@agentwares/agentguard 0.1.7 → 0.1.9

package/dist/cli.js

@@ -1,4781 +1,14 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// ../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/timing_safe_equal.js
-var require_timing_safe_equal = __commonJS({
-  "../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/timing_safe_equal.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.timingSafeEqual = void 0;
-    function assert(expr, msg = "") {
-      if (!expr) {
-        throw new Error(msg);
-      }
-    }
-    function timingSafeEqual(a, b) {
-      if (a.byteLength !== b.byteLength) {
-        return false;
-      }
-      if (!(a instanceof DataView)) {
-        a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
-      }
-      if (!(b instanceof DataView)) {
-        b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
-      }
-      assert(a instanceof DataView);
-      assert(b instanceof DataView);
-      const length = a.byteLength;
-      let out = 0;
-      let i = -1;
-      while (++i < length) {
-        out |= a.getUint8(i) ^ b.getUint8(i);
-      }
-      return out === 0;
-    }
-    exports.timingSafeEqual = timingSafeEqual;
-  }
-});
-
-// ../../node_modules/.pnpm/@stablelib+base64@1.0.1/node_modules/@stablelib/base64/lib/base64.js
-var require_base64 = __commonJS({
-  "../../node_modules/.pnpm/@stablelib+base64@1.0.1/node_modules/@stablelib/base64/lib/base64.js"(exports) {
-    "use strict";
-    var __extends = exports && exports.__extends || /* @__PURE__ */ (function() {
-      var extendStatics = function(d, b) {
-        extendStatics = Object.setPrototypeOf || { __proto__: [] } instanceof Array && function(d2, b2) {
-          d2.__proto__ = b2;
-        } || function(d2, b2) {
-          for (var p in b2) if (b2.hasOwnProperty(p)) d2[p] = b2[p];
-        };
-        return extendStatics(d, b);
-      };
-      return function(d, b) {
-        extendStatics(d, b);
-        function __() {
-          this.constructor = d;
-        }
-        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    var INVALID_BYTE = 256;
-    var Coder = (
-      /** @class */
-      (function() {
-        function Coder2(_paddingCharacter) {
-          if (_paddingCharacter === void 0) {
-            _paddingCharacter = "=";
-          }
-          this._paddingCharacter = _paddingCharacter;
-        }
-        Coder2.prototype.encodedLength = function(length) {
-          if (!this._paddingCharacter) {
-            return (length * 8 + 5) / 6 | 0;
-          }
-          return (length + 2) / 3 * 4 | 0;
-        };
-        Coder2.prototype.encode = function(data) {
-          var out = "";
-          var i = 0;
-          for (; i < data.length - 2; i += 3) {
-            var c = data[i] << 16 | data[i + 1] << 8 | data[i + 2];
-            out += this._encodeByte(c >>> 3 * 6 & 63);
-            out += this._encodeByte(c >>> 2 * 6 & 63);
-            out += this._encodeByte(c >>> 1 * 6 & 63);
-            out += this._encodeByte(c >>> 0 * 6 & 63);
-          }
-          var left = data.length - i;
-          if (left > 0) {
-            var c = data[i] << 16 | (left === 2 ? data[i + 1] << 8 : 0);
-            out += this._encodeByte(c >>> 3 * 6 & 63);
-            out += this._encodeByte(c >>> 2 * 6 & 63);
-            if (left === 2) {
-              out += this._encodeByte(c >>> 1 * 6 & 63);
-            } else {
-              out += this._paddingCharacter || "";
-            }
-            out += this._paddingCharacter || "";
-          }
-          return out;
-        };
-        Coder2.prototype.maxDecodedLength = function(length) {
-          if (!this._paddingCharacter) {
-            return (length * 6 + 7) / 8 | 0;
-          }
-          return length / 4 * 3 | 0;
-        };
-        Coder2.prototype.decodedLength = function(s) {
-          return this.maxDecodedLength(s.length - this._getPaddingLength(s));
-        };
-        Coder2.prototype.decode = function(s) {
-          if (s.length === 0) {
-            return new Uint8Array(0);
-          }
-          var paddingLength = this._getPaddingLength(s);
-          var length = s.length - paddingLength;
-          var out = new Uint8Array(this.maxDecodedLength(length));
-          var op = 0;
-          var i = 0;
-          var haveBad = 0;
-          var v0 = 0, v1 = 0, v2 = 0, v3 = 0;
-          for (; i < length - 4; i += 4) {
-            v0 = this._decodeChar(s.charCodeAt(i + 0));
-            v1 = this._decodeChar(s.charCodeAt(i + 1));
-            v2 = this._decodeChar(s.charCodeAt(i + 2));
-            v3 = this._decodeChar(s.charCodeAt(i + 3));
-            out[op++] = v0 << 2 | v1 >>> 4;
-            out[op++] = v1 << 4 | v2 >>> 2;
-            out[op++] = v2 << 6 | v3;
-            haveBad |= v0 & INVALID_BYTE;
-            haveBad |= v1 & INVALID_BYTE;
-            haveBad |= v2 & INVALID_BYTE;
-            haveBad |= v3 & INVALID_BYTE;
-          }
-          if (i < length - 1) {
-            v0 = this._decodeChar(s.charCodeAt(i));
-            v1 = this._decodeChar(s.charCodeAt(i + 1));
-            out[op++] = v0 << 2 | v1 >>> 4;
-            haveBad |= v0 & INVALID_BYTE;
-            haveBad |= v1 & INVALID_BYTE;
-          }
-          if (i < length - 2) {
-            v2 = this._decodeChar(s.charCodeAt(i + 2));
-            out[op++] = v1 << 4 | v2 >>> 2;
-            haveBad |= v2 & INVALID_BYTE;
-          }
-          if (i < length - 3) {
-            v3 = this._decodeChar(s.charCodeAt(i + 3));
-            out[op++] = v2 << 6 | v3;
-            haveBad |= v3 & INVALID_BYTE;
-          }
-          if (haveBad !== 0) {
-            throw new Error("Base64Coder: incorrect characters for decoding");
-          }
-          return out;
-        };
-        Coder2.prototype._encodeByte = function(b) {
-          var result = b;
-          result += 65;
-          result += 25 - b >>> 8 & 0 - 65 - 26 + 97;
-          result += 51 - b >>> 8 & 26 - 97 - 52 + 48;
-          result += 61 - b >>> 8 & 52 - 48 - 62 + 43;
-          result += 62 - b >>> 8 & 62 - 43 - 63 + 47;
-          return String.fromCharCode(result);
-        };
-        Coder2.prototype._decodeChar = function(c) {
-          var result = INVALID_BYTE;
-          result += (42 - c & c - 44) >>> 8 & -INVALID_BYTE + c - 43 + 62;
-          result += (46 - c & c - 48) >>> 8 & -INVALID_BYTE + c - 47 + 63;
-          result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
-          result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
-          result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
-          return result;
-        };
-        Coder2.prototype._getPaddingLength = function(s) {
-          var paddingLength = 0;
-          if (this._paddingCharacter) {
-            for (var i = s.length - 1; i >= 0; i--) {
-              if (s[i] !== this._paddingCharacter) {
-                break;
-              }
-              paddingLength++;
-            }
-            if (s.length < 4 || paddingLength > 2) {
-              throw new Error("Base64Coder: incorrect padding");
-            }
-          }
-          return paddingLength;
-        };
-        return Coder2;
-      })()
-    );
-    exports.Coder = Coder;
-    var stdCoder = new Coder();
-    function encode(data) {
-      return stdCoder.encode(data);
-    }
-    exports.encode = encode;
-    function decode(s) {
-      return stdCoder.decode(s);
-    }
-    exports.decode = decode;
-    var URLSafeCoder = (
-      /** @class */
-      (function(_super) {
-        __extends(URLSafeCoder2, _super);
-        function URLSafeCoder2() {
-          return _super !== null && _super.apply(this, arguments) || this;
-        }
-        URLSafeCoder2.prototype._encodeByte = function(b) {
-          var result = b;
-          result += 65;
-          result += 25 - b >>> 8 & 0 - 65 - 26 + 97;
-          result += 51 - b >>> 8 & 26 - 97 - 52 + 48;
-          result += 61 - b >>> 8 & 52 - 48 - 62 + 45;
-          result += 62 - b >>> 8 & 62 - 45 - 63 + 95;
-          return String.fromCharCode(result);
-        };
-        URLSafeCoder2.prototype._decodeChar = function(c) {
-          var result = INVALID_BYTE;
-          result += (44 - c & c - 46) >>> 8 & -INVALID_BYTE + c - 45 + 62;
-          result += (94 - c & c - 96) >>> 8 & -INVALID_BYTE + c - 95 + 63;
-          result += (47 - c & c - 58) >>> 8 & -INVALID_BYTE + c - 48 + 52;
-          result += (64 - c & c - 91) >>> 8 & -INVALID_BYTE + c - 65 + 0;
-          result += (96 - c & c - 123) >>> 8 & -INVALID_BYTE + c - 97 + 26;
-          return result;
-        };
-        return URLSafeCoder2;
-      })(Coder)
-    );
-    exports.URLSafeCoder = URLSafeCoder;
-    var urlSafeCoder = new URLSafeCoder();
-    function encodeURLSafe(data) {
-      return urlSafeCoder.encode(data);
-    }
-    exports.encodeURLSafe = encodeURLSafe;
-    function decodeURLSafe(s) {
-      return urlSafeCoder.decode(s);
-    }
-    exports.decodeURLSafe = decodeURLSafe;
-    exports.encodedLength = function(length) {
-      return stdCoder.encodedLength(length);
-    };
-    exports.maxDecodedLength = function(length) {
-      return stdCoder.maxDecodedLength(length);
-    };
-    exports.decodedLength = function(s) {
-      return stdCoder.decodedLength(s);
-    };
-  }
-});
-
-// ../../node_modules/.pnpm/fast-sha256@1.3.0/node_modules/fast-sha256/sha256.js
-var require_sha256 = __commonJS({
-  "../../node_modules/.pnpm/fast-sha256@1.3.0/node_modules/fast-sha256/sha256.js"(exports, module) {
-    "use strict";
-    (function(root, factory) {
-      var exports2 = {};
-      factory(exports2);
-      var sha256 = exports2["default"];
-      for (var k in exports2) {
-        sha256[k] = exports2[k];
-      }
-      if (typeof module === "object" && typeof module.exports === "object") {
-        module.exports = sha256;
-      } else if (typeof define === "function" && define.amd) {
-        define(function() {
-          return sha256;
-        });
-      } else {
-        root.sha256 = sha256;
-      }
-    })(exports, function(exports2) {
-      "use strict";
-      exports2.__esModule = true;
-      exports2.digestLength = 32;
-      exports2.blockSize = 64;
-      var K = new Uint32Array([
-        1116352408,
-        1899447441,
-        3049323471,
-        3921009573,
-        961987163,
-        1508970993,
-        2453635748,
-        2870763221,
-        3624381080,
-        310598401,
-        607225278,
-        1426881987,
-        1925078388,
-        2162078206,
-        2614888103,
-        3248222580,
-        3835390401,
-        4022224774,
-        264347078,
-        604807628,
-        770255983,
-        1249150122,
-        1555081692,
-        1996064986,
-        2554220882,
-        2821834349,
-        2952996808,
-        3210313671,
-        3336571891,
-        3584528711,
-        113926993,
-        338241895,
-        666307205,
-        773529912,
-        1294757372,
-        1396182291,
-        1695183700,
-        1986661051,
-        2177026350,
-        2456956037,
-        2730485921,
-        2820302411,
-        3259730800,
-        3345764771,
-        3516065817,
-        3600352804,
-        4094571909,
-        275423344,
-        430227734,
-        506948616,
-        659060556,
-        883997877,
-        958139571,
-        1322822218,
-        1537002063,
-        1747873779,
-        1955562222,
-        2024104815,
-        2227730452,
-        2361852424,
-        2428436474,
-        2756734187,
-        3204031479,
-        3329325298
-      ]);
-      function hashBlocks(w, v, p, pos, len) {
-        var a, b, c, d, e, f, g, h, u, i, j, t1, t2;
-        while (len >= 64) {
-          a = v[0];
-          b = v[1];
-          c = v[2];
-          d = v[3];
-          e = v[4];
-          f = v[5];
-          g = v[6];
-          h = v[7];
-          for (i = 0; i < 16; i++) {
-            j = pos + i * 4;
-            w[i] = (p[j] & 255) << 24 | (p[j + 1] & 255) << 16 | (p[j + 2] & 255) << 8 | p[j + 3] & 255;
-          }
-          for (i = 16; i < 64; i++) {
-            u = w[i - 2];
-            t1 = (u >>> 17 | u << 32 - 17) ^ (u >>> 19 | u << 32 - 19) ^ u >>> 10;
-            u = w[i - 15];
-            t2 = (u >>> 7 | u << 32 - 7) ^ (u >>> 18 | u << 32 - 18) ^ u >>> 3;
-            w[i] = (t1 + w[i - 7] | 0) + (t2 + w[i - 16] | 0);
-          }
-          for (i = 0; i < 64; i++) {
-            t1 = (((e >>> 6 | e << 32 - 6) ^ (e >>> 11 | e << 32 - 11) ^ (e >>> 25 | e << 32 - 25)) + (e & f ^ ~e & g) | 0) + (h + (K[i] + w[i] | 0) | 0) | 0;
-            t2 = ((a >>> 2 | a << 32 - 2) ^ (a >>> 13 | a << 32 - 13) ^ (a >>> 22 | a << 32 - 22)) + (a & b ^ a & c ^ b & c) | 0;
-            h = g;
-            g = f;
-            f = e;
-            e = d + t1 | 0;
-            d = c;
-            c = b;
-            b = a;
-            a = t1 + t2 | 0;
-          }
-          v[0] += a;
-          v[1] += b;
-          v[2] += c;
-          v[3] += d;
-          v[4] += e;
-          v[5] += f;
-          v[6] += g;
-          v[7] += h;
-          pos += 64;
-          len -= 64;
-        }
-        return pos;
-      }
-      var Hash = (
-        /** @class */
-        (function() {
-          function Hash2() {
-            this.digestLength = exports2.digestLength;
-            this.blockSize = exports2.blockSize;
-            this.state = new Int32Array(8);
-            this.temp = new Int32Array(64);
-            this.buffer = new Uint8Array(128);
-            this.bufferLength = 0;
-            this.bytesHashed = 0;
-            this.finished = false;
-            this.reset();
-          }
-          Hash2.prototype.reset = function() {
-            this.state[0] = 1779033703;
-            this.state[1] = 3144134277;
-            this.state[2] = 1013904242;
-            this.state[3] = 2773480762;
-            this.state[4] = 1359893119;
-            this.state[5] = 2600822924;
-            this.state[6] = 528734635;
-            this.state[7] = 1541459225;
-            this.bufferLength = 0;
-            this.bytesHashed = 0;
-            this.finished = false;
-            return this;
-          };
-          Hash2.prototype.clean = function() {
-            for (var i = 0; i < this.buffer.length; i++) {
-              this.buffer[i] = 0;
-            }
-            for (var i = 0; i < this.temp.length; i++) {
-              this.temp[i] = 0;
-            }
-            this.reset();
-          };
-          Hash2.prototype.update = function(data, dataLength) {
-            if (dataLength === void 0) {
-              dataLength = data.length;
-            }
-            if (this.finished) {
-              throw new Error("SHA256: can't update because hash was finished.");
-            }
-            var dataPos = 0;
-            this.bytesHashed += dataLength;
-            if (this.bufferLength > 0) {
-              while (this.bufferLength < 64 && dataLength > 0) {
-                this.buffer[this.bufferLength++] = data[dataPos++];
-                dataLength--;
-              }
-              if (this.bufferLength === 64) {
-                hashBlocks(this.temp, this.state, this.buffer, 0, 64);
-                this.bufferLength = 0;
-              }
-            }
-            if (dataLength >= 64) {
-              dataPos = hashBlocks(this.temp, this.state, data, dataPos, dataLength);
-              dataLength %= 64;
-            }
-            while (dataLength > 0) {
-              this.buffer[this.bufferLength++] = data[dataPos++];
-              dataLength--;
-            }
-            return this;
-          };
-          Hash2.prototype.finish = function(out) {
-            if (!this.finished) {
-              var bytesHashed = this.bytesHashed;
-              var left = this.bufferLength;
-              var bitLenHi = bytesHashed / 536870912 | 0;
-              var bitLenLo = bytesHashed << 3;
-              var padLength = bytesHashed % 64 < 56 ? 64 : 128;
-              this.buffer[left] = 128;
-              for (var i = left + 1; i < padLength - 8; i++) {
-                this.buffer[i] = 0;
-              }
-              this.buffer[padLength - 8] = bitLenHi >>> 24 & 255;
-              this.buffer[padLength - 7] = bitLenHi >>> 16 & 255;
-              this.buffer[padLength - 6] = bitLenHi >>> 8 & 255;
-              this.buffer[padLength - 5] = bitLenHi >>> 0 & 255;
-              this.buffer[padLength - 4] = bitLenLo >>> 24 & 255;
-              this.buffer[padLength - 3] = bitLenLo >>> 16 & 255;
-              this.buffer[padLength - 2] = bitLenLo >>> 8 & 255;
-              this.buffer[padLength - 1] = bitLenLo >>> 0 & 255;
-              hashBlocks(this.temp, this.state, this.buffer, 0, padLength);
-              this.finished = true;
-            }
-            for (var i = 0; i < 8; i++) {
-              out[i * 4 + 0] = this.state[i] >>> 24 & 255;
-              out[i * 4 + 1] = this.state[i] >>> 16 & 255;
-              out[i * 4 + 2] = this.state[i] >>> 8 & 255;
-              out[i * 4 + 3] = this.state[i] >>> 0 & 255;
-            }
-            return this;
-          };
-          Hash2.prototype.digest = function() {
-            var out = new Uint8Array(this.digestLength);
-            this.finish(out);
-            return out;
-          };
-          Hash2.prototype._saveState = function(out) {
-            for (var i = 0; i < this.state.length; i++) {
-              out[i] = this.state[i];
-            }
-          };
-          Hash2.prototype._restoreState = function(from, bytesHashed) {
-            for (var i = 0; i < this.state.length; i++) {
-              this.state[i] = from[i];
-            }
-            this.bytesHashed = bytesHashed;
-            this.finished = false;
-            this.bufferLength = 0;
-          };
-          return Hash2;
-        })()
-      );
-      exports2.Hash = Hash;
-      var HMAC = (
-        /** @class */
-        (function() {
-          function HMAC2(key) {
-            this.inner = new Hash();
-            this.outer = new Hash();
-            this.blockSize = this.inner.blockSize;
-            this.digestLength = this.inner.digestLength;
-            var pad = new Uint8Array(this.blockSize);
-            if (key.length > this.blockSize) {
-              new Hash().update(key).finish(pad).clean();
-            } else {
-              for (var i = 0; i < key.length; i++) {
-                pad[i] = key[i];
-              }
-            }
-            for (var i = 0; i < pad.length; i++) {
-              pad[i] ^= 54;
-            }
-            this.inner.update(pad);
-            for (var i = 0; i < pad.length; i++) {
-              pad[i] ^= 54 ^ 92;
-            }
-            this.outer.update(pad);
-            this.istate = new Uint32Array(8);
-            this.ostate = new Uint32Array(8);
-            this.inner._saveState(this.istate);
-            this.outer._saveState(this.ostate);
-            for (var i = 0; i < pad.length; i++) {
-              pad[i] = 0;
-            }
-          }
-          HMAC2.prototype.reset = function() {
-            this.inner._restoreState(this.istate, this.inner.blockSize);
-            this.outer._restoreState(this.ostate, this.outer.blockSize);
-            return this;
-          };
-          HMAC2.prototype.clean = function() {
-            for (var i = 0; i < this.istate.length; i++) {
-              this.ostate[i] = this.istate[i] = 0;
-            }
-            this.inner.clean();
-            this.outer.clean();
-          };
-          HMAC2.prototype.update = function(data) {
-            this.inner.update(data);
-            return this;
-          };
-          HMAC2.prototype.finish = function(out) {
-            if (this.outer.finished) {
-              this.outer.finish(out);
-            } else {
-              this.inner.finish(out);
-              this.outer.update(out, this.digestLength).finish(out);
-            }
-            return this;
-          };
-          HMAC2.prototype.digest = function() {
-            var out = new Uint8Array(this.digestLength);
-            this.finish(out);
-            return out;
-          };
-          return HMAC2;
-        })()
-      );
-      exports2.HMAC = HMAC;
-      function hash(data) {
-        var h = new Hash().update(data);
-        var digest = h.digest();
-        h.clean();
-        return digest;
-      }
-      exports2.hash = hash;
-      exports2["default"] = hash;
-      function hmac(key, data) {
-        var h = new HMAC(key).update(data);
-        var digest = h.digest();
-        h.clean();
-        return digest;
-      }
-      exports2.hmac = hmac;
-      function fillBuffer(buffer, hmac2, info, counter) {
-        var num = counter[0];
-        if (num === 0) {
-          throw new Error("hkdf: cannot expand more");
-        }
-        hmac2.reset();
-        if (num > 1) {
-          hmac2.update(buffer);
-        }
-        if (info) {
-          hmac2.update(info);
-        }
-        hmac2.update(counter);
-        hmac2.finish(buffer);
-        counter[0]++;
-      }
-      var hkdfSalt = new Uint8Array(exports2.digestLength);
-      function hkdf(key, salt, info, length) {
-        if (salt === void 0) {
-          salt = hkdfSalt;
-        }
-        if (length === void 0) {
-          length = 32;
-        }
-        var counter = new Uint8Array([1]);
-        var okm = hmac(salt, key);
-        var hmac_ = new HMAC(okm);
-        var buffer = new Uint8Array(hmac_.digestLength);
-        var bufpos = buffer.length;
-        var out = new Uint8Array(length);
-        for (var i = 0; i < length; i++) {
-          if (bufpos === buffer.length) {
-            fillBuffer(buffer, hmac_, info, counter);
-            bufpos = 0;
-          }
-          out[i] = buffer[bufpos++];
-        }
-        hmac_.clean();
-        buffer.fill(0);
-        counter.fill(0);
-        return out;
-      }
-      exports2.hkdf = hkdf;
-      function pbkdf2(password, salt, iterations, dkLen) {
-        var prf = new HMAC(password);
-        var len = prf.digestLength;
-        var ctr = new Uint8Array(4);
-        var t = new Uint8Array(len);
-        var u = new Uint8Array(len);
-        var dk = new Uint8Array(dkLen);
-        for (var i = 0; i * len < dkLen; i++) {
