gogcli-mcp 3.0.0 → 4.0.1

package/dist/lib.js

@@ -74,7 +74,6 @@ __export(external_exports, {
   ZodPrefault: () => ZodPrefault,
   ZodPreprocess: () => ZodPreprocess,
   ZodPromise: () => ZodPromise,
-  ZodProperties: () => ZodProperties,
   ZodReadonly: () => ZodReadonly,
   ZodRealError: () => ZodRealError,
   ZodRecord: () => ZodRecord,
@@ -118,6 +117,7 @@ __export(external_exports, {
   creditCard: () => creditCard2,
   cuid: () => cuid3,
   cuid2: () => cuid22,
+  currencyCode: () => currencyCode2,
   custom: () => custom,
   date: () => date2,
   decode: () => decode2,
@@ -211,7 +211,7 @@ __export(external_exports, {
   preprocess: () => preprocess,
   prettifyError: () => prettifyError,
   promise: () => promise,
-  properties: () => properties,
+  properties: () => _properties,
   property: () => _property,
   readonly: () => readonly,
   record: () => record,
@@ -299,6 +299,7 @@ __export(core_exports2, {
   $ZodCheckMultipleOf: () => $ZodCheckMultipleOf,
   $ZodCheckNumberFormat: () => $ZodCheckNumberFormat,
   $ZodCheckOverwrite: () => $ZodCheckOverwrite,
+  $ZodCheckProperties: () => $ZodCheckProperties,
   $ZodCheckProperty: () => $ZodCheckProperty,
   $ZodCheckRegex: () => $ZodCheckRegex,
   $ZodCheckSizeEquals: () => $ZodCheckSizeEquals,
@@ -352,7 +353,6 @@ __export(core_exports2, {
   $ZodPrefault: () => $ZodPrefault,
   $ZodPreprocess: () => $ZodPreprocess,
   $ZodPromise: () => $ZodPromise,
-  $ZodProperties: () => $ZodProperties,
   $ZodReadonly: () => $ZodReadonly,
   $ZodRealError: () => $ZodRealError,
   $ZodRecord: () => $ZodRecord,
@@ -520,6 +520,7 @@ __export(core_exports2, {
   _xor: () => _xor,
   base64Charset: () => base64Charset,
   base64urlCharset: () => base64urlCharset,
+  canParseURL: () => canParseURL,
   clone: () => clone,
   compile: () => compile,
   compileFn: () => compileFn,
@@ -542,7 +543,6 @@ __export(core_exports2, {
   initializeContext: () => initializeContext,
   isBackEdge: () => isBackEdge,
   isRecursiveSchema: () => isRecursiveSchema,
-  isTransforming: () => isTransforming,
   isValidBase64: () => isValidBase64,
   isValidBase64URL: () => isValidBase64URL,
   isValidCIDRv6: () => isValidCIDRv6,
@@ -579,6 +579,7 @@ __export(core_exports2, {
   util: () => util_exports,
   validate: () => validate,
   validateAsync: () => validateAsync,
+  validateURL: () => validateURL,
   version: () => version,
   withParser: () => withParser
 });
@@ -1320,9 +1321,6 @@ function members(proto, table) {
     else
       defineBound(proto, key, desc.value);
   }
-  for (const sym of Object.getOwnPropertySymbols(table)) {
-    defineBound(proto, sym, table[sym]);
-  }
 }
 function own(inst, key, value, enumerable = true) {
   Object.defineProperty(inst, key, { configurable: true, writable: true, enumerable, value });
@@ -1475,8 +1473,7 @@ function $constructor(name, initializer3, proto, params) {
       } finally {
         _zodDesc.value = void 0;
       }
-    }
-    if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name)) {
       return;
     }
     inst._zod.traits.add(name);
@@ -1918,6 +1915,7 @@ __export(regexes_exports, {
   creditCard: () => creditCard,
   cuid: () => cuid,
   cuid2: () => cuid2,
+  currencyCode: () => currencyCode,
   date: () => date,
   datetime: () => datetime,
   domain: () => domain,
@@ -2016,6 +2014,7 @@ var domain = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
 var creditCard = /^\d(?:[ -]?\d){11,18}$/;
+var currencyCode = /^(?:AED|AFN|ALL|AMD|AOA|ARS|AUD|AWG|AZN|BAM|BBD|BDT|BHD|BIF|BMD|BND|BOB|BOV|BRL|BSD|BTN|BWP|BYN|BZD|CAD|CDF|CHE|CHF|CHW|CLF|CLP|CNY|COP|COU|CRC|CUP|CVE|CZK|DJF|DKK|DOP|DZD|EGP|ERN|ETB|EUR|FJD|FKP|GBP|GEL|GHS|GIP|GMD|GNF|GTQ|GYD|HKD|HNL|HTG|HUF|IDR|ILS|INR|IQD|IRR|ISK|JMD|JOD|JPY|KES|KGS|KHR|KMF|KPW|KRW|KWD|KYD|KZT|LAK|LBP|LKR|LRD|LSL|LYD|MAD|MDL|MGA|MKD|MMK|MNT|MOP|MRU|MUR|MVR|MWK|MXN|MXV|MYR|MZN|NAD|NGN|NIO|NOK|NPR|NZD|OMR|PAB|PEN|PGK|PHP|PKR|PLN|PYG|QAR|RON|RSD|RUB|RWF|SAR|SBD|SCR|SDG|SEK|SGD|SHP|SLE|SOS|SRD|SSP|STN|SVC|SYP|SZL|THB|TJS|TMT|TND|TOP|TRY|TTD|TWD|TZS|UAH|UGX|USD|USN|UYI|UYU|UYW|UZS|VED|VES|VND|VUV|WST|XAD|XAF|XAG|XAU|XBA|XBB|XBC|XBD|XCD|XCG|XDR|XOF|XPD|XPF|XPT|XSU|XTS|XUA|XXX|YER|ZAR|ZMW|ZWG)$/;
 var iban = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;
 var dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
 function anchor(source) {
@@ -2500,6 +2499,34 @@ var $ZodCheckProperty = /* @__PURE__ */ $constructor("$ZodCheckProperty", (inst,
     return;
   };
 });
+var $ZodCheckProperties = /* @__PURE__ */ $constructor("$ZodCheckProperties", (inst, def) => {
+  $ZodCheck.init(inst, def);
+  hide(inst, Symbol.iterator, function* () {
+    yield inst;
+  });
+  let entries;
+  inst._zod.check = (payload) => {
+    if (payload.value == null) {
+      payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
+      return void 0;
+    }
+    entries ?? (entries = Reflect.ownKeys(def.shape).map((key) => [key, def.shape[key]]));
+    const input2 = payload.value;
+    let proms;
+    for (const [key, schema] of entries) {
+      const result = schema._zod.run({ value: input2[key], issues: [] }, {});
+      if (result instanceof Promise) {
+        proms ?? (proms = []);
+        proms.push(result.then((result2) => handleCheckPropertyResult(result2, payload, key)));
+      } else {
+        handleCheckPropertyResult(result, payload, key);
+      }
+    }
+    if (proms)
+      return Promise.all(proms).then(() => void 0);
+    return void 0;
+  };
+});
 var $ZodCheckMimeType = /* @__PURE__ */ $constructor("$ZodCheckMimeType", (inst, def) => {
   $ZodCheck.init(inst, def);
   const mimeSet = new Set(def.mime);
@@ -2567,7 +2594,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 1
+  patch: 5
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -2755,11 +2782,32 @@ var $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
 });
 var URL_BAD_FORMAT = 1;
 var URL_UNPARSEABLE = 2;
+function canParseURL(input2) {
+  try {
+    if (typeof URL !== "undefined" && typeof URL.canParse === "function")
+      return URL.canParse(input2);
+    new URL(input2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function validateURL(trimmed, def) {
+  if (!("normalize" in def) && !("hostname" in def) && !("protocol" in def)) {
+    return canParseURL(trimmed) || URL_UNPARSEABLE;
+  }
+  return parseURLObject(trimmed, def);
+}
 function parseURLObject(trimmed, def) {
   if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed)) {
     return URL_BAD_FORMAT;
   }
   try {
+    if (typeof URL !== "undefined") {
+      const URLStatic = URL;
+      if (typeof URLStatic.parse === "function")
+        return URLStatic.parse(trimmed) ?? URL_UNPARSEABLE;
+    }
     return new URL(trimmed);
   } catch {
     return URL_UNPARSEABLE;
@@ -2782,7 +2830,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
   inst._zod.check = (payload) => {
     try {
       const trimmed = payload.value.trim();
-      const url2 = parseURLObject(trimmed, def);
+      const url2 = validateURL(trimmed, def);
       if (url2 === URL_BAD_FORMAT) {
         payload.issues.push({
           code: "invalid_format",
@@ -2804,6 +2852,10 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
         });
         return;
       }
+      if (url2 === true) {
+        payload.value = stripTabAndNewline(trimmed);
+        return;
+      }
       if (def.hostname && !urlHostnameOk(url2, def.hostname)) {
         payload.issues.push({
           code: "invalid_format",
@@ -2893,12 +2945,7 @@ var ipv6Alphabet = /^[0-9a-fA-F:.]+$/;
 function isValidIPv6(value) {
   if (!ipv6Alphabet.test(value))
     return false;
-  try {
-    new URL(`http://[${value}]`);
-    return true;
-  } catch {
-    return false;
-  }
+  return canParseURL(`http://[${value}]`);
 }
 var $ZodIPv6 = /* @__PURE__ */ $constructor("$ZodIPv6", (inst, def) => {
   def.pattern ?? (def.pattern = ipv6);
@@ -3371,7 +3418,7 @@ function handlePropertyResult(result, final, key, input2, optin, optout) {
     return;
   }
   if (result.value === void 0) {
-    if (isPresent) {
+    if (isPresent || optin === "defaulted" && !isOptionalOut) {
       final.value[key] = void 0;
     }
   } else {
@@ -3607,16 +3654,16 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
         doc.write(`
         if (${id}.issues.length) {${prefixStr(id, k)}
         }
-        
-        if (${id}.value === undefined) {
-          if (${isPresent}) {
-            newResult[${k}] = undefined;
-          }
+      `);
+        if (optin === "defaulted") {
+          doc.write(`newResult[${k}] = ${id}.value;`);
         } else {
+          doc.write(`
+        if (${id}.value !== undefined || ${isPresent}) {
           newResult[${k}] = ${id}.value;
         }
-
       `);
+        }
       }
     }
     doc.write(`payload.value = newResult;`);
@@ -4963,59 +5010,6 @@ function handleRefineResult(result, payload, input2, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-function handlePropertiesResult(result, payload, key) {
-  if (result.issues.length) {
-    payload.issues.push(...prefixIssues(key, result.issues));
-  }
-}
-var $ZodProperties = /* @__PURE__ */ $constructor("$ZodProperties", (inst, def) => {
-  $ZodType.init(inst, def);
-  $ZodCheck.init(inst, def);
-  const memo3 = globalConfig.memoizer;
-  memo3?.attach(inst);
-  let entries;
-  const runShape = (payload, ctx) => {
-    entries ?? (entries = Reflect.ownKeys(def.shape).map((key) => [key, def.shape[key]]));
-    const input2 = payload.value;
-    let proms;
-    for (const [key, schema] of entries) {
-      const result = schema._zod.run({ value: input2[key], issues: [] }, ctx);
-      if (result instanceof Promise) {
-        proms ?? (proms = []);
-        proms.push(result.then((result2) => handlePropertiesResult(result2, payload, key)));
-      } else {
-        handlePropertiesResult(result, payload, key);
-      }
-    }
-    if (proms)
-      return Promise.all(proms).then(() => void 0);
-    return void 0;
-  };
-  inst._zod.parse = (payload, ctx) => {
-    const input2 = payload.value;
-    if (input2 === null || typeof input2 !== "object" && typeof input2 !== "function") {
-      payload.issues.push({ expected: "object", code: "invalid_type", input: input2, inst });
-      return payload;
-    }
-    if (ctx.direction === "backward")
-      ctx = { ...ctx, direction: "forward" };
-    if (memo3)
-      memo3.alloc(inst, payload, input2, ctx);
-    const result = runShape(payload, ctx);
-    return result instanceof Promise ? result.then(() => payload) : payload;
-  };
-  inst._zod.check = (payload) => {
-    if (payload.value == null) {
-      payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
-      return void 0;
-    }
-    return runShape(payload, {});
-  };
-}, {
-  *[Symbol.iterator]() {
-    yield this;
-  }
-});
 
 // ../../node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
@@ -5027,7 +5021,7 @@ var $ZodCyclicError = class extends Error {
 var STATE = "~memo";
 var NO_ISSUES = [];
 function isRef(value) {
-  return value !== null && (typeof value === "object" || typeof value === "function");
+  return value !== null && typeof value === "object";
 }
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
@@ -5076,9 +5070,6 @@ function isRecursive(inst, stack, resolve) {
       check2(def.catchall);
       break;
     }
-    case "properties":
-      merge2(shape(def.shape, false));
-      break;
     case "array":
       check2(def.element);
       break;
@@ -5406,6 +5397,7 @@ var error = () => {
     json_string: "\u0646\u064E\u0635 \u0639\u0644\u0649 \u0647\u064A\u0626\u0629 JSON",
     e164: "\u0631\u0642\u0645 \u0647\u0627\u062A\u0641 \u0628\u0645\u0639\u064A\u0627\u0631 E.164",
     credit_card: "\u0631\u0642\u0645 \u0628\u0637\u0627\u0642\u0629 \u0627\u0644\u0627\u0626\u062A\u0645\u0627\u0646",
+    currency_code: "\u0631\u0645\u0632 \u0627\u0644\u0639\u0645\u0644\u0629",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0645\u062F\u062E\u0644"
@@ -5517,6 +5509,7 @@ var error2 = () => {
     json_string: "JSON string",
     e164: "E.164 number",
     credit_card: "kredit kart\u0131 n\xF6mr\u0259si",
+    currency_code: "valyuta kodu",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -5677,6 +5670,7 @@ var error3 = () => {
     json_string: "JSON \u0440\u0430\u0434\u043E\u043A",
     e164: "\u043D\u0443\u043C\u0430\u0440 E.164",
     credit_card: "\u043D\u0443\u043C\u0430\u0440 \u043A\u0440\u044D\u0434\u044B\u0442\u043D\u0430\u0439 \u043A\u0430\u0440\u0442\u044B",
+    currency_code: "\u043A\u043E\u0434 \u0432\u0430\u043B\u044E\u0442\u044B",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0443\u0432\u043E\u0434"
@@ -5795,6 +5789,7 @@ var error4 = () => {
     json_string: "JSON \u043D\u0438\u0437",
     e164: "E.164 \u043D\u043E\u043C\u0435\u0440",
     credit_card: "\u043D\u043E\u043C\u0435\u0440 \u043D\u0430 \u043A\u0440\u0435\u0434\u0438\u0442\u043D\u0430 \u043A\u0430\u0440\u0442\u0430",
+    currency_code: "\u043A\u043E\u0434 \u043D\u0430 \u0432\u0430\u043B\u0443\u0442\u0430",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0432\u0445\u043E\u0434"
@@ -5920,6 +5915,7 @@ var error5 = () => {
     json_string: "JSON \u09B8\u09CD\u099F\u09CD\u09B0\u09BF\u0982",
     e164: "E.164 \u09A8\u09AE\u09CD\u09AC\u09B0",
     credit_card: "\u0995\u09CD\u09B0\u09C7\u09A1\u09BF\u099F \u0995\u09BE\u09B0\u09CD\u09A1 \u09A8\u09AE\u09CD\u09AC\u09B0",
