stitchkit 0.90.4 → 0.90.6

package/dist/oauth.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Browser-safe OAuth Authorization Code + PKCE mechanics.
+ *
+ * The application owns navigation, token exchange, identity, persistence,
+ * sessions, roles and account policy. This module owns one pending browser
+ * transaction and consumes it exactly once.
+ */
+import type { z } from 'zod';
+export type AuthorizationCodeClientErrorCode = 'INVALID_CONFIGURATION' | 'RESERVED_PARAMETER' | 'INVALID_CONTEXT' | 'STORAGE_FAILURE' | 'MISSING_TRANSACTION' | 'MALFORMED_TRANSACTION' | 'UNSUPPORTED_TRANSACTION_VERSION' | 'STATE_MISMATCH';
+export declare class AuthorizationCodeClientError extends Error {
+    readonly code: AuthorizationCodeClientErrorCode;
+    constructor(code: AuthorizationCodeClientErrorCode, options?: ErrorOptions);
+}
+export interface AuthorizationCodeStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export interface AuthorizationCodeCrypto {
+    getRandomValues(bytes: Uint8Array): Uint8Array;
+    subtle: Pick<SubtleCrypto, 'digest'>;
+}
+export interface AuthorizationCodeClientConfig<TContext> {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    scopes: readonly string[];
+    storage: AuthorizationCodeStorage;
+    storageKey: string;
+    contextSchema: z.ZodType<TContext>;
+    authorizationParameters?: Readonly<Record<string, string>>;
+    /** Web Crypto seam for deterministic tests. Defaults at call time, never module load. */
+    crypto?: AuthorizationCodeCrypto;
+}
+export interface BeginAuthorizationCodeInput<TContext> {
+    context: TContext;
+}
+export interface BeginAuthorizationCodeResult {
+    authorizationUrl: string;
+}
+export interface ConsumeAuthorizationCodeInput {
+    state: string;
+}
+export interface ConsumedAuthorizationCode<TContext> {
+    codeVerifier: string;
+    nonce: string;
+    redirectUri: string;
+    context: TContext;
+}
+export interface AuthorizationCodeClient<TContext> {
+    begin(input: BeginAuthorizationCodeInput<TContext>): Promise<BeginAuthorizationCodeResult>;
+    consume(input: ConsumeAuthorizationCodeInput): ConsumedAuthorizationCode<TContext>;
+}
+export declare function createAuthorizationCodeClient<TContext>(config: AuthorizationCodeClientConfig<TContext>): AuthorizationCodeClient<TContext>;
+/** Keep a return target on the current origin, or use the caller's trusted fallback. */
+export declare function safeInternalReturnPath(candidate: string | null | undefined, fallback: string): string;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgB7B,MAAM,MAAM,gCAAgC,GACxC,uBAAuB,GACvB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,iCAAiC,GACjC,gBAAgB,CAAC;AAarB,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;IAEhD,YAAY,IAAI,EAAE,gCAAgC,EAAE,OAAO,CAAC,EAAE,YAAY,EAIzE;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,6BAA6B,CAAC,QAAQ;IACrD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,wBAAwB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,uBAAuB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,yFAAyF;IACzF,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B,CAAC,QAAQ;IACnD,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB,CAAC,QAAQ;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB,CAAC,QAAQ;IAC/C,KAAK,CAAC,KAAK,EAAE,2BAA2B,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,EAAE,6BAA6B,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;CACpF;AAmED,wBAAgB,6BAA6B,CAAC,QAAQ,EACpD,MAAM,EAAE,6BAA6B,CAAC,QAAQ,CAAC,GAC9C,uBAAuB,CAAC,QAAQ,CAAC,CAgFnC;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,GACf,MAAM,CAcR"}

