@artil-ai/server 0.1.2 → 0.2.0

package/bin/main.js

@@ -22326,7 +22326,7 @@ var channel = {
   create: ({ webhookUrl, secret, fetch: fetch2 }) => new TelegramChannel(createBotApi({ webhook: webhookUrl ? { url: webhookUrl, secret } : undefined, fetch: fetch2 }))
 };
 // package.json
-var version2 = "0.1.2";
+var version2 = "0.2.0";
 
 // src/app/cli.ts
 import { parseArgs } from "util";
@@ -24091,11 +24091,28 @@ function createAddressCommands({ agents, addresses, out }) {
   ]);
 }
 
+// src/platform/artil-cli.ts
+var {$ } = globalThis.Bun;
+function loginCommand(baseUrl) {
+  return `artil auth login --base-url ${baseUrl}`;
+}
+function findArtilCli() {
+  return {
+    installed: Bun.which("artil") !== null,
+    async install() {
+      const installed = await $`bun install --global artil-ai`.nothrow().quiet();
+      if (installed.exitCode !== 0) {
+        throw new Error(installed.stderr.toString().trim() || `bun install exited with ${installed.exitCode}`);
+      }
+    }
+  };
+}
+
 // src/domains/agents/commands.ts
 function signInGuide({ baseUrl, names }) {
   return [
     `Sign ${names.length === 1 ? "the agent" : "each agent"} in from its client:`,
-    ...names.map((name) => `  ARTIL_BASE_URL=${baseUrl} artil auth login --account ${shellQuoted(name)}`),
+    ...names.map((name) => `  ${loginCommand(baseUrl)} --account ${shellQuoted(name)}`),
     `MCP clients connect to ${baseUrl}/mcp and sign in on the page it opens.`,
     "On a computer without a browser, make a token with: artil-server account token <name>"
   ].join(`
@@ -24142,7 +24159,7 @@ function createAgentCommands({
     const token = tokens.issue({ agentId: agent.id, name: "artil-server account token" });
     out([
       `A token for ${agent.name}. Keep it secret; it signs in as the agent until you revoke it.`,
-      `  ARTIL_BASE_URL=${await baseUrl()} artil auth login --token ${token}`
+      `  ${loginCommand(await baseUrl())} --token ${token}`
     ].join(`
 `));
   }
@@ -29929,13 +29946,65 @@ function migrate(db, config2) {
   db.dialect.migrate(migrations, db.session, config2);
 }
 
+// src/platform/db/encryption.ts
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes as randomBytes2 } from "crypto";
+var algorithm = "aes-256-gcm";
+var keyLength = 32;
+var nonceLength = 12;
+var tagLength = 16;
+var key;
+function initEncryption(secret) {
+  key = Buffer.from(hkdfSync("sha256", secret, "", "encryption", keyLength));
+}
+function encryptedText(table, column) {
+  const label = `${table}.${column}`;
+  return customType({
+    dataType: () => "text",
+    toDriver: (plaintext) => encryptText(plaintext, label),
+    fromDriver: (stored) => decryptBytes(Buffer.from(stored, "base64url"), label).toString("utf8")
+  })(column);
+}
+function encryptText(plaintext, label) {
+  return encryptBytes(Buffer.from(plaintext, "utf8"), label).toString("base64url");
+}
+function encryptBytes(bytes, label) {
+  const nonce = randomBytes2(nonceLength);
+  const cipher = createCipheriv(algorithm, activeKey(label), nonce);
+  cipher.setAAD(Buffer.from(label));
+  const ciphertext = Buffer.concat([cipher.update(bytes), cipher.final()]);
+  return Buffer.concat([nonce, ciphertext, cipher.getAuthTag()]);
+}
+function decryptBytes(sealed, label) {
+  const payload = Buffer.from(sealed);
+  const decryptionKey = activeKey(label);
+  try {
+    const decipher = createDecipheriv(algorithm, decryptionKey, payload.subarray(0, nonceLength), {
+      authTagLength: tagLength
+    });
+    decipher.setAAD(Buffer.from(label));
+    decipher.setAuthTag(payload.subarray(-tagLength));
+    return Buffer.concat([
+      decipher.update(payload.subarray(nonceLength, -tagLength)),
+      decipher.final()
+    ]);
+  } catch {
+    throw new Error(`${label} does not decrypt with this server's secret`);
+  }
+}
+function activeKey(label) {
+  if (!key)
+    throw new Error(`Open the database before reading or writing ${label}`);
+  return key;
+}
+
 // src/platform/db/connection.ts
-function openDatabase({ path, migrationsFolder }) {
+function openDatabase({ path, migrationsFolder, secret }) {
   const sqlite = new Sqlite(path, { create: true, strict: true });
   sqlite.run("pragma journal_mode = wal");
   sqlite.run("pragma busy_timeout = 5000");
   sqlite.run("pragma foreign_keys = on");
   const db = drizzle({ client: sqlite });
+  initEncryption(secret);
   migrate(db, { migrationsFolder });
   return {
     db,
@@ -29955,19 +30024,26 @@ function createS3Store({
 }) {
   const client = new S3Client({ endpoint, bucket, region, accessKeyId, secretAccessKey });
   return {
-    put: async ({ key, bytes, type }) => {
-      await client.write(key, bytes, { type });
+    put: async ({ key: key2, bytes, type }) => {
+      await client.write(key2, bytes, { type });
     },
-    read: async (key) => new Uint8Array(await client.file(key).arrayBuffer()),
-    remove: (key) => client.delete(key)
+    read: async (key2) => new Uint8Array(await client.file(key2).arrayBuffer()),
+    remove: (key2) => client.delete(key2)
   };
 }
+var contentLabel = "files.content";
+function encryptContent(bytes) {
+  return encryptBytes(bytes, contentLabel);
+}
+function decryptContent(sealed) {
+  return decryptBytes(sealed, contentLabel);
+}
 async function checkStore(store) {
-  const key = `checks/${crypto.randomUUID()}`;
+  const key2 = `checks/${crypto.randomUUID()}`;
   const bytes = new TextEncoder().encode("artil-server");
-  await store.put({ key, bytes, type: "text/plain" });
-  const read = await store.read(key);
-  await store.remove(key);
+  await store.put({ key: key2, bytes, type: "text/plain" });
+  const read = await store.read(key2);
+  await store.remove(key2);
   if (new TextDecoder().decode(read) !== "artil-server") {
     throw new Error("The bucket gave back other bytes than it was given");
   }
@@ -30015,7 +30091,7 @@ var addresses = sqliteTable("addresses", {
   agentId: text2("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   channel: text2("channel").notNull(),
   value: text2("value").notNull(),
-  credentials: text2("credentials"),
+  credentials: encryptedText("addresses", "credentials"),
   createdAt: createdAt()
 }, (table) => [
   uniqueIndex("addresses_channel_value_idx").on(table.channel, table.value).where(sql`${table.credentials} is not null`),
@@ -30035,9 +30111,9 @@ var messages = sqliteTable("messages", {
   direction: text2("direction", { enum: ["inbound", "outbound"] }).notNull(),
   externalId: text2("external_id"),
   counterpart: text2("counterpart").notNull(),
-  counterpartName: text2("counterpart_name"),
+  counterpartName: encryptedText("messages", "counterpart_name"),
   to: text2("to", { mode: "json" }).$type().notNull(),
-  text: text2("text").notNull(),
+  text: encryptedText("messages", "text").notNull(),
   status: text2("status", {
     enum: ["received", "refused", "sending", "sent", "failed"]
   }).notNull(),
@@ -30053,7 +30129,7 @@ var files = sqliteTable("files", {
   id: id(),
   agentId: text2("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   messageId: text2("message_id").notNull(),
-  name: text2("name").notNull(),
+  name: encryptedText("files", "name").notNull(),
   type: text2("type").notNull(),
   size: integer2("size").notNull(),
   key: text2("key"),
@@ -30066,7 +30142,7 @@ var events = sqliteTable("events", {
   type: text2("type", { enum: ["message.received"] }).notNull(),
   channel: text2("channel").notNull(),
   messageId: text2("message_id").notNull(),
-  text: text2("text"),
+  text: encryptedText("events", "text"),
   sender: text2("sender", { mode: "json" }).$type(),
   thread: text2("thread"),
   toThread: text2("to_thread"),
@@ -30585,13 +30661,13 @@ function createFilesService({ filesRepository, store, log: log2 }) {
     if (!store || file3.key === null || file3.expiresAt && file3.expiresAt <= new Date) {
       return;
     }
-    return store.read(file3.key);
+    return decryptContent(await store.read(file3.key));
   }
-  async function putInStore(options) {
+  async function putInStore({ bytes, ...object3 }) {
     if (!store)
       return false;
     try {
-      await store.put(options);
+      await store.put({ ...object3, bytes: encryptContent(bytes) });
       return true;
     } catch (cause) {
