brepjs-verify 0.4.0 → 0.13.0

package/dist/mcp/server.js

@@ -0,0 +1,489 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import { spawn } from "node:child_process";
+import { appendFile, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { createHash } from "node:crypto";
+//#region src/sandbox/runProgram.ts
+/**
+* Sandbox executor — run agent-authored brepjs TypeScript in an isolated child process.
+*
+* The program is written to a temp ESM directory and executed by the verify CLI in a separate
+* process, with a wall-clock timeout and a memory cap. Out-of-process execution is what makes the
+* loop *unattended-safe*: a runaway (CPU-bound infinite loop) or memory-hungry part is killed
+* rather than hanging or crashing the host. Results cross the boundary as serialized JSON (never
+* live WASM handles), and the temp program directory is always cleaned up.
+*/
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_MEMORY_MB = 2048;
+var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+/**
+* In-flight sandbox process *groups*, keyed by group-leader pid. Tracked so a dying host can reap
+* its runs (see installSandboxShutdownHandlers) — the per-run timeout can't, since its timer dies
+* with the host.
+*/
+var activeGroups = /* @__PURE__ */ new Set();
+/** SIGKILL (or `signal`) an entire detached process group by its leader pid; ignore if already gone. */
+function killGroup(pid, signal) {
+	try {
+		process.kill(process.platform === "win32" ? pid : -pid, signal);
+	} catch {}
+}
+/**
+* Clamp a caller-supplied limit to a positive, finite value, falling back to the default otherwise.
+* Critical for the timeout: Node's `execFile` treats `timeout: 0` (and it ignores negatives) as
+* "no timeout", which would silently disable the sandbox's only runaway protection.
+*/
+function positiveOrDefault(value, fallback) {
+	return value !== void 0 && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function defaultCliEntry() {
+	const builtJs = fileURLToPath(new URL("data:video/mp2t;base64,IyEvdXNyL2Jpbi9lbnYgbm9kZQppbXBvcnQgeyBDb21tYW5kIH0gZnJvbSAnY29tbWFuZGVyJzsKaW1wb3J0IHsgd3JpdGVGaWxlU3luYywgd2F0Y2ggYXMgZnNXYXRjaCwgcmVhbHBhdGhTeW5jIH0gZnJvbSAnbm9kZTpmcyc7CmltcG9ydCB7IHJlc29sdmUsIGpvaW4sIGJhc2VuYW1lLCBkaXJuYW1lIH0gZnJvbSAnbm9kZTpwYXRoJzsKaW1wb3J0IHsgdG1wZGlyIH0gZnJvbSAnbm9kZTpvcyc7CmltcG9ydCB7IGZpbGVVUkxUb1BhdGggfSBmcm9tICdub2RlOnVybCc7CmltcG9ydCB7IHJ1blBhcnQgfSBmcm9tICcuLi92ZXJpZnkvcnVuUGFydC5qcyc7CmltcG9ydCB7IHB1c2hFcnJvciwgcmVwb3J0T2ssIHNlcmlhbGl6ZVJlcG9ydCB9IGZyb20gJy4uL3ZlcmlmeS9yZXBvcnQuanMnOwppbXBvcnQgeyBydW5NZWFzdXJlIH0gZnJvbSAnLi4vdmVyaWZ5L21lYXN1cmUuanMnOwppbXBvcnQgeyBydW5EaWZmIH0gZnJvbSAnLi4vdmVyaWZ5L2RpZmYuanMnOwppbXBvcnQgeyBzY2FmZm9sZFBhcnQgfSBmcm9tICcuL3NjYWZmb2xkLmpzJzsKaW1wb3J0IHsgZGVib3VuY2UsIERFRkFVTFRfREVCT1VOQ0VfTVMgfSBmcm9tICcuL3dhdGNoLmpzJzsKaW1wb3J0IHsgZXhwb3J0UGFydCB9IGZyb20gJy4vZXhwb3J0UGFydC5qcyc7CmltcG9ydCB7IG9wZW5Ccm93c2VyLCBzaG91bGRBdXRvT3BlbiB9IGZyb20gJy4vb3BlbkJyb3dzZXIuanMnOwppbXBvcnQgeyBkaXNwb3NlU2hhcGUgfSBmcm9tICcuLi9kaXNwb3NlU2hhcGUuanMnOwppbXBvcnQgdHlwZSB7IHNob290IGFzIFNob290Rm4gfSBmcm9tICcuLi9zbmFwc2hvdC9zaG9vdC5qcyc7CgovLyBPQ0NUJ3MgV0FTTSBTVEVQIHdyaXRlciBlbWl0cyBhICJTdGF0aXN0aWNzIG9uIFRyYW5zZmVyIiBiYW5uZXIgdmlhIGNvbnNvbGUubG9nCi8vIChFbXNjcmlwdGVuJ3MgZGVmYXVsdCBzdGRvdXQgc2luaykuIFRoZSBDTEkgb3ducyBzdGRvdXQgZm9yIG1hY2hpbmUtcmVhZGFibGUgSlNPTiwKLy8gc28gZGl2ZXJ0IHRoYXQga2VybmVsIGNoYXR0ZXIgdG8gc3RkZXJyIHRvIGtlZXAgc3Rkb3V0IGEgc2luZ2xlIGNsZWFuIEpTT04gZG9jdW1lbnQuCi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBuby1jb25zb2xlIC0tIHJlcm91dGUga2VybmVsIHN0ZG91dCBjaGF0dGVyIG9mZiB0aGUgSlNPTiBjaGFubmVsCmNvbnNvbGUubG9nID0gKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gewogIHByb2Nlc3Muc3RkZXJyLndyaXRlKGFyZ3MubWFwKFN0cmluZykuam9pbignICcpICsgJ1xuJyk7Cn07CgpleHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9hZFNuYXBzaG90U2hvb3QoKTogUHJvbWlzZTx0eXBlb2YgU2hvb3RGbiB8IHVuZGVmaW5lZD4gewogIHRyeSB7CiAgICBjb25zdCBtb2QgPSBhd2FpdCBpbXBvcnQoJy4uL3NuYXBzaG90L3Nob290LmpzJyk7CiAgICByZXR1cm4gbW9kLnNob290OwogIH0gY2F0Y2ggewogICAgcHJvY2Vzcy5zdGRlcnIud3JpdGUoJ3NuYXBzaG90cyBuZWVkIHB1cHBldGVlci9DaHJvbWUg4oCUIHJ1bjogbnBtIGkgcHVwcGV0ZWVyXG4nKTsKICAgIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogICAgcmV0dXJuIHVuZGVmaW5lZDsKICB9Cn0KCmNvbnN0IHByb2dyYW0gPSBuZXcgQ29tbWFuZCgpOwpwcm9ncmFtLm5hbWUoJ2JyZXBqcy12ZXJpZnknKTsKCnByb2dyYW0KICAuY29tbWFuZCgndmVyaWZ5JywgeyBpc0RlZmF1bHQ6IHRydWUgfSkKICAuYXJndW1lbnQoJzxmaWxlPicsICdwYXRoIHRvIGEgLmJyZXAudHMgbW9kdWxlIHdpdGggYSBkZWZhdWx0LWV4cG9ydGVkIHBhcnQgZnVuY3Rpb24nKQogIC5vcHRpb24oJy0tc3RlcCA8b3V0PicsICd3cml0ZSB0aGUgcHJpbWFyeSBTVEVQIGFydGlmYWN0IHRvIHRoaXMgcGF0aCcpCiAgLm9wdGlvbignLS1nbGIgPG91dD4nLCAnd3JpdGUgYSBkZXJpdmVkIEdMQiBwcmV2aWV3IHRvIHRoaXMgcGF0aCcpCiAgLm9wdGlvbignLS1qc29uIDxvdXQ+JywgJ3dyaXRlIHRoZSBKU09OIHJlcG9ydCB0byB0aGlzIHBhdGgnKQogIC5vcHRpb24oCiAgICAnLS1jaGVjaycsCiAgICAndHlwZS1jaGVjayB0aGUgcGFydCAoYWdhaW5zdCBicmVwanMgdHlwZXMpIGJlZm9yZSBydW5uaW5nOyBza2lwIGV4ZWN1dGlvbiBvbiB0eXBlIGVycm9ycycKICApCiAgLm9wdGlvbignLS1zbmFwc2hvdCA8ZGlyPicsICdyZW5kZXIgaXNvL2Zyb250L3RvcC9yaWdodCBQTkdzIHRvIHRoaXMgZGlyIChyZXF1aXJlcyBidWlsdCB2aWV3ZXIpJykKICAub3B0aW9uKAogICAgJy0tc2VydmUnLAogICAgJ2FmdGVyIHZlcmlmeWluZywgc3RhcnQgYSBwcmV2aWV3IHNlcnZlciBhbmQgcHJpbnQgYSA/ZGlyPSZmaWxlPSBkZWVwIGxpbmsgKHN0YXlzIHJ1bm5pbmcpJwogICkKICAub3B0aW9uKCctLW5vLW9wZW4nLCAnd2l0aCAtLXNlcnZlLCBkbyBub3QgYXV0by1vcGVuIHRoZSBicm93c2VyIChqdXN0IHByaW50IHRoZSB2aWV3ZXIgVVJMKScpCiAgLmFjdGlvbigKICAgIGFzeW5jICgKICAgICAgZmlsZTogc3RyaW5nLAogICAgICBvcHRzOiB7CiAgICAgICAgc3RlcD86IHN0cmluZzsKICAgICAgICBnbGI/OiBzdHJpbmc7CiAgICAgICAganNvbj86IHN0cmluZzsKICAgICAgICBjaGVjaz86IGJvb2xlYW47CiAgICAgICAgc25hcHNob3Q/OiBzdHJpbmc7CiAgICAgICAgc2VydmU/OiBib29sZWFuOwogICAgICAgIC8vIENvbW1hbmRlciBtYXRlcmlhbGl6ZXMgYSBuZWdhdGVkIGZsYWcgYXMgYSBjb25jcmV0ZSBib29sZWFuOiB0cnVlIGJ5CiAgICAgICAgLy8gZGVmYXVsdCwgZmFsc2Ugd2hlbiAtLW5vLW9wZW4gaXMgcGFzc2VkLgogICAgICAgIG9wZW46IGJvb2xlYW47CiAgICAgIH0KICAgICkgPT4gewogICAgICAvLyBUaGUgV0FTTSB2aWV3ZXIgbG9hZHMgYSBDQUQgZmlsZSAoaXQgY2FuJ3QgcnVuIGEgLmJyZXAudHMpLCBzbyAtLXNuYXBzaG90Ly0tc2VydmUKICAgICAgLy8gc3RhZ2UgdGhlIHByaW1hcnkgU1RFUCBhbmQgcG9pbnQgdGhlIHZpZXdlciBhdCBpdCB2aWEgP2Rpcj0mZmlsZT0uIC0tZ2xiIGlzIGl0cyBvd24gYXJ0aWZhY3QuCiAgICAgIGNvbnN0IHdhbnRTdGVwID0gQm9vbGVhbihvcHRzLnN0ZXApIHx8IEJvb2xlYW4ob3B0cy5zbmFwc2hvdCkgfHwgQm9vbGVhbihvcHRzLnNlcnZlKTsKICAgICAgY29uc3QgeyByZXBvcnQsIHN0ZXAsIGdsYiwgc2hhcGUgfSA9IGF3YWl0IHJ1blBhcnQocmVzb2x2ZShmaWxlKSwgewogICAgICAgIHN0ZXA6IHdhbnRTdGVwLAogICAgICAgIGdsYjogQm9vbGVhbihvcHRzLmdsYiksCiAgICAgICAgY2hlY2s6IEJvb2xlYW4ob3B0cy5jaGVjayksCiAgICAgIH0pOwogICAgICBsZXQgc3RlcFBhdGg6IHN0cmluZyB8IHVuZGVmaW5lZCA9IG9wdHMuc3RlcDsKICAgICAgdHJ5IHsKICAgICAgICBpZiAob3B0cy5nbGIgJiYgZ2xiKSB3cml0ZUZpbGVTeW5jKG9wdHMuZ2xiLCBCdWZmZXIuZnJvbShnbGIpKTsKCiAgICAgICAgaWYgKHdhbnRTdGVwICYmIHN0ZXApIHsKICAgICAgICAgIHN0ZXBQYXRoID0gb3B0cy5zdGVwID8/IGpvaW4odG1wZGlyKCksIGBicmVwanMtdmVyaWZ5LSR7YmFzZW5hbWUoZmlsZSl9LnN0ZXBgKTsKICAgICAgICAgIHdyaXRlRmlsZVN5bmMoc3RlcFBhdGgsIEJ1ZmZlci5mcm9tKHN0ZXApKTsKICAgICAgICB9CiAgICAgICAgaWYgKG9wdHMuc25hcHNob3QgJiYgc3RlcFBhdGgpIHsKICAgICAgICAgIGNvbnN0IHNob290ID0gYXdhaXQgbG9hZFNuYXBzaG90U2hvb3QoKTsgLy8gbGF6eToga2VlcHMgcHVwcGV0ZWVyIG9mZiB0aGUgZGVmYXVsdCBwYXRoCiAgICAgICAgICBpZiAoc2hvb3QpIHsKICAgICAgICAgICAgY29uc3QgeyBwbmdzIH0gPSBhd2FpdCBzaG9vdCh7IGZpbGU6IHN0ZXBQYXRoLCBvdXREaXI6IG9wdHMuc25hcHNob3QgfSk7CiAgICAgICAgICAgIC8vIERpYWdub3N0aWMgcGF0aHMgZ28gdG8gc3RkZXJyIOKAlCBzdGRvdXQgc3RheXMgYSBzaW5nbGUgY2xlYW4gSlNPTiBkb2N1bWVudC4KICAgICAgICAgICAgZm9yIChjb25zdCBwIG9mIHBuZ3MpIHByb2Nlc3Muc3RkZXJyLndyaXRlKGBzbmFwc2hvdDogJHtwfVxuYCk7CiAgICAgICAgICB9CiAgICAgICAgfSBlbHNlIGlmIChvcHRzLnNuYXBzaG90KSB7CiAgICAgICAgICBwcm9jZXNzLnN0ZGVyci53cml0ZSgnc25hcHNob3Qgc2tpcHBlZDogU1RFUCBleHBvcnQgcHJvZHVjZWQgbm8gYXJ0aWZhY3RcbicpOwogICAgICAgIH0KICAgICAgfSBjYXRjaCAoZSkgewogICAgICAgIHB1c2hFcnJvcihyZXBvcnQsIHsgbWVzc2FnZTogYGFydGlmYWN0IHdyaXRlIGZhaWxlZDogJHsoZSBhcyBFcnJvcikubWVzc2FnZX1gIH0pOwogICAgICB9IGZpbmFsbHkgewogICAgICAgIC8vIFRoZSBzaGFwZSBpcyBhIGxpdmUgV0FTTSBoYW5kbGU7IHJlbGVhc2UgaXQgYmVmb3JlIHRoZSBzZXJ2ZXIgdGFrZXMgb3ZlciAodGhlCiAgICAgICAgLy8gLS1zZXJ2ZSBwYXRoIHN0YXlzIHJ1bm5pbmcsIHNvIGxlYWtpbmcgaGVyZSB3b3VsZCBwZXJzaXN0IGZvciB0aGUgc2VydmVyJ3MgbGlmZXRpbWUpLgogICAgICAgIGRpc3Bvc2VTaGFwZShzaGFwZSk7CiAgICAgIH0KICAgICAgLy8gU2VyaWFsaXplIG9uY2UgYWZ0ZXIgYWxsIGFydGlmYWN0IHdyaXRlcyBzbyB0aGUgLS1qc29uIGZpbGUgYW5kIHN0ZG91dAogICAgICAvLyByZWZsZWN0IHRoZSBzYW1lIHJlcG9ydCAoaW5jbC4gYW55ICJhcnRpZmFjdCB3cml0ZSBmYWlsZWQiIGVycm9yKS4KICAgICAgY29uc3QganNvbiA9IHNlcmlhbGl6ZVJlcG9ydChyZXBvcnQpOwogICAgICBpZiAob3B0cy5qc29uKSB3cml0ZUZpbGVTeW5jKG9wdHMuanNvbiwganNvbik7CiAgICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKGpzb24gKyAnXG4nKTsKICAgICAgaWYgKCFyZXBvcnRPayhyZXBvcnQpKSBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgICAgY29uc3Qgd2lsbFNlcnZlID0gQm9vbGVhbihvcHRzLnNlcnZlKSAmJiBzdGVwUGF0aCAhPT0gdW5kZWZpbmVkICYmIHJlcG9ydE9rKHJlcG9ydCk7CiAgICAgIGlmICh3aWxsU2VydmUgJiYgc3RlcFBhdGgpIHsKICAgICAgICBjb25zdCB7IHNlcnZlIH0gPSBhd2FpdCBpbXBvcnQoJy4uL3NuYXBzaG90L3NlcnZlLmpzJyk7IC8vIGxhenk6IG5vIHNlcnZlciBkZXBzIG9uIHRoZSBkZWZhdWx0IHBhdGgKICAgICAgICBjb25zdCB7IHVybCwgcmV1c2VkIH0gPSBhd2FpdCBzZXJ2ZSh7IGZpbGU6IHN0ZXBQYXRoIH0pOyAvLyBidWlsZHMgYSA/ZGlyPSZmaWxlPSBVUkw7IHNlcnZlciBydW5zIHVudGlsIEN0cmwtQwogICAgICAgIHByb2Nlc3Muc3RkZXJyLndyaXRlKGB2aWV3ZXI6ICR7dXJsfVxuYCk7CiAgICAgICAgLy8gQXV0by1vcGVuIG9ubHkgZm9yIGEgZnJlc2hseSBzdGFydGVkIHNlcnZlciAoYSByZXVzZWQgb25lIGFscmVhZHkgaGFzCiAgICAgICAgLy8gYSB0YWIpIGluIGFuIGludGVyYWN0aXZlIHNlc3Npb247IGAtLW5vLW9wZW5gIChvcHRzLm9wZW4gPT09IGZhbHNlKQogICAgICAgIC8vIGFsd2F5cyBzdXBwcmVzc2VzIGl0LgogICAgICAgIGlmICghcmV1c2VkICYmIG9wdHMub3BlbiAmJiBzaG91bGRBdXRvT3BlbigpKSB7CiAgICAgICAgICBvcGVuQnJvd3Nlcih1cmwpOwogICAgICAgIH0KICAgICAgfQogICAgfQogICk7Cgpwcm9ncmFtCiAgLmNvbW1hbmQoJ21lYXN1cmUnKQogIC5hcmd1bWVudCgnPGE+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGUnKQogIC5hcmd1bWVudCgnW2JdJywgJ29wdGlvbmFsIHNlY29uZCBtb2R1bGU7IGlmIGdpdmVuLCBtZWFzdXJlcyBkaXN0YW5jZSBiZXR3ZWVuIHRoZSB0d28gcGFydHMnKQogIC5hY3Rpb24oYXN5bmMgKGE6IHN0cmluZywgYj86IHN0cmluZykgPT4gewogICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgcnVuTWVhc3VyZShyZXNvbHZlKGEpLCBiID09PSB1bmRlZmluZWQgPyB1bmRlZmluZWQgOiByZXNvbHZlKGIpKTsKICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICBKU09OLnN0cmluZ2lmeSh7IG9rOiByZXN1bHQuZXJyb3JzLmxlbmd0aCA