-          var c = i + 1;
-          ctr[0] = c >>> 24 & 255;
-          ctr[1] = c >>> 16 & 255;
-          ctr[2] = c >>> 8 & 255;
-          ctr[3] = c >>> 0 & 255;
-          prf.reset();
-          prf.update(salt);
-          prf.update(ctr);
-          prf.finish(u);
-          for (var j = 0; j < len; j++) {
-            t[j] = u[j];
-          }
-          for (var j = 2; j <= iterations; j++) {
-            prf.reset();
-            prf.update(u).finish(u);
-            for (var k = 0; k < len; k++) {
-              t[k] ^= u[k];
-            }
-          }
-          for (var j = 0; j < len && i * len + j < dkLen; j++) {
-            dk[i * len + j] = t[j];
-          }
-        }
-        for (var i = 0; i < len; i++) {
-          t[i] = u[i] = 0;
-        }
-        for (var i = 0; i < 4; i++) {
-          ctr[i] = 0;
-        }
-        prf.clean();
-        return dk;
-      }
-      exports2.pbkdf2 = pbkdf2;
-    });
-  }
-});
-
-// ../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/index.js
-var require_dist = __commonJS({
-  "../../node_modules/.pnpm/standardwebhooks@1.0.0/node_modules/standardwebhooks/dist/index.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.Webhook = exports.WebhookVerificationError = void 0;
-    var timing_safe_equal_1 = require_timing_safe_equal();
-    var base64 = require_base64();
-    var sha256 = require_sha256();
-    var WEBHOOK_TOLERANCE_IN_SECONDS = 5 * 60;
-    var ExtendableError = class _ExtendableError extends Error {
-      constructor(message) {
-        super(message);
-        Object.setPrototypeOf(this, _ExtendableError.prototype);
-        this.name = "ExtendableError";
-        this.stack = new Error(message).stack;
-      }
-    };
-    var WebhookVerificationError = class _WebhookVerificationError extends ExtendableError {
-      constructor(message) {
-        super(message);
-        Object.setPrototypeOf(this, _WebhookVerificationError.prototype);
-        this.name = "WebhookVerificationError";
-      }
-    };
-    exports.WebhookVerificationError = WebhookVerificationError;
-    var Webhook2 = class _Webhook {
-      constructor(secret, options) {
-        if (!secret) {
-          throw new Error("Secret can't be empty.");
-        }
-        if ((options === null || options === void 0 ? void 0 : options.format) === "raw") {
-          if (secret instanceof Uint8Array) {
-            this.key = secret;
-          } else {
-            this.key = Uint8Array.from(secret, (c) => c.charCodeAt(0));
-          }
-        } else {
-          if (typeof secret !== "string") {
-            throw new Error("Expected secret to be of type string");
-          }
-          if (secret.startsWith(_Webhook.prefix)) {
-            secret = secret.substring(_Webhook.prefix.length);
-          }
-          this.key = base64.decode(secret);
-        }
-      }
-      verify(payload, headers_) {
-        const headers = {};
-        for (const key of Object.keys(headers_)) {
-          headers[key.toLowerCase()] = headers_[key];
-        }
-        const msgId = headers["webhook-id"];
-        const msgSignature = headers["webhook-signature"];
-        const msgTimestamp = headers["webhook-timestamp"];
-        if (!msgSignature || !msgId || !msgTimestamp) {
-          throw new WebhookVerificationError("Missing required headers");
-        }
-        const timestamp = this.verifyTimestamp(msgTimestamp);
-        const computedSignature = this.sign(msgId, timestamp, payload);
-        const expectedSignature = computedSignature.split(",")[1];
-        const passedSignatures = msgSignature.split(" ");
-        const encoder2 = new globalThis.TextEncoder();
-        for (const versionedSignature of passedSignatures) {
-          const [version3, signature] = versionedSignature.split(",");
-          if (version3 !== "v1") {
-            continue;
-          }
-          if ((0, timing_safe_equal_1.timingSafeEqual)(encoder2.encode(signature), encoder2.encode(expectedSignature))) {
-            return JSON.parse(payload.toString());
-          }
-        }
-        throw new WebhookVerificationError("No matching signature found");
-      }
-      sign(msgId, timestamp, payload) {
-        if (typeof payload === "string") {
-        } else if (payload.constructor.name === "Buffer") {
-          payload = payload.toString();
-        } else {
-          throw new Error("Expected payload to be of type string or Buffer.");
-        }
-        const encoder2 = new TextEncoder();
-        const timestampNumber = Math.floor(timestamp.getTime() / 1e3);
-        const toSign = encoder2.encode(`${msgId}.${timestampNumber}.${payload}`);
-        const expectedSignature = base64.encode(sha256.hmac(this.key, toSign));
-        return `v1,${expectedSignature}`;
-      }
-      verifyTimestamp(timestampHeader) {
-        const now = Math.floor(Date.now() / 1e3);
-        const timestamp = parseInt(timestampHeader, 10);
-        if (isNaN(timestamp)) {
-          throw new WebhookVerificationError("Invalid Signature Headers");
-        }
-        if (now - timestamp > WEBHOOK_TOLERANCE_IN_SECONDS) {
-          throw new WebhookVerificationError("Message timestamp too old");
-        }
-        if (timestamp > now + WEBHOOK_TOLERANCE_IN_SECONDS) {
-          throw new WebhookVerificationError("Message timestamp too new");
-        }
-        return new Date(timestamp * 1e3);
-      }
-    };
-    exports.Webhook = Webhook2;
-    Webhook2.prefix = "whsec_";
-  }
-});
-
-// src/args.ts
-var VALUE_FLAGS = /* @__PURE__ */ new Set([
-  "config",
-  "client",
-  "mode",
-  "port",
-  "host",
-  "agent",
-  "run-id",
-  "run",
-  "base",
-  "head",
-  "paths",
-  "format",
-  "by",
-  "note",
-  "allow",
-  "deny",
-  "writes",
-  "spend",
-  "tool-calls",
-  "deletes",
-  "emails",
-  "reason",
-  "url",
-  "timeout",
-  "out",
-  "upstream"
-]);
-function parseArgs(argv) {
-  const out = { command: void 0, positionals: [], flags: {} };
-  const push = (key, value) => {
-    const existing = out.flags[key];
-    if (existing === void 0) out.flags[key] = value;
-    else if (Array.isArray(existing)) existing.push(String(value));
-    else out.flags[key] = [String(existing), String(value)];
-  };
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === "--") {
-      out.positionals.push(...argv.slice(i + 1));
-      break;
-    }
-    if (arg.startsWith("--")) {
-      const body = arg.slice(2);
-      const eq = body.indexOf("=");
-      if (eq >= 0) {
-        push(body.slice(0, eq), body.slice(eq + 1));
-        continue;
-      }
-      if (body.startsWith("no-")) {
-        push(body.slice(3), false);
-        continue;
-      }
-      const next = argv[i + 1];
-      if (VALUE_FLAGS.has(body) && next !== void 0 && !next.startsWith("--")) {
-        push(body, next);
-        i += 1;
-      } else push(body, true);
-      continue;
-    }
-    if (arg.startsWith("-") && arg.length === 2) {
-      const short = {
-        c: "config",
-        y: "yes",
-        h: "help",
-        v: "version",
-        j: "json",
-        a: "all"
-      };
-      const key = short[arg[1]] ?? arg[1];
-      const next = argv[i + 1];
-      if (VALUE_FLAGS.has(key) && next !== void 0 && !next.startsWith("-")) {
-        push(key, next);
-        i += 1;
-      } else push(key, true);
-      continue;
-    }
-    if (out.command === void 0) out.command = arg;
-    else out.positionals.push(arg);
-  }
-  return out;
-}
-function flagString(args, name) {
-  const v = args.flags[name];
-  if (Array.isArray(v)) return v[v.length - 1];
-  return typeof v === "string" ? v : void 0;
-}
-function flagList(args, name) {
-  const v = args.flags[name];
-  if (Array.isArray(v)) return v.flatMap((s) => s.split(","));
-  return typeof v === "string" ? v.split(",") : [];
-}
-function flagBool(args, name) {
-  const v = args.flags[name];
-  if (typeof v === "boolean") return v;
-  if (typeof v === "string") return v !== "false" && v !== "0";
-  return void 0;
-}
-function flagNumber(args, name) {
-  const s = flagString(args, name);
-  if (s === void 0) return void 0;
-  const n = Number(s);
-  return Number.isFinite(n) ? n : void 0;
-}
-
-// src/version.ts
-import { readFileSync } from "fs";
-var cached;
-function version() {
-  if (cached !== void 0) return cached;
-  try {
-    cached = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
-  } catch {
-    cached = "0.0.0";
-  }
-  return cached;
-}
-
-// src/context.ts
-import { existsSync as existsSync3 } from "fs";
-import { resolve } from "path";
-import { Guard } from "@agentwares/agentguard-core";
-import {
-  FileApprovalStore,
-  FileAuditSink,
-  FileKillSwitch as FileKillSwitch2,
-  FileStateStore,
-  loadPolicyFile
-} from "@agentwares/agentguard-core/node";
-import { existsSync as exists, readFileSync as readFileSync3 } from "fs";
-
-// ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
-import { completable } from "@modelcontextprotocol/sdk/server/completable.js";
-import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
-import {
-  CreateMessageResultSchema,
-  ElicitResultSchema,
-  SubscribeRequestSchema,
-  UnsubscribeRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-import { z } from "zod";
-
-// ../../packages/x402/dist/index.js
-var USDC_BASE = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-var USDC_DECIMALS = 6;
-var USDC_EIP712_DOMAIN = { name: "USD Coin", version: "2" };
-function toAtomicUnits(amountUsd, decimals = USDC_DECIMALS) {
-  const trimmed = amountUsd.trim();
-  if (!/^\d+(\.\d+)?$/.test(trimmed)) throw new Error(`not a decimal amount: ${amountUsd}`);
-  const [whole = "0", fraction = ""] = trimmed.split(".");
-  if (fraction.length > decimals) {
-    throw new Error(`${amountUsd} has more than ${decimals} decimal places`);
-  }
-  return `${whole}${fraction.padEnd(decimals, "0")}`.replace(/^0+(?=\d)/, "");
-}
-var DEFAULT_X402_NETWORK = "eip155:8453";
-var X402_HEADER = "X-Payment-Requirements";
-var X402_REQUIRED_HEADER = "PAYMENT-REQUIRED";
-function toAmount(priceUsd) {
-  if (!Number.isFinite(priceUsd) || priceUsd < 0)
-    throw new Error("priceUsd must be a non-negative number");
-  return priceUsd.toFixed(6).replace(/0+$/, "").replace(/\.$/, ".0");
-}
-function buildPaymentRequired(opts) {
-  const amountUsd = toAmount(opts.priceUsd);
-  const creditsPayTo = opts.creditsPayTo ?? opts.selfServe?.keysUrl;
-  const accepts = [];
-  if (opts.payTo) {
-    accepts.push({
-      rail: "x402",
-      scheme: "exact",
-      amountUsd,
-      amount: toAtomicUnits(amountUsd, opts.assetDecimals),
-      resource: opts.resource,
-      description: opts.description,
-      mimeType: "application/json",
-      network: opts.network ?? DEFAULT_X402_NETWORK,
-      asset: opts.asset ?? USDC_BASE,
-      extra: opts.assetDomain ?? USDC_EIP712_DOMAIN,
-      payTo: opts.payTo,
-      maxTimeoutSeconds: 300,
-      ...opts.bazaar ? { bazaar: opts.bazaar } : {}
-    });
-  }
-  if (creditsPayTo) {
-    accepts.push({
-      rail: "prepaid_credits",
-      amountUsd,
-      resource: opts.resource,
-      description: opts.description,
-      currency: "usd",
-      payTo: creditsPayTo,
-      maxTimeoutSeconds: 300,
-      // funding a balance ends at a hosted Stripe Checkout page, which an agent cannot fill in
-      humanRequired: true
-    });
-  }
-  const live = opts.live === true;
-  const selfServe = opts.selfServe;
-  const x402Rail = accepts.find((a) => a.rail === "x402" && a.payTo);
-  const usdcFix = x402Rail ? `Pay in USDC with no account and no human: take the \`accepts\` entry with \`rail: "x402"\`, sign an EIP-3009 transferWithAuthorization for ${x402Rail.amountUsd} USDC to ${x402Rail.payTo} on ${x402Rail.network}, and retry with it base64 in the X-PAYMENT header. The facilitator submits the transfer, so you need USDC and no gas. ` : "";
-  const sampleFix = opts.sampleMode ? "Free first: retry with sample=true \u2014 no key, no payment. " : "";
-  const cardFix = selfServe ? `Or pay by card: POST ${selfServe.keysUrl} (no auth, no signup) returns a key and a Stripe Checkout URL. Funding that key needs a person at a browser; if you are running unattended, surface the URL to your operator rather than retrying, or use the USDC rail above. Once funded, send Authorization: Bearer <key>, plus Idempotency-Key so a repeated call is charged once.` : "";
-  const liveFix = usdcFix || cardFix ? `${sampleFix}${usdcFix}${cardFix}`.trim() : "Retry with a PAYMENT header satisfying one of `accepts`, or send an API key with credit balance.";
-  const body = {
-    code: "PAYMENT_REQUIRED",
-    cause: live ? `This call costs $${amountUsd}. No valid payment or credit was presented.` : `This call costs $${amountUsd}. Pay-per-call (x402 / Stripe MPP) is coming soon; use an API key with prepaid credits.`,
-    fix: live ? liveFix : `Create an API key${opts.signupUrl ? ` at ${opts.signupUrl}` : ""} and retry with Authorization: Bearer <key>. Try the free sample mode first.`,
-    retryable: true,
-    priceUsd: opts.priceUsd,
-    accepts,
-    comingSoon: !live,
-    alternatives: [
-      ...creditsPayTo ? ["api_key_credits"] : [],
-      ...opts.sampleMode ? ["sample_mode"] : []
-    ],
-    ...selfServe ? { selfServe } : {},
-    ...opts.bazaar ? { extensions: { bazaar: opts.bazaar } } : {}
-  };
-  const encoded = JSON.stringify({
-    x402Version: 2,
-    accepts,
-    resource: opts.resource,
-    ...opts.bazaar ? { extensions: { bazaar: opts.bazaar } } : {}
-  });
-  const headers = {
-    "Content-Type": "application/json",
-    "WWW-Authenticate": `Payment realm="agentwares", methods="x402 prepaid_credits", price="${amountUsd} USD"`,
-    [X402_HEADER]: encoded,
-    [X402_REQUIRED_HEADER]: btoa(encoded),
-    "Cache-Control": "no-store"
-  };
-  return { status: 402, headers, body };
-}
-var StubVerifier = class {
-  async verify(request, requirement) {
-    const hasHeader = request.headers.has("PAYMENT") || request.headers.has("X-PAYMENT");
-    return {
-      ok: false,
-      rail: requirement.rail,
-      reason: hasHeader ? "payments are not live yet (phase 2: wallet). Use an API key with credits." : "no payment header present"
-    };
-  }
-};
-
-// ../../packages/mcp-kit/dist/chunk-7LRFDQNC.js
-import { z as z2 } from "zod";
-import { z as z3 } from "zod";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import {
-  CallToolRequestSchema,
-  ErrorCode,
-  ListToolsRequestSchema,
-  McpError
-} from "@modelcontextprotocol/sdk/types.js";
-import { z as z4 } from "zod";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-var ERROR_CODES = [
-  "INVALID_INPUT",
-  "NOT_FOUND",
-  "UNAUTHORIZED",
-  "PAYMENT_REQUIRED",
-  "RATE_LIMITED",
-  "UPSTREAM_ERROR",
-  "INTERNAL"
-];
-var DEFAULT_RETRYABLE = {
-  INVALID_INPUT: false,
-  NOT_FOUND: false,
-  UNAUTHORIZED: false,
-  PAYMENT_REQUIRED: true,
-  RATE_LIMITED: true,
-  UPSTREAM_ERROR: true,
-  INTERNAL: false
-};
-var DEFAULT_HTTP_STATUS = {
-  INVALID_INPUT: 400,
-  NOT_FOUND: 404,
-  UNAUTHORIZED: 401,
-  PAYMENT_REQUIRED: 402,
-  RATE_LIMITED: 429,
-  UPSTREAM_ERROR: 502,
-  INTERNAL: 500
-};
-var INTERNAL_FIX = "retry; if it persists, report the request id";
-function isStandardCode(code) {
-  return ERROR_CODES.includes(code);
-}
-var McpToolError = class extends Error {
-  code;
-  cause;
-  fix;
-  retryable;
-  details;
-  httpStatus;
-  extra;
-  constructor(init) {
-    super(`${init.code}: ${init.cause}`);
-    this.name = "McpToolError";
-    this.code = init.code;
-    this.cause = init.cause;
-    this.fix = init.fix;
-    this.retryable = init.retryable ?? (isStandardCode(init.code) ? DEFAULT_RETRYABLE[init.code] : false);
-    this.details = init.details;
-    this.httpStatus = init.httpStatus ?? (isStandardCode(init.code) ? DEFAULT_HTTP_STATUS[init.code] : 500);
-    this.extra = init.extra;
-  }
-  /** The body agents see: `{ code, cause, fix, retryable, details?, ...extra }`. */
-  toJSON() {
-    const body = {
-      ...this.extra,
-      code: this.code,
-      cause: this.cause,
-      fix: this.fix,
-      retryable: this.retryable
-    };
-    if (this.details !== void 0) body.details = this.details;
-    return body;
-  }
-};
-function toolError(codeOrInit, cause, fix, extra) {
-  if (typeof codeOrInit === "object") return new McpToolError(codeOrInit);
-  return new McpToolError({ code: codeOrInit, cause: cause ?? "", fix: fix ?? "", ...extra });
-}
-function describeUnknown(err) {
-  if (err instanceof Error) return err.message || err.name;
-  if (typeof err === "string") return err;
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
-}
-function normalizeError(err) {
-  if (err instanceof McpToolError) return err;
-  return new McpToolError({
-    code: "INTERNAL",
-    cause: describeUnknown(err),
-    fix: INTERNAL_FIX,
-    retryable: false
-  });
-}
-function errorResult(err, opts = {}) {
-  const error = normalizeError(err);
-  const body = error.toJSON();
-  const meta = { httpStatus: error.httpStatus };
-  if (opts.requestId !== void 0) meta.requestId = opts.requestId;
-  Object.assign(meta, opts.meta);
-  return {
-    isError: true,
-    content: [{ type: "text", text: JSON.stringify(body) }],
-    structuredContent: body,
-    _meta: meta
-  };
-}
-function createToolContext(init = {}) {
-  const { headers, ...rest } = init;
-  return { headers: headers ?? new Headers(), ...rest };
-}
-var TOOL_NAME_PATTERN = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
-var MIN_NAMESPACE_LENGTH = 3;
-var MIN_DESCRIPTION_LENGTH = 20;
-function isValidToolName(name) {
-  if (!TOOL_NAME_PATTERN.test(name)) return false;
-  const namespace = name.split("_")[0] ?? "";
-  return namespace.length >= MIN_NAMESPACE_LENGTH;
-}
-function assertToolName(name) {
-  if (!isValidToolName(name)) {
-    throw new Error(
-      `tool name must be namespaced: <namespace>_<verb>_<object>, got ${JSON.stringify(name)}`
-    );
-  }
-}
-function isPlainObject(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function isCallToolResult(value) {
-  if (!isPlainObject(value) || !Array.isArray(value.content)) return false;
-  return value.content.every(
-    (block) => isPlainObject(block) && typeof block.type === "string"
-  );
-}
-function toCallToolResult(value) {
-  if (isCallToolResult(value)) return value;
-  const text = typeof value === "string" ? value : JSON.stringify(value ?? null, null, 2);
-  const result = { content: [{ type: "text", text }] };
-  if (isPlainObject(value)) result.structuredContent = value;
-  return result;
-}
-function issuePath(issue) {
-  return issue.path.map(String).join(".") || "(root)";
-}
-function invalidInputError(issues) {
-  const fields = [...new Set(issues.map(issuePath))];
-  const summary = issues.map((issue) => `${issuePath(issue)}: ${issue.message}`).join("; ");
-  return toolError({
-    code: "INVALID_INPUT",
-    cause: `invalid input for ${fields.join(", ")} \u2014 ${summary}`,
-    fix: `fix ${fields.join(", ")} to match the tool's inputSchema (see details.issues), then retry`,
-    retryable: false,
-    details: {
-      fields,
-      issues: issues.map((issue) => ({
-        path: issue.path.map(String),
-        code: issue.code,
-        message: issue.message
-      }))
-    }
-  });
-}
-function defineTool(opts) {
-  assertToolName(opts.name);
-  if (typeof opts.description !== "string" || opts.description.trim().length < MIN_DESCRIPTION_LENGTH) {
-    throw new Error(
-      `tool ${opts.name}: description must be at least ${MIN_DESCRIPTION_LENGTH} characters \u2014 say what it does, when to use it and what it returns`
-    );
-  }
-  const { name, title, description, input, output, annotations } = opts;
-  const handler = opts.handler.bind(opts);
-  const tool = {
-    name,
-    title,
-    description,
-    input,
-    output,
-    annotations,
-    handler,
-    async invoke(rawInput, ctx) {
-      const fail2 = (err) => {
-        const result = errorResult(err, { requestId: ctx.requestId });
-        if (output) delete result.structuredContent;
-        return result;
-      };
-      const parsed = input.safeParse(rawInput ?? {});
-      if (!parsed.success) return fail2(invalidInputError(parsed.error.issues));
-      try {
-        const value = await handler(parsed.data, ctx);
-        if (output && !isCallToolResult(value)) {
-          const checked = output.safeParse(value);
-          if (!checked.success) {
-            throw toolError({
-              code: "INTERNAL",
-              cause: `tool ${name} returned a value that does not match its output schema \u2014 ${checked.error.issues.map((issue) => `${issuePath(issue)}: ${issue.message}`).join("; ")}`,
-              fix: "this is a bug in the tool, not in your call; report it with the request id",
-              retryable: false,
-              details: { issues: checked.error.issues }
-            });
-          }
-          return toCallToolResult(checked.data);
-        }
-        return toCallToolResult(value);
-      } catch (err) {
-        return fail2(err);
-      }
-    }
-  };
-  return tool;
-}
-var PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
-var WAV_BASE64 = "UklGRiQAAABXQVZFZm10IBAAAAABAAEARKwAAIhYAQACABAAZGF0YQAAAAA=";
-var STATIC_TEXT_URI = "test://static-text";
-var STATIC_TEXT = "This is a static text resource for testing.";
-var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
-function embeddedResource() {
-  return {
-    type: "resource",
-    resource: { uri: STATIC_TEXT_URI, mimeType: "text/plain", text: STATIC_TEXT }
-  };
-}
-function requireExtra(ctx) {
-  if (!ctx.extra) {
-    throw toolError("INTERNAL", "no client connection in this context", "call this tool over MCP");
-  }
-  return ctx.extra;
-}
-async function elicit(ctx, message, requestedSchema) {
-  const result = await requireExtra(ctx).sendRequest(
-    { method: "elicitation/create", params: { message, requestedSchema } },
-    ElicitResultSchema
-  );
-  return `Elicitation completed: action=${result.action}, content=${JSON.stringify(result.content ?? {})}`;
-}
-var conformanceTools = [
-  defineTool({
-    name: "test_simple_text",
-    description: "Conformance fixture: returns a fixed simple text response.",
-    input: z.object({}),
-    handler: () => "This is a simple text response for testing."
