@krapht/ork 1.0.0-alpha.18 → 1.0.0-alpha.19

package/dist/{src-DWAcd3Sy.mjs → src-n-u4TGev.mjs}

@@ -1,11 +1,11 @@
-import { An as liveStatus, Ar as loadAgents, Br as inside, Bt as decisionListTable, D as triggersReport, Dn as requestPause, En as requestContinue, F as activeTree, Fr as placeFor, Gt as worktreeListTable, Hr as LESSON_CAP_TOKENS, Ht as followUpListTable, I as isNodeEvent, In as processAlive, Jr as WorkflowEditSchema, Jt as keyOf, Kn as endOf, Kt as applyClean, L as openStore, Lr as runDirOf, Mn as pausedOf, Nn as runStatus, On as requestStop, Pr as placeFiles, R as storePath, S as detectInstaller, St as walkSummary, Tn as unlinkNodes, Un as loadProject, Ut as runListTable, Vt as feedbackListTable, Wt as usageListTable, Xr as newWorkflowText, Xt as stepActs, Yn as END_KINDS, Yr as applyEdits, Yt as planClean, Zr as readDocument, Zt as stepPrunes, _ as capsHere, a as planRemove, ai as EdgeInputSchema, b as runningRunIds, bn as liveSessionOf, bt as checkWorkflowText, ci as expandEdge, d as planLine, er as DISCUSSIONS, f as removeRefusal, g as usageReport, gn as startFollowUpChecks, ht as explainWorkflowText, i as lostWork, kn as tellLiveRun, l as labelOf, lt as detachRun, ni as parseWorkflow, nr as runGh, nt as answerDecision, o as projectHead, on as nodeSays, ot as detachResume, p as stateParts, pn as checkFollowUpsDue, pr as readCondition, pt as limitsReport, qr as skillsIn, qt as cleanStep, r as applyRemove, rr as sendPost, rt as pendingDecisions, s as readWorktrees, st as resumable, ti as renderJsonSchema, tr as planPost, u as mergeStateOf, ui as NodeSchema, ut as followEvents, v as planUpgrade, wn as linkNodes, x as runningScript, xn as DEFAULT_FOLLOW_UPS_RULE, xt as walkChecks, y as releaseNotes, zn as nestItems, zr as workflowDirOf, zt as LIST_TABLES } from "./src-Frwpx3WF.mjs";
-import { a as acceptItem, c as feedbackActions, i as recordNote, l as openFixRun, n as previewPost, o as lessonPlaceOf, s as placeOf$1, t as runInstall } from "./install-B743Bwzz.mjs";
-import { _ as dueCause, a as registryShown, c as fetchLatest, d as readUpdateCache, f as refreshUpdateCache, g as changeFollowUp, h as nodeSession, i as registryOf, l as newerVersion, m as writeUpdateCache, o as updateSwitchOff, p as updateCachePath, s as checkDue, v as findFollowUp, y as followUpActions } from "./__build_info__-B8TNbFtN.mjs";
-import { t as postFollowUpMessage } from "./post-y1qL1Fnj.mjs";
+import { $t as stepActs, An as requestPause, C as detectInstaller, Cn as liveSessionOf, Ct as checkWorkflowText, Dn as linkNodes, Fn as pausedOf, Gt as followUpListTable, Hn as nestItems, Ht as LIST_TABLES, I as activeTree, In as runStatus, Jn as changeFollowUp, Jr as workflowDirOf, Jt as worktreeListTable, Kn as loadProject, Kr as runDirOf, Kt as runListTable, L as isNodeEvent, Mn as tellLiveRun, Nn as liveStatus, O as triggersReport, On as unlinkNodes, Qt as planClean, R as openStore, S as runningScript, Sr as readCondition, Tt as walkSummary, Ur as placeFiles, Ut as decisionListTable, Wr as placeFor, Wt as feedbackListTable, Xn as findFollowUp, Xt as cleanStep, Yn as dueCause, Yr as inside, Yt as applyClean, Zn as followUpActions, Zr as