@whop/cli 0.8.2 → 0.9.0

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   external_exports
 } from "./chunk-KFCNNWPI.js";
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Cli.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Cli.js
 var Cli_exports = {};
 __export(Cli_exports, {
   collectSkillCommands: () => collectSkillCommands,
@@ -106,7 +106,7 @@ function extractSegmentPart(segment, segmentTokenStart, segmentTokenCount, targe
   return segment.slice(charStart, charEnd);
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/helpers.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/helpers.js
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -154,7 +154,7 @@ function suggest(input, candidates) {
   return best;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Completions.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Completions.js
 function register(shell, name) {
   switch (shell) {
     case "bash":
@@ -417,7 +417,7 @@ let _incur_complete_${id} = {|spans|
 }`;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Errors.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Errors.js
 var BaseError = class extends Error {
   name = "Incur.BaseError";
   /** The short, human-readable error message (without details). */
@@ -491,7 +491,7 @@ function walk(error, fn) {
   return current;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Fetch.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Fetch.js
 var reservedFlags = /* @__PURE__ */ new Set(["method", "body", "data", "header"]);
 var reservedShort = { X: "method", d: "data", H: "header" };
 function parseArgv(argv2) {
@@ -627,7 +627,7 @@ async function parseResponse(response) {
   };
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Filter.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Filter.js
 function parse(expression) {
   const paths = [];
   const tokens = [];
@@ -1127,7 +1127,7 @@ function resolveOptions(options) {
   };
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/json.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/json.js
 function stringify(value, space) {
   return JSON.stringify(value, (_key, value2) => {
     if (typeof value2 === "bigint")
@@ -1139,7 +1139,7 @@ function normalize(value) {
   return JSON.parse(stringify(value));
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/yaml.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/yaml.js
 import { createRequire } from "module";
 var cached;
 async function load() {
@@ -1151,7 +1151,7 @@ function loadSync() {
   return cached;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Formatter.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Formatter.js
 function format2(value, fmt = "toon") {
   if (value == null)
     return "";
@@ -1259,7 +1259,7 @@ ${String(val)}`;
   return kvTable(obj);
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Parser.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Parser.js
 function parse2(argv2, options = {}) {
   const { args: argsSchema, options: optionsSchema, alias, defaults } = options;
   const optionNames = createOptionNames(optionsSchema, alias);
@@ -1676,10 +1676,10 @@ function defaultEnvSource() {
   return {};
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/command.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/command.js
 var sentinel = Symbol.for("incur.sentinel");
 async function execute(command, options) {
-  const { argv: argv2, inputOptions, agent, format: format3, formatExplicit, name, path: path8, version, envSource = process.env, env: envSchema, globals = {}, vars: varsSchema, middlewares = [] } = options;
+  const { argv: argv2, inputOptions: inputOptions2, agent, format: format3, formatExplicit, name, path: path8, version, envSource = process.env, env: envSchema, globals = {}, vars: varsSchema, middlewares = [], request: request2 } = options;
   const displayName = options.displayName ?? name;
   const parseMode = options.parseMode ?? "argv";
   const varsMap = varsSchema ? varsSchema.parse({}) : {};
@@ -1705,9 +1705,9 @@ async function execute(command, options) {
     } else if (parseMode === "split") {
       const parsed = parse2(argv2, { args: command.args });
       args = parsed.args;
-      parsedOptions = command.options ? zodParse(command.options, inputOptions) : {};
+      parsedOptions = command.options ? zodParse(command.options, inputOptions2) : {};
     } else {
-      const split2 = splitParams(inputOptions, command);
+      const split2 = splitParams(inputOptions2, command);
       args = command.args ? zodParse(command.args, split2.args) : {};
       parsedOptions = command.options ? zodParse(command.options, split2.options) : {};
     }
@@ -1725,6 +1725,7 @@ async function execute(command, options) {
       name,
       ok: okFn,
       options: parsedOptions,
+      request: request2,
       var: varsMap,
       version
     });
@@ -1796,6 +1797,7 @@ async function execute(command, options) {
         formatExplicit,
         globals,
         name,
+        request: request2,
         set(key, value) {
           varsMap[key] = value;
         },
@@ -1923,7 +1925,7 @@ function findBuiltinSubcommand(builtin, token) {
   return builtin.subcommands?.find((sub) => sub.name === token || sub.aliases?.includes(token));
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Help.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Help.js
 function formatRoot(name, options = {}) {
   const { aliases, configFlag, description, globals, version, commands = [], root = false } = options;
   const lines = [];
@@ -2209,7 +2211,7 @@ function redact(value) {
   return `****${value.slice(-4)}`;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/cta.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/cta.js
 function formatCtaBlock(name, block) {
   if (!block || block.commands.length === 0)
     return void 0;
@@ -2232,7 +2234,7 @@ function formatCta(name, cta) {
   return { command: cmd, ...cta.description ? { description: cta.description } : void 0 };
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/pm.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/pm.js
 function detectRunner() {
   const userAgent = process.env.npm_config_user_agent ?? "";
   const execPath = process.env.npm_execpath ?? "";
@@ -2243,7 +2245,7 @@ function detectRunner() {
   return "npx";
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Schema.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Schema.js
 function toJsonSchema(schema) {
   const result = external_exports.toJSONSchema(schema, {
     unrepresentable: "any",
@@ -2257,39 +2259,23 @@ function toJsonSchema(schema) {
   return result;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Mcp.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Mcp.js
 async function serve(name, version, commands, options = {}) {
   const stdio = importStdioModule();
   const mcp = await import("./dist-2MZJLO2W.js");
   const { fromJsonSchema, McpServer } = mcp;
   const StdioServerTransport = await importStdioServerTransport(mcp, stdio);
   const server = new McpServer({ name, version }, options.instructions ? { instructions: options.instructions } : void 0);
-  for (const tool of collectTools(commands, [])) {
-    const mergedShape = {