       log2(`Could not put a file in the bucket: ${messageOf(cause, String(cause))}`);
@@ -30634,8 +30710,8 @@ function createFilesService({ filesRepository, store, log: log2 }) {
     describeByMessages: (messageIds) => new Map(filesRepository.listByMessages(messageIds).entries().map(([messageId, records]) => [messageId, records.map(toMessageAttachment)])),
     save: ({ agentId, messageId, uploads, expiresAt }) => Promise.all(uploads.map(async ({ name, type, size, content }) => {
       const id2 = crypto.randomUUID();
-      const key = `${agentId}/${id2}`;
-      const stored = content !== null && await putInStore({ key, bytes: content, type });
+      const key2 = `${agentId}/${id2}`;
+      const stored = content !== null && await putInStore({ key: key2, bytes: content, type });
       return filesRepository.add({
         id: id2,
         agentId,
@@ -30643,7 +30719,7 @@ function createFilesService({ filesRepository, store, log: log2 }) {
         name,
         type,
         size,
-        key: stored ? key : null,
+        key: stored ? key2 : null,
         expiresAt
       });
     })),
@@ -30952,9 +31028,9 @@ function createSignInsRepository(db) {
 }
 
 // src/platform/crypto.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 function randomSecret() {
-  return randomBytes2(32).toString("base64url");
+  return randomBytes3(32).toString("base64url");
 }
 function hashSecret(secret) {
   return createHash2("sha256").update(secret).digest("hex");
@@ -31229,7 +31305,7 @@ async function openCommandContext({
   tailscale,
   out
 }) {
-  const database = openDatabase({ path: paths.database, migrationsFolder });
+  const database = openDatabase({ path: paths.database, migrationsFolder, secret: config2.secret });
   const channels = createChannels({
     definitions: await loadChannels({
       specifiers: config2.channels,
@@ -31399,49 +31475,49 @@ async function parseFormData(request, options) {
 function convertFormDataToBodyData(formData, options) {
   const form = Object.create(null);
   const nestingState = { count: 0 };
-  formData.forEach((value, key) => {
-    if (!(options.all || key.endsWith("[]")))
-      form[key] = value;
+  formData.forEach((value, key2) => {
+    if (!(options.all || key2.endsWith("[]")))
+      form[key2] = value;
     else
-      handleParsingAllValues(form, key, value);
+      handleParsingAllValues(form, key2, value);
   });
   if (options.dot)
-    Object.entries(form).forEach(([key, value]) => {
-      if (key.includes(".")) {
-        handleParsingNestedValues(form, key, value, nestingState);
-        delete form[key];
+    Object.entries(form).forEach(([key2, value]) => {
+      if (key2.includes(".")) {
+        handleParsingNestedValues(form, key2, value, nestingState);
+        delete form[key2];
       }
     });
   return form;
 }
-var handleParsingAllValues = (form, key, value) => {
-  if (form[key] !== undefined) {
-    if (Array.isArray(form[key]))
-      form[key].push(value);
+var handleParsingAllValues = (form, key2, value) => {
+  if (form[key2] !== undefined) {
+    if (Array.isArray(form[key2]))
+      form[key2].push(value);
     else
-      form[key] = [form[key], value];
-  } else if (!key.endsWith("[]"))
-    form[key] = value;
+      form[key2] = [form[key2], value];
+  } else if (!key2.endsWith("[]"))
+    form[key2] = value;
   else
-    form[key] = [value];
+    form[key2] = [value];
 };
-var handleParsingNestedValues = (form, key, value, state) => {
-  if (/(?:^|\.)__proto__\./.test(key))
+var handleParsingNestedValues = (form, key2, value, state) => {
+  if (/(?:^|\.)__proto__\./.test(key2))
     return;
   let nestedForm = form;
-  const keys = key.split(".", 34);
+  const keys = key2.split(".", 34);
   if (keys.length > 33)
     throwNestingLimitExceeded();
-  keys.forEach((key2, index2) => {
+  keys.forEach((key3, index2) => {
     if (index2 === keys.length - 1)
-      nestedForm[key2] = value;
+      nestedForm[key3] = value;
     else {
-      if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+      if (!nestedForm[key3] || typeof nestedForm[key3] !== "object" || Array.isArray(nestedForm[key3]) || nestedForm[key3] instanceof File) {
         if (state.count++ >= MAX_NESTED_OBJECTS)
           throwNestingLimitExceeded();
-        nestedForm[key2] = Object.create(null);
+        nestedForm[key3] = Object.create(null);
       }
-      nestedForm = nestedForm[key2];
+      nestedForm = nestedForm[key3];
     }
   });
 };
@@ -31462,48 +31538,48 @@ var HonoRequest = class {
     this.path = path;
     this.#matchResult = matchResult;
   }
-  param(key) {
-    return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
+  param(key2) {
+    return key2 ? this.#getDecodedParam(key2) : this.#getAllDecodedParams();
   }
-  #getDecodedParam(key) {
-    const paramKey2 = this.#matchResult[0][this.routeIndex]?.[1][key];
+  #getDecodedParam(key2) {
+    const paramKey2 = this.#matchResult[0][this.routeIndex]?.[1][key2];
     const param = this.#getParamValue(paramKey2);
     return param && tryDecodeURIComponent(param);
   }
   #getAllDecodedParams() {
     const decoded = {};
     const keys = Object.keys(this.#matchResult[0][this.routeIndex]?.[1] ?? {});
-    for (const key of keys) {
-      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
+    for (const key2 of keys) {
+      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key2]);
       if (value !== undefined)
-        decoded[key] = tryDecodeURIComponent(value);
+        decoded[key2] = tryDecodeURIComponent(value);
     }
     return decoded;
   }
   #getParamValue(paramKey2) {
     return this.#matchResult[1] ? this.#matchResult[1][paramKey2] : paramKey2;
   }
-  query(key) {
-    return getQueryParam(this.url, key);
+  query(key2) {
+    return getQueryParam(this.url, key2);
   }
-  queries(key) {
-    return getQueryParams(this.url, key);
+  queries(key2) {
+    return getQueryParams(this.url, key2);
   }
   header(name) {
     if (name)
       return this.raw.headers.get(name) ?? undefined;
     const headerData = Object.create(null);
-    this.raw.headers.forEach((value, key) => {
-      headerData[key] = value;
+    this.raw.headers.forEach((value, key2) => {
+      headerData[key2] = value;
     });
     return headerData;
   }
   async parseBody(options) {
     return parseBody(this, options);
   }
-  #cachedBody = (key) => {
+  #cachedBody = (key2) => {
     const { bodyCache, raw } = this;
-    const cachedBody = bodyCache[key];
+    const cachedBody = bodyCache[key2];
     if (cachedBody)
       return cachedBody;
     for (const anyCachedKey in bodyCache)
@@ -31511,9 +31587,9 @@ var HonoRequest = class {
         if (anyCachedKey === "json")
           body = JSON.stringify(body);
         const contentType = anyCachedKey === "formData" ? undefined : raw.headers.get("content-type");
-        return new Response(body, { headers: contentType ? { "Content-Type": contentType } : undefined })[key]();
+        return new Response(body, { headers: contentType ? { "Content-Type": contentType } : undefined })[key2]();
       });
-    return bodyCache[key] = raw[key]();
+    return bodyCache[key2] = raw[key2]();
   };
   json() {
     return this.#cachedBody("text").then((text3) => JSON.parse(text3));
@@ -31762,12 +31838,12 @@ var Context = class {
   status = (status) => {
     this.#status = status;
   };
-  set = (key, value) => {
+  set = (key2, value) => {
     this.#var ??= /* @__PURE__ */ new Map;
-    this.#var.set(key, value);
+    this.#var.set(key2, value);
   };
-  get = (key) => {
-    return this.#var ? this.#var.get(key) : undefined;
+  get = (key2) => {
+    return this.#var ? this.#var.get(key2) : undefined;
   };
   get var() {
     if (!this.#var)
@@ -31778,11 +31854,11 @@ var Context = class {
     let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
     if (typeof arg === "object" && arg.headers) {
       responseHeaders ??= new Headers;
-      for (const [key, value] of new Headers(arg.headers))
-        if (key === "set-cookie")
-          responseHeaders.append(key, value);
+      for (const [key2, value] of new Headers(arg.headers))
+        if (key2 === "set-cookie")
+          responseHeaders.append(key2, value);
         else
-          responseHeaders.set(key, value);
+          responseHeaders.set(key2, value);
     }