+    currency_code: "\u09AE\u09C1\u09A6\u09CD\u09B0\u09BE \u0995\u09CB\u09A1",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0987\u09A8\u09AA\u09C1\u099F"
@@ -6033,6 +6029,7 @@ var error6 = () => {
     json_string: "cadena JSON",
     e164: "n\xFAmero E.164",
     credit_card: "n\xFAmero de targeta de cr\xE8dit",
+    currency_code: "codi de moneda",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "entrada"
@@ -6146,6 +6143,7 @@ var error7 = () => {
     json_string: "\u062F\u06D5\u0642\u06CC JSON",
     e164: "\u0698\u0645\u0627\u0631\u06D5\u06CC E.164",
     credit_card: "\u0698\u0645\u0627\u0631\u06D5\u06CC \u06A9\u0627\u0631\u062A\u06CC \u06A9\u0631\u06CE\u062F\u06CC\u062A",
+    currency_code: "\u06A9\u06C6\u062F\u06CC \u062F\u0631\u0627\u0648",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u062A\u06CE\u06A9\u0631\u062F\u06D5"
@@ -6278,6 +6276,7 @@ var error8 = () => {
     json_string: "\u0159et\u011Bzec ve form\xE1tu JSON",
     e164: "\u010D\xEDslo E.164",
     credit_card: "\u010D\xEDslo kreditn\xED karty",
+    currency_code: "k\xF3d m\u011Bny",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "vstup"
@@ -6394,6 +6393,7 @@ var error9 = () => {
     json_string: "JSON-streng",
     e164: "E.164-nummer",
     credit_card: "kreditkortnummer",
+    currency_code: "valutakode",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -6514,6 +6514,7 @@ var error10 = () => {
     json_string: "JSON-String",
     e164: "E.164-Nummer",
     credit_card: "Kreditkartennummer",
+    currency_code: "W\xE4hrungscode",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "Eingabe"
@@ -6627,6 +6628,7 @@ var error11 = () => {
     json_string: "\u03C3\u03C5\u03BC\u03B2\u03BF\u03BB\u03BF\u03C3\u03B5\u03B9\u03C1\u03AC JSON",
     e164: "\u03B1\u03C1\u03B9\u03B8\u03BC\u03CC\u03C2 E.164",
     credit_card: "\u03B1\u03C1\u03B9\u03B8\u03BC\u03CC\u03C2 \u03C0\u03B9\u03C3\u03C4\u03C9\u03C4\u03B9\u03BA\u03AE\u03C2 \u03BA\u03AC\u03C1\u03C4\u03B1\u03C2",
+    currency_code: "\u03BA\u03C9\u03B4\u03B9\u03BA\u03CC\u03C2 \u03BD\u03BF\u03BC\u03AF\u03C3\u03BC\u03B1\u03C4\u03BF\u03C2",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u03B5\u03AF\u03C3\u03BF\u03B4\u03BF\u03C2"
@@ -6738,6 +6740,7 @@ var error12 = () => {
     base64url: "base64url-encoded string",
     json_string: "JSON string",
     e164: "E.164 number",
+    currency_code: "currency code",
     credit_card: "credit card number",
     iban: "IBAN",
     jwt: "JWT",
@@ -6863,6 +6866,7 @@ var error13 = () => {
     json_string: "JSON-karaktraro",
     e164: "E.164-nombro",
     credit_card: "kreditkarta numero",
+    currency_code: "valuta kodo",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "enigo"
@@ -6976,6 +6980,7 @@ var error14 = () => {
     json_string: "cadena JSON",
     e164: "n\xFAmero E.164",
     credit_card: "n\xFAmero de tarjeta de cr\xE9dito",
+    currency_code: "c\xF3digo de moneda",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "entrada"
@@ -7113,6 +7118,7 @@ var error15 = () => {
     json_string: "JSON \u0631\u0634\u062A\u0647",
     e164: "E.164 \u0639\u062F\u062F",
     credit_card: "\u0634\u0645\u0627\u0631\u0647 \u06A9\u0627\u0631\u062A \u0627\u0639\u062A\u0628\u0627\u0631\u06CC",
+    currency_code: "\u06A9\u062F \u0627\u0631\u0632",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0648\u0631\u0648\u062F\u06CC"
@@ -7236,6 +7242,7 @@ var error16 = () => {
     json_string: "JSON-merkkijono",
     e164: "E.164-luku",
     credit_card: "luottokortin numero",
+    currency_code: "valuuttakoodi",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "templaattimerkkijono"
@@ -7348,6 +7355,7 @@ var error17 = () => {
     json_string: "cha\xEEne de caract\xE8res JSON",
     e164: "num\xE9ro au format E.164",
     credit_card: "num\xE9ro de carte de cr\xE9dit",
+    currency_code: "code de devise",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "entr\xE9e"
@@ -7478,6 +7486,7 @@ var error18 = () => {
     json_string: "cha\xEEne JSON",
     e164: "num\xE9ro E.164",
     credit_card: "num\xE9ro de carte de cr\xE9dit",
+    currency_code: "code de devise",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "entr\xE9e"
@@ -7590,6 +7599,7 @@ var error19 = () => {
     json_string: "JSON \u0AB8\u0ACD\u0A9F\u0ACD\u0AB0\u0ABF\u0A82\u0A97",
     e164: "E.164 \u0AA8\u0A82\u0AAC\u0AB0",
     credit_card: "\u0A95\u0ACD\u0AB0\u0AC7\u0AA1\u0ABF\u0A9F \u0A95\u0ABE\u0AB0\u0ACD\u0AA1 \u0AA8\u0A82\u0AAC\u0AB0",
+    currency_code: "\u0A9A\u0AB2\u0AA3 \u0A95\u0ACB\u0AA1",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0A87\u0AA8\u0AAA\u0AC1\u0A9F"
@@ -7739,6 +7749,7 @@ var error20 = () => {
     json_string: { label: "\u05DE\u05D7\u05E8\u05D5\u05D6\u05EA JSON", gender: "f" },
     e164: { label: "\u05DE\u05E1\u05E4\u05E8 E.164", gender: "m" },
     credit_card: { label: "\u05DE\u05E1\u05E4\u05E8 \u05DB\u05E8\u05D8\u05D9\u05E1 \u05D0\u05E9\u05E8\u05D0\u05D9", gender: "m" },
+    currency_code: { label: "\u05E7\u05D5\u05D3 \u05DE\u05D8\u05D1\u05E2", gender: "m" },
     iban: { label: "IBAN", gender: "m" },
     jwt: { label: "JWT", gender: "m" },
     template_literal: { label: "\u05E7\u05DC\u05D8", gender: "m" },
@@ -7904,6 +7915,7 @@ var error21 = () => {
     json_string: "JSON \u0938\u094D\u091F\u094D\u0930\u093F\u0902\u0917",
     e164: "E.164 \u0938\u0902\u0916\u094D\u092F\u093E",
     credit_card: "\u0915\u094D\u0930\u0947\u0921\u093F\u091F \u0915\u093E\u0930\u094D\u0921 \u0938\u0902\u0916\u094D\u092F\u093E",
+    currency_code: "\u092E\u0941\u0926\u094D\u0930\u093E \u0915\u094B\u0921",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0907\u0928\u092A\u0941\u091F"
@@ -8014,6 +8026,7 @@ var error22 = () => {
     json_string: "JSON tekst",
     e164: "E.164 broj",
     credit_card: "broj kreditne kartice",
+    currency_code: "kod valute",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "unos"
@@ -8141,6 +8154,7 @@ var error23 = () => {
     json_string: "JSON string",
     e164: "E.164 sz\xE1m",
     credit_card: "hitelk\xE1rtyasz\xE1m",
+    currency_code: "p\xE9nznemk\xF3d",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "bemenet"
@@ -8294,6 +8308,7 @@ var error24 = () => {
     json_string: "JSON \u057F\u0578\u0572",
     e164: "E.164 \u0570\u0561\u0574\u0561\u0580",
     credit_card: "\u056F\u0580\u0565\u0564\u056B\u057F \u0584\u0561\u0580\u057F\u056B \u0570\u0561\u0574\u0561\u0580",
+    currency_code: "\u0561\u0580\u056A\u0578\u0582\u0575\u0569\u056B \u056F\u0578\u0564",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0574\u0578\u0582\u057F\u0584"
@@ -8412,6 +8427,7 @@ var error25 = () => {
     json_string: "string JSON",
     e164: "angka E.164",
     credit_card: "nomor kartu kredit",
+    currency_code: "kode mata uang",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -8523,6 +8539,7 @@ var error26 = () => {
     json_string: "JSON strengur",
     e164: "E.164 t\xF6lugildi",
     credit_card: "kreditkortan\xFAmer",
+    currency_code: "gjaldmi\xF0ilsk\xF3\xF0i",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "gildi"
@@ -8637,6 +8654,7 @@ var error27 = () => {
     json_string: "stringa JSON",
     e164: "numero E.164",
     credit_card: "numero di carta di credito",
+    currency_code: "codice valuta",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -8750,6 +8768,7 @@ var error28 = () => {
     json_string: "JSON\u6587\u5B57\u5217",
     e164: "E.164\u756A\u53F7",
     credit_card: "\u30AF\u30EC\u30B8\u30C3\u30C8\u30AB\u30FC\u30C9\u756A\u53F7",
+    currency_code: "\u901A\u8CA8\u30B3\u30FC\u30C9",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u5165\u529B\u5024"
@@ -8862,6 +8881,7 @@ var error29 = () => {
     json_string: "JSON \u10D5\u10D4\u10DA\u10D8",
     e164: "E.164 \u10DC\u10DD\u10DB\u10D4\u10E0\u10D8",
     credit_card: "\u10E1\u10D0\u10D9\u10E0\u10D4\u10D3\u10D8\u10E2\u10DD \u10D1\u10D0\u10E0\u10D0\u10D7\u10D8\u10E1 \u10DC\u10DD\u10DB\u10D4\u10E0\u10D8",
+    currency_code: "\u10D5\u10D0\u10DA\u10E3\u10E2\u10D8\u10E1 \u10D9\u10DD\u10D3\u10D8",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u10E8\u10D4\u10E7\u10D5\u10D0\u10DC\u10D0"
@@ -8979,6 +8999,7 @@ var error30 = () => {
     json_string: "\u1781\u17D2\u179F\u17C2\u17A2\u1780\u17D2\u179F\u179A JSON",
     e164: "\u179B\u17C1\u1781 E.164",
     credit_card: "\u179B\u17C1\u1781\u1794\u17D0\u178E\u17D2\u178E\u17A5\u178E\u1791\u17B6\u1793",
+    currency_code: "\u1780\u17BC\u178A\u179A\u17BC\u1794\u17B7\u1799\u1794\u17D0\u178E\u17D2\u178E",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u1791\u17B7\u1793\u17D2\u1793\u1793\u17D0\u1799\u1794\u1789\u17D2\u1785\u17BC\u179B"
@@ -9099,6 +9120,7 @@ var error31 = () => {
     json_string: "JSON\u0CB8\u0CCD\u0C9F\u0CCD\u0CB0\u0CBF\u0C82\u0C97\u0CCD",
     e164: "E.164 \u0CB8\u0C82\u0C96\u0CCD\u0CAF\u0CC6",
     credit_card: "\u0C95\u0CCD\u0CB0\u0CC6\u0CA1\u0CBF\u0C9F\u0CCD \u0C95\u0CBE\u0CB0\u0CCD\u0CA1\u0CCD \u0CB8\u0C82\u0C96\u0CCD\u0CAF\u0CC6",
+    currency_code: "\u0C95\u0CB0\u0CC6\u0CA8\u0CCD\u0CB8\u0CBF \u0C95\u0CCB\u0CA1\u0CCD",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0C87\u0CA8\u0CCD\u0CAA\u0CC1\u0C9F\u0CCD"
@@ -9214,6 +9236,7 @@ var error32 = () => {
     json_string: "JSON \uBB38\uC790\uC5F4",
     e164: "E.164 \uBC88\uD638",
     credit_card: "\uC2E0\uC6A9\uCE74\uB4DC \uBC88\uD638",
+    currency_code: "\uD1B5\uD654 \uCF54\uB4DC",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\uC785\uB825"
@@ -9412,6 +9435,7 @@ var error33 = () => {
     json_string: "JSON eilut\u0117",
     e164: "E.164 numeris",
     credit_card: "kredito kortel\u0117s numeris",
+    currency_code: "valiutos kodas",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u012Fvestis"
@@ -9537,6 +9561,7 @@ var error34 = () => {
     json_string: "JSON \u043D\u0438\u0437\u0430",
     e164: "E.164 \u0431\u0440\u043E\u0458",
     credit_card: "\u0431\u0440\u043E\u0458 \u043D\u0430 \u043A\u0440\u0435\u0434\u0438\u0442\u043D\u0430 \u043A\u0430\u0440\u0442\u0438\u0447\u043A\u0430",
+    currency_code: "\u043A\u043E\u0434 \u043D\u0430 \u0432\u0430\u043B\u0443\u0442\u0430",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0432\u043D\u0435\u0441"
@@ -9651,6 +9676,7 @@ var error35 = () => {
     json_string: "string JSON",
     e164: "nombor E.164",
     credit_card: "nombor kad kredit",
+    currency_code: "kod mata wang",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -9763,6 +9789,7 @@ var error36 = () => {
     json_string: "JSON \u0938\u094D\u091F\u094D\u0930\u093F\u0919",
     e164: "E.164 \u0928\u092E\u094D\u092C\u0930",
     credit_card: "\u0915\u094D\u0930\u0947\u0921\u093F\u091F \u0915\u093E\u0930\u094D\u0921 \u0928\u092E\u094D\u092C\u0930",
+    currency_code: "\u092E\u0941\u0926\u094D\u0930\u093E \u0915\u094B\u0921",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0907\u0928\u092A\u0941\u091F"
@@ -9874,6 +9901,7 @@ var error37 = () => {
     json_string: "JSON string",
     e164: "E.164-nummer",
     credit_card: "creditcardnummer",
+    currency_code: "valutacode",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "invoer"
@@ -9989,6 +10017,7 @@ var error38 = () => {
     json_string: "JSON-streng",
     e164: "E.164-nummer",
     credit_card: "kredittkortnummer",
+    currency_code: "valutakode",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -10102,6 +10131,7 @@ var error39 = () => {
     json_string: "JSON-streng",
     e164: "E.164-nummer",
     credit_card: "kredittkortnummer",
+    currency_code: "valutakode",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -10215,6 +10245,7 @@ var error40 = () => {
     json_string: "JSON metin",
     e164: "E.164 say\u0131s\u0131",
     credit_card: "i'tib\xE2r kart\u0131 numaras\u0131",
+    currency_code: "para birimi kodu",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "giren"
@@ -10329,6 +10360,7 @@ var error41 = () => {
     json_string: "JSON \u0645\u062A\u0646",
     e164: "\u062F E.164 \u0634\u0645\u06D0\u0631\u0647",
     credit_card: "\u062F \u06A9\u0631\u06CC\u0689\u06CC\u067C \u06A9\u0627\u0631\u062A \u0634\u0645\u06CC\u0631\u0647",
+    currency_code: "\u062F \u0627\u0633\u0639\u0627\u0631\u0648 \u06A9\u0648\u0689",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0648\u0631\u0648\u062F\u064A"
@@ -10448,6 +10480,7 @@ var error42 = () => {
     json_string: "ci\u0105g znak\xF3w w formacie JSON",
     e164: "liczba E.164",
     credit_card: "numer karty kredytowej",
+    currency_code: "kod waluty",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "wej\u015Bcie"
@@ -10562,6 +10595,7 @@ var error43 = () => {
     json_string: "o texto JSON",
     e164: "o n\xFAmero E.164",
     credit_card: "o n\xFAmero de cart\xE3o de cr\xE9dito",
+    currency_code: "o c\xF3digo de moeda",
     iban: "o IBAN",
     jwt: "o JWT",
     template_literal: "a entrada"
@@ -10705,6 +10739,7 @@ var error44 = () => {
     json_string: "o texto JSON",
     e164: "o n\xFAmero E.164",
     credit_card: "o n\xFAmero de cart\xE3o de cr\xE9dito",
+    currency_code: "o c\xF3digo de moeda",
     iban: "o IBAN",
     jwt: "o JWT",
     template_literal: "a entrada"
@@ -10849,6 +10884,7 @@ var error45 = () => {
     json_string: "\u0219ir JSON",
     e164: "num\u0103r E.164",
     credit_card: "num\u0103r de card de credit",
+    currency_code: "cod valutar",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "intrare"
