@ai-ecoverse/mcpcat 0.8.0 → 0.10.0

package/dist/host/mcpcat.mjs

@@ -5298,6 +5298,367 @@ var init_portable = __esm({
   }
 });
 
+// src/args/coerce.ts
+function asSchemaObject(schema) {
+  return schema ?? {};
+}
+function emptyArgObject() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function isUnsafeObjectKey(key) {
+  return key === "__proto__" || key === "prototype" || key === "constructor";
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && value !== Object.prototype;
+}
+function splitFlag(a) {
+  const eq = a.indexOf("=");
+  if (eq > 2) return { key: a.slice(2, eq), inlineValue: a.slice(eq + 1) };
+  return { key: a.slice(2), inlineValue: void 0 };
+}
+function coerceScalar(raw, type) {
+  switch (type) {
+    case "integer": {
+      if (!/^-?\d+$/.test(raw)) return { ok: false, error: `expected integer, got "${raw}"` };
+      return { ok: true, value: Number(raw) };
+    }
+    case "number": {
+      const n = Number(raw);
+      if (!Number.isFinite(n)) return { ok: false, error: `expected number, got "${raw}"` };
+      return { ok: true, value: n };
+    }
+    case "boolean": {
+      if (raw === "true" || raw === "1" || raw === "yes") return { ok: true, value: true };
+      if (raw === "false" || raw === "0" || raw === "no") return { ok: true, value: false };
+      return { ok: false, error: `expected boolean, got "${raw}"` };
+    }
+    case "object":
+      return coerceJsonObject(raw);
+    default:
+      return { ok: true, value: raw };
+  }
+}
+function coerceJsonObject(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: `expected object JSON, got "${raw}"` };
+  }
+  if (!isPlainObject(parsed)) {
+    return { ok: false, error: `expected object JSON, got "${raw}"` };
+  }
+  return { ok: true, value: parsed };
+}
+function resolveToolFlag(key, properties) {
+  if (Object.hasOwn(properties, key)) {
+    return { ok: true, rootKey: key, dottedPath: null, meta: properties[key] ?? {} };
+  }
+  const dot = key.indexOf(".");
+  if (dot <= 0) return { ok: false, error: `unknown flag: --${key}` };
+  const rootKey = key.slice(0, dot);
+  const rest = key.slice(dot + 1);
+  if (!Object.hasOwn(properties, rootKey) || rest.length === 0) {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  const parts = rest.split(".");
+  if (isUnsafeObjectKey(rootKey) || parts.some((p) => p.length === 0 || isUnsafeObjectKey(p))) {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  return { ok: true, rootKey, dottedPath: parts, meta: properties[rootKey] ?? {} };
+}
+function readFlagRaw(args2, i, key, inlineValue, type, dottedPath) {
+  if (inlineValue !== void 0) {
+    return { ok: true, raw: inlineValue, nextIndex: i + 1, bareBoolean: false };
+  }
+  const next = args2[i + 1];
+  if (!dottedPath && type === "boolean" && (next === void 0 || next.startsWith("--"))) {
+    return { ok: true, raw: "", nextIndex: i + 1, bareBoolean: true };
+  }
+  if (next === void 0) {
+    return { ok: false, error: `flag --${key} requires a value` };
+  }
+  return { ok: true, raw: next, nextIndex: i + 2, bareBoolean: false };
+}
+function setDotted(out, rootKey, path, value) {
+  if (isUnsafeObjectKey(rootKey) || path.some((p) => p.length === 0 || isUnsafeObjectKey(p))) {
+    return { ok: false, error: `unknown flag: --${rootKey}.${path.join(".")}` };
+  }
+  const existing = Object.hasOwn(out, rootKey) ? out[rootKey] : void 0;
+  if (existing === void 0) {
+    out[rootKey] = emptyArgObject();
+  } else if (!isPlainObject(existing)) {
+    return { ok: false, error: `--${rootKey}: cannot nest into a ${typeof existing} value` };
+  }
+  let cursor = out[rootKey];
+  for (let i = 0; i < path.length - 1; i++) {
+    const seg = path[i];
+    const next = Object.hasOwn(cursor, seg) ? cursor[seg] : void 0;
+    if (next === void 0) {
+      cursor[seg] = emptyArgObject();
+    } else if (!isPlainObject(next)) {
+      return {
+        ok: false,
+        error: `--${rootKey}.${path.slice(0, i + 1).join(".")}: cannot nest into a ${typeof next} value`
+      };
+    }
+    cursor = cursor[seg];
+  }
+  cursor[path[path.length - 1]] = value;
+  return { ok: true };
+}
+function assignFlagValue(out, rootKey, dottedPath, value, isArray) {
+  if (dottedPath) return setDotted(out, rootKey, dottedPath, value);
+  if (isArray) {
+    const prev = out[rootKey];
+    if (Array.isArray(prev)) prev.push(value);
+    else out[rootKey] = [value];
+    return { ok: true };
+  }
+  const existing = out[rootKey];
+  if (isPlainObject(existing) && isPlainObject(value)) {
+    Object.assign(existing, value);
+    return { ok: true };
+  }
+  out[rootKey] = value;
+  return { ok: true };
+}
+function parseOneFlag(args2, i, properties, out) {
+  const a = args2[i];
+  if (a === "--") return { ok: true, nextIndex: args2.length };
+  if (a.startsWith("--no-") && a.length > 5) {
+    const key2 = a.slice(5);
+    if (Object.hasOwn(properties, key2) && properties[key2]?.type === "boolean") {
+      out[key2] = false;
+      return { ok: true, nextIndex: i + 1 };
+    }
+    return { ok: false, error: `unknown flag: ${a}` };
+  }
+  if (!a.startsWith("--")) {
+    return { ok: false, error: `unexpected positional argument "${a}"` };
+  }
+  const { key, inlineValue } = splitFlag(a);
+  const resolved = resolveToolFlag(key, properties);
+  if (!resolved.ok) return resolved;
+  const { rootKey, dottedPath, meta } = resolved;
+  const declaredType = meta.type;
+  const type = declaredType ?? "string";
+  const isArray = type === "array";
+  const itemType = (isArray ? meta.items?.type : void 0) ?? "string";
+  if (dottedPath && declaredType !== void 0 && declaredType !== "object") {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  const taken = readFlagRaw(args2, i, key, inlineValue, type, dottedPath);
+  if (!taken.ok) return taken;
+  if (taken.bareBoolean) {
+    out[rootKey] = true;
+    return { ok: true, nextIndex: taken.nextIndex };
+  }
+  const valueType = dottedPath ? "string" : isArray ? itemType : type;
+  const coerced = coerceScalar(taken.raw, valueType);
+  if (!coerced.ok) return { ok: false, error: `--${key}: ${coerced.error}` };
+  const assigned = assignFlagValue(out, rootKey, dottedPath, coerced.value, isArray);
+  if (!assigned.ok) return assigned;
+  return { ok: true, nextIndex: taken.nextIndex };
+}
+function coerceArgsBySchema(args2, schema, options) {
+  const s = asSchemaObject(schema);
+  const properties = s.properties ?? {};
+  const required = new Set(Array.isArray(s.required) ? s.required : []);
+  const out = emptyArgObject();
+  let i = 0;
+  while (i < args2.length) {
+    const result = parseOneFlag(args2, i, properties, out);
+    if (!result.ok) return result;
+    i = result.nextIndex;
+  }
+  if (!options?.noValidate) {
+    for (const r of required) {
+      if (!Object.hasOwn(out, r)) {
+        return { ok: false, error: `missing required flag --${r}` };
+      }
+    }
+  }
+  return { ok: true, value: out };
+}
+function mergeArgs(base, flags) {
+  const result = { ...base };
+  for (const [k, v] of Object.entries(flags)) {
+    result[k] = v;
+  }
+  return result;
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/callback.js
+import { createServer } from "node:http";
+function plainText(page) {
+  if (page.ok)
+    return "Authorization complete. You may close this window.";
+  return page.details ? `${page.message}
+
+${page.details}` : page.message;
+}
+var OAuthCallbackServer = class _OAuthCallbackServer {
+  redirectUrl;
+  server;
+  paths;
+  timeoutMs;
+  renderPage;
+  pending = /* @__PURE__ */ new Map();
+  constructor(server, redirectUrl, paths, timeoutMs, renderPage) {
+    this.server = server;
+    this.redirectUrl = redirectUrl;
+    this.paths = paths;
+    this.timeoutMs = timeoutMs;
+    this.renderPage = renderPage;
+  }
+  static async listen(options = {}) {
+    const host = options.host ?? "127.0.0.1";
+    const redirectHost = options.redirectHost ?? host;
+    const path = options.path ?? "/callback";
+    let instance;
+    const server = createServer((request, response) => instance?.handle(request.url ?? "/", response));
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port ?? 0, host, () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+      throw new Error("OAuth callback server did not bind to TCP");
+    instance = new _OAuthCallbackServer(server, `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${path}`, [path, ...options.extraPaths ?? []], options.timeoutMs ?? 5 * 6e4, options.renderPage);
+    return instance;
+  }
+  /**
+   * Wait for the authorization response with `state`. With `path`, a response on another path fails, so
+   * a server-specific redirect URI can tell authorization servers apart (RFC 9700 section 4.4.2.2).
+   */
+  waitForCallback(state, path) {
+    if (this.pending.has(state))
+      throw new Error("OAuth state is already pending");
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(state);
+        reject(new Error("OAuth callback timed out"));
+      }, this.timeoutMs);
+      this.pending.set(state, { resolve, reject, timer, path });
+    });
+  }
+  async close() {
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(new Error("OAuth callback server closed"));
+    }
+    this.pending.clear();
+    await new Promise((resolve, reject) => {
+      this.server.close((error) => error ? reject(error) : resolve());
+    });
+  }
+  reply(response, status, page) {
+    if (this.renderPage) {
+      response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+      response.end(this.renderPage(page));
+    } else {
+      response.writeHead(status, { "content-type": "text/plain; charset=utf-8" }).end(plainText(page));
+    }
+  }
+  handle(rawUrl, response) {
+    const url = new URL(rawUrl, this.redirectUrl);
+    if (!this.paths.includes(url.pathname)) {
+      this.reply(response, 404, { ok: false, message: "Not found" });
+      return;
+    }
+    const state = url.searchParams.get("state");
+    const pending = state ? this.pending.get(state) : void 0;
+    if (!state || !pending) {
+      this.reply(response, 400, { ok: false, message: "Invalid or expired OAuth state" });
+      return;
+    }
+    clearTimeout(pending.timer);
+    this.pending.delete(state);
+    if (pending.path !== void 0 && url.pathname !== pending.path) {
+      pending.reject(new Error("The authorization response arrived on another redirect URI"));
+      this.reply(response, 400, { ok: false, message: "Unexpected redirect URI" });
+      return;
+    }
+    const error = url.searchParams.get("error");
+    if (error) {
+      const description = url.searchParams.get("error_description") ?? error;
+      pending.reject(new Error(description));
+      this.reply(response, 200, {
+        ok: false,
+        message: "Authorization failed. You may close this window.",
+        details: description
+      });
+      return;
+    }
+    const code2 = url.searchParams.get("code");
+    if (!code2) {
+      pending.reject(new Error("OAuth callback did not include an authorization code"));
+      this.reply(response, 400, { ok: false, message: "Missing authorization code" });
+      return;
+    }
+    const iss = url.searchParams.get("iss");
+    pending.resolve({ code: code2, state, ...iss ? { iss } : {} });
+    this.reply(response, 200, { ok: true });
+  }
+};
+
+// node_modules/@earendil-works/pi-mcp/dist/protocol/types.js
+var LATEST_PROTOCOL_VERSION = "2025-11-25";
+var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05"];
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/errors.js
+var OAuthError = class extends Error {
+  code;
+  errorUri;
+  constructor(code2, message, errorUri) {
+    super(message || code2);
+    this.name = "OAuthError";
+    this.code = code2;
+    this.errorUri = errorUri;
+  }
+};
+var OAuthIssuerMismatchError = class extends Error {
+  /** `undefined` when no authorization server metadata was discovered. */
+  expected;
+  /** `undefined` when an authorization response lacks the `iss` parameter its server promised (RFC 9207). */
+  received;
+  constructor(expected, received) {
+    const format = (issuer) => issuer === void 0 ? "none" : JSON.stringify(issuer);
+    super(`OAuth issuer mismatch: expected ${format(expected)}, received ${format(received)}`);
+    this.name = "OAuthIssuerMismatchError";
+    this.expected = expected;
+    this.received = received;
+  }
+};
+var OAuthInsecureEndpointError = class extends Error {
+  endpoint;
+  constructor(endpoint) {
+    super(`Refusing to send OAuth credentials to non-HTTPS endpoint ${endpoint}`);
+    this.name = "OAuthInsecureEndpointError";
+    this.endpoint = endpoint;
+  }
+};
+var OAuthRegistrationError = class extends Error {
+  status;
+  body;
+  constructor(status, body) {
+    super(`OAuth dynamic client registration failed with status ${status}: ${body}`);
+    this.name = "OAuthRegistrationError";
+    this.status = status;
+    this.body = body;
+  }
+};
+var McpOAuthAuthorizationRequiredError = class extends Error {
+  constructor() {
+    super("MCP OAuth authorization requires user interaction");
+    this.name = "McpOAuthAuthorizationRequiredError";
+  }
+};
+
 // node_modules/@earendil-works/pi-mcp/dist/protocol/jsonrpc.js
 var JSON_RPC_ERROR_CODES = {
   parseError: -32700,
@@ -5366,9 +5727,726 @@ function parseJsonRpcMessage(value) {
   throw new McpError(JSON_RPC_ERROR_CODES.invalidRequest, "Invalid JSON-RPC message");
 }
 