     if (headers) {
       if (!responseHeaders) {
@@ -32360,8 +32436,8 @@ var RegExpRouter = class {
     const own2 = createNullObject();
     const entries = handlers.map(([h2, p2], i2) => {
       (own2[p2] ??= []).push(i2);
-      return [h2, trie.paths[p2][1].reduceRight((map3, [key, varIndex]) => {
-        map3[key] = paramReplacementMap[varIndex];
+      return [h2, trie.paths[p2][1].reduceRight((map3, [key2, varIndex]) => {
+        map3[key2] = paramReplacementMap[varIndex];
         return map3;
       }, createNullObject())];
     });
@@ -32458,8 +32534,8 @@ var Node3 = class Node4 {
       const nextP = parts[++i2];
       const pattern = getPattern(p2, nextP) || (nextP === undefined && p2 && p2.indexOf("*") === p2.length - 1 ? p2 : null);
       const isParam = Array.isArray(pattern);
-      const key = isParam ? pattern[0] : pattern || p2;
-      const child = curNode.#children[key] ||= new Node4;
+      const key2 = isParam ? pattern[0] : pattern || p2;
+      const child = curNode.#children[key2] ||= new Node4;
       if (pattern && !child.#pattern) {
         child.#pattern = pattern;
         curNode.#patterns.push(child);
@@ -32482,8 +32558,8 @@ var Node3 = class Node4 {
         handlerSet.params = createNullObject();
         handlerSets.push(handlerSet);
         for (let i3 = 0, len2 = handlerSet.possibleKeys.length;i3 < len2; i3++) {
-          const key = handlerSet.possibleKeys[i3];
-          handlerSet.params[key] = params?.[key] && !i3 ? params[key] : nodeParams[key] ?? params?.[key];
+          const key2 = handlerSet.possibleKeys[i3];
+          handlerSet.params[key2] = params?.[key2] && !i3 ? params[key2] : nodeParams[key2] ?? params?.[key2];
         }
       }
     }
@@ -32715,8 +32791,8 @@ var secureHeaders = (customOptions) => {
   };
 };
 function getFilteredHeaders(options) {
-  return Object.entries(HEADERS_MAP).filter(([key]) => options[key]).map(([key, defaultValue]) => {
-    const overrideValue = options[key];
+  return Object.entries(HEADERS_MAP).filter(([key2]) => options[key2]).map(([key2, defaultValue]) => {
+    const overrideValue = options[key2];
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
@@ -33039,10 +33115,10 @@ var SSEStreamingApi = class extends StreamingApi {
       return `data: ${line}`;
     }).join(`
 `);
-    for (const key of ["event", "id"]) {
-      const value = message[key];
+    for (const key2 of ["event", "id"]) {
+      const value = message[key2];
       if (value && /[\r\n]/.test(value))
-        throw new Error(`${key} must not contain "\\r" or "\\n"`);
+        throw new Error(`${key2} must not contain "\\r" or "\\n"`);
     }
     const sseData = [
       message.event && `event: ${message.event}`,
@@ -33580,8 +33656,8 @@ var cors = (options2) => {
       return () => "";
   })(opts.allowMethods);
   return async function cors2(c3, next) {
-    function set3(key, value) {
-      c3.res.headers.set(key, value);
+    function set3(key2, value) {
+      c3.res.headers.set(key2, value);
     }
     const allowOrigin = await findAllowOrigin(c3.req.header("origin") || "", c3);
     if (allowOrigin)
@@ -34092,8 +34168,8 @@ var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context })
       for (const [, tagProps] of tags6) {
         if (tagName === "link" && !(tagProps.rel === "stylesheet" && tagProps["data-precedence"] !== undefined))
           continue;
-        for (const key of deDupeKeys)
-          if ((tagProps?.[key] ?? null) === props?.[key]) {
+        for (const key2 of deDupeKeys)
+          if ((tagProps?.[key2] ?? null) === props?.[key2]) {
             duped = true;
             break LOOP;
           }
@@ -34214,7 +34290,7 @@ var normalizeElementKeyMap = /* @__PURE__ */ new Map([
   ["noModule", "nomodule"],
   ["formAction", "formaction"]
 ]);
-var normalizeIntrinsicElementKey = (key) => normalizeElementKeyMap.get(key) || key;
+var normalizeIntrinsicElementKey = (key2) => normalizeElementKeyMap.get(key2) || key2;
 var invalidAttributeNameCharRe = /[\s"'<>/=`\\\x00-\x1f\x7f-\x9f]/;
 var validAttributeNameCache = /* @__PURE__ */ new Set;
 var validAttributeNameCacheMax = 1024;
@@ -34320,30 +34396,30 @@ var hasUnsafeStyleValue = (value) => {
 };
 var styleObjectForEach = (style2, fn) => {
   for (const [k, v] of Object.entries(style2)) {
-    const key = k[0] === "-" || !/[A-Z]/.test(k) ? k : k.replace(/[A-Z]/g, (m2) => `-${m2.toLowerCase()}`);
-    if (!isValidStylePropertyName(key))
+    const key2 = k[0] === "-" || !/[A-Z]/.test(k) ? k : k.replace(/[A-Z]/g, (m2) => `-${m2.toLowerCase()}`);
+    if (!isValidStylePropertyName(key2))
       continue;
     if (v == null) {
-      fn(key, null);
+      fn(key2, null);
       continue;
     }
     let value;
     if (typeof v === "number")
-      value = !key.match(/^(?:a|border-im|column(?:-c|s)|flex(?:$|-[^b])|grid-(?!.*gap)(?:ar|[^a])|font-w|li|or|sca|st|ta|wido|z)|ty$/) ? `${v}px` : `${v}`;
+      value = !key2.match(/^(?:a|border-im|column(?:-c|s)|flex(?:$|-[^b])|grid-(?!.*gap)(?:ar|[^a])|font-w|li|or|sca|st|ta|wido|z)|ty$/) ? `${v}px` : `${v}`;
     else if (typeof v === "string") {
       if (hasUnsafeStyleValue(v))
         continue;
       value = v;
     } else
       continue;
-    fn(key, value);
+    fn(key2, value);
   }
 };
 
 // ../../node_modules/.bun/hono@4.13.16/node_modules/hono/dist/jsx/base.js
 var nameSpaceContext = undefined;
 var getNameSpaceContext = () => nameSpaceContext;
-var toSVGAttributeName = (key) => /[A-Z]/.test(key) && key.match(/^(?:al|basel|clip(?:Path|Rule)$|co|do|fill|fl|fo|gl|let|lig|i|marker[EMS]|o|pai|pointe|sh|st[or]|text[^L]|tr|u|ve|w)/) ? key.replace(/([A-Z])/g, "-$1").toLowerCase() : key;
+var toSVGAttributeName = (key2) => /[A-Z]/.test(key2) && key2.match(/^(?:al|basel|clip(?:Path|Rule)$|co|do|fill|fl|fo|gl|let|lig|i|marker[EMS]|o|pai|pointe|sh|st[or]|text[^L]|tr|u|ve|w)/) ? key2.replace(/([A-Z])/g, "-$1").toLowerCase() : key2;
 var emptyTags = [
   "area",
   "base",
@@ -34467,12 +34543,12 @@ var JSXNode = class {
     const props = this.props;
     let { children } = this;
     buffer[0] += `<${tag}`;
-    const normalizeKey = tag === "svg" || nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName(normalizeIntrinsicElementKey(key)) : (key) => normalizeIntrinsicElementKey(key);
-    for (let [key, v] of Object.entries(props)) {
-      key = normalizeKey(key);
-      if (!isValidAttributeName(key))
+    const normalizeKey = tag === "svg" || nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key2) => toSVGAttributeName(normalizeIntrinsicElementKey(key2)) : (key2) => normalizeIntrinsicElementKey(key2);
+    for (let [key2, v] of Object.entries(props)) {
+      key2 = normalizeKey(key2);
+      if (!isValidAttributeName(key2))
         continue;
-      if (key === "children") {} else if (key === "style" && typeof v === "object") {
+      if (key2 === "children") {} else if (key2 === "style" && typeof v === "object") {
         let styleStr = "";
         styleObjectForEach(v, (property, value) => {
           if (value != null)
@@ -34482,26 +34558,26 @@ var JSXNode = class {
         escapeToBuffer(styleStr, buffer);
         buffer[0] += '"';
       } else if (typeof v === "string") {
-        buffer[0] += ` ${key}="`;
+        buffer[0] += ` ${key2}="`;
         escapeToBuffer(v, buffer);
         buffer[0] += '"';
       } else if (v === null || v === undefined) {} else if (typeof v === "number" || v.isEscaped)
-        buffer[0] += ` ${key}="${v}"`;
-      else if (typeof v === "boolean" && booleanAttributes.includes(key)) {
+        buffer[0] += ` ${key2}="${v}"`;
+      else if (typeof v === "boolean" && booleanAttributes.includes(key2)) {
         if (v)
-          buffer[0] += ` ${key}=""`;
-      } else if (key === "dangerouslySetInnerHTML") {
+          buffer[0] += ` ${key2}=""`;
+      } else if (key2 === "dangerouslySetInnerHTML") {
         if (children.length > 0)
           throw new Error("Can only set one of `children` or `props.dangerouslySetInnerHTML`.");
         children = [raw(v.__html)];
       } else if (v instanceof Promise) {
-        buffer[0] += ` ${key}="`;
+        buffer[0] += ` ${key2}="`;
         buffer.unshift('"', v);
       } else if (typeof v === "function") {
-        if (!key.startsWith("on") && key !== "ref")
