...cursor === void 0 ? {} : { cursor }
+      });
+      for (const item of page.items) {
+        let record2 = parseRecord(item.value);
+        if (record2.deviceId !== deviceId) continue;
+        record2 = await this.expireRecord(item.key, record2);
+        if (!isTerminal(record2.state)) pending++;
+        if (pending >= this.maxPendingPerDevice) {
+          throw new TBError("rate_limited", "device mailbox pending limit reached", {
+            retryable: true
+          });
+        }
+      }
+      cursor = page.cursor;
+    } while (cursor !== void 0);
+  }
+  async enqueue(input) {
+    const ttlSeconds = input.ttlSeconds ?? this.defaultTtlSeconds;
+    if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > this.maxTtlSeconds) {
+      throw new TBError("invalid_argument", `ttlSeconds must be between 1 and ${this.maxTtlSeconds}`);
+    }
+    const payloadText = canonicalJson({ arguments: input.arguments });
+    if (bytes(payloadText) > this.maxPayloadBytes) {
+      throw new TBError("rate_limited", "device mailbox payload is too large", { retryable: false });
+    }
+    if (input.idempotencyKey !== void 0 && (input.idempotencyKey.length < 1 || input.idempotencyKey.length > 255 || /[\r\n\0]/.test(input.idempotencyKey))) throw new TBError("invalid_argument", "idempotency key is invalid");
+    const binding = input.idempotencyKey === void 0 ? void 0 : canonicalJson({
+      callerOwner: input.caller.owner,
+      deviceId: input.deviceId,
+      targetPath: input.targetPath,
+      idempotencyKey: input.idempotencyKey
+    });
+    const operationId = binding === void 0 ? randomId(this.randomBytes) : await deterministicOperationId(binding);
+    const fingerprint = binding === void 0 ? void 0 : await sha256Hex(canonicalJson({
+      arguments: input.arguments,
+      deviceKeyId: input.deviceKeyId,
+      path: input.path,
+      ttlSeconds
+    }));
+    const key = await stateKey(input.deviceId, operationId);
+    if (binding !== void 0) {
+      const existing2 = await this.state.get(key);
+      if (existing2 !== null) {
+        const record3 = parseRecord(existing2);
+        if (record3.callerOwner !== input.caller.owner || record3.deviceId !== input.deviceId || record3.targetPath !== input.targetPath || record3.idempotencyFingerprint !== fingerprint) throw new TBError("conflict", "idempotency key is bound to another operation");
+        return await this.detail(record3);
+      }
+    }
+    await this.enforcePendingCap(input.deviceId);
+    const now = this.nowIso();
+    const record2 = {
+      v: 1,
+      revision: 1,
+      operationId,
+      deviceId: input.deviceId,
+      deviceKeyId: input.deviceKeyId,
+      mountPath: input.mountPath,
+      targetPath: input.targetPath,
+      path: input.path,
+      callerKeyId: input.caller.keyId,
+      callerOwner: input.caller.owner,
+      traceId: input.traceId,
+      createdAt: now,
+      updatedAt: now,
+      expiresAt: new Date(this.now() + ttlSeconds * 1e3).toISOString(),
+      state: "queued",
+      attempt: 0,
+      executionMayHaveOccurred: false,
+      payload: await this.cipher.encrypt(operationId, "payload", { arguments: input.arguments }),
+      ...fingerprint === void 0 ? {} : { idempotencyFingerprint: fingerprint }
+    };
+    if (await this.cas(key, null, record2)) return await this.detail(record2);
+    if (binding === void 0) {
+      throw new TBError("conflict", "device operation id collision", { retryable: true });
+    }
+    const winner = await this.state.get(key);
+    if (winner === null) throw new TBError("conflict", "device operation enqueue conflicted");
+    const existing = parseRecord(winner);
+    if (existing.idempotencyFingerprint !== fingerprint) {
+      throw new TBError("conflict", "idempotency key is bound to another operation");
+    }
+    return await this.detail(existing);
+  }
+  async get(deviceId, operationId) {
+    const { key, record: record2 } = await this.read(deviceId, operationId);
+    return await this.detail(await this.expireRecord(key, record2));
+  }
+  async list(input) {
+    const limit = clampLimit3(input.limit);
+    const states = input.states === void 0 ? void 0 : new Set(input.states);
+    if (states !== void 0 && [...states].some((state) => !isState(state))) {
+      throw new TBError("invalid_argument", "states contains an invalid operation state");
+    }
+    const page = await this.state.list(await devicePrefix(input.deviceId), {
+      limit,
+      ...input.cursor === void 0 ? {} : { cursor: input.cursor }
+    });
+    const items = [];
+    for (const item of page.items) {
+      let record2 = parseRecord(item.value);
+      if (record2.deviceId !== input.deviceId) continue;
+      record2 = await this.expireRecord(item.key, record2);
+      if (states !== void 0 && !states.has(record2.state)) continue;
+      items.push(this.summary(record2));
+    }
+    return { items, ...page.cursor === void 0 ? {} : { cursor: page.cursor } };
+  }
+  async claim(input) {
+    const serverNow = this.nowIso();
+    const page = await this.state.list(await devicePrefix(input.deviceId), {
+      limit: clampLimit3(input.limit),
+      ...input.cursor === void 0 ? {} : { cursor: input.cursor }
+    });
+    for (const item of page.items) {
+      let record2 = parseRecord(item.value);
+      if (record2.deviceId !== input.deviceId || record2.deviceKeyId !== input.deviceKeyId) continue;
+      record2 = await this.expireRecord(item.key, record2);
+      const reclaimable = record2.state === "claimed" && record2.leaseUntil !== void 0 && Date.parse(record2.leaseUntil) <= this.now();
+      if (record2.state !== "queued" && !reclaimable) continue;
+      await input.authorize?.({
+        deviceId: record2.deviceId,
+        deviceKeyId: record2.deviceKeyId,
+        mountPath: record2.mountPath,
+        targetPath: record2.targetPath
+      });
+      const leaseId = randomId(this.randomBytes);
+      const leaseUntil = new Date(Math.min(
+        this.now() + this.leaseSeconds * 1e3,
+        Date.parse(record2.expiresAt)
+      )).toISOString();
+      const next = {
+        ...record2,
+        revision: record2.revision + 1,
+        state: "claimed",
+        attempt: record2.attempt + 1,
+        leaseId,
+        leaseUntil,
+        updatedAt: serverNow
+      };
+      if (!await this.cas(item.key, record2.revision, next)) continue;
+      const payload = await this.cipher.decrypt(
+        record2.operationId,
+        "payload",
+        record2.payload
+      );
+      if (typeof payload !== "object" || payload === null || typeof payload.arguments !== "object" || payload.arguments === null || Array.isArray(payload.arguments)) throw new TBError("internal", "device mailbox payload is invalid", { retryable: false });
+      return {
+        serverNow,
+        ...page.cursor === void 0 ? {} : { cursor: page.cursor },
+        operation: {
+          operationId: next.operationId,
+          targetPath: next.targetPath,
+          path: next.path,