@@ -11021,6 +11057,7 @@ var error46 = () => {
     json_string: "JSON \u0441\u0442\u0440\u043E\u043A\u0430",
     e164: "\u043D\u043E\u043C\u0435\u0440 E.164",
     credit_card: "\u043D\u043E\u043C\u0435\u0440 \u043A\u0440\u0435\u0434\u0438\u0442\u043D\u043E\u0439 \u043A\u0430\u0440\u0442\u044B",
+    currency_code: "\u043A\u043E\u0434 \u0432\u0430\u043B\u044E\u0442\u044B",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0432\u0432\u043E\u0434"
@@ -11139,6 +11176,7 @@ var error47 = () => {
     json_string: "re\u0165azec vo form\xE1te JSON",
     e164: "\u010D\xEDslo E.164",
     credit_card: "\u010D\xEDslo kreditnej karty",
+    currency_code: "k\xF3d meny",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "vstup"
@@ -11255,6 +11293,7 @@ var error48 = () => {
     json_string: "JSON niz",
     e164: "E.164 \u0161tevilka",
     credit_card: "\u0161tevilka kreditne kartice",
+    currency_code: "koda valute",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "vnos"
@@ -11369,6 +11408,7 @@ var error49 = () => {
     json_string: "JSON-str\xE4ng",
     e164: "E.164-nummer",
     credit_card: "kreditkortsnummer",
+    currency_code: "valutakod",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "mall-literal"
@@ -11484,6 +11524,7 @@ var error50 = () => {
     json_string: "JSON \u0B9A\u0BB0\u0BAE\u0BCD",
     e164: "E.164 \u0B8E\u0BA3\u0BCD",
     credit_card: "\u0B95\u0B9F\u0BA9\u0BCD \u0B85\u0B9F\u0BCD\u0B9F\u0BC8 \u0B8E\u0BA3\u0BCD",
+    currency_code: "\u0BA8\u0BBE\u0BA3\u0BAF\u0B95\u0BCD \u0B95\u0BC1\u0BB1\u0BBF\u0BAF\u0BC0\u0B9F\u0BC1",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input"
@@ -11599,6 +11640,7 @@ var error51 = () => {
     json_string: "\u0441\u0430\u0442\u0440\u0438 JSON",
     e164: "\u0440\u0430\u049B\u0430\u043C\u0438 E.164",
     credit_card: "\u0440\u0430\u049B\u0430\u043C\u0438 \u043A\u043E\u0440\u0442\u0438 \u043A\u0440\u0435\u0434\u0438\u0442\u04E3",
+    currency_code: "\u0440\u0430\u043C\u0437\u0438 \u0430\u0441\u044A\u043E\u0440",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0432\u0443\u0440\u0443\u0434"
@@ -11715,6 +11757,7 @@ var error52 = () => {
     json_string: "\u0E02\u0E49\u0E2D\u0E04\u0E27\u0E32\u0E21\u0E41\u0E1A\u0E1A JSON",
     e164: "\u0E40\u0E1A\u0E2D\u0E23\u0E4C\u0E42\u0E17\u0E23\u0E28\u0E31\u0E1E\u0E17\u0E4C\u0E23\u0E30\u0E2B\u0E27\u0E48\u0E32\u0E07\u0E1B\u0E23\u0E30\u0E40\u0E17\u0E28 (E.164)",
     credit_card: "\u0E2B\u0E21\u0E32\u0E22\u0E40\u0E25\u0E02\u0E1A\u0E31\u0E15\u0E23\u0E40\u0E04\u0E23\u0E14\u0E34\u0E15",
+    currency_code: "\u0E23\u0E2B\u0E31\u0E2A\u0E2A\u0E01\u0E38\u0E25\u0E40\u0E07\u0E34\u0E19",
     iban: "IBAN",
     jwt: "\u0E42\u0E17\u0E40\u0E04\u0E19 JWT",
     template_literal: "\u0E02\u0E49\u0E2D\u0E21\u0E39\u0E25\u0E17\u0E35\u0E48\u0E1B\u0E49\u0E2D\u0E19"
@@ -11830,6 +11873,7 @@ var error53 = () => {
     json_string: "JSON setiri",
     e164: "E.164 nomeri",
     credit_card: "kredit kartyny\u0148 nomeri",
+    currency_code: "wal\xFDuta kody",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u015Fablon"
@@ -11937,6 +11981,7 @@ var error54 = () => {
     json_string: "JSON dizesi",
     e164: "E.164 say\u0131s\u0131",
     credit_card: "kredi kart\u0131 numaras\u0131",
+    currency_code: "para birimi kodu",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u015Eablon dizesi"
@@ -12047,6 +12092,7 @@ var error55 = () => {
     json_string: "\u0440\u044F\u0434\u043E\u043A JSON",
     e164: "\u043D\u043E\u043C\u0435\u0440 E.164",
     credit_card: "\u043D\u043E\u043C\u0435\u0440 \u043A\u0440\u0435\u0434\u0438\u0442\u043D\u043E\u0457 \u043A\u0430\u0440\u0442\u043A\u0438",
+    currency_code: "\u043A\u043E\u0434 \u0432\u0430\u043B\u044E\u0442\u0438",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0432\u0445\u0456\u0434\u043D\u0456 \u0434\u0430\u043D\u0456"
@@ -12165,6 +12211,7 @@ var error56 = () => {
     json_string: "\u062C\u06D2 \u0627\u06CC\u0633 \u0627\u0648 \u0627\u06CC\u0646 \u0633\u0679\u0631\u0646\u06AF",
     e164: "\u0627\u06CC 164 \u0646\u0645\u0628\u0631",
     credit_card: "\u06A9\u0631\u06CC\u0688\u0679 \u06A9\u0627\u0631\u0688 \u0646\u0645\u0628\u0631",
+    currency_code: "\u06A9\u0631\u0646\u0633\u06CC \u06A9\u0648\u0688",
     iban: "IBAN",
     jwt: "\u062C\u06D2 \u0688\u0628\u0644\u06CC\u0648 \u0679\u06CC",
     template_literal: "\u0627\u0646 \u067E\u0679"
@@ -12280,6 +12327,7 @@ var error57 = () => {
     json_string: "JSON satr",
     e164: "E.164 raqam",
     credit_card: "kredit karta raqami",
+    currency_code: "valyuta kodi",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "kirish"
@@ -12393,6 +12441,7 @@ var error58 = () => {
     json_string: "chu\u1ED7i JSON",
     e164: "s\u1ED1 E.164",
     credit_card: "s\u1ED1 th\u1EBB t\xEDn d\u1EE5ng",
+    currency_code: "m\xE3 ti\u1EC1n t\u1EC7",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u0111\u1EA7u v\xE0o"
@@ -12506,6 +12555,7 @@ var error59 = () => {
     json_string: "JSON\u5B57\u7B26\u4E32",
     e164: "E.164\u53F7\u7801",
     credit_card: "\u4FE1\u7528\u5361\u53F7",
+    currency_code: "\u8D27\u5E01\u4EE3\u7801",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u8F93\u5165"
@@ -12620,6 +12670,7 @@ var error60 = () => {
     json_string: "JSON \u5B57\u4E32",
     e164: "E.164 \u6578\u503C",
     credit_card: "\u4FE1\u7528\u5361\u865F",
+    currency_code: "\u8CA8\u5E63\u4EE3\u78BC",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u8F38\u5165"
@@ -12732,6 +12783,7 @@ var error61 = () => {
     json_string: "\u1ECD\u0300r\u1ECD\u0300 JSON",
     e164: "n\u1ECD\u0301mb\xE0 E.164",
     credit_card: "n\u1ECDmba kaadi gbese",
+    currency_code: "koodu ow\xF3",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "\u1EB9\u0300r\u1ECD \xECb\xE1w\u1ECDl\xE9"
@@ -13110,7 +13162,7 @@ function generateChecks(doc, ctx, schema, accessor) {
         generatePropertyCheck(doc, ctx, def, currentAccessor);
         break;
       case "properties":
-        generatePropertiesChecks(doc, ctx, def, currentAccessor, false);
+        generatePropertiesChecks(doc, ctx, def, currentAccessor);
         break;
       case "overwrite": {
         const newAccessor = newVar(ctx);
@@ -13220,11 +13272,11 @@ function generateMimeTypeCheck(doc, ctx, def, accessor) {
     doc.write(`if (!${mimeSet}.has(${accessor}.type)) return INVALID;`);
   }
 }
-function generatePropertiesChecks(doc, ctx, def, accessor, schemaRole) {
+function generatePropertiesChecks(doc, ctx, def, accessor) {
   if (def.when) {
     throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
   }
-  doc.write(schemaRole ? `if (${accessor} === null || (typeof ${accessor} !== "object" && typeof ${accessor} !== "function")) return INVALID;` : `if (${accessor} == null) return INVALID;`);
+  doc.write(`if (${accessor} == null) return INVALID;`);
   const shape = def.shape;
   for (const key of Reflect.ownKeys(shape)) {
     const keyExpr = typeof key === "symbol" ? addConstant(ctx, key) : esc(key);
@@ -13314,7 +13366,7 @@ var PATTERN_IS_COMPLETE = /* @__PURE__ */ new Set([
   "uuid",
   "xid"
 ]);
-function generateStringFormatCheck(doc, ctx, def, accessor) {
+function generateStringFormatCheck(doc, ctx, def, accessor, needsValue = true) {
   const fmt = def.format;
   if (fmt === "base64") {
     const validator = addConstant(ctx, isValidBase64);
@@ -13354,7 +13406,7 @@ function generateStringFormatCheck(doc, ctx, def, accessor) {
   }
   const formatDef = def;
   if (fmt === "url" || fmt === "httpurl" || formatDef.normalize || formatDef.hostname !== void 0 || formatDef.protocol !== void 0) {
-    const parseConst = addConstant(ctx, parseURLObject);
+    const parseConst = addConstant(ctx, validateURL);
     const defConst = addConstant(ctx, def);
     const trimVar = newVar(ctx);
     const urlVar = newVar(ctx);
@@ -13369,6 +13421,8 @@ function generateStringFormatCheck(doc, ctx, def, accessor) {
       const protocolConst = addConstant(ctx, urlProtocolOk);
       doc.write(`if (!${protocolConst}(${urlVar}, ${defConst}.protocol)) return INVALID;`);
     }
+    if (!needsValue)
+      return null;
     const outputVar = newVar(ctx);
     const outputExpr = formatDef.normalize ? `${urlVar}.href` : `${addConstant(ctx, stripTabAndNewline)}(${trimVar})`;
     doc.write(`const ${outputVar} = ${outputExpr};`);
@@ -13428,7 +13482,7 @@ function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
   let typeAccessor;
   switch (type) {
     case "string":
-      typeAccessor = generateStringCheck(doc, ctx, schema, accessor);
+      typeAccessor = generateStringCheck(doc, ctx, schema, accessor, buildsValue);
       break;
     case "number":
       typeAccessor = generateNumberCheck(doc, schema, accessor);
@@ -13534,10 +13588,6 @@ function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
     case "custom":
       typeAccessor = generateCustomCheck(doc, ctx, schema, accessor);
       break;
-    case "properties":
-      generatePropertiesChecks(doc, ctx, schema._zod.def, accessor, true);
-      typeAccessor = accessor;
-      break;
     case "transform":
       typeAccessor = generateTransformCheck(doc, ctx, schema, accessor);
       break;
@@ -13553,12 +13603,12 @@ function generateCheck(doc, ctx, schema, accessor, needsValue = true) {
     return null;
   return generateChecks(doc, ctx, schema, typeAccessor);
 }
-function generateStringCheck(doc, ctx, schema, accessor) {
+function generateStringCheck(doc, ctx, schema, accessor, needsValue = true) {
   doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
   const def = schema._zod.def;
   if (def.format === void 0)
     return accessor;
-  return generateStringFormatCheck(doc, ctx, def, accessor);
+  return generateStringFormatCheck(doc, ctx, def, accessor, needsValue);
 }
 function generateNumberCheck(doc, schema, accessor) {
   doc.write(`if (typeof ${accessor} !== "number" || !Number.isFinite(${accessor})) return INVALID;`);
@@ -13676,7 +13726,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
     }
   }
   const outputVar = newVar(ctx);
-  const hasConditionalKeys = allKeys.some((k) => mayOutputUndefined(propShape[k]) || dropsWhenAbsent(propShape[k]));
+  const hasConditionalKeys = allKeys.some((k) => mayOmitUndefined(propShape[k]) || dropsWhenAbsent(propShape[k]));
   if (!buildsValue) {
     if (unknownKeysMode === "schema") {
       const knownSet = keys.length > 0 ? addConstant(ctx, new Set(keys)) : null;
@@ -13703,7 +13753,7 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
       const out = propOutputs.get(k);
       if (dropsWhenAbsent(propShape[k])) {
         doc.write(`if (${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
-      } else if (mayOutputUndefined(propShape[k])) {
+      } else if (mayOmitUndefined(propShape[k])) {
         doc.write(`if (${out} !== undefined || ${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
       } else {
         doc.write(`${outputVar}[${kx}] = ${out};`);
@@ -13836,6 +13886,9 @@ function fastPathAcceptsAbsence(schema) {
 function dropsWhenAbsent(schema) {
   return schema._zod.optin === "optional" && schema._zod.optout === "optional";
 }
+function mayOmitUndefined(schema) {
+  return (schema._zod.optin !== "defaulted" || schema._zod.optout === "optional") && mayOutputUndefined(schema);
+}
 function mayOutputUndefined(schema) {
   const def = schema._zod.def;
   switch (def.type) {
@@ -14455,20 +14508,18 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
 }
 
 // ../../node_modules/zod/v4/core/api.js
+function snapshotChecks(def) {
+  if (def.checks)
+    def.checks = [...def.checks];
+  return def;
+}
 // @__NO_SIDE_EFFECTS__
 function _string(Class2, params) {
-  return new Class2({
-    type: "string",
-    ...normalizeParams(params)
-  });
+  return new Class2(snapshotChecks({ type: "string", ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _coercedString(Class2, params) {
-  return new Class2({
-    type: "string",
-    coerce: true,
-    ...normalizeParams(params)
-  });
+  return new Class2(snapshotChecks({ type: "string", coerce: true, ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _email(Class2, params) {
@@ -14772,20 +14823,11 @@ function _isoDuration(Class2, params) {
 }
 // @__NO_SIDE_EFFECTS__
 function _number(Class2, params) {
-  return new Class2({
-    type: "number",
-    checks: [],
-    ...normalizeParams(params)
-  });
+  return new Class2(snapshotChecks({ type: "number", checks: [], ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _coercedNumber(Class2, params) {
-  return new Class2({
-    type: "number",
-    coerce: true,
-    checks: [],
-    ...normalizeParams(params)
-  });
+  return new Class2(snapshotChecks({ type: "number", coerce: true, checks: [], ...normalizeParams(params) }));
 }
 // @__NO_SIDE_EFFECTS__
 function _int(Class2, params) {
@@ -15127,9 +15169,8 @@ function _property(property, schema, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _properties(Class2, shape, params) {
-  return new Class2({
-    type: "properties",
+function _properties(shape, params) {
+  return new $ZodCheckProperties({
     check: "properties",
     shape,
     ...normalizeParams(params)
@@ -15764,11 +15805,11 @@ function foldObjects(members2) {
     }
     objects.push(member);
   }
-  const properties2 = {};
+  const properties = {};
   const required2 = /* @__PURE__ */ new Set();
   for (const object2 of objects) {