-  }),
-  defineTool({
-    name: "test_error_handling",
-    description: "Conformance fixture: always returns an error result (isError: true).",
-    input: z.object({}),
-    handler: () => {
-      throw toolError({
-        code: "UPSTREAM_ERROR",
-        cause: "This tool intentionally returns an error for testing",
-        fix: "nothing to fix; this fixture always fails",
-        retryable: false
-      });
-    }
-  }),
-  defineTool({
-    name: "test_image_content",
-    description: "Conformance fixture: returns a 1x1 PNG image content block.",
-    input: z.object({}),
-    handler: () => ({ content: [{ type: "image", data: PNG_BASE64, mimeType: "image/png" }] })
-  }),
-  defineTool({
-    name: "test_audio_content",
-    description: "Conformance fixture: returns an empty WAV audio content block.",
-    input: z.object({}),
-    handler: () => ({ content: [{ type: "audio", data: WAV_BASE64, mimeType: "audio/wav" }] })
-  }),
-  defineTool({
-    name: "test_embedded_resource",
-    description: "Conformance fixture: returns an embedded text resource content block.",
-    input: z.object({}),
-    handler: () => ({ content: [embeddedResource()] })
-  }),
-  defineTool({
-    name: "test_multiple_content_types",
-    description: "Conformance fixture: returns text, image and resource content blocks together.",
-    input: z.object({}),
-    handler: () => ({
-      content: [
-        { type: "text", text: "Mixed content response" },
-        { type: "image", data: PNG_BASE64, mimeType: "image/png" },
-        embeddedResource()
-      ]
-    })
-  }),
-  defineTool({
-    name: "test_tool_with_logging",
-    description: "Conformance fixture: emits three info log notifications while running.",
-    input: z.object({}),
-    handler: async (_input, ctx) => {
-      await ctx.log?.("info", "Tool execution started");
-      await sleep(50);
-      await ctx.log?.("info", "Tool processing data");
-      await sleep(50);
-      await ctx.log?.("info", "Tool execution completed");
-      return "Tool execution completed with logging";
-    }
-  }),
-  defineTool({
-    name: "test_tool_with_progress",
-    description: "Conformance fixture: reports progress 0/100, 50/100, 100/100 while running.",
-    input: z.object({}),
-    handler: async (_input, ctx) => {
-      await ctx.progress?.(0, 100, "starting");
-      await sleep(50);
-      await ctx.progress?.(50, 100, "halfway");
-      await sleep(50);
-      await ctx.progress?.(100, 100, "done");
-      return "Tool execution completed with progress";
-    }
-  }),
-  defineTool({
-    name: "test_sampling",
-    description: "Conformance fixture: asks the client to sample a completion and returns it.",
-    input: z.object({ prompt: z.string().describe("Prompt to send to the client's model") }),
-    handler: async ({ prompt }, ctx) => {
-      const result = await requireExtra(ctx).sendRequest(
-        {
-          method: "sampling/createMessage",
-          params: {
-            messages: [{ role: "user", content: { type: "text", text: prompt } }],
-            maxTokens: 100
-          }
-        },
-        CreateMessageResultSchema
-      );
-      const content = Array.isArray(result.content) ? result.content[0] : result.content;
-      const text = content && content.type === "text" ? content.text : JSON.stringify(content);
-      return `Sampling completed (${result.model}): ${text}`;
-    }
-  }),
-  defineTool({
-    name: "test_elicitation",
-    description: "Conformance fixture: asks the client for user input and reports the outcome.",
-    input: z.object({ message: z.string().describe("Message shown to the user") }),
-    handler: ({ message }, ctx) => elicit(ctx, message, {
-      type: "object",
-      properties: {
-        name: { type: "string", title: "Name", description: "Your name" },
-        email: { type: "string", title: "Email", format: "email" }
-      },
-      required: ["name"]
-    })
-  }),
-  defineTool({
-    name: "test_elicitation_sep1034_defaults",
-    description: "Conformance fixture: elicitation schema with defaults for every primitive type.",
-    input: z.object({}),
-    handler: (_input, ctx) => elicit(ctx, "Please confirm your details", {
-      type: "object",
-      properties: {
-        name: { type: "string", title: "Name", default: "John Doe" },
-        age: { type: "integer", title: "Age", default: 30 },
-        score: { type: "number", title: "Score", default: 95.5 },
-        status: {
-          type: "string",
-          title: "Status",
-          enum: ["active", "inactive", "pending"],
-          default: "active"
-        },
-        verified: { type: "boolean", title: "Verified", default: true }
-      }
-    })
-  }),
-  defineTool({
-    name: "test_elicitation_sep1330_enums",
-    description: "Conformance fixture: elicitation schema with titled, untitled and multi-select enums.",
-    input: z.object({}),
-    handler: (_input, ctx) => elicit(ctx, "Pick some options", {
-      type: "object",
-      properties: {
-        untitledSingle: {
-          type: "string",
-          title: "Untitled single",
-          enum: ["red", "green", "blue"]
-        },
-        titledSingle: {
-          type: "string",
-          title: "Titled single",
-          oneOf: [
-            { const: "red", title: "Red" },
-            { const: "green", title: "Green" },
-            { const: "blue", title: "Blue" }
-          ]
-        },
-        legacyEnum: {
-          type: "string",
-          title: "Legacy titled",
-          enum: ["red", "green", "blue"],
-          enumNames: ["Red", "Green", "Blue"]
-        },
-        untitledMulti: {
-          type: "array",
-          title: "Untitled multi",
-          items: { type: "string", enum: ["red", "green", "blue"] }
-        },
-        titledMulti: {
-          type: "array",
-          title: "Titled multi",
-          items: {
-            anyOf: [
-              { const: "red", title: "Red" },
-              { const: "green", title: "Green" },
-              { const: "blue", title: "Blue" }
-            ]
-          }
-        }
-      }
-    })
-  }),
-  defineTool({
-    name: "json_schema_2020_12_tool",
-    description: "Conformance fixture: input schema with a $defs reference to an address object.",
-    input: z.object({
-      name: z.string(),
-      address: z.object({ street: z.string(), city: z.string() }).meta({ id: "address" })
-    }),
-    handler: (input) => input
-  })
-];
-function paymentRequiredError(body, reason) {
-  const { code, cause, fix, retryable, ...rest } = body;
-  return toolError({
-    code,
-    cause,
-    fix,
-    retryable,
-    httpStatus: 402,
-    details: reason !== void 0 ? { reason } : void 0,
-    extra: rest
-  });
-}
-function formatUsd(priceUsd) {
-  return priceUsd.toFixed(6).replace(/0+$/, "").replace(/\.$/, ".00").replace(/\.(\d)$/, ".$10");
-}
-function withPayment(tool, opts) {
-  if (!Number.isFinite(opts.priceUsd) || opts.priceUsd < 0) {
-    throw new Error(`withPayment(${tool.name}): priceUsd must be a non-negative number`);
-  }
-  const sampleField = opts.sampleField ?? "sample";
-  if (sampleField in tool.input.shape) {
-    throw new Error(
-      `withPayment(${tool.name}): input already has a field named ${JSON.stringify(sampleField)}; pass sampleField to rename it`
-    );
-  }
-  const verifier = opts.verifier ?? new StubVerifier();
-  const liveRail = opts.verifier !== void 0;
-  const input = tool.input.extend({
-    [sampleField]: z2.boolean().default(false).describe(
-      "Set true to return an example response at no charge (sample mode). Default false."
-    )
-  });
-  const description = `${tool.description.trim()} Paid: $${formatUsd(opts.priceUsd)} per call; without credit you get a PAYMENT_REQUIRED result. Set ${sampleField}=true for a free example response.`;
-  return defineTool({
-    name: tool.name,
-    title: tool.title,
-    description,
-    input,
-    output: tool.output,
-    annotations: tool.annotations,
-    async handler(raw, ctx) {
-      const record = { ...raw };
-      const sample = record[sampleField] === true;
-      delete record[sampleField];
-      if (sample) return tool.handler(record, { ...ctx, sample: true });
-      let reason;
-      if (opts.authorize) {
-        const auth = await opts.authorize(ctx);
-        if (auth.ok) return tool.handler(record, { ...ctx, userId: auth.userId });
-        reason = auth.reason;
-      }
-      const resource = ctx.resourceUrl ?? tool.name;
-      const required = buildPaymentRequired({
-        resource,
-        priceUsd: opts.priceUsd,
-        live: opts.live,
-        description: opts.description,
-        payTo: opts.payTo,
-        creditsPayTo: opts.creditsPayTo,
-        signupUrl: opts.signupUrl,
-        selfServe: opts.selfServe,
-        // withPayment always adds a free `sample` flag to the tool's input schema
-        sampleMode: true,
-        ...opts.bazaar ? { bazaar: opts.bazaar } : {}
-      });
-      const advertised = required.body.accepts.find((a) => a.rail === "prepaid_credits") ?? required.body.accepts[0];
-      const requirement = advertised ?? {
-        rail: "prepaid_credits",
-        amountUsd: String(required.body.priceUsd),
-        resource,
-        ...opts.description ? { description: opts.description } : {}
-      };
-      const verified = await verifier.verify(
-        new Request(`https://mcp.local/${tool.name}`, { headers: ctx.headers }),
-        requirement
-      );
-      if (verified.ok) {
-        let result;
-        try {
-          result = await tool.handler(record, ctx);
-        } catch (error) {
-          await opts.onPaidFailure?.(ctx, verified, error);
-          throw error;
-        }
-        const settled = await verifier.settle?.(verified);
-        if (settled && !settled.ok) {
-          opts.onSettlementFailure?.(ctx, verified, settled.reason);
-        }
-        return result;
-      }
-      reason = liveRail ? verified.reason ?? reason : reason ?? verified.reason;
-      throw paymentRequiredError(required.body, reason);
-    }
-  });
-}
-var exampleEcho = defineTool({
-  name: "example_echo",
-  title: "Echo",
-  description: "Echo a message back unchanged. Use it to check the connection and to see the result shape mcp-kit tools return (JSON text plus structuredContent).",
-  input: z3.object({ message: z3.string().describe("Text to echo back") }),
-  output: z3.object({ message: z3.string() }),
-  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
-  handler: ({ message }) => ({ message })
-});
-var exampleAdd = defineTool({
-  name: "example_add",
-  title: "Add",
-  description: "Add two numbers and return their sum as { sum }. Demonstrates typed input and output schemas; send non-numbers to see an INVALID_INPUT error result.",
-  input: z3.object({
-    a: z3.number().describe("First addend"),
-    b: z3.number().describe("Second addend")
-  }),
-  output: z3.object({ sum: z3.number() }),
-  annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
-  handler: ({ a, b }) => ({ sum: a + b })
-});
-var examplePaidLookup = withPayment(
-  defineTool({
-    name: "example_paid_lookup",
-    title: "Paid lookup",
-    description: "Look up a record by query and return { query, result, sample } (fake data). Demonstrates a paid tool: without an entitlement the call returns a PAYMENT_REQUIRED result with x402 and MPP payment options.",
-    input: z3.object({ query: z3.string().min(1).describe("What to look up") }),
-    output: z3.object({ query: z3.string(), result: z3.string(), sample: z3.boolean() }),
-    annotations: { readOnlyHint: true, idempotentHint: true },
-    handler: ({ query }, ctx) => ({
-      query,
-      result: ctx.sample ? `SAMPLE: example record for "${query}"` : `record for "${query}"`,
-      sample: ctx.sample === true
-    })
-  }),
-  { priceUsd: 0.05, description: "One record lookup" }
-);
-function isZodObject(schema) {
-  return schema instanceof z4.ZodObject;
-}
-function contextFromExtra(extra) {
-  const headers = new Headers();
-  const raw = extra.requestInfo?.headers;
-  if (raw) {
-    for (const [key, value] of Object.entries(raw)) {
-      if (Array.isArray(value)) for (const item of value) headers.append(key, item);
-      else if (typeof value === "string") headers.append(key, value);
-    }
-  }
-  const progressToken = extra._meta?.progressToken;
-  return {
-    headers,
-    requestId: String(extra.requestId),
-    signal: extra.signal,
-    sessionId: extra.sessionId,
-    meta: extra._meta,
-    extra,
-    log: async (level, data) => {
-      await extra.sendNotification({ method: "notifications/message", params: { level, data } });
-    },
-    progress: async (progress, total, message) => {
-      if (progressToken === void 0) return;
-      await extra.sendNotification({
-        method: "notifications/progress",
-        params: { progressToken, progress, total, message }
-      });
-    }
-  };
-}
-function createMcpServer(opts) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const tool of opts.tools) {
-    if (byName.has(tool.name)) throw new Error(`duplicate tool name: ${tool.name}`);
-    byName.set(tool.name, tool);
-  }
-  const server = new McpServer(
-    { name: opts.name, version: opts.version, title: opts.title, websiteUrl: opts.websiteUrl },
-    { instructions: opts.instructions, capabilities: { logging: {}, ...opts.capabilities } }
-  );
-  const registered = /* @__PURE__ */ new Map();
-  for (const tool of byName.values()) {
-    const config = {
-      title: tool.title,
-      description: tool.description,
-      inputSchema: tool.input,
-      annotations: tool.annotations
-    };
-    if (isZodObject(tool.output)) config.outputSchema = tool.output;
-    registered.set(
-      tool.name,
-      server.registerTool(tool.name, config, () => {
-        throw new Error("unreachable: mcp-kit dispatches tools/call itself");
-      })
-    );
-  }
-  if (byName.size > 0) {
-    server.server.setRequestHandler(ListToolsRequestSchema, async () => {
-      const enabled = [...byName.values()].filter(
-        (tool) => registered.get(tool.name)?.enabled !== false
-      );
-      return {
-        tools: listToolManifest(enabled).map((entry) => ({
-          ...entry,
-          inputSchema: entry.inputSchema,
-          outputSchema: entry.outputSchema
-        }))
-      };
-    });
-    server.server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-      const name = request.params.name;
-      const tool = byName.get(name);
-      const entry = registered.get(name);
-      if (!tool || !entry) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} not found`);
-      if (!entry.enabled) throw new McpError(ErrorCode.InvalidParams, `Tool ${name} disabled`);
-      return tool.invoke(request.params.arguments ?? {}, contextFromExtra(extra));
-    });
-  }
-  return server;
-}
-function toJsonSchema(schema, io = "input") {
-  const json2 = z4.toJSONSchema(schema, { io, target: "draft-2020-12" });
-  if (isZodObject(schema) && schema._zod.def.catchall === void 0 && json2.additionalProperties === void 0) {
-    json2.additionalProperties = false;
-  }
-  return json2;
-}
-function listToolManifest(tools) {
-  return tools.map((tool) => {
-    const entry = {
-      name: tool.name,
-      description: tool.description,
-      inputSchema: toJsonSchema(tool.input, "input")
-    };
-    if (tool.title !== void 0) entry.title = tool.title;
-    if (isZodObject(tool.output)) entry.outputSchema = toJsonSchema(tool.output, "output");
-    if (tool.annotations !== void 0) entry.annotations = tool.annotations;
-    return entry;
-  });
-}
-var DEFAULT_CORS = {
-  origin: "*",
-  methods: "GET, POST, DELETE, OPTIONS",
-  headers: "Content-Type, Accept, Authorization, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, PAYMENT, X-PAYMENT",
-  exposeHeaders: "Mcp-Session-Id, Mcp-Protocol-Version, WWW-Authenticate, X-Payment-Requirements, PAYMENT-REQUIRED",
-  maxAge: 86400
-};
-var DEFAULT_SESSION_TTL_MS = 30 * 6e4;
-function corsHeaders(cors) {
-  if (!cors) return {};
-  const c = { ...DEFAULT_CORS, ...typeof cors === "object" ? cors : {} };
-  return {
-    "Access-Control-Allow-Origin": c.origin,
-    "Access-Control-Allow-Methods": c.methods,
-    "Access-Control-Allow-Headers": c.headers,
-    "Access-Control-Expose-Headers": c.exposeHeaders,
-    "Access-Control-Max-Age": String(c.maxAge)
-  };
-}
-function jsonResponse(body, status, headers = {}) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers }
-  });
-}
-function methodNotAllowed(method, allow, cors) {
-  return jsonResponse(
-    {
-      code: "METHOD_NOT_ALLOWED",
-      cause: `${method} is not supported here without a session`,
-      fix: "send JSON-RPC over POST with `Accept: application/json, text/event-stream` (start with `initialize`)",
-      retryable: false
-    },
-    405,
-    { Allow: allow, ...cors }
-  );
-}
-function splitOptions(opts, transport) {
-  if (typeof opts === "function") return { factory: opts, transport };
-  const {
-    cors,
-    jsonResponse: jsonResponse2,
-    sessions,
-    allowedHosts,
-    allowedOrigins,
-    enableDnsRebindingProtection,
-    ...server
-  } = opts;
-  return {
-    factory: () => createMcpServer(server),
-    transport: {
-      cors,
-      jsonResponse: jsonResponse2,
-      sessions,
-      allowedHosts,
-      allowedOrigins,
-      enableDnsRebindingProtection,
-      ...transport
-    }
-  };
-}
-function withCors(response, cors) {
-  const keys = Object.keys(cors);
-  if (keys.length === 0) return response;
-  const headers = new Headers(response.headers);
-  for (const key of keys) headers.set(key, cors[key] ?? "");
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function errorResponse(err, cors) {
-  const error = normalizeError(err);
-  return jsonResponse(error.toJSON(), error.httpStatus, cors);
-}
-function createStatelessHandler({ factory, cors, transportBase }) {
-  return async (request) => {
-    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
-    const server = factory();
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      ...transportBase,
-      sessionIdGenerator: void 0
-    });
-    let closed = false;
-    const cleanup = async () => {
-      if (closed) return;
-      closed = true;
-      try {
-        await server.close();
-      } catch {
-      }
-    };
-    try {
-      await server.connect(transport);
-      const response = withCors(await transport.handleRequest(request), cors);
-      if (!response.body) {
-        await cleanup();
-        return response;
-      }
-      request.signal?.addEventListener("abort", () => void cleanup(), { once: true });
-      const body = response.body.pipeThrough(
-        new TransformStream({ flush: () => cleanup() })
-      );
-      return new Response(body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
-    } catch (err) {
-      await cleanup();
-      return errorResponse(err, cors);
-    }
-  };
-}
-function createStatefulHandler({ factory, cors, transportBase }, options) {
-  const ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
-  const sessions = /* @__PURE__ */ new Map();
-  const drop = (id) => {
-    const session = sessions.get(id);
-    if (!session) return;
-    sessions.delete(id);
-    session.server.close().catch(() => void 0);
-  };
-  const sweep = () => {
-    const now = Date.now();
-    for (const [id, session] of sessions) if (now - session.lastSeen > ttlMs) drop(id);
-  };
-  return async (request) => {
-    const sessionId = request.headers.get("mcp-session-id");
-    if (sessionId) {
-      const session = sessions.get(sessionId);
-      if (!session) {
-        return jsonResponse(
-          {
-            code: "NOT_FOUND",
-            cause: "unknown or expired Mcp-Session-Id",
-            fix: "send `initialize` again without an Mcp-Session-Id header and use the id from the response",
-            retryable: true
-          },
-          404,
-          cors
-        );
-      }
-      session.lastSeen = Date.now();
-      try {
-        return withCors(await session.transport.handleRequest(request), cors);
-      } catch (err) {
-        return errorResponse(err, cors);
-      }
-    }
-    if (request.method !== "POST") return methodNotAllowed(request.method, "POST, OPTIONS", cors);
-    sweep();
-    const server = factory();
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      ...transportBase,
-      sessionIdGenerator: () => crypto.randomUUID(),
-      onsessioninitialized: (id) => {
-        sessions.set(id, { server, transport, lastSeen: Date.now() });
-      },
-      onsessionclosed: (id) => {
-        sessions.delete(id);
-      }
-    });
-    try {
-      await server.connect(transport);
-      const previousOnClose = transport.onclose;
-      transport.onclose = () => {
-        previousOnClose?.();
-        if (transport.sessionId) sessions.delete(transport.sessionId);
-      };
-      const response = withCors(await transport.handleRequest(request), cors);
-      if (!transport.sessionId) server.close().catch(() => void 0);
-      return response;
-    } catch (err) {
-      server.close().catch(() => void 0);
