@tabbio-technologies/cli 1.2.8

package/dist/chunks/chunk-7LNC3FIV.js

@@ -0,0 +1,2019 @@
+import { createRequire as __tabbioCreateRequire } from 'node:module';
+const require = __tabbioCreateRequire(import.meta.url);
+import {
+  activeCommandSignal
+} from "./chunk-NK5RPNSV.js";
+import {
+  WEB_PAGE_PALETTE,
+  theme
+} from "./chunk-VHHZFMIF.js";
+
+// src/core/errors.ts
+var ExitCode = {
+  Ok: 0,
+  Error: 1,
+  Usage: 2,
+  Auth: 3,
+  Forbidden: 4,
+  NotFound: 5,
+  ApprovalPending: 6,
+  Network: 7,
+  Server: 8,
+  /** SIGINT / Ctrl-C (128 + 2). */
+  Interrupted: 130
+};
+var EXIT_CODE_DOCS = [
+  { code: ExitCode.Ok, name: "Ok", meaning: "Success" },
+  { code: ExitCode.Error, name: "Error", meaning: "General failure (including a failed tool)" },
+  { code: ExitCode.Usage, name: "Usage", meaning: "Bad flags or input; missing required fields" },
+  { code: ExitCode.Auth, name: "Auth", meaning: "Not signed in, session expired or token rejected" },
+  { code: ExitCode.Forbidden, name: "Forbidden", meaning: "Not allowed (token scope, plan or permission)" },
+  { code: ExitCode.NotFound, name: "NotFound", meaning: "The tool or resource does not exist" },
+  { code: ExitCode.ApprovalPending, name: "ApprovalPending", meaning: "The action is waiting for approval" },
+  { code: ExitCode.Network, name: "Network", meaning: "Could not reach Tabbio, or timed out" },
+  { code: ExitCode.Server, name: "Server", meaning: "Tabbio failed on its side (5xx)" },
+  { code: ExitCode.Interrupted, name: "Interrupted", meaning: "Cancelled with Ctrl-C" }
+];
+var CliError = class extends Error {
+  code;
+  hint;
+  exitCode;
+  requestId;
+  status;
+  retry;
+  constructor(opts) {
+    super(opts.message, opts.cause === void 0 ? void 0 : { cause: opts.cause });
+    this.name = "CliError";
+    this.code = opts.code;
+    this.hint = opts.hint;
+    this.exitCode = opts.exitCode;
+    this.requestId = opts.requestId;
+    this.status = opts.status;
+    this.retry = opts.retry ?? (opts.exitCode === ExitCode.Network || opts.exitCode === ExitCode.Server || opts.code.toUpperCase() === "RATE_LIMIT_EXCEEDED");
+  }
+  /** Shape printed by `--json` error output. Never includes the cause. */
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      ...this.hint ? { hint: this.hint } : {},
+      exitCode: this.exitCode,
+      retry: this.retry,
+      ...this.requestId ? { requestId: this.requestId } : {},
+      ...this.status ? { status: this.status } : {}
+    };
+  }
+};
+function isCliError(value) {
+  return value instanceof CliError;
+}
+var AUTH_CODES = /* @__PURE__ */ new Set([
+  "UNAUTHORIZED",
+  "UNAUTHENTICATED",
+  "AUTH_REQUIRED",
+  "SESSION_REUSE_DETECTED",
+  "SESSION_EXPIRED",
+  "INVALID_TOKEN",
+  "TOKEN_EXPIRED",
+  "NOT_SIGNED_IN"
+]);
+var FORBIDDEN_CODES = /* @__PURE__ */ new Set([
+  "FORBIDDEN",
+  "MCP_SCOPE_FORBIDDEN",
+  "INSUFFICIENT_SCOPE",
+  "SUBSCRIPTION_ENTITLEMENT_DENIED",
+  "UPGRADE_REQUIRED",
+  "PAYMENT_REQUIRED",
+  "ENTITLEMENT_REQUIRED",
+  "QUOTA_EXCEEDED"
+]);
+var USAGE_CODES = /* @__PURE__ */ new Set(["VALIDATION_ERROR", "BAD_REQUEST", "INVALID_INPUT", "USAGE"]);
+var APPROVAL_CODES = /* @__PURE__ */ new Set(["APPROVAL_PENDING", "APPROVAL_REQUIRED"]);
+var NETWORK_CODES = /* @__PURE__ */ new Set(["NETWORK_ERROR", "TIMEOUT", "REQUEST_ABORTED"]);
+var INTERRUPT_CODES = /* @__PURE__ */ new Set(["CANCELLED", "INTERRUPTED"]);
+var SERVER_CODES = /* @__PURE__ */ new Set([
+  "INTERNAL_ERROR",
+  "SERVICE_UNAVAILABLE",
+  "DATABASE_UNAVAILABLE",
+  "BAD_RESPONSE",
+  "MCP_INTEGRATION_NOT_READY"
+]);
+function exitCodeForErrorCode(code, status) {
+  const normalized = code.trim().toUpperCase();
+  if (AUTH_CODES.has(normalized)) return ExitCode.Auth;
+  if (FORBIDDEN_CODES.has(normalized)) return ExitCode.Forbidden;
+  if (normalized === "NOT_FOUND" || normalized.endsWith("_NOT_FOUND")) return ExitCode.NotFound;
+  if (USAGE_CODES.has(normalized)) return ExitCode.Usage;
+  if (APPROVAL_CODES.has(normalized)) return ExitCode.ApprovalPending;
+  if (NETWORK_CODES.has(normalized)) return ExitCode.Network;
+  if (INTERRUPT_CODES.has(normalized)) return ExitCode.Interrupted;
+  if (SERVER_CODES.has(normalized)) return ExitCode.Server;
+  return status === void 0 ? ExitCode.Error : exitCodeForStatus(status);
+}
+function exitCodeForStatus(status) {
+  if (status === 400 || status === 422) return ExitCode.Usage;
+  if (status === 401) return ExitCode.Auth;
+  if (status === 402 || status === 403) return ExitCode.Forbidden;
+  if (status === 404) return ExitCode.NotFound;
+  if (status >= 500) return ExitCode.Server;
+  return ExitCode.Error;
+}
+function codeForStatus(status) {
+  switch (status) {
+    case 400:
+      return "BAD_REQUEST";
+    case 401:
+      return "UNAUTHORIZED";
+    case 402:
+      return "PAYMENT_REQUIRED";
+    case 403:
+      return "FORBIDDEN";
+    case 404:
+      return "NOT_FOUND";
+    case 409:
+      return "CONFLICT";
+    case 429:
+      return "RATE_LIMIT_EXCEEDED";
+    default:
+      return status >= 500 ? "INTERNAL_ERROR" : `HTTP_${status}`;
+  }
+}
+function hintForCode(code, exitCode) {
+  if (exitCode === ExitCode.Auth) return "Run `tabbio login` to sign in again.";
+  if (code === "RATE_LIMIT_EXCEEDED") return "Wait a minute and try again.";
+  if (code === "UPGRADE_REQUIRED" || code === "PAYMENT_REQUIRED" || code === "ENTITLEMENT_REQUIRED") {
+    return "This needs a higher Tabbio plan. Manage your plan in the Tabbio app.";
+  }
+  if (exitCode === ExitCode.Server) return "Tabbio had a problem on its side. Try again shortly.";
+  return void 0;
+}
+function cliErrorFromEnvelope(error, opts = {}) {
+  const code = (error.code || (opts.status ? codeForStatus(opts.status) : "ERROR")).trim();
+  const exitCode = exitCodeForErrorCode(code, opts.status);
+  return new CliError({
+    code,
+    message: error.message?.trim() || defaultMessageForCode(code),
+    hint: opts.hint ?? hintForCode(code.toUpperCase(), exitCode),
+    exitCode,
+    requestId: opts.requestId,
+    status: opts.status
+  });
+}
+function cliErrorFromStatus(status, opts = {}) {
+  return cliErrorFromEnvelope(
+    { code: codeForStatus(status), message: opts.message ?? `Request failed with HTTP ${status}` },
+    { status, requestId: opts.requestId }
+  );
+}
+function defaultMessageForCode(code) {
+  switch (code.toUpperCase()) {
+    case "UNAUTHORIZED":
+      return "You are not signed in or your session expired";
+    case "FORBIDDEN":
+      return "You do not have access to do that";
+    case "NOT_FOUND":
+      return "Not found";
+    default:
+      return `Request failed (${code})`;
+  }
+}
+function notSignedInError(profile) {
+  return new CliError({
+    code: "NOT_SIGNED_IN",
+    message: `Not signed in (profile "${profile}")`,
+    hint: "Run `tabbio login` to sign in.",
+    exitCode: ExitCode.Auth
+  });
+}
+function needsFullSignInError(feature) {
+  return new CliError({
+    code: "FULL_SIGN_IN_REQUIRED",
+    message: `${feature} needs a full sign-in; a personal MCP token only works for tool commands`,
+    hint: "Run `tabbio login` (browser) or `tabbio login --email you@example.com`.",
+    exitCode: ExitCode.Auth
+  });
+}
+function interruptedError(message = "Cancelled") {
+  return new CliError({ code: "CANCELLED", message, exitCode: ExitCode.Interrupted, retry: false });
+}
+function usageError(message, hint) {
+  return new CliError({ code: "USAGE", message, hint, exitCode: ExitCode.Usage });
+}
+function networkError(url, cause) {
+  const timedOut = cause instanceof Error && (cause.name === "TimeoutError" || cause.name === "AbortError");
+  let host = url;
+  try {
+    host = new URL(url).host;
+  } catch {
+  }
+  return new CliError({
+    code: timedOut ? "TIMEOUT" : "NETWORK_ERROR",