-      ...tool.command.args?.shape,
-      ...tool.command.options?.shape
-    };
-    const hasInput = Object.keys(mergedShape).length > 0;
-    server.registerTool(tool.name, {
-      ...tool.description ? { description: tool.description } : void 0,
-      ...hasInput ? { inputSchema: external_exports.object(mergedShape) } : void 0,
-      ...tool.outputSchema ? { outputSchema: fromJsonSchema(tool.outputSchema) } : void 0,
-      ...tool.annotations ? { annotations: tool.annotations } : void 0,
-      ...tool.instructions ? { _meta: { instructions: tool.instructions } } : void 0
-    }, async (...callArgs) => {
-      const params = hasInput ? callArgs[0] : {};
-      const extra = hasInput ? callArgs[1] : callArgs[0];
-      return callTool(tool, params, {
-        extra,
-        sendNotification: (n) => server.server.notification(n),
-        name,
-        version,
-        middlewares: options.middlewares,
-        env: options.env,
-        vars: options.vars
-      });
-    });
-  }
+  registerTools(server, commands, {
+    env: options.env,
+    fromJsonSchema,
+    middlewares: options.middlewares,
+    name,
+    sendNotification: (notification) => server.server.notification(notification),
+    tools: options.tools,
+    vars: options.vars,
+    version
+  });
   const input = options.input ?? process.stdin;
   const output = options.output ?? process.stdout;
   const transport = new StdioServerTransport(input, output);
@@ -2325,6 +2311,7 @@ async function callTool(tool, params, options = {}) {
     name: options.name ?? tool.name,
     parseMode: "flat",
     path: tool.name,
+    request: options.request,
     vars: options.vars,
     version: options.version
   });
@@ -2368,34 +2355,215 @@ async function callTool(tool, params, options = {}) {
     ...cta ? { _meta: { cta } } : void 0
   };
 }
-function collectTools(commands, prefix, parentMiddlewares = []) {
+function registerTools(server, commands, options) {
+  const tools = collectTools(commands, [], [], options.tools);
+  if (tools.length === 0)
+    return;
+  if ((options.tools?.discovery ?? "progressive") === "direct") {
+    for (const tool of tools)
+      registerDirectTool(server, tool, options);
+    return;
+  }
+  registerDiscoveryTools(server, tools, options);
+}
+function registerDirectTool(server, tool, options) {
+  const mergedShape = {
+    ...tool.command.args?.shape,
+    ...tool.command.options?.shape
+  };
+  const hasInput = Object.keys(mergedShape).length > 0;
+  server.registerTool(tool.name, {
+    ...tool.description ? { description: tool.description } : void 0,
+    ...hasInput ? { inputSchema: external_exports.object(mergedShape) } : void 0,
+    ...tool.outputSchema ? { outputSchema: options.fromJsonSchema(tool.outputSchema) } : void 0,
+    ...tool.annotations ? { annotations: tool.annotations } : void 0,
+    ...tool.instructions ? { _meta: { instructions: tool.instructions } } : void 0
+  }, async (...callArgs) => {
+    const params = hasInput ? callArgs[0] : {};
+    const extra = hasInput ? callArgs[1] : callArgs[0];
+    return callTool(tool, params, callOptions(options, extra));
+  });
+}
+function registerDiscoveryTools(server, tools, options) {
+  const byName = new Map(tools.map((tool) => [tool.name, tool]));
+  server.registerTool("search_tools", {
+    description: "Search or page through available tools by capability. Returns names and descriptions without loading their schemas. Inspect a result before calling it.",
+    inputSchema: external_exports.object({
+      limit: external_exports.number().int().min(1).max(20).default(5).describe("Maximum matches."),
+      offset: external_exports.number().int().min(0).default(0).describe("Matches to skip."),
+      query: external_exports.string().default("").describe("Capability to find. Empty lists all tools.")
+    }),
+    annotations: catalogAnnotations
+  }, async (params) => {
+    const matches = searchTools(tools, params.query);
+    const page = matches.slice(params.offset, params.offset + params.limit);
+    return toolResult({
+      tools: page.map((tool) => ({
+        name: tool.name,
+        ...tool.description ? { description: tool.description } : void 0,
+        ...tool.annotations ? { annotations: tool.annotations } : void 0
+      })),
+      ...params.offset + page.length < matches.length ? { nextOffset: params.offset + page.length } : void 0
+    });
+  });
+  server.registerTool("get_tool_details", {
+    description: "Inspect one tool returned by search_tools. Returns its complete input schema and metadata.",
+    inputSchema: external_exports.object({ name: external_exports.string().min(1).describe("Exact tool name.") }),
+    annotations: catalogAnnotations
+  }, async (params) => {
+    const tool = byName.get(params.name);
+    if (!tool)
+      return toolError(`Unknown tool: ${params.name}`);
+    return toolResult({
+      name: tool.name,
+      ...tool.description ? { description: tool.description } : void 0,
+      inputSchema: tool.inputSchema,
+      ...tool.outputSchema ? { outputSchema: tool.outputSchema } : void 0,
+      ...tool.annotations ? { annotations: tool.annotations } : void 0,
+      ...tool.instructions ? { instructions: tool.instructions } : void 0
+    });
+  });
+  server.registerTool("call_read_tool", {
+    description: "Execute a tool marked read-only after inspecting its schema with get_tool_details.",
+    inputSchema: callSchema,
+    annotations: readAnnotations
+  }, async (params, extra) => {
+    const tool = byName.get(params.name);
+    if (!tool)
+      return toolError(`Unknown tool: ${params.name}`);
+    if (tool.annotations?.readOnlyHint !== true)
+      return toolError(`Tool is not read-only: ${params.name}`);
+    return callTool(tool, params.arguments, callOptions(options, extra));
+  });
+  server.registerTool("call_write_tool", {
+    description: "Execute a writable or unclassified tool after inspecting its schema with get_tool_details.",
+    inputSchema: callSchema,
+    annotations: writeAnnotations
+  }, async (params, extra) => {
+    const tool = byName.get(params.name);
+    if (!tool)
+      return toolError(`Unknown tool: ${params.name}`);
+    if (tool.annotations?.readOnlyHint === true)
+      return toolError(`Tool is read-only: ${params.name}`);
+    return callTool(tool, params.arguments, callOptions(options, extra));
+  });
+}
+var callSchema = external_exports.object({
+  name: external_exports.string().min(1).describe("Exact tool name."),
+  arguments: external_exports.record(external_exports.string(), external_exports.unknown()).default({}).describe("Arguments from its schema.")
+});
+var catalogAnnotations = {
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+  readOnlyHint: true
+};
+var readAnnotations = {
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true,
+  readOnlyHint: true
+};
+var writeAnnotations = {
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true,
+  readOnlyHint: false
+};
+function callOptions(options, extra) {
+  return {
+    env: options.env,
+    extra,
+    middlewares: options.middlewares,
+    name: options.name,
+    request: options.request?.(extra),
+    ...options.sendNotification ? { sendNotification: options.sendNotification } : void 0,
+    vars: options.vars,
+    version: options.version
+  };
+}
+function searchTools(tools, query) {
+  const normalized = normalizeSearch(query);
+  const terms = normalized.split(" ").filter(Boolean);
+  return tools.map((tool) => ({ tool, score: toolScore(tool, normalized, terms) })).filter(({ score }) => score > 0).sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name)).map(({ tool }) => tool);
+}
+function toolScore(tool, query, terms) {
+  const name = normalizeSearch(tool.name);
+  const description = normalizeSearch(tool.description ?? "");
+  if (name === query)
+    return 1e3;
+  let score = name.startsWith(query) ? 100 : name.includes(query) ? 50 : 0;
+  for (const term of terms) {
+    if (name.split(" ").includes(term))
+      score += 20;
+    else if (name.includes(term))
+      score += 10;
+    if (description.includes(term))
+      score += 2;
+  }
+  return score;
+}
+function normalizeSearch(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+function toolResult(value) {
+  return { content: [{ type: "text", text: stringify(value) }] };
+}
+function toolError(message) {
+  return { ...toolResult({ error: message }), isError: true };
+}
+function collectTools(commands, prefix, parentMiddlewares = [], filter) {
+  const tools = filterTools(collectToolEntries(commands, prefix, parentMiddlewares), filter);
+  assertUniqueToolNames(tools);
+  return tools.sort((a, b) => a.name.localeCompare(b.name));
+}
+function collectToolEntries(commands, prefix, parentMiddlewares = []) {
   const result = [];
   for (const [name, entry] of commands) {
     if ("_alias" in entry)
       continue;
+    if (entry.mcp === false)
+      continue;
     const path8 = [...prefix, name];
     if ("_group" in entry && entry._group) {
       const groupMw = [
         ...parentMiddlewares,
         ...entry.middlewares ?? []
       ];
-      result.push(...collectTools(entry.commands, path8, groupMw));
+      result.push(...collectToolEntries(entry.commands, path8, groupMw));
     } else {
-      const outputSchema = entry.output ? mcpOutputSchema(entry.output) : void 0;
+      const mcp = entry.mcp === false ? void 0 : entry.mcp;
+      const outputSchema2 = entry.output ? mcpOutputSchema(entry.output) : void 0;
       result.push({
-        name: entry.mcp?.name ?? path8.join("_"),
-        description: entry.mcp?.description ?? entry.description,
+        name: mcp?.name ?? path8.join("_"),
+        description: mcp?.description ?? entry.description,
         inputSchema: buildToolSchema(entry.args, entry.options),
-        ...outputSchema ? { outputSchema } : void 0,
-        ...entry.mcp?.annotations ? { annotations: entry.mcp.annotations } : void 0,
-        ...entry.mcp?.instructions ? { instructions: entry.mcp.instructions } : void 0,
+        ...outputSchema2 ? { outputSchema: outputSchema2 } : void 0,
+        ...mcp?.annotations ? { annotations: mcp.annotations } : void 0,
+        ...mcp?.instructions ? { instructions: mcp.instructions } : void 0,
         command: entry,
         ...parentMiddlewares.length > 0 ? { middlewares: parentMiddlewares } : void 0
       });
     }
   }
-  assertUniqueToolNames(result);
-  return result.sort((a, b) => a.name.localeCompare(b.name));
+  return result;
+}
+function filterTools(tools, filter) {
+  if (!filter)
+    return tools;
+  const includes = filter.include?.map(patternToRegExp);
+  const excludes = filter.exclude?.map(patternToRegExp) ?? [];
+  return tools.filter((tool) => {
+    if (excludes.some((pattern) => pattern.test(tool.name)))
+      return false;
+    if (!includes || includes.length === 0)
+      return true;
+    return includes.some((pattern) => pattern.test(tool.name));
+  });
+}
+function patternToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
 }
 function assertUniqueToolNames(tools) {
   const seen = /* @__PURE__ */ new Set();
@@ -2426,15 +2594,17 @@ function buildToolSchema(args, options) {
   return { type: "object", properties };
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Openapi.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Openapi.js
 var Openapi_exports = {};
 __export(Openapi_exports, {
+  coerceIfNeeded: () => coerceIfNeeded,
   fromCli: () => fromCli,
   generateCommands: () => generateCommands,
-  resolve: () => resolve
+  resolve: () => resolve,
+  toZod: () => toZod
 });
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/dereference.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/dereference.js
 function dereference(root) {
   const cache = /* @__PURE__ */ new Map();
   return walk2(root, root, cache);
@@ -2486,7 +2656,7 @@ function resolvePointer(root, pointer) {
   return current;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Openapi.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Openapi.js
 function fromCli(cli2, options = {}) {
   const commands = toCommands.get(cli2);
   if (!commands)
@@ -2526,7 +2696,7 @@ function splitCommandName(name) {
 function addCommand(paths, segments, command) {
   const argsSchema = command.args ? toJsonSchema(command.args) : void 0;
   const optionsSchema = command.options ? toJsonSchema(command.options) : void 0;
-  const outputSchema = command.output ? toJsonSchema(command.output) : void 0;
+  const outputSchema2 = command.output ? toJsonSchema(command.output) : void 0;
   const args = objectProperties(argsSchema);
   const requiredArgs = new Set(requiredProperties(argsSchema));
   const method = inferMethod(segments);
@@ -2550,7 +2720,7 @@ function addCommand(paths, segments, command) {
       ...command.description ? { summary: command.description } : void 0,
       ...parameters.length ? { parameters } : void 0,
       ...requestBody(method, optionsSchema),
-      responses: responses(outputSchema)
+      responses: responses(outputSchema2)
     };
     const item = paths[variant.path] ?? {};
     item[method] = operation;
@@ -2700,6 +2870,8 @@ async function generateCommands(spec2, fetch3, options = {}) {
   const operations = openapiOperations(paths);
   const namespaceInfo = getNamespaceInfo(operations);
   const { config } = options;
+  if (config?.compact)
+    compactOperations(operations);
   for (const { method, operation: op, path: path8 } of operations) {
     const segments = commandSegments({
       method,
@@ -2713,7 +2885,7 @@ async function generateCommands(spec2, fetch3, options = {}) {
     const queryParams = (op.parameters ?? []).filter((p) => p.in === "query");
     const headerParams = headerOptions([
       ...(op.parameters ?? []).filter((p) => p.in === "header"),
-      ...securityHeaderParams(resolved, op)
+      ...config?.security === false ? [] : securityHeaderParams(resolved, op)
     ]);
     const bodySchema = op.requestBody?.content?.["application/json"]?.schema;
     const bodyProps = bodySchema?.properties ?? {};
@@ -2760,11 +2932,19 @@ async function generateCommands(spec2, fetch3, options = {}) {
     const optionsSchema = Object.keys(optShape).length > 0 ? external_exports.object(optShape) : void 0;
     setCommand(commands, segments, {
       description: op.summary ?? op.description,
+      mcp: {
+        annotations: mcpAnnotations(method),
+        // Help keeps the short summary; MCP tools surface the full prose.
