paper-mono 0.62.0

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Release notes
+
+## 0.62.0 — 2026-08-28
+
+- Added equivalent public `paper` and `paper-mono` binaries with deterministic Paper reads, screenshots, diagnostics, and the guarded specialist.
+- Added the reference-to-code, audit-only, and Paper-copilot workflows.
+- Enforced a runtime implementation-brief gate before project writes, approved shell commands, or live Paper mutations can run.
+- Added bounded Snapshot-scale reads, exact tool-contract diagnostics, public bundle provenance, runtime-asset inventory, third-party notices, and fail-closed screenshot validation.
+- Disabled inherited install telemetry, automatic version polling, and provider-attribution telemetry before every Paper specialist startup.
+- Made deterministic screenshot export no-clobber by default and documented its narrow pre-approval file-output boundary.
+- Removed inherited `/debug`, `/export`, `/import`, and `/share` commands plus the global debug shortcut from the public TUI, and added an exact-tarball PTY gate proving their upstream transcript, file, and network handlers cannot run.
+- Required user-installed `fd` (or `fdfind`) and `rg`, disabled inherited executable acquisition, and added exact-artifact default/offline missing-tool proof.
+- Replaced synthetic resume receipts with exact-installed-tarball PTY proof for both `-r` and `--resume`: two visible controlled sessions, named selection, privacy-safe identity, locked startup, append-only lifecycle records, and byte-identical cancellation.
+- Hardened rejected inline-option diagnostics to redact every value, restricted `--session` to verified IDs while keeping `--fork` as the explicit transcript-import path, and proved `--` option-shaped prompts against the installed tarball.
+- Replaced generated absolute project, context, attachment, and approval metadata with `<repository-root>` and repository-relative labels, while preserving the locally bound canonical brief and hash.
+- Required a healthy structured doctor report to exit `0` in release and executable-documentation gates.
+- Added source-digest-bound clean-room receipts, real bounded specialist-startup probes, exact prerequisite classification, global-install and `npx` proof against the allowlisted tarball, verified uninstall postconditions, live public-link checks, and a zero-high/critical production dependency gate.
+
+This is the first public npm release. The package passed exact-tarball clean-room installation, runtime-safety, dependency, documentation, and independent-review gates before publication. Public source remains intentionally deferred until the installed product has stabilized.
+
+Known v1 limits are documented in `docs/runtime.md`. Support and private security reporting use `hello@luke-nittmann.com`; there is no public repository or issue-tracker link yet.

package/DEPENDENCIES.json

@@ -0,0 +1,143 @@
+{
+  "schemaVersion": "paper-mono-dependencies.v1",
+  "package": "paper-mono@0.62.0",
+  "external": [
+    {
+      "name": "@earendil-works/pi-agent-core",
+      "version": "0.84.3"
+    },
+    {
+      "name": "@earendil-works/pi-ai",
+      "version": "0.84.3"
+    },
+    {
+      "name": "@earendil-works/pi-coding-agent",
+      "version": "0.84.3"
+    },
+    {
+      "name": "@earendil-works/pi-tui",
+      "version": "0.84.3"
+    },
+    {
+      "name": "@silvia-odwyer/photon-node",
+      "version": "0.3.4"
+    },
+    {
+      "name": "@sinclair/typebox",
+      "version": "0.34.48"
+    },
+    {
+      "name": "chalk",
+      "version": "5.6.2"
+    },
+    {
+      "name": "cli-highlight",
+      "version": "2.1.11"
+    },
+    {
+      "name": "debug",
+      "version": "4.4.3"
+    },
+    {
+      "name": "undici",
+      "version": "7.29.0"
+    },
+    {
+      "name": "yaml",
+      "version": "2.9.0"
+    },
+    {
+      "name": "yauzl",
+      "version": "3.4.0"
+    }
+  ],
