@glasstrace/sdk 1.1.0 → 1.1.1

package/dist/cli/init.cjs

@@ -31,889 +31,418 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/cli/constants.ts
-function formatAgentName(name) {
-  const displayNames = {
-    claude: "Claude Code",
-    codex: "Codex",
-    gemini: "Gemini",
-    cursor: "Cursor",
-    windsurf: "Windsurf",
-    generic: "Generic"
-  };
-  return displayNames[name];
-}
-var MCP_ENDPOINT, NEXT_CONFIG_NAMES;
-var init_constants = __esm({
-  "src/cli/constants.ts"() {
-    "use strict";
-    MCP_ENDPOINT = "https://api.glasstrace.dev/mcp";
-    NEXT_CONFIG_NAMES = ["next.config.ts", "next.config.js", "next.config.mjs"];
-  }
-});
-
-// src/cli/scaffolder.ts
-function identityFingerprint(token) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(token).digest("hex")}`;
-}
-function hasRegisterGlasstraceCall(content) {
-  return content.split("\n").some((line) => {
-    const uncommented = line.replace(/\/\/.*$/, "");
-    return /\bregisterGlasstrace\s*\(/.test(uncommented);
-  });
-}
-function injectRegisterGlasstrace(content) {
-  if (hasRegisterGlasstraceCall(content)) {
-    return { injected: false, content };
-  }
-  const registerFnRegex = /export\s+(?:async\s+)?function\s+register\s*\([^)]*\)\s*\{/;
-  const match = registerFnRegex.exec(content);
-  if (!match) {
-    return { injected: false, content };
-  }
-  const afterBrace = content.slice(match.index + match[0].length);
-  const indentMatch = /\n([ \t]+)/.exec(afterBrace);
-  const indent = indentMatch ? indentMatch[1] : "  ";
-  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
-  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
-  const insertPoint = match.index + match[0].length;
-  const callInjection = `
-${indent}// Glasstrace must be registered before other instrumentation
-${indent}registerGlasstrace();
-`;
-  let modified;
-  if (hasGlasstraceImport2) {
-    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
-    const importMatch = importRegex.exec(content);
-    if (importMatch) {
-      const specifiers = importMatch[1];
-      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
-      if (alreadyImported) {
-        modified = content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
-      } else {
-        const existingImports = specifiers.trimEnd();
-        const separator = existingImports.endsWith(",") ? " " : ", ";
-        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
-        modified = content.replace(importMatch[0], updatedImport);
-        const newMatch = registerFnRegex.exec(modified);
-        if (newMatch) {
-          const newInsertPoint = newMatch.index + newMatch[0].length;
-          modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
-        }
-      }
-    } else {
-      modified = importLine + content;
-      const newMatch = registerFnRegex.exec(modified);
-      if (newMatch) {
-        const newInsertPoint = newMatch.index + newMatch[0].length;
-        modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
-      }
+// ../../node_modules/zod/v4/core/core.js
+// @__NO_SIDE_EFFECTS__
+function $constructor(name, initializer3, params) {
+  function init(inst, def) {
+    if (!inst._zod) {
+      Object.defineProperty(inst, "_zod", {
+        value: {
+          def,
+          constr: _,
+          traits: /* @__PURE__ */ new Set()
+        },
+        enumerable: false
+      });
     }
-  } else {
-    modified = importLine + content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
-  }
-  return { injected: true, content: modified };
-}
-function resolveInstrumentationTarget(projectRoot) {
-  const rootExisting = [];
-  const srcExisting = [];
-  for (const name of INSTRUMENTATION_FILENAMES) {
-    const rootPath = path.join(projectRoot, name);
-    if (isRegularFile(rootPath)) {
-      rootExisting.push(rootPath);
+    if (inst._zod.traits.has(name)) {
+      return;
     }
-    const srcPath = path.join(projectRoot, "src", name);
-    if (isRegularFile(srcPath)) {
-      srcExisting.push(srcPath);
+    inst._zod.traits.add(name);
+    initializer3(inst, def);
+    const proto = _.prototype;
+    const keys = Object.keys(proto);
+    for (let i = 0; i < keys.length; i++) {
+      const k = keys[i];
+      if (!(k in inst)) {
+        inst[k] = proto[k].bind(inst);
+      }
     }
   }
-  const existing = [...rootExisting, ...srcExisting];
-  if (rootExisting.length > 0 && srcExisting.length > 0) {
-    return {
-      target: null,
-      layout: null,
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: true
-    };
-  }
-  if (srcExisting.length > 0) {
-    return {
-      target: srcExisting[0],
-      layout: "src",
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: false
-    };
-  }
-  if (rootExisting.length > 0) {
-    return {
-      target: rootExisting[0],
-      layout: "root",
-      existing,
-      rootExisting,
-      srcExisting,
-      conflict: false
-    };
-  }
-  const srcDir = path.join(projectRoot, "src");
-  const layout = isDirectory(srcDir) ? "src" : "root";
-  const target = layout === "src" ? path.join(projectRoot, "src", "instrumentation.ts") : path.join(projectRoot, "instrumentation.ts");
-  return {
-    target,
-    layout,
-    existing,
-    rootExisting,
-    srcExisting,
-    conflict: false
-  };
-}
-function isDirectory(p) {
-  try {
-    return fs.statSync(p).isDirectory();
-  } catch {
-    return false;
+  const Parent = params?.Parent ?? Object;
+  class Definition extends Parent {
   }
-}
-function isRegularFile(p) {
-  try {
-    const stat2 = fs.lstatSync(p);
-    if (stat2.isSymbolicLink()) {
-      return fs.statSync(p).isFile();
+  Object.defineProperty(Definition, "name", { value: name });
+  function _(def) {
+    var _a2;
+    const inst = params?.Parent ? new Definition() : this;
+    init(inst, def);
+    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
+    for (const fn of inst._zod.deferred) {
+      fn();
     }
-    return stat2.isFile();
-  } catch {
-    return false;
+    return inst;
   }
-}
-function appendRegisterFunction(content) {
-  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
-  const functionBlock = "\nexport async function register() {\n  // Glasstrace must be registered before Prisma instrumentation\n  // to ensure all ORM spans are captured correctly.\n  // If you use @prisma/instrumentation, import it after this call.\n  registerGlasstrace();\n}\n";
-  let withImport = content;
-  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
-  if (!hasGlasstraceImport2) {
-    withImport = importLine + content;
-  } else {
-    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
-    const importMatch = importRegex.exec(content);
-    if (importMatch) {
-      const specifiers = importMatch[1];
-      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
-      if (!alreadyImported) {
-        const existingImports = specifiers.trimEnd();
-        const separator = existingImports.endsWith(",") ? " " : ", ";
-        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
-        withImport = content.replace(importMatch[0], updatedImport);
-      }
-    } else {
-      withImport = importLine + content;
+  Object.defineProperty(_, "init", { value: init });
+  Object.defineProperty(_, Symbol.hasInstance, {
+    value: (inst) => {
+      if (params?.Parent && inst instanceof params.Parent)
+        return true;
+      return inst?._zod?.traits?.has(name);
     }
-  }
-  const trailingNewline = withImport.endsWith("\n") ? "" : "\n";
-  return withImport + trailingNewline + functionBlock;
-}
-async function defaultInstrumentationPrompt(question, defaultValue) {
-  if (!process.stdin.isTTY) return defaultValue;
-  const readline2 = await import("node:readline");
-  const rl = readline2.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  return new Promise((resolve2) => {
-    const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
-    rl.question(question + suffix, (answer) => {
-      rl.close();
-      const trimmed = answer.trim().toLowerCase();
-      if (trimmed === "") {
-        resolve2(defaultValue);
-        return;
-      }
-      resolve2(trimmed === "y" || trimmed === "yes");
-    });
   });
+  Object.defineProperty(_, "name", { value: name });
+  return _;
 }
-async function scaffoldInstrumentation(projectRoot, options = {}) {
-  const target = resolveInstrumentationTarget(projectRoot);
-  if (target.conflict) {
-    return {
-      action: "conflict",
-      // Point the user at the `src/` variant — modern Next.js apps with a
-      // `src/` directory load from there, so that's the merge target. The
-      // competing path is reported separately for the error message.
-      filePath: target.srcExisting[0],
-      conflictingPath: target.rootExisting[0]
-    };
-  }
-  const filePath = target.target;
-  const layout = target.layout;
-  if (filePath === null || layout === null) {
-    return { action: "unrecognized" };
-  }
-  const force = options.force === true;
-  const prompt = options.prompt ?? defaultInstrumentationPrompt;
-  if (!fs.existsSync(filePath)) {
-    const content = `import { registerGlasstrace } from "@glasstrace/sdk";
-
-export async function register() {
-  // Glasstrace must be registered before Prisma instrumentation
-  // to ensure all ORM spans are captured correctly.
-  // If you use @prisma/instrumentation, import it after this call.