-      return errorResponse(err, cors);
-    }
-  };
-}
-function createHttpHandler(opts, transportOptions = {}) {
-  const { factory, transport: t } = splitOptions(opts, transportOptions);
-  const cors = corsHeaders(t.cors);
-  const sessions = t.sessions ? typeof t.sessions === "object" ? t.sessions : {} : void 0;
-  const context = {
-    factory,
-    cors,
-    transportBase: {
-      enableJsonResponse: t.jsonResponse ?? sessions === void 0,
-      allowedHosts: t.allowedHosts,
-      allowedOrigins: t.allowedOrigins,
-      enableDnsRebindingProtection: t.enableDnsRebindingProtection
-    }
-  };
-  const handler = sessions ? createStatefulHandler(context, sessions) : createStatelessHandler(context);
-  const allow = sessions ? "GET, POST, DELETE, OPTIONS" : "POST, OPTIONS";
-  return async (request) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, { status: 204, headers: { Allow: allow, ...cors } });
-    }
-    return handler(request);
-  };
-}
-function localhostHosts(port) {
-  const hosts = ["localhost", "127.0.0.1", "[::1]"];
-  return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
-}
-
-// ../../packages/mcp-kit/dist/chunk-M567BWMA.js
-var LIST_MAX_PAGES = 20;
-var LIST_MAX_ITEMS = 2e3;
-async function readAllPages(fetchPage, opts = {}) {
-  const maxPages = opts.maxPages ?? LIST_MAX_PAGES;
-  const maxItems = opts.maxItems ?? LIST_MAX_ITEMS;
-  const method = opts.method ?? "tools/list";
-  const items = [];
-  const followed = /* @__PURE__ */ new Set();
-  let cursor;
-  for (let page = 1; ; page++) {
-    const res = await fetchPage(cursor, page);
-    if (Array.isArray(res.items)) items.push(...res.items);
-    const next = res.nextCursor;
-    const more = typeof next === "string" && next !== "";
-    if (items.length > maxItems) {
-      return {
-        items,
-        pages: page,
-        truncated: {
-          ceiling: "items",
-          reason: `${method} listed more than ${maxItems} items in ${page} page${page === 1 ? "" : "s"}${more ? " and had more" : ""}; at most ${maxItems} are read`
-        }
-      };
-    }
-    if (!more) return { items, pages: page };
-    if (followed.has(next)) return { items, pages: page, repeatedCursor: true };
-    if (page >= maxPages) {
-      return {
-        items,
-        pages: page,
-        truncated: {
-          ceiling: "pages",
-          reason: `${method} had more than ${maxPages} pages (${items.length} items read); at most ${maxPages} pages are read`
-        }
-      };
-    }
-    followed.add(next);
-    cursor = next;
-  }
-}
-
-// ../../packages/mcp-kit/dist/index.js
-import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
-async function serveStdio(serverOrOpts) {
-  const server = serverOrOpts instanceof McpServer2 ? serverOrOpts : createMcpServer(serverOrOpts);
-  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  await new Promise((resolve5) => {
-    const previous = transport.onclose;
-    transport.onclose = () => {
-      previous?.();
-      resolve5();
-    };
-  });
-}
-
-// src/proxy/http.ts
-import { writeFileSync, unlinkSync, existsSync as existsSync2, mkdirSync } from "fs";
-import { createServer } from "http";
-import { join } from "path";
-import { FileKillSwitch } from "@agentwares/agentguard-core/node";
-
-// src/proxy/server.ts
-import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import {
-  CallToolRequestSchema as CallToolRequestSchema2,
-  CompleteRequestSchema,
-  GetPromptRequestSchema,
-  ListPromptsRequestSchema,
-  ListResourceTemplatesRequestSchema,
-  ListResourcesRequestSchema,
-  ListToolsRequestSchema as ListToolsRequestSchema2,
-  ReadResourceRequestSchema,
-  SetLevelRequestSchema,
-  SubscribeRequestSchema as SubscribeRequestSchema2,
-  UnsubscribeRequestSchema as UnsubscribeRequestSchema2
-} from "@modelcontextprotocol/sdk/types.js";
 import {
-  keyFromHeaders,
-  resolveAgent
-} from "@agentwares/agentguard-core";
-
-// src/proxy/own-tools.ts
-import {
-  buildReport,
-  latestRunId,
-  listRuns,
-  parseAuditJsonl,
-  renderReportMarkdown,
-  verifyChain
-} from "@agentwares/agentguard-core";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { z as z5 } from "zod";
-var INIT_COMMAND = "npx -y @agentwares/agentguard init";
-var READ_ONLY = {
-  readOnlyHint: true,
-  destructiveHint: false,
-  idempotentHint: true,
-  openWorldHint: false
-};
-var runIdInput = z5.string().min(1).max(128).optional().describe(
-  "Run to read, as it appears in the audit log (for example run_20261007093015_ab12, or the X-Run-Id an HTTP client sent). Omit it for the most recent run."
-);
-var counters = z5.record(z5.string(), z5.number()).describe(
-  "counter name (tool_calls, writes, deletes, emails, spend_usd or a custom one) \u2192 value"
-);
-function readAudit(path) {
-  if (!existsSync(path)) return { exists: false, entries: [] };
-  try {
-    return { exists: true, entries: parseAuditJsonl(readFileSync2(path, "utf8")) };
-  } catch (err) {
-    return { exists: true, entries: [], error: err instanceof Error ? err.message : String(err) };
-  }
-}
-function unreadable(path, error) {
-  return toolError({
-    code: "AUDIT_UNREADABLE",
-    cause: `the audit log at ${path} could not be read: ${error}`,
-    fix: "call agentguard_verify_audit_log to see where it breaks; a hand-edited or truncated line has to be restored from a copy",
-    retryable: false
-  });
-}
-function numbers(caps) {
-  const out = {};
-  for (const [k, v] of Object.entries(caps)) if (typeof v === "number") out[k] = v;
-  return out;
-}
-function nextStep(runtime) {
-  if (!runtime.configured)
-    return `agentguard is guarding nothing: no policy file at ${runtime.loaded.path}. Run \`${INIT_COMMAND}\` in the project directory: it writes agentguard.yaml in dry-run mode and routes the project's MCP servers through agentguard (backup kept, \`--undo\` restores). Then restart the MCP client.`;
-  if (runtime.policy.upstreams.length === 0)
-    return `${runtime.loaded.path} lists no upstream servers, so agentguard is guarding nothing. Add the MCP servers your agent uses under \`upstreams:\` in that file (it has commented examples), then restart the MCP client.`;
-  return "agentguard is running; run your agent, then read agentguard_get_report.";
-}
-var StatusOutput = z5.object({
-  configured: z5.boolean().describe(
-    "true when a policy file was found and loaded; false means agentguard guards nothing"
-  ),
-  policy_path: z5.string().describe("absolute path of the policy file read, or looked for"),
-  mode: z5.enum(["dry-run", "enforce"]).describe("dry-run fakes writes and spends and records them; enforce lets allowed calls run"),
-  upstreams: z5.array(
-    z5.object({
-      name: z5.string().describe("upstream name from the policy"),
-      connected: z5.boolean().describe("whether agentguard is connected to it"),
-      tools: z5.number().int().describe("tools it exposes"),
-      transport: z5.enum(["stdio", "http"]).describe("how agentguard reaches it"),
-      error: z5.string().optional().describe("why it is not connected")
-    })
-  ).describe("the MCP servers this proxy fronts; empty means none are configured"),
-  run_id: z5.string().nullable().describe(
-    "run the usage is for: the requested run_id, else the latest run in the log, else null"
-  ),
-  caps: z5.object({ per_run: counters, per_day: counters }).describe("limits from the policy; a counter that is absent has no cap"),
-  used: z5.object({ per_run: counters, per_day: counters }).describe("what that run, and today, have used against the caps"),
-  remaining: z5.record(
-    z5.string(),
-    z5.object({ per_run: z5.number().optional(), per_day: z5.number().optional() })
-  ).describe("budget left per capped counter, per run and per day"),
-  kill_switch: z5.object({
-    on: z5.boolean().describe("true halts every tool call with KILLED"),
-    reason: z5.string().optional().describe("why it was pulled"),
-    source: z5.string().optional().describe("file, env or memory")
-  }).describe("the kill switch state"),
-  pending_approvals: z5.number().int().describe("destructive calls waiting for a human decision"),
-  audit_log: z5.object({
-    path: z5.string().describe("absolute path of the hash-chained JSONL audit log"),
-    entries: z5.number().int().describe("entries in it; 0 when it does not exist yet")
-  }).describe("where every tool call is recorded"),
-  next_step: z5.string().describe("the one thing to do next, with the command when there is one")
-});
-var ReportOutput = z5.object({
-  configured: z5.boolean().describe("false when no policy file was found (agentguard guards nothing)"),
-  audit_log_path: z5.string().describe("absolute path of the audit log the report was built from"),
-  run_id: z5.string().nullable().describe("the run reported on; null when the log has no runs"),
-  runs_in_log: z5.number().int().describe("how many runs the audit log holds"),
-  tool_calls: z5.number().int().describe("tool calls in this run"),
-  would_have: z5.object({
-    creates: z5.number().int(),
-    updates: z5.number().int(),
-    deletes: z5.number().int(),
-    sends: z5.number().int(),
-    executes: z5.number().int(),
-    spends: z5.number().int(),
-    spend_usd: z5.number()
-  }).describe("what dry-run mode faked: what the run would have done had the calls executed"),
-  did: z5.object({
-    writes: z5.number().int(),
-    deletes: z5.number().int(),
-    sends: z5.number().int(),
-    spend_usd: z5.number()
-  }).describe("what actually executed upstream"),
-  halts: z5.array(
-    z5.object({
-      seq: z5.number().int().describe("audit entry number"),
-      ts: z5.string().describe("ISO time of the call"),
-      code: z5.string().describe("CAP_EXCEEDED, LOOP_DETECTED, KILLED, APPROVAL_REQUIRED, \u2026"),
-      tool: z5.string().describe("the tool that was stopped"),
-      cause: z5.string().describe("why")
-    })
-  ).describe("every call agentguard stopped, in order"),
-  top_tools: z5.array(z5.object({ tool: z5.string(), calls: z5.number().int(), class: z5.string() })).describe("the most-called tools with their class (read, write, spend)"),
-  markdown: z5.string().describe("the same report `agentguard report` prints, as Markdown")
-});
-var VerifyOutput = z5.object({
-  configured: z5.boolean().describe("false when no policy file was found (agentguard guards nothing)"),
-  path: z5.string().describe("absolute path of the audit log checked"),
-  exists: z5.boolean().describe("false when no call has been recorded yet; an absent log verifies"),
-  ok: z5.boolean().describe("true when every entry's hash and prev_hash recompute"),
-  entries: z5.number().int().describe("entries checked"),
-  head_hash: z5.string().nullable().describe(
-    "hash of the last entry; record it with the count to detect entries cut from the end"
-  ),
-  broken_at: z5.number().int().nullable().describe("seq of the first entry that does not verify"),
-  reason: z5.string().nullable().describe("why verification failed")
-});
-function createOwnTools(runtime) {
-  const status = defineTool({
-    name: "agentguard_get_status",
-    title: "agentguard status",
-    description: "Report what agentguard is guarding right now: the policy file it loaded (or that none was found), dry-run or enforce mode, each upstream MCP server and whether it connected, a run's cap usage and remaining budget, the kill switch, and pending approvals. Call it first to learn whether agentguard is set up; next_step says what to do when it is not. For what a run did, use agentguard_get_report; to check the log was not edited, agentguard_verify_audit_log. Reads local files only and changes nothing.",
-    input: z5.strictObject({ run_id: runIdInput }),
-    output: StatusOutput,
-    annotations: { title: "agentguard status", ...READ_ONLY },
-    async handler({ run_id }) {
-      const { loaded, guard } = runtime;
-      const audit = readAudit(loaded.auditPath);
-      if (audit.error) throw unreadable(loaded.auditPath, audit.error);
-      const runId = run_id ?? latestRunId(audit.entries) ?? null;
-      const state = await guard.status(runId ?? "(none yet)");
-      const pending = await guard.approvals.list("pending");
-      return {
-        configured: runtime.configured,
-        policy_path: loaded.path,
-        mode: runtime.policy.mode,
-        upstreams: runtime.upstreamStatus(),
-        run_id: runId,
-        caps: { per_run: numbers(state.caps.per_run), per_day: numbers(state.caps.per_day) },
-        used: state.usage,
-        remaining: state.remaining,
-        kill_switch: {
-          on: state.killed.killed,
-          ...state.killed.reason ? { reason: state.killed.reason } : {},
-          ...state.killed.source ? { source: state.killed.source } : {}
-        },
-        pending_approvals: pending.length,
-        audit_log: { path: loaded.auditPath, entries: audit.entries.length },
-        next_step: nextStep(runtime)
-      };
-    }
-  });
-  const report = defineTool({
-    name: "agentguard_get_report",
-    title: "agentguard run report",
-    description: "Summarize one run from agentguard's audit log: how many tool calls, what dry-run mode faked (records it would have created, updated or deleted, messages sent, dollars spent), what really ran upstream, and every call agentguard halted with its code and cause. Defaults to the most recent run. Use it after an agent run, before switching a policy from dry-run to enforce; for live caps and the kill switch use agentguard_get_status. Read-only: reads the audit file and does not record this call.",
-    input: z5.strictObject({ run_id: runIdInput }),
-    output: ReportOutput,
-    annotations: { title: "agentguard run report", ...READ_ONLY },
-    handler({ run_id }) {
-      const { loaded } = runtime;
-      const audit = readAudit(loaded.auditPath);
-      if (audit.error) throw unreadable(loaded.auditPath, audit.error);
-      const runs = listRuns(audit.entries);
-      if (run_id && !runs.some((r) => r.runId === run_id)) {
-        throw toolError({
-          code: "NOT_FOUND",
-          cause: `no run "${run_id}" in the audit log at ${loaded.auditPath}`,
-          fix: `call again without run_id for the latest run${runs.length ? `; runs in the log: ${runs.slice(0, 5).map((r) => r.runId).join(", ")}` : "; the log has no runs yet"}`,
-          retryable: false
-        });
-      }
-      const runId = run_id ?? latestRunId(audit.entries) ?? null;
-      const built = buildReport(audit.entries, { runId: runId ?? void 0 });
-      const markdown = runId ? renderReportMarkdown(built) : `# agentguard report
-
-No runs recorded in ${loaded.auditPath} yet. ${nextStep(runtime)}`;
-      return {
-        configured: runtime.configured,
-        audit_log_path: loaded.auditPath,
-        run_id: runId,
-        runs_in_log: runs.length,
-        tool_calls: runId ? audit.entries.filter((e) => e.run_id === runId).length : 0,
-        would_have: {
-          creates: built.wouldHave.creates,
-          updates: built.wouldHave.updates,
-          deletes: built.wouldHave.deletes,
-          sends: built.wouldHave.sends,
-          executes: built.wouldHave.executes,
-          spends: built.wouldHave.spends,
-          spend_usd: built.wouldHave.spendUsd
-        },
-        did: {
-          writes: built.did.writes,
-          deletes: built.did.deletes,
-          sends: built.did.sends,
-          spend_usd: built.did.spendUsd
-        },
-        halts: built.halts,
-        top_tools: built.topTools,
-        markdown
-      };
-    }
-  });
-  const verify = defineTool({
-    name: "agentguard_verify_audit_log",
-    title: "Verify agentguard audit log",
-    description: "Recompute the hash chain of agentguard's audit log (JSONL, one entry per tool call) and say whether any entry was edited, removed from the middle or reordered, naming the first broken entry. Returns the entry count and head hash; record both elsewhere, because entries cut from the end of the file still verify. Use it before trusting agentguard_get_report. Takes no arguments: it checks the log the loaded policy names. Read-only; a log that does not exist yet verifies as empty.",
-    input: z5.strictObject({}),
-    output: VerifyOutput,
-    annotations: { title: "Verify agentguard audit log", ...READ_ONLY },
-    async handler() {
-      const { loaded } = runtime;
-      const audit = readAudit(loaded.auditPath);
-      if (audit.error) {
-        return {
-          configured: runtime.configured,
-          path: loaded.auditPath,
-          exists: true,
-          ok: false,
-          entries: 0,
-          head_hash: null,
-          broken_at: null,
-          reason: audit.error
-        };
-      }
-      const result = await verifyChain(audit.entries);
-      return {
-        configured: runtime.configured,
-        path: loaded.auditPath,
-        exists: audit.exists,
-        ok: result.ok,
-        entries: result.entries,
-        // an empty chain's head is the genesis hash, which is not an entry anyone can record
-        head_hash: result.entries > 0 ? result.head ?? null : null,
-        broken_at: result.brokenAt ?? null,
-        reason: result.reason ?? null
-      };
-    }
-  });
-  return [status, report, verify];
-}
-function ownToolsActive(runtime) {
-  return runtime.upstreamStatus().length === 0;
-}
-function ownToolList(tools) {
-  return listToolManifest(tools);
-}
-async function callOwnTool(tools, name, args, requestId) {
-  const tool = tools.find((t) => t.name === name);
-  if (!tool) return void 0;
-  return tool.invoke(args, createToolContext({ requestId }));
-}
-
-// src/proxy/server.ts
-var PROXY_VERSION = version();
-function headerValue(extra, name) {
-  const raw = extra.requestInfo?.headers?.[name] ?? extra.requestInfo?.headers?.[name.toLowerCase()];
-  if (Array.isArray(raw)) return raw[0];
-  return typeof raw === "string" ? raw : void 0;
-}
-function headersOf(extra) {
-  const out = {};
-  for (const [k, v] of Object.entries(extra.requestInfo?.headers ?? {}))
-    out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
-  return out;
-}
-function runIdFor(extra, meta, fallback) {
-  const header = headerValue(extra, "x-run-id");
-  if (header && header.trim()) return header.trim().slice(0, 128);
-  const fromMeta = meta?.runId ?? meta?.["agentguard/runId"] ?? meta?.run_id;
-  if (typeof fromMeta === "string" && fromMeta.trim()) return fromMeta.trim().slice(0, 128);
-  if (extra.sessionId) return `sess_${extra.sessionId.slice(0, 12)}`;
-  return fallback;
-}
-function toCallToolResult2(result, tool) {
-  const meta = {
-    agentguard: {
-      class: result.decision.classification.class,
-      verb: result.decision.classification.verb,
-      mode: result.decision.mode,
-      outcome: result.outcome,
-      dryRun: result.faked,
-      seq: result.entry.seq,
-      run_id: result.entry.run_id
-    }
-  };
-  const hasOutputSchema = Boolean(tool?.tool.outputSchema);
-  if (result.error) {
-    const upstream2 = result.value;
-    if (upstream2 && upstream2.content) {
-      return { ...upstream2, isError: true, _meta: { ...upstream2._meta ?? {}, ...meta } };
-    }
-    const body = result.error;
-    return {
-      isError: true,
-      content: [{ type: "text", text: JSON.stringify(body) }],
-      ...hasOutputSchema ? {} : { structuredContent: body },
-      _meta: { ...meta, httpStatus: httpStatusFor(body.code) }
-    };
-  }
-  if (result.faked) {
-    const value = result.value;
-    const isObject = value !== null && typeof value === "object" && !Array.isArray(value);
-    return {
-      content: [
-        { type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }
-      ],
-      ...isObject ? { structuredContent: value } : {},
-      _meta: meta
-    };
-  }
-  const upstream = result.value;
-  return { ...upstream, _meta: { ...upstream._meta ?? {}, ...meta } };
-}
-function httpStatusFor(code) {
-  switch (code) {
-    case "KILLED":
-    case "TOOL_DENIED":
-    case "APPROVAL_DENIED":
-      return 403;
-    case "APPROVAL_REQUIRED":
-      return 202;
-    case "CAP_EXCEEDED":
-    case "LOOP_DETECTED":
-      return 429;
-    case "UNKNOWN_TOOL":
-      return 404;
-    case "UPSTREAM_ERROR":
-      return 502;
-    default:
-      return 500;
-  }
-}
-function annotateTool(t, mode) {
-  return {
-    ...t.tool,
-    name: t.name,
-    _meta: {
-      ...t.tool._meta ?? {},
-      agentguard: {
-        upstream: t.upstream,
-        class: t.classification.class,
-        verb: t.classification.verb,
-        mode
-      }
-    }
-  };
-}
-function killedError(state) {
-  return Object.assign(
-    new Error(`agentguard kill switch is on (${state.source ?? "?"}: ${state.reason ?? ""})`),
-    { code: -32e3 }
-  );
-}
-function serverInstructions(runtime) {
-  if (ownToolsActive(runtime))
-    return `agentguard is an MCP policy proxy, and this one fronts no upstream MCP servers${runtime.configured ? "" : ` (no policy file at ${runtime.loaded.path})`}, so it serves only its own read-only tools: agentguard_get_status (what it guards, caps, kill switch), agentguard_get_report (what a run did or would have done) and agentguard_verify_audit_log. To guard the user's MCP servers, run \`${INIT_COMMAND}\` in the project directory and restart the client.`;