+  "bundledInternal": [
+    {
+      "name": "@creative-int/mono",
+      "version": "0.21.0"
+    },
+    {
+      "name": "@creative-int/pi-coding-core",
+      "version": "0.7.0"
+    },
+    {
+      "name": "@creative-int/pi-coding-runtime",
+      "version": "0.7.0"
+    },
+    {
+      "name": "@creative-int/pi-prompts",
+      "version": "0.4.2"
+    }
+  ],
+  "bundledThirdParty": [
+    {
+      "name": "@borewit/text-codec",
+      "version": "0.2.2",
+      "license": "MIT"
+    },
+    {
+      "name": "@tokenizer/inflate",
+      "version": "0.4.1",
+      "license": "MIT"
+    },
+    {
+      "name": "ansi-regex",
+      "version": "6.2.2",
+      "license": "MIT"
+    },
+    {
+      "name": "diff",
+      "version": "8.0.4",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "file-type",
+      "version": "21.3.4",
+      "license": "MIT"
+    },
+    {
+      "name": "ieee754",
+      "version": "1.2.1",
+      "license": "BSD-3-Clause"
+    },
+    {
+      "name": "strip-ansi",
+      "version": "7.2.0",
+      "license": "MIT"
+    },
+    {
+      "name": "strtok3",
+      "version": "10.3.5",
+      "license": "MIT"
+    },
+    {
+      "name": "token-types",
+      "version": "6.1.2",
+      "license": "MIT"
+    },
+    {
+      "name": "typebox",
+      "version": "1.1.38",
+      "license": "MIT"
+    },
+    {
+      "name": "uint8array-extras",
+      "version": "1.5.0",
+      "license": "MIT"
+    }
+  ],
+  "runtimeAssets": [
+    {
+      "path": "dist/modes/interactive/theme/dark.json",
+      "sourcePackage": "@creative-int/pi-coding-core",
+      "sourcePath": "dist/modes/interactive/theme/dark.json",
+      "sha256": "1d809f2794166584bf4fd8bea0c547f2c75483013fe367e00ccde961ec403c7d"
+    },
+    {
+      "path": "dist/modes/interactive/theme/light.json",
+      "sourcePackage": "@creative-int/pi-coding-core",
+      "sourcePath": "dist/modes/interactive/theme/light.json",
+      "sha256": "1d6b3ce3f89b5ccd0de423a0c7ef97a58df193a60ffd6592a3f414d559aabbdb"
+    }
+  ]
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# Paper Mono
+
+> Turn a Paper reference into a sharp implementation brief, get explicit approval, then carry it faithfully into production code.
+
+Paper Mono is a local-first CLI for [Paper Desktop](https://paper.design). It reads the document open in Paper through Paper's local MCP server and runs the design-to-code specialist on your machine. No Paper Mono account, Convex backend, hosted workspace, or Paper Mono cloud service is required.
+
+## Quick start
+
+You need Node.js 22.19.0 or newer, Paper Desktop, a Paper document open, and user-installed `fd` (or `fdfind`) plus `rg` on `PATH`. On macOS, install the search tools with `brew install fd ripgrep`; on Debian or Ubuntu, use `apt install fd-find ripgrep`. Paper Mono checks these prerequisites before specialist startup and never downloads executable dependencies automatically.
+
+Open a terminal in the destination repository root before starting the specialist. That current working directory becomes the brief's project boundary for inspection, approved edit/write paths, command approval, and verification. An `@file` attachment must be a regular file inside that repository after symlink resolution; its contents are sent to the selected model provider as prompt context. Edit and write tools enforce approved project paths. An approved shell command must exactly match the brief and launches from the repository root, but it runs in the normal host shell—not an operating-system sandbox. Review every proposed command for absolute paths, parent traversal, redirection, subprocesses, and package lifecycle scripts that could reach outside the repository.
+
+```bash
+npm install -g paper-mono
+paper doctor
+paper mono
+```
+
+On first use, enter `/login` inside `paper mono` and choose a supported model provider. Then tell Paper Mono which reference and destination surface to inspect.