+        ...op.summary && op.description && op.summary !== op.description ? { description: `${op.summary}
+
+${op.description}` } : void 0
+      },
       args: argsSchema,
       options: optionsSchema,
       run: createHandler({
         basePath: options.basePath,
         fetch: fetch3,
+        forwardHeaders: config?.forwardHeaders,
         httpMethod,
         path: path8,
         headerParams,
@@ -2776,6 +2956,15 @@ async function generateCommands(spec2, fetch3, options = {}) {
   }
   return commands;
 }
+function mcpAnnotations(method) {
+  const readOnly = ["get", "head", "options", "trace"].includes(method);
+  return {
+    destructiveHint: !readOnly,
+    idempotentHint: readOnly || method === "delete" || method === "put",
+    openWorldHint: true,
+    readOnlyHint: readOnly
+  };
+}
 var openapiMethods = /* @__PURE__ */ new Set([
   "delete",
   "get",
@@ -2829,6 +3018,58 @@ function securityHeaderParam(name, scheme) {
   return void 0;
 }
 var authorizationSchemes = /* @__PURE__ */ new Set(["basic", "bearer"]);
+var compactPatternLimit = 100;
+var dateTimeFormats = /* @__PURE__ */ new Set(["date", "date-time", "duration", "time"]);
+function compactOperations(operations) {
+  for (const { operation } of operations) {
+    for (const parameter of operation.parameters ?? [])
+      if (parameter.schema)
+        parameter.schema = compactSchema(parameter.schema);
+    const body = operation.requestBody?.content?.["application/json"];
+    if (body?.schema)
+      body.schema = compactSchema(body.schema);
+  }
+}
+function compactSchema(schema, seen = /* @__PURE__ */ new Map()) {
+  const cached2 = seen.get(schema);
+  if (cached2)
+    return cached2;
+  const out = { ...schema };
+  seen.set(schema, out);
+  delete out.example;
+  delete out.examples;
+  if (typeof out.pattern === "string" && out.pattern.length > compactPatternLimit)
+    delete out.pattern;
+  if (typeof out.format === "string" && dateTimeFormats.has(out.format))
+    delete out.format;
+  for (const key of ["allOf", "anyOf", "oneOf", "prefixItems"]) {
+    if (!Array.isArray(out[key]))
+      continue;
+    const entries = out[key].map((entry) => compactSchema(entry, seen)).filter((entry) => Object.keys(entry).length > 0);
+    if (entries.length > 0)
+      out[key] = entries;
+    else
+      delete out[key];
+  }
+  for (const key of ["additionalProperties", "contains", "items", "not", "propertyNames"]) {
+    const value = out[key];
+    if (isSchemaObject(value))
+      out[key] = compactSchema(value, seen);
+  }
+  for (const key of ["$defs", "patternProperties", "properties"]) {
+    const value = out[key];
+    if (!isSchemaObject(value))
+      continue;
+    const map = {};
+    for (const [name, entry] of Object.entries(value))
+      map[name] = isSchemaObject(entry) ? compactSchema(entry, seen) : entry;
+    out[key] = map;
+  }
+  return out;
+}
+function isSchemaObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function headerOptions(parameters) {
   const seen = /* @__PURE__ */ new Set();
   const headers = [];
@@ -2966,10 +3207,15 @@ function createHandler(config) {
       if (value !== void 0)
         input.headers.set(p.name, String(value));
     }
+    for (const name of config.forwardHeaders ?? []) {
+      const value = context.request?.headers.get(name);
+      if (!input.headers.has(name) && value !== null && value !== void 0)
+        input.headers.set(name, value);
+    }
     if (body && !input.headers.has("content-type"))
       input.headers.set("content-type", "application/json");
-    const request = buildRequest(input);
-    const response = await config.fetch(request);
+    const request2 = buildRequest(input);
+    const response = await config.fetch(request2);
     const output = await parseResponse(response);
     if (!output.ok)
       return context.error({
@@ -3005,7 +3251,174 @@ function coerceIfNeeded(schema) {
   return desc ? coerced.describe(desc) : coerced;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Skill.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/McpSource.js
+var protocolVersion = "2025-06-18";
+async function resolve2(source, options = {}) {
+  const session = sourceSession(source);
+  await request(session, "initialize", {
+    protocolVersion,
+    capabilities: {},
+    clientInfo: { name: "incur", version: options.version ?? "1.0.0" }
+  });
+  session.initialized = true;
+  await request(session, "notifications/initialized");
+  const result = await request(session, "tools/list");
+  const listed = result.tools ?? [];
+  if (isProgressiveCatalog(listed))
+    return { discovery: "progressive", tools: await discoverTools(session), session };
+  return { tools: listed, session };
+}
+function generateCommands2(resolved) {
+  const commands = /* @__PURE__ */ new Map();
+  for (const tool of resolved.tools) {
+    const options = tool.inputSchema ? inputOptions(tool.inputSchema) : void 0;
+    const output = outputSchema(tool.outputSchema);
+    commands.set(tool.name, {
+      description: tool.description,
+      ...tool.annotations ? { mcp: { annotations: tool.annotations } } : void 0,
+      ...options ? { options } : void 0,
+      ...output ? { output } : void 0,
+      async run(context) {
+        const parameters = { name: tool.name, arguments: { ...context.args, ...context.options } };
+        const result = await request(resolved.session, "tools/call", resolved.discovery === "progressive" ? {
+          name: tool.annotations?.readOnlyHint === true ? "call_read_tool" : "call_write_tool",
+          arguments: parameters
+        } : parameters);
+        if (result.isError)
+          return context.error({ code: "MCP_TOOL_ERROR", message: resultText(result) });
+        return resultValue(result);
+      }
+    });
+  }
+  return commands;
+}
+function isProgressiveCatalog(tools) {
+  if (tools.length !== 4)
+    return false;
+  const names = new Set(tools.map((tool) => tool.name));
+  return names.has("search_tools") && names.has("get_tool_details") && names.has("call_read_tool") && names.has("call_write_tool");
+}
+async function discoverTools(session) {
+  const tools = [];
+  let offset = 0;
+  while (offset !== void 0) {
+    const search = await callRemoteTool(session, "search_tools", {
+      query: "",
+      limit: 20,
+      offset
+    });
+    for (const match of search.tools ?? []) {
+      if (!match.name)
+        continue;
+      const tool = await callRemoteTool(session, "get_tool_details", {
+        name: match.name
+      });
+      if (tool.name)
+        tools.push(tool);
+    }
+    if (search.nextOffset !== void 0 && search.nextOffset <= offset)
+      throw new Error("MCP tool catalog returned a non-advancing offset");
+    offset = search.nextOffset;
+  }
+  return tools;
+}
+async function callRemoteTool(session, name, arguments_) {
+  const result = await request(session, "tools/call", { name, arguments: arguments_ });
+  if (result.isError)
+    throw new Error(resultText(result) || `MCP tool failed: ${name}`);
+  return resultValue(result);
+}
+function sourceSession(source) {
+  if (typeof source === "string" || source instanceof URL)
+    return { url: new URL(source), fetch: globalThis.fetch.bind(globalThis) };
+  return {
+    url: new URL(source.url),
+    fetch: source.fetch ?? globalThis.fetch.bind(globalThis),
+    ...source.headers ? { headers: source.headers } : void 0
+  };
+}
+async function request(session, method, params) {
+  const notification = method.startsWith("notifications/");
+  const id = notification ? void 0 : crypto.randomUUID();
+  const headers = new Headers(session.headers);
+  headers.set("content-type", "application/json");
+  headers.set("accept", "application/json, text/event-stream");
+  if (session.id)
+    headers.set("mcp-session-id", session.id);
+  if (session.initialized)
+    headers.set("MCP-Protocol-Version", protocolVersion);
+  const body = JSON.stringify({ jsonrpc: "2.0", ...id ? { id } : void 0, method, params });
