@finchtech/cli 0.3.8 → 0.4.0

package/dist/finch.js

@@ -1,10 +1,17 @@
 #!/usr/bin/env node
+import { createRequire as createBundleRequire } from 'node:module'; const require = createBundleRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x2) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x2, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x2)(function(x2) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x2 + '" is not supported');
+});
 var __esm = (fn, res, err2) => function __init() {
   if (err2) throw err2[0];
   try {
@@ -13,7 +20,7 @@ var __esm = (fn, res, err2) => function __init() {
     throw err2 = [e], e;
   }
 };
-var __commonJS = (cb, mod2) => function __require() {
+var __commonJS = (cb, mod2) => function __require2() {
   try {
     return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
   } catch (e) {
@@ -3315,8 +3322,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -3805,7 +3812,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -3854,9 +3861,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed2.host);
             parsed2.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed2.scheme === void 0 && parsed2.userinfo === void 0 && parsed2.host === void 0 && parsed2.port === void 0 && parsed2.query === void 0 && !parsed2.path) {
@@ -3873,7 +3880,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed2.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed2.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed2.host)) {
+          if (parsed2.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed2.host)) {
             try {
               parsed2.host = new URL("http://" + parsed2.host).hostname;
             } catch (e) {
@@ -3887,7 +3894,7 @@ var require_fast_uri = __commonJS({
               parsed2.scheme = unescape(parsed2.scheme);
             }
             if (parsed2.host !== void 0) {
-              parsed2.host = reescapeHostDelimiters(unescape(parsed2.host), isIP);
+              parsed2.host = reescapeHostDelimiters(unescape(parsed2.host), isIP2);
             }
           }
           if (parsed2.path) {
@@ -6606,6 +6613,66 @@ var require_ajv = __commonJS({
   }
 });
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@finchtech/cli",
+      version: "0.4.0",
+      description: "Finch Agent CLI for wallet-owned marketplace and MCP workflows.",
+      type: "module",
+      bin: {
+        finch: "dist/finch.js",
+        finchtech: "dist/finch.js"
+      },
+      files: [
+        "dist/finch.js",
+        "README.md",
+        "THIRD_PARTY_LICENSES.txt"
+      ],
+      engines: {
+        node: ">=20"
+      },
+      publishConfig: {
+        access: "public"
+      },
+      repository: {
+        type: "git",
+        url: "git+https://github.com/FinchipAI/Finch-Site.git",
+        directory: "apps/cli"
+      },
+      homepage: "https://www.finchtech.ai",
+      scripts: {
+        build: `esbuild src/bootstrap.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/finch.js --banner:js="import { createRequire as createBundleRequire } from 'node:module'; const require = createBundleRequire(import.meta.url);"`,
+        check: "pnpm lint && pnpm typecheck && pnpm test && pnpm build",
+        lint: "eslint src vitest.config.ts eslint.config.mjs",
+        prepack: "pnpm build",
+        test: "vitest run",
+        typecheck: "tsc --noEmit"
+      },
+      devDependencies: {
+        "@eslint/js": "9.39.2",
+        "@finch/agent-market-contracts": "workspace:*",
+        "@finch/deployment-manifest": "workspace:*",
+        "@finch/skill-content": "workspace:*",
+        "@finch/skill-market-contracts": "workspace:*",
+        "@finch/task-market-contracts": "workspace:*",
+        "@types/cross-spawn": "6.0.6",
+        "@types/node": "20.19.30",
+        ajv: "8.20.0",
+        "cross-spawn": "7.0.6",
+        esbuild: "0.28.2",
+        eslint: "9.39.2",
+        typescript: "5.9.3",
+        "typescript-eslint": "8.67.0",
+        viem: "2.55.15",
+        vitest: "4.1.10"
+      }
+    };
+  }
+});
+
 // src/state.ts
 import { execFile } from "node:child_process";
 import { constants } from "node:fs";
@@ -7086,7 +7153,7 @@ function localFailureMessage(error51) {
   }
   return "Command input does not match the expected schema. Check finch help for this command.";
 }
-var CliAuthorityError, CliProductionUnavailableError, BrowserOpenError, PUBLIC_RECOVERY_COMMAND, CliRecoveryBlockedError, CliSkillSourceError, CliSkillPresentationStaleError, CliSkillRecoveryUncertainError, CliSkillPublicationError;
+var CliAuthorityError, CliProductionUnavailableError, BrowserOpenError, MCP_AUTHORIZATION_FLOW_GUIDANCE, McpAuthorizationFlowError, PUBLIC_RECOVERY_COMMAND, CliRecoveryBlockedError, CliSkillSourceError, CliSkillPresentationStaleError, CliSkillRecoveryUncertainError, CliSkillPublicationError;
 var init_cli_error = __esm({
   "src/cli-error.ts"() {
     "use strict";
@@ -7112,6 +7179,30 @@ var init_cli_error = __esm({
         this.name = "BrowserOpenError";
       }
     };
+    MCP_AUTHORIZATION_FLOW_GUIDANCE = Object.freeze({
+      login_command_not_started: "The login command after -- could not be started. Check that the MCP client is installed and the command is correct, or use finch mcp authorize --stdin with the URL its native login prints.",
+      request_url_not_found: "The login command did not print a Finch authorization URL in time and was stopped; its callback listener is gone. Start the MCP client native login again, keep it running, and pass the new URL to finch mcp authorize --stdin, or run the command shown on the Finch authorization page.",
+      second_authorization_request: "The login command started a second authorization request, which was not approved and the command was stopped. Start the MCP client native login again.",
+      login_command_failed: "The authorization was approved, but the login command exited unsuccessfully. Read its output above, then start the MCP client native login again.",
+      login_command_timeout: "The authorization was approved and the callback delivered, but the login command did not exit in time and was stopped. Check the MCP client connection; if it is not authorized, start its native login again.",
+      callback_rejected: "The authorization was approved, but the MCP client callback rejected it. Start the MCP client native login again.",
+      callback_delivery_unknown: "The authorization was approved, but whether the MCP client received the callback is unknown. Check the MCP client connection before starting its native login again.",
+      callback_unreachable: "The authorization was approved, but no MCP client callback listener was reachable on this machine. Keep the MCP client native login running on the same machine as Finch CLI and try again.",
+      stdin_invalid: "Pass exactly one Finch authorization URL on standard input, for example printf '%s' '<URL>' | finch mcp authorize --stdin."
+    });
+    McpAuthorizationFlowError = class extends Error {
+      constructor(reason, detail = {}, options) {
+        super("MCP_AUTHORIZATION_FLOW_FAILED", options);
+        this.reason = reason;
+        this.detail = detail;
+        this.name = "McpAuthorizationFlowError";
+        this.guidance = MCP_AUTHORIZATION_FLOW_GUIDANCE[reason];
+      }
+      reason;
+      detail;
+      code = "MCP_AUTHORIZATION_FLOW_FAILED";
+      guidance;
+    };
     PUBLIC_RECOVERY_COMMAND = /^(?:finch purchase (?:submit|recover-approval) [0-9a-f-]+(?: --transaction-hash 0x[0-9a-f]{64})?|finch task recover [0-9a-f-]+ (?:publish|award|reclaim)|finch skill recover (?:publication|intent) [0-9a-f]{64})$/u;
     CliRecoveryBlockedError = class extends Error {
       code = "CLI_RECOVERY_BLOCKED";
@@ -12571,7 +12662,7 @@ function decodeAgentCliMcpAuthorizationRequest(requestToken) {
   }
   return requestUrl;
 }
-var booleanSchema, timestampSchema, agentCliMcpAuthorizationRequestTokenPrefix, agentCliMcpAuthorizationRequestMaximumUrlBytes, agentCliMcpAuthorizationRequestMaximumPayloadCharacters, base64UrlAlphabet, AGENT_CLI_MCP_AUTHORIZATION_REQUEST_TOKEN, LOCAL_SIGNING_ABANDON_CONTRACT, localSigningAbandonReceiptSchema, authorizationBase, browserAuthorizationBase, signingStatusSchema, agentCliSigningIntentSchema, browserPublicationSigningIntentSchema, browserPurchaseSigningIntentSchema, agentCliSigningApproveRequestSchema, agentCliSigningDenyRequestSchema, agentCliSigningDecisionResponseSchema, agentCliCredentialClaimSchema, agentCliCredentialSetupSchema, agentCliCredentialFulfillmentReceiptSchema, CLI_AGENTON_CREDENTIAL_MATERIAL_DOWNLOAD_CONTRACT, AGENT_CLI_V1_HTTP_OPERATIONS, AGENT_CLI_OUTPUT_CONTRACT, agentCliErrorEnvelopeSchema, cliHttpErrorCodes, agentCliLocalErrorCodes, nullableCliStringSchema, cliLocalErrorEnvelopeSchema, AGENT_CLI_RECOVERY_CONTRACT;
+var booleanSchema, timestampSchema, agentCliMcpAuthorizationRequestTokenPrefix, agentCliMcpAuthorizationRequestMaximumUrlBytes, agentCliMcpAuthorizationRequestMaximumPayloadCharacters, base64UrlAlphabet, AGENT_CLI_MCP_AUTHORIZATION_REQUEST_TOKEN, AGENT_CLI_MCP_AUTHORIZATION_CLIENT, LOCAL_SIGNING_ABANDON_CONTRACT, localSigningAbandonReceiptSchema, authorizationBase, browserAuthorizationBase, signingStatusSchema, agentCliSigningIntentSchema, browserPublicationSigningIntentSchema, browserPurchaseSigningIntentSchema, agentCliSigningApproveRequestSchema, agentCliSigningDenyRequestSchema, agentCliSigningDecisionResponseSchema, agentCliCredentialClaimSchema, agentCliCredentialSetupSchema, agentCliCredentialFulfillmentReceiptSchema, CLI_AGENTON_CREDENTIAL_MATERIAL_DOWNLOAD_CONTRACT, AGENT_CLI_V1_HTTP_OPERATIONS, AGENT_CLI_OUTPUT_CONTRACT, agentCliErrorEnvelopeSchema, cliHttpErrorCodes, agentCliLocalErrorCodes, nullableCliStringSchema, cliLocalErrorEnvelopeSchema, AGENT_CLI_RECOVERY_CONTRACT;
 var init_agent_cli = __esm({
   "../../packages/agent-market-contracts/src/v1/agent-cli.ts"() {
     "use strict";
@@ -12593,6 +12684,11 @@ var init_agent_cli = __esm({
       maximumUrlBytes: agentCliMcpAuthorizationRequestMaximumUrlBytes,
       shellMetacharacters: false
     });
+    AGENT_CLI_MCP_AUTHORIZATION_CLIENT = Object.freeze({
+      versionHeader: "x-finch-cli-version",
+      minimumVersion: "0.4.0",
+      packageName: "@finchtech/cli"
+    });
     LOCAL_SIGNING_ABANDON_CONTRACT = Object.freeze({
       transport: "local_only",
       networkCalls: 0,
@@ -12821,7 +12917,8 @@ var init_agent_cli = __esm({
     agentCliLocalErrorCodes = Object.freeze([
       ...agentMarketErrorCodes,
       ...cliHttpErrorCodes,
-      "BROWSER_OPEN_FAILED"
+      "BROWSER_OPEN_FAILED",
+      "MCP_AUTHORIZATION_FLOW_FAILED"
     ]);
     nullableCliStringSchema = { type: ["string", "null"] };
     cliLocalErrorEnvelopeSchema = strictObjectSchema({
@@ -17652,7 +17749,7 @@ var init_schemas = __esm({
       requiresHuman: { type: "boolean" },
       requiresTwitter: { type: "boolean" },
       autoSettle: { type: "boolean" },
-      settlementMode: { type: "string", enum: ["merchant_manual", "fcfs_realtime", "weighted_lottery", "delayed_auto_7d"] },
+      settlementMode: { type: "string", enum: ["merchant_manual", "fcfs_realtime", "weighted_lottery", "delayed_auto_7d", "merchant_review_7d"] },
       deadline: nullableString,
       startAt: nullableString,
       goals: { type: "array", maxItems: 5, items: openObjectSchema },
@@ -17665,7 +17762,7 @@ var init_schemas = __esm({
     }, ["content"]);
     taskReviewRequestSchema = strictObjectSchema2({
       submissionIds: { type: "array", minItems: 1, maxItems: 100, uniqueItems: true, items: canonicalUuidSchema2 },
-      action: { type: "string", enum: ["approve", "cancel_award", "reject", "spam", "favorite", "unfavorite"] },
+      action: { type: "string", enum: ["approve", "cancel_award", "reject", "review_later", "spam", "favorite", "unfavorite"] },
       spamReason: { type: "string", maxLength: 200 }
     }, ["submissionIds", "action"]);
     signedAwardSchema = strictObjectSchema2({
@@ -42339,44 +42436,44 @@ var init_formatter = __esm({
 });
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/utils/formatters/transactionRequest.js
-function formatTransactionRequest(request, _) {
+function formatTransactionRequest(request2, _) {
   const rpcRequest = {};
-  if (typeof request.authorizationList !== "undefined")
-    rpcRequest.authorizationList = formatAuthorizationList(request.authorizationList);
-  if (typeof request.accessList !== "undefined")
-    rpcRequest.accessList = request.accessList;
-  if (typeof request.blobVersionedHashes !== "undefined")
-    rpcRequest.blobVersionedHashes = request.blobVersionedHashes;
-  if (typeof request.blobs !== "undefined") {
-    if (typeof request.blobs[0] !== "string")
-      rpcRequest.blobs = request.blobs.map((x2) => bytesToHex(x2));
+  if (typeof request2.authorizationList !== "undefined")
+    rpcRequest.authorizationList = formatAuthorizationList(request2.authorizationList);
+  if (typeof request2.accessList !== "undefined")
+    rpcRequest.accessList = request2.accessList;
+  if (typeof request2.blobVersionedHashes !== "undefined")
+    rpcRequest.blobVersionedHashes = request2.blobVersionedHashes;
+  if (typeof request2.blobs !== "undefined") {
+    if (typeof request2.blobs[0] !== "string")
+      rpcRequest.blobs = request2.blobs.map((x2) => bytesToHex(x2));
     else
-      rpcRequest.blobs = request.blobs;
-  }
-  if (typeof request.data !== "undefined")
-    rpcRequest.data = request.data;
-  if (request.account)
-    rpcRequest.from = request.account.address;
-  if (typeof request.from !== "undefined")
-    rpcRequest.from = request.from;
-  if (typeof request.gas !== "undefined")
-    rpcRequest.gas = numberToHex(request.gas);
-  if (typeof request.gasPrice !== "undefined")
-    rpcRequest.gasPrice = numberToHex(request.gasPrice);
-  if (typeof request.maxFeePerBlobGas !== "undefined")
-    rpcRequest.maxFeePerBlobGas = numberToHex(request.maxFeePerBlobGas);
-  if (typeof request.maxFeePerGas !== "undefined")
-    rpcRequest.maxFeePerGas = numberToHex(request.maxFeePerGas);
-  if (typeof request.maxPriorityFeePerGas !== "undefined")
-    rpcRequest.maxPriorityFeePerGas = numberToHex(request.maxPriorityFeePerGas);
-  if (typeof request.nonce !== "undefined")
-    rpcRequest.nonce = numberToHex(request.nonce);
-  if (typeof request.to !== "undefined")
-    rpcRequest.to = request.to;
-  if (typeof request.type !== "undefined")
-    rpcRequest.type = rpcTransactionType[request.type];
-  if (typeof request.value !== "undefined")
-    rpcRequest.value = numberToHex(request.value);
+      rpcRequest.blobs = request2.blobs;
+  }
+  if (typeof request2.data !== "undefined")
+    rpcRequest.data = request2.data;
+  if (request2.account)
+    rpcRequest.from = request2.account.address;
+  if (typeof request2.from !== "undefined")
+    rpcRequest.from = request2.from;
+  if (typeof request2.gas !== "undefined")
+    rpcRequest.gas = numberToHex(request2.gas);
+  if (typeof request2.gasPrice !== "undefined")
+    rpcRequest.gasPrice = numberToHex(request2.gasPrice);
+  if (typeof request2.maxFeePerBlobGas !== "undefined")
+    rpcRequest.maxFeePerBlobGas = numberToHex(request2.maxFeePerBlobGas);
+  if (typeof request2.maxFeePerGas !== "undefined")
+    rpcRequest.maxFeePerGas = numberToHex(request2.maxFeePerGas);
+  if (typeof request2.maxPriorityFeePerGas !== "undefined")
+    rpcRequest.maxPriorityFeePerGas = numberToHex(request2.maxPriorityFeePerGas);
+  if (typeof request2.nonce !== "undefined")
+    rpcRequest.nonce = numberToHex(request2.nonce);
+  if (typeof request2.to !== "undefined")
+    rpcRequest.to = request2.to;
+  if (typeof request2.type !== "undefined")
+    rpcRequest.type = rpcTransactionType[request2.type];
+  if (typeof request2.value !== "undefined")
+    rpcRequest.value = numberToHex(request2.value);
   return rpcRequest;
 }
 function formatAuthorizationList(authorizationList) {
@@ -42798,7 +42895,7 @@ async function estimateMaxPriorityFeePerGas(client, args) {
   return internal_estimateMaxPriorityFeePerGas(client, args);
 }
 async function internal_estimateMaxPriorityFeePerGas(client, args) {
-  const { block: block_, chain = client.chain, request } = args || {};
+  const { block: block_, chain = client.chain, request: request2 } = args || {};
   try {
     const maxPriorityFeePerGas = chain?.fees?.maxPriorityFeePerGas ?? chain?.fees?.defaultPriorityFee;
     if (typeof maxPriorityFeePerGas === "function") {
@@ -42806,7 +42903,7 @@ async function internal_estimateMaxPriorityFeePerGas(client, args) {
       const maxPriorityFeePerGas_ = await maxPriorityFeePerGas({
         block,
         client,
-        request
+        request: request2
       });
       if (maxPriorityFeePerGas_ === null)
         throw new Error();
@@ -42846,13 +42943,13 @@ async function estimateFeesPerGas(client, args) {
   return internal_estimateFeesPerGas(client, args);
 }
 async function internal_estimateFeesPerGas(client, args) {
-  const { block: block_, chain = client.chain, request, type = "eip1559" } = args || {};
+  const { block: block_, chain = client.chain, request: request2, type = "eip1559" } = args || {};
   const baseFeeMultiplier = await (async () => {
     if (typeof chain?.fees?.baseFeeMultiplier === "function")
       return chain.fees.baseFeeMultiplier({
         block: block_,
         client,
-        request
+        request: request2
       });
     return chain?.fees?.baseFeeMultiplier ?? 1.2;
   })();
@@ -42867,7 +42964,7 @@ async function internal_estimateFeesPerGas(client, args) {
       block: block_,
       client,
       multiply,
-      request,
+      request: request2,
       type
     });
     if (fees !== null)
@@ -42876,19 +42973,19 @@ async function internal_estimateFeesPerGas(client, args) {
   if (type === "eip1559") {
     if (typeof block.baseFeePerGas !== "bigint")
       throw new Eip1559FeesNotSupportedError();
-    const maxPriorityFeePerGas = typeof request?.maxPriorityFeePerGas === "bigint" ? request.maxPriorityFeePerGas : await internal_estimateMaxPriorityFeePerGas(client, {
+    const maxPriorityFeePerGas = typeof request2?.maxPriorityFeePerGas === "bigint" ? request2.maxPriorityFeePerGas : await internal_estimateMaxPriorityFeePerGas(client, {
       block,
       chain,
-      request
+      request: request2
     });
     const baseFeePerGas = multiply(block.baseFeePerGas);
-    const maxFeePerGas = request?.maxFeePerGas ?? baseFeePerGas + maxPriorityFeePerGas;
+    const maxFeePerGas = request2?.maxFeePerGas ?? baseFeePerGas + maxPriorityFeePerGas;
     return {
       maxFeePerGas,
       maxPriorityFeePerGas
     };
   }
-  const gasPrice = request?.gasPrice ?? multiply(await getAction(client, getGasPrice, "getGasPrice")({}));
+  const gasPrice = request2?.gasPrice ?? multiply(await getAction(client, getGasPrice, "getGasPrice")({}));
   return {
     gasPrice
   };
@@ -43253,7 +43350,7 @@ async function fillTransaction(client, parameters) {
   assertRequest(parameters);
   const chainFormat = chain?.formatters?.transactionRequest?.format;
   const format3 = chainFormat || formatTransactionRequest;
-  const request = format3({
+  const request2 = format3({
     // Pick out extra data that might exist on the chain's transaction request type.