-  return `Tool calls pass through agentguard (${runtime.policy.mode} mode). Errors carry { code, cause, fix, retryable }; follow "fix". CAP_EXCEEDED, LOOP_DETECTED and KILLED are not retryable: stop and report to the user. APPROVAL_REQUIRED: relay the approval command to the user, then retry the identical call once.`;
-}
-function createDownstreamServer(runtime, opts = {}) {
-  const server = new McpServer3(
-    { name: "agentguard", version: PROXY_VERSION, title: "agentguard policy proxy" },
-    {
-      capabilities: {
-        tools: { listChanged: true },
-        resources: { subscribe: true, listChanged: true },
-        prompts: { listChanged: true },
-        logging: {},
-        completions: {}
-      },
-      instructions: serverInstructions(runtime)
-    }
-  );
-  const ownTools = createOwnTools(runtime);
-  const session = {
-    id: crypto.randomUUID(),
-    server,
-    lastActive: Date.now(),
-    inflight: /* @__PURE__ */ new Map()
-  };
-  runtime.attach(session);
-  const previousOnClose = server.server.onclose;
-  server.server.onclose = () => {
-    previousOnClose?.();
-    runtime.detach(session);
-  };
-  const touch = () => {
-    session.lastActive = Date.now();
-  };
-  const agentFor = async (extra) => {
-    const key = keyFromHeaders(headersOf(extra));
-    if (!key) return { agent: void 0 };
-    const resolved = await resolveAgent(runtime.policy, { key });
-    if (resolved.error) {
-      return {
-        agent: null,
-        error: {
-          code: "TOOL_DENIED",
-          cause: "the agent key in Authorization / X-Agentguard-Key is not in agentguard.yaml",
-          fix: "use a key created with `agentguard key create <agent>`, or omit the key to use the global policy",
-          retryable: false
-        }
-      };
-    }
-    return { agent: resolved.agent };
-  };
-  const low = server.server;
-  low.setRequestHandler(ListToolsRequestSchema2, async (_req, extra) => {
-    touch();
-    const { agent } = await agentFor(extra);
-    const scope = agent === void 0 ? runtime.agent : agent;
-    if (ownToolsActive(runtime)) return { tools: ownToolList(ownTools) };
-    return {
-      tools: runtime.listTools(scope).map((t) => annotateTool(t, scope?.mode ?? runtime.policy.mode))
-    };
-  });
-  low.setRequestHandler(CallToolRequestSchema2, async (req, extra) => {
-    touch();
-    if (ownToolsActive(runtime)) {
-      const own = await callOwnTool(
-        ownTools,
-        req.params.name,
-        req.params.arguments ?? {},
-        String(extra.requestId)
-      );
-      if (own) return own;
-    }
-    const { agent, error } = await agentFor(extra);
-    const runId = runIdFor(extra, req.params._meta, opts.defaultRunId ?? runtime.defaultRunId);
-    if (error) {
-      return {
-        isError: true,
-        content: [{ type: "text", text: JSON.stringify(error) }],
-        structuredContent: error,
-        _meta: { httpStatus: 401 }
-      };
-    }
-    const progressToken = req.params._meta?.progressToken;
-    const { result, tool } = await runtime.callTool(req.params.name, req.params.arguments ?? {}, {
-      runId,
-      agent,
-      sessionId: extra.sessionId ?? session.id,
-      session,
-      requestId: extra.requestId,
-      onprogress: progressToken === void 0 ? void 0 : (p) => {
-        void extra.sendNotification({
-          method: "notifications/progress",
-          params: { progressToken, ...p }
-        });
-      }
-    });
-    return toCallToolResult2(result, tool);
-  });
-  const guardRead = async () => {
-    const state = await runtime.guard.killState();
-    if (state.killed) throw killedError(state);
-  };
-  low.setRequestHandler(ListResourcesRequestSchema, async () => {
-    touch();
-    return runtime.listResources();
-  });
-  low.setRequestHandler(ListResourceTemplatesRequestSchema, async () => {
-    touch();
-    return runtime.listResourceTemplates();
-  });
-  low.setRequestHandler(ReadResourceRequestSchema, async (req) => {
-    touch();
-    await guardRead();
-    return runtime.readResource(req.params.uri);
-  });
-  low.setRequestHandler(SubscribeRequestSchema2, async (req) => {
-    await runtime.subscribe(req.params.uri, true);
-    return {};
-  });
-  low.setRequestHandler(UnsubscribeRequestSchema2, async (req) => {
-    await runtime.subscribe(req.params.uri, false);
-    return {};
-  });
-  low.setRequestHandler(ListPromptsRequestSchema, async () => {
-    touch();
-    return runtime.listPrompts();
-  });
-  low.setRequestHandler(GetPromptRequestSchema, async (req) => {
-    touch();
-    await guardRead();
-    return runtime.getPrompt(req.params.name, req.params.arguments);
-  });
-  low.setRequestHandler(CompleteRequestSchema, async (req) => {
-    touch();
-    return runtime.complete(req.params);
-  });
-  low.setRequestHandler(SetLevelRequestSchema, async (req) => {
-    await runtime.setLevel(req.params.level);
-    return {};
-  });
-  return server;
-}
-
-// src/proxy/http.ts
-function registrationPath(stateDir) {
-  return join(stateDir, "http.json");
-}
-function json(res, status, body) {
-  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
-  res.end(JSON.stringify(body));
-}
-function html(res, status, body) {
-  res.writeHead(status, {
-    "Content-Type": "text/html; charset=utf-8",
-    "Cache-Control": "no-store"
-  });
-  res.end(
-    `<!doctype html><meta name="viewport" content="width=device-width"><body style="font:16px system-ui;padding:2rem;max-width:40rem">${body}</body>`
-  );
-}
-async function readBody(req) {
-  if (req.method === "GET" || req.method === "HEAD") return void 0;
-  const chunks = [];
-  for await (const chunk of req) chunks.push(chunk);
-  return new Uint8Array(Buffer.concat(chunks));
-}
-function isLoopback(host) {
-  return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
-}
-async function startHttpProxy(opts) {
-  const { runtime } = opts;
-  const host = opts.host ?? "127.0.0.1";
-  const path = opts.path ?? "/mcp";
-  const token = opts.token ?? crypto.randomUUID().replace(/-/g, "");
-  const kill = new FileKillSwitch(runtime.loaded.killPath);
-  const holder = {};
-  const server = createServer((req, res) => {
-    void (async () => {
-      const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
-      const authorized = () => {
-        const q = url2.searchParams.get("token");
-        const h = req.headers.authorization?.replace(/^Bearer\s+/i, "");
-        return q === token || h === token;
-      };
-      if (url2.pathname === path && holder.mcp) {
-        const headers = new Headers();
-        for (const [k, v] of Object.entries(req.headers)) {
-          if (Array.isArray(v)) for (const item of v) headers.append(k, item);
-          else if (typeof v === "string") headers.set(k, v);
-        }
-        const controller = new AbortController();
-        res.on("close", () => {
-          if (!res.writableFinished) controller.abort();
-        });
-        const response = await holder.mcp(
-          new Request(url2, {
-            method: req.method ?? "GET",
-            headers,
-            body: await readBody(req),
-            signal: controller.signal
-          })
-        );
-        const out = {};
-        response.headers.forEach((v, k) => {
-          out[k] = v;
-        });
-        res.writeHead(response.status, out);
-        if (!response.body) return res.end();
-        const reader = response.body.getReader();
-        try {
-          for (; ; ) {
-            const { done, value } = await reader.read();
-            if (done) break;
-            res.write(value);
-          }
-        } catch {
-        }
-        return res.end();
-      }
-      if (url2.pathname === "/health") {
-        const killed = await runtime.guard.killState();
-        return json(res, 200, {
-          ok: true,
-          name: "agentguard",
-          version: PROXY_VERSION,
-          mode: runtime.policy.mode,
-          killed: killed.killed,
-          upstreams: runtime.upstreamStatus(),
-          tools: runtime.listTools().length,
-          mcp: `${url2.origin}${path}`
-        });
-      }
-      if (url2.pathname === "/status") {
-        if (!authorized()) return json(res, 401, unauthorized());
-        const runId = url2.searchParams.get("run") ?? runtime.defaultRunId;
-        return json(res, 200, { runId, ...await runtime.guard.status(runId) });
-      }
-      if (url2.pathname === "/kill" && req.method === "POST") {
-        if (!authorized()) return json(res, 401, unauthorized());
-        const body = await readBody(req);
-        let reason = "killed via HTTP";
-        try {
-          const parsed = JSON.parse(Buffer.from(body ?? []).toString("utf8") || "{}");
-          if (parsed.reason) reason = String(parsed.reason).slice(0, 200);
-        } catch {
-        }
-        kill.kill(reason);
-        await runtime.guard.halt(reason);
-        return json(res, 200, { killed: true, reason });
-      }
-      if (url2.pathname === "/resume" && req.method === "POST") {
-        if (!authorized()) return json(res, 401, unauthorized());
-        kill.resume();
-        await runtime.guard.resume();
-        return json(res, 200, { killed: false });
-      }
-      const decision = /^\/(approve|deny)\/([A-Za-z0-9_-]+)$/.exec(url2.pathname);
-      if (decision) {
-        if (!authorized()) return json(res, 401, unauthorized());
-        const [, action, id] = decision;
-        const record = await runtime.guard.decide(
-          id,
-          action === "approve" ? "approved" : "denied",
-          "http"
-        );
-        if (!record)
-          return json(res, 404, {
-            code: "NOT_FOUND",
-            cause: `no approval ${id}`,
-            fix: "list pending approvals with `agentguard approvals`",
-            retryable: false
-          });
-        if (req.headers.accept?.includes("text/html")) {
-          return html(
-            res,
-            200,
-            `<h1>${record.status === "approved" ? "Approved" : record.status === "denied" ? "Denied" : record.status}</h1><p><code>${record.tool}</code> \u2014 approval <code>${record.id}</code>.</p><p>The agent may now retry the call once.</p>`
-          );
-        }
-        return json(res, 200, record);
-      }
-      if (url2.pathname === "/approvals") {
-        if (!authorized()) return json(res, 401, unauthorized());
-        return json(res, 200, {
-          approvals: await runtime.guard.approvals.list(
-            url2.searchParams.get("all") ? void 0 : "pending"
-          )
-        });
-      }
-      return json(res, 404, {
-        code: "NOT_FOUND",
-        cause: `no route for ${url2.pathname}`,
-        fix: `POST JSON-RPC to ${path}; GET /health`,
-        retryable: false
-      });
-    })().catch((err) => {
-      if (!res.headersSent)
-        json(res, 500, {
-          code: "INTERNAL",
-          cause: err instanceof Error ? err.message : String(err),
-          fix: "retry; if it persists, report the request",
-          retryable: false
-        });
-      else res.end();
-    });
-  });
-  await new Promise((resolve5, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port ?? 8788, host, () => resolve5());
-  });
-  const address = server.address();
-  const port = typeof address === "object" && address ? address.port : opts.port ?? 8788;
-  holder.mcp = createHttpHandler(() => createDownstreamServer(runtime), {
-    sessions: true,
-    jsonResponse: false,
-    cors: true,
-    allowedHosts: isLoopback(host) ? localhostHosts(port) : void 0,
-    enableDnsRebindingProtection: isLoopback(host)
-  });
-  const baseUrl = `http://${host}:${port}`;
-  const url = `${baseUrl}${path}`;
-  const regFile = registrationPath(runtime.loaded.stateDir);
-  if (opts.registerFile !== false) {
-    mkdirSync(runtime.loaded.stateDir, { recursive: true });
-    const reg = {
-      url,
-      baseUrl,
-      token,
-      pid: process.pid,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    writeFileSync(regFile, JSON.stringify(reg, null, 2));
-  }
-  return {
-    url,
-    port,
-    token,
-    close: () => new Promise((resolve5, reject) => {
-      if (opts.registerFile !== false && existsSync2(regFile)) {
-        try {
-          unlinkSync(regFile);
-        } catch {
-        }
-      }
-      server.closeAllConnections();
-      server.close((err) => err ? reject(err) : resolve5());
-    })
-  };
-}
-function unauthorized() {
-  return {
-    code: "UNAUTHORIZED",
-    cause: "missing or wrong control token",
-    fix: "pass ?token=<token> or Authorization: Bearer <token> from <state>/http.json",
-    retryable: false
-  };
-}
-
-// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/decode-strings.js
-var textEncoder = new TextEncoder();
-var base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-var base64Lookup = new Uint8Array(256);
-for (let i = 0; i < base64Chars.length; i++) {
-  base64Lookup[base64Chars.charCodeAt(i)] = i;
-}
-var charsetAliases = /* @__PURE__ */ new Map([
-  ["iso-8859-8-i", "iso-8859-8"],
-  ["iso-8859-8-e", "iso-8859-8"]
-]);
-function getDecoder(charset) {
-  charset = (charset || "utf8").trim().toLowerCase();
-  charset = charsetAliases.get(charset) || charset;
-  let decoder;
-  try {
-    decoder = new TextDecoder(charset);
-  } catch (err) {
-    decoder = new TextDecoder("windows-1252");
-  }
-  return decoder;
-}
-
-// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/mime-node.js
-var defaultDecoder = getDecoder();
-
-// ../../node_modules/.pnpm/postal-mime@2.7.5/node_modules/postal-mime/src/postal-mime.js
-var MAX_HEADERS_SIZE = 2 * 1024 * 1024;
-
-// ../../node_modules/.pnpm/resend@6.25.0/node_modules/resend/dist/index.mjs
-var import_standardwebhooks = __toESM(require_dist(), 1);
-var version2 = "6.25.0";
-var defaultUserAgent = `resend-node:${version2}`;
-
-// ../../packages/notify/dist/index.js
-var palette = {
-  bg: "#f4f5f7",
-  card: "#ffffff",
-  text: "#111827",
-  muted: "#6b7280",
-  border: "#e5e7eb",
-  link: "#2563eb",
-  codeBg: "#f3f4f6",
-  red: "#b91c1c",
-  redBg: "#fef2f2",
-  green: "#15803d",
-  greenBg: "#f0fdf4",
-  amber: "#b45309",
-  amberBg: "#fffbeb",
-  gray: "#374151",
-  grayBg: "#f3f4f6"
-};
-var fontStack = "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif";
-var baseText = `font-family:${fontStack};font-size:15px;line-height:1.55;color:${palette.text};`;
-var USER_AGENT = "agentwares-notify/0.1";
-function errorMessage(e) {
-  if (e instanceof Error) return e.message;
-  return typeof e === "string" ? e : "unknown error";
-}
-async function readBody2(res) {
-  try {
-    return (await res.text()).slice(0, 500);
-  } catch {
-    return "";
-  }
-}
-function defaultFetch() {
-  return typeof fetch === "function" ? (input, init) => fetch(input, init) : void 0;
-}
-async function postJson(url, body, headers, fetchImpl) {
-  if (!fetchImpl) return { error: "fetch is not available" };
-  try {
-    const res = await fetchImpl(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT, ...headers },
-      body: typeof body === "string" ? body : JSON.stringify(body)
-    });
-    return { res, text: await readBody2(res) };
-  } catch (e) {
-    return { error: errorMessage(e) };
-  }
-}
-async function sendSlack(webhookUrl, message, opts = {}) {
-  const r = await postJson(webhookUrl, message, {}, opts.fetch ?? defaultFetch());
-  if ("error" in r) return { ok: false, error: r.error };
-  return r.res.ok ? { ok: true, status: r.res.status } : { ok: false, status: r.res.status, error: r.text || r.res.statusText || "slack error" };
-}
-var SIGNATURE_HEADER = "X-Agentwares-Signature";
-var encoder = new TextEncoder();
-function toHex(bytes) {
-  return Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(secret, body) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  return toHex(await crypto.subtle.sign("HMAC", key, encoder.encode(body)));
-}
-async function sendWebhook(url, payload, opts = {}) {
-  const body = JSON.stringify(payload);
-  const headers = { ...opts.headers ?? {} };
-  if (opts.secret) headers[SIGNATURE_HEADER] = `sha256=${await hmacSha256Hex(opts.secret, body)}`;
-  const r = await postJson(url, body, headers, opts.fetch ?? defaultFetch());
-  if ("error" in r) return { ok: false, error: r.error };
-  return r.res.ok ? { ok: true, status: r.res.status } : { ok: false, status: r.res.status, error: r.text || r.res.statusText || "webhook error" };
-}
-
-// src/notify.ts
-function approvalSlackMessage(event, url) {
-  const a = event.approval;
-  const argsText = JSON.stringify(a.args ?? {}, null, 2).slice(0, 1500);
-  const text = `[agentguard] approval needed: ${a.tool} (run ${a.run_id}) \u2014 run \`agentguard approve ${a.id}\`${url ? ` or open ${url}` : ""}`;
-  const blocks = [
-    { type: "header", text: { type: "plain_text", text: `Approval needed: ${a.tool}` } },
-    {
-      type: "section",
-      text: {
-        type: "mrkdwn",
-        text: `*run* \`${a.run_id}\`${a.agent ? ` \xB7 *agent* \`${a.agent}\`` : ""}${a.upstream ? ` \xB7 *upstream* \`${a.upstream}\`` : ""}
-\`\`\`${argsText}\`\`\``
-      }
-    },
-    {
-      type: "context",
-      elements: [
-        {
-          type: "mrkdwn",
-          text: `Approve: \`agentguard approve ${a.id}\` \xB7 Deny: \`agentguard deny ${a.id}\` \xB7 expires ${a.expires_at}`
-        }
-      ]
-    }
-  ];
-  if (url) {
-    blocks.push({
-      type: "actions",
-      elements: [
-        { type: "button", text: { type: "plain_text", text: "Approve" }, style: "primary", url },
-        {
-          type: "button",
-          text: { type: "plain_text", text: "Deny" },
-          style: "danger",
-          url: url.replace("/approve/", "/deny/")
-        }
-      ]
-    });
-  }
-  return { text, blocks };
-}
-function haltSlackMessage(event) {
-  const cause = event.error?.cause ?? "";
-  const text = `[agentguard] ${event.type}: ${event.tool} (run ${event.runId}) \u2014 ${cause}`;
-  return {
-    text,
-    blocks: [
-      {
-        type: "section",
-        text: {
-          type: "mrkdwn",
-          text: `*${event.type}* on \`${event.tool}\` (run \`${event.runId}\`)
-${cause}`
-        }
-      },
-      {
-        type: "context",
-        elements: [
-          {
-            type: "mrkdwn",
-            text: `\`agentguard report --run ${event.runId}\` for the full picture${event.type === "KILLED" ? "" : " \xB7 `agentguard kill` to stop everything"}`
-          }
-        ]
-      }
-    ]
-  };
-}
-function createAlerter(opts) {
-  const { policy } = opts;
-  const log = opts.log ?? (() => void 0);
-  const channel = { fetch: opts.fetch };
-  return async (event) => {
-    if (event.type === "APPROVAL_DECIDED") return;
-    if (!policy.alerts.on.includes(event.type)) return;
-    const slack = event.type === "APPROVAL_REQUIRED" ? policy.approval.notify.slack || policy.alerts.slack : policy.alerts.slack;
-    const webhook = event.type === "APPROVAL_REQUIRED" ? policy.approval.notify.webhook || policy.alerts.webhook : policy.alerts.webhook;
-    const url = event.approval ? opts.approvalUrl?.(event.approval) : void 0;
-    const message = event.type === "APPROVAL_REQUIRED" && event.approval ? approvalSlackMessage(event, url) : haltSlackMessage(event);
-    const jobs = [];
-    if (slack) {
-      jobs.push(
-        sendSlack(slack, message, channel).then((r) => {
-          if (!r.ok) log(`slack alert failed: ${r.error ?? r.status}`);
-        })
-      );
-    }
-    if (webhook) {
-      jobs.push(
-        sendWebhook(
-          webhook,
-          {
-            event: event.type,
-            product: "agentguard",
-            subject: message.text,
-            summary: event.error?.cause ?? "",
-            occurredAt: event.at,
-            data: {
-              runId: event.runId,
-              tool: event.tool,
-              error: event.error,
-              approval: event.approval,
-              approveUrl: url
-            }
-          },
-          channel
-        ).then((r) => {
-          if (!r.ok) log(`webhook alert failed: ${r.error ?? r.status}`);
-        })
-      );
-    }
-    await Promise.all(jobs);
-  };
-}
-
-// src/context.ts
-import { homedir } from "os";
-var DEFAULT_POLICY_FILE = "agentguard.yaml";
-function homeFrom(io) {
-  return io.env.HOME ?? io.env.USERPROFILE ?? homedir();
-}
-function defaultIo() {
-  return {
-    out: (line) => process.stdout.write(line + "\n"),
-    err: (line) => process.stderr.write(line + "\n"),
-    cwd: process.cwd(),
-    env: process.env,
-    tty: process.stdout.isTTY === true
-  };
-}
-function policyPathFrom(args, io) {
-  return resolve(
-    io.cwd,
-    flagString(args, "config") ?? io.env.AGENTGUARD_CONFIG ?? DEFAULT_POLICY_FILE
-  );
-}
-function loadPolicyFor(args, io, opts = {}) {
-  return loadPolicyFile(policyPathFrom(args, io), {
-    env: io.env,
-    allowMissingEnv: opts.allowMissingEnv
-  });
-}
-function createFileGuard(loaded, opts = {}) {
-  const kill = new FileKillSwitch2(loaded.killPath);
-  const audit = new FileAuditSink(loaded.auditPath);
-  const approvals = new FileApprovalStore(loaded.stateDir);