+          arguments: payload.arguments,
+          caller: { keyId: next.callerKeyId, owner: next.callerOwner },
+          traceId: next.traceId,
+          createdAt: next.createdAt,
+          expiresAt: next.expiresAt,
+          attempt: next.attempt,
+          leaseId,
+          leaseUntil,
+          ...next.cancelRequestedAt === void 0 ? {} : { cancelRequestedAt: next.cancelRequestedAt }
+        }
+      };
+    }
+    return {
+      serverNow,
+      ...page.cursor === void 0 ? {} : { cursor: page.cursor }
+    };
+  }
+  async activeLease(input) {
+    const current = await this.read(input.deviceId, input.operationId);
+    const record2 = await this.expireRecord(current.key, current.record);
+    if (record2.deviceKeyId !== input.deviceKeyId || record2.state !== "claimed" || record2.leaseId !== input.leaseId || record2.leaseUntil === void 0 || Date.parse(record2.leaseUntil) <= this.now()) throw new TBError("conflict", "device operation lease is no longer active");
+    await input.authorize?.({
+      deviceId: record2.deviceId,
+      deviceKeyId: record2.deviceKeyId,
+      mountPath: record2.mountPath,
+      targetPath: record2.targetPath
+    });
+    return { key: current.key, record: record2 };
+  }
+  async renew(input) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+      const { key, record: record2 } = await this.activeLease(input);
+      const serverNow = this.nowIso();
+      const leaseUntil = new Date(Math.min(
+        this.now() + this.leaseSeconds * 1e3,
+        Date.parse(record2.expiresAt)
+      )).toISOString();
+      const next = {
+        ...record2,
+        revision: record2.revision + 1,
+        leaseUntil,
+        updatedAt: serverNow
+      };
+      if (await this.cas(key, record2.revision, next)) {
+        return {
+          serverNow,
+          leaseUntil,
+          ...next.cancelRequestedAt === void 0 ? {} : { cancelRequestedAt: next.cancelRequestedAt }
+        };
+      }
+    }
+    throw new TBError("unavailable", "device operation lease is busy", { retryable: true });
+  }
+  async complete(input, completionInput) {
+    const completion = normalizeCompletion(completionInput);
+    const terminalData = completion.outcome === "succeeded" ? { result: completion.result } : completion.error === void 0 ? {} : { error: completion.error };
+    if (bytes(canonicalJson(terminalData)) > this.maxPayloadBytes) {
+      throw new TBError("rate_limited", "device mailbox terminal payload is too large", {
+        retryable: false
+      });
+    }
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+      const current = await this.read(input.deviceId, input.operationId);
+      let record2 = await this.expireRecord(current.key, current.record);
+      if (record2.deviceKeyId !== input.deviceKeyId) {
+        throw new TBError("conflict", "device operation credential does not match");
+      }
+      await input.authorize?.({
+        deviceId: record2.deviceId,
+        deviceKeyId: record2.deviceKeyId,
+        mountPath: record2.mountPath,
+        targetPath: record2.targetPath
+      });
+      if (isTerminal(record2.state)) {
+        if (record2.completedLeaseId !== input.leaseId || record2.state !== completion.outcome || record2.terminalData === void 0) throw new TBError("conflict", "device operation is already terminal");
+        const existing = await this.cipher.decrypt(
+          record2.operationId,
+          "terminal",
+          record2.terminalData
+        );
+        const requested = completion.outcome === "succeeded" ? { result: completion.result } : completion.error === void 0 ? {} : { error: completion.error };
+        if (canonicalJson(existing) !== canonicalJson(requested)) {
+          throw new TBError("conflict", "device operation completion differs from terminal result");
+        }
+        return await this.detail(record2);
+      }
+      const active = await this.activeLease(input);
+      record2 = active.record;
+      const now = this.nowIso();
+      const next = {
+        ...record2,
+        revision: record2.revision + 1,
+        state: completion.outcome,
+        terminalAt: now,
+        terminalData: await this.cipher.encrypt(record2.operationId, "terminal", terminalData),
+        completedLeaseId: input.leaseId,
+        updatedAt: now
+      };
+      if (await this.cas(active.key, record2.revision, next)) return await this.detail(next);
+    }
+    throw new TBError("unavailable", "device operation completion is busy", { retryable: true });
+  }
+  async cancel(deviceId, operationId) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+      const current = await this.read(deviceId, operationId);
+      const record2 = await this.expireRecord(current.key, current.record);
+      if (isTerminal(record2.state) || record2.cancelRequestedAt !== void 0) {
+        return await this.detail(record2);
+      }
+      const now = this.nowIso();
+      const next = record2.state === "queued" ? {
+        ...record2,
+        revision: record2.revision + 1,
+        state: "cancelled",
+        cancelRequestedAt: now,
+        terminalAt: now,
+        updatedAt: now
+      } : {
+        ...record2,
+        revision: record2.revision + 1,
+        cancelRequestedAt: now,
+        updatedAt: now
+      };
+      if (await this.cas(current.key, record2.revision, next)) return await this.detail(next);
+    }
+    throw new TBError("unavailable", "device operation cancellation is busy", { retryable: true });
+  }
+  async cleanup(opts = {}) {
+    const page = await this.state.list(KEY_DEVICE_OPERATION, {
+      limit: clampLimit3(opts.limit),
+      ...opts.cursor === void 0 ? {} : { cursor: opts.cursor }
+    });
+    let deleted = 0;
+    let expired = 0;
+    for (const item of page.items) {
+      let record2;
+      try {
+        record2 = parseRecord(item.value);
+      } catch {
+        continue;
+      }
+      if (!isTerminal(record2.state) && Date.parse(record2.expiresAt) <= this.now()) {
+        const next = await this.expireRecord(item.key, record2);
+        if (next.state === "expired") expired++;
+        record2 = next;
+      }
+      if (isTerminal(record2.state) && record2.terminalAt !== void 0 && Date.parse(record2.terminalAt) + this.terminalRetentionSeconds * 1e3 <= this.now() && await this.cas(item.key, record2.revision, null)) deleted++;
+    }
+    return {
+      scanned: page.items.length,
+      expired,
+      deleted,
+      ...page.cursor === void 0 ? {} : { cursor: page.cursor }
+    };
+  }
+};
+
 // ../core/src/protocol/errorWire.ts
 var tbErrorCodeSchema = external_exports.enum(TB_ERROR_CODES);
 var tbErrorBodySchema = external_exports.object({
@@ -16663,6 +17342,7 @@ var helpChildSchema = external_exports.object({
 });
 var helpCommandSchema = external_exports.object({
   confirm: external_exports.boolean().optional(),
+  delivery: external_exports.enum(["realtime", "mailbox", "both"]).optional(),
   effect: external_exports.string().optional(),
   h: external_exports.string().optional(),