-  registerGlasstrace();
+function config(newConfig) {
+  if (newConfig)
+    Object.assign(globalConfig, newConfig);
+  return globalConfig;
 }
-`;
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, content, "utf-8");
-    return { action: "created", filePath, layout };
-  }
-  const existing = fs.readFileSync(filePath, "utf-8");
-  if (hasRegisterGlasstraceCall(existing)) {
-    return { action: "already-registered", filePath, layout };
-  }
-  if (!force) {
-    const approved = await prompt(
-      `Merge registerGlasstrace() into ${path.relative(projectRoot, filePath)}?`,
-      false
-    );
-    if (!approved) {
-      return { action: "skipped", filePath, layout };
-    }
-  }
-  const injectResult = injectRegisterGlasstrace(existing);
-  if (injectResult.injected) {
-    fs.writeFileSync(filePath, injectResult.content, "utf-8");
-    return { action: "injected", filePath, layout };
+var NEVER, $brand, $ZodAsyncError, $ZodEncodeError, globalConfig;
+var init_core = __esm({
+  "../../node_modules/zod/v4/core/core.js"() {
+    "use strict";
+    NEVER = Object.freeze({
+      status: "aborted"
+    });
+    $brand = /* @__PURE__ */ Symbol("zod_brand");
+    $ZodAsyncError = class extends Error {
+      constructor() {
+        super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
+      }
+    };
+    $ZodEncodeError = class extends Error {
+      constructor(name) {
+        super(`Encountered unidirectional transform during encode: ${name}`);
+        this.name = "ZodEncodeError";
+      }
+    };
+    globalConfig = {};
   }
-  const appended = appendRegisterFunction(existing);
-  fs.writeFileSync(filePath, appended, "utf-8");
-  return { action: "appended", filePath, layout };
+});
+
+// ../../node_modules/zod/v4/core/util.js
+var util_exports = {};
+__export(util_exports, {
+  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
+  Class: () => Class,
+  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  aborted: () => aborted,
+  allowsEval: () => allowsEval,
+  assert: () => assert,
+  assertEqual: () => assertEqual,
+  assertIs: () => assertIs,
+  assertNever: () => assertNever,
+  assertNotEqual: () => assertNotEqual,
+  assignProp: () => assignProp,
+  base64ToUint8Array: () => base64ToUint8Array,
+  base64urlToUint8Array: () => base64urlToUint8Array,
+  cached: () => cached,
+  captureStackTrace: () => captureStackTrace,
+  cleanEnum: () => cleanEnum,
+  cleanRegex: () => cleanRegex,
+  clone: () => clone,
+  cloneDef: () => cloneDef,
+  createTransparentProxy: () => createTransparentProxy,
+  defineLazy: () => defineLazy,
+  esc: () => esc,
+  escapeRegex: () => escapeRegex,
+  extend: () => extend,
+  finalizeIssue: () => finalizeIssue,
+  floatSafeRemainder: () => floatSafeRemainder,
+  getElementAtPath: () => getElementAtPath,
+  getEnumValues: () => getEnumValues,
+  getLengthableOrigin: () => getLengthableOrigin,
+  getParsedType: () => getParsedType,
+  getSizableOrigin: () => getSizableOrigin,
+  hexToUint8Array: () => hexToUint8Array,
+  isObject: () => isObject,
+  isPlainObject: () => isPlainObject,
+  issue: () => issue,
+  joinValues: () => joinValues,
+  jsonStringifyReplacer: () => jsonStringifyReplacer,
+  merge: () => merge,
+  mergeDefs: () => mergeDefs,
+  normalizeParams: () => normalizeParams,
+  nullish: () => nullish,
+  numKeys: () => numKeys,
+  objectClone: () => objectClone,
+  omit: () => omit,
+  optionalKeys: () => optionalKeys,
+  parsedType: () => parsedType,
+  partial: () => partial,
+  pick: () => pick,
+  prefixIssues: () => prefixIssues,
+  primitiveTypes: () => primitiveTypes,
+  promiseAllObject: () => promiseAllObject,
+  propertyKeyTypes: () => propertyKeyTypes,
+  randomString: () => randomString,
+  required: () => required,
+  safeExtend: () => safeExtend,
+  shallowClone: () => shallowClone,
+  slugify: () => slugify,
+  stringifyPrimitive: () => stringifyPrimitive,
+  uint8ArrayToBase64: () => uint8ArrayToBase64,
+  uint8ArrayToBase64url: () => uint8ArrayToBase64url,
+  uint8ArrayToHex: () => uint8ArrayToHex,
+  unwrapMessage: () => unwrapMessage
+});
+function assertEqual(val) {
+  return val;
 }
-async function scaffoldNextConfig(projectRoot) {
-  let configPath;
-  let configName;
-  for (const name of NEXT_CONFIG_NAMES) {
-    const candidate = path.join(projectRoot, name);
-    if (fs.existsSync(candidate)) {
-      configPath = candidate;
-      configName = name;
-      break;
-    }
-  }
-  if (configPath === void 0 || configName === void 0) {
-    return null;
-  }
-  const existing = fs.readFileSync(configPath, "utf-8");
-  if (existing.trim().length === 0) {
-    return { modified: false, reason: "empty-file" };
-  }
-  if (existing.includes("withGlasstraceConfig")) {
-    return { modified: false, reason: "already-wrapped" };
-  }
-  const isESM = configName.endsWith(".ts") || configName.endsWith(".mjs");
-  if (isESM) {
-    const importLine = 'import { withGlasstraceConfig } from "@glasstrace/sdk";\n';
-    const wrapResult2 = wrapExport(existing);
-    if (!wrapResult2.wrapped) {
-      return { modified: false, reason: "no-export" };
-    }
-    const modified2 = importLine + "\n" + wrapResult2.content;
-    fs.writeFileSync(configPath, modified2, "utf-8");
-    return { modified: true };
-  }
-  const requireLine = 'const { withGlasstraceConfig } = require("@glasstrace/sdk");\n';
-  const wrapResult = wrapCJSExport(existing);
-  if (!wrapResult.wrapped) {
-    return { modified: false, reason: "no-export" };
-  }
-  const modified = requireLine + "\n" + wrapResult.content;
-  fs.writeFileSync(configPath, modified, "utf-8");
-  return { modified: true };
+function assertNotEqual(val) {
+  return val;
 }
-function wrapExport(content) {
-  const marker = "export default";
-  const idx = content.lastIndexOf(marker);
-  if (idx === -1) {
-    return { content, wrapped: false };
-  }
-  const preamble = content.slice(0, idx);
-  const exprRaw = content.slice(idx + marker.length);
-  const expr = exprRaw.trim().replace(/;?\s*$/, "");
-  if (expr.length === 0) {
-    return { content, wrapped: false };
-  }
-  return {
-    content: preamble + `export default withGlasstraceConfig(${expr});
-`,
-    wrapped: true
-  };
+function assertIs(_arg) {
 }
-function wrapCJSExport(content) {
-  const cjsMarker = "module.exports";
-  const cjsIdx = content.lastIndexOf(cjsMarker);
-  if (cjsIdx === -1) {
-    return { content, wrapped: false };
-  }
-  const preamble = content.slice(0, cjsIdx);
-  const afterMarker = content.slice(cjsIdx + cjsMarker.length);
-  const eqMatch = /^\s*=\s*/.exec(afterMarker);
-  if (!eqMatch) {
-    return { content, wrapped: false };
-  }
-  const exprRaw = afterMarker.slice(eqMatch[0].length);
-  const expr = exprRaw.trim().replace(/;?\s*$/, "");
-  if (expr.length === 0) {
-    return { content, wrapped: false };
-  }
+function assertNever(_x) {
+  throw new Error("Unexpected value in exhaustive check");
+}
+function assert(_) {
+}
+function getEnumValues(entries) {
+  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
+  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
+  return values;
+}
+function joinValues(array2, separator = "|") {
+  return array2.map((val) => stringifyPrimitive(val)).join(separator);
+}
+function jsonStringifyReplacer(_, value) {
+  if (typeof value === "bigint")
+    return value.toString();
+  return value;
+}
+function cached(getter) {
+  const set2 = false;
   return {
-    content: preamble + `module.exports = withGlasstraceConfig(${expr});
-`,
-    wrapped: true
+    get value() {
+      if (!set2) {
+        const value = getter();
+        Object.defineProperty(this, "value", { value });
+        return value;
+      }
+      throw new Error("cached value already set");
+    }
   };
 }
-function readEnvLocalApiKey(content) {
-  let last = null;
-  const regex = /^\s*GLASSTRACE_API_KEY\s*=\s*(.*)$/gm;
-  let match;
-  while ((match = regex.exec(content)) !== null) {
-    const raw = match[1].trim();
-    if (raw === "") continue;
-    const unquoted = raw.replace(/^(['"])(.*)\1$/, "$2");
-    if (unquoted === "" || unquoted === "your_key_here") continue;
-    last = unquoted;
-  }
-  return last;
+function nullish(input) {
+  return input === null || input === void 0;
 }
-function isDevApiKey(value) {
-  if (value === null || value === void 0) return false;
-  return value.trim().startsWith("gt_dev_");
+function cleanRegex(source) {
+  const start = source.startsWith("^") ? 1 : 0;
+  const end = source.endsWith("$") ? source.length - 1 : source.length;
+  return source.slice(start, end);
 }
-async function scaffoldEnvLocal(projectRoot) {
-  const filePath = path.join(projectRoot, ".env.local");
-  if (fs.existsSync(filePath)) {
-    const existing = fs.readFileSync(filePath, "utf-8");
-    if (/^\s*#?\s*GLASSTRACE_API_KEY\s*=/m.test(existing)) {
-      return false;
+function floatSafeRemainder(val, step) {
+  const valDecCount = (val.toString().split(".")[1] || "").length;
+  const stepString = step.toString();
+  let stepDecCount = (stepString.split(".")[1] || "").length;
+  if (stepDecCount === 0 && /\d?e-\d?/.test(stepString)) {
+    const match = stepString.match(/\d?e-(\d?)/);
+    if (match?.[1]) {
+      stepDecCount = Number.parseInt(match[1]);
     }
-    const separator = existing.endsWith("\n") ? "" : "\n";
-    fs.writeFileSync(filePath, existing + separator + "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
-    return true;
   }
-  fs.writeFileSync(filePath, "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
-  return true;
+  const decCount = valDecCount > stepDecCount ? valDecCount : stepDecCount;