-// node_modules/@earendil-works/pi-mcp/dist/protocol/types.js
-var LATEST_PROTOCOL_VERSION = "2025-11-25";
-var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05"];
+// node_modules/@earendil-works/pi-mcp/dist/oauth/types.js
+function object(value, name) {
+  if (!isObject(value))
+    throw new Error(`Invalid ${name}`);
+  return value;
+}
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
+}
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`Invalid ${name}`);
+  return value;
+}
+function absent(value) {
+  return value === void 0 || value === null || value === "";
+}
+function optionalString(value, name) {
+  if (absent(value))
+    return void 0;
+  return requiredString(value, name);
+}
+function optionalStrings(value, name) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string"))
+    throw new Error(`Invalid ${name}`);
+  return [...value];
+}
+function safeUrl(value, name) {
+  const text = requiredString(value, name);
+  if (!URL.canParse(text))
+    throw new Error(`Invalid ${name}`);
+  const url = new URL(text);
+  if (["javascript:", "data:", "vbscript:"].includes(url.protocol))
+    throw new Error(`Invalid ${name}`);
+  return text;
+}
+function optionalUrl(value, name) {
+  return absent(value) ? void 0 : safeUrl(value, name);
+}
+function parseProtectedResourceMetadata(value) {
+  const input = object(value, "OAuth protected resource metadata");
+  return compact({
+    ...input,
+    resource: safeUrl(input.resource, "OAuth protected resource metadata resource"),
+    authorization_servers: optionalStrings(input.authorization_servers, "authorization_servers")?.map((url) => safeUrl(url, "authorization server URL")),
+    scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported")
+  });
+}
+function parseAuthorizationServerMetadata(value) {
+  const input = object(value, "authorization server metadata");
+  const responseTypes = optionalStrings(input.response_types_supported, "response_types_supported");
+  if (!responseTypes)
+    throw new Error("Invalid response_types_supported");
+  return compact({
+    ...input,
+    issuer: safeUrl(input.issuer, "authorization server issuer"),
+    authorization_endpoint: safeUrl(input.authorization_endpoint, "authorization endpoint"),
+    token_endpoint: safeUrl(input.token_endpoint, "token endpoint"),
+    registration_endpoint: optionalUrl(input.registration_endpoint, "registration endpoint"),
+    scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported"),
+    response_types_supported: responseTypes,
+    grant_types_supported: optionalStrings(input.grant_types_supported, "grant_types_supported"),
+    token_endpoint_auth_methods_supported: optionalStrings(input.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported"),
+    code_challenge_methods_supported: optionalStrings(input.code_challenge_methods_supported, "code_challenge_methods_supported"),
+    client_id_metadata_document_supported: typeof input.client_id_metadata_document_supported === "boolean" ? input.client_id_metadata_document_supported : void 0,
+    authorization_response_iss_parameter_supported: typeof input.authorization_response_iss_parameter_supported === "boolean" ? input.authorization_response_iss_parameter_supported : void 0
+  });
+}
+function parseOAuthTokens(value) {
+  const input = object(value, "OAuth token response");
+  const expires = absent(input.expires_in) ? void 0 : Number(input.expires_in);
+  if (expires !== void 0 && !Number.isFinite(expires))
+    throw new Error("Invalid expires_in");
+  return compact({
+    access_token: requiredString(input.access_token, "access_token"),
+    token_type: requiredString(input.token_type, "token_type"),
+    expires_in: expires,
+    scope: optionalString(input.scope, "scope"),
+    refresh_token: optionalString(input.refresh_token, "refresh_token"),
+    id_token: optionalString(input.id_token, "id_token")
+  });
+}
+function parseClientInformation(value) {
+  const input = object(value, "OAuth client registration response");
+  return compact({
+    ...input,
+    client_id: requiredString(input.client_id, "client_id"),
+    client_secret: optionalString(input.client_secret, "client_secret"),
+    client_id_issued_at: typeof input.client_id_issued_at === "number" ? input.client_id_issued_at : void 0,
+    client_secret_expires_at: typeof input.client_secret_expires_at === "number" ? input.client_secret_expires_at : void 0,
+    redirect_uris: optionalStrings(input.redirect_uris, "redirect_uris") ?? []
+  });
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/discovery.js
+function discard(response) {
+  void response?.body?.cancel().catch(() => {
+  });
+}
+function isDiscoveryMiss(status) {
+  return status >= 400 && status < 500 || status === 502;
+}
+function pathSuffix(pathname) {
+  return pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+}
+function field(header, name) {
+  const match = header.match(new RegExp(String.raw`(?:^|[,\s])${name}=(?:"([^"]*)"|([^\s,]+))`, "i"));
+  return match?.[1] || match?.[2] || void 0;
+}
+function parseWwwAuthenticate(header) {
+  if (!header)
+    return {};
+  const scheme = header.trimStart().split(/\s+/, 1)[0]?.toLowerCase();
+  if (scheme !== "bearer" && scheme !== "dpop")
+    return {};
+  const resourceMetadata = field(header, "resource_metadata");
+  let resourceMetadataUrl;
+  if (resourceMetadata) {
+    try {
+      resourceMetadataUrl = new URL(resourceMetadata);
+    } catch {
+    }
+  }
+  return {
+    resourceMetadataUrl,
+    scope: field(header, "scope"),
+    error: field(header, "error"),
+    errorDescription: field(header, "error_description")
+  };
+}
+async function fetchMetadata(url, fetch, protocolVersion, signal) {
+  return fetch(url, {
+    headers: { Accept: "application/json", "MCP-Protocol-Version": protocolVersion },
+    signal
+  });
+}
+async function discoverProtectedResourceMetadata(serverUrl, options = {}) {
+  const server = new URL(serverUrl);
+  const fetch = options.fetch ?? globalThis.fetch;
+  const version = options.protocolVersion ?? LATEST_PROTOCOL_VERSION;
+  let response = await fetchMetadata(options.resourceMetadataUrl ? new URL(options.resourceMetadataUrl) : new URL(`/.well-known/oauth-protected-resource${pathSuffix(server.pathname)}`, server.origin), fetch, version, options.signal);
+  if (!options.resourceMetadataUrl && server.pathname !== "/" && isDiscoveryMiss(response.status)) {
+    discard(response);
+    response = await fetchMetadata(new URL("/.well-known/oauth-protected-resource", server.origin), fetch, version, options.signal);
+  }
+  if (!response.ok) {
+    discard(response);
+    throw new Error(`HTTP ${response.status} loading OAuth protected resource metadata`);
+  }
+  return parseProtectedResourceMetadata(await response.json());
+}
+function buildAuthorizationServerDiscoveryUrls(authorizationServerUrl) {
+  const issuer = new URL(authorizationServerUrl);
+  const path = pathSuffix(issuer.pathname);
+  const urls = [
+    { url: new URL(`/.well-known/oauth-authorization-server${path}`, issuer.origin), type: "oauth" },
+    { url: new URL(`/.well-known/openid-configuration${path}`, issuer.origin), type: "oidc" }
+  ];
+  if (path)
+    urls.push({ url: new URL(`${path}/.well-known/openid-configuration`, issuer.origin), type: "oidc" });
+  return urls;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, options = {}) {
+  const fetch = options.fetch ?? globalThis.fetch;
+  for (const { url } of buildAuthorizationServerDiscoveryUrls(authorizationServerUrl)) {
+    const response = await fetchMetadata(url, fetch, options.protocolVersion ?? LATEST_PROTOCOL_VERSION, options.signal);
+    if (!response.ok) {
+      discard(response);
+      if (isDiscoveryMiss(response.status))
+        continue;
+      throw new Error(`HTTP ${response.status} loading authorization server metadata from ${url}`);
+    }
+    const metadata = parseAuthorizationServerMetadata(await response.json());
+    if (!options.skipIssuerValidation) {
+      const expected = String(authorizationServerUrl);
+      const trim = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
+      if (trim(metadata.issuer) !== trim(expected))
+        throw new OAuthIssuerMismatchError(expected, metadata.issuer);
+    }
+    return metadata;
+  }
+  return void 0;
+}
+async function discoverOAuthServerInfo(serverUrl, options = {}) {
+  let resourceMetadata;
+  try {
+    resourceMetadata = await discoverProtectedResourceMetadata(serverUrl, {
+      resourceMetadataUrl: options.resourceMetadataUrl,
+      fetch: options.fetch,
+      signal: options.signal
+    });
+  } catch (error) {
+    if (error instanceof TypeError)
+      throw error;
+  }
+  if (options.authorizationServerMetadataUrl) {
+    const url = options.authorizationServerMetadataUrl;
+    const response = await fetchMetadata(url, options.fetch ?? globalThis.fetch, LATEST_PROTOCOL_VERSION, options.signal);
+    if (!response.ok) {
+      discard(response);
+      throw new Error(`HTTP ${response.status} loading authorization server metadata from ${url}`);
+    }
+    const metadata = parseAuthorizationServerMetadata(await response.json());
+    return { authorizationServerUrl: metadata.issuer, authorizationServerMetadata: metadata, resourceMetadata };
+  }
+  const authorizationServerUrl = resourceMetadata?.authorization_servers?.[0] ?? String(new URL("/", serverUrl));
+  return {
+    authorizationServerUrl,
+    authorizationServerMetadata: await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+      fetch: options.fetch,
+      skipIssuerValidation: options.skipIssuerValidation,
+      signal: options.signal
+    }),
+    resourceMetadata
+  };
+}
+function resourceUrlFromServerUrl(value) {
+  const url = new URL(value);
+  url.hash = "";
+  return url;
+}
+function selectResource(serverUrl, metadata) {
+  if (!metadata)
+    return void 0;
+  const requested = resourceUrlFromServerUrl(serverUrl);
+  const configured = new URL(metadata.resource);
+  if (requested.origin !== configured.origin) {
+    throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
+  }
+  const requestedPath = requested.pathname.endsWith("/") ? requested.pathname : `${requested.pathname}/`;
+  const configuredPath = configured.pathname.endsWith("/") ? configured.pathname : `${configured.pathname}/`;
+  if (!requestedPath.startsWith(configuredPath)) {
+    throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
+  }
+  return metadata.resource;
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/flow.js
+function loopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+function applicationType(redirectUris) {
+  const native = redirectUris.some((uri) => {
+    if (!URL.canParse(uri))
+      return false;
+    const url = new URL(uri);
+    return url.protocol !== "http:" && url.protocol !== "https:" || loopback(url.hostname);
+  });
+  return native ? "native" : "web";
+}
+function secureEndpoint(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" && !loopback(url.hostname))
+    throw new OAuthInsecureEndpointError(url.href);
+  return url;
+}
+function selectClientAuthMethod(information, supported) {
+  const hinted = "token_endpoint_auth_method" in information ? information.token_endpoint_auth_method : void 0;
+  if (hinted && ["client_secret_basic", "client_secret_post", "none"].includes(hinted) && (supported.length === 0 || supported.includes(hinted))) {
+    return hinted;
+  }
+  if (supported.length === 0)
+    return information.client_secret ? "client_secret_basic" : "none";
+  if (information.client_secret && supported.includes("client_secret_basic"))
+    return "client_secret_basic";
+  if (information.client_secret && supported.includes("client_secret_post"))
+    return "client_secret_post";
+  if (supported.includes("none"))
+    return "none";
+  return information.client_secret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, information, headers, params) {
+  if (method === "client_secret_basic") {
+    if (!information.client_secret)
+      throw new Error("client_secret_basic requires a client secret");
+    headers.set("Authorization", `Basic ${Buffer.from(`${information.client_id}:${information.client_secret}`).toString("base64")}`);
+  } else {
+    params.set("client_id", information.client_id);
+    if (method === "client_secret_post" && information.client_secret)
+      params.set("client_secret", information.client_secret);
+  }
+}
+async function pkce() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  const verifier = Buffer.from(bytes).toString("base64url");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: Buffer.from(digest).toString("base64url") };
+}
+async function startAuthorization(authorizationServerUrl, options) {
+  const metadata = options.metadata;
+  if (metadata && !metadata.response_types_supported.includes("code")) {
+    throw new Error("Authorization server does not support authorization codes");
+  }
+  if (metadata?.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256")) {
+    throw new Error("Authorization server does not support PKCE S256");
+  }
+  const url = new URL(metadata?.authorization_endpoint ?? new URL("/authorize", authorizationServerUrl));
+  const { verifier, challenge } = await pkce();
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientInformation.client_id);
+  url.searchParams.set("code_challenge", challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("redirect_uri", String(options.redirectUrl));
+  if (options.state)
+    url.searchParams.set("state", options.state);
+  if (options.scope)
+    url.searchParams.set("scope", options.scope);
+  if (options.scope?.split(/\s+/).includes("offline_access"))
+    url.searchParams.set("prompt", "consent");
+  if (options.resource)
+    url.searchParams.set("resource", options.resource);
+  return { authorizationUrl: url, codeVerifier: verifier };
+}
+async function tokenRequest(authorizationServerUrl, options, params) {
+  const url = secureEndpoint(options.metadata?.token_endpoint ?? new URL("/token", authorizationServerUrl));
+  const headers = new Headers({ Accept: "application/json", "content-type": "application/x-www-form-urlencoded" });
+  if (options.resource)
+    params.set("resource", options.resource);
+  if (options.addClientAuthentication) {
+    await options.addClientAuthentication(headers, params, url, options.metadata);
+  } else {
+    applyClientAuthentication(selectClientAuthMethod(options.clientInformation, options.metadata?.token_endpoint_auth_methods_supported ?? []), options.clientInformation, headers, params);
+  }
+  const response = await (options.fetch ?? globalThis.fetch)(url, {
+    method: "POST",
+    headers,
+    body: params,
+    signal: options.signal
+  });
+  const text = await response.text();
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+  }
+  if (isObject(value) && typeof value.error === "string") {
+    throw new OAuthError(value.error, typeof value.error_description === "string" ? value.error_description : value.error, typeof value.error_uri === "string" ? value.error_uri : void 0);
+  }
+  if (!response.ok)
+    throw new OAuthError("server_error", `HTTP ${response.status}: ${text}`);
+  return parseOAuthTokens(value);
+}
+async function registerClient(authorizationServerUrl, options) {
+  const endpoint = options.metadata?.registration_endpoint;
+  if (options.metadata && !endpoint)
+    throw new Error("Authorization server does not support dynamic client registration");
+  const response = await (options.fetch ?? globalThis.fetch)(new URL(endpoint ?? new URL("/register", authorizationServerUrl)), {
+    method: "POST",
+    headers: { Accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({
+      ...options.clientMetadata,
+      application_type: options.clientMetadata.application_type ?? applicationType(options.clientMetadata.redirect_uris),
+      ...options.scope ? { scope: options.scope } : {}
+    }),
+    signal: options.signal
+  });
+  if (!response.ok)
+    throw new OAuthRegistrationError(response.status, await response.text());
+  return parseClientInformation(await response.json());
+}
+async function exchangeAuthorizationCode(authorizationServerUrl, options) {
+  return tokenRequest(authorizationServerUrl, options, new URLSearchParams({
+    grant_type: "authorization_code",
+    code: options.code,
+    code_verifier: options.codeVerifier,
+    redirect_uri: String(options.redirectUrl)
+  }));
+}
+async function refreshAuthorization(authorizationServerUrl, options) {
+  const tokens = await tokenRequest(authorizationServerUrl, options, new URLSearchParams({ grant_type: "refresh_token", refresh_token: options.refreshToken }));
+  return { refresh_token: options.refreshToken, ...tokens };
+}
+function withScope(tokens, scope) {
+  return tokens.scope === void 0 && scope ? { ...tokens, scope } : tokens;
+}
+function stepUpScope(granted, challenged) {
+  if (!challenged)
+    return void 0;
+  const scopes = [granted, challenged].flatMap((scope) => scope?.split(/\s+/).filter(Boolean) ?? []);
+  return [...new Set(scopes)].join(" ");
+}
+async function runFlow(provider, options) {
+  const metadataUrl = options.authorizationServerMetadataUrl && secureEndpoint(options.authorizationServerMetadataUrl);
+  const cached = metadataUrl ? void 0 : await provider.discoveryState?.();
+  const discovered = cached?.authorizationServerUrl ? {
+    authorizationServerUrl: cached.authorizationServerUrl,
+    authorizationServerMetadata: cached.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(cached.authorizationServerUrl, {
+      fetch: options.fetch,
+      skipIssuerValidation: options.skipIssuerValidation,
+      signal: options.signal
+    }),
+    resourceMetadata: cached.resourceMetadata
+  } : await discoverOAuthServerInfo(options.serverUrl, {
+    resourceMetadataUrl: options.resourceMetadataUrl,
+    authorizationServerMetadataUrl: metadataUrl,
+    fetch: options.fetch,
+    skipIssuerValidation: options.skipIssuerValidation,
+    signal: options.signal
+  });
+  if (!metadataUrl) {
+    await provider.saveDiscoveryState?.({
+      ...discovered,
+      ...options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl.href } : {}
+    });
+  }
+  const metadata = discovered.authorizationServerMetadata;
+  const resource = selectResource(options.serverUrl, discovered.resourceMetadata);
+  const scope = options.scope || discovered.resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
+  const stored = await provider.clientInformation();
+  const clientDocument = stored ? void 0 : provider.clientMetadataDocument?.(metadata);
+  if (clientDocument) {
+    const url = new URL(clientDocument.url);
+    if (url.protocol !== "https:" || url.pathname === "/")
+      throw new Error("Invalid OAuth client metadata URL");
+  }
+  let client = stored ?? (clientDocument && { client_id: clientDocument.url });
+  if (!client) {
+    if (options.authorizationCode)
+      throw new Error("OAuth client information is missing during code exchange");
+    if (!provider.saveClientInformation)
+      throw new Error("OAuth client information cannot be persisted");
+    client = await registerClient(discovered.authorizationServerUrl, {
+      metadata,
+      clientMetadata: provider.clientMetadata,
+      scope,
+      fetch: options.fetch,
+      signal: options.signal
+    });
+    await provider.saveClientInformation(client);
+  }
+  const redirectUrl = clientDocument?.redirectUrl ?? provider.redirectUrl;
+  const tokenOptions = {
+    metadata,
+    clientInformation: client,
+    resource,
+    addClientAuthentication: provider.addClientAuthentication,
+    fetch: options.fetch,
+    signal: options.signal
+  };
+  if (options.authorizationCode) {
+    const iss = options.iss;
+    if (iss !== void 0 || metadata?.authorization_response_iss_parameter_supported) {
+      if (iss !== metadata?.issuer)
+        throw new OAuthIssuerMismatchError(metadata?.issuer, iss);
+    }
+    const tokens = await exchangeAuthorizationCode(discovered.authorizationServerUrl, {
+      ...tokenOptions,
+      code: options.authorizationCode,
+      codeVerifier: await provider.codeVerifier(),
+      redirectUrl
+    });
+    await provider.saveTokens(withScope(tokens, scope));
+    return "AUTHORIZED";
+  }
+  const existing = options.skipRefresh ? void 0 : await provider.tokens();
+  if (existing?.refresh_token) {
+    try {
+      const tokens = await refreshAuthorization(discovered.authorizationServerUrl, {
+        ...tokenOptions,
+        refreshToken: existing.refresh_token
+      });
+      await provider.saveTokens(withScope(tokens, existing.scope));
+      return "AUTHORIZED";
+    } catch (error) {
+      if (options.signal?.aborted || error instanceof OAuthInsecureEndpointError)
+        throw error;
+      if (error instanceof OAuthError && error.code !== "server_error")
+        throw error;
+    }
+  }
+  const state = await provider.state?.();
+  const authorization = await startAuthorization(discovered.authorizationServerUrl, {
+    metadata,
+    clientInformation: client,
+    redirectUrl,
+    scope,
+    state,
+    resource
+  });
+  await provider.saveCodeVerifier(authorization.codeVerifier);
+  await provider.redirectToAuthorization(authorization.authorizationUrl);
+  return "REDIRECT";
+}
+async function authorizeMcp(provider, options) {
+  try {
+    return await runFlow(provider, options);
+  } catch (error) {
+    if (error instanceof OAuthError && ["invalid_client", "unauthorized_client"].includes(error.code)) {
+      await provider.invalidateCredentials?.("all");
+      return runFlow(provider, options);
+    }
+    if (error instanceof OAuthError && error.code === "invalid_grant") {
+      await provider.invalidateCredentials?.("tokens");
+      return runFlow(provider, options);
+    }
+    throw error;
+  }
+}
+
+// node_modules/@earendil-works/pi-mcp/dist/oauth/provider.js
+var MemoryOAuthStateStore = class {
+  value;
+  load() {
+    return this.value === void 0 ? void 0 : structuredClone(this.value);
+  }
+  save(state) {
+    this.value = structuredClone(state);
+  }
+};
+var McpOAuthProvider = class {
+  redirectUrl;
+  clientMetadata;
+  clientMetadataDocument;
+  serverUrl;
+  configuredClient;
+  store;
+  onRedirect;
+  writes = Promise.resolve();
+  constructor(options) {
+    this.serverUrl = String(new URL(options.serverUrl));
+    this.redirectUrl = String(options.redirectUrl);
+    this.clientMetadata = {
+      ...options.clientMetadata,
+      redirect_uris: options.clientMetadata.redirect_uris ?? [this.redirectUrl],
+      grant_types: options.clientMetadata.grant_types ?? ["authorization_code", "refresh_token"],
+      response_types: options.clientMetadata.response_types ?? ["code"],
+      token_endpoint_auth_method: options.clientMetadata.token_endpoint_auth_method ?? (options.clientSecret ? "client_secret_post" : "none")
+    };
+    this.clientMetadataDocument = options.clientMetadataDocument;
+    this.configuredClient = options.clientId ? { client_id: options.clientId, ...options.clientSecret ? { client_secret: options.clientSecret } : {} } : void 0;
+    this.store = options.store ?? new MemoryOAuthStateStore();
+    this.onRedirect = options.onRedirect;
+  }
+  async state() {
+    const existing = (await this.load()).oauthState;
+    if (existing)
+      return existing;
+    const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+    await this.update((value) => ({ ...value, oauthState: state }));
+    return state;
+  }
+  async clientInformation() {
+    return this.configuredClient ?? (await this.load()).clientInformation;
+  }
+  async saveClientInformation(information) {
+    if (this.configuredClient)
+      return;
+    await this.update((value) => ({ ...value, clientInformation: information }));
+  }
+  async tokens() {
+    return (await this.load()).tokens;
+  }
+  async saveTokens(tokens) {
+    const expiresAt = tokens.expires_in === void 0 ? void 0 : Date.now() + tokens.expires_in * 1e3;
+    await this.update((value) => {
+      const next = { ...value, tokens };
+      if (expiresAt === void 0)
+        delete next.tokensExpireAt;
+      else
+        next.tokensExpireAt = expiresAt;
+      return next;
+    });
+  }
+  async redirectToAuthorization(url) {
+    await this.onRedirect(url);
+  }
+  async saveCodeVerifier(verifier) {
+    await this.update((value) => ({ ...value, codeVerifier: verifier }));
+  }
+  async codeVerifier() {
+    const verifier = (await this.load()).codeVerifier;
+    if (!verifier)
+      throw new Error("No OAuth PKCE code verifier is stored");
+    return verifier;
+  }
+  async invalidateCredentials(kind) {
+    await this.update((value) => {
+      const next = { ...value };
+      if (kind === "all" || kind === "client")
+        delete next.clientInformation;
+      if (kind === "all" || kind === "tokens") {
+        delete next.tokens;
+        delete next.tokensExpireAt;
+      }
+      if (kind === "all" || kind === "verifier")
+        delete next.codeVerifier;
+      if (kind === "all" || kind === "discovery")
+        delete next.discovery;
+      if (kind === "all")
+        delete next.oauthState;
+      return next;
+    });
+  }
+  async saveDiscoveryState(discovery) {
+    await this.update((value) => ({ ...value, discovery }));
+  }
+  async discoveryState() {
+    return (await this.load()).discovery;
+  }
+  async load() {
+    await this.writes;
+    return this.own(await this.store.load());
+  }
+  async update(update) {
+    this.writes = this.writes.then(async () => {
+      await this.store.save(update(this.own(await this.store.load())));
+    });
+    await this.writes;
+  }
+  /** Stored state for another server URL is ignored so credentials never leak across servers. */
+  own(state) {
+    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };
+  }
+};
+
+// src/auth/auth-provider.ts
+var CIMD_URL = "https://mcpcat.sliccy.ai/oauth/client.json";
+var CLIENT_NAME = "mcpcat";
+var CALLBACK_HOST = "127.0.0.1";
+var CALLBACK_PATH = "/callback";
+var REQUEST_TIMEOUT_MS = 15e3;
+var REFRESH_SKEW_MS = 3e4;
+var FALLBACK_REDIRECT_URL = `http://${CALLBACK_HOST}${CALLBACK_PATH}`;
+function timedFetch(fetchImpl) {
+  return (input, init) => {
+    const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    return fetchImpl(input, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout
+    });
+  };
+}
+var SourceBackedStore = class {
+  source;
+  name;
+  serverUrl;
+  constructor(source, name, serverUrl) {
+    this.source = source;
+    this.name = name;
+    this.serverUrl = serverUrl;
+  }
+  async load() {
+    return this.source.load(this.name, this.serverUrl);
+  }
+  async save(state) {
+    await this.source.save(this.name, this.serverUrl, state);
+  }
+};
+function cimdFn(redirectUrl) {
+  return (metadata) => {
+    if (!metadata?.client_id_metadata_document_supported) return void 0;
+    if (!metadata.token_endpoint_auth_methods_supported?.includes("none")) return void 0;
+    if (!metadata.authorization_response_iss_parameter_supported) return void 0;
+    return { url: CIMD_URL, redirectUrl };
+  };
+}
+var AuthStepUpError = class extends Error {
+  scope;
+  target;
+  constructor(scope, target) {
+    super(scope ? `insufficient_scope: ${scope}` : "insufficient_scope");
+    this.name = "AuthStepUpError";
+    this.scope = scope;
+    this.target = target;
+  }
+};
+function createMcpAuthProvider(options) {
+  const { name, serverUrl, source, oauth, platform: platform2 } = options;
+  const store = new SourceBackedStore(source, name, serverUrl);
+  let refreshing;
+  const refresh = async (staleToken) => {
+    refreshing ??= (async () => {
+      const state = await store.load();
+      if (state?.tokens?.access_token !== staleToken) return;
+      if (!state?.tokens?.refresh_token) throw new McpOAuthAuthorizationRequiredError();
+      const registered = state.clientInformation && "redirect_uris" in state.clientInformation ? state.clientInformation.redirect_uris : [];
+      const redirectUrl = registered[0] ?? FALLBACK_REDIRECT_URL;
+      const provider = new McpOAuthProvider({
+        serverUrl,
+        redirectUrl,
+        clientMetadata: { client_name: oauth?.clientName ?? CLIENT_NAME },
+        clientMetadataDocument: oauth?.clientId ? void 0 : cimdFn(redirectUrl),
+        clientId: oauth?.clientId,
+        clientSecret: oauth?.clientSecret,
+        store,
+        onRedirect() {
+        }
+      });
+      const result = await authorizeMcp(provider, {
+        serverUrl,
+        authorizationServerMetadataUrl: oauth?.authServerMetadataUrl ? new URL(oauth.authServerMetadataUrl) : void 0,
+        fetch: timedFetch(platform2.fetch)
+      });
+      if (result === "REDIRECT") throw new McpOAuthAuthorizationRequiredError();
+    })().finally(() => {
+      refreshing = void 0;
+    });
+    return refreshing;
+  };
+  return {
+    async token() {
+      await refreshing?.catch(() => void 0);
+      const state = await store.load();
+      const token = state?.tokens?.access_token;
+      const expired = state?.tokensExpireAt !== void 0 && state.tokensExpireAt - REFRESH_SKEW_MS <= Date.now();
+      if (!expired || !state?.tokens?.refresh_token) return token;
+      await refresh(token).catch(() => void 0);
+      return (await store.load())?.tokens?.access_token;
+    },
+    async onUnauthorized(context) {
+      const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
+      if (challenge.error === "insufficient_scope") {
+        throw new AuthStepUpError(challenge.scope, options.name);
+      }
+      await refresh(context.token);
+    }
+  };
+}
 