+  const response = await session.fetch(new Request(session.url, { method: "POST", headers, body }));
+  const sessionId = response.headers.get("mcp-session-id");
+  if (sessionId)
+    session.id = sessionId;
+  if (!response.ok)
+    throw new Error(`MCP HTTP ${response.status}`);
+  if (notification && response.status === 202)
+    return {};
+  const text4 = await response.text();
+  if (!text4)
+    return {};
+  const contentType = response.headers.get("content-type") ?? "";
+  const message = contentType.includes("text/event-stream") ? parseSse(text4, id) : JSON.parse(text4);
+  if (message.error)
+    throw new Error(message.error.message ?? "MCP request failed");
+  return message.result ?? {};
+}
+function parseSse(text4, id) {
+  for (const event of text4.split(/\r?\n\r?\n/)) {
+    const data = event.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+    if (!data)
+      continue;
+    const message = JSON.parse(data);
+    if (id === void 0 || message.id === id)
+      return message;
+  }
+  throw new Error("MCP SSE response did not include the matching JSON-RPC message");
+}
+function inputOptions(schema) {
+  const properties = schema.properties ?? {};
+  const required = new Set(schema.required ?? []);
+  const shape = {};
+  for (const [key, property] of Object.entries(properties)) {
+    let zodType = toZod(property);
+    if (!required.has(key))
+      zodType = zodType.optional();
+    if (typeof property.description === "string")
+      zodType = zodType.describe(property.description);
+    shape[key] = coerceIfNeeded(zodType);
+  }
+  return Object.keys(shape).length > 0 ? external_exports.object(shape) : void 0;
+}
+function outputSchema(schema) {
+  if (!schema || schema.type !== "object")
+    return void 0;
+  try {
+    return external_exports.fromJSONSchema(schema);
+  } catch {
+    return void 0;
+  }
+}
+function resultText(result) {
+  const content = Array.isArray(result.content) ? result.content : [];
+  return content.map((item) => item.type === "text" ? item.text : "").filter(Boolean).join("\n");
+}
+function resultValue(result) {
+  if (result.structuredContent !== void 0)
+    return result.structuredContent;
+  const content = Array.isArray(result.content) ? result.content : [];
+  const textItems = content.filter((item) => item.type === "text").map((item) => item.text);
+  if (textItems.length === 1) {
+    try {
+      return JSON.parse(textItems[0]);
+    } catch {
+      return textItems[0];
+    }
+  }
+  return textItems;
+}
+
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Skill.js
 import { createHash } from "crypto";
 function index(name, commands, description) {
   const lines = [`# ${name}`];
@@ -3160,14 +3573,14 @@ ${rows.join("\n")}`);
 ${rows.join("\n")}`);
   }
   if (cmd.output) {
-    const outputSchema = toJsonSchema(cmd.output);
-    const table2 = schemaToTable(outputSchema);
+    const outputSchema2 = toJsonSchema(cmd.output);
+    const table2 = schemaToTable(outputSchema2);
     if (table2)
       sections.push(`${sub} Output
 
 ${table2}`);
     else {
-      const type = resolveTypeName2(outputSchema);
+      const type = resolveTypeName2(outputSchema2);
       sections.push(`${sub} Output
 
 Type: \`${type}\``);
@@ -3249,7 +3662,7 @@ function resolveTypeName2(prop) {
   return "unknown";
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/SyncMcp.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/SyncMcp.js
 import { execFile } from "child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
@@ -3300,8 +3713,16 @@ function registerAmp(name, command) {
   return true;
 }
 function defaultCommand(name, runner) {
+  if (isStandaloneBinary())
+    return `"${process.execPath}" --mcp`;
   return shouldUseBareCommand(name) ? `${name} --mcp` : `${runner} ${detectPackageSpecifier(name)} --mcp`;
 }
+function isStandaloneBinary() {
+  const bin = process.argv[1]?.replace(/\\/g, "/");
+  if (!bin)
+    return false;
+  return bin.startsWith("/$bunfs/") || bin.includes("/~BUN/");
+}
 function nodeModulesInfo() {
   const normalized = process.argv[1]?.replace(/\\/g, "/");
   const match = normalized?.match(/^(.+)\/node_modules\/(.+)$/);
@@ -3377,24 +3798,24 @@ function splitCommand(input) {
   return tokens;
 }
 function exec(cmd, args) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     execFile(cmd, args, (error, stdout, stderr) => {
       if (error) {
         const msg = stderr?.trim() || stdout?.trim() || error.message;
         reject(new Error(msg));
       } else
-        resolve5({ stdout, stderr });
+        resolve6({ stdout, stderr });
     });
   });
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/SyncSkills.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/SyncSkills.js
 import fsSync from "fs";
 import fs2 from "fs/promises";
 import os2 from "os";
 import path2 from "path";
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/internal/agents.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/internal/agents.js
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -3674,7 +4095,7 @@ function resolveParent(dir) {
   }
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/SyncSkills.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/SyncSkills.js
 async function sync(name, commands, options = {}) {
   const { depth = 1, description, global = true } = options;
   const cwd = options.cwd ?? (global ? resolvePackageRoot() : process.cwd());
@@ -3835,7 +4256,7 @@ function readHash(name) {
   return readMeta(name)?.hash;
 }
 
-// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3/node_modules/incur/dist/Cli.js
+// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+9e4339e90ed46153268c0183d5f49245598bed57/node_modules/incur/dist/Cli.js
 var destructiveCommandHint = "Confirm with the user before executing this destructive command.";
 function create(nameOrDefinition, definition) {
   const name = typeof nameOrDefinition === "string" ? nameOrDefinition : nameOrDefinition.name;
@@ -3848,7 +4269,8 @@ function create(nameOrDefinition, definition) {
   const middlewares = [];
   const pending = [];
   const mcpHandler = createMcpHttpHandler(name, def.version ?? "0.0.0", {
-    stateless: def.mcp?.stateless
+    stateless: def.mcp?.stateless,
+    tools: def.mcp?.tools
   });
   if (def.openapi && rootFetch) {
     pending.push((async () => {
@@ -3867,6 +4289,21 @@ function create(nameOrDefinition, definition) {
     vars: def.vars,
     command(nameOrCli, def2) {
       if (typeof nameOrCli === "string") {
+        if (isMcpSourceDefinition(def2)) {
+          pending.push((async () => {
+            const resolved = await resolve2(def2.mcp);
+            const generated = generateCommands2(resolved);
+            const entry2 = {
+              _group: true,
+              description: def2.description,
+              commands: generated,
+              ...def2.outputPolicy ? { outputPolicy: def2.outputPolicy } : void 0
+            };
+            assertNoGlobalOptionConflicts(nameOrCli, entry2, toGlobals.get(cli2));
+            commands.set(nameOrCli, entry2);
+          })());
+          return cli2;
+        }
         if (def2 && "fetch" in def2 && isFetchSource(def2.fetch)) {
           const fetch3 = resolveFetch(def2.fetch);
           if (def2.openapi) {
@@ -3882,7 +4319,8 @@ function create(nameOrDefinition, definition) {
                 _group: true,
                 description: def2.description,
                 commands: generated,
-                ...def2.outputPolicy ? { outputPolicy: def2.outputPolicy } : void 0
+                ...def2.outputPolicy ? { outputPolicy: def2.outputPolicy } : void 0,
+                ...def2.mcp === false ? { mcp: false } : void 0
               };
               assertNoGlobalOptionConflicts(nameOrCli, entry2, toGlobals.get(cli2));
               commands.set(nameOrCli, entry2);
@@ -4023,7 +4461,8 @@ function create(nameOrDefinition, definition) {