+  const valInt = Number.parseInt(val.toFixed(decCount).replace(".", ""));
+  const stepInt = Number.parseInt(step.toFixed(decCount).replace(".", ""));
+  return valInt % stepInt / 10 ** decCount;
 }
-async function addCoverageMapEnv(projectRoot) {
-  const filePath = path.join(projectRoot, ".env.local");
-  if (!fs.existsSync(filePath)) {
-    fs.writeFileSync(filePath, "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
-    return true;
-  }
-  const existing = fs.readFileSync(filePath, "utf-8");
-  const keyRegex = /^(\s*GLASSTRACE_COVERAGE_MAP\s*=\s*)(.*)$/m;
-  const keyMatch = keyRegex.exec(existing);
-  if (keyMatch) {
-    const currentValue = keyMatch[2].trim();
-    if (currentValue === "true") {
-      return false;
-    }
-    const updated = existing.replace(keyRegex, `${keyMatch[1]}true`);
-    fs.writeFileSync(filePath, updated, "utf-8");
-    return true;
-  }
-  const separator = existing.endsWith("\n") ? "" : "\n";
-  fs.writeFileSync(filePath, existing + separator + "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
-  return true;
+function defineLazy(object2, key, getter) {
+  let value = void 0;
+  Object.defineProperty(object2, key, {
+    get() {
+      if (value === EVALUATING) {
+        return void 0;
+      }
+      if (value === void 0) {
+        value = EVALUATING;
+        value = getter();
+      }
+      return value;
+    },
+    set(v) {
+      Object.defineProperty(object2, key, {
+        value: v
+        // configurable: true,
+      });
+    },
+    configurable: true
+  });
 }
-async function scaffoldGitignore(projectRoot) {
-  const filePath = path.join(projectRoot, ".gitignore");
-  if (fs.existsSync(filePath)) {
-    const existing = fs.readFileSync(filePath, "utf-8");
-    const lines = existing.split("\n").map((l) => l.trim());
-    if (lines.includes(".glasstrace/")) {
-      return false;
-    }
-    const separator = existing.endsWith("\n") ? "" : "\n";
-    fs.writeFileSync(filePath, existing + separator + ".glasstrace/\n", "utf-8");
-    return true;
-  }
-  fs.writeFileSync(filePath, ".glasstrace/\n", "utf-8");
-  return true;
+function objectClone(obj) {
+  return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
 }
-function mcpConfigMatches(existingContent, expectedContent) {
-  const trimmedExpected = expectedContent.trim();
-  try {
-    const existingParsed = JSON.parse(existingContent);
-    const expectedParsed = JSON.parse(trimmedExpected);
-    return JSON.stringify(canonicalize(existingParsed)) === JSON.stringify(canonicalize(expectedParsed));
-  } catch {
-  }
-  return existingContent.trim() === trimmedExpected;
+function assignProp(target, prop, value) {
+  Object.defineProperty(target, prop, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
 }
-function canonicalize(value) {
-  if (Array.isArray(value)) {
-    return value.map(canonicalize);
-  }
-  if (value !== null && typeof value === "object") {
-    const obj = value;
-    const sorted = {};
-    for (const key of Object.keys(obj).sort()) {
-      sorted[key] = canonicalize(obj[key]);
-    }
-    return sorted;
+function mergeDefs(...defs) {
+  const mergedDescriptors = {};
+  for (const def of defs) {
+    const descriptors = Object.getOwnPropertyDescriptors(def);
+    Object.assign(mergedDescriptors, descriptors);
   }
-  return value;
+  return Object.defineProperties({}, mergedDescriptors);
 }
-async function scaffoldMcpMarker(projectRoot, anonKey) {
-  const dirPath = path.join(projectRoot, ".glasstrace");
-  const markerPath = path.join(dirPath, "mcp-connected");
-  const keyHash = identityFingerprint(anonKey);
-  if (fs.existsSync(markerPath)) {
-    try {
-      const existing = JSON.parse(fs.readFileSync(markerPath, "utf-8"));
-      if (existing.keyHash === keyHash) {
-        return false;
-      }
-    } catch {
-    }
-  }
-  fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
-  const marker = JSON.stringify(
-    { keyHash, configuredAt: (/* @__PURE__ */ new Date()).toISOString() },
-    null,
-    2
-  );
-  fs.writeFileSync(markerPath, marker, { mode: 384 });
-  fs.chmodSync(markerPath, 384);
-  return true;
+function cloneDef(schema) {
+  return mergeDefs(schema._zod.def);
 }
-var import_node_crypto, fs, path, INSTRUMENTATION_FILENAMES;
-var init_scaffolder = __esm({
-  "src/cli/scaffolder.ts"() {
-    "use strict";
-    import_node_crypto = require("node:crypto");
-    fs = __toESM(require("node:fs"), 1);
-    path = __toESM(require("node:path"), 1);
-    init_constants();
-    INSTRUMENTATION_FILENAMES = [
-      "instrumentation.ts",
-      "instrumentation.js",
-      "instrumentation.mjs"
-    ];
-  }
-});
-
-// ../../node_modules/zod/v4/core/core.js
-// @__NO_SIDE_EFFECTS__
-function $constructor(name, initializer3, params) {
-  function init(inst, def) {
-    if (!inst._zod) {
-      Object.defineProperty(inst, "_zod", {
-        value: {
-          def,
-          constr: _,
-          traits: /* @__PURE__ */ new Set()
-        },
-        enumerable: false
-      });
-    }
-    if (inst._zod.traits.has(name)) {
-      return;
-    }
-    inst._zod.traits.add(name);
-    initializer3(inst, def);
-    const proto = _.prototype;
-    const keys = Object.keys(proto);
+function getElementAtPath(obj, path10) {
+  if (!path10)
+    return obj;
+  return path10.reduce((acc, key) => acc?.[key], obj);
+}
+function promiseAllObject(promisesObj) {
+  const keys = Object.keys(promisesObj);
+  const promises = keys.map((key) => promisesObj[key]);
+  return Promise.all(promises).then((results) => {
+    const resolvedObj = {};
     for (let i = 0; i < keys.length; i++) {
-      const k = keys[i];
-      if (!(k in inst)) {
-        inst[k] = proto[k].bind(inst);
-      }
+      resolvedObj[keys[i]] = results[i];
     }
+    return resolvedObj;
+  });
+}
+function randomString(length = 10) {
+  const chars = "abcdefghijklmnopqrstuvwxyz";
+  let str = "";
+  for (let i = 0; i < length; i++) {
+    str += chars[Math.floor(Math.random() * chars.length)];
   }
-  const Parent = params?.Parent ?? Object;
-  class Definition extends Parent {
+  return str;
+}
+function esc(str) {
+  return JSON.stringify(str);
+}
+function slugify(input) {
+  return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function isObject(data) {
+  return typeof data === "object" && data !== null && !Array.isArray(data);
+}
+function isPlainObject(o) {
+  if (isObject(o) === false)
+    return false;
+  const ctor = o.constructor;
+  if (ctor === void 0)
+    return true;
+  if (typeof ctor !== "function")
+    return true;
+  const prot = ctor.prototype;
+  if (isObject(prot) === false)
+    return false;
+  if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
+    return false;
   }
-  Object.defineProperty(Definition, "name", { value: name });
-  function _(def) {
-    var _a2;
-    const inst = params?.Parent ? new Definition() : this;
-    init(inst, def);
-    (_a2 = inst._zod).deferred ?? (_a2.deferred = []);
-    for (const fn of inst._zod.deferred) {
-      fn();
+  return true;
+}
+function shallowClone(o) {
+  if (isPlainObject(o))
+    return { ...o };
+  if (Array.isArray(o))
+    return [...o];
+  return o;
+}
+function numKeys(data) {
+  let keyCount = 0;
+  for (const key in data) {
+    if (Object.prototype.hasOwnProperty.call(data, key)) {
+      keyCount++;
     }
-    return inst;
   }
-  Object.defineProperty(_, "init", { value: init });
-  Object.defineProperty(_, Symbol.hasInstance, {
-    value: (inst) => {
-      if (params?.Parent && inst instanceof params.Parent)
-        return true;
-      return inst?._zod?.traits?.has(name);
-    }
-  });
-  Object.defineProperty(_, "name", { value: name });
-  return _;
+  return keyCount;
 }
-function config(newConfig) {
-  if (newConfig)
-    Object.assign(globalConfig, newConfig);
-  return globalConfig;
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var NEVER, $brand, $ZodAsyncError, $ZodEncodeError, globalConfig;
-var init_core = __esm({
-  "../../node_modules/zod/v4/core/core.js"() {
-    "use strict";
-    NEVER = Object.freeze({
-      status: "aborted"
-    });
-    $brand = /* @__PURE__ */ Symbol("zod_brand");
-    $ZodAsyncError = class extends Error {
-      constructor() {
-        super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
-      }
-    };
-    $ZodEncodeError = class extends Error {
-      constructor(name) {
-        super(`Encountered unidirectional transform during encode: ${name}`);
-        this.name = "ZodEncodeError";
-      }
-    };
-    globalConfig = {};
-  }
-});
-
-// ../../node_modules/zod/v4/core/util.js
-var util_exports = {};
-__export(util_exports, {
-  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
-  Class: () => Class,
-  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
-  aborted: () => aborted,
-  allowsEval: () => allowsEval,
-  assert: () => assert,
-  assertEqual: () => assertEqual,
-  assertIs: () => assertIs,
-  assertNever: () => assertNever,
-  assertNotEqual: () => assertNotEqual,
-  assignProp: () => assignProp,
-  base64ToUint8Array: () => base64ToUint8Array,
-  base64urlToUint8Array: () => base64urlToUint8Array,
-  cached: () => cached,
-  captureStackTrace: () => captureStackTrace,
-  cleanEnum: () => cleanEnum,
-  cleanRegex: () => cleanRegex,
-  clone: () => clone,
-  cloneDef: () => cloneDef,
-  createTransparentProxy: () => createTransparentProxy,
-  defineLazy: () => defineLazy,
-  esc: () => esc,
-  escapeRegex: () => escapeRegex,
-  extend: () => extend,
-  finalizeIssue: () => finalizeIssue,
-  floatSafeRemainder: () => floatSafeRemainder,
-  getElementAtPath: () => getElementAtPath,