9PT0gMCwgLi4ucmVzdWx0IH0sIG51bGwsIDIpICsgJ1xuJwogICAgKTsKICAgIGlmIChyZXN1bHQuZXJyb3JzLmxlbmd0aCA+IDApIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdkaWZmJykKICAuYXJndW1lbnQoJzxhPicsICdwYXRoIHRvIHRoZSBiYXNlbGluZSAuYnJlcC50cyBtb2R1bGUnKQogIC5hcmd1bWVudCgnPGI+JywgJ3BhdGggdG8gdGhlIGNvbXBhcmlzb24gLmJyZXAudHMgbW9kdWxlJykKICAuYWN0aW9uKGFzeW5jIChhOiBzdHJpbmcsIGI6IHN0cmluZykgPT4gewogICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgcnVuRGlmZihyZXNvbHZlKGEpLCByZXNvbHZlKGIpKTsKICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICBKU09OLnN0cmluZ2lmeSh7IG9rOiByZXN1bHQuZXJyb3JzLmxlbmd0aCA9PT0gMCwgLi4ucmVzdWx0IH0sIG51bGwsIDIpICsgJ1xuJwogICAgKTsKICAgIGlmIChyZXN1bHQuZXJyb3JzLmxlbmd0aCA+IDApIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdpbml0JykKICAuYXJndW1lbnQoJzxuYW1lPicsICdwYXJ0IG5hbWU7IHNjYWZmb2xkcyA8bmFtZT4uYnJlcC50cyArIHRzY29uZmlnLmpzb24gKyBSRUFETUUubWQnKQogIC5vcHRpb24oJy0tb3V0IDxkaXI+JywgJ3RhcmdldCBkaXJlY3RvcnkgKGRlZmF1bHRzIHRvIC4vPG5hbWU+KScpCiAgLmFjdGlvbigobmFtZTogc3RyaW5nLCBvcHRzOiB7IG91dD86IHN0cmluZyB9KSA9PiB7CiAgICBjb25zdCBkaXIgPSByZXNvbHZlKG9wdHMub3V0ID8/IG5hbWUpOwogICAgY29uc3QgcmVzdWx0ID0gc2NhZmZvbGRQYXJ0KG5hbWUsIGRpcik7CiAgICBmb3IgKGNvbnN0IGYgb2YgcmVzdWx0LmZpbGVzKSB7CiAgICAgIGNvbnN0IHRhZyA9IGYuY3JlYXRlZCA/ICdjcmVhdGVkJyA6ICdleGlzdHMgKGtlcHQpJzsKICAgICAgcHJvY2Vzcy5zdGRlcnIud3JpdGUoYCR7dGFnfTogJHtmLnBhdGh9XG5gKTsKICAgIH0KICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKEpTT04uc3RyaW5naWZ5KHJlc3VsdCwgbnVsbCwgMikgKyAnXG4nKTsKICB9KTsKCnByb2dyYW0KICAuY29tbWFuZCgnd2F0Y2gnKQogIC5hcmd1bWVudCgnPGZpbGU+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGU7IHJlLXZlcmlmaWVzIG9uIGVhY2ggc2F2ZSB1bnRpbCBDdHJsLUMnKQogIC5hY3Rpb24oKGZpbGU6IHN0cmluZykgPT4gewogICAgY29uc3QgcGF0aCA9IHJlc29sdmUoZmlsZSk7CiAgICBjb25zdCBydW4gPSBhc3luYyAoKSA9PiB7CiAgICAgIHRyeSB7CiAgICAgICAgY29uc3QgeyByZXBvcnQsIHNoYXBlIH0gPSBhd2FpdCBydW5QYXJ0KHBhdGgpOwogICAgICAgIHRyeSB7CiAgICAgICAgICBwcm9jZXNzLnN0ZG91dC53cml0ZShzZXJpYWxpemVSZXBvcnQocmVwb3J0KSArICdcbicpOwogICAgICAgIH0gZmluYWxseSB7CiAgICAgICAgICBkaXNwb3NlU2hhcGUoc2hhcGUpOyAvLyBsaXZlIFdBU00gaGFuZGxlOyB0aGUgbG9vcCBydW5zIGluZGVmaW5pdGVseQogICAgICAgIH0KICAgICAgfSBjYXRjaCAoZSkgewogICAgICAgIHByb2Nlc3Muc3RkZXJyLndyaXRlKGB3YXRjaCBydW4gZmFpbGVkOiAkeyhlIGFzIEVycm9yKS5tZXNzYWdlfVxuYCk7CiAgICAgIH0KICAgIH07CiAgICBjb25zdCB7IHRyaWdnZXIgfSA9IGRlYm91bmNlKHJ1biwgREVGQVVMVF9ERUJPVU5DRV9NUyk7CiAgICBwcm9jZXNzLnN0ZGVyci53cml0ZShgd2F0Y2hpbmcgJHtwYXRofSAoQ3RybC1DIHRvIHN0b3ApXG5gKTsKICAgIHZvaWQgcnVuKCk7IC8vIGluaXRpYWwgdmVyaWZ5CiAgICAvLyBXYXRjaCB0aGUgcGFyZW50IGRpcjogZWRpdG9ycyBvZnRlbiByZXBsYWNlIHRoZSBmaWxlIChyZW5hbWUpIG9uIHNhdmUsCiAgICAvLyB3aGljaCBkcm9wcyBhIHdhdGNoZXIgYm91bmQgdG8gdGhlIGZpbGUgaW5vZGUgaXRzZWxmLgogICAgY29uc3Qgd2F0Y2hlciA9IGZzV2F0Y2goZGlybmFtZShwYXRoKSwgKF9ldmVudCwgZmlsZW5hbWUpID0+IHsKICAgICAgaWYgKGZpbGVuYW1lID09PSB1bmRlZmluZWQgfHwgZmlsZW5hbWUgPT09IG51bGwpIHsKICAgICAgICB0cmlnZ2VyKCk7CiAgICAgICAgcmV0dXJuOwogICAgICB9CiAgICAgIGlmIChiYXNlbmFtZShwYXRoKSA9PT0gZmlsZW5hbWUudG9TdHJpbmcoKSkgdHJpZ2dlcigpOwogICAgfSk7CiAgICBjb25zdCBzdG9wID0gKCkgPT4gewogICAgICB3YXRjaGVyLmNsb3NlKCk7CiAgICAgIHByb2Nlc3MuZXhpdCgwKTsKICAgIH07CiAgICBwcm9jZXNzLm9uKCdTSUdJTlQnLCBzdG9wKTsKICAgIHByb2Nlc3Mub24oJ1NJR1RFUk0nLCBzdG9wKTsgLy8gc3VwZXJ2aXNvcnMgKGRvY2tlciBzdG9wLCBzeXN0ZW1jdGwpIHNlbmQgU0lHVEVSTQogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdleHBvcnQnKQogIC5hcmd1bWVudCgnPGZpbGU+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGUnKQogIC5vcHRpb24oJy0tc3RlcCcsICd3cml0ZSBhIFNURVAgYXJ0aWZhY3QnKQogIC5vcHRpb24oJy0tZ2xiJywgJ3dyaXRlIGEgR0xCIGFydGlmYWN0JykKICAub3B0aW9uKCctLXN0bCcsICd3cml0ZSBhbiBTVEwgYXJ0aWZhY3QnKQogIC5vcHRpb24oJy0tYWxsJywgJ3dyaXRlIFNURVAgKyBHTEIgKyBTVEwnKQogIC5vcHRpb24oJy0tb3V0IDxkaXI+JywgJ291dHB1dCBkaXJlY3RvcnknLCAnLicpCiAgLmFjdGlvbigKICAgIGFzeW5jICgKICAgICAgZmlsZTogc3RyaW5nLAogICAgICBvcHRzOiB7IHN0ZXA/OiBib29sZWFuOyBnbGI/OiBib29sZWFuOyBzdGw/OiBib29sZWFuOyBhbGw/OiBib29sZWFuOyBvdXQ6IHN0cmluZyB9CiAgICApID0+IHsKICAgICAgY29uc3QgZm9ybWF0cyA9IG9wdHMuYWxsCiAgICAgICAgPyB7IHN0ZXA6IHRydWUsIGdsYjogdHJ1ZSwgc3RsOiB0cnVlIH0KICAgICAgICA6IHsgc3RlcDogQm9vbGVhbihvcHRzLnN0ZXApLCBnbGI6IEJvb2xlYW4ob3B0cy5nbGIpLCBzdGw6IEJvb2xlYW4ob3B0cy5zdGwpIH07CiAgICAgIGlmICghZm9ybWF0cy5zdGVwICYmICFmb3JtYXRzLmdsYiAmJiAhZm9ybWF0cy5zdGwpIHsKICAgICAgICBwcm9jZXNzLnN0ZGVyci53cml0ZSgnbm8gZm9ybWF0cyByZXF1ZXN0ZWQg4oCUIHBhc3MgLS1zdGVwLy0tZ2xiLy0tc3RsIG9yIC0tYWxsXG4nKTsKICAgICAgICBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgICAgICByZXR1cm47CiAgICAgIH0KICAgICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgZXhwb3J0UGFydChyZXNvbHZlKGZpbGUpLCBmb3JtYXRzLCByZXNvbHZlKG9wdHMub3V0KSk7CiAgICAgIGZvciAoY29uc3QgcCBvZiByZXN1bHQud3JpdHRlbikgcHJvY2Vzcy5zdGRlcnIud3JpdGUoYHdyb3RlOiAke3B9XG5gKTsKICAgICAgZm9yIChjb25zdCBlIG9mIHJlc3VsdC5lcnJvcnMpIHByb2Nlc3Muc3RkZXJyLndyaXRlKGBlcnJvcjogJHtlfVxuYCk7CiAgICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICAgIEpTT04uc3RyaW5naWZ5KHsgb2s6IHJlc3VsdC5vaywgd3JpdHRlbjogcmVzdWx0LndyaXR0ZW4sIGVycm9yczogcmVzdWx0LmVycm9ycyB9LCBudWxsLCAyKSArCiAgICAgICAgICAnXG4nCiAgICAgICk7CiAgICAgIGlmICghcmVzdWx0Lm9rKSBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgIH0KICApOwoKLy8gT25seSBkcml2ZSB0aGUgQ0xJIHdoZW4gcnVuIGFzIHRoZSBlbnRyeSBzY3JpcHQsIHNvIHRlc3RzIGNhbiBpbXBvcnQgdGhlCi8vIGd1YXJkZWQgbG9hZGVycyB3aXRob3V0IGNvbW1hbmRlciBwYXJzaW5nIHRoZSB0ZXN0IHJ1bm5lcidzIGFyZ3YuCi8vIFJlc29sdmUgc3ltbGlua3Mgb24gYm90aCBzaWRlczogdGhlIG5wbS1pbnN0YWxsZWQgYmluIChub2RlX21vZHVsZXMvLmJpbi9icmVwanMpCi8vIGlzIGEgc3ltbGluaywgc28gcHJvY2Vzcy5hcmd2WzFdIHdvdWxkIG90aGVyd2lzZSBuZXZlciBlcXVhbCB0aGUgcmVhbCBtb2R1bGUgcGF0aC4KZXhwb3J0IGZ1bmN0aW9uIGlzRW50cnlwb2ludChhcmd2MTogc3RyaW5nIHwgdW5kZWZpbmVkLCBtb2R1bGVVcmw6IHN0cmluZyk6IGJvb2xlYW4gewogIGlmICghYXJndjEpIHJldHVybiBmYWxzZTsKICB0cnkgewogICAgcmV0dXJuIHJlYWxwYXRoU3luYyhhcmd2MSkgPT09IHJlYWxwYXRoU3luYyhmaWxlVVJMVG9QYXRoKG1vZHVsZVVybCkpOwogIH0gY2F0Y2ggewogICAgcmV0dXJuIGZhbHNlOwogIH0KfQoKaWYgKGlzRW50cnlwb2ludChwcm9jZXNzLmFyZ3ZbMV0sIGltcG9ydC5tZXRhLnVybCkpIHsKICB2b2lkIHByb2dyYW0ucGFyc2VBc3luYygpOwp9Cg==", "" + import.meta.url));
+	if (existsSync(builtJs)) return builtJs;
+	return fileURLToPath(new URL("data:video/mp2t;base64,IyEvdXNyL2Jpbi9lbnYgbm9kZQppbXBvcnQgeyBDb21tYW5kIH0gZnJvbSAnY29tbWFuZGVyJzsKaW1wb3J0IHsgd3JpdGVGaWxlU3luYywgd2F0Y2ggYXMgZnNXYXRjaCwgcmVhbHBhdGhTeW5jIH0gZnJvbSAnbm9kZTpmcyc7CmltcG9ydCB7IHJlc29sdmUsIGpvaW4sIGJhc2VuYW1lLCBkaXJuYW1lIH0gZnJvbSAnbm9kZTpwYXRoJzsKaW1wb3J0IHsgdG1wZGlyIH0gZnJvbSAnbm9kZTpvcyc7CmltcG9ydCB7IGZpbGVVUkxUb1BhdGggfSBmcm9tICdub2RlOnVybCc7CmltcG9ydCB7IHJ1blBhcnQgfSBmcm9tICcuLi92ZXJpZnkvcnVuUGFydC5qcyc7CmltcG9ydCB7IHB1c2hFcnJvciwgcmVwb3J0T2ssIHNlcmlhbGl6ZVJlcG9ydCB9IGZyb20gJy4uL3ZlcmlmeS9yZXBvcnQuanMnOwppbXBvcnQgeyBydW5NZWFzdXJlIH0gZnJvbSAnLi4vdmVyaWZ5L21lYXN1cmUuanMnOwppbXBvcnQgeyBydW5EaWZmIH0gZnJvbSAnLi4vdmVyaWZ5L2RpZmYuanMnOwppbXBvcnQgeyBzY2FmZm9sZFBhcnQgfSBmcm9tICcuL3NjYWZmb2xkLmpzJzsKaW1wb3J0IHsgZGVib3VuY2UsIERFRkFVTFRfREVCT1VOQ0VfTVMgfSBmcm9tICcuL3dhdGNoLmpzJzsKaW1wb3J0IHsgZXhwb3J0UGFydCB9IGZyb20gJy4vZXhwb3J0UGFydC5qcyc7CmltcG9ydCB7IG9wZW5Ccm93c2VyLCBzaG91bGRBdXRvT3BlbiB9IGZyb20gJy4vb3BlbkJyb3dzZXIuanMnOwppbXBvcnQgeyBkaXNwb3NlU2hhcGUgfSBmcm9tICcuLi9kaXNwb3NlU2hhcGUuanMnOwppbXBvcnQgdHlwZSB7IHNob290IGFzIFNob290Rm4gfSBmcm9tICcuLi9zbmFwc2hvdC9zaG9vdC5qcyc7CgovLyBPQ0NUJ3MgV0FTTSBTVEVQIHdyaXRlciBlbWl0cyBhICJTdGF0aXN0aWNzIG9uIFRyYW5zZmVyIiBiYW5uZXIgdmlhIGNvbnNvbGUubG9nCi8vIChFbXNjcmlwdGVuJ3MgZGVmYXVsdCBzdGRvdXQgc2luaykuIFRoZSBDTEkgb3ducyBzdGRvdXQgZm9yIG1hY2hpbmUtcmVhZGFibGUgSlNPTiwKLy8gc28gZGl2ZXJ0IHRoYXQga2VybmVsIGNoYXR0ZXIgdG8gc3RkZXJyIHRvIGtlZXAgc3Rkb3V0IGEgc2luZ2xlIGNsZWFuIEpTT04gZG9jdW1lbnQuCi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBuby1jb25zb2xlIC0tIHJlcm91dGUga2VybmVsIHN0ZG91dCBjaGF0dGVyIG9mZiB0aGUgSlNPTiBjaGFubmVsCmNvbnNvbGUubG9nID0gKC4uLmFyZ3M6IHVua25vd25bXSkgPT4gewogIHByb2Nlc3Muc3RkZXJyLndyaXRlKGFyZ3MubWFwKFN0cmluZykuam9pbignICcpICsgJ1xuJyk7Cn07CgpleHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9hZFNuYXBzaG90U2hvb3QoKTogUHJvbWlzZTx0eXBlb2YgU2hvb3RGbiB8IHVuZGVmaW5lZD4gewogIHRyeSB7CiAgICBjb25zdCBtb2QgPSBhd2FpdCBpbXBvcnQoJy4uL3NuYXBzaG90L3Nob290LmpzJyk7CiAgICByZXR1cm4gbW9kLnNob290OwogIH0gY2F0Y2ggewogICAgcHJvY2Vzcy5zdGRlcnIud3JpdGUoJ3NuYXBzaG90cyBuZWVkIHB1cHBldGVlci9DaHJvbWUg4oCUIHJ1bjogbnBtIGkgcHVwcGV0ZWVyXG4nKTsKICAgIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogICAgcmV0dXJuIHVuZGVmaW5lZDsKICB9Cn0KCmNvbnN0IHByb2dyYW0gPSBuZXcgQ29tbWFuZCgpOwpwcm9ncmFtLm5hbWUoJ2JyZXBqcy12ZXJpZnknKTsKCnByb2dyYW0KICAuY29tbWFuZCgndmVyaWZ5JywgeyBpc0RlZmF1bHQ6IHRydWUgfSkKICAuYXJndW1lbnQoJzxmaWxlPicsICdwYXRoIHRvIGEgLmJyZXAudHMgbW9kdWxlIHdpdGggYSBkZWZhdWx0LWV4cG9ydGVkIHBhcnQgZnVuY3Rpb24nKQogIC5vcHRpb24oJy0tc3RlcCA8b3V0PicsICd3cml0ZSB0aGUgcHJpbWFyeSBTVEVQIGFydGlmYWN0IHRvIHRoaXMgcGF0aCcpCiAgLm9wdGlvbignLS1nbGIgPG91dD4nLCAnd3JpdGUgYSBkZXJpdmVkIEdMQiBwcmV2aWV3IHRvIHRoaXMgcGF0aCcpCiAgLm9wdGlvbignLS1qc29uIDxvdXQ+JywgJ3dyaXRlIHRoZSBKU09OIHJlcG9ydCB0byB0aGlzIHBhdGgnKQogIC5vcHRpb24oCiAgICAnLS1jaGVjaycsCiAgICAndHlwZS1jaGVjayB0aGUgcGFydCAoYWdhaW5zdCBicmVwanMgdHlwZXMpIGJlZm9yZSBydW5uaW5nOyBza2lwIGV4ZWN1dGlvbiBvbiB0eXBlIGVycm9ycycKICApCiAgLm9wdGlvbignLS1zbmFwc2hvdCA8ZGlyPicsICdyZW5kZXIgaXNvL2Zyb250L3RvcC9yaWdodCBQTkdzIHRvIHRoaXMgZGlyIChyZXF1aXJlcyBidWlsdCB2aWV3ZXIpJykKICAub3B0aW9uKAogICAgJy0tc2VydmUnLAogICAgJ2FmdGVyIHZlcmlmeWluZywgc3RhcnQgYSBwcmV2aWV3IHNlcnZlciBhbmQgcHJpbnQgYSA/ZGlyPSZmaWxlPSBkZWVwIGxpbmsgKHN0YXlzIHJ1bm5pbmcpJwogICkKICAub3B0aW9uKCctLW5vLW9wZW4nLCAnd2l0aCAtLXNlcnZlLCBkbyBub3QgYXV0by1vcGVuIHRoZSBicm93c2VyIChqdXN0IHByaW50IHRoZSB2aWV3ZXIgVVJMKScpCiAgLmFjdGlvbigKICAgIGFzeW5jICgKICAgICAgZmlsZTogc3RyaW5nLAogICAgICBvcHRzOiB7CiAgICAgICAgc3RlcD86IHN0cmluZzsKICAgICAgICBnbGI/OiBzdHJpbmc7CiAgICAgICAganNvbj86IHN0cmluZzsKICAgICAgICBjaGVjaz86IGJvb2xlYW47CiAgICAgICAgc25hcHNob3Q/OiBzdHJpbmc7CiAgICAgICAgc2VydmU/OiBib29sZWFuOwogICAgICAgIC8vIENvbW1hbmRlciBtYXRlcmlhbGl6ZXMgYSBuZWdhdGVkIGZsYWcgYXMgYSBjb25jcmV0ZSBib29sZWFuOiB0cnVlIGJ5CiAgICAgICAgLy8gZGVmYXVsdCwgZmFsc2Ugd2hlbiAtLW5vLW9wZW4gaXMgcGFzc2VkLgogICAgICAgIG9wZW46IGJvb2xlYW47CiAgICAgIH0KICAgICkgPT4gewogICAgICAvLyBUaGUgV0FTTSB2aWV3ZXIgbG9hZHMgYSBDQUQgZmlsZSAoaXQgY2FuJ3QgcnVuIGEgLmJyZXAudHMpLCBzbyAtLXNuYXBzaG90Ly0tc2VydmUKICAgICAgLy8gc3RhZ2UgdGhlIHByaW1hcnkgU1RFUCBhbmQgcG9pbnQgdGhlIHZpZXdlciBhdCBpdCB2aWEgP2Rpcj0mZmlsZT0uIC0tZ2xiIGlzIGl0cyBvd24gYXJ0aWZhY3QuCiAgICAgIGNvbnN0IHdhbnRTdGVwID0gQm9vbGVhbihvcHRzLnN0ZXApIHx8IEJvb2xlYW4ob3B0cy5zbmFwc2hvdCkgfHwgQm9vbGVhbihvcHRzLnNlcnZlKTsKICAgICAgY29uc3QgeyByZXBvcnQsIHN0ZXAsIGdsYiwgc2hhcGUgfSA9IGF3YWl0IHJ1blBhcnQocmVzb2x2ZShmaWxlKSwgewogICAgICAgIHN0ZXA6IHdhbnRTdGVwLAogICAgICAgIGdsYjogQm9vbGVhbihvcHRzLmdsYiksCiAgICAgICAgY2hlY2s6IEJvb2xlYW4ob3B0cy5jaGVjayksCiAgICAgIH0pOwogICAgICBsZXQgc3RlcFBhdGg6IHN0cmluZyB8IHVuZGVmaW5lZCA9IG9wdHMuc3RlcDsKICAgICAgdHJ5IHsKICAgICAgICBpZiAob3B0cy5nbGIgJiYgZ2xiKSB3cml0ZUZpbGVTeW5jKG9wdHMuZ2xiLCBCdWZmZXIuZnJvbShnbGIpKTsKCiAgICAgICAgaWYgKHdhbnRTdGVwICYmIHN0ZXApIHsKICAgICAgICAgIHN0ZXBQYXRoID0gb3B0cy5zdGVwID8/IGpvaW4odG1wZGlyKCksIGBicmVwanMtdmVyaWZ5LSR7YmFzZW5hbWUoZmlsZSl9LnN0ZXBgKTsKICAgICAgICAgIHdyaXRlRmlsZVN5bmMoc3RlcFBhdGgsIEJ1ZmZlci5mcm9tKHN0ZXApKTsKICAgICAgICB9CiAgICAgICAgaWYgKG9wdHMuc25hcHNob3QgJiYgc3RlcFBhdGgpIHsKICAgICAgICAgIGNvbnN0IHNob290ID0gYXdhaXQgbG9hZFNuYXBzaG90U2hvb3QoKTsgLy8gbGF6eToga2VlcHMgcHVwcGV0ZWVyIG9mZiB0aGUgZGVmYXVsdCBwYXRoCiAgICAgICAgICBpZiAoc2hvb3QpIHsKICAgICAgICAgICAgY29uc3QgeyBwbmdzIH0gPSBhd2FpdCBzaG9vdCh7IGZpbGU6IHN0ZXBQYXRoLCBvdXREaXI6IG9wdHMuc25hcHNob3QgfSk7CiAgICAgICAgICAgIC8vIERpYWdub3N0aWMgcGF0aHMgZ28gdG8gc3RkZXJyIOKAlCBzdGRvdXQgc3RheXMgYSBzaW5nbGUgY2xlYW4gSlNPTiBkb2N1bWVudC4KICAgICAgICAgICAgZm9yIChjb25zdCBwIG9mIHBuZ3MpIHByb2Nlc3Muc3RkZXJyLndyaXRlKGBzbmFwc2hvdDogJHtwfVxuYCk7CiAgICAgICAgICB9CiAgICAgICAgfSBlbHNlIGlmIChvcHRzLnNuYXBzaG90KSB7CiAgICAgICAgICBwcm9jZXNzLnN0ZGVyci53cml0ZSgnc25hcHNob3Qgc2tpcHBlZDogU1RFUCBleHBvcnQgcHJvZHVjZWQgbm8gYXJ0aWZhY3RcbicpOwogICAgICAgIH0KICAgICAgfSBjYXRjaCAoZSkgewogICAgICAgIHB1c2hFcnJvcihyZXBvcnQsIHsgbWVzc2FnZTogYGFydGlmYWN0IHdyaXRlIGZhaWxlZDogJHsoZSBhcyBFcnJvcikubWVzc2FnZX1gIH0pOwogICAgICB9IGZpbmFsbHkgewogICAgICAgIC8vIFRoZSBzaGFwZSBpcyBhIGxpdmUgV0FTTSBoYW5kbGU7IHJlbGVhc2UgaXQgYmVmb3JlIHRoZSBzZXJ2ZXIgdGFrZXMgb3ZlciAodGhlCiAgICAgICAgLy8gLS1zZXJ2ZSBwYXRoIHN0YXlzIHJ1bm5pbmcsIHNvIGxlYWtpbmcgaGVyZSB3b3VsZCBwZXJzaXN0IGZvciB0aGUgc2VydmVyJ3MgbGlmZXRpbWUpLgogICAgICAgIGRpc3Bvc2VTaGFwZShzaGFwZSk7CiAgICAgIH0KICAgICAgLy8gU2VyaWFsaXplIG9uY2UgYWZ0ZXIgYWxsIGFydGlmYWN0IHdyaXRlcyBzbyB0aGUgLS1qc29uIGZpbGUgYW5kIHN0ZG91dAogICAgICAvLyByZWZsZWN0IHRoZSBzYW1lIHJlcG9ydCAoaW5jbC4gYW55ICJhcnRpZmFjdCB3cml0ZSBmYWlsZWQiIGVycm9yKS4KICAgICAgY29uc3QganNvbiA9IHNlcmlhbGl6ZVJlcG9ydChyZXBvcnQpOwogICAgICBpZiAob3B0cy5qc29uKSB3cml0ZUZpbGVTeW5jKG9wdHMuanNvbiwganNvbik7CiAgICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKGpzb24gKyAnXG4nKTsKICAgICAgaWYgKCFyZXBvcnRPayhyZXBvcnQpKSBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgICAgY29uc3Qgd2lsbFNlcnZlID0gQm9vbGVhbihvcHRzLnNlcnZlKSAmJiBzdGVwUGF0aCAhPT0gdW5kZWZpbmVkICYmIHJlcG9ydE9rKHJlcG9ydCk7CiAgICAgIGlmICh3aWxsU2VydmUgJiYgc3RlcFBhdGgpIHsKICAgICAgICBjb25zdCB7IHNlcnZlIH0gPSBhd2FpdCBpbXBvcnQoJy4uL3NuYXBzaG90L3NlcnZlLmpzJyk7IC8vIGxhenk6IG5vIHNlcnZlciBkZXBzIG9uIHRoZSBkZWZhdWx0IHBhdGgKICAgICAgICBjb25zdCB7IHVybCwgcmV1c2VkIH0gPSBhd2FpdCBzZXJ2ZSh7IGZpbGU6IHN0ZXBQYXRoIH0pOyAvLyBidWlsZHMgYSA/ZGlyPSZmaWxlPSBVUkw7IHNlcnZlciBydW5zIHVudGlsIEN0cmwtQwogICAgICAgIHByb2Nlc3Muc3RkZXJyLndyaXRlKGB2aWV3ZXI6ICR7dXJsfVxuYCk7CiAgICAgICAgLy8gQXV0by1vcGVuIG9ubHkgZm9yIGEgZnJlc2hseSBzdGFydGVkIHNlcnZlciAoYSByZXVzZWQgb25lIGFscmVhZHkgaGFzCiAgICAgICAgLy8gYSB0YWIpIGluIGFuIGludGVyYWN0aXZlIHNlc3Npb247IGAtLW5vLW9wZW5gIChvcHRzLm9wZW4gPT09IGZhbHNlKQogICAgICAgIC8vIGFsd2F5cyBzdXBwcmVzc2VzIGl0LgogICAgICAgIGlmICghcmV1c2VkICYmIG9wdHMub3BlbiAmJiBzaG91bGRBdXRvT3BlbigpKSB7CiAgICAgICAgICBvcGVuQnJvd3Nlcih1cmwpOwogICAgICAgIH0KICAgICAgfQogICAgfQogICk7Cgpwcm9ncmFtCiAgLmNvbW1hbmQoJ21lYXN1cmUnKQogIC5hcmd1bWVudCgnPGE+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGUnKQogIC5hcmd1bWVudCgnW2JdJywgJ29wdGlvbmFsIHNlY29uZCBtb2R1bGU7IGlmIGdpdmVuLCBtZWFzdXJlcyBkaXN0YW5jZSBiZXR3ZWVuIHRoZSB0d28gcGFydHMnKQogIC5hY3Rpb24oYXN5bmMgKGE6IHN0cmluZywgYj86IHN0cmluZykgPT4gewogICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgcnVuTWVhc3VyZShyZXNvbHZlKGEpLCBiID09PSB1bmRlZmluZWQgPyB1bmRlZmluZWQgOiByZXNvbHZlKGIpKTsKICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICBKU09OLnN0cmluZ2lmeSh7IG9rOiByZXN1bHQuZXJyb3JzLmxlbmd0aCA9PT0gMCwgLi4ucmVzdWx0IH0sIG51bGwsIDIpICsgJ1xuJwogICAgKTsKICAgIGlmIChyZXN1bHQuZXJyb3JzLmxlbmd0aCA+IDApIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdkaWZmJykKICAuYXJndW1lbnQoJzxhPicsICdwYXRoIHRvIHRoZSBiYXNlbGluZSAuYnJlcC50cyBtb2R1bGUnKQogIC5hcmd1bWVudCgnPGI+JywgJ3BhdGggdG8gdGhlIGNvbXBhcmlzb24gLmJyZXAudHMgbW9kdWxlJykKICAuYWN0aW9uKGFzeW5jIChhOiBzdHJpbmcsIGI6IHN0cmluZykgPT4gewogICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgcnVuRGlmZihyZXNvbHZlKGEpLCByZXNvbHZlKGIpKTsKICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICBKU09OLnN0cmluZ2lmeSh7IG9rOiByZXN1bHQuZXJyb3JzLmxlbmd0aCA9PT0gMCwgLi4ucmVzdWx0IH0sIG51bGwsIDIpICsgJ1xuJwogICAgKTsKICAgIGlmIChyZXN1bHQuZXJyb3JzLmxlbmd0aCA+IDApIHByb2Nlc3MuZXhpdENvZGUgPSAxOwogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdpbml0JykKICAuYXJndW1lbnQoJzxuYW1lPicsICdwYXJ0IG5hbWU7IHNjYWZmb2xkcyA8bmFtZT4uYnJlcC50cyArIHRzY29uZmlnLmpzb24gKyBSRUFETUUubWQnKQogIC5vcHRpb24oJy0tb3V0IDxkaXI+JywgJ3RhcmdldCBkaXJlY3RvcnkgKGRlZmF1bHRzIHRvIC4vPG5hbWU+KScpCiAgLmFjdGlvbigobmFtZTogc3RyaW5nLCBvcHRzOiB7IG91dD86IHN0cmluZyB9KSA9PiB7CiAgICBjb25zdCBkaXIgPSByZXNvbHZlKG9wdHMub3V0ID8/IG5hbWUpOwogICAgY29uc3QgcmVzdWx0ID0gc2NhZmZvbGRQYXJ0KG5hbWUsIGRpcik7CiAgICBmb3IgKGNvbnN0IGYgb2YgcmVzdWx0LmZpbGVzKSB7CiAgICAgIGNvbnN0IHRhZyA9IGYuY3JlYXRlZCA/ICdjcmVhdGVkJyA6ICdleGlzdHMgKGtlcHQpJzsKICAgICAgcHJvY2Vzcy5zdGRlcnIud3JpdGUoYCR7dGFnfTogJHtmLnBhdGh9XG5gKTsKICAgIH0KICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKEpTT04uc3RyaW5naWZ5KHJlc3VsdCwgbnVsbCwgMikgKyAnXG4nKTsKICB9KTsKCnByb2dyYW0KICAuY29tbWFuZCgnd2F0Y2gnKQogIC5hcmd1bWVudCgnPGZpbGU+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGU7IHJlLXZlcmlmaWVzIG9uIGVhY2ggc2F2ZSB1bnRpbCBDdHJsLUMnKQogIC5hY3Rpb24oKGZpbGU6IHN0cmluZykgPT4gewogICAgY29uc3QgcGF0aCA9IHJlc29sdmUoZmlsZSk7CiAgICBjb25zdCBydW4gPSBhc3luYyAoKSA9PiB7CiAgICAgIHRyeSB7CiAgICAgICAgY29uc3QgeyByZXBvcnQsIHNoYXBlIH0gPSBhd2FpdCBydW5QYXJ0KHBhdGgpOwogICAgICAgIHRyeSB7CiAgICAgICAgICBwcm9jZXNzLnN0ZG91dC53cml0ZShzZXJpYWxpemVSZXBvcnQocmVwb3J0KSArICdcbicpOwogICAgICAgIH0gZmluYWxseSB7CiAgICAgICAgICBkaXNwb3NlU2hhcGUoc2hhcGUpOyAvLyBsaXZlIFdBU00gaGFuZGxlOyB0aGUgbG9vcCBydW5zIGluZGVmaW5pdGVseQogICAgICAgIH0KICAgICAgfSBjYXRjaCAoZSkgewogICAgICAgIHByb2Nlc3Muc3RkZXJyLndyaXRlKGB3YXRjaCBydW4gZmFpbGVkOiAkeyhlIGFzIEVycm9yKS5tZXNzYWdlfVxuYCk7CiAgICAgIH0KICAgIH07CiAgICBjb25zdCB7IHRyaWdnZXIgfSA9IGRlYm91bmNlKHJ1biwgREVGQVVMVF9ERUJPVU5DRV9NUyk7CiAgICBwcm9jZXNzLnN0ZGVyci53cml0ZShgd2F0Y2hpbmcgJHtwYXRofSAoQ3RybC1DIHRvIHN0b3ApXG5gKTsKICAgIHZvaWQgcnVuKCk7IC8vIGluaXRpYWwgdmVyaWZ5CiAgICAvLyBXYXRjaCB0aGUgcGFyZW50IGRpcjogZWRpdG9ycyBvZnRlbiByZXBsYWNlIHRoZSBmaWxlIChyZW5hbWUpIG9uIHNhdmUsCiAgICAvLyB3aGljaCBkcm9wcyBhIHdhdGNoZXIgYm91bmQgdG8gdGhlIGZpbGUgaW5vZGUgaXRzZWxmLgogICAgY29uc3Qgd2F0Y2hlciA9IGZzV2F0Y2goZGlybmFtZShwYXRoKSwgKF9ldmVudCwgZmlsZW5hbWUpID0+IHsKICAgICAgaWYgKGZpbGVuYW1lID09PSB1bmRlZmluZWQgfHwgZmlsZW5hbWUgPT09IG51bGwpIHsKICAgICAgICB0cmlnZ2VyKCk7CiAgICAgICAgcmV0dXJuOwogICAgICB9CiAgICAgIGlmIChiYXNlbmFtZShwYXRoKSA9PT0gZmlsZW5hbWUudG9TdHJpbmcoKSkgdHJpZ2dlcigpOwogICAgfSk7CiAgICBjb25zdCBzdG9wID0gKCkgPT4gewogICAgICB3YXRjaGVyLmNsb3NlKCk7CiAgICAgIHByb2Nlc3MuZXhpdCgwKTsKICAgIH07CiAgICBwcm9jZXNzLm9uKCdTSUdJTlQnLCBzdG9wKTsKICAgIHByb2Nlc3Mub24oJ1NJR1RFUk0nLCBzdG9wKTsgLy8gc3VwZXJ2aXNvcnMgKGRvY2tlciBzdG9wLCBzeXN0ZW1jdGwpIHNlbmQgU0lHVEVSTQogIH0pOwoKcHJvZ3JhbQogIC5jb21tYW5kKCdleHBvcnQnKQogIC5hcmd1bWVudCgnPGZpbGU+JywgJ3BhdGggdG8gYSAuYnJlcC50cyBtb2R1bGUnKQogIC5vcHRpb24oJy0tc3RlcCcsICd3cml0ZSBhIFNURVAgYXJ0aWZhY3QnKQogIC5vcHRpb24oJy0tZ2xiJywgJ3dyaXRlIGEgR0xCIGFydGlmYWN0JykKICAub3B0aW9uKCctLXN0bCcsICd3cml0ZSBhbiBTVEwgYXJ0aWZhY3QnKQogIC5vcHRpb24oJy0tYWxsJywgJ3dyaXRlIFNURVAgKyBHTEIgKyBTVEwnKQogIC5vcHRpb24oJy0tb3V0IDxkaXI+JywgJ291dHB1dCBkaXJlY3RvcnknLCAnLicpCiAgLmFjdGlvbigKICAgIGFzeW5jICgKICAgICAgZmlsZTogc3RyaW5nLAogICAgICBvcHRzOiB7IHN0ZXA/OiBib29sZWFuOyBnbGI/OiBib29sZWFuOyBzdGw/OiBib29sZWFuOyBhbGw/OiBib29sZWFuOyBvdXQ6IHN0cmluZyB9CiAgICApID0+IHsKICAgICAgY29uc3QgZm9ybWF0cyA9IG9wdHMuYWxsCiAgICAgICAgPyB7IHN0ZXA6IHRydWUsIGdsYjogdHJ1ZSwgc3RsOiB0cnVlIH0KICAgICAgICA6IHsgc3RlcDogQm9vbGVhbihvcHRzLnN0ZXApLCBnbGI6IEJvb2xlYW4ob3B0cy5nbGIpLCBzdGw6IEJvb2xlYW4ob3B0cy5zdGwpIH07CiAgICAgIGlmICghZm9ybWF0cy5zdGVwICYmICFmb3JtYXRzLmdsYiAmJiAhZm9ybWF0cy5zdGwpIHsKICAgICAgICBwcm9jZXNzLnN0ZGVyci53cml0ZSgnbm8gZm9ybWF0cyByZXF1ZXN0ZWQg4oCUIHBhc3MgLS1zdGVwLy0tZ2xiLy0tc3RsIG9yIC0tYWxsXG4nKTsKICAgICAgICBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgICAgICByZXR1cm47CiAgICAgIH0KICAgICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgZXhwb3J0UGFydChyZXNvbHZlKGZpbGUpLCBmb3JtYXRzLCByZXNvbHZlKG9wdHMub3V0KSk7CiAgICAgIGZvciAoY29uc3QgcCBvZiByZXN1bHQud3JpdHRlbikgcHJvY2Vzcy5zdGRlcnIud3JpdGUoYHdyb3RlOiAke3B9XG5gKTsKICAgICAgZm9yIChjb25zdCBlIG9mIHJlc3VsdC5lcnJvcnMpIHByb2Nlc3Muc3RkZXJyLndyaXRlKGBlcnJvcjogJHtlfVxuYCk7CiAgICAgIHByb2Nlc3Muc3Rkb3V0LndyaXRlKAogICAgICAgIEpTT04uc3RyaW5naWZ5KHsgb2s6IHJlc3VsdC5vaywgd3JpdHRlbjogcmVzdWx0LndyaXR0ZW4sIGVycm9yczogcmVzdWx0LmVycm9ycyB9LCBudWxsLCAyKSArCiAgICAgICAgICAnXG4nCiAgICAgICk7CiAgICAgIGlmICghcmVzdWx0Lm9rKSBwcm9jZXNzLmV4aXRDb2RlID0gMTsKICAgIH0KICApOwoKLy8gT25seSBkcml2ZSB0aGUgQ0xJIHdoZW4gcnVuIGFzIHRoZSBlbnRyeSBzY3JpcHQsIHNvIHRlc3RzIGNhbiBpbXBvcnQgdGhlCi8vIGd1YXJkZWQgbG9hZGVycyB3aXRob3V0IGNvbW1hbmRlciBwYXJzaW5nIHRoZSB0ZXN0IHJ1bm5lcidzIGFyZ3YuCi8vIFJlc29sdmUgc3ltbGlua3Mgb24gYm90aCBzaWRlczogdGhlIG5wbS1pbnN0YWxsZWQgYmluIChub2RlX21vZHVsZXMvLmJpbi9icmVwanMpCi8vIGlzIGEgc3ltbGluaywgc28gcHJvY2Vzcy5hcmd2WzFdIHdvdWxkIG90aGVyd2lzZSBuZXZlciBlcXVhbCB0aGUgcmVhbCBtb2R1bGUgcGF0aC4KZXhwb3J0IGZ1bmN0aW9uIGlzRW50cnlwb2ludChhcmd2MTogc3RyaW5nIHwgdW5kZWZpbmVkLCBtb2R1bGVVcmw6IHN0cmluZyk6IGJvb2xlYW4gewogIGlmICghYXJndjEpIHJldHVybiBmYWxzZTsKICB0cnkgewogICAgcmV0dXJuIHJlYWxwYXRoU3luYyhhcmd2MSkgPT09IHJlYWxwYXRoU3luYyhmaWxlVVJMVG9QYXRoKG1vZHVsZVVybCkpOwogIH0gY2F0Y2ggewogICAgcmV0dXJuIGZhbHNlOwogIH0KfQoKaWYgKGlzRW50cnlwb2ludChwcm9jZXNzLmFyZ3ZbMV0sIGltcG9ydC5tZXRhLnVybCkpIHsKICB2b2lkIHByb2dyYW0ucGFyc2VBc3luYygpOwp9Cg==", "" + import.meta.url));
+}
+/**
+* Write `code` to a temp ESM directory, run the verify CLI with `makeArgs(partPath)` in a
+* resource-bounded child process, and return the raw outcome. The temp *program* directory is
+* always cleaned up; any artifacts the CLI writes elsewhere (e.g. an `--out` dir) are the caller's.
+*/
+async function runVerifyCli(code, makeArgs, opts) {
+	const timeoutMs = positiveOrDefault(opts.timeoutMs, DEFAULT_TIMEOUT_MS);
+	const maxMemoryMb = positiveOrDefault(opts.maxMemoryMb, DEFAULT_MAX_MEMORY_MB);
+	const cliEntry = opts.cliEntry ?? defaultCliEntry();
+	const useTsx = cliEntry.endsWith(".ts");
+	const dir = await mkdtemp(join(tmpdir(), "brepjs-run-"));
+	try {
+		await writeFile(join(dir, "package.json"), "{\"type\":\"module\"}\n");
+		const partPath = join(dir, "part.brep.ts");
+		await writeFile(partPath, code);
+		const cliArgs = makeArgs(partPath);
+		return await spawnCliOutcome(useTsx ? "npx" : process.execPath, useTsx ? [
+			"tsx",
+			cliEntry,
+			...cliArgs
+		] : [cliEntry, ...cliArgs], {
+			...process.env,
+			NODE_OPTIONS: [process.env["NODE_OPTIONS"], `--max-old-space-size=${maxMemoryMb}`].filter(Boolean).join(" ")
+		}, timeoutMs);
+	} finally {
+		await rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/**
+* Spawn the verify CLI in its OWN process group and enforce the wall-clock budget by SIGKILLing the
+* WHOLE group on timeout — not just the direct child.
+*
+* Why a process group rather than Node's built-in `execFile` timeout: in dev/test the CLI runs as
+* `npx tsx <main.ts>`, so the process that actually executes the part (and can spin on a CPU-bound
+* OCCT op) is a *grandchild* behind npx+tsx. `child_process`' `timeout`/`killSignal` signals only
+* the direct child, so a fired timeout SIGKILLs `npx` and orphans the still-spinning grandchild
+* forever (it reparents to init and keeps burning a core). Spawning `detached` makes the child a
+* process-group leader that npx's descendants inherit, so `process.kill(-pid, …)` reaps the entire
+* tree. The production path (`node dist/cli/main.js`) has no intermediary, but the group kill is
+* equally correct there.
+*/
+function spawnCliOutcome(cmd, args, env, timeoutMs) {
+	return new Promise((resolve) => {
+		const child = spawn(cmd, args, {
+			env,
+			detached: true,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		if (child.pid !== void 0) activeGroups.add(child.pid);
+		let stdout = "";
+		let stderr = "";
+		let stdoutBytes = 0;
+		let timedOut = false;
+		let outputTooLarge = false;
+		let settled = false;
+		const killTree = (signal) => {
+			if (child.pid !== void 0) killGroup(child.pid, signal);
+		};
+		const timer = setTimeout(() => {
+			timedOut = true;
+			killTree("SIGKILL");
+		}, timeoutMs);
+		child.stdout?.on("data", (chunk) => {
+			if (outputTooLarge) return;
+			stdoutBytes += chunk.length;
+			if (stdoutBytes > MAX_OUTPUT_BYTES) {
+				outputTooLarge = true;
+				killTree("SIGKILL");
+				return;
+			}
+			stdout += chunk.toString();
+		});
+		let stderrBytes = 0;
+		child.stderr?.on("data", (chunk) => {
+			stderrBytes += chunk.length;
+			if (stderrBytes <= MAX_OUTPUT_BYTES) stderr += chunk.toString();
+		});
+		const finish = (exitCode) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			if (child.pid !== void 0) activeGroups.delete(child.pid);
+			resolve({
+				stdout,
+				stderr,
+				timedOut,
+				outputTooLarge,
+				exitCode
+			});
+		};
+		child.on("error", (err) => {
+			if (!stderr) stderr = err.message;
+			finish(null);
+		});
+		child.on("close", (code) => finish(code));
+	});
+}
+/** SIGKILL every in-flight sandbox process group now. Exported so a host can reap explicitly. */
+function killActiveSandboxes(signal = "SIGKILL") {
+	for (const pid of activeGroups) killGroup(pid, signal);
+	activeGroups.clear();
+}
+var shutdownHandlersInstalled = false;
+/**
+* Install process-shutdown hooks that reap any in-flight sandbox process groups when THIS process
+* (the host — e.g. the MCP server) terminates. Idempotent; call once at startup from an entrypoint.
+*
+* Rationale: the per-run timeout (`spawnCliOutcome`) only protects a run while the host is alive —
+* its timer dies with the host. If the host is stopped (the agent disconnects) before a run's
+* budget elapses, the `detached` sandbox group is in its own session and survives, burning a core
+* indefinitely. These hooks SIGKILL every tracked group on the way down so a dying host doesn't
+* leak its children. (A hard SIGKILL of the host can't be trapped — that residual needs the kernel's
+* PR_SET_PDEATHSIG, which Node doesn't expose.)
+*/
+function installSandboxShutdownHandlers() {
+	if (shutdownHandlersInstalled) return;
+	shutdownHandlersInstalled = true;
+	process.on("exit", () => killActiveSandboxes("SIGKILL"));
+	process.once("SIGTERM", () => {
+		killActiveSandboxes("SIGKILL");
+		process.exit(143);
+	});
+	process.once("SIGINT", () => {
+		killActiveSandboxes("SIGKILL");
+		process.exit(130);
+	});
+}
+function tryParse(out) {
+	if (!out.trim()) return null;
+	try {
+		return JSON.parse(out);
+	} catch {
+		return null;
+	}
+}
+/** Execute `code` (an agent-authored `.brep.ts` module) in an isolated, resource-bounded child. */
+async function runProgram(code, opts = {}) {
+	const o = await runVerifyCli(code, (partPath) => [partPath, "--check"], opts);
+	const report = tryParse(o.stdout);
+	if (report) return {
+		outcome: "completed",
+		report
+	};
+	if (o.timedOut) return {
+		outcome: "timeout",
+		timeoutMs: positiveOrDefault(opts.timeoutMs, DEFAULT_TIMEOUT_MS)
+	};
+	if (o.outputTooLarge) return {
+		outcome: "crashed",
+		exitCode: null,
+		detail: "output exceeded size limit"
+	};
+	return {
+		outcome: "crashed",
+		exitCode: o.exitCode,
+		detail: o.stderr.slice(0, 2e3) || "no JSON report on stdout"
+	};
+}
+/**
+* Execute `code` and export artifacts to `outDir`. Artifacts persist in `outDir` (the caller owns
+* it); only the temp program directory is cleaned up. Returns the written paths and any errors.
+*/
+async function exportProgram(code, outDir, formats = {
+	step: true,
+	glb: true,
+	stl: true
+}, opts = {}) {
+	const formatFlags = [
+		formats.step ? "--step" : "",
+		formats.glb ? "--glb" : "",
+		formats.stl ? "--stl" : ""
+	].filter(Boolean);
+	if (formatFlags.length === 0) return {
+		outcome: "crashed",
+		exitCode: 1,
+		detail: "no formats selected; pass at least one of step/glb/stl"
+	};
+	const o = await runVerifyCli(code, (partPath) => [
+		"export",
+		partPath,
+		...formatFlags,
+		"--out",
+		outDir
+	], opts);
+	const parsed = tryParse(o.stdout);
+	if (parsed) return {
+		outcome: "completed",
+		ok: parsed.ok,
+		written: parsed.written,
+		errors: parsed.errors
+	};
+	if (o.timedOut) return {
+		outcome: "timeout",
+		timeoutMs: positiveOrDefault(opts.timeoutMs, DEFAULT_TIMEOUT_MS)
+	};
+	if (o.outputTooLarge) return {
+		outcome: "crashed",
+		exitCode: null,
+		detail: "output exceeded size limit"
+	};
+	return {
+		outcome: "crashed",
+		exitCode: o.exitCode,
+		detail: o.stderr.slice(0, 2e3) || "no JSON result on stdout"
+	};
+}
+//#endregion
+//#region src/sandbox/runRecord.ts
+/**
+* Run-record — a lightweight, append-only provenance envelope for sandbox executions.
+*
+* Every `run_program` call can emit one JSONL record capturing what ran and what came back
+* (program source, outcome, validity, the content-addressed result hash, and the geometric
+* summary). It is deliberately small and side-channel: it keeps a dataset/eval option open
+* (program → outcome pairs) without changing the agent-facing contract.
+*/
+/** Build a {@link RunRecord} from a program and its sandbox result. `now` is injectable for tests. */
+function buildRunRecord(program, result, now = () => /* @__PURE__ */ new Date()) {
+	const ok = result.outcome === "completed" && result.report.ok;
+	const measurements = result.outcome === "completed" ? result.report.measurements : void 0;
+	const topology = result.outcome === "completed" ? result.report.topology : void 0;
+	const digest = JSON.stringify({
+		outcome: result.outcome,
+		ok,
+		measurements,
+		topology
+	});
+	const resultHash = createHash("sha256").update(`${program}${digest}`).digest("hex");
+	return {
+		timestamp: now().toISOString(),
+		program,
+		outcome: result.outcome,
+		ok,
+		resultHash,
+		...measurements !== void 0 ? { measurements } : {},
+		...topology !== void 0 ? { topology } : {}
+	};
+}
+/** Append a record as one JSON line to `filePath` (creating it if absent). */
+async function appendRunRecord(filePath, record) {
+	await appendFile(filePath, `${JSON.stringify(record)}\n`);
+}
+//#endregion
+//#region src/mcp/tools.ts
+/** JSON Schema for `run_program` input (the low-level Server API takes plain JSON Schema). */
+var RUN_PROGRAM_INPUT_SCHEMA = {
+	type: "object",
+	properties: {
+		code: {
+			type: "string",
+			description: "A brepjs .brep.ts module with a default-exported part function."
+		},
+		timeoutMs: {
+			type: "number",
+			description: "Optional wall-clock budget in milliseconds (default 30000)."
+		}
+	},
+	required: ["code"]
+};
+/**
+* Execute an agent-authored brepjs program in the sandbox and return its verification report.
+* `isError` is set when the part failed checks, timed out, or crashed — so the agent can branch.
+*/
+async function runProgramTool(args) {
+	if (!args.code || !args.code.trim()) return {
+		content: [{
+			type: "text",
+			text: "run_program requires a non-empty \"code\" string."
+		}],
+		isError: true
+	};
+	const result = await runProgram(args.code, args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {});
+	const recordPath = process.env["BREPJS_RUN_RECORD_PATH"];
+	if (recordPath) appendRunRecord(recordPath, buildRunRecord(args.code, result)).catch((err) => {
+		console.warn(`run-record append failed (BREPJS_RUN_RECORD_PATH=${recordPath}):`, err);
+	});
+	if (result.outcome === "completed") {
+		const payload = {
+			outcome: "completed",
+			ok: result.report.ok,
+			report: result.report
+		};
+		return {
+			content: [{
+				type: "text",
+				text: JSON.stringify(payload, null, 2)
+			}],
+			isError: !result.report.ok
+		};
+	}
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}],
+		isError: true
+	};
+}
+/** JSON Schema for `export_part` input. */
+var EXPORT_PART_INPUT_SCHEMA = {
+	type: "object",
+	properties: {
+		code: {
+			type: "string",
+			description: "A brepjs .brep.ts module with a default-exported part function."
+		},
+		outDir: {
+			type: "string",
+			description: "Directory to write artifacts into."
+		},
+		formats: {
+			type: "object",
+			description: "Which artifacts to write; omit for all.",
+			properties: {
+				step: { type: "boolean" },
+				glb: { type: "boolean" },
+				stl: { type: "boolean" }
+			}
+		},
+		timeoutMs: {
+			type: "number",
+			description: "Optional wall-clock budget in ms (default 30000)."
+		}
+	},
+	required: ["code", "outDir"]
+};
+/**
+* Build a part in the sandbox and export it to `outDir` (STEP/GLB/STL). Returns the written paths;
+* `isError` is set when the export produced no valid solid, timed out, or crashed. The artifacts
+* persist in `outDir` for the agent to hand off.
+*/
+async function exportPartTool(args) {
+	if (!args.code || !args.code.trim()) return {
+		content: [{
+			type: "text",
+			text: "export_part requires a non-empty \"code\" string."
+		}],
+		isError: true
+	};
+	if (!args.outDir || !args.outDir.trim()) return {
+		content: [{
+			type: "text",
+			text: "export_part requires an \"outDir\" string."
+		}],
+		isError: true
+	};
+	const result = await exportProgram(args.code, args.outDir, args.formats, args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {});
+	if (result.outcome === "completed") {
+		const payload = {
+			outcome: "completed",
+			ok: result.ok,
+			written: result.written,
+			errors: result.errors
+		};
+		return {
+			content: [{
+				type: "text",
+				text: JSON.stringify(payload, null, 2)
+			}],
+			isError: !result.ok
+		};
+	}
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}],
+		isError: true
+	};
+}
+//#endregion
+//#region src/mcp/server.ts
+/**
+* brepjs-verify MCP server (stdio).
+*
+* Exposes the verify substrate to MCP-capable agents. The first tool, `run_program`, executes an
+* agent-authored brepjs program in the sandbox and returns the verification report — the closed
+* "build → verify" step the agent loop is built on. Uses the SDK's low-level `Server` with plain
+* JSON-Schema tool definitions (no direct zod dependency in this package).
+*/
+installSandboxShutdownHandlers();
+var pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+var server = new Server({
+	name: "brepjs-verify",
+	version: JSON.parse(readFileSync(pkgPath, "utf8")).version
+}, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [{
+	name: "run_program",
+	description: "Execute an agent-authored brepjs program in an isolated sandbox and return the verification report (validity, measurements, topology). Use this to build a part and check it in one step.",
+	inputSchema: RUN_PROGRAM_INPUT_SCHEMA
+}, {
+	name: "export_part",
+	description: "Build a brepjs part in the sandbox and export it to a directory (STEP/GLB/STL). Use this to hand off the final artifact once a part verifies.",
+	inputSchema: EXPORT_PART_INPUT_SCHEMA
+}] }));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+	if (req.params.name === "run_program") {
+		const a = req.params.arguments ?? {};
+		const code = typeof a["code"] === "string" ? a["code"] : "";
+		const timeoutMs = typeof a["timeoutMs"] === "number" && a["timeoutMs"] > 0 ? a["timeoutMs"] : void 0;
+		return runProgramTool({
+			code,
+			...timeoutMs !== void 0 ? { timeoutMs } : {}
+		});
+	}
+	if (req.params.name === "export_part") {
+		const a = req.params.arguments ?? {};
+		const code = typeof a["code"] === "string" ? a["code"] : "";
+		const outDir = typeof a["outDir"] === "string" ? a["outDir"] : "";
+		const timeoutMs = typeof a["timeoutMs"] === "number" && a["timeoutMs"] > 0 ? a["timeoutMs"] : void 0;
+		const f = typeof a["formats"] === "object" && a["formats"] !== null ? a["formats"] : void 0;
+		const formats = f && (f["step"] === true || f["glb"] === true || f["stl"] === true) ? {
+			...f["step"] === true ? { step: true } : {},
+			...f["glb"] === true ? { glb: true } : {},
+			...f["stl"] === true ? { stl: true } : {}
+		} : void 0;
+		return exportPartTool({
+			code,
+			outDir,
+			...formats !== void 0 ? { formats } : {},
+			...timeoutMs !== void 0 ? { timeoutMs } : {}
+		});
+	}
+	throw new Error(`Unknown tool: ${req.params.name}`);
+});
+async function main() {
+	await server.connect(new StdioServerTransport());
+}
+main().catch((err) => {
+	console.error("brepjs-verify MCP server failed to start:", err);
+	process.exit(1);
+});
+//#endregion

package/dist/mcp/tools.d.ts

@@ -0,0 +1,77 @@
+import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { ExportFormats } from '../sandbox/runProgram.js';
+export interface RunProgramToolArgs {
+    /** A brepjs `.brep.ts` module source with a default-exported part function. */
+    code: string;
+    /** Optional wall-clock budget in ms (default 30000). */
+    timeoutMs?: number;
+}
+/** JSON Schema for `run_program` input (the low-level Server API takes plain JSON Schema). */
+export declare const RUN_PROGRAM_INPUT_SCHEMA: {
+    type: "object";
+    properties: {
+        code: {
+            type: string;
+            description: string;
+        };
+        timeoutMs: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/**
+ * Execute an agent-authored brepjs program in the sandbox and return its verification report.
+ * `isError` is set when the part failed checks, timed out, or crashed — so the agent can branch.
+ */
+export declare function runProgramTool(args: RunProgramToolArgs): Promise<CallToolResult>;
+export interface ExportPartToolArgs {
+    /** A brepjs `.brep.ts` module source with a default-exported part function. */
+    code: string;
+    /** Directory to write artifacts into (the caller owns it; artifacts persist there). */
+    outDir: string;
+    /** Which formats to write (default: all of STEP/GLB/STL). */
+    formats?: ExportFormats;
+    timeoutMs?: number;
+}
+/** JSON Schema for `export_part` input. */
+export declare const EXPORT_PART_INPUT_SCHEMA: {
+    type: "object";
+    properties: {
+        code: {
+            type: string;
+            description: string;
+        };
+        outDir: {
+            type: string;
+            description: string;
+        };
+        formats: {
+            type: string;
+            description: string;
+            properties: {
+                step: {
+                    type: string;
+                };
+                glb: {
+                    type: string;
+                };
+                stl: {
+                    type: string;
+                };
+            };
+        };
+        timeoutMs: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/**
+ * Build a part in the sandbox and export it to `outDir` (STEP/GLB/STL). Returns the written paths;
+ * `isError` is set when the export produced no valid solid, timed out, or crashed. The artifacts
+ * persist in `outDir` for the agent to hand off.
+ */
+export declare function exportPartTool(args: ExportPartToolArgs): Promise<CallToolResult>;