-  const alerter = opts.alerts === false ? void 0 : createAlerter({ policy: loaded.policy, approvalUrl: opts.approvalUrl, log: opts.log });
-  const guard = new Guard({
-    policy: loaded.policy,
-    state: new FileStateStore(loaded.stateDir),
-    audit,
-    kill,
-    approvals,
-    env: opts.env ?? process.env,
-    approvalUrl: opts.approvalUrl,
-    onEvent: async (event) => {
-      await opts.onEvent?.(event);
-      await alerter?.(event);
-    }
-  });
-  return { guard, kill, audit, approvals, loaded };
-}
-function readRegistration(loaded) {
-  const file = registrationPath(loaded.stateDir);
-  if (!exists(file)) return void 0;
-  try {
-    const reg = JSON.parse(readFileSync3(file, "utf8"));
-    return reg;
-  } catch {
-    return void 0;
-  }
-}
-function describeError(err) {
-  if (err && typeof err === "object" && "code" in err && "cause" in err) {
-    const e = err;
-    return `${e.code}: ${e.cause}${e.fix ? `
-  fix: ${e.fix}` : ""}`;
-  }
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/commands/connect.ts
-import { existsSync as existsSync5 } from "fs";
-import { relative } from "path";
-
-// src/configs.ts
-import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2, platform } from "os";
-import { join as join2, resolve as resolve2 } from "path";
-function candidateConfigs(cwd = process.cwd(), home = homedir2(), env = process.env) {
-  const desktop = platform() === "darwin" ? join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform() === "win32" ? join2(
-    env.APPDATA ?? join2(home, "AppData", "Roaming"),
-    "Claude",
-    "claude_desktop_config.json"
-  ) : join2(
-    env.XDG_CONFIG_HOME ?? join2(home, ".config"),
-    "Claude",
-    "claude_desktop_config.json"
-  );
-  return [
-    {
-      kind: "claude-code-project",
-      label: "Claude Code (project .mcp.json)",
-      path: join2(cwd, ".mcp.json"),
-      serversKey: "mcpServers"
-    },
-    {
-      kind: "cursor-project",
-      label: "Cursor (project)",
-      path: join2(cwd, ".cursor", "mcp.json"),
-      serversKey: "mcpServers"
-    },
-    {
-      kind: "vscode",
-      label: "VS Code (project)",
-      path: join2(cwd, ".vscode", "mcp.json"),
-      serversKey: "servers"
-    },
-    { kind: "generic", label: "mcp.json", path: join2(cwd, "mcp.json"), serversKey: "mcpServers" },
-    {
-      kind: "gemini-project",
-      label: "Gemini CLI (project .gemini/settings.json)",
-      path: join2(cwd, ".gemini", "settings.json"),
-      serversKey: "mcpServers"
-    },
-    { kind: "claude-desktop", label: "Claude Desktop", path: desktop, serversKey: "mcpServers" },
-    {
-      kind: "cursor-user",
-      label: "Cursor (user)",
-      path: join2(home, ".cursor", "mcp.json"),
-      serversKey: "mcpServers"
-    },
-    {
-      kind: "windsurf",
-      label: "Windsurf",
-      path: join2(home, ".codeium", "windsurf", "mcp_config.json"),
-      serversKey: "mcpServers"
-    },
-    {
-      kind: "claude-code-user",
-      label: "Claude Code (user ~/.claude.json)",
-      path: join2(home, ".claude.json"),
-      serversKey: "mcpServers"
-    },
-    {
-      kind: "gemini-user",
-      label: "Gemini CLI (user ~/.gemini/settings.json)",
-      path: join2(home, ".gemini", "settings.json"),
-      serversKey: "mcpServers"
-    }
-  ];
-}
-function isGeminiConfig(file) {
-  return file.kind === "gemini-project" || file.kind === "gemini-user" || /[/\\]\.gemini[/\\]settings\.json$/.test(file.path);
-}
-function detectClientConfigs(cwd, home, env) {
-  return candidateConfigs(cwd, home, env).filter((c) => existsSync4(c.path));
-}
-function describeConfigPath(path) {
-  const abs = resolve2(path);
-  const known = candidateConfigs().find((c) => c.path === abs);
-  if (known) return known;
-  let serversKey = "mcpServers";
-  try {
-    const parsed = JSON.parse(readFileSync4(abs, "utf8"));
-    if (parsed.servers && !parsed.mcpServers) serversKey = "servers";
-  } catch {
-  }
-  return {
-    kind: abs.includes(".vscode") ? "vscode" : "generic",
-    label: abs,
-    path: abs,
-    serversKey
-  };
-}
-function readServers(file) {
-  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
-  const servers = raw[file.serversKey];
-  if (!servers || typeof servers !== "object") return {};
-  return servers;
-}
-var PROXY_SERVER_NAME = "agentguard";
-var PROXY_PACKAGE = "@agentwares/agentguard";
-function isProxyEntry(entry) {
-  return (entry.args ?? []).some((a) => a === "agentguard" || /(^|\/)agentguard(\.js)?$/.test(a)) && (entry.args ?? []).includes("proxy");
-}
-function serversToUpstreams(servers) {
-  const upstreams = [];
-  const skipped = [];
-  for (const [rawName, entry] of Object.entries(servers)) {
-    if (isProxyEntry(entry)) {
-      skipped.push({ name: rawName, reason: "already the agentguard proxy" });
-      continue;
-    }
-    const name = rawName.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/^[^a-zA-Z0-9]+/, "") || "upstream";
-    const url = typeof entry.httpUrl === "string" ? entry.httpUrl : entry.url;
-    if (url) {
-      upstreams.push({
-        name,
-        url,
-        headers: entry.headers ?? {},
-        args: [],
-        env: {},
-        prefix: false,
-        timeout_ms: 6e4
-      });
-    } else if (entry.command) {
-      upstreams.push({
-        name,
-        command: entry.command,
-        args: entry.args ?? [],
-        env: entry.env ?? {},
-        cwd: entry.cwd,
-        headers: {},
-        prefix: false,
-        timeout_ms: 6e4
-      });
-    } else {
-      skipped.push({ name: rawName, reason: "no `command` or `url`" });
-    }
-  }
-  return { upstreams, skipped };
-}
-function backupPath(file) {
-  return `${file.path}.agentguard-backup`;
-}
-function proxyEntry(file, policyPath, opts = {}) {
-  const args = ["-y", PROXY_PACKAGE, "proxy", "--config", policyPath];
-  if (opts.agent) args.push("--agent", opts.agent);
-  const entry = { command: "npx", args };
-  if (file.serversKey === "servers") entry.type = "stdio";
-  return entry;
-}
-function rewriteClientConfig(file, policyPath, opts = {}) {
-  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
-  const servers = raw[file.serversKey] ?? {};
-  const replaced = Object.keys(servers).filter((n) => !isProxyEntry(servers[n]));
-  const backup = backupPath(file);
-  if (!existsSync4(backup)) copyFileSync(file.path, backup);
-  raw[file.serversKey] = { [PROXY_SERVER_NAME]: proxyEntry(file, policyPath, opts) };
-  writeFileSync2(file.path, JSON.stringify(raw, null, 2) + "\n");
-  return { backup, replaced };
-}
-function restoreClientConfig(file) {
-  const backup = backupPath(file);
-  if (!existsSync4(backup)) return false;
-  copyFileSync(backup, file.path);
-  return true;
-}
-function mergeServerIntoConfig(file, name, entry) {
-  const raw = JSON.parse(readFileSync4(file.path, "utf8"));
-  const servers = raw[file.serversKey] ?? {};
-  const replaced = name in servers;
-  const backup = backupPath(file);
-  if (!existsSync4(backup)) copyFileSync(file.path, backup);
-  raw[file.serversKey] = { ...servers, [name]: entry };
-  writeFileSync2(file.path, JSON.stringify(raw, null, 2) + "\n");
-  return { backup, replaced };
-}
-
-// src/commands/connect.ts
-var DEFAULT_PROXY_URL = "https://agentwares-agentguard-proxy.vercel.app";
-function fail(e) {
-  throw e;
-}
-async function connectCommand(args, io, fetchImpl = fetch) {
-  const key = args.positionals[0] ?? io.env.AGENTGUARD_KEY;
-  if (!key) {
-    io.err("usage: agentguard connect <key> [--write] [--client <path>] [--url <proxy-url>]");
-    io.err("  the key is on your dashboard; it starts with agk_");
-    return 2;
-  }
-  const base = (flagString(args, "url") ?? io.env.AGENTGUARD_PROXY_URL ?? DEFAULT_PROXY_URL).replace(/\/+$/, "");
-  let res;
-  try {
-    res = await fetchImpl(`${base}/connect`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ key })
-    });
-  } catch (err) {
-    fail({
-      code: "PROXY_UNREACHABLE",
-      cause: `could not reach ${base}: ${err instanceof Error ? err.message : String(err)}`,
-      fix: "check the network, or pass --url if you run your own proxy",
-      retryable: true
-    });
-  }
-  const text = await res.text();
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch {
-    fail({
-      code: "PROXY_BAD_RESPONSE",
-      cause: `${base}/connect returned ${res.status} that was not JSON: ${text.slice(0, 200)}`,
-      fix: "check --url points at an agentguard proxy, not at the dashboard",
-      retryable: false
-    });
-  }
-  if (!res.ok) {
-    const e = body;
-    fail({
-      code: e.code ?? "CONNECT_REFUSED",
-      cause: e.cause ?? `${base}/connect returned ${res.status}`,
-      fix: e.fix ?? "check the key on your dashboard; revoked keys stop working immediately",
-      retryable: e.retryable ?? false
-    });
-  }
-  const conn = body;
-  if (flagBool(args, "json")) {
-    io.out(JSON.stringify(conn, null, 2));
-    return 0;
-  }
-  const rel = (p) => p.startsWith(io.cwd + "/") ? relative(io.cwd, p) : p;
-  const entry = conn.mcpServers[PROXY_SERVER_NAME] ?? {
-    type: "http",
-    url: conn.mcpUrl,
-    headers: conn.headers
-  };
-  if (!flagBool(args, "write")) {
-    io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));
-  } else {
-    const explicit = flagString(args, "client");
-    const configs = explicit ? [describeConfigPath(explicit)] : detectClientConfigs(io.cwd, homeFrom(io), io.env);
-    const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + "/"));
-    let chosen;
-    if (explicit || flagBool(args, "all")) chosen = configs;
-    else chosen = projectLevel.slice(0, 1);
-    if (chosen.length === 0) {
-      io.err(
-        "no MCP config found here (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). Create one, or paste this into your client:"
-      );
-      io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));
-      return 1;
-    }
-    for (const c of chosen) {
-      if (!existsSync5(c.path)) {
-        io.err(`no MCP config at ${c.path}`);
-        return 1;
-      }
-      const forClient = isGeminiConfig(c) ? { httpUrl: entry.url, ...entry.headers ? { headers: entry.headers } : {} } : entry;
-      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, forClient);
-      io.out(
-        `${replaced ? "updated" : "wrote  "} ${rel(c.path)} (${c.label}) \u2192 ${PROXY_SERVER_NAME} = ${conn.mcpUrl}`
-      );
-      io.out(`backup  ${rel(backup)}`);
-    }
-    for (const c of configs.filter((c2) => !chosen.includes(c2)))
-      io.out(
-        `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to write it too`
-      );
-  }
-  const band = conn.band ? ` band=${conn.band.tier} (${conn.band.quantity} calls/mo)` : "";
-  io.out(`
-proxy ${conn.slug} (${conn.proxyId}) mode=${conn.mode}${band}`);
-  if (conn.upstreams?.length) io.out(`upstreams: ${conn.upstreams.join(", ")}`);
-  if (conn.dashboardUrl) io.out(`dashboard: ${conn.dashboardUrl}`);
-  if (conn.claudeCode) io.out(`claude code: ${conn.claudeCode}`);
-  if (!flagBool(args, "write"))
-    io.out(`
-run again with --write to add this to your MCP client config`);
-  return 0;
-}
-
-// src/commands/control.ts
-async function pokeHttp(io, reg, path, body) {
-  if (!reg) return;
-  try {
-    const res = await fetch(`${reg.baseUrl}${path}`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${reg.token}`, "Content-Type": "application/json" },
-      body: body === void 0 ? void 0 : JSON.stringify(body),
-      signal: AbortSignal.timeout(2e3)
-    });
-    if (!res.ok)
-      io.err(
-        `running proxy at ${reg.baseUrl} answered ${res.status} (the file switch still applies)`
-      );
-  } catch {
-    io.err(
-      `no proxy answering at ${reg.baseUrl} (stale ${reg.pid}?) \u2014 the file switch still applies`
-    );
-  }
-}
-async function killCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
-  const reason = args.positionals.join(" ") || flagString(args, "reason") || `agentguard kill by ${io.env.USER ?? "operator"}`;
-  kill.kill(reason);
-  await pokeHttp(io, readRegistration(loaded), "/kill", { reason });
-  io.out(
-    `KILLED: ${kill.path} written \u2014 every tool call through this policy now returns KILLED. Clear with: agentguard resume`
-  );
-  return 0;
-}
-async function resumeCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
-  kill.resume();
-  await pokeHttp(io, readRegistration(loaded), "/resume");
-  io.out(`resumed: ${kill.path} removed`);
-  if (io.env[loaded.policy.kill.env])
-    io.err(
-      `note: ${loaded.policy.kill.env} is set in this shell's environment; proxies started from it stay killed`
-    );
-  return 0;
-}
-async function decideCommand(decision, args, io) {
-  const id = args.positionals[0];
-  if (!id) {
-    io.err(
-      `usage: agentguard ${decision === "approved" ? "approve" : "deny"} <approval-id> [--by name] [--note text]`
-    );
-    return 1;
-  }
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
-  const record = await guard.decide(
-    id,
-    decision,
-    flagString(args, "by") ?? io.env.USER ?? "cli",
-    flagString(args, "note")
-  );
-  if (!record) {
-    io.err(`no approval ${id} \u2014 pending ones: agentguard approvals`);
-    return 1;
-  }
-  io.out(
-    `${record.status}: ${record.tool} (${record.id}, run ${record.run_id})${record.status === "approved" ? " \u2014 the agent may now retry the identical call once" : ""}`
-  );
-  return 0;
-}
-async function approvalsCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
-  const list = await guard.approvals.list(flagBool(args, "all") ? void 0 : "pending");
-  if (flagBool(args, "json")) {
-    io.out(JSON.stringify(list, null, 2));
-    return 0;
-  }
-  if (list.length === 0) {
-    io.out(flagBool(args, "all") ? "no approvals recorded" : "no pending approvals");
-    return 0;
-  }
-  for (const r of list) {
-    io.out(
-      `${r.id}  ${r.status.padEnd(9)} ${r.tool}  run ${r.run_id}${r.agent ? ` agent ${r.agent}` : ""}  expires ${r.expires_at}`
-    );
-    io.out(`  args: ${JSON.stringify(r.args).slice(0, 300)}`);
-    if (r.status === "pending")
-      io.out(`  \u2192 agentguard approve ${r.id}   |   agentguard deny ${r.id}`);
-  }
-  return 0;
-}
-
-// src/commands/init.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync3 } from "fs";
-import { relative as relative2, resolve as resolve3 } from "path";
-import YAML from "yaml";
-
-// src/commands/tools.ts
-import {
-  Guard as Guard2,
-  classifyTool as classifyTool2,
-  parsePolicy
-} from "@agentwares/agentguard-core";
-
-// src/proxy/runtime.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import {
-  getDefaultEnvironment,
-  StdioClientTransport
-} from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import {
-  CreateMessageRequestSchema,
-  ElicitRequestSchema,
-  LoggingMessageNotificationSchema,
-  PromptListChangedNotificationSchema,
-  ResourceListChangedNotificationSchema,
-  ResourceUpdatedNotificationSchema,
-  ToolListChangedNotificationSchema
-} from "@modelcontextprotocol/sdk/types.js";
-import {
-  GuardError,
-  classifyTool,
-  upstreamHeaders
-} from "@agentwares/agentguard-core";
-var ProxyRuntime = class {
-  loaded;
-  guard;
-  agent;
-  defaultRunId;
-  configured;
-  sessions = /* @__PURE__ */ new Set();
-  connections = /* @__PURE__ */ new Map();
-  exposed = [];
-  resourceOwner = /* @__PURE__ */ new Map();
-  templateOwner = /* @__PURE__ */ new Map();
-  promptOwner = /* @__PURE__ */ new Map();
-  log;
-  connectTimeoutMs;
-  testClients;
-  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */
-  closing = false;
-  constructor(opts) {
-    this.loaded = opts.loaded;
-    this.guard = opts.guard;
-    this.agent = opts.agent;
-    this.defaultRunId = opts.defaultRunId;
-    this.configured = opts.configured ?? true;
-    this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}
-`));
-    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15e3;
-    this.testClients = opts.clients ?? {};
-  }
-  get policy() {
-    return this.loaded.policy;
-  }
-  async start() {
-    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));
-    for (const [name, client] of Object.entries(this.testClients)) {
-      if (this.connections.has(name)) continue;
-      const upstream = {
-        name,
-        command: "in-memory",
-        args: [],
-        env: {},
-        headers: {},
-        prefix: false,
-        timeout_ms: 6e4
-      };
-      const conn = {
-        upstream,
-        client,
-        tools: [],
-        capabilities: client.getServerCapabilities(),
-        connected: true
-      };
-      this.connections.set(name, conn);
-      this.wire(conn);
-      await this.refreshTools(name);
-    }
-    this.rebuildExposed();
-    const status = this.upstreamStatus();
-    this.log(
-      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`
-    );
-  }
-  async connect(upstream) {
-    const client = new Client(
-      { name: "agentguard", version: version() },
-      { capabilities: { sampling: {}, elicitation: {} } }
-    );
-    const conn = {
-      upstream,
-      client,
-      tools: [],
-      capabilities: void 0,
-      connected: false
-    };
-    this.connections.set(upstream.name, conn);
-    try {
-      const transport = upstream.url ? new StreamableHTTPClientTransport(new URL(upstream.url), {
-        requestInit: { headers: upstreamHeaders(upstream) }
-      }) : new StdioClientTransport({
-        command: upstream.command,
-        args: upstream.args,
-        env: { ...getDefaultEnvironment(), ...upstream.env },
-        cwd: upstream.cwd,
-        stderr: "pipe"
-      });
-      if (transport instanceof StdioClientTransport) {
-        transport.stderr?.on("data", (chunk) => {
-          if (this.closing) return;
-          for (const line of chunk.toString("utf8").split("\n"))
-            if (line.trim()) this.log(`${upstream.name}: ${line}`);
-        });
-      }
-      await withTimeout(
-        client.connect(transport),
-        this.connectTimeoutMs,
-        `connect to upstream "${upstream.name}"`
-      );
-      conn.capabilities = client.getServerCapabilities();
-      conn.connected = true;
-      this.wire(conn);
-      await this.refreshTools(upstream.name);
-    } catch (err) {
-      conn.connected = false;
-      conn.error = err instanceof Error ? err.message : String(err);
-      this.log(`upstream "${upstream.name}" unavailable: ${conn.error}`);
-    }
-  }
-  wire(conn) {
-    const { client, upstream } = conn;
-    client.onclose = () => {
-      conn.connected = false;
-      conn.error = "connection closed";
-      if (!this.closing) this.log(`upstream "${upstream.name}" closed`);
-    };
-    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {
-      await this.broadcast(upstream.name, n.method, n.params);
-    });
-    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {
-      await this.broadcast(upstream.name, n.method, n.params);
-    });
-    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
-      this.resourceOwner.clear();
-      await this.broadcast(upstream.name, "notifications/resources/list_changed", void 0);
-    });
-    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
-      this.promptOwner.clear();
-      await this.broadcast(upstream.name, "notifications/prompts/list_changed", void 0);
-    });
-    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
-      await this.refreshTools(upstream.name);
-      this.rebuildExposed();
-      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => void 0);
-    });
-    try {
-      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {
-        const session = this.pickSession(upstream.name);
-        if (!session) throw new Error("no downstream client is connected to relay sampling to");
-        const related = session.inflight.get(upstream.name)?.at(-1);
-        return session.server.server.createMessage(req.params, { relatedRequestId: related });
-      });
-      client.setRequestHandler(ElicitRequestSchema, async (req) => {
-        const session = this.pickSession(upstream.name);
-        if (!session) throw new Error("no downstream client is connected to relay elicitation to");
-        const related = session.inflight.get(upstream.name)?.at(-1);
-        return session.server.server.elicitInput(req.params, { relatedRequestId: related });
-      });
-    } catch {
-    }
-  }
-  pickSession(upstream) {
-    let best;
-    for (const s of this.sessions) {
-      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;
-      if (!best || s.lastActive > best.lastActive) best = s;
-    }
-    return best;
-  }
-  async broadcast(upstream, method, params) {
-    for (const s of this.sessions) {
-      const related = s.inflight.get(upstream)?.at(-1);
-      try {
-        await s.server.server.notification(
-          { method, params },
-          related !== void 0 ? { relatedRequestId: related } : void 0
-        );
-      } catch {
-      }
-    }
-  }
-  /**
-   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each
-   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow
-   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for
-   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,
-   * changes nothing: the agent keeps the last good list, and the log says why.