+
+The default workflow is deliberately gated:
+
+1. confirm the exact Paper file, page, artboard, and relevant nodes;
+2. inspect the reference and destination project without mutation;
+3. produce a structured implementation brief with scope, uncertainty, and verification;
+4. wait for the exact `APPROVE PAPER BRIEF <brief-id>` phrase;
+5. implement only the approved scope through the destination's existing design system;
+6. verify the real product route, viewport, state, and interaction—not only the Paper reference.
+
+Closing or cancelling before approval leaves project files and Paper unchanged, except for a deterministic `paper screenshot --out <file>` export you explicitly requested.
+
+## What it is—and is not
+
+Paper Mono is a local Paper specialist for humans and agents. It provides deterministic document reads, guarded model-powered chat, diagnostics, audit-only analysis, and approved Paper refinement.
+
+It is not a hosted design service, a Paper replacement, a Chrome automation tool, or a promise to copy a reference's branding or CSS. It does not require the private Mono Factory UI, Rust TUI, backend workflows, Doppler, Bun, pnpm, GitHub Packages, or a source checkout.
+
+## Three supported paths
+
+Reference-to-code is the default. Two explicit alternatives are available:
+
+```bash
+paper mono --audit-only
+paper mono --copilot
+```
+
+- `--audit-only` is permanently read-only and can never unlock mutation.
+- `--copilot` can propose guarded work inside Paper, but the same brief approval boundary still applies.
+
+`paper mono --list-models` is a model-inventory helper, not a fourth workflow.
+
+For a one-command trial without a global install, use:
+
+```bash
+npx paper-mono mono
+```
+
+`npx` uses npm-managed cache and Paper Mono may create normal local state under `~/.paper/agent`; it only avoids a global package install. The package exposes equivalent `paper` and `paper-mono` binaries. Documentation uses `paper` as the canonical command.
+
+## Paper Snapshot
+
+Paper Snapshot is Paper's separate Chrome extension. [Get it from Paper's official page](https://paper.design/snapshot-extension) to bring a web reference into Paper. Paper Mono reads the resulting Paper nodes; it does not operate Chrome, run the extension, or capture the source site itself.
+
+Start broad only long enough to resolve identity, then narrow: confirm the file and selection, inspect a bounded tree, target one artboard or subtree, request a scale-1 screenshot, and read JSX or computed styles only for nodes needed by the current decision. See the [Paper MCP boundary](docs/paper-mcp.md) for the large-Snapshot recovery path.
+
+## Deterministic commands
+
+```bash
+paper --help
+paper --version
+paper --about-json
+paper doctor --json
+paper info --json
+paper selection --json
+paper tree --json
+paper node "replace-with-node-id" --json
+paper screenshot --out reference --json
+paper mono --help
+```
+
+Machine-readable commands emit JSON without decorative stdout. Screenshot exports require an explicit `--node` or exactly one current selection, append the verified image extension when needed, and refuse to overwrite an existing path. Deterministic owner commands reject unknown subcommands, and the specialist rejects unsupported flags, invalid option values, path-like `--session` values, and conflicting session actions with a nonzero exit and an actionable error. Bare positional text on `paper mono` is prompt input. Use `paper mono -- --version` or the same `--` terminator for prompt text that looks like an option. The short `paper` specialist form reserves the owner command words `show`, `info`, `selection`, `tree`, `node`, `screenshot`, `doctor`, `page`, and `help`; use `paper mono` when prompt text could be mistaken for one of them.
+
+## Model authentication
+
+Run `paper mono`, enter `/login`, and choose a provider. You may instead use that provider's documented environment variable. `paper mono --list-models` shows available model IDs; Paper Mono never prints credential values in diagnostics.