     ...extract(rest, { format: chainFormat }),
     account: account ? parseAccount(account) : void 0,
@@ -43275,7 +43372,7 @@ async function fillTransaction(client, parameters) {
   try {
     const response = await client.request({
       method: "eth_fillTransaction",
-      params: [request]
+      params: [request2]
     });
     const format4 = chain?.formatters?.transaction?.format || formatTransaction;
     const transaction2 = format4(response.tx);
@@ -43324,7 +43421,7 @@ async function fillTransaction(client, parameters) {
     return {
       raw: response.raw,
       transaction: {
-        from: request.from,
+        from: request2.from,
         ...transaction2
       },
       ...response.capabilities ? { capabilities: response.capabilities } : {}
@@ -43353,10 +43450,10 @@ var init_fillTransaction = __esm({
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/actions/wallet/prepareTransactionRequest.js
 async function prepareTransactionRequest(client, args) {
-  let request = args;
-  request.account ??= client.account;
-  request.parameters ??= defaultParameters;
-  const { account: account_, chain = client.chain, nonceManager, parameters } = request;
+  let request2 = args;
+  request2.account ??= client.account;
+  request2.parameters ??= defaultParameters;
+  const { account: account_, chain = client.chain, nonceManager, parameters } = request2;
   const prepareTransactionRequest2 = (() => {
     if (typeof chain?.prepareTransactionRequest === "function")
       return {
@@ -43374,8 +43471,8 @@ async function prepareTransactionRequest(client, args) {
   async function getChainId2() {
     if (chainId)
       return chainId;
-    if (typeof request.chainId !== "undefined")
-      return request.chainId;
+    if (typeof request2.chainId !== "undefined")
+      return request2.chainId;
     if (chain)
       return chain.id;
     const chainId_ = await getAction(client, getChainId, "getChainId")({});
@@ -43383,14 +43480,14 @@ async function prepareTransactionRequest(client, args) {
     return chainId;
   }
   let account = account_ ? parseAccount(account_) : account_;
-  let nonce = request.nonce;
+  let nonce = request2.nonce;
   if (prepareTransactionRequest2?.fn && prepareTransactionRequest2.runAt?.includes("beforeFillTransaction")) {
-    request = await prepareTransactionRequest2.fn({ ...request, chain }, {
+    request2 = await prepareTransactionRequest2.fn({ ...request2, chain }, {
       client,
       phase: "beforeFillTransaction"
     });
-    nonce ??= request.nonce;
-    const sender = request.account ?? request.from;
+    nonce ??= request2.nonce;
+    const sender = request2.account ?? request2.from;
     account = sender ? parseAccount(sender) : void 0;
   }
   if (parameters.includes("nonce") && typeof nonce === "undefined" && account && nonceManager) {
@@ -43402,44 +43499,44 @@ async function prepareTransactionRequest(client, args) {
     });
   }
   const attemptFill = (() => {
-    if ((parameters.includes("blobVersionedHashes") || parameters.includes("sidecars")) && request.kzg && request.blobs)
+    if ((parameters.includes("blobVersionedHashes") || parameters.includes("sidecars")) && request2.kzg && request2.blobs)
       return false;
-    if (parameters.length > 0 && "feePayer" in request && request.feePayer && !("feePayerSignature" in request && request.feePayerSignature))
+    if (parameters.length > 0 && "feePayer" in request2 && request2.feePayer && !("feePayerSignature" in request2 && request2.feePayerSignature))
       return true;
     if (supportsFillTransaction.get(client.uid) === false)
       return false;
     const shouldAttempt = ["fees", "gas"].some((parameter) => parameters.includes(parameter));
     if (!shouldAttempt)
       return false;
-    if (parameters.includes("chainId") && typeof request.chainId !== "number")
+    if (parameters.includes("chainId") && typeof request2.chainId !== "number")
       return true;
     if (parameters.includes("nonce") && typeof nonce !== "number")
       return true;
-    if (parameters.includes("fees") && typeof request.gasPrice !== "bigint" && (typeof request.maxFeePerGas !== "bigint" || typeof request.maxPriorityFeePerGas !== "bigint"))
+    if (parameters.includes("fees") && typeof request2.gasPrice !== "bigint" && (typeof request2.maxFeePerGas !== "bigint" || typeof request2.maxPriorityFeePerGas !== "bigint"))
       return true;
-    if (parameters.includes("gas") && typeof request.gas !== "bigint")
+    if (parameters.includes("gas") && typeof request2.gas !== "bigint")
       return true;
     return false;
   })();
-  const fillResult = attemptFill ? await getAction(client, fillTransaction, "fillTransaction")({ ...request, nonce }).then((result2) => {
+  const fillResult = attemptFill ? await getAction(client, fillTransaction, "fillTransaction")({ ...request2, nonce }).then((result2) => {
     const { chainId: chainId2, from: from16, gas: gas2, gasPrice, nonce: nonce2, maxFeePerBlobGas, maxFeePerGas, maxPriorityFeePerGas, type: type2, ...rest } = result2.transaction;
     const feeToken = "feeToken" in rest ? rest.feeToken : void 0;
     const hasFilledFeePayerSignature = "feePayerSignature" in rest && rest.feePayerSignature !== null && typeof rest.feePayerSignature !== "undefined";
-    const shouldUseFilledFeeToken = typeof feeToken !== "undefined" && feeToken !== null && (!("feeToken" in request) || hasFilledFeePayerSignature);
+    const shouldUseFilledFeeToken = typeof feeToken !== "undefined" && feeToken !== null && (!("feeToken" in request2) || hasFilledFeePayerSignature);
     supportsFillTransaction.set(client.uid, true);
     return {
-      ...request,
+      ...request2,
       ...from16 ? { from: from16 } : {},
-      ...type2 && !request.type ? { type: type2 } : {},
+      ...type2 && !request2.type ? { type: type2 } : {},
       ...typeof chainId2 !== "undefined" ? { chainId: chainId2 } : {},
       ...typeof gas2 !== "undefined" ? { gas: gas2 } : {},
       ...typeof gasPrice !== "undefined" ? { gasPrice } : {},
       ...typeof nonce2 !== "undefined" ? { nonce: nonce2 } : {},
-      ...typeof maxFeePerBlobGas !== "undefined" && request.type !== "legacy" && request.type !== "eip2930" ? { maxFeePerBlobGas } : {},
-      ...typeof maxFeePerGas !== "undefined" && request.type !== "legacy" && request.type !== "eip2930" ? { maxFeePerGas } : {},
-      ...typeof maxPriorityFeePerGas !== "undefined" && request.type !== "legacy" && request.type !== "eip2930" ? { maxPriorityFeePerGas } : {},
+      ...typeof maxFeePerBlobGas !== "undefined" && request2.type !== "legacy" && request2.type !== "eip2930" ? { maxFeePerBlobGas } : {},
+      ...typeof maxFeePerGas !== "undefined" && request2.type !== "legacy" && request2.type !== "eip2930" ? { maxFeePerGas } : {},
+      ...typeof maxPriorityFeePerGas !== "undefined" && request2.type !== "legacy" && request2.type !== "eip2930" ? { maxPriorityFeePerGas } : {},
       ..."nonceKey" in rest && typeof rest.nonceKey !== "undefined" ? { nonceKey: rest.nonceKey } : {},
-      ..."keyAuthorization" in rest && typeof rest.keyAuthorization !== "undefined" && rest.keyAuthorization !== null && !("keyAuthorization" in request) ? { keyAuthorization: rest.keyAuthorization } : {},
+      ..."keyAuthorization" in rest && typeof rest.keyAuthorization !== "undefined" && rest.keyAuthorization !== null && !("keyAuthorization" in request2) ? { keyAuthorization: rest.keyAuthorization } : {},
       ..."feePayerSignature" in rest && typeof rest.feePayerSignature !== "undefined" && rest.feePayerSignature !== null ? { feePayerSignature: rest.feePayerSignature } : {},
       ...shouldUseFilledFeeToken ? { feeToken } : {},
       ...result2.capabilities ? { _capabilities: result2.capabilities } : {}
@@ -43447,7 +43544,7 @@ async function prepareTransactionRequest(client, args) {
   }).catch((e) => {
     const error51 = e;
     if (error51.name !== "TransactionExecutionError")
-      return request;
+      return request2;
     const executionReverted = error51.walk?.((e2) => {
       const error52 = e2;
       return error52.name === "ExecutionRevertedError";
@@ -43460,17 +43557,17 @@ async function prepareTransactionRequest(client, args) {
     });
     if (unsupported)
       supportsFillTransaction.set(client.uid, false);
-    return request;
-  }) : request;
+    return request2;
+  }) : request2;
   nonce ??= fillResult.nonce;
-  request = {
+  request2 = {
     ...fillResult,
     ...account ? { from: account?.address } : {},
     ...typeof nonce !== "undefined" ? { nonce } : {}
   };
-  const { blobs, gas, kzg, type } = request;
+  const { blobs, gas, kzg, type } = request2;
   if (prepareTransactionRequest2?.fn && prepareTransactionRequest2.runAt?.includes("beforeFillParameters")) {
-    request = await prepareTransactionRequest2.fn({ ...request, chain }, {
+    request2 = await prepareTransactionRequest2.fn({ ...request2, chain }, {
       client,
       phase: "beforeFillParameters"
     });
@@ -43483,7 +43580,7 @@ async function prepareTransactionRequest(client, args) {
     return block;
   }
   if (parameters.includes("nonce") && typeof nonce === "undefined" && account && !nonceManager)
-    request.nonce = await getAction(client, getTransactionCount, "getTransactionCount")({
+    request2.nonce = await getAction(client, getTransactionCount, "getTransactionCount")({
       address: account.address,
       blockTag: "pending"
     });
@@ -43494,7 +43591,7 @@ async function prepareTransactionRequest(client, args) {
         commitments,
         to: "hex"
       });
-      request.blobVersionedHashes = versionedHashes;
+      request2.blobVersionedHashes = versionedHashes;
     }
     if (parameters.includes("sidecars")) {
       const proofs = blobsToProofs({ blobs, commitments, kzg });
@@ -43504,14 +43601,14 @@ async function prepareTransactionRequest(client, args) {
         proofs,
         to: "hex"
       });
-      request.sidecars = sidecars;
+      request2.sidecars = sidecars;
     }
   }
   if (parameters.includes("chainId"))
-    request.chainId = await getChainId2();
+    request2.chainId = await getChainId2();
   if ((parameters.includes("fees") || parameters.includes("type")) && typeof type === "undefined") {
     try {
-      request.type = getTransactionType(request);
+      request2.type = getTransactionType(request2);
     } catch {
       let isEip1559Network = eip1559NetworkCache.get(client.uid);
       if (typeof isEip1559Network === "undefined") {
@@ -43519,54 +43616,54 @@ async function prepareTransactionRequest(client, args) {
         isEip1559Network = typeof block2?.baseFeePerGas === "bigint";
         eip1559NetworkCache.set(client.uid, isEip1559Network);
       }
-      request.type = isEip1559Network ? "eip1559" : "legacy";
+      request2.type = isEip1559Network ? "eip1559" : "legacy";
     }
   }
   if (parameters.includes("fees")) {
-    if (request.type !== "legacy" && request.type !== "eip2930") {
-      if (typeof request.maxFeePerGas === "undefined" || typeof request.maxPriorityFeePerGas === "undefined") {
+    if (request2.type !== "legacy" && request2.type !== "eip2930") {
+      if (typeof request2.maxFeePerGas === "undefined" || typeof request2.maxPriorityFeePerGas === "undefined") {
         const block2 = await getBlock2();
         const { maxFeePerGas, maxPriorityFeePerGas } = await internal_estimateFeesPerGas(client, {
           block: block2,
           chain,
-          request
+          request: request2
         });
-        if (typeof request.maxPriorityFeePerGas === "undefined" && request.maxFeePerGas && request.maxFeePerGas < maxPriorityFeePerGas)
+        if (typeof request2.maxPriorityFeePerGas === "undefined" && request2.maxFeePerGas && request2.maxFeePerGas < maxPriorityFeePerGas)
           throw new MaxFeePerGasTooLowError({
             maxPriorityFeePerGas
           });
-        request.maxPriorityFeePerGas = maxPriorityFeePerGas;
-        request.maxFeePerGas = maxFeePerGas;
+        request2.maxPriorityFeePerGas = maxPriorityFeePerGas;
+        request2.maxFeePerGas = maxFeePerGas;
       }
     } else {
-      if (typeof request.maxFeePerGas !== "undefined" || typeof request.maxPriorityFeePerGas !== "undefined")
+      if (typeof request2.maxFeePerGas !== "undefined" || typeof request2.maxPriorityFeePerGas !== "undefined")
         throw new Eip1559FeesNotSupportedError();
-      if (typeof request.gasPrice === "undefined") {
+      if (typeof request2.gasPrice === "undefined") {
         const block2 = await getBlock2();
         const { gasPrice: gasPrice_ } = await internal_estimateFeesPerGas(client, {
           block: block2,
           chain,
-          request,
+          request: request2,
           type: "legacy"
         });
-        request.gasPrice = gasPrice_;
+        request2.gasPrice = gasPrice_;
       }
     }
   }
   if (parameters.includes("gas") && typeof gas === "undefined")
-    request.gas = await getAction(client, estimateGas, "estimateGas")({
-      ...request,
+    request2.gas = await getAction(client, estimateGas, "estimateGas")({
+      ...request2,
       account,
       prepare: account?.type === "local" ? [] : ["blobVersionedHashes"]
     });
   if (prepareTransactionRequest2?.fn && prepareTransactionRequest2.runAt?.includes("afterFillParameters"))
-    request = await prepareTransactionRequest2.fn({ ...request, chain }, {
+    request2 = await prepareTransactionRequest2.fn({ ...request2, chain }, {
       client,
       phase: "afterFillParameters"
     });
-  assertRequest(request);
-  delete request.parameters;
-  return request;
+  assertRequest(request2);
+  delete request2.parameters;
+  return request2;
 }
 var defaultParameters, eip1559NetworkCache, supportsFillTransaction;
 var init_prepareTransactionRequest = __esm({
@@ -43636,7 +43733,7 @@ async function estimateGas(client, args) {
     assertRequest(args);
     const chainFormat = client.chain?.formatters?.transactionRequest?.format;
     const format3 = chainFormat || formatTransactionRequest;
-    const request = format3({
+    const request2 = format3({
       // Pick out extra data that might exist on the chain's transaction request type.