     for (const key in object2.properties) {
-      if (Object.prototype.hasOwnProperty.call(properties2, key))
+      if (Object.prototype.hasOwnProperty.call(properties, key))
         continue;
       const parts = [];
       for (const other of objects) {
@@ -15779,12 +15820,12 @@ function foldObjects(members2) {
           parts.push(part);
       }
       const merged = parts.length === 1 ? parts[0] : foldObjects(parts) ?? { allOf: parts };
-      assignProp(properties2, key, merged);
+      assignProp(properties, key, merged);
     }
     for (const key of object2.required ?? [])
       required2.add(key);
   }
-  const folded = { type: "object", properties: properties2 };
+  const folded = { type: "object", properties };
   if (required2.size)
     folded.required = [...required2];
   if (objects.every((object2) => object2.additionalProperties === false)) {
@@ -16406,17 +16447,15 @@ var objectProcessor = (schema, ctx, _json, params) => {
       path: [...params.path, "properties", key]
     }));
   }
-  const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set([...allKeys].filter((key) => {
+  const requiredKeys = [];
+  for (const key of Object.keys(shape)) {
     const field = def.shape[key];
-    if (ctx.io === "input") {
-      return inputOptin(field) === void 0;
-    } else {
-      return field._zod.optout === void 0;
+    if (ctx.io === "input" ? inputOptin(field) === void 0 : field._zod.optout === void 0) {
+      requiredKeys.push(key);
     }
-  }));
-  if (requiredKeys.size > 0) {
-    json2.required = Array.from(requiredKeys);
+  }
+  if (requiredKeys.length > 0) {
+    json2.required = requiredKeys;
   }
   if (def.catchall?._zod.def.type === "never") {
     json2.additionalProperties = false;
@@ -16430,31 +16469,6 @@ var objectProcessor = (schema, ctx, _json, params) => {
     });
   }
 };
-var propertiesProcessor = (schema, ctx, _json, params) => {
-  const json2 = _json;
-  const def = schema._zod.def;
-  if (Object.getOwnPropertySymbols(def.shape).length && handleUnrepresentable(schema, ctx, json2, params, "Symbol keys cannot be represented in JSON Schema")) {
-    return;
-  }
-  if (ctx.io === "output") {
-    for (const key in def.shape) {
-      if (isTransforming(def.shape[key]) && handleUnrepresentable(schema, ctx, json2, params, `z.properties() returns its input, so the output of a transforming schema at key "${key}" cannot be represented in JSON Schema`)) {
-        return;
-      }
-    }
-  }
-  json2.type = "object";
-  json2.properties = {};
-  for (const key in def.shape) {
-    assignProp(json2.properties, key, processSchema(def.shape[key], ctx, {
-      ...params,
-      path: [...params.path, "properties", key]
-    }));
-  }
-  const required2 = Object.keys(def.shape).filter((key) => inputOptin(def.shape[key]) === void 0);
-  if (required2.length > 0)
-    json2.required = required2;
-};
 var unionProcessor = (schema, ctx, json2, params) => {
   const def = schema._zod.def;
   const isExclusive = def.inclusive === false;
@@ -16774,7 +16788,6 @@ var allProcessors = {
   file: fileProcessor,
   success: successProcessor,
   custom: customProcessor,
-  properties: propertiesProcessor,
   function: functionProcessor,
   transform: transformProcessor,
   map: mapProcessor,
@@ -16971,7 +16984,6 @@ __export(schemas_exports2, {
   ZodPrefault: () => ZodPrefault,
   ZodPreprocess: () => ZodPreprocess,
   ZodPromise: () => ZodPromise,
-  ZodProperties: () => ZodProperties,
   ZodReadonly: () => ZodReadonly,
   ZodRecord: () => ZodRecord,
   ZodSet: () => ZodSet,
@@ -17009,6 +17021,7 @@ __export(schemas_exports2, {
   creditCard: () => creditCard2,
   cuid: () => cuid3,
   cuid2: () => cuid22,
+  currencyCode: () => currencyCode2,
   custom: () => custom,
   date: () => date2,
   describe: () => describe2,
@@ -17063,7 +17076,6 @@ __export(schemas_exports2, {
   prefault: () => prefault,
   preprocess: () => preprocess,
   promise: () => promise,
-  properties: () => properties,
   readonly: () => readonly,
   record: () => record,
   refine: () => refine,
@@ -17117,6 +17129,7 @@ __export(checks_exports2, {
   normalize: () => _normalize,
   overwrite: () => _overwrite,
   positive: () => _positive,
+  properties: () => _properties,
   property: () => _property,
   regex: () => _regex,
   size: () => _size,
@@ -17576,8 +17589,8 @@ function url(params) {
 }
 function httpUrl(params) {
   return _url(ZodURL, {
-    protocol: regexes_exports.httpProtocol,
-    hostname: regexes_exports.domain,
+    protocol: httpProtocol,
+    hostname: domain,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -17715,10 +17728,13 @@ function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
 function hostname2(_params) {
-  return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
+  return _stringFormat(ZodCustomStringFormat, "hostname", hostname, _params);
 }
 function hex2(_params) {
-  return _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
+  return _stringFormat(ZodCustomStringFormat, "hex", hex, _params);
+}
+function currencyCode2(_params) {
+  return _stringFormat(ZodCustomStringFormat, "currency_code", currencyCode, _params);
 }
 function hash(alg, params) {
   const enc = params?.enc ?? "hex";
@@ -18583,14 +18599,6 @@ var ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
   ZodType.init(inst, def);
   inst._zod.processJSONSchema = (ctx, json2, params) => customProcessor(inst, ctx, json2, params);
 });
-var ZodProperties = /* @__PURE__ */ $constructor("ZodProperties", (inst, def) => {
-  _ensureDefaultMemoizer();
-  $ZodProperties.init(inst, def);
-  ZodType.init(inst, def);
-});
-function properties(shape, params) {
-  return _properties(ZodProperties, shape, params);
-}
 function check(fn) {
   const ch = new $ZodCheck({
     check: "custom"
@@ -18614,7 +18622,7 @@ var ZodInstanceOf = /* @__PURE__ */ $constructor("ZodInstanceOf", (inst, def) =>
   ZodCustom.init(inst, def);
 }, {
   properties(shape, params) {
-    return this.check(properties(shape, params));
+    return this.check(_properties(shape, params));
   }
 });
 function _instanceof(cls, params = {}) {
@@ -19201,10 +19209,10 @@ function convertBaseSchema(schema, ctx) {
     }
     case "object": {
       const shape = {};
-      const properties2 = schema.properties || {};
+      const properties = schema.properties || {};
       const requiredSet = new Set(schema.required || []);
       const additionalSchema = typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : void 0;
-      for (const [key, propSchema] of Object.entries(properties2)) {
+      for (const [key, propSchema] of Object.entries(properties)) {
         const propZodSchema = convertSchema(propSchema, ctx);
         assignProp(shape, key, requiredSet.has(key) ? propZodSchema : propZodSchema.optional());
       }
@@ -19449,21 +19457,21 @@ function visit(schema, fnOrHandlers) {
     const h = fnOrHandlers[node2._zod.def.type];
     return h ? h(node2, rewritten) : node2;
   };
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache = /* @__PURE__ */ new Map();
   function run2(s) {
-    const cached2 = cache2.get(s);
+    const cached2 = cache.get(s);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache2.get(s)
+        getter: () => cache.get(s)
       });
     }
     if (cached2 !== void 0)
       return cached2;
-    cache2.set(s, RESOLVING);
+    cache.set(s, RESOLVING);
     const inner = mapInner(s);
     const mapped = fn(inner, inner !== s);
-    cache2.set(s, mapped);
+    cache.set(s, mapped);
     return mapped;
   }
   function mapInner(s) {
@@ -19565,18 +19573,6 @@ function visit(schema, fnOrHandlers) {
         const { _cachedInner, ...rest } = def;
         return clone(s, { ...rest, getter: () => run2(original()) });
       }
-      case "properties": {
-        const oldShape = def.shape;
-        let changed = false;
-        const newShape = {};
-        for (const k of Reflect.ownKeys(oldShape)) {
-          const mapped = run2(oldShape[k]);
-          if (mapped !== oldShape[k])
-            changed = true;
-          newShape[k] = mapped;
-        }
-        return changed ? clone(s, { ...def, shape: newShape }) : s;
-      }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
       // Leaves.
@@ -26549,8 +26545,8 @@ var require_defaults = /* @__PURE__ */ __commonJSMin(((exports) => {
   const codegen_1 = require_codegen();
   const util_1 = require_util();
   function assignDefaults(it, ty) {
-    const { properties: properties2, items } = it.schema;
-    if (ty === "object" && properties2) for (const key in properties2) assignDefault(it, key, properties2[key].default);
+    const { properties, items } = it.schema;
+    if (ty === "object" && properties) for (const key in properties) assignDefault(it, key, properties[key].default);
     else if (ty === "array" && Array.isArray(items)) items.forEach((sch, i) => assignDefault(it, i, sch.default));
   }
   exports.assignDefaults = assignDefaults;
@@ -26582,8 +26578,8 @@ var require_code = /* @__PURE__ */ __commonJSMin(((exports) => {
     });
   }
   exports.checkReportMissingProp = checkReportMissingProp;
-  function checkMissingProp({ gen, data, it: { opts } }, properties2, missing) {
-    return (0, codegen_1.or)(...properties2.map((prop) => (0, codegen_1.and)(noPropertyInData(gen, data, prop, opts.ownProperties), (0, codegen_1._)`${missing} = ${prop}`)));
+  function checkMissingProp({ gen, data, it: { opts } }, properties, missing) {
+    return (0, codegen_1.or)(...properties.map((prop) => (0, codegen_1.and)(noPropertyInData(gen, data, prop, opts.ownProperties), (0, codegen_1._)`${missing} = ${prop}`)));
   }
   exports.checkMissingProp = checkMissingProp;
   function reportMissingProp(cxt, missing) {
@@ -28624,8 +28620,8 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
           return this;
         }
         case "object": {
-          const cacheKey2 = schemaKeyRef;
-          this._cache.delete(cacheKey2);
+          const cacheKey = schemaKeyRef;
+          this._cache.delete(cacheKey);
           let id = schemaKeyRef[this.opts.schemaId];
           if (id) {
             id = (0, resolve_1.normalizeId)(id);
@@ -28768,10 +28764,10 @@ var require_core$3 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Ajv2.ValidationError = validation_error_1.default;
   Ajv2.MissingRefError = ref_error_1.default;
   exports.default = Ajv2;
-  function checkOptions(checkOpts, options, msg, log = "error") {
+  function checkOptions(checkOpts, options, msg, log2 = "error") {
     for (const key in checkOpts) {
       const opt = key;
-      if (opt in options) this.logger[log](`${msg}: option ${key}. ${checkOpts[opt]}`);
+      if (opt in options) this.logger[log2](`${msg}: option ${key}. ${checkOpts[opt]}`);
     }
   }
   function getSchEnv(keyRef) {
@@ -29859,10 +29855,10 @@ var require_properties = /* @__PURE__ */ __commonJSMin(((exports) => {
       const allProps = (0, code_1.allSchemaProperties)(schema);
       for (const prop of allProps) it.definedProperties.add(prop);
       if (it.opts.unevaluated && allProps.length && it.props !== true) it.props = util_1.mergeEvaluated.props(gen, (0, util_1.toHash)(allProps), it.props);
-      const properties2 = allProps.filter((p) => !(0, util_1.alwaysValidSchema)(it, schema[p]));
-      if (properties2.length === 0) return;
+      const properties = allProps.filter((p) => !(0, util_1.alwaysValidSchema)(it, schema[p]));
+      if (properties.length === 0) return;
       const valid = gen.name("valid");
-      for (const prop of properties2) {
+      for (const prop of properties) {
         if (hasDefault(prop)) applyPropertySchema(prop);
         else {
           gen.if((0, code_1.propertyInData)(gen, data, prop, it.opts.ownProperties));
@@ -33040,33 +33036,210 @@ var pageSchema = {
 };
 
 // src/runner.ts
-import { AsyncLocalStorage } from "node:async_hooks";
 import { delimiter, join } from "node:path";
-function isGogFileArg(arg) {
-  return typeof arg !== "string";
+
+// src/timestamps.ts
+var DEFAULT_DISPLAY_TZ = "America/New_York";
+function isValidTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
 }
-var RUNNER_TRANSPORT_BRAND = /* @__PURE__ */ Symbol.for("gogcli.RunnerTransportError");
-var RunnerTransportError = class extends Error {
-  kind;
-  status;
-  constructor(message, kind, status) {
-    super(message);
-    this.name = "RunnerTransportError";
-    this.kind = kind;
-    this.status = status;
-    Object.defineProperty(this, RUNNER_TRANSPORT_BRAND, { value: true });
+function displayTimeZone() {
+  const configured = readEnvVar("DISPLAY_TZ");
+  if (configured && isValidTimeZone(configured)) return configured;
+  return DEFAULT_DISPLAY_TZ;
+}
+function naiveSourceTimeZone() {
+  const configured = readEnvVar("GOG_TIMEZONE");
+  if (configured && isValidTimeZone(configured)) return configured;
+  return displayTimeZone();
+}
+function offsetAt(instant, tz) {
+  const w = wallPartsIn(instant, tz);
+  const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
+  const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
+  const sign2 = minutes < 0 ? "-" : "+";
+  const abs = Math.abs(minutes);
+  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+}
+function wallPartsIn(instant, tz) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    // h23 pins midnight to hour 00; without it some ICU builds render hour 24.