+
+Credentials, settings, and sessions stay under `~/.paper/agent` by default. Set `PAPER_CODING_AGENT_DIR` before the first run to use another local directory. `--session <id>` accepts a verified session ID only; public v1 rejects path-like values before session activation. Use `--fork <path-or-id>` when you explicitly intend to import a transcript into a new session scoped to the current project. `--session-dir <dir>` overrides session storage and lookup only; it may place transcripts outside the agent home and uses the runtime's explicit-directory lookup instead of Paper Mono's hardened implicit-session verification path. Use only a directory you trust. A resumed session is mutation-locked again until the current brief is reconfirmed.
+
+Resume a previous interactive session with:
+
+```bash
+paper mono -r
+```
+
+## Privacy and network boundaries
+
+Paper document reads travel over the loopback MCP endpoint at `127.0.0.1`. Paper Mono disables the inherited install ping, automatic version polling, provider-attribution telemetry, and executable downloader before startup; it adds no product telemetry or hidden backend and does not silently phone home. The public TUI also disables inherited `/debug`, `/export`, `/import`, and `/share` commands, so a locked session cannot write a raw debug log or export, replace itself from a file, or send a transcript to an external sharing service. Generated provider metadata names the current project as `<repository-root>` and uses repository-relative labels for attached and context files; Paper Mono does not add the absolute local project path to the model request. User-authored prompts, attached file contents, imported instructions, tool results, or approved commands can still contain paths. Prompts, relevant code/reference context, and tool results needed for reasoning are sent to the model provider you select, so that provider's privacy and retention terms apply.
+
+Use `PAPER_OFFLINE=1` or `paper mono --offline` to disable startup network operations. Local deterministic Paper reads remain available, but model work still requires a reachable configured provider unless you use a local one.
+
+## Compatibility and current limits
+
+- Node.js 22.19.0 or newer is required.
+- `fd` (or `fdfind`) and `rg` must already be executable on `PATH` before `paper mono` starts. Missing tools fail with install guidance in both default and offline modes; Paper Mono does not acquire them.
+- Paper Desktop must be running with a document open for live MCP reads.
+- Clean-room installation and offline CLI behavior are exercised on Apple-silicon macOS with Node.js 22.23.1. That receipt does not claim live Paper Desktop integration on any operating system. The package declares no OS restriction, but Linux and Windows live integration remain unproven.
+- A static Snapshot cannot prove original motion, hidden application state, backend behavior, or inaccessible assets. The brief labels those details as unknown instead of inventing them.
+- Paper's current MCP surface does not expose every possible page-management or design operation. Unsupported work is reported rather than routed through a raw-provider bypass.
+- Public npm distribution comes first. Public source is intentionally deferred until the installed product has stabilized, so there is no source-repository link yet.
+
+## Troubleshooting
+
+- **Paper is closed or no file is open:** open Paper Desktop and a document, then rerun `paper doctor --json`. Reinstallation is unnecessary.
+- **MCP is unreachable:** confirm the document is open and that another process is not interfering with `127.0.0.1:29979`, then rerun doctor. Restart Paper only if the local endpoint still does not recover.
+- **Model authentication is missing:** start `paper mono`, enter `/login`, or configure the selected provider's documented environment variable. A missing key should produce guidance, not a stack trace.
+- **The Snapshot is too large:** select or name one artboard, rerun bounded inspection, use scale 1, and request JSX/styles for a smaller subtree. Paper Mono suppresses over-budget rich parts whole; it never returns partial JSON, JSX, or base64.
+- **The wrong file, page, or artboard is active:** run `paper info --json` and `paper selection --json`, switch to the intended target in Paper, and request a fresh brief. Existing approval does not carry across target drift.
+- **The imported structure is malformed or incomplete:** provide a narrower node or screenshot and let the brief record unsupported details explicitly.
+
+The [CLI reference](docs/cli.md) contains full recovery steps and exit behavior.
+
+## Uninstall
+
+```bash
+npm uninstall -g paper-mono
+```
+
+Uninstalling the package intentionally leaves `~/.paper/agent` in place so sessions and provider settings are not destroyed. Review that directory and remove it manually only if you also want to erase local Paper Mono state. If you set `PAPER_CODING_AGENT_DIR`, review that directory instead. Any directory passed with `--session-dir` is separate local state and must be reviewed or removed separately.