 async function serveImpl(name, commands, argv2, options = {}) {
   const stdout = options.stdout ?? ((s) => process.stdout.write(s));
   const exit = options.exit ?? ((code) => process.exit(code));
-  const human = process.stdout.isTTY === true;
+  const tty = process.stdout.isTTY === true;
+  let human = tty;
   const configEnabled = options.config !== void 0;
   const configFlag = options.config?.flag;
   const displayName = resolveDisplayName(name, options.aliases);
@@ -4058,6 +4497,7 @@ async function serveImpl(name, commands, argv2, options = {}) {
     return;
   }
   const { fullOutput, format: formatFlag, formatExplicit, filterOutput, tokenLimit, tokenOffset, tokenCount, llms, llmsFull, mcp: mcpFlag, help, version, schema, configPath: configPath2, configDisabled, rest } = builtinFlags;
+  human = tty && !formatExplicit;
   let globals = {};
   let filtered = rest;
   function parseGlobalOptions(validate) {
@@ -4091,7 +4531,8 @@ async function serveImpl(name, commands, argv2, options = {}) {
       env: options.envSchema,
       vars: options.vars,
       version: options.version,
-      ...options.mcp?.instructions ? { instructions: options.mcp.instructions } : void 0
+      ...options.mcp?.instructions ? { instructions: options.mcp.instructions } : void 0,
+      ...options.mcp?.tools ? { tools: options.mcp.tools } : void 0
     });
     return;
   }
@@ -4666,7 +5107,7 @@ async function serveImpl(name, commands, argv2, options = {}) {
     const cta = output.meta.cta;
     if (human && !fullOutput) {
       if (output.ok && output.data != null && renderOutput) {
-        const custom = !formatExplicit && options.renderer != null ? options.renderer(output.data) : null;
+        const custom = options.renderer != null ? options.renderer(output.data) : null;
         const rendered = custom ?? format2(output.data, format3);
         const t = truncate(rendered);
         writeln(t.text);
@@ -4752,8 +5193,8 @@ async function serveImpl(name, commands, argv2, options = {}) {
       const input = parseArgv(fetchRest);
       if (fetchGateway.basePath)
         input.path = fetchGateway.basePath + input.path;
-      const request = buildRequest(input);
-      const response = await fetchGateway.fetch(request);
+      const request2 = buildRequest(input);
+      const response = await fetchGateway.fetch(request2);
       if (isStreamingResponse(response)) {
         const generator = parseStreamingResponse(response);
         await handleStreaming(generator, {
@@ -4972,27 +5413,17 @@ function createMcpHttpHandler(name, version, options = {}) {
     if (!transport) {
       const { fromJsonSchema, McpServer, WebStandardStreamableHTTPServerTransport } = await import("./dist-2MZJLO2W.js");
       const server = new McpServer({ name, version });
-      for (const tool of collectTools(commands, [])) {
-        const mergedShape = {
-          ...tool.command.args?.shape,
-          ...tool.command.options?.shape
-        };
-        const hasInput = Object.keys(mergedShape).length > 0;
-        server.registerTool(tool.name, {
-          ...tool.description ? { description: tool.description } : void 0,
-          ...hasInput ? { inputSchema: external_exports.object(mergedShape) } : void 0,
-          ...tool.outputSchema ? { outputSchema: fromJsonSchema(tool.outputSchema) } : void 0
-        }, async (...callArgs) => {
-          const params = hasInput ? callArgs[0] : {};
-          return callTool(tool, params, {
-            name,
-            version,
-            middlewares: mcpOptions?.middlewares,
-            env: mcpOptions?.env,
-            vars: mcpOptions?.vars
-          });
-        });
-      }
+      registerTools(server, commands, {
+        env: mcpOptions?.env,
+        fromJsonSchema,
+        middlewares: mcpOptions?.middlewares,
+        name,
+        request: (extra) => extra?.http?.req,
+        sendNotification: (notification) => server.server.notification(notification),
+        tools: options.tools,
+        vars: mcpOptions?.vars,
+        version
+      });
       const transportOptions = stateless ? { enableJsonResponse: true } : {
         sessionIdGenerator: () => crypto.randomUUID(),
         enableJsonResponse: true
@@ -5073,15 +5504,15 @@ async function fetchImpl(name, commands, req, options = {}) {
     }
     return new Response("Not Found", { status: 404 });
   }
-  let inputOptions = {};
+  let inputOptions2 = {};
   if (req.method === "GET")
     for (const [key, value] of url.searchParams)
-      inputOptions[key] = value;
+      inputOptions2[key] = value;
   else {
     try {
       const contentType = req.headers.get("content-type") ?? "";
       if (contentType.includes("application/json"))
-        inputOptions = await req.json();
+        inputOptions2 = await req.json();
     } catch {
     }
   }
@@ -5093,7 +5524,7 @@ async function fetchImpl(name, commands, req, options = {}) {
   }
   if (segments.length === 0) {
     if (options.rootCommand)
-      return executeCommand(name, options.rootCommand, [], inputOptions, start, options);
+      return executeCommand(name, options.rootCommand, [], inputOptions2, req, start, options);
     return jsonResponse({
       ok: false,
       error: { code: "COMMAND_NOT_FOUND", message: "No root command defined." },
@@ -5127,12 +5558,12 @@ async function fetchImpl(name, commands, req, options = {}) {
     return resolved.fetchGateway.fetch(req);
   const { command, path: path8, rest } = resolved;
   const groupMiddlewares = "middlewares" in resolved ? resolved.middlewares : [];
-  return executeCommand(path8, command, rest, inputOptions, start, {
+  return executeCommand(path8, command, rest, inputOptions2, req, start, {
     ...options,
     groupMiddlewares
   });
 }
-async function executeCommand(path8, command, rest, inputOptions, start, options) {
+async function executeCommand(path8, command, rest, inputOptions2, request2, start, options) {
   function jsonResponse(body, status) {
     return new Response(stringify(body), {
       status,
@@ -5145,12 +5576,12 @@ async function executeCommand(path8, command, rest, inputOptions, start, options
     ...command.middleware ?? []
   ];
   let globals = {};
-  let commandInputOptions = inputOptions;
+  let commandInputOptions = inputOptions2;
   if (options.globals) {
     const globalKeys = new Set(Object.keys(options.globals.schema.shape));
     const rawGlobals = {};
     commandInputOptions = {};
-    for (const [key, value] of Object.entries(inputOptions)) {
+    for (const [key, value] of Object.entries(inputOptions2)) {
       if (globalKeys.has(key))
         rawGlobals[key] = value;
       else
@@ -5180,6 +5611,7 @@ async function executeCommand(path8, command, rest, inputOptions, start, options
     name: options.name ?? path8,
     parseMode: "split",
     path: path8,
+    request: request2,
     vars: options.vars,
     version: options.version
   });
@@ -5637,10 +6069,15 @@ async function runMcpDoctor(name, commands, options) {
     env: options.envSchema,
     vars: options.vars,
     version: options.version,
-    ...options.mcp?.instructions ? { instructions: options.mcp.instructions } : void 0
+    ...options.mcp?.instructions ? { instructions: options.mcp.instructions } : void 0,
+    tools: { ...options.mcp?.tools, discovery: "direct" }
   }).catch((error) => {
     serveError = error;
   });
+  let serveFinished = false;
+  void done.finally(() => {
+    serveFinished = true;
+  });
   input.write(`${stringify({
     jsonrpc: "2.0",
     id: 1,
@@ -5654,7 +6091,7 @@ async function runMcpDoctor(name, commands, options) {
 `);
   input.write(`${stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })}
 `);
-  await new Promise((resolve5) => setTimeout(resolve5, 20));
+  await waitForMcpDoctorResponses(chunks, () => serveFinished);
   input.end();
   await done;
   if (serveError)
@@ -5708,6 +6145,14 @@ async function runMcpDoctor(name, commands, options) {
     errors