       ...extract(rest, { format: chainFormat }),
       account,
@@ -43656,10 +43753,10 @@ async function estimateGas(client, args) {
     return BigInt(await client.request({
       method: "eth_estimateGas",
       params: rpcStateOverride ? [
-        request,
+        request2,
         block ?? client.experimental_blockTag ?? "latest",
         rpcStateOverride
-      ] : block ? [request, block] : [request]
+      ] : block ? [request2, block] : [request2]
     }));
   } catch (err2) {
     throw getEstimateGasError(err2, {
@@ -43686,7 +43783,7 @@ var init_estimateGas2 = __esm({
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/actions/public/estimateContractGas.js
 async function estimateContractGas(client, parameters) {
-  const { abi: abi2, address: address2, args, functionName, dataSuffix = typeof client.dataSuffix === "string" ? client.dataSuffix : client.dataSuffix?.value, ...request } = parameters;
+  const { abi: abi2, address: address2, args, functionName, dataSuffix = typeof client.dataSuffix === "string" ? client.dataSuffix : client.dataSuffix?.value, ...request2 } = parameters;
   const data = encodeFunctionData({
     abi: abi2,
     args,
@@ -43696,11 +43793,11 @@ async function estimateContractGas(client, parameters) {
     const gas = await getAction(client, estimateGas, "estimateGas")({
       data: `${data}${dataSuffix ? dataSuffix.replace("0x", "") : ""}`,
       to: address2,
-      ...request
+      ...request2
     });
     return gas;
   } catch (error51) {
-    const account = request.account ? parseAccount(request.account) : void 0;
+    const account = request2.account ? parseAccount(request2.account) : void 0;
     throw getContractError(error51, {
       abi: abi2,
       address: address2,
@@ -45970,7 +46067,7 @@ async function call(client, args) {
     const rpcStateOverride = serializeStateOverride(stateOverride);
     const chainFormat = client.chain?.formatters?.transactionRequest?.format;
     const format3 = chainFormat || formatTransactionRequest;
-    const request = format3({
+    const request2 = format3({
       // Pick out extra data that might exist on the chain's transaction request type.
       ...extract(rest, { format: chainFormat }),
       accessList,
@@ -45987,7 +46084,7 @@ async function call(client, args) {
       to: deploylessCall ? void 0 : to,
       value
     }, "call");
-    if (batch && shouldPerformMulticall({ request }) && !rpcBlockOverrides && blockHash === void 0) {
+    if (batch && shouldPerformMulticall({ request: request2 }) && !rpcBlockOverrides && blockHash === void 0) {
       try {
         const { deployless = false } = typeof client.batch?.multicall === "object" ? client.batch.multicall : {};
         const multicallAddress = getMulticallAddress(client, {
@@ -45996,7 +46093,7 @@ async function call(client, args) {
         });
         if (!multicallAddress || !hasStateOverrideForAddress(rpcStateOverride, multicallAddress))
           return await scheduleMulticall(client, {
-            ...request,
+            ...request2,
             blockHash,
             blockNumber: blockNumber2,
             blockTag,
@@ -46012,7 +46109,7 @@ async function call(client, args) {
     }
     const params = (() => {
       const base3 = [
-        request,
+        request2,
         block
       ];
       if (rpcStateOverride && rpcBlockOverrides)
@@ -46050,8 +46147,8 @@ async function call(client, args) {
     });
   }
 }
-function shouldPerformMulticall({ request }) {
-  const { data, to, ...request_ } = request;
+function shouldPerformMulticall({ request: request2 }) {
+  const { data, to, ...request_ } = request2;
   if (!data)
     return false;
   if (data.startsWith(aggregate3Signature))
@@ -46095,10 +46192,10 @@ async function scheduleMulticall(client, args) {
       return size5 > batchSize * 2;
     },
     fn: async (requests) => {
-      const calls = requests.map((request) => ({
+      const calls = requests.map((request2) => ({
         allowFailure: true,
-        callData: request.data,
-        target: request.to
+        callData: request2.data,
+        target: request2.to
       }));
       const calldata = encodeFunctionData({
         abi: multicall3Abi,
@@ -46790,7 +46887,7 @@ async function sendTransaction(client, parameters) {
       }
       const chainFormat = client.chain?.formatters?.transactionRequest?.format;
       const format3 = chainFormat || formatTransactionRequest;
-      const request = format3({
+      const request2 = format3({
         // Pick out extra data that might exist on the chain's transaction request type.
         ...extract(rest, { format: chainFormat }),
         accessList,
@@ -46814,7 +46911,7 @@ async function sendTransaction(client, parameters) {
       try {
         return await client.request({
           method: method2,
-          params: [request]
+          params: [request2]
         }, { retryCount: 0 });
       } catch (e) {
         if (isWalletNamespaceSupported === false)
@@ -46823,7 +46920,7 @@ async function sendTransaction(client, parameters) {
         if (error51.name === "InvalidInputRpcError" || error51.name === "InvalidParamsRpcError" || error51.name === "MethodNotFoundRpcError" || error51.name === "MethodNotSupportedRpcError") {
           return await client.request({
             method: "wallet_sendTransaction",
-            params: [request]
+            params: [request2]
           }, { retryCount: 0 }).then((hash5) => {
             supportsWalletNamespace.set(client.uid, true);
             return hash5;
@@ -46863,7 +46960,7 @@ async function sendTransaction(client, parameters) {
           }
         };
       })();
-      const request = await getAction(client, prepareTransactionRequest, "prepareTransactionRequest")({
+      const request2 = await getAction(client, prepareTransactionRequest, "prepareTransactionRequest")({
         account,
         accessList,
         authorizationList,
@@ -46884,7 +46981,7 @@ async function sendTransaction(client, parameters) {
         to
       });
       const serializer = chain?.serializers?.transaction;
-      const serializedTransaction = await account.signTransaction(request, {
+      const serializedTransaction = await account.signTransaction(request2, {
         serializer
       });
       return await getAction(client, sendRawTransaction, "sendRawTransaction")({
@@ -46951,7 +47048,7 @@ var init_writeContract = __esm({
     init_sendTransaction();
     (function(writeContract2) {
       async function internal(client, actionFn, name, parameters) {
-        const { abi: abi2, account: account_ = client.account, address: address2, args, functionName, ...request } = parameters;
+        const { abi: abi2, account: account_ = client.account, address: address2, args, functionName, ...request2 } = parameters;
         if (typeof account_ === "undefined")
           throw new AccountNotFoundError({
             docsPath: "/docs/contract/writeContract"
@@ -46967,7 +47064,7 @@ var init_writeContract = __esm({
             data,
             to: address2,
             account,
-            ...request
+            ...request2
           });
         } catch (error51) {
           throw getContractError(error51, {
@@ -47393,7 +47490,7 @@ function createClient(parameters) {
   const pollingInterval = parameters.pollingInterval ?? defaultPollingInterval;
   const cacheTime = parameters.cacheTime ?? pollingInterval;
   const account = parameters.account ? parseAccount(parameters.account) : void 0;
-  const { config: config2, request, value } = parameters.transport({
+  const { config: config2, request: request2, value } = parameters.transport({
     account,
     chain,
     pollingInterval
@@ -47409,7 +47506,7 @@ function createClient(parameters) {
     key,
     name,
     pollingInterval,
-    request,
+    request: request2,
     tokens,
     transport,
     type,
@@ -48144,7 +48241,7 @@ async function createAccessList(client, args) {
     const block = blockNumberHex || blockTag;
     const chainFormat = client.chain?.formatters?.transactionRequest?.format;
     const format3 = chainFormat || formatTransactionRequest;
-    const request = format3({
+    const request2 = format3({
       // Pick out extra data that might exist on the chain's transaction request type.
       ...extract(rest, { format: chainFormat }),
       account,
@@ -48160,7 +48257,7 @@ async function createAccessList(client, args) {
     }, "createAccessList");
     const response = await client.request({
       method: "eth_createAccessList",
-      params: [request, block]
+      params: [request2, block]
     });
     if (response.error)
       throw new BaseError2(response.error, { details: response.error });
@@ -48937,7 +49034,7 @@ var init_withDedupe = __esm({
 });
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/utils/buildRequest.js
-function buildRequest(request, options = {}) {
+function buildRequest(request2, options = {}) {
   return async (args, overrideOptions = {}) => {
     const { dedupe = false, methods, retryDelay = 150, retryCount = 3, signal, uid: uid2 } = {
       ...options,
@@ -48957,7 +49054,7 @@ function buildRequest(request, options = {}) {
     const requestId = dedupe ? hashString(`${uid2}.${stringify(args)}`) : void 0;
     return withDedupe(() => withRetry(async () => {
       try {
-        return await request(args, signal ? { signal } : void 0);
+        return await request2(args, signal ? { signal } : void 0);
       } catch (err_) {
         if (signal?.aborted)
           throw getAbortError(signal);
@@ -49243,8 +49340,8 @@ function getHttpRpcClient(url_, options = {}) {
             method: method2 || "POST",
             signal: signal_ || (timeout > 0 ? signal : null)
           };
-          const request = new Request(url2, init);
-          const args = await onRequest?.(request, init) ?? { ...init, url: url2 };
+          const request2 = new Request(url2, init);
+          const args = await onRequest?.(request2, init) ?? { ...init, url: url2 };
           const response2 = await fetchFn(args.url ?? url2, args);
           return response2;
         }, {
@@ -51803,14 +51900,14 @@ async function simulateBlocks(client, parameters) {
         const call2 = call_;
         const account = call2.account ? parseAccount(call2.account) : void 0;
         const data = call2.abi ? encodeFunctionData(call2) : call2.data;
-        const request = {
+        const request2 = {
           ...call2,
           account,
           data: call2.dataSuffix ? concat2([data || "0x", call2.dataSuffix]) : data,
           from: call2.from ?? account?.address
         };
-        assertRequest(request);
-        return formatTransactionRequest(request);
+        assertRequest(request2);
+        return formatTransactionRequest(request2);
       });
       const stateOverrides = block2.stateOverrides ? serializeStateOverride(block2.stateOverrides) : void 0;
       blockStateCalls.push({
@@ -53882,7 +53979,7 @@ async function sendTransactionSync(client, parameters) {
       }
       const chainFormat = client.chain?.formatters?.transactionRequest?.format;
       const format3 = chainFormat || formatTransactionRequest;
-      const request = format3({
+      const request2 = format3({
         // Pick out extra data that might exist on the chain's transaction request type.
         ...extract(rest, { format: chainFormat }),
         accessList,
@@ -53907,7 +54004,7 @@ async function sendTransactionSync(client, parameters) {
         try {
           return await client.request({
             method: method2,
-            params: [request]
+            params: [request2]
           }, { retryCount: 0 });
         } catch (e) {
           if (isWalletNamespaceSupported === false)
@@ -53916,7 +54013,7 @@ async function sendTransactionSync(client, parameters) {
           if (error51.name === "InvalidInputRpcError" || error51.name === "InvalidParamsRpcError" || error51.name === "MethodNotFoundRpcError" || error51.name === "MethodNotSupportedRpcError") {
             return await client.request({
               method: "wallet_sendTransaction",
-              params: [request]
+              params: [request2]
             }, { retryCount: 0 }).then((hash6) => {
               supportsWalletNamespace2.set(client.uid, true);
               return hash6;
@@ -53966,7 +54063,7 @@ async function sendTransactionSync(client, parameters) {
           }
         };
       })();
-      const request = await getAction(client, prepareTransactionRequest, "prepareTransactionRequest")({
+      const request2 = await getAction(client, prepareTransactionRequest, "prepareTransactionRequest")({
         account,
         accessList,
         authorizationList,
@@ -53987,7 +54084,7 @@ async function sendTransactionSync(client, parameters) {
         to
       });
       const serializer = chain?.serializers?.transaction;
-      const serializedTransaction = await account.signTransaction(request, {
+      const serializedTransaction = await account.signTransaction(request2, {
         serializer
       });
       return await getAction(client, sendRawTransactionSync, "sendRawTransactionSync")({
@@ -54524,11 +54621,11 @@ var init_addChain = __esm({
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/actions/wallet/deployContract.js
 function deployContract(walletClient, parameters) {
-  const { abi: abi2, args, bytecode, ...request } = parameters;
+  const { abi: abi2, args, bytecode, ...request2 } = parameters;
   const calldata = encodeDeployData({ abi: abi2, args, bytecode });
   return sendTransaction(walletClient, {
-    ...request,
-    ...request.authorizationList ? { to: null } : {},
+    ...request2,
+    ...request2.authorizationList ? { to: null } : {},
     data: calldata
   });
 }
@@ -54951,20 +55048,20 @@ var init_createWalletClient = __esm({
 });
 
 // ../../node_modules/.pnpm/viem@2.55.15_bufferutil@4.1_ce20031be19c56210207d462110a7a29/node_modules/viem/_esm/clients/transports/createTransport.js
-function createTransport({ key, methods, name, request, retryCount = 3, retryDelay = 150, timeout, type }, value) {
+function createTransport({ key, methods, name, request: request2, retryCount = 3, retryDelay = 150, timeout, type }, value) {
   const uid2 = uid();
   return {
     config: {
       key,
       methods,
       name,
-      request,
+      request: request2,
       retryCount,
       retryDelay,
       timeout,
       type
     },
-    request: buildRequest(request, { methods, retryCount, retryDelay, uid: uid2 }),
+    request: buildRequest(request2, { methods, retryCount, retryDelay, uid: uid2 }),
     value
   };
 }
@@ -55201,6 +55298,18 @@ function jsonObject(value) {
   }
   return value;
 }
+function includesCapabilities(value, required4) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0) && required4.every((item) => value.includes(item));
+}
+function sameOriginEndpoint(value, origin2) {
+  if (typeof value !== "string") return false;
+  try {
+    const url2 = new URL(value);
+    return url2.origin === origin2 && url2.username === "" && url2.password === "" && url2.hash === "";
+  } catch {
+    return false;
+  }
+}
 function protectedResourceMetadataAuthority(authenticate, origin2, resourcePath) {
   const matches = [...authenticate.matchAll(/(?:^|[\s,])resource_metadata="([^"]+)"/gu)];
   if (!/(?:^|[\s,])Bearer(?:[\s,]|$)/iu.test(authenticate) || matches.length !== 1) {
@@ -55338,6 +55447,7 @@ var init_api2 = __esm({
   "src/api.ts"() {
     "use strict";
     import_ajv = __toESM(require_ajv(), 1);
+    init_package();
     init_cli_error();
     init_src2();
     init_v1();
@@ -55465,7 +55575,8 @@ var init_api2 = __esm({
             method: options.method.toUpperCase(),
             headers,
             body,
-            redirect: "error"
+            redirect: "error",
+            ...options.signal === void 0 ? {} : { signal: options.signal }
           });
         } catch (cause) {
           throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", null, { cause });
@@ -55534,12 +55645,30 @@ var init_api2 = __esm({
           return await this.fetchImplementation(`${this.origin}${path2}`, {
             method: "GET",
             redirect: "error",
-            cache: "no-store"
+            cache: "no-store",
+            signal: AbortSignal.timeout(15e3)
           });
         } catch (cause) {
           throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", null, { cause });
         }
       }
+      async authorizationServerMetadata() {
+        const authorizationResponse = await this.publicFetch("/.well-known/oauth-authorization-server");
+        if (authorizationResponse.status !== 200) {
+          await authorizationResponse.body?.cancel().catch(() => void 0);
+          throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", authorizationResponse.status);
+        }
+        const authorization = jsonObject(await readBoundedJson(authorizationResponse));
+        if (authorization.issuer !== this.origin || authorization.authorization_endpoint !== `${this.origin}/oauth/authorize` || !sameOriginEndpoint(authorization.token_endpoint, this.origin) || !sameOriginEndpoint(authorization.registration_endpoint, this.origin) || !includesCapabilities(authorization.response_types_supported, ["code"]) || !includesCapabilities(authorization.grant_types_supported, ["authorization_code", "refresh_token"]) || !includesCapabilities(authorization.token_endpoint_auth_methods_supported, ["none"]) || !includesCapabilities(authorization.code_challenge_methods_supported, ["S256"]) || !["boolean", "undefined"].includes(typeof authorization.authorization_response_iss_parameter_supported)) {
+          throw new CliHttpError("CLI_RESPONSE_INVALID", authorizationResponse.status);
+        }
+        return authorization;
+      }
+      /** The issuer every authorization response must carry as `iss` (RFC 9207), or null when none is advertised. */
+      async authorizationResponseIssuer() {
+        const metadata = await this.authorizationServerMetadata();
+        return metadata.authorization_response_iss_parameter_supported === true ? this.origin : null;
+      }
       async inspectRemoteMcp() {
         const mcpUrl = `${this.origin}/mcp`;
         const compatibilityManifestUrl = `${this.origin}/mcp/client-compatibility.json`;
@@ -55563,42 +55692,15 @@ var init_api2 = __esm({
           throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", resourceResponse.status);
         }
         const resource = jsonObject(await readBoundedJson(resourceResponse));
-        if (resource.resource !== resourceMetadataAuthority.resource || JSON.stringify(resource.authorization_servers) !== JSON.stringify([this.origin])) {
+        if (resource.resource !== resourceMetadataAuthority.resource || !includesCapabilities(resource.authorization_servers, [this.origin])) {
           throw new CliHttpError("CLI_RESPONSE_INVALID", resourceResponse.status);
         }
-        const authorizationResponse = await this.publicFetch("/.well-known/oauth-authorization-server");
-        if (authorizationResponse.status !== 200) {
-          await authorizationResponse.body?.cancel().catch(() => void 0);
-          throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", authorizationResponse.status);
-        }
-        const authorization = jsonObject(await readBoundedJson(authorizationResponse));
