askpillar 0.0.0-stage → 0.3.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PILLAR
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,165 @@
-# Temporary Holding Version
+# PILLAR
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+![PILLAR](https://askpillar.ai/brand/tent.svg)
+
+Scripture-grounded, independently reviewed Christian guidance from [PILLAR](https://askpillar.ai), available inside Claude and ChatGPT.
+
+Both the npm CLI and the separate plugin package connect to **https://mcp.askpillar.ai/mcp**. The plugin’s `pillar-guidance` skill applies when the user explicitly requests PILLAR. It instructs the model to call `ask_pillar`, present PILLAR's answer exactly as returned, and send requested follow-ups back to PILLAR using the returned `conversation_id`. The model must preserve PILLAR's Scripture references and attribution, and must never supply additional verse quotations or translations from memory. `get_pillar_usage` is reserved for explicit PILLAR usage questions.
+
+## PILLAR CLI for coding agents
+
+The CLI connects **Codex, Claude Code, and Cursor** to the same hosted PILLAR MCP and existing PILLAR accounts. It supports macOS/Linux with Node.js 22 and a browser on the same computer. No separate API key or new PILLAR account is needed.
+
+Install the PILLAR CLI with:
+
+```sh
+npx askpillar install
+```
+
+The install command asks which client to connect, then opens browser sign-in and finishes automatically. Running without a command displays help. Coding agents can select the client without a terminal prompt:
+
+```sh
+npx askpillar install --client codex
+```
+
+Use `--client claude`, `--client cursor`, `--client codex,claude`, or `--client all` for other clients. The product and installed command remain **PILLAR / `pillar`**; the npm package is **`askpillar`**. The package exposes only the `pillar` executable; npx resolves that executable from the `askpillar` package automatically.
+
+To build and test the local artifact before an authorized release:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm pack:cli
+npx --yes "file:$(pwd)/dist/askpillar-0.3.2.tgz" install
+```
+
+Run the local build commands from the repository root, or pass an absolute tarball path from another directory. Publishing to npm is a separate, explicitly authorized release operation.
+
+Installation opens PILLAR's existing browser sign-in. Choose **Google** or **email magic link**, complete any required PILLAR account setup, and approve access. Open email links in the same browser profile on this computer. Leave the terminal running; the loopback callback resumes setup automatically. Login expires after five minutes and can be retried. SSH/headless authentication and a browser on another device are not supported.
+
+The CLI verifies a real authenticated `get_profile` MCP call before configuring the selected clients. This check does not generate guidance or consume inference quota. Authentication does not prove a guidance answer was generated. **Restart the selected client or start a new session** to load PILLAR. The CLI installs the MCP connection; the plugin's guidance skill remains available through the plugin installation instructions below.
+
+Manage the connection with:
+
+```sh
+npx askpillar login
+npx askpillar status --json
+npx askpillar logout
+```
+
+`login` starts a fresh browser authorization. `install` reuses valid credentials and refreshes them as necessary. Repeating installation with the same bundle leaves matching client configuration byte-for-byte unchanged. Exact older CLI-generated Codex entries receive the new timeout settings automatically; custom settings are preserved. It preserves unrelated servers, settings, and comments, and refuses malformed configuration or an existing different `pillar` entry. Resolve that entry manually rather than replacing another connection silently. Concurrent edits detected before replacement fail with a retry message; clients should be closed while editing their configuration.
+
+| Client | User configuration |
+| --- | --- |
+| Codex | `~/.codex/config.toml`, or `$CODEX_HOME/config.toml` |
+| Claude Code | `~/.claude.json`, or `$CLAUDE_CONFIG_DIR/.claude.json` |
+| Cursor | `~/.cursor/mcp.json` |
+
+The installer writes user-level configuration and checks the current project separately. `status` distinguishes `userState` (what is installed globally) from `state` in the checked working directory. Claude local/project entries and Cursor project entries are preserved and reported as `shadowed` when they override this bridge. Codex project overrides are checked against the recorded project trust; unknown trust is reported as `project_override`. Unreadable project configuration is `scope_unknown`, not a claim that PILLAR is active. Other projects' Claude local entries do not block installation. The output names the checked directory, winning scope, and configuration file without printing server settings or credentials. Explicit launch flags, external profiles, and organization policies may further affect a client and are not evaluated by this inspection.