-          throw new Error(`Invalid prop '${key}' of type 'function' supplied to '${tag}'.`);
+        if (!key2.startsWith("on") && key2 !== "ref")
+          throw new Error(`Invalid prop '${key2}' of type 'function' supplied to '${tag}'.`);
       } else {
-        buffer[0] += ` ${key}="`;
+        buffer[0] += ` ${key2}="`;
         escapeToBuffer(v.toString(), buffer);
         buffer[0] += '"';
       }
@@ -34567,7 +34643,7 @@ var jsxFn = (tag, props, children) => {
 };
 
 // ../../node_modules/.bun/hono@4.13.16/node_modules/hono/dist/jsx/jsx-dev-runtime.js
-function jsxDEV(tag, props, key) {
+function jsxDEV(tag, props, key2) {
   let node2;
   if (!props || !("children" in props))
     node2 = jsxFn(tag, props, []);
@@ -34575,7 +34651,7 @@ function jsxDEV(tag, props, key) {
     const children = props.children;
     node2 = Array.isArray(children) ? jsxFn(tag, props, children) : jsxFn(tag, props, [children]);
   }
-  node2.key = key;
+  node2.key = key2;
   return node2;
 }
 
@@ -34902,12 +34978,12 @@ var __exportAll2 = (all, symbols) => {
 };
 var __copyProps = (to, from, except2, desc2) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (var keys = __getOwnPropNames2(from), i2 = 0, n3 = keys.length, key;i2 < n3; i2++) {
-      key = keys[i2];
-      if (!__hasOwnProp2.call(to, key) && key !== except2) {
-        __defProp3(to, key, {
-          get: ((k) => from[k]).bind(null, key),
-          enumerable: !(desc2 = __getOwnPropDesc(from, key)) || desc2.enumerable
+    for (var keys = __getOwnPropNames2(from), i2 = 0, n3 = keys.length, key2;i2 < n3; i2++) {
+      key2 = keys[i2];
+      if (!__hasOwnProp2.call(to, key2) && key2 !== except2) {
+        __defProp3(to, key2, {
+          get: ((k) => from[k]).bind(null, key2),
+          enumerable: !(desc2 = __getOwnPropDesc(from, key2)) || desc2.enumerable
         });
       }
     }
@@ -36110,7 +36186,7 @@ var TOOL_RESULT_FOREIGN_FAMILY_KEYS = [
   "requestState"
 ];
 function normalizeContentlessToolResult(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value) || value.content !== undefined || TOOL_RESULT_FOREIGN_FAMILY_KEYS.some((key) => (key in value)))
+  if (value === null || typeof value !== "object" || Array.isArray(value) || value.content !== undefined || TOOL_RESULT_FOREIGN_FAMILY_KEYS.some((key2) => (key2 in value)))
     return value;
   return {
     ...value,
@@ -36983,11 +37059,11 @@ function build$1() {
     CallToolResultWireSchema: unknown2().superRefine((value, ctx) => {
       if (typeof value !== "object" || value === null || Array.isArray(value) || value.content !== undefined)
         return;
-      for (const key of TOOL_RESULT_FOREIGN_FAMILY_KEYS)
-        if (key in value) {
+      for (const key2 of TOOL_RESULT_FOREIGN_FAMILY_KEYS)
+        if (key2 in value) {
           ctx.addIssue({
             code: "custom",
-            message: `content is required when the body carries '${key}' \u2014 another result family cannot default into an empty tools/call success`
+            message: `content is required when the body carries '${key2}' \u2014 another result family cannot default into an empty tools/call success`
           });
           return;
         }
@@ -38550,21 +38626,21 @@ var rev2026Codec = {
   },
   validateEnvelopeMeta(meta5) {
     const issues = [];
-    for (const key of REQUIRED_ENVELOPE_KEYS)
-      if (!(key in meta5))
+    for (const key2 of REQUIRED_ENVELOPE_KEYS)
+      if (!(key2 in meta5))
         issues.push({
-          key,
+          key: key2,
           problem: "missing"
         });
     const parsed = buildSchemas2026().RequestMetaEnvelopeSchema.safeParse(meta5);
     if (!parsed.success)
       for (const issue2 of parsed.error.issues) {
         const path = issue2.path.map(String);
-        const key = path.length > 0 ? path.join(".") : "_meta";
-        if (path.length === 1 && issues.some((existing) => existing.key === key && existing.problem === "missing"))
+        const key2 = path.length > 0 ? path.join(".") : "_meta";
+        if (path.length === 1 && issues.some((existing) => existing.key === key2 && existing.problem === "missing"))
           continue;
         issues.push({
-          key,
+          key: key2,
           problem: issue2.message
         });
       }
@@ -38936,8 +39012,8 @@ function scanXMcpHeaderDeclarations(inputSchema) {
     }
     const properties = schema.properties;
     if (properties !== null && typeof properties === "object")
-      for (const [key, child] of Object.entries(properties)) {
-        const fault$1 = visit2(child, [...path, key], reachable);
+      for (const [key2, child] of Object.entries(properties)) {
+        const fault$1 = visit2(child, [...path, key2], reachable);
         if (fault$1 !== undefined)
           return fault$1;
       }
@@ -39035,10 +39111,10 @@ function decodeMcpParamValue(value) {
 }
 function valueAtPath(root, path) {
   let node2 = root;
-  for (const key of path) {
+  for (const key2 of path) {
     if (node2 === null || typeof node2 !== "object")
       return;
-    node2 = node2[key];
+    node2 = node2[key2];
   }
   return node2;
 }
@@ -39475,12 +39551,12 @@ function isProvablyObjectShapedRoot(schema, root = schema) {
   const ref = typeof schema.$ref === "string" && LOCAL_DEFINITION_REF.exec(schema.$ref);
   if (ref && root[ref[1]]?.[ref[2]]?.type === "object")
     return true;
-  for (const key of [
+  for (const key2 of [
     "oneOf",
     "anyOf",
     "allOf"
   ]) {
-    const members2 = schema[key];
+    const members2 = schema[key2];
     if (Array.isArray(members2) && members2.length > 0)
       return members2.every((m2) => m2 !== null && typeof m2 === "object" && (m2.type === "object" || isProvablyObjectShapedRoot(m2, "$id" in m2 ? {} : root)));
   }
@@ -39579,8 +39655,8 @@ var ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS = new Set([
   "title",
   "writeOnly"
 ]);
-function isAnnotationOnlyJsonSchemaKeyword(key) {
-  return ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS.has(key) || key.startsWith("x-");
+function isAnnotationOnlyJsonSchemaKeyword(key2) {
+  return ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS.has(key2) || key2.startsWith("x-");
 }
 var ROOT_KEYS = new Set(["$schema", ...Object.keys(ElicitRequestFormParamsSchema.shape.requestedSchema.shape)]);
 var PROPERTY_KEYS_BY_TYPE = {
@@ -39603,28 +39679,28 @@ function walkProperty(node2, path, vendor, unsupported) {
   if (allowedKeys === undefined)
     return node2;
   const pruned = {};
-  for (const [key, value] of Object.entries(node2))
-    if (allowedKeys.has(key) || isAnnotationOnlyJsonSchemaKeyword(key))
-      pruned[key] = value;
-    else if (key === "pattern" && node2.type === "string" && typeof node2.format === "string") {
+  for (const [key2, value] of Object.entries(node2))
+    if (allowedKeys.has(key2) || isAnnotationOnlyJsonSchemaKeyword(key2))
+      pruned[key2] = value;
+    else if (key2 === "pattern" && node2.type === "string" && typeof node2.format === "string") {
       if (!SUPPORTED_STRING_FORMATS.has(node2.format))
-        pruned[key] = value;
+        pruned[key2] = value;
       else if (typeof value !== "string" || !isLibraryFormatPattern(node2.format, value, vendor))
-        unsupported.push(`${path}.${key}`);
+        unsupported.push(`${path}.${key2}`);
     } else
-      unsupported.push(`${path}.${key}`);
+      unsupported.push(`${path}.${key2}`);
   return pruned;
 }
 function walkRequestedSchema(converted, vendor) {
   const pruned = {};
   const unsupported = [];
-  for (const [key, value] of Object.entries(converted))
-    if (key === "properties" && isJsonObject(value))
-      pruned[key] = Object.fromEntries(Object.entries(value).map(([name, node2]) => [name, walkProperty(node2, `properties.${name}`, vendor, unsupported)]));
-    else if (ROOT_KEYS.has(key))
-      pruned[key] = value;
-    else if (!isAnnotationOnlyJsonSchemaKeyword(key))
-      unsupported.push(key);
+  for (const [key2, value] of Object.entries(converted))
+    if (key2 === "properties" && isJsonObject(value))
+      pruned[key2] = Object.fromEntries(Object.entries(value).map(([name, node2]) => [name, walkProperty(node2, `properties.${name}`, vendor, unsupported)]));
+    else if (ROOT_KEYS.has(key2))
+      pruned[key2] = value;