+    message: timedOut ? `Timed out talking to ${host}` : `Could not reach ${host}`,
+    hint: "Check your connection, or the API URL with `tabbio status` / `tabbio doctor`.",
+    exitCode: ExitCode.Network,
+    cause
+  });
+}
+function toCliError(value) {
+  if (value instanceof CliError) return value;
+  if (value instanceof Error) {
+    return new CliError({
+      code: "UNEXPECTED",
+      message: value.message || "Unexpected error",
+      exitCode: ExitCode.Error,
+      cause: value
+    });
+  }
+  return new CliError({ code: "UNEXPECTED", message: String(value), exitCode: ExitCode.Error });
+}
+
+// src/core/io.ts
+function writeOut(text = "") {
+  process.stdout.write(`${text}
+`);
+}
+function printJson(value) {
+  const pretty = Boolean(process.stdout.isTTY);
+  process.stdout.write(`${JSON.stringify(value, null, pretty ? 2 : 0)}
+`);
+}
+function formatKeyValues(rows) {
+  const visible = rows.filter(([, value]) => value !== void 0 && value !== null && value !== "");
+  const width = Math.max(0, ...visible.map(([label]) => label.length));
+  return visible.map(([label, value]) => `${theme.dim(label.padEnd(width))}  ${String(value)}`);
+}
+function printKeyValues(rows) {
+  for (const line of formatKeyValues(rows)) writeOut(line);
+}
+function successLine(message) {
+  return `${theme.success(theme.symbols.success)} ${message}`;
+}
+function heading(text) {
+  return theme.bold(text);
+}
+function relativeTime(date, now = Date.now()) {
+  const diff = date.getTime() - now;
+  const abs = Math.abs(diff);
+  const units = [
+    [864e5, "d"],
+    [36e5, "h"],
+    [6e4, "m"],
+    [1e3, "s"]
+  ];
+  for (const [ms, unit] of units) {
+    if (abs >= ms) {
+      const value = Math.floor(abs / ms);
+      return diff < 0 ? `${value}${unit} ago` : `in ${value}${unit}`;
+    }
+  }
+  return "just now";
+}
+
+// src/core/config.ts
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { z } from "zod";
+
+// src/core/fs-atomic.ts
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { dirname } from "node:path";
+var PRIVATE_DIR_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var isWindows = process.platform === "win32";
+function ensurePrivateDir(dir, mode = PRIVATE_DIR_MODE) {
+  mkdirSync(dir, { recursive: true, mode });
+  if (!isWindows) {
+    const current = statSync(dir).mode & 511;
+    if (current !== mode) chmodSync(dir, mode);
+  }
+}
+function writeFileAtomic(file, content, mode = PRIVATE_FILE_MODE) {
+  ensurePrivateDir(dirname(file));
+  const tmp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  let fd;
+  try {
+    fd = openSync(tmp, "wx", mode);
+    writeSync(fd, content);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = void 0;
+    if (!isWindows) chmodSync(tmp, mode);
+    renameSync(tmp, file);
+  } catch (error) {
+    if (fd !== void 0) closeSync(fd);
+    rmSync(tmp, { force: true });
+    throw error;
+  }
+}
+function readFileIfExists(file) {
+  try {
+    return readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function permissionBits(path) {
+  if (!existsSync(path)) return null;
+  return statSync(path).mode & 511;
+}
+var LOCK_STALE_MS = 3e4;
+var LOCK_WAIT_MS = 15e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withFileLock(lockFile, fn) {
+  ensurePrivateDir(dirname(lockFile));
+  const started = Date.now();
+  let fd;
+  while (fd === void 0) {
+    try {
+      fd = openSync(lockFile, "wx", PRIVATE_FILE_MODE);
+      writeSync(fd, String(process.pid));
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const age = Date.now() - statSync(lockFile).mtimeMs;
+        if (age > LOCK_STALE_MS) {
+          unlinkSync(lockFile);
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - started > LOCK_WAIT_MS) {
+        throw new Error(`Timed out waiting for ${lockFile}`);
+      }
+      await sleep(50 + Math.floor(Math.random() * 50));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    closeSync(fd);
+    rmSync(lockFile, { force: true });
+  }
+}
+
+// src/core/config.ts
+var DEFAULT_PROFILE = "default";
+var PRODUCTION_API_URL = "https://server.tabbio.com";
+var PRODUCTION_APP_URL = "https://app.tabbio.com";
+var MCP_PATH = "/api/mcp";
+var PROFILE_PRESETS = {
+  [DEFAULT_PROFILE]: { apiUrl: PRODUCTION_API_URL, appUrl: PRODUCTION_APP_URL },
+  local: { apiUrl: "http://localhost:3001", appUrl: "http://localhost:8081" }
+};
+var profileConfigSchema = z.object({
+  apiUrl: z.string().optional(),
+  appUrl: z.string().optional(),
+  mcpUrl: z.string().optional()
+}).passthrough();
+var configSchema = z.object({
+  version: z.literal(1).default(1),
+  currentProfile: z.string().optional(),
+  profiles: z.record(profileConfigSchema).default({}),
+  /** Set to false to disable the once-a-day npm update check. */
+  updateCheck: z.boolean().optional()
+}).passthrough();
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/;
+function env(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function absoluteEnvDir(name) {
+  const value = env(name);
+  return value && isAbsolute(value) ? value : void 0;
+}
+function configPaths() {
+  const explicit = env("TABBIO_CONFIG_DIR");
+  const dir = explicit ?? join(absoluteEnvDir("XDG_CONFIG_HOME") ?? join(homedir(), ".config"), "tabbio");
+  const cacheDir = env("TABBIO_CACHE_DIR") ?? (explicit ? join(dir, "cache") : join(absoluteEnvDir("XDG_CACHE_HOME") ?? join(homedir(), ".cache"), "tabbio"));
+  return {
+    dir,
+    configFile: join(dir, "config.json"),
+    credentialsFile: join(dir, "credentials.json"),
+    cacheDir
+  };
+}
+function emptyConfig() {
+  return { version: 1, profiles: {} };
+}
+function loadConfig() {
+  const { configFile } = configPaths();
+  const raw = readFileIfExists(configFile);
+  if (raw === null || raw.trim() === "") return emptyConfig();
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (error) {
+    throw new CliError({
+      code: "CONFIG_INVALID",
+      message: `Config file is not valid JSON: ${configFile}`,
+      hint: "Fix the file or delete it to start fresh.",
+      exitCode: ExitCode.Usage,
+      cause: error
+    });
+  }
+  const parsed = configSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new CliError({
+      code: "CONFIG_INVALID",
+      message: `Config file has an unexpected shape: ${configFile}`,
+      hint: parsed.error.errors[0]?.message ?? "Fix the file or delete it to start fresh.",
+      exitCode: ExitCode.Usage
+    });
+  }
+  return parsed.data;
+}
+function saveConfig(c) {
+  const { configFile } = configPaths();
+  writeFileAtomic(configFile, `${JSON.stringify(configSchema.parse(c), null, 2)}
+`);
+}
+function updateConfig(mutate) {
+  const config = loadConfig();
+  mutate(config);
+  saveConfig(config);
+  return config;
+}
+function assertProfileName(name) {
+  const trimmed = name.trim();
+  if (!PROFILE_NAME_PATTERN.test(trimmed)) {
+    throw usageError(
+      `Invalid profile name "${name}"`,
+      'Use 1-32 letters, digits, "-" or "_", starting with a letter or digit.'
+    );
+  }
+  return trimmed;
+}
+function isLoopbackHost(hostname2) {
+  const host = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || /^127\./.test(host);
+}
+function normalizeBaseUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw usageError(`${label} is not a valid URL: ${value}`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw usageError(`${label} must use http or https: ${value}`);
+  }
+  if (url.username || url.password) {
+    throw usageError(`${label} must not contain credentials`);
+  }
+  if (url.protocol === "http:" && !isLoopbackHost(url.hostname) && env("TABBIO_ALLOW_INSECURE_HTTP") !== "1") {
+    throw usageError(
+      `${label} must use https for non-local hosts: ${value}`,
+      "Set TABBIO_ALLOW_INSECURE_HTTP=1 only for trusted development networks."