+
+## Support and security
+
+For setup help, compatibility reports, or reproducible failures, email [hello@luke-nittmann.com](mailto:hello@luke-nittmann.com) with the Paper Mono version, Node version, operating system, command, and redacted output. Never send provider keys, auth files, or private document contents.
+
+For a possible security or unsafe-mutation issue, use the same address with `paper-mono security` in the subject and follow the private-reporting guidance in [SAFETY.md](SAFETY.md).
+
+## Public contract
+
+See the [CLI reference](docs/cli.md), [Paper MCP boundary](docs/paper-mcp.md), [runtime and privacy model](docs/runtime.md), [safety model](SAFETY.md), [release notes](CHANGELOG.md), [dependency inventory](DEPENDENCIES.json), and [third-party notices](THIRD_PARTY_NOTICES.md). The package does not link to a private source repository or nonexistent public issue tracker.

package/SAFETY.md

@@ -0,0 +1,27 @@
+# Safety model
+
+Paper Mono starts locked. It can inspect the destination project and Paper reference, but it cannot edit project files, execute an approved project command, or make a live Paper change until it has produced a valid `paper-implementation-brief.v1` and you have entered its exact `APPROVE PAPER BRIEF <brief-id>` phrase. The one explicit pre-approval file-output path is the deterministic `paper screenshot --out <file>` command described below.
+
+The brief is bound to the active session, workflow, project directory, allowed project paths and commands, and the exact Paper file, page, artboard, nodes, and structural fingerprint observed at submission time. Paper Mono rechecks that target at approval and before every mutation. Target drift, a new user message, a completed run, session navigation, resume, reload, fork, an unlisted tool or path, or any out-of-scope command relocks the runtime.
+
+Additional boundaries:
+
+- `--audit-only` cannot unlock mutation.
+- Paper mutation tools expose dry runs where the provider supports them.
+- Direct page commands, RPC process control, external extensions, custom tools, resource loaders, and raw runtime exports are unavailable. The public interactive runtime removes and intercepts inherited `/debug`, `/export`, `/import`, and `/share` commands, including the global debug shortcut, before their upstream transcript, file, or network handlers can run.
+- The deterministic `show`, `info`, `selection`, `tree`, `node`, and `doctor` commands do not mutate Paper.
+- `screenshot` creates only the output path you explicitly provide, appends the verified image extension when none is present, and refuses to overwrite an existing path. It writes only after the complete response contains exactly one PNG, JPEG, or WebP image with canonical base64 and matching MIME type, file signature, and extension.
+- Edit and write tools enforce the paths approved in the brief. An approved shell command must exactly match the brief and launches from the project directory, but it runs in the normal host shell—not an operating-system sandbox. Review it for absolute paths, parent traversal, redirection, subprocesses, and package lifecycle scripts that could affect paths outside the project.
+- `@file` inputs must resolve to regular files inside the destination repository, including through symlinks. Attached text or processed image data becomes prompt context for the selected model provider. Generated prompt metadata uses repository-relative labels and `<repository-root>` instead of adding the absolute local project path; user-authored content, imported instructions, tool results, or approved commands can still contain paths.
+- Credentials, settings, and sessions stay local under `~/.paper/agent` unless `PAPER_CODING_AGENT_DIR` is set. `--session <id>` accepts a verified session ID only; path-like values are rejected, while `--fork <path-or-id>` is the explicit transcript-import path into a new current-project session. `--session-dir <dir>` can store sessions elsewhere and uses the runtime's explicit-directory lookup instead of Paper Mono's hardened implicit-session verification path; use only a trusted directory and remember that uninstall does not remove it.
+- Paper Desktop's MCP server listens on `127.0.0.1` and requires an open document.
+- Model prompts and the relevant context needed to answer them go only to the provider selected by the user. Paper Mono disables inherited install telemetry, automatic version polling, and provider-attribution telemetry; it adds no product telemetry or hidden backend.