+    else if (!isAnnotationOnlyJsonSchemaKeyword(key2))
+      unsupported.push(key2);
   if (unsupported.length > 0)
     throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${unsupported.join(", ")}`);
   return pruned;
@@ -39640,11 +39716,11 @@ function findDroppedConstraintPaths(original, parsed, path = "") {
     return original.flatMap((item, index2) => findDroppedConstraintPaths(item, parsed[index2], `${path}[${index2}]`));
   if (!isJsonObject(original) || !isJsonObject(parsed))
     return [];
-  return Object.entries(original).flatMap(([key, value]) => {
-    const childPath = path ? `${path}.${key}` : key;
-    if (!Object.prototype.hasOwnProperty.call(parsed, key))
-      return isAnnotationOnlyJsonSchemaKeyword(key) ? [] : [childPath];
-    return findDroppedConstraintPaths(value, parsed[key], childPath);
+  return Object.entries(original).flatMap(([key2, value]) => {
+    const childPath = path ? `${path}.${key2}` : key2;
+    if (!Object.prototype.hasOwnProperty.call(parsed, key2))
+      return isAnnotationOnlyJsonSchemaKeyword(key2) ? [] : [childPath];
+    return findDroppedConstraintPaths(value, parsed[key2], childPath);
   });
 }
 function normalizeElicitInputParams(input4) {
@@ -39662,7 +39738,7 @@ function normalizeElicitInputParams(input4) {
   const droppedConstraints = findDroppedConstraintPaths(pruned, parsed.data);
   if (droppedConstraints.length > 0)
     throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${droppedConstraints.join(", ")}`);
-  const danglingRequired = (parsed.data.required ?? []).filter((key) => !Object.prototype.hasOwnProperty.call(parsed.data.properties, key));
+  const danglingRequired = (parsed.data.required ?? []).filter((key2) => !Object.prototype.hasOwnProperty.call(parsed.data.properties, key2));
   if (danglingRequired.length > 0)
     throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Elicitation requestedSchema lists required properties that are not defined in properties: ${danglingRequired.join(", ")}`);
   return {
@@ -39924,15 +40000,15 @@ var authSchemas = {
 };
 var _specTypeSchemas = {};
 var _isSpecType = {};
-function register2(key, schema) {
-  const name = key.slice(0, -6);
+function register2(key2, schema) {
+  const name = key2.slice(0, -6);
   _specTypeSchemas[name] = schema;
   _isSpecType[name] = (v) => schema.safeParse(v).success;
 }
-for (const key of SPEC_SCHEMA_KEYS)
-  register2(key, schemas_exports[key]);
-for (const [key, schema] of Object.entries(authSchemas))
-  register2(key, schema);
+for (const key2 of SPEC_SCHEMA_KEYS)
+  register2(key2, schemas_exports[key2]);
+for (const [key2, schema] of Object.entries(authSchemas))
+  register2(key2, schema);
 var specTypeSchemas = Object.freeze(_specTypeSchemas);
 var isSpecType = Object.freeze(_isSpecType);
 function bootstrapOutboundCodec(method) {
@@ -39962,8 +40038,8 @@ function liftWireOnlyMaterial(message, kind) {
       lifted: {}
     };
   const meta5 = params._meta;
-  const envelopeKeys = isPlainObject$1(meta5) ? RESERVED_ENVELOPE_META_KEYS.filter((key) => (key in meta5)) : [];
-  const retryKeys = kind === "request" ? RETRY_PARAMS_KEYS.filter((key) => (key in params)) : [];
+  const envelopeKeys = isPlainObject$1(meta5) ? RESERVED_ENVELOPE_META_KEYS.filter((key2) => (key2 in meta5)) : [];
+  const retryKeys = kind === "request" ? RETRY_PARAMS_KEYS.filter((key2) => (key2 in params)) : [];
   if (envelopeKeys.length === 0 && retryKeys.length === 0)
     return {
       message,
@@ -39974,9 +40050,9 @@ function liftWireOnlyMaterial(message, kind) {
   if (envelopeKeys.length > 0 && isPlainObject$1(meta5)) {
     const envelope = {};
     const nextMeta = { ...meta5 };
-    for (const key of envelopeKeys) {
-      envelope[key] = meta5[key];
-      delete nextMeta[key];
+    for (const key2 of envelopeKeys) {
+      envelope[key2] = meta5[key2];
+      delete nextMeta[key2];
     }
     lifted.envelope = envelope;
     if (Object.keys(nextMeta).length > 0)
@@ -39984,12 +40060,12 @@ function liftWireOnlyMaterial(message, kind) {
     else
       delete nextParams._meta;
   }
-  for (const key of retryKeys) {
-    if (key === "inputResponses")
-      lifted.inputResponses = nextParams[key];
-    if (key === "requestState")
-      lifted.requestState = nextParams[key];
-    delete nextParams[key];
+  for (const key2 of retryKeys) {
+    if (key2 === "inputResponses")
+      lifted.inputResponses = nextParams[key2];
+    if (key2 === "requestState")
+      lifted.requestState = nextParams[key2];
+    delete nextParams[key2];
   }
   return {
     message: {
@@ -40640,8 +40716,8 @@ function isPlainObject$1(value) {
 }
 function mergeCapabilities(base, additional) {
   const result = { ...base };
-  for (const key in additional) {
-    const k = key;
+  for (const key2 in additional) {
+    const k = key2;
     const addValue = additional[k];
     if (addValue === undefined)
       continue;
@@ -40664,12 +40740,12 @@ function partitionInputResponses(inputResponses) {
       accepted,
       droppedKeys
     };
-  for (const [key, entry] of Object.entries(inputResponses)) {
+  for (const [key2, entry] of Object.entries(inputResponses)) {
     if (!isPlainObject2(entry) || "method" in entry || "result" in entry) {
-      droppedKeys.push(key);
+      droppedKeys.push(key2);
       continue;
     }
-    accepted[key] = entry;
+    accepted[key2] = entry;
   }
   return {
     accepted,
@@ -40706,7 +40782,7 @@ var require_content_type = /* @__PURE__ */ __commonJSMin((exports) => {
       throw new TypeError("invalid media type");
     var obj = new ContentType(type.toLowerCase());
     if (index2 !== -1) {
-      var key;
+      var key2;
       var match2;
       var value;
       PARAM_REGEXP.lastIndex = index2;
@@ -40714,14 +40790,14 @@ var require_content_type = /* @__PURE__ */ __commonJSMin((exports) => {
         if (match2.index !== index2)
           throw new TypeError("invalid parameter format");
         index2 += match2[0].length;
-        key = match2[1].toLowerCase();
+        key2 = match2[1].toLowerCase();
         value = match2[2];
         if (value.charCodeAt(0) === 34) {
           value = value.slice(1, -1);
           if (value.indexOf("\\") !== -1)
             value = value.replace(QESC_REGEXP, "$1");
         }
-        obj.parameters[key] = value;
+        obj.parameters[key2] = value;
       }
       if (index2 !== header.length)
         throw new TypeError("invalid parameter format");
@@ -40972,14 +41048,14 @@ var require_code$1 = /* @__PURE__ */ __commonJSMin((exports) => {
     return JSON.stringify(x).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
   }
   exports.safeStringify = safeStringify;
-  function getProperty(key) {
-    return typeof key == "string" && exports.IDENTIFIER.test(key) ? new _Code(`.${key}`) : _2`[${key}]`;
+  function getProperty(key2) {
+    return typeof key2 == "string" && exports.IDENTIFIER.test(key2) ? new _Code(`.${key2}`) : _2`[${key2}]`;
   }
   exports.getProperty = getProperty;
-  function getEsmExportName(key) {
-    if (typeof key == "string" && exports.IDENTIFIER.test(key))
-      return new _Code(`${key}`);
-    throw new Error(`CodeGen: invalid export name: ${key}, use explicit $id name mapping`);
+  function getEsmExportName(key2) {
+    if (typeof key2 == "string" && exports.IDENTIFIER.test(key2))
+      return new _Code(`${key2}`);
+    throw new Error(`CodeGen: invalid export name: ${key2}, use explicit $id name mapping`);
   }
   exports.getEsmExportName = getEsmExportName;
   function regexpCode(rx) {
@@ -41625,11 +41701,11 @@ var require_codegen = /* @__PURE__ */ __commonJSMin((exports) => {
     }
     object(...keyValues) {
       const code = ["{"];
-      for (const [key, value] of keyValues) {
+      for (const [key2, value] of keyValues) {
         if (code.length > 1)
           code.push(",");
-        code.push(key);
-        if (key !== value || this.opts.es5) {
+        code.push(key2);
+        if (key2 !== value || this.opts.es5) {
           code.push(":");
           (0, code_1.addCodeArg)(code, value);
         }
@@ -41876,16 +41952,16 @@ var require_util = /* @__PURE__ */ __commonJSMin((exports) => {
     if (typeof schema === "boolean")
       return;
     const rules = self.RULES.keywords;
-    for (const key in schema)
-      if (!rules[key])