-   */
-  async refreshTools(name) {
-    const conn = this.connections.get(name);
-    if (!conn?.connected) return;
-    if (conn.capabilities && !conn.capabilities.tools) {
-      conn.tools = [];
-      return;
-    }
-    const kept = () => `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? "" : "s"})`;
-    try {
-      const read = await readAllPages(async (cursor) => {
-        const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        return { items: page.tools, nextCursor: page.nextCursor };
-      });
-      if (read.truncated) {
-        this.log(`tools/list for "${name}" not applied: ${read.truncated.reason}; ${kept()}`);
-        return;
-      }
-      conn.tools = read.items;
-    } catch (err) {
-      this.log(
-        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}; ${kept()}`
-      );
-    }
-  }
-  rebuildExposed() {
-    const taken = /* @__PURE__ */ new Set();
-    const out = [];
-    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];
-    for (const name of order) {
-      const conn = this.connections.get(name);
-      if (!conn) continue;
-      const prefix = conn.upstream.prefix === true ? name : typeof conn.upstream.prefix === "string" ? conn.upstream.prefix : void 0;
-      for (const tool of conn.tools) {
-        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;
-        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;
-        if (taken.has(exposedName)) {
-          this.log(`skipping duplicate tool ${exposedName} from ${name}`);
-          continue;
-        }
-        taken.add(exposedName);
-        out.push({
-          name: exposedName,
-          upstream: name,
-          original: tool.name,
-          tool,
-          classification: classifyTool(
-            {
-              name: exposedName,
-              description: tool.description,
-              annotations: tool.annotations,
-              inputSchema: tool.inputSchema,
-              outputSchema: tool.outputSchema
-            },
-            this.policy
-          )
-        });
-      }
-    }
-    this.exposed = out;
-  }
-  listTools(agent) {
-    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams.includes(t.upstream));
-    return this.exposed;
-  }
-  findTool(name) {
-    return this.exposed.find((t) => t.name === name);
-  }
-  upstreamStatus() {
-    return [...this.connections.values()].map((c) => ({
-      name: c.upstream.name,
-      connected: c.connected,
-      tools: c.tools.length,
-      transport: c.upstream.url ? "http" : "stdio",
-      error: c.error
-    }));
-  }
-  attach(session) {
-    this.sessions.add(session);
-  }
-  detach(session) {
-    this.sessions.delete(session);
-  }
-  /** Run a tool call through the policy engine and, if allowed, the upstream. */
-  async callTool(name, args, ctx) {
-    const tool = this.findTool(name);
-    const agent = ctx.agent === void 0 ? this.agent : ctx.agent;
-    if (!tool) {
-      const result2 = await this.guard.run(
-        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },
-        async () => {
-          throw new GuardError({
-            code: "UNKNOWN_TOOL",
-            cause: `no upstream exposes a tool named "${name}"`,
-            fix: "call tools/list and use one of the listed names",
-            retryable: false
-          });
-        }
-      );
-      return { result: result2 };
-    }
-    const conn = this.connections.get(tool.upstream);
-    const track = () => {
-      if (!ctx.session || ctx.requestId === void 0) return () => void 0;
-      const list = ctx.session.inflight.get(tool.upstream) ?? [];
-      list.push(ctx.requestId);
-      ctx.session.inflight.set(tool.upstream, list);
-      return () => {
-        const l = ctx.session.inflight.get(tool.upstream) ?? [];
-        const i = l.indexOf(ctx.requestId);
-        if (i >= 0) l.splice(i, 1);
-      };
-    };
-    const result = await this.guard.run(
-      {
-        tool: {
-          name: tool.name,
-          description: tool.tool.description,
-          annotations: tool.tool.annotations,
-          inputSchema: tool.tool.inputSchema,
-          outputSchema: tool.tool.outputSchema
-        },
-        args,
-        runId: ctx.runId,
-        agent,
-        sessionId: ctx.sessionId,
-        upstream: tool.upstream
-      },
-      async (finalArgs) => {
-        if (!conn?.connected) {
-          throw new GuardError({
-            code: "UPSTREAM_ERROR",
-            cause: `upstream "${tool.upstream}" is not connected${conn?.error ? ` (${conn.error})` : ""}`,
-            fix: "check the upstream command/url in agentguard.yaml and restart the proxy",
-            retryable: true
-          });
-        }
-        const untrack = track();
-        try {
-          return await conn.client.callTool(
-            { name: tool.original, arguments: finalArgs ?? {} },
-            void 0,
-            {
-              timeout: conn.upstream.timeout_ms,
-              resetTimeoutOnProgress: true,
-              onprogress: ctx.onprogress
-            }
-          );
-        } finally {
-          untrack();
-        }
-      }
-    );
-    return { result, tool };
-  }
-  connectedWith(capability) {
-    return [...this.connections.values()].filter(
-      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === void 0)
-    );
-  }
-  async listResources() {
-    const resources = [];
-    for (const conn of this.connectedWith("resources")) {
-      try {
-        const page = await conn.client.listResources(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const r of page.resources) {
-          this.resourceOwner.set(r.uri, conn.upstream.name);
-          resources.push(r);
-        }
-      } catch {
-      }
-    }
-    return { resources };
-  }
-  async listResourceTemplates() {
-    const resourceTemplates = [];
-    for (const conn of this.connectedWith("resources")) {
-      try {
-        const page = await conn.client.listResourceTemplates(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const t of page.resourceTemplates) {
-          this.templateOwner.set(t.uriTemplate, conn.upstream.name);
-          resourceTemplates.push(t);
-        }
-      } catch {
-      }
-    }
-    return { resourceTemplates };
-  }
-  ownerForUri(uri) {
-    const owner = this.resourceOwner.get(uri);
-    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)];
-    for (const [template, name] of this.templateOwner) {
-      if (templateMatches(template, uri) && this.connections.get(name)?.connected)
-        return [this.connections.get(name)];
-    }
-    return this.connectedWith("resources");
-  }
-  async readResource(uri) {
-    let lastError;
-    for (const conn of this.ownerForUri(uri)) {
-      try {
-        const result = await conn.client.readResource(
-          { uri },
-          { timeout: conn.upstream.timeout_ms }
-        );
-        this.resourceOwner.set(uri, conn.upstream.name);
-        return result;
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error(`no upstream serves resource ${uri}`);
-  }
-  async subscribe(uri, on) {
-    for (const conn of this.ownerForUri(uri)) {
-      try {
-        if (on) await conn.client.subscribeResource({ uri });
-        else await conn.client.unsubscribeResource({ uri });
-        return;
-      } catch {
-      }
-    }
-  }
-  async listPrompts() {
-    const prompts = [];
-    const taken = /* @__PURE__ */ new Set();
-    this.promptOwner.clear();
-    for (const conn of this.connectedWith("prompts")) {
-      try {
-        const page = await conn.client.listPrompts(void 0, {
-          timeout: conn.upstream.timeout_ms
-        });
-        for (const p of page.prompts) {
-          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;
-          taken.add(name);
-          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });
-          prompts.push({ ...p, name });
-        }
-      } catch {
-      }
-    }
-    return { prompts };
-  }
-  async getPrompt(name, args) {
-    if (this.promptOwner.size === 0) await this.listPrompts();
-    const owner = this.promptOwner.get(name);
-    const conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("prompts");
-    let lastError;
-    for (const conn of conns) {
-      try {
-        return await conn.client.getPrompt(
-          { name: owner?.original ?? name, arguments: args },
-          { timeout: conn.upstream.timeout_ms }
-        );
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error(`no upstream serves prompt ${name}`);
-  }
-  async complete(params) {
-    let conns;
-    if (params.ref.type === "ref/prompt") {
-      if (this.promptOwner.size === 0) await this.listPrompts();
-      const owner = this.promptOwner.get(params.ref.name);
-      conns = owner ? [this.connections.get(owner.upstream)] : this.connectedWith("completions");
-      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };
-    } else {
-      if (this.templateOwner.size === 0) await this.listResourceTemplates();
-      conns = this.ownerForUri(params.ref.uri);
-    }
-    let lastError;
-    for (const conn of conns) {
-      try {
-        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });
-      } catch (err) {
-        lastError = err;
-      }
-    }
-    throw lastError ?? new Error("no upstream supports completions");
-  }
-  async setLevel(level) {
-    await Promise.all(
-      this.connectedWith("logging").map(
-        (c) => c.client.setLoggingLevel(level).catch(() => void 0)
-      )
-    );
-  }
-  async close() {
-    this.closing = true;
-    for (const conn of this.connections.values()) {
-      try {
-        await conn.client.close();
-      } catch {
-      }
-    }
-    this.connections.clear();
-  }
-};
-function templateMatches(template, uri) {
-  const re = new RegExp(
-    "^" + template.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^}]+\\\}/g, "[^/]+") + "$"
-  );
-  return re.test(uri);
-}
-async function withTimeout(promise, ms, what) {
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);
-  });
-  try {
-    return await Promise.race([promise, timeout]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
-// src/commands/tools.ts
-async function probeUpstreams(upstreams, opts = {}) {
-  const policy = opts.policy ?? parsePolicy({ upstreams });
-  const loaded = {
-    policy: { ...policy, upstreams },
-    path: "",
-    baseDir: process.cwd(),
-    stateDir: "",
-    auditPath: "",
-    killPath: ""
-  };
-  const guard = new Guard2({ policy: loaded.policy, env: opts.env ?? {} });
-  const runtime = new ProxyRuntime({
-    loaded,
-    guard,
-    defaultRunId: "probe",
-    log: opts.log ?? (() => void 0),
-    connectTimeoutMs: opts.timeoutMs ?? 15e3
-  });
-  try {
-    await runtime.start();
-    return {
-      tools: runtime.listTools().map((t) => ({
-        upstream: t.upstream,
-        name: t.name,
-        tool: t.tool,
-        classification: classifyTool2(
-          { name: t.name, annotations: t.tool.annotations },
-          loaded.policy
-        )
-      })),
-      upstreams: runtime.upstreamStatus()
-    };
-  } finally {
-    await runtime.close();
-  }
-}
-function formatToolTable(tools) {
-  const width = Math.min(48, Math.max(12, ...tools.map((t) => t.name.length)));
-  const lines = [
-    `${"tool".padEnd(width)}  ${"class".padEnd(8)}${"verb".padEnd(9)}${"upstream".padEnd(14)}why`
-  ];
-  for (const t of tools) {
-    const c = t.classification;
-    lines.push(
-      `${t.name.padEnd(width)}  ${c.class.padEnd(8)}${c.verb.padEnd(9)}${t.upstream.padEnd(14)}${c.source}: ${c.reason}`
-    );
-  }
-  return lines;
-}
-async function toolsCommand(args, io) {
-  const loaded = loadPolicyFor(args, io);
-  const result = await probeUpstreams(loaded.policy.upstreams, {
-    policy: loaded.policy,
-    log: io.err,
-    env: io.env
-  });
-  if (flagBool(args, "json")) {
-    io.out(
-      JSON.stringify(
-        {
-          upstreams: result.upstreams,
-          tools: result.tools.map((t) => ({
-            name: t.name,
-            upstream: t.upstream,
-            ...t.classification
-          }))
-        },
-        null,
-        2
-      )
-    );
-    return 0;
-  }
-  for (const u of result.upstreams)
-    io.err(
-      `${u.connected ? "ok  " : "down"} ${u.name}: ${u.connected ? `${u.tools} tools` : u.error}`
-    );
-  if (result.upstreams.length === 0)
-    io.err(
-      "no upstreams in the policy: an MCP client sees agentguard's own read-only tools instead (agentguard_get_status, agentguard_get_report, agentguard_verify_audit_log)"
-    );
-  for (const line of formatToolTable(result.tools)) io.out(line);
-  const counts = result.tools.reduce(
-    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
-    {}
-  );
-  io.err(
-    `
-${result.tools.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")} \xB7 mode ${loaded.policy.mode}`
-  );
-  return result.upstreams.every((u) => u.connected) ? 0 : 2;
-}
-
-// src/commands/init.ts
-function dump(value, indent = 0) {
-  const text = YAML.stringify(value, { indent: 2, lineWidth: 100 }).trimEnd();
-  const pad = " ".repeat(indent);
-  return text.split("\n").map((l) => pad + l).join("\n");
-}
-function flow(list) {
-  return list.length === 0 ? "[]" : `[${list.map((s) => JSON.stringify(s)).join(", ")}]`;
-}
-function renderStarterPolicy(opts) {
-  const tools = opts.tools ?? [];
-  const unknown = tools.filter((t) => t.classification.class === "unknown").map((t) => t.name);
-  const destructive = tools.filter((t) => t.classification.destructive || t.classification.verb === "delete").map((t) => t.name);
-  const spend = tools.filter((t) => t.classification.class === "spend").map((t) => t.name);
-  const date = (opts.generatedAt ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const counts = tools.reduce(
-    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
-    {}
-  );
-  const detected = tools.length === 0 ? ["#   (no upstreams probed \u2014 run `agentguard tools` after fixing the upstreams above)"] : tools.map(
-    (t) => `#   ${t.name.padEnd(36)} ${t.classification.class.padEnd(8)} ${t.classification.verb.padEnd(8)} ${t.classification.source}: ${t.classification.reason}`
-  );
-  const probeNotes = (opts.probeErrors ?? []).map((e) => `#   ! ${e}`);
-  const upstreamsYaml = opts.upstreams.length ? dump({ upstreams: opts.upstreams.map(cleanUpstream) }) : 'upstreams: []\n  # - name: crm\n  #   url: https://mcp.example.com/mcp\n  #   auth: ${CRM_TOKEN}\n  # - name: files\n  #   command: npx\n  #   args: [-y, "@modelcontextprotocol/server-filesystem", "."]';
-  return `# agentguard.yaml \u2014 generated by \`agentguard init\` on ${date}
-# Every knob is explained inline. Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#policy
-version: 1
-
-# dry-run: reads pass through; writes and spends are FAKED (plausible success, nothing executes)
-# and recorded. Run your agent once, then \`agentguard report\` and \`agentguard diff\`.
-# Flip to \`enforce\` when the diff looks right. Caps and the loop breaker apply in both modes.
-mode: ${opts.mode ?? "dry-run"}
-
-# The servers your agent used to talk to directly. agentguard connects to them and holds their
-# credentials; your agent only talks to agentguard. Use \${ENV_VAR} for secrets.
-${upstreamsYaml}
-
-# Detected tools (${tools.length}${tools.length ? `: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""}):
-${[...detected, ...probeNotes].join("\n")}
-# readOnlyHint annotations and verb heuristics classify most tools. List anything that is wrong here;
-# these patterns win over annotations. \`*\` matches anything.
-classify:
-  read: []
-  write: ${flow(unknown)}${unknown.length ? "   # could not be classified \u2014 treated as writes; move to read: if they only read" : ""}
-  spend: ${flow(spend)}
-  unknown: write   # a tool nobody can classify counts as a write (alternatives: read | block)
-
-# Blast-radius caps. The call that would exceed a cap gets CAP_EXCEEDED with the remaining budget.
-# \`writes\` counts every write or spend; \`deletes\`/\`emails\` count the subsets matched by \`counters\`.
-caps:
-  per_run:
-    tool_calls: 400
-    writes: 50
-    deletes: 10
-    emails: 5
-    spend_usd: 25
-  per_day:
-    spend_usd: 200
-
-# Dollar amounts. Declare how to read the amount from a spend tool's arguments; results reporting
-# cost_usd / amount_usd are picked up automatically. Unknown spend tools cost \`default_usd\`.
-spend:
-  tools: {}
-  #  stripe_create_charge: { amount_arg: amount, divisor: 100, currency_arg: currency }
-  #  openai_*: { fixed_usd: 0.01 }
-  default_usd: 0
-
-# Semantic loop breaker: the same (tool, normalized arguments) ${3} times in the last 30 calls, or a
-# repeating A\u2192B\u2192A\u2192B cycle, returns LOOP_DETECTED. Timestamps, ids and whitespace are ignored.
-loop:
-  window: 30
-  max_repeats: 3
-  max_cycle_len: 4
-  max_read_repeats: 10
-
-# Always fake these, even in enforce mode. Remove entries as you gain trust.
-dry_run:
-  tools: []
-  synthesize: true
-
-# Destructive actions that need a human. The agent gets APPROVAL_REQUIRED with an id; you run
-# \`agentguard approve <id>\` (or click the link in Slack); the agent retries the identical call once.
-approval:
-  tools: ${flow(destructive)}
-  wait_s: 0          # > 0 holds the call open this long waiting for the decision
-  ttl_s: 3600
-  # notify:
-  #   slack: \${SLACK_WEBHOOK_URL}
-
-# Kill switch: \`agentguard kill\` creates this file (or POST /kill on the HTTP proxy); every call
-# returns KILLED until \`agentguard resume\`. AGENTGUARD_KILL=1 in the environment does the same.
-kill:
-  file: .agentguard/KILL
-
-# Scoped agent keys for the HTTP proxy: \`agentguard key create deployer --allow 'crm_get_*'\`.
-# Only the key's hash is stored here; the agent sends the key as a Bearer token.
-agents: []
-
-# Alerts on halts (Slack incoming webhook or any HTTPS endpoint; signed with X-Agentwares-Signature).
-# alerts:
-#   slack: \${SLACK_WEBHOOK_URL}
-#   on: [LOOP_DETECTED, CAP_EXCEEDED, KILLED, APPROVAL_REQUIRED]
-
-# Hash-chained JSONL of every call; \`agentguard verify\` proves it was not edited.