+
+Codex entries use `startup_timeout_sec = 45` and `tool_timeout_sec = 210`, allowing overhead beyond the bridge's 20-second initialization and 180-second tool budgets. Custom shorter timeouts or disabled entries remain unchanged and produce warnings. The bridge preserves remote server instructions and capabilities during initialization. Its long-lived SSE connection has a response-header deadline but no fixed stream lifetime; process cancellation still closes it.
+
+Client configuration contains the absolute Node executable path, the local bridge command, and the applicable client timeout settings. The bundled bridge is copied to `~/.pillar/runtime/pillar.mjs`, so deleting the source checkout or npx cache does not break it. If you move/remove the Node installation, remove the old `pillar` client entry and reinstall using the new Node executable.
+
+Credentials live only in `~/.pillar/credentials.json` (mode `0600`, parent `0700`), outside the current project. This is an owner-readable file, **not an encrypted OS keychain**; applications running as your OS user can read it. Tokens, authorization codes, and provider error bodies are never printed. The CLI uses a public OAuth client with S256 PKCE and state validation, pins PILLAR's existing issuer, refuses credential-bearing HTTP redirects, and serializes token rotation across local processes. Refresh happens automatically when the bridge needs it; the bridge never opens a browser on its own. Browser sign-in holds no credential lock while waiting, so existing connections can continue and refresh. A protected, non-secret `login-generation.json` marker prevents an older browser login from overwriting a newer login or undoing logout. Lock recovery messages identify the exact path and owner PID; do not delete an active lock. Lock release checks that the path still belongs to the holder.
+
+`logout` deletes this CLI's local credentials, including refresh credentials. Future bridge calls must sign in again; already in-flight calls may complete. It also invalidates pending browser logins and removes safely owned orphaned credential temporary files left by a crash. The non-secret generation marker remains. It leaves client configuration intact. **Server-side grant revocation is unavailable through the currently advertised OAuth metadata**, so logout reports `remoteRevoked: false`. It does not sign out PILLAR's website, mobile app, or independently configured native connectors.
+
+Use `--json` for one JSON result on stdout; progress goes to stderr. Success uses `{ "ok": true, ... }`, failures use `{ "ok": false, "error": { "code": "...", "message": "..." } }` and exit 1. Signed-out `status` is a successful inspection with `authenticated: false`; authenticated status includes `verifiedTool: "get_profile"` and per-client configuration states. Setup errors do not print raw exceptions or credentials. Configuration of multiple clients is sequential. A failure after an earlier client write returns `partial_install`, the completed client records, the failed client, and `restartRequired: true`; rerunning resumes safely. SIGINT/SIGTERM cancel startup, verification, and active bridge work, and stdin EOF closes the bridge even during startup.
+
+No backend or website changes are required for the existing OAuth flow. A production acceptance run still requires a human to complete Google or email sign-in and consent. Automated tests use a local callback and fixture OAuth/MCP services; they cannot establish that either external identity provider delivered a sign-in or magic link. Tests also exercise configuration precedence, preservation, concurrent authentication, refresh, logout, and packed npx execution without writing real client settings. Packed-process regressions drive initialize, tool listing, and authenticated tool calls through the actual extracted stdio executable, including first-signal cancellation and stdin EOF. The loopback fetch adapter used by those tests is excluded from the npm allowlist.
+
+## Package
+
+```text
+.claude-plugin/plugin.json       Claude manifest
+.claude-plugin/marketplace.json  Claude Code installation catalog
+.mcp.json                       Claude HTTP MCP connection
+plugin.json                     Portable Agent Plugins manifest
+mcp.json                        Portable Streamable HTTP connection; ChatGPT OAuth DCR
+skills/pillar-guidance/SKILL.md  Shared, provider-neutral instructions
+assets/                         Official PILLAR logo files
+LICENSE                         MIT license
+```
+
+## Install in Claude
+
+For Claude Code, add this repository's marketplace and install the plugin:
+
+```sh
+claude plugin marketplace add brandoncarneiro/pillar-plugin
+claude plugin install pillar-plugin@pillar-plugins --scope user
+```
+
+For a local checkout, replace the marketplace source with its absolute path. Restart the Claude Code session after installation. Run `/mcp` and authenticate the plugin's PILLAR server if prompted, then ask a question with `/pillar-plugin:pillar-guidance`.
+
+Claude Desktop shares Claude Code's user-scoped plugins with local Code sessions. For Claude chat or Cowork, use **Customize → Plugins → Add plugin → Upload plugin** to upload the packaged ZIP where custom plugin installation is available, then connect PILLAR through its normal OAuth flow. A standalone MCP connector supplies tools; the packaged skill supplies the answer-presentation instructions.
+
+## Use in ChatGPT
+
+Follow [OpenAI's plugin authoring and installation instructions](https://developers.openai.com/plugins/build/plugins) to install the portable package through the flow available in your ChatGPT workspace. The root `mcp.json` declares OAuth with `client.mode: "dcr"`; ChatGPT discovers PILLAR's authorization server and registers its client dynamically. Sign in to PILLAR and review the consent screen. No API key, client secret, or access token belongs in this package.
+
+Ask PILLAR a question about faith, Scripture, or everyday life. Continue with follow-ups in the same conversation. Skills guide model behavior; verify the returned answer in the host when testing an installation.
+
+The repository currently requires GitHub access. Building this package does not publish it to either provider's public directory.
+
+## Data sent to PILLAR
+
+`ask_pillar` receives the user's question and, for follow-ups, the PILLAR conversation ID. The host manages OAuth credentials. PILLAR processes the question under the connected account and maintains conversation history and usage. Connector turns may add account memory; existing memory items cannot be overwritten, modified, or deleted by connector turns. See PILLAR's [privacy policy](https://askpillar.ai/privacy) and [terms](https://askpillar.ai/terms).
+
+The successful guidance result contains exactly `answer`, `scripture_references`, and `conversation_id`. The MCP response also mirrors those same three fields in a JSON text block for hosts that expose only text content. The skill reads that mirror when structured content is unavailable, displays the answer once, preserves references and attribution, and keeps the ID for requested follow-ups. It does not display both answer copies or raw metadata unless explicitly requested. The conversation ID is needed to continue the correct PILLAR conversation and is not appended to the displayed answer. The skill does not send host transcripts or accumulated context. The authenticated `get_profile` tool identifies the connected profile with an opaque ID; it does not provide an account directory or user lookup.
+
+## Directory submission preparation
+
+The portable manifest includes five positive and three negative review scenarios. These are expected behaviors for reviewers to execute, not evidence that the deployed connector or either host has passed them. Run them with a dedicated sample account after the hosted tools and their metadata are deployed, including `get_profile`.
+
+Before OpenAI submission, supply a real reviewer-accessible video demonstrating the cases, verified publisher identity, domain verification, and reviewer account access through the secure dashboard. The package includes the public reviewer demo URL and omits all reviewer credentials. Keep the demo account available without MFA approval, email or SMS codes, magic links, or private-network access. Complete the required attestations only after verifying them. The current package is preparation material, not an approved or submitted listing.
+
+For Claude's native Connectors Directory, submit the hosted MCP server separately through [the connector portal](https://claude.ai/directory/manage). This plugin package does not create a connector listing. Follow [Claude's submission requirements](https://claude.com/docs/connectors/building/submission) and [OpenAI's submission requirements](https://developers.openai.com/plugins/deploy/submission) for the remaining listing and review materials. The text-only connector does not have an interactive UI to screenshot.
+
+## Validate and package
+
+This repository contains a declarative plugin package and the bundled CLI. The supported MCP service is hosted by `pillar-backend`; the CLI is a local stdio bridge to that service, not an implementation of the PILLAR backend. Existing plugin installation commands and OAuth connections are unchanged.
+
+Use Node.js 22 and pnpm 11.28.2 for development tooling:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm check
+```
+
+`pnpm check` runs Claude's pinned CLI in strict validation mode for both Claude manifests, validates the portable manifest and MCP configuration, checks the OpenAI fields and OAuth DCR configuration, runs package and CLI regression tests, then builds and verifies `dist/pillar-plugin.zip` and the standalone CLI. These checks use fixture services; none calls PILLAR or performs model inference. `pnpm validate`, `pnpm test`, and `pnpm build` can also run separately; `build` includes package validation, while Claude's official validation is a separate `validate:claude` step.
+
+The plugin ZIP build uses the explicit ten-file allowlist in `scripts/package.mjs`, preserving the prior upload layout. It includes both logos, both manifest formats, MCP configuration, the skill, README, and license. It excludes local configuration, credentials, dependencies, validation tooling, and obsolete runtime files. The ZIP is checked for unexpected, missing, duplicate, or changed entries and compared byte-for-byte with the source files. Package inputs cannot be symlinks. Known credential patterns in allowed files fail validation without printing their values. The allowlist excludes secret files; pattern checks are an additional safeguard, not a guarantee of detecting every possible secret embedded in prose or images.