-  getEnumValues: () => getEnumValues,
-  getLengthableOrigin: () => getLengthableOrigin,
-  getParsedType: () => getParsedType,
-  getSizableOrigin: () => getSizableOrigin,
-  hexToUint8Array: () => hexToUint8Array,
-  isObject: () => isObject,
-  isPlainObject: () => isPlainObject,
-  issue: () => issue,
-  joinValues: () => joinValues,
-  jsonStringifyReplacer: () => jsonStringifyReplacer,
-  merge: () => merge,
-  mergeDefs: () => mergeDefs,
-  normalizeParams: () => normalizeParams,
-  nullish: () => nullish,
-  numKeys: () => numKeys,
-  objectClone: () => objectClone,
-  omit: () => omit,
-  optionalKeys: () => optionalKeys,
-  parsedType: () => parsedType,
-  partial: () => partial,
-  pick: () => pick,
-  prefixIssues: () => prefixIssues,
-  primitiveTypes: () => primitiveTypes,
-  promiseAllObject: () => promiseAllObject,
-  propertyKeyTypes: () => propertyKeyTypes,
-  randomString: () => randomString,
-  required: () => required,
-  safeExtend: () => safeExtend,
-  shallowClone: () => shallowClone,
-  slugify: () => slugify,
-  stringifyPrimitive: () => stringifyPrimitive,
-  uint8ArrayToBase64: () => uint8ArrayToBase64,
-  uint8ArrayToBase64url: () => uint8ArrayToBase64url,
-  uint8ArrayToHex: () => uint8ArrayToHex,
-  unwrapMessage: () => unwrapMessage
-});
-function assertEqual(val) {
-  return val;
-}
-function assertNotEqual(val) {
-  return val;
-}
-function assertIs(_arg) {
-}
-function assertNever(_x) {
-  throw new Error("Unexpected value in exhaustive check");
-}
-function assert(_) {
-}
-function getEnumValues(entries) {
-  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
-  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
-  return values;
-}
-function joinValues(array2, separator = "|") {
-  return array2.map((val) => stringifyPrimitive(val)).join(separator);
-}
-function jsonStringifyReplacer(_, value) {
-  if (typeof value === "bigint")
-    return value.toString();
-  return value;
-}
-function cached(getter) {
-  const set2 = false;
-  return {
-    get value() {
-      if (!set2) {
-        const value = getter();
-        Object.defineProperty(this, "value", { value });
-        return value;
-      }
-      throw new Error("cached value already set");
-    }
-  };
-}
-function nullish(input) {
-  return input === null || input === void 0;
-}
-function cleanRegex(source) {
-  const start = source.startsWith("^") ? 1 : 0;
-  const end = source.endsWith("$") ? source.length - 1 : source.length;
-  return source.slice(start, end);
+function clone(inst, def, params) {
+  const cl = new inst._zod.constr(def ?? inst._zod.def);
+  if (!def || params?.parent)
+    cl._zod.parent = inst;
+  return cl;
 }
-function floatSafeRemainder(val, step) {
-  const valDecCount = (val.toString().split(".")[1] || "").length;
-  const stepString = step.toString();
-  let stepDecCount = (stepString.split(".")[1] || "").length;
-  if (stepDecCount === 0 && /\d?e-\d?/.test(stepString)) {
-    const match = stepString.match(/\d?e-(\d?)/);
-    if (match?.[1]) {
-      stepDecCount = Number.parseInt(match[1]);
-    }
+function normalizeParams(_params) {
+  const params = _params;
+  if (!params)
+    return {};
+  if (typeof params === "string")
+    return { error: () => params };
+  if (params?.message !== void 0) {
+    if (params?.error !== void 0)
+      throw new Error("Cannot specify both `message` and `error` params");
+    params.error = params.message;
   }
-  const decCount = valDecCount > stepDecCount ? valDecCount : stepDecCount;
-  const valInt = Number.parseInt(val.toFixed(decCount).replace(".", ""));
-  const stepInt = Number.parseInt(step.toFixed(decCount).replace(".", ""));
-  return valInt % stepInt / 10 ** decCount;
+  delete params.message;
+  if (typeof params.error === "string")
+    return { ...params, error: () => params.error };
+  return params;
 }
-function defineLazy(object2, key, getter) {
-  let value = void 0;
-  Object.defineProperty(object2, key, {
-    get() {
-      if (value === EVALUATING) {
-        return void 0;
-      }
-      if (value === void 0) {
-        value = EVALUATING;
-        value = getter();
-      }
-      return value;
+function createTransparentProxy(getter) {
+  let target;
+  return new Proxy({}, {
+    get(_, prop, receiver) {
+      target ?? (target = getter());
+      return Reflect.get(target, prop, receiver);
     },
-    set(v) {
-      Object.defineProperty(object2, key, {
-        value: v
-        // configurable: true,
-      });
+    set(_, prop, value, receiver) {
+      target ?? (target = getter());
+      return Reflect.set(target, prop, value, receiver);
     },
-    configurable: true
+    has(_, prop) {
+      target ?? (target = getter());
+      return Reflect.has(target, prop);
+    },
+    deleteProperty(_, prop) {
+      target ?? (target = getter());
+      return Reflect.deleteProperty(target, prop);
+    },
+    ownKeys(_) {
+      target ?? (target = getter());
+      return Reflect.ownKeys(target);
+    },
+    getOwnPropertyDescriptor(_, prop) {
+      target ?? (target = getter());
+      return Reflect.getOwnPropertyDescriptor(target, prop);
+    },
+    defineProperty(_, prop, descriptor) {
+      target ?? (target = getter());
+      return Reflect.defineProperty(target, prop, descriptor);
+    }
   });
 }
-function objectClone(obj) {
-  return Object.create(Object.getPrototypeOf(obj), Object.getOwnPropertyDescriptors(obj));
+function stringifyPrimitive(value) {
+  if (typeof value === "bigint")
+    return value.toString() + "n";
+  if (typeof value === "string")
+    return `"${value}"`;
+  return `${value}`;
 }
-function assignProp(target, prop, value) {
-  Object.defineProperty(target, prop, {
-    value,
-    writable: true,
-    enumerable: true,
-    configurable: true
+function optionalKeys(shape) {
+  return Object.keys(shape).filter((k) => {
+    return shape[k]._zod.optin === "optional" && shape[k]._zod.optout === "optional";
   });
 }
-function mergeDefs(...defs) {
-  const mergedDescriptors = {};
-  for (const def of defs) {
-    const descriptors = Object.getOwnPropertyDescriptors(def);
-    Object.assign(mergedDescriptors, descriptors);
+function pick(schema, mask) {
+  const currDef = schema._zod.def;
+  const checks = currDef.checks;
+  const hasChecks = checks && checks.length > 0;
+  if (hasChecks) {
+    throw new Error(".pick() cannot be used on object schemas containing refinements");
   }
-  return Object.defineProperties({}, mergedDescriptors);
-}
-function cloneDef(schema) {
-  return mergeDefs(schema._zod.def);
-}
-function getElementAtPath(obj, path10) {
-  if (!path10)
-    return obj;
-  return path10.reduce((acc, key) => acc?.[key], obj);
-}
-function promiseAllObject(promisesObj) {
-  const keys = Object.keys(promisesObj);
-  const promises = keys.map((key) => promisesObj[key]);
-  return Promise.all(promises).then((results) => {
-    const resolvedObj = {};
-    for (let i = 0; i < keys.length; i++) {
-      resolvedObj[keys[i]] = results[i];
-    }
-    return resolvedObj;
-  });
-}
-function randomString(length = 10) {
-  const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str = "";
-  for (let i = 0; i < length; i++) {
-    str += chars[Math.floor(Math.random() * chars.length)];
-  }
-  return str;
-}
-function esc(str) {
-  return JSON.stringify(str);
-}
-function slugify(input) {
-  return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function isObject(data) {
-  return typeof data === "object" && data !== null && !Array.isArray(data);
-}
-function isPlainObject(o) {
-  if (isObject(o) === false)
-    return false;
-  const ctor = o.constructor;
-  if (ctor === void 0)
-    return true;
-  if (typeof ctor !== "function")
-    return true;
-  const prot = ctor.prototype;
-  if (isObject(prot) === false)
-    return false;
-  if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
-    return false;
-  }
-  return true;
-}
-function shallowClone(o) {
-  if (isPlainObject(o))
-    return { ...o };
-  if (Array.isArray(o))
-    return [...o];
-  return o;
-}
-function numKeys(data) {
-  let keyCount = 0;
-  for (const key in data) {
-    if (Object.prototype.hasOwnProperty.call(data, key)) {
-      keyCount++;
-    }
-  }
-  return keyCount;
-}
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function clone(inst, def, params) {
-  const cl = new inst._zod.constr(def ?? inst._zod.def);
-  if (!def || params?.parent)
-    cl._zod.parent = inst;
-  return cl;
-}
-function normalizeParams(_params) {
-  const params = _params;
-  if (!params)
-    return {};
-  if (typeof params === "string")
-    return { error: () => params };
-  if (params?.message !== void 0) {
-    if (params?.error !== void 0)
-      throw new Error("Cannot specify both `message` and `error` params");
-    params.error = params.message;
-  }
-  delete params.message;
-  if (typeof params.error === "string")
-    return { ...params, error: () => params.error };
-  return params;
-}
-function createTransparentProxy(getter) {
-  let target;
-  return new Proxy({}, {
-    get(_, prop, receiver) {
-      target ?? (target = getter());
-      return Reflect.get(target, prop, receiver);
-    },
-    set(_, prop, value, receiver) {
-      target ?? (target = getter());
-      return Reflect.set(target, prop, value, receiver);
-    },
-    has(_, prop) {
-      target ?? (target = getter());
-      return Reflect.has(target, prop);
-    },
-    deleteProperty(_, prop) {
-      target ?? (target = getter());
-      return Reflect.deleteProperty(target, prop);
-    },
-    ownKeys(_) {
-      target ?? (target = getter());
-      return Reflect.ownKeys(target);
-    },
-    getOwnPropertyDescriptor(_, prop) {
-      target ?? (target = getter());
-      return Reflect.getOwnPropertyDescriptor(target, prop);
-    },
-    defineProperty(_, prop, descriptor) {
-      target ?? (target = getter());
-      return Reflect.defineProperty(target, prop, descriptor);
-    }
-  });
-}
-function stringifyPrimitive(value) {
-  if (typeof value === "bigint")
-    return value.toString() + "n";
-  if (typeof value === "string")
-    return `"${value}"`;
-  return `${value}`;
-}
-function optionalKeys(shape) {
-  return Object.keys(shape).filter((k) => {
-    return shape[k]._zod.optin === "optional" && shape[k]._zod.optout === "optional";
-  });
-}
-function pick(schema, mask) {
-  const currDef = schema._zod.def;
-  const checks = currDef.checks;
-  const hasChecks = checks && checks.length > 0;
-  if (hasChecks) {
-    throw new Error(".pick() cannot be used on object schemas containing refinements");
-  }
-  const def = mergeDefs(schema._zod.def, {
-    get shape() {
-      const newShape = {};
-      for (const key in mask) {
-        if (!(key in currDef.shape)) {
-          throw new Error(`Unrecognized key: "${key}"`);
-        }
-        if (!mask[key])
-          continue;
-        newShape[key] = currDef.shape[key];
-      }
-      assignProp(this, "shape", newShape);
-      return newShape;
-    },
-    checks: []
-  });
-  return clone(schema, def);
+  const def = mergeDefs(schema._zod.def, {
+    get shape() {
+      const newShape = {};
+      for (const key in mask) {
+        if (!(key in currDef.shape)) {
+          throw new Error(`Unrecognized key: "${key}"`);
+        }
+        if (!mask[key])
+          continue;
+        newShape[key] = currDef.shape[key];
+      }
+      assignProp(this, "shape", newShape);
+      return newShape;
+    },
+    checks: []
+  });
+  return clone(schema, def);
 }
 function omit(schema, mask) {
   const currDef = schema._zod.def;
@@ -15104,99 +14633,706 @@ var init_dist = __esm({
       3329325298
     ]);
   }
-});
-
-// src/anon-key.ts
-async function loadFsPath() {
-  if (fsPathCache !== void 0) return fsPathCache;
-  try {
-    const [fs10, path10] = await Promise.all([
-      import("node:fs/promises"),
-      import("node:path")
-    ]);
-    fsPathCache = { fs: fs10, path: path10 };
-    return fsPathCache;
-  } catch {
-    fsPathCache = null;
-    return null;
+});
+
+// src/anon-key.ts
+async function loadFsPath() {
+  if (fsPathCache !== void 0) return fsPathCache;
+  try {
+    const [fs10, path10] = await Promise.all([
+      import("node:fs/promises"),
+      import("node:path")
+    ]);
+    fsPathCache = { fs: fs10, path: path10 };
+    return fsPathCache;
+  } catch {
+    fsPathCache = null;
+    return null;
+  }
+}
+async function readAnonKey(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const modules = await loadFsPath();
+  if (modules) {
+    const keyPath = modules.path.join(root, GLASSTRACE_DIR, ANON_KEY_FILE);
+    try {
+      const content = await modules.fs.readFile(keyPath, "utf-8");
+      const result = AnonApiKeySchema.safeParse(content);
+      if (result.success) {
+        return result.data;
+      }
+    } catch {
+    }
+  }
+  const cached2 = ephemeralKeyCache.get(root);
+  if (cached2 !== void 0) {
+    return cached2;
+  }
+  return null;
+}
+async function readClaimedKey(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const modules = await loadFsPath();
+  if (!modules) return null;
+  const keyPath = modules.path.join(root, GLASSTRACE_DIR, CLAIMED_KEY_FILE);
+  try {
+    const content = await modules.fs.readFile(keyPath, "utf-8");
+    const trimmed = content.trim();
+    const parsed = DevApiKeySchema.safeParse(trimmed);
+    if (parsed.success) {
+      return parsed.data;
+    }
+  } catch {
+  }
+  return null;
+}
+async function getOrCreateAnonKey(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const existingKey = await readAnonKey(root);
+  if (existingKey !== null) {
+    return existingKey;
+  }
+  const cached2 = ephemeralKeyCache.get(root);
+  if (cached2 !== void 0) {
+    return cached2;
+  }
+  const newKey = createAnonApiKey();
+  const modules = await loadFsPath();
+  if (!modules) {
+    ephemeralKeyCache.set(root, newKey);
+    return newKey;
+  }
+  const dirPath = modules.path.join(root, GLASSTRACE_DIR);
+  const keyPath = modules.path.join(dirPath, ANON_KEY_FILE);
+  try {
+    await modules.fs.mkdir(dirPath, { recursive: true, mode: 448 });
+    await modules.fs.writeFile(keyPath, newKey, { flag: "wx", mode: 384 });
+    return newKey;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") {
+      for (let attempt = 0; attempt < 3; attempt++) {
+        const winnerKey = await readAnonKey(root);
+        if (winnerKey !== null) {
+          return winnerKey;
+        }
+        if (attempt < 2) {
+          await new Promise((resolve2) => setTimeout(resolve2, 50));
+        }
+      }
+      try {
+        await modules.fs.writeFile(keyPath, newKey, { mode: 384 });
+        await modules.fs.chmod(keyPath, 384);
+        return newKey;
+      } catch {
+      }
+    }
+    ephemeralKeyCache.set(root, newKey);
+    console.warn(
+      `[glasstrace] Failed to persist anonymous key to ${keyPath}: ${err instanceof Error ? err.message : String(err)}. Using ephemeral key.`
+    );
+    return newKey;
+  }
+}
+var GLASSTRACE_DIR, ANON_KEY_FILE, CLAIMED_KEY_FILE, fsPathCache, ephemeralKeyCache;
+var init_anon_key = __esm({
+  "src/anon-key.ts"() {
+    "use strict";
+    init_dist();
+    GLASSTRACE_DIR = ".glasstrace";
+    ANON_KEY_FILE = "anon_key";
+    CLAIMED_KEY_FILE = "claimed-key";
+    ephemeralKeyCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/mcp-runtime.ts
+async function loadFsPath2() {
+  if (fsPathCache2 !== void 0) return fsPathCache2;
+  try {
+    const [fs10, path10] = await Promise.all([
+      import("node:fs/promises"),
+      import("node:path")
+    ]);
+    fsPathCache2 = { fs: fs10, path: path10 };
+    return fsPathCache2;
+  } catch {
+    fsPathCache2 = null;
+    return null;
+  }
+}
+function identityFingerprint(token) {
+  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(token).digest("hex")}`;
+}
+function mcpConfigMatches(existingContent, expectedContent) {
+  const trimmedExpected = expectedContent.trim();
+  try {
+    const existingParsed = JSON.parse(existingContent);
+    const expectedParsed = JSON.parse(trimmedExpected);
+    return JSON.stringify(canonicalize(existingParsed)) === JSON.stringify(canonicalize(expectedParsed));
+  } catch {
+  }
+  return existingContent.trim() === trimmedExpected;
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = canonicalize(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function readEnvLocalApiKey(content) {
+  let last = null;
+  const regex = /^\s*GLASSTRACE_API_KEY\s*=\s*(.*)$/gm;
+  let match;
+  while ((match = regex.exec(content)) !== null) {
+    const raw = match[1].trim();
+    if (raw === "") continue;
+    const unquoted = raw.replace(/^(['"])(.*)\1$/, "$2");
+    if (unquoted === "" || unquoted === "your_key_here") continue;
+    last = unquoted;
+  }
+  return last;
+}
+function isDevApiKey(value) {
+  if (value === null || value === void 0) return false;
+  return value.trim().startsWith("gt_dev_");
+}
+function isAnonApiKey(value) {
+  if (value === null || value === void 0) return false;
+  return AnonApiKeySchema.safeParse(value).success;
+}
+async function resolveEffectiveMcpCredential(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const warnings = [];
+  const envLocalKey = await readEnvLocalDevKey(root, warnings);
+  const claimedKey = envLocalKey === null ? await readClaimedKey(root) : null;
+  const anonKey = await readAnonKey(root);
+  let effective = null;
+  if (envLocalKey !== null) {
+    effective = { source: "env-local", key: envLocalKey };
+  } else if (claimedKey !== null) {
+    effective = { source: "claimed-key", key: claimedKey };
+    warnings.push("claimed-key-only");
+  } else if (anonKey !== null) {
+    effective = { source: "anon", key: anonKey };
+  }
+  return { effective, anonKey, warnings };
+}
+async function readEnvLocalDevKey(root, warnings) {
+  const modules = await loadFsPath2();
+  if (!modules) return null;
+  const envPath = modules.path.join(root, ".env.local");
+  let content;
+  try {
+    content = await modules.fs.readFile(envPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const raw = readEnvLocalApiKey(content);
+  if (raw === null) return null;
+  const parsed = DevApiKeySchema.safeParse(raw);
+  if (!parsed.success) {
+    warnings.push("malformed-env-local");
+    return null;
+  }
+  return parsed.data;
+}
+async function readMcpMarker(projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const modules = await loadFsPath2();
+  if (!modules) return { status: "absent" };
+  const markerPath = modules.path.join(root, GLASSTRACE_DIR2, MCP_MARKER_FILE);
+  let content;
+  try {
+    content = await modules.fs.readFile(markerPath, "utf-8");
+  } catch {
+    return { status: "absent" };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return { status: "corrupted" };
+  }
+  if (parsed === null || typeof parsed !== "object") {
+    return { status: "corrupted" };
+  }
+  const obj = parsed;
+  const version2 = obj["version"];
+  if (version2 === void 0) {
+    const keyHash = obj["keyHash"];
+    if (typeof keyHash !== "string" || keyHash === "") {
+      return { status: "corrupted" };
+    }
+    return {
+      status: "valid",
+      credentialSource: "anon",
+      credentialHash: keyHash
+    };
+  }
+  if (version2 === 2) {
+    const source = obj["credentialSource"];
+    const hash2 = obj["credentialHash"];
+    if (source !== "env-local" && source !== "claimed-key" && source !== "anon" || typeof hash2 !== "string" || hash2 === "") {
+      return { status: "corrupted" };
+    }
+    return {
+      status: "valid",
+      credentialSource: source,
+      credentialHash: hash2
+    };
+  }
+  if (typeof version2 === "number" && version2 > 2) {
+    return { status: "unknown-version" };
+  }
+  return { status: "corrupted" };
+}
+async function writeMcpMarker(projectRoot, target) {
+  const modules = await loadFsPath2();
+  if (!modules) return false;
+  const dirPath = modules.path.join(projectRoot, GLASSTRACE_DIR2);
+  const markerPath = modules.path.join(dirPath, MCP_MARKER_FILE);
+  const state = await readMcpMarker(projectRoot);
+  if (state.status === "valid" && state.credentialSource === target.credentialSource && state.credentialHash === target.credentialHash) {
+    return false;
+  }
+  await modules.fs.mkdir(dirPath, { recursive: true, mode: 448 });
+  const body = JSON.stringify(
+    {
+      version: 2,
+      credentialSource: target.credentialSource,
+      credentialHash: target.credentialHash,
+      configuredAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    null,
+    2
+  );
+  await modules.fs.writeFile(markerPath, body, { mode: 384 });
+  await modules.fs.chmod(markerPath, 384);
+  return true;
+}
+var import_node_crypto, MCP_ENDPOINT, fsPathCache2, MCP_MARKER_FILE, GLASSTRACE_DIR2;
+var init_mcp_runtime = __esm({
+  "src/mcp-runtime.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    init_dist();
+    init_anon_key();
+    MCP_ENDPOINT = "https://api.glasstrace.dev/mcp";
+    MCP_MARKER_FILE = "mcp-connected";
+    GLASSTRACE_DIR2 = ".glasstrace";
+  }
+});
+
+// src/cli/constants.ts
+function formatAgentName(name) {
+  const displayNames = {
+    claude: "Claude Code",
+    codex: "Codex",
+    gemini: "Gemini",
+    cursor: "Cursor",
+    windsurf: "Windsurf",
+    generic: "Generic"
+  };
+  return displayNames[name];
+}
+var NEXT_CONFIG_NAMES;
+var init_constants = __esm({
+  "src/cli/constants.ts"() {
+    "use strict";
+    init_mcp_runtime();
+    NEXT_CONFIG_NAMES = ["next.config.ts", "next.config.js", "next.config.mjs"];
+  }
+});
+
+// src/cli/scaffolder.ts
+function hasRegisterGlasstraceCall(content) {
+  return content.split("\n").some((line) => {
+    const uncommented = line.replace(/\/\/.*$/, "");
+    return /\bregisterGlasstrace\s*\(/.test(uncommented);
+  });
+}
+function injectRegisterGlasstrace(content) {
+  if (hasRegisterGlasstraceCall(content)) {
+    return { injected: false, content };
+  }
+  const registerFnRegex = /export\s+(?:async\s+)?function\s+register\s*\([^)]*\)\s*\{/;
+  const match = registerFnRegex.exec(content);
+  if (!match) {
+    return { injected: false, content };
+  }
+  const afterBrace = content.slice(match.index + match[0].length);
+  const indentMatch = /\n([ \t]+)/.exec(afterBrace);
+  const indent = indentMatch ? indentMatch[1] : "  ";
+  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
+  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
+  const insertPoint = match.index + match[0].length;
+  const callInjection = `
+${indent}// Glasstrace must be registered before other instrumentation
+${indent}registerGlasstrace();
+`;
+  let modified;
+  if (hasGlasstraceImport2) {
+    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
+    const importMatch = importRegex.exec(content);
+    if (importMatch) {
+      const specifiers = importMatch[1];
+      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
+      if (alreadyImported) {
+        modified = content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
+      } else {
+        const existingImports = specifiers.trimEnd();
+        const separator = existingImports.endsWith(",") ? " " : ", ";
+        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
+        modified = content.replace(importMatch[0], updatedImport);
+        const newMatch = registerFnRegex.exec(modified);
+        if (newMatch) {
+          const newInsertPoint = newMatch.index + newMatch[0].length;
+          modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
+        }
+      }
+    } else {
+      modified = importLine + content;
+      const newMatch = registerFnRegex.exec(modified);
+      if (newMatch) {
+        const newInsertPoint = newMatch.index + newMatch[0].length;
+        modified = modified.slice(0, newInsertPoint) + callInjection + modified.slice(newInsertPoint);
+      }
+    }
+  } else {
+    modified = importLine + content.slice(0, insertPoint) + callInjection + content.slice(insertPoint);
+  }
+  return { injected: true, content: modified };
+}
+function resolveInstrumentationTarget(projectRoot) {
+  const rootExisting = [];
+  const srcExisting = [];
+  for (const name of INSTRUMENTATION_FILENAMES) {
+    const rootPath = path.join(projectRoot, name);
+    if (isRegularFile(rootPath)) {
+      rootExisting.push(rootPath);
+    }
+    const srcPath = path.join(projectRoot, "src", name);
+    if (isRegularFile(srcPath)) {
+      srcExisting.push(srcPath);
+    }
+  }
+  const existing = [...rootExisting, ...srcExisting];
+  if (rootExisting.length > 0 && srcExisting.length > 0) {
+    return {
+      target: null,
+      layout: null,
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: true
+    };
+  }
+  if (srcExisting.length > 0) {
+    return {
+      target: srcExisting[0],
+      layout: "src",
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: false
+    };
+  }
+  if (rootExisting.length > 0) {
+    return {
+      target: rootExisting[0],
+      layout: "root",
+      existing,
+      rootExisting,
+      srcExisting,
+      conflict: false
+    };
+  }
+  const srcDir = path.join(projectRoot, "src");
+  const layout = isDirectory(srcDir) ? "src" : "root";
+  const target = layout === "src" ? path.join(projectRoot, "src", "instrumentation.ts") : path.join(projectRoot, "instrumentation.ts");
+  return {
+    target,
+    layout,
+    existing,
+    rootExisting,
+    srcExisting,
+    conflict: false
+  };
+}
+function isDirectory(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isRegularFile(p) {
+  try {
+    const stat2 = fs.lstatSync(p);
+    if (stat2.isSymbolicLink()) {
+      return fs.statSync(p).isFile();
+    }
+    return stat2.isFile();
+  } catch {
+    return false;
+  }
+}
+function appendRegisterFunction(content) {
+  const importLine = 'import { registerGlasstrace } from "@glasstrace/sdk";\n';
+  const functionBlock = "\nexport async function register() {\n  // Glasstrace must be registered before Prisma instrumentation\n  // to ensure all ORM spans are captured correctly.\n  // If you use @prisma/instrumentation, import it after this call.\n  registerGlasstrace();\n}\n";
+  let withImport = content;
+  const hasGlasstraceImport2 = content.includes("@glasstrace/sdk");
+  if (!hasGlasstraceImport2) {
+    withImport = importLine + content;
+  } else {
+    const importRegex = /import\s*\{([^}]+)\}\s*from\s*["']@glasstrace\/sdk["']/;
+    const importMatch = importRegex.exec(content);
+    if (importMatch) {
+      const specifiers = importMatch[1];
+      const alreadyImported = specifiers.split(",").some((s) => s.trim() === "registerGlasstrace");
+      if (!alreadyImported) {
+        const existingImports = specifiers.trimEnd();
+        const separator = existingImports.endsWith(",") ? " " : ", ";
+        const updatedImport = `import { ${existingImports.trim()}${separator}registerGlasstrace } from "@glasstrace/sdk"`;
+        withImport = content.replace(importMatch[0], updatedImport);
+      }
+    } else {
+      withImport = importLine + content;
+    }
+  }
+  const trailingNewline = withImport.endsWith("\n") ? "" : "\n";
+  return withImport + trailingNewline + functionBlock;
+}
+async function defaultInstrumentationPrompt(question, defaultValue) {
+  if (!process.stdin.isTTY) return defaultValue;
+  const readline2 = await import("node:readline");
+  const rl = readline2.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve2) => {
+    const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
+    rl.question(question + suffix, (answer) => {
+      rl.close();
+      const trimmed = answer.trim().toLowerCase();
+      if (trimmed === "") {
+        resolve2(defaultValue);
+        return;
+      }
+      resolve2(trimmed === "y" || trimmed === "yes");
+    });
+  });
+}
+async function scaffoldInstrumentation(projectRoot, options = {}) {
+  const target = resolveInstrumentationTarget(projectRoot);
+  if (target.conflict) {
+    return {
+      action: "conflict",
+      // Point the user at the `src/` variant — modern Next.js apps with a
+      // `src/` directory load from there, so that's the merge target. The
+      // competing path is reported separately for the error message.
+      filePath: target.srcExisting[0],
+      conflictingPath: target.rootExisting[0]
+    };
+  }
+  const filePath = target.target;
+  const layout = target.layout;
+  if (filePath === null || layout === null) {
+    return { action: "unrecognized" };
+  }
+  const force = options.force === true;
+  const prompt = options.prompt ?? defaultInstrumentationPrompt;
+  if (!fs.existsSync(filePath)) {
+    const content = `import { registerGlasstrace } from "@glasstrace/sdk";
+
+export async function register() {
+  // Glasstrace must be registered before Prisma instrumentation
+  // to ensure all ORM spans are captured correctly.
+  // If you use @prisma/instrumentation, import it after this call.