+    hourCycle: "h23"
+  }).formatToParts(instant);
+  const out = {};
+  for (const p of parts) {
+    if (p.type !== "literal") out[p.type] = Number(p.value);
   }
-};
-function isRunnerTransportError(err) {
-  return err instanceof Error && err[RUNNER_TRANSPORT_BRAND] === true;
+  return out;
+}
+function wallTimeToInstant(y, mo, d, h, mi, s, ms, tz) {
+  let guess = Date.UTC(y, mo - 1, d, h, mi, s, ms);
+  for (let i = 0; i < 2; i += 1) {
+    const seen = wallPartsIn(new Date(guess), tz);
+    const seenUTC = Date.UTC(seen.year, seen.month - 1, seen.day, seen.hour, seen.minute, seen.second, ms);
+    const drift = Date.UTC(y, mo - 1, d, h, mi, s, ms) - seenUTC;
+    if (drift === 0) break;
+    guess += drift;
+  }
+  return new Date(guess);
+}
+function pad(n, width = 2) {
+  return String(n).padStart(width, "0");
+}
+function isoWithOffset(instant, tz, offset) {
+  const w = wallPartsIn(instant, tz);
+  const msPart = instant.getUTCMilliseconds();
+  const frac = msPart ? `.${pad(msPart, 3)}` : "";
+  return `${pad(w.year, 4)}-${pad(w.month)}-${pad(w.day)}T${pad(w.hour)}:${pad(w.minute)}:${pad(w.second)}${frac}${offset}`;
+}
+function formatInstant(instant, tz = displayTimeZone()) {
+  const offset = offsetAt(instant, tz);
+  const display = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    weekday: "short",
+    month: "short",
+    day: "numeric",
+    year: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+    timeZoneName: "short"
+  }).format(instant);
+  return { iso: isoWithOffset(instant, tz, offset), display };
+}
+var TIMESTAMP_KEYS = /* @__PURE__ */ new Set([
+  "date",
+  // gog gmail message/thread listings ("2026-07-28 03:36")
+  "dateTime",
+  // Calendar event start/end
+  "internalDate",
+  // Gmail, epoch milliseconds (authoritative)
+  // gog >= 0.35.0 Gmail message AND thread listings. Already offset-bearing
+  // (RFC3339 from internalDate), so it needs no offset repair — it is
+  // allowlisted purely to gain a Display sibling, and to be re-rendered in
+  // DISPLAY_TZ like every other instant. Separately sourced from the sibling
+  // `date`, which is a naive re-format of the sender's Date header; the two may
+  // legitimately disagree. See docs/timestamps.md.
+  "internalDateIso",
+  "modifiedTime",
+  // Drive
+  "createdTime",
+  // Drive
+  "createTime",
+  "updateTime",
+  "updated",
+  "originalStartTime",
+  "expirationTime",
+  "lastModified",
+  "sentAt",
+  "viewedAt",
+  "modifiedAt",
+  "fetchedBodyAt",
+  "asOf"
+]);
+var ZONE_NAME_KEYS = /* @__PURE__ */ new Set(["timeZone", "timezone"]);
+var RFC3339_WITH_OFFSET = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?(Z|[+-]\d{2}:?\d{2})$/;
+var NAIVE_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?$/;
+var EPOCH_MILLIS = /^\d{13}$/;
+var DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+function isRealCalendarDate(p) {
+  const utc = new Date(Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, p.second));
+  return utc.getUTCFullYear() === p.year && utc.getUTCMonth() === p.month - 1 && utc.getUTCDate() === p.day && utc.getUTCHours() === p.hour && utc.getUTCMinutes() === p.minute && utc.getUTCSeconds() === p.second;
 }
-var runExecutor = new AsyncLocalStorage();
-var defaultExecutor;
-function setDefaultGogExecutor(executor) {
-  defaultExecutor = executor ? { executor } : void 0;
+function parseTimestampValue(key, value, assumeNaiveIn) {
+  if (typeof value !== "string") return null;
+  const raw = value.trim();
+  if (raw === "" || DATE_ONLY.test(raw)) return null;
+  if (key === "internalDate" && EPOCH_MILLIS.test(raw)) {
+    return new Date(Number(raw));
+  }
+  if (RFC3339_WITH_OFFSET.test(raw)) {
+    const parsed = new Date(raw.replace(" ", "T"));
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+  }
+  const naive = NAIVE_DATE_TIME.exec(raw);
+  if (naive) {
+    const [, y, mo, d, h, mi, s, frac] = naive;
+    const ms = frac ? Number(frac.padEnd(3, "0").slice(0, 3)) : 0;
+    const parts = {
+      year: Number(y),
+      month: Number(mo),
+      day: Number(d),
+      hour: Number(h),
+      minute: Number(mi),
+      second: Number(s ?? "0")
+    };
+    if (!isRealCalendarDate(parts)) return null;
+    return wallTimeToInstant(
+      parts.year,
+      parts.month,
+      parts.day,
+      parts.hour,
+      parts.minute,
+      parts.second,
+      ms,
+      assumeNaiveIn
+    );
+  }
+  return null;
 }
-function activeExecutor() {
-  return runExecutor.getStore() ?? defaultExecutor;
+function walk2(node2, tz, naiveTz) {
+  let changed = false;
+  if (Array.isArray(node2)) {
+    for (const item of node2) {
+      if (walk2(item, tz, naiveTz)) changed = true;
+    }
+    return changed;
+  }
+  if (node2 === null || typeof node2 !== "object") return false;
+  const obj = node2;
+  for (const key of Object.keys(obj)) {
+    const value = obj[key];
+    if (value !== null && typeof value === "object") {
+      if (walk2(value, tz, naiveTz)) changed = true;
+      continue;
+    }
+    if (ZONE_NAME_KEYS.has(key) || !TIMESTAMP_KEYS.has(key)) continue;
+    const instant = parseTimestampValue(key, value, naiveTz);
+    if (!instant) continue;
+    const { iso, display } = formatInstant(instant, tz);
+    obj[key] = iso;
+    obj[`${key}Display`] = display;
+    changed = true;
+  }
+  return changed;
+}
+function detectIndent(text) {
+  const match = /\n(\s+)\S/.exec(text);
+  return match ? match[1].replace(/\t/g, "  ").length : 0;
+}
+function normalizeTimestamps(text, tz = displayTimeZone(), naiveTz = naiveSourceTimeZone()) {
+  const trimmed = text.trim();
+  if (trimmed === "" || !/^[[{]/.test(trimmed)) return text;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return text;
+  }
+  if (!walk2(parsed, tz, naiveTz)) return text;
+  return JSON.stringify(parsed, null, detectIndent(text));
+}
+
+// src/runner.ts
+function isGogFileArg(arg) {
+  return typeof arg !== "string";
 }
 var TIMEOUT_MS = 3e4;
 var MIN_GOG_VERSION = "0.40.0";
@@ -33186,7 +33359,7 @@ async function spawnGog(fullArgs, opts) {
   const spawn = spawner ?? (await import("node:child_process")).spawn;
   const effectiveTimeout = timeout ?? TIMEOUT_MS;
   return new Promise((resolve, reject) => {
-    const childEnv = { ...sanitizedEnv(), PATH: augmentedPath() };
+    const childEnv = { ...sanitizedEnv(), GOG_TIMEZONE: naiveSourceTimeZone(), PATH: augmentedPath() };
     const child = spawn(readEnvVar("GOG_PATH") ?? "gog", fullArgs, { env: childEnv });
     const stdoutChunks = [];
     const stderrChunks = [];
@@ -33256,235 +33429,18 @@ async function run(args, options = {}) {
   const base = redactMode === "tokens" ? redactGoogleTokens : redactSecrets2;
   const redact = opaqueFields?.length ? (text) => redactPreservingOpaqueFields(text, opaqueFields, base) : base;
   const fullArgs = assembleArgs(args, { account, interactive, readonly: readonly2 });
-  const store = activeExecutor();
   try {
-    let output2;
-    if (spawner) {
-      output2 = await spawnExecutor(fullArgs, { timeout, interactive, spawner });
-    } else if (store) {
-      output2 = await store.executor(fullArgs, { timeout, interactive });
-    } else {
-      output2 = await spawnExecutor(fullArgs, { timeout, interactive });
-    }
-    return redact(output2);
+    return redact(await spawnExecutor(fullArgs, { timeout, interactive, spawner }));
   } catch (err) {
-    const message = base(err instanceof Error ? err.message : String(err));
-    if (isRunnerTransportError(err)) {
-      throw new RunnerTransportError(message, err.kind, err.status);
-    }
-    throw new Error(message);
+    throw new Error(base(err instanceof Error ? err.message : String(err)));
   }
 }
 async function runBinary(args, options = {}) {
   const { account, spawner, timeout, readonly: readonly2 = false } = options;
-  if (!spawner && activeExecutor()) {
-    throw new Error(
-      "Raw byte retrieval is not available over the hosted connector (its transport is text-only). Use the text-extraction path instead, or run the local stdio server to fetch bytes."
-    );
-  }
   const fullArgs = assembleArgs(args, { account, interactive: false, readonly: readonly2 });
   return spawnExecutor(fullArgs, { timeout, interactive: false, spawner, binary: true });
 }
 
-// src/timestamps.ts
-var DEFAULT_DISPLAY_TZ = "America/New_York";
-function isValidTimeZone(tz) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function displayTimeZone() {
-  const configured = readEnvVar("DISPLAY_TZ");
-  if (configured && isValidTimeZone(configured)) return configured;
-  return DEFAULT_DISPLAY_TZ;
-}
-function naiveSourceTimeZone() {
-  const configured = readEnvVar("GOG_TIMEZONE");
-  if (configured && isValidTimeZone(configured)) return configured;
-  return displayTimeZone();
-}
-function offsetAt(instant, tz) {
-  const w = wallPartsIn(instant, tz);
-  const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
-  const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
-  const sign2 = minutes < 0 ? "-" : "+";
-  const abs = Math.abs(minutes);
-  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
-}
-function wallPartsIn(instant, tz) {
-  const parts = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit",
-    // h23 pins midnight to hour 00; without it some ICU builds render hour 24.
-    hourCycle: "h23"
-  }).formatToParts(instant);
-  const out = {};
-  for (const p of parts) {
-    if (p.type !== "literal") out[p.type] = Number(p.value);
-  }
-  return out;
-}
-function wallTimeToInstant(y, mo, d, h, mi, s, ms, tz) {
-  let guess = Date.UTC(y, mo - 1, d, h, mi, s, ms);
-  for (let i = 0; i < 2; i += 1) {
-    const seen = wallPartsIn(new Date(guess), tz);
-    const seenUTC = Date.UTC(seen.year, seen.month - 1, seen.day, seen.hour, seen.minute, seen.second, ms);
-    const drift = Date.UTC(y, mo - 1, d, h, mi, s, ms) - seenUTC;
-    if (drift === 0) break;
-    guess += drift;
-  }
-  return new Date(guess);
-}
-function pad(n, width = 2) {
-  return String(n).padStart(width, "0");
-}
-function isoWithOffset(instant, tz, offset) {
-  const w = wallPartsIn(instant, tz);
-  const msPart = instant.getUTCMilliseconds();
-  const frac = msPart ? `.${pad(msPart, 3)}` : "";
-  return `${pad(w.year, 4)}-${pad(w.month)}-${pad(w.day)}T${pad(w.hour)}:${pad(w.minute)}:${pad(w.second)}${frac}${offset}`;
-}
-function formatInstant(instant, tz = displayTimeZone()) {
-  const offset = offsetAt(instant, tz);
-  const display = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    weekday: "short",
-    month: "short",
-    day: "numeric",
-    year: "numeric",
-    hour: "numeric",
-    minute: "2-digit",
-    timeZoneName: "short"
-  }).format(instant);
-  return { iso: isoWithOffset(instant, tz, offset), display };
-}
-var TIMESTAMP_KEYS = /* @__PURE__ */ new Set([
-  "date",
-  // gog gmail message/thread listings ("2026-07-28 03:36")
-  "dateTime",
-  // Calendar event start/end
-  "internalDate",
-  // Gmail, epoch milliseconds (authoritative)
-  // gog >= 0.35.0 Gmail message AND thread listings. Already offset-bearing
-  // (RFC3339 from internalDate), so it needs no offset repair — it is
-  // allowlisted purely to gain a Display sibling, and to be re-rendered in
-  // DISPLAY_TZ like every other instant. Separately sourced from the sibling
-  // `date`, which is a naive re-format of the sender's Date header; the two may
-  // legitimately disagree. See docs/timestamps.md.