   inputSchema: external_exports.unknown().optional(),
@@ -16696,6 +17376,7 @@ var treeJsonSchema = external_exports.lazy(() => external_exports.object({
 }));
 var toolSpecSchema = external_exports.object({
   confirm: external_exports.boolean().optional(),
+  delivery: external_exports.enum(["realtime", "mailbox", "both"]).optional(),
   description: external_exports.string().optional(),
   effect: external_exports.string().optional(),
   inputSchema: external_exports.unknown().optional(),
@@ -16733,6 +17414,12 @@ var toolSearchItemSchema = external_exports.strictObject({
   source: toolSearchSourceSchema.optional(),
   tool: toolSpecSchema
 });
+function pageSchema(itemSchema) {
+  return external_exports.object({
+    cursor: external_exports.string().optional(),
+    items: external_exports.array(itemSchema)
+  });
+}
 var toolSearchPageSchema = external_exports.strictObject({
   cursor: external_exports.string().optional(),
   items: external_exports.array(toolSearchItemSchema),
@@ -16749,15 +17436,118 @@ var toolSearchRequestSchema = external_exports.strictObject({
     limit: external_exports.number().int().optional(),
     matching: external_exports.enum(["best", "all"]).optional(),
     minCoverage: external_exports.number().gt(0).max(1).optional(),
-    mode: external_exports.enum(["keyword", "semantic"]).optional(),
+    mode: external_exports.enum(["keyword"]).optional(),
     pathPrefix: external_exports.string().optional()
   }).optional(),
   query: external_exports.string().trim().min(1)
 });
+var deviceOperationStateSchema = external_exports.enum(
+  DEVICE_OPERATION_STATES
+);
+var deviceOperationCallerSchema = external_exports.object({
+  keyId: external_exports.string().min(1),
+  owner: external_exports.string().min(1)
+});
+var deviceOperationSummaryShape = {
+  attempt: external_exports.number().int().nonnegative(),
+  caller: deviceOperationCallerSchema,
+  cancelRequestedAt: external_exports.iso.datetime({ offset: true }).optional(),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  deviceId: external_exports.string().min(1),
+  executionMayHaveOccurred: external_exports.boolean(),
+  expiresAt: external_exports.iso.datetime({ offset: true }),
+  leaseUntil: external_exports.iso.datetime({ offset: true }).optional(),
+  mountPath: external_exports.string().min(1),
+  operationId: external_exports.string().min(1),
+  state: deviceOperationStateSchema,
+  targetPath: external_exports.string().min(1),
+  terminalAt: external_exports.iso.datetime({ offset: true }).optional(),
+  traceId: external_exports.string().min(1),
+  updatedAt: external_exports.iso.datetime({ offset: true })
+};
+var deviceOperationSummarySchema = external_exports.object(
+  deviceOperationSummaryShape
+);
+var deviceOperationDetailSchema = external_exports.object({
+  ...deviceOperationSummaryShape,
+  error: tbErrorBodySchema.optional(),
+  result: external_exports.json().optional()
+});
+var deviceOperationListRequestSchema = external_exports.strictObject({
+  deviceId: external_exports.string().min(1),
+  opts: external_exports.strictObject({
+    cursor: external_exports.string().min(1).optional(),
+    limit: external_exports.number().int().positive().optional(),
+    states: external_exports.array(deviceOperationStateSchema).min(1).optional()
+  }).optional()
+});
+var deviceOperationListResponseSchema = pageSchema(deviceOperationSummarySchema);
+var deviceOperationIdentityRequestSchema = external_exports.strictObject({
+  deviceId: external_exports.string().min(1),
+  operationId: external_exports.string().min(1)
+});
+var deviceOperationClaimRequestSchema = external_exports.strictObject({
+  cursor: external_exports.string().min(1).optional(),
+  deviceId: external_exports.string().min(1),
+  limit: external_exports.number().int().positive().optional()
+});
+var deviceOperationClaimSchema = external_exports.object({
+  arguments: external_exports.record(external_exports.string(), external_exports.json()),
+  attempt: external_exports.number().int().positive(),
+  caller: deviceOperationCallerSchema,
+  cancelRequestedAt: external_exports.iso.datetime({ offset: true }).optional(),
+  createdAt: external_exports.iso.datetime({ offset: true }),
+  expiresAt: external_exports.iso.datetime({ offset: true }),
+  leaseId: external_exports.string().min(1),
+  leaseUntil: external_exports.iso.datetime({ offset: true }),
+  operationId: external_exports.string().min(1),
+  path: external_exports.string().min(1),
+  targetPath: external_exports.string().min(1),
+  traceId: external_exports.string().min(1)
+});
+var deviceOperationClaimResponseSchema = external_exports.object({
+  cursor: external_exports.string().optional(),
+  operation: deviceOperationClaimSchema.optional(),
+  serverNow: external_exports.iso.datetime({ offset: true })
+});
+var deviceOperationLeaseShape = {
+  deviceId: external_exports.string().min(1),
+  leaseId: external_exports.string().min(1),
+  operationId: external_exports.string().min(1)
+};
+var deviceOperationRenewRequestSchema = external_exports.strictObject(deviceOperationLeaseShape);
+var deviceOperationRenewResponseSchema = external_exports.object({
+  cancelRequestedAt: external_exports.iso.datetime({ offset: true }).optional(),
+  leaseUntil: external_exports.iso.datetime({ offset: true }),
+  serverNow: external_exports.iso.datetime({ offset: true })
+});
+var deviceOperationCompleteRequestSchema = external_exports.discriminatedUnion("outcome", [
+  external_exports.strictObject({
+    ...deviceOperationLeaseShape,
+    outcome: external_exports.literal("succeeded"),
+    result: external_exports.json()
+  }),
+  external_exports.strictObject({
+    ...deviceOperationLeaseShape,
+    error: tbErrorBodySchema,
+    outcome: external_exports.literal("rejected")
+  }),
+  external_exports.strictObject({
+    ...deviceOperationLeaseShape,
+    error: tbErrorBodySchema,
+    outcome: external_exports.literal("failed")
+  }),
+  external_exports.strictObject({
+    ...deviceOperationLeaseShape,
+    error: tbErrorBodySchema.optional(),
+    outcome: external_exports.literal("result_unknown")
+  })
+]);
 var registryNodeSchema = external_exports.object({
   config: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   createdAt: external_exports.string().optional(),
   description: external_exports.string(),
+  deviceId: external_exports.string().optional(),
   kind: nodeKindSchema,
   lastSeenAt: external_exports.string().optional(),
   online: external_exports.boolean().optional(),
@@ -17106,17 +17896,7 @@ function createSkModule(store, now) {
 
 // ../core/src/builtin/index.ts
 async function countNodes(registry2) {
-  let count = 0;
-  let cursor;
-  do {
-    const page = await registry2.list(void 0, {
-      limit: LIST_LIMIT_MAX,
-      ...cursor !== void 0 ? { cursor } : {}
-    });
-    count += page.items.length;
-    cursor = page.cursor;
-  } while (cursor);
-  return count;
+  return (await registry2.subtree("")).length;
 }
 function createBuiltins(deps) {