 // node_modules/@earendil-works/pi-mcp/dist/client.js
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
@@ -6066,21 +7144,21 @@ async function consumeSseStream(stream, options) {
     if (line.startsWith(":"))
       return;
     const colon = line.indexOf(":");
-    const field = colon < 0 ? line : line.slice(0, colon);
+    const field2 = colon < 0 ? line : line.slice(0, colon);
     let value = colon < 0 ? "" : line.slice(colon + 1);
     if (value.startsWith(" "))
       value = value.slice(1);
-    if (field === "data") {
+    if (field2 === "data") {
       dataBytes += Buffer.byteLength(value) + (dataLines.length > 0 ? 1 : 0);
       if (dataBytes > maxEventBytes)
         throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
       dataLines.push(value);
-    } else if (field === "event")
+    } else if (field2 === "event")
       eventName = value;
-    else if (field === "id" && !value.includes("\0")) {
+    else if (field2 === "id" && !value.includes("\0")) {
       eventId = value;
       options.onId?.(value);
-    } else if (field === "retry" && /^\d+$/.test(value))
+    } else if (field2 === "retry" && /^\d+$/.test(value))
       options.onRetry?.(Number(value));
   };
   try {
@@ -6143,7 +7221,7 @@ function needsAuthorization(response) {
 function isTransientStatus(status) {
   return status === 408 || status === 429 || status >= 500;
 }
-function discard(response) {
+function discard2(response) {
   return response.body?.cancel().catch(() => {
   }) ?? Promise.resolve();
 }
@@ -6194,7 +7272,7 @@ var StreamableHttpTransport = class extends TransportEvents {
     await this.checkResponse(response);
     this.captureSession(response);
     if (!isJsonRpcRequest(message)) {
-      await discard(response);
+      await discard2(response);
       if ("method" in message && message.method === "notifications/initialized")
         this.startGetStream();
       return;
@@ -6213,7 +7291,7 @@ var StreamableHttpTransport = class extends TransportEvents {
       void this.consumeResponseStream(response.body, message.id);
       return;
     }
-    await discard(response);
+    await discard2(response);
     throw new McpHttpError(response.status, `Unsupported MCP response content type: ${type ?? "missing"}`);
   }
   async close() {
@@ -6228,7 +7306,7 @@ var StreamableHttpTransport = class extends TransportEvents {
           headers: this.buildHeaders({}, this.lastToken),
           signal: AbortSignal.timeout(1e3)
         });
-        await discard(response);
+        await discard2(response);
       } catch {
       }
     }
@@ -6259,7 +7337,7 @@ var StreamableHttpTransport = class extends TransportEvents {
       try {
         await onUnauthorized({ response, serverUrl: this.url, fetch: this.fetch, token });
       } finally {
-        await discard(response);
+        await discard2(response);
       }
     }
   }
@@ -6416,14 +7494,14 @@ var StreamableHttpTransport = class extends TransportEvents {
       }
     });
     if (response.status === 405) {
-      await discard(response);
+      await discard2(response);
       return void 0;
     }
     await this.checkResponse(response);
     this.captureSession(response);
     const type = contentType(response);
     if (type !== "text/event-stream" || !response.body) {
-      await discard(response);
+      await discard2(response);
       throw new McpHttpError(response.status, `Unsupported MCP GET response content type: ${type ?? "missing"}`);
     }
     return response.body;
@@ -6651,67 +7729,6 @@ var PlatformStdioTransport = class {
   }
 };
 