-        if (authorization.issuer !== this.origin || authorization.authorization_endpoint !== `${this.origin}/oauth/authorize` || authorization.token_endpoint !== `${this.origin}/oauth/token` || authorization.registration_endpoint !== `${this.origin}/oauth/register` || JSON.stringify(authorization.response_types_supported) !== JSON.stringify(["code"]) || JSON.stringify(authorization.grant_types_supported) !== JSON.stringify(["authorization_code", "refresh_token"]) || JSON.stringify(authorization.token_endpoint_auth_methods_supported) !== JSON.stringify(["none"]) || JSON.stringify(authorization.code_challenge_methods_supported) !== JSON.stringify(["S256"])) {
-          throw new CliHttpError("CLI_RESPONSE_INVALID", authorizationResponse.status);
-        }
-        const manifestResponse = await this.publicFetch("/mcp/client-compatibility.json");
-        if (manifestResponse.status !== 200) {
-          await manifestResponse.body?.cancel().catch(() => void 0);
-          throw new CliHttpError("CLI_REMOTE_UNAVAILABLE", manifestResponse.status);
-        }
-        const manifest4 = jsonObject(await readBoundedJson(manifestResponse));
-        const mcp = jsonObject(manifest4.mcp);
-        const source = jsonObject(manifest4.source);
-        if (!Array.isArray(manifest4.clients) || manifest4.clients.length !== 1) {
-          throw new CliHttpError("CLI_RESPONSE_INVALID", manifestResponse.status);
-        }
-        const client = jsonObject(manifest4.clients[0]);
-        const install = jsonObject(client.install);
-        const authorize = jsonObject(client.authorize);
-        const verify = jsonObject(client.verify);
-        if (manifest4.schemaVersion !== 3 || manifest4.manifestId !== "finch.remote-mcp-clients" || mcp.serverName !== "finch" || mcp.url !== mcpUrl || mcp.transport !== "streamable_http" || mcp.authorization !== "oauth" || source.repository !== "https://github.com/FinchipAI/Finch-Site" || source.path !== "apps/mcp/src/client-compatibility.ts" || client.id !== "codex" || client.supportLevel !== "verified" || install.kind !== "native_cli" || install.executable !== "codex" || JSON.stringify(install.arguments) !== JSON.stringify(["mcp", "add", "finch", "--url", mcpUrl]) || authorize.kind !== "native_cli" || authorize.executable !== "codex" || JSON.stringify(authorize.arguments) !== JSON.stringify(["mcp", "login", "finch"]) || verify.kind !== "harness_ui" || verify.surface !== "mcp_tools" || client.reload !== "new_session") {
-          throw new CliHttpError("CLI_RESPONSE_INVALID", manifestResponse.status);
-        }
+        await this.authorizationServerMetadata();
         return Object.freeze({
           url: mcpUrl,
           transport: "streamable_http",
           authorization: "oauth",
-          compatibilityManifestUrl,
-          supportedClients: Object.freeze(["codex"])
+          compatibilityManifestUrl
         });
       }
       async uploadSkillObject(input) {
@@ -55900,7 +56002,7 @@ var init_api2 = __esm({
         if (response.status === 202 && body?.status === "indexing_pending") return "indexing_pending";
         throw new CliHttpError("CLI_RESPONSE_INVALID", response.status);
       }
-      getSession(bearer) {
+      getSession(bearer, signal) {
         const operation3 = IDENTITY_V1_OPERATIONS.session;
         return this.request({
           method: operation3.method,
@@ -55908,7 +56010,8 @@ var init_api2 = __esm({
           successStatus: operation3.successStatus,
           errorContract: "identity",
           responseSchema: operation3.responseSchema,
-          bearer
+          bearer,
+          ...signal === void 0 ? {} : { signal }
         });
       }
       authorizeMcp(requestPath, bearer) {
@@ -55928,7 +56031,8 @@ var init_api2 = __esm({
           errorContract: "oauth",
           responseSchema: oauthAuthorizationResponseSchema,
           bearer,
-          body: {}
+          body: {},
+          headers: { [AGENT_CLI_MCP_AUTHORIZATION_CLIENT.versionHeader]: package_default.version }
         });
       }
       createChallenge(input) {
@@ -56649,6 +56753,84 @@ var init_skill_buyer_intent_journal = __esm({
   }
 });
 
+// src/loopback-callback.ts
+import { lookup } from "node:dns/promises";
+import { request } from "node:http";
+import { isIP } from "node:net";
+function isLoopbackHttpUrl(url2) {
+  return url2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname);
+}
+function isLoopbackAddress(address2) {
+  return address2 === "::1" || /^127\./u.test(address2);
+}
+function attempt(url2, address2, port) {
+  return new Promise((resolve4, reject5) => {
+    let connected = false;
+    const outgoing = request({
+      host: address2,
+      port,
+      method: "GET",
+      path: `${url2.pathname}${url2.search}`,
+      family: isIP(address2),
+      headers: { host: url2.host, connection: "close" },
+      timeout: DELIVERY_TIMEOUT_MILLISECONDS
+    }, (response) => {
+      let received = 0;
+      response.on("data", (chunk) => {
+        received += chunk.byteLength;
+        if (received > MAXIMUM_RESPONSE_BYTES) response.destroy();
+      });
+      response.on("close", () => {
+        const status = response.statusCode ?? 0;
+        if (status >= 200 && status < 400) resolve4("delivered");
+        else reject5(new McpAuthorizationFlowError("callback_rejected", { callbackStatus: status }));
+      });
+    });
+    outgoing.on("socket", (socket) => {
+      socket.once("connect", () => {
+        connected = true;
+      });
+    });
+    outgoing.on("timeout", () => outgoing.destroy(new Error("timeout")));
+    outgoing.on("error", (cause) => {
+      if (!connected) resolve4("not_connected");
+      else reject5(new McpAuthorizationFlowError("callback_delivery_unknown", {}, { cause }));
+    });
+    outgoing.end();
+  });
+}
+var DELIVERY_TIMEOUT_MILLISECONDS, MAXIMUM_RESPONSE_BYTES, LoopbackCallbackDelivery;
+var init_loopback_callback = __esm({
+  "src/loopback-callback.ts"() {
+    "use strict";
+    init_cli_error();
+    DELIVERY_TIMEOUT_MILLISECONDS = 15e3;
+    MAXIMUM_RESPONSE_BYTES = 65536;
+    LoopbackCallbackDelivery = class {
+      constructor(resolve4 = async (hostname3) => (await lookup(hostname3, { all: true, verbatim: true })).map((entry2) => entry2.address), send = attempt) {
+        this.resolve = resolve4;
+        this.send = send;
+      }
+      resolve;
+      send;
+      async deliver(callbackUrl) {
+        const url2 = new URL(callbackUrl);
+        if (!isLoopbackHttpUrl(url2)) throw new TypeError("OAuth callback is not a loopback HTTP address.");
+        const addresses = url2.hostname === "localhost" ? await this.resolve("localhost") : [url2.hostname === "[::1]" ? "::1" : url2.hostname];
+        const loopback = addresses.filter(isLoopbackAddress);
+        if (loopback.length === 0 || loopback.length !== addresses.length) {
+          throw new McpAuthorizationFlowError("callback_unreachable");
+        }
+        const port = url2.port === "" ? 80 : Number(url2.port);
+        for (const address2 of loopback) {
+          if (await this.send(url2, address2, port) === "delivered") return;
+        }
+        throw new McpAuthorizationFlowError("callback_unreachable");
+      }
+    };
+  }
+});
+
 // src/application.ts
 import { createHash as createHash2, randomUUID } from "node:crypto";
 import { open as open2 } from "node:fs/promises";
@@ -56917,7 +57099,7 @@ function parseTaskRecoveryJournal(value, expected) {
     idempotencyKey: journal.idempotencyKey
   });
 }
-var FinchCliApplication;
+var MAXIMUM_STDIN_AUTHORIZATION_BYTES, FinchCliApplication;
 var init_application = __esm({
   "src/application.ts"() {
     "use strict";
@@ -56931,6 +57113,8 @@ var init_application = __esm({
     init_state();
     init_skill_buyer_intent_journal();
     init_cli_error();
+    init_loopback_callback();
+    MAXIMUM_STDIN_AUTHORIZATION_BYTES = 4098;
     FinchCliApplication = class {
       api;
       state;
@@ -56944,6 +57128,9 @@ var init_application = __esm({
       skillIntentSender;
       skillLocalFlow;
       browserLauncher;
+      callbackDelivery;
+      mcpLoginProcess;
+      stdin;
       constructor(dependencies) {
         this.api = dependencies.api;
         this.state = dependencies.state;
@@ -56957,6 +57144,9 @@ var init_application = __esm({
         this.skillIntentSender = dependencies.skillIntentSender;
         this.skillLocalFlow = dependencies.skillLocalFlow;
         this.browserLauncher = dependencies.browserLauncher;
+        this.callbackDelivery = dependencies.callbackDelivery;
+        this.mcpLoginProcess = dependencies.mcpLoginProcess;
+        this.stdin = dependencies.stdin;
       }
       async authorizedProfile() {
         return this.activeProfile ?? await required2(this.state.readProfile, "state.readProfile").call(this.state);
@@ -57159,8 +57349,8 @@ var init_application = __esm({
         const handoffId = this.randomUuid();
         const token = this.randomBearer();
         const tokenCommitment = `0x${createHash2("sha256").update(token, "utf8").digest("hex")}`;
-        const request = { handoffId, tokenCommitment };
-        const response = input.requestId === void 0 ? await required2(this.api.createBrowserHandoff, "api.createBrowserHandoff").call(this.api, request, input.session.rawBearer) : await required2(this.api.bindBrowserHandoff, "api.bindBrowserHandoff").call(this.api, { ...request, requestId: input.requestId }, input.session.rawBearer);
+        const request2 = { handoffId, tokenCommitment };
+        const response = input.requestId === void 0 ? await required2(this.api.createBrowserHandoff, "api.createBrowserHandoff").call(this.api, request2, input.session.rawBearer) : await required2(this.api.bindBrowserHandoff, "api.bindBrowserHandoff").call(this.api, { ...request2, requestId: input.requestId }, input.session.rawBearer);
         const bound = asObject(response, "Browser handoff");
         if (bound.accountId !== input.session.accountId || bound.environment !== input.session.environment || String(bound.walletAddress).toLowerCase() !== input.session.walletAddress.toLowerCase()) {
           throw new CliAuthorityError();
@@ -57192,19 +57382,45 @@ var init_application = __esm({
         const authority = await this.verifiedAgentCliAuthority();
         return this.openBrowserHandoff({ ...authority, requestId: match[1] });
       }
+      /** Layer 3: the shell-safe request token shown on the Finch authorization page. */
       async authorizeMcp(requestToken) {
+        return this.authorizeMcpRequest(decodeAgentCliMcpAuthorizationRequest(requestToken));
+      }
+      /** Layer 2: one raw authorization URL on standard input, which argv cannot carry intact on Windows. */
+      async authorizeMcpFromStdin() {
+        const input = await required2(this.stdin, "stdin").readAll(MAXIMUM_STDIN_AUTHORIZATION_BYTES);
+        const requestUrl = input.replace(/\r?\n$/u, "");
+        if (requestUrl.length === 0 || /\s/u.test(requestUrl)) {
+          throw new McpAuthorizationFlowError("stdin_invalid");
+        }
+        return this.authorizeMcpRequest(requestUrl);
+      }
+      /** Layer 1: run the MCP client's own login command and approve the URL it prints. */
+      async connectMcp(command) {
         const profile = await this.authorizedProfile();
-        const requestUrl = decodeAgentCliMcpAuthorizationRequest(requestToken);
-        let request;
+        await this.verifiedAgentCliAuthority();
+        const session = required2(this.mcpLoginProcess, "MCP login process").start(command, profile.origin);
         try {
-          request = new URL(requestUrl);
+          const requestUrl = await session.authorizationUrl();
+          const result2 = await this.authorizeMcpRequest(requestUrl, (code) => session.redact(code));
+          await session.waitForExit();
+          return Object.freeze({ ...result2, loginCommandExitCode: 0 });
+        } finally {
+          session.close();
+        }
+      }
+      async authorizeMcpRequest(requestUrl, onAuthorizationCode) {
+        const profile = await this.authorizedProfile();
+        let request2;
+        try {
+          request2 = new URL(requestUrl);
         } catch {
           throw new TypeError("MCP OAuth request URL is invalid.");
         }
-        const redirectValues = request.searchParams.getAll("redirect_uri");
-        const stateValues = request.searchParams.getAll("state");
-        const scopeValues = request.searchParams.getAll("scope");
-        if (request.origin !== profile.origin || request.pathname !== "/oauth/authorize" || request.username !== "" || request.password !== "" || request.hash !== "" || requestUrl !== `${profile.origin}${request.pathname}${request.search}` || redirectValues.length !== 1 || stateValues.length > 1 || scopeValues.length !== 1) {
+        const redirectValues = request2.searchParams.getAll("redirect_uri");
+        const stateValues = request2.searchParams.getAll("state");
+        const scopeValues = request2.searchParams.getAll("scope");
+        if (request2.origin !== profile.origin || request2.pathname !== "/oauth/authorize" || request2.username !== "" || request2.password !== "" || request2.hash !== "" || requestUrl !== `${profile.origin}${request2.pathname}${request2.search}` || redirectValues.length !== 1 || stateValues.length > 1 || scopeValues.length > 1) {
           throw new TypeError("MCP OAuth request URL does not match the active profile authority.");
         }
         let registeredRedirect;
@@ -57213,18 +57429,19 @@ var init_application = __esm({
         } catch {
           throw new TypeError("MCP OAuth redirect URI is invalid.");
         }
-        if (registeredRedirect.username !== "" || registeredRedirect.password !== "" || registeredRedirect.hash !== "") {
+        if (registeredRedirect.username !== "" || registeredRedirect.password !== "" || registeredRedirect.hash !== "" || registeredRedirect.protocol !== "https:" && !isLoopbackHttpUrl(registeredRedirect)) {
           throw new TypeError("MCP OAuth redirect URI is invalid.");
         }
         const authority = await this.verifiedAgentCliAuthority();
-        const response = asObject(await required2(this.api.authorizeMcp, "api.authorizeMcp").call(this.api, `${request.pathname}${request.search}`, authority.session.rawBearer), "MCP authorization");
+        const expectedIssuer = await required2(this.api.authorizationResponseIssuer, "api.authorizationResponseIssuer").call(this.api);
+        const response = asObject(await required2(this.api.authorizeMcp, "api.authorizeMcp").call(this.api, `${request2.pathname}${request2.search}`, authority.session.rawBearer), "MCP authorization");
         if (response.authorized !== true || response.accountId !== authority.session.accountId || String(response.walletAddress).toLowerCase() !== authority.walletAddress || typeof response.clientName !== "string" || response.clientName.length < 1 || response.clientName.length > 128 || !Array.isArray(response.scopes) || response.scopes.some((scope) => typeof scope !== "string" || scope.length < 1) || typeof response.callbackUrl !== "string") {
           throw new CliAuthorityError();
         }
-        const requestedScopes = scopeValues[0].split(" ").filter(Boolean).sort();
-        const returnedScopes = [...response.scopes].sort();
-        if (requestedScopes.length < 1 || requestedScopes.length !== returnedScopes.length || requestedScopes.some((scope, index2) => scope !== returnedScopes[index2])) {
-          throw new CliAuthorityError();
+        const requestedScopes = [...new Set((scopeValues[0] ?? "").split(" ").filter(Boolean))].sort();
+        const returnedScopes = [...new Set(response.scopes)].sort();
+        if (returnedScopes.length < 1 || requestedScopes.length > 0 && (requestedScopes.length !== returnedScopes.length || requestedScopes.some((scope, index2) => scope !== returnedScopes[index2]))) {
+          throw new TypeError("MCP OAuth granted scopes do not match the authorization request.");
         }
         let callback;
         try {
@@ -57233,22 +57450,36 @@ var init_application = __esm({
           throw new TypeError("MCP OAuth callback is invalid.");
         }
         const codes = callback.searchParams.getAll("code");
-        if (codes.length !== 1 || !/^[A-Za-z0-9_-]{43}$/u.test(codes[0])) {
+        if (codes.length !== 1 || codes[0].length < 1 || callback.searchParams.has("error")) {
           throw new TypeError("MCP OAuth callback is invalid.");
         }
+        onAuthorizationCode?.(codes[0]);
         const expectedCallback = new URL(registeredRedirect.href);
         expectedCallback.searchParams.set("code", codes[0]);
         if (stateValues.length === 1) expectedCallback.searchParams.set("state", stateValues[0]);
-        if (callback.href !== expectedCallback.href) {
-          throw new TypeError("MCP OAuth callback does not match the registered redirect and state.");
+        if (expectedIssuer !== null) expectedCallback.searchParams.set("iss", expectedIssuer);
+        const expectedParameters = new URLSearchParams(expectedCallback.search);
+        const callbackParameters = new URLSearchParams(callback.search);
+        expectedParameters.sort();
+        callbackParameters.sort();
+        if (callback.origin !== registeredRedirect.origin || callback.pathname !== registeredRedirect.pathname || callback.protocol !== registeredRedirect.protocol || callback.username !== "" || callback.password !== "" || callback.hash !== "" || callbackParameters.toString() !== expectedParameters.toString()) {
+          throw new TypeError("MCP OAuth callback does not match the registered redirect, state, and issuer.");
+        }
+        let callbackDelivery;
+        if (isLoopbackHttpUrl(callback)) {
+          await required2(this.callbackDelivery, "callback delivery").deliver(callback.href);
+          callbackDelivery = "loopback_http";
+        } else {
+          await required2(this.browserLauncher, "browser launcher").open(callback.href);
+          callbackDelivery = "browser";
         }
-        await required2(this.browserLauncher, "browser launcher").open(callback.href);
         return Object.freeze({
           authorized: true,
           clientName: response.clientName,
           walletAddress: authority.walletAddress,
           environment: authority.session.environment,
-          scopes: Object.freeze([...returnedScopes])
+          scopes: Object.freeze([...returnedScopes]),
+          callbackDelivery
         });
       }
       async createWallet() {
@@ -57412,7 +57643,8 @@ var init_application = __esm({
                 message: localFailureMessage(cause)
               }];
             } else if (cause instanceof CliHttpError) {
-              return [null, { status: cause.status === 401 || cause.status === 403 || cause.code === "CLI_RESPONSE_INVALID" ? "invalid" : "unavailable", message: guidance }];
+              const unavailable = cause.status === 429 || cause.status !== null && cause.status >= 500;
+              return [null, { status: !unavailable && (cause.status === 401 || cause.status === 403 || cause.code === "CLI_RESPONSE_INVALID") ? "invalid" : "unavailable", message: guidance }];
             } else if (cause instanceof TypeError || cause instanceof CliAuthorityError) {
               return [null, { status: "invalid", message: guidance }];
             } else {
@@ -57425,7 +57657,7 @@ var init_application = __esm({
           "Check the protected FINCHTECH_HOME/profile.json endpoint override."