+  registerGlasstrace();
+}
+`;
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content, "utf-8");
+    return { action: "created", filePath, layout };
+  }
+  const existing = fs.readFileSync(filePath, "utf-8");
+  if (hasRegisterGlasstraceCall(existing)) {
+    return { action: "already-registered", filePath, layout };
+  }
+  if (!force) {
+    const approved = await prompt(
+      `Merge registerGlasstrace() into ${path.relative(projectRoot, filePath)}?`,
+      false
+    );
+    if (!approved) {
+      return { action: "skipped", filePath, layout };
+    }
+  }
+  const injectResult = injectRegisterGlasstrace(existing);
+  if (injectResult.injected) {
+    fs.writeFileSync(filePath, injectResult.content, "utf-8");
+    return { action: "injected", filePath, layout };
   }
+  const appended = appendRegisterFunction(existing);
+  fs.writeFileSync(filePath, appended, "utf-8");
+  return { action: "appended", filePath, layout };
 }
-async function readAnonKey(projectRoot) {
-  const root = projectRoot ?? process.cwd();
-  const modules = await loadFsPath();
-  if (modules) {
-    const keyPath = modules.path.join(root, GLASSTRACE_DIR, ANON_KEY_FILE);
-    try {
-      const content = await modules.fs.readFile(keyPath, "utf-8");
-      const result = AnonApiKeySchema.safeParse(content);
-      if (result.success) {
-        return result.data;
-      }
-    } catch {
+async function scaffoldNextConfig(projectRoot) {
+  let configPath;
+  let configName;
+  for (const name of NEXT_CONFIG_NAMES) {
+    const candidate = path.join(projectRoot, name);
+    if (fs.existsSync(candidate)) {
+      configPath = candidate;
+      configName = name;
+      break;
     }
   }
-  const cached2 = ephemeralKeyCache.get(root);
-  if (cached2 !== void 0) {
-    return cached2;
+  if (configPath === void 0 || configName === void 0) {
+    return null;
   }
-  return null;
+  const existing = fs.readFileSync(configPath, "utf-8");
+  if (existing.trim().length === 0) {
+    return { modified: false, reason: "empty-file" };
+  }
+  if (existing.includes("withGlasstraceConfig")) {
+    return { modified: false, reason: "already-wrapped" };
+  }
+  const isESM = configName.endsWith(".ts") || configName.endsWith(".mjs");
+  if (isESM) {
+    const importLine = 'import { withGlasstraceConfig } from "@glasstrace/sdk";\n';
+    const wrapResult2 = wrapExport(existing);
+    if (!wrapResult2.wrapped) {
+      return { modified: false, reason: "no-export" };
+    }
+    const modified2 = importLine + "\n" + wrapResult2.content;
+    fs.writeFileSync(configPath, modified2, "utf-8");
+    return { modified: true };
+  }
+  const requireLine = 'const { withGlasstraceConfig } = require("@glasstrace/sdk");\n';
+  const wrapResult = wrapCJSExport(existing);
+  if (!wrapResult.wrapped) {
+    return { modified: false, reason: "no-export" };
+  }
+  const modified = requireLine + "\n" + wrapResult.content;
+  fs.writeFileSync(configPath, modified, "utf-8");
+  return { modified: true };
 }
-async function getOrCreateAnonKey(projectRoot) {
-  const root = projectRoot ?? process.cwd();
-  const existingKey = await readAnonKey(root);
-  if (existingKey !== null) {
-    return existingKey;
+function wrapExport(content) {
+  const marker = "export default";
+  const idx = content.lastIndexOf(marker);
+  if (idx === -1) {
+    return { content, wrapped: false };
   }
-  const cached2 = ephemeralKeyCache.get(root);
-  if (cached2 !== void 0) {
-    return cached2;
+  const preamble = content.slice(0, idx);
+  const exprRaw = content.slice(idx + marker.length);
+  const expr = exprRaw.trim().replace(/;?\s*$/, "");
+  if (expr.length === 0) {
+    return { content, wrapped: false };
   }
-  const newKey = createAnonApiKey();
-  const modules = await loadFsPath();
-  if (!modules) {
-    ephemeralKeyCache.set(root, newKey);
-    return newKey;
+  return {
+    content: preamble + `export default withGlasstraceConfig(${expr});
+`,
+    wrapped: true
+  };
+}
+function wrapCJSExport(content) {
+  const cjsMarker = "module.exports";
+  const cjsIdx = content.lastIndexOf(cjsMarker);
+  if (cjsIdx === -1) {
+    return { content, wrapped: false };
   }
-  const dirPath = modules.path.join(root, GLASSTRACE_DIR);
-  const keyPath = modules.path.join(dirPath, ANON_KEY_FILE);
-  try {
-    await modules.fs.mkdir(dirPath, { recursive: true, mode: 448 });
-    await modules.fs.writeFile(keyPath, newKey, { flag: "wx", mode: 384 });
-    return newKey;
-  } catch (err) {
-    const code = err.code;
-    if (code === "EEXIST") {
-      for (let attempt = 0; attempt < 3; attempt++) {
-        const winnerKey = await readAnonKey(root);
-        if (winnerKey !== null) {
-          return winnerKey;
-        }
-        if (attempt < 2) {
-          await new Promise((resolve2) => setTimeout(resolve2, 50));
-        }
-      }
-      try {
-        await modules.fs.writeFile(keyPath, newKey, { mode: 384 });
-        await modules.fs.chmod(keyPath, 384);
-        return newKey;
-      } catch {
-      }
+  const preamble = content.slice(0, cjsIdx);
+  const afterMarker = content.slice(cjsIdx + cjsMarker.length);
+  const eqMatch = /^\s*=\s*/.exec(afterMarker);
+  if (!eqMatch) {
+    return { content, wrapped: false };
+  }
+  const exprRaw = afterMarker.slice(eqMatch[0].length);
+  const expr = exprRaw.trim().replace(/;?\s*$/, "");
+  if (expr.length === 0) {
+    return { content, wrapped: false };
+  }
+  return {
+    content: preamble + `module.exports = withGlasstraceConfig(${expr});
+`,
+    wrapped: true
+  };
+}
+async function scaffoldEnvLocal(projectRoot) {
+  const filePath = path.join(projectRoot, ".env.local");
+  if (fs.existsSync(filePath)) {
+    const existing = fs.readFileSync(filePath, "utf-8");
+    if (/^\s*#?\s*GLASSTRACE_API_KEY\s*=/m.test(existing)) {
+      return false;
     }
-    ephemeralKeyCache.set(root, newKey);
-    console.warn(
-      `[glasstrace] Failed to persist anonymous key to ${keyPath}: ${err instanceof Error ? err.message : String(err)}. Using ephemeral key.`
-    );
-    return newKey;
+    const separator = existing.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(filePath, existing + separator + "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
+    return true;
   }
+  fs.writeFileSync(filePath, "# GLASSTRACE_API_KEY=your_key_here\n", "utf-8");
+  return true;
 }
-var GLASSTRACE_DIR, ANON_KEY_FILE, fsPathCache, ephemeralKeyCache;
-var init_anon_key = __esm({
-  "src/anon-key.ts"() {
+async function addCoverageMapEnv(projectRoot) {
+  const filePath = path.join(projectRoot, ".env.local");
+  if (!fs.existsSync(filePath)) {
+    fs.writeFileSync(filePath, "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
+    return true;
+  }
+  const existing = fs.readFileSync(filePath, "utf-8");
+  const keyRegex = /^(\s*GLASSTRACE_COVERAGE_MAP\s*=\s*)(.*)$/m;
+  const keyMatch = keyRegex.exec(existing);
+  if (keyMatch) {
+    const currentValue = keyMatch[2].trim();
+    if (currentValue === "true") {
+      return false;
+    }
+    const updated = existing.replace(keyRegex, `${keyMatch[1]}true`);
+    fs.writeFileSync(filePath, updated, "utf-8");
+    return true;
+  }
+  const separator = existing.endsWith("\n") ? "" : "\n";
+  fs.writeFileSync(filePath, existing + separator + "GLASSTRACE_COVERAGE_MAP=true\n", "utf-8");
+  return true;
+}
+async function scaffoldGitignore(projectRoot) {
+  const filePath = path.join(projectRoot, ".gitignore");
+  if (fs.existsSync(filePath)) {
+    const existing = fs.readFileSync(filePath, "utf-8");
+    const lines = existing.split("\n").map((l) => l.trim());
+    if (lines.includes(".glasstrace/")) {
+      return false;
+    }
+    const separator = existing.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(filePath, existing + separator + ".glasstrace/\n", "utf-8");
+    return true;
+  }
+  fs.writeFileSync(filePath, ".glasstrace/\n", "utf-8");
+  return true;
+}
+var fs, path, INSTRUMENTATION_FILENAMES;
+var init_scaffolder = __esm({
+  "src/cli/scaffolder.ts"() {
     "use strict";
-    init_dist();
-    GLASSTRACE_DIR = ".glasstrace";
-    ANON_KEY_FILE = "anon_key";
-    ephemeralKeyCache = /* @__PURE__ */ new Map();
+    fs = __toESM(require("node:fs"), 1);
+    path = __toESM(require("node:path"), 1);
+    init_constants();
+    init_mcp_runtime();
+    INSTRUMENTATION_FILENAMES = [
+      "instrumentation.ts",
+      "instrumentation.js",
+      "instrumentation.mjs"
+    ];
   }
 });
 
@@ -15360,12 +15496,12 @@ var init_detect = __esm({
 });
 
 // src/agent-detection/configs.ts
-function generateMcpConfig(agent, endpoint, anonKey) {
+function generateMcpConfig(agent, endpoint, bearer) {
   if (!endpoint || endpoint.trim() === "") {
     throw new Error("endpoint must not be empty");
   }
-  if (!anonKey || anonKey.trim() === "") {
-    throw new Error("anonKey must not be empty");
+  if (!bearer || bearer.trim() === "") {
+    throw new Error("bearer must not be empty");
   }
   switch (agent.name) {
     case "claude":
@@ -15376,7 +15512,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
               type: "http",
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15400,7 +15536,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               httpUrl: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15415,7 +15551,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15430,7 +15566,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               serverUrl: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -15445,7 +15581,7 @@ function generateMcpConfig(agent, endpoint, anonKey) {
             glasstrace: {
               url: endpoint,
               headers: {
-                Authorization: `Bearer ${anonKey}`
+                Authorization: `Bearer ${bearer}`
               }
             }
           }
@@ -16873,19 +17009,23 @@ var init_uninit = __esm({
 // src/cli/mcp-add.ts
 var mcp_add_exports = {};
 __export(mcp_add_exports, {
-  mcpAdd: () => mcpAdd
+  mcpAdd: () => mcpAdd,
+  registerViaCli: () => registerViaCli
 });
-async function registerViaCli(agent, anonKey) {
+async function registerViaCli(agent, bearer) {
   if (!agent.cliAvailable) {
     return false;
   }
+  if (agent.name !== "codex" && !isAnonApiKey(bearer)) {
+    return false;
+  }
   try {
     switch (agent.name) {
       case "claude": {
         const payload = JSON.stringify({
           type: "http",
           url: MCP_ENDPOINT,
-          headers: { Authorization: `Bearer ${anonKey}` }
+          headers: { Authorization: `Bearer ${bearer}` }
         });
         await execFileAsync("claude", [
           "mcp",
@@ -16929,7 +17069,7 @@ async function registerViaCli(agent, anonKey) {
           "--transport",
           "http",
           "--header",
-          `Authorization: Bearer ${anonKey}`,
+          `Authorization: Bearer ${bearer}`,
           "glasstrace",
           MCP_ENDPOINT
         ]);
@@ -16942,26 +17082,41 @@ async function registerViaCli(agent, anonKey) {
     return false;
   }
 }
+async function markerMatchesEffective(projectRoot, effective) {
+  const state = await readMcpMarker(projectRoot);
+  if (state.status !== "valid") return false;
+  return state.credentialHash === identityFingerprint(effective.key);
+}
 async function mcpAdd(options) {
   const force = options?.force ?? false;
   const dryRun = options?.dryRun ?? false;
   const projectRoot = process.cwd();
   const messages = [];
-  const anonKey = await readAnonKey(projectRoot);
-  if (anonKey === null) {
+  const resolved = await resolveEffectiveMcpCredential(projectRoot);
+  if (resolved.effective === null) {
     return {
       exitCode: 1,
       results: [],
       messages: ["Error: Run `glasstrace init` first to generate an API key."]