   };
 }
+async function waitForMcpDoctorResponses(chunks, finished) {
+  const started = Date.now();
+  while (!finished() && (chunks.join("").match(/\n/g)?.length ?? 0) < 2) {
+    if (Date.now() - started >= 1e3)
+      return;
+    await new Promise((resolve6) => setTimeout(resolve6, 5));
+  }
+}
 function parseMcpDoctorResponses(chunks) {
   const responses2 = [];
   for (const line of chunks.join("").split(/\r?\n/)) {
@@ -5756,6 +6201,14 @@ function isFetchSource(value) {
   const source = value;
   return typeof source.fetch === "function" && source.url instanceof URL;
 }
+function isMcpSourceDefinition(value) {
+  if (typeof value !== "object" || value === null || !("mcp" in value))
+    return false;
+  const source = value.mcp;
+  if (typeof source === "string" || source instanceof URL)
+    return true;
+  return typeof source === "object" && source !== null && "url" in source;
+}
 function resolveFetch(source) {
   if (typeof source === "function")
     return source;
@@ -6046,8 +6499,8 @@ function collectCommands(commands, prefix) {
       if (entry.description)
         cmd.description = entry.description;
       const inputSchema = buildInputSchema(entry.args, entry.env, entry.options);
-      const outputSchema = entry.output ? toJsonSchema(entry.output) : void 0;
-      if (inputSchema || outputSchema) {
+      const outputSchema2 = entry.output ? toJsonSchema(entry.output) : void 0;
+      if (inputSchema || outputSchema2) {
         cmd.schema = {};
         if (inputSchema?.args)
           cmd.schema.args = inputSchema.args;
@@ -6055,8 +6508,8 @@ function collectCommands(commands, prefix) {
           cmd.schema.env = inputSchema.env;
         if (inputSchema?.options)
           cmd.schema.options = inputSchema.options;
-        if (outputSchema)
-          cmd.schema.output = outputSchema;
+        if (outputSchema2)
+          cmd.schema.output = outputSchema2;
       }
       const examples = formatExamples(entry.examples);
       if (examples) {
@@ -6138,7 +6591,7 @@ function collectSkillCommands(commands, prefix, groups, rootCommand) {
   return result.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
 }
 function isDestructive(command) {
-  return command.destructive === true || command.mcp?.annotations?.destructiveHint === true;
+  return command.destructive === true || command.mcp !== false && command.mcp?.annotations?.destructiveHint === true;
 }
 function appendDestructiveHint(hint) {
   if (!hint)
@@ -7005,6 +7458,66 @@ var native_spec_default = {
                       "null"
                     ]
                   },
+                  tax_collection_enabled_states: {
+                    description: "US state codes (50 states plus `DC`) where the account collects tax. Replaces the full set on update. Only settable when `tax_remitted_by` is `self`.",
+                    items: {
+                      enum: [
+                        "AL",
+                        "AK",
+                        "AZ",
+                        "AR",
+                        "CA",
+                        "CO",
+                        "CT",
+                        "DE",
+                        "DC",
+                        "FL",
+                        "GA",
+                        "HI",
+                        "ID",
+                        "IL",
+                        "IN",
+                        "IA",
+                        "KS",
+                        "KY",
+                        "LA",
+                        "ME",
+                        "MD",
+                        "MA",
+                        "MI",
+                        "MN",
+                        "MS",
+                        "MO",
+                        "MT",
+                        "NE",
+                        "NV",
+                        "NH",
+                        "NJ",
+                        "NM",
+                        "NY",
+                        "NC",
+                        "ND",
+                        "OH",
+                        "OK",
+                        "OR",
+                        "PA",
+                        "RI",
+                        "SC",
+                        "SD",
+                        "TN",
+                        "TX",
+                        "UT",
+                        "VT",
+                        "VA",
+                        "WA",
+                        "WV",
+                        "WI",
+                        "WY"
+                      ],
+                      type: "string"
+                    },
+                    type: "array"
+                  },
                   tax_identifiers: {
                     description: "Account tax/VAT registrations to add or update. When `tax_remitted_by` is `self`, tax is calculated and collected only in the countries where the account holds a registration.",
                     items: {
@@ -16891,6 +17404,15 @@ var native_spec_default = {
                               "null"
                             ]
                           },
+                          income_source: {
+                            description: "Which income source the commission is on: product-sales gross profit or Whop Ads spend billed to the business.",
+                            enum: [
+                              "sales",
+                              "ad_spend"
+                            ],
+                            example: "sales",
+                            type: "string"
+                          },
                           object: {
                             enum: [
                               "partner_business_earning"
@@ -17050,6 +17572,7 @@ var native_spec_default = {
                           "product",
                           "status",
                           "second_tier",
+                          "income_source",
                           "transaction_amount_usd",
                           "payout_percentage",
                           "commission_amount_usd",
@@ -26103,6 +26626,13 @@ var native_spec_default = {
               "null"
             ]
           },
+          tax_collection_enabled_states: {
+            items: {
+              description: "US state codes (of the 50 states plus `DC`) where the account collects tax: the full set when Whop remits (`tax_remitted_by` `whop`), the configured subset when the account self-remits (`self`), and empty when neither. On update, send the complete list to replace it (only allowed when `self`).",
+              type: "string"
+            },
+            type: "array"
+          },
           tax_identifiers: {
             description: "Account tax/VAT registrations, each with `id`, `tax_id_type`, and `tax_id_value`. Empty when none are set.",
             type: "array"
@@ -26191,6 +26721,7 @@ var native_spec_default = {
           "product_tax_code",
           "business_address",
           "tax_identifiers",
+          "tax_collection_enabled_states",
           "total_usd",
           "balances",
           "verification",
@@ -36268,7 +36799,7 @@ import { createRequire as createRequire2 } from "module";
 // src/lib/build-info.ts
 var buildChannel = true ? "npm" : "dev";
 var buildTarget = typeof WHOP_CLI_TARGET === "string" ? WHOP_CLI_TARGET : null;
-var buildVersion = true ? "0.8.2" : null;
+var buildVersion = true ? "0.9.0" : null;
 function isHomebrewPath(execPath, env = process.env) {
   if (/[/\\](Cellar|homebrew|linuxbrew)[/\\]/.test(execPath)) return true;
   const prefix = env.HOMEBREW_PREFIX?.trim();
@@ -37257,7 +37788,7 @@ var HTTP_METHODS = /* @__PURE__ */ new Set([
 ]);
 var API_VERSION_HEADER = "Api-Version-Date";
 var API_VERSION_DATE = native_spec_default.info["x-api-version-date"];
-var HIDDEN_PARAMS = /* @__PURE__ */ new Set(["authorization", "api-version-date"]);
+var HIDDEN_PARAMS = /* @__PURE__ */ new Set(["api-version-date"]);
 var AUTO_FILLED_PARAMS = /* @__PURE__ */ new Set(["company_id", "account_id"]);