LESSON_CAP_TOKENS, Zt as keyOf, _ as usageReport, _i as expandEdge, _n as checkFollowUpsDue, _r as feedbackActions, a as planRemove, ai as newWorkflowText, ar as previewPost, at as answerDecision, b as releaseNotes, bn as startFollowUpChecks, d as mergeStateOf, di as parseWorkflow, dr as DISCUSSIONS, en as stepPrunes, er as endOf, f as planLine, fr as planPost, ft as detachRun, gn as postFollowUpMessage, gt as limitsReport, i as lostWork, ii as applyEdits, jn as requestStop, kn as requestContinue, ln as nodeSays, lt as detachResume, m as stateParts, mi as EdgeInputSchema, mr as sendPost, ni as skillsIn, o as projectHead, oi as readDocument, ot as pendingDecisions, p as removeRefusal, pr as runGh, pt as followEvents, qt as usageListTable, r as applyRemove, ri as WorkflowEditSchema, rr as END_KINDS, s as readWorktrees, sr as recordNote, u as labelOf, ui as renderJsonSchema, ut as resumable, v as capsHere, vr as openFixRun, vt as explainWorkflowText, wn as DEFAULT_FOLLOW_UPS_RULE, wt as walkChecks, x as runningRunIds, y as planUpgrade, yi as NodeSchema, z as storePath, zn as processAlive, zr as loadAgents } from "./src-Ciy7i3se.mjs";
+import { i as placeOf$1, n as acceptItem, r as lessonPlaceOf, t as runInstall } from "./install-CsqK1avz.mjs";
 import { t as applyFilters } from "./apply-Mb0fNpCX.mjs";
-import { t as parseFilters } from "./parse-BzWpMN-a.mjs";
-import { t as builtinProblem } from "./builtin-files-dnTP2GaX.mjs";
-import { n as newRunId, t as findRun } from "./find-P-VV4B47.mjs";
+import { i as parseLimit, n as unknownProjectRefusal, r as parseFilters, t as limitRefusal } from "./refusals-DQQX3AIb.mjs";
+import { t as builtinProblem } from "./builtin-files-CWL3JEo-.mjs";
+import { n as newRunId, t as findRun } from "./find-B30-rd-u.mjs";
+import { a as registryShown, c as fetchLatest, d as readUpdateCache, f as refreshUpdateCache, h as nodeSession, i as registryOf, l as newerVersion, m as writeUpdateCache, o as updateSwitchOff, p as updateCachePath, s as checkDue } from "./__build_info__-dPf4cEGL.mjs";
+import { t as outputsText } from "./outputs-text-CNTJ7Qq_.mjs";
 import path from "node:path";
 import { z } from "zod";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -436,6 +436,11 @@ const API = {
 		method: "GET",
 		path: "/api/health"
 	},
+	/** Bearer token only (RFC-019): mints a single-use code for `/?code=`. */
+	signIn: {
+		method: "POST",
+		path: "/api/sign-in"
+	},
 	...BUILDER_API,
 	...CONTEXT_API,
 	...AFTER_API,
@@ -542,6 +547,64 @@ const STREAMS = {
 	overview: "/api/stream",
 	upgrade: "/api/upgrade/stream"
 };
+/** A route's path with its `:params` filled in, each encoded. */
+const fillPath = (path, params) => path.replaceAll(/:(\w+)/gu, (_, name) => encodeURIComponent(params[name] ?? ""));
+// ../server/src/client.ts
+/**
+* @file The typed client of the API (ADR-039), built from the contract: a call
+*   names a route and passes its params, query and body, and gets the route's
+*   response type back, or the server's error. The UI uses it in the browser
+*   (the session cookie goes with each request on its own); scripts pass the
+*   token. It uses only `fetch`, so it runs in a browser and in Node.