     };
   }
+  if (resolved.warnings.includes("claimed-key-only")) {
+    messages.push(
+      "Note: dev key was loaded from .glasstrace/claimed-key. Copy it into .env.local so your app and Codex pick it up automatically."
+    );
+  }
   const markerPath = path6.join(projectRoot, ".glasstrace", "mcp-connected");
   if (fs6.existsSync(markerPath) && !force) {
-    return {
-      exitCode: 0,
-      results: [],
-      messages: ["MCP already configured. Use --force to reconfigure."]
-    };
+    if (await markerMatchesEffective(projectRoot, resolved.effective)) {
+      return {
+        exitCode: 0,
+        results: [],
+        messages: ["MCP already configured. Use --force to reconfigure."]
+      };
+    }
+    messages.push(
+      "Detected a credential change since MCP was last configured. Refreshing MCP config so queries use the current account credential."
+    );
   }
   const agents = await detectAgents(projectRoot);
   const detectedNonGeneric = agents.filter((a) => a.name !== "generic");
@@ -16970,7 +17125,7 @@ async function mcpAdd(options) {
     messages.push("Dry run: would perform the following actions:", "");
     for (const agent of targetAgents) {
       const name = formatAgentName(agent.name);
-      if (agent.cliAvailable) {
+      if (agent.cliAvailable && resolved.effective.source === "anon") {
         messages.push(
           `  ${name}: Register via CLI (${agent.name} mcp add)`
         );
@@ -16993,10 +17148,11 @@ async function mcpAdd(options) {
     return { exitCode: 0, results: [], messages };
   }
   const results = [];
+  const bearer = resolved.effective.key;
   for (const agent of targetAgents) {
     const name = formatAgentName(agent.name);
     if (agent.name !== "generic") {
-      const cliSuccess = await registerViaCli(agent, anonKey);
+      const cliSuccess = await registerViaCli(agent, bearer);
       if (cliSuccess) {
         const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
         if (infoContent !== "") {
@@ -17013,7 +17169,7 @@ async function mcpAdd(options) {
     }
     if (agent.mcpConfigPath !== null) {
       try {
-        const configContent = generateMcpConfig(agent, MCP_ENDPOINT, anonKey);
+        const configContent = generateMcpConfig(agent, MCP_ENDPOINT, bearer);
         await writeMcpConfig(agent, configContent, projectRoot);
         if (fs6.existsSync(agent.mcpConfigPath)) {
           const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
@@ -17058,7 +17214,10 @@ async function mcpAdd(options) {
   );
   const anySuccess = results.some((r) => r.success);
   if (anySuccess) {
-    await scaffoldMcpMarker(projectRoot, anonKey);
+    await writeMcpMarker(projectRoot, {
+      credentialSource: resolved.effective.source,
+      credentialHash: identityFingerprint(resolved.effective.key)
+    });
   }
   messages.push("", "MCP registration summary:");
   for (const result of results) {
@@ -17090,11 +17249,10 @@ var init_mcp_add = __esm({
     fs6 = __toESM(require("node:fs"), 1);
     path6 = __toESM(require("node:path"), 1);
     import_node_util = require("node:util");
-    init_anon_key();
+    init_mcp_runtime();
     init_detect();
     init_configs();
     init_inject();
-    init_scaffolder();
     init_constants();
     execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
   }
@@ -17414,6 +17572,7 @@ var fs9 = __toESM(require("node:fs"), 1);
 var path9 = __toESM(require("node:path"), 1);
 var readline = __toESM(require("node:readline"), 1);
 init_scaffolder();
+init_mcp_runtime();
 
 // src/import-graph.ts
 var fs2 = __toESM(require("node:fs/promises"), 1);
@@ -18332,6 +18491,9 @@ Then add this as the first statement in your register() function:
       );
     }
     let anyConfigWritten = false;
+    let anyConfigRewrittenWithBearer = false;
+    const resolved = await resolveEffectiveMcpCredential(projectRoot);
+    const bearer = resolved.effective?.key ?? anonKey;
     if (isCI) {
       const genericAgent = {
         name: "generic",
@@ -18340,7 +18502,7 @@ Then add this as the first statement in your register() function:
         cliAvailable: false,
         registrationCommand: null
       };
-      const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, anonKey);
+      const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, bearer);
       const decision = await decideMcpConfigAction({
         configPath: genericAgent.mcpConfigPath,
         expectedContent: genericConfig,
@@ -18348,6 +18510,9 @@ Then add this as the first statement in your register() function:
       });
       if (decision !== "skip") {
         await writeMcpConfig(genericAgent, genericConfig, projectRoot);
+        if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
+          anyConfigRewrittenWithBearer = true;
+        }
       }
       if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
         anyConfigWritten = true;
@@ -18368,17 +18533,18 @@ Then add this as the first statement in your register() function:
           cliAvailable: false,
           registrationCommand: null
         };
-        const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, anonKey);
+        const genericConfig = generateMcpConfig(genericAgent, MCP_ENDPOINT, bearer);
         await writeMcpConfig(genericAgent, genericConfig, projectRoot);
         if (genericAgent.mcpConfigPath !== null && fs9.existsSync(genericAgent.mcpConfigPath)) {
           anyConfigWritten = true;
+          anyConfigRewrittenWithBearer = true;
         }
         agents = [];
       }
       const configuredNames = [];
       for (const agent of agents) {
         try {
-          const configContent = generateMcpConfig(agent, MCP_ENDPOINT, anonKey);
+          const configContent = generateMcpConfig(agent, MCP_ENDPOINT, bearer);
           const decision = await decideMcpConfigAction({
             configPath: agent.mcpConfigPath,
             expectedContent: configContent,
@@ -18399,6 +18565,7 @@ Then add this as the first statement in your register() function:
             continue;
           }
           anyConfigWritten = true;
+          anyConfigRewrittenWithBearer = true;
           const infoContent = generateInfoSection(agent, MCP_ENDPOINT);
           if (infoContent !== "") {
             await injectInfoSection(agent, infoContent, projectRoot);
@@ -18422,8 +18589,13 @@ Then add this as the first statement in your register() function:
       [".mcp.json", ".cursor/mcp.json", ".gemini/settings.json", ".codex/config.toml"],
       projectRoot
     );
-    if (anyConfigWritten) {
-      const markerCreated = await scaffoldMcpMarker(projectRoot, anonKey);
+    if (anyConfigRewrittenWithBearer) {
+      const markerSource = resolved.effective?.source ?? "anon";
+      const markerHash = identityFingerprint(bearer);
+      const markerCreated = await writeMcpMarker(projectRoot, {
+        credentialSource: markerSource,
+        credentialHash: markerHash
+      });
       if (markerCreated) {
         summary.push("Created .glasstrace/mcp-connected marker");
       }
@@ -18492,7 +18664,7 @@ async function verifyAnonKeyRegistration(projectRoot) {
   }
   const baseConfig = resolveConfig({ apiKey: devKey });
   const config2 = { ...baseConfig, apiKey: devKey };
-  const sdkVersion = true ? "1.1.0" : "0.0.0-dev";
+  const sdkVersion = true ? "1.1.1" : "0.0.0-dev";
   const result = await verifyInitReachable(config2, anonKey, sdkVersion);
   if (result.ok) {
     return { outcome: "verified" };