+- Paper Mono requires user-installed `fd` (or `fdfind`) and `rg`, checks them before specialist startup, and keeps the inherited executable downloader disabled. Missing tools fail with local install guidance in both default and offline modes.
+
+The included `tools.contract.json` and `tool-walk/mono-safety-card.json` are machine-readable records of the 27-tool surface and its executable safety cases. `THIRD_PARTY_NOTICES.md` records licenses discovered from the exact bundled input graph.
+
+## Report a security or unsafe-mutation issue
+
+Email [hello@luke-nittmann.com](mailto:hello@luke-nittmann.com) with `paper-mono security` in the subject. Include the Paper Mono version, Node version, operating system, workflow mode, the command or transcript sequence, expected boundary, and observed behavior.
+
+Do not include provider keys, `auth.json`, private repository contents, or confidential Paper documents. Redact personal paths and document content where possible. If the report concerns unexpected mutation, stop using the affected workflow and preserve the local session transcript and before/after diff for private follow-up.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,244 @@
+# Third-party notices
+
+Paper Mono bundles the following third-party packages. Each notice is derived from the exact esbuild input graph used for this artifact.
+
+## @borewit/text-codec@0.2.2
+
+License: MIT
+Packaged license file: LICENSE.txt
+
+----- BEGIN @borewit/text-codec LICENSE -----
+The MIT License (MIT)
+
+Copyright © 2025 Borewit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END @borewit/text-codec LICENSE -----
+
+## @tokenizer/inflate@0.4.1
+
+License: MIT
+Packaged license file: LICENSE
+
+----- BEGIN @tokenizer/inflate LICENSE -----
+Copyright (c) 2024, Borewit
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END @tokenizer/inflate LICENSE -----
+
+## ansi-regex@6.2.2
+
+License: MIT
+Packaged license file: license
+
+----- BEGIN ansi-regex LICENSE -----
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END ansi-regex LICENSE -----
+
+## diff@8.0.4
+
+License: BSD-3-Clause
+Packaged license file: LICENSE
+
+----- BEGIN diff LICENSE -----
+BSD 3-Clause License
+
+Copyright (c) 2009-2015, Kevin Decker <kpdecker@gmail.com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+----- END diff LICENSE -----
+
+## file-type@21.3.4
+
+License: MIT
+Packaged license file: license
+
+----- BEGIN file-type LICENSE -----
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END file-type LICENSE -----
+
+## ieee754@1.2.1
+
+License: BSD-3-Clause
+Packaged license file: LICENSE
+
+----- BEGIN ieee754 LICENSE -----
+Copyright 2008 Fair Oaks Labs, Inc.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+----- END ieee754 LICENSE -----
+
+## strip-ansi@7.2.0
+
+License: MIT
+Packaged license file: license
+
+----- BEGIN strip-ansi LICENSE -----
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END strip-ansi LICENSE -----
+
+## strtok3@10.3.5
+
+License: MIT
+Packaged license file: LICENSE.txt
+
+----- BEGIN strtok3 LICENSE -----
+MIT License
+
+Copyright © 2026 Borewit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+----- END strtok3 LICENSE -----
+
+## token-types@6.1.2
+
+License: MIT
+Packaged license file: LICENSE.txt
+
+----- BEGIN token-types LICENSE -----
+The MIT License (MIT)
+
+Copyright © 2026 Borewit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END token-types LICENSE -----
+
+## typebox@1.1.38
+
+License: MIT
+Packaged license file: license
+
+----- BEGIN typebox LICENSE -----
+TypeBox
+
+The MIT License (MIT)
+
+Copyright (c) 2017-2026 Haydn Paterson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+----- END typebox LICENSE -----
+
+## uint8array-extras@1.5.0
+
+License: MIT
+Packaged license file: license
+
+----- BEGIN uint8array-extras LICENSE -----
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+----- END uint8array-extras LICENSE -----