-audit:
-  path: .agentguard/audit.jsonl
-  redact: true
-  include_results: false
-`;
-}
-function cleanUpstream(u) {
-  const out = { name: u.name };
-  if (u.url) {
-    out.url = u.url;
-    if (Object.keys(u.headers).length) out.headers = u.headers;
-  } else {
-    out.command = u.command;
-    if (u.args.length) out.args = u.args;
-    if (Object.keys(u.env).length) out.env = u.env;
-    if (u.cwd) out.cwd = u.cwd;
-  }
-  return out;
-}
-async function initCommand(args, io) {
-  const policyPath = policyPathFrom(args, io);
-  const explicit = flagString(args, "client");
-  const configs = explicit ? [describeConfigPath(resolve3(io.cwd, explicit))] : detectClientConfigs(io.cwd, homeFrom(io), io.env);
-  const rel = (p) => {
-    const r = relative2(io.cwd, p);
-    return r.startsWith("..") ? p : r || ".";
-  };
-  if (flagBool(args, "undo")) {
-    let restored = 0;
-    for (const c of configs) {
-      if (restoreClientConfig(c)) {
-        io.out(`restored ${rel(c.path)} from backup`);
-        restored += 1;
-      }
-    }
-    if (restored === 0)
-      io.err("nothing to undo (no *.agentguard-backup files next to your MCP configs)");
-    return 0;
-  }
-  const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + "/"));
-  const userLevel = configs.filter((c) => !projectLevel.includes(c));
-  let chosen;
-  if (explicit) chosen = configs;
-  else if (flagBool(args, "all")) chosen = configs;
-  else chosen = projectLevel.slice(0, 1);
-  if (!explicit && !flagBool(args, "all")) {
-    for (const c of userLevel)
-      io.out(
-        `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to route it through agentguard`
-      );
-  }
-  if (!chosen.every((c) => existsSync6(c.path))) {
-    io.err(`no MCP config at ${chosen.map((c) => c.path).join(", ")}`);
-    return 1;
-  }
-  const servers = {};
-  for (const c of chosen) {
-    const found = readServers(c);
-    io.out(
-      `found   ${rel(c.path)} (${c.label}) \u2192 ${Object.keys(found).length} server${Object.keys(found).length === 1 ? "" : "s"}: ${Object.keys(found).join(", ") || "none"}`
-    );
-    for (const [name, entry] of Object.entries(found))
-      if (!(name in servers)) servers[name] = entry;
-  }
-  if (chosen.length === 0)
-    io.out(
-      "found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI) \u2014 writing a policy with no upstreams"
-    );
-  const { upstreams, skipped } = serversToUpstreams(servers);
-  for (const s of skipped) io.err(`skipped ${s.name}: ${s.reason}`);
-  if (skipped.some((s) => s.reason.includes("already")) && upstreams.length === 0 && existsSync6(policyPath)) {
-    io.out(
-      `already initialized: ${rel(policyPath)} exists and ${chosen.map((c) => rel(c.path)).join(", ")} already points at agentguard`
-    );
-    return 0;
-  }
-  let probed = [];
-  const probeErrors = [];
-  if (flagBool(args, "probe") !== false && upstreams.length > 0) {
-    io.out(`probing ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}\u2026`);
-    const result = await probeUpstreams(upstreams, {
-      log: () => void 0,
-      env: io.env,
-      timeoutMs: 2e4
-    });
-    probed = result.tools;
-    for (const u of result.upstreams) {
-      if (u.connected) io.out(`        ${u.name}: ${u.tools} tools`);
-      else {
-        io.err(
-          `        ${u.name}: could not connect (${u.error}) \u2014 the proxy will keep retrying at start; fix the entry in agentguard.yaml`
-        );
-        probeErrors.push(`${u.name}: ${u.error}`);
-      }
-    }
-  }
-  const mode = flagString(args, "mode") ?? "dry-run";
-  if (existsSync6(policyPath) && !flagBool(args, "force")) {
-    io.out(`kept    ${rel(policyPath)} (exists; pass --force to regenerate)`);
-  } else {
-    writeFileSync3(policyPath, renderStarterPolicy({ upstreams, tools: probed, mode, probeErrors }));
-    const counts = probed.reduce(
-      (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
-      {}
-    );
-    io.out(
-      `wrote   ${rel(policyPath)} (mode: ${mode}, ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}${probed.length ? `, ${probed.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""})`
-    );
-  }
-  if (flagBool(args, "rewrite") !== false) {
-    for (const c of chosen) {
-      if (resolve3(c.path) === resolve3(policyPath)) {
-        throw new Error(
-          `refusing: ${rel(c.path)} is both the policy file (--config) and a client config. Rewriting it would replace the policy with the proxy entry and leave the proxy pointing at itself. Use --config for the policy path and --client for the client's config, or let --config default to agentguard.yaml.`
-        );
-      }
-      const { backup, replaced } = rewriteClientConfig(c, policyPath, {
-        agent: flagString(args, "agent")
-      });
-      io.out(
-        `rewrote ${rel(c.path)} \u2192 ${replaced.length ? `${replaced.join(", ")} now go through` : "points at"} \`npx @agentwares/agentguard proxy\` (backup: ${rel(backup)})`
-      );
-    }
-  }
-  io.out("");
-  io.out("Next:");
-  io.out(
-    `  1. restart your MCP client so it re-reads ${chosen.map((c) => rel(c.path)).join(", ") || "its config"}`
-  );
-  io.out(
-    `  2. run your agent once \u2014 ${mode === "dry-run" ? "writes are faked; nothing executes upstream" : "enforce mode: caps, loop breaker and approvals are live"}`
-  );
-  io.out("  3. agentguard report        # what this run would have destroyed / spent");
-  io.out("     agentguard diff          # the record-by-record mutation diff");
-  if (mode === "dry-run")
-    io.out(`  4. set \`mode: enforce\` in ${rel(policyPath)} when it looks right`);
-  io.out("  undo any time: agentguard init --undo");
-  return 0;
-}
-
-// src/commands/keys.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import YAML2, { isMap, isSeq, YAMLSeq } from "yaml";
-import { generateAgentKey, hashAgentKey } from "@agentwares/agentguard-core";
-async function keyCommand(args, io) {
-  const [sub, name] = args.positionals;
-  const path = policyPathFrom(args, io);
-  const doc = YAML2.parseDocument(readFileSync5(path, "utf8"));
-  let agents = doc.get("agents");
-  if (!isSeq(agents)) {
-    agents = new YAMLSeq();
-    doc.set("agents", agents);
-  }
-  const seq = agents;
-  const items = seq.items.filter(isMap);
-  if (sub === "list" || sub === void 0) {
-    if (items.length === 0)
-      io.out(
-        "no agents in agentguard.yaml \u2014 create one: agentguard key create <name> --allow 'crm_get_*'"
-      );
-    for (const a of items) {
-      const allow2 = a.get("allow");
-      io.out(
-        `${String(a.get("name")).padEnd(20)} key: ${a.get("key_hash") ? "set" : "none (stdio --agent only)"}  allow: ${isSeq(allow2) ? allow2.items.map(String).join(", ") : "all"}`
-      );
-    }
-    return 0;
-  }
-  if (!name) {
-    io.err(
-      "usage: agentguard key create <agent> [--allow pattern]... [--deny pattern]... [--writes n] [--spend n] [--deletes n] [--emails n] [--tool-calls n] [--mode dry-run|enforce] [--upstream name]..."
-    );
-    return 1;
-  }
-  if (sub === "revoke") {
-    const idx = items.findIndex((a) => a.get("name") === name);
-    if (idx < 0) {
-      io.err(`no agent "${name}"`);
-      return 1;
-    }
-    seq.items.splice(seq.items.indexOf(items[idx]), 1);
-    writeFileSync4(path, doc.toString());
-    io.out(`revoked ${name}: removed from agentguard.yaml (running proxies pick it up on restart)`);
-    return 0;
-  }
-  if (sub !== "create") {
-    io.err(`unknown subcommand "${sub}" \u2014 use create, list or revoke`);
-    return 1;
-  }
-  const key = generateAgentKey();
-  const keyHash = await hashAgentKey(key);
-  const existing = items.find((a) => a.get("name") === name);
-  const entry = { name, key_hash: keyHash };
-  const allow = flagList(args, "allow");
-  const deny = flagList(args, "deny");
-  if (allow.length) entry.allow = allow;
-  if (deny.length) entry.deny = deny;
-  const upstreams = flagList(args, "upstream");
-  if (upstreams.length) entry.upstreams = upstreams;
-  const mode = flagString(args, "mode");
-  if (mode) entry.mode = mode;
-  const perRun = {};
-  for (const [flag, counter] of [
-    ["writes", "writes"],
-    ["spend", "spend_usd"],
-    ["deletes", "deletes"],
-    ["emails", "emails"],
-    ["tool-calls", "tool_calls"]
-  ]) {
-    const n = flagNumber(args, flag);
-    if (n !== void 0) perRun[counter] = n;
-  }
-  if (Object.keys(perRun).length) entry.caps = { per_run: perRun };
-  if (existing) {
-    for (const [k, v] of Object.entries(entry)) existing.set(k, v);
-  } else {
-    seq.add(doc.createNode(entry));
-  }
-  writeFileSync4(path, doc.toString());
-  io.err(
-    `${existing ? "rotated" : "created"} agent "${name}" in ${path}${allow.length ? ` (allow: ${allow.join(", ")})` : " (allow: all tools)"}`
-  );
-  io.err(
-    "the key is shown once; give it to the agent as `Authorization: Bearer <key>` (HTTP) \u2014 over stdio use `agentguard proxy --agent " + name + "`"
-  );
-  io.out(key);
-  return 0;
-}
-
-// src/commands/permission-diff.ts
-import { execFileSync } from "child_process";
-import {
-  diffPermissionFile,
-  renderPermissionDiffMarkdown
-} from "@agentwares/agentguard-core";
-var DEFAULT_PERMISSION_PATHS = [
-  "agentguard.yaml",
-  "agentguard.yml",
-  ".claude/settings.json",
-  ".claude/settings.local.json",
-  ".mcp.json",
-  "mcp.json",
-  ".cursor/mcp.json",
-  ".vscode/mcp.json"
-];
-var PERMISSION_FILE = /(^|\/)(agentguard[^/]*\.ya?ml|\.claude\/settings(\.local)?\.json|[^/]*mcp[^/]*\.json|claude_desktop_config\.json)$/;
-function git(cwd, argv) {
-  try {
-    return execFileSync("git", argv, {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return void 0;
-  }
-}
-function showAt(cwd, ref, path) {
-  return git(cwd, ["show", `${ref}:${path}`]);
-}
-function changedPermissionFiles(cwd, base, head) {
-  const out = git(cwd, ["diff", "--name-only", base, head]) ?? "";
-  return out.split("\n").map((l) => l.trim()).filter((l) => l && PERMISSION_FILE.test(l));
-}
-function resolveBase(cwd, explicit) {
-  if (explicit) return explicit;
-  for (const candidate of ["origin/main", "main", "origin/master", "master"]) {
-    if (git(cwd, ["rev-parse", "--verify", "--quiet", candidate]) !== void 0) return candidate;
-  }
-  return "HEAD~1";
-}
-function runPermissionDiff(cwd, opts) {
-  const base = resolveBase(cwd, opts.base);
-  const head = opts.head ?? "HEAD";
-  const files = [
-    .../* @__PURE__ */ new Set([
-      ...opts.paths ?? DEFAULT_PERMISSION_PATHS,
-      ...changedPermissionFiles(cwd, base, head)
-    ])
-  ];
-  const findings = [];
-  const touched = [];
-  for (const file of files) {
-    const before = showAt(cwd, base, file);
-    const after = showAt(cwd, head, file);
-    if (before === void 0 && after === void 0) continue;
-    if (before === after) continue;
-    touched.push(file);
-    findings.push(...diffPermissionFile(file, before, after));
-  }
-  return {
-    base,
-    head,
-    files: touched,
-    findings,
-    markdown: renderPermissionDiffMarkdown(findings, { title: opts.title })
-  };
-}
-async function permissionDiffCommand(args, io) {
-  const paths = flagList(args, "paths");
-  const result = runPermissionDiff(io.cwd, {
-    base: flagString(args, "base"),
-    head: flagString(args, "head"),
-    paths: paths.length ? paths : void 0
-  });
-  const format = flagString(args, "format") ?? (flagBool(args, "json") ? "json" : "markdown");
-  if (format === "json") io.out(JSON.stringify(result, null, 2));
-  else io.out(result.markdown);
-  const widen = result.findings.filter((f) => f.severity === "widen").length;
-  if (flagBool(args, "fail-on-widen") && widen > 0) return 1;
-  return 0;
-}
-
-// src/commands/proxy.ts
-import { existsSync as existsSync7 } from "fs";
-import { dirname } from "path";
-import { Guard as Guard3, defaultPolicy, resolveAgent as resolveAgent2 } from "@agentwares/agentguard-core";
-import { FileKillSwitch as FileKillSwitch3, resolvePath } from "@agentwares/agentguard-core/node";
-function newRunId(now = /* @__PURE__ */ new Date()) {
-  return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
-}
-function unconfiguredPolicy(args, io) {
-  if (flagString(args, "config") !== void 0 || io.env.AGENTGUARD_CONFIG) return void 0;
-  const path = policyPathFrom(args, io);
-  if (existsSync7(path)) return void 0;
-  const policy = defaultPolicy();
-  const baseDir = dirname(path);
-  return {
-    policy,
-    path,
-    baseDir,
-    stateDir: resolvePath(policy.state.dir, baseDir),
-    auditPath: resolvePath(policy.audit.path, baseDir),
-    killPath: resolvePath(policy.kill.file, baseDir)
-  };
-}
-async function serveOverStdio(runtime) {
-  const server = createDownstreamServer(runtime);
-  const stop = async () => {
-    await runtime.close();
-  };
-  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
-  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
-  await serveStdio(server);
-  await stop();
-  return 0;
-}
-async function proxyCommand(args, io) {
-  const log = (line) => io.err(`[agentguard] ${line}`);
-  const modeOverride = flagString(args, "mode");
-  const http = flagBool(args, "http") === true;
-  const unconfigured = http ? void 0 : unconfiguredPolicy(args, io);
-  if (unconfigured) {
-    if (modeOverride === "dry-run" || modeOverride === "enforce")
-      unconfigured.policy.mode = modeOverride;
-    const runtime2 = new ProxyRuntime({
-      loaded: unconfigured,
-      guard: new Guard3({
-        policy: unconfigured.policy,
-        env: io.env,
-        kill: new FileKillSwitch3(unconfigured.killPath)
-      }),
-      configured: false,
-      defaultRunId: flagString(args, "run-id") ?? newRunId(),
-      log
-    });
-    await runtime2.start();
-    log(
-      `no policy file at ${unconfigured.path}: serving agentguard's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
-    );
-    return serveOverStdio(runtime2);
-  }
-  const loaded = loadPolicyFor(args, io);
-  if (modeOverride === "dry-run" || modeOverride === "enforce") loaded.policy.mode = modeOverride;
-  const agentName = flagString(args, "agent");
-  let agent = void 0;
-  if (agentName) {
-    const resolved = await resolveAgent2(loaded.policy, { name: agentName });
-    if (resolved.error) {
-      io.err(
-        `unknown agent "${agentName}" \u2014 agents in agentguard.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
-      );
-      return 1;
-    }
-    agent = resolved.agent;
-  }
-  let approvalBase;
-  const fileGuard = createFileGuard(loaded, {
-    log,
-    env: io.env,
-    approvalUrl: (r) => approvalBase ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}` : void 0,
-    onEvent: (e) => {
-      if (e.type === "APPROVAL_DECIDED") return;
-      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : ""}`);
-      if (e.type === "APPROVAL_REQUIRED" && e.approval)
-        log(`approve with: agentguard approve ${e.approval.id}`);
-    }
-  });
-  const runtime = new ProxyRuntime({
-    loaded,
-    guard: fileGuard.guard,
-    agent,
-    defaultRunId: flagString(args, "run-id") ?? newRunId(),
-    log
-  });
-  await runtime.start();
-  const killed = await fileGuard.kill.check();
-  if (killed.killed)
-    log(
-      `kill switch is ON (${killed.reason}); every call returns KILLED until \`agentguard resume\``
-    );
-  if (runtime.upstreamStatus().length === 0)
-    log(
-      `${loaded.path} lists no upstreams: serving agentguard's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
-    );
-  if (http) {
-    const server = await startHttpProxy({
-      runtime,
-      port: flagNumber(args, "port") ?? 8788,
-      host: flagString(args, "host") ?? "127.0.0.1",
-      token: io.env.AGENTGUARD_HTTP_TOKEN
-    });
-    approvalBase = { baseUrl: server.url.replace(/\/mcp$/, ""), token: server.token };
-    log(
-      `Streamable HTTP at ${server.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
-    );
-    log(
-      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
-    );
-    const stop = async () => {
-      await server.close();
-      await runtime.close();
-      process.exit(0);
-    };
-    process.once("SIGINT", () => void stop());
-    process.once("SIGTERM", () => void stop());
-    await new Promise(() => void 0);
-  }
-  return serveOverStdio(runtime);
-}
-
-// src/commands/report.ts
-import { resolve as resolve4 } from "path";
+  HELP,
+  main
+} from "./chunk-6TUQD666.js";
+import "./chunk-3O6KWT3E.js";
+import "./chunk-TW5KJREH.js";
 import {
-  buildReport as buildReport2,
-  latestRunId as latestRunId2,
-  listRuns as listRuns2,
-  renderMutationDiff,
-  renderReportMarkdown as renderReportMarkdown2
-} from "@agentwares/agentguard-core";
-import { readAuditFile, verifyAuditFile } from "@agentwares/agentguard-core/node";
-function pickRun(args, entries) {
-  if (flagBool(args, "all")) return void 0;
-  return flagString(args, "run") ?? latestRunId2(entries);
-}
-async function reportCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const entries = readAuditFile(loaded.auditPath);
-  const runId = pickRun(args, entries);
-  const report = buildReport2(entries, { runId });
-  if (flagBool(args, "json")) {
-    io.out(
-      JSON.stringify(
-        {
-          ...report,
-          mutations: report.mutations.map((m) => ({
-            seq: m.seq,
-            ts: m.ts,
-            tool: m.tool,
-            mutation: m.mutation
-          }))
-        },
-        null,
-        2
-      )
-    );
-    return 0;
-  }
-  io.out(renderReportMarkdown2(report));
-  const chain = await verifyAuditFile(loaded.auditPath);
-  io.out(
-    chain.ok ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).` : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`
-  );
-  if (runId && listRuns2(entries).length > 1) io.out(`Other runs: agentguard report --all`);
-  return 0;
-}
-async function diffCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const entries = readAuditFile(loaded.auditPath);
-  const runId = pickRun(args, entries);
-  io.out(renderMutationDiff(entries, { runId }).trimEnd());
-  return 0;
-}
-async function verifyCommand(args, io) {
-  let path = args.positionals[0];
-  if (!path) path = loadPolicyFor(args, io, { allowMissingEnv: true }).auditPath;
-  path = resolve4(io.cwd, path);
-  const result = await verifyAuditFile(path);
-  if (flagBool(args, "json")) io.out(JSON.stringify({ path, ...result }));
-  else if (result.ok)
-    io.out(
-      `ok: ${result.entries} entries, chain intact, head ${result.head?.slice(0, 16)}\u2026 (${path})`
-    );
-  else io.out(`BROKEN at entry ${result.brokenAt}: ${result.reason} (${path})`);
-  return result.ok ? 0 : 1;
-}
-async function statusCommand(args, io) {
-  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
-  const { guard, kill } = createFileGuard(loaded, { alerts: false, env: io.env });
-  const entries = readAuditFile(loaded.auditPath);
-  const runId = flagString(args, "run") ?? latestRunId2(entries) ?? "(none yet)";
-  const status = await guard.status(runId);
-  const killed = kill.check();
-  const reg = readRegistration(loaded);
-  const pending = await guard.approvals.list("pending");
-  if (flagBool(args, "json")) {
-    io.out(
-      JSON.stringify(
-        {
-          policy: loaded.path,
-          mode: loaded.policy.mode,
-          runId,
-          ...status,
-          killed,
-          pendingApprovals: pending.length,
-          http: reg ? { url: reg.url, pid: reg.pid } : void 0
-        },
-        null,
-        2
-      )
-    );
-    return 0;
-  }
-  io.out(
-    `policy   ${loaded.path} (mode: ${loaded.policy.mode}, ${loaded.policy.upstreams.length} upstreams)`
-  );
-  io.out(
-    `kill     ${killed.killed ? `ON \u2014 ${killed.reason} (agentguard resume to clear)` : "off"}`
-  );
-  io.out(
-    `http     ${reg ? `${reg.url} (pid ${reg.pid})` : "not running (agentguard proxy --http)"}`
-  );
-  io.out(`audit    ${entries.length} entries in ${loaded.auditPath}`);
-  io.out(
-    `pending  ${pending.length} approval${pending.length === 1 ? "" : "s"}${pending.length ? ` \u2014 agentguard approvals` : ""}`
-  );
-  io.out(`run      ${runId}`);
-  const fmt = (scope) => Object.entries(status.caps[scope]).map(([k, limit]) => `${k} ${status.usage[scope][k] ?? 0}/${limit}`).join("  ") || "no caps";
-  io.out(`  per_run  ${fmt("per_run")}`);
-  io.out(`  per_day  ${fmt("per_day")}`);
-  return 0;
-}
-
-// src/cli.ts
-var HELP = `agentguard \u2014 MCP policy proxy for agents that touch production
-
-  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy
-  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted
-  agentguard diff [--run id]          record-by-record mutation diff from a dry run
-  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited
-  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)
-
-  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]
-  agentguard tools [--json]           the tools your agent will see, with class and why
-  agentguard status [--run id]        counters vs caps, kill state, pending approvals
-
-  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume
-  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]
-  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]
-  agentguard key list | revoke <agent>
-  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]
-
-Options: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version
-Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli`;
-async function main(argv, io = defaultIo()) {
-  const args = parseArgs(argv);
-  if (args.flags.version) {
-    io.out(version());
-    return 0;
-  }
-  if (args.command === void 0 && !args.flags.help && io.tty === false) {
-    try {
-      return await proxyCommand(args, io);
-    } catch (err) {
-      io.err(describeError(err));
-      return 1;
-    }
-  }
-  if (args.flags.help || args.command === void 0 || args.command === "help") {
-    io.out(HELP);
-    return args.command === void 0 && !args.flags.help ? 1 : 0;
-  }
-  try {
-    switch (args.command) {
-      case "init":
-        return await initCommand(args, io);
-      case "proxy":
-      case "serve":
-        return await proxyCommand(args, io);
-      case "report":
-        return await reportCommand(args, io);
-      case "diff":
-        return await diffCommand(args, io);
-      case "verify":
-        return await verifyCommand(args, io);
-      case "connect":
-        return await connectCommand(args, io);
-      case "status":
-        return await statusCommand(args, io);
-      case "tools":
-        return await toolsCommand(args, io);
-      case "kill":
-        return await killCommand(args, io);
-      case "resume":
-        return await resumeCommand(args, io);
-      case "approve":
-        return await decideCommand("approved", args, io);
-      case "deny":
-        return await decideCommand("denied", args, io);
-      case "approvals":
-        return await approvalsCommand(args, io);
-      case "key":
-      case "keys":
-        return await keyCommand(args, io);
-      case "permission-diff":
-        return await permissionDiffCommand(args, io);
-      default:
-        io.err(`unknown command "${args.command}"
-`);
-        io.err(HELP);
-        return 1;
-    }
-  } catch (err) {
-    io.err(describeError(err));
-    return 1;
-  }
-}
-var isMain = process.argv[1] !== void 0 && /(^|\/)(cli\.[cm]?[jt]s|agentguard)$/.test(process.argv[1]);
-if (isMain) {
-  main(process.argv.slice(2)).then(
-    (code) => {
-      if (code !== 0) process.exitCode = code;
-    },
-    (err) => {
-      process.stderr.write(`${describeError(err)}
-`);
-      process.exitCode = 1;
-    }
-  );
-}
+  version
+} from "./chunk-SUXQTT3X.js";
+import "./chunk-5WRI5ZAA.js";
 export {
   HELP,
   main,