+*/
+/** An object's string and number fields, as text. */
+const entries = (value) => typeof value === "object" && value !== null ? Object.entries(value).flatMap(([key, field]) => typeof field === "string" || typeof field === "number" ? [[key, String(field)]] : []) : [];
+const queryString = (query) => {
+	const search = new URLSearchParams();
+	for (const [key, value] of entries(query)) search.set(key, value);
+	const text = search.toString();
+	return text === "" ? "" : `?${text}`;
+};
+const errorOf = (body, status) => typeof body === "object" && body !== null && "error" in body && typeof body.error === "string" ? body.error : `The server answered ${String(status)}.`;
+const createClient = (options = {}) => {
+	const send = (url, init) => (options.fetch ?? globalThis.fetch)(url, init);
+	return { call: async (name, ...[input]) => {
+		const route = API[name];
+		const parts = input ?? {};
+		const params = Object.fromEntries(entries(parts.params));
+		const url = `${options.base ?? ""}${fillPath(route.path, params)}${queryString(parts.query)}`;
+		const headers = { accept: "application/json" };
+		if (options.token !== void 0) headers["authorization"] = `Bearer ${options.token}`;
+		const init = {
+			method: route.method,
+			headers
+		};
+		if (route.method === "POST") {
+			headers["content-type"] = "application/json";
+			init.body = JSON.stringify(parts.body ?? {});
+		}
+		let response;
+		try {
+			response = await send(url, init);
+		} catch (error) {
+			return {
+				ok: false,
+				status: 0,
+				error: `No answer: ${error instanceof Error ? error.message : String(error)}`
+			};
+		}
+		const body = await response.json().catch(() => null);
+		return response.ok ? {
+			ok: true,
+			status: response.status,
+			data: body
+		} : {
+			ok: false,
+			status: response.status,
+			error: errorOf(body, response.status)
+		};
+	} };
+};
 // ../server/src/graph.ts
 /**
 * @file A workflow or a run as the graph the UI draws: its nodes, its edges
@@ -597,13 +660,16 @@ const runGraph = (events, file) => {
 };
 // ../server/src/guards.ts
 /**
-* @file What the server lets in (ADR-039,
+* @file What the server lets in (ADR-039, RFC-019,
 *   specs/server/streams-contract-and-security.md#security): only its own
-*   loopback `Host` (against DNS rebinding); only with its token, from the
-*   session cookie or an `Authorization: Bearer` header; and, for a write sent
-*   with the cookie, only from its own `Origin` (against CSRF). The token in
-*   `?token=` is swapped once for the cookie, with a redirect that takes it out
-*   of the address bar. Pure: it reads the request's parts and decides.
+*   loopback `Host` (against DNS rebinding); only with the token in an
+*   `Authorization: Bearer` header (scripts, `ork mcp`) or the session secret
+*   in the cookie (the browser); and, for a write sent with the cookie, only
+*   from its own `Origin` (against CSRF). A single-use code in `?code=` is
+*   swapped once for the cookie, with a redirect that takes it out of the
+*   address bar; the token itself never reaches a browser. It reads the
+*   request's parts and decides; its only state is the code store it spends
+*   from.
 */
 const WRITES = /* @__PURE__ */ new Set([
 	"POST",
@@ -611,11 +677,13 @@ const WRITES = /* @__PURE__ */ new Set([
 	"PATCH",
 	"DELETE"
 ]);
+/** What a used, expired or wrong code all get, so none tells them apart. */
+const BAD_CODE = "That sign-in link is not valid any more; open it again with `ork ui`.";
 /** A new token: 32 random bytes. */
 const newToken = () => randomBytes(32).toString("base64url");
 /** The session cookie's name; one per port, as cookies ignore ports. */
 const cookieName = (port) => `ork_ui_${String(port)}`;
-/** Whether `given` is the token, compared in constant time. */
+/** Whether `given` is the token (or session secret), compared in constant time. */
 const sameToken = (given, token) => {
 	const a = Buffer.from(given);
 	const b = Buffer.from(token);
@@ -631,22 +699,22 @@ const cookieValue = (request, name) => (header(request, "cookie") ?? "").split("
 const bearer = (request) => {
 	return /^Bearer\s+(\S+)$/iu.exec(header(request, "authorization") ?? "")?.[1];
 };
-/** The session cookie that holds `token`. */
-const sessionCookie = (port, token) => `${cookieName(port)}=${token}; HttpOnly; SameSite=Strict; Path=/`;
+/** The session cookie that holds the session secret. */
+const sessionCookie = (port, session) => `${cookieName(port)}=${session}; HttpOnly; SameSite=Strict; Path=/`;
 const exchange = (request, context) => {
-	const url = new URL(request.url, "http://127.0.0.1");
-	const given = url.searchParams.get("token");
+	const url = new URL(request.url.replace(/^[/\\]+/u, "/"), "http://127.0.0.1");
+	const given = url.searchParams.get("code");
 	if (given === null || request.method !== "GET") return null;
-	if (!sameToken(given, context.token)) return {
+	if (!context.codes.redeem(given)) return {
 		kind: "refuse",
 		status: 401,
-		error: "That link's token is not this server's; open it again with `ork ui`."