   const now = deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
@@ -17165,7 +17945,7 @@ function contextHelpModel(node, opts = {}) {
   return contextCommands.helpModel(
     { path: node.path, kind: "context", description: node.description },
     (command) => {
-      if (command.name === "create_upload") return false;
+      if (contextCommands.isHostOnly(command.name)) return false;
       if (opts.methods !== void 0 && !opts.methods.has(command.name)) return false;
       return opts.readOnly !== true || command.scope === "read";
     }
@@ -17195,7 +17975,7 @@ async function readStreamBytes(stream) {
   return out;
 }
 async function readStreamText(stream) {
-  return new TextDecoder().decode(await readStreamBytes(stream));
+  return new TextDecoder2().decode(await readStreamBytes(stream));
 }
 function ownedBytes(view) {
   return view.buffer instanceof ArrayBuffer ? new Uint8Array(view.buffer, view.byteOffset, view.byteLength) : new Uint8Array(view);
@@ -17206,7 +17986,7 @@ async function objectBodyToBytes(body) {
   if (body instanceof ArrayBuffer) return new Uint8Array(body);
   return readStreamBytes(body);
 }
-function bytesToObjectStream(bytes) {
+function bytesToObjectStream(bytes2) {
   return {
     getReader() {
       let done = false;
@@ -17214,7 +17994,7 @@ function bytesToObjectStream(bytes) {
         async read() {
           if (done) return { done: true };
           done = true;
-          return { done: false, value: bytes };
+          return { done: false, value: bytes2 };
         },
         releaseLock() {
         },
@@ -17232,6 +18012,14 @@ function bytesToObjectStream(bytes) {
 var DEFAULT_STORE_NAME = "default";
 var DEFAULT_STORE_DRIVER_KEY_ROOT = "__tool_bridge_internal__/store/v1";
 
+// ../core/src/context/contentType.ts
+function normalizeContentType(value, message) {
+  if (typeof value !== "string" || value.trim() === "" || value.length > 255 || !value.includes("/") || /[\r\n\0]/.test(value)) {
+    throw new TBError("invalid_argument", message);
+  }
+  return value.trim().toLowerCase();
+}
+
 // ../core/src/context/path.ts
 function hasControlChar(s) {
   for (let i = 0; i < s.length; i++) {
@@ -17314,9 +18102,10 @@ async function createObjectContextUploadGrant(store, opts, input) {
   if (unknownKeys.length > 0) {
     throw new TBError("invalid_argument", `create_upload \u542B\u672A\u77E5\u5B57\u6BB5:${unknownKeys.join(",")}`);
   }
-  if (typeof input?.contentType !== "string" || input.contentType.trim() === "" || input.contentType.length > 255 || !input.contentType.includes("/") || /[\r\n\0]/.test(input.contentType)) {
-    throw new TBError("invalid_argument", "create_upload \u9700\u8981\u5408\u6CD5\u7684 'contentType'");
-  }
+  const contentType = normalizeContentType(
+    input?.contentType,
+    "create_upload \u9700\u8981\u5408\u6CD5\u7684 'contentType'"
+  );
   const nsPath = normalizePath(opts.nsPath);
   const entryPath = normalizeEntryPath(input.path);
   const key = `${keyPrefixBare === "" ? "" : `${keyPrefixBare}/`}${entryPath}`;
@@ -17325,7 +18114,6 @@ async function createObjectContextUploadGrant(store, opts, input) {
     throw new TBError("unavailable", "\u5BF9\u8C61\u5B58\u50A8\u672A\u914D\u7F6E\u76F4\u4F20\u7B7E\u540D\u80FD\u529B", { retryable: false });
   }
   const ttlSec = assertPresignTtlSec(opts.uploadGrantTtlSec ?? PRESIGN_TTL_SEC_DEFAULT);
-  const contentType = input.contentType.trim();
   const expiresAt = new Date(Date.now() + ttlSec * 1e3).toISOString();
   const signed = await store.presignPut(key, ttlSec, {
     contentType,
@@ -17339,7 +18127,7 @@ async function createObjectContextUploadGrant(store, opts, input) {
     expiresAt
   };
 }
-function clampLimit3(limit) {
+function clampLimit4(limit) {
   if (limit === void 0) return LIST_LIMIT_DEFAULT;
   if (!Number.isInteger(limit) || limit < 1) {
     throw new TBError("invalid_argument", `limit \u975E\u6CD5:${limit}`);
@@ -17413,7 +18201,7 @@ function createObjectContextProvider(store, opts) {
   return {
     async list(path, listOpts) {
       rejectFilter(listOpts);
-      const limit = clampLimit3(listOpts?.limit);
+      const limit = clampLimit4(listOpts?.limit);
       const rel = path === "" ? "" : `${normalizeEntryPath(path)}/`;
       const full = keyPrefix + rel;
       assertContextKeyAllowed(full.slice(0, -1), path, false);
@@ -17523,7 +18311,7 @@ function createObjectContextProvider(store, opts) {
         throw new TBError("invalid_argument", "query \u4E0D\u80FD\u4E3A\u7A7A");
       }
       rejectFilter(searchOpts);
-      const limit = clampLimit3(searchOpts?.limit);
+      const limit = clampLimit4(searchOpts?.limit);
       const q = query.toLowerCase();
       const after = searchOpts?.cursor;
       const items = [];
@@ -17580,6 +18368,7 @@ function isContextExpired(createdAt, ttlSec, now) {
 // ../core/src/device/frames.ts
 var deviceNodeCmdSchema = external_exports.object({
   name: external_exports.string().min(1),
+  delivery: external_exports.enum(["realtime", "mailbox", "both"]).optional(),
   description: external_exports.string().optional(),
   inputSchema: external_exports.unknown().optional(),
   outputSchema: external_exports.unknown().optional(),
@@ -17762,18 +18551,18 @@ function derivePresence(input) {
 var DEVICE_CALL_TIMEOUT_MS = 6e4;
 var DEVICE_REJECT_CLOSE_CODE = 1008;
 var DeviceGatewaySession = class {
-  constructor(io, opts) {
-    this.io = io;
-    this.opts = opts;
-    this.timeoutMs = opts.timeoutMs ?? DEVICE_CALL_TIMEOUT_MS;
-  }
-  io;
-  opts;
   phase_ = "awaiting-hello";
   helloSeen = false;
   results = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   timeoutMs;
+  io;
+  opts;
+  constructor(io, opts) {
+    this.io = io;
+    this.opts = opts;
+    this.timeoutMs = opts.timeoutMs ?? DEVICE_CALL_TIMEOUT_MS;
+  }
   get phase() {
     return this.phase_;
   }
@@ -17846,7 +18635,7 @@ var DeviceGatewaySession = class {
   call(req, done) {
     const cached2 = this.results.get(req.id);
     if (cached2 !== void 0) {
-      done(cached2);
+      done(cached2, "completed");
       return;
     }
     const inflight = this.pending.get(req.id);
@@ -17855,19 +18644,28 @@ var DeviceGatewaySession = class {
       return;
     }
     if (this.phase_ !== "ready") {
-      done({ ok: false, error: TBError.deviceOffline().toJSON() });
+      done({ ok: false, error: TBError.deviceOffline().toJSON() }, "not_dispatched");
       return;
     }
     const cancelTimer = this.opts.setTimer(() => this.onCallTimeout(req.id), this.timeoutMs);
     this.pending.set(req.id, { waiters: [done], cancelTimer });
-    this.io.send({
-      type: "call",
-      id: req.id,
-      path: req.path,
-      arguments: req.arguments,
-      // undefined 经 JSON.stringify 丢弃:老网关不带 context 时帧形状不变。
-      ...req.context !== void 0 ? { context: req.context } : {}
-    });
+    try {
+      this.io.send({
+        type: "call",
+        id: req.id,
+        path: req.path,
+        arguments: req.arguments,
+        // undefined 经 JSON.stringify 丢弃:老网关不带 context 时帧形状不变。
+        ...req.context !== void 0 ? { context: req.context } : {}
+      });
+    } catch {
+      this.pending.delete(req.id);
+      cancelTimer();
+      done({
+        ok: false,
+        error: new TBError("unavailable", "\u8BBE\u5907\u8C03\u7528\u53D1\u9001\u5931\u8D25", { retryable: true }).toJSON()
+      }, "unknown");
+    }
   }
   /** 幂等表回放种子(DO 从 ctx.storage 恢复时用);已有同 id 结果则忽略。 */
   seedResult(id, result) {
@@ -17887,7 +18685,7 @@ var DeviceGatewaySession = class {
     };
     for (const entry of entries) {
       entry.cancelTimer();
-      for (const waiter of entry.waiters) waiter(result);
+      for (const waiter of entry.waiters) waiter(result, "unknown");
     }
   }
   protocolReject(message) {
@@ -17901,7 +18699,7 @@ var DeviceGatewaySession = class {
     if (entry === void 0) return;
     this.pending.delete(id);
     entry.cancelTimer();
-    for (const waiter of entry.waiters) waiter(result);
+    for (const waiter of entry.waiters) waiter(result, "completed");
   }
   onCallTimeout(id) {
     const entry = this.pending.get(id);
@@ -17914,7 +18712,7 @@ var DeviceGatewaySession = class {
         retryable: true
       }).toJSON()
     };
-    for (const waiter of entry.waiters) waiter(result);
+    for (const waiter of entry.waiters) waiter(result, "unknown");
   }
 };
 
@@ -17988,10 +18786,10 @@ function toView(entry) {
 }
 var ID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 function randomFeedbackId() {
-  const bytes = new Uint8Array(6);
-  crypto.getRandomValues(bytes);
+  const bytes2 = new Uint8Array(6);
+  crypto.getRandomValues(bytes2);
   let out = "fb_";
-  for (const b of bytes) out += ID_ALPHABET[b % ID_ALPHABET.length];
+  for (const b of bytes2) out += ID_ALPHABET[b % ID_ALPHABET.length];
   return out;
 }
 function requireShort(value, field, max) {
@@ -18136,6 +18934,7 @@ function renderHelpDsl(model) {
     if (cmd.outputSchema !== void 0) lines.push(`  result ${JSON.stringify(cmd.outputSchema)}`);
     if (cmd.returns !== void 0) lines.push(...attrLines("returns", cmd.returns));
     lines.push(`  scope ${cmd.scope}`);
+    if (cmd.delivery !== void 0) lines.push(`  delivery ${cmd.delivery}`);
     if (cmd.effect !== void 0) lines.push(`  effect ${cmd.effect}`);
     if (cmd.confirm) lines.push("  confirm");
   }
@@ -18168,6 +18967,7 @@ function renderHelpJson(model) {
     if (cmd.inputSchema !== void 0) out.inputSchema = cmd.inputSchema;
     if (cmd.outputSchema !== void 0) out.outputSchema = cmd.outputSchema;
     if (cmd.returns !== void 0) out.returns = cmd.returns;
+    if (cmd.delivery !== void 0) out.delivery = cmd.delivery;
     if (cmd.effect !== void 0) out.effect = cmd.effect;
     if (cmd.confirm) out.confirm = cmd.confirm;
     return out;
@@ -18207,6 +19007,7 @@ function cmdSection(cmd, index) {
   }
   lines.push(`- Invoke: \`POST ${cmd.path}\` with body \`{...arguments}\``);
   lines.push(`- Required scope: \`${cmd.scope}\``);
+  if (cmd.delivery !== void 0) lines.push(`- Delivery: \`${cmd.delivery}\``);
   if (cmd.effect !== void 0) {
     lines.push(
       `- Effect: \`${cmd.effect}\`${cmd.confirm ? " \u2014 **ask the user to confirm before calling**" : ""}`
@@ -18424,7 +19225,7 @@ var KEY_STORE_IDEMPOTENCY = "store:idempotency:";
 var UPLOAD_TTL_SEC_DEFAULT = 15 * 60;
 var SHARE_TTL_SEC_DEFAULT = 15 * 60;
 var MAX_OBJECT_BYTES_DEFAULT = 256 * 1024 * 1024;
-var MAX_CAS_ATTEMPTS = 32;
+var MAX_CAS_ATTEMPTS2 = 32;
 var CAPABILITY_TTL_SEC_MAX = 7 * 24 * 60 * 60;
 var TOKEN_PREFIX = {
   call: "tbc",
@@ -18574,12 +19375,6 @@ function normalizeTimestamp(value, field) {
     throw error51;
   }
 }
-function normalizeContentType(value) {
-  if (typeof value !== "string" || value.trim() === "" || value.length > 255 || !value.includes("/") || /[\r\n\0]/.test(value)) {
-    throw new TBError("invalid_argument", "contentType \u4E0D\u5408\u6CD5");
-  }
-  return value.trim().toLowerCase();
-}
 function normalizeChecksum(value) {
   if (value === void 0) return void 0;
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -18596,7 +19391,7 @@ function normalizeChecksum(value) {
   return { algorithm: "sha256", value: digest };
 }
 function normalizeUploadInput(input) {
-  const contentType = normalizeContentType(input?.contentType);
+  const contentType = normalizeContentType(input?.contentType, "contentType \u4E0D\u5408\u6CD5");
   let filename;
   if (input.filename !== void 0) {
     if (typeof input.filename !== "string" || input.filename.trim() === "" || input.filename.length > 1024 || /[\r\n\0]/.test(input.filename)) throw new TBError("invalid_argument", "filename \u4E0D\u5408\u6CD5");
@@ -18645,7 +19440,7 @@ function normalizeContentTypePattern(value) {
     const prefix = value.slice(0, -1);
     if (prefix.length > 1 && !/[\r\n\0]/.test(value)) return value.toLowerCase();
   }
-  return normalizeContentType(value);
+  return normalizeContentType(value, "contentType \u4E0D\u5408\u6CD5");
 }
 function descriptorOf(object2) {
   if (object2.status !== "ready" || object2.readyAt === void 0 || object2.size === void 0) throw stateCorrupt("ready object");
@@ -18667,6 +19462,15 @@ function descriptorOf(object2) {
   };
 }
 var StoreService = class {
+  maxObjectBytes;
+  now;
+  relayMaxBytes;
+  shareTtlSec;
+  tokenSecret;
+  uploadTtlSec;
+  cas;
+  state;
+  objects;
   constructor(state, objects, opts) {
     this.state = state;
     this.objects = objects;
@@ -18698,15 +19502,6 @@ var StoreService = class {
       "shareTtlSec"
     );
   }
-  state;
-  objects;
-  maxObjectBytes;
-  now;
-  relayMaxBytes;
-  shareTtlSec;
-  tokenSecret;
-  uploadTtlSec;
-  cas;
   /** 所有已存在记录的 CAS 共用 revision 期望，并拒绝错误的版本跃迁。 */
   async compareRecord(key, current, next) {
     if (next !== null && next.revision !== current.revision + 1)
@@ -18774,7 +19569,7 @@ var StoreService = class {
   }
   async revokeCallUploadCapability(token) {
     const id = this.tokenId(token, "call");
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const raw = await this.state.get(`${KEY_STORE_CALL_CAPABILITY}${id}`);
       if (raw === null) throw new TBError("permission_denied", "call upload capability \u65E0\u6548");
       const capability = parseCallCapability(raw);
@@ -18988,7 +19783,7 @@ var StoreService = class {
   }
   async delete(uri, actor) {
     const { objectId } = parseStoreUri(uri);
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const object2 = await this.requireObject(objectId);
       if (!actor.admin && object2.owner !== actor.owner) {
         throw new TBError("not_found", "Store \u5BF9\u8C61\u4E0D\u5B58\u5728");
@@ -19052,7 +19847,7 @@ var StoreService = class {
   }
   async revokeShare(shareId, actor) {
     const owner = requireOwner(actor);
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const raw = await this.state.get(`${KEY_STORE_SHARE}${shareId}`);
       if (raw === null) throw new TBError("not_found", "share grant \u4E0D\u5B58\u5728");
       const grant = parseShare(raw);
@@ -19376,7 +20171,7 @@ var StoreService = class {
     await this.compareRecord(resolved.key, resolved.binding, null);
   }
   async reserveCallCapability(token, objectId, input, transportMaxBytes) {
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const capability = await this.verifyCallUploadCapability(token);
       const previous = capability.reservations.find((r) => r.objectId === objectId);
       if (previous !== void 0) {
@@ -19498,7 +20293,7 @@ var StoreService = class {
   }
   /** driver DELETE 成功后持久化证据；后续 cleanup 只收 tombstone，不再重复外部 DELETE。 */
   async markBytesDeleted(objectId, expectedDriverKey) {
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const raw = await this.state.get(`${KEY_STORE_OBJECT}${objectId}`);
       if (raw === null) return;
       const object2 = parseObject(raw);
@@ -19598,7 +20393,7 @@ var StoreService = class {
   }
   async markReady(sessionInput, meta3) {
     const actualChecksum = sessionInput.expectedChecksum !== void 0 && meta3.metadata?.["checksum-sha256"]?.toLowerCase() === sessionInput.expectedChecksum.value ? sessionInput.expectedChecksum : void 0;
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const object2 = await this.requireObject(sessionInput.objectId);
       if (object2.status === "ready") {
         await this.completeSessionBestEffort(await this.requireSession(sessionInput.id));
@@ -19628,7 +20423,7 @@ var StoreService = class {
     throw new TBError("conflict", "\u5BF9\u8C61\u5E76\u53D1\u72B6\u6001\u51B2\u7A81:pending");
   }
   async completeSessionBestEffort(sessionInput) {
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS2; attempt++) {
       const session = await this.requireSession(sessionInput.id);
       if (session.status === "completed" || session.status !== "created") return;
       const completedAt = this.nowIso();
@@ -19804,8 +20599,8 @@ function canonicalCatalogJson(value) {
   return JSON.stringify(normalize(value));
 }
 async function catalogDigest(value) {
-  const bytes = new TextEncoder().encode(canonicalCatalogJson(value));
-  const hash2 = await crypto.subtle.digest("SHA-256", bytes);
+  const bytes2 = new TextEncoder().encode(canonicalCatalogJson(value));
+  const hash2 = await crypto.subtle.digest("SHA-256", bytes2);
   return [...new Uint8Array(hash2)].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 async function catalogSetDigest(catalog) {
@@ -19974,7 +20769,7 @@ function encodeCallContext(ctx) {
 function decodeCallContext(header) {
   let text;
   try {
-    text = new TextDecoder().decode(base64urlDecode(header));
+    text = new TextDecoder2().decode(base64urlDecode(header));
   } catch {
     throw new TBError("invalid_argument", `${HEADER_TB_CONTEXT} \u975E\u6CD5 base64url`);
   }
@@ -19999,11 +20794,11 @@ var pluginCallSchema = external_exports.object({
   arguments: external_exports.record(external_exports.string(), external_exports.unknown())
 });
 function assertPluginPayloadSize(payload) {
-  const bytes = new TextEncoder().encode(payload).length;
-  if (bytes > PLUGIN_PAYLOAD_MAX_BYTES) {
+  const bytes2 = new TextEncoder().encode(payload).length;
+  if (bytes2 > PLUGIN_PAYLOAD_MAX_BYTES) {
     throw new TBError(
       "invalid_argument",
-      `payload ${bytes} \u5B57\u8282\u8D85\u8FC7\u4E0A\u9650 ${PLUGIN_PAYLOAD_MAX_BYTES}(\u2264 1 MiB;\u66F4\u5927\u5185\u5BB9\u7ECF $ref)`
+      `payload ${bytes2} \u5B57\u8282\u8D85\u8FC7\u4E0A\u9650 ${PLUGIN_PAYLOAD_MAX_BYTES}(\u2264 1 MiB;\u66F4\u5927\u5185\u5BB9\u7ECF $ref)`
     );
   }
 }
@@ -20181,9 +20976,9 @@ function searchUnitAllowsPath(unit) {
   return !/^%[A-Za-z0-9]{1,2}%$/u.test(unit.pattern);
 }
 function stableDigest(value) {
-  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  const bytes2 = new TextEncoder().encode(JSON.stringify(value));
   let hash2 = 0xcbf29ce484222325n;
-  for (const byte of bytes) {
+  for (const byte of bytes2) {
     hash2 ^= BigInt(byte);
     hash2 = BigInt.asUintN(64, hash2 * 0x100000001b3n);
   }
@@ -20193,12 +20988,12 @@ function truncateUtf8(value, maxBytes) {
   const encoder = new TextEncoder();
   if (encoder.encode(value).length <= maxBytes) return value;
   let result = "";
-  let bytes = 0;
+  let bytes2 = 0;
   for (const char of value) {
     const size = encoder.encode(char).length;
-    if (bytes + size > maxBytes) break;
+    if (bytes2 + size > maxBytes) break;
     result += char;
-    bytes += size;
+    bytes2 += size;
   }
   return result;
 }
@@ -20558,7 +21353,7 @@ async function decodeToolSearchCursor(cursor, query, mode, revision, secret, opt
       await cursorCryptoKey(secret),
       sealed.slice(12)
     );
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(new Uint8Array(plaintext)));
+    value = JSON.parse(new TextDecoder2("utf-8", { fatal: true }).decode(new Uint8Array(plaintext)));
   } catch (error51) {
     if (error51 instanceof TBError) throw error51;
     throw new TBError("invalid_argument", "\u641C\u7D22 cursor \u683C\u5F0F\u975E\u6CD5");
@@ -20626,36 +21421,45 @@ var TOOL_SEARCH_INSERT_SQL = `
 INSERT INTO tb_search_tools_v5 (path, name, description, effect, feedback)
 VALUES (?, ?, ?, ?, ?)
 `;
-var TOOL_SEARCH_INSERT_SNAPSHOT_SQL = "INSERT INTO tb_search_snapshots_v5(path, digest) VALUES (?, ?)";
-var META_SQL = "SELECT revision, seeded, cursor_secret FROM tb_search_meta_v5 WHERE singleton = 1";
-var SNAPSHOT_DIGESTS_SQL = "SELECT path, digest FROM tb_search_snapshots_v5 ORDER BY path";
-var PATH_STATE_SQL = `
+function toolSearchFixedStatements(syntax) {
+  const p = (index) => syntax.placeholder(index);
+  const int2 = syntax.castInt ?? ((expr) => expr);
+  return {
+    bumpRevision: "UPDATE tb_search_meta_v5 SET revision = revision + 1 WHERE singleton = 1",
+    completeRebuild: "UPDATE tb_search_meta_v5 SET seeded = 1, revision = revision + 1 WHERE singleton = 1",
+    deleteAllSnapshots: "DELETE FROM tb_search_snapshots_v5",
+    deleteAllTools: "DELETE FROM tb_search_tools_v5",
+    deleteSnapshot: `DELETE FROM tb_search_snapshots_v5 WHERE path = ${p(1)}`,
+    deleteSnapshotPrefix: `
+DELETE FROM tb_search_snapshots_v5
+WHERE path = ${p(1)} OR substr(path, 1, length(${p(2)}) + 1) = ${p(3)} || '/'
+`,
+    deleteTools: `DELETE FROM tb_search_tools_v5 WHERE path = ${p(1)}`,
+    deleteToolsPrefix: `
+DELETE FROM tb_search_tools_v5
+WHERE path = ${p(1)} OR substr(path, 1, length(${p(2)}) + 1) = ${p(3)} || '/'
+`,
+    insertSnapshot: `INSERT INTO tb_search_snapshots_v5(path, digest) VALUES (${p(1)}, ${p(2)})`,
+    meta: `SELECT ${int2("revision")} AS revision, ${int2("seeded")} AS seeded, cursor_secret FROM tb_search_meta_v5 WHERE singleton = 1`,
+    // replace 的前置探测:一次拿到本 path 的 digest、是否残留 source 行、已用节点数。
+    pathState: `
 SELECT snapshots.digest,
-  EXISTS(SELECT 1 FROM tb_search_tools_v5 WHERE path = ?) AS has_tools,
-  (SELECT COUNT(*) FROM tb_search_snapshots_v5) AS path_count
+  ${int2(`EXISTS(SELECT 1 FROM tb_search_tools_v5 WHERE path = ${p(1)})`)} AS has_tools,
+  ${int2("(SELECT COUNT(*) FROM tb_search_snapshots_v5)")} AS path_count
 FROM (SELECT 1) AS singleton
-LEFT JOIN tb_search_snapshots_v5 AS snapshots ON snapshots.path = ?
-`;
-var PRESENT_SQL = "SELECT 1 AS present FROM tb_search_tools_v5 WHERE path = ? LIMIT 1";
-var PRESENT_PREFIX_SQL = `
+LEFT JOIN tb_search_snapshots_v5 AS snapshots ON snapshots.path = ${p(2)}
+`,
+    present: `SELECT 1 AS present FROM tb_search_tools_v5 WHERE path = ${p(1)} LIMIT 1`,
+    presentPrefix: `
 SELECT 1 AS present FROM tb_search_tools_v5
-WHERE path = ? OR substr(path, 1, length(?) + 1) = ? || '/'
+WHERE path = ${p(1)} OR substr(path, 1, length(${p(2)}) + 1) = ${p(3)} || '/'
 LIMIT 1
-`;
-var DELETE_TOOLS_SQL = "DELETE FROM tb_search_tools_v5 WHERE path = ?";
-var DELETE_SNAPSHOT_SQL = "DELETE FROM tb_search_snapshots_v5 WHERE path = ?";
-var DELETE_TOOLS_PREFIX_SQL = `
-DELETE FROM tb_search_tools_v5
-WHERE path = ? OR substr(path, 1, length(?) + 1) = ? || '/'
-`;
-var DELETE_SNAPSHOT_PREFIX_SQL = `
-DELETE FROM tb_search_snapshots_v5
-WHERE path = ? OR substr(path, 1, length(?) + 1) = ? || '/'
-`;
-var DELETE_ALL_TOOLS_SQL = "DELETE FROM tb_search_tools_v5";
-var DELETE_ALL_SNAPSHOTS_SQL = "DELETE FROM tb_search_snapshots_v5";
-var BUMP_REVISION_SQL = "UPDATE tb_search_meta_v5 SET revision = revision + 1 WHERE singleton = 1";
-var COMPLETE_REBUILD_SQL = "UPDATE tb_search_meta_v5 SET seeded = 1, revision = revision + 1 WHERE singleton = 1";
+`,
+    snapshotDigests: "SELECT path, digest FROM tb_search_snapshots_v5 ORDER BY path"
+  };
+}
+var SQLITE_FIXED_STATEMENTS = toolSearchFixedStatements({ placeholder: () => "?" });
+var TOOL_SEARCH_INSERT_SNAPSHOT_SQL = SQLITE_FIXED_STATEMENTS.insertSnapshot;
 function toolSearchEffectSql(effect) {
   switch (effect) {
     case "read":
@@ -20762,31 +21566,16 @@ var sqliteSearchDialect = {
     );
   },
   schemaStatements: TOOL_SEARCH_SCHEMA_STATEMENTS,
-  statements: {
-    bumpRevision: BUMP_REVISION_SQL,
-    completeRebuild: COMPLETE_REBUILD_SQL,
-    deleteAllSnapshots: DELETE_ALL_SNAPSHOTS_SQL,
-    deleteAllTools: DELETE_ALL_TOOLS_SQL,
-    deleteSnapshot: DELETE_SNAPSHOT_SQL,
-    deleteSnapshotPrefix: DELETE_SNAPSHOT_PREFIX_SQL,
-    deleteTools: DELETE_TOOLS_SQL,
-    deleteToolsPrefix: DELETE_TOOLS_PREFIX_SQL,
-    insertSnapshot: TOOL_SEARCH_INSERT_SNAPSHOT_SQL,
-    meta: META_SQL,
-    pathState: PATH_STATE_SQL,
-    present: PRESENT_SQL,
-    presentPrefix: PRESENT_PREFIX_SQL,
-    snapshotDigests: SNAPSHOT_DIGESTS_SQL
-  }
+  statements: SQLITE_FIXED_STATEMENTS
 };
 var SqlSearchIndex = class {
+  capabilities = ["search"];
+  dialect;
+  driver;
   constructor(driver, dialect = sqliteSearchDialect) {
     this.driver = driver;
     this.dialect = dialect;
   }
-  driver;
-  capabilities = ["search"];
-  dialect;
   /** 容量 trigger 的 ABORT 在各驱动里错误形状不同,统一按标记串归一。 */
   async writeOrCapacity(statements) {
     try {
@@ -21006,7 +21795,11 @@ var PG_SEARCH_SCHEMA_STATEMENTS = [
     FOR EACH ROW EXECUTE FUNCTION tb_search_snapshots_v5_capacity()`
 ];
 var PG_SEARCH_WRITE_LOCK_KEY = 2069799624;
-var PG_SEARCH_INSERT_SNAPSHOT_SQL = "INSERT INTO tb_search_snapshots_v5(path, digest) VALUES ($1, $2)";
+var PG_FIXED_STATEMENTS = toolSearchFixedStatements({
+  castInt: (expr) => `${expr}::int`,
+  placeholder: (index) => `$${index}`
+});
+var PG_SEARCH_INSERT_SNAPSHOT_SQL = PG_FIXED_STATEMENTS.insertSnapshot;
 function pgBulkInsertSql(table, columns, rows) {
   const tuples = [];
   for (let r = 0; r < rows; r++) {
@@ -21026,38 +21819,6 @@ var PG_SEARCH_TOOLS_COLUMNS = [
 var PG_SEARCH_SNAPSHOTS_TABLE = "tb_search_snapshots_v5";
 var PG_SEARCH_SNAPSHOTS_COLUMNS = ["path", "digest"];
 var PG_SEARCH_INSERT_ROWS_MAX = 1e3;
-var META_SQL2 = `
-SELECT revision::int AS revision, seeded::int AS seeded, cursor_secret
-FROM tb_search_meta_v5 WHERE singleton = 1
-`;
-var SNAPSHOT_DIGESTS_SQL2 = "SELECT path, digest FROM tb_search_snapshots_v5 ORDER BY path";
-var PATH_STATE_SQL2 = `
-SELECT snapshots.digest,
-  EXISTS(SELECT 1 FROM tb_search_tools_v5 WHERE path = $1)::int AS has_tools,
-  (SELECT COUNT(*) FROM tb_search_snapshots_v5)::int AS path_count
-FROM (SELECT 1) AS singleton
-LEFT JOIN tb_search_snapshots_v5 AS snapshots ON snapshots.path = $2
-`;
-var PRESENT_SQL2 = "SELECT 1 AS present FROM tb_search_tools_v5 WHERE path = $1 LIMIT 1";
-var PRESENT_PREFIX_SQL2 = `
-SELECT 1 AS present FROM tb_search_tools_v5
-WHERE path = $1 OR substr(path, 1, length($2) + 1) = $3 || '/'
-LIMIT 1
-`;
-var DELETE_TOOLS_SQL2 = "DELETE FROM tb_search_tools_v5 WHERE path = $1";
-var DELETE_SNAPSHOT_SQL2 = "DELETE FROM tb_search_snapshots_v5 WHERE path = $1";
-var DELETE_TOOLS_PREFIX_SQL2 = `
-DELETE FROM tb_search_tools_v5
-WHERE path = $1 OR substr(path, 1, length($2) + 1) = $3 || '/'
-`;
-var DELETE_SNAPSHOT_PREFIX_SQL2 = `
-DELETE FROM tb_search_snapshots_v5
-WHERE path = $1 OR substr(path, 1, length($2) + 1) = $3 || '/'
-`;
-var DELETE_ALL_TOOLS_SQL2 = "DELETE FROM tb_search_tools_v5";
-var DELETE_ALL_SNAPSHOTS_SQL2 = "DELETE FROM tb_search_snapshots_v5";
-var BUMP_REVISION_SQL2 = "UPDATE tb_search_meta_v5 SET revision = revision + 1 WHERE singleton = 1";
-var COMPLETE_REBUILD_SQL2 = "UPDATE tb_search_meta_v5 SET seeded = 1, revision = revision + 1 WHERE singleton = 1";
 var pgSearchDialect = {
   candidateStatement: (query, limit, offset, rawConstraints) => {
     const constraints = normalizeToolSearchOptions(rawConstraints);
@@ -21075,22 +21836,7 @@ var pgSearchDialect = {
     );
   },
   schemaStatements: PG_SEARCH_SCHEMA_STATEMENTS,
-  statements: {
-    bumpRevision: BUMP_REVISION_SQL2,
-    completeRebuild: COMPLETE_REBUILD_SQL2,
-    deleteAllSnapshots: DELETE_ALL_SNAPSHOTS_SQL2,
-    deleteAllTools: DELETE_ALL_TOOLS_SQL2,
-    deleteSnapshot: DELETE_SNAPSHOT_SQL2,
-    deleteSnapshotPrefix: DELETE_SNAPSHOT_PREFIX_SQL2,
-    deleteTools: DELETE_TOOLS_SQL2,
-    deleteToolsPrefix: DELETE_TOOLS_PREFIX_SQL2,
-    insertSnapshot: PG_SEARCH_INSERT_SNAPSHOT_SQL,
-    meta: META_SQL2,
-    pathState: PATH_STATE_SQL2,
-    present: PRESENT_SQL2,
-    presentPrefix: PRESENT_PREFIX_SQL2,
-    snapshotDigests: SNAPSHOT_DIGESTS_SQL2
-  }
+  statements: PG_FIXED_STATEMENTS
 };
 
 // ../core/src/secret/secretStore.ts
@@ -21222,7 +21968,7 @@ var SecretStoreImpl = class _SecretStoreImpl {
       await this.key(),
       ciphertext
     );
-    return new TextDecoder().decode(plaintext);
+    return new TextDecoder2().decode(plaintext);
   }
 };
 
@@ -21387,7 +22133,7 @@ function guessContentType(path) {
   if (dot < 0) return "text/plain";
   return CONTENT_TYPE_BY_EXT[path.slice(dot + 1).toLowerCase()] ?? "text/plain";
 }
-function clampLimit4(limit) {
+function clampLimit5(limit) {
   if (limit === void 0) return LIST_LIMIT_DEFAULT;
   if (!Number.isInteger(limit) || limit < 1) {
     throw new TBError("invalid_argument", `limit \u975E\u6CD5:${limit}`);
@@ -21442,7 +22188,7 @@ function createSkillhubProvider(store, opts) {
   };
   return {
     async list(listOpts) {
-      const limit = clampLimit4(listOpts?.limit);
+      const limit = clampLimit5(listOpts?.limit);
       const res = await store.list(keyPrefix, {
         delimiter: "/",
         cursor: listOpts?.cursor,
@@ -21502,7 +22248,7 @@ function createSkillhubProvider(store, opts) {
       if (typeof query !== "string" || query === "") {
         throw new TBError("invalid_argument", "query \u4E0D\u80FD\u4E3A\u7A7A");
       }
-      const limit = clampLimit4(searchOpts?.limit);
+      const limit = clampLimit5(searchOpts?.limit);
       const q = query.toLowerCase();
       const after = searchOpts?.cursor;
       const items = [];
@@ -21677,6 +22423,7 @@ function toolToCmd(nodePath, tool, index) {
   if (tool.description !== void 0) {
     cmd.h = index ? summarizeOneLine(tool.description) : tool.description;
   }
+  if (tool.delivery !== void 0) cmd.delivery = tool.delivery;
   if (!index && tool.inputSchema !== void 0) cmd.inputSchema = tool.inputSchema;
   if (!index && tool.outputSchema !== void 0) cmd.outputSchema = tool.outputSchema;
   if (tool.effect !== void 0) cmd.effect = tool.effect;
@@ -21726,7 +22473,7 @@ function rewriteRemotePath(nodePath, requestPath, baseUrl) {
   return rel === "" ? base : `${base}/${rel}`;
 }
 function hostOf(url2) {
-  const m = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)/.exec(url2);
+  const m = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#\\]*)/.exec(url2);
   if (m === null) return void 0;
   let authority = m[1] ?? "";
   const at = authority.lastIndexOf("@");
@@ -21808,7 +22555,7 @@ function resolveUpstreamTool(v, source, virtualName2) {
 }
 
 // ../core/src/tree/registry.ts
-function clampLimit5(limit) {
+function clampLimit6(limit) {
   if (limit === void 0 || limit < 1) return LIST_LIMIT_DEFAULT;
   return limit > LIST_LIMIT_MAX ? LIST_LIMIT_MAX : limit;
 }
@@ -21825,10 +22572,10 @@ function byPath(a, b) {
   return a.path < b.path ? -1 : a.path > b.path ? 1 : 0;
 }
 var NodeRegistryStore = class {
+  store;
   constructor(store) {
     this.store = store;
   }
-  store;
   keyOf(path) {
     return KEY_NODE + path;
   }
@@ -21909,7 +22656,7 @@ var NodeRegistryStore = class {
    */
   async list(prefix, opts) {
     const normPrefix = prefix === void 0 ? "" : canonicalizePath(prefix);
-    const limit = clampLimit5(opts?.limit);
+    const limit = clampLimit6(opts?.limit);
     const all = (await this.scanAll()).filter((n) => isPrefixOf(normPrefix, n.path)).sort(byPath);
     const cursor = opts?.cursor;
     const start = cursor ? all.findIndex((n) => n.path === cursor) + 1 : 0;
@@ -21998,6 +22745,7 @@ var NodeRegistryStore = class {
       description: node.description,
       ...node.config !== void 0 ? { config: node.config } : {},
       ...node.virtualize !== void 0 ? { virtualize: node.virtualize } : {},
+      ...opts.deviceId !== void 0 ? { deviceId: opts.deviceId } : {},
       ...opts.online !== void 0 ? { online: opts.online } : {},
       ...opts.lastSeenAt !== void 0 ? { lastSeenAt: opts.lastSeenAt } : {},
       registeredBy,
@@ -22218,8 +22966,8 @@ function createPlugin(opts = {}) {
     const b64 = raw.replaceAll("-", "+").replaceAll("_", "/");
     const padded = b64.padEnd(b64.length + (4 - b64.length % 4) % 4, "=");
     try {
-      const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-      return new TextDecoder().decode(bytes);
+      const bytes2 = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+      return new TextDecoder().decode(bytes2);
     } catch {
       throw new TBError("invalid_argument", `${HEADER_TB_UPSTREAM_AUTH} is not valid base64url`);
     }
@@ -22481,6 +23229,7 @@ export {
   TBError,
   isTBError,
   normalizePath,
+  assertNoCollision,
   validatePath,
   KEY_SK_HASH,
   KEY_SK_ID,
@@ -22545,6 +23294,7 @@ export {
   pluginTokenSecretName,
   createStoreModule,
   RemoteAllowlistStore,
+  DeviceMailboxService,
   tbErrorBodySchema,
   nodeInputSchema,
   helpJsonSchema,
@@ -22554,6 +23304,16 @@ export {
   toolSearchSourceResultSchema,
   toolSearchPageSchema,
   toolSearchRequestSchema,
+  deviceOperationSummarySchema,
+  deviceOperationDetailSchema,
+  deviceOperationListRequestSchema,
+  deviceOperationListResponseSchema,
+  deviceOperationIdentityRequestSchema,
+  deviceOperationClaimRequestSchema,
+  deviceOperationClaimResponseSchema,
+  deviceOperationRenewRequestSchema,
+  deviceOperationRenewResponseSchema,
+  deviceOperationCompleteRequestSchema,
   registryNodeSchema,
   feedbackViewSchema,
   feedbackDetailSchema,