-// src/client/pi-connection.ts
-async function createPiConnection(options) {
-  const clientOptions = {
-    name: "mcpcat",
-    version: options.version ?? "0.0.0"
-  };
-  const client = new McpClient(clientOptions);
-  let transport;
-  if (options.url) {
-    transport = new StreamableHttpTransport({
-      url: options.url,
-      headers: options.headers,
-      fetch: options.fetchImpl
-    });
-  } else if (options.command) {
-    if (options.platform) {
-      transport = new PlatformStdioTransport({
-        command: options.command,
-        args: options.args,
-        env: options.env,
-        cwd: options.cwd,
-        inheritEnv: true,
-        platform: options.platform
-      });
-    } else {
-      transport = new StdioTransport({
-        command: options.command,
-        args: options.args,
-        env: options.env,
-        cwd: options.cwd,
-        inheritEnv: true,
-        stderr: "pipe"
-      });
-    }
-  } else {
-    throw new Error("PiConnection requires either a url or a command");
-  }
-  const initResult = await client.connect(transport);
-  return {
-    async info() {
-      return {
-        name: initResult.serverInfo?.name,
-        version: initResult.serverInfo?.version,
-        title: initResult.serverInfo?.title,
-        protocolVersion: initResult.protocolVersion,
-        capabilities: initResult.capabilities,
-        instructions: initResult.instructions
-      };
-    },
-    async listTools() {
-      return client.listTools();
-    },
-    async callTool(name, args2) {
-      return client.callTool(name, args2);
-    },
-    async close() {
-      await client.close();
-    }
-  };
-}
-
 // src/client/stateless-connection.ts
 var STATELESS_PROTOCOL_VERSION = "2026-07-28";
 var StatelessRpcError = class extends Error {
@@ -6740,6 +7757,22 @@ var InputRequiredError = class extends Error {
     this.requestJson = requestJson;
   }
 };
+var McpTimeoutError2 = class extends Error {
+  constructor(method, ms) {
+    super(`timeout after ${ms}ms waiting for ${method}`);
+    this.name = "McpTimeoutError";
+  }
+};
+var McpAuthError = class extends Error {
+  status;
+  target;
+  constructor(status, target) {
+    super(`HTTP ${status}: authentication required. Run: mcpcat login ${target}`);
+    this.name = "McpAuthError";
+    this.status = status;
+    this.target = target;
+  }
+};
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
   const blocks = text.replace(/\r\n/g, "\n").split(/\n\n/);
@@ -6770,25 +7803,66 @@ async function createStatelessConnection(options) {
     headers: extraHeaders,
     fetchImpl,
     timeoutMs = 6e4,
-    clientInfo = { name: "mcpcat", version: "0.0.0" }
+    clientInfo = { name: "mcpcat", version: "0.0.0" },
+    signal: externalSignal,
+    verbose
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
-  async function request(method, params) {
-    const id = nextId2++;
-    const headers = {
+  function buildHeaders(method, params) {
+    const h = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
       "Mcp-Method": method,
       ...extraHeaders
     };
-    const mcpName = mcpNameForMethod(method, params);
-    if (mcpName) {
-      headers["Mcp-Name"] = mcpName;
+    const n = mcpNameForMethod(method, params);
+    if (n) h["Mcp-Name"] = n;
+    if (negotiatedVersion) h["Mcp-Protocol-Version"] = negotiatedVersion;
+    return h;
+  }
+  function makeAbort() {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (externalSignal) {
+      if (externalSignal.aborted) {
+        clearTimeout(timer);
+        controller.abort();
+      } else {
+        externalSignal.addEventListener(
+          "abort",
+          () => {
+            clearTimeout(timer);
+            controller.abort();
+          },
+          { once: true }
+        );
+      }
+    }
+    return { controller, timer };
+  }
+  function logHeaders(dir, entries) {
+    if (!verbose?.enabled) return;
+    for (const [k, v] of entries) {
+      if (dir === ">") verbose.headerOut(k, v);
+      else verbose.headerIn(k, v);
     }
-    if (negotiatedVersion) {
-      headers["Mcp-Protocol-Version"] = negotiatedVersion;
+  }
+  async function handleErrorStatus(res, method) {
+    if (res.status === 401 || res.status === 403) throw new McpAuthError(res.status, url);
+    const text = await res.text();
+    let rpc;
+    try {
+      const p = JSON.parse(text);
+      if (p.error && typeof p.error.code === "number") rpc = p.error;
+    } catch {
     }
+    if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
+    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+  }
+  async function request(method, params) {
+    const id = nextId2++;
+    const headers = buildHeaders(method, params);
     const meta = {
       protocolVersion: negotiatedVersion ?? STATELESS_PROTOCOL_VERSION,
       clientInfo
@@ -6799,8 +7873,11 @@ async function createStatelessConnection(options) {
       method,
       params: { ...params, _meta: meta }
     });
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (verbose?.enabled) {
+      verbose.request(method, body);
+      logHeaders(">", Object.entries(headers));
+    }
+    const { controller, timer } = makeAbort();
     let res;
     try {
       res = await fetchImpl(url, {
@@ -6809,35 +7886,28 @@ async function createStatelessConnection(options) {
         body,
         signal: controller.signal
       });
+    } catch (err) {
+      clearTimeout(timer);
+      if (controller.signal.aborted && !externalSignal?.aborted) {
+        throw new McpTimeoutError2(method, timeoutMs);
+      }
+      throw err;
     } finally {
       clearTimeout(timer);
     }
-    if (res.status === 401) {
-      throw new StatelessHttpError(401, "Unauthorized", method, "");
-    }
-    if (res.status >= 400) {
-      const text = await res.text();
-      let rpcError3;
-      try {
-        const parsed = JSON.parse(text);
-        if (parsed.error && typeof parsed.error.code === "number") {
-          rpcError3 = parsed.error;
-        }
-      } catch {
-      }
-      if (rpcError3) {
-        throw new StatelessRpcError(rpcError3.code, rpcError3.message, rpcError3.data);
-      }
-      throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    if (verbose?.enabled) {
+      verbose.http("<", `HTTP/1.1 ${res.status} ${res.statusText}`);
+      logHeaders("<", res.headers.entries());
     }
+    if (res.status >= 400) await handleErrorStatus(res, method);
     const ct = res.headers.get("content-type") ?? "";
     let frame;
     if (ct.toLowerCase().includes("text/event-stream")) {
-      const bytes = new Uint8Array(await res.arrayBuffer());
-      frame = selectSseFrame(bytes, id);
+      frame = selectSseFrame(new Uint8Array(await res.arrayBuffer()), id);
     } else {
       frame = await res.json();
     }
+    if (verbose?.enabled) verbose.response(JSON.stringify(frame));
     if (frame.error) {
       throw new StatelessRpcError(frame.error.code, frame.error.message, frame.error.data);
     }
@@ -6857,28 +7927,26 @@ async function createStatelessConnection(options) {
   return {
     async info() {
       if (serverInfoCache) return serverInfoCache;
-      const result = discoverResult2;
+      const r = discoverResult2;
       serverInfoCache = {
-        name: result?.serverInfo?.name,
-        version: result?.serverInfo?.version,
-        title: result?.serverInfo?.title,
+        name: r?.serverInfo?.name,
+        version: r?.serverInfo?.version,
+        title: r?.serverInfo?.title,
         protocolVersion: STATELESS_PROTOCOL_VERSION,
-        capabilities: result?.capabilities ?? {},
-        instructions: result?.instructions
+        capabilities: r?.capabilities ?? {},
+        instructions: r?.instructions
       };
       return serverInfoCache;
     },
     async listTools() {
-      const result = await request("tools/list", {});
-      return result?.tools ?? [];
+      return (await request("tools/list", {}))?.tools ?? [];
     },
-    async callTool(name, args2) {
+    async callTool(name, args2, _callOptions) {
       const result = await request("tools/call", {
         name,
         arguments: args2 ?? {}
       });
-      const resultType = result.resultType ?? "complete";
-      if (resultType === "input_required") {
+      if ((result.resultType ?? "complete") === "input_required") {
         throw new InputRequiredError(
           JSON.stringify({ name, arguments: args2 ?? {}, result }, null, 2)
         );
@@ -6890,28 +7958,151 @@ async function createStatelessConnection(options) {
   };
 }
 
+// src/client/pi-connection.ts
+function buildStderrHandler(options) {
+  if (!options.verbose?.enabled) return void 0;
+  return (chunk) => {
+    for (const l of chunk.split("\n")) {
+      if (l.trim()) options.verbose.server(l);
+    }
+  };
+}
+function buildTransport(options) {
+  if (options.url) {
+    return new StreamableHttpTransport({
+      url: options.url,
+      headers: options.headers,
+      fetch: options.fetchImpl,
+      authProvider: options.authProvider
+    });
+  }
+  if (!options.command) throw new Error("PiConnection requires either a url or a command");
+  if (options.platform) {
+    return new PlatformStdioTransport({
+      command: options.command,
+      args: options.args,
+      env: options.env,
+      cwd: options.cwd,
+      inheritEnv: true,
+      platform: options.platform,
+      onStderr: buildStderrHandler(options)
+    });
+  }
+  return new StdioTransport({
+    command: options.command,
+    args: options.args,
+    env: options.env,
+    cwd: options.cwd,
+    inheritEnv: true,
+    stderr: "pipe",
+    onStderr: buildStderrHandler(options)
+  });
+}
+async function createPiConnection(options) {
+  const clientOptions = {
+    name: "mcpcat",
+    version: options.version ?? "0.0.0",
+    requestTimeoutMs: options.timeoutMs
+  };
+  const client = new McpClient(clientOptions);
+  const transport = buildTransport(options);
+  if (options.verbose?.enabled) {
+    transport.onMessage((msg) => {
+      options.verbose.response(JSON.stringify(msg));
+    });
+  }
+  try {
+    let reqOpts2 = function() {
+      const o = {};
+      if (options.signal) o.signal = options.signal;
+      if (options.verbose?.enabled) {
+        o.onProgress = (p) => {
+          options.verbose.progress(`progress: ${p.message ?? ""}`);
+        };
+      }
+      return o;
+    };
+    var reqOpts = reqOpts2;
+    const initResult = await client.connect(transport);
+    return {
+      async info() {
+        return {
+          name: initResult.serverInfo?.name,
+          version: initResult.serverInfo?.version,
+          title: initResult.serverInfo?.title,
+          protocolVersion: initResult.protocolVersion,
+          capabilities: initResult.capabilities,
+          instructions: initResult.instructions
+        };
+      },
+      async listTools() {
+        return client.listTools(reqOpts2());
+      },
+      async callTool(name, args2, callOptions) {
+        const o = reqOpts2();
+        if (callOptions?.onProgress) {
+          const outer = callOptions.onProgress;
+          const inner = o.onProgress;
+          o.onProgress = (p) => {
+            outer(p.progress, p.total, p.message);
+            inner?.(p);
+          };
+        }
+        return client.callTool(name, args2, o);
+      },
+      async close() {
+        await client.close();
+      }
+    };
+  } catch (err) {
+    const msg = err.message ?? "";
+    if (msg.includes("401") || msg.includes("403") || msg.includes("Unauthorized")) {
+      throw new McpAuthError(401, options.url ?? options.command ?? "");
+    }
+    if (msg.includes("timeout") || msg.includes("Timeout") || msg.includes("ETIMEDOUT")) {
+      throw new McpTimeoutError2("connect", options.timeoutMs ?? 6e4);
+    }
+    throw err;
+  }
+}
+
 // src/client/connect.ts
 async function connect(platform2, options) {
+  const shared = {
+    version: options.version,
+    timeoutMs: options.timeoutMs,
+    signal: options.signal,
+    verbose: options.verbose,
+    platform: platform2
+  };
   if (options.command) {
     return createPiConnection({
       command: options.command,
       args: options.args,
       env: options.env,
       cwd: options.cwd,
-      version: options.version,
-      platform: platform2
+      ...shared
     });
   }
-  if (!options.url) {
-    throw new Error("connect requires either a url or a command");
+  if (!options.url) throw new Error("connect requires either a url or a command");
+  if (options.authProvider) {
+    const token = await options.authProvider.token();
+    if (token) {
+      return createPiConnection({
+        url: options.url,
+        headers: options.headers,
+        fetchImpl: platform2.fetch,
+        authProvider: options.authProvider,
+        ...shared
+      });
+    }
   }
   if (options.protocolVersion && !options.protocolVersion.startsWith("2026")) {
     return createPiConnection({
       url: options.url,
       headers: options.headers,
-      version: options.version,
       fetchImpl: platform2.fetch,
-      platform: platform2
+      ...shared
     });
   }
   try {
@@ -6919,20 +8110,21 @@ async function connect(platform2, options) {
       url: options.url,
       headers: options.headers,
       fetchImpl: platform2.fetch,
-      clientInfo: { name: "mcpcat", version: options.version ?? "0.0.0" }
+      clientInfo: { name: "mcpcat", version: options.version ?? "0.0.0" },
+      timeoutMs: options.timeoutMs,
+      signal: options.signal,
+      verbose: options.verbose
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
-    if (options.protocolVersion?.startsWith("2026")) {
-      throw err;
-    }
+    if (options.protocolVersion?.startsWith("2026")) throw err;
     if (isMethodNotFound) {
       return createPiConnection({
         url: options.url,
         headers: options.headers,
-        version: options.version,
         fetchImpl: platform2.fetch,
-        platform: platform2
+        authProvider: options.authProvider,
+        ...shared
       });
     }
     throw err;
@@ -7406,8 +8598,8 @@ async function formatOutput(platform2, result, json) {
   return result.ok ? 0 : isTimeout ? 124 : 1;
 }
 async function createSandbox(platform2, tools, globals, timeoutMs) {
-  const isKernel = platform2.packageDir !== void 0;
-  if (isKernel) {
+  const isKernel2 = platform2.packageDir !== void 0;
+  if (isKernel2) {
     const { InlineCodemodeSandbox: InlineCodemodeSandbox2 } = await Promise.resolve().then(() => (init_portable(), portable_exports));
     const wasm = await loadWasmKernel(platform2);
     return new InlineCodemodeSandbox2({ tools, globals, timeoutMs, wasm });
@@ -7484,6 +8676,28 @@ async function readStream(stream) {
   return new TextDecoder().decode(merged);
 }
 
+// src/config/expand.ts
+var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function containsPlaceholders(value) {
+  return PLACEHOLDER_TEST.test(value);
+}
+function expandPlaceholders(value, env) {
+  return value.replace(PLACEHOLDER, (_, name) => env[name] ?? "");
+}
+function expandPlaceholdersStrict(value, env) {
+  let hasUndefined = false;
+  const result = value.replace(PLACEHOLDER, (_, name) => {
+    if (env[name] === void 0) {
+      hasUndefined = true;
+      return "";
+    }
+    return env[name];
+  });
+  if (hasUndefined) return void 0;
+  return result;
+}
+
 // src/config/parse.ts
 var SERVER_NAME = /^[A-Za-z0-9_-]+$/;
 var EXPOSURES = ["codemode", "deferred", "direct", "hidden"];
@@ -7510,8 +8724,8 @@ function resolveAliases(value) {
   }
   return out;
 }
-function fail(server, message, field) {
-  return { server, ...field ? { field } : {}, message };
+function fail(server, message, field2) {
+  return { server, ...field2 ? { field: field2 } : {}, message };
 }
 function validateCommon(name, value) {
   const exposures = EXPOSURES.map((e) => `"${e}"`).join(", ");
@@ -8720,23 +9934,98 @@ async function runDiscover(platform2, args2) {
   return 0;
 }
 
-// src/config/expand.ts
-var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
-function containsPlaceholders(value) {
-  return PLACEHOLDER_TEST.test(value);
+// src/render/result.ts
+function formatBytes(n) {
+  if (n < 1024) return `${n} bytes`;
+  const kb = n / 1024;
+  if (kb < 1024) return `${kb.toFixed(1)} KB`;
+  return `${(kb / 1024).toFixed(1)} MB`;
+}
+function truncateMiddle(text, max) {
+  if (text.length <= max) return text;
+  const half = Math.floor((max - 5) / 2);
+  return `${text.slice(0, half)}
+[\u2026]
+${text.slice(-half)}`;
+}
+function renderContentBlock(block) {
+  if (block.type === "text") return block.text;
+  if (block.type === "image") {
+    const size = formatBytes(Math.ceil(block.data.length * 3 / 4));
+    return `[image: ${block.mimeType}, ${size}]`;
+  }
+  if (block.type === "audio") {
+    const audioBlock = block;
+    const size = formatBytes(Math.ceil(audioBlock.data.length * 3 / 4));
+    return `[audio: ${audioBlock.mimeType}, ${size}]`;
+  }
+  if (block.type === "resource_link") return `[resource: ${block.uri}]`;
+  if (block.type === "resource") {
+    return "text" in block.resource ? block.resource.text : `[blob: ${block.resource.uri}]`;
+  }
+  return void 0;
 }
-function expandPlaceholdersStrict(value, env) {
-  let hasUndefined = false;
-  const result = value.replace(PLACEHOLDER, (_, name) => {
-    if (env[name] === void 0) {
-      hasUndefined = true;
-      return "";
+function renderCallResultText(result, options) {
+  const parts = [];
+  if (result.content) {
+    for (const block of result.content) {
+      const rendered = renderContentBlock(block);
+      if (rendered !== void 0) parts.push(rendered);
     }
-    return env[name];
-  });
-  if (hasUndefined) return void 0;
-  return result;
+  }
+  if (parts.length === 0 && result.structuredContent !== void 0) {
+    parts.push(JSON.stringify(result.structuredContent, null, 2));
+  }
+  let text = parts.join("\n");
+  if (options?.maxChars && text.length > options.maxChars) {
+    text = truncateMiddle(text, options.maxChars);
+  }
+  return text;
+}
+function renderCallResultJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+async function renderCallResult(platform2, result, options) {
+  if (options?.json) {
+    const json = renderCallResultJson(result);
+    if (result.isError) {
+      await platform2.write(
+        2,
+        `${JSON.stringify({ error: { kind: "tool_error", message: json } }, null, 2)}
+`
+      );
+      return 1;
+    }
+    await platform2.write(1, `${json}
+`);
+    return 0;
+  }
+  const text = renderCallResultText(result, options);
+  if (result.isError) {
+    await platform2.write(2, `${text || "(tool reported error)"}
+`);
+    return 1;
+  }
+  if (text) {
+    await platform2.write(1, `${text}
+`);
+  }
+  return 0;
+}
+async function renderToolsJson(platform2, tools) {
+  await platform2.write(1, `${JSON.stringify({ tools }, null, 2)}
+`);
+}
+async function renderInfoJson(platform2, info) {
+  await platform2.write(1, `${JSON.stringify(info, null, 2)}
+`);
+}
+async function renderErrorJson(platform2, kind, message, code2, data) {
+  const errorObj = { kind, message };
+  if (code2 !== void 0) errorObj.code = code2;
+  if (data !== void 0) errorObj.data = data;
+  await platform2.write(2, `${JSON.stringify({ error: errorObj }, null, 2)}
+`);
 }
 
 // src/serve/catalog.ts
@@ -8857,7 +10146,7 @@ function argvForCommand(command, args2) {
   if (args2.error) return { error: args2.error };
   const argv = [...command.path];
   for (const positional of command.positionals) {
-    const found = args2.fields.find((field) => field.name === positional.name);
+    const found = args2.fields.find((field2) => field2.name === positional.name);
     if (!found) {
       if (positional.required) return { error: `missing ${positional.name}` };
       continue;
@@ -8876,7 +10165,7 @@ function argvForCommand(command, args2) {
 function appendFlags(flags, fields) {
   const argv = [];
   for (const flag of flags) {
-    const found = fields.find((field) => field.name === flag.name);
+    const found = fields.find((field2) => field2.name === flag.name);
     if (!found || found.value === false) continue;
     const encoded = encodeFlag(flag, found.value);
     if ("error" in encoded) return encoded;
@@ -10469,120 +11758,592 @@ async function runStdioServer(platform2, tools, call, serverName, version) {
   } finally {
     reader.releaseLock();
   }
-  return 0;
+  return 0;
+}
+async function runHttpServer(platform2, options, tools, call, serverName, version, resolvedBearer) {
+  if (!platform2.listen) {
+    await platform2.write(2, "mcpcat serve: HTTP transport requires platform.listen\n");
+    return 3;
+  }
+  const boundLoopback = options.host === "127.0.0.1" || options.host === "localhost" || options.host === "::1";
+  if (!boundLoopback && !resolvedBearer) {
+    await platform2.write(2, "mcpcat serve: --bearer is required when binding off loopback\n");
+    return 2;
+  }
+  const allowedOrigins = new Set(options.allowOrigins);
+  const listener = await platform2.listen({ host: options.host, port: options.port });
+  const actualPort = listener.port;
+  const listenUrl = `http://${options.host}:${actualPort}/mcp`;
+  if (options.json) {
+    await platform2.write(1, `${JSON.stringify({ url: listenUrl })}
+`);
+  }
+  await platform2.write(2, `mcpcat serve: listening on ${listenUrl}
+`);
+  let shutdownRequested = false;
+  const shutdown = () => {
+    if (shutdownRequested) return;
+    shutdownRequested = true;
+    listener.close();
+    void killInflight();
+  };
+  if (platform2.onSignal) {
+    platform2.onSignal("SIGINT", shutdown);
+    platform2.onSignal("SIGTERM", shutdown);
+  }
+  const handler = (request) => handleMcpRequest(
+    request,
+    tools,
+    call,
+    serverName,
+    version,
+    allowedOrigins,
+    boundLoopback,
+    resolvedBearer
+  );
+  try {
+    for await (const connection of listener) {
+      if (shutdownRequested) break;
+      const conn = connection;
+      handleConnection(conn.readable, conn.writable, handler).catch(() => {
+      }).finally(() => {
+        try {
+          conn.close();
+        } catch {
+        }
+      });
+    }
+  } catch {
+    if (!shutdownRequested) throw new Error("listener closed unexpectedly");
+  }
+  return 0;
+}
+async function handleMcpRequest(request, tools, call, serverName, version, allowedOrigins, boundLoopback, resolvedBearer) {
+  if (resolvedBearer) {
+    const authHeader = request.headers.authorization;
+    const provided = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
+    if (!provided || !constantTimeEqual(provided, resolvedBearer)) {
+      return {
+        status: 401,
+        reason: "Unauthorized",
+        headers: { "content-type": "text/plain" },
+        body: "Unauthorized"
+      };
+    }
+  }
+  const originCheck = checkOrigin(request.headers.origin, allowedOrigins, boundLoopback);
+  if (!originCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: originCheck.reason ?? "Forbidden"
+    };
+  }
+  const hostCheck = checkHost(request.headers.host, boundLoopback);
+  if (!hostCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: hostCheck.reason ?? "Forbidden"
+    };
+  }
+  if (request.target !== "/mcp") {
+    return {
+      status: 404,
+      reason: "Not Found",
+      headers: { "content-type": "text/plain" },
+      body: "Not Found"
+    };
+  }
+  if (request.method !== "POST") {
+    return {
+      status: 405,
+      reason: "Method Not Allowed",
+      headers: { "content-type": "text/plain", allow: "POST" },
+      body: "Method Not Allowed"
+    };
+  }
+  const outcome = await handleJsonRpc(request.body, tools, call, serverName, version);
+  return {
+    status: outcome.status,
+    reason: outcome.status === 200 ? "OK" : "Accepted",
+    headers: { "content-type": outcome.contentType },
+    body: outcome.body
+  };
+}
+
+// src/auth/oauth.ts
+var CALLBACK_HOST2 = "127.0.0.1";
+var CALLBACK_PATH2 = "/callback";
+var CIMD_URL2 = "https://mcpcat.sliccy.ai/oauth/client.json";
+var CLIENT_NAME2 = "mcpcat";
+var REQUEST_TIMEOUT_MS2 = 15e3;
+function timedFetch2(fetchImpl) {
+  return (input, init) => {
+    const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS2);
+    return fetchImpl(input, {
+      ...init,
+      signal: init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout
+    });
+  };
+}
+function callbackSettings(oauth) {
+  const raw = oauth?.callbackUrl ?? `http://${CALLBACK_HOST2}${CALLBACK_PATH2}`;
+  const url = new URL(raw);
+  const address = url.hostname.replace(/^\[|\]$/g, "");
+  const port = url.port ? Number(url.port) : oauth?.callbackPort;
+  let fixedRedirectUrl;
+  if (url.port) fixedRedirectUrl = oauth?.callbackUrl;
+  else if (port !== void 0) {
+    url.port = String(port);
+    fixedRedirectUrl = url.href;
+  }
+  return {
+    host: address === "localhost" ? CALLBACK_HOST2 : address,
+    redirectHost: address,
+    port,
+    path: url.pathname,
+    fixedRedirectUrl
+  };
+}
+function cimdForServer(metadata, redirectUrl) {
+  if (!metadata?.client_id_metadata_document_supported) return void 0;
+  if (!metadata.token_endpoint_auth_methods_supported?.includes("none")) return void 0;
+  if (!metadata.authorization_response_iss_parameter_supported) return void 0;
+  return {
+    url: CIMD_URL2,
+    redirectUrl
+  };
+}
+function buildClientMetadataDocumentFn(oauth, redirectUrl) {
+  if (oauth?.clientRegistration === "dcr") return void 0;
+  if (oauth?.clientId) return void 0;
+  return (metadata) => {
+    if (oauth?.clientRegistration === "cimd") {
+      if (!metadata?.client_id_metadata_document_supported || !metadata.token_endpoint_auth_methods_supported?.includes("none")) {
+        return void 0;
+      }
+      if (!metadata.authorization_response_iss_parameter_supported) return void 0;
+      return { url: CIMD_URL2, redirectUrl };
+    }
+    return cimdForServer(metadata, redirectUrl);
+  };
+}
+function createProvider(serverUrl, store, oauth, redirectUrl, onRedirect) {
+  const cimdFn2 = buildClientMetadataDocumentFn(oauth, redirectUrl);
+  return new McpOAuthProvider({
+    serverUrl,
+    redirectUrl,
+    clientMetadata: { client_name: oauth?.clientName ?? CLIENT_NAME2 },
+    clientMetadataDocument: cimdFn2,
+    clientId: oauth?.clientId,
+    clientSecret: oauth?.clientSecret,
+    store,
+    onRedirect
+  });
+}
+var SourceBackedStateStore = class {
+  source;
+  name;
+  serverUrl;
+  constructor(source, name, serverUrl) {
+    this.source = source;
+    this.name = name;
+    this.serverUrl = serverUrl;
+  }
+  async load() {
+    return this.source.load(this.name, this.serverUrl);
+  }
+  async save(state) {
+    await this.source.save(this.name, this.serverUrl, state);
+  }
+};
+var SignInCancelledError = class extends Error {
+  constructor() {
+    super("Sign-in cancelled");
+    this.name = "SignInCancelledError";
+  }
+};
+function responseFromRedirectUrl(input, state, redirectUrl) {
+  let url;
+  try {
+    url = new URL(input.trim());
+  } catch {
+    throw new Error("Expected the full redirect URL from the browser address bar");
+  }
+  if (url.origin !== redirectUrl.origin || url.pathname !== redirectUrl.pathname) {
+    throw new Error("The redirect URL does not match this sign-in's redirect URI");
+  }
+  const error = url.searchParams.get("error");
+  if (error) throw new Error(url.searchParams.get("error_description") ?? error);
+  if (url.searchParams.get("state") !== state) {
+    throw new Error("The redirect URL belongs to a different sign-in");
+  }
+  const code2 = url.searchParams.get("code");
+  if (!code2) throw new Error("The redirect URL does not contain an authorization code");
+  return { code: code2, iss: url.searchParams.get("iss") ?? void 0 };
+}
+async function waitForAuthorizationResponse(callback, state, redirectUrl, prompt, signal) {
+  const controller = new AbortController();
+  const promptSignal = signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;
+  const fromBrowser = callback.waitForCallback(state, redirectUrl.pathname);
+  const fromUser = prompt.promptForRedirectUrl(promptSignal).then((input) => {
+    if (!input?.trim()) throw new SignInCancelledError();
+    return responseFromRedirectUrl(input, state, redirectUrl);
+  });
+  try {
+    return await Promise.race([fromBrowser, fromUser]);
+  } finally {
+    controller.abort();
+    fromBrowser.catch(() => void 0);
+    fromUser.catch(() => void 0);
+  }
+}
+function mergeScopes(...scopes) {
+  const merged = [...new Set(scopes.flatMap((s) => s?.split(/\s+/).filter(Boolean) ?? []))];
+  return merged.length > 0 ? merged.join(" ") : void 0;
+}
+async function signIn(options) {
+  const { name, serverUrl, source, oauth, prompt, platform: platform2, signal } = options;
+  if (signal?.aborted) throw new SignInCancelledError();
+  const store = new SourceBackedStateStore(source, name, serverUrl);
+  const stored = await store.load();
+  const cbSettings = callbackSettings(oauth);
+  const registered = stored?.clientInformation && "redirect_uris" in stored.clientInformation ? stored.clientInformation.redirect_uris : [];
+  const preferredPort = cbSettings.port ?? (registered[0] ? Number(new URL(registered[0]).port) || void 0 : void 0);
+  const callback = await OAuthCallbackServer.listen({
+    host: cbSettings.host,
+    redirectHost: cbSettings.redirectHost,
+    port: preferredPort ?? 0,
+    path: cbSettings.path
+  });
+  const redirectUrl = cbSettings.fixedRedirectUrl ?? callback.redirectUrl;
+  try {
+    if (stored) {
+      const next = { ...stored };
+      delete next.oauthState;
+      const hasCimd = buildClientMetadataDocumentFn(oauth, redirectUrl) !== void 0;
+      const keepClient = oauth?.clientId || (hasCimd ? !stored.clientInformation : registered.includes(redirectUrl));
+      if (!keepClient) {
+        delete next.clientInformation;
+        delete next.tokens;
+        delete next.tokensExpireAt;
+      }
+      await store.save(next);
+    }
+    let authorizationUrl;
+    const provider = createProvider(serverUrl, store, oauth, redirectUrl, (url) => {
+      authorizationUrl = url;
+    });
+    const flow = {
+      serverUrl,
+      fetch: timedFetch2(platform2.fetch),
+      signal,
+      authorizationServerMetadataUrl: oauth?.authServerMetadataUrl ? new URL(oauth.authServerMetadataUrl) : void 0,
+      scope: mergeScopes(
+        oauth?.scope,
+        options.stepUp ? stepUpScope(stored?.tokens?.scope, options.scope) : options.scope
+      )
+    };
+    const skipRefresh = options.stepUp === true;
+    if (await authorizeMcp(provider, { ...flow, skipRefresh }) === "AUTHORIZED") return;
+    if (!authorizationUrl) throw new Error("OAuth flow did not produce an authorization URL");
+    const state = await provider.state();
+    const authRedirectUrl = new URL(
+      authorizationUrl.searchParams.get("redirect_uri") ?? redirectUrl
+    );
+    prompt.showAuthorizationUrl(authorizationUrl);
+    const { code: code2, iss } = await waitForAuthorizationResponse(
+      callback,
+      state,
+      authRedirectUrl,
+      prompt,
+      signal
+    );
+    await authorizeMcp(provider, { ...flow, authorizationCode: code2, iss });
+  } catch (err) {
+    if (signal?.aborted) throw new SignInCancelledError();
+    throw err;
+  } finally {
+    await callback.close();
+  }
+}
+
+// src/auth/token-source.ts
+function mcpNamespace(server) {
+  return `mcp__${server.replace(/-/g, "_")}`;
+}
+function storeKey(name, serverUrl) {
+  const ns = mcpNamespace(name);
+  const url = String(new URL(serverUrl));
+  return `${ns}|${url}`;
+}
+function isKernel(platform2) {
+  return platform2.kind === "kernel";
+}
+
+// src/auth/pi-store.ts
+var AUTH_FILE = "mcp-auth.json";
+var FILE_MODE = 384;
+function parseStates(raw) {
+  if (!raw?.trim()) return {};
+  const parsed = JSON.parse(raw);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function serializeStates(states) {
+  return `${JSON.stringify(states, null, 2)}
+`;
+}
+function legacyKey(serverUrl) {
+  return String(new URL(serverUrl));
+}
+var PiFileTokenSource = class {
+  platform;
+  authPath;
+  dirPath;
+  constructor(platform2) {
+    this.platform = platform2;
+    this.dirPath = userConfigDir(platform2);
+    this.authPath = `${this.dirPath}/${AUTH_FILE}`;
+  }
+  get path() {
+    return this.authPath;
+  }
+  async getToken(name, serverUrl) {
+    const state = await this.load(name, serverUrl);
+    if (!state?.tokens?.access_token) return void 0;
+    return {
+      accessToken: state.tokens.access_token,
+      expiresAt: state.tokensExpireAt
+    };
+  }
+  async load(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      if (states[key]) return states[key];
+      if (states[legacy]) {
+        states[key] = states[legacy];
+        delete states[legacy];
+        await this.writeStates(states);
+        return states[key];
+      }
+      return void 0;
+    } finally {
+      await release();
+    }
+  }
+  async save(name, serverUrl, state) {
+    const key = storeKey(name, serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      states[key] = state;
+      await this.writeStates(states);
+    } finally {
+      await release();
+    }
+  }
+  async remove(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      const stored = key in states ? key : legacy in states ? legacy : void 0;
+      if (!stored) return false;
+      delete states[stored];
+      await this.writeStates(states);
+      return true;
+    } finally {
+      await release();
+    }
+  }
+  async acquireLock() {
+    await this.ensureDir();
+    return acquireLock(this.platform.fs, this.authPath);
+  }
+  async ensureDir() {
+    try {
+      await this.platform.fs.mkdir(this.dirPath);
+    } catch {
+    }
+  }
+  async readRaw() {
+    try {
+      const data = await this.platform.fs.readFile(this.authPath);
+      return new TextDecoder().decode(data);
+    } catch {
+      return void 0;
+    }
+  }
+  async writeStates(states) {
+    await this.platform.fs.writeFile(this.authPath, serializeStates(states), { mode: FILE_MODE });
+  }
+};
+
+// src/cli/auth-verbs.ts
+function createTokenSource(platform2) {
+  return new PiFileTokenSource(platform2);
+}
+function resolveServerName(target) {
+  try {
+    const u = new URL(target.startsWith("http") ? target : `https://${target}`);
+    if (target.includes(".") || target.includes(":")) {
+      return { name: `url:${u.origin}${u.pathname}`, isUrl: true };
+    }
+  } catch {
+  }
+  return { name: target, isUrl: false };
 }
-async function runHttpServer(platform2, options, tools, call, serverName, version, resolvedBearer) {
-  if (!platform2.listen) {
-    await platform2.write(2, "mcpcat serve: HTTP transport requires platform.listen\n");
-    return 3;
+async function resolveLoginTarget(platform2, target) {
+  const config = await MergedConfigSource.load(platform2);
+  const entry = config.entry(target);
+  if (entry && "url" in entry.config && entry.config.url) {
+    const httpConfig = entry.config;
+    return {
+      name: target,
+      serverUrl: httpConfig.url,
+      oauth: httpConfig.oauth
+    };
   }
-  const boundLoopback = options.host === "127.0.0.1" || options.host === "localhost" || options.host === "::1";
-  if (!boundLoopback && !resolvedBearer) {
-    await platform2.write(2, "mcpcat serve: --bearer is required when binding off loopback\n");
-    return 2;
+  const resolved = resolveServerName(target);
+  if (resolved.isUrl) {
+    const url = target.startsWith("http") ? target : `https://${target}`;
+    return { name: resolved.name, serverUrl: url, oauth: void 0 };
   }
-  const allowedOrigins = new Set(options.allowOrigins);
-  const listener = await platform2.listen({ host: options.host, port: options.port });
-  const actualPort = listener.port;
-  const listenUrl = `http://${options.host}:${actualPort}/mcp`;
-  if (options.json) {
-    await platform2.write(1, `${JSON.stringify({ url: listenUrl })}
-`);
+  throw new Error(`unknown target '${target}': not a URL and not found in mcp.json`);
+}
+async function runLogin(platform2, args2, source) {
+  if (isKernel(platform2)) {
+    await platform2.write(
+      2,
+      "mcpcat: login is not available in seven. Use the agent's MCP sign-in in Settings, or run mcpcat login on the host.\n"
+    );
+    return 4;
   }
-  await platform2.write(2, `mcpcat serve: listening on ${listenUrl}
+  const noBrowser = args2.includes("--no-browser");
+  const positional = args2.filter((a) => !a.startsWith("-"));
+  if (positional.length === 0) {
+    await platform2.write(2, "mcpcat: login requires a target\n");
+    return 2;
+  }
+  const target = positional[0];
+  let resolved;
+  try {
+    resolved = await resolveLoginTarget(platform2, target);
+  } catch (err) {
+    await platform2.write(2, `mcpcat: ${err.message}
 `);
-  let shutdownRequested = false;
-  const shutdown = () => {
-    if (shutdownRequested) return;
-    shutdownRequested = true;
-    listener.close();
-    void killInflight();
-  };
-  if (platform2.onSignal) {
-    platform2.onSignal("SIGINT", shutdown);
-    platform2.onSignal("SIGTERM", shutdown);
+    return 2;
   }
-  const handler = (request) => handleMcpRequest(
-    request,
-    tools,
-    call,
-    serverName,
-    version,
-    allowedOrigins,
-    boundLoopback,
-    resolvedBearer
-  );
   try {
-    for await (const connection of listener) {
-      if (shutdownRequested) break;
-      const conn = connection;
-      handleConnection(conn.readable, conn.writable, handler).catch(() => {
-      }).finally(() => {
-        try {
-          conn.close();
-        } catch {
+    await signIn({
+      name: resolved.name,
+      serverUrl: resolved.serverUrl,
+      source,
+      oauth: resolved.oauth,
+      platform: platform2,
+      prompt: {
+        showAuthorizationUrl(url) {
+          if (!noBrowser && platform2.openUrl) {
+            platform2.openUrl(url.href).catch(() => {
+            });
+          }
+          void platform2.write(2, `Open this URL to sign in:
+${url.href}
+`);
+          if (noBrowser || !platform2.openUrl) {
+            void platform2.write(2, "\nPaste the redirect URL from your browser address bar:\n");
+          }
+        },
+        async promptForRedirectUrl(signal) {
+          if (!noBrowser && platform2.openUrl) {
+            return new Promise((_resolve, reject) => {
+              signal.addEventListener("abort", () => reject(new SignInCancelledError()));
+            });
+          }
+          const reader = platform2.stdin.getReader();
+          const chunks = [];
+          try {
+            while (true) {
+              const read = reader.read();
+              const result = await Promise.race([
+                read,
+                new Promise((_, reject) => {
+                  signal.addEventListener("abort", () => reject(new SignInCancelledError()));
+                })
+              ]);
+              if (result.done) break;
+              chunks.push(result.value);
+              const text = new TextDecoder().decode(concatUint8Arrays(chunks));
+              if (text.includes("\n")) return text.trim();
+            }
+          } finally {
+            reader.releaseLock();
+          }
+          return new TextDecoder().decode(concatUint8Arrays(chunks)).trim() || void 0;
         }
-      });
+      }
+    });
+    await platform2.write(1, `Signed in to ${target}
+`);
+    return 0;
+  } catch (err) {
+    if (err instanceof SignInCancelledError) {
+      await platform2.write(2, "mcpcat: sign-in cancelled\n");
+      return 1;
     }
-  } catch {
-    if (!shutdownRequested) throw new Error("listener closed unexpectedly");
+    await platform2.write(2, `mcpcat: login failed: ${err.message}
+`);
+    return 4;
   }
-  return 0;
 }
-async function handleMcpRequest(request, tools, call, serverName, version, allowedOrigins, boundLoopback, resolvedBearer) {
-  if (resolvedBearer) {
-    const authHeader = request.headers.authorization;
-    const provided = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
-    if (!provided || !constantTimeEqual(provided, resolvedBearer)) {
-      return {
-        status: 401,
-        reason: "Unauthorized",
-        headers: { "content-type": "text/plain" },
-        body: "Unauthorized"
-      };
-    }
+async function runLogout(platform2, args2, source) {
+  if (isKernel(platform2)) {
+    await platform2.write(2, "mcpcat: logout is not available in seven.\n");
+    return 4;
   }
-  const originCheck = checkOrigin(request.headers.origin, allowedOrigins, boundLoopback);
-  if (!originCheck.ok) {
-    return {
-      status: 403,
-      reason: "Forbidden",
-      headers: { "content-type": "text/plain" },
-      body: originCheck.reason ?? "Forbidden"
-    };
+  const positional = args2.filter((a) => !a.startsWith("-"));
+  if (positional.length === 0) {
+    await platform2.write(2, "mcpcat: logout requires a target\n");
+    return 2;
   }
-  const hostCheck = checkHost(request.headers.host, boundLoopback);
-  if (!hostCheck.ok) {
-    return {
-      status: 403,
-      reason: "Forbidden",
-      headers: { "content-type": "text/plain" },
-      body: hostCheck.reason ?? "Forbidden"
-    };
+  const target = positional[0];
+  let resolved;
+  try {
+    resolved = await resolveLoginTarget(platform2, target);
+  } catch (err) {
+    await platform2.write(2, `mcpcat: ${err.message}
+`);
+    return 2;
   }
-  if (request.target !== "/mcp") {
-    return {
-      status: 404,
-      reason: "Not Found",
-      headers: { "content-type": "text/plain" },
-      body: "Not Found"
-    };
+  const removed = await source.remove(resolved.name, resolved.serverUrl);
+  if (removed) {
+    await platform2.write(1, `Signed out of ${target}
+`);
+  } else {
+    await platform2.write(1, `No credentials stored for ${target}
+`);
   }
-  if (request.method !== "POST") {
-    return {
-      status: 405,
-      reason: "Method Not Allowed",
-      headers: { "content-type": "text/plain", allow: "POST" },
-      body: "Method Not Allowed"
-    };
+  return 0;
+}
+function concatUint8Arrays(arrays) {
+  const total = arrays.reduce((s, a) => s + a.length, 0);
+  const result = new Uint8Array(total);
+  let offset = 0;
+  for (const a of arrays) {
+    result.set(a, offset);
+    offset += a.length;
   }
-  const outcome = await handleJsonRpc(request.body, tools, call, serverName, version);
-  return {
-    status: outcome.status,
-    reason: outcome.status === 200 ? "OK" : "Accepted",
-    headers: { "content-type": outcome.contentType },
-    body: outcome.body
-  };
+  return result;
 }
 
 // src/config/import.ts
@@ -11405,6 +13166,91 @@ bridge does not survive a reload; runs in the foreground (start with &)
   return runServe(platform2, serveOptions, version);
 }
 
+// src/cli/exit-codes.ts
+var EXIT_OK = 0;
+var EXIT_TOOL_ERROR = 1;
+var EXIT_USAGE = 2;
+var EXIT_CONNECTION = 3;
+var EXIT_AUTH = 4;
+var EXIT_RPC_ERROR = 5;
+var EXIT_INPUT_REQUIRED = 6;
+var EXIT_TIMEOUT = 124;
+var EXIT_INTERRUPTED = 130;
+var McpcatError = class extends Error {
+  exitCode;
+  constructor(exitCode, message) {
+    super(message);
+    this.name = "McpcatError";
+    this.exitCode = exitCode;
+  }
+};
+
+// src/cli/verbose.ts
+var SENSITIVE_HEADER_RE = /^(authorization|cookie|proxy-authorization)$/i;
+var SENSITIVE_NAME_RE = /token|key|secret|password|session/i;
+function isSensitiveHeader(name) {
+  return SENSITIVE_HEADER_RE.test(name) || SENSITIVE_NAME_RE.test(name);
+}
+function redact(text, secrets) {
+  let result = text;
+  for (const secret of secrets) {
+    if (secret.length > 0) {
+      while (result.includes(secret)) {
+        result = result.replace(secret, "[REDACTED]");
+      }
+    }
+  }
+  return result;
+}
+function createVerboseLogger(platform2, enabled) {
+  const secrets = /* @__PURE__ */ new Set();
+  function write(line) {
+    const safe = redact(line, secrets);
+    platform2.write(2, `${safe}
+`).catch(() => {
+    });
+  }
+  return {
+    enabled,
+    secrets,
+    request(method, body) {
+      if (!enabled) return;
+      write(`> ${method}`);
+      for (const line of body.split("\n")) {
+        write(`> ${line}`);
+      }
+    },
+    response(body) {
+      if (!enabled) return;
+      for (const line of body.split("\n")) {
+        write(`< ${line}`);
+      }
+    },
+    http(direction, line) {
+      if (!enabled) return;
+      write(`${direction} ${line}`);
+    },
+    server(line) {
+      if (!enabled) return;
+      write(`[server] ${line}`);
+    },
+    headerOut(name, value) {
+      if (!enabled) return;
+      const display = isSensitiveHeader(name) ? "[REDACTED]" : redact(value, secrets);
+      write(`> ${name}: ${display}`);
+    },
+    headerIn(name, value) {
+      if (!enabled) return;
+      const display = isSensitiveHeader(name) ? "[REDACTED]" : redact(value, secrets);
+      write(`< ${name}: ${display}`);
+    },
+    progress(message) {
+      if (!enabled) return;
+      write(`* ${message}`);
+    }
+  };
+}
+
 // src/cli/main.ts
 var VERBS = [
   "info",
@@ -11443,16 +13289,7 @@ var CONFIG_VERBS = {
   exposure: true,
   import: true
 };
-var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
-  "resources",
-  "read",
-  "prompts",
-  "prompt",
-  "complete",
-  "task",
-  "login",
-  "logout"
-]);
+var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set(["resources", "read", "prompts", "prompt", "complete", "task"]);
 var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe", "serve"]);
 function helpText(version) {
   return `mcpcat ${version} \u2013 a curl for the Model Context Protocol
@@ -11476,8 +13313,8 @@ Configuration verbs:
   enable|disable <name>      Toggle a server
   exposure <name> <mode>     Set exposure mode
   import <file>              Import from other configs
-  login <target>             OAuth sign-in (not implemented yet)
-  logout <target>            Remove tokens (not implemented yet)
+  login <target>             OAuth sign-in
+  logout <target>            Remove stored tokens
 
 Server and code verbs:
   serve [--stdio|--http] \u2026   Expose commands or proxy upstream as MCP server
@@ -11522,6 +13359,8 @@ function parseFlags(args2) {
   const serverTargets = [];
   let allowShell = false;
   let timeoutMs;
+  let verbose = false;
+  let silent = false;
   const positional = [];
   let trailingCommand;
   for (let i = 0; i < args2.length; i++) {
@@ -11558,6 +13397,10 @@ function parseFlags(args2) {
       serverTargets.push(args2[++i]);
     } else if (arg === "--allow-shell") {
       allowShell = true;
+    } else if (arg === "-v" || arg === "--verbose") {
+      verbose = true;
+    } else if (arg === "--silent") {
+      silent = true;
     } else if ((arg === "-m" || arg === "--timeout") && args2[i + 1]) {
       timeoutMs = Number(args2[++i]) * 1e3;
     } else if (!arg.startsWith("-")) {
@@ -11578,6 +13421,8 @@ function parseFlags(args2) {
     serverTargets,
     allowShell,
     timeoutMs,
+    verbose,
+    silent,
     positional,
     trailingCommand
   };
@@ -11626,7 +13471,9 @@ function parseArgs(args2) {
     inlineSource: flags.inlineSource,
     serverTargets: flags.serverTargets,
     allowShell: flags.allowShell,
-    timeoutMs: flags.timeoutMs
+    timeoutMs: flags.timeoutMs,
+    verbose: flags.verbose,
+    silent: flags.silent
   };
 }
 function formatToolLine(tool) {
@@ -11650,26 +13497,6 @@ function formatToolSchema(tool) {
   }
   return lines.join("\n");
 }
-function renderCallResult(result) {
-  const parts = [];
-  if (result.content) {
-    for (const block of result.content) {
-      if (block.type === "text") parts.push(block.text);
-      else if (block.type === "image")
-        parts.push(`[image: ${block.mimeType}, ${Math.ceil(block.data.length * 3 / 4)} bytes]`);
-      else if (block.type === "resource_link") parts.push(`[resource: ${block.uri}]`);
-      else if (block.type === "resource") {
-        parts.push(
-          "text" in block.resource ? block.resource.text : `[blob: ${block.resource.uri}]`
-        );
-      }
-    }
-  }
-  if (parts.length === 0 && result.structuredContent !== void 0) {
-    parts.push(JSON.stringify(result.structuredContent, null, 2));
-  }
-  return parts.join("\n");
-}
 var NETWORK_HINT = "connection failed (use slicc-node, slicc-swift, or the browser extension for servers without CORS)";
 function transportHint(err) {
   if (err instanceof TypeError) {
@@ -11712,8 +13539,12 @@ async function readDataArg(platform2, dataArg) {
   }
   return JSON.parse(raw);
 }
-async function runInfo(platform2, conn) {
+async function runInfo(platform2, conn, json) {
   const info = await conn.info();
+  if (json) {
+    await renderInfoJson(platform2, info);
+    return EXIT_OK;
+  }
   const lines = [];
   if (info.name) lines.push(`Server: ${info.name}${info.version ? ` ${info.version}` : ""}`);
   if (info.title) lines.push(`Title: ${info.title}`);
@@ -11730,48 +13561,66 @@ async function runInfo(platform2, conn) {
   }
   await platform2.write(1, `${lines.join("\n")}
 `);
-  return 0;
+  return EXIT_OK;
 }
-async function runTools(platform2, conn) {
+async function runTools(platform2, conn, json) {
   const tools = await conn.listTools();
-  if (tools.length === 0) {
-    await platform2.write(1, "(no tools)\n");
-  } else {
-    await platform2.write(1, `${tools.map(formatToolLine).join("\n")}
-`);
+  if (json) {
+    await renderToolsJson(platform2, tools);
+    return EXIT_OK;
   }
-  return 0;
+  await platform2.write(
+    1,
+    tools.length === 0 ? "(no tools)\n" : `${tools.map(formatToolLine).join("\n")}
+`
+  );
+  return EXIT_OK;
 }
-async function runCall(platform2, conn, toolName, dataArg) {
-  let toolArgs = {};
+async function runCall(platform2, conn, toolName, dataArg, toolArgs, opts) {
+  let base = {};
   if (dataArg) {
     try {
-      toolArgs = await readDataArg(platform2, dataArg);
+      base = await readDataArg(platform2, dataArg);
     } catch (err) {
-      await platform2.write(2, `mcpcat: invalid -d argument: ${err.message}
-`);
-      return 2;
+      await writeErr(
+        platform2,
+        opts.json ?? false,
+        "usage",
+        `invalid -d argument: ${err.message}`
+      );
+      return EXIT_USAGE;
     }
   }
-  const result = await conn.callTool(toolName, toolArgs);
-  const output = renderCallResult(result);
-  if (result.isError) {
-    await platform2.write(2, `${output}
-`);
-    return 1;
+  let fin = base;
+  if (toolArgs.length > 0) {
+    const tools = await conn.listTools();
+    const tool = tools.find((t) => t.name === toolName);
+    const schema = tool?.inputSchema ?? { type: "object", properties: {} };
+    const c = coerceArgsBySchema(toolArgs, schema, { noValidate: opts.noValidate });
+    if (!c.ok) {
+      await writeErr(platform2, opts.json ?? false, "usage", c.error);
+      return EXIT_USAGE;
+    }
+    fin = mergeArgs(base, c.value);
   }
-  await platform2.write(1, `${output}
-`);
-  return 0;
+  return renderCallResult(
+    platform2,
+    await conn.callTool(toolName, fin, { onProgress: opts.onProgress }),
+    { json: opts.json }
+  );
 }
-async function runDescribe(platform2, conn, toolName, showSchema) {
+async function runDescribe(platform2, conn, toolName, showSchema, json) {
   const tools = await conn.listTools();
   if (toolName) {
     const tool = tools.find((t) => t.name === toolName);
     if (!tool) {
-      await platform2.write(2, `mcpcat: tool '${toolName}' not found
+      await writeErr(platform2, json, "usage", `tool '${toolName}' not found`);
+      return EXIT_USAGE;
+    }
+    if (json) {
+      await platform2.write(1, `${JSON.stringify(tool, null, 2)}
 `);
-      return 2;
+      return EXIT_OK;
     }
     if (showSchema && tool.inputSchema) {
       await platform2.write(1, `${JSON.stringify(tool.inputSchema, null, 2)}
@@ -11781,28 +13630,36 @@ async function runDescribe(platform2, conn, toolName, showSchema) {
 `);
     }
   } else {
+    if (json) {
+      await platform2.write(1, `${JSON.stringify({ tools }, null, 2)}
+`);
+      return EXIT_OK;
+    }
     for (const tool of tools) {
       await platform2.write(1, `${formatToolSchema(tool)}
 
 `);
     }
   }
-  return 0;
+  return EXIT_OK;
 }
-async function runVerb(platform2, parsed, conn) {
+async function runVerb(platform2, parsed, conn, onProgress) {
   switch (parsed.verb) {
     case "info":
-      return runInfo(platform2, conn);
+      return runInfo(platform2, conn, parsed.jsonOutput);
     case "tools":
-      return runTools(platform2, conn);
+      return runTools(platform2, conn, parsed.jsonOutput);
     case "call":
-      return runCall(platform2, conn, parsed.toolName, parsed.dataArg);
+      return runCall(platform2, conn, parsed.toolName, parsed.dataArg, [], {
+        json: parsed.jsonOutput,
+        onProgress
+      });
     case "describe":
-      return runDescribe(platform2, conn, parsed.toolName, parsed.showSchema);
+      return runDescribe(platform2, conn, parsed.toolName, parsed.showSchema, parsed.jsonOutput);
     default:
       await platform2.write(2, `mcpcat: unknown command '${parsed.verb}'
 `);
-      return 2;
+      return EXIT_USAGE;
   }
 }
 async function probeServer(_name, config, platform2) {
@@ -12048,10 +13905,18 @@ async function run(platform2, version, args2) {
   }
   const discResult = await dispatchDiscoveryVerb(platform2, parsed, args2);
   if (discResult !== void 0) return discResult;
+  if (parsed.verb === "login") {
+    const source = createTokenSource(platform2);
+    return runLogin(platform2, args2.slice(1), source);
+  }
+  if (parsed.verb === "logout") {
+    const source = createTokenSource(platform2);
+    return runLogout(platform2, args2.slice(1), source);
+  }
   if (UNIMPLEMENTED_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: '${parsed.verb}' is not implemented yet
 `);
-    return 1;
+    return EXIT_TOOL_ERROR;
   }
   if (parsed.verb === "serve") {
     return dispatchServeVerb(platform2, args2, version);
@@ -12073,44 +13938,132 @@ async function run(platform2, version, args2) {
 `);
     return 2;
   }
+  return runClientVerb(platform2, version, parsed);
+}
+function expandAndCollect(headers, env) {
+  const secrets = [];
+  const result = {};
+  for (const [k, v] of Object.entries(headers)) {
+    const e = expandPlaceholders(v, env);
+    result[k] = e;
+    if (e !== v) secrets.push(e);
+    if (v.length > 0) secrets.push(v);
+  }
+  return { expanded: result, secrets };
+}
+function classifyError(err) {
+  if (err instanceof InputRequiredError) {
+    return { code: EXIT_INPUT_REQUIRED, kind: "input_required", msg: err.requestJson };
+  }
+  if (err instanceof McpTimeoutError2) {
+    return { code: EXIT_TIMEOUT, kind: "timeout", msg: err.message };
+  }
+  if (err instanceof McpAuthError) {
+    return { code: EXIT_AUTH, kind: "auth", msg: err.message };
+  }
+  if (err instanceof AuthStepUpError) {
+    const scopeHint = err.scope ? ` --scope ${err.scope}` : "";
+    return {
+      code: EXIT_AUTH,
+      kind: "auth",
+      msg: `insufficient scope. Run: mcpcat login ${err.target ?? "<target>"}${scopeHint}`
+    };
+  }
+  if (err.name === "McpOAuthAuthorizationRequiredError" || err.name === "McpAuthRequiredError") {
+    return { code: EXIT_AUTH, kind: "auth", msg: err.message };
+  }
+  if (err instanceof McpcatError) {
+    return { code: err.exitCode, kind: "error", msg: err.message };
+  }
+  const msg = err.message ?? String(err);
+  const name = err.name ?? "";
+  if (name === "McpTimeoutError" || msg.includes("timed out") || msg.includes("timeout") || msg.includes("Timeout")) {
+    return { code: EXIT_TIMEOUT, kind: "timeout", msg };
+  }
+  return { code: EXIT_RPC_ERROR, kind: "rpc_error", msg };
+}
+function resolveAuthProvider(platform2, hasAuthHeader, url, target, config) {
+  if (hasAuthHeader || !url) return void 0;
+  const source = createTokenSource(platform2);
+  const entry = config.entry(target);
+  const oauth = entry && "url" in entry.config ? entry.config.oauth : void 0;
+  const name = entry ? target : `url:${new URL(url).origin}${new URL(url).pathname}`;
+  return createMcpAuthProvider({ name, serverUrl: url, source, oauth, platform: platform2 });
+}
+async function runClientVerb(platform2, version, parsed) {
+  const { expanded, secrets } = expandAndCollect(parsed.headers, platform2.env);
+  const verbose = createVerboseLogger(platform2, parsed.verbose);
+  for (const s of secrets) verbose.secrets.add(s);
+  const timeoutMs = parsed.timeoutMs;
+  const sigintController = new AbortController();
+  let interrupted = false;
+  platform2.onSignal?.("SIGINT", () => {
+    interrupted = true;
+    sigintController.abort();
+  });
+  const showProgress = !parsed.silent && (parsed.verbose || platform2.isatty(2));
+  const onProgress = (progress, total, message) => {
+    if (!showProgress) return;
+    const pct = total ? ` ${Math.round(progress / total * 100)}%` : "";
+    const msg = message ? ` ${message}` : "";
+    platform2.write(2, `* progress:${pct}${msg}
+`).catch(() => {
+    });
+  };
   const config = await MergedConfigSource.load(platform2);
+  const target = parsed.target === "__trailing__" ? "" : parsed.target;
   let resolved;
   try {
-    resolved = await resolveTarget(
-      parsed.target === "__trailing__" ? "" : parsed.target,
-      parsed.trailingCommand,
-      config
-    );
+    resolved = await resolveTarget(target, parsed.trailingCommand, config);
   } catch (err) {
-    await platform2.write(2, `mcpcat: ${err.message}
-`);
-    return 2;
+    await writeErr(platform2, parsed.jsonOutput, "usage", err.message);
+    return EXIT_USAGE;
   }
+  const hasAuthHeader = "Authorization" in expanded;
+  const authProvider = resolveAuthProvider(platform2, hasAuthHeader, resolved.url, target, config);
   let conn;
   try {
     conn = await connect(platform2, {
       ...resolved,
-      headers: { ...resolved.headers, ...parsed.headers },
+      headers: { ...resolved.headers, ...expanded },
       protocolVersion: parsed.protocolVersion,
-      version
+      version,
+      timeoutMs,
+      signal: sigintController.signal,
+      verbose,
+      authProvider
     });
   } catch (err) {
+    if (err instanceof McpAuthError || err instanceof AuthStepUpError) {
+      const e = classifyError(err);
+      await writeErr(platform2, parsed.jsonOutput, e.kind, e.msg);
+      return EXIT_AUTH;
+    }
+    if (err.name === "McpOAuthAuthorizationRequiredError" || err.name === "McpAuthRequiredError") {
+      await writeErr(
+        platform2,
+        parsed.jsonOutput,
+        "auth",
+        `unauthorized. Run: mcpcat login ${target}`
+      );
+      return EXIT_AUTH;
+    }
     const msg = transportHint(err) ?? `connection failed: ${err.message}`;
-    await platform2.write(2, `mcpcat: ${msg}
-`);
-    return 3;
+    await writeErr(platform2, parsed.jsonOutput, "connection", msg);
+    return EXIT_CONNECTION;
   }
   try {
-    return await runVerb(platform2, parsed, conn);
+    return await runVerb(platform2, parsed, conn, onProgress);
   } catch (err) {
-    if (err instanceof InputRequiredError) {
-      await platform2.write(2, `${err.requestJson}
-`);
-      return 6;
+    if (interrupted) {
+      await platform2.write(2, "mcpcat: interrupted\n");
+      return EXIT_INTERRUPTED;
     }
-    await platform2.write(2, `mcpcat: ${err.message}
+    const e = classifyError(err);
+    if (err instanceof InputRequiredError) await platform2.write(2, `${e.msg}
 `);
-    return 5;
+    else await writeErr(platform2, parsed.jsonOutput, e.kind, e.msg);
+    return e.code;
   } finally {
     try {
       await conn.close();
@@ -12118,12 +14071,17 @@ async function run(platform2, version, args2) {
     }
   }
 }
+async function writeErr(p, json, kind, msg) {
+  if (json) await renderErrorJson(p, kind, msg);
+  else await p.write(2, `mcpcat: ${msg}
+`);
+}
 
 // src/platform/host.ts
 import { spawn as cpSpawn } from "node:child_process";
 import { constants } from "node:fs";
 import { access, mkdir, readFile as readFile3, rename, rmdir, stat, writeFile } from "node:fs/promises";
-import { createServer } from "node:net";
+import { createServer as createServer2 } from "node:net";
 import { Readable, Writable } from "node:stream";
 import * as tty from "node:tty";
 var USE_PROCESS_GROUPS2 = process.platform !== "win32";
@@ -12182,8 +14140,8 @@ var hostFs = {
   async readFile(path) {
     return new Uint8Array(await readFile3(path));
   },
-  async writeFile(path, data) {
-    await writeFile(path, data);
+  async writeFile(path, data, options) {
+    await writeFile(path, data, options?.mode !== void 0 ? { mode: options.mode } : void 0);
   },
   async mkdir(path) {
     await mkdir(path, { recursive: true });
@@ -12221,7 +14179,7 @@ function createStderrStream() {
 }
 function nodeListen(options) {
   return new Promise((resolve, reject) => {
-    const server = createServer();
+    const server = createServer2();
     const pending = [];
     const ready = [];
     let closed = false;
@@ -12319,5 +14277,5 @@ function createHostPlatform() {
 // src/host.ts
 var platform = createHostPlatform();
 var args = process.argv.slice(2);
-var code = await run(platform, "0.0.0", args);
+var code = await run(platform, "0.10.0", args);
 process.exit(code);