-  "internalDateIso",
-  "modifiedTime",
-  // Drive
-  "createdTime",
-  // Drive
-  "createTime",
-  "updateTime",
-  "updated",
-  "originalStartTime",
-  "expirationTime",
-  "lastModified",
-  "sentAt",
-  "viewedAt",
-  "modifiedAt",
-  "fetchedBodyAt",
-  "asOf"
-]);
-var ZONE_NAME_KEYS = /* @__PURE__ */ new Set(["timeZone", "timezone"]);
-var RFC3339_WITH_OFFSET = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?(Z|[+-]\d{2}:?\d{2})$/;
-var NAIVE_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d{1,9}))?$/;
-var EPOCH_MILLIS = /^\d{13}$/;
-var DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
-function isRealCalendarDate(p) {
-  const utc = new Date(Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute, p.second));
-  return utc.getUTCFullYear() === p.year && utc.getUTCMonth() === p.month - 1 && utc.getUTCDate() === p.day && utc.getUTCHours() === p.hour && utc.getUTCMinutes() === p.minute && utc.getUTCSeconds() === p.second;
-}
-function parseTimestampValue(key, value, assumeNaiveIn) {
-  if (typeof value !== "string") return null;
-  const raw = value.trim();
-  if (raw === "" || DATE_ONLY.test(raw)) return null;
-  if (key === "internalDate" && EPOCH_MILLIS.test(raw)) {
-    return new Date(Number(raw));
-  }
-  if (RFC3339_WITH_OFFSET.test(raw)) {
-    const parsed = new Date(raw.replace(" ", "T"));
-    return Number.isNaN(parsed.getTime()) ? null : parsed;
-  }
-  const naive = NAIVE_DATE_TIME.exec(raw);
-  if (naive) {
-    const [, y, mo, d, h, mi, s, frac] = naive;
-    const ms = frac ? Number(frac.padEnd(3, "0").slice(0, 3)) : 0;
-    const parts = {
-      year: Number(y),
-      month: Number(mo),
-      day: Number(d),
-      hour: Number(h),
-      minute: Number(mi),
-      second: Number(s ?? "0")
-    };
-    if (!isRealCalendarDate(parts)) return null;
-    return wallTimeToInstant(
-      parts.year,
-      parts.month,
-      parts.day,
-      parts.hour,
-      parts.minute,
-      parts.second,
-      ms,
-      assumeNaiveIn
-    );
-  }
-  return null;
-}
-function walk2(node2, tz, naiveTz) {
-  let changed = false;
-  if (Array.isArray(node2)) {
-    for (const item of node2) {
-      if (walk2(item, tz, naiveTz)) changed = true;
-    }
-    return changed;
-  }
-  if (node2 === null || typeof node2 !== "object") return false;
-  const obj = node2;
-  for (const key of Object.keys(obj)) {
-    const value = obj[key];
-    if (value !== null && typeof value === "object") {
-      if (walk2(value, tz, naiveTz)) changed = true;
-      continue;
-    }
-    if (ZONE_NAME_KEYS.has(key) || !TIMESTAMP_KEYS.has(key)) continue;
-    const instant = parseTimestampValue(key, value, naiveTz);
-    if (!instant) continue;
-    const { iso, display } = formatInstant(instant, tz);
-    obj[key] = iso;
-    obj[`${key}Display`] = display;
-    changed = true;
-  }
-  return changed;
-}
-function detectIndent(text) {
-  const match = /\n(\s+)\S/.exec(text);
-  return match ? match[1].replace(/\t/g, "  ").length : 0;
-}
-function normalizeTimestamps(text, tz = displayTimeZone(), naiveTz = naiveSourceTimeZone()) {
-  const trimmed = text.trim();
-  if (trimmed === "" || !/^[[{]/.test(trimmed)) return text;
-  let parsed;
-  try {
-    parsed = JSON.parse(trimmed);
-  } catch {
-    return text;
-  }
-  if (!walk2(parsed, tz, naiveTz)) return text;
-  return JSON.stringify(parsed, null, detectIndent(text));
-}
-
 // src/pagination.ts
 function detectIndent2(text) {
   const match = /\n(\s+)\S/.exec(text);
@@ -33623,14 +33579,6 @@ var AUTH_HINT = "\n\nAuthentication may have expired. Use gog_auth_add to re-aut
 var INVALID_GRANT_HINT = '\n\nThe stored refresh token was rejected (invalid_grant): it has expired or been revoked, so the whole account is signed out and re-authorization is required. The most common cause is the 7-day refresh-token limit Google applies to OAuth apps whose consent screen is still in "Testing" mode. Re-authorize with gog_auth_add (opens a browser) or gog_auth_add_url + gog_auth_add_complete (remote/headless). To stop this recurring, publish the OAuth consent screen to "In production" in the Google Cloud project that owns the OAuth client. Ask the user if they would like to re-authenticate.';
 var TRANSIENT_HINT = "\n\nThis error is often transient. Retry the same call before trying a different approach (do not fall back to smaller writes or row-by-row operations).";
 var GRID_LIMIT_HINT = "\n\nThe target range is outside the sheet's current grid. Add the missing rows or columns first with gog_sheets_insert (dimension: rows or cols), then retry the write.";
-var RUNNER_TRANSPORT_AUTH_HINT = "\n\nThis is the CONNECTOR's own transport auth failing, not your Google sign-in. The gog-runner backend rejected the bearer token this server sent, so the request never reached gog and no Google credential was checked \u2014 the Google account is not the problem and re-authorizing it cannot fix this. An operator must make the Worker secret GOG_RUNNER_KEY equal RUNNER_KEY on the Fly app (wrangler secret put GOG_RUNNER_KEY / fly secrets set RUNNER_KEY), then retry.";
-var RUNNER_TRANSPORT_HINTS = {
-  "transport-auth": RUNNER_TRANSPORT_AUTH_HINT,
-  // The request itself was malformed, so the runner will refuse it identically
-  // every time. Nothing to advise beyond the message the runner already gave.
-  "transport-request": "",
-  "transport-retryable": TRANSIENT_HINT
-};
 function formatAccountList(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -33643,12 +33591,11 @@ function formatAccountList(raw) {
 }
 async function diagnose(err) {
   const errText = errorText(err);
-  const transportHint = isRunnerTransportError(err) ? RUNNER_TRANSPORT_HINTS[err.kind] : void 0;
   const isInvalidGrant = INVALID_GRANT_PATTERN.test(errText);
   const isTransientError = !DEFINITE_AUTH_PATTERN.test(errText) && TRANSIENT_ERROR_PATTERN.test(errText);
   const isAuthError = !isTransientError && AUTH_ERROR_PATTERN.test(errText);
   const isGridLimitError = GRID_LIMIT_ERROR_PATTERN.test(errText);
-  const hint = transportHint ?? (isInvalidGrant ? INVALID_GRANT_HINT : isAuthError ? AUTH_HINT : isTransientError ? TRANSIENT_HINT : isGridLimitError ? GRID_LIMIT_HINT : "");
+  const hint = isInvalidGrant ? INVALID_GRANT_HINT : isAuthError ? AUTH_HINT : isTransientError ? TRANSIENT_HINT : isGridLimitError ? GRID_LIMIT_HINT : "";
   try {
     const accounts = formatAccountList(await run(["auth", "list"]));
     return errorResult(`${errText}
@@ -33709,8 +33656,8 @@ function formatOneAccountHealth(a, now) {
   const age = ageInDays(a.created_at, now);
   const ageStr = age === null ? "" : ` Authorized ${age.toFixed(1)} day(s) ago.`;
   if (a.valid === false) {
-    const cause2 = INVALID_GRANT_PATTERN.test(a.error ?? "") ? 'refresh token expired or revoked \u2014 commonly the 7-day limit on OAuth consent screens still in "Testing" mode' : a.error?.trim() || "unknown error";
-    return `\u2717 ${email3}: NEEDS RE-AUTH \u2014 ${cause2}.${ageStr} Re-authorize with gog_auth_add (browser) or gog_auth_add_url + gog_auth_add_complete (remote/headless).`;
+    const cause = INVALID_GRANT_PATTERN.test(a.error ?? "") ? 'refresh token expired or revoked \u2014 commonly the 7-day limit on OAuth consent screens still in "Testing" mode' : a.error?.trim() || "unknown error";
+    return `\u2717 ${email3}: NEEDS RE-AUTH \u2014 ${cause}.${ageStr} Re-authorize with gog_auth_add (browser) or gog_auth_add_url + gog_auth_add_complete (remote/headless).`;
   }
   if (a.valid === true) {
     let line = `\u2713 ${email3}: token valid.${ageStr}`;
@@ -33825,7 +33772,7 @@ function registerAppScriptTools(server) {
     return runOrDiagnose(["appscript", "content", scriptId], { account });
   });
   server.registerTool("gog_appscript_pull", {
-    description: "Write a project's files into a local directory, for editing a script as ordinary files. THE DIRECTORY IS RESOLVED WHERE GOG RUNS, which is the caller's own machine only on a local (stdio) deployment: on the hosted connector, or any GOG_RUNNER_URL backend, the files land on that server where the caller cannot reach them. Use gog_appscript_content there instead \u2014 it returns the same source in the response. Existing files are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back." + apiEnableNote,
+    description: "Write a project's files into a local directory, for editing a script as ordinary files. THE DIRECTORY IS RESOLVED WHERE GOG RUNS, which is the caller's own machine only on a local (stdio) deployment: on a hosted deployment (e.g. mcp-host) the files land on that server where the caller cannot reach them. Use gog_appscript_content there instead \u2014 it returns the same source in the response. Existing files are left alone unless overwrite is set. Read-only as far as Google is concerned: nothing is pushed back." + apiEnableNote,
     inputSchema: external_exports.object({
       scriptId: scriptIdParam,
       dir: external_exports.string().describe("Destination directory, resolved on the machine where gog runs"),
@@ -33936,7 +33883,7 @@ function registerAuthToolsWith(server, defaultServices) {
     }
   });
   server.registerTool("gog_auth_health", {
-    description: 'Check the LIVE health of each stored Google account. Unlike gog_auth_status (which only reports keyring/config setup), this performs a real token refresh against Google, so it detects expired or revoked (invalid_grant) refresh tokens \u2014 the account-wide sign-out that blocks every service. Reports per account: whether the token is currently valid, the mapped cause when it is not, how long ago it was authorized, and a warning as it approaches the 7-day refresh-token limit that applies to OAuth apps whose consent screen is still in "Testing" mode. Run it proactively to re-authorize on your own schedule instead of mid-task. On the hosted connector this is the ONLY check that measures Google: a connector showing "connected" or "refreshed" has verified the connector key that reaches the gog machine, and nothing else \u2014 the Google credential lives on that machine and can be dead while the connection looks perfectly healthy.',
+    description: `Check the LIVE health of each stored Google account. Unlike gog_auth_status (which only reports keyring/config setup), this performs a real token refresh against Google, so it detects expired or revoked (invalid_grant) refresh tokens \u2014 the account-wide sign-out that blocks every service. Reports per account: whether the token is currently valid, the mapped cause when it is not, how long ago it was authorized, and a warning as it approaches the 7-day refresh-token limit that applies to OAuth apps whose consent screen is still in "Testing" mode. Run it proactively to re-authorize on your own schedule instead of mid-task. On a hosted deployment this is the ONLY check that measures Google: a connector showing "connected" or "refreshed" has verified the client's connection to the MCP host, and nothing else \u2014 the Google credential lives in gog's keyring on that host and can be dead while the connection looks perfectly healthy.`,
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({})
   }, async () => {
@@ -33978,7 +33925,7 @@ function registerAuthToolsWith(server, defaultServices) {
     }
   });
   server.registerTool("gog_auth_add_url", {
-    description: "Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser \u2014 no local server or terminal on the gogcli host is needed, so this works over the hosted connector where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load \u2014 that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.",
+    description: "Begin REMOTE/headless Google authorization (step 1 of 2). Returns a sign-in URL to open in any browser \u2014 no local server or terminal on the gogcli host is needed, so this works on a hosted deployment where the interactive gog_auth_add cannot. Hand the URL to the user; after they sign in, the browser is redirected to a localhost URL that fails to load \u2014 that is expected. They copy that full redirected URL (from the address bar) and you pass it to gog_auth_add_complete. The link is valid for 10 minutes. If you pass a custom `services` here, pass the SAME value to gog_auth_add_complete or the second step will not match this one.",
     inputSchema: external_exports.object({
       email: external_exports.string().describe("Google account email to authorize"),
       services: external_exports.string().optional().default(defaultServices).describe(servicesDescribe),
@@ -34227,9 +34174,9 @@ function registerCalendarTools(server) {
 
 // src/attachments.ts
 var MAX_INLINE_ATTACHMENT_BYTES = 8 * 1024 * 1024;
-var RUNNER_MAX_BODY_BYTES = 32 * 1024 * 1024;
-var RUNNER_BODY_JSON_RESERVE_BYTES = 256 * 1024;
-var MAX_REQUEST_PAYLOAD_WIRE_BYTES = RUNNER_MAX_BODY_BYTES - RUNNER_BODY_JSON_RESERVE_BYTES;
+var REQUEST_MAX_BODY_BYTES = 32 * 1024 * 1024;
+var REQUEST_BODY_JSON_RESERVE_BYTES = 256 * 1024;
+var MAX_REQUEST_PAYLOAD_WIRE_BYTES = REQUEST_MAX_BODY_BYTES - REQUEST_BODY_JSON_RESERVE_BYTES;
 var MAX_INLINE_ATTACHMENT_TOTAL_BYTES = Math.floor(MAX_REQUEST_PAYLOAD_WIRE_BYTES * 3 / 4);
 function wireBytesOf(arg) {
   if (typeof arg === "string") return Buffer.byteLength(arg, "utf8");
@@ -34246,7 +34193,7 @@ var inlineAttachmentSchema = external_exports.object({
   )
 });
 var attachInlineParam = external_exports.array(inlineAttachmentSchema).optional().describe(
-  `Attachments supplied as BYTES rather than as server-side paths \u2014 use this whenever you hold a file and the gog server does not, which is always the case on the hosted connector and on any remote deployment. Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). Can be combined with \`attach\`: the two name disjoint files (paths read on the server vs. bytes sent with the call), and both end up as ordinary attachments on the message.`
+  `Attachments supplied as BYTES rather than as server-side paths \u2014 use this whenever you hold a file and the gog server does not, which is always the case on a hosted deployment (e.g. mcp-host). Each entry is {filename, contentBase64} (${INLINE_ATTACHMENT_LIMITS_TEXT}). Can be combined with \`attach\`: the two name disjoint files (paths read on the server vs. bytes sent with the call), and both end up as ordinary attachments on the message.`
 );
 function validateFilename(filename, where) {
   if (/[/\\]/.test(filename)) {
@@ -35246,7 +35193,7 @@ function registerDriveTools(server) {
     }
   });
   server.registerTool("gog_drive_read_bytes", {
-    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. For readable text from a PDF, prefer gog_drive_extract_text. NOTE: only works on the local stdio server; over the hosted connector the transport is text-only and this returns a clear error (use gog_drive_extract_text there).",
+    description: "Fetch a Drive file's raw bytes and return them base64-encoded as an embedded resource \u2014 the generic fallback for callers that want the file itself (to parse locally) rather than extracted text. For readable text from a PDF, prefer gog_drive_extract_text.",
     annotations: { readOnlyHint: true },
     inputSchema: external_exports.object({
       fileId: external_exports.string().describe("Drive file ID"),
@@ -35458,7 +35405,7 @@ var replySchema = {
   remove: external_exports.array(external_exports.string()).optional().describe("Remove these recipients from all fields (repeatable) \u2014 e.g. to drop someone from a reply-all."),
   subject: external_exports.string().optional().describe('Override reply subject (default: "Re: <original>"). A changed subject starts a NEW Gmail thread.'),
   noQuote: external_exports.boolean().optional().describe("Do not include the original message quoted below the reply (default: the original is quoted)"),
-  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on the hosted connector or any GOG_RUNNER_URL backend these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.`),
+  attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Read on the server, base64-encoded with a MIME type inferred from the extension.`),
   attachInline: attachInlineParam,
   from: external_exports.string().optional().describe("Send from this email address (must be a verified send-as alias)"),
   autoFromAddressedAlias: external_exports.boolean().optional().describe("When from is omitted, send from the verified send-as alias the original message was addressed TO, instead of the account's primary address \u2014 so a reply to mail sent to an alias goes back out from that alias. Ignored when from is set."),
@@ -35595,7 +35542,7 @@ function registerGmailTools(server) {
       replyToMessageId: external_exports.string().optional().describe('Message ID to thread this message against \u2014 sets In-Reply-To/References only. It does NOT quote the original (pass quote for that), inherit its recipients, or prefix the subject with "Re:". For an actual reply use gog_gmail_reply.'),
       threadId: external_exports.string().optional().describe("Thread ID to thread this message within. Same caveat as replyToMessageId: threading only, no quote and no inherited subject or recipients."),
       quote: external_exports.boolean().optional().describe("Include the original message quoted below the body. Requires replyToMessageId or threadId. gog quotes by DEFAULT on gmail reply but never on gmail send, so without this a threaded send arrives with the original nowhere in it."),
-      attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on the hosted connector or any GOG_RUNNER_URL backend these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.`),
+      attach: external_exports.array(external_exports.string()).optional().describe(`File paths to attach (repeatable), resolved ON THE GOG SERVER's filesystem \u2014 NOT this client's. Only usable when gog runs on the same machine you do (local stdio); on a hosted deployment (e.g. mcp-host) these paths do not exist and the call fails with "no such file or directory" \u2014 use attachInline there. Each file is read on the server, base64-encoded with a MIME type inferred from its extension, and added as a multipart attachment.`),
       attachInline: attachInlineParam,
       account: accountParam
     })
@@ -35970,7 +35917,7 @@ function registerTasksTools(server) {
 }
 
 // src/server.ts
-var VERSION = true ? "3.0.0" : "0.0.0";
+var VERSION = true ? "4.0.1" : "0.0.0";
 var BASE_TOOL_REGISTRARS = [
   registerApiTools,
   registerAppScriptTools,
@@ -35987,488 +35934,68 @@ var BASE_TOOL_REGISTRARS = [
   registerTasksTools
 ];
 
-// src/auth-log.ts
-var FAILURES = /* @__PURE__ */ new Set([
-  "token.mint-failed",
-  "grant.dead",
-  "replay.failed",
-  "runner.auth-failed",
-  "connect.key-rejected",
-  // An enrolment that could not proceed is a failure even though nobody is at
-  // fault: it is the only trace a half-enrolled connector leaves behind, and
-  // the absence of exactly this record is why DEFECT 4 could not be explained.