-        checkStrictMode(it, `unknown keyword: "${key}"`);
+    for (const key2 in schema)
+      if (!rules[key2])
+        checkStrictMode(it, `unknown keyword: "${key2}"`);
   }
   exports.checkUnknownRules = checkUnknownRules;
   function schemaHasRules(schema, rules) {
     if (typeof schema == "boolean")
       return !schema;
-    for (const key in schema)
-      if (rules[key])
+    for (const key2 in schema)
+      if (rules[key2])
         return true;
     return false;
   }
@@ -41893,8 +41969,8 @@ var require_util = /* @__PURE__ */ __commonJSMin((exports) => {
   function schemaHasRulesButRef(schema, RULES) {
     if (typeof schema == "boolean")
       return !schema;
-    for (const key in schema)
-      if (key !== "$ref" && RULES.all[key])
+    for (const key2 in schema)
+      if (key2 !== "$ref" && RULES.all[key2])
         return true;
     return false;
   }
@@ -42440,8 +42516,8 @@ var require_defaults = /* @__PURE__ */ __commonJSMin((exports) => {
   function assignDefaults(it, ty) {
     const { properties, items } = it.schema;
     if (ty === "object" && properties)
-      for (const key in properties)
-        assignDefault(it, key, properties[key].default);
+      for (const key2 in properties)
+        assignDefault(it, key2, properties[key2].default);
     else if (ty === "array" && Array.isArray(items))
       items.forEach((sch, i2) => assignDefault(it, i2, sch.default));
   }
@@ -42802,8 +42878,8 @@ var require_fast_deep_equal = /* @__PURE__ */ __commonJSMin((exports, module) =>
         if (!Object.prototype.hasOwnProperty.call(b2, keys[i2]))
           return false;
       for (i2 = length;i2-- !== 0; ) {
-        var key = keys[i2];
-        if (!equal(a2[key], b2[key]))
+        var key2 = keys[i2];
+        if (!equal(a2[key2], b2[key2]))
           return false;
       }
       return true;
@@ -42869,18 +42945,18 @@ var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin((exports, modul
   function _traverse(opts, pre, post, schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex) {
     if (schema && typeof schema == "object" && !Array.isArray(schema)) {
       pre(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
-      for (var key in schema) {
-        var sch = schema[key];
+      for (var key2 in schema) {
+        var sch = schema[key2];
         if (Array.isArray(sch)) {
-          if (key in traverse.arrayKeywords)
+          if (key2 in traverse.arrayKeywords)
             for (var i2 = 0;i2 < sch.length; i2++)
-              _traverse(opts, pre, post, sch[i2], jsonPtr + "/" + key + "/" + i2, rootSchema, jsonPtr, key, schema, i2);
-        } else if (key in traverse.propsKeywords) {
+              _traverse(opts, pre, post, sch[i2], jsonPtr + "/" + key2 + "/" + i2, rootSchema, jsonPtr, key2, schema, i2);
+        } else if (key2 in traverse.propsKeywords) {
           if (sch && typeof sch == "object")
             for (var prop in sch)
-              _traverse(opts, pre, post, sch[prop], jsonPtr + "/" + key + "/" + escapeJsonPtr(prop), rootSchema, jsonPtr, key, schema, prop);
-        } else if (key in traverse.keywords || opts.allKeys && !(key in traverse.skipKeywords))
-          _traverse(opts, pre, post, sch, jsonPtr + "/" + key, rootSchema, jsonPtr, key, schema);
+              _traverse(opts, pre, post, sch[prop], jsonPtr + "/" + key2 + "/" + escapeJsonPtr(prop), rootSchema, jsonPtr, key2, schema, prop);
+        } else if (key2 in traverse.keywords || opts.allKeys && !(key2 in traverse.skipKeywords))
+          _traverse(opts, pre, post, sch, jsonPtr + "/" + key2, rootSchema, jsonPtr, key2, schema);
       }
       post(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
     }
@@ -42931,10 +43007,10 @@ var require_resolve = /* @__PURE__ */ __commonJSMin((exports) => {
     "$dynamicAnchor"
   ]);
   function hasRef(schema) {
-    for (const key in schema) {
-      if (REF_KEYWORDS.has(key))
+    for (const key2 in schema) {
+      if (REF_KEYWORDS.has(key2))
         return true;
-      const sch = schema[key];
+      const sch = schema[key2];
       if (Array.isArray(sch) && sch.some(hasRef))
         return true;
       if (typeof sch == "object" && hasRef(sch))
@@ -42944,14 +43020,14 @@ var require_resolve = /* @__PURE__ */ __commonJSMin((exports) => {
   }
   function countKeys(schema) {
     let count2 = 0;
-    for (const key in schema) {
-      if (key === "$ref")
+    for (const key2 in schema) {
+      if (key2 === "$ref")
         return Infinity;
       count2++;
-      if (SIMPLE_INLINED.has(key))
+      if (SIMPLE_INLINED.has(key2))
         continue;
-      if (typeof schema[key] == "object")
-        (0, util_1.eachItem)(schema[key], (sch) => count2 += countKeys(sch));
+      if (typeof schema[key2] == "object")
+        (0, util_1.eachItem)(schema[key2], (sch) => count2 += countKeys(sch));
       if (count2 === Infinity)
         return Infinity;
     }
@@ -43128,8 +43204,8 @@ var require_validate = /* @__PURE__ */ __commonJSMin((exports) => {
   function schemaCxtHasRules({ schema, self }) {
     if (typeof schema == "boolean")
       return !schema;
-    for (const key in schema)
-      if (self.RULES.all[key])
+    for (const key2 in schema)
+      if (self.RULES.all[key2])
         return true;
     return false;
   }
@@ -45089,7 +45165,7 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin((exports) => {
         }
       }
     }
-    addSchema(schema, key, _meta, _validateSchema = this.opts.validateSchema) {
+    addSchema(schema, key2, _meta, _validateSchema = this.opts.validateSchema) {
       if (Array.isArray(schema)) {
         for (const sch of schema)
           this.addSchema(sch, undefined, _meta, _validateSchema);
@@ -45102,13 +45178,13 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin((exports) => {
         if (id2 !== undefined && typeof id2 != "string")
           throw new Error(`schema ${schemaId} must be string`);
       }
-      key = (0, resolve_1.normalizeId)(key || id2);
-      this._checkUnique(key);
-      this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
+      key2 = (0, resolve_1.normalizeId)(key2 || id2);
+      this._checkUnique(key2);
+      this.schemas[key2] = this._addSchema(schema, _meta, key2, _validateSchema, true);
       return this;
     }
-    addMetaSchema(schema, key, _validateSchema = this.opts.validateSchema) {
-      this.addSchema(schema, key, true, _validateSchema);
+    addMetaSchema(schema, key2, _validateSchema = this.opts.validateSchema) {
+      this.addSchema(schema, key2, true, _validateSchema);
       return this;
     }
     validateSchema(schema, throwOrLogError) {
@@ -45254,14 +45330,14 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin((exports) => {
         let keywords = metaSchema;
         for (const seg of segments)
           keywords = keywords[seg];
-        for (const key in rules) {
-          const rule = rules[key];
+        for (const key2 in rules) {
+          const rule = rules[key2];
           if (typeof rule != "object")
             continue;
           const { $data } = rule.definition;
-          const schema = keywords[key];
+          const schema = keywords[key2];
           if ($data && schema)
-            keywords[key] = schemaOrData(schema);
+            keywords[key2] = schemaOrData(schema);
         }
       }
       return metaSchema;
@@ -45337,10 +45413,10 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin((exports) => {
   Ajv.MissingRefError = ref_error_1.default;
   exports.default = Ajv;
   function checkOptions(checkOpts, options2, msg, log2 = "error") {
-    for (const key in checkOpts) {
-      const opt = key;
+    for (const key2 in checkOpts) {
+      const opt = key2;
       if (opt in options2)
-        this.logger[log2](`${msg}: option ${key}. ${checkOpts[opt]}`);
+        this.logger[log2](`${msg}: option ${key2}. ${checkOpts[opt]}`);
     }
   }
   function getSchEnv(keyRef) {
@@ -45354,8 +45430,8 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin((exports) => {
     if (Array.isArray(optsSchemas))
       this.addSchema(optsSchemas);
     else
-      for (const key in optsSchemas)
-        this.addSchema(optsSchemas[key], key);
+      for (const key2 in optsSchemas)
+        this.addSchema(optsSchemas[key2], key2);
   }