+		error: BAD_CODE
 	};
-	url.searchParams.delete("token");
+	url.searchParams.delete("code");
 	return {
 		kind: "exchange",
-		cookie: sessionCookie(context.port, context.token),
-		location: `${url.pathname}${url.search}`
+		cookie: sessionCookie(context.port, context.session),
+		location: `${url.pathname.replace(/^\/+/u, "/")}${url.search}`
 	};
 };
 /** Decides whether a request may go on. */
@@ -661,15 +729,20 @@ const guard = (request, context) => {
 	if (exchanged !== null) return exchanged;
 	const fromBearer = bearer(request);
 	const fromCookie = cookieValue(request, cookieName(context.port));
+	const via = fromBearer === void 0 ? "cookie" : "bearer";
 	const given = fromBearer ?? fromCookie;
-	if (given === void 0 || !sameToken(given, context.token)) return {
+	const secret = via === "bearer" ? context.token : context.session;
+	if (given === void 0 || !sameToken(given, secret)) return {
 		kind: "refuse",
 		status: 401,
 		error: "Not signed in; open the UI with `ork ui`."
 	};
-	if (!WRITES.has(request.method)) return { kind: "pass" };
+	if (!WRITES.has(request.method)) return {
+		kind: "pass",
+		via
+	};
 	const origin = header(request, "origin");
-	if ((fromBearer === void 0 || origin !== void 0) && (origin === void 0 || !ownOrigins(context.port).includes(origin))) return {
+	if ((via === "cookie" || origin !== void 0) && (origin === void 0 || !ownOrigins(context.port).includes(origin))) return {
 		kind: "refuse",
 		status: 403,
 		error: `Origin ${origin ?? "(none)"} may not write here.`
@@ -680,7 +753,10 @@ const guard = (request, context) => {
 		status: 415,
 		error: "Send JSON (Content-Type: application/json)."
 	};
-	return { kind: "pass" };
+	return {
+		kind: "pass",
+		via
+	};
 };
 /** How often an open event stream gets a keep-alive comment. */
 const KEEP_ALIVE_MS = 15e3;
@@ -904,6 +980,15 @@ const viewOf$2 = (context, run) => {
 		paused: pausedOf(events)
 	};
 };
+/** The run's view plus its last finish's declared outputs, when it has any. */
+const viewWithOutputs = (context, run) => {
+	const finished = context.store.controlEvents(run.id).map((stored) => stored.event).findLast((event) => event.type === "run.finished");
+	const outputs = outputsText(finished?.type === "run.finished" ? finished.result.outputs : void 0);
+	return {
+		...viewOf$2(context, run),
+		...outputs.length === 0 ? {} : { outputs }
+	};
+};
 // ../server/src/mcp-answers.ts
 /**
 * @file What `ork mcp`'s tools answer with (RFC-012): a route's reply as text,
@@ -1701,6 +1786,23 @@ const projectRootOf = (context, filter) => {
 	const key = filter["project"];
 	return key === void 0 || key === "all" ? void 0 : projectOf(context, key)?.root ?? key;
 };
+/** `now` is injectable so a test can move the clock. */
+const createSignInCodes = (now = Date.now) => {
+	const expiries = /* @__PURE__ */ new Map();
+	return {
+		mint: () => {
+			for (const [code, expiry] of expiries) if (expiry <= now()) expiries.delete(code);
+			const code = randomBytes(32).toString("base64url");
+			expiries.set(code, now() + 6e4);
+			return code;
+		},
+		redeem: (code) => {
+			const expiry = expiries.get(code);
+			expiries.delete(code);
+			return expiry !== void 0 && expiry > now();
+		}
+	};
+};
 // ../server/src/workflows.ts
 /**
 * @file A project's workflows, for the UI's Run workflow dialog: each
@@ -1776,6 +1878,10 @@ const readRoutes = (context) => ({
 		pid: context.pid,
 		startedAt: context.startedAt
 	}),
+	signIn: () => ok({
+		code: context.codes.mint(),
+		expiresIn: 60
+	}),
 	projects: () => ok(context.store.projects()),
 	triggers: () => ok(triggersReport(context.store, context.store.projects(), context.home)),
 	links: ({ query }) => ok(context.store.links(query.run === void 0 ? {} : { run: query.run })),
@@ -1813,7 +1919,7 @@ const readRoutes = (context) => ({
 	},
 	run: ({ params }) => {
 		const found = runOf(context, params.id);
-		return found.ok ? ok(viewOf$2(context, found.run)) : found.refusal;
+		return found.ok ? ok(viewWithOutputs(context, found.run)) : found.refusal;
 	},
 	tree: ({ params }) => {
 		const found = runOf(context, params.id);
@@ -1876,6 +1982,8 @@ const RECENT_EVENTS = 30;
 const ANSWERED_BY_A_PERSON = "Only a person answers these: in `ork ui`, or with `ork decide` in their own terminal. Tell them what waits, and where.";
 const project = z.string().min(1).describe("A registered project's id or root");
 const run = z.string().min(1).describe("A run's id, or a unique start of it");
+/** An error answer, in the CLI's words, when `project` names none registered. */
+const unknownProject = (context, key) => key === void 0 || key === "all" || projectOf(context, key) !== void 0 ? void 0 : refused$1(unknownProjectRefusal(key, context.store.projects().map((p) => p.id)));
 const mcpTools = (context) => {
 	const read = readRoutes(context);
 	const { builderCatalog } = builderRoutes(context);
@@ -1890,13 +1998,22 @@ const mcpTools = (context) => {
 			...NO_QUERY,
 			params: { id: args.project }
 		}))),
-		tool("runs", "Runs, newest first, with their live status and cost. 10 unless a limit is given. Narrow them with `status` (running, paused, crashed, succeeded, failed, … or all), `workflow`, `project` (or all), `since` (24h, 30d, 2026-11-01, all) and `until` (a day).", RunsQuerySchema.shape, (args) => fromReply(read.runs({
-			...NO_QUERY,
-			query: {
-				limit: 10,
-				...args
-			}
-		}))),
+		tool("runs", "Runs, newest first, with their live status and cost. 10 unless a limit is given. Narrow them with `status` (running, paused, crashed, succeeded, failed, … or all), `workflow`, `project` (or all), `since` (24h, 30d, 2026-11-01, all) and `until` (a day).", {
+			...RunsQuerySchema.shape,
+			limit: z.union([z.number(), z.string()]).optional()
+		}, ({ limit, ...args }) => {
+			const bad = unknownProject(context, args.project);
+			if (bad !== void 0) return bad;
+			const count = limit === void 0 ? 10 : parseLimit(String(limit));
+			if (count === null) return refused$1(limitRefusal(String(limit)));
+			return fromReply(read.runs({
+				...NO_QUERY,
+				query: {
+					...args,
+					limit: count
+				}
+			}));
+		}),
 		tool("run", "One run: its status, what it waits on, its cost, and each node's state.", { run }, async (args) => {
 			const view = await read.run({
 				...NO_QUERY,
@@ -1926,11 +2043,11 @@ const mcpTools = (context) => {
 				}
 			}));
 		}),
-		tool("usage", "What runs spent, by workflow and model, and how close the limits are. Narrow it with `workflow`, `project` (or all), `since` and `until`: an age (24h, 30d), a day (2026-11-01) or an ISO time; `since` also takes all.", UsageQuerySchema.shape, (args) => fromReply(read.usage({
+		tool("usage", "What runs spent, by workflow and model, and how close the limits are. Narrow it with `workflow`, `project` (or all), `since` and `until`: an age (24h, 30d), a day (2026-11-01) or an ISO time; `since` also takes all.", UsageQuerySchema.shape, (args) => unknownProject(context, args.project) ?? fromReply(read.usage({
 			...NO_QUERY,
 			query: args
 		}))),
-		tool("decisions", "The decisions open in live runs, waiting on a person. This server can't answer them. Narrow them with `workflow`, `run` (an id or a start of one) and `project` (or all).", DecisionsQuerySchema.shape, (args) => fromReply(read.decisions({
+		tool("decisions", "The decisions open in live runs, waiting on a person. This server can't answer them. Narrow them with `workflow`, `run` (an id or a start of one) and `project` (or all).", DecisionsQuerySchema.shape, (args) => unknownProject(context, args.project) ?? fromReply(read.decisions({
 			...NO_QUERY,
 			query: args
 		}), (open) => ({
@@ -2042,7 +2159,8 @@ const openMcp = (options) => {
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		...options.home === void 0 ? {} : { home: options.home },
 		...options.script === void 0 ? {} : { script: options.script },
-		updates: createUpdates({ version: options.version })
+		updates: createUpdates({ version: options.version }),
+		codes: createSignInCodes()
 	};
 	return {
 		tools: [...mcpTools(context), ...actingTools(context, { start: options.start })],
@@ -2060,6 +2178,17 @@ const openMcp = (options) => {
 		}
 	};
 };
+// ../server/src/access.ts
+/**
+* @file The secrets a server starts with (RFC-019): the API token (bearer), the
+*   session secret (the browser's cookie) and the sign-in code store. Each is
+*   the caller's or a new one.
+*/
+const createAccess = (given) => ({
+	token: given.token ?? newToken(),
+	session: given.session ?? newToken(),
+	codes: given.codes ?? createSignInCodes()
+});
 // ../server/src/assets.ts
 /**
 * @file The built UI's files (`packages/ui/dist`, shipped as the CLI's
@@ -2328,7 +2457,8 @@ const feedbackRoutes = (context) => {
 		note: ({ params, body }) => {
 			const found = runOf(context, params.id);
 			if (!found.ok) return found.refusal;
-			const noted = recordNote(store, found.run, body);
+			const scrub = context.noteScrub?.(found.run, store.projects());
+			const noted = recordNote(store, found.run, body, "", scrub);
 			return noted.ok ? ok({ item: noted.item }) : fail(400, noted.error);
 		},
 		feedbackItems: ({ query }) => {
@@ -3368,7 +3498,9 @@ const createDispatch = (context, access) => {
 			headers: req.headers
 		}, {
 			port: access.port(),
-			token: access.token
+			token: access.token,
+			session: access.session,
+			codes: context.codes
 		});
 		if (verdict.kind === "refuse") {
 			if (api) sendError(res, verdict.status, verdict.error);
@@ -3383,6 +3515,10 @@ const createDispatch = (context, access) => {
 			}).end();
 			return;
 		}
+		if (url.pathname === API.signIn.path && verdict.via !== "bearer") {
+			sendError(res, 403, "Sign-in codes are minted with the API token only.");
+			return;
+		}
 		const streamed = RUN_STREAM.pattern.exec(url.pathname);
 		if (method === "GET" && streamed !== null) {
 			const id = decodeURIComponent(streamed[1] ?? "");
@@ -3471,7 +3607,13 @@ const startServer = async (options) => {
 		...options.home === void 0 ? {} : { home: options.home },
 		...options.update === void 0 ? {} : { options: options.update }
 	});
+	const { token, session, codes } = createAccess({
+		...options.token === void 0 ? {} : { token: options.token },
+		...options.sessionSecret === void 0 ? {} : { session: options.sessionSecret },
+		...options.codes === void 0 ? {} : { codes: options.codes }
+	});
 	const context = {
+		codes,
 		store,
 		version: options.version,
 		pid: process.pid,
@@ -3481,9 +3623,9 @@ const startServer = async (options) => {
 		...uiDir === void 0 ? {} : { uiDir },
 		...options.gh === void 0 ? {} : { gh: options.gh },
 		updates,
-		...options.restart === void 0 ? {} : { restart: options.restart }
+		...options.restart === void 0 ? {} : { restart: options.restart },
+		...options.noteScrub === void 0 ? {} : { noteScrub: options.noteScrub }
 	};
-	const token = options.token ?? newToken();
 	const shutdown = new AbortController();
 	const log = options.log ?? ((line) => {
 		process.stderr.write(`${line}\n`);
@@ -3492,6 +3634,7 @@ const startServer = async (options) => {
 	const handle = createDispatch(context, {
 		port: () => port,
 		token,
+		session,
 		shutdown: shutdown.signal
 	});
 	const server = createServer((req, res) => {
@@ -3549,4 +3692,4 @@ const startServer = async (options) => {
 		}
 	};
 };
-export { openMcp as a, refused$1 as c, uiFilePath as i, newToken as l, startServer as n, tool as o, runningServer as r, answer as s, DEFAULT_PORT as t };
+export { openMcp as a, refused$1 as c, uiFilePath as i, newToken as l, startServer as n, tool as o, runningServer as r, answer as s, DEFAULT_PORT as t, createClient as u };

package/dist/{store-B0nGqnPq.mjs → store-2KXzMCEN.mjs}

@@ -1,4 +1,4 @@
-import { L as openStore } from "./src-Frwpx3WF.mjs";
+import { R as openStore } from "./src-Ciy7i3se.mjs";
 // src/store.ts
 /**
 * @file Opening the user's store (`~/.ork/state.db`) for the length of one