-  "connect.runner-unreachable",
-  "connect.google-unhealthy",
-  "refusal.google-unhealthy",
-  // The loudest record on this branch, and the only one that means "we cannot
-  // explain this". Google refused a real call while a live check of the same
-  // credential, taken seconds later, succeeded — so neither the 7-day cliff nor
-  // a revoked grant accounts for it. It is filed as a failure precisely because
-  // it is the record nobody may scroll past: it is the only evidence that could
-  // ever justify building something on the hosted path, and its absence over
-  // time is what retires that theory for good.
-  "refusal.google-ok"
-]);
-var PREFIX = "gog-auth ";
-var TAG_CHARS = 12;
-function credentialTag(cacheKeyHash) {
-  return cacheKeyHash.slice(0, TAG_CHARS);
-}
-function logAuthTransition(event, context) {
-  const record2 = JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), event, ...context });
-  const write = FAILURES.has(event) ? console.error : console.warn;
-  write(PREFIX + redactSecrets2(record2));
-}
-
-// src/google-token.ts
-var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-var EXPIRY_MARGIN_MS = 12e4;
-var cache = /* @__PURE__ */ new Map();
-var inFlight = /* @__PURE__ */ new Map();
-async function cacheKey(refreshToken, clientId) {
-  const data = new TextEncoder().encode(`${clientId}\0${refreshToken}`);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function makeAccessTokenSource(env) {
-  const direct = readEnvVar("GOG_ACCESS_TOKEN", { env });
-  if (direct) return async () => direct;
-  const refreshToken = readEnvVar("GOG_REFRESH_TOKEN", { env });
-  if (!refreshToken) return void 0;
-  const clientId = readEnvVar("GOG_CLIENT_ID", { env });
-  const clientSecret = readEnvVar("GOG_CLIENT_SECRET", { env });
-  if (!clientId || !clientSecret) {
-    const missing = [!clientId && "GOG_CLIENT_ID", !clientSecret && "GOG_CLIENT_SECRET"].filter(Boolean).join(" and ");
-    return async () => {
-      throw new Error(
-        `GOG_REFRESH_TOKEN is set but ${missing} is not, so no access token can be minted. Set the OAuth client alongside the refresh token, or unset GOG_REFRESH_TOKEN to use the backend\u2019s own identity.`
-      );
-    };
-  }
-  let keyPromise;
-  const key = () => keyPromise ??= cacheKey(refreshToken, clientId);
-  const logCacheHits = parseBoolEnv("GOG_AUTH_LOG_CACHE_HITS", { env });
-  const read = async () => {
-    const k = await key();
-    const hit = cache.get(k);
-    if (hit && hit.expiresAt - EXPIRY_MARGIN_MS > Date.now()) {
-      if (logCacheHits) logAuthTransition("token.cache-hit", { credential: credentialTag(k) });
-      return hit.accessToken;
-    }
-    let pending = inFlight.get(k);
-    if (!pending) {
-      pending = exchange(refreshToken, clientId, clientSecret).then((minted2) => {
-        cache.set(k, minted2);
-        logAuthTransition("token.minted", {
-          credential: credentialTag(k),
-          reason: `valid for ${Math.round((minted2.expiresAt - Date.now()) / 1e3)}s`
-        });
-        return minted2;
-      }).catch((err) => {
-        logAuthTransition(err.grantDead ? "grant.dead" : "token.mint-failed", {
-          credential: credentialTag(k),
-          reason: err.message
-        });
-        throw err;
-      }).finally(() => inFlight.delete(k));
-      inFlight.set(k, pending);
-    }
-    const minted = await pending;
-    return minted.accessToken;
-  };
-  const invalidate = async (rejected) => {
-    const k = await key();
-    const hit = cache.get(k);
-    if (!hit || hit.accessToken !== rejected) {
-      logAuthTransition("token.evict-noop", {
-        credential: credentialTag(k),
-        reason: hit ? "a concurrent caller had already replaced this credential\u2019s token" : "no token was cached for this credential"
-      });
-      return false;
-    }
-    cache.delete(k);
-    logAuthTransition("token.evicted", {
-      credential: credentialTag(k),
-      reason: "Google rejected this access token; the next read will mint a new one"
-    });
-    return true;
-  };
-  return Object.assign(read, {
-    invalidate,
-    credentialId: async () => credentialTag(await key())
-  });
-}
-var TokenExchangeError = class extends Error {
-  /**
-   * The REFRESH token is dead (Google's `invalid_grant`), not merely the access
-   * token. Carried as a flag rather than re-read from the message, because
-   * inferring the author of a failure from prose several authors can produce is
-   * precisely the mistake this branch exists to undo. `instanceof` is safe: the
-   * class is thrown and caught inside this one module.
-   */
-  grantDead;
-  constructor(message, grantDead) {
-    super(message);
-    this.grantDead = grantDead;
-  }
+// src/bootstrap-auth.ts
+import { join as join2 } from "node:path";
+var AUTH_BOOTSTRAP_MARKER = "auth-bootstrap.sha256";
+var VARS = ["GOG_CLIENT_ID", "GOG_CLIENT_SECRET", "GOG_REFRESH_TOKEN", "GOG_ACCOUNT"];
+var log = (line) => {
+  process.stderr.write(`[gogcli-mcp] auth bootstrap: ${line}
+`);
 };
-async function exchange(refreshToken, clientId, clientSecret) {
-  let res;
+var jsonFile = (name, payload) => ({
+  kind: "file",
+  flag: name,
+  ext: "json",
+  contents: JSON.stringify(payload),
+  positional: true
+});
+async function accountListed(account, spawner) {
   try {
-    res = await fetch(TOKEN_ENDPOINT, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        client_id: clientId,
-        client_secret: clientSecret
-      }).toString()
-    });
-  } catch (err) {
-    throw new TokenExchangeError(
-      `the Google token exchange could not be reached: ${err instanceof Error ? err.message : String(err)}`,
-      false
-    );
-  }
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    if (body.error === "invalid_grant") {
-      throw new TokenExchangeError(
-        'the stored refresh token was rejected (invalid_grant): it has expired or been revoked, so this account must be re-authorized (commonly the 7-day limit on OAuth consent screens still in "Testing" mode). Re-enrol with gog_auth_add_url + gog_auth_add_complete and store the new refresh token.',
-        true
-      );
-    }
-    throw new TokenExchangeError(
-      `the access token could not be refreshed (HTTP ${res.status}${body.error ? `, ${body.error}` : ""})`,
-      false
-    );
-  }
-  if (!body.access_token) {
-    throw new TokenExchangeError(
-      "the access token could not be refreshed: Google returned no access_token",
-      false
-    );
+    const out = await run(["auth", "list"], { spawner, account });
+    const accounts = JSON.parse(out).accounts ?? [];
+    return accounts.some((a) => a.email?.toLowerCase() === account.toLowerCase());
+  } catch {
+    return false;
   }
-  const expiresInMs = (body.expires_in ?? 3600) * 1e3;
-  return { accessToken: body.access_token, expiresAt: Date.now() + expiresInMs };
 }
-
-// src/google-probe.ts
-var bool = (value) => typeof value === "boolean" ? value : void 0;
-var cause = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
-function readGoogleProbe(body) {
-  const record2 = typeof body === "object" && body !== null ? body : {};
-  const measured = bool(record2.measured);
-  const reported = cause(record2.error);
-  if (measured === false) {
-    return {
-      kind: "unmeasured",
-      reason: reported ?? "the runner reported it could not measure the Google layer"
-    };
+async function bootstrapGogAuth(env = process.env, options = {}) {
+  const values = VARS.map((key) => readEnvVar(key, { env }));
+  const missing = VARS.filter((_key, i) => values[i] === void 0);
+  if (missing.length === VARS.length) return "unconfigured";
+  if (missing.length > 0) {
+    log(`skipped, missing ${missing.join(", ")}`);
+    return "incomplete";
   }
-  if (measured === true) {
-    if (bool(record2.ok) === true) return { kind: "ok" };
-    return {
-      kind: "unhealthy",
-      reason: reported ?? "the runner reported the Google layer unhealthy with no cause"
-    };
-  }
-  return {
-    kind: "unmeasured",
-    reason: reported ? `the runner did not report whether it measured the Google layer; it said: ${reported}` : "the runner did not report whether it measured the Google layer"
-  };
-}
-
-// src/connector-runtime.ts
-var DEFAULT_TIMEOUT_MS = 3e4;
-var DEADLINE_GRACE_MS = 5e3;
-var MIN_REPLAY_BUDGET_MS = 1e3;
-var REFUSAL_PROBE_TIMEOUT_MS = 4e3;
-var MIN_PROBE_BUDGET_MS = 1e3;
-var PROBE_INTERVAL_MS = 6e4;
-var RUNNER_GOG_FAILED = 422;
-var RUNNER_DRAINING = 503;
-var RUNNER_BAD_REQUEST = 400;
-var RUNNER_BAD_KEY = 401;
-var GogFailedError = class extends Error {
-  /** gog's stderr alone, with no echoed argv mixed in. */
-  stderr;
-  constructor(message, stderr) {
-    super(message);
-    this.stderr = stderr;
-  }
-};
-var GOOGLE_TOKEN_REJECTED_PATTERN = /Google API error \(401\b|invalid[ _]authentication[ _]credentials|\bACCESS_TOKEN_EXPIRED\b|\binvalid_token\b/i;
-var REFRESH_TOKEN_DEAD_PATTERN = /\binvalid_grant\b/i;
-var READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "cat",
-  "describe",
-  "get",
-  "info",
-  "list",
-  "list-slides",
-  "ls",
-  "metadata",
-  "read-slide",
-  "search",
-  "services",
-  "status",
-  "structure"
-]);
-function gogTarget(args) {
-  const words = args.filter((arg) => typeof arg === "string");
-  let service;
-  for (let i = 0; i < words.length; i += 1) {
-    const word = words[i];
-    if (word.startsWith("-")) {
-      if (word === "--account") i += 1;
-      continue;
-    }
-    if (service === void 0) {
-      service = word;
-      continue;
-    }
-    return { service, subcommand: word };
-  }
-  return { service };
-}
-async function remintAfterGoogleRejection(err, used, args, readAccessToken, deadlineAt, probeGoogle) {
-  if (!(err instanceof GogFailedError)) return void 0;
-  const grantDead = REFRESH_TOKEN_DEAD_PATTERN.test(err.stderr);
-  if (!grantDead && !GOOGLE_TOKEN_REJECTED_PATTERN.test(err.stderr)) return void 0;
-  const { service, subcommand } = gogTarget(args);
-  const credential = await readAccessToken?.credentialId?.();
-  const where = { credential, service };
-  if (grantDead) {
-    logAuthTransition("grant.dead", {
-      ...where,
-      reason: "gog reported invalid_grant: the stored refresh token is dead, so no token can be minted and this account must be re-authorized"
-    });
-    return void 0;
-  }
-  if (!used) {
-    await probeGoogle(where);
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: "no access token was supplied with the call, so gog acted as the backend volume\u2019s own identity"
-    });
-    return void 0;
-  }
-  if (!readAccessToken?.invalidate) {
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: "this token source cannot mint a replacement, so a replay would resend the rejected token"
-    });
-    return void 0;
-  }
-  const evicted = await readAccessToken.invalidate(used);
-  if (subcommand === void 0 || !READ_ONLY_SUBCOMMANDS.has(subcommand)) {
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: `not replayable: '${subcommand ?? "(none)"}' is not a known read-only subcommand and a write could double-apply`
-    });
-    return void 0;
-  }
-  if (!evicted) {
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: "the rejected token was already superseded, so the cache holds the token a replay would send"
-    });
-    return void 0;
-  }
-  const fresh = await readAccessToken();
-  if (!fresh) {
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: "the token source produced no token after eviction; replaying without one would act as the backend"
-    });
-    return void 0;
-  }
-  const budgetMs = deadlineAt - Date.now();
-  if (budgetMs < MIN_REPLAY_BUDGET_MS) {
-    logAuthTransition("replay.declined", {
-      ...where,
-      reason: `only ${budgetMs}ms of the call\u2019s deadline remained, so a replay could only time out; the rejected token was evicted, so the next call mints a fresh one`
-    });
-    return void 0;
-  }
-  return { token: fresh, budgetMs, invalidate: readAccessToken.invalidate, ...where };
-}
-function makeFlyExecutor(endpoint, key, readAccessToken) {
-  let lastProbeAt = Number.NEGATIVE_INFINITY;
-  const probeGoogleAfterRefusal = async (where, deadlineAt) => {
-    const record2 = { ...where, endpoint };
-    const now = Date.now();
-    const remainingMs = deadlineAt - now;
-    if (remainingMs < MIN_PROBE_BUDGET_MS) {
-      logAuthTransition("refusal.google-unmeasured", {
-        ...record2,
-        reason: `only ${remainingMs}ms of the call\u2019s deadline remained, so the Google layer was not measured rather than delay the caller\u2019s own error`
-      });
-      return;
-    }
-    if (now - lastProbeAt < PROBE_INTERVAL_MS) {
-      logAuthTransition("refusal.google-unmeasured", {
-        ...record2,
-        // "attempted", not "measured". `lastProbeAt` is stamped before the
-        // fetch and is deliberately NOT reset when the probe comes back with no
-        // verdict (a 404 from a runner too old to have the endpoint, a timeout,
-        // a dead socket) — the backend cost this throttle exists to bound was
-        // paid either way, and resetting it would let a retry loop storm a
-        // runner that is already unwell. So the timestamp stays and the sentence
-        // has to be the true one: on this branch a log line may not assert a
-        // measurement that never happened, and the previous probe may well have
-        // measured nothing at all.