+
+Portable validation uses vendored Agent Plugins 1.0.0 schemas, so checks do not depend on a live schema fetch. The published MCP schema excludes per-server extensions; the validator checks the exact documented OpenAI OAuth DCR configuration separately and applies the schema to the remaining portable core. OpenAI interface/review fields, PILLAR identity/version, skill references, required assets, and package metadata receive additional package-specific checks. These static checks do not execute directory review scenarios or establish host behavior, OAuth success, or Scripture correctness.
+
+The separate npm artifact has its own explicit allowlist: the standalone `dist/pillar.mjs` bundle, generated `dist/THIRD_PARTY_NOTICES.md` for bundled dependencies, package metadata, README, and license. The logo in this README uses a hosted URL so it also renders in the npm package. CLI dependencies are bundled during development; no dependency installation or postinstall script runs on the user machine. `pnpm pack:cli` creates the tarball without publishing it.
+
+
+Independent CI runs `bash scripts/ci/validate.sh` with Node.js 22 and pinned
+pnpm 11.28.2, preserves the frozen lockfile, and retains the validated ZIP with its
+SHA-256 digest and execution log outside GitHub. The operator-owned controller
+in `pillar-mobile/infrastructure/ci` polls GitHub directly and runs the reviewed
+gate in an isolated Linux guest without GitHub credentials. It publishes genuine
+`pillar-ci/validation` status on the exact head SHA and `pillar-ci/integration`
+status after validating the head merged with the current base. Its evidence
+records both commits and the tested tree; neither status authorizes publishing.
+
+GitHub Actions are disabled and no hosted workflow, Actions scheduler, artifact
+storage or cache is required. Keep CI independent of GitHub paid features and
+payment settings. If the host is asleep or offline, validation waits; an old green
+status does not validate a new commit or base. Gate updates require an explicit
+reviewed installation into the controller's protected guest gate directory. `vercel.json` keeps Git-triggered deployment disabled; this package has no Vercel function or rewrite. Publishing, host acceptance tests, and directory submission remain separate actions.
+
+## Logo and license
+
+The assets come from PILLAR's published [vector logo](https://askpillar.ai/brand/tent.svg) and [PNG logo](https://askpillar.ai/brand/library/v1/tent-blue-512.png). The vector retains its original paths, color, and viewBox, with a square 512px viewport for OpenAI's listing and composer icons. The PNG is unchanged. The package uses PILLAR's blue, `#2E5F86`.
+
+Package code and documentation are licensed under [MIT](LICENSE). PILLAR branding remains owned by PILLAR.
+
+## Format references
+
+- [Claude plugin manifest](https://code.claude.com/docs/en/plugins-reference)
+- [Claude installation](https://code.claude.com/docs/en/discover-plugins)
+- [OpenAI plugin packaging and DCR configuration](https://developers.openai.com/plugins/build/plugins)
+- [OpenAI OAuth authentication](https://developers.openai.com/plugins/build/auth)

package/dist/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,358 @@
+# Bundled dependency notices
+
+## @modelcontextprotocol/sdk@1.32.2
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2024 Anthropic, PBC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## ajv-formats@3.0.1
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2020 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## ajv@8.20.0
+
+### LICENSE
+
+The MIT License (MIT)
+
+Copyright (c) 2015-2021 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+
+## content-type@1.0.5
+
+### LICENSE
+
+(The MIT License)
+
+Copyright (c) 2015 Douglas Christopher Wilson
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+## eventsource-parser@3.1.1
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## fast-deep-equal@3.1.3
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## fast-uri@3.1.8
+
+### LICENSE
+
+Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
+Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * The names of any contributors may not be used to endorse or promote
+      products derived from this software without specific prior written
+      permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+                                  *   *   *
+
+The complete list of contributors can be found at:
+- https://github.com/garycourt/uri-js/graphs/contributors
+
+## json-schema-traverse@1.0.0
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2017 Evgeny Poberezkin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## jsonc-parser@3.3.1
+
+### LICENSE.md
+
+The MIT License (MIT)
+
+Copyright (c) Microsoft
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## pkce-challenge@5.0.1
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2019 
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+## smol-toml@1.9.1
+
+### LICENSE
+
+Copyright (c) Squirrel Chat et al., All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+## zod-to-json-schema@3.25.2
+
+### LICENSE
+
+ISC License
+
+Copyright (c) 2020, Stefan Terdell
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+## zod@4.6.7
+
+### LICENSE
+
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+