 function hiddenParamRefs(spec2) {
   const refs = /* @__PURE__ */ new Set();
@@ -37281,9 +37812,8 @@ function isHiddenParam(p, hiddenRefs) {
   return typeof rec.name === "string" && HIDDEN_PARAMS.has(rec.name.toLowerCase());
 }
 function transformParams(op, hiddenRefs) {
-  const { security: _security, ...rest } = op;
-  const params = rest.parameters;
-  if (!Array.isArray(params)) return rest;
+  const params = op.parameters;
+  if (!Array.isArray(params)) return op;
   const relaxed = params.filter((p) => !isHiddenParam(p, hiddenRefs)).map((p) => {
     if (p != null && typeof p === "object" && AUTO_FILLED_PARAMS.has(
       String(p.name ?? "")
@@ -37292,7 +37822,7 @@ function transformParams(op, hiddenRefs) {
     }
     return p;
   });
-  return { ...rest, parameters: relaxed };
+  return { ...op, parameters: relaxed };
 }
 function filterSpecByTag(spec2, tag) {
   const hiddenRefs = hiddenParamRefs(spec2);
@@ -37383,7 +37913,7 @@ async function resolveActiveAccountId() {
   return resolveAccountId(profile, normalizeApiKey(rawKey));
 }
 function createWhopFetch() {
-  return async (request) => {
+  return async (request2) => {
     const profile = getActiveProfile();
     const rawKey = profile ? await getValidAccessToken(profile) : process.env.WHOP_API_KEY ?? null;
     if (!rawKey) {
@@ -37391,11 +37921,11 @@ function createWhopFetch() {
       return Response.json({ message: message2 }, { status: 401 });
     }
     const token = normalizeApiKey(rawKey);
-    const incomingUrl = new URL(request.url);
-    const op = findOperation(request.method, incomingUrl.pathname);
+    const incomingUrl = new URL(request2.url);
+    const op = findOperation(request2.method, incomingUrl.pathname);
     const accountId = await resolveAccountId(profile, token);
-    const method = request.method.toUpperCase();
-    let body = request.body ? await request.text() : void 0;
+    const method = request2.method.toUpperCase();
+    let body = request2.body ? await request2.text() : void 0;
     if (op && accountId) {
       if (method === "GET" || method === "DELETE" || method === "HEAD") {
         for (const name of ACCOUNT_FIELDS) {
@@ -37436,13 +37966,13 @@ function createWhopFetch() {
     }
     const base = apiBaseUrl().replace(/\/$/, "");
     const target = `${base}${incomingUrl.pathname}${incomingUrl.search}`;
-    const headers = new Headers(request.headers);
+    const headers = new Headers(request2.headers);
     headers.set("Authorization", `Bearer ${token}`);
     headers.set("Content-Type", "application/json");
     if (!headers.has(API_VERSION_HEADER)) {
       headers.set(API_VERSION_HEADER, API_VERSION_DATE);
     }
-    const res = await fetch(target, { method: request.method, headers, body });
+    const res = await fetch(target, { method: request2.method, headers, body });
     if (res.ok) {
       if (method === "POST" || method === "PATCH") {
         const text5 = await res.text();
@@ -37669,7 +38199,7 @@ import { isCancel as isCancel3, select as select2, spinner as spinner2, text as
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
-import { join as join6, relative as relative2, resolve as resolve4 } from "path";
+import { join as join6, relative as relative2, resolve as resolve5 } from "path";
 import chalk from "chalk";
 
 // src/journey/client.ts
@@ -37808,18 +38338,18 @@ async function waitForBuildPromotion(buildId, timeoutMs = 3e4) {
   return latest;
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 
 // src/apps/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join4, resolve as resolve3 } from "path";
+import { join as join4, resolve as resolve4 } from "path";
 var APP_CONFIG_FILENAME = "whop.app.json";
 function findProjectDir(startDir) {
-  let dir = resolve3(startDir ?? process.cwd());
+  let dir = resolve4(startDir ?? process.cwd());
   for (let i = 0; i < 25; i++) {
     if (existsSync3(join4(dir, APP_CONFIG_FILENAME))) return dir;
-    const parent = resolve3(dir, "..");
+    const parent = resolve4(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -38191,7 +38721,8 @@ async function registerSpecCommands(group, tag) {
   const spec2 = filterSpecByTag(apps_spec_default, tag);
   const generated = await Openapi_exports.generateCommands(
     spec2,
-    createWhopFetch()
+    createWhopFetch(),
+    { config: { security: false } }
   );
   for (const [name, entry] of generated) {
     if ("run" in entry) group.command(name, entry);
@@ -38210,7 +38741,7 @@ function ensurePackageManager() {
   });
 }
 async function ensureViteApp(c2, pm, dirOption) {
-  const projectDir = dirOption ? resolve4(dirOption) : findProjectDir() ?? process.cwd();
+  const projectDir = dirOption ? resolve5(dirOption) : findProjectDir() ?? process.cwd();
   const isViteApp = existsSync5(join6(projectDir, "package.json")) && findViteConfig(projectDir) !== void 0;
   if (isViteApp) return { projectDir, freshlyScaffolded: false };
   if (c2.agent) {
@@ -38271,7 +38802,7 @@ async function scaffoldNewApp(c2, pm) {
       retryable: true
     });
   }
-  const targetDir = resolve4(`./${route}`);
+  const targetDir = resolve5(`./${route}`);
   if (existsSync5(targetDir) && readdirSync2(targetDir).length > 0) {
     throw new DeployAbort({
       code: "TARGET_NOT_EMPTY",
@@ -38500,9 +39031,9 @@ var LOG_LEVEL_COLORS = {
 function printLogLine(row) {
   const time = row.created_at.replace("T", " ").replace("Z", "");
   const color = LOG_LEVEL_COLORS[row.level] ?? chalk.dim;
-  const request = row.request_method ? chalk.dim(` ${row.request_method} ${row.request_path ?? ""}`) : "";
+  const request2 = row.request_method ? chalk.dim(` ${row.request_method} ${row.request_path ?? ""}`) : "";
   console.log(
-    `${chalk.dim(time)} ${color(row.level.padEnd(5))}${request}  ${row.message}`
+    `${chalk.dim(time)} ${color(row.level.padEnd(5))}${request2}  ${row.message}`
   );
   if (row.stack) console.log(chalk.dim(row.stack));
 }
@@ -38634,7 +39165,7 @@ async function buildAppGroup() {
       dir: external_exports.string().optional().describe("Project directory (defaults to the current directory)")
     }),
     run: async (c2) => {
-      const projectDir = c2.options.dir ? resolve4(c2.options.dir) : findProjectDir();
+      const projectDir = c2.options.dir ? resolve5(c2.options.dir) : findProjectDir();
       const config = projectDir ? readAppConfig(projectDir) : null;
       if (!projectDir || !config) {
         return c2.error({
@@ -39664,7 +40195,8 @@ async function buildMediaGroup(description) {
   const spec2 = filterSpecByTag(native_spec_default, "Media");
   const generated = await Openapi_exports.generateCommands(
     spec2,
-    whopFetch2
+    whopFetch2,
+    { config: { security: false } }
   );
   const getEntry = generated.get("get");
   for (const [name, entry] of generated) {
@@ -39801,13 +40333,13 @@ async function fetchAsset(c2, getEntry, id, progress) {
   }
 }
 function sleep2(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 
 // package.json
 var package_default = {
   name: "@whop/cli",
-  version: "0.8.2",
+  version: "0.9.0",
   description: "The Whop CLI \u2014 build and manage Whop apps from your terminal. Human and agent friendly.",
   keywords: [
     "agent",
@@ -39866,7 +40398,7 @@ var package_default = {
   devDependencies: {
     "@types/node": "25.3.5",
     fflate: "0.8.2",
-    incur: "github:whopio/incur#fbe3f4dbf48f1bc780cb1bca476f7dade1fe12d3",
+    incur: "github:whopio/incur#9e4339e90ed46153268c0183d5f49245598bed57",
     tsup: "8.5.0",
     tsx: "4.19.4",
     typescript: "5.9.3",
@@ -40973,7 +41505,12 @@ for (const { name, tag, description } of API_GROUPS) {
     cli.command(await buildMediaGroup(description));
     continue;
   }
-  cli.command(name, { description, fetch: fetch2, openapi: spec(tag) });
+  cli.command(name, {
+    description,
+    fetch: fetch2,
+    openapi: spec(tag),
+    openapiConfig: { security: false }
+  });
 }
 var cli_default = cli;