         );
         const [wallet, walletCheck] = await inspect(
-          () => required2(this.state.readWalletAddress, "state.readWalletAddress").call(this.state),
+          () => required2(this.state.readWalletAddress, "state.readWalletAddress").call(this.state, { migrateLegacy: false }),
           "Restore the current wallet from backup."
         );
         const [session, sessionCheck] = await inspect(
@@ -57439,7 +57671,7 @@ var init_application = __esm({
             if (session.origin !== profile.origin || wallet.walletAddress !== session.walletAddress) {
               throw new CliAuthorityError();
             }
-            const remote = asObject(await required2(this.api.getSession, "api.getSession").call(this.api, session.rawBearer), "MCP doctor Session");
+            const remote = asObject(await required2(this.api.getSession, "api.getSession").call(this.api, session.rawBearer, AbortSignal.timeout(15e3)), "MCP doctor Session");
             if (remote.sessionId !== session.sessionId || remote.accountId !== session.accountId || remote.walletAddress !== session.walletAddress || remote.environment !== session.environment || remote.audience !== "agent_cli" || typeof remote.sessionExpiresAt !== "string" || !Number.isFinite(Date.parse(remote.sessionExpiresAt)) || Date.parse(remote.sessionExpiresAt) <= Date.now()) throw new CliAuthorityError();
             return { sessionExpiresAt: remote.sessionExpiresAt };
           }, "Verify the endpoint and current wallet, then run finch login --help to renew the CLI login. If the server is unavailable, retry later.");
@@ -57451,7 +57683,7 @@ var init_application = __esm({
         if (profile !== null) {
           [mcp, mcpDiscoveryCheck] = await inspect(async () => {
             const discovery = await required2(this.api.inspectRemoteMcp, "api.inspectRemoteMcp").call(this.api);
-            if (discovery.url !== `${profile.origin}/mcp` || discovery.authorization !== "oauth" || JSON.stringify(discovery.supportedClients) !== JSON.stringify(["codex"])) {
+            if (discovery.url !== `${profile.origin}/mcp` || discovery.authorization !== "oauth" || discovery.transport !== "streamable_http") {
               throw new TypeError("MCP discovery authority mismatch.");
             }
             return discovery;
@@ -58298,66 +58530,13 @@ var init_application = __esm({
   }
 });
 
-// package.json
-var package_default;
-var init_package = __esm({
-  "package.json"() {
-    package_default = {
-      name: "@finchtech/cli",
-      version: "0.3.8",
-      description: "Finch Agent CLI for wallet-owned marketplace and MCP workflows.",
-      type: "module",
-      bin: {
-        finch: "dist/finch.js",
-        finchtech: "dist/finch.js"
-      },
-      files: [
-        "dist/finch.js",
-        "README.md",
-        "THIRD_PARTY_LICENSES.txt"
-      ],
-      engines: {
-        node: ">=20"
-      },
-      publishConfig: {
-        access: "public"
-      },
-      repository: {
-        type: "git",
-        url: "git+https://github.com/FinchipAI/Finch-Site.git",
-        directory: "apps/cli"
-      },
-      homepage: "https://www.finchtech.ai",
-      scripts: {
-        build: 'esbuild src/bootstrap.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/finch.js --banner:js="#!/usr/bin/env node"',
-        check: "pnpm lint && pnpm typecheck && pnpm test && pnpm build",
-        lint: "eslint src vitest.config.ts eslint.config.mjs",
-        prepack: "pnpm build",
-        test: "vitest run",
-        typecheck: "tsc --noEmit"
-      },
-      devDependencies: {
-        "@finch/agent-market-contracts": "workspace:*",
-        "@finch/deployment-manifest": "workspace:*",
-        "@finch/skill-content": "workspace:*",
-        "@finch/skill-market-contracts": "workspace:*",
-        "@finch/task-market-contracts": "workspace:*",
-        "@eslint/js": "9.39.2",
-        "@types/node": "20.19.30",
-        ajv: "8.20.0",
-        esbuild: "0.28.2",
-        eslint: "9.39.2",
-        typescript: "5.9.3",
-        "typescript-eslint": "8.67.0",
-        viem: "2.55.15",
-        vitest: "4.1.10"
-      }
-    };
-  }
-});
-
 // src/command-router.ts
-function helpTopic(arguments_) {
+function finchOwnArguments(arguments_) {
+  const separator = arguments_.indexOf("--");
+  return separator < 0 ? arguments_ : arguments_.slice(0, separator);
+}
+function helpTopic(allArguments) {
+  const arguments_ = finchOwnArguments(allArguments);
   if (arguments_[0] === "help" && arguments_.length > 1) return arguments_.slice(1).join(" ");
   if (arguments_.length > 1 && arguments_.at(-1) === "--help" && arguments_.filter((argument) => argument === "--help").length === 1) {
     return arguments_.slice(0, -1).join(" ");
@@ -58481,7 +58660,13 @@ async function routeCommand(arguments_, application) {
   if (first === "mcp" && second === "doctor" && arguments_.length === 2) {
     return result("mcp.doctor", await method(application.doctorMcp, "mcp doctor").call(application));
   }
-  if (first === "mcp" && second === "authorize" && arguments_.length === 3 && third !== void 0) {
+  if (first === "mcp" && second === "connect" && third === "--" && arguments_.length > 3) {
+    return result("mcp.connect", await method(application.connectMcp, "mcp connect").call(application, Object.freeze(arguments_.slice(3))));
+  }
+  if (first === "mcp" && second === "authorize" && arguments_.length === 3 && third === "--stdin") {
+    return result("mcp.authorize", await method(application.authorizeMcpFromStdin, "mcp authorize").call(application));
+  }
+  if (first === "mcp" && second === "authorize" && arguments_.length === 3 && third !== void 0 && !third.startsWith("--")) {
     return result("mcp.authorize", await method(application.authorizeMcp, "mcp authorize").call(application, third));
   }
   if (first === "mcp" && second === "grant" && third === "create") {
@@ -58804,6 +58989,7 @@ var init_command_router = __esm({
       "site open",
       "site login",
       "mcp doctor",
+      "mcp connect",
       "mcp authorize",
       "mcp grant create",
       "mcp grant show",
@@ -58870,7 +59056,8 @@ var init_command_router = __esm({
       "site open": "finch site open",
       "site login": "finch site login <REQUEST_URL>",
       "mcp doctor": "finch mcp doctor",
-      "mcp authorize": "finch mcp authorize <REQUEST_TOKEN>",
+      "mcp connect": "finch mcp connect -- <MCP_CLIENT_LOGIN_COMMAND...>",
+      "mcp authorize": "finch mcp authorize --stdin | finch mcp authorize <REQUEST_TOKEN>",
       "mcp grant create": "finch mcp grant create --scopes <CSV> --expires-at <ISO-8601>",
       "mcp grant show": "finch mcp grant show <GRANT_ID>",
       "mcp grant revoke": "finch mcp grant revoke <GRANT_ID>",
@@ -58926,6 +59113,735 @@ var init_command_router = __esm({
   }
 });
 
+// ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js
+var require_windows = __commonJS({
+  "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
+    module.exports = isexe;
+    isexe.sync = sync;
+    var fs = __require("fs");
+    function checkPathExt(path2, options) {
+      var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
+      if (!pathext) {
+        return true;
+      }
+      pathext = pathext.split(";");
+      if (pathext.indexOf("") !== -1) {
+        return true;
+      }
+      for (var i2 = 0; i2 < pathext.length; i2++) {
+        var p = pathext[i2].toLowerCase();
+        if (p && path2.substr(-p.length).toLowerCase() === p) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function checkStat(stat, path2, options) {
+      if (!stat.isSymbolicLink() && !stat.isFile()) {
+        return false;
+      }
+      return checkPathExt(path2, options);
+    }
+    function isexe(path2, options, cb) {
+      fs.stat(path2, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path2, options));
+      });
+    }
+    function sync(path2, options) {
+      return checkStat(fs.statSync(path2), path2, options);
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js
+var require_mode = __commonJS({
+  "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
+    module.exports = isexe;
+    isexe.sync = sync;
+    var fs = __require("fs");
+    function isexe(path2, options, cb) {
+      fs.stat(path2, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, options));
+      });
+    }
+    function sync(path2, options) {
+      return checkStat(fs.statSync(path2), options);
+    }
+    function checkStat(stat, options) {
+      return stat.isFile() && checkMode(stat, options);
+    }
+    function checkMode(stat, options) {
+      var mod2 = stat.mode;
+      var uid2 = stat.uid;
+      var gid = stat.gid;
+      var myUid = options.uid !== void 0 ? options.uid : process.getuid && process.getuid();
+      var myGid = options.gid !== void 0 ? options.gid : process.getgid && process.getgid();
+      var u = parseInt("100", 8);
+      var g = parseInt("010", 8);
+      var o = parseInt("001", 8);
+      var ug = u | g;
+      var ret = mod2 & o || mod2 & g && gid === myGid || mod2 & u && uid2 === myUid || mod2 & ug && myUid === 0;
+      return ret;
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
+var require_isexe = __commonJS({
+  "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
+    var fs = __require("fs");
+    var core;
+    if (process.platform === "win32" || global.TESTING_WINDOWS) {
+      core = require_windows();
+    } else {
+      core = require_mode();
+    }
+    module.exports = isexe;
+    isexe.sync = sync;
+    function isexe(path2, options, cb) {
+      if (typeof options === "function") {
+        cb = options;
+        options = {};
+      }
+      if (!cb) {
+        if (typeof Promise !== "function") {
+          throw new TypeError("callback not provided");
+        }
+        return new Promise(function(resolve4, reject5) {
+          isexe(path2, options || {}, function(er, is2) {
+            if (er) {
+              reject5(er);
+            } else {
+              resolve4(is2);
+            }
+          });
+        });
+      }
+      core(path2, options || {}, function(er, is2) {
+        if (er) {
+          if (er.code === "EACCES" || options && options.ignoreErrors) {
+            er = null;
+            is2 = false;
+          }
+        }
+        cb(er, is2);
+      });
+    }
+    function sync(path2, options) {
+      try {
+        return core.sync(path2, options || {});
+      } catch (er) {
+        if (options && options.ignoreErrors || er.code === "EACCES") {
+          return false;
+        } else {
+          throw er;
+        }
+      }
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js
+var require_which = __commonJS({
+  "../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports, module) {
+    var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
+    var path2 = __require("path");
+    var COLON = isWindows ? ";" : ":";
+    var isexe = require_isexe();
+    var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
+    var getPathInfo = (cmd, opt) => {
+      const colon = opt.colon || COLON;
+      const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [
+        // windows always checks the cwd first
+        ...isWindows ? [process.cwd()] : [],
+        ...(opt.path || process.env.PATH || /* istanbul ignore next: very unusual */
+        "").split(colon)
+      ];
+      const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
+      const pathExt = isWindows ? pathExtExe.split(colon) : [""];
+      if (isWindows) {
+        if (cmd.indexOf(".") !== -1 && pathExt[0] !== "")
+          pathExt.unshift("");
+      }
+      return {
+        pathEnv,
+        pathExt,
+        pathExtExe
+      };
+    };
+    var which = (cmd, opt, cb) => {
+      if (typeof opt === "function") {
+        cb = opt;
+        opt = {};
+      }
+      if (!opt)
+        opt = {};
+      const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+      const found = [];
+      const step = (i2) => new Promise((resolve4, reject5) => {
+        if (i2 === pathEnv.length)
+          return opt.all && found.length ? resolve4(found) : reject5(getNotFoundError(cmd));
+        const ppRaw = pathEnv[i2];
+        const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+        const pCmd = path2.join(pathPart, cmd);
+        const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+        resolve4(subStep(p, i2, 0));
+      });
+      const subStep = (p, i2, ii) => new Promise((resolve4, reject5) => {
+        if (ii === pathExt.length)
+          return resolve4(step(i2 + 1));
+        const ext = pathExt[ii];
+        isexe(p + ext, { pathExt: pathExtExe }, (er, is2) => {
+          if (!er && is2) {
+            if (opt.all)
+              found.push(p + ext);
+            else
+              return resolve4(p + ext);
+          }
+          return resolve4(subStep(p, i2, ii + 1));
+        });
+      });
+      return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
+    };
+    var whichSync = (cmd, opt) => {
+      opt = opt || {};
+      const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+      const found = [];
+      for (let i2 = 0; i2 < pathEnv.length; i2++) {
+        const ppRaw = pathEnv[i2];
+        const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+        const pCmd = path2.join(pathPart, cmd);
+        const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+        for (let j = 0; j < pathExt.length; j++) {
+          const cur = p + pathExt[j];
+          try {
+            const is2 = isexe.sync(cur, { pathExt: pathExtExe });
+            if (is2) {
+              if (opt.all)
+                found.push(cur);
+              else
+                return cur;
+            }
+          } catch (ex) {
+          }
+        }
+      }
+      if (opt.all && found.length)
+        return found;
+      if (opt.nothrow)
+        return null;
+      throw getNotFoundError(cmd);
+    };
+    module.exports = which;
+    which.sync = whichSync;
+  }
+});
+
+// ../../node_modules/.pnpm/path-key@3.1.1/node_modules/path-key/index.js
+var require_path_key = __commonJS({
+  "../../node_modules/.pnpm/path-key@3.1.1/node_modules/path-key/index.js"(exports, module) {
+    "use strict";
+    var pathKey = (options = {}) => {
+      const environment3 = options.env || process.env;
+      const platform = options.platform || process.platform;
+      if (platform !== "win32") {
+        return "PATH";
+      }
+      return Object.keys(environment3).reverse().find((key) => key.toUpperCase() === "PATH") || "Path";
+    };
+    module.exports = pathKey;
+    module.exports.default = pathKey;
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js
+var require_resolveCommand = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
+    "use strict";
+    var path2 = __require("path");
+    var which = require_which();
+    var getPathKey = require_path_key();
+    function resolveCommandAttempt(parsed2, withoutPathExt) {
+      const env = parsed2.options.env || process.env;
+      const cwd = process.cwd();
+      const hasCustomCwd = parsed2.options.cwd != null;
+      const shouldSwitchCwd = hasCustomCwd && process.chdir !== void 0 && !process.chdir.disabled;
+      if (shouldSwitchCwd) {
+        try {
+          process.chdir(parsed2.options.cwd);
+        } catch (err2) {
+        }
+      }
+      let resolved;
+      try {
+        resolved = which.sync(parsed2.command, {
+          path: env[getPathKey({ env })],
+          pathExt: withoutPathExt ? path2.delimiter : void 0
+        });
+      } catch (e) {
+      } finally {
+        if (shouldSwitchCwd) {
+          process.chdir(cwd);
+        }
+      }
+      if (resolved) {
+        resolved = path2.resolve(hasCustomCwd ? parsed2.options.cwd : "", resolved);
+      }
+      return resolved;
+    }
+    function resolveCommand(parsed2) {
+      return resolveCommandAttempt(parsed2) || resolveCommandAttempt(parsed2, true);
+    }
+    module.exports = resolveCommand;
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/escape.js
+var require_escape = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/escape.js"(exports, module) {
+    "use strict";
+    var metaCharsRegExp = /([()\][%!^"`<>&|;, *?])/g;
+    function escapeCommand(arg) {
+      arg = arg.replace(metaCharsRegExp, "^$1");
+      return arg;
+    }
+    function escapeArgument(arg, doubleEscapeMetaChars) {
+      arg = `${arg}`;
+      arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+      arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
+      arg = `"${arg}"`;
+      arg = arg.replace(metaCharsRegExp, "^$1");
+      if (doubleEscapeMetaChars) {
+        arg = arg.replace(metaCharsRegExp, "^$1");
+      }
+      return arg;
+    }
+    module.exports.command = escapeCommand;
+    module.exports.argument = escapeArgument;
+  }
+});
+
+// ../../node_modules/.pnpm/shebang-regex@3.0.0/node_modules/shebang-regex/index.js
+var require_shebang_regex = __commonJS({
+  "../../node_modules/.pnpm/shebang-regex@3.0.0/node_modules/shebang-regex/index.js"(exports, module) {
+    "use strict";
+    module.exports = /^#!(.*)/;
+  }
+});
+
+// ../../node_modules/.pnpm/shebang-command@2.0.0/node_modules/shebang-command/index.js
+var require_shebang_command = __commonJS({
+  "../../node_modules/.pnpm/shebang-command@2.0.0/node_modules/shebang-command/index.js"(exports, module) {
+    "use strict";
+    var shebangRegex = require_shebang_regex();
+    module.exports = (string5 = "") => {
+      const match = string5.match(shebangRegex);
+      if (!match) {
+        return null;
+      }
+      const [path2, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path2.split("/").pop();