   function addInitialFormats() {
     for (const name in this.opts.formats) {
@@ -46302,11 +46378,11 @@ var require_dependencies = /* @__PURE__ */ __commonJSMin((exports) => {
   function splitDependencies({ schema }) {
     const propertyDeps = {};
     const schemaDeps = {};
-    for (const key in schema) {
-      if (key === "__proto__")
+    for (const key2 in schema) {
+      if (key2 === "__proto__")
         continue;
-      const deps = Array.isArray(schema[key]) ? propertyDeps : schemaDeps;
-      deps[key] = schema[key];
+      const deps = Array.isArray(schema[key2]) ? propertyDeps : schemaDeps;
+      deps[key2] = schema[key2];
     }
     return [propertyDeps, schemaDeps];
   }
@@ -46374,13 +46450,13 @@ var require_propertyNames = /* @__PURE__ */ __commonJSMin((exports) => {
       if ((0, util_1.alwaysValidSchema)(it, schema))
         return;
       const valid = gen.name("valid");
-      gen.forIn("key", data, (key) => {
-        cxt.setParams({ propertyName: key });
+      gen.forIn("key", data, (key2) => {
+        cxt.setParams({ propertyName: key2 });
         cxt.subschema({
           keyword: "propertyNames",
-          data: key,
+          data: key2,
           dataTypes: ["string"],
-          propertyName: key,
+          propertyName: key2,
           compositeRule: true
         }, valid);
         gen.if((0, codegen_1.not)(valid), () => {
@@ -46423,36 +46499,36 @@ var require_additionalProperties = /* @__PURE__ */ __commonJSMin((exports) => {
       checkAdditionalProperties();
       cxt.ok((0, codegen_1._)`${errsCount} === ${names_1.default.errors}`);
       function checkAdditionalProperties() {
-        gen.forIn("key", data, (key) => {
+        gen.forIn("key", data, (key2) => {
           if (!props.length && !patProps.length)
-            additionalPropertyCode(key);
+            additionalPropertyCode(key2);
           else
-            gen.if(isAdditional(key), () => additionalPropertyCode(key));
+            gen.if(isAdditional(key2), () => additionalPropertyCode(key2));
         });
       }
-      function isAdditional(key) {
+      function isAdditional(key2) {
         let definedProp;
         if (props.length > 8) {
           const propsSchema = (0, util_1.schemaRefOrVal)(it, parentSchema.properties, "properties");
-          definedProp = (0, code_1.isOwnProperty)(gen, propsSchema, key);
+          definedProp = (0, code_1.isOwnProperty)(gen, propsSchema, key2);
         } else if (props.length)
-          definedProp = (0, codegen_1.or)(...props.map((p2) => (0, codegen_1._)`${key} === ${p2}`));
+          definedProp = (0, codegen_1.or)(...props.map((p2) => (0, codegen_1._)`${key2} === ${p2}`));
         else
           definedProp = codegen_1.nil;
         if (patProps.length)
-          definedProp = (0, codegen_1.or)(definedProp, ...patProps.map((p2) => (0, codegen_1._)`${(0, code_1.usePattern)(cxt, p2)}.test(${key})`));
+          definedProp = (0, codegen_1.or)(definedProp, ...patProps.map((p2) => (0, codegen_1._)`${(0, code_1.usePattern)(cxt, p2)}.test(${key2})`));
         return (0, codegen_1.not)(definedProp);
       }
-      function deleteAdditional(key) {
-        gen.code((0, codegen_1._)`delete ${data}[${key}]`);
+      function deleteAdditional(key2) {
+        gen.code((0, codegen_1._)`delete ${data}[${key2}]`);
       }
-      function additionalPropertyCode(key) {
+      function additionalPropertyCode(key2) {
         if (opts.removeAdditional === "all" || opts.removeAdditional && schema === false) {
-          deleteAdditional(key);
+          deleteAdditional(key2);
           return;
         }
         if (schema === false) {
-          cxt.setParams({ additionalProperty: key });
+          cxt.setParams({ additionalProperty: key2 });
           cxt.error();
           if (!allErrors)
             gen.break();
@@ -46461,22 +46537,22 @@ var require_additionalProperties = /* @__PURE__ */ __commonJSMin((exports) => {
         if (typeof schema == "object" && !(0, util_1.alwaysValidSchema)(it, schema)) {
           const valid = gen.name("valid");
           if (opts.removeAdditional === "failing") {
-            applyAdditionalSchema(key, valid, false);
+            applyAdditionalSchema(key2, valid, false);
             gen.if((0, codegen_1.not)(valid), () => {
               cxt.reset();
-              deleteAdditional(key);
+              deleteAdditional(key2);
             });
           } else {
-            applyAdditionalSchema(key, valid);
+            applyAdditionalSchema(key2, valid);
             if (!allErrors)
               gen.if((0, codegen_1.not)(valid), () => gen.break());
           }
         }
       }
-      function applyAdditionalSchema(key, valid, errors3) {
+      function applyAdditionalSchema(key2, valid, errors3) {
         const subschema = {
           keyword: "additionalProperties",
-          dataProp: key,
+          dataProp: key2,
           dataPropType: util_1.Type.Str
         };
         if (errors3 === false)
@@ -46583,18 +46659,18 @@ var require_patternProperties = /* @__PURE__ */ __commonJSMin((exports) => {
             (0, util_1.checkStrictMode)(it, `property ${prop} matches pattern ${pat} (use allowMatchingProperties)`);
       }
       function validateProperties(pat) {
-        gen.forIn("key", data, (key) => {
-          gen.if((0, codegen_1._)`${(0, code_1.usePattern)(cxt, pat)}.test(${key})`, () => {
+        gen.forIn("key", data, (key2) => {
+          gen.if((0, codegen_1._)`${(0, code_1.usePattern)(cxt, pat)}.test(${key2})`, () => {
             const alwaysValid = alwaysValidPatterns.includes(pat);
             if (!alwaysValid)
               cxt.subschema({
                 keyword: "patternProperties",
                 schemaProp: pat,
-                dataProp: key,
+                dataProp: key2,
                 dataPropType: util_2.Type.Str
               }, valid);
             if (it.opts.unevaluated && props !== true)
-              gen.assign((0, codegen_1._)`${props}[${key}]`, true);
+              gen.assign((0, codegen_1._)`${props}[${key2}]`, true);
             else if (!alwaysValid && !it.allErrors)
               gen.if((0, codegen_1.not)(valid), () => gen.break());
           });
@@ -47494,14 +47570,14 @@ var require_unevaluatedProperties = /* @__PURE__ */ __commonJSMin((exports) => {
         throw new Error("ajv implementation error");
       const { allErrors, props } = it;
       if (props instanceof codegen_1.Name)
-        gen.if((0, codegen_1._)`${props} !== true`, () => gen.forIn("key", data, (key) => gen.if(unevaluatedDynamic(props, key), () => unevaluatedPropCode(key))));
+        gen.if((0, codegen_1._)`${props} !== true`, () => gen.forIn("key", data, (key2) => gen.if(unevaluatedDynamic(props, key2), () => unevaluatedPropCode(key2))));
       else if (props !== true)
-        gen.forIn("key", data, (key) => props === undefined ? unevaluatedPropCode(key) : gen.if(unevaluatedStatic(props, key), () => unevaluatedPropCode(key)));
+        gen.forIn("key", data, (key2) => props === undefined ? unevaluatedPropCode(key2) : gen.if(unevaluatedStatic(props, key2), () => unevaluatedPropCode(key2)));
       it.props = true;
       cxt.ok((0, codegen_1._)`${errsCount} === ${names_1.default.errors}`);
-      function unevaluatedPropCode(key) {
+      function unevaluatedPropCode(key2) {
         if (schema === false) {
-          cxt.setParams({ unevaluatedProperty: key });
+          cxt.setParams({ unevaluatedProperty: key2 });
           cxt.error();
           if (!allErrors)
             gen.break();
@@ -47511,21 +47587,21 @@ var require_unevaluatedProperties = /* @__PURE__ */ __commonJSMin((exports) => {
           const valid = gen.name("valid");
           cxt.subschema({
             keyword: "unevaluatedProperties",
-            dataProp: key,
+            dataProp: key2,
             dataPropType: util_1.Type.Str
           }, valid);
           if (!allErrors)
             gen.if((0, codegen_1.not)(valid), () => gen.break());
         }
       }
-      function unevaluatedDynamic(evaluatedProps, key) {
-        return (0, codegen_1._)`!${evaluatedProps} || !${evaluatedProps}[${key}]`;
+      function unevaluatedDynamic(evaluatedProps, key2) {
+        return (0, codegen_1._)`!${evaluatedProps} || !${evaluatedProps}[${key2}]`;