package/dist/oauth.js

@@ -0,0 +1,170 @@
+import {
+  deriveCodeChallenge
+} from "./index-hr4tzbwq.js";
+import {
+  bytesToBase64Url
+} from "./index-rxfy4cq7.js";
+
+// src/oauth.ts
+var TRANSACTION_VERSION = 1;
+var RESERVED_PARAMETERS = new Set([
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "scope",
+  "state",
+  "nonce",
+  "code_challenge",
+  "code_challenge_method"
+]);
+var ERROR_MESSAGES = {
+  INVALID_CONFIGURATION: "The OAuth client configuration is invalid.",
+  RESERVED_PARAMETER: "A provider parameter conflicts with the OAuth protocol.",
+  INVALID_CONTEXT: "The OAuth transaction context is invalid.",
+  STORAGE_FAILURE: "The OAuth transaction store is unavailable.",
+  MISSING_TRANSACTION: "The OAuth transaction is missing or was already consumed.",
+  MALFORMED_TRANSACTION: "The OAuth transaction is malformed.",
+  UNSUPPORTED_TRANSACTION_VERSION: "The OAuth transaction version is unsupported.",
+  STATE_MISMATCH: "The OAuth response state does not match the pending transaction."
+};
+
+class AuthorizationCodeClientError extends Error {
+  code;
+  constructor(code, options) {
+    super(ERROR_MESSAGES[code], options);
+    this.name = "AuthorizationCodeClientError";
+    this.code = code;
+  }
+}
+function recordOf(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+}
+function randomToken(crypto) {
+  return bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function runtimeCrypto() {
+  const runtime = globalThis.crypto;
+  if (!runtime?.subtle || typeof runtime.getRandomValues !== "function") {
+    throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+  }
+  return {
+    getRandomValues: (bytes) => runtime.getRandomValues(bytes),
+    subtle: runtime.subtle
+  };
+}
+function parseTransaction(raw, contextSchema) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  }
+  const record = recordOf(decoded);
+  if (!record)
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  if (record.version !== TRANSACTION_VERSION) {
+    throw new AuthorizationCodeClientError("UNSUPPORTED_TRANSACTION_VERSION");
+  }
+  const context = contextSchema.safeParse(record.context);
+  if (!context.success)
+    throw new AuthorizationCodeClientError("INVALID_CONTEXT");
+  if (typeof record.state !== "string" || typeof record.nonce !== "string" || typeof record.codeVerifier !== "string" || typeof record.redirectUri !== "string") {
+    throw new AuthorizationCodeClientError("MALFORMED_TRANSACTION");
+  }
+  return {
+    version: TRANSACTION_VERSION,
+    state: record.state,
+    nonce: record.nonce,
+    codeVerifier: record.codeVerifier,
+    redirectUri: record.redirectUri,
+    context: context.data
+  };
+}
+function createAuthorizationCodeClient(config) {
+  if (!config.authorizationEndpoint || !config.clientId || !config.redirectUri || !config.storageKey || config.scopes.length === 0 || config.scopes.some((scope) => !scope)) {
+    throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+  }
+  for (const parameter of Object.keys(config.authorizationParameters ?? {})) {
+    if (RESERVED_PARAMETERS.has(parameter)) {
+      throw new AuthorizationCodeClientError("RESERVED_PARAMETER");
+    }
+  }
+  return {
+    async begin({ context }) {
+      const parsedContext = config.contextSchema.safeParse(context);
+      if (!parsedContext.success)
+        throw new AuthorizationCodeClientError("INVALID_CONTEXT");
+      const crypto = config.crypto ?? runtimeCrypto();
+      const state = randomToken(crypto);
+      const nonce = randomToken(crypto);
+      const codeVerifier = randomToken(crypto);
+      const codeChallenge = await deriveCodeChallenge(codeVerifier, crypto.subtle);
+      let url;
+      try {
+        url = new URL(config.authorizationEndpoint);
+      } catch {
+        throw new AuthorizationCodeClientError("INVALID_CONFIGURATION");
+      }
+      for (const [name, value] of Object.entries(config.authorizationParameters ?? {})) {
+        url.searchParams.set(name, value);
+      }
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      url.searchParams.set("redirect_uri", config.redirectUri);
+      url.searchParams.set("scope", config.scopes.join(" "));
+      url.searchParams.set("state", state);
+      url.searchParams.set("nonce", nonce);
+      url.searchParams.set("code_challenge", codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      const transaction = {
+        version: TRANSACTION_VERSION,
+        state,
+        nonce,
+        codeVerifier,
+        redirectUri: config.redirectUri,
+        context: parsedContext.data
+      };
+      try {
+        config.storage.setItem(config.storageKey, JSON.stringify(transaction));
+      } catch {
+        throw new AuthorizationCodeClientError("STORAGE_FAILURE");
+      }
+      return { authorizationUrl: url.toString() };
+    },
+    consume({ state }) {
+      let raw;
+      try {
+        raw = config.storage.getItem(config.storageKey);
+        config.storage.removeItem(config.storageKey);
+      } catch {
+        throw new AuthorizationCodeClientError("STORAGE_FAILURE");
+      }
+      if (raw === null)
+        throw new AuthorizationCodeClientError("MISSING_TRANSACTION");
+      const transaction = parseTransaction(raw, config.contextSchema);
+      if (transaction.state !== state)
+        throw new AuthorizationCodeClientError("STATE_MISMATCH");
+      return {
+        codeVerifier: transaction.codeVerifier,
+        nonce: transaction.nonce,
+        redirectUri: transaction.redirectUri,
+        context: transaction.context
+      };
+    }
+  };
+}
+function safeInternalReturnPath(candidate, fallback) {
+  const hasAsciiControl = [...candidate ?? ""].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (!candidate?.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\") || hasAsciiControl) {
+    return fallback;
+  }
+  return candidate;
+}
+export {
+  safeInternalReturnPath,
+  createAuthorizationCodeClient,
+  AuthorizationCodeClientError
+};

package/dist/observability/index.js

@@ -28,9 +28,9 @@ import"../index-f9mb610r.js";
 import {
   recordedErrorMessage
 } from "../index-2hryh65w.js";
-import"../index-kazec06k.js";
+import"../index-nrqg8tks.js";
+import"../index-rxfy4cq7.js";
 import"../index-6k1937bx.js";
-import"../index-scs3f1eg.js";
 import {
   childSpan,
   createTraceContext,
@@ -39,6 +39,7 @@ import {
   resolvePropagationContext,
   resolveTraceContext
 } from "../index-zcgf3gqf.js";
+import"../index-scs3f1eg.js";
 import"../index-kzfs85xp.js";
 import {
   isRecord

package/dist/primitives.js

@@ -1,4 +1,5 @@
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import {
   ManagedFileRefSchema
 } from "./index-6k1937bx.js";

package/dist/remote.js

@@ -1,6 +1,6 @@
 import {
   createClient
-} from "./index-6q3zjwaz.js";
+} from "./index-vy2nxwg8.js";
 import"./index-1txvygak.js";
 import {
   ApiError
@@ -9,12 +9,13 @@ import"./index-2hryh65w.js";
 import {
   mergeMeta,
   resolveRouteParamsSchema
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
+import"./index-zcgf3gqf.js";
 import {
   AppError
 } from "./index-scs3f1eg.js";
-import"./index-zcgf3gqf.js";
 import"./index-kzfs85xp.js";
 import {
   isRecord

package/dist/server/bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/server/bun.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,MAAM,SAAS,CAAC;AAEjB,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC9C,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAExD,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,KAAK,oBAAoB,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1D,KAAK,qBAAqB,GAAG,eAAe,SAAS;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3F,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,eAAe,EACf,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAChF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,gBAAgB,EAAE,mBAAmB;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,iGAAiG;IACjG,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAyD7D,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA+NrE"}
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/server/bun.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,MAAM,SAAS,CAAC;AAEjB,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC9C,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAExD,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,KAAK,oBAAoB,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1D,KAAK,qBAAqB,GAAG,eAAe,SAAS;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3F,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,eAAe,EACf,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAChF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,gBAAgB,EAAE,mBAAmB;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,iGAAiG;IACjG,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAyD7D,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAiOrE"}

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   sseRoute,
   streamingRoute,
   webSocketLane
-} from "../index-db51n3xr.js";
+} from "../index-640tz39q.js";
 import"../index-y91ry9h2.js";
 import {
   withDeadline
@@ -37,7 +37,6 @@ import {
   createAuthHook,
   createBearerResolver,
   defineCookie,
-  deriveCodeChallenge,
   extractToken,
   parseCookieHeader,
   parseCookies,
@@ -45,7 +44,10 @@ import {
   signJwt,
   verifyJwt,
   verifyPkce
-} from "../index-bg8ypxzn.js";
+} from "../index-bva395we.js";
+import {
+  deriveCodeChallenge
+} from "../index-hr4tzbwq.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_CORS_EXPOSE_HEADERS,
@@ -59,7 +61,7 @@ import {
   defineMultipartStream,
   implement,
   implementRegistry
-} from "../index-z78bjcxj.js";
+} from "../index-aj9geeez.js";
 import {
   isWithinDir,
   realPathWithinDir
@@ -85,8 +87,14 @@ import {
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   joinRoutePath,
   parseTrailingWildcard
-} from "../index-kazec06k.js";
+} from "../index-nrqg8tks.js";
+import"../index-rxfy4cq7.js";
 import"../index-6k1937bx.js";
+import"../index-zcgf3gqf.js";
+import {
+  jsonSchemaFields,
+  toJsonSchema
+} from "../index-cby4ar3v.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,
@@ -99,12 +107,7 @@ import {
   rateLimited,
   unauthorized
 } from "../index-scs3f1eg.js";
-import"../index-zcgf3gqf.js";
 import"../index-kzfs85xp.js";
-import {
-  jsonSchemaFields,
-  toJsonSchema
-} from "../index-cby4ar3v.js";
 import {
   isRecord
 } from "../index-77fekveh.js";
@@ -491,7 +494,7 @@ function createServer(config) {
   };
   if (unixPath !== undefined) {
     reclaimStaleUnixSocket(unixPath);
-    const { reusePort, ipv6Only, http3, http1, idleTimeout, ...unixExtra } = bunExtra ?? {};
+    const { reusePort, ipv6Only, http3, http2, http1, idleTimeout, ...unixExtra } = bunExtra ?? {};
     runtime = trackedWebSocket ? Bun.serve({
       ...unixExtra,
       ...development && { development },

package/dist/server/middleware/pkce.d.ts

@@ -1,7 +1,6 @@
+export { deriveCodeChallenge } from '../../internal/pkce.js';
 /** The only PKCE method OAuth 2.1 permits for public clients. */
 export type PkceMethod = 'S256';
-/** Derive the S256 `code_challenge` from a `code_verifier`. */
-export declare function deriveCodeChallenge(verifier: string): Promise<string>;
 /**
  * Verify a `code_verifier` against the stored S256 `code_challenge`. S256 is the
  * only method OAuth 2.1 permits for public clients — `plain` is intentionally

package/dist/server/middleware/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/pkce.ts"],"names":[],"mappings":"AAQA,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,+DAA+D;AAC/D,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItF"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/pkce.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItF"}

package/dist/testing.js

@@ -28,7 +28,7 @@ import {
 import {
   createClient,
   createClients
-} from "./index-6q3zjwaz.js";
+} from "./index-vy2nxwg8.js";
 import {
   RealtimeRequestDisconnectedError,
   RealtimeRequestInvalidAcknowledgementError,
@@ -39,11 +39,10 @@ import"./index-3xwxfj4z.js";
 import"./index-2hryh65w.js";
 import {
   joinRoutePath
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
-import"./index-scs3f1eg.js";
 import"./index-zcgf3gqf.js";
-import"./index-kzfs85xp.js";
 import {
   mcpProjectionCandidate,
   prepareProjectedMcpTools,
@@ -52,6 +51,8 @@ import {
 import {
   toJsonSchema
 } from "./index-cby4ar3v.js";
+import"./index-scs3f1eg.js";
+import"./index-kzfs85xp.js";
 import {
   isRecord
 } from "./index-77fekveh.js";

package/dist/tool-invoker.js

@@ -1,19 +1,20 @@
 import {
   createToolInvoker
-} from "./index-7t0wq6j5.js";
-import"./index-32vjke6q.js";
-import"./index-vcnfwrtr.js";
+} from "./index-tgh3ksfh.js";
+import"./index-1bnkzq95.js";
+import"./index-8pjqv3zh.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
-import"./index-scs3f1eg.js";
 import"./index-zcgf3gqf.js";
 import"./index-7zbps32p.js";
-import"./index-kzfs85xp.js";
 import"./index-fenaekmk.js";
 import"./index-cby4ar3v.js";
+import"./index-scs3f1eg.js";
+import"./index-kzfs85xp.js";
 import"./index-77fekveh.js";
 export {
   createToolInvoker

package/dist/tools/cli-args.d.ts

@@ -35,8 +35,11 @@ export type CliResultView = {
     by?: string;
     top?: number;
 } | {
-    kind: 'table';
-    fields: readonly string[];
+    kind: 'records';
+    sort?: string;
+    ascending?: boolean;
+    top?: number;
+    table?: readonly string[];
 };
 /** CLI-behaviour flags, parsed out of argv before the tool arguments. */
 export interface CliRunOptions {
@@ -68,6 +71,8 @@ export interface CliArgvRoute {
     commandArgv: string[];
     topLevelHelp: boolean;
     version: boolean;
+    /** `--help <substring>` — narrow the command list instead of printing it whole. */
+    helpFilter?: string;
     error?: string;
 }
 type FieldKind = 'boolean' | 'number' | 'bigint' | 'date' | 'string' | 'enum' | 'array' | 'object' | 'other';
@@ -77,12 +82,6 @@ interface FieldInfo {
     elementKind?: FieldKind;
 }
 export declare const RESERVED_CLI_OPTIONS: Set<string>;
-/**
- * Select a command without duplicating the framework-global option grammar.
- * With no default configured this returns the historical first-token routing
- * byte-for-byte. With a default, recognised leading globals may precede an
- * explicit command; a remaining option token belongs to the default command.
- */
 export declare function routeCliArgv(argv: string[], defaultCommand?: string): CliArgvRoute;
 export declare class CliArgumentError extends Error {
     name: string;
@@ -94,6 +93,9 @@ export declare class CliArgumentError extends Error {
  * scalar schema yields an empty map and every value is left as a string.
  */
 export declare function describeSchemaFields(schema: z.ZodType | undefined): Map<string, FieldInfo>;
+/** Strict boolean for a RESERVED option — an unrecognised value is a usage error, never a silent `true`. */
+/** True for a value the reserved-boolean grammar already claims. */
+export declare function isReservedBoolWord(value: string): boolean;
 /**
  * Parse a command's argv slice (everything after the command name) against its
  * merged tool schema.

package/dist/tools/cli-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../../src/tools/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,SAAS,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,UAAU,SAAS;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB;AAQD,eAAO,MAAM,oBAAoB,aAA+C,CAAC;AA0BjF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,YAAY,CAsFlF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,SAAsB;CACpC;AAuED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AA8FD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAsOf;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,GAC9B,qBAAqB,CA8CvB"}
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../../src/tools/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEN,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,SAAS,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,UAAU,SAAS;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB;AAQD,eAAO,MAAM,oBAAoB,aAA+C,CAAC;AAuDjF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,YAAY,CA6GlF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,SAAsB;CACpC;AAuED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AA0FD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAwOf;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,GAC9B,qBAAqB,CA8CvB"}

package/dist/tools/cli-installer.d.ts

@@ -10,8 +10,13 @@
 import type { CliBuildAsset, CliBuildManifest } from './cli-manifest.js';
 export interface CliInstallerConfig {
     manifest: CliBuildManifest;
-    /** The asset this script installs — one script per target. */
-    asset: CliBuildAsset;
+    /**
+     * The asset this script installs. Omit it to render one script covering every
+     * asset in the manifest, selected by `uname` at run time — otherwise the
+     * dispatch is the one hand-written piece left in the install path, and every
+     * publisher writes the same `uname -s`/`uname -m` mapping from memory.
+     */
+    asset?: CliBuildAsset;
     /** The name the binary takes on the PATH; defaults to the manifest name. */
     binaryName?: string;
     /** Default install directory; overridable by `INSTALL_DIR` at run time. */

package/dist/tools/cli-installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-installer.d.ts","sourceRoot":"","sources":["../../src/tools/cli-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAuErE"}
+{"version":3,"file":"cli-installer.d.ts","sourceRoot":"","sources":["../../src/tools/cli-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA+ErE"}

package/dist/tools/cli-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-view.d.ts","sourceRoot":"","sources":["../../src/tools/cli-view.ts"],"names":[],"mappings":"AAeA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAuH7F,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,CA+B/E"}
+{"version":3,"file":"cli-view.d.ts","sourceRoot":"","sources":["../../src/tools/cli-view.ts"],"names":[],"mappings":"AAeA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAwK7F,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,CA+B/E"}

package/dist/tools/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAShE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AAsXD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EACtC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8c7D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUhE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AA2ZD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EACtC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAme7D"}

package/dist/tools/connections/index.js

@@ -6,6 +6,12 @@ import {
   withDefsDialect
 } from "../../index-fenaekmk.js";
 import"../../index-cby4ar3v.js";
+import {
+  AppError
+} from "../../index-scs3f1eg.js";
+import {
+  safeJsonParse
+} from "../../index-kzfs85xp.js";
 import {
   isRecord
 } from "../../index-77fekveh.js";
@@ -514,6 +520,34 @@ class McpHttpClient {
   }
 }
 
+// src/tools/connections/mcp-envelope.ts
+function unwrapMcpResult(result) {
+  if (!isRecord(result))
+    return result;
+  if (result.structuredContent !== undefined)
+    return result.structuredContent;
+  if (!Array.isArray(result.content))
+    return result;
+  const only = result.content.length === 1 ? result.content[0] : undefined;
+  if (!isRecord(only) || only.type !== "text" || typeof only.text !== "string")
+    return result;
+  try {
+    return safeJsonParse(only.text);
+  } catch {
+    return only.text;
+  }
+}
+var UPSTREAM_TOOL_ERROR = "UPSTREAM_TOOL_ERROR";
+function mcpToolFailure(toolName, result) {
+  const payload = unwrapMcpResult(result);
+  if (isRecord(payload) && typeof payload.error === "string") {
+    const details = isRecord(payload.details) ? payload.details : undefined;
+    const message = typeof details?.message === "string" ? details.message : payload.error;
+    return new AppError(payload.error, message, 502, details);
+  }
+  return new AppError(UPSTREAM_TOOL_ERROR, `External MCP tool "${toolName}" returned an error`, 502, payload === undefined ? undefined : { upstream: payload });
+}
+
 // src/tools/connections/runtime.ts
 import { z } from "zod";
 async function withConnectionToken(params, body) {
@@ -608,10 +642,9 @@ async function mountMcpConnection(connection, instanceId, onSkipped) {
         return withConnectionToken({ instanceId, provider: connection.token, client, context }, async (token) => {
           await client.initialize(token, context.signal);
           const result = await client.request("tools/call", { name, arguments: context.input }, token, context.signal);
-          if (isRecord(result) && result.isError === true) {
-            throw new Error(`External MCP tool "${name}" returned an error`);
-          }
-          return result;
+          if (isRecord(result) && result.isError === true)
+            throw mcpToolFailure(name, result);
+          return context.source === "cli" ? unwrapMcpResult(result) : result;
         }).finally(() => client.teardown());
       }
     });

package/dist/tools/connections/mcp-envelope.d.ts

@@ -0,0 +1,44 @@
+/**
+ * What a discovered MCP tool's answer is, per transport.
+ *
+ * `tools/call` returns an envelope — `{ content: [...], structuredContent? }` —
+ * and an agent mount needs exactly that: the parts are what a model is shown.
+ * The CLI transport is different in kind, because the handler's value is what
+ * gets printed, piped and aggregated. Handed the envelope, `--count-by status`
+ * groups the *parts* and answers `no record carries the field "status" —
+ * available: text, type`, and `--json` emits the answer as a JSON string nested
+ * inside `content[0].text`, so every consumer unwraps before anything works.
+ *
+ * So the CLI unwraps, and only the CLI. The order is the server's own order of
+ * preference: `structuredContent` is the answer when the server sent one; a lone
+ * text part is the answer when it parses as JSON, and its text when it does not.
+ * Anything else — several parts, an image, audio — is passed through whole,
+ * because picking one part out of many would be inventing an answer.
+ */
+import { AppError } from '../../contract/errors.js';
+export declare function unwrapMcpResult(result: unknown): unknown;
+/**
+ * The class a relayed failure carries when the server sent no structured body.
+ *
+ * Not `INTERNAL_SERVER_ERROR`: nothing of ours broke. The honest statement is
+ * that the call failed upstream and we cannot say more than the server did.
+ */
+export declare const UPSTREAM_TOOL_ERROR = "UPSTREAM_TOOL_ERROR";
+/**
+ * Turn a failed `CallToolResult` into the error the caller can act on.
+ *
+ * The line this replaces threw a one-sentence `Error` and discarded the result,
+ * which cost three things at once: the code (so `exitCodes` had nothing to map
+ * and every remote failure exited `1`), the message the operator needed, and the
+ * error's own class — a plain `Error` is an *unexpected* error to the runner, so
+ * it printed a code frame of the framework bundle before the JSON failure and
+ * was then scrubbed to a bare `INTERNAL_SERVER_ERROR`.
+ *
+ * A structured `{ error, details }` body is the remote contract's own refusal
+ * and is relayed as one. Anything else keeps the framework's sentence and
+ * carries what the server did send — reporting less than we have is not caution.
+ * The status is 502 either way: whatever the code says, the failure happened
+ * upstream, and a consumer re-serving it over HTTP should say so.
+ */
+export declare function mcpToolFailure(toolName: string, result: unknown): AppError;
+//# sourceMappingURL=mcp-envelope.d.ts.map