+    );
+  }
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/+$/, "");
+}
+function resolveProfileName(opts = {}, config) {
+  if (opts.profile?.trim()) return { name: assertProfileName(opts.profile), source: "flag" };
+  const fromEnv = env("TABBIO_PROFILE");
+  if (fromEnv) return { name: assertProfileName(fromEnv), source: "env" };
+  const current = (config ?? loadConfig()).currentProfile;
+  if (current?.trim()) return { name: assertProfileName(current), source: "config" };
+  return { name: DEFAULT_PROFILE, source: "default" };
+}
+function resolveProfileWithSources(opts = {}) {
+  const config = loadConfig();
+  const { name, source: nameSource } = resolveProfileName(opts, config);
+  const stored = config.profiles[name] ?? {};
+  const preset = PROFILE_PRESETS[name] ?? PROFILE_PRESETS[DEFAULT_PROFILE];
+  const pick = (flag, envName, fromConfig, fallback) => {
+    if (flag?.trim()) return [flag, "flag"];
+    const fromEnv = env(envName);
+    if (fromEnv) return [fromEnv, "env"];
+    if (fromConfig?.trim()) return [fromConfig, "config"];
+    return [fallback, PROFILE_PRESETS[name] && name !== DEFAULT_PROFILE ? "preset" : "default"];
+  };
+  const [apiRaw, apiSource] = pick(opts.apiUrl, "TABBIO_API_URL", stored.apiUrl, preset.apiUrl);
+  const [appRaw, appSource] = pick(opts.appUrl, "TABBIO_APP_URL", stored.appUrl, preset.appUrl);
+  const apiUrl = normalizeBaseUrl(apiRaw, "API URL");
+  const appUrl = normalizeBaseUrl(appRaw, "App URL");
+  let mcpUrl = `${apiUrl}${MCP_PATH}`;
+  let mcpSource = "derived";
+  const envMcp = env("TABBIO_MCP_URL");
+  if (envMcp) {
+    mcpUrl = normalizeBaseUrl(envMcp, "MCP URL");
+    mcpSource = "env";
+  } else if (stored.mcpUrl?.trim() && apiSource !== "flag" && apiSource !== "env") {
+    mcpUrl = normalizeBaseUrl(stored.mcpUrl, "MCP URL");
+    mcpSource = "config";
+  }
+  return {
+    profile: { name, apiUrl, appUrl, mcpUrl },
+    sources: { name: nameSource, apiUrl: apiSource, appUrl: appSource, mcpUrl: mcpSource }
+  };
+}
+function resolveProfile(opts = {}) {
+  return resolveProfileWithSources(opts).profile;
+}
+function listProfileNames(config = loadConfig()) {
+  return Array.from(/* @__PURE__ */ new Set([...Object.keys(PROFILE_PRESETS), ...Object.keys(config.profiles)])).sort();
+}
+
+// src/core/credentials.ts
+import { join as join2 } from "node:path";
+import { z as z2 } from "zod";
+var storedCredentialsSchema = z2.object({
+  accessToken: z2.string().optional(),
+  accessTokenExpiresAt: z2.string().optional(),
+  refreshToken: z2.string().optional(),
+  mcpToken: z2.string().optional(),
+  user: z2.object({ id: z2.string(), email: z2.string(), name: z2.string().nullable().optional() }).optional(),
+  savedAt: z2.string().optional()
+}).passthrough();
+var credentialsFileSchema = z2.object({
+  version: z2.literal(1).default(1),
+  profiles: z2.record(storedCredentialsSchema).default({})
+});
+function env2(name) {
+  const value = process.env[name]?.trim();
+  return value ? value : void 0;
+}
+function readStore() {
+  const { credentialsFile } = configPaths();
+  const raw = readFileIfExists(credentialsFile);
+  if (raw === null || raw.trim() === "") return { version: 1, profiles: {} };
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (error) {
+    throw new CliError({
+      code: "CREDENTIALS_INVALID",
+      message: `Credential store is corrupted: ${credentialsFile}`,
+      hint: "Delete the file and run `tabbio login` again.",
+      exitCode: ExitCode.Auth,
+      cause: error
+    });
+  }
+  const parsed = credentialsFileSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new CliError({
+      code: "CREDENTIALS_INVALID",
+      message: `Credential store has an unexpected shape: ${credentialsFile}`,
+      hint: "Delete the file and run `tabbio login` again.",
+      exitCode: ExitCode.Auth
+    });
+  }
+  return parsed.data;
+}
+function writeStore(store) {
+  const { credentialsFile } = configPaths();
+  writeFileAtomic(credentialsFile, `${JSON.stringify(store, null, 2)}
+`, PRIVATE_FILE_MODE);
+}
+function toCredentials(profile, stored) {
+  return {
+    profile,
+    ...stored.accessToken ? { accessToken: stored.accessToken } : {},
+    ...stored.accessTokenExpiresAt ? { accessTokenExpiresAt: stored.accessTokenExpiresAt } : {},
+    ...stored.refreshToken ? { refreshToken: stored.refreshToken } : {},
+    ...stored.mcpToken ? { mcpToken: stored.mcpToken } : {},
+    ...stored.user ? { user: stored.user } : {}
+  };
+}
+function loadStoredCredentials(profile) {
+  const stored = readStore().profiles[profile];
+  if (!stored) return null;
+  const creds = toCredentials(profile, stored);
+  creds.origin = {
+    ...creds.accessToken ? { accessToken: "store" } : {},
+    ...creds.mcpToken ? { mcpToken: "store" } : {}
+  };
+  return creds;
+}
+function loadCredentials(profile) {
+  const stored = loadStoredCredentials(profile);
+  const envMcp = env2("TABBIO_TOKEN");
+  const envAccess = env2("TABBIO_ACCESS_TOKEN");
+  if (!stored && !envMcp && !envAccess) return null;
+  const creds = stored ?? { profile, origin: {} };
+  creds.origin = { ...creds.origin };
+  if (envMcp) {
+    creds.mcpToken = envMcp;
+    creds.origin.mcpToken = "env";
+  }
+  if (envAccess) {
+    creds.accessToken = envAccess;
+    delete creds.accessTokenExpiresAt;
+    delete creds.refreshToken;
+    creds.origin.accessToken = "env";
+  }
+  return creds;
+}
+function saveCredentials(c) {
+  const store = readStore();
+  const next = { savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const envMcp = env2("TABBIO_TOKEN");
+  const envAccess = env2("TABBIO_ACCESS_TOKEN");
+  const accessFromEnv = c.origin?.accessToken === "env" || envAccess && c.accessToken === envAccess;
+  const mcpFromEnv = c.origin?.mcpToken === "env" || envMcp && c.mcpToken === envMcp;
+  if (c.accessToken && !accessFromEnv) {
+    next.accessToken = c.accessToken;
+    if (c.accessTokenExpiresAt) next.accessTokenExpiresAt = c.accessTokenExpiresAt;
+  }
+  if (c.refreshToken) next.refreshToken = c.refreshToken;
+  if (c.mcpToken && !mcpFromEnv) next.mcpToken = c.mcpToken;
+  if (c.user) next.user = { id: c.user.id, email: c.user.email, name: c.user.name ?? null };
+  const previous = store.profiles[c.profile];
+  if (previous && accessFromEnv && previous.accessToken && !next.accessToken) {
+    next.accessToken = previous.accessToken;
+    if (previous.accessTokenExpiresAt) next.accessTokenExpiresAt = previous.accessTokenExpiresAt;
+    if (!next.refreshToken && previous.refreshToken) next.refreshToken = previous.refreshToken;
+  }
+  if (previous && mcpFromEnv && previous.mcpToken && !next.mcpToken) next.mcpToken = previous.mcpToken;
+  store.profiles[c.profile] = next;
+  writeStore(store);
+}
+function clearCredentials(profile) {
+  const store = readStore();
+  if (!(profile in store.profiles)) return;
+  delete store.profiles[profile];
+  writeStore(store);
+}
+function listCredentialProfiles() {
+  return Object.keys(readStore().profiles).sort();
+}
+function withCredentialsLock(fn) {
+  return withFileLock(join2(configPaths().dir, "credentials.lock"), fn);
+}
+function credentialPermissionIssues() {
+  if (process.platform === "win32") return [];
+  const { dir, credentialsFile } = configPaths();
+  const issues = [];
+  const dirBits = permissionBits(dir);
+  if (dirBits !== null && (dirBits & 63) !== 0) {
+    issues.push(`${dir} is mode ${dirBits.toString(8)} (expected ${PRIVATE_DIR_MODE.toString(8)})`);
+  }
+  const fileBits = permissionBits(credentialsFile);
+  if (fileBits !== null && (fileBits & 63) !== 0) {
+    issues.push(
+      `${credentialsFile} is mode ${fileBits.toString(8)} (expected ${PRIVATE_FILE_MODE.toString(8)})`
+    );
+  }
+  return issues;
+}
+var KNOWN_PREFIXES = ["tabbio_mcp_"];
+function fingerprint(secret) {
+  const value = secret.trim();
+  if (value.length < 16) return "\u2026";
+  const prefix = KNOWN_PREFIXES.find((p) => value.startsWith(p)) ?? value.slice(0, 3);
+  return `${prefix}\u2026${value.slice(-4)}`;
+}
+var SECRET_JSON_KEYS = /("(?:accessToken|refreshToken|token|secret|mcpToken|otp|code|password|cookie|authorization)"\s*:\s*")([^"]*)(")/gi;
+function redactSecrets(text) {
+  return text.replace(/(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, "$1[redacted]").replace(/tabbio_mcp_[A-Za-z0-9_-]+/g, "tabbio_mcp_[redacted]").replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-jwt]").replace(SECRET_JSON_KEYS, "$1[redacted]$3").replace(/((?:^|[?&;\s])(?:code|state|token|refreshToken|otp)=)[^&\s;]+/gi, "$1[redacted]").replace(/((?:__Secure-|__Host-)?better-auth\.[a-z_]+=)[^;\s]+/gi, "$1[redacted]");
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    for (const key of Array.from(parsed.searchParams.keys())) {
+      if (/code|state|token|otp|secret/i.test(key)) parsed.searchParams.set(key, "[redacted]");
+    }
+    return parsed.toString();
+  } catch {
+    return redactSecrets(url);
+  }
+}
+
+// src/core/runtime.ts
+import { hostname } from "node:os";
+var DEFAULT_GLOBALS = {
+  json: false,
+  color: true,
+  debug: false,
+  yes: false,
+  quiet: false
+};
+var globals = { ...DEFAULT_GLOBALS, debug: process.env.TABBIO_DEBUG === "1" };
+function setGlobalOptions(partial) {
+  globals = { ...globals, ...partial };
+  return globals;
+}
+function getGlobalOptions() {
+  return globals;
+}
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY) && !process.env.CI;
+}
+function deviceLabel() {
+  const raw = process.env.TABBIO_DEVICE_LABEL?.trim() || hostname() || "unknown-host";
+  const clean = raw.replace(/\.local$/i, "").replace(/[^\x20-\x7E]/g, "").trim();
+  return (clean || "unknown-host").slice(0, 64);
+}
+function debug(message) {
+  if (!globals.debug) return;
+  process.stderr.write(`${theme.dim(`[debug] ${redactSecrets(message)}`)}
+`);
+}
+function info(message) {
+  if (globals.quiet) return;
+  process.stderr.write(`${message}
+`);
+}
+function warn(message, hint) {
+  process.stderr.write(`${theme.warn(`${theme.symbols.warning} ${message}`)}
+`);
+  if (hint) process.stderr.write(`  ${theme.dim(hint)}
+`);
+}
+
+// src/core/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+var CLI_VERSION = true ? "1.2.8" : readPackageField("version") ?? "0.0.0-dev";
+var CLI_PACKAGE_NAME = true ? "@tabbio-technologies/cli" : readPackageField("name") ?? "@tabbio-technologies/cli";
+function userAgent() {
+  return `tabbio-cli/${CLI_VERSION} node/${process.versions.node} ${process.platform}-${process.arch}`;
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const [core = "", pre] = v.trim().replace(/^v/, "").split("-", 2);
+    const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    return { nums: [nums[0] ?? 0, nums[1] ?? 0, nums[2] ?? 0], pre };
+  };
+  const left = parse(a);
+  const right = parse(b);
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);
+    if (diff !== 0) return diff > 0 ? 1 : -1;
+  }
+  if (left.pre && !right.pre) return -1;
+  if (!left.pre && right.pre) return 1;
+  return 0;
+}
+var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+var UPDATE_CHECK_TIMEOUT_MS = 1e3;
+function updateChecksDisabled() {
+  if (process.env.TABBIO_NO_UPDATE_CHECK || process.env.CI) return true;
+  if (!process.stderr.isTTY) return true;
+  try {
+    return loadConfig().updateCheck === false;
+  } catch {
+    return true;
+  }
+}
+function cacheFile() {
+  return join3(configPaths().cacheDir, "update-check.json");
+}
+function readUpdateCache() {
+  try {
+    const raw = readFileIfExists(cacheFile());
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+async function checkForUpdate(opts = {}) {
+  if (updateChecksDisabled()) return null;
+  const now = opts.now ?? Date.now();
+  let cache = readUpdateCache();
+  const stale = !cache || now - Date.parse(cache.checkedAt) > UPDATE_CHECK_TTL_MS;
+  if (stale) {
+    let latest2 = null;
+    try {
+      const response = await (opts.fetch ?? fetch)(
+        `https://registry.npmjs.org/${CLI_PACKAGE_NAME}/latest`,
+        { signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS), headers: { accept: "application/json" } }
+      );
+      if (response.ok) {
+        const body = await response.json();
+        latest2 = typeof body.version === "string" ? body.version : null;
+      }
+    } catch {
+      latest2 = cache?.latest ?? null;
+    }
+    cache = { checkedAt: new Date(now).toISOString(), latest: latest2 };
+    try {
+      writeFileAtomic(cacheFile(), JSON.stringify(cache), 384);
+    } catch {
+    }
+  }
+  const latest = cache?.latest;
+  return latest && compareVersions(latest, CLI_VERSION) > 0 ? latest : null;
+}
+
+// src/core/mcp.ts
+import { createHash } from "node:crypto";
+import { readdirSync, rmSync as rmSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+// src/core/catalog.ts
+var HIDDEN_TOOL_IDS = /* @__PURE__ */ new Set(["mcp.approvalStatus"]);
+var COMMAND_PATH_OVERRIDES = {
+  publishArtifact: ["site", "publish"],
+  unpublishArtifact: ["site", "unpublish"]
+};
+var PRIMARY_AGENT_KEY = "tabbio";
+function kebabCase(value) {
+  return value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/[\s_.]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function toSchema(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) return value;
+  return { type: "object", properties: {} };
+}
+function commandPathFor(id, mcpName = id) {
+  const agent = /^ask_(.+)$/.exec(mcpName);
+  if (agent?.[1]) {
+    const key = agent[1];
+    if (key === PRIMARY_AGENT_KEY) {
+      return { kind: "agent", group: "ask", action: "", commandPath: ["ask"], key };
+    }
+    const action2 = kebabCase(key);
+    return { kind: "agent", group: "ask", action: action2, commandPath: ["ask", action2], key };
+  }
+  const workflow = /^run_(.+)$/.exec(mcpName);
+  if (workflow?.[1]) {
+    const key = workflow[1];
+    const action2 = kebabCase(key);
+    return {
+      kind: "workflow",
+      group: "workflows",
+      action: action2,
+      commandPath: ["workflows", "run", action2],
+      key
+    };
+  }
+  const override = COMMAND_PATH_OVERRIDES[id];
+  if (override) {
+    const [group, action2] = override;
+    return { kind: "tool", group, action: action2, commandPath: [group, action2] };
+  }
+  const segments = id.split(".").filter(Boolean);
+  if (segments.length >= 2) {
+    const group = kebabCase(segments[0]);
+    const action2 = segments.slice(1).map(kebabCase).join("-");
+    return { kind: "tool", group, action: action2, commandPath: [group, action2] };
+  }
+  const action = kebabCase(id);
+  return { kind: "tool", group: "misc", action, commandPath: ["misc", action] };
+}
+function normalizeTool(raw) {
+  const meta = raw._meta ?? {};
+  const annotations = raw.annotations ?? {};
+  const mcpName = raw.name;
+  const id = readString(meta.tabbioToolId) ?? mcpName;
+  const placement = commandPathFor(id, mcpName);
+  const title = readString(annotations.title) ?? readString(raw.title) ?? (placement.kind === "workflow" ? `Run workflow ${placement.action}` : placement.kind === "agent" ? `Ask ${placement.key ?? "Tabbio"}` : id);
+  return {
+    id,
+    mcpName,
+    title,
+    description: readString(raw.description) ?? "",
+    readOnly: annotations.readOnlyHint === true,
+    inputSchema: toSchema(raw.inputSchema),
+    kind: placement.kind,
+    group: placement.group,
+    action: placement.action,
+    commandPath: placement.commandPath,
+    hidden: HIDDEN_TOOL_IDS.has(id),
+    annotations: { ...annotations },
+    ...placement.key ? { key: placement.key } : {}
+  };
+}
+function buildCatalog(rawTools) {
+  return rawTools.filter((tool) => typeof tool?.name === "string" && tool.name.length > 0).map(normalizeTool).sort((a, b) => a.commandPath.join(" ").localeCompare(b.commandPath.join(" ")));
+}
+function findTool(tools, ref) {
+  const needle = ref.trim();
+  if (!needle) return void 0;
+  const exact = tools.find((t) => t.id === needle || t.mcpName === needle);
+  if (exact) return exact;
+  const lower = needle.toLowerCase();
+  const asPath = lower.split(/[\s:.]+/).filter(Boolean).map(kebabCase).join(" ");
+  return tools.find(
+    (t) => t.id.toLowerCase() === lower || t.commandPath.join(" ") === asPath || [t.group, t.action].filter(Boolean).join(" ") === asPath || t.kind === "workflow" && (t.action === asPath || t.key?.toLowerCase() === lower)
+  );
+}
+function groupCatalog(tools) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    const list = groups.get(tool.group) ?? [];
+    list.push(tool);
+    groups.set(tool.group, list);
+  }
+  return groups;
+}
+
+// src/core/http.ts
+var CLIENT_PLATFORM = "cli";
+var CLIENT_PLATFORM_HEADER = "x-tabbio-client-platform";
+var DEVICE_LABEL_HEADER = "x-tabbio-device-label";
+var REFRESH_SKEW_MS = 5 * 60 * 1e3;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([502, 503, 504]);
+var MAX_RETRIES = 2;
+var REQUEST_ID_HEADERS = ["x-request-id", "x-railway-request-id", "x-vercel-id", "cf-ray"];
+function readRequestId(headers) {
+  for (const name of REQUEST_ID_HEADERS) {
+    const value = headers.get(name);
+    if (value) return value;
+  }
+  return void 0;
+}
+function baseHeaders() {
+  return {
+    [CLIENT_PLATFORM_HEADER]: CLIENT_PLATFORM,
+    [DEVICE_LABEL_HEADER]: deviceLabel(),
+    "user-agent": userAgent()
+  };
+}
+function isEnvelope(value) {
+  return typeof value === "object" && value !== null && "data" in value && "error" in value;
+}
+function isExpiringSoon(creds, now = Date.now()) {
+  if (!creds.accessTokenExpiresAt) return false;
+  const expiresAt = Date.parse(creds.accessTokenExpiresAt);
+  return Number.isFinite(expiresAt) && expiresAt - now < REFRESH_SKEW_MS;
+}
+var sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function combineSignals(...signals) {
+  const present = signals.filter((s) => Boolean(s));
+  if (present.length === 1) return present[0];
+  const controller = new AbortController();
+  for (const signal of present) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+var ApiClient = class {
+  constructor(profile, creds, opts = {}) {
+    this.profile = profile;
+    this.creds = creds ? { ...creds } : null;
+    this.opts = opts;
+    this.fetchImpl = opts.fetch ?? ((...args) => fetch(...args));
+  }
+  creds;
+  fetchImpl;
+  opts;
+  refreshing = null;
+  /** Request id of the most recent response, when the server sent one. */
+  lastRequestId;
+  get credentials() {
+    return this.creds;
+  }
+  /** JSON request; unwraps the `{ data, error, meta }` envelope or throws CliError. */
+  async json(path, init = {}) {
+    return (await this.request(path, init)).data;
+  }
+  /** Like json() but also returns meta, status and request id. */
+  async request(path, init = {}) {
+    const headers = { accept: "application/json", ...init.headers };
+    let body;
+    if (init.body !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(init.body);
+    }
+    const response = await this.raw(path, {
+      method: init.method ?? "GET",
+      headers,
+      body,
+      auth: init.auth,
+      timeoutMs: init.timeoutMs,
+      signal: init.signal
+    });
+    return parseJsonResponse(response);
+  }
+  /** Low-level fetch with CLI headers, auth, refresh-on-401 and GET retries. */
+  async raw(path, init = {}) {
+    if (!path.startsWith("/")) throw new Error(`API path must start with "/": ${path}`);
+    const { auth = "jwt", timeoutMs, ...requestInit } = init;
+    const method = (requestInit.method ?? "GET").toUpperCase();
+    const url = `${this.profile.apiUrl}${path}`;
+    const idempotent = method === "GET" || method === "HEAD";
+    let token = auth === "jwt" ? await this.ensureAccessToken() : void 0;
+    let refreshed = false;
+    let attempt = 0;
+    for (; ; ) {
+      const headers = new Headers(requestInit.headers);
+      for (const [key, value] of Object.entries(baseHeaders())) {
+        if (!headers.has(key)) headers.set(key, value);
+      }
+      if (token) headers.set("authorization", `Bearer ${token}`);
+      const signal = combineSignals(
+        activeCommandSignal,
+        AbortSignal.timeout(timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        requestInit.signal ?? void 0
+      );
+      const started = Date.now();
+      debug(`\u2192 ${method} ${redactUrl(url)}`);
+      let response;
+      try {
+        response = await this.fetchImpl(url, {
+          ...requestInit,
+          method,
+          headers,
+          signal
+        });
+      } catch (error) {
+        if (activeCommandSignal.aborted || requestInit.signal?.aborted) throw error;
+        debug(`\u2717 ${method} ${redactUrl(url)} ${error.message} ${Date.now() - started}ms`);
+        if (idempotent && attempt < MAX_RETRIES) {
+          attempt += 1;
+          await sleep2(this.backoff(attempt));
+          continue;
+        }
+        throw networkError(url, error);
+      }
+      const requestId = readRequestId(response.headers);
+      if (requestId) this.lastRequestId = requestId;
+      debug(
+        `\u2190 ${response.status} ${method} ${redactUrl(url)} ${Date.now() - started}ms${requestId ? ` req=${requestId}` : ""}`
+      );
+      if (idempotent && RETRYABLE_STATUS.has(response.status) && attempt < MAX_RETRIES) {
+        attempt += 1;
+        await response.body?.cancel().catch(() => void 0);
+        await sleep2(this.backoff(attempt));
+        continue;
+      }
+      if (response.status === 401 && auth === "jwt" && !refreshed && this.canRefresh()) {
+        refreshed = true;
+        await response.body?.cancel().catch(() => void 0);
+        token = await this.refresh();
+        continue;
+      }
+      return response;
+    }
+  }
+  /**
+   * Returns a usable access token, refreshing first when it expires within
+   * five minutes. Throws CliError (exit 3) when there is no JWT session.
+   */
+  async ensureAccessToken() {
+    const creds = this.creds;
+    if (!creds?.accessToken) {
+      if (creds?.mcpToken) throw needsFullSignInError("This command");
+      throw notSignedInError(this.profile.name);
+    }
+    if (isExpiringSoon(creds) && this.canRefresh()) return this.refresh();
+    return creds.accessToken;
+  }
+  /**
+   * Rotates the refresh token once. The rotated token is persisted atomically
+   * before it is used, under a cross-process lock; if another process already
+   * rotated it, its result is adopted instead of refreshing twice (which the
+   * server would treat as token reuse and revoke the session family).
+   */
+  refresh() {
+    if (!this.refreshing) {
+      this.refreshing = this.doRefresh().finally(() => {
+        this.refreshing = null;
+      });
+    }
+    return this.refreshing;
+  }
+  canRefresh() {
+    return Boolean(this.creds?.refreshToken);
+  }
+  backoff(attempt) {
+    const base = this.opts.retryDelayMs ?? 300;
+    return base * 3 ** (attempt - 1) + (base ? Math.floor(Math.random() * base) : 0);
+  }
+  async doRefresh() {
+    const persist = this.opts.persist !== false;
+    const run = async () => {
+      const current = this.creds;
+      if (!current?.refreshToken) throw notSignedInError(this.profile.name);
+      if (persist) {
+        const onDisk = loadStoredCredentials(this.profile.name);
+        if (onDisk?.refreshToken && onDisk.refreshToken !== current.refreshToken && onDisk.accessToken && !isExpiringSoon(onDisk)) {
+          debug("adopting credentials refreshed by another tabbio process");
+          this.creds = { ...current, ...onDisk, origin: current.origin };
+          return onDisk.accessToken;
+        }
+      }
+      let payload;
+      try {
+        payload = await this.json("/api/auth/tokens/refresh", {
+          method: "POST",
+          body: { refreshToken: current.refreshToken },
+          auth: "none"
+        });
+      } catch (error) {
+        if (error instanceof CliError && error.exitCode !== ExitCode.Network) {
+          throw new CliError({
+            code: error.code === "SESSION_REUSE_DETECTED" ? error.code : "SESSION_EXPIRED",
+            message: "Your Tabbio session has expired",
+            hint: "Run `tabbio login` to sign in again.",
+            exitCode: ExitCode.Auth,
+            requestId: error.requestId,
+            cause: error
+          });
+        }
+        throw error;
+      }
+      const next = {
+        ...current,
+        accessToken: payload.accessToken,
+        accessTokenExpiresAt: payload.accessTokenExpiresAt,
+        refreshToken: payload.refreshToken ?? current.refreshToken,
+        user: payload.user ? { id: payload.user.id, email: payload.user.email, name: payload.user.name ?? null } : current.user,
+        origin: { ...current.origin, accessToken: "store" }
+      };
+      if (persist) saveCredentials(next);
+      this.creds = next;
+      this.opts.onCredentialsChange?.(next);
+      return payload.accessToken;
+    };
+    return persist ? withCredentialsLock(run) : run();
+  }
+};
+async function parseJsonResponse(response) {
+  const requestId = readRequestId(response.headers);
+  const text = await response.text();
+  let parsed = void 0;
+  if (text.trim()) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      if (!response.ok) throw cliErrorFromStatus(response.status, { requestId });
+      throw new CliError({
+        code: "BAD_RESPONSE",
+        message: "Tabbio sent a response the CLI could not read",
+        exitCode: ExitCode.Server,
+        status: response.status,
+        requestId
+      });
+    }
+  }
+  if (isEnvelope(parsed)) {
+    if (parsed.error) {
+      throw cliErrorFromEnvelope(parsed.error, { status: response.status, requestId });
+    }
+    if (!response.ok) throw cliErrorFromStatus(response.status, { requestId });
+    return { data: parsed.data, meta: parsed.meta ?? null, status: response.status, requestId };
+  }
+  if (!response.ok) {
+    const record = parsed ?? {};
+    if (typeof record.message === "string" || typeof record.code === "string") {
+      throw cliErrorFromEnvelope(
+        {
+          code: typeof record.code === "string" ? record.code : void 0,
+          message: typeof record.message === "string" ? record.message : void 0
+        },
+        { status: response.status, requestId }
+      );
+    }
+    throw cliErrorFromStatus(response.status, { requestId });
+  }
+  return { data: parsed, meta: null, status: response.status, requestId };
+}
+
+// src/core/mcp-results.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function detectApproval(value, fallbackToolName = "") {
+  if (!isRecord(value) || value.approvalRequired !== true) return null;
+  if (typeof value.approvalId !== "string" || !value.approvalId) return null;
+  return {
+    approvalId: value.approvalId,
+    toolName: typeof value.toolName === "string" ? value.toolName : fallbackToolName,
+    message: typeof value.message === "string" ? value.message : "This Tabbio action requires approval before it runs.",
+    ...typeof value.status === "string" ? { status: value.status } : {}
+  };
+}
+function extractToolPayload(result) {
+  const first = result.content?.[0];
+  if (first?.type === "text" && typeof first.text === "string") {
+    const text = first.text;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  if (result.structuredContent !== void 0) return result.structuredContent;
+  return result.content ?? null;
+}
+function contentText(result) {
+  return (result.content ?? []).filter((item) => item.type === "text" && typeof item.text === "string").map((item) => item.text).join("\n").trim();
+}
+function parseToolErrorText(text) {
+  const trimmed = text.trim();
+  try {
+    const json = JSON.parse(trimmed);
+    if (isRecord(json)) {
+      const cause = isRecord(json.cause) ? json.cause : void 0;
+      const details = isRecord(json.details) ? json.details : void 0;
+      const message = typeof cause?.message === "string" && cause.message || typeof json.message === "string" && json.message || trimmed;
+      const status = [json.status, cause?.status, details?.status].find(
+        (value) => typeof value === "number"
+      );
+      const code = typeof json.code === "string" ? json.code : void 0;
+      return { message: String(message).replace(/^Error:\s*/, ""), status, code };
+    }
+  } catch {
+  }
+  return { message: trimmed.replace(/^Error:\s*/, "") || "The tool failed" };
+}
+function classifyToolError(toolName, message, status, code) {
+  const make = (errCode, exitCode, hint) => new CliError({ code: errCode, message, hint, exitCode, status });
+  if (/pass companyId/i.test(message)) {
+    return make("MCP_SCOPE_FORBIDDEN", ExitCode.Forbidden, "Pass the company id (e.g. --company-id <id>).");
+  }
+  if (/does not allow (writes|reads)|not scoped to|scoped to selected company/i.test(message)) {
+    return make(
+      "MCP_SCOPE_FORBIDDEN",
+      ExitCode.Forbidden,
+      "The personal token in use does not cover this. Sign in with `tabbio login` for full access."
+    );
+  }
+  if (/not available through the assistant/i.test(message)) return make("FORBIDDEN", ExitCode.Forbidden);
+  if (/^Unknown tool/i.test(message)) {
+    return make("UNKNOWN_TOOL", ExitCode.NotFound, "Run `tabbio tools --refresh` to reload the catalog.");
+  }
+  if (/validation failed|invalid arguments/i.test(message)) return make("VALIDATION_ERROR", ExitCode.Usage);
+  if (/requires an active company/i.test(message)) {
+    return make("COMPANY_REQUIRED", ExitCode.Usage, "Pass the company id (e.g. --company-id <id>).");
+  }
+  if (/missing authenticated user|unauthori[sz]ed/i.test(message)) {
+    return make("UNAUTHORIZED", ExitCode.Auth, "Run `tabbio login` to sign in again.");
+  }
+  if (code && code !== "ERROR") {
+    const mapped = cliErrorFromEnvelope({ code, message }, { status });
+    if (mapped.exitCode !== ExitCode.Error) return mapped;
+  }
+  if (status) return make(status === 404 ? "NOT_FOUND" : "TOOL_ERROR", exitCodeForStatus(status));
+  if (/\bnot found\b/i.test(message)) return make("NOT_FOUND", ExitCode.NotFound);
+  return make("TOOL_ERROR", ExitCode.Error, toolName ? `Tool: ${toolName}` : void 0);
+}
+function interpretToolResult(result, toolName) {
+  if (result.isError) {
+    const parsed = parseToolErrorText(contentText(result) || "The tool failed");
+    return { ok: false, error: classifyToolError(toolName, parsed.message, parsed.status, parsed.code) };
+  }
+  return interpretToolPayload(extractToolPayload(result), toolName);
+}
+function interpretToolPayload(payload, toolName) {
+  if (isRecord(payload)) {
+    if (payload.error === true && typeof payload.message === "string") {
+      return { ok: false, error: classifyToolError(toolName, payload.message) };
+    }
+    if (payload.ok === false && isRecord(payload.error)) {
+      const err = payload.error;
+      return {
+        ok: false,
+        error: cliErrorFromEnvelope(
+          {
+            code: typeof err.code === "string" ? err.code : "TOOL_ERROR",
+            message: typeof err.message === "string" ? err.message : "The tool failed"
+          },
+          { status: typeof err.status === "number" ? err.status : void 0 }
+        )
+      };
+    }
+  }
+  const approval = detectApproval(payload, toolName);
+  return approval ? { ok: true, result: payload, approval } : { ok: true, result: payload };
+}
+function readErrorDescription(text) {
+  const match = /\{[\s\S]*\}/.exec(text);
+  if (!match) return void 0;
+  try {
+    const json = JSON.parse(match[0]);
+    if (typeof json.error_description === "string") return json.error_description;
+    if (typeof json.message === "string") return json.message;
+    if (typeof json.error === "string") return json.error;
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function mapMcpTransportError(error, ctx) {
+  if (error instanceof CliError) return error;
+  const err = error;
+  const message = err?.message ?? String(error);
+  const isUnauthorized = err?.name === "UnauthorizedError" || error?.constructor?.name === "UnauthorizedError" || typeof err?.code === "number" && err.code === 401;
+  if (isUnauthorized) {
+    const detail = readErrorDescription(message);
+    const personal = ctx.kind === "personal-token";
+    return new CliError({
+      code: personal ? "MCP_TOKEN_REJECTED" : "SESSION_EXPIRED",
+      message: personal ? `The personal MCP token for profile "${ctx.profile}" was rejected${detail ? ` (${detail})` : ""}` : `Tabbio rejected the session for profile "${ctx.profile}"${detail ? ` (${detail})` : ""}`,
+      hint: personal ? "Tokens are revoked when a newer one is created in Settings \u2192 MCP access. Create one and run `tabbio login --token \u2026`, or sign in with `tabbio login`." : "Run `tabbio login` to sign in again.",
+      exitCode: ExitCode.Auth,
+      status: 401,
+      cause: error
+    });
+  }
+  if (typeof err?.code === "number" && err.code >= 400 && err.code < 600) {
+    const detail = readErrorDescription(message);
+    const exitCode = exitCodeForStatus(err.code);
+    return new CliError({
+      code: err.code === 404 ? "MCP_ENDPOINT_NOT_FOUND" : err.code === 403 ? "FORBIDDEN" : "MCP_HTTP_ERROR",
+      message: err.code === 404 ? `No MCP endpoint at ${ctx.mcpUrl}` : `MCP request failed (HTTP ${err.code})${detail ? `: ${detail}` : ""}`,
+      hint: err.code === 404 ? "Check the API URL with `tabbio status`." : void 0,
+      exitCode,
+      status: err.code,
+      cause: error
+    });
+  }
+  if (err?.name === "McpError" && typeof err.code === "number") {
+    if (err.code === -32001) {
+      return new CliError({
+        code: "TIMEOUT",
+        message: "The Tabbio tool call timed out",
+        hint: "Long-running workflows may still finish; check `tabbio approvals` or the app.",
+        exitCode: ExitCode.Network,
+        cause: error
+      });
+    }
+    if (err.code === -32e3) return networkError(ctx.mcpUrl, error);
+    if (err.code === -32602) {
+      return new CliError({ code: "VALIDATION_ERROR", message, exitCode: ExitCode.Usage, cause: error });
+    }
+    return new CliError({ code: "MCP_ERROR", message, exitCode: ExitCode.Error, cause: error });
+  }
+  if (err?.name === "TypeError" || err?.name === "AbortError" || err?.name === "TimeoutError") {
+    return networkError(ctx.mcpUrl, error);
+  }
+  return new CliError({ code: "MCP_ERROR", message, exitCode: ExitCode.Error, cause: error });
+}
+
+// src/core/mcp.ts
+var CATALOG_TTL_MS = 60 * 60 * 1e3;
+var TOOL_TIMEOUT_MS = 2 * 60 * 1e3;
+var LONG_TOOL_TIMEOUT_MS = 10 * 60 * 1e3;
+function sha(value, length = 16) {
+  return createHash("sha256").update(value).digest("hex").slice(0, length);
+}
+function selectMcpBearer(creds) {
+  if (!creds) return null;
+  const personal = (token, source) => ({
+    kind: "personal-token",
+    source,
+    token,
+    fingerprint: fingerprint(token),
+    cacheIdentity: `personal-token:${sha(token)}`
+  });
+  const session = (token, source) => ({
+    kind: "app-session",
+    source,
+    token,
+    fingerprint: fingerprint(token),
+    // The JWT rotates daily; the user id keeps the cache stable across refreshes.
+    cacheIdentity: `app-session:${creds.user?.id && source === "store" ? creds.user.id : sha(token)}`
+  });
+  if (creds.mcpToken && creds.origin?.mcpToken === "env") return personal(creds.mcpToken, "env");
+  if (creds.accessToken && creds.origin?.accessToken === "env") return session(creds.accessToken, "env");
+  if (creds.accessToken) return session(creds.accessToken, "store");
+  if (creds.mcpToken) return personal(creds.mcpToken, "store");
+  return null;
+}
+function describeMcpBearer(creds) {
+  const bearer = selectMcpBearer(creds);
+  if (!bearer) return null;
+  const { token: _token, ...rest } = bearer;
+  return rest;
+}
+function cachePrefix(profile) {
+  return `catalog-${profile.name}-`;
+}
+function catalogCacheFile(profile, identity) {
+  return join4(configPaths().cacheDir, `${cachePrefix(profile)}${sha(`${profile.mcpUrl}
+${identity}`)}.json`);
+}
+function catalogCachePath(profile, creds) {
+  const bearer = selectMcpBearer(creds);
+  return bearer ? catalogCacheFile(profile, bearer.cacheIdentity) : null;
+}
+function readCatalogCache(file) {
+  try {
+    const raw = readFileIfExists(file);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    return parsed?.version === 1 && Array.isArray(parsed.tools) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readCachedCatalog(profile, creds) {
+  const file = catalogCachePath(profile, creds);
+  const cache = file ? readCatalogCache(file) : null;
+  if (!cache) return null;
+  const fetchedAt = new Date(cache.fetchedAt);
+  const ageMs = Date.now() - fetchedAt.getTime();
+  return { fetchedAt, tools: buildCatalog(cache.tools), ageMs, fresh: ageMs < CATALOG_TTL_MS, kind: cache.kind };
+}
+function clearCatalogCache(profile, keep) {
+  const { cacheDir } = configPaths();
+  try {
+    for (const file of readdirSync(cacheDir)) {
+      if (file.startsWith(cachePrefix(profile)) && file !== keep) rmSync2(join4(cacheDir, file), { force: true });
+    }
+  } catch {
+  }
+}
+function describeRpcBody(body) {
+  if (typeof body !== "string") return "";
+  try {
+    const message = JSON.parse(body);
+    return [message.method, message.params?.name].filter(Boolean).join(" ");
+  } catch {
+    return "";
+  }
+}
+function authedFetch(inner, getToken, refresh) {
+  return async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    const method = (init?.method ?? "GET").toUpperCase();
+    const send2 = async (token) => {
+      const headers = new Headers(init?.headers);
+      headers.set("authorization", `Bearer ${token}`);
+      const started = Date.now();
+      debug(`\u2192 ${method} ${redactUrl(url)} ${describeRpcBody(init?.body)}`.trimEnd());
+      const response2 = await inner(input, { ...init, headers });
+      const requestId = readRequestId(response2.headers);
+      debug(`\u2190 ${response2.status} ${method} ${redactUrl(url)} ${Date.now() - started}ms${requestId ? ` req=${requestId}` : ""}`);
+      return response2;
+    };
+    const response = await send2(await getToken());
+    if (response.status !== 401 || !refresh) return response;
+    await response.body?.cancel().catch(() => void 0);
+    debug("MCP returned 401 for the app session; refreshing once");
+    return send2(await refresh());
+  };
+}
+var McpSession = class _McpSession {
+  constructor(profile, bearer, client) {
+    this.profile = profile;
+    this.bearer = bearer;
+    this.client = client;
+  }
+  catalog = null;
+  rawTools = null;
+  static async connect(profile, creds, opts = {}) {
+    const selected = selectMcpBearer(creds);
+    if (!selected) throw notSignedInError(profile.name);
+    const { token: initialToken, ...bearer } = selected;
+    let getToken = async () => initialToken;
+    let refresh = null;
+    if (bearer.kind === "app-session") {
+      const api = opts.api ?? new ApiClient(profile, creds, { fetch: opts.fetch });
+      getToken = () => api.ensureAccessToken();
+      if (api.credentials?.refreshToken) refresh = () => api.refresh();
+    }
+    const transport = new StreamableHTTPClientTransport(new URL(profile.mcpUrl), {
+      requestInit: { headers: baseHeaders() },
+      fetch: authedFetch(opts.fetch ?? ((...args) => fetch(...args)), getToken, refresh)
+    });
+    const client = new Client({ name: opts.clientName ?? "tabbio-cli", version: CLI_VERSION }, { capabilities: {} });
+    try {
+      await client.connect(transport);
+    } catch (error) {
+      await client.close().catch(() => void 0);
+      throw mapMcpTransportError(error, { mcpUrl: profile.mcpUrl, profile: profile.name, kind: bearer.kind });
+    }
+    return new _McpSession(profile, bearer, client);
+  }
+  /** Server-provided instructions (forwarded by `mcp serve`). */
+  get instructions() {
+    return this.client.getInstructions();
+  }
+  get serverVersion() {
+    return this.client.getServerVersion();
+  }
+  /** Raw MCP tools, from the 1h on-disk cache unless `refresh` is set. */
+  async listRawTools(opts = {}) {
+    if (this.rawTools && !opts.refresh) return this.rawTools;
+    const file = catalogCacheFile(this.profile, this.bearer.cacheIdentity);
+    if (!opts.refresh) {
+      const cache = readCatalogCache(file);
+      if (cache && cache.mcpUrl === this.profile.mcpUrl && Date.now() - Date.parse(cache.fetchedAt) < CATALOG_TTL_MS) {
+        debug(`catalog cache hit (${cache.tools.length} tools)`);
+        this.rawTools = cache.tools;
+        return cache.tools;
+      }
+    }
+    const tools = [];
+    let cursor;
+    try {
+      do {
+        const page = await this.client.listTools(cursor ? { cursor } : {});
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+      } while (cursor);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+    this.rawTools = tools;
+    this.catalog = null;
+    try {
+      const cache = {
+        version: 1,
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        mcpUrl: this.profile.mcpUrl,
+        kind: this.bearer.kind,
+        tools
+      };
+      writeFileAtomic(file, JSON.stringify(cache));
+      clearCatalogCache(this.profile, file.split(/[\\/]/).pop());
+    } catch (error) {
+      debug(`could not write catalog cache: ${error.message}`);
+    }
+    return tools;
+  }
+  async listTools(opts = {}) {
+    if (this.catalog && !opts.refresh) return this.catalog;
+    this.catalog = buildCatalog(await this.listRawTools(opts));
+    return this.catalog;
+  }
+  /** Resolves any accepted tool reference (id, MCP name, command path). */
+  async resolveTool(ref) {
+    return findTool(await this.listTools(), ref);
+  }
+  /**
+   * Calls a tool by id (`cv.list`), MCP name or command path. Approval-gated
+   * tools return `{ ok: true, approval }` instead of executing.
+   */
+  async callTool(id, input, opts = {}) {
+    const tool = await this.resolveTool(id);
+    if (!tool) {
+      return {
+        ok: false,
+        error: new CliError({
+          code: "UNKNOWN_TOOL",
+          message: `Unknown tool: ${id}`,
+          hint: "Run `tabbio tools` to list tools, or `tabbio tools --refresh` to reload the catalog.",
+          exitCode: ExitCode.NotFound
+        })
+      };
+    }
+    const long = tool.kind !== "tool";
+    const result = await this.callRaw(
+      { name: tool.mcpName, arguments: input },
+      { ...opts, timeoutMs: opts.timeoutMs ?? (long ? LONG_TOOL_TIMEOUT_MS : TOOL_TIMEOUT_MS) }
+    );
+    return interpretToolResult(result, tool.id);
+  }
+  /** Raw `tools/call` passthrough (used by the stdio bridge). Throws CliError on transport failure. */
+  async callRaw(params, opts = {}) {
+    try {
+      const result = await this.client.callTool(params, void 0, {
+        timeout: opts.timeoutMs ?? TOOL_TIMEOUT_MS,
+        resetTimeoutOnProgress: true,
+        ...opts.signal ? { signal: opts.signal } : {},
+        ...opts.onProgress ? { onprogress: opts.onProgress } : {}
+      });
+      return result;
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async close() {
+    await this.client.close().catch(() => void 0);
+  }
+  mapError(error) {
+    return mapMcpTransportError(error, { mcpUrl: this.profile.mcpUrl, profile: this.profile.name, kind: this.bearer.kind });
+  }
+};
+function assertJwtSession(creds, profile, feature) {
+  if (creds?.accessToken) return;
+  if (creds?.mcpToken) throw needsFullSignInError(feature);
+  throw notSignedInError(profile.name);
+}
+
+// src/core/loopback.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+var STATE_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+var CODE_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+var LOOPBACK_HOST = "127.0.0.1";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+function generateState() {
+  return randomBytes2(32).toString("base64url");
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function validateLoopbackCallback(url, expectedState) {
+  if (url.pathname !== "/callback") {
+    return { ok: false, status: 404, reason: "Not found", fatal: false };
+  }
+  const state = url.searchParams.get("state") ?? "";
+  if (!STATE_PATTERN.test(state) || !safeEqual(state, expectedState)) {
+    return { ok: false, status: 400, reason: "This sign-in link does not match the waiting terminal.", fatal: false };
+  }
+  const error = url.searchParams.get("error");
+  if (error) {
+    return {
+      ok: false,
+      status: 200,
+      reason: error === "access_denied" ? "Connection was declined in the browser." : `Connection failed: ${error.slice(0, 80)}`,
+      fatal: true
+    };
+  }
+  const code = url.searchParams.get("code") ?? "";
+  if (!CODE_PATTERN.test(code)) {
+    return { ok: false, status: 400, reason: "The connect code is missing or malformed.", fatal: false };
+  }
+  return { ok: true, code };
+}
+function paletteCss() {
+  const vars = (p) => Object.entries(p).map(([key, value]) => `--${key}:${value}`).join(";");
+  const { light, dark, accent, onAccent } = WEB_PAGE_PALETTE;
+  return `:root{${vars(light)};--accent:${accent};--on-accent:${onAccent}}
+@media (prefers-color-scheme:dark){:root{${vars(dark)}}}`;
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+function renderLoopbackPage(kind, message) {
+  const title = kind === "success" ? "Tabbio CLI connected" : "Tabbio CLI sign-in";
+  const heading2 = kind === "success" ? "You are signed in to the Tabbio CLI" : "Sign-in did not finish";
+  const mark = kind === "success" ? "&#10003;" : "!";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="referrer" content="no-referrer"><title>${title}</title>
+<style>
+${paletteCss()}
+*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--bg);color:var(--fg);
+font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;padding:24px}
+main{max-width:420px;width:100%;background:var(--card);border:1px solid var(--line);border-radius:16px;padding:32px;text-align:start}
+.mark{width:40px;height:40px;border-radius:12px;display:grid;place-items:center;background:var(--accent);color:var(--on-accent);font-weight:700;margin-bottom:16px}
+h1{font-size:20px;margin:0 0 8px}p{margin:0;color:var(--muted)}.brand{font-weight:600;color:var(--accent);margin-bottom:24px;font-size:14px}
+</style></head>
+<body><main><div class="brand">tabbio</div><div class="mark">${mark}</div><h1>${escapeHtml(heading2)}</h1>
+<p dir="auto">${escapeHtml(message)}</p></main></body></html>`;
+}
+function send(res, status, html) {
+  res.writeHead(status, {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+    "referrer-policy": "no-referrer",
+    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
+    "x-content-type-options": "nosniff",
+    connection: "close"
+  });
+  res.end(html);
+}
+async function startLoopbackServer(opts) {
+  let settle;
+  let outcome;
+  const finish = (result) => {
+    if (outcome) return;
+    outcome = result;
+    if (settle) {
+      if (result.code) settle.resolve(result.code);
+      else settle.reject(result.error ?? new Error("Login failed"));
+    }
+  };
+  let port = 0;
+  let pending;
+  const server = createServer((req, res) => {
+    if (req.headers.host !== `${LOOPBACK_HOST}:${port}`) {
+      return send(res, 400, renderLoopbackPage("error", "Unexpected host."));
+    }
+    if (req.method !== "GET") return send(res, 405, renderLoopbackPage("error", "Method not allowed."));
+    const url = new URL(req.url ?? "/", `http://${LOOPBACK_HOST}:${port}`);
+    if (outcome) {
+      return send(res, 410, renderLoopbackPage("error", "This sign-in already finished. Return to your terminal."));
+    }
+    const result = validateLoopbackCallback(url, opts.state);
+    if (result.ok) {
+      pending = res;
+      finish({ code: result.code });
+      return;
+    }
+    send(res, result.status, renderLoopbackPage("error", result.reason));
+    if (result.fatal) {
+      finish({ error: new CliError({ code: "LOGIN_DECLINED", message: result.reason, exitCode: ExitCode.Auth }) });
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, LOOPBACK_HOST, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  port = server.address().port;
+  const timeoutMs = opts.timeoutMs ?? LOGIN_TIMEOUT_MS;
+  const timer = setTimeout(() => {
+    finish({
+      error: new CliError({
+        code: "LOGIN_TIMEOUT",
+        message: `Timed out after ${Math.round(timeoutMs / 6e4) || 1} min waiting for the browser`,
+        hint: "Run `tabbio login` again, or use `tabbio login --email you@example.com` on a machine without a browser.",
+        exitCode: ExitCode.Auth
+      })
+    });
+  }, timeoutMs);
+  timer.unref();
+  const onAbort = () => finish({ error: interruptedError("Login cancelled") });
+  if (opts.signal?.aborted) onAbort();
+  opts.signal?.addEventListener("abort", onAbort, { once: true });
+  const complete = (kind, message) => {
+    if (pending && !pending.writableEnded) send(pending, kind === "success" ? 200 : 400, renderLoopbackPage(kind, message));
+    pending = void 0;
+  };
+  const close = async () => {
+    complete("error", "Return to your terminal to see what happened.");
+    clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", onAbort);
+    server.closeAllConnections?.();
+    await new Promise((resolve) => server.close(() => resolve()));
+  };
+  return {
+    port,
+    waitForCode: () => new Promise((resolve, reject) => {
+      if (!outcome) {
+        settle = { resolve, reject };
+        return;
+      }
+      if (outcome.code) resolve(outcome.code);
+      else reject(outcome.error ?? new Error("Login failed"));
+    }),
+    complete,
+    close
+  };
+}
+
+// src/core/auth.ts
+var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var OTP_MAX_ATTEMPTS = 3;
+function hasDisplay(env3 = process.env, platform = process.platform) {
+  if (env3.SSH_CONNECTION || env3.SSH_TTY || env3.SSH_CLIENT) return false;
+  if (platform === "darwin" || platform === "win32") return true;
+  return Boolean(env3.DISPLAY || env3.WAYLAND_DISPLAY);
+}
+function chooseLoginMethod(opts) {
+  const flags = [
+    opts.browser && "--browser",
+    opts.email && "--email",
+    opts.token && "--token",
+    opts.withToken && "--with-token"
+  ].filter(Boolean);
+  if (flags.length > 1) throw usageError(`Choose one of ${flags.join(", ")}`);
+  if (opts.nonInteractive && (opts.email || opts.token || opts.withToken)) {
+    throw usageError("--non-interactive only applies to the browser flow");
+  }
+  if (opts.token || opts.withToken) return "token";
+  if (opts.email) return "email";
+  if (opts.browser || opts.nonInteractive) return "browser";
+  if (opts.isTTY && opts.hasDisplay) return "browser";
+  if (opts.isTTY) return "email";
+  throw usageError(
+    "No login method for a non-interactive session",
+    "Use `tabbio login --token <tabbio_mcp_\u2026>` or set TABBIO_TOKEN / TABBIO_ACCESS_TOKEN."
+  );
+}
+function assertEmail(email) {
+  const value = email.trim().toLowerCase();
+  if (!EMAIL_PATTERN.test(value)) throw usageError(`Not a valid email address: ${email}`);
+  return value;
+}
+function buildConnectUrl(appUrl, params) {
+  const url = new URL("/cli/connect", `${appUrl}/`);
+  url.searchParams.set("port", String(params.port));
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("device", params.device.slice(0, 64));
+  return url.toString();
+}
+function cookieHeaderFromSetCookie(values) {
+  return values.map((value) => value.split(";", 1)[0]?.trim() ?? "").filter((pair) => pair.includes("=") && !pair.endsWith("=")).join("; ");
+}
+function toUser(user) {
+  return { id: user.id, email: user.email, name: user.name ?? null };
+}
+function assertTokenPayload(payload) {
+  if (!payload?.accessToken || !payload.user?.id) {
+    throw new CliError({ code: "BAD_RESPONSE", message: "Sign-in returned no session", exitCode: ExitCode.Server });
+  }
+  if (!payload.refreshToken) {
+    throw new CliError({
+      code: "NO_REFRESH_TOKEN",
+      message: "Sign-in returned no refresh token",
+      hint: "A proxy may be stripping the x-tabbio-client-platform header.",
+      exitCode: ExitCode.Server
+    });
+  }
+  return payload;
+}
+async function exchangeGrantCode(api, code) {
+  const payload = await api.json("/api/auth/tokens/extension-exchange", {
+    method: "POST",
+    body: { code },
+    auth: "none"
+  });
+  return assertTokenPayload(payload);
+}
+async function loginWithBrowser(api, opts) {
+  const state = generateState();
+  const timeoutMs = opts.timeoutMs ?? LOGIN_TIMEOUT_MS;
+  const server = await startLoopbackServer({ state, timeoutMs, signal: opts.signal });
+  const expiresAt = new Date(Date.now() + timeoutMs).toISOString();
+  try {
+    const url = buildConnectUrl(api.profile.appUrl, { port: server.port, state, device: opts.device });
+    const opened = await opts.openUrl(url).catch(() => false);
+    opts.onWaiting?.(url, opened, { state, port: server.port, expiresAt });
+    const code = await server.waitForCode();
+    debug("received connect code on loopback");
+    try {
+      const payload = await exchangeGrantCode(api, code);
+      server.complete("success", "You can close this tab and return to your terminal.");
+      return payload;
+    } catch (error) {
+      server.complete("error", "The connection could not be completed. Check your terminal.");
+      throw error;
+    }
+  } finally {
+    await server.close();
+  }
+}
+async function sendEmailOtp(api, email) {
+  const response = await api.raw("/api/auth/email-otp/send-verification-otp", {
+    method: "POST",
+    auth: "none",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ email, type: "sign-in" })
+  });
+  await parseJsonResponse(response);
+}
+async function signInWithEmailOtp(api, email, otp) {
+  const response = await api.raw("/api/auth/sign-in/email-otp", {
+    method: "POST",
+    auth: "none",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ email, otp })
+  });
+  const cookies = response.ok ? response.headers.getSetCookie() : [];
+  await parseJsonResponse(response);
+  const cookie = cookieHeaderFromSetCookie(cookies);
+  if (!cookie) {
+    throw new CliError({ code: "BAD_RESPONSE", message: "Sign-in returned no session cookie", exitCode: ExitCode.Server });
+  }
+  return cookie;
+}
+async function exchangeSessionCookie(api, cookie) {
+  const payload = await api.json("/api/auth/tokens/exchange", {
+    method: "POST",
+    auth: "none",
+    headers: { cookie }
+  });
+  return assertTokenPayload(payload);
+}
+async function loginWithEmailOtp(api, opts) {
+  const email = assertEmail(opts.email);
+  await sendEmailOtp(api, email);
+  for (let attempt = 1; attempt <= OTP_MAX_ATTEMPTS; attempt += 1) {
+    const otp = (await opts.promptCode(attempt)).replace(/\s+/g, "");
+    if (!otp) throw usageError("No code entered");
+    try {
+      const cookie = await signInWithEmailOtp(api, email, otp);
+      return await exchangeSessionCookie(api, cookie);
+    } catch (error) {
+      if (!(error instanceof CliError)) throw error;
+      const code = error.code.toUpperCase();
+      if (code === "INVALID_OTP" && attempt < OTP_MAX_ATTEMPTS) {
+        opts.onInvalidCode?.(OTP_MAX_ATTEMPTS - attempt);
+        continue;
+      }
+      if (code === "INVALID_OTP" || code === "TOO_MANY_ATTEMPTS" || code === "OTP_EXPIRED") {
+        throw new CliError({
+          code,
+          message: code === "OTP_EXPIRED" ? "That code expired" : "Too many wrong codes",
+          hint: "Run `tabbio login --email` again to get a new code.",
+          exitCode: ExitCode.Auth,
+          requestId: error.requestId
+        });
+      }
+      throw error;
+    }
+  }
+  throw new CliError({ code: "TOO_MANY_ATTEMPTS", message: "Too many wrong codes", exitCode: ExitCode.Auth });
+}
+function getMcpAccessState(api) {
+  return api.json("/api/integrations/mcp");
+}
+async function revokeSession(api, refreshToken) {
+  await api.json("/api/auth/tokens/logout", { method: "POST", body: { refreshToken }, auth: "none" });
+}
+function credentialsFromLogin(profile, payload) {
+  return {
+    profile: profile.name,
+    accessToken: payload.accessToken,
+    accessTokenExpiresAt: payload.accessTokenExpiresAt,
+    refreshToken: payload.refreshToken,
+    user: toUser(payload.user)
+  };
+}
+async function logoutProfile(profile, creds, opts = {}) {
+  const warnings = [];
+  let revokedSession = false;
+  const refreshToken = creds?.origin?.accessToken === "env" ? void 0 : creds?.refreshToken;
+  if (refreshToken) {
+    try {
+      await revokeSession(new ApiClient(profile, null, { fetch: opts.fetch, persist: false }), refreshToken);
+      revokedSession = true;
+    } catch (error) {
+      warnings.push(`Could not end the session on the server: ${error.message}`);
+    }
+  }
+  clearCredentials(profile.name);
+  clearCatalogCache(profile);
+  return { warnings, revokedSession };
+}
+
+export {
+  ExitCode,
+  EXIT_CODE_DOCS,
+  CliError,
+  isCliError,
+  notSignedInError,
+  interruptedError,
+  usageError,
+  networkError,
+  toCliError,
+  writeOut,
+  printJson,
+  printKeyValues,
+  successLine,
+  heading,
+  relativeTime,
+  DEFAULT_PROFILE,
+  PROFILE_PRESETS,
+  configPaths,
+  loadConfig,
+  updateConfig,
+  assertProfileName,
+  normalizeBaseUrl,
+  resolveProfileWithSources,
+  resolveProfile,
+  listProfileNames,
+  loadStoredCredentials,
+  loadCredentials,
+  saveCredentials,
+  listCredentialProfiles,
+  credentialPermissionIssues,
+  fingerprint,
+  redactSecrets,
+  setGlobalOptions,
+  getGlobalOptions,
+  isInteractive,
+  deviceLabel,
+  debug,
+  info,
+  warn,
+  CLI_VERSION,
+  CLI_PACKAGE_NAME,
+  checkForUpdate,
+  readRequestId,
+  ApiClient,
+  parseJsonResponse,
+  PRIMARY_AGENT_KEY,
+  kebabCase,
+  findTool,
+  groupCatalog,
+  interpretToolPayload,
+  selectMcpBearer,
+  describeMcpBearer,
+  readCachedCatalog,
+  clearCatalogCache,
+  McpSession,
+  assertJwtSession,
+  hasDisplay,
+  chooseLoginMethod,
+  loginWithBrowser,
+  loginWithEmailOtp,
+  getMcpAccessState,
+  revokeSession,
+  credentialsFromLogin,
+  logoutProfile
+};
+//# sourceMappingURL=chunk-7LNC3FIV.js.map