       }
-      function unevaluatedStatic(evaluatedProps, key) {
+      function unevaluatedStatic(evaluatedProps, key2) {
         const ps = [];
         for (const p2 in evaluatedProps)
           if (evaluatedProps[p2] === true)
-            ps.push((0, codegen_1._)`${key} !== ${p2}`);
+            ps.push((0, codegen_1._)`${key2} !== ${p2}`);
         return (0, codegen_1.and)(...ps);
       }
     }
@@ -49146,13 +49222,13 @@ function resolveLegacyShimOptions(options2) {
     legacyShim: options2?.legacyShim ?? true
   };
 }
-function coerceEmbeddedInputRequest(method, key, entry) {
+function coerceEmbeddedInputRequest(method, key2, entry) {
   if (entry === null || typeof entry !== "object" || typeof entry.method !== "string")
-    throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an invalid input request '${key}': each inputRequests entry must be an embedded elicitation/create, sampling/createMessage, or roots/list request`);
+    throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an invalid input request '${key2}': each inputRequests entry must be an embedded elicitation/create, sampling/createMessage, or roots/list request`);
   const embedded = entry;
   const required3 = requiredClientCapabilitiesForInputRequest(embedded);
   if (required3 === undefined)
-    throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an input request '${key}' of kind '${embedded.method}', which is not an embedded request the 2026-07-28 revision defines`);
+    throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an input request '${key2}' of kind '${embedded.method}', which is not an embedded request the 2026-07-28 revision defines`);
   return {
     embedded,
     required: required3
@@ -49202,13 +49278,13 @@ var LegacyInputRequiredShim = class {
       if (hasInputRequests) {
         const declared = this._host.resolvedClientCapabilities(ctx);
         const coerced = [];
-        for (const [key, entry] of Object.entries(inputRequests)) {
-          const { embedded, required: required3 } = coerceEmbeddedInputRequest(method, key, entry);
+        for (const [key2, entry] of Object.entries(inputRequests)) {
+          const { embedded, required: required3 } = coerceEmbeddedInputRequest(method, key2, entry);
           if (embedded.method !== "roots/list" && embedded.params === undefined)
-            throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an input request '${key}' of kind '${embedded.method}' without params`);
+            throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an input request '${key2}' of kind '${embedded.method}' without params`);
           if (missingClientCapabilities(required3, declared) !== undefined)
-            return legacyShimFailure(method, `Cannot request input '${key}' (${embedded.method}): the client on this 2025-era connection did not declare the required capability${declared === undefined ? " (no client capabilities are available on this connection \u2014 per-request legacy serving cannot receive server-to-client requests)" : ""}`);
-          coerced.push([key, embedded]);
+            return legacyShimFailure(method, `Cannot request input '${key2}' (${embedded.method}): the client on this 2025-era connection did not declare the required capability${declared === undefined ? " (no client capabilities are available on this connection \u2014 per-request legacy serving cannot receive server-to-client requests)" : ""}`);
+          coerced.push([key2, embedded]);
         }
         const roundAbort = linkedRoundAbort(outerSignal);
         try {
@@ -49219,9 +49295,9 @@ var LegacyInputRequiredShim = class {
             onprogress: () => {},
             signal: roundAbort.signal
           };
-          const fulfilled = await Promise.all(coerced.map(async ([key, embedded]) => {
+          const fulfilled = await Promise.all(coerced.map(async ([key2, embedded]) => {
             try {
-              return [key, await this._dispatchLeg(embedded, legOptions)];
+              return [key2, await this._dispatchLeg(embedded, legOptions)];
             } catch (error62) {
               roundAbort.abort(error62);
               throw error62;
@@ -49502,11 +49578,11 @@ var Server = class extends Protocol {
       throw new ProtocolError(ProtocolErrorCode.InternalError, `Handler for ${method} returned an input-required result with neither inputRequests nor requestState (every InputRequiredResult must include at least one of the two)`);
     if (hasInputRequests) {
       const declared = this._inputRequestCapabilityView(ctx);
-      for (const [key, entry] of Object.entries(inputRequests)) {
-        const { embedded, required: required3 } = coerceEmbeddedInputRequest(method, key, entry);
+      for (const [key2, entry] of Object.entries(inputRequests)) {
+        const { embedded, required: required3 } = coerceEmbeddedInputRequest(method, key2, entry);
         const missing = missingClientCapabilities(required3, declared);
         if (missing !== undefined)
-          throw new MissingRequiredClientCapabilityError({ requiredCapabilities: missing }, `Cannot request input '${key}' (${embedded.method}): the request's client capabilities do not declare the required capability`);
+          throw new MissingRequiredClientCapabilityError({ requiredCapabilities: missing }, `Cannot request input '${key2}' (${embedded.method}): the request's client capabilities do not declare the required capability`);
       }
     }
     return result;
@@ -49791,12 +49867,12 @@ function toolInputElementCount(value, max) {
           stack.push(child);
       }
     else
-      for (const key in node2) {
-        if (!Object.prototype.hasOwnProperty.call(node2, key))
+      for (const key2 in node2) {
+        if (!Object.prototype.hasOwnProperty.call(node2, key2))
           continue;
         if (++count2 > max)
           return count2;
-        const child = node2[key];
+        const child = node2[key2];
         if (child !== null && typeof child === "object")
           stack.push(child);
       }
@@ -52007,7 +52083,7 @@ function createApp({ services, hosts, password: password2, workspace, log: log2
   }).get("/accounts/*", (c3) => c3.text(`This server has no web app. Manage its agents with artil-server; see artil-server --help.
 `)).get("/", (c3) => c3.text(`Artil Server is running. Sign an agent in with:
 
-  ARTIL_BASE_URL=${hosts.requestOrigin(c3.req.raw)} artil auth login
+  ${loginCommand(hosts.requestOrigin(c3.req.raw))}
 `)).all("*", (c3) => notFound(c3.req.method, c3.req.path));
 }
 
@@ -52026,7 +52102,7 @@ async function startServer({
   store = config2.s3 ? createS3Store(config2.s3) : undefined,
   fetch: fetch2
 }) {
-  const database = openDatabase({ path: databasePath, migrationsFolder });
+  const database = openDatabase({ path: databasePath, migrationsFolder, secret: config2.secret });
   let handleRequest = startingResponse;
   const server = Bun.serve({
     hostname: "127.0.0.1",
@@ -52395,7 +52471,7 @@ async function serve({ paths, config: config2, environment }) {
     log: out
   });
   out(`Artil Server is at ${server.baseUrl}${config2.public ? " (public, through Tailscale Funnel)" : ""}.`);
-  out(`Sign an agent in with: ARTIL_BASE_URL=${server.baseUrl} artil auth login`);
+  out(`Sign an agent in with: ${loginCommand(server.baseUrl)}`);
   out(`MCP clients connect to ${server.baseUrl}/mcp`);
   const { promise: promise3, resolve } = Promise.withResolvers();
   process.once("SIGINT", resolve);
@@ -52498,20 +52574,6 @@ async function runCli(environment) {
   }
 }
 
-// src/platform/artil-cli.ts
-var {$ } = globalThis.Bun;
-function findArtilCli() {
-  return {
-    installed: Bun.which("artil") !== null,
-    async install() {
-      const installed = await $`bun install --global artil-ai`.nothrow().quiet();
-      if (installed.exitCode !== 0) {
-        throw new Error(installed.stderr.toString().trim() || `bun install exited with ${installed.exitCode}`);
-      }
-    }
-  };
-}
-
 // src/platform/tailscale.ts
 import { existsSync } from "fs";
 var statusSchema = exports_external2.object({
@@ -52610,5 +52672,5 @@ try {
   process.exitCode = 1;
 }
 
-//# debugId=E162EED6D52D865664756E2164756E21
+//# debugId=0F36EC3652814C0464756E2164756E21
 //# sourceMappingURL=main.js.map