+      if (binary === "env") {
+        return argument;
+      }
+      return argument ? `${binary} ${argument}` : binary;
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js
+var require_readShebang = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
+    "use strict";
+    var fs = __require("fs");
+    var shebangCommand = require_shebang_command();
+    function readShebang(command) {
+      const size5 = 150;
+      const buffer3 = Buffer.alloc(size5);
+      let fd2;
+      try {
+        fd2 = fs.openSync(command, "r");
+        fs.readSync(fd2, buffer3, 0, size5, 0);
+        fs.closeSync(fd2);
+      } catch (e) {
+      }
+      return shebangCommand(buffer3.toString());
+    }
+    module.exports = readShebang;
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js
+var require_parse = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports, module) {
+    "use strict";
+    var path2 = __require("path");
+    var resolveCommand = require_resolveCommand();
+    var escape2 = require_escape();
+    var readShebang = require_readShebang();
+    var isWin = process.platform === "win32";
+    var isExecutableRegExp = /\.(?:com|exe)$/i;
+    var isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;
+    function detectShebang(parsed2) {
+      parsed2.file = resolveCommand(parsed2);
+      const shebang = parsed2.file && readShebang(parsed2.file);
+      if (shebang) {
+        parsed2.args.unshift(parsed2.file);
+        parsed2.command = shebang;
+        return resolveCommand(parsed2);
+      }
+      return parsed2.file;
+    }
+    function parseNonShell(parsed2) {
+      if (!isWin) {
+        return parsed2;
+      }
+      const commandFile = detectShebang(parsed2);
+      const needsShell = !isExecutableRegExp.test(commandFile);
+      if (parsed2.options.forceShell || needsShell) {
+        const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
+        parsed2.command = path2.normalize(parsed2.command);
+        parsed2.command = escape2.command(parsed2.command);
+        parsed2.args = parsed2.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
+        const shellCommand = [parsed2.command].concat(parsed2.args).join(" ");
+        parsed2.args = ["/d", "/s", "/c", `"${shellCommand}"`];
+        parsed2.command = process.env.comspec || "cmd.exe";
+        parsed2.options.windowsVerbatimArguments = true;
+      }
+      return parsed2;
+    }
+    function parse4(command, args, options) {
+      if (args && !Array.isArray(args)) {
+        options = args;
+        args = null;
+      }
+      args = args ? args.slice(0) : [];
+      options = Object.assign({}, options);
+      const parsed2 = {
+        command,
+        args,
+        options,
+        file: void 0,
+        original: {
+          command,
+          args
+        }
+      };
+      return options.shell ? parsed2 : parseNonShell(parsed2);
+    }
+    module.exports = parse4;
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/enoent.js
+var require_enoent = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/enoent.js"(exports, module) {
+    "use strict";
+    var isWin = process.platform === "win32";
+    function notFoundError(original, syscall) {
+      return Object.assign(new Error(`${syscall} ${original.command} ENOENT`), {
+        code: "ENOENT",
+        errno: "ENOENT",
+        syscall: `${syscall} ${original.command}`,
+        path: original.command,
+        spawnargs: original.args
+      });
+    }
+    function hookChildProcess(cp, parsed2) {
+      if (!isWin) {
+        return;
+      }
+      const originalEmit = cp.emit;
+      cp.emit = function(name, arg1) {
+        if (name === "exit") {
+          const err2 = verifyENOENT(arg1, parsed2);
+          if (err2) {
+            return originalEmit.call(cp, "error", err2);
+          }
+        }
+        return originalEmit.apply(cp, arguments);
+      };
+    }
+    function verifyENOENT(status, parsed2) {
+      if (isWin && status === 1 && !parsed2.file) {
+        return notFoundError(parsed2.original, "spawn");
+      }
+      return null;
+    }
+    function verifyENOENTSync(status, parsed2) {
+      if (isWin && status === 1 && !parsed2.file) {
+        return notFoundError(parsed2.original, "spawnSync");
+      }
+      return null;
+    }
+    module.exports = {
+      hookChildProcess,
+      verifyENOENT,
+      verifyENOENTSync,
+      notFoundError
+    };
+  }
+});
+
+// ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/index.js
+var require_cross_spawn = __commonJS({
+  "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/index.js"(exports, module) {
+    "use strict";
+    var cp = __require("child_process");
+    var parse4 = require_parse();
+    var enoent = require_enoent();
+    function spawn2(command, args, options) {
+      const parsed2 = parse4(command, args, options);
+      const spawned = cp.spawn(parsed2.command, parsed2.args, parsed2.options);
+      enoent.hookChildProcess(spawned, parsed2);
+      return spawned;
+    }
+    function spawnSync2(command, args, options) {
+      const parsed2 = parse4(command, args, options);
+      const result2 = cp.spawnSync(parsed2.command, parsed2.args, parsed2.options);
+      result2.error = result2.error || enoent.verifyENOENTSync(result2.status, parsed2);
+      return result2;
+    }
+    module.exports = spawn2;
+    module.exports.spawn = spawn2;
+    module.exports.sync = spawnSync2;
+    module.exports._parse = parse4;
+    module.exports._enoent = enoent;
+  }
+});
+
+// src/authorization-url-scanner.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+var MAXIMUM_BUFFERED_LINE_CHARACTERS, URL_CHARACTERS, OSC8_HYPERLINK, ESCAPE_SEQUENCE, AuthorizationUrlScanner;
+var init_authorization_url_scanner = __esm({
+  "src/authorization-url-scanner.ts"() {
+    "use strict";
+    MAXIMUM_BUFFERED_LINE_CHARACTERS = 16384;
+    URL_CHARACTERS = '[^\\s"<>`{}|\\\\^]+';
+    OSC8_HYPERLINK = /\u001b\]8;[^;\u0007\u001b]*;([^\u0007\u001b]*)(?:\u0007|\u001b\\)/gu;
+    ESCAPE_SEQUENCE = /\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)|\u001b\[[0-?]*[ -/]*[@-~]|\u001b[@-_]/gu;
+    AuthorizationUrlScanner = class {
+      pattern;
+      buffers = /* @__PURE__ */ new Map();
+      seen = /* @__PURE__ */ new Set();
+      constructor(origin2) {
+        this.pattern = new RegExp(`${escapeRegExp(`${origin2}/oauth/authorize?`)}${URL_CHARACTERS}`, "gu");
+      }
+      /**
+       * Adds one chunk of one stream. Returns the complete lines it closed, for forwarding, and every
+       * authorization URL those lines introduced that was not seen before on any stream.
+       */
+      feed(stream, chunk) {
+        const buffered = `${this.buffers.get(stream) ?? ""}${chunk}`;
+        const parts = buffered.split(/\r\n|\n|\r/u);
+        let remainder = parts.pop();
+        if (remainder.length > MAXIMUM_BUFFERED_LINE_CHARACTERS) {
+          parts.push(remainder);
+          remainder = "";
+        }
+        this.buffers.set(stream, remainder);
+        return this.scan(parts);
+      }
+      /** Closes one stream, treating any unterminated text as its final line. */
+      end(stream) {
+        const remainder = this.buffers.get(stream) ?? "";
+        this.buffers.delete(stream);
+        return this.scan(remainder === "" ? [] : [remainder]);
+      }
+      scan(lines) {
+        const urls = [];
+        for (const line of lines) {
+          const hyperlinkTargets = [...line.matchAll(OSC8_HYPERLINK)].map((match) => match[1]);
+          const visible = line.replace(ESCAPE_SEQUENCE, "");
+          for (const text3 of [...hyperlinkTargets, visible]) {
+            for (const match of text3.matchAll(this.pattern)) {
+              const url2 = match[0];
+              if (!this.seen.has(url2)) {
+                this.seen.add(url2);
+                urls.push(url2);
+              }
+            }
+          }
+        }
+        return Object.freeze({ lines: Object.freeze([...lines]), urls: Object.freeze(urls) });
+      }
+    };
+  }
+});
+
+// src/mcp-login-process.ts
+import { spawn as spawnSync } from "node:child_process";
+function terminate(child) {
+  if (child.exitCode !== null || child.signalCode !== null || child.pid === void 0) return;
+  if (process.platform === "win32") {
+    spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  } else {
+    child.kill("SIGTERM");
+  }
+}
+var import_cross_spawn, AUTHORIZATION_URL_TIMEOUT_MILLISECONDS, LOGIN_EXIT_TIMEOUT_MILLISECONDS, spawnLoginCommand, InstalledMcpLoginSession, InstalledMcpLoginProcess;
+var init_mcp_login_process = __esm({
+  "src/mcp-login-process.ts"() {
+    "use strict";
+    import_cross_spawn = __toESM(require_cross_spawn(), 1);
+    init_authorization_url_scanner();
+    init_cli_error();
+    AUTHORIZATION_URL_TIMEOUT_MILLISECONDS = 12e4;
+    LOGIN_EXIT_TIMEOUT_MILLISECONDS = 6e4;
+    spawnLoginCommand = (command, arguments_) => (0, import_cross_spawn.default)(command, [...arguments_], {
+      // stdin stays an open pipe that is never written: clients that also accept a pasted callback
+      // treat end-of-input as a failed login.
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    InstalledMcpLoginSession = class {
+      constructor(child, origin2, diagnostics, timeouts) {
+        this.child = child;
+        this.diagnostics = diagnostics;
+        this.timeouts = timeouts;
+        this.scanner = new AuthorizationUrlScanner(origin2);
+        this.firstUrlPromise = new Promise((resolve4, reject5) => {
+          this.firstUrl = resolve4;
+          this.firstUrlFailed = reject5;
+        });
+        this.firstUrlPromise.catch(() => void 0);
+        for (const [name, stream] of [["stdout", child.stdout], ["stderr", child.stderr]]) {
+          stream?.setEncoding("utf8");
+          stream?.on("data", (chunk) => this.accept(this.scanner.feed(name, chunk)));
+          stream?.on("end", () => this.accept(this.scanner.end(name)));
+        }
+        this.exited = new Promise((resolve4) => {
+          child.once("error", (cause) => {
+            this.firstUrlFailed?.(new McpAuthorizationFlowError("login_command_not_started", {}, { cause }));
+            resolve4(-1);
+          });
+          child.once("close", (code) => resolve4(code ?? -1));
+        });
+        void this.exited.then((code) => this.firstUrlFailed?.(new McpAuthorizationFlowError(
+          "request_url_not_found",
+          { loginCommandExitCode: code }
+        )));
+      }
+      child;
+      diagnostics;
+      timeouts;
+      scanner;
+      secrets = [];
+      exited;
+      firstUrl;
+      firstUrlFailed;
+      firstUrlPromise;
+      authorizationUrlCount = 0;
+      accept(scan) {
+        for (const line of scan.lines) {
+          this.diagnostics(`${this.secrets.reduce((text3, secret) => text3.split(secret).join("[REDACTED]"), line)}
+`);
+        }
+        for (const url2 of scan.urls) {
+          this.authorizationUrlCount += 1;
+          if (this.authorizationUrlCount === 1) this.firstUrl?.(url2);
+        }
+      }
+      async authorizationUrl() {
+        let timer;
+        const timeout = new Promise((_resolve, reject5) => {
+          timer = setTimeout(
+            () => reject5(new McpAuthorizationFlowError("request_url_not_found")),
+            this.timeouts.authorizationUrl
+          );
+        });
+        try {
+          return await Promise.race([this.firstUrlPromise, timeout]);
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      redact(secret) {
+        if (secret.length > 0) this.secrets.push(secret);
+      }
+      async waitForExit() {
+        let timer;
+        const timeout = new Promise((resolve4) => {
+          timer = setTimeout(() => resolve4("timeout"), this.timeouts.exit);
+        });
+        try {
+          const code = await Promise.race([this.exited, timeout]);
+          if (this.authorizationUrlCount > 1) {
+            throw new McpAuthorizationFlowError("second_authorization_request");
+          }
+          if (code === "timeout") throw new McpAuthorizationFlowError("login_command_timeout");
+          if (code !== 0) throw new McpAuthorizationFlowError("login_command_failed", { loginCommandExitCode: code });
+          return code;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      close() {
+        terminate(this.child);
+        this.child.stdin?.end();
+      }
+    };
+    InstalledMcpLoginProcess = class {
+      constructor(spawn2 = spawnLoginCommand, diagnostics = (text3) => {
+        process.stderr.write(text3);
+      }, timeouts = {
+        authorizationUrl: AUTHORIZATION_URL_TIMEOUT_MILLISECONDS,
+        exit: LOGIN_EXIT_TIMEOUT_MILLISECONDS
+      }) {
+        this.spawn = spawn2;
+        this.diagnostics = diagnostics;
+        this.timeouts = timeouts;
+      }
+      spawn;
+      diagnostics;
+      timeouts;
+      start(command, origin2) {
+        const [executable, ...arguments_] = command;
+        if (executable === void 0 || executable.length === 0) {
+          throw new TypeError("finch mcp connect requires an MCP client login command after --.");
+        }
+        return new InstalledMcpLoginSession(this.spawn(executable, arguments_), origin2, this.diagnostics, this.timeouts);
+      }
+    };
+  }
+});
+
+// src/stdin-reader.ts
+var ProcessStdinReader;
+var init_stdin_reader = __esm({
+  "src/stdin-reader.ts"() {
+    "use strict";
+    init_cli_error();
+    ProcessStdinReader = class {
+      constructor(input = process.stdin) {
+        this.input = input;
+      }
+      input;
+      async readAll(maximumBytes) {
+        if (this.input.isTTY === true) throw new McpAuthorizationFlowError("stdin_invalid");
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of this.input) {
+          const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), "utf8");
+          total += bytes.byteLength;
+          if (total > maximumBytes) {
+            this.input.destroy();
+            throw new McpAuthorizationFlowError("stdin_invalid");
+          }
+          chunks.push(bytes);
+        }
+        try {
+          return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+        } catch (cause) {
+          throw new McpAuthorizationFlowError("stdin_invalid", {}, { cause });
+        }
+      }
+    };
+  }
+});
+
 // src/recovery-inventory.ts
 function object3(value, name) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -59133,7 +60049,13 @@ function privateKey(value) {
 function validatedWallet(input) {
   const address2 = walletAddress(input.walletAddress);
   const key = privateKey(input.privateKey);
-  if (privateKeyToAccount(key).address.toLowerCase() !== address2) {
+  let derivedAddress;
+  try {
+    derivedAddress = privateKeyToAccount(key).address.toLowerCase();
+  } catch (cause) {
+    throw new CliStateError("CLI_STATE_CORRUPT", { cause });
+  }
+  if (derivedAddress !== address2) {
     throw new CliStateError("CLI_STATE_CORRUPT");
   }
   return Object.freeze({ walletAddress: address2, privateKey: key });
@@ -59205,13 +60127,7 @@ var init_wallet_store = __esm({
         await this.writeIndex(nextIndex);
         if (makeCurrent || currentIndex.length === 0) await this.writeCurrent(wallet.walletAddress);
       }
-      async migrateLegacyOnce() {
-        try {
-          await this.files.readJson("wallet/current.json");
-          return;
-        } catch (cause) {
-          if (!(cause instanceof CliStateError) || cause.code !== "CLI_STATE_NOT_FOUND") throw cause;
-        }
+      async readLegacy() {
         const readOptional = async (read2) => {
           try {
             return await read2();
@@ -59226,15 +60142,26 @@ var init_wallet_store = __esm({
         ]);
         if (metadata === null && key === null) {
           const index2 = await this.readIndex();
-          if (index2.length === 0) return;
+          if (index2.length === 0) return null;
           throw new CliStateError("CLI_STATE_CORRUPT");
         }
         if (metadata === null || key === null) throw new CliStateError("CLI_STATE_CORRUPT");
         const legacy = record4(metadata);
-        await this.registerInternal(validatedWallet({
+        return validatedWallet({
           walletAddress: legacy.walletAddress,
           privateKey: key.toString("utf8")
-        }), true);
+        });
+      }
+      async migrateLegacyOnce() {
+        try {
+          await this.files.readJson("wallet/current.json");
+          return;
+        } catch (cause) {
+          if (!(cause instanceof CliStateError) || cause.code !== "CLI_STATE_NOT_FOUND") throw cause;
+        }
+        const legacy = await this.readLegacy();
+        if (legacy === null) return;
+        await this.registerInternal(legacy, true);
         await this.files.remove("wallet/private-key");
         await this.files.remove("wallet/metadata.json");
       }
@@ -59267,9 +60194,17 @@ var init_wallet_store = __esm({
         await this.migrateLegacy();
         return this.readIndex();
       }
-      async readCurrent() {
-        await this.migrateLegacy();
-        const current = record4(await this.files.readJson("wallet/current.json"));
+      async readCurrent(options = {}) {
+        if (options.migrateLegacy !== false) await this.migrateLegacy();
+        let current;
+        try {
+          current = record4(await this.files.readJson("wallet/current.json"));
+        } catch (cause) {
+          if (options.migrateLegacy !== false || !(cause instanceof CliStateError) || cause.code !== "CLI_STATE_NOT_FOUND") throw cause;
+          const legacy = await this.readLegacy();
+          if (legacy === null) throw cause;
+          return legacy;
+        }
         if (current.version !== 1) throw new CliStateError("CLI_STATE_CORRUPT");
         try {
           return await this.readRegistered(walletAddress(current.walletAddress));
@@ -59563,16 +60498,16 @@ var init_local_state = __esm({
       async saveWallet(input) {
         await this.wallets.register(input);
       }
-      async readWallet() {
+      async readWallet(options) {
         try {
-          return await this.wallets.readCurrent();
+          return await this.wallets.readCurrent(options);
         } catch (cause) {
           if (cause instanceof CliStateError) throw new CliStateError(cause.code, { cause, diagnostic: "wallet" });
           throw cause;
         }
       }
-      async readWalletAddress() {
-        const wallet = await this.readWallet();
+      async readWalletAddress(options) {
+        const wallet = await this.readWallet(options);
         return Object.freeze({ walletAddress: wallet.walletAddress });
       }
       async assertWalletBootstrap() {
@@ -60410,12 +61345,12 @@ function assertCanonicalPlanTransactions(input) {
     }
   })();
   if (decoded.functionName !== "purchase") throw new TypeError("Agent purchase method is invalid.");
-  const request = decoded.args[0];
+  const request2 = decoded.args[0];
   const deadline = Date.parse(input.confirmationDeadlineAt);
-  if (!Number.isSafeInteger(deadline) || deadline <= Date.now() || request.purchaseId !== uuidBytes32(input.operationId) || request.payToken.toLowerCase() !== token || request.unitPrice * request.units !== amount || request.validUntil !== BigInt(Math.floor(deadline / 1e3))) {
+  if (!Number.isSafeInteger(deadline) || deadline <= Date.now() || request2.purchaseId !== uuidBytes32(input.operationId) || request2.payToken.toLowerCase() !== token || request2.unitPrice * request2.units !== amount || request2.validUntil !== BigInt(Math.floor(deadline / 1e3))) {
     throw new TypeError("Agent purchase arguments do not match the frozen plan.");
   }
-  const purchase = encodeFunctionData({ abi: agentPurchaseAbi, functionName: "purchase", args: [request] });
+  const purchase = encodeFunctionData({ abi: agentPurchaseAbi, functionName: "purchase", args: [request2] });
   if (input.approval.data !== approval || input.revokeApproval.data !== revoke || input.purchase.data !== purchase) {
     throw new TypeError("Agent purchase calldata is not canonical for the frozen plan.");
   }
@@ -60905,12 +61840,12 @@ var init_task_protocol_sender = __esm({
         const preparation = record5(input.preparation, "Task pool preparation");
         assertSigningAuthority2(preparation, input.walletAddress, input.accountId);
         const deployment = taskDeployment(preparation.chainId);
-        const { vault, token, amount, request } = poolAuthority(preparation, input.taskId, deployment);
+        const { vault, token, amount, request: request2 } = poolAuthority(preparation, input.taskId, deployment);
         const rpc = await this.rpc(input.privateKey, input.walletAddress, deployment);
         const owner = canonicalAddress(input.walletAddress, "Task wallet");
         const credit = await rpc.readCreditBalance(vault, owner, token);
         if (credit >= amount) {
-          const data = encodeFunctionData({ abi: taskVaultAbi, functionName: "createPool", args: [request] });
+          const data = encodeFunctionData({ abi: taskVaultAbi, functionName: "createPool", args: [request2] });
           await rpc.simulateTransaction({ to: vault, data, value: 0n });
           const hash5 = await rpc.sendTransaction({ to: vault, data, value: 0n });
           await input.onBroadcast?.({ transactionHash: hash5 });
@@ -60924,7 +61859,7 @@ var init_task_protocol_sender = __esm({
         const createPool = encodeFunctionData({
           abi: taskVaultAbi,
           functionName: "depositAndCreatePool",
-          args: [request, depositAmount]
+          args: [request2, depositAmount]
         });
         const allowance = await rpc.readAllowance(token, owner, vault);
         if (allowance < depositAmount) {
@@ -60967,7 +61902,7 @@ var init_task_protocol_sender = __esm({
           const fields = record5(typedData.types, "Task award types").AwardAuthorization;
           const selected = taskDeployment(domain2.chainId);
           deployment ??= selected;
-          if (deployment.chainId !== selected.chainId || typedData.primaryType !== "AwardAuthorization" || domain2.name !== "Finch Task Vault" || domain2.version !== "0" || domain2.chainId !== deployment.chainId || JSON.stringify(fields) !== JSON.stringify(awardTypes.AwardAuthorization) || message.awardId !== record5(award.authorization, "Task award authorization").awardId) {
+          if (deployment.chainId !== selected.chainId || typedData.primaryType !== "AwardAuthorization" || domain2.name !== "Finch Task Vault" || domain2.version !== "0" || domain2.chainId !== deployment.chainId || !Array.isArray(fields) || fields.length !== awardTypes.AwardAuthorization.length || fields.some((field, index2) => typeof field !== "object" || field === null || Array.isArray(field) || Object.keys(field).length !== 2 || field.name !== awardTypes.AwardAuthorization[index2].name || field.type !== awardTypes.AwardAuthorization[index2].type) || message.awardId !== record5(award.authorization, "Task award authorization").awardId) {
             throw new TypeError("Task award signing authority is invalid.");
           }
           const canonicalDomain = {
@@ -61089,14 +62024,14 @@ function resolveSkillViemChain(chainId) {
   if (chain !== void 0) return chain;
   throw new TypeError(`Unsupported Skill chain ${String(chainId)}.`);
 }
-function expectedCall(kind, request, deployment) {
-  const skillId = () => unsigned2(request.skillId, "Skill id", true);
+function expectedCall(kind, request2, deployment) {
+  const skillId = () => unsigned2(request2.skillId, "Skill id", true);
   if (kind === "purchase") {
-    const quantity = unsigned2(request.quantity, "Skill quantity", true);
-    const unitPrice = unsigned2(request.unitPrice, "Skill unit price");
+    const quantity = unsigned2(request2.quantity, "Skill quantity", true);
+    const unitPrice = unsigned2(request2.unitPrice, "Skill unit price");
     return {
       to: getAddress(deployment.skillInstanceAddress),
-      data: encodeFunctionData({ abi: instanceAbi, functionName: "purchase", args: [skillId(), version5(request.version, "Skill version"), quantity] }),
+      data: encodeFunctionData({ abi: instanceAbi, functionName: "purchase", args: [skillId(), version5(request2.version, "Skill version"), quantity] }),
       value: unitPrice * quantity
     };
   }
@@ -61104,43 +62039,43 @@ function expectedCall(kind, request, deployment) {
     to: getAddress(deployment.skillInstanceAddress),
     data: encodeFunctionData({ abi: instanceAbi, functionName: "convert", args: [
       skillId(),
-      version5(request.fromVersion, "Source version"),
-      version5(request.toVersion, "Target version"),
-      unsigned2(request.quantity, "Skill quantity", true)
+      version5(request2.fromVersion, "Source version"),
+      version5(request2.toVersion, "Target version"),
+      unsigned2(request2.quantity, "Skill quantity", true)
     ] }),
     value: 0n
   };
   throw new TypeError("Skill intent kind is invalid.");
 }
-function expectedPreparedCall(action, request, deployment) {
-  const skillId = () => unsigned2(request.skillId, "Skill id", true);
+function expectedPreparedCall(action, request2, deployment) {
+  const skillId = () => unsigned2(request2.skillId, "Skill id", true);
   if (action === "createSkill") {
-    if (typeof request.plaintext !== "boolean" || !Number.isInteger(request.royaltyBPS) || Number(request.royaltyBPS) < 0 || Number(request.royaltyBPS) > 1e3) throw new TypeError("Skill create request is invalid.");
+    if (typeof request2.plaintext !== "boolean" || !Number.isInteger(request2.royaltyBPS) || Number(request2.royaltyBPS) < 0 || Number(request2.royaltyBPS) > 1e3) throw new TypeError("Skill create request is invalid.");
     return {
       to: getAddress(deployment.skillFactoryAddress),
       value: 0n,
       data: encodeFunctionData({ abi: factoryAbi, functionName: "createSkill", args: [{
-        mdHash: hash4(request.mdHash, "Skill primary-document hash"),
-        packageHash: hash4(request.packageHash, "Skill package hash"),
-        packageURI: textValue(request.packageURI, "Skill package URI"),
-        slug: textValue(request.slug, "Skill slug"),
-        name: textValue(request.name, "Skill name"),
-        category: textValue(request.category, "Skill category", true),
-        licenseTypeName: textValue(request.licenseTypeName, "Skill license", true),
-        imageURI: textValue(request.imageURI, "Skill image URI", true),
-        plaintext: request.plaintext,
-        unitPrice: unsigned2(request.unitPrice, "Skill unit price"),
-        maxSupply: unsigned2(request.maxSupply, "Skill max supply"),
-        royaltyBPS: BigInt(Number(request.royaltyBPS)),
-        usageLimit: unsigned2(request.usageLimit, "Skill usage limit")
+        mdHash: hash4(request2.mdHash, "Skill primary-document hash"),
+        packageHash: hash4(request2.packageHash, "Skill package hash"),
+        packageURI: textValue(request2.packageURI, "Skill package URI"),
+        slug: textValue(request2.slug, "Skill slug"),
+        name: textValue(request2.name, "Skill name"),
+        category: textValue(request2.category, "Skill category", true),
+        licenseTypeName: textValue(request2.licenseTypeName, "Skill license", true),
+        imageURI: textValue(request2.imageURI, "Skill image URI", true),
+        plaintext: request2.plaintext,
+        unitPrice: unsigned2(request2.unitPrice, "Skill unit price"),
+        maxSupply: unsigned2(request2.maxSupply, "Skill max supply"),
+        royaltyBPS: BigInt(Number(request2.royaltyBPS)),
+        usageLimit: unsigned2(request2.usageLimit, "Skill usage limit")
       }] })
     };
   }
-  if (action === "updateSkill") return { to: getAddress(deployment.skillTokenAddress), value: 0n, data: encodeFunctionData({ abi: tokenAbi, functionName: "updateSkill", args: [skillId(), hash4(request.mdHash, "Skill primary-document hash"), hash4(request.packageHash, "Skill package hash")] }) };
-  if (action === "setSkillURI") return { to: getAddress(deployment.skillTokenAddress), value: 0n, data: encodeFunctionData({ abi: tokenAbi, functionName: "setSkillURI", args: [skillId(), textValue(request.packageURI, "Skill package URI")] }) };
-  if (action === "setUnitPrice") return { to: getAddress(deployment.revenueRightAddress), value: 0n, data: encodeFunctionData({ abi: revenueAbi, functionName: "setUnitPrice", args: [skillId(), unsigned2(request.unitPrice, "Skill unit price")] }) };
-  if (action === "setMaxSupply") return { to: getAddress(deployment.revenueRightAddress), value: 0n, data: encodeFunctionData({ abi: revenueAbi, functionName: "setMaxSupply", args: [skillId(), unsigned2(request.maxSupply, "Skill max supply")] }) };
-  if (action === "setLitData") return { to: getAddress(deployment.skillInstanceAddress), value: 0n, data: encodeFunctionData({ abi: instanceAbi, functionName: "setLitData", args: [skillId(), version5(request.version, "Skill version"), textValue(request.ciphertext, "Skill ciphertext"), textValue(request.scheme, "Skill envelope scheme"), textValue(request.chain, "Skill chain tag")] }) };
+  if (action === "updateSkill") return { to: getAddress(deployment.skillTokenAddress), value: 0n, data: encodeFunctionData({ abi: tokenAbi, functionName: "updateSkill", args: [skillId(), hash4(request2.mdHash, "Skill primary-document hash"), hash4(request2.packageHash, "Skill package hash")] }) };
+  if (action === "setSkillURI") return { to: getAddress(deployment.skillTokenAddress), value: 0n, data: encodeFunctionData({ abi: tokenAbi, functionName: "setSkillURI", args: [skillId(), textValue(request2.packageURI, "Skill package URI")] }) };
+  if (action === "setUnitPrice") return { to: getAddress(deployment.revenueRightAddress), value: 0n, data: encodeFunctionData({ abi: revenueAbi, functionName: "setUnitPrice", args: [skillId(), unsigned2(request2.unitPrice, "Skill unit price")] }) };
+  if (action === "setMaxSupply") return { to: getAddress(deployment.revenueRightAddress), value: 0n, data: encodeFunctionData({ abi: revenueAbi, functionName: "setMaxSupply", args: [skillId(), unsigned2(request2.maxSupply, "Skill max supply")] }) };
+  if (action === "setLitData") return { to: getAddress(deployment.skillInstanceAddress), value: 0n, data: encodeFunctionData({ abi: instanceAbi, functionName: "setLitData", args: [skillId(), version5(request2.version, "Skill version"), textValue(request2.ciphertext, "Skill ciphertext"), textValue(request2.scheme, "Skill envelope scheme"), textValue(request2.chain, "Skill chain tag")] }) };
   throw new TypeError("Skill prepared action is invalid.");
 }
 function assertIntentMatches(raw, expected, chainId) {
@@ -61251,9 +62186,9 @@ var init_skill_intent_sender = __esm({
         if (typeof input.intent.walletAddress !== "string" || input.intent.walletAddress.toLowerCase() !== input.walletAddress.toLowerCase()) {
           throw new TypeError("Skill intent wallet does not match the active CLI wallet.");
         }
-        const request = record6(input.intent.request, "Skill intent request");
-        if (request.chainId !== deployment.chainId) throw new TypeError("Skill intent request chain is invalid.");
-        const expected = expectedCall(input.expectedKind, request, deployment);
+        const request2 = record6(input.intent.request, "Skill intent request");
+        if (request2.chainId !== deployment.chainId) throw new TypeError("Skill intent request chain is invalid.");
+        const expected = expectedCall(input.expectedKind, request2, deployment);
         assertIntentMatches(
           input.intent,
           expected,
@@ -61292,10 +62227,10 @@ var init_skill_intent_sender = __esm({
         return Object.freeze({ transactionHash: transactionHash3, blockNumber: actual.blockNumber.toString() });
       }
       async submitPrepared(input) {
-        const request = record6(input.request, "Skill prepared request");
-        const deployment = this.authority(request.chainId);
+        const request2 = record6(input.request, "Skill prepared request");
+        const deployment = this.authority(request2.chainId);
         if (input.intent.chainId !== deployment.chainId) throw new TypeError("Skill prepared intent chain is invalid.");
-        const expected = expectedPreparedCall(input.action, request, deployment);
+        const expected = expectedPreparedCall(input.action, request2, deployment);
         assertIntentMatches(input.intent, expected, deployment.chainId);
         const rpc = await this.rpc(input.privateKey, input.walletAddress, deployment);
         await rpc.simulateTransaction(expected);
@@ -61306,9 +62241,9 @@ var init_skill_intent_sender = __esm({
         return Object.freeze({ transactionHash: transactionHash3, blockNumber: receipt.blockNumber.toString() });
       }
       async verifyPrepared(input) {
-        const request = record6(input.request, "Skill prepared request");
-        const deployment = this.authority(request.chainId);
-        const expected = expectedPreparedCall(input.action, request, deployment);
+        const request2 = record6(input.request, "Skill prepared request");
+        const deployment = this.authority(request2.chainId);
+        const expected = expectedPreparedCall(input.action, request2, deployment);
         const rpc = await this.rpc(input.privateKey, input.walletAddress, deployment);
         const transactionHash3 = hash4(input.transactionHash, "Skill recovery transaction hash");
         const exactTransaction2 = (actual2) => actual2.from.toLowerCase() === input.walletAddress && actual2.to?.toLowerCase() === expected.to.toLowerCase() && actual2.data === expected.data && actual2.value === expected.value;
@@ -61470,26 +62405,26 @@ function publishPlan(value, context) {
   exact2(plan, ["kind", "sourceCommit", "chainId", "walletAddress", "signingAuthority", "request", "localAction"], "Skill publish plan");
   const chainId = assertAuthority(plan, "publish", context.walletAddress);
   assertLocalAction(plan.localAction, "skill publish-submit");
-  const request = object5(plan.request, "Skill publish request");
-  exact2(request, ["chainId", "slug", "name", "category", "licenseTypeName", "imageURI", "sourceKind", "contentMode", "unitPrice", "maxSupply", "royaltyBPS", "usageLimit", ...Object.hasOwn(request, "summary") ? ["summary"] : []], "Skill publish request");
-  if (request.chainId !== chainId) throw new TypeError("Skill publish request chain is invalid.");
-  string4(request.slug, "Skill slug");
-  string4(request.name, "Skill name");
-  string4(request.category, "Skill category");
-  string4(request.licenseTypeName, "Skill license");
-  if (typeof request.imageURI !== "string") {
+  const request2 = object5(plan.request, "Skill publish request");
+  exact2(request2, ["chainId", "slug", "name", "category", "licenseTypeName", "imageURI", "sourceKind", "contentMode", "unitPrice", "maxSupply", "royaltyBPS", "usageLimit", ...Object.hasOwn(request2, "summary") ? ["summary"] : []], "Skill publish request");
+  if (request2.chainId !== chainId) throw new TypeError("Skill publish request chain is invalid.");
+  string4(request2.slug, "Skill slug");
+  string4(request2.name, "Skill name");
+  string4(request2.category, "Skill category");
+  string4(request2.licenseTypeName, "Skill license");
+  if (typeof request2.imageURI !== "string") {
     throw new TypeError("Skill publish metadata is invalid.");
   }
-  if (Object.hasOwn(request, "summary") && (typeof request.summary !== "string" || request.summary.length > 500)) throw new TypeError("Skill summary is invalid.");
-  sourceKind(request.sourceKind);
-  contentMode(request.contentMode);
-  string4(request.unitPrice, "Skill unitPrice", DECIMAL);
-  string4(request.maxSupply, "Skill maxSupply", DECIMAL);
-  string4(request.usageLimit, "Skill usageLimit", DECIMAL);
-  if (!Number.isInteger(request.royaltyBPS) || Number(request.royaltyBPS) < 0 || Number(request.royaltyBPS) > 1e3) throw new TypeError("Skill royaltyBPS is invalid.");
+  if (Object.hasOwn(request2, "summary") && (typeof request2.summary !== "string" || request2.summary.length > 500)) throw new TypeError("Skill summary is invalid.");
+  sourceKind(request2.sourceKind);
+  contentMode(request2.contentMode);
+  string4(request2.unitPrice, "Skill unitPrice", DECIMAL);
+  string4(request2.maxSupply, "Skill maxSupply", DECIMAL);
+  string4(request2.usageLimit, "Skill usageLimit", DECIMAL);
+  if (!Number.isInteger(request2.royaltyBPS) || Number(request2.royaltyBPS) < 0 || Number(request2.royaltyBPS) > 1e3) throw new TypeError("Skill royaltyBPS is invalid.");
   return {
     chainId,
-    request,
+    request: request2,
     signingAuthority: assertPublicationAuthority(signingAuthority(plan.signingAuthority, context.walletAddress), context)
   };
 }
@@ -61499,18 +62434,18 @@ function versionPlan(value, context) {
   const chainId = assertAuthority(plan, "version", context.walletAddress);
   const skillId = string4(plan.skillId, "Skill id", /^[1-9][0-9]*$/u);
   assertLocalAction(plan.localAction, "skill version-submit", skillId);
-  const request = { chainId, skillId, sourceKind: sourceKind(plan.sourceKind), contentMode: contentMode(plan.contentMode) };
+  const request2 = { chainId, skillId, sourceKind: sourceKind(plan.sourceKind), contentMode: contentMode(plan.contentMode) };
   const currentVersion = integer2(plan.currentVersion, "Current version");
   const nextVersion = integer2(plan.nextVersion, "Next version");
   if (nextVersion !== currentVersion + 1) throw new TypeError("Skill version plan does not advance exactly one version.");
   return {
     chainId,
-    request,
+    request: request2,
     currentVersion,
     nextVersion,
     currentPackageURI: string4(plan.currentManifestURI, "Current manifest URI", IPFS),
-    sourceKind: request.sourceKind,
-    contentMode: request.contentMode,
+    sourceKind: request2.sourceKind,
+    contentMode: request2.contentMode,
     signingAuthority: assertPublicationAuthority(signingAuthority(plan.signingAuthority, context.walletAddress), context)
   };
 }
@@ -61518,13 +62453,13 @@ function managePlan(value, walletAddress2, kind) {
   const plan = object5(value, `Skill ${kind} plan`);
   exact2(plan, ["kind", "sourceCommit", "chainId", "to", "data", "value", "summary", "walletAddress", "signingAuthority", "request"], `Skill ${kind} plan`);
   const chainId = assertAuthority(plan, kind === "price" ? "set_unit_price" : "set_max_supply", walletAddress2);
-  const request = object5(plan.request, `Skill ${kind} request`);
+  const request2 = object5(plan.request, `Skill ${kind} request`);
   const field = kind === "price" ? "unitPrice" : "maxSupply";
-  exact2(request, ["chainId", "skillId", field], `Skill ${kind} request`);
-  if (request.chainId !== chainId) throw new TypeError(`Skill ${kind} request chain is invalid.`);
-  string4(request.skillId, "Skill id", /^[1-9][0-9]*$/u);
-  string4(request[field], `Skill ${field}`, DECIMAL);
-  return { chainId, request, intent: intent({
+  exact2(request2, ["chainId", "skillId", field], `Skill ${kind} request`);
+  if (request2.chainId !== chainId) throw new TypeError(`Skill ${kind} request chain is invalid.`);
+  string4(request2.skillId, "Skill id", /^[1-9][0-9]*$/u);
+  string4(request2[field], `Skill ${field}`, DECIMAL);
+  return { chainId, request: request2, intent: intent({
     chainId: plan.chainId,
     to: plan.to,
     data: plan.data,
@@ -61574,9 +62509,9 @@ function assetPlan(value, walletAddress2) {
   ], "Skill asset plan");
   const chainId = assertAuthority(plan, "asset_upload", walletAddress2, false);
   const skillId = string4(plan.skillId, "Skill id", /^[1-9][0-9]*$/u);
-  if (plan.assetKind !== "cover" || plan.maxBytes !== 5242880) throw new TypeError("Skill cover authority is invalid.");
+  if (plan.assetKind !== "cover" || typeof plan.maxBytes !== "number" || !Number.isSafeInteger(plan.maxBytes) || plan.maxBytes < 1) throw new TypeError("Skill cover authority is invalid.");
   const accepted = plan.acceptedMediaTypes;
-  if (!Array.isArray(accepted) || JSON.stringify(accepted) !== JSON.stringify(["image/png", "image/jpeg", "image/webp", "image/gif"])) {
+  if (!Array.isArray(accepted) || accepted.length < 1 || new Set(accepted).size !== accepted.length || accepted.some((mediaType) => typeof mediaType !== "string" || !/^image\/[a-z0-9.+-]+$/u.test(mediaType))) {
     throw new TypeError("Skill cover media authority is invalid.");
   }
   const action = object5(plan.localAction, "Skill local action");
@@ -61624,11 +62559,11 @@ function recoveryReceipt(value, name) {
   });
 }
 function recoveryRequest(value, action, name, chainId) {
-  const request = object5(value, name);
-  if (request.action !== action || request.chainId !== void 0 && request.chainId !== chainId) {
+  const request2 = object5(value, name);
+  if (request2.action !== action || request2.chainId !== void 0 && request2.chainId !== chainId) {
     throw new TypeError(`${name} authority is invalid.`);
   }
-  return { ...request, chainId };
+  return { ...request2, chainId };
 }
 function canonical2(value) {
   if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
@@ -61794,12 +62729,12 @@ var init_skill_local_flow = __esm({
       async recoverPublication(fingerprint2, context) {
         return this.publication((progress) => this.recoverWithProgress(fingerprint2, context, progress));
       }
-      async send(context, action, request, prepared, authority, onBroadcast) {
+      async send(context, action, request2, prepared, authority, onBroadcast) {
         return required3(this.sender.submitPrepared, "Skill prepared-intent sender").call(this.sender, {
           privateKey: context.privateKey,
           walletAddress: context.walletAddress,
           action,
-          request,
+          request: request2,
           intent: authority === void 0 ? intent(prepared, context.walletAddress) : legacyIntent(prepared, context.walletAddress, authority),
           onBroadcast
         });
@@ -61932,14 +62867,14 @@ var init_skill_local_flow = __esm({
         };
       }
       async settle(read2, name) {
-        for (let attempt = 0; attempt < 60; attempt += 1) {
+        for (let attempt2 = 0; attempt2 < 60; attempt2 += 1) {
           if (await read2()) return;
           await this.pause();
         }
         throw new TypeError(`${name} transaction confirmed but the settled chain read did not advance.`);
       }
-      async verify(context, action, request, receipt) {
-        return required3(this.sender.verifyPrepared, "Skill transaction verifier").call(this.sender, { privateKey: context.privateKey, walletAddress: context.walletAddress, action, request, ...receipt });
+      async verify(context, action, request2, receipt) {
+        return required3(this.sender.verifyPrepared, "Skill transaction verifier").call(this.sender, { privateKey: context.privateKey, walletAddress: context.walletAddress, action, request: request2, ...receipt });
       }
       async save(fingerprint2, journal) {
         await required3(this.recovery, "Skill publication recovery").saveSkillPublicationRecovery(fingerprint2, journal);
@@ -61947,14 +62882,14 @@ var init_skill_local_flow = __esm({
       async project(chainId, transactionHash3, bearer) {
         await this.api.confirmSkillProjection?.(chainId, transactionHash3, bearer);
       }
-      async stage(progress, context, fingerprint2, journal, stage, action, request, prepare) {
+      async stage(progress, context, fingerprint2, journal, stage, action, request2, prepare) {
         progress.journal = journal;
         progress.fingerprint = fingerprint2;
         progress.journalSaved = true;
         progress.phase = "transaction";
         const existing = journal.receipts[stage];
         if (existing !== null) {
-          journal.receipts[stage] = await this.verify(context, action, request, existing);
+          journal.receipts[stage] = await this.verify(context, action, request2, existing);
           if (journal.pendingStage === stage) journal.pendingStage = null;
           await this.save(fingerprint2, journal);
           progress.uncertain = false;
@@ -61984,7 +62919,7 @@ var init_skill_local_flow = __esm({
         journal.receipts[stage] = await this.send(
           context,
           action,
-          request,
+          request2,
           prepared,
           journal.signingAuthority,
           async ({ transactionHash: transactionHash3 }) => {
@@ -62158,7 +63093,7 @@ var init_skill_local_flow = __esm({
       }
       async publishWithProgress(path2, planValue, context, progress) {
         const plan = publishPlan(planValue, context);
-        const request = plan.request;
+        const request2 = plan.request;
         const fingerprint2 = recoveryFingerprint2("publish", planValue, context.walletAddress);
         const store = required3(this.recovery, "Skill publication recovery");
         progress.phase = "recovery";
@@ -62170,8 +63105,8 @@ var init_skill_local_flow = __esm({
         }
         progress.phase = "source";
         const selected = await readPublishablePath(path2);
-        const expectedSourceKind = sourceKind(request.sourceKind);
-        const mode = contentMode(request.contentMode);
+        const expectedSourceKind = sourceKind(request2.sourceKind);
+        const mode = contentMode(request2.contentMode);
         if (selected.sourceKind !== expectedSourceKind) throw new TypeError(`Skill plan requires a ${expectedSourceKind} source.`);
         progress.phase = "packaging";
         const packaged = await this.package(selected.files, prior === null ? mode : "plaintext", selected.excluded);
@@ -62186,14 +63121,14 @@ var init_skill_local_flow = __esm({
             files: selected.files,
             archive: packaged.archive,
             version: 1,
-            name: String(request.name),
-            summary: request.summary === void 0 ? "" : String(request.summary),
+            name: String(request2.name),
+            summary: request2.summary === void 0 ? "" : String(request2.summary),
             pinBundle: async (bytes) => {
               publishedBytes = bytes;
               progress.phase = "upload";
               return this.upload({
                 bytes,
-                filename: `${request.slug}.skillroot.zip`,
+                filename: `${request2.slug}.skillroot.zip`,
                 bearer: context.bearer,
                 objectKind: "package",
                 sourceKind: "file",
@@ -62204,12 +63139,12 @@ var init_skill_local_flow = __esm({
           const packageURI = entry2.packageURI;
           const manifestURI = await this.upload({
             bytes: serializeManifest(buildManifest([entry2])),
-            filename: `${request.slug}.versions.json`,
+            filename: `${request2.slug}.versions.json`,
             bearer: context.bearer,
             objectKind: "manifest"
           });
           const chainMetadata = Object.fromEntries(
-            Object.entries(request).filter(([key]) => key !== "sourceKind" && key !== "contentMode" && key !== "summary")
+            Object.entries(request2).filter(([key]) => key !== "sourceKind" && key !== "contentMode" && key !== "summary")
           );
           const createRequest = {
             action: "createSkill",
@@ -62262,11 +63197,11 @@ var init_skill_local_flow = __esm({
           skillId = await required3(this.api.resolveSkillId, "Skill resolve API").call(
             this.api,
             journal.chainId,
-            String(request.slug),
+            String(request2.slug),
             context.bearer
           );
           return skillId !== null;
-        }, `Skill ${request.slug} publication`);
+        }, `Skill ${request2.slug} publication`);
         if (skillId === null) throw new TypeError("Published Skill slug did not resolve.");
         if (journal.skillId !== null && journal.skillId !== skillId) throw new TypeError("Skill publication recovery resolved a different Skill id.");
         journal.skillId = skillId;
@@ -62484,15 +63419,15 @@ var init_skill_local_flow = __esm({
           bearer: context.bearer,
           objectKind: "manifest"
         });
-        const request = { action: "setSkillURI", chainId: plan.chainId, skillId: plan.skillId, packageURI: manifestURI };
+        const request2 = { action: "setSkillURI", chainId: plan.chainId, skillId: plan.skillId, packageURI: manifestURI };
         progress.phase = "intent";
-        const prepared = await required3(this.api.requestSkillIntent, "Skill intent API").call(this.api, request, context.bearer);
+        const prepared = await required3(this.api.requestSkillIntent, "Skill intent API").call(this.api, request2, context.bearer);
         progress.phase = "transaction";
         progress.uncertain = true;
         const submission = await this.send(
           context,
           "setSkillURI",
-          request,
+          request2,
           prepared,
           plan.signingAuthority,
           async ({ transactionHash: transactionHash3 }) => {
@@ -62513,6 +63448,7 @@ var init_skill_local_flow = __esm({
         if (!stat.isFile() || stat.isSymbolicLink()) throw new TypeError("Skill cover path must be one regular file.");
         if (stat.size < 1 || stat.size > plan.maxBytes) throw new TypeError("Skill cover size is outside the prepared bound.");
         const bytes = new Uint8Array(await readFile2(absolute));
+        if (bytes.byteLength < 1 || bytes.byteLength > plan.maxBytes) throw new TypeError("Skill cover size is outside the prepared bound.");
         const mediaType = detectedImageMediaType(bytes);
         if (mediaType === null || !plan.acceptedMediaTypes.includes(mediaType)) {
           throw new TypeError("Skill cover bytes do not match an accepted image type.");
@@ -62626,12 +63562,14 @@ async function resolveInstalledProfile(readProfile) {
     throw cause;
   }
 }
-function commandNeedsHttp(arguments_) {
+function commandNeedsHttp(allArguments) {
+  const arguments_ = finchOwnArguments(allArguments);
   if (arguments_.length === 0 || arguments_.length === 1 && ["--help", "help", "--version"].includes(arguments_[0]) || arguments_[0] === "help" && arguments_.length > 1 || arguments_.length > 1 && arguments_.at(-1) === "--help" && arguments_.filter((argument) => argument === "--help").length === 1) return false;
   return (arguments_[0] !== "wallet" || arguments_[1] === "use") && !(arguments_.length === 2 && arguments_[0] === "logout" && arguments_[1] === "--local");
 }
 async function runInstalledCli(arguments_, environment3 = process.env, authorities = {}) {
-  const profileFree = arguments_.length === 0 || arguments_.length === 1 && ["--help", "help", "--version"].includes(arguments_[0]) || arguments_[0] === "help" && arguments_.length > 1 || arguments_.length > 1 && arguments_.at(-1) === "--help" && arguments_.filter((argument) => argument === "--help").length === 1;
+  const own = finchOwnArguments(arguments_);
+  const profileFree = own.length === 0 || own.length === 1 && ["--help", "help", "--version"].includes(own[0]) || own[0] === "help" && own.length > 1 || own.length > 1 && own.at(-1) === "--help" && own.filter((argument) => argument === "--help").length === 1;
   if (profileFree) return routeCommand(arguments_, {});
   const home = resolveFinchtechHome(environment3);
   const state = new LocalCliState(home);
@@ -62658,7 +63596,10 @@ async function runInstalledCli(arguments_, environment3 = process.env, authoriti
     taskProtocolSender: new InstalledTaskProtocolSender(),
     skillIntentSender,
     skillLocalFlow: profile === void 0 || skillIntentSender === void 0 ? void 0 : new SkillLocalFlow(api, skillIntentSender, signer, void 0, void 0, state),
-    browserLauncher: new InstalledBrowserLauncher()
+    browserLauncher: new InstalledBrowserLauncher(),
+    callbackDelivery: new LoopbackCallbackDelivery(),
+    mcpLoginProcess: new InstalledMcpLoginProcess(),
+    stdin: new ProcessStdinReader()
   });
   return routeCommand(arguments_, application);
 }
@@ -62668,6 +63609,9 @@ var init_main = __esm({
     init_api2();
     init_application();
     init_command_router();
+    init_loopback_callback();
+    init_mcp_login_process();
+    init_stdin_reader();
     init_local_state();
     init_state();
     init_signing();
@@ -62831,6 +63775,22 @@ function emitCliOutcome(outcome, sinks) {
 `);
     return AGENT_CLI_OUTPUT_CONTRACT.exitCodes.remoteOrProviderUnavailable;
   }
+  if (outcome instanceof McpAuthorizationFlowError) {
+    sinks.stdout(`${JSON.stringify({ error: {
+      code: outcome.code,
+      message: outcome.guidance,
+      reasonCode: null,
+      retryable: false,
+      nextAction: "none",
+      state: JSON.stringify({ reason: outcome.reason, ...outcome.detail }),
+      operationId: null,
+      currentRevision: null,
+      currentEtag: null,
+      traceId: null
+    } })}
+`);
+    return AGENT_CLI_OUTPUT_CONTRACT.exitCodes.conflictOrPrecondition;
+  }
   if (outcome instanceof CliHttpError && outcome.envelope !== null && outcome.status !== null) {
     sinks.stdout(`${JSON.stringify(outcome.envelope)}
 `);