-        reason: "a Google probe was attempted recently, so another was not sent: this probe spawns gog on the backend and takes the keyring\u2019s exclusive lock"
-      });
-      return;
-    }
-    lastProbeAt = now;
-    let event;
-    let reason;
-    try {
-      const res = await fetch(`${endpoint}/health/google`, {
-        headers: { Authorization: `Bearer ${key}` },
-        // Never more than the probe's own budget, never more than the call has
-        // left. `Math.min` rather than a plain constant because the second
-        // bound is the caller's, and it outranks ours.
-        signal: AbortSignal.timeout(Math.min(REFUSAL_PROBE_TIMEOUT_MS, remainingMs))
-      });
-      if (!res.ok) {
-        event = "refusal.google-unmeasured";
-        reason = `the runner did not answer the Google probe (HTTP ${res.status})`;
-      } else {
-        const verdict = readGoogleProbe(await res.json());
-        if (verdict.kind === "ok") {
-          event = "refusal.google-ok";
-          reason = "Google refused this call, yet a live token check on the same volume succeeded \u2014 so a dead or expired refresh token does not explain this refusal";
-        } else {
-          event = verdict.kind === "unhealthy" ? "refusal.google-unhealthy" : "refusal.google-unmeasured";
-          reason = verdict.reason;
-        }
-      }
-    } catch (err) {
-      event = "refusal.google-unmeasured";
-      reason = err instanceof Error ? err.message : String(err);
-    }
-    logAuthTransition(event, { ...record2, reason });
-  };
-  return async (args, opts) => {
-    const deadlineMs = (opts?.timeout ?? DEFAULT_TIMEOUT_MS) + DEADLINE_GRACE_MS;
-    const accessToken = await readAccessToken?.();
-    const deadlineAt = Date.now() + deadlineMs;
-    try {
-      return await attempt(endpoint, key, args, accessToken, deadlineMs);
-    } catch (err) {
-      const replay = await remintAfterGoogleRejection(
-        err,
-        accessToken,
-        args,
-        readAccessToken,
-        deadlineAt,
-        (where2) => probeGoogleAfterRefusal(where2, deadlineAt)
-      );
-      if (replay === void 0) throw err;
-      const where = { credential: replay.credential, service: replay.service, endpoint };
-      logAuthTransition("replay.attempted", {
-        ...where,
-        reason: "Google rejected the access token; replaying this read once with a freshly minted one"
-      });
-      try {
-        const stdout = await attempt(endpoint, key, args, replay.token, replay.budgetMs);
-        logAuthTransition("replay.succeeded", where);
-        return stdout;
-      } catch (replayErr) {
-        logAuthTransition("replay.failed", { ...where, reason: String(replayErr) });
-        if (replayErr instanceof GogFailedError && GOOGLE_TOKEN_REJECTED_PATTERN.test(replayErr.stderr)) {
-          await replay.invalidate(replay.token);
-        }
-        throw replayErr;
-      }
-    }
-  };
-}
-async function attempt(endpoint, key, args, accessToken, deadlineMs) {
-  let res;
+  const [clientId, clientSecret, refreshToken, account] = values;
+  const { spawner } = options;
   try {
-    res = await fetch(endpoint + "/run", {
-      method: "POST",
-      headers: {
-        Authorization: "Bearer " + key,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(accessToken ? { args, accessToken } : { args }),
-      signal: AbortSignal.timeout(deadlineMs)
-    });
-  } catch (err) {
-    const name = err instanceof Error ? err.name : "";
-    if (name === "TimeoutError" || name === "AbortError") {
-      throw new RunnerTransportError(
-        `gog-runner did not respond within ${deadlineMs}ms (${endpoint}) \u2014 the Fly backend may be cold or wedged`,
-        "transport-retryable"
-      );
-    }
-    throw err;
-  }
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    const detail = body && typeof body.error === "string" ? body.stderr && body.stderr.trim() && body.stderr.trim() !== body.error.trim() ? `${body.error}
-${body.stderr}` : body.error : "";
-    if (res.status === RUNNER_GOG_FAILED) {
-      throw new GogFailedError(
-        detail || "gog failed on the runner (no detail supplied)",
-        typeof body?.stderr === "string" ? body.stderr : ""
-      );
-    }
-    if (res.status === RUNNER_BAD_KEY) {
-      logAuthTransition("runner.auth-failed", {
-        service: gogTarget(args).service,
-        endpoint,
-        reason: "the gog-runner rejected the connector\u2019s bearer token, so gog never ran and no Google credential was read; GOG_RUNNER_KEY does not match the Fly app\u2019s RUNNER_KEY"
-      });
-      throw new RunnerTransportError(
-        "gog-runner rejected the connector's bearer token, so the request never reached gog and no Google credential was involved. The Worker secret GOG_RUNNER_KEY no longer matches RUNNER_KEY on the Fly app; set them to the same value (wrangler secret put GOG_RUNNER_KEY / fly secrets set RUNNER_KEY) and retry.",
-        "transport-auth",
-        res.status
-      );
-    }
-    if (res.status === RUNNER_BAD_REQUEST) {
-      throw new RunnerTransportError(
-        detail || "gog-runner rejected the request (no detail supplied)",
-        "transport-request",
-        res.status
-      );
-    }
-    if (res.status === RUNNER_DRAINING || body?.retryable === true) {
-      throw new RunnerTransportError(
-        `gog-runner is restarting; retry this call.${detail ? ` ${detail}` : ""}`,
-        "transport-retryable",
-        res.status
-      );
-    }
-    if (detail) {
-      throw new Error(detail);
-    }
-    throw new RunnerTransportError(
-      `gog-runner HTTP ${res.status}: the response did not come from the runner, so the request never reached gog. The backend Machine was most likely starting or shutting down \u2014 this is transient, retry the same call.`,
-      "transport-retryable",
-      res.status
+    const { createHash } = await import("node:crypto");
+    const { mkdir, readFile, writeFile, chmod } = await import("node:fs/promises");
+    const home = options.home ?? (await import("node:os")).homedir();
+    const dir = join2(home, ".gogcli-mcp");
+    const marker = join2(dir, AUTH_BOOTSTRAP_MARKER);
+    const fingerprint = createHash("sha256").update(values.join("\0")).digest("hex");
+    const previous = await readFile(marker, "utf8").catch(() => void 0);
+    if (previous === fingerprint && await accountListed(account, spawner)) return "present";
+    await run(
+      ["auth", "credentials", "set", jsonFile("credentials", { installed: { client_id: clientId, client_secret: clientSecret } })],
+      { spawner, account }
     );
+    await run(
+      ["auth", "tokens", "import", jsonFile("token", { email: account, refresh_token: refreshToken })],
+      { spawner, account }
+    );
+    await mkdir(dir, { recursive: true, mode: 448 });
+    await chmod(dir, 448);
+    await writeFile(marker, fingerprint, { mode: 384 });
+    await chmod(marker, 384);
+    return "imported";
+  } catch (err) {
+    let message = redactSecrets2(errorText(err));
+    for (const value of [clientSecret, refreshToken]) message = message.split(value).join("[REDACTED]");
+    log(`failed, ${message}`);
+    return "failed";
   }
-  const { stdout } = await res.json();
-  return stdout;
-}
-
-// src/remote-runner.ts
-function useRemoteGogRunner(env = process.env) {
-  const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
-  const key = readEnvVar("GOG_RUNNER_KEY", { env });
-  if (!endpoint || !key) return false;
-  setDefaultGogExecutor(
-    makeFlyExecutor(endpoint.replace(/\/+$/, ""), key, makeAccessTokenSource(env))
-  );
-  return true;
 }
 
 // src/blob-urls.ts
@@ -36547,70 +36074,136 @@ function blobStoreFromEnv() {
 }
 
 // src/blob-upload.ts
-var RUNNER_UPLOAD_TIMEOUT_MS = 125e3;
+var ATTACHMENT_DOWNLOAD_ROOT = "/tmp/gog-attachments";
+var MAX_BLOB_UPLOAD_BYTES = 100 * 1024 * 1024;
+var BLOB_UPLOAD_TIMEOUT_MS = 12e4;
+var ERROR_BODY_SNIPPET = 512;
 function withoutUrlSecrets(message, url2) {
   let out = url2 ? message.split(url2).join("<signed url>") : message;
   const signature = /[?&]sig=([^&#]+)/.exec(url2)?.[1];
   if (signature) out = out.split(signature).join("<signature>");
   return out;
 }
-async function uploadToBlobStore(request, options = {}) {
-  const env = options.env ?? process.env;
-  const endpoint = readEnvVar("GOG_RUNNER_URL", { env });
-  const key = readEnvVar("GOG_RUNNER_KEY", { env });
-  if (!endpoint || !key) {
-    throw new Error(
-      "no gog runner is configured (GOG_RUNNER_URL + GOG_RUNNER_KEY, both or neither), and the attachment bytes are on the runner's disk rather than here \u2014 so nothing on this side can send them"
-    );
-  }
-  let response;
+var UploadError = class extends Error {
+};
+async function resolveConfined(root, requested) {
+  const path = await import("node:path");
+  const { realpath, stat } = await import("node:fs/promises");
+  const isInside = (base, candidate2) => candidate2 === base || candidate2.startsWith(base + path.sep);
+  const lexicalRoot = path.resolve(root);
+  const candidate = path.resolve(lexicalRoot, requested);
+  if (!isInside(lexicalRoot, candidate)) {
+    throw new UploadError(`the attachment path must be inside ${lexicalRoot}`);
+  }
+  let realFile;
+  let realRoot;
   try {
-    response = await fetch(`${endpoint.replace(/\/+$/, "")}/upload`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ path: request.path, url: request.url, contentType: request.contentType }),
-      signal: AbortSignal.timeout(RUNNER_UPLOAD_TIMEOUT_MS)
-    });
+    realFile = await realpath(candidate);
+    realRoot = await realpath(lexicalRoot);
   } catch (err) {
-    throw new Error(withoutUrlSecrets(
-      `the upload to the blob store did not complete: ${err instanceof Error ? err.message : String(err)}`,
-      request.url
-    ));
+    throw new UploadError(`the downloaded attachment could not be found: ${err.message}`);
   }
-  let raw;
-  try {
-    raw = await response.text();
-  } catch (err) {
-    throw new Error(withoutUrlSecrets(
-      `the upload to the blob store did not complete: the runner's answer could not be read: ${err instanceof Error ? err.message : String(err)}`,
-      request.url
-    ));
+  if (!isInside(realRoot, realFile)) {
+    throw new UploadError(`the attachment path must be inside ${realRoot}`);
   }
-  let body = {};
+  const info = await stat(realFile);
+  if (!info.isFile()) throw new UploadError("the attachment path must name a regular file");
+  if (info.size > MAX_BLOB_UPLOAD_BYTES) {
+    throw new UploadError(
+      `the attachment is ${info.size} bytes; the blob store's maximum is ${MAX_BLOB_UPLOAD_BYTES} bytes`
+    );
+  }
+  return { file: realFile, bytes: info.size };
+}
+function parseTarget(url2) {
+  let target;
   try {
-    body = JSON.parse(raw);
+    target = new URL(url2);
   } catch {
-    body = { error: raw };
   }
-  if (!response.ok) {
-    throw new Error(withoutUrlSecrets(
-      `the runner could not store the attachment (HTTP ${response.status}${body.status ? `, blob store ${body.status}` : ""}): ${body.error ?? "no reason given"}`,
-      request.url
-    ));
+  if (!target || target.protocol !== "https:" && target.protocol !== "http:") {
+    throw new UploadError("the upload target must be an absolute http(s) URL");
+  }
+  return target;
+}
+async function putFile(target, file2, bytes, contentType, timeoutMs) {
+  const { createReadStream } = await import("node:fs");
+  const { pipeline } = await import("node:stream");
+  const transport = target.protocol === "https:" ? await import("node:https") : await import("node:http");
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const source = createReadStream(file2);
+    const req = transport.request(target, {
+      method: "PUT",
+      headers: { "content-type": contentType, "content-length": String(bytes) }
+    });
+    const finish2 = (settle2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      source.destroy();
+      req.destroy();
+      settle2();
+    };
+    const fail = (err) => finish2(() => reject(err));
+    const timer = setTimeout(
+      () => fail(new UploadError(`the upload to the blob store did not finish within ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    req.on("error", fail);
+    req.on("response", (res) => {
+      const chunks = [];
+      let held = 0;
+      res.on("data", (chunk) => {
+        if (held >= ERROR_BODY_SNIPPET) return;
+        chunks.push(chunk);
+        held += chunk.length;
+      });
+      res.on("error", fail);
+      res.on("end", () => finish2(() => resolve({
+        status: res.statusCode,
+        body: Buffer.concat(chunks).toString().slice(0, ERROR_BODY_SNIPPET)
+      })));
+    });
+    pipeline(source, req, (err) => {
+      if (err) fail(err);
+    });
+  });
+}
+async function uploadToBlobStore(request, options = {}) {
+  try {
+    const target = parseTarget(request.url);
+    const { file: file2, bytes } = await resolveConfined(options.root ?? ATTACHMENT_DOWNLOAD_ROOT, request.path);
+    const answer = await putFile(
+      target,
+      file2,
+      bytes,
+      request.contentType,
+      options.timeoutMs ?? BLOB_UPLOAD_TIMEOUT_MS
+    );
+    if (answer.status < 200 || answer.status >= 300) {
+      throw new UploadError(`the blob store refused the upload with ${answer.status}: ${answer.body}`.trim());
+    }
+    return { bytes, status: answer.status };
+  } catch (err) {
+    const message = err instanceof UploadError ? err.message : `the upload to the blob store did not complete: ${err.message}`;
+    throw new Error(withoutUrlSecrets(message, request.url));
   }
-  return { bytes: body.bytes, status: body.status };
 }
 export {
+  ATTACHMENT_DOWNLOAD_ROOT,
+  AUTH_BOOTSTRAP_MARKER,
   BASE_TOOL_REGISTRARS,
+  BLOB_UPLOAD_TIMEOUT_MS,
   BLOB_URL_DEFAULT_TTL_MS,
   BLOB_URL_MAX_TTL_MS,
   INLINE_ATTACHMENT_LIMITS_TEXT,
+  MAX_BLOB_UPLOAD_BYTES,
   MAX_INLINE_ATTACHMENT_BYTES,
   MAX_INLINE_ATTACHMENT_TOTAL_BYTES,
   MAX_REQUEST_PAYLOAD_WIRE_BYTES,
   MIN_GOG_VERSION,
   PAYLOAD_INLINE_MAX,
-  RUNNER_UPLOAD_TIMEOUT_MS,
   VERSION,
   accountParam,
   annotateTruncatedList,
@@ -36619,6 +36212,7 @@ export {
   attachInlineParam,
   authToolsFor,
   blobStoreFromEnv,
+  bootstrapGogAuth,
   createBlobUrlMinter,
   diagnose,
   errorText,
@@ -36657,11 +36251,9 @@ export {
   resultText,
   run,
   runBinary,
-  runExecutor,
   runOrDiagnose,
   stripConsumedPageToken,
-  uploadToBlobStore,
-  useRemoteGogRunner
+  uploadToBlobStore
 };
 /*! Bundled license information: