pullfrog 0.1.64 → 0.1.65

package/dist/cli.mjs

@@ -69,14 +69,14 @@ var __callDispose = (stack, error52, hasError) => {
   var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
     return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
   };
-  var fail = (e) => error52 = hasError ? new E(e, error52, "An error was suppressed during disposal") : (hasError = true, e);
+  var fail2 = (e) => error52 = hasError ? new E(e, error52, "An error was suppressed during disposal") : (hasError = true, e);
   var next2 = (it) => {
     while (it = stack.pop()) {
       try {
         var result = it[1] && it[1].call(it[2]);
-        if (it[0]) return Promise.resolve(result).then(next2, (e) => (fail(e), next2()));
+        if (it[0]) return Promise.resolve(result).then(next2, (e) => (fail2(e), next2()));
       } catch (e) {
-        fail(e);
+        fail2(e);
       }
     }
     if (hasError) throw error52;
@@ -73651,11 +73651,11 @@ var require_dataType = __commonJS({
       gen.if((0, codegen_1._)`${parentData} !== undefined`, () => gen.assign((0, codegen_1._)`${parentData}[${parentDataProperty}]`, expr));
     }
     function checkDataType(dataType, data, strictNums, correct = DataType.Correct) {
-      const EQ = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
+      const EQ2 = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
       let cond;
       switch (dataType) {
         case "null":
-          return (0, codegen_1._)`${data} ${EQ} null`;
+          return (0, codegen_1._)`${data} ${EQ2} null`;
         case "array":
           cond = (0, codegen_1._)`Array.isArray(${data})`;
           break;
@@ -73669,7 +73669,7 @@ var require_dataType = __commonJS({
           cond = numCond();
           break;
         default:
-          return (0, codegen_1._)`typeof ${data} ${EQ} ${dataType}`;
+          return (0, codegen_1._)`typeof ${data} ${EQ2} ${dataType}`;
       }
       return correct === DataType.Correct ? cond : (0, codegen_1.not)(cond);
       function numCond(_cond = codegen_1.nil) {
@@ -75125,15 +75125,33 @@ var require_data = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
+// node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js
 var require_utils5 = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i2 = 0; i2 < 256; i2++) {
+        BYTE_HEX[i2] = "%" + HEX_DIGITS[i2 >> 4] + HEX_DIGITS[i2 & 15];
+      }
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -75158,91 +75176,105 @@ var require_utils5 = __commonJS({
       }
       return acc;
     }
+    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer) {
-      buffer.length = 0;
-      return true;
-    }
-    function consumeHextets(buffer, address, output) {
-      if (buffer.length) {
-        const hex4 = stringArrayToHexStripped(buffer);
-        if (hex4 !== "") {
-          address.push(hex4);
-        } else {
-          output.error = true;
-          return false;
+    function isZoneIdentifier(zone) {
+      if (zone.length === 0) return false;
+      for (let i2 = 0; i2 < zone.length; i2++) {
+        if (isZoneCharacter(zone[i2])) continue;
+        if (zone[i2] === "%" && i2 + 2 < zone.length && isHexPair(zone.slice(i2 + 1, i2 + 3))) {
+          i2 += 2;
+          continue;
         }
-        buffer.length = 0;
+        return false;
       }
       return true;
     }
-    function getIPV6(input) {
-      let tokenCount = 0;
-      const output = { error: false, address: "", zone: "" };
-      const address = [];
-      const buffer = [];
-      let endipv6Encountered = false;
-      let endIpv6 = false;
-      let consume = consumeHextets;
-      for (let i2 = 0; i2 < input.length; i2++) {
-        const cursor3 = input[i2];
-        if (cursor3 === "[" || cursor3 === "]") {
-          continue;
-        }
-        if (cursor3 === ":") {
-          if (endipv6Encountered === true) {
-            endIpv6 = true;
+    function compressIPv6ZeroRun(hextets) {
+      let bestStart = -1;
+      let bestLength = 0;
+      let runStart = -1;
+      let runLength = 0;
+      for (let i2 = 0; i2 < hextets.length; i2++) {
+        if (hextets[i2] === "0") {
+          if (runStart === -1) runStart = i2;
+          runLength++;
+          if (runLength > bestLength) {
+            bestLength = runLength;
+            bestStart = runStart;
           }
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          if (++tokenCount > 7) {
-            output.error = true;
-            break;
-          }
-          if (i2 > 0 && input[i2 - 1] === ":") {
-            endipv6Encountered = true;
-          }
-          address.push(":");
-          continue;
-        } else if (cursor3 === "%") {
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          consume = consumeIsZone;
         } else {
-          buffer.push(cursor3);
+          runStart = -1;
+          runLength = 0;
+        }
+      }
+      if (bestLength < 2) return hextets.join(":");
+      const head = hextets.slice(0, bestStart).join(":");
+      const tail = hextets.slice(bestStart + bestLength).join(":");
+      return head + "::" + tail;
+    }
+    function normalizeIPv6Address(input) {
+      const compression = input.indexOf("::");
+      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+      if (compression !== -1) {
+        if (left.length === 1 && left[0] === "") left.length = 0;
+        if (right.length === 1 && right[0] === "") right.length = 0;
+      }
+      const parts = left.concat(right);
+      let hextetCount = 0;
+      for (let i2 = 0; i2 < parts.length; i2++) {
+        const part = parts[i2];
+        if (part === "") return void 0;
+        if (part.indexOf(".") !== -1) {
+          if (i2 !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+          hextetCount += 2;
           continue;
         }
+        if (!isHextet(part)) return void 0;
+        parts[i2] = parseInt(part, 16).toString(16);
+        hextetCount++;
       }
-      if (buffer.length) {
-        if (consume === consumeIsZone) {
-          output.zone = buffer.join("");
-        } else if (endIpv6) {
-          address.push(buffer.join(""));
-        } else {
-          address.push(stringArrayToHexStripped(buffer));
-        }
+      if (compression === -1) {
+        if (hextetCount !== 8) return void 0;
+        return compressIPv6ZeroRun(parts);
       }
-      output.address = address.join("");
-      return output;
+      if (hextetCount >= 8) return void 0;
+      const expanded = parts.slice(0, left.length);
+      for (let i2 = hextetCount; i2 < 8; i2++) expanded.push("0");
+      for (let i2 = left.length; i2 < parts.length; i2++) expanded.push(parts[i2]);
+      return compressIPv6ZeroRun(expanded);
     }
     function normalizeIPv6(host) {
-      if (findToken(host, ":") < 2) {
-        return { host, isIPV6: false };
-      }
-      const ipv64 = getIPV6(host);
-      if (!ipv64.error) {
-        let newHost = ipv64.address;
-        let escapedHost = ipv64.address;
-        if (ipv64.zone) {
-          newHost += "%" + ipv64.zone;
-          escapedHost += "%25" + ipv64.zone;
-        }
-        return { host: newHost, isIPV6: true, escapedHost };
-      } else {
-        return { host, isIPV6: false };
-      }
+      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+      let input = bracketed ? host.slice(1, -1) : host;
+      if (bracketed && isIPvFuture(input)) {
+        input = input.toLowerCase();
+        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+      }
+      if (findToken(input, ":") < 2) {
+        return { host, isIPV6: false, error: bracketed };
+      }
+      let zoneIdentifier = "";
+      const zoneSeparator = input.indexOf("%");
+      if (zoneSeparator !== -1) {
+        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        input = input.slice(0, zoneSeparator);
+      }
+      const address = normalizeIPv6Address(input);
+      if (address === void 0) return { host, isIPV6: false, error: true };
+      return {
+        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+        isIPV6: true
+      };
     }
     function findToken(str, token) {
       let ind = 0;
@@ -75361,7 +75393,8 @@ var require_utils5 = __commonJS({
     function normalizePathEncoding(input) {
       let output = "";
       for (let i2 = 0; i2 < input.length; i2++) {
-        if (input[i2] === "%" && i2 + 2 < input.length) {
+        const ch = input[i2];
+        if (ch === "%" && i2 + 2 < input.length) {
           const hex4 = input.slice(i2 + 1, i2 + 3);
           if (isHexPair(hex4)) {
             const normalizedHex = hex4.toUpperCase();
@@ -75375,10 +75408,152 @@ var require_utils5 = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i2])) {
-          output += input[i2];
+        if (isPathCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i2);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i2 + 1 < input.length) {
+            const low = input.charCodeAt(i2 + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i2++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function serializePathEncoding(input, pathNoScheme = false) {
+      let output = "";
+      let firstSegment = pathNoScheme && input[0] !== "/";
+      for (let i2 = 0; i2 < input.length; i2++) {
+        const ch = input[i2];
+        if (ch === "%" && i2 + 2 < input.length) {
+          const hex4 = input.slice(i2 + 1, i2 + 3);
+          if (isHexPair(hex4)) {
+            output += "%" + hex4.toUpperCase();
+            i2 += 2;
+            continue;
+          }
+        }
+        if (ch === "/") {
+          firstSegment = false;
+        }
+        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i2);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i2 + 1 < input.length) {
+            const low = input.charCodeAt(i2 + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i2++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeComponent(input, isAllowed) {
+      let output = "";
+      for (let i2 = 0; i2 < input.length; i2++) {
+        const ch = input[i2];
+        if (ch === "%" && i2 + 2 < input.length) {
+          const hex4 = input.slice(i2 + 1, i2 + 3);
+          if (isHexPair(hex4)) {
+            output += "%" + hex4.toUpperCase();
+            i2 += 2;
+            continue;
+          }
+        }
+        if (isAllowed(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i2);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i2 + 1 < input.length) {
+            const low = input.charCodeAt(i2 + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i2++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeUserinfo(input) {
+      return encodeComponent(input, isUserinfoCharacter);
+    }
+    function encodeQuery(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function encodeFragment(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i2 = 0; i2 < input.length; i2++) {
+        const ch = input[i2];
+        if (ch === "%" && i2 + 2 < input.length) {
+          const hex4 = input.slice(i2 + 1, i2 + 3);
+          if (isHexPair(hex4)) {
+            const normalizedHex = hex4.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i2 += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i2]);
+          const code = input.charCodeAt(i2);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i2 + 1 < input.length) {
+            const low = input.charCodeAt(i2 + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i2++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -75401,14 +75576,18 @@ var require_utils5 = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(component.userinfo);
+        uriTokens.push(encodeUserinfo(component.userinfo));
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = unescape(component.host);
+        let host = component.host;
         if (!isIPv4(host)) {
-          const ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 === true) {
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -75428,6 +75607,11 @@ var require_utils5 = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      serializePathEncoding,
+      normalizeQueryFragmentEncoding,
+      encodeUserinfo,
+      encodeQuery,
+      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -75438,12 +75622,12 @@ var require_utils5 = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
+// node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils5();
-    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -75504,9 +75688,10 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path4, query] = wsComponent.resourceName.split("?");
+        const queryIndex = wsComponent.resourceName.indexOf("?");
+        const path4 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
         wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
-        wsComponent.query = query;
+        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -75518,7 +75703,7 @@ var require_schemes = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      if (matches && matches[0] === urnComponent.path) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -75648,12 +75833,21 @@ var require_schemes = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js
+// node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils5();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils5();
     var { SCHEMES, getSchemeHandler } = require_schemes();
+    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+    function decodeValidScheme(scheme) {
+      const decodedScheme = unescape(String(scheme));
+      if (!VALID_SCHEME.test(decodedScheme)) {
+        throw new TypeError(MALFORMED_SCHEME_ERROR);
+      }
+      return decodedScheme;
+    }
     function normalize3(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -75666,12 +75860,34 @@ var require_fast_uri = __commonJS({
     }
     function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-      if (baseMalformed || relativeMalformed) {
+      const {
+        parsed: baseParsed,
+        malformedAuthorityOrPort: baseMalformed,
+        malformedPercentEncoding: baseMalformedPercentEncoding,
+        malformedSchemeSpecific: baseMalformedSchemeSpecific,
+        malformedHost: baseMalformedHost,
+        malformedScheme: baseMalformedScheme
+      } = parseWithStatus(baseURI, schemelessOptions);
+      const {
+        parsed: relativeParsed,
+        malformedAuthorityOrPort: relativeMalformed,
+        malformedPercentEncoding: relativeMalformedPercentEncoding,
+        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+        malformedHost: relativeMalformedHost,
+        malformedScheme: relativeMalformedScheme
+      } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
         throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
       }
       const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+      const resolvedHost = resolved.host;
+      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
+      if (resolved.error && !encodedASCIIHost) {
+        throw new Error(resolved.error);
+      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -75731,7 +75947,7 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -75752,19 +75968,22 @@ var require_fast_uri = __commonJS({
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
+      if (component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
+      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
+      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escapePreservingEscapes(component.path);
-          if (component.scheme !== void 0) {
-            component.path = component.path.split("%3A").join(":");
-          }
+          component.path = serializePathEncoding(component.path, pathNoScheme);
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -75782,16 +76001,19 @@ var require_fast_uri = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s = removeDotSegments(s);
         }
+        if (pathNoScheme) {
+          s = serializePathEncoding(s, true);
+        }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
           s = "/%2F" + s.slice(2);
         }
         uriTokens.push(s);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", component.query);
+        uriTokens.push("?", encodeQuery(component.query));
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", component.fragment);
+        uriTokens.push("#", encodeFragment(component.fragment));
       }
       return uriTokens.join("");
     }
@@ -75807,6 +76029,32 @@ var require_fast_uri = __commonJS({
       }
       return void 0;
     }
+    function hasMalformedPercentEncoding(component) {
+      if (component === void 0) return false;
+      let percent = component.indexOf("%");
+      while (percent !== -1) {
+        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+          return true;
+        }
+        percent = component.indexOf("%", percent + 3);
+      }
+      return false;
+    }
+    function hasMalformedComponentPercentEncoding(matches) {
+      const host = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+    }
+    function canonicalizeHost(parsed2, options, schemeHandler, isIP) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed2.host && parsed2.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed2.host)) {
+        try {
+          parsed2.host = new URL("http://" + parsed2.host).hostname;
+        } catch (e) {
+          parsed2.error = parsed2.error || "Host's domain name can not be converted to ASCII: " + e;
+          return true;
+        }
+      }
+      return false;
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed2 = {
@@ -75819,6 +76067,11 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
+      let malformedPercentEncoding = false;
+      let malformedSchemeSpecific = false;
+      let malformedHost = false;
+      let malformedIPLiteral = false;
+      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -75855,6 +76108,19 @@ var require_fast_uri = __commonJS({
         parsed2.path = matches[6] || "";
         parsed2.query = matches[7];
         parsed2.fragment = matches[8];
+        if (parsed2.scheme !== void 0) {
+          const decodedScheme = unescape(parsed2.scheme);
+          if (VALID_SCHEME.test(decodedScheme)) {
+            parsed2.scheme = decodedScheme.toLowerCase();
+          } else {
+            parsed2.error = parsed2.error || MALFORMED_SCHEME_ERROR;
+            malformedScheme = true;
+          }
+        }
+        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+        if (malformedPercentEncoding) {
+          parsed2.error = parsed2.error || "URI contains malformed percent-encoding.";
+        }
         if (isNaN(parsed2.port)) {
           parsed2.port = matches[5];
         }
@@ -75866,9 +76132,15 @@ var require_fast_uri = __commonJS({
         if (parsed2.host) {
           const ipv4result = isIPv4(parsed2.host);
           if (ipv4result === false) {
+            const bracketedIPLiteral = parsed2.host[0] === "[" && parsed2.host[parsed2.host.length - 1] === "]";
             const ipv6result = normalizeIPv6(parsed2.host);
-            parsed2.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            parsed2.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            if (malformedIPLiteral) {
+              parsed2.error = parsed2.error || "URI host is malformed.";
+              malformedAuthorityOrPort = true;
+            }
           } else {
             isIP = true;
           }
@@ -75886,42 +76158,34 @@ var require_fast_uri = __commonJS({
           parsed2.error = parsed2.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed2.scheme);
-        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed2.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed2.host)) {
-            try {
-              parsed2.host = new URL("http://" + parsed2.host).hostname;
-            } catch (e) {
-              parsed2.error = parsed2.error || "Host's domain name can not be converted to ASCII: " + e;
-            }
-          }
-        }
+        malformedHost = canonicalizeHost(parsed2, options, schemeHandler, isIP);
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
-            if (parsed2.scheme !== void 0) {
-              parsed2.scheme = unescape(parsed2.scheme);
-            }
-            if (parsed2.host !== void 0) {
-              parsed2.host = reescapeHostDelimiters(unescape(parsed2.host), isIP);
+            if (parsed2.host !== void 0 && !malformedIPLiteral) {
+              const host = isIP ? parsed2.host : normalizePercentEncoding(parsed2.host, true);
+              parsed2.host = reescapeHostDelimiters(host, isIP);
             }
           }
           if (parsed2.path) {
             parsed2.path = normalizePathEncoding(parsed2.path);
           }
+          if (parsed2.query) {
+            parsed2.query = normalizeQueryFragmentEncoding(parsed2.query);
+          }
           if (parsed2.fragment) {
-            try {
-              parsed2.fragment = encodeURI(decodeURIComponent(parsed2.fragment));
-            } catch {
-              parsed2.error = parsed2.error || "URI malformed";
-            }
+            parsed2.fragment = normalizeQueryFragmentEncoding(parsed2.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed2, options);
+          if (schemeHandler === SCHEMES.urn && parsed2.nid === void 0) {
+            malformedSchemeSpecific = true;
+          }
         }
       } else {
         parsed2.error = parsed2.error || "URI can not be parsed.";
       }
-      return { parsed: parsed2, malformedAuthorityOrPort };
+      return { parsed: parsed2, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
     function parse6(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -75930,20 +76194,28 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed: parsed2, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed: parsed2, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed2, opts),
-        malformedAuthorityOrPort
+        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed2, opts),
+        malformedAuthorityOrPort,
+        malformedPercentEncoding,
+        malformedSchemeSpecific,
+        malformedHost,
+        malformedScheme
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri === "string") {
-        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-        return malformedAuthorityOrPort ? void 0 : normalized;
+      if (typeof uri !== "string" && typeof uri !== "object") {
+        return void 0;
       }
-      if (typeof uri === "object") {
-        return serialize(uri, opts);
+      let value2;
+      try {
+        value2 = typeof uri === "string" ? uri : serialize(uri, opts);
+      } catch {
+        return void 0;
       }
+      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value2, opts);
+      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
@@ -81205,137 +81477,6 @@ var require_light = __commonJS({
   }
 });
 
-// node_modules/.pnpm/content-type@2.0.0/node_modules/content-type/dist/index.js
-var require_dist4 = __commonJS({
-  "node_modules/.pnpm/content-type@2.0.0/node_modules/content-type/dist/index.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.format = format2;
-    exports.parse = parse6;
-    var TEXT_REGEXP = /^[\u0009\u0020-\u007e\u0080-\u00ff]*$/;
-    var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    var QUOTE_REGEXP = /[\\"]/g;
-    var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    var NullObject = /* @__PURE__ */ (() => {
-      const C = function() {
-      };
-      C.prototype = /* @__PURE__ */ Object.create(null);
-      return C;
-    })();
-    function format2(obj) {
-      const { type: type2, parameters } = obj;
-      if (!type2 || !TYPE_REGEXP.test(type2)) {
-        throw new TypeError(`Invalid type: ${type2}`);
-      }
-      let result = type2;
-      if (parameters) {
-        for (const param of Object.keys(parameters)) {
-          if (!TOKEN_REGEXP.test(param)) {
-            throw new TypeError(`Invalid parameter name: ${param}`);
-          }
-          result += `; ${param}=${qstring(parameters[param])}`;
-        }
-      }
-      return result;
-    }
-    function parse6(header, options) {
-      const len = header.length;
-      let index = skipOWS(header, 0, len);
-      const valueStart = index;
-      index = skipValue(header, index, len);
-      const valueEnd = trailingOWS(header, valueStart, index);
-      const type2 = header.slice(valueStart, valueEnd).toLowerCase();
-      const parameters = options?.parameters === false ? new NullObject() : parseParameters(header, index, len);
-      return { type: type2, parameters };
-    }
-    var SP = 32;
-    var HTAB = 9;
-    var SEMI = 59;
-    var EQ = 61;
-    var DQUOTE = 34;
-    var BSLASH = 92;
-    function parseParameters(header, index, len) {
-      const parameters = new NullObject();
-      parameter: while (index < len) {
-        index = skipOWS(header, index + 1, len);
-        const keyStart = index;
-        while (index < len) {
-          const code = header.charCodeAt(index);
-          if (code === SEMI)
-            continue parameter;
-          if (code === EQ) {
-            const keyEnd = trailingOWS(header, keyStart, index);
-            const key = header.slice(keyStart, keyEnd).toLowerCase();
-            index = skipOWS(header, index + 1, len);
-            if (index < len && header.charCodeAt(index) === DQUOTE) {
-              index++;
-              let value2 = "";
-              while (index < len) {
-                const code2 = header.charCodeAt(index++);
-                if (code2 === DQUOTE) {
-                  index = skipValue(header, index, len);
-                  if (parameters[key] === void 0)
-                    parameters[key] = value2;
-                  break;
-                }
-                if (code2 === BSLASH && index < len) {
-                  value2 += header[index++];
-                  continue;
-                }
-                value2 += String.fromCharCode(code2);
-              }
-              continue parameter;
-            }
-            const valueStart = index;
-            index = skipValue(header, index, len);
-            if (parameters[key] === void 0) {
-              const valueEnd = trailingOWS(header, valueStart, index);
-              parameters[key] = header.slice(valueStart, valueEnd);
-            }
-            continue parameter;
-          }
-          index++;
-        }
-      }
-      return parameters;
-    }
-    function skipValue(str, index, len) {
-      while (index < len) {
-        const char = str.charCodeAt(index);
-        if (char === SEMI)
-          break;
-        index++;
-      }
-      return index;
-    }
-    function skipOWS(header, index, len) {
-      while (index < len) {
-        const char = header.charCodeAt(index);
-        if (char !== SP && char !== HTAB)
-          break;
-        index++;
-      }
-      return index;
-    }
-    function trailingOWS(header, start, end) {
-      while (end > start) {
-        const char = header.charCodeAt(end - 1);
-        if (char !== SP && char !== HTAB)
-          break;
-        end--;
-      }
-      return end;
-    }
-    function qstring(str) {
-      if (TOKEN_REGEXP.test(str))
-        return str;
-      if (TEXT_REGEXP.test(str))
-        return `"${str.replace(QUOTE_REGEXP, "\\$&")}"`;
-      throw new TypeError(`Invalid parameter value: ${str}`);
-    }
-  }
-});
-
 // node_modules/.pnpm/@mixmark-io+domino@2.2.0/node_modules/@mixmark-io/domino/lib/Event.js
 var require_Event = __commonJS({
   "node_modules/.pnpm/@mixmark-io+domino@2.2.0/node_modules/@mixmark-io/domino/lib/Event.js"(exports, module) {
@@ -83378,7 +83519,7 @@ var require_select = __commonJS({
     var compareDocumentPosition = function(a2, b) {
       return a2.compareDocumentPosition(b);
     };
-    var order = function(a2, b) {
+    var order2 = function(a2, b) {
       return compareDocumentPosition(a2, b) & 2 ? 1 : -1;
     };
     var next2 = function(el) {
@@ -84059,7 +84200,7 @@ var require_select = __commonJS({
             }
           }
         }
-        results.sort(order);
+        results.sort(order2);
       }
       return results;
     };
@@ -98607,14 +98748,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node2.nodeType === 1) {
           replacement = replacementForNode.call(self2, node2);
         }
-        return join29(output, replacement);
+        return join30(output, replacement);
       }, "");
     }
     function postProcess(output) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output = join29(output, rule.append(self2.options));
+          output = join30(output, rule.append(self2.options));
         }
       });
       return output.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -98626,7 +98767,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node2, this.options) + whitespace.trailing;
     }
-    function join29(output, replacement) {
+    function join30(output, replacement) {
       var s1 = trimTrailingNewlines(output);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output.length - s1.length, replacement.length - s2.length);
@@ -104834,36 +104975,43 @@ function handleCancel(value2) {
     process.exit(0);
   }
 }
-function getGhToken() {
-  let token;
+function tryGetGhToken() {
   try {
-    token = execFileSync("gh", ["auth", "token"], { encoding: "utf-8" }).trim();
+    return execFileSync("gh", ["auth", "token"], { encoding: "utf-8" }).trim() || null;
   } catch {
-    bail(
-      `gh cli not found or not authenticated.
-  ${import_picocolors.default.dim("install:")} https://cli.github.com
-  ${import_picocolors.default.dim("then:")}    gh auth login`
-    );
+    return null;
   }
+}
+var GH_TOKEN_HELP = "gh cli not found or not authenticated. install https://cli.github.com, then run `gh auth login`.";
+function getGhToken() {
+  const token = tryGetGhToken();
   if (!token) {
     bail(
-      `gh cli returned an empty token. try re-authenticating:
-  ${import_picocolors.default.dim("run:")} gh auth login`
+      `gh cli not found, not authenticated, or returned an empty token.
+  ${import_picocolors.default.dim("install:")} https://cli.github.com
+  ${import_picocolors.default.dim("then:")}    gh auth login`
     );
   }
   return token;
 }
-function parseGitRemote() {
+function tryParseGitRemote() {
   let url4;
   try {
     url4 = execFileSync("git", ["remote", "get-url", "origin"], { encoding: "utf-8" }).trim();
   } catch {
-    bail("not a git repository or no 'origin' remote found.");
+    return null;
   }
   const match3 = url4.match(/github\.com(?::\d+)?[:/]+([^/]+)\/(.+?)(?:\.git)?(?:\/)?$/);
-  if (!match3) bail(`could not parse github owner/repo from remote: ${url4}`);
+  if (!match3) return null;
   return { owner: match3[1], repo: match3[2] };
 }
+function parseGitRemote() {
+  const parsed2 = tryParseGitRemote();
+  if (!parsed2) {
+    bail("not a git repository, no 'origin' remote, or the remote is not a github url.");
+  }
+  return parsed2;
+}
 async function pullfrogApi(ctx) {
   const headers = { authorization: `Bearer ${ctx.token}` };
   if (ctx.body) headers["content-type"] = "application/json";
@@ -105840,7 +105988,12 @@ var providers = {
         displayName: "O3",
         resolve: "openai/o3",
         effort: ["low", "medium", "high"],
-        openRouterResolve: "openrouter/openai/o3"
+        openRouterResolve: "openrouter/openai/o3",
+        // OpenRouter publishes a reasoning TOGGLE for o3 where direct OpenAI
+        // publishes a ladder, so the route genuinely has no rungs. `[]` rather
+        // than omitting the field: an absent openRouterEffort falls through to
+        // `effort` and would send a rung this route rejects.
+        openRouterEffort: []
       }
     }
   }),
@@ -106005,14 +106158,19 @@ var providers = {
         effort: ["low", "medium", "high", "xhigh", "max"],
         openRouterResolve: "openrouter/anthropic/claude-opus-5",
         subagentModel: "claude-sonnet",
-        // TEMPORARY — clear this when Zen serves opus again. Zen still LISTS
-        // claude-opus-5 in /zen/v1/models, so the catalog test passes, but the
-        // endpoint answers 503 `Upstream request failed: Endpoint is
-        // unavailable.` (measured 5/5; claude-sonnet-5, claude-opus-4-8,
-        // claude-haiku-4-5 and claude-fable-5 all 200 on the same key). opencode
-        // retries the 503 above the AI SDK emitting no part.updated, so a run
-        // just produces nothing until it is killed — metaideas/init logged six
-        // zero-output failures from 2026-08-23. see wiki/opencode-silent-stall.md
+        // TEMPORARY — clear this ONLY when opus completes a run through opencode,
+        // never when the endpoint merely answers. Zen LISTS claude-opus-5 in
+        // /zen/v1/models, so the catalog test passes; on 2026-08-25 the endpoint
+        // itself answered 503 `Upstream request failed: Endpoint is unavailable.`
+        // (measured 5/5; claude-sonnet-5, claude-opus-4-8, claude-haiku-4-5 and
+        // claude-fable-5 all 200 on the same key). opencode retries above the AI
+        // SDK emitting no part.updated, so a run just produces nothing until it is
+        // killed — metaideas/init logged six zero-output failures from 2026-08-23.
+        // The 503 has since cleared and the model is STILL unusable: re-measured
+        // 2026-08-26, direct POST /zen/v1/messages is 10/10 200 at 1.3-4.1s while
+        // `opencode run --model opencode/claude-opus-5` on the same trivial prompt
+        // emitted nothing for 240s in CI. A raw-endpoint 200 is not runtime
+        // availability. see wiki/opencode-silent-stall.md
         fallback: "opencode/claude-sonnet"
       },
       "claude-sonnet": {
@@ -106143,22 +106301,139 @@ var providers = {
       }
     }
   }),
+  // OpenCode Go is a separate $10/mo subscription from Zen, served on its own
+  // base URL (`https://opencode.ai/zen/go/v1`) but authenticated with the SAME
+  // `OPENCODE_API_KEY`. it carries the open-weight coding models plus a couple
+  // of frontier ones, and 14 of the ids below are served ONLY here — Zen's
+  // `/v1/models` does not list glm-5.3*, qwen3.7/3.8-*, mimo-*, longcat-2.0,
+  // hy3 or muse-spark. so for a Go subscriber this provider is not a duplicate
+  // route to Zen, it is the only route to most of what they pay for.
+  // like `opencode` and `openrouter` this is a ROUTER, not a vendor: slugs and
+  // display names mirror the upstream brand tier, and the picker groups them
+  // under the upstream vendor.
   "opencode-go": provider({
     displayName: "OpenCode Go",
     envVars: ["OPENCODE_API_KEY"],
     models: {
+      // Z.ai — the plan's flagship coding family, and the only route the
+      // catalog offers to GLM at all.
+      glm: {
+        displayName: "GLM",
+        resolve: "opencode-go/glm-5.3",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/z-ai/glm-5.3",
+        preferred: true,
+        subagentModel: "glm-flash"
+      },
+      "glm-flash": {
+        displayName: "GLM Flash",
+        resolve: "opencode-go/glm-5.3-flash",
+        effort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/z-ai/glm-5.3-flash"
+      },
+      // legacy alias — the slug pinned a version instead of a brand tier and
+      // was already resolving to 5.2 under a "GLM 5.2" label. folds forward to
+      // the tier slug; 16 repos and 9 accounts still hold it.
       "glm-5.1": {
         displayName: "GLM 5.2",
         resolve: "opencode-go/glm-5.2",
         effort: ["high", "max"],
         openRouterEffort: ["high", "xhigh"],
         openRouterResolve: "openrouter/z-ai/glm-5.2",
-        preferred: true
+        fallback: "opencode-go/glm"
+      },
+      // Moonshot — parity with moonshotai/* and openrouter/*.
+      "kimi-k3": {
+        displayName: "Kimi K3",
+        resolve: "opencode-go/kimi-k3",
+        // Go publishes a single rung for K3 where the OpenRouter route
+        // publishes three, so every position lands on `max` here.
+        effort: ["max"],
+        openRouterEffort: ["low", "high", "max"],
+        openRouterResolve: "openrouter/moonshotai/kimi-k3",
+        subagentModel: "kimi-k2"
       },
       "kimi-k2": {
         displayName: "Kimi K2",
         resolve: "opencode-go/kimi-k2.7-code",
         openRouterResolve: "openrouter/moonshotai/kimi-k2.7-code"
+      },
+      // DeepSeek and Muse Spark are deliberately ABSENT even though Go serves
+      // them and prices DeepSeek Pro below Zen. each sits behind a per-workspace
+      // opt-in that is off by default — measured, the run dies with
+      // `RegionError` ("only available hosted in China") and `DataPolicyError`
+      // ("collects data used to improve its quality"). that toggle lives on the
+      // CUSTOMER's OpenCode workspace, so no change here can satisfy it, and a
+      // picker row that fails for almost everyone is worse than none. DeepSeek
+      // stays reachable ungated via `deepseek/*`, `opencode/*` and
+      // `openrouter/*`; both remain runnable by full specifier once opted in.
+      // Alibaba — new vendor family for the catalog; Zen serves neither tier.
+      "qwen-max": {
+        displayName: "Qwen Max",
+        resolve: "opencode-go/qwen3.8-max",
+        // both routes publish rungs, and they are different sets rather than
+        // different spellings of one — OpenRouter carries a `minimal` and a
+        // `high` the Go route does not.
+        effort: ["low", "medium", "xhigh"],
+        openRouterEffort: ["minimal", "low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/qwen/qwen3.8-max"
+      },
+      "qwen-plus": {
+        displayName: "Qwen Plus",
+        resolve: "opencode-go/qwen3.7-plus",
+        openRouterResolve: "openrouter/qwen/qwen3.7-plus"
+      },
+      // MiniMax — parity with opencode/* and openrouter/*; the m2 slug pins the
+      // line for DB stability while the resolve tracks the current m2.7.
+      "minimax-m3": {
+        displayName: "MiniMax M3",
+        resolve: "opencode-go/minimax-m3",
+        openRouterResolve: "openrouter/minimax/minimax-m3"
+      },
+      "minimax-m2.5": {
+        displayName: "MiniMax M2",
+        resolve: "opencode-go/minimax-m2.7",
+        openRouterResolve: "openrouter/minimax/minimax-m2.7"
+      },
+      // Xiaomi — Go-only; Zen serves the free `mimo-v2-pro-free` promo instead.
+      "mimo-pro": {
+        displayName: "MiMo Pro",
+        resolve: "opencode-go/mimo-v2.5-pro",
+        openRouterResolve: "openrouter/xiaomi/mimo-v2.5-pro"
+      },
+      // Meituan — Go-only.
+      longcat: {
+        displayName: "LongCat",
+        resolve: "opencode-go/longcat-2.0",
+        openRouterResolve: "openrouter/meituan/longcat-2.0"
+      },
+      // Tencent — Go-only, and the cheapest model on the plan by an order of
+      // magnitude (0.0175/0.0725). Hy3 succeeds the Hunyuan 2.0 line, so the
+      // generation is part of the product name the way Kimi K2/K3 is.
+      hy3: {
+        displayName: "Hy3",
+        resolve: "opencode-go/hy3",
+        effort: ["none", "low", "high"],
+        openRouterResolve: "openrouter/tencent/hy3"
+      },
+      // xAI and OpenAI — the two non-open models on the plan. same list price as
+      // Zen, but a Go subscription covers them where Zen meters them.
+      // Go is the only route that has retired grok-4.5 (models.dev marks
+      // `opencode-go/grok-4.5` deprecated while every other provider still
+      // serves it), so this alias LEADS `xai/grok` by a generation. a mirror
+      // that leads is safe; it is the trailing case that rots — see
+      // wiki/models-catalog.md on `opencode/kimi-k2`.
+      grok: {
+        displayName: "Grok",
+        resolve: "opencode-go/grok-4.6",
+        effort: ["low", "medium", "high", "xhigh"],
+        openRouterResolve: "openrouter/x-ai/grok-4.6"
+      },
+      "gpt-luna": {
+        displayName: "GPT Luna",
+        resolve: "opencode-go/gpt-5.6-luna",
+        effort: ["none", "low", "medium", "high", "xhigh", "max"],
+        openRouterResolve: "openrouter/openai/gpt-5.6-luna"
       }
     }
   }),
@@ -106335,7 +106610,6 @@ var providers = {
       "o4-mini": {
         displayName: "O4 Mini",
         resolve: "openrouter/openai/o4-mini",
-        effort: ["low", "medium", "high"],
         openRouterResolve: "openrouter/openai/o4-mini"
       },
       "gemini-pro": {
@@ -106836,7 +107110,6 @@ function logTokenTable(t2) {
 
 // utils/globals.ts
 import { existsSync } from "node:fs";
-var isCloudflareSandbox = !!process.env.CLOUDFLARE_APPLICATION_ID && !!process.env.SANDBOX_VERSION;
 var isGitHubActions = !!process.env.GITHUB_ACTIONS;
 var isInsideDocker = existsSync("/.dockerenv");
 
@@ -107367,7 +107640,7 @@ var import_semver = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "pullfrog",
-  version: "0.1.64",
+  version: "0.1.65",
   type: "module",
   bin: {
     pullfrog: "dist/cli.mjs",
@@ -125320,7 +125593,7 @@ Fuse.use = function(...plugins) {
 };
 var entry_default = Fuse;
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/compose.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next2) => {
     let index = -1;
@@ -125364,10 +125637,10 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/request/constants.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/utils/buffer.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/buffer.js
 var bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
@@ -125378,7 +125651,9 @@ var bufferToFormData = (arrayBuffer, contentType) => {
   return response.formData();
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/utils/body.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/body.js
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request2) => "headers" in request2;
 var parseBody = async (request2, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -125411,6 +125686,7 @@ async function parseFormData(request2, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value2, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -125423,7 +125699,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value2]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value2);
+        handleParsingNestedValues(form, key, value2, nestingState);
         delete form[key];
       }
     });
@@ -125446,25 +125722,34 @@ var handleParsingAllValues = (form, key, value2) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value2) => {
+var handleParsingNestedValues = (form, key, value2, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value2;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/utils/url.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/url.js
 var splitPath = (path4) => {
   const paths = path4.split("/");
   if (paths[0] === "") {
@@ -125570,13 +125855,13 @@ var checkOptionalParameter = (path4) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {
@@ -125594,6 +125879,10 @@ var _decodeURI = (value2) => {
   return tryDecodeURIComponent(value2);
 };
 var _getQueryParam = (url4, key, multiple) => {
+  const hashIndex = url4.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url4 = url4.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url4.indexOf("?", 8);
@@ -125666,7 +125955,7 @@ var getQueryParams = (url4, key) => {
 };
 var decodeURIComponent_ = decodeURIComponent;
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/request.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/request.js
 var HonoRequest = class {
   /**
    * `.raw` can get the raw Request object.
@@ -125710,13 +125999,13 @@ var HonoRequest = class {
     return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
   }
   #getDecodedParam(key) {
-    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const paramKey = this.#matchResult[0][this.routeIndex]?.[1][key];
     const param = this.#getParamValue(paramKey);
     return param && tryDecodeURIComponent(param);
   }
   #getAllDecodedParams() {
     const decoded = {};
-    const keys = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex]?.[1] ?? {});
     for (const key of keys) {
       const value2 = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
       if (value2 !== void 0) {
@@ -125947,7 +126236,7 @@ var HonoRequest = class {
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/utils/html.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -125989,7 +126278,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/context.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
 var setDefaultContentType = (contentType, headers) => {
   return {
@@ -126191,6 +126480,10 @@ var Context = class {
    *   c.header('X-Message', 'Hello!')
    *   c.header('Content-Type', 'text/plain')
    *
+   *   // Append multiple headers using the append option (e.g. Vary)
+   *   c.header('Vary', 'Accept-Encoding', { append: true })
+   *   c.header('Vary', 'User-Agent', { append: true })
+   *
    *   return c.body('Thank you for coming')
    * })
    * ```
@@ -126411,7 +126704,7 @@ var Context = class {
   };
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router.js
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch", "query"];
@@ -126419,10 +126712,10 @@ var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is
 var UnsupportedPathError = class extends Error {
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/utils/constants.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/hono-base.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c2) => {
   return c2.text("404 Not Found", 404);
 };
@@ -126799,7 +127092,10 @@ var Hono = class _Hono {
   };
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/reg-exp-router/matcher.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/utils.js
+var createNullObject = () => /* @__PURE__ */ Object.create(null);
+
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path4) {
   const matchers2 = this.buildAllMatchers();
@@ -126820,7 +127116,7 @@ function match(method, path4) {
   return match22(method, path4);
 }
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/reg-exp-router/node.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/reg-exp-router/node.js
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -126849,7 +127145,7 @@ var Node = class _Node {
   // handler index of a dynamic path, or -1 for a static path terminal
   #index;
   #varIndex;
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   insert(tokens, index, paramMap, context, isStatic) {
     let node2 = this;
     for (let i2 = 0, len = tokens.length; i2 < len; i2++) {
@@ -126927,13 +127223,13 @@ var Node = class _Node {
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/reg-exp-router/trie.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/reg-exp-router/trie.js
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node();
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
-  paths = /* @__PURE__ */ Object.create(null);
+  paths = createNullObject();
   insert(path4, isStatic) {
     if (isStatic) {
       this.#root.insert(path4.split(""), 0, [], this.#context, true);
@@ -126991,23 +127287,17 @@ var Trie = class {
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/reg-exp-router/router.js
-var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/reg-exp-router/router.js
+var wildcardRegExpCache = createNullObject();
 function buildWildcardRegExp(path4) {
   return wildcardRegExpCache[path4] ??= new RegExp(
-    path4 === "*" ? "" : `^${path4.replace(
-      /\/\*$|([.\\+*[^\]$()])/g,
-      (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)"
+    `^${path4.replace(
+      /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
+      (match22, metaChar) => metaChar ? `\\${metaChar}` : match22 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match22 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function clearWildcardRegExpCache() {
-  wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
-}
 function findMiddleware(middleware, path4) {
-  if (!middleware) {
-    return void 0;
-  }
   for (const k2 of Object.keys(middleware).sort((a2, b) => b.length - a2.length)) {
     if (buildWildcardRegExp(k2).test(path4)) {
       return [...middleware[k2]];
@@ -127021,8 +127311,8 @@ var RegExpRouter = class {
   #routes;
   #tries;
   constructor() {
-    this.#middleware = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
-    this.#routes = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+    this.#middleware = { [METHOD_NAME_ALL]: createNullObject() };
+    this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
   #insertPath(method, path4) {
@@ -127035,121 +127325,90 @@ var RegExpRouter = class {
   add(method, path4, handler2) {
     const middleware = this.#middleware;
     const routes = this.#routes;
-    if (!middleware || !routes) {
+    if (!middleware) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
     if (!middleware[method]) {
       this.#tries[method] = new Trie();
-      [middleware, routes].forEach((handlerMap) => {
-        handlerMap[method] = /* @__PURE__ */ Object.create(null);
-        Object.keys(handlerMap[METHOD_NAME_ALL]).forEach((p) => {
+      for (const handlerMap of [middleware, routes]) {
+        handlerMap[method] = createNullObject();
+        for (const p in handlerMap[METHOD_NAME_ALL]) {
           handlerMap[method][p] = [...handlerMap[METHOD_NAME_ALL][p]];
           this.#insertPath(method, p);
-        });
-      });
+        }
+      }
     }
     if (path4 === "/*") {
       path4 = "*";
     }
-    const paramCount = (path4.match(/\/:/g) || []).length;
+    const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
     if (/\*$/.test(path4)) {
       const re = buildWildcardRegExp(path4);
-      Object.keys(middleware).forEach((m) => {
-        if ((method === METHOD_NAME_ALL || method === m) && !middleware[m][path4]) {
+      for (const m of methods) {
+        if (!middleware[m][path4]) {
           this.#insertPath(m, path4);
           middleware[m][path4] = findMiddleware(middleware[m], path4) || findMiddleware(middleware[METHOD_NAME_ALL], path4) || [];
         }
-      });
-      Object.keys(middleware).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(middleware[m]).forEach((p) => {
-            re.test(p) && middleware[m][p].push([handler2, paramCount]);
-          });
-        }
-      });
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(routes[m]).forEach(
-            (p) => re.test(p) && routes[m][p].push([handler2, paramCount])
-          );
+      }
+      for (const handlerMap of [middleware, routes]) {
+        for (const m of methods) {
+          for (const p in handlerMap[m]) {
+            re.test(p) && handlerMap[m][p].push([handler2, path4]);
+          }
         }
-      });
+      }
       return;
     }
     const paths = checkOptionalParameter(path4) || [path4];
-    for (let i2 = 0, len = paths.length; i2 < len; i2++) {
-      const path22 = paths[i2];
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          if (!routes[m][path22]) {
-            this.#insertPath(m, path22);
-            routes[m][path22] = [
-              ...findMiddleware(middleware[m], path22) || findMiddleware(middleware[METHOD_NAME_ALL], path22) || []
-            ];
-          }
-          routes[m][path22].push([handler2, paramCount - len + i2 + 1]);
+    for (const path22 of paths) {
+      for (const m of methods) {
+        if (!routes[m][path22]) {
+          this.#insertPath(m, path22);
+          routes[m][path22] = findMiddleware(middleware[m], path22) || findMiddleware(middleware[METHOD_NAME_ALL], path22) || [];
         }
-      });
+        routes[m][path22].push([handler2, path22]);
+      }
     }
   }
   match = match;
   buildAllMatchers() {
-    const matchers2 = /* @__PURE__ */ Object.create(null);
-    Object.keys(this.#routes).concat(Object.keys(this.#middleware)).forEach((method) => {
-      matchers2[method] ||= this.#buildMatcher(method);
-    });
+    const matchers2 = createNullObject();
+    for (const method of Object.keys(this.#routes)) {
+      matchers2[method] = this.#buildMatcher(method);
+    }
     this.#middleware = this.#routes = this.#tries = void 0;
-    clearWildcardRegExpCache();
+    wildcardRegExpCache = createNullObject();
     return matchers2;
   }
   #buildMatcher(method) {
     const middleware = this.#middleware[method];
     const routes = this.#routes[method];
     const trie = this.#tries[method];
-    const staticMap = /* @__PURE__ */ Object.create(null);
+    const staticMap = createNullObject();
     const handlerData = [];
-    [middleware, routes].forEach((r2) => {
+    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+    for (const r2 of [middleware, routes]) {
       for (const path4 in r2) {
         const handlers2 = r2[path4];
         const pathData = trie.paths[path4];
         if (!pathData) {
-          staticMap[path4] = [handlers2.map(([h2]) => [h2, /* @__PURE__ */ Object.create(null)]), emptyParam];
+          staticMap[path4] = [handlers2.map(([h2]) => [h2, createNullObject()]), emptyParam];
           continue;
         }
-        const paramAssoc = pathData[1];
-        handlerData[pathData[0]] = handlers2.map(([h2, paramCount]) => {
-          const paramIndexMap = /* @__PURE__ */ Object.create(null);
-          paramCount -= 1;
-          for (; paramCount >= 0; paramCount--) {
-            const [key, value2] = paramAssoc[paramCount];
-            paramIndexMap[key] = value2;
-          }
-          return [h2, paramIndexMap];
-        });
-      }
-    });
-    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-    for (let i2 = 0, len = handlerData.length; i2 < len; i2++) {
-      for (let j2 = 0, len2 = handlerData[i2].length; j2 < len2; j2++) {
-        const map2 = handlerData[i2][j2]?.[1];
-        if (!map2) {
-          continue;
-        }
-        const keys = Object.keys(map2);
-        for (let k2 = 0, len3 = keys.length; k2 < len3; k2++) {
-          map2[keys[k2]] = paramReplacementMap[map2[keys[k2]]];
-        }
+        handlerData[pathData[0]] = handlers2.map(([h2, handlerPath]) => [
+          h2,
+          trie.paths[handlerPath][1].reduceRight((map2, [key], i2) => {
+            map2[key] = paramReplacementMap[pathData[1][i2][1]];
+            return map2;
+          }, createNullObject())
+        ]);
       }
     }
-    const handlerMap = [];
-    for (const i2 in indexReplacementMap) {
-      handlerMap[i2] = handlerData[indexReplacementMap[i2]];
-    }
-    return [regexp, handlerMap, staticMap];
+    return [regexp, indexReplacementMap.map((i2) => handlerData[i2]), staticMap];
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/smart-router/router.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
   #routers = [];
@@ -127204,78 +127463,53 @@ var SmartRouter = class {
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/trie-router/node.js
-var emptyParams = /* @__PURE__ */ Object.create(null);
-var hasChildren = (children) => {
-  for (const _ in children) {
-    return true;
-  }
-  return false;
-};
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/trie-router/node.js
+var emptyParams = createNullObject();
+var order = 0;
 var Node2 = class _Node2 {
-  #methods;
-  #children;
-  #patterns;
-  #order = 0;
+  #methods = [];
+  #children = createNullObject();
+  #patterns = [];
+  #pattern;
   #params = emptyParams;
-  constructor(method, handler2, children) {
-    this.#children = children || /* @__PURE__ */ Object.create(null);
-    this.#methods = [];
-    if (method && handler2) {
-      const m = /* @__PURE__ */ Object.create(null);
-      m[method] = { handler: handler2, possibleKeys: [], score: 0 };
-      this.#methods = [m];
-    }
-    this.#patterns = [];
-  }
   insert(method, path4, handler2) {
-    this.#order = ++this.#order;
     let curNode = this;
     const parts = splitRoutingPath(path4);
-    const possibleKeys = [];
-    for (let i2 = 0, len = parts.length; i2 < len; i2++) {
-      const p = parts[i2];
-      const nextP = parts[i2 + 1];
-      const pattern = getPattern(p, nextP);
-      const key = Array.isArray(pattern) ? pattern[0] : p;
-      if (key in curNode.#children) {
-        curNode = curNode.#children[key];
-        if (pattern) {
-          possibleKeys.push(pattern[1]);
-        }
-        continue;
+    const possibleKeys = /* @__PURE__ */ new Set();
+    let i2 = 0;
+    for (const p of parts) {
+      const nextP = parts[++i2];
+      const pattern = getPattern(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern);
+      const key = isParam ? pattern[0] : pattern || p;
+      const child = curNode.#children[key] ||= new _Node2();
+      if (pattern && !child.#pattern) {
+        child.#pattern = pattern;
+        curNode.#patterns.push(child);
       }
-      curNode.#children[key] = new _Node2();
-      if (pattern) {
-        curNode.#patterns.push(pattern);
-        possibleKeys.push(pattern[1]);
+      curNode = child;
+      if (isParam) {
+        possibleKeys.add(pattern[1]);
       }
-      curNode = curNode.#children[key];
     }
     curNode.#methods.push({
       [method]: {
         handler: handler2,
-        possibleKeys: possibleKeys.filter((v, i2, a2) => a2.indexOf(v) === i2),
-        score: this.#order
+        possibleKeys: [...possibleKeys],
+        score: ++order
       }
     });
-    return curNode;
   }
   #pushHandlerSets(handlerSets, node2, method, nodeParams, params) {
     for (let i2 = 0, len = node2.#methods.length; i2 < len; i2++) {
       const m = node2.#methods[i2];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
-      const processedSet = {};
-      if (handlerSet !== void 0) {
-        handlerSet.params = /* @__PURE__ */ Object.create(null);
+      if (handlerSet) {
+        handlerSet.params = createNullObject();
         handlerSets.push(handlerSet);
-        if (nodeParams !== emptyParams || params && params !== emptyParams) {
-          for (let i22 = 0, len2 = handlerSet.possibleKeys.length; i22 < len2; i22++) {
-            const key = handlerSet.possibleKeys[i22];
-            const processed = processedSet[handlerSet.score];
-            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
-            processedSet[handlerSet.score] = true;
-          }
+        for (let i22 = 0, len2 = handlerSet.possibleKeys.length; i22 < len2; i22++) {
+          const key = handlerSet.possibleKeys[i22];
+          handlerSet.params[key] = params?.[key] && !i22 ? params[key] : nodeParams[key] ?? params?.[key];
         }
       }
     }
@@ -127307,33 +127541,33 @@ var Node2 = class _Node2 {
             tempNodes.push(nextNode);
           }
         }
-        for (let k2 = 0, len3 = node2.#patterns.length; k2 < len3; k2++) {
-          const pattern = node2.#patterns[k2];
+        for (const child of node2.#patterns) {
+          const pattern = child.#pattern;
           const params = node2.#params === emptyParams ? {} : { ...node2.#params };
-          if (pattern === "*") {
-            const astNode = node2.#children["*"];
-            if (astNode) {
-              this.#pushHandlerSets(handlerSets, astNode, method, node2.#params);
-              astNode.#params = params;
-              tempNodes.push(astNode);
+          if (typeof pattern === "string") {
+            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+              this.#pushHandlerSets(handlerSets, child, method, node2.#params);
+              if (pattern === "*") {
+                child.#params = params;
+                tempNodes.push(child);
+              }
             }
             continue;
           }
-          const [key, name, matcher] = pattern;
-          if (!part && !(matcher instanceof RegExp)) {
+          const [, name, matcher] = pattern;
+          if (!part && matcher === true) {
             continue;
           }
-          const child = node2.#children[key];
-          if (matcher instanceof RegExp) {
-            if (partOffsets === null) {
-              partOffsets = new Array(len);
+          if (matcher !== true) {
+            if (!partOffsets) {
+              partOffsets = [];
               let offset = path4[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path4.substring(partOffsets[i2]);
+            const restPathString = path4.slice(partOffsets[i2]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -127347,11 +127581,12 @@ var Node2 = class _Node2 {
                   params
                 );
               }
-              if (hasChildren(child.#children)) {
+              for (const _ in child.#children) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
+                break;
               }
               continue;
             }
@@ -127379,7 +127614,7 @@ var Node2 = class _Node2 {
       const shifted = curNodesQueue.shift();
       curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
     }
-    if (handlerSets.length > 1) {
+    if (handlerSets[1]) {
       handlerSets.sort((a2, b) => {
         return a2.score - b.score;
       });
@@ -127388,29 +127623,21 @@ var Node2 = class _Node2 {
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/router/trie-router/router.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/router/trie-router/router.js
 var TrieRouter = class {
   name = "TrieRouter";
-  #node;
-  constructor() {
-    this.#node = new Node2();
-  }
+  #node = new Node2();
   add(method, path4, handler2) {
-    const results = checkOptionalParameter(path4);
-    if (results) {
-      for (let i2 = 0, len = results.length; i2 < len; i2++) {
-        this.#node.insert(method, results[i2], handler2);
-      }
-      return;
+    for (const result of checkOptionalParameter(path4) || [path4]) {
+      this.#node.insert(method, result, handler2);
     }
-    this.#node.insert(method, path4, handler2);
   }
   match(method, path4) {
     return this.#node.search(method, path4);
   }
 };
 
-// node_modules/.pnpm/hono@4.13.1/node_modules/hono/dist/hono.js
+// node_modules/.pnpm/hono@4.13.5/node_modules/hono/dist/hono.js
 var Hono2 = class extends Hono {
   /**
    * Creates an instance of the Hono class.
@@ -127425,7 +127652,7 @@ var Hono2 = class extends Hono {
   }
 };
 
-// node_modules/.pnpm/mcp-proxy@6.7.2/node_modules/mcp-proxy/dist/startStdioServer-BomI-BJR.mjs
+// node_modules/.pnpm/mcp-proxy@6.7.11/node_modules/mcp-proxy/dist/startStdioServer-C4sEMMHS.mjs
 import { createRequire } from "node:module";
 import { randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
 
@@ -134681,11 +134908,11 @@ var require_dataType2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     gen.if((0, codegen_1._)`${parentData} !== undefined`, () => gen.assign((0, codegen_1._)`${parentData}[${parentDataProperty}]`, expr));
   }
   function checkDataType(dataType, data, strictNums, correct = DataType.Correct) {
-    const EQ = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
+    const EQ2 = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
     let cond;
     switch (dataType) {
       case "null":
-        return (0, codegen_1._)`${data} ${EQ} null`;
+        return (0, codegen_1._)`${data} ${EQ2} null`;
       case "array":
         cond = (0, codegen_1._)`Array.isArray(${data})`;
         break;
@@ -134699,7 +134926,7 @@ var require_dataType2 = /* @__PURE__ */ __commonJSMin(((exports) => {
         cond = numCond();
         break;
       default:
-        return (0, codegen_1._)`typeof ${data} ${EQ} ${dataType}`;
+        return (0, codegen_1._)`typeof ${data} ${EQ2} ${dataType}`;
     }
     return correct === DataType.Correct ? cond : (0, codegen_1.not)(cond);
     function numCond(_cond = codegen_1.nil) {
@@ -143024,7 +143251,7 @@ function createMcpHandler(factory, options = {}) {
   };
 }
 
-// node_modules/.pnpm/mcp-proxy@6.7.2/node_modules/mcp-proxy/dist/startStdioServer-BomI-BJR.mjs
+// node_modules/.pnpm/mcp-proxy@6.7.11/node_modules/mcp-proxy/dist/startStdioServer-C4sEMMHS.mjs
 import http from "http";
 import { Http2ServerRequest } from "http2";
 import { Readable } from "stream";
@@ -148732,11 +148959,11 @@ var require_dataType3 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     gen.if((0, codegen_1._)`${parentData} !== undefined`, () => gen.assign((0, codegen_1._)`${parentData}[${parentDataProperty}]`, expr));
   }
   function checkDataType(dataType, data, strictNums, correct = DataType.Correct) {
-    const EQ = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
+    const EQ2 = correct === DataType.Correct ? codegen_1.operators.EQ : codegen_1.operators.NEQ;
     let cond;
     switch (dataType) {
       case "null":
-        return (0, codegen_1._)`${data} ${EQ} null`;
+        return (0, codegen_1._)`${data} ${EQ2} null`;
       case "array":
         cond = (0, codegen_1._)`Array.isArray(${data})`;
         break;
@@ -148750,7 +148977,7 @@ var require_dataType3 = /* @__PURE__ */ __commonJSMin2(((exports) => {
         cond = numCond();
         break;
       default:
-        return (0, codegen_1._)`typeof ${data} ${EQ} ${dataType}`;
+        return (0, codegen_1._)`typeof ${data} ${EQ2} ${dataType}`;
     }
     return correct === DataType.Correct ? cond : (0, codegen_1.not)(cond);
     function numCond(_cond = codegen_1.nil) {
@@ -154429,7 +154656,7 @@ var SseError = class extends Error {
   }
 };
 
-// node_modules/.pnpm/mcp-proxy@6.7.2/node_modules/mcp-proxy/dist/startStdioServer-BomI-BJR.mjs
+// node_modules/.pnpm/mcp-proxy@6.7.11/node_modules/mcp-proxy/dist/startStdioServer-C4sEMMHS.mjs
 var __create4 = Object.create;
 var __defProp$1 = Object.defineProperty;
 var __getOwnPropDesc4 = Object.getOwnPropertyDescriptor;
@@ -154537,6 +154764,12 @@ var InMemoryEventStore = class {
   get size() {
     return this.events.size;
   }
+  /**
+  * Keeps event IDs in stream-local insertion order so replay can walk only the
+  * relevant stream instead of sorting the entire global event map on every
+  * reconnect.
+  */
+  eventIdsByStream = /* @__PURE__ */ new Map();
   events = /* @__PURE__ */ new Map();
   lastTimestamp = 0;
   lastTimestampCounter = 0;
@@ -154560,15 +154793,15 @@ var InMemoryEventStore = class {
     if (!lastEventId) return "";
     const streamId = await this.getStreamIdForEventId(lastEventId);
     if (!streamId) return "";
-    let foundLastEvent = false;
-    const sortedEvents = [...this.events.entries()].sort((a2, b) => a2[0].localeCompare(b[0]));
-    for (const [eventId, { message, streamId: eventStreamId }] of sortedEvents) {
-      if (eventStreamId !== streamId) continue;
-      if (eventId === lastEventId) {
-        foundLastEvent = true;
-        continue;
-      }
-      if (foundLastEvent) await send(eventId, message);
+    const eventIdsForStream = this.eventIdsByStream.get(streamId);
+    if (!eventIdsForStream) return "";
+    const lastEventIndex = eventIdsForStream.indexOf(lastEventId);
+    if (lastEventIndex === -1) return "";
+    for (let index = lastEventIndex + 1; index < eventIdsForStream.length; index++) {
+      const eventId = eventIdsForStream[index];
+      const storedEvent = this.events.get(eventId);
+      if (!storedEvent) continue;
+      await send(eventId, storedEvent.message);
     }
     return streamId;
   }
@@ -154582,10 +154815,22 @@ var InMemoryEventStore = class {
       message,
       streamId
     });
+    const streamEvents = this.eventIdsByStream.get(streamId) ?? [];
+    streamEvents.push(eventId);
+    this.eventIdsByStream.set(streamId, streamEvents);
     while (this.events.size > this.maxEvents) {
       const oldestEventId = this.events.keys().next().value;
       if (oldestEventId === void 0) break;
+      const oldestEvent = this.events.get(oldestEventId);
       this.events.delete(oldestEventId);
+      if (oldestEvent) {
+        const streamEventIds = this.eventIdsByStream.get(oldestEvent.streamId);
+        if (streamEventIds) {
+          const index = streamEventIds.indexOf(oldestEventId);
+          if (index !== -1) streamEventIds.splice(index, 1);
+          if (streamEventIds.length === 0) this.eventIdsByStream.delete(oldestEvent.streamId);
+        }
+      }
     }
     return eventId;
   }
@@ -171150,6 +171395,34 @@ data: ${JSON.stringify(message)}
   }
 };
 var DEFAULT_KEEP_ALIVE_TIMEOUT = 3e5;
+var addUtf8Charset = (contentType$1) => {
+  if (/;\s*charset=/i.test(contentType$1) || !/^(application\/json|text\/event-stream)(?:\s*;|$)/i.test(contentType$1)) return contentType$1;
+  return `${contentType$1}; charset=utf-8`;
+};
+var normalizeResponseHeaders = (headers) => {
+  if (Array.isArray(headers)) return headers.map((value2, index) => {
+    const headerName = headers[index - 1];
+    if (index % 2 === 1 && typeof headerName === "string" && headerName.toLowerCase() === "content-type" && typeof value2 === "string") return addUtf8Charset(value2);
+    return value2;
+  });
+  const normalizedHeaders = { ...headers };
+  for (const [name, value2] of Object.entries(headers)) if (name.toLowerCase() === "content-type" && typeof value2 === "string") normalizedHeaders[name] = addUtf8Charset(value2);
+  return normalizedHeaders;
+};
+var ensureUtf8ResponseCharset = (res) => {
+  const originalWriteHead = res.writeHead.bind(res);
+  res.writeHead = ((statusCode, statusMessageOrHeaders, headers) => {
+    const currentContentType = res.getHeader("Content-Type");
+    if (typeof currentContentType === "string") res.setHeader("Content-Type", addUtf8Charset(currentContentType));
+    const responseHeaders = typeof statusMessageOrHeaders === "string" ? headers : statusMessageOrHeaders;
+    if (responseHeaders) {
+      const normalizedHeaders = normalizeResponseHeaders(responseHeaders);
+      if (typeof statusMessageOrHeaders === "string") return originalWriteHead(statusCode, statusMessageOrHeaders, normalizedHeaders);
+      return originalWriteHead(statusCode, normalizedHeaders);
+    }
+    return originalWriteHead(statusCode, statusMessageOrHeaders, headers);
+  });
+};
 var DEFAULT_SESSION_IDLE_TIMEOUT = 18e5;
 var SESSION_SWEEP_INTERVAL = 6e4;
 var FORCE_CLOSE_GRACE_PERIOD = 1e3;
@@ -171197,6 +171470,7 @@ var getBody = (request2, maxBodySize = DEFAULT_MAX_BODY_SIZE) => {
       if (maxBodySize !== false) {
         size += chunk.length;
         if (size > maxBodySize) {
+          request2.pause();
           resolve3({
             limit: maxBodySize,
             tooLarge: true
@@ -171302,6 +171576,10 @@ var isScopeChallengeError = (error52) => {
 var handleResponseError = async (error52, res) => {
   if (error52 && typeof error52 === "object" && "status" in error52 && "headers" in error52 && "statusText" in error52 || error52 instanceof Response) {
     const responseError = error52;
+    if (res.headersSent) {
+      res.end();
+      return true;
+    }
     const fixedHeaders = {};
     responseError.headers.forEach((value2, key$1) => {
       if (fixedHeaders[key$1]) if (Array.isArray(fixedHeaders[key$1])) fixedHeaders[key$1].push(value2);
@@ -171377,8 +171655,9 @@ var applyCorsHeaders = (req, res, corsOptions) => {
       else if (Array.isArray(finalCorsOptions.origin)) allowedOrigin = finalCorsOptions.origin.includes(origin.origin) ? origin.origin : "false";
       else if (typeof finalCorsOptions.origin === "function") allowedOrigin = finalCorsOptions.origin(origin.origin) ? origin.origin : "false";
     }
+    res.setHeader("Vary", "Origin");
     if (allowedOrigin !== "false") res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
-    if (finalCorsOptions.credentials !== void 0) res.setHeader("Access-Control-Allow-Credentials", finalCorsOptions.credentials.toString());
+    if (finalCorsOptions.credentials !== void 0 && allowedOrigin !== "*") res.setHeader("Access-Control-Allow-Credentials", finalCorsOptions.credentials.toString());
     if (finalCorsOptions.methods) res.setHeader("Access-Control-Allow-Methods", finalCorsOptions.methods.join(", "));
     if (finalCorsOptions.allowedHeaders) {
       const allowedHeaders = typeof finalCorsOptions.allowedHeaders === "string" ? finalCorsOptions.allowedHeaders : finalCorsOptions.allowedHeaders.join(", ");
@@ -171612,8 +171891,16 @@ var handleStreamRequest = async ({ activeTransports, authenticate, authMiddlewar
           });
           return true;
         }
-        await server.connect(transport);
-        if (onConnect) await onConnect(server);
+        try {
+          await server.connect(transport);
+          if (onConnect) await onConnect(server);
+        } catch (error52) {
+          if (!isCleaningUp) {
+            isCleaningUp = true;
+            await cleanupServer(server, onClose);
+          }
+          throw error52;
+        }
         await transport.handleRequest(req, res, body);
         return true;
       } else if (stateless && !sessionId && !isInitializeRequest(body)) {
@@ -171635,8 +171922,13 @@ var handleStreamRequest = async ({ activeTransports, authenticate, authMiddlewar
           });
           return true;
         }
-        await server.connect(transport);
-        if (onConnect) await onConnect(server);
+        try {
+          await server.connect(transport);
+          if (onConnect) await onConnect(server);
+        } catch (error52) {
+          await cleanupServer(server, onClose);
+          throw error52;
+        }
         await transport.handleRequest(req, res, body);
         return true;
       } else {
@@ -171655,6 +171947,11 @@ var handleStreamRequest = async ({ activeTransports, authenticate, authMiddlewar
       await transport.handleRequest(req, res, body);
       return true;
     } catch (error52) {
+      if (res.headersSent) {
+        console.error("[mcp-proxy] error handling request after headers sent", error52);
+        res.end();
+        return true;
+      }
       if (isScopeChallengeError(error52)) {
         const response = authMiddleware.getScopeChallengeResponse(error52.data.requiredScopes, error52.data.errorDescription, body?.id);
         res.writeHead(response.statusCode, response.headers);
@@ -171700,7 +171997,13 @@ var handleStreamRequest = async ({ activeTransports, authenticate, authMiddlewar
     if (lastEventId) console.log(`[mcp-proxy] client reconnecting with Last-Event-ID ${lastEventId} for session ID ${sessionId}`);
     else console.log(`[mcp-proxy] establishing new SSE stream for session ID ${sessionId}`);
     trackSessionStream(activeTransport, res);
-    await activeTransport.transport.handleRequest(req, res);
+    try {
+      await activeTransport.transport.handleRequest(req, res);
+    } catch (error52) {
+      console.error("[mcp-proxy] error handling stream request", error52);
+      if (res.headersSent) res.end();
+      else res.writeHead(500).end("Error handling request");
+    }
     return true;
   }
   if (req.method === "DELETE" && new URL(req.url, "http://localhost").pathname === endpoint2) {
@@ -171810,6 +172113,7 @@ var startHTTPServer = async ({ apiKey, authenticate, cors, createServer: createS
     onListenSubscriptions
   }) : void 0;
   const requestListener = async (req, res) => {
+    ensureUtf8ResponseCharset(res);
     applyCorsHeaders(req, res, cors);
     if (req.method === "OPTIONS") {
       res.writeHead(204);
@@ -182316,7 +182620,7 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
   let lastEmittedSeq = -2;
   let seq = 0;
   let hasChanges = false;
-  function emit(line) {
+  function emit2(line) {
     if (lastEmittedSeq >= 0 && line.seq > lastEmittedSeq + 1) out += (out ? "\n" : "") + "...";
     out += (out ? "\n" : "") + line.prefix + raw2.slice(line.from, line.to);
     lastEmittedSeq = line.seq;
@@ -182324,10 +182628,10 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
     if (lastHunkHdr?.seq === line.seq) hunkHdrEmitted = true;
   }
   function flushBefore() {
-    if (lastFileHdr && !fileHdrEmitted) emit(lastFileHdr);
-    if (lastHunkHdr && !hunkHdrEmitted) emit(lastHunkHdr);
+    if (lastFileHdr && !fileHdrEmitted) emit2(lastFileHdr);
+    if (lastHunkHdr && !hunkHdrEmitted) emit2(lastHunkHdr);
     for (const line of beforeBuf) {
-      if (line.seq > lastEmittedSeq) emit(line);
+      if (line.seq > lastEmittedSeq) emit2(line);
     }
     beforeBuf.length = 0;
   }
@@ -182366,10 +182670,10 @@ function postProcessRangeDiff(raw2, contextLines = 3) {
         if (isChange) {
           hasChanges = true;
           flushBefore();
-          emit(line);
+          emit2(line);
           afterRemaining = contextLines;
         } else if (afterRemaining > 0) {
-          emit(line);
+          emit2(line);
           afterRemaining--;
         } else {
           if (beforeBuf.length >= contextLines) beforeBuf.shift();
@@ -184182,10 +184486,111 @@ function withDefaults(oldDefaults, newDefaults) {
 }
 var endpoint = withDefaults(null, DEFAULTS);
 
-// node_modules/.pnpm/@octokit+request@10.0.13/node_modules/@octokit/request/dist-bundle/index.js
-var import_content_type4 = __toESM(require_dist4(), 1);
+// node_modules/.pnpm/content-type@3.0.0/node_modules/content-type/dist/index.js
+var NullObject = /* @__PURE__ */ (() => {
+  const C = function() {
+  };
+  C.prototype = /* @__PURE__ */ Object.create(null);
+  return C;
+})();
+function parse5(header, options) {
+  const stopChar = options?.comma === true ? COMMA : 65536;
+  const len = header.length;
+  let index = skipOWS(header, options?.start ?? 0, len);
+  const valueStart = index;
+  index = skipValue(header, index, len, stopChar);
+  const valueEnd = trailingOWS(header, valueStart, index);
+  const type2 = header.slice(valueStart, valueEnd).toLowerCase();
+  if (options?.parameters === false) {
+    return { type: type2, index, parameters: new NullObject() };
+  }
+  return parseParameters(header, type2, index, len, stopChar);
+}
+var SP = 32;
+var HTAB = 9;
+var SEMI = 59;
+var EQ = 61;
+var DQUOTE = 34;
+var BSLASH = 92;
+var COMMA = 44;
+function parseParameters(header, type2, index, len, stopChar) {
+  const parameters = new NullObject();
+  parameter: while (index < len) {
+    if (header.charCodeAt(index) === stopChar)
+      break;
+    index = skipOWS(header, index + 1, len);
+    const keyStart = index;
+    while (index < len) {
+      const code = header.charCodeAt(index);
+      if (code === stopChar)
+        break parameter;
+      if (code === SEMI)
+        continue parameter;
+      if (code === EQ) {
+        const keyEnd = trailingOWS(header, keyStart, index);
+        const key = header.slice(keyStart, keyEnd).toLowerCase();
+        index = skipOWS(header, index + 1, len);
+        if (index < len && header.charCodeAt(index) === DQUOTE) {
+          index++;
+          let value2 = "";
+          while (index < len) {
+            const code2 = header.charCodeAt(index++);
+            if (code2 === DQUOTE) {
+              index = skipValue(header, index, len, stopChar);
+              if (parameters[key] === void 0)
+                parameters[key] = value2;
+              break;
+            }
+            if (code2 === BSLASH && index < len) {
+              value2 += header[index++];
+              continue;
+            }
+            value2 += String.fromCharCode(code2);
+          }
+          continue parameter;
+        }
+        const valueStart = index;
+        index = skipValue(header, index, len, stopChar);
+        if (parameters[key] === void 0) {
+          const valueEnd = trailingOWS(header, valueStart, index);
+          parameters[key] = header.slice(valueStart, valueEnd);
+        }
+        continue parameter;
+      }
+      index++;
+    }
+  }
+  return { type: type2, index, parameters };
+}
+function skipValue(str, index, len, stopChar) {
+  while (index < len) {
+    const code = str.charCodeAt(index);
+    if (code === SEMI || code === stopChar)
+      break;
+    index++;
+  }
+  return index;
+}
+function skipOWS(header, index, len) {
+  while (index < len) {
+    const char = header.charCodeAt(index);
+    if (char !== SP && char !== HTAB)
+      break;
+    index++;
+  }
+  return index;
+}
+function trailingOWS(header, start, end) {
+  while (end > start) {
+    const char = header.charCodeAt(end - 1);
+    if (char !== SP && char !== HTAB)
+      break;
+    end--;
+  }
+  return end;
+}
 
-// node_modules/.pnpm/json-with-bigint@3.5.10/node_modules/json-with-bigint/json-with-bigint.js
+// node_modules/.pnpm/json-with-bigint@3.5.12/node_modules/json-with-bigint/json-with-bigint.js
 var intRegex = /^-?\d+$/;
 var noiseValue = /^-?\d+n+$/;
 var originalStringify = JSON.stringify;
@@ -184442,7 +184847,7 @@ var JSONParseV2 = (text, reviver) => {
 };
 var MAX_INT = Number.MAX_SAFE_INTEGER.toString();
 var MAX_DIGITS = MAX_INT.length;
-var stringsOrLargeNumbers = /"(?:\\.|[^"])*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g;
+var stringsOrLargeNumbers = /"(?:[^"\\]|\\.)*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g;
 var noiseValueWithQuotes = /^"-?\d+n+"$/;
 var applyReviverIteratively = (parsed2, userReviver) => {
   const rootHolder = { "": parsed2 };
@@ -184559,8 +184964,8 @@ var RequestError2 = class extends Error {
   }
 };
 
-// node_modules/.pnpm/@octokit+request@10.0.13/node_modules/@octokit/request/dist-bundle/index.js
-var VERSION3 = "10.0.13";
+// node_modules/.pnpm/@octokit+request@10.0.15/node_modules/@octokit/request/dist-bundle/index.js
+var VERSION3 = "10.0.15";
 var defaults_default = {
   headers: {
     "user-agent": `octokit-request.js/${VERSION3} ${getUserAgent2()}`
@@ -184678,7 +185083,7 @@ async function getResponseData(response) {
   if (!contentType) {
     return response.text().catch(noop2);
   }
-  const mimetype = (0, import_content_type4.parse)(contentType);
+  const mimetype = parse5(contentType);
   if (isJSONResponse(mimetype)) {
     let text = "";
     try {
@@ -188050,7 +188455,7 @@ function resolveRepoCtx(ctx, repo) {
 // node_modules/.pnpm/@toon-format+toon@1.4.0/node_modules/@toon-format/toon/dist/index.mjs
 var LIST_ITEM_MARKER = "-";
 var LIST_ITEM_PREFIX = "- ";
-var COMMA = ",";
+var COMMA2 = ",";
 var PIPE = "|";
 var DOT = ".";
 var NULL_LITERAL = "null";
@@ -188060,7 +188465,7 @@ var BACKSLASH = "\\";
 var DOUBLE_QUOTE = '"';
 var TAB = "	";
 var DELIMITERS = {
-  comma: COMMA,
+  comma: COMMA2,
   tab: TAB,
   pipe: PIPE
 };
@@ -188205,7 +188610,7 @@ function encodeAndJoinPrimitives(values, delimiter2 = DEFAULT_DELIMITER) {
 function formatHeader(length, options) {
   const key = options?.key;
   const fields = options?.fields;
-  const delimiter2 = options?.delimiter ?? COMMA;
+  const delimiter2 = options?.delimiter ?? COMMA2;
   let header = "";
   if (key) header += encodeKey(key);
   header += `[${length}${delimiter2 !== DEFAULT_DELIMITER ? delimiter2 : ""}]`;
@@ -194629,116 +195034,16 @@ function subagentDeniedToolNames(ctx, outputSchema) {
   return names;
 }
 
-// utils/agent.ts
-function hasEnvVar2(name) {
-  const val = process.env[name];
-  return typeof val === "string" && val.length > 0;
-}
-function hasClaudeCodeAuth() {
-  return hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar2("ANTHROPIC_API_KEY") || hasEnvVar2("ANTHROPIC_AUTH_TOKEN");
-}
-function hasCodexAuth() {
-  return hasEnvVar2("CODEX_AUTH_JSON") || hasEnvVar2("OPENAI_API_KEY");
-}
-function hasBedrockAuth() {
-  return hasEnvVar2("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar2("AWS_ACCESS_KEY_ID") && hasEnvVar2("AWS_SECRET_ACCESS_KEY");
-}
-function hasVertexAuth() {
-  return hasEnvVar2(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
-}
-function resolveSlug(slug2) {
-  const alias = resolveDisplayAlias(slug2);
-  if (alias?.routing === "bedrock") {
-    const bedrockId = process.env[BEDROCK_MODEL_ID_ENV]?.trim();
-    if (!bedrockId) {
-      throw new Error(
-        `${BEDROCK_MODEL_ID_ENV} env var is required when the model is set to "${slug2}". set it to an AWS Bedrock model ID from the Bedrock console. see https://docs.pullfrog.com/bedrock for setup.`
-      );
-    }
-    return bedrockId;
-  }
-  if (alias?.routing === "vertex") {
-    const vertexId = process.env[VERTEX_MODEL_ID_ENV]?.trim();
-    if (!vertexId) {
-      throw new Error(
-        `${VERTEX_MODEL_ID_ENV} env var is required when the model is set to "${slug2}". set it to a Google Vertex AI model ID from Model Garden. see https://docs.pullfrog.com/vertex for setup.`
-      );
-    }
-    return vertexId;
-  }
-  if (alias?.routing === "azure") {
-    const deployment = process.env[AZURE_DEPLOYMENT_ENV]?.trim();
-    if (!deployment) {
-      throw new Error(
-        `${AZURE_DEPLOYMENT_ENV} env var is required when the model is set to "${slug2}". set it to the name of your Azure OpenAI deployment (not the model it serves \u2014 Azure routes on the deployment name). see https://docs.pullfrog.com/azure for setup.`
-      );
-    }
-    return `${AZURE_PROVIDER}/${deployment}`;
-  }
-  if (alias?.routing === "openai-compatible") {
-    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
-    if (!modelId) {
-      throw new Error(
-        `${OPENAI_COMPATIBLE_MODEL_ENV} env var is required when the model is set to "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
-      );
-    }
-    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
-  }
-  return resolveCliModel(slug2);
-}
-function resolveModel(ctx) {
-  const envModel = process.env.PULLFROG_MODEL?.trim();
-  if (envModel) {
-    return resolveSlug(envModel) ?? envModel;
-  }
-  const slug2 = ctx.slug?.trim();
-  if (slug2) {
-    const resolved = resolveSlug(slug2);
-    if (resolved) {
-      return resolved;
-    }
-    if (slug2.includes("/")) {
-      log2.info(`\xBB "${slug2}" is not a curated alias \u2014 passing through as a raw model specifier`);
-      return slug2;
-    }
-    log2.warning(`\xBB unknown model slug "${slug2}" \u2014 agent will auto-select`);
-  }
-  return void 0;
-}
-function resolveAgent(ctx) {
-  const envAgent = process.env.PULLFROG_AGENT?.trim();
-  if (envAgent) {
-    if (envAgent in agents) {
-      return agents[envAgent];
-    }
-    log2.warning(`\xBB unknown PULLFROG_AGENT="${envAgent}" \u2014 falling through to auto-select`);
-  }
-  if (ctx.proxyModel) return agents.opencode;
-  if (ctx.model && hasBedrockAuth() && process.env[BEDROCK_MODEL_ID_ENV]?.trim() === ctx.model) {
-    return isBedrockAnthropicId(ctx.model) ? agents.claude : agents.opencode;
-  }
-  if (ctx.model && hasVertexAuth() && process.env[VERTEX_MODEL_ID_ENV]?.trim() === ctx.model) {
-    return isVertexAnthropicId(ctx.model) ? agents.claude : agents.opencode;
-  }
-  if (ctx.model) {
-    try {
-      const provider2 = getModelProvider(ctx.model);
-      if (provider2 === "anthropic" && hasClaudeCodeAuth()) return agents.claude;
-      if (provider2 === "openai" && ctx.codexAgent && hasCodexAuth()) return agents.codex;
-    } catch {
-    }
-  }
-  if (!ctx.model) {
-    if (hasEnvVar2("ANTHROPIC_AUTH_TOKEN") && !hasEnvVar2("ANTHROPIC_API_KEY") && !hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN")) {
-      return agents.claude;
-    }
-    if (ctx.codexAgent && hasCodexAuth() && !hasClaudeCodeAuth()) return agents.codex;
-  }
-  return agents.opencode;
-}
-
 // utils/apiKeys.ts
 var MISSING_KEY_MARKER = "no API key found";
+var BYOK_SLUG_MARKER = "env var is required when the model is set to";
+var BYOK_CONFIG_MARKER = "selected but required configuration is missing:";
+var BYOK_SETUP_PATTERN = new RegExp(
+  `^(?:[A-Z][A-Z0-9_]+ ${BYOK_SLUG_MARKER}|[A-Z][\\w-]*(?: [\\w-]+){0,3} ${BYOK_CONFIG_MARKER})`
+);
+function isByokSetupError(text) {
+  return BYOK_SETUP_PATTERN.test(text);
+}
 var SECRETS_UNAVAILABLE_MARKER = "couldn't load your Pullfrog secrets";
 var ROUTER_UNFUNDED_MARKER = "your Pullfrog Router balance is empty";
 var CREDENTIAL_REJECTED_MARKER = "was rejected by its provider";
@@ -194787,7 +195092,7 @@ function buildMissingApiKeyError(params) {
 }
 function buildBedrockSetupError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
-  return `Bedrock model selected but required configuration is missing: ${params.missing.join(", ")}.
+  return `Bedrock model ${BYOK_CONFIG_MARKER} ${params.missing.join(", ")}.
 
 add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then reference them in your workflow's \`env:\` block:
 
@@ -194801,7 +195106,7 @@ for full setup instructions, see https://docs.pullfrog.com/bedrock`;
 }
 function buildVertexSetupError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
-  return `Google Vertex AI model selected but required configuration is missing: ${params.missing.join(", ")}.
+  return `Google Vertex AI model ${BYOK_CONFIG_MARKER} ${params.missing.join(", ")}.
 
 add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then reference them in your workflow's \`env:\` block:
 
@@ -194814,7 +195119,7 @@ for full setup instructions, see https://docs.pullfrog.com/vertex`;
 }
 function buildOpenAICompatibleSetupError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
-  return `OpenAI-compatible model selected but required configuration is missing: ${params.missing.join(", ")}.
+  return `OpenAI-compatible model ${BYOK_CONFIG_MARKER} ${params.missing.join(", ")}.
 
 only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. everything else is plain workflow \`env:\`:
 
@@ -194833,7 +195138,7 @@ for full setup instructions, see https://docs.pullfrog.com/openai-compatible`;
 }
 function buildAzureSetupError(params) {
   const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
-  return `Azure OpenAI selected but required configuration is missing: ${params.missing.join(", ")}.
+  return `Azure OpenAI ${BYOK_CONFIG_MARKER} ${params.missing.join(", ")}.
 
 only the API key is sensitive \u2014 add it as a secret at ${githubSecretsUrl}. the rest is plain workflow \`env:\`:
 
@@ -194854,22 +195159,22 @@ is disabled, so long runs grow until Azure refuses them.
 
 for full setup instructions, see https://docs.pullfrog.com/azure`;
 }
-function hasEnvVar3(name) {
+function hasEnvVar2(name) {
   const value2 = process.env[name];
   return typeof value2 === "string" && value2.length > 0;
 }
 function modelHasRuntimeAuth(model) {
   const authVars = [...getModelEnvVars(model), ...getModelManagedCredentials(model)];
-  return authVars.length === 0 || authVars.some(hasEnvVar3);
+  return authVars.length === 0 || authVars.some(hasEnvVar2);
 }
 function hasPositiveNumberEnvVar(name) {
   return Number(process.env[name]) > 0;
 }
 function validateOpenAICompatibleSetup(params) {
   const missing = [];
-  if (!hasEnvVar3(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
-  if (!hasEnvVar3(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
-  if (!hasEnvVar3(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
+  if (!hasEnvVar2(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar2(OPENAI_COMPATIBLE_API_KEY_ENV)) missing.push(OPENAI_COMPATIBLE_API_KEY_ENV);
+  if (!hasEnvVar2(OPENAI_COMPATIBLE_MODEL_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ENV);
   if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_CONTEXT_ENV))
     missing.push(OPENAI_COMPATIBLE_CONTEXT_ENV);
   if (!hasPositiveNumberEnvVar(OPENAI_COMPATIBLE_MAX_OUTPUT_ENV))
@@ -194882,9 +195187,9 @@ function validateOpenAICompatibleSetup(params) {
 }
 function validateAzureSetup(params) {
   const missing = [];
-  if (!hasEnvVar3(AZURE_API_KEY_ENV)) missing.push(AZURE_API_KEY_ENV);
-  if (!hasEnvVar3(AZURE_RESOURCE_NAME_ENV)) missing.push(AZURE_RESOURCE_NAME_ENV);
-  if (!hasEnvVar3(AZURE_DEPLOYMENT_ENV)) missing.push(AZURE_DEPLOYMENT_ENV);
+  if (!hasEnvVar2(AZURE_API_KEY_ENV)) missing.push(AZURE_API_KEY_ENV);
+  if (!hasEnvVar2(AZURE_RESOURCE_NAME_ENV)) missing.push(AZURE_RESOURCE_NAME_ENV);
+  if (!hasEnvVar2(AZURE_DEPLOYMENT_ENV)) missing.push(AZURE_DEPLOYMENT_ENV);
   if (!hasPositiveNumberEnvVar(AZURE_CONTEXT_ENV)) missing.push(AZURE_CONTEXT_ENV);
   if (!hasPositiveNumberEnvVar(AZURE_MAX_OUTPUT_ENV)) missing.push(AZURE_MAX_OUTPUT_ENV);
   if (missing.length > 0) {
@@ -194892,33 +195197,33 @@ function validateAzureSetup(params) {
   }
 }
 function validateBedrockSetup(params) {
-  const hasAuth = hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
+  const hasAuth = hasEnvVar2("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar2("AWS_ACCESS_KEY_ID") && hasEnvVar2("AWS_SECRET_ACCESS_KEY");
   const missing = [];
   if (!hasAuth)
     missing.push("AWS_BEARER_TOKEN_BEDROCK (or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)");
-  if (!hasEnvVar3("AWS_REGION")) missing.push("AWS_REGION");
-  if (!hasEnvVar3(BEDROCK_MODEL_ID_ENV)) missing.push(BEDROCK_MODEL_ID_ENV);
+  if (!hasEnvVar2("AWS_REGION")) missing.push("AWS_REGION");
+  if (!hasEnvVar2(BEDROCK_MODEL_ID_ENV)) missing.push(BEDROCK_MODEL_ID_ENV);
   if (missing.length > 0) {
     throw new Error(buildBedrockSetupError({ owner: params.owner, name: params.name, missing }));
   }
 }
 function validateVertexSetup(params) {
-  const hasAuth = hasEnvVar3(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
-  const hasProject = hasEnvVar3(GOOGLE_CLOUD_PROJECT_ENV) || readProjectIdFromVertexServiceAccountJson() !== void 0;
+  const hasAuth = hasEnvVar2(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
+  const hasProject = hasEnvVar2(GOOGLE_CLOUD_PROJECT_ENV) || readProjectIdFromVertexServiceAccountJson() !== void 0;
   const missing = [];
   if (!hasAuth) missing.push(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
   if (!hasProject) missing.push(GOOGLE_CLOUD_PROJECT_ENV);
-  if (!hasEnvVar3(VERTEX_LOCATION_ENV)) missing.push(VERTEX_LOCATION_ENV);
-  if (!hasEnvVar3(VERTEX_MODEL_ID_ENV)) missing.push(VERTEX_MODEL_ID_ENV);
+  if (!hasEnvVar2(VERTEX_LOCATION_ENV)) missing.push(VERTEX_LOCATION_ENV);
+  if (!hasEnvVar2(VERTEX_MODEL_ID_ENV)) missing.push(VERTEX_MODEL_ID_ENV);
   if (missing.length > 0) {
     throw new Error(buildVertexSetupError({ owner: params.owner, name: params.name, missing }));
   }
 }
 function hasSingleProviderAuth(agentName) {
   if (agentName === "codex") {
-    return hasEnvVar3("OPENAI_API_KEY") || hasEnvVar3("CODEX_AUTH_JSON");
+    return hasEnvVar2("OPENAI_API_KEY") || hasEnvVar2("CODEX_AUTH_JSON");
   }
-  return hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("ANTHROPIC_AUTH_TOKEN") || hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN");
+  return hasEnvVar2("ANTHROPIC_API_KEY") || hasEnvVar2("ANTHROPIC_AUTH_TOKEN") || hasEnvVar2("CLAUDE_CODE_OAUTH_TOKEN");
 }
 function validateAgentApiKey(params) {
   if (params.model) {
@@ -194951,7 +195256,7 @@ function validateAgentApiKey(params) {
       if (params.authorized.has(params.model)) return;
       const reason = getModelsFailure();
       if (reason) throw new Error(reason);
-      if (getModelEnvVars(params.model).some(hasEnvVar3)) return;
+      if (getModelEnvVars(params.model).some(hasEnvVar2)) return;
       throw new Error(
         buildKeyError({
           owner: params.owner,
@@ -194998,7 +195303,7 @@ function validateAgentApiKey(params) {
 }
 function isApiKeyAuthError(text) {
   if (!text) return false;
-  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
+  return text.includes(MISSING_KEY_MARKER) || /Invalid API key/i.test(text) || /Incorrect API key provided/i.test(text) || /\bUser not found\b/i.test(text) || /\bInvalid authentication\b/i.test(text) || /authentication_error/i.test(text) || /Invalid bearer token/i.test(text) || /api_error_status\s*=\s*401/i.test(text) || /API Error:\s*401/i.test(text) || /Failed to authenticate\. API Error:/i.test(text) || /Your api key:.*is invalid/i.test(text) || isMalformedKeyError(text) || isClaudeSubscriptionDisabledError(text) || isClaudeSessionLimitError(text) || isOAuthCredentialExpiredError(text);
 }
 function isOAuthCredentialExpiredError(text) {
   return (
@@ -195094,8 +195399,8 @@ function formatApiKeyErrorSummary(params) {
       `[Claude subscription \u2192](https://docs.pullfrog.com/claude-auth) \xB7 [ChatGPT subscription \u2192](https://docs.pullfrog.com/codex-auth) \xB7 [Model settings \u2192](${settingsUrl}) \xB7 [Ask in Discord \u2192](https://discord.gg/8y96raFg8e)`
     ].join("\n");
   }
-  const subscription = Object.keys(SUBSCRIPTION_CREDENTIALS).find(hasEnvVar3);
-  if (subscription && !hasEnvVar3("ANTHROPIC_API_KEY")) {
+  const subscription = Object.keys(SUBSCRIPTION_CREDENTIALS).find(hasEnvVar2);
+  if (subscription && !hasEnvVar2("ANTHROPIC_API_KEY")) {
     const details = SUBSCRIPTION_CREDENTIALS[subscription];
     return [
       `**Your ${details?.label} was rejected during this run.** Re-authenticate with \`${details?.command}\` and re-trigger \u2014 a subscription credential can't be rotated from a provider dashboard.`,
@@ -195110,6 +195415,114 @@ function formatApiKeyErrorSummary(params) {
   ].join("\n");
 }
 
+// utils/agent.ts
+function hasEnvVar3(name) {
+  const val = process.env[name];
+  return typeof val === "string" && val.length > 0;
+}
+function hasClaudeCodeAuth() {
+  return hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN") || hasEnvVar3("ANTHROPIC_API_KEY") || hasEnvVar3("ANTHROPIC_AUTH_TOKEN");
+}
+function hasCodexAuth() {
+  return hasEnvVar3("CODEX_AUTH_JSON") || hasEnvVar3("OPENAI_API_KEY");
+}
+function hasBedrockAuth() {
+  return hasEnvVar3("AWS_BEARER_TOKEN_BEDROCK") || hasEnvVar3("AWS_ACCESS_KEY_ID") && hasEnvVar3("AWS_SECRET_ACCESS_KEY");
+}
+function hasVertexAuth() {
+  return hasEnvVar3(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
+}
+function resolveSlug(slug2) {
+  const alias = resolveDisplayAlias(slug2);
+  if (alias?.routing === "bedrock") {
+    const bedrockId = process.env[BEDROCK_MODEL_ID_ENV]?.trim();
+    if (!bedrockId) {
+      throw new Error(
+        `${BEDROCK_MODEL_ID_ENV} ${BYOK_SLUG_MARKER} "${slug2}". set it to an AWS Bedrock model ID from the Bedrock console. see https://docs.pullfrog.com/bedrock for setup.`
+      );
+    }
+    return bedrockId;
+  }
+  if (alias?.routing === "vertex") {
+    const vertexId = process.env[VERTEX_MODEL_ID_ENV]?.trim();
+    if (!vertexId) {
+      throw new Error(
+        `${VERTEX_MODEL_ID_ENV} ${BYOK_SLUG_MARKER} "${slug2}". set it to a Google Vertex AI model ID from Model Garden. see https://docs.pullfrog.com/vertex for setup.`
+      );
+    }
+    return vertexId;
+  }
+  if (alias?.routing === "azure") {
+    const deployment = process.env[AZURE_DEPLOYMENT_ENV]?.trim();
+    if (!deployment) {
+      throw new Error(
+        `${AZURE_DEPLOYMENT_ENV} ${BYOK_SLUG_MARKER} "${slug2}". set it to the name of your Azure OpenAI deployment (not the model it serves \u2014 Azure routes on the deployment name). see https://docs.pullfrog.com/azure for setup.`
+      );
+    }
+    return `${AZURE_PROVIDER}/${deployment}`;
+  }
+  if (alias?.routing === "openai-compatible") {
+    const modelId = process.env[OPENAI_COMPATIBLE_MODEL_ENV]?.trim();
+    if (!modelId) {
+      throw new Error(
+        `${OPENAI_COMPATIBLE_MODEL_ENV} ${BYOK_SLUG_MARKER} "${slug2}". set it to the model ID served by your OpenAI-compatible endpoint (e.g. a Cloudflare AI Gateway or DashScope model). see https://docs.pullfrog.com/openai-compatible for setup.`
+      );
+    }
+    return `${OPENAI_COMPATIBLE_PROVIDER}/${modelId}`;
+  }
+  return resolveCliModel(slug2);
+}
+function resolveModel(ctx) {
+  const envModel = process.env.PULLFROG_MODEL?.trim();
+  if (envModel) {
+    return resolveSlug(envModel) ?? envModel;
+  }
+  const slug2 = ctx.slug?.trim();
+  if (slug2) {
+    const resolved = resolveSlug(slug2);
+    if (resolved) {
+      return resolved;
+    }
+    if (slug2.includes("/")) {
+      log2.info(`\xBB "${slug2}" is not a curated alias \u2014 passing through as a raw model specifier`);
+      return slug2;
+    }
+    log2.warning(`\xBB unknown model slug "${slug2}" \u2014 agent will auto-select`);
+  }
+  return void 0;
+}
+function resolveAgent(ctx) {
+  const envAgent = process.env.PULLFROG_AGENT?.trim();
+  if (envAgent) {
+    if (envAgent in agents) {
+      return agents[envAgent];
+    }
+    log2.warning(`\xBB unknown PULLFROG_AGENT="${envAgent}" \u2014 falling through to auto-select`);
+  }
+  if (ctx.proxyModel) return agents.opencode;
+  if (ctx.model && hasBedrockAuth() && process.env[BEDROCK_MODEL_ID_ENV]?.trim() === ctx.model) {
+    return isBedrockAnthropicId(ctx.model) ? agents.claude : agents.opencode;
+  }
+  if (ctx.model && hasVertexAuth() && process.env[VERTEX_MODEL_ID_ENV]?.trim() === ctx.model) {
+    return isVertexAnthropicId(ctx.model) ? agents.claude : agents.opencode;
+  }
+  if (ctx.model) {
+    try {
+      const provider2 = getModelProvider(ctx.model);
+      if (provider2 === "anthropic" && hasClaudeCodeAuth()) return agents.claude;
+      if (provider2 === "openai" && ctx.codexAgent && hasCodexAuth()) return agents.codex;
+    } catch {
+    }
+  }
+  if (!ctx.model) {
+    if (hasEnvVar3("ANTHROPIC_AUTH_TOKEN") && !hasEnvVar3("ANTHROPIC_API_KEY") && !hasEnvVar3("CLAUDE_CODE_OAUTH_TOKEN")) {
+      return agents.claude;
+    }
+    if (ctx.codexAgent && hasCodexAuth() && !hasClaudeCodeAuth()) return agents.codex;
+  }
+  return agents.opencode;
+}
+
 // utils/billingErrors.ts
 var BillingError = class extends Error {
   code;
@@ -195962,10 +196375,7 @@ async function persistLearnings(ctx) {
         authorization: `Bearer ${ctx.apiToken}`,
         "content-type": "application/json"
       },
-      body: JSON.stringify({
-        learnings: current,
-        model: ctx.toolState.model
-      }),
+      body: JSON.stringify({ learnings: current }),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) {
@@ -196007,7 +196417,7 @@ async function persistXrepoLearnings(ctx) {
         authorization: `Bearer ${ctx.apiToken}`,
         "content-type": "application/json"
       },
-      body: JSON.stringify({ learnings: current, model: ctx.toolState.model }),
+      body: JSON.stringify({ learnings: current }),
       signal: AbortSignal.timeout(1e4)
     });
     if (!response.ok) {
@@ -197418,6 +197828,15 @@ ${input.errorMessage}
 \`\`\``
   ].join("\n");
 }
+function formatByokSetupSummary(input) {
+  return [
+    "**This repo's model isn't fully set up yet.**",
+    "",
+    input.raw,
+    "",
+    `[Configure model \u2192](${getApiUrl()}/console/${input.owner}/${input.name})`
+  ].join("\n");
+}
 function formatProviderModelNotFoundSummary(input) {
   return `The configured model is no longer available in OpenCode's catalog. Pick a different model in the Pullfrog console for \`${input.owner}/${input.name}\`, or contact support if this persists.
 
@@ -197473,6 +197892,16 @@ ${body}`, comment: body };
     });
     return { summary: `### \u274C Pullfrog failed
 
+${body}`, comment: body };
+  }
+  if (isByokSetupError(input.errorMessage)) {
+    const body = formatByokSetupSummary({
+      owner: input.repo.owner,
+      name: input.repo.name,
+      raw: input.errorMessage
+    });
+    return { summary: `### \u274C Pullfrog failed
+
 ${body}`, comment: body };
   }
   const apiKeySource = hangBody ?? input.errorMessage;
@@ -199197,16 +199626,192 @@ async function run2() {
   }
 }
 
+// commands/_prEvents.ts
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync16 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join29 } from "node:path";
+var REQUEST_TIMEOUT_MS = 35e3;
+var SERVER_POLL_WINDOW_MS = 25e3;
+var PrEventsAuthError = class extends Error {
+};
+var PrEventsAccessError = class extends Error {
+};
+function isTerminal2(error52) {
+  return error52 instanceof PrEventsAuthError || error52 instanceof PrEventsAccessError;
+}
+async function pollPrEvents(ctx) {
+  const params = new URLSearchParams({
+    owner: ctx.owner,
+    repo: ctx.repo,
+    pr: String(ctx.pr)
+  });
+  if (ctx.cursor !== void 0) params.set("since", ctx.cursor);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  const onCallerAbort = () => controller.abort();
+  if (ctx.signal?.aborted) controller.abort();
+  else ctx.signal?.addEventListener("abort", onCallerAbort, { once: true });
+  try {
+    const response = await fetch(`${PULLFROG_API_URL}/api/cli/pr-events?${params}`, {
+      headers: { authorization: `Bearer ${ctx.token}` },
+      signal: controller.signal
+    });
+    if (response.status === 401 || response.status === 403) {
+      throw new PrEventsAuthError("invalid or expired github token \u2014 run `gh auth login`.");
+    }
+    if (response.status === 404) {
+      throw new PrEventsAccessError(
+        `repository ${ctx.owner}/${ctx.repo} not found or Pullfrog not installed on it.`
+      );
+    }
+    if (!response.ok) {
+      throw new Error(`pr-events returned ${response.status}`);
+    }
+    return await response.json();
+  } finally {
+    clearTimeout(timeout);
+    ctx.signal?.removeEventListener("abort", onCallerAbort);
+  }
+}
+function stateDir() {
+  return process.env.PULLFROG_STATE_DIR || join29(homedir3(), ".pullfrog");
+}
+function cursorPath(target) {
+  const key = [target.owner, target.repo, String(target.pr)].map(encodeURIComponent).join("__");
+  return join29(stateDir(), "watch", `${key}.cursor`);
+}
+function readCursor(target) {
+  try {
+    const raw2 = readFileSync8(cursorPath(target), "utf-8").trim();
+    return /^\d+$/.test(raw2) ? raw2 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeCursor(target, cursor3) {
+  try {
+    const path4 = cursorPath(target);
+    mkdirSync11(join29(stateDir(), "watch"), { recursive: true });
+    writeFileSync16(path4, cursor3, "utf-8");
+  } catch {
+  }
+}
+async function resolveCursor(ctx) {
+  if (ctx.since !== void 0) return ctx.since;
+  const stored = readCursor(ctx);
+  if (stored !== void 0) return stored;
+  const subscribed = await pollPrEvents({ ...ctx, cursor: void 0 });
+  writeCursor(ctx, subscribed.cursor);
+  return subscribed.cursor;
+}
+async function waitForPrEvents(ctx) {
+  const controller = new AbortController();
+  const deadline = setTimeout(() => controller.abort(), ctx.maxWaitMs);
+  let cursor3 = ctx.cursor;
+  try {
+    for (; ; ) {
+      const result = await pollPrEvents({ ...ctx, cursor: cursor3, signal: controller.signal });
+      cursor3 = result.cursor;
+      if (result.events.length > 0) return { cursor: cursor3, events: result.events };
+    }
+  } catch (error52) {
+    if (isTerminal2(error52) || !controller.signal.aborted) throw error52;
+    return { cursor: cursor3, events: [] };
+  } finally {
+    clearTimeout(deadline);
+    writeCursor(ctx, cursor3);
+  }
+}
+
+// commands/mcp.ts
+var MAX_WAIT_SECONDS = 50;
+var PrWait = type({
+  pr: type.number.describe("The pull request number to wait on"),
+  "repo?": type.string.describe("Target repo as 'owner/repo'. Defaults to the current git remote."),
+  "max_wait_seconds?": type.number.describe(
+    `How long to block before returning empty. Default 25, maximum ${MAX_WAIT_SECONDS}.`
+  )
+});
+var ok = (data) => ({
+  content: [{ type: "text", text: JSON.stringify(data) }]
+});
+var fail = (message) => ({
+  content: [{ type: "text", text: message }],
+  isError: true
+});
+function resolveTarget(repo) {
+  if (repo === void 0) return tryParseGitRemote();
+  const match3 = repo.match(/^([^/\s]+)\/([^/\s]+)$/);
+  if (!match3) return null;
+  return { owner: match3[1], repo: match3[2] };
+}
+function cliVersion() {
+  const parts = /^(\d+)\.(\d+)\.(\d+)$/.exec("0.1.65");
+  if (!parts) return "0.0.0";
+  return `${Number(parts[1])}.${Number(parts[2])}.${Number(parts[3])}`;
+}
+async function runCli4(input) {
+  if (input.showHelp || input.args.includes("--help") || input.args.includes("-h")) {
+    console.log(`usage: ${input.prog} mcp
+`);
+    console.log("run a stdio MCP server exposing this repo's PR activity as an agent tool.\n");
+    console.log("register it with your harness rather than running it by hand:");
+    console.log(`  claude mcp add pullfrog -- npx ${input.prog} mcp`);
+    process.exit(0);
+  }
+  const server = new FastMCP({ name: "pullfrog", version: cliVersion() });
+  server.addTool({
+    name: "pr_wait",
+    description: "Block until new activity lands on a GitHub pull request, then return it. Covers new reviews, review comments, resolved/unresolved review threads, top-level PR comments, PR state changes (opened/closed/merged/synchronized), and completed check suites. Returns as soon as anything arrives, or an empty `events` array if the wait elapsed quietly \u2014 call it again to keep waiting. Reads a push feed of GitHub webhooks rather than polling the GitHub API, and remembers its position between calls, so consecutive calls do not miss events that landed in between. Example: `pr_wait({ pr: 42 })`.",
+    parameters: PrWait,
+    execute: async (params) => {
+      const token = tryGetGhToken();
+      if (!token) return fail(GH_TOKEN_HELP);
+      const target = resolveTarget(params.repo);
+      if (!target) {
+        return fail(
+          "could not determine the repo \u2014 pass `repo` as 'owner/repo', or run the server from a git checkout whose origin remote points at github."
+        );
+      }
+      if (!Number.isInteger(params.pr) || params.pr <= 0) {
+        return fail(`pr must be a positive integer, got ${params.pr}`);
+      }
+      const requested = params.max_wait_seconds ?? SERVER_POLL_WINDOW_MS / 1e3;
+      const maxWaitMs = Math.min(Math.max(requested, 1), MAX_WAIT_SECONDS) * 1e3;
+      const watched = { ...target, pr: params.pr };
+      try {
+        const cursor3 = await resolveCursor({ ...watched, token, since: void 0 });
+        const started = Date.now();
+        const result = await waitForPrEvents({ ...watched, token, cursor: cursor3, maxWaitMs });
+        return ok({
+          repo: `${target.owner}/${target.repo}`,
+          pr: params.pr,
+          waited_seconds: Math.round((Date.now() - started) / 1e3),
+          events: result.events
+        });
+      } catch (error52) {
+        if (isTerminal2(error52)) return fail(error52.message);
+        throw error52;
+      }
+    }
+  });
+  await server.start({ transportType: "stdio" });
+  await new Promise((resolve3) => {
+    process.stdin.once("end", resolve3);
+    process.stdin.once("close", resolve3);
+  });
+}
+
 // commands/watch.ts
 var import_arg4 = __toESM(require_arg(), 1);
 var import_picocolors4 = __toESM(require_picocolors(), 1);
-var REQUEST_TIMEOUT_MS = 35e3;
 function parseWatchArgs(args2) {
   return (0, import_arg4.default)(
     {
       "--pr": Number,
       "--pretty": Boolean,
       "--since": String,
+      "--once": Boolean,
       "--help": Boolean,
       "-h": "--help",
       "-p": "--pretty"
@@ -199223,7 +199828,8 @@ function printUsage(prog, stream) {
   stream("");
   stream("options:");
   stream("  --pr <number>    pull request number to watch (required)");
-  stream("  --since <cursor> resume from a cursor emitted by a prior event");
+  stream("  --once           wait for one batch of events, print it, and exit");
+  stream("  --since <cursor> resume from a cursor instead of the saved position");
   stream("  -p, --pretty     human-readable output instead of JSON lines");
   stream("  -h, --help       show help");
 }
@@ -199233,34 +199839,6 @@ function resolveRepo(positional) {
   if (!match3) bail(`invalid repo "${positional}" \u2014 expected <owner>/<repo>`);
   return { owner: match3[1], repo: match3[2] };
 }
-async function pollOnce(ctx) {
-  const params = new URLSearchParams({
-    owner: ctx.owner,
-    repo: ctx.repo,
-    pr: String(ctx.pr)
-  });
-  if (ctx.cursor !== void 0) params.set("since", ctx.cursor);
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-  try {
-    const response = await fetch(`${PULLFROG_API_URL}/api/cli/pr-events?${params}`, {
-      headers: { authorization: `Bearer ${ctx.token}` },
-      signal: controller.signal
-    });
-    if (response.status === 401 || response.status === 403) {
-      bail("invalid or expired github token \u2014 run `gh auth login`.");
-    }
-    if (response.status === 404) {
-      bail(`repository ${ctx.owner}/${ctx.repo} not found or Pullfrog not installed on it.`);
-    }
-    if (!response.ok) {
-      throw new Error(`pr-events returned ${response.status}`);
-    }
-    return await response.json();
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function formatPretty(event) {
   const time4 = new Date(event.createdAt).toLocaleTimeString();
   const action = typeof event.data.action === "string" ? event.data.action : "";
@@ -199268,7 +199846,14 @@ function formatPretty(event) {
   const detail = [action, actor && import_picocolors4.default.dim(`by ${actor}`)].filter(Boolean).join(" ");
   return `${import_picocolors4.default.dim(time4)} ${import_picocolors4.default.cyan(event.kind)} ${import_picocolors4.default.bold(`#${event.pr}`)} ${detail}`.trimEnd();
 }
-async function runCli4(input) {
+function emit(events, pretty) {
+  for (const event of events) {
+    process.stdout.write(pretty ? `${formatPretty(event)}
+` : `${JSON.stringify(event)}
+`);
+  }
+}
+async function runCli5(input) {
   let parsed2;
   try {
     parsed2 = parseWatchArgs(input.args);
@@ -199289,21 +199874,37 @@ async function runCli4(input) {
   }
   const token = getGhToken();
   const pretty = parsed2["--pretty"] === true;
-  let cursor3 = parsed2["--since"];
-  const poll = op(pollOnce, {
+  const watched = { ...target, pr };
+  let cursor3;
+  try {
+    cursor3 = await resolveCursor({ ...watched, token, since: parsed2["--since"] });
+    if (parsed2["--once"] === true) {
+      const result = await waitForPrEvents({
+        ...watched,
+        token,
+        cursor: cursor3,
+        maxWaitMs: SERVER_POLL_WINDOW_MS
+      });
+      emit(result.events, pretty);
+      return;
+    }
+  } catch (error52) {
+    if (isTerminal2(error52)) bail(error52.message);
+    throw error52;
+  }
+  const poll = op(pollPrEvents, {
     name: "pr-events poll",
-    retries: [1e3, 2e3, 5e3, 1e4, 15e3]
+    retries: [1e3, 2e3, 5e3, 1e4, 15e3],
+    bail: isTerminal2
   });
   for (; ; ) {
     try {
-      const result = await poll({ owner: target.owner, repo: target.repo, pr, token, cursor: cursor3 });
+      const result = await poll({ ...watched, token, cursor: cursor3 });
       cursor3 = result.cursor;
-      for (const event of result.events) {
-        process.stdout.write(pretty ? `${formatPretty(event)}
-` : `${JSON.stringify(event)}
-`);
-      }
+      writeCursor(watched, cursor3);
+      emit(result.events, pretty);
     } catch (error52) {
+      if (isTerminal2(error52)) bail(error52.message);
       const message = error52 instanceof Error ? error52.message : String(error52);
       console.error(import_picocolors4.default.dim(`watch: ${message} \u2014 retrying in 30s`));
       await new Promise((resolve3) => setTimeout(resolve3, 3e4));
@@ -199312,7 +199913,7 @@ async function runCli4(input) {
 }
 
 // cli.ts
-var VERSION10 = "0.1.64";
+var VERSION10 = "0.1.65";
 var bin = basename2(process.argv[1] || "");
 var PROG = bin === "pf" || bin === "pullfrog" ? bin : "pullfrog";
 var rawArgs = process.argv.slice(2);
@@ -199323,6 +199924,7 @@ function printMainUsage(stream) {
   stream("  init        install pullfrog on the current repository and open its dashboard");
   stream("  auth        manage provider credentials for the current repository");
   stream("  watch       stream a PR's activity as one JSON line per event");
+  stream("  mcp         run a stdio MCP server exposing PR activity as an agent tool");
   stream("");
   stream("global options:");
   stream("  -h, --help      show help");
@@ -199396,7 +199998,7 @@ async function run3() {
     });
     return;
   }
-  if (command === "watch") {
+  if (command === "mcp") {
     await runCli4({
       args: commandArgs,
       prog: PROG,
@@ -199404,6 +200006,14 @@ async function run3() {
     });
     return;
   }
+  if (command === "watch") {
+    await runCli5({
+      args: commandArgs,
+      prog: PROG,
+      showHelp: globalParsed["--help"] === true
+    });
+    return;
+  }
   if (globalParsed["--help"]) {
     printMainUsage(console.log);
     process.exit(0);
@@ -199431,13 +200041,6 @@ undici/lib/websocket/frame.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 
-content-type/dist/index.js:
-  (*!
-   * content-type
-   * Copyright(c) 2015 Douglas Christopher Wilson
-   * MIT Licensed
-   *)
-
 @mixmark-io/domino/lib/style_parser.js:
   (**
    * @license
@@ -199458,7 +200061,7 @@ ieee754/index.js:
   * MIT Licensed
   *)
 
-mcp-proxy/dist/startStdioServer-BomI-BJR.mjs:
+mcp-proxy/dist/startStdioServer-C4sEMMHS.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson
@@ -199504,6 +200107,13 @@ mcp-proxy/dist/startStdioServer-BomI-BJR.mjs:
   * MIT Licensed
   *)
 
+content-type/dist/index.js:
+  (*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   *)
+
 @octokit/request-error/dist-src/index.js:
   (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *)