@ai-ecoverse/slicc-agent 3.52.1 → 4.1.0

package/dist/mcp/credentials.js

@@ -13,33 +13,24 @@ function secretNames(config) {
     for (const name of placeholders(value)) names.add(name);
   return [...names];
 }
-async function resolveHeaders(server, config, credentials) {
+function resolveHeaders(server, config, records) {
   const names = secretNames(config);
-  if (!names.length) return { ok: true, headers: { ...config.headers }, secrets: [] };
-  const stored = await credentials.read(await credentialKey(server, config.url));
-  const env = stored?.type === "api_key" ? stored.env ?? {} : {};
-  const key = stored?.type === "api_key" ? stored.key : void 0;
-  const value = (name) => env[name] ?? (names.length === 1 ? key : void 0);
-  const missing = names.filter((name) => !value(name));
+  if (!names.length) return { ok: true, headers: { ...config.headers } };
+  const placeholder = (name) => (records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : void 0))?.placeholder;
+  const missing = names.filter((name) => !placeholder(name));
   if (missing.length) return { ok: false, missing };
   const headers = {};
   for (const [header, text] of Object.entries(config.headers ?? {}))
     headers[header] = text.replace(
       /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,
-      (_, name) => String(value(name))
+      (_, name) => String(placeholder(name))
     );
-  return { ok: true, headers, secrets: names.map((name) => String(value(name))) };
-}
-function scrub(text, secrets) {
-  let out = text;
-  for (const secret of secrets) if (secret.length >= 4) out = out.split(secret).join("[redacted]");
-  return out;
+  return { ok: true, headers };
 }
 export {
   MCP_CREDENTIAL_PREFIX,
   credentialKey,
   resolveHeaders,
-  scrub,
   secretNames
 };
 //# sourceMappingURL=credentials.js.map

package/dist/mcp/credentials.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/credentials.ts"],
-  "sourcesContent": ["import type { CredentialStore } from '@earendil-works/pi-ai';\nimport { type McpServerConfig, placeholders } from './config.ts';\n\nexport const MCP_CREDENTIAL_PREFIX = 'mcp:';\n\nasync function digest(text: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));\n  return [...new Uint8Array(bytes).slice(0, 12)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport async function credentialKey(server: string, url: string): Promise<string> {\n  return `${MCP_CREDENTIAL_PREFIX}${server}|${await digest(new URL(url).href)}`;\n}\n\nexport function secretNames(config: McpServerConfig): string[] {\n  const names = new Set<string>();\n  for (const value of Object.values(config.headers ?? {}))\n    for (const name of placeholders(value)) names.add(name);\n  return [...names];\n}\n\nexport type Resolved =\n  | { ok: true; headers: Record<string, string>; secrets: string[] }\n  | { ok: false; missing: string[] };\n\nexport async function resolveHeaders(\n  server: string,\n  config: McpServerConfig,\n  credentials: CredentialStore\n): Promise<Resolved> {\n  const names = secretNames(config);\n  if (!names.length) return { ok: true, headers: { ...config.headers }, secrets: [] };\n  const stored = await credentials.read(await credentialKey(server, config.url));\n  const env = stored?.type === 'api_key' ? (stored.env ?? {}) : {};\n  const key = stored?.type === 'api_key' ? stored.key : undefined;\n  const value = (name: string) => env[name] ?? (names.length === 1 ? key : undefined);\n  const missing = names.filter((name) => !value(name));\n  if (missing.length) return { ok: false, missing };\n  const headers: Record<string, string> = {};\n  for (const [header, text] of Object.entries(config.headers ?? {}))\n    headers[header] = text.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_, name: string) =>\n      String(value(name))\n    );\n  return { ok: true, headers, secrets: names.map((name) => String(value(name))) };\n}\n\nexport function scrub(text: string, secrets: readonly string[]): string {\n  let out = text;\n  for (const secret of secrets) if (secret.length >= 4) out = out.split(secret).join('[redacted]');\n  return out;\n}\n"],
-  "mappings": "AACA,SAA+B,oBAAoB;AAE5C,MAAM,wBAAwB;AAErC,eAAe,OAAO,MAA+B;AACnD,QAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAClF,SAAO,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAC1C,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAEA,eAAsB,cAAc,QAAgB,KAA8B;AAChF,SAAO,GAAG,qBAAqB,GAAG,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC;AAC7E;AAEO,SAAS,YAAY,QAAmC;AAC7D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC;AACpD,eAAW,QAAQ,aAAa,KAAK,EAAG,OAAM,IAAI,IAAI;AACxD,SAAO,CAAC,GAAG,KAAK;AAClB;AAMA,eAAsB,eACpB,QACA,QACA,aACmB;AACnB,QAAM,QAAQ,YAAY,MAAM;AAChC,MAAI,CAAC,MAAM,OAAQ,QAAO,EAAE,IAAI,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ,GAAG,SAAS,CAAC,EAAE;AAClF,QAAM,SAAS,MAAM,YAAY,KAAK,MAAM,cAAc,QAAQ,OAAO,GAAG,CAAC;AAC7E,QAAM,MAAM,QAAQ,SAAS,YAAa,OAAO,OAAO,CAAC,IAAK,CAAC;AAC/D,QAAM,MAAM,QAAQ,SAAS,YAAY,OAAO,MAAM;AACtD,QAAM,QAAQ,CAAC,SAAiB,IAAI,IAAI,MAAM,MAAM,WAAW,IAAI,MAAM;AACzE,QAAM,UAAU,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC;AACnD,MAAI,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ;AAChD,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;AAC9D,YAAQ,MAAM,IAAI,KAAK;AAAA,MAAQ;AAAA,MAAmC,CAAC,GAAG,SACpE,OAAO,MAAM,IAAI,CAAC;AAAA,IACpB;AACF,SAAO,EAAE,IAAI,MAAM,SAAS,SAAS,MAAM,IAAI,CAAC,SAAS,OAAO,MAAM,IAAI,CAAC,CAAC,EAAE;AAChF;AAEO,SAAS,MAAM,MAAc,SAAoC;AACtE,MAAI,MAAM;AACV,aAAW,UAAU,QAAS,KAAI,OAAO,UAAU,EAAG,OAAM,IAAI,MAAM,MAAM,EAAE,KAAK,YAAY;AAC/F,SAAO;AACT;",
+  "sourcesContent": ["import { type McpServerConfig, placeholders } from './config.ts';\n\nexport const MCP_CREDENTIAL_PREFIX = 'mcp:';\n\nexport interface McpRecords {\n  mcp(server: string, name?: string): { placeholder: string } | undefined;\n}\n\nasync function digest(text: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));\n  return [...new Uint8Array(bytes).slice(0, 12)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport async function credentialKey(server: string, url: string): Promise<string> {\n  return `${MCP_CREDENTIAL_PREFIX}${server}|${await digest(new URL(url).href)}`;\n}\n\nexport function secretNames(config: McpServerConfig): string[] {\n  const names = new Set<string>();\n  for (const value of Object.values(config.headers ?? {}))\n    for (const name of placeholders(value)) names.add(name);\n  return [...names];\n}\n\nexport type Resolved =\n  | { ok: true; headers: Record<string, string> }\n  | { ok: false; missing: string[] };\n\nexport function resolveHeaders(\n  server: string,\n  config: McpServerConfig,\n  records: McpRecords\n): Resolved {\n  const names = secretNames(config);\n  if (!names.length) return { ok: true, headers: { ...config.headers } };\n  const placeholder = (name: string) =>\n    (records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : undefined))\n      ?.placeholder;\n  const missing = names.filter((name) => !placeholder(name));\n  if (missing.length) return { ok: false, missing };\n  const headers: Record<string, string> = {};\n  for (const [header, text] of Object.entries(config.headers ?? {}))\n    headers[header] = text.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_, name: string) =>\n      String(placeholder(name))\n    );\n  return { ok: true, headers };\n}\n"],
+  "mappings": "AAAA,SAA+B,oBAAoB;AAE5C,MAAM,wBAAwB;AAMrC,eAAe,OAAO,MAA+B;AACnD,QAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAClF,SAAO,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAC1C,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAEA,eAAsB,cAAc,QAAgB,KAA8B;AAChF,SAAO,GAAG,qBAAqB,GAAG,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC;AAC7E;AAEO,SAAS,YAAY,QAAmC;AAC7D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC;AACpD,eAAW,QAAQ,aAAa,KAAK,EAAG,OAAM,IAAI,IAAI;AACxD,SAAO,CAAC,GAAG,KAAK;AAClB;AAMO,SAAS,eACd,QACA,QACA,SACU;AACV,QAAM,QAAQ,YAAY,MAAM;AAChC,MAAI,CAAC,MAAM,OAAQ,QAAO,EAAE,IAAI,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ,EAAE;AACrE,QAAM,cAAc,CAAC,UAClB,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,IAAI,MAAM,IAAI,UACtE;AACN,QAAM,UAAU,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC;AACzD,MAAI,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ;AAChD,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;AAC9D,YAAQ,MAAM,IAAI,KAAK;AAAA,MAAQ;AAAA,MAAmC,CAAC,GAAG,SACpE,OAAO,YAAY,IAAI,CAAC;AAAA,IAC1B;AACF,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;",
   "names": []
 }

package/dist/mcp/index.js

@@ -13,7 +13,6 @@ const idle = {
   disconnect: async () => void 0,
   onChange: () => () => void 0,
   status: () => [],
-  secrets: () => [],
   reload: async () => void 0,
   close: async () => void 0
 };

package/dist/mcp/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/index.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport { configPath, shown } from './paths.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  signIn: async (id) => {\n    throw new Error(`${id} is not an MCP server that signs in`);\n  },\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  onChange: () => () => undefined,\n  status: () => [],\n  secrets: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = configPath(options.home, options.agentDir);\n  const named = shown(file, options.home);\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: `mcp:${named}`,\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: `The MCP client didn't load, so the servers in ${named} stay off until SLICC is updated.`,\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
-  "mappings": "AASA,SAAS,sBAAsB;AAC/B,SAAS,YAAY,aAAa;AAGlC,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,QAAQ,OAAO,OAAO;AACpB,UAAM,IAAI,MAAM,GAAG,EAAE,qCAAqC;AAAA,EAC5D;AAAA,EACA,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,SAAS,MAAM,CAAC;AAAA,EAChB,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ,QAAQ;AACtD,QAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI;AACtC,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM,iDAAiD,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport { configPath, shown } from './paths.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  signIn: async (id) => {\n    throw new Error(`${id} is not an MCP server that signs in`);\n  },\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  onChange: () => () => undefined,\n  status: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = configPath(options.home, options.agentDir);\n  const named = shown(file, options.home);\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: `mcp:${named}`,\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: `The MCP client didn't load, so the servers in ${named} stay off until SLICC is updated.`,\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
+  "mappings": "AASA,SAAS,sBAAsB;AAC/B,SAAS,YAAY,aAAa;AAGlC,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,QAAQ,OAAO,OAAO;AACpB,UAAM,IAAI,MAAM,GAAG,EAAE,qCAAqC;AAAA,EAC5D;AAAA,EACA,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ,QAAQ;AACtD,QAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI;AACtC,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM,iDAAiD,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/mcp/oauth.js

@@ -32,7 +32,8 @@ function authProvider(provider, server) {
       await authorizeMcp(provider, {
         serverUrl: context.serverUrl,
         ...challenge.resourceMetadataUrl ? { resourceMetadataUrl: challenge.resourceMetadataUrl } : {},
-        ...step ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true } : challenge.scope ? { scope: challenge.scope } : {},
+        skipRefresh: true,
+        ...step ? { scope: stepUpScope(granted?.scope, challenge.scope) } : challenge.scope ? { scope: challenge.scope } : {},
         ...configured ? { authorizationServerMetadataUrl: new URL(configured) } : {},
         fetch: context.fetch
       });
@@ -69,12 +70,12 @@ function randomState() {
 class StoredOAuth {
   redirectUrl;
   clientMetadata;
-  #credentials;
+  #store;
   #server;
   #writes = Promise.resolve();
-  constructor(server, credentials, redirectUrl) {
+  constructor(server, store, redirectUrl) {
     this.#server = server;
-    this.#credentials = credentials;
+    this.#store = store;
     this.redirectUrl = redirectUrl;
     this.clientMetadata = {
       client_name: server.config.oauth?.clientName ?? CLIENT_NAME,
@@ -93,26 +94,17 @@ class StoredOAuth {
   }
   async load() {
     await this.#writes;
-    const stored = await this.#credentials.read(await this.#key());
-    const state = stored?.type === "oauth" ? stored.state : void 0;
+    const state = await this.#store.get(await this.#key());
     return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };
   }
   async update(change) {
     const write = this.#writes.then(async () => {
       const key = await this.#key();
-      await this.#credentials.modify(key, async (current) => {
-        const before = current?.type === "oauth" ? current.state : void 0;
-        const next = change(
-          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }
-        );
-        return {
-          type: "oauth",
-          access: next.tokens?.access_token ?? "",
-          refresh: next.tokens?.refresh_token ?? "",
-          expires: next.tokensExpireAt ?? 0,
-          state: next
-        };
-      });
+      const before = await this.#store.get(key);
+      await this.#store.set(
+        key,
+        change(before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl })
+      );
     });
     this.#writes = write.catch(() => void 0);
     await write;
@@ -176,7 +168,7 @@ class StoredOAuth {
   }
   async forget() {
     await this.#writes;
-    await this.#credentials.delete(await this.#key());
+    await this.#store.set(await this.#key(), void 0);
   }
 }
 async function beginSignIn(provider, server, options) {
@@ -203,6 +195,9 @@ async function beginSignIn(provider, server, options) {
     });
     await provider.saveClientInformation(client);
   }
+  await options.register(
+    new URL(metadata?.token_endpoint ?? new URL("/token", info.authorizationServerUrl)).href
+  );
   const { verifier, challenge } = await pkce();
   const state = randomState();
   await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));

package/dist/mcp/oauth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/oauth.ts"],
-  "sourcesContent": ["import type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { AuthProvider, McpFetch, UnauthorizedContext } from '@earendil-works/pi-mcp';\nimport {\n  authorizeMcp,\n  discoverOAuthServerInfo,\n  McpOAuthAuthorizationRequiredError,\n  type McpOAuthState,\n  type OAuthChallenge,\n  parseWwwAuthenticate,\n  registerClient,\n  selectResource,\n  stepUpScope,\n} from '@earendil-works/pi-mcp/oauth';\nimport type { McpSignIn } from '../services.ts';\nimport type { McpServerConfig } from './config.ts';\nimport { credentialKey } from './credentials.ts';\n\ntype Provider = Parameters<typeof authorizeMcp>[0];\ntype Tokens = Awaited<ReturnType<Provider['tokens']>>;\ntype Client = Awaited<ReturnType<Provider['clientInformation']>>;\ntype Discovery = NonNullable<McpOAuthState['discovery']>;\n\nexport const CLIENT_NAME = 'SLICC';\n\nexport function sentence(text: string): string {\n  const trimmed = text.trim();\n  const lowered = /^[A-Z][a-z]/.test(trimmed)\n    ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}`\n    : trimmed;\n  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;\n}\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function secureUrl(url: URL): boolean {\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nexport function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError {\n  const error = new McpOAuthAuthorizationRequiredError();\n  if (cause !== undefined) error.cause = cause;\n  return error;\n}\n\nexport function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  let inFlight: Promise<void> | undefined;\n  const authorize = async (\n    context: UnauthorizedContext,\n    step: boolean,\n    challenge: OAuthChallenge\n  ) => {\n    const granted = step ? await provider.tokens() : undefined;\n    try {\n      await authorizeMcp(provider, {\n        serverUrl: context.serverUrl,\n        ...(challenge.resourceMetadataUrl\n          ? { resourceMetadataUrl: challenge.resourceMetadataUrl }\n          : {}),\n        ...(step\n          ? { scope: stepUpScope(granted?.scope, challenge.scope), skipRefresh: true }\n          : challenge.scope\n            ? { scope: challenge.scope }\n            : {}),\n        ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n        fetch: context.fetch,\n      });\n    } catch (error) {\n      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);\n    }\n  };\n  return {\n    token: async () => (await provider.tokens())?.access_token,\n    async onUnauthorized(context) {\n      const challenge = parseWwwAuthenticate(context.response.headers.get('www-authenticate'));\n      const step = challenge.error === 'insufficient_scope';\n      if (!step && !inFlight && context.token !== undefined) {\n        const current = (await provider.tokens())?.access_token;\n        if (current !== undefined && current !== context.token) return;\n      }\n      inFlight ??= authorize(context, step, challenge).finally(() => {\n        inFlight = undefined;\n      });\n      await inFlight;\n    },\n  };\n}\n\nconst bytesToBase64Url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst random = (length: number) => crypto.getRandomValues(new Uint8Array(length));\n\nexport async function pkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = bytesToBase64Url(random(32));\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };\n}\n\nexport function randomState(): string {\n  return [...random(32)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nexport interface OAuthServer {\n  name: string;\n  config: McpServerConfig;\n}\n\nexport class StoredOAuth implements Provider {\n  readonly redirectUrl: string;\n  readonly clientMetadata: Provider['clientMetadata'];\n  readonly #credentials: CredentialStore;\n  readonly #server: OAuthServer;\n  #writes: Promise<unknown> = Promise.resolve();\n\n  constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string) {\n    this.#server = server;\n    this.#credentials = credentials;\n    this.redirectUrl = redirectUrl;\n    this.clientMetadata = {\n      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,\n      redirect_uris: [redirectUrl],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n      ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    };\n  }\n\n  get serverUrl(): string {\n    return String(new URL(this.#server.config.url));\n  }\n\n  async #key(): Promise<string> {\n    return credentialKey(this.#server.name, this.#server.config.url);\n  }\n\n  async load(): Promise<McpOAuthState> {\n    await this.#writes;\n    const stored = await this.#credentials.read(await this.#key());\n    const state =\n      stored?.type === 'oauth' ? (stored.state as McpOAuthState | undefined) : undefined;\n    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };\n  }\n\n  async update(change: (state: McpOAuthState) => McpOAuthState): Promise<void> {\n    const write = this.#writes.then(async () => {\n      const key = await this.#key();\n      await this.#credentials.modify(key, async (current) => {\n        const before =\n          current?.type === 'oauth' ? (current.state as McpOAuthState | undefined) : undefined;\n        const next = change(\n          before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl }\n        );\n        return {\n          type: 'oauth',\n          access: next.tokens?.access_token ?? '',\n          refresh: next.tokens?.refresh_token ?? '',\n          expires: next.tokensExpireAt ?? 0,\n          state: next,\n        };\n      });\n    });\n    this.#writes = write.catch(() => undefined);\n    await write;\n  }\n\n  async signedIn(): Promise<boolean> {\n    return (await this.load()).tokens !== undefined;\n  }\n\n  state(): string {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async clientInformation(): Promise<Client> {\n    const configured = this.#server.config.oauth?.clientId;\n    return configured ? { client_id: configured } : (await this.load()).clientInformation;\n  }\n\n  async saveClientInformation(information: NonNullable<Client>): Promise<void> {\n    if (this.#server.config.oauth?.clientId) return;\n    await this.update((state) => ({ ...state, clientInformation: information }));\n  }\n\n  async tokens(): Promise<Tokens> {\n    return (await this.load()).tokens;\n  }\n\n  async saveTokens(tokens: NonNullable<Tokens>): Promise<void> {\n    const expires =\n      tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;\n    await this.update((state) => {\n      const next: McpOAuthState = { ...state, tokens };\n      if (expires === undefined) delete next.tokensExpireAt;\n      else next.tokensExpireAt = expires;\n      return next;\n    });\n  }\n\n  redirectToAuthorization(): void {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.update((state) => ({ ...state, codeVerifier: verifier }));\n  }\n\n  async codeVerifier(): Promise<string> {\n    const verifier = (await this.load()).codeVerifier;\n    if (!verifier) throw new Error('No OAuth PKCE code verifier is stored');\n    return verifier;\n  }\n\n  async invalidateCredentials(\n    kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'\n  ): Promise<void> {\n    await this.update((state) => {\n      const next = { ...state };\n      if (kind === 'all' || kind === 'client') delete next.clientInformation;\n      if (kind === 'all' || kind === 'tokens') {\n        delete next.tokens;\n        delete next.tokensExpireAt;\n      }\n      if (kind === 'all' || kind === 'verifier') delete next.codeVerifier;\n      if (kind === 'all' || kind === 'discovery') delete next.discovery;\n      if (kind === 'all') delete next.oauthState;\n      return next;\n    });\n  }\n\n  async saveDiscoveryState(discovery: Discovery): Promise<void> {\n    await this.update((state) => ({ ...state, discovery }));\n  }\n\n  async discoveryState(): Promise<Discovery | undefined> {\n    return (await this.load()).discovery;\n  }\n\n  async forget(): Promise<void> {\n    await this.#writes;\n    await this.#credentials.delete(await this.#key());\n  }\n}\n\nexport type { McpSignIn } from '../services.ts';\n\nexport async function beginSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  options: { fetch: McpFetch; resourceMetadataUrl?: URL }\n): Promise<McpSignIn> {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  const info = await discoverOAuthServerInfo(server.config.url, {\n    fetch: options.fetch,\n    ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n  });\n  if (!configured) await provider.saveDiscoveryState(info);\n  const metadata = info.authorizationServerMetadata;\n  if (metadata && !metadata.response_types_supported.includes('code'))\n    throw new Error(\"The authorization server doesn't support authorization codes.\");\n  if (\n    metadata?.code_challenge_methods_supported &&\n    !metadata.code_challenge_methods_supported.includes('S256')\n  )\n    throw new Error(\"The authorization server doesn't support PKCE S256.\");\n  const scope =\n    server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(' ') || undefined;\n  let client = await provider.clientInformation();\n  if (!client) {\n    client = await registerClient(info.authorizationServerUrl, {\n      ...(metadata ? { metadata } : {}),\n      clientMetadata: provider.clientMetadata,\n      ...(scope ? { scope } : {}),\n      fetch: options.fetch,\n    });\n    await provider.saveClientInformation(client);\n  }\n  const { verifier, challenge } = await pkce();\n  const state = randomState();\n  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));\n  const url = new URL(\n    metadata?.authorization_endpoint ?? new URL('/authorize', info.authorizationServerUrl)\n  );\n  if (!secureUrl(url)) throw new Error(\"The authorization server's sign-in address isn't https.\");\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', client.client_id);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('redirect_uri', provider.redirectUrl);\n  url.searchParams.set('state', state);\n  if (scope) url.searchParams.set('scope', scope);\n  if (scope?.split(/\\s+/).includes('offline_access')) url.searchParams.set('prompt', 'consent');\n  const resource = selectResource(server.config.url, info.resourceMetadata);\n  if (resource) url.searchParams.set('resource', resource);\n  return { url: url.href, state };\n}\n\nexport interface Callback {\n  code?: string;\n  state?: string;\n  iss?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport async function finishSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  answer: string,\n  fetch: McpFetch\n): Promise<void> {\n  let callback: Callback;\n  try {\n    callback = JSON.parse(answer) as Callback;\n  } catch {\n    throw new Error(\"The sign-in answer isn't a callback.\");\n  }\n  const expected = (await provider.load()).oauthState;\n  if (!expected || callback.state !== expected)\n    throw new Error(\"The sign-in answer doesn't match this sign-in. Try again.\");\n  if (callback.error)\n    throw new Error(\n      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`\n    );\n  if (!callback.code) throw new Error('The sign-in answer has no authorization code.');\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  await authorizeMcp(provider, {\n    serverUrl: server.config.url,\n    authorizationCode: callback.code,\n    ...(callback.iss ? { iss: callback.iss } : {}),\n    ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n    fetch,\n  });\n  await provider.update((state) => {\n    const next = { ...state };\n    delete next.oauthState;\n    delete next.codeVerifier;\n    return next;\n  });\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,qBAAqB;AAOvB,MAAM,cAAc;AAEpB,SAAS,SAAS,MAAsB;AAC7C,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,UAAU,cAAc,KAAK,OAAO,IACtC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAC/C;AACJ,SAAO,SAAS,KAAK,OAAO,IAAI,UAAU,GAAG,OAAO;AACtD;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,UAAU,KAAmB;AAC3C,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEO,SAAS,eAAe,OAAqD;AAClF,QAAM,QAAQ,IAAI,mCAAmC;AACrD,MAAI,UAAU,OAAW,OAAM,QAAQ;AACvC,SAAO;AACT;AAEO,SAAS,aAAa,UAAuB,QAAmC;AACrF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,MAAI;AACJ,QAAM,YAAY,OAChB,SACA,MACA,cACG;AACH,UAAM,UAAU,OAAO,MAAM,SAAS,OAAO,IAAI;AACjD,QAAI;AACF,YAAM,aAAa,UAAU;AAAA,QAC3B,WAAW,QAAQ;AAAA,QACnB,GAAI,UAAU,sBACV,EAAE,qBAAqB,UAAU,oBAAoB,IACrD,CAAC;AAAA,QACL,GAAI,OACA,EAAE,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK,GAAG,aAAa,KAAK,IACzE,UAAU,QACR,EAAE,OAAO,UAAU,MAAM,IACzB,CAAC;AAAA,QACP,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,QAC5E,OAAO,QAAQ;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,iBAAiB,qCAAqC,QAAQ,eAAe,KAAK;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,aAAa,MAAM,SAAS,OAAO,IAAI;AAAA,IAC9C,MAAM,eAAe,SAAS;AAC5B,YAAM,YAAY,qBAAqB,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,CAAC;AACvF,YAAM,OAAO,UAAU,UAAU;AACjC,UAAI,CAAC,QAAQ,CAAC,YAAY,QAAQ,UAAU,QAAW;AACrD,cAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,YAAI,YAAY,UAAa,YAAY,QAAQ,MAAO;AAAA,MAC1D;AACA,mBAAa,UAAU,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM;AAC7D,mBAAW;AAAA,MACb,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,CAAC,UACxB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAC/B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEtB,MAAM,SAAS,CAAC,WAAmB,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAEhF,eAAsB,OAAyD;AAC7E,QAAM,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC5C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,iBAAiB,IAAI,WAAW,MAAM,CAAC,EAAE;AACzE;AAEO,SAAS,cAAsB;AACpC,SAAO,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAClF;AAOO,MAAM,YAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,UAA4B,QAAQ,QAAQ;AAAA,EAE5C,YAAY,QAAqB,aAA8B,aAAqB;AAClF,SAAK,UAAU;AACf,SAAK,eAAe;AACpB,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAAO,OAAO,OAAO,cAAc;AAAA,MAChD,eAAe,CAAC,WAAW;AAAA,MAC3B,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,cAAc,KAAK,QAAQ,MAAM,KAAK,QAAQ,OAAO,GAAG;AAAA,EACjE;AAAA,EAEA,MAAM,OAA+B;AACnC,UAAM,KAAK;AACX,UAAM,SAAS,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7D,UAAM,QACJ,QAAQ,SAAS,UAAW,OAAO,QAAsC;AAC3E,WAAO,OAAO,cAAc,KAAK,YAAY,QAAQ,EAAE,WAAW,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,OAAO,QAAgE;AAC3E,UAAM,QAAQ,KAAK,QAAQ,KAAK,YAAY;AAC1C,YAAM,MAAM,MAAM,KAAK,KAAK;AAC5B,YAAM,KAAK,aAAa,OAAO,KAAK,OAAO,YAAY;AACrD,cAAM,SACJ,SAAS,SAAS,UAAW,QAAQ,QAAsC;AAC7E,cAAM,OAAO;AAAA,UACX,QAAQ,cAAc,KAAK,YAAY,SAAS,EAAE,WAAW,KAAK,UAAU;AAAA,QAC9E;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,KAAK,QAAQ,gBAAgB;AAAA,UACrC,SAAS,KAAK,QAAQ,iBAAiB;AAAA,UACvC,SAAS,KAAK,kBAAkB;AAAA,UAChC,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,SAAK,UAAU,MAAM,MAAM,MAAM,MAAS;AAC1C,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,WAA6B;AACjC,YAAQ,MAAM,KAAK,KAAK,GAAG,WAAW;AAAA,EACxC;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,oBAAqC;AACzC,UAAM,aAAa,KAAK,QAAQ,OAAO,OAAO;AAC9C,WAAO,aAAa,EAAE,WAAW,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,aAAiD;AAC3E,QAAI,KAAK,QAAQ,OAAO,OAAO,SAAU;AACzC,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,mBAAmB,YAAY,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SAA0B;AAC9B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,UAAM,UACJ,OAAO,eAAe,SAAY,SAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AACjF,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAsB,EAAE,GAAG,OAAO,OAAO;AAC/C,UAAI,YAAY,OAAW,QAAO,KAAK;AAAA,UAClC,MAAK,iBAAiB;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,0BAAgC;AAC9B,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,iBAAiB,UAAiC;AACtD,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,cAAc,SAAS,EAAE;AAAA,EACrE;AAAA,EAEA,MAAM,eAAgC;AACpC,UAAM,YAAY,MAAM,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBACJ,MACe;AACf,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAO,EAAE,GAAG,MAAM;AACxB,UAAI,SAAS,SAAS,SAAS,SAAU,QAAO,KAAK;AACrD,UAAI,SAAS,SAAS,SAAS,UAAU;AACvC,eAAO,KAAK;AACZ,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,SAAS,SAAS,WAAY,QAAO,KAAK;AACvD,UAAI,SAAS,SAAS,SAAS,YAAa,QAAO,KAAK;AACxD,UAAI,SAAS,MAAO,QAAO,KAAK;AAChC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,mBAAmB,WAAqC;AAC5D,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,EACxD;AAAA,EAEA,MAAM,iBAAiD;AACrD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,KAAK;AACX,UAAM,KAAK,aAAa,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAClD;AACF;AAIA,eAAsB,YACpB,UACA,QACA,SACoB;AACpB,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,OAAO,MAAM,wBAAwB,OAAO,OAAO,KAAK;AAAA,IAC5D,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,CAAC,WAAY,OAAM,SAAS,mBAAmB,IAAI;AACvD,QAAM,WAAW,KAAK;AACtB,MAAI,YAAY,CAAC,SAAS,yBAAyB,SAAS,MAAM;AAChE,UAAM,IAAI,MAAM,+DAA+D;AACjF,MACE,UAAU,oCACV,CAAC,SAAS,iCAAiC,SAAS,MAAM;AAE1D,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,QACJ,OAAO,OAAO,OAAO,SAAS,KAAK,kBAAkB,kBAAkB,KAAK,GAAG,KAAK;AACtF,MAAI,SAAS,MAAM,SAAS,kBAAkB;AAC9C,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,eAAe,KAAK,wBAAwB;AAAA,MACzD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,gBAAgB,SAAS;AAAA,MACzB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,UAAM,SAAS,sBAAsB,MAAM;AAAA,EAC7C;AACA,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,KAAK;AAC3C,QAAM,QAAQ,YAAY;AAC1B,QAAM,SAAS,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,cAAc,UAAU,YAAY,MAAM,EAAE;AAC9F,QAAM,MAAM,IAAI;AAAA,IACd,UAAU,0BAA0B,IAAI,IAAI,cAAc,KAAK,sBAAsB;AAAA,EACvF;AACA,MAAI,CAAC,UAAU,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAC9F,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,OAAO,SAAS;AAClD,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,gBAAgB,SAAS,WAAW;AACzD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,MAAI,OAAO,MAAM,KAAK,EAAE,SAAS,gBAAgB,EAAG,KAAI,aAAa,IAAI,UAAU,SAAS;AAC5F,QAAM,WAAW,eAAe,OAAO,OAAO,KAAK,KAAK,gBAAgB;AACxE,MAAI,SAAU,KAAI,aAAa,IAAI,YAAY,QAAQ;AACvD,SAAO,EAAE,KAAK,IAAI,MAAM,MAAM;AAChC;AAUA,eAAsB,aACpB,UACA,QACA,QACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,MAAM;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,YAAY,MAAM,SAAS,KAAK,GAAG;AACzC,MAAI,CAAC,YAAY,SAAS,UAAU;AAClC,UAAM,IAAI,MAAM,2DAA2D;AAC7E,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,SAAS,mBAAmB,KAAK,KAAK,SAAS,KAAK,CAAC;AAAA,IACnF;AACF,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,+CAA+C;AACnF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,aAAa,UAAU;AAAA,IAC3B,WAAW,OAAO,OAAO;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,GAAI,SAAS,MAAM,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IACzE,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,CAAC,UAAU;AAC/B,UAAM,OAAO,EAAE,GAAG,MAAM;AACxB,WAAO,KAAK;AACZ,WAAO,KAAK;AACZ,WAAO;AAAA,EACT,CAAC;AACH;",
+  "sourcesContent": ["import type { AuthProvider, McpFetch, UnauthorizedContext } from '@earendil-works/pi-mcp';\nimport {\n  authorizeMcp,\n  discoverOAuthServerInfo,\n  McpOAuthAuthorizationRequiredError,\n  type McpOAuthState,\n  type OAuthChallenge,\n  parseWwwAuthenticate,\n  registerClient,\n  selectResource,\n  stepUpScope,\n} from '@earendil-works/pi-mcp/oauth';\nimport type { PlainStore } from '../secrets/store.ts';\nimport type { McpSignIn } from '../services.ts';\nimport type { McpServerConfig } from './config.ts';\nimport { credentialKey } from './credentials.ts';\n\ntype Provider = Parameters<typeof authorizeMcp>[0];\ntype Tokens = Awaited<ReturnType<Provider['tokens']>>;\ntype Client = Awaited<ReturnType<Provider['clientInformation']>>;\ntype Discovery = NonNullable<McpOAuthState['discovery']>;\n\nexport const CLIENT_NAME = 'SLICC';\n\nexport function sentence(text: string): string {\n  const trimmed = text.trim();\n  const lowered = /^[A-Z][a-z]/.test(trimmed)\n    ? `${trimmed[0]?.toLowerCase()}${trimmed.slice(1)}`\n    : trimmed;\n  return /[.!?]$/.test(lowered) ? lowered : `${lowered}.`;\n}\n\nconst LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);\n\nexport function secureUrl(url: URL): boolean {\n  return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.has(url.hostname));\n}\n\nexport function signInRequired(cause?: unknown): McpOAuthAuthorizationRequiredError {\n  const error = new McpOAuthAuthorizationRequiredError();\n  if (cause !== undefined) error.cause = cause;\n  return error;\n}\n\nexport function authProvider(provider: StoredOAuth, server: OAuthServer): AuthProvider {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  let inFlight: Promise<void> | undefined;\n  const authorize = async (\n    context: UnauthorizedContext,\n    step: boolean,\n    challenge: OAuthChallenge\n  ) => {\n    const granted = step ? await provider.tokens() : undefined;\n    try {\n      await authorizeMcp(provider, {\n        serverUrl: context.serverUrl,\n        ...(challenge.resourceMetadataUrl\n          ? { resourceMetadataUrl: challenge.resourceMetadataUrl }\n          : {}),\n        skipRefresh: true,\n        ...(step\n          ? { scope: stepUpScope(granted?.scope, challenge.scope) }\n          : challenge.scope\n            ? { scope: challenge.scope }\n            : {}),\n        ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n        fetch: context.fetch,\n      });\n    } catch (error) {\n      throw error instanceof McpOAuthAuthorizationRequiredError ? error : signInRequired(error);\n    }\n  };\n  return {\n    token: async () => (await provider.tokens())?.access_token,\n    async onUnauthorized(context) {\n      const challenge = parseWwwAuthenticate(context.response.headers.get('www-authenticate'));\n      const step = challenge.error === 'insufficient_scope';\n      if (!step && !inFlight && context.token !== undefined) {\n        const current = (await provider.tokens())?.access_token;\n        if (current !== undefined && current !== context.token) return;\n      }\n      inFlight ??= authorize(context, step, challenge).finally(() => {\n        inFlight = undefined;\n      });\n      await inFlight;\n    },\n  };\n}\n\nconst bytesToBase64Url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst random = (length: number) => crypto.getRandomValues(new Uint8Array(length));\n\nexport async function pkce(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = bytesToBase64Url(random(32));\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));\n  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };\n}\n\nexport function randomState(): string {\n  return [...random(32)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nexport interface OAuthServer {\n  name: string;\n  config: McpServerConfig;\n}\n\nexport class StoredOAuth implements Provider {\n  readonly redirectUrl: string;\n  readonly clientMetadata: Provider['clientMetadata'];\n  readonly #store: PlainStore;\n  readonly #server: OAuthServer;\n  #writes: Promise<unknown> = Promise.resolve();\n\n  constructor(server: OAuthServer, store: PlainStore, redirectUrl: string) {\n    this.#server = server;\n    this.#store = store;\n    this.redirectUrl = redirectUrl;\n    this.clientMetadata = {\n      client_name: server.config.oauth?.clientName ?? CLIENT_NAME,\n      redirect_uris: [redirectUrl],\n      grant_types: ['authorization_code', 'refresh_token'],\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n      ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    };\n  }\n\n  get serverUrl(): string {\n    return String(new URL(this.#server.config.url));\n  }\n\n  async #key(): Promise<string> {\n    return credentialKey(this.#server.name, this.#server.config.url);\n  }\n\n  async load(): Promise<McpOAuthState> {\n    await this.#writes;\n    const state = (await this.#store.get(await this.#key())) as McpOAuthState | undefined;\n    return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };\n  }\n\n  async update(change: (state: McpOAuthState) => McpOAuthState): Promise<void> {\n    const write = this.#writes.then(async () => {\n      const key = await this.#key();\n      const before = (await this.#store.get(key)) as McpOAuthState | undefined;\n      await this.#store.set(\n        key,\n        change(before?.serverUrl === this.serverUrl ? before : { serverUrl: this.serverUrl })\n      );\n    });\n    this.#writes = write.catch(() => undefined);\n    await write;\n  }\n\n  async signedIn(): Promise<boolean> {\n    return (await this.load()).tokens !== undefined;\n  }\n\n  state(): string {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async clientInformation(): Promise<Client> {\n    const configured = this.#server.config.oauth?.clientId;\n    return configured ? { client_id: configured } : (await this.load()).clientInformation;\n  }\n\n  async saveClientInformation(information: NonNullable<Client>): Promise<void> {\n    if (this.#server.config.oauth?.clientId) return;\n    await this.update((state) => ({ ...state, clientInformation: information }));\n  }\n\n  async tokens(): Promise<Tokens> {\n    return (await this.load()).tokens;\n  }\n\n  async saveTokens(tokens: NonNullable<Tokens>): Promise<void> {\n    const expires =\n      tokens.expires_in === undefined ? undefined : Date.now() + tokens.expires_in * 1000;\n    await this.update((state) => {\n      const next: McpOAuthState = { ...state, tokens };\n      if (expires === undefined) delete next.tokensExpireAt;\n      else next.tokensExpireAt = expires;\n      return next;\n    });\n  }\n\n  redirectToAuthorization(): void {\n    throw new McpOAuthAuthorizationRequiredError();\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.update((state) => ({ ...state, codeVerifier: verifier }));\n  }\n\n  async codeVerifier(): Promise<string> {\n    const verifier = (await this.load()).codeVerifier;\n    if (!verifier) throw new Error('No OAuth PKCE code verifier is stored');\n    return verifier;\n  }\n\n  async invalidateCredentials(\n    kind: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'\n  ): Promise<void> {\n    await this.update((state) => {\n      const next = { ...state };\n      if (kind === 'all' || kind === 'client') delete next.clientInformation;\n      if (kind === 'all' || kind === 'tokens') {\n        delete next.tokens;\n        delete next.tokensExpireAt;\n      }\n      if (kind === 'all' || kind === 'verifier') delete next.codeVerifier;\n      if (kind === 'all' || kind === 'discovery') delete next.discovery;\n      if (kind === 'all') delete next.oauthState;\n      return next;\n    });\n  }\n\n  async saveDiscoveryState(discovery: Discovery): Promise<void> {\n    await this.update((state) => ({ ...state, discovery }));\n  }\n\n  async discoveryState(): Promise<Discovery | undefined> {\n    return (await this.load()).discovery;\n  }\n\n  async forget(): Promise<void> {\n    await this.#writes;\n    await this.#store.set(await this.#key(), undefined);\n  }\n}\n\nexport type { McpSignIn } from '../services.ts';\n\nexport async function beginSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  options: { fetch: McpFetch; resourceMetadataUrl?: URL; register(tokenUrl: string): Promise<void> }\n): Promise<McpSignIn> {\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  const info = await discoverOAuthServerInfo(server.config.url, {\n    fetch: options.fetch,\n    ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n  });\n  if (!configured) await provider.saveDiscoveryState(info);\n  const metadata = info.authorizationServerMetadata;\n  if (metadata && !metadata.response_types_supported.includes('code'))\n    throw new Error(\"The authorization server doesn't support authorization codes.\");\n  if (\n    metadata?.code_challenge_methods_supported &&\n    !metadata.code_challenge_methods_supported.includes('S256')\n  )\n    throw new Error(\"The authorization server doesn't support PKCE S256.\");\n  const scope =\n    server.config.oauth?.scope || info.resourceMetadata?.scopes_supported?.join(' ') || undefined;\n  let client = await provider.clientInformation();\n  if (!client) {\n    client = await registerClient(info.authorizationServerUrl, {\n      ...(metadata ? { metadata } : {}),\n      clientMetadata: provider.clientMetadata,\n      ...(scope ? { scope } : {}),\n      fetch: options.fetch,\n    });\n    await provider.saveClientInformation(client);\n  }\n  await options.register(\n    new URL(metadata?.token_endpoint ?? new URL('/token', info.authorizationServerUrl)).href\n  );\n  const { verifier, challenge } = await pkce();\n  const state = randomState();\n  await provider.update((current) => ({ ...current, codeVerifier: verifier, oauthState: state }));\n  const url = new URL(\n    metadata?.authorization_endpoint ?? new URL('/authorize', info.authorizationServerUrl)\n  );\n  if (!secureUrl(url)) throw new Error(\"The authorization server's sign-in address isn't https.\");\n  url.searchParams.set('response_type', 'code');\n  url.searchParams.set('client_id', client.client_id);\n  url.searchParams.set('code_challenge', challenge);\n  url.searchParams.set('code_challenge_method', 'S256');\n  url.searchParams.set('redirect_uri', provider.redirectUrl);\n  url.searchParams.set('state', state);\n  if (scope) url.searchParams.set('scope', scope);\n  if (scope?.split(/\\s+/).includes('offline_access')) url.searchParams.set('prompt', 'consent');\n  const resource = selectResource(server.config.url, info.resourceMetadata);\n  if (resource) url.searchParams.set('resource', resource);\n  return { url: url.href, state };\n}\n\nexport interface Callback {\n  code?: string;\n  state?: string;\n  iss?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport async function finishSignIn(\n  provider: StoredOAuth,\n  server: OAuthServer,\n  answer: string,\n  fetch: McpFetch\n): Promise<void> {\n  let callback: Callback;\n  try {\n    callback = JSON.parse(answer) as Callback;\n  } catch {\n    throw new Error(\"The sign-in answer isn't a callback.\");\n  }\n  const expected = (await provider.load()).oauthState;\n  if (!expected || callback.state !== expected)\n    throw new Error(\"The sign-in answer doesn't match this sign-in. Try again.\");\n  if (callback.error)\n    throw new Error(\n      `Sign-in failed: ${sentence(callback.error_description?.trim() || callback.error)}`\n    );\n  if (!callback.code) throw new Error('The sign-in answer has no authorization code.');\n  const configured = server.config.oauth?.authServerMetadataUrl;\n  await authorizeMcp(provider, {\n    serverUrl: server.config.url,\n    authorizationCode: callback.code,\n    ...(callback.iss ? { iss: callback.iss } : {}),\n    ...(server.config.oauth?.scope ? { scope: server.config.oauth.scope } : {}),\n    ...(configured ? { authorizationServerMetadataUrl: new URL(configured) } : {}),\n    fetch,\n  });\n  await provider.update((state) => {\n    const next = { ...state };\n    delete next.oauthState;\n    delete next.codeVerifier;\n    return next;\n  });\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,qBAAqB;AAOvB,MAAM,cAAc;AAEpB,SAAS,SAAS,MAAsB;AAC7C,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,UAAU,cAAc,KAAK,OAAO,IACtC,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,KAC/C;AACJ,SAAO,SAAS,KAAK,OAAO,IAAI,UAAU,GAAG,OAAO;AACtD;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAErD,SAAS,UAAU,KAAmB;AAC3C,SAAO,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,SAAS,IAAI,IAAI,QAAQ;AAC5F;AAEO,SAAS,eAAe,OAAqD;AAClF,QAAM,QAAQ,IAAI,mCAAmC;AACrD,MAAI,UAAU,OAAW,OAAM,QAAQ;AACvC,SAAO;AACT;AAEO,SAAS,aAAa,UAAuB,QAAmC;AACrF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,MAAI;AACJ,QAAM,YAAY,OAChB,SACA,MACA,cACG;AACH,UAAM,UAAU,OAAO,MAAM,SAAS,OAAO,IAAI;AACjD,QAAI;AACF,YAAM,aAAa,UAAU;AAAA,QAC3B,WAAW,QAAQ;AAAA,QACnB,GAAI,UAAU,sBACV,EAAE,qBAAqB,UAAU,oBAAoB,IACrD,CAAC;AAAA,QACL,aAAa;AAAA,QACb,GAAI,OACA,EAAE,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK,EAAE,IACtD,UAAU,QACR,EAAE,OAAO,UAAU,MAAM,IACzB,CAAC;AAAA,QACP,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,QAC5E,OAAO,QAAQ;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,iBAAiB,qCAAqC,QAAQ,eAAe,KAAK;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,aAAa,MAAM,SAAS,OAAO,IAAI;AAAA,IAC9C,MAAM,eAAe,SAAS;AAC5B,YAAM,YAAY,qBAAqB,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,CAAC;AACvF,YAAM,OAAO,UAAU,UAAU;AACjC,UAAI,CAAC,QAAQ,CAAC,YAAY,QAAQ,UAAU,QAAW;AACrD,cAAM,WAAW,MAAM,SAAS,OAAO,IAAI;AAC3C,YAAI,YAAY,UAAa,YAAY,QAAQ,MAAO;AAAA,MAC1D;AACA,mBAAa,UAAU,SAAS,MAAM,SAAS,EAAE,QAAQ,MAAM;AAC7D,mBAAW;AAAA,MACb,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,MAAM,mBAAmB,CAAC,UACxB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAC/B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAEtB,MAAM,SAAS,CAAC,WAAmB,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAEhF,eAAsB,OAAyD;AAC7E,QAAM,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC5C,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,iBAAiB,IAAI,WAAW,MAAM,CAAC,EAAE;AACzE;AAEO,SAAS,cAAsB;AACpC,SAAO,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAClF;AAOO,MAAM,YAAgC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,UAA4B,QAAQ,QAAQ;AAAA,EAE5C,YAAY,QAAqB,OAAmB,aAAqB;AACvE,SAAK,UAAU;AACf,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,SAAK,iBAAiB;AAAA,MACpB,aAAa,OAAO,OAAO,OAAO,cAAc;AAAA,MAChD,eAAe,CAAC,WAAW;AAAA,MAC3B,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,GAAG,CAAC;AAAA,EAChD;AAAA,EAEA,MAAM,OAAwB;AAC5B,WAAO,cAAc,KAAK,QAAQ,MAAM,KAAK,QAAQ,OAAO,GAAG;AAAA,EACjE;AAAA,EAEA,MAAM,OAA+B;AACnC,UAAM,KAAK;AACX,UAAM,QAAS,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,CAAC;AACtD,WAAO,OAAO,cAAc,KAAK,YAAY,QAAQ,EAAE,WAAW,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,OAAO,QAAgE;AAC3E,UAAM,QAAQ,KAAK,QAAQ,KAAK,YAAY;AAC1C,YAAM,MAAM,MAAM,KAAK,KAAK;AAC5B,YAAM,SAAU,MAAM,KAAK,OAAO,IAAI,GAAG;AACzC,YAAM,KAAK,OAAO;AAAA,QAChB;AAAA,QACA,OAAO,QAAQ,cAAc,KAAK,YAAY,SAAS,EAAE,WAAW,KAAK,UAAU,CAAC;AAAA,MACtF;AAAA,IACF,CAAC;AACD,SAAK,UAAU,MAAM,MAAM,MAAM,MAAS;AAC1C,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,WAA6B;AACjC,YAAQ,MAAM,KAAK,KAAK,GAAG,WAAW;AAAA,EACxC;AAAA,EAEA,QAAgB;AACd,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,oBAAqC;AACzC,UAAM,aAAa,KAAK,QAAQ,OAAO,OAAO;AAC9C,WAAO,aAAa,EAAE,WAAW,WAAW,KAAK,MAAM,KAAK,KAAK,GAAG;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,aAAiD;AAC3E,QAAI,KAAK,QAAQ,OAAO,OAAO,SAAU;AACzC,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,mBAAmB,YAAY,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SAA0B;AAC9B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,UAAM,UACJ,OAAO,eAAe,SAAY,SAAY,KAAK,IAAI,IAAI,OAAO,aAAa;AACjF,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAsB,EAAE,GAAG,OAAO,OAAO;AAC/C,UAAI,YAAY,OAAW,QAAO,KAAK;AAAA,UAClC,MAAK,iBAAiB;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,0BAAgC;AAC9B,UAAM,IAAI,mCAAmC;AAAA,EAC/C;AAAA,EAEA,MAAM,iBAAiB,UAAiC;AACtD,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,cAAc,SAAS,EAAE;AAAA,EACrE;AAAA,EAEA,MAAM,eAAgC;AACpC,UAAM,YAAY,MAAM,KAAK,KAAK,GAAG;AACrC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uCAAuC;AACtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBACJ,MACe;AACf,UAAM,KAAK,OAAO,CAAC,UAAU;AAC3B,YAAM,OAAO,EAAE,GAAG,MAAM;AACxB,UAAI,SAAS,SAAS,SAAS,SAAU,QAAO,KAAK;AACrD,UAAI,SAAS,SAAS,SAAS,UAAU;AACvC,eAAO,KAAK;AACZ,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,SAAS,SAAS,WAAY,QAAO,KAAK;AACvD,UAAI,SAAS,SAAS,SAAS,YAAa,QAAO,KAAK;AACxD,UAAI,SAAS,MAAO,QAAO,KAAK;AAChC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,mBAAmB,WAAqC;AAC5D,UAAM,KAAK,OAAO,CAAC,WAAW,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,EACxD;AAAA,EAEA,MAAM,iBAAiD;AACrD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,MAAM,SAAwB;AAC5B,UAAM,KAAK;AACX,UAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,GAAG,MAAS;AAAA,EACpD;AACF;AAIA,eAAsB,YACpB,UACA,QACA,SACoB;AACpB,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,OAAO,MAAM,wBAAwB,OAAO,OAAO,KAAK;AAAA,IAC5D,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;AAAA,IAC1F,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,EAC9E,CAAC;AACD,MAAI,CAAC,WAAY,OAAM,SAAS,mBAAmB,IAAI;AACvD,QAAM,WAAW,KAAK;AACtB,MAAI,YAAY,CAAC,SAAS,yBAAyB,SAAS,MAAM;AAChE,UAAM,IAAI,MAAM,+DAA+D;AACjF,MACE,UAAU,oCACV,CAAC,SAAS,iCAAiC,SAAS,MAAM;AAE1D,UAAM,IAAI,MAAM,qDAAqD;AACvE,QAAM,QACJ,OAAO,OAAO,OAAO,SAAS,KAAK,kBAAkB,kBAAkB,KAAK,GAAG,KAAK;AACtF,MAAI,SAAS,MAAM,SAAS,kBAAkB;AAC9C,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,eAAe,KAAK,wBAAwB;AAAA,MACzD,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,gBAAgB,SAAS;AAAA,MACzB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,UAAM,SAAS,sBAAsB,MAAM;AAAA,EAC7C;AACA,QAAM,QAAQ;AAAA,IACZ,IAAI,IAAI,UAAU,kBAAkB,IAAI,IAAI,UAAU,KAAK,sBAAsB,CAAC,EAAE;AAAA,EACtF;AACA,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,KAAK;AAC3C,QAAM,QAAQ,YAAY;AAC1B,QAAM,SAAS,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,cAAc,UAAU,YAAY,MAAM,EAAE;AAC9F,QAAM,MAAM,IAAI;AAAA,IACd,UAAU,0BAA0B,IAAI,IAAI,cAAc,KAAK,sBAAsB;AAAA,EACvF;AACA,MAAI,CAAC,UAAU,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAC9F,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,OAAO,SAAS;AAClD,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,gBAAgB,SAAS,WAAW;AACzD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,MAAI,OAAO,MAAM,KAAK,EAAE,SAAS,gBAAgB,EAAG,KAAI,aAAa,IAAI,UAAU,SAAS;AAC5F,QAAM,WAAW,eAAe,OAAO,OAAO,KAAK,KAAK,gBAAgB;AACxE,MAAI,SAAU,KAAI,aAAa,IAAI,YAAY,QAAQ;AACvD,SAAO,EAAE,KAAK,IAAI,MAAM,MAAM;AAChC;AAUA,eAAsB,aACpB,UACA,QACA,QACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,MAAM;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,QAAM,YAAY,MAAM,SAAS,KAAK,GAAG;AACzC,MAAI,CAAC,YAAY,SAAS,UAAU;AAClC,UAAM,IAAI,MAAM,2DAA2D;AAC7E,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,SAAS,mBAAmB,KAAK,KAAK,SAAS,KAAK,CAAC;AAAA,IACnF;AACF,MAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,+CAA+C;AACnF,QAAM,aAAa,OAAO,OAAO,OAAO;AACxC,QAAM,aAAa,UAAU;AAAA,IAC3B,WAAW,OAAO,OAAO;AAAA,IACzB,mBAAmB,SAAS;AAAA,IAC5B,GAAI,SAAS,MAAM,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,OAAO,OAAO,QAAQ,EAAE,OAAO,OAAO,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IACzE,GAAI,aAAa,EAAE,gCAAgC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,CAAC,UAAU;AAC/B,UAAM,OAAO,EAAE,GAAG,MAAM;AACxB,WAAO,KAAK;AACZ,WAAO,KAAK;AACZ,WAAO;AAAA,EACT,CAAC;AACH;",
   "names": []
 }

package/dist/mcp/runtime.js

@@ -1,4 +1,5 @@
 import { StreamableHttpTransport } from "@earendil-works/pi-mcp";
+import { scrubText } from "../secrets/scrub.js";
 import { mcpAccounts } from "./accounts.js";
 import { McpCatalog } from "./catalog.js";
 import {
@@ -7,7 +8,7 @@ import {
   usesOAuth
 } from "./config.js";
 import { McpServerConnection } from "./connection.js";
-import { resolveHeaders, scrub, secretNames } from "./credentials.js";
+import { resolveHeaders, secretNames } from "./credentials.js";
 import { authProvider as oauthAuth, StoredOAuth } from "./oauth.js";
 import { configPath, logPath, shown } from "./paths.js";
 import { patchSse } from "./sse.js";
@@ -54,7 +55,7 @@ ${connection.missing.join(",")}`
 auth`
     };
   if (connection.state !== "failed") return void 0;
-  const error = scrub(connection.error ?? "unknown error", connection.secrets);
+  const error = connection.error ?? "unknown error";
   const blocked = cors && CORS_ERROR.test(error);
   return {
     ...base,
@@ -79,9 +80,9 @@ connected
 ${connection.entry.config.url}`
   };
 }
-function logLine(server, params, secrets, at) {
+function logLine(server, params, at) {
   const { level, logger, data } = params ?? {};
-  const text = scrub(typeof data === "string" ? data : JSON.stringify(data) ?? "", secrets);
+  const text = typeof data === "string" ? data : JSON.stringify(data) ?? "";
   return `${at.toISOString()} [${server}] ${level ?? "info"}${logger ? ` ${logger}` : ""}: ${text}
 `;
 }
@@ -91,8 +92,9 @@ function serverLog(options, context) {
   const { env } = options;
   return {
     write(connection, params) {
-      const line = logLine(connection.name, params, connection.secrets, /* @__PURE__ */ new Date());
+      const text = logLine(connection.name, params, /* @__PURE__ */ new Date());
       logging = logging.then(async () => {
+        const line = await scrubText(text);
         const info = await env.fileInfo(path, context);
         if (info.ok && info.value.size > MCP_LOG_MAX_BYTES)
           await env.renameFile(path, `${path}.1`, context);
@@ -118,22 +120,30 @@ async function attachMcp(catalog, options, context) {
   let initial = /* @__PURE__ */ new Set();
   let first = true;
   const log = serverLog(options, context);
-  const fetcher = (input, init) => options.fetch(input, init);
-  const oauth = (entry) => new StoredOAuth(entry, options.credentials, options.redirect);
+  const { vault } = options;
+  const base = (input, init) => options.fetch(input, init);
+  const fetcher = (server) => vault.fetch(server, base);
+  const oauth = (entry) => new StoredOAuth(entry, options.store, options.redirect);
   const transport = async (entry) => {
-    const resolved = await resolveHeaders(entry.name, entry.config, options.credentials);
+    const resolved = resolveHeaders(entry.name, entry.config, vault.records);
     if (!resolved.ok) return { missing: resolved.missing };
     const authProvider = usesOAuth(entry.config) ? oauthAuth(oauth(entry), entry) : void 0;
     return {
       transport: new StreamableHttpTransport({
         url: entry.config.url,
         headers: resolved.headers,
-        fetch: fetcher,
+        fetch: fetcher(entry.name),
         ...authProvider ? { authProvider } : {}
-      }),
-      secrets: resolved.secrets
+      })
     };
   };
+  const register = (entries) => vault.servers(
+    [...entries].map((entry) => ({
+      server: entry.name,
+      url: entry.config.url,
+      names: secretNames(entry.config)
+    }))
+  ).catch(() => void 0);
   const open = (entry) => {
     const connection = new McpServerConnection({
       entry,
@@ -170,6 +180,7 @@ async function attachMcp(catalog, options, context) {
     }
     if (first) initial = new Set(wanted.keys());
     first = false;
+    void register(wanted.values());
     for (const [name, entry] of wanted) if (!catalog.connections.has(name)) open(entry);
     catalog.rebuild();
     notify();
@@ -192,10 +203,21 @@ async function attachMcp(catalog, options, context) {
     void connection.close();
     catalog.rebuild();
   };
+  const stopRecords = vault.records.state.subscribe(() => {
+    for (const connection of [...catalog.connections.values()])
+      if (connection.state === "needs-secret") restart(connection);
+    notify();
+  });
   return {
     ...mcpAccounts(
       catalog,
-      { credentials: options.credentials, oauth, fetch: fetcher },
+      {
+        records: vault.records,
+        oauth,
+        fetch: fetcher,
+        grant: (server) => vault.grant(server, fetcher(server)),
+        register: (server, url) => vault.token(server, url)
+      },
       restart,
       listeners
     ),
@@ -203,12 +225,12 @@ async function attachMcp(catalog, options, context) {
       name: connection.name,
       state: connection.state,
       tools: connection.tools.length,
-      ...connection.error ? { error: scrub(connection.error, connection.secrets) } : {}
+      ...connection.error ? { error: connection.error } : {}
     })),
-    secrets: () => [...catalog.connections.values()].flatMap((connection) => connection.secrets),
     reload,
     async close(using) {
       clearTimeout(timer);
+      stopRecords();
       await watcher?.close(using);
       const all = [...catalog.connections.values()];
       catalog.connections.clear();

package/dist/mcp/runtime.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/runtime.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type { CredentialStore } from '@earendil-works/pi-ai';\nimport type { Registry } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport { StreamableHttpTransport } from '@earendil-works/pi-mcp';\nimport type { LickEvent, Licks } from '../licks/licks.ts';\nimport { type McpAccounts, mcpAccounts } from './accounts.ts';\nimport { McpCatalog } from './catalog.ts';\nimport {\n  type McpConfigProblem,\n  type McpServerEntry,\n  parseMcpConfig,\n  sameConfig,\n  usesOAuth,\n} from './config.ts';\nimport { McpServerConnection } from './connection.ts';\nimport { resolveHeaders, scrub, secretNames } from './credentials.ts';\nimport { authProvider as oauthAuth, StoredOAuth } from './oauth.ts';\nimport { configPath, logPath, shown } from './paths.ts';\nimport { patchSse } from './sse.ts';\n\nexport const MCP_LOG_MAX_BYTES = 5 * 1024 * 1024;\n\nexport { configPath, logPath, shown } from './paths.ts';\n\nexport interface McpAttach {\n  licks: Licks;\n  env: ExecutionEnv;\n  home: string;\n  agentDir?: string;\n  credentials: CredentialStore;\n  fetch: typeof fetch;\n  version: string;\n  reloadMs: number;\n  codemode: boolean;\n  cors: boolean;\n  redirect: string;\n}\n\nexport interface ServerStatus {\n  name: string;\n  state: string;\n  tools: number;\n  error?: string;\n}\n\nexport type { McpAccounts } from './accounts.ts';\n\nexport interface McpRuntime extends McpAccounts {\n  status(): ServerStatus[];\n  secrets(): string[];\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport function problemLick(problem: McpConfigProblem, home: string, dir?: string): LickEvent {\n  const file = shown(configPath(home, dir), home);\n  const where = problem.server ? `server \"${problem.server}\"` : file;\n  const field = problem.field ? `, field ${problem.field}` : '';\n  return {\n    channel: 'fswatch',\n    source: `mcp:${file}`,\n    title: `MCP config problem: ${where}${field}`,\n    text: problem.message,\n    body: `${file}: the entry is skipped until it is fixed. The format is in the slicc-agent README.`,\n    target: 'cone',\n    severity: 'warn',\n    eventId: `${problem.server ?? ''}\\n${problem.field ?? ''}\\n${problem.message}`,\n  };\n}\n\nconst CORS_ERROR = /failed to fetch|networkerror|load failed|cors/i;\n\nexport function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined {\n  const name = connection.name;\n  const base = { channel: 'fswatch' as const, source: `mcp:${name}`, target: 'cone' as const };\n  if (connection.state === 'needs-secret')\n    return {\n      ...base,\n      title: `MCP server \"${name}\" needs a token`,\n      text: `Its headers use ${connection.missing.map((item) => `\\${${item}}`).join(', ')}. Add the value in Settings \u203A MCP servers.`,\n      severity: 'warn',\n      eventId: `${name}\\nsecret\\n${connection.missing.join(',')}`,\n    };\n  if (connection.state === 'needs-auth')\n    return {\n      ...base,\n      title: secretNames(connection.entry.config).length\n        ? `MCP server \"${name}\" rejected its token`\n        : `MCP server \"${name}\" needs sign-in`,\n      text: connection.signInMessage(),\n      severity: 'warn',\n      eventId: `${name}\\nauth`,\n    };\n  if (connection.state !== 'failed') return undefined;\n  const error = scrub(connection.error ?? 'unknown error', connection.secrets);\n  const blocked = cors && CORS_ERROR.test(error);\n  return {\n    ...base,\n    title: `MCP server \"${name}\" can't connect`,\n    text: blocked\n      ? \"Seven reaches it with the page's own fetch, and the server sends no CORS headers. Link the `slicc` CLI or connect the SLICC extension; either fetches without CORS.\"\n      : error,\n    severity: 'warn',\n    eventId: `${name}\\nfailed\\n${blocked ? 'cors' : error}`,\n  };\n}\n\nexport function connectedLick(connection: McpServerConnection): LickEvent {\n  const count = connection.tools.length;\n  return {\n    channel: 'fswatch',\n    source: `mcp:${connection.name}`,\n    title: `MCP server \"${connection.name}\" connected`,\n    text: `${connection.entry.config.url} offers ${count} tool${count === 1 ? '' : 's'}.`,\n    target: 'cone',\n    eventId: `${connection.name}\\nconnected\\n${connection.entry.config.url}`,\n  };\n}\n\nexport function logLine(\n  server: string,\n  params: unknown,\n  secrets: readonly string[],\n  at: Date\n): string {\n  const { level, logger, data } = (params ?? {}) as {\n    level?: string;\n    logger?: string;\n    data?: unknown;\n  };\n  const text = scrub(typeof data === 'string' ? data : (JSON.stringify(data) ?? ''), secrets);\n  return `${at.toISOString()} [${server}] ${level ?? 'info'}${logger ? ` ${logger}` : ''}: ${text}\\n`;\n}\n\nfunction serverLog(options: McpAttach, context: Context) {\n  let logging = Promise.resolve();\n  const path = logPath(options.home, options.agentDir);\n  const { env } = options;\n  return {\n    write(connection: McpServerConnection, params: unknown) {\n      const line = logLine(connection.name, params, connection.secrets, new Date());\n      logging = logging.then(async () => {\n        const info = await env.fileInfo(path, context);\n        if (info.ok && info.value.size > MCP_LOG_MAX_BYTES)\n          await env.renameFile(path, `${path}.1`, context);\n        await env.appendFile(path, line, context);\n      });\n    },\n    settled: () => logging,\n  };\n}\n\nexport async function attachMcp(\n  catalog: McpCatalog,\n  options: McpAttach,\n  context: Context\n): Promise<McpRuntime> {\n  const { env, home } = options;\n  catalog.codemodeOn = options.codemode;\n  const reported = new Set<string>();\n  const report = async (lick: LickEvent | undefined, using: Context) => {\n    if (!lick?.eventId || reported.has(lick.eventId)) return;\n    reported.add(lick.eventId);\n    await options.licks.deliver(lick, using).catch(() => undefined);\n  };\n  const listeners = new Set<() => void>();\n  const notify = () => {\n    for (const listener of listeners) listener();\n  };\n  let initial: Set<string> = new Set();\n  let first = true;\n  const log = serverLog(options, context);\n  const fetcher = (input: string | URL, init?: RequestInit) => options.fetch(input, init);\n  const oauth = (entry: McpServerEntry) =>\n    new StoredOAuth(entry, options.credentials, options.redirect);\n  const transport = async (entry: McpServerEntry) => {\n    const resolved = await resolveHeaders(entry.name, entry.config, options.credentials);\n    if (!resolved.ok) return { missing: resolved.missing };\n    const authProvider = usesOAuth(entry.config) ? oauthAuth(oauth(entry), entry) : undefined;\n    return {\n      transport: new StreamableHttpTransport({\n        url: entry.config.url,\n        headers: resolved.headers,\n        fetch: fetcher,\n        ...(authProvider ? { authProvider } : {}),\n      }),\n      secrets: resolved.secrets,\n    };\n  };\n  const open = (entry: McpServerEntry) => {\n    const connection = new McpServerConnection({\n      entry,\n      version: options.version,\n      transport,\n      onTools: () => catalog.rebuild(),\n      onLog: log.write,\n      onChange: (changed) => {\n        if (catalog.connections.get(changed.name) !== changed) return;\n        if (changed.state === 'connected' && !initial.has(changed.name))\n          void report(connectedLick(changed), context);\n        void report(stateLick(changed, options.cors), context);\n        if (changed.state !== 'connected') catalog.rebuild();\n        notify();\n      },\n    });\n    catalog.connections.set(entry.name, connection);\n    void connection.getClient().catch(() => undefined);\n  };\n  const reload = async (using: Context) => {\n    const read = await env.readTextFile(configPath(home, options.agentDir), using);\n    const parsed = parseMcpConfig(read.ok ? read.value : undefined);\n    for (const problem of parsed.problems)\n      await report(problemLick(problem, home, options.agentDir), using);\n    const wanted = new Map(\n      parsed.servers\n        .filter((entry) => entry.config.enabled !== false)\n        .map((entry) => [entry.name, entry])\n    );\n    const closing: Promise<void>[] = [];\n    for (const [name, connection] of [...catalog.connections]) {\n      const next = wanted.get(name);\n      if (next && sameConfig(next.config, connection.entry.config)) continue;\n      catalog.connections.delete(name);\n      closing.push(connection.close());\n    }\n    if (first) initial = new Set(wanted.keys());\n    first = false;\n    for (const [name, entry] of wanted) if (!catalog.connections.has(name)) open(entry);\n    catalog.rebuild();\n    notify();\n    await Promise.all(closing);\n  };\n  await reload(context);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const watched = await env.watch(\n    [{ path: configPath(home, options.agentDir) }],\n    schedule,\n    context\n  );\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  const restart = (connection: McpServerConnection) => {\n    open(connection.entry);\n    void connection.close();\n    catalog.rebuild();\n  };\n  return {\n    ...mcpAccounts(\n      catalog,\n      { credentials: options.credentials, oauth, fetch: fetcher },\n      restart,\n      listeners\n    ),\n    status: () =>\n      [...catalog.connections.values()].map((connection) => ({\n        name: connection.name,\n        state: connection.state,\n        tools: connection.tools.length,\n        ...(connection.error ? { error: scrub(connection.error, connection.secrets) } : {}),\n      })),\n    secrets: () => [...catalog.connections.values()].flatMap((connection) => connection.secrets),\n    reload,\n    async close(using) {\n      clearTimeout(timer);\n      await watcher?.close(using);\n      const all = [...catalog.connections.values()];\n      catalog.connections.clear();\n      await Promise.all(all.map((connection) => connection.close()));\n      catalog.rebuild();\n      await log.settled();\n    },\n  };\n}\n\nexport async function startMcp(\n  registry: Registry,\n  options: McpAttach,\n  context: Context\n): Promise<{ catalog: McpCatalog; runtime: McpRuntime }> {\n  patchSse();\n  const catalog = new McpCatalog(registry);\n  return { catalog, runtime: await attachMcp(catalog, options, context) };\n}\n"],
-  "mappings": "AAIA,SAAS,+BAA+B;AAExC,SAA2B,mBAAmB;AAC9C,SAAS,kBAAkB;AAC3B;AAAA,EAGE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,gBAAgB,OAAO,mBAAmB;AACnD,SAAS,gBAAgB,WAAW,mBAAmB;AACvD,SAAS,YAAY,SAAS,aAAa;AAC3C,SAAS,gBAAgB;AAElB,MAAM,oBAAoB,IAAI,OAAO;AAE5C,SAAS,cAAAA,aAAY,WAAAC,UAAS,SAAAC,cAAa;AAgCpC,SAAS,YAAY,SAA2B,MAAc,KAAyB;AAC5F,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,GAAG,IAAI;AAC9C,QAAM,QAAQ,QAAQ,SAAS,WAAW,QAAQ,MAAM,MAAM;AAC9D,QAAM,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,KAAK,KAAK;AAC3D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,IAAI;AAAA,IACnB,OAAO,uBAAuB,KAAK,GAAG,KAAK;AAAA,IAC3C,MAAM,QAAQ;AAAA,IACd,MAAM,GAAG,IAAI;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS,GAAG,QAAQ,UAAU,EAAE;AAAA,EAAK,QAAQ,SAAS,EAAE;AAAA,EAAK,QAAQ,OAAO;AAAA,EAC9E;AACF;AAEA,MAAM,aAAa;AAEZ,SAAS,UAAU,YAAiC,MAAsC;AAC/F,QAAM,OAAO,WAAW;AACxB,QAAM,OAAO,EAAE,SAAS,WAAoB,QAAQ,OAAO,IAAI,IAAI,QAAQ,OAAgB;AAC3F,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,eAAe,IAAI;AAAA,MAC1B,MAAM,mBAAmB,WAAW,QAAQ,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MACnF,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,WAAW,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC3D;AACF,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SACxC,eAAe,IAAI,yBACnB,eAAe,IAAI;AAAA,MACvB,MAAM,WAAW,cAAc;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,IAClB;AACF,MAAI,WAAW,UAAU,SAAU,QAAO;AAC1C,QAAM,QAAQ,MAAM,WAAW,SAAS,iBAAiB,WAAW,OAAO;AAC3E,QAAM,UAAU,QAAQ,WAAW,KAAK,KAAK;AAC7C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,eAAe,IAAI;AAAA,IAC1B,MAAM,UACF,wKACA;AAAA,IACJ,UAAU;AAAA,IACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,UAAU,SAAS,KAAK;AAAA,EACvD;AACF;AAEO,SAAS,cAAc,YAA4C;AACxE,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,WAAW,IAAI;AAAA,IAC9B,OAAO,eAAe,WAAW,IAAI;AAAA,IACrC,MAAM,GAAG,WAAW,MAAM,OAAO,GAAG,WAAW,KAAK,QAAQ,UAAU,IAAI,KAAK,GAAG;AAAA,IAClF,QAAQ;AAAA,IACR,SAAS,GAAG,WAAW,IAAI;AAAA;AAAA,EAAgB,WAAW,MAAM,OAAO,GAAG;AAAA,EACxE;AACF;AAEO,SAAS,QACd,QACA,QACA,SACA,IACQ;AACR,QAAM,EAAE,OAAO,QAAQ,KAAK,IAAK,UAAU,CAAC;AAK5C,QAAM,OAAO,MAAM,OAAO,SAAS,WAAW,OAAQ,KAAK,UAAU,IAAI,KAAK,IAAK,OAAO;AAC1F,SAAO,GAAG,GAAG,YAAY,CAAC,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG,SAAS,IAAI,MAAM,KAAK,EAAE,KAAK,IAAI;AAAA;AACjG;AAEA,SAAS,UAAU,SAAoB,SAAkB;AACvD,MAAI,UAAU,QAAQ,QAAQ;AAC9B,QAAM,OAAO,QAAQ,QAAQ,MAAM,QAAQ,QAAQ;AACnD,QAAM,EAAE,IAAI,IAAI;AAChB,SAAO;AAAA,IACL,MAAM,YAAiC,QAAiB;AACtD,YAAM,OAAO,QAAQ,WAAW,MAAM,QAAQ,WAAW,SAAS,oBAAI,KAAK,CAAC;AAC5E,gBAAU,QAAQ,KAAK,YAAY;AACjC,cAAM,OAAO,MAAM,IAAI,SAAS,MAAM,OAAO;AAC7C,YAAI,KAAK,MAAM,KAAK,MAAM,OAAO;AAC/B,gBAAM,IAAI,WAAW,MAAM,GAAG,IAAI,MAAM,OAAO;AACjD,cAAM,IAAI,WAAW,MAAM,MAAM,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEA,eAAsB,UACpB,SACA,SACA,SACqB;AACrB,QAAM,EAAE,KAAK,KAAK,IAAI;AACtB,UAAQ,aAAa,QAAQ;AAC7B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,SAAS,OAAO,MAA6B,UAAmB;AACpE,QAAI,CAAC,MAAM,WAAW,SAAS,IAAI,KAAK,OAAO,EAAG;AAClD,aAAS,IAAI,KAAK,OAAO;AACzB,UAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EAChE;AACA,QAAM,YAAY,oBAAI,IAAgB;AACtC,QAAM,SAAS,MAAM;AACnB,eAAW,YAAY,UAAW,UAAS;AAAA,EAC7C;AACA,MAAI,UAAuB,oBAAI,IAAI;AACnC,MAAI,QAAQ;AACZ,QAAM,MAAM,UAAU,SAAS,OAAO;AACtC,QAAM,UAAU,CAAC,OAAqB,SAAuB,QAAQ,MAAM,OAAO,IAAI;AACtF,QAAM,QAAQ,CAAC,UACb,IAAI,YAAY,OAAO,QAAQ,aAAa,QAAQ,QAAQ;AAC9D,QAAM,YAAY,OAAO,UAA0B;AACjD,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,MAAM,QAAQ,QAAQ,WAAW;AACnF,QAAI,CAAC,SAAS,GAAI,QAAO,EAAE,SAAS,SAAS,QAAQ;AACrD,UAAM,eAAe,UAAU,MAAM,MAAM,IAAI,UAAU,MAAM,KAAK,GAAG,KAAK,IAAI;AAChF,WAAO;AAAA,MACL,WAAW,IAAI,wBAAwB;AAAA,QACrC,KAAK,MAAM,OAAO;AAAA,QAClB,SAAS,SAAS;AAAA,QAClB,OAAO;AAAA,QACP,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,MACzC,CAAC;AAAA,MACD,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AACA,QAAM,OAAO,CAAC,UAA0B;AACtC,UAAM,aAAa,IAAI,oBAAoB;AAAA,MACzC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAO,IAAI;AAAA,MACX,UAAU,CAAC,YAAY;AACrB,YAAI,QAAQ,YAAY,IAAI,QAAQ,IAAI,MAAM,QAAS;AACvD,YAAI,QAAQ,UAAU,eAAe,CAAC,QAAQ,IAAI,QAAQ,IAAI;AAC5D,eAAK,OAAO,cAAc,OAAO,GAAG,OAAO;AAC7C,aAAK,OAAO,UAAU,SAAS,QAAQ,IAAI,GAAG,OAAO;AACrD,YAAI,QAAQ,UAAU,YAAa,SAAQ,QAAQ;AACnD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,IAAI,MAAM,MAAM,UAAU;AAC9C,SAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACA,QAAM,SAAS,OAAO,UAAmB;AACvC,UAAM,OAAO,MAAM,IAAI,aAAa,WAAW,MAAM,QAAQ,QAAQ,GAAG,KAAK;AAC7E,UAAM,SAAS,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS;AAC9D,eAAW,WAAW,OAAO;AAC3B,YAAM,OAAO,YAAY,SAAS,MAAM,QAAQ,QAAQ,GAAG,KAAK;AAClE,UAAM,SAAS,IAAI;AAAA,MACjB,OAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,YAAY,KAAK,EAChD,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,IACvC;AACA,UAAM,UAA2B,CAAC;AAClC,eAAW,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,QAAQ,WAAW,GAAG;AACzD,YAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,MAAM,EAAG;AAC9D,cAAQ,YAAY,OAAO,IAAI;AAC/B,cAAQ,KAAK,WAAW,MAAM,CAAC;AAAA,IACjC;AACA,QAAI,MAAO,WAAU,IAAI,IAAI,OAAO,KAAK,CAAC;AAC1C,YAAQ;AACR,eAAW,CAAC,MAAM,KAAK,KAAK,OAAQ,KAAI,CAAC,QAAQ,YAAY,IAAI,IAAI,EAAG,MAAK,KAAK;AAClF,YAAQ,QAAQ;AAChB,WAAO;AACP,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AACA,QAAM,OAAO,OAAO;AACpB,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,UAAU,MAAM,IAAI;AAAA,IACxB,CAAC,EAAE,MAAM,WAAW,MAAM,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC7C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,QAAM,UAAU,CAAC,eAAoC;AACnD,SAAK,WAAW,KAAK;AACrB,SAAK,WAAW,MAAM;AACtB,YAAQ,QAAQ;AAAA,EAClB;AACA,SAAO;AAAA,IACL,GAAG;AAAA,MACD;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,OAAO,OAAO,QAAQ;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ,MACN,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACrD,MAAM,WAAW;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,WAAW,MAAM;AAAA,MACxB,GAAI,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,OAAO,WAAW,OAAO,EAAE,IAAI,CAAC;AAAA,IACnF,EAAE;AAAA,IACJ,SAAS,MAAM,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAAE,QAAQ,CAAC,eAAe,WAAW,OAAO;AAAA,IAC3F;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,mBAAa,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,MAAM,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC;AAC5C,cAAQ,YAAY,MAAM;AAC1B,YAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC;AAC7D,cAAQ,QAAQ;AAChB,YAAM,IAAI,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UACA,SACA,SACuD;AACvD,WAAS;AACT,QAAM,UAAU,IAAI,WAAW,QAAQ;AACvC,SAAO,EAAE,SAAS,SAAS,MAAM,UAAU,SAAS,SAAS,OAAO,EAAE;AACxE;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type { Registry } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport { StreamableHttpTransport } from '@earendil-works/pi-mcp';\nimport type { LickEvent, Licks } from '../licks/licks.ts';\nimport type { McpServerSource } from '../secrets/endpoints.ts';\nimport { scrubText } from '../secrets/scrub.ts';\nimport type { PlainStore } from '../secrets/store.ts';\nimport { type McpAccounts, mcpAccounts } from './accounts.ts';\nimport { McpCatalog } from './catalog.ts';\nimport {\n  type McpConfigProblem,\n  type McpServerEntry,\n  parseMcpConfig,\n  sameConfig,\n  usesOAuth,\n} from './config.ts';\nimport { McpServerConnection } from './connection.ts';\nimport { type McpRecords, resolveHeaders, secretNames } from './credentials.ts';\nimport { authProvider as oauthAuth, StoredOAuth } from './oauth.ts';\nimport { configPath, logPath, shown } from './paths.ts';\nimport { patchSse } from './sse.ts';\n\nexport const MCP_LOG_MAX_BYTES = 5 * 1024 * 1024;\n\nexport { configPath, logPath, shown } from './paths.ts';\n\nexport interface McpVault {\n  records: McpRecords & {\n    refresh(context: Context): Promise<void>;\n    state: { subscribe(listener: () => void): () => void };\n  };\n  fetch(server: string, base: typeof fetch): typeof fetch;\n  grant(server: string, base: typeof fetch): typeof fetch;\n  servers(list: readonly McpServerSource[]): Promise<void>;\n  token(server: string, url: string): Promise<void>;\n}\n\nexport interface McpAttach {\n  licks: Licks;\n  env: ExecutionEnv;\n  home: string;\n  agentDir?: string;\n  store: PlainStore;\n  vault: McpVault;\n  fetch: typeof fetch;\n  version: string;\n  reloadMs: number;\n  codemode: boolean;\n  cors: boolean;\n  redirect: string;\n}\n\nexport interface ServerStatus {\n  name: string;\n  state: string;\n  tools: number;\n  error?: string;\n}\n\nexport type { McpAccounts } from './accounts.ts';\n\nexport interface McpRuntime extends McpAccounts {\n  status(): ServerStatus[];\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport function problemLick(problem: McpConfigProblem, home: string, dir?: string): LickEvent {\n  const file = shown(configPath(home, dir), home);\n  const where = problem.server ? `server \"${problem.server}\"` : file;\n  const field = problem.field ? `, field ${problem.field}` : '';\n  return {\n    channel: 'fswatch',\n    source: `mcp:${file}`,\n    title: `MCP config problem: ${where}${field}`,\n    text: problem.message,\n    body: `${file}: the entry is skipped until it is fixed. The format is in the slicc-agent README.`,\n    target: 'cone',\n    severity: 'warn',\n    eventId: `${problem.server ?? ''}\\n${problem.field ?? ''}\\n${problem.message}`,\n  };\n}\n\nconst CORS_ERROR = /failed to fetch|networkerror|load failed|cors/i;\n\nexport function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined {\n  const name = connection.name;\n  const base = { channel: 'fswatch' as const, source: `mcp:${name}`, target: 'cone' as const };\n  if (connection.state === 'needs-secret')\n    return {\n      ...base,\n      title: `MCP server \"${name}\" needs a token`,\n      text: `Its headers use ${connection.missing.map((item) => `\\${${item}}`).join(', ')}. Add the value in Settings \u203A MCP servers.`,\n      severity: 'warn',\n      eventId: `${name}\\nsecret\\n${connection.missing.join(',')}`,\n    };\n  if (connection.state === 'needs-auth')\n    return {\n      ...base,\n      title: secretNames(connection.entry.config).length\n        ? `MCP server \"${name}\" rejected its token`\n        : `MCP server \"${name}\" needs sign-in`,\n      text: connection.signInMessage(),\n      severity: 'warn',\n      eventId: `${name}\\nauth`,\n    };\n  if (connection.state !== 'failed') return undefined;\n  const error = connection.error ?? 'unknown error';\n  const blocked = cors && CORS_ERROR.test(error);\n  return {\n    ...base,\n    title: `MCP server \"${name}\" can't connect`,\n    text: blocked\n      ? \"Seven reaches it with the page's own fetch, and the server sends no CORS headers. Link the `slicc` CLI or connect the SLICC extension; either fetches without CORS.\"\n      : error,\n    severity: 'warn',\n    eventId: `${name}\\nfailed\\n${blocked ? 'cors' : error}`,\n  };\n}\n\nexport function connectedLick(connection: McpServerConnection): LickEvent {\n  const count = connection.tools.length;\n  return {\n    channel: 'fswatch',\n    source: `mcp:${connection.name}`,\n    title: `MCP server \"${connection.name}\" connected`,\n    text: `${connection.entry.config.url} offers ${count} tool${count === 1 ? '' : 's'}.`,\n    target: 'cone',\n    eventId: `${connection.name}\\nconnected\\n${connection.entry.config.url}`,\n  };\n}\n\nexport function logLine(server: string, params: unknown, at: Date): string {\n  const { level, logger, data } = (params ?? {}) as {\n    level?: string;\n    logger?: string;\n    data?: unknown;\n  };\n  const text = typeof data === 'string' ? data : (JSON.stringify(data) ?? '');\n  return `${at.toISOString()} [${server}] ${level ?? 'info'}${logger ? ` ${logger}` : ''}: ${text}\\n`;\n}\n\nfunction serverLog(options: McpAttach, context: Context) {\n  let logging = Promise.resolve();\n  const path = logPath(options.home, options.agentDir);\n  const { env } = options;\n  return {\n    write(connection: McpServerConnection, params: unknown) {\n      const text = logLine(connection.name, params, new Date());\n      logging = logging.then(async () => {\n        const line = await scrubText(text);\n        const info = await env.fileInfo(path, context);\n        if (info.ok && info.value.size > MCP_LOG_MAX_BYTES)\n          await env.renameFile(path, `${path}.1`, context);\n        await env.appendFile(path, line, context);\n      });\n    },\n    settled: () => logging,\n  };\n}\n\nexport async function attachMcp(\n  catalog: McpCatalog,\n  options: McpAttach,\n  context: Context\n): Promise<McpRuntime> {\n  const { env, home } = options;\n  catalog.codemodeOn = options.codemode;\n  const reported = new Set<string>();\n  const report = async (lick: LickEvent | undefined, using: Context) => {\n    if (!lick?.eventId || reported.has(lick.eventId)) return;\n    reported.add(lick.eventId);\n    await options.licks.deliver(lick, using).catch(() => undefined);\n  };\n  const listeners = new Set<() => void>();\n  const notify = () => {\n    for (const listener of listeners) listener();\n  };\n  let initial: Set<string> = new Set();\n  let first = true;\n  const log = serverLog(options, context);\n  const { vault } = options;\n  const base = (input: string | URL | Request, init?: RequestInit) => options.fetch(input, init);\n  const fetcher = (server: string) => vault.fetch(server, base);\n  const oauth = (entry: McpServerEntry) => new StoredOAuth(entry, options.store, options.redirect);\n  const transport = async (entry: McpServerEntry) => {\n    const resolved = resolveHeaders(entry.name, entry.config, vault.records);\n    if (!resolved.ok) return { missing: resolved.missing };\n    const authProvider = usesOAuth(entry.config) ? oauthAuth(oauth(entry), entry) : undefined;\n    return {\n      transport: new StreamableHttpTransport({\n        url: entry.config.url,\n        headers: resolved.headers,\n        fetch: fetcher(entry.name),\n        ...(authProvider ? { authProvider } : {}),\n      }),\n    };\n  };\n  const register = (entries: Iterable<McpServerEntry>) =>\n    vault\n      .servers(\n        [...entries].map((entry) => ({\n          server: entry.name,\n          url: entry.config.url,\n          names: secretNames(entry.config),\n        }))\n      )\n      .catch(() => undefined);\n  const open = (entry: McpServerEntry) => {\n    const connection = new McpServerConnection({\n      entry,\n      version: options.version,\n      transport,\n      onTools: () => catalog.rebuild(),\n      onLog: log.write,\n      onChange: (changed) => {\n        if (catalog.connections.get(changed.name) !== changed) return;\n        if (changed.state === 'connected' && !initial.has(changed.name))\n          void report(connectedLick(changed), context);\n        void report(stateLick(changed, options.cors), context);\n        if (changed.state !== 'connected') catalog.rebuild();\n        notify();\n      },\n    });\n    catalog.connections.set(entry.name, connection);\n    void connection.getClient().catch(() => undefined);\n  };\n  const reload = async (using: Context) => {\n    const read = await env.readTextFile(configPath(home, options.agentDir), using);\n    const parsed = parseMcpConfig(read.ok ? read.value : undefined);\n    for (const problem of parsed.problems)\n      await report(problemLick(problem, home, options.agentDir), using);\n    const wanted = new Map(\n      parsed.servers\n        .filter((entry) => entry.config.enabled !== false)\n        .map((entry) => [entry.name, entry])\n    );\n    const closing: Promise<void>[] = [];\n    for (const [name, connection] of [...catalog.connections]) {\n      const next = wanted.get(name);\n      if (next && sameConfig(next.config, connection.entry.config)) continue;\n      catalog.connections.delete(name);\n      closing.push(connection.close());\n    }\n    if (first) initial = new Set(wanted.keys());\n    first = false;\n    void register(wanted.values());\n    for (const [name, entry] of wanted) if (!catalog.connections.has(name)) open(entry);\n    catalog.rebuild();\n    notify();\n    await Promise.all(closing);\n  };\n  await reload(context);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const watched = await env.watch(\n    [{ path: configPath(home, options.agentDir) }],\n    schedule,\n    context\n  );\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  const restart = (connection: McpServerConnection) => {\n    open(connection.entry);\n    void connection.close();\n    catalog.rebuild();\n  };\n  const stopRecords = vault.records.state.subscribe(() => {\n    for (const connection of [...catalog.connections.values()])\n      if (connection.state === 'needs-secret') restart(connection);\n    notify();\n  });\n  return {\n    ...mcpAccounts(\n      catalog,\n      {\n        records: vault.records,\n        oauth,\n        fetch: fetcher,\n        grant: (server) => vault.grant(server, fetcher(server)),\n        register: (server, url) => vault.token(server, url),\n      },\n      restart,\n      listeners\n    ),\n    status: () =>\n      [...catalog.connections.values()].map((connection) => ({\n        name: connection.name,\n        state: connection.state,\n        tools: connection.tools.length,\n        ...(connection.error ? { error: connection.error } : {}),\n      })),\n    reload,\n    async close(using) {\n      clearTimeout(timer);\n      stopRecords();\n      await watcher?.close(using);\n      const all = [...catalog.connections.values()];\n      catalog.connections.clear();\n      await Promise.all(all.map((connection) => connection.close()));\n      catalog.rebuild();\n      await log.settled();\n    },\n  };\n}\n\nexport async function startMcp(\n  registry: Registry,\n  options: McpAttach,\n  context: Context\n): Promise<{ catalog: McpCatalog; runtime: McpRuntime }> {\n  patchSse();\n  const catalog = new McpCatalog(registry);\n  return { catalog, runtime: await attachMcp(catalog, options, context) };\n}\n"],
+  "mappings": "AAGA,SAAS,+BAA+B;AAGxC,SAAS,iBAAiB;AAE1B,SAA2B,mBAAmB;AAC9C,SAAS,kBAAkB;AAC3B;AAAA,EAGE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAA0B,gBAAgB,mBAAmB;AAC7D,SAAS,gBAAgB,WAAW,mBAAmB;AACvD,SAAS,YAAY,SAAS,aAAa;AAC3C,SAAS,gBAAgB;AAElB,MAAM,oBAAoB,IAAI,OAAO;AAE5C,SAAS,cAAAA,aAAY,WAAAC,UAAS,SAAAC,cAAa;AA2CpC,SAAS,YAAY,SAA2B,MAAc,KAAyB;AAC5F,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,GAAG,IAAI;AAC9C,QAAM,QAAQ,QAAQ,SAAS,WAAW,QAAQ,MAAM,MAAM;AAC9D,QAAM,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,KAAK,KAAK;AAC3D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,IAAI;AAAA,IACnB,OAAO,uBAAuB,KAAK,GAAG,KAAK;AAAA,IAC3C,MAAM,QAAQ;AAAA,IACd,MAAM,GAAG,IAAI;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS,GAAG,QAAQ,UAAU,EAAE;AAAA,EAAK,QAAQ,SAAS,EAAE;AAAA,EAAK,QAAQ,OAAO;AAAA,EAC9E;AACF;AAEA,MAAM,aAAa;AAEZ,SAAS,UAAU,YAAiC,MAAsC;AAC/F,QAAM,OAAO,WAAW;AACxB,QAAM,OAAO,EAAE,SAAS,WAAoB,QAAQ,OAAO,IAAI,IAAI,QAAQ,OAAgB;AAC3F,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,eAAe,IAAI;AAAA,MAC1B,MAAM,mBAAmB,WAAW,QAAQ,IAAI,CAAC,SAAS,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MACnF,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,WAAW,QAAQ,KAAK,GAAG,CAAC;AAAA,IAC3D;AACF,MAAI,WAAW,UAAU;AACvB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SACxC,eAAe,IAAI,yBACnB,eAAe,IAAI;AAAA,MACvB,MAAM,WAAW,cAAc;AAAA,MAC/B,UAAU;AAAA,MACV,SAAS,GAAG,IAAI;AAAA;AAAA,IAClB;AACF,MAAI,WAAW,UAAU,SAAU,QAAO;AAC1C,QAAM,QAAQ,WAAW,SAAS;AAClC,QAAM,UAAU,QAAQ,WAAW,KAAK,KAAK;AAC7C,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,eAAe,IAAI;AAAA,IAC1B,MAAM,UACF,wKACA;AAAA,IACJ,UAAU;AAAA,IACV,SAAS,GAAG,IAAI;AAAA;AAAA,EAAa,UAAU,SAAS,KAAK;AAAA,EACvD;AACF;AAEO,SAAS,cAAc,YAA4C;AACxE,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,OAAO,WAAW,IAAI;AAAA,IAC9B,OAAO,eAAe,WAAW,IAAI;AAAA,IACrC,MAAM,GAAG,WAAW,MAAM,OAAO,GAAG,WAAW,KAAK,QAAQ,UAAU,IAAI,KAAK,GAAG;AAAA,IAClF,QAAQ;AAAA,IACR,SAAS,GAAG,WAAW,IAAI;AAAA;AAAA,EAAgB,WAAW,MAAM,OAAO,GAAG;AAAA,EACxE;AACF;AAEO,SAAS,QAAQ,QAAgB,QAAiB,IAAkB;AACzE,QAAM,EAAE,OAAO,QAAQ,KAAK,IAAK,UAAU,CAAC;AAK5C,QAAM,OAAO,OAAO,SAAS,WAAW,OAAQ,KAAK,UAAU,IAAI,KAAK;AACxE,SAAO,GAAG,GAAG,YAAY,CAAC,KAAK,MAAM,KAAK,SAAS,MAAM,GAAG,SAAS,IAAI,MAAM,KAAK,EAAE,KAAK,IAAI;AAAA;AACjG;AAEA,SAAS,UAAU,SAAoB,SAAkB;AACvD,MAAI,UAAU,QAAQ,QAAQ;AAC9B,QAAM,OAAO,QAAQ,QAAQ,MAAM,QAAQ,QAAQ;AACnD,QAAM,EAAE,IAAI,IAAI;AAChB,SAAO;AAAA,IACL,MAAM,YAAiC,QAAiB;AACtD,YAAM,OAAO,QAAQ,WAAW,MAAM,QAAQ,oBAAI,KAAK,CAAC;AACxD,gBAAU,QAAQ,KAAK,YAAY;AACjC,cAAM,OAAO,MAAM,UAAU,IAAI;AACjC,cAAM,OAAO,MAAM,IAAI,SAAS,MAAM,OAAO;AAC7C,YAAI,KAAK,MAAM,KAAK,MAAM,OAAO;AAC/B,gBAAM,IAAI,WAAW,MAAM,GAAG,IAAI,MAAM,OAAO;AACjD,cAAM,IAAI,WAAW,MAAM,MAAM,OAAO;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,IACA,SAAS,MAAM;AAAA,EACjB;AACF;AAEA,eAAsB,UACpB,SACA,SACA,SACqB;AACrB,QAAM,EAAE,KAAK,KAAK,IAAI;AACtB,UAAQ,aAAa,QAAQ;AAC7B,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,SAAS,OAAO,MAA6B,UAAmB;AACpE,QAAI,CAAC,MAAM,WAAW,SAAS,IAAI,KAAK,OAAO,EAAG;AAClD,aAAS,IAAI,KAAK,OAAO;AACzB,UAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EAChE;AACA,QAAM,YAAY,oBAAI,IAAgB;AACtC,QAAM,SAAS,MAAM;AACnB,eAAW,YAAY,UAAW,UAAS;AAAA,EAC7C;AACA,MAAI,UAAuB,oBAAI,IAAI;AACnC,MAAI,QAAQ;AACZ,QAAM,MAAM,UAAU,SAAS,OAAO;AACtC,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,OAAO,CAAC,OAA+B,SAAuB,QAAQ,MAAM,OAAO,IAAI;AAC7F,QAAM,UAAU,CAAC,WAAmB,MAAM,MAAM,QAAQ,IAAI;AAC5D,QAAM,QAAQ,CAAC,UAA0B,IAAI,YAAY,OAAO,QAAQ,OAAO,QAAQ,QAAQ;AAC/F,QAAM,YAAY,OAAO,UAA0B;AACjD,UAAM,WAAW,eAAe,MAAM,MAAM,MAAM,QAAQ,MAAM,OAAO;AACvE,QAAI,CAAC,SAAS,GAAI,QAAO,EAAE,SAAS,SAAS,QAAQ;AACrD,UAAM,eAAe,UAAU,MAAM,MAAM,IAAI,UAAU,MAAM,KAAK,GAAG,KAAK,IAAI;AAChF,WAAO;AAAA,MACL,WAAW,IAAI,wBAAwB;AAAA,QACrC,KAAK,MAAM,OAAO;AAAA,QAClB,SAAS,SAAS;AAAA,QAClB,OAAO,QAAQ,MAAM,IAAI;AAAA,QACzB,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,WAAW,CAAC,YAChB,MACG;AAAA,IACC,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,WAAW;AAAA,MAC3B,QAAQ,MAAM;AAAA,MACd,KAAK,MAAM,OAAO;AAAA,MAClB,OAAO,YAAY,MAAM,MAAM;AAAA,IACjC,EAAE;AAAA,EACJ,EACC,MAAM,MAAM,MAAS;AAC1B,QAAM,OAAO,CAAC,UAA0B;AACtC,UAAM,aAAa,IAAI,oBAAoB;AAAA,MACzC;AAAA,MACA,SAAS,QAAQ;AAAA,MACjB;AAAA,MACA,SAAS,MAAM,QAAQ,QAAQ;AAAA,MAC/B,OAAO,IAAI;AAAA,MACX,UAAU,CAAC,YAAY;AACrB,YAAI,QAAQ,YAAY,IAAI,QAAQ,IAAI,MAAM,QAAS;AACvD,YAAI,QAAQ,UAAU,eAAe,CAAC,QAAQ,IAAI,QAAQ,IAAI;AAC5D,eAAK,OAAO,cAAc,OAAO,GAAG,OAAO;AAC7C,aAAK,OAAO,UAAU,SAAS,QAAQ,IAAI,GAAG,OAAO;AACrD,YAAI,QAAQ,UAAU,YAAa,SAAQ,QAAQ;AACnD,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,IAAI,MAAM,MAAM,UAAU;AAC9C,SAAK,WAAW,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACA,QAAM,SAAS,OAAO,UAAmB;AACvC,UAAM,OAAO,MAAM,IAAI,aAAa,WAAW,MAAM,QAAQ,QAAQ,GAAG,KAAK;AAC7E,UAAM,SAAS,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS;AAC9D,eAAW,WAAW,OAAO;AAC3B,YAAM,OAAO,YAAY,SAAS,MAAM,QAAQ,QAAQ,GAAG,KAAK;AAClE,UAAM,SAAS,IAAI;AAAA,MACjB,OAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,YAAY,KAAK,EAChD,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,IACvC;AACA,UAAM,UAA2B,CAAC;AAClC,eAAW,CAAC,MAAM,UAAU,KAAK,CAAC,GAAG,QAAQ,WAAW,GAAG;AACzD,YAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,MAAM,MAAM,EAAG;AAC9D,cAAQ,YAAY,OAAO,IAAI;AAC/B,cAAQ,KAAK,WAAW,MAAM,CAAC;AAAA,IACjC;AACA,QAAI,MAAO,WAAU,IAAI,IAAI,OAAO,KAAK,CAAC;AAC1C,YAAQ;AACR,SAAK,SAAS,OAAO,OAAO,CAAC;AAC7B,eAAW,CAAC,MAAM,KAAK,KAAK,OAAQ,KAAI,CAAC,QAAQ,YAAY,IAAI,IAAI,EAAG,MAAK,KAAK;AAClF,YAAQ,QAAQ;AAChB,WAAO;AACP,UAAM,QAAQ,IAAI,OAAO;AAAA,EAC3B;AACA,QAAM,OAAO,OAAO;AACpB,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,UAAU,MAAM,IAAI;AAAA,IACxB,CAAC,EAAE,MAAM,WAAW,MAAM,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC7C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,QAAM,UAAU,CAAC,eAAoC;AACnD,SAAK,WAAW,KAAK;AACrB,SAAK,WAAW,MAAM;AACtB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,cAAc,MAAM,QAAQ,MAAM,UAAU,MAAM;AACtD,eAAW,cAAc,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC;AACvD,UAAI,WAAW,UAAU,eAAgB,SAAQ,UAAU;AAC7D,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,MACD;AAAA,MACA;AAAA,QACE,SAAS,MAAM;AAAA,QACf;AAAA,QACA,OAAO;AAAA,QACP,OAAO,CAAC,WAAW,MAAM,MAAM,QAAQ,QAAQ,MAAM,CAAC;AAAA,QACtD,UAAU,CAAC,QAAQ,QAAQ,MAAM,MAAM,QAAQ,GAAG;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ,MACN,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB;AAAA,MACrD,MAAM,WAAW;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,WAAW,MAAM;AAAA,MACxB,GAAI,WAAW,QAAQ,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;AAAA,IACxD,EAAE;AAAA,IACJ;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,mBAAa,KAAK;AAClB,kBAAY;AACZ,YAAM,SAAS,MAAM,KAAK;AAC1B,YAAM,MAAM,CAAC,GAAG,QAAQ,YAAY,OAAO,CAAC;AAC5C,cAAQ,YAAY,MAAM;AAC1B,YAAM,QAAQ,IAAI,IAAI,IAAI,CAAC,eAAe,WAAW,MAAM,CAAC,CAAC;AAC7D,cAAQ,QAAQ;AAChB,YAAM,IAAI,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,UACA,SACA,SACuD;AACvD,WAAS;AACT,QAAM,UAAU,IAAI,WAAW,QAAQ;AACvC,SAAO,EAAE,SAAS,SAAS,MAAM,UAAU,SAAS,SAAS,OAAO,EAAE;AACxE;",
   "names": ["configPath", "logPath", "shown"]
 }

package/dist/mcp/tools.js

@@ -15,7 +15,6 @@ import {
   scriptResult,
   spiller
 } from "./content.js";
-import { scrub } from "./credentials.js";
 const LIST_MCP_RESOURCES = "list_mcp_resources";
 const LIST_MCP_RESOURCE_TEMPLATES = "list_mcp_resource_templates";
 function parametersOf(schema) {
@@ -56,9 +55,8 @@ function progressText(progress) {
   const total = progress.total === void 0 ? "" : `/${progress.total}`;
   return progress.message ?? `Progress ${progress.progress}${total}`;
 }
-function failure(entry, error) {
-  const message = error instanceof Error ? error.message : String(error);
-  throw new Error(scrub(message, entry.connection.secrets));
+function failure(error) {
+  throw new Error(error instanceof Error ? error.message : String(error));
 }
 function directTool(entry, readable) {
   return defineTool({
@@ -75,7 +73,7 @@ function directTool(entry, readable) {
       };
       const signal = signalOf(context);
       if (signal) options.signal = signal;
-      const result = await entry.connection.callTool(entry.tool.name, args, options).catch((error) => failure(entry, error));
+      const result = await entry.connection.callTool(entry.tool.name, args, options).catch(failure);
       const converted = await convertResult(
         entry.server,
         entry.tool.name,
@@ -109,7 +107,7 @@ function scriptTool(entry, signal) {
       const result = await entry.connection.callTool(entry.tool.name, args ?? {}, {
         signal: combined,
         timeoutMs: entry.connection.timeoutMs
-      }).catch((error) => failure(entry, error));
+      }).catch(failure);
       return scriptResult(result);
     }
   };