uigraph 1.0.0 → 1.0.1

package/dist/runtime-DTkBxiaM.mjs

@@ -1,2822 +0,0 @@
-import { a as __toESM } from "./bin.mjs";
-import { t as require_cross_spawn } from "./cross-spawn-B2jIQPlu.mjs";
-import { d as getAgentDir, s as VERSION, t as APP_NAME } from "./config-D8DMGzIq.mjs";
-import { d as resolveHeadersOrThrow, n as FileAuthStorageBackend, u as resolveConfigValueOrThrow, x as require_proper_lockfile, y as mcpNamespace } from "./auth-storage-BvNH97p9.mjs";
-import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, renameSync, statSync } from "node:fs";
-import fE from "node:process";
-import { basename, dirname, join, resolve } from "node:path";
-import { homedir } from "node:os";
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { pathToFileURL } from "node:url";
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/protocol/jsonrpc.js
-const JSON_RPC_ERROR_CODES = {
-	parseError: -32700,
-	invalidRequest: -32600,
-	methodNotFound: -32601,
-	invalidParams: -32602,
-	internalError: -32603
-};
-var McpError = class extends Error {
-	code;
-	data;
-	constructor(code, message, data) {
-		super(message);
-		this.name = "McpError";
-		this.code = code;
-		this.data = data;
-	}
-};
-var McpConnectionClosedError = class extends Error {
-	constructor(message = "MCP connection closed") {
-		super(message);
-		this.name = "McpConnectionClosedError";
-	}
-};
-var McpTimeoutError = class extends Error {
-	timeoutMs;
-	constructor(timeoutMs) {
-		super(`MCP request timed out after ${timeoutMs}ms`);
-		this.name = "McpTimeoutError";
-		this.timeoutMs = timeoutMs;
-	}
-};
-var McpAbortError = class extends Error {
-	constructor(message = "MCP request aborted") {
-		super(message);
-		this.name = "AbortError";
-	}
-};
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function toError(value) {
-	return value instanceof Error ? value : new Error(String(value));
-}
-function isJsonRpcId(value) {
-	return typeof value === "string" || typeof value === "number" && Number.isFinite(value);
-}
-function isJsonRpcRequest(message) {
-	return isObject(message) && message.jsonrpc === "2.0" && isJsonRpcId(message.id) && typeof message.method === "string";
-}
-function isJsonRpcNotification(message) {
-	return isObject(message) && message.jsonrpc === "2.0" && !("id" in message) && typeof message.method === "string";
-}
-function isJsonRpcResponse(message) {
-	if (!isObject(message) || message.jsonrpc !== "2.0" || !isJsonRpcId(message.id)) return false;
-	if ("result" in message) return !("error" in message);
-	if (!("error" in message) || !isObject(message.error)) return false;
-	return typeof message.error.code === "number" && typeof message.error.message === "string";
-}
-function parseJsonRpcMessage(value) {
-	if (isJsonRpcRequest(value) || isJsonRpcNotification(value) || isJsonRpcResponse(value)) return value;
-	throw new McpError(JSON_RPC_ERROR_CODES.invalidRequest, "Invalid JSON-RPC message");
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/protocol/types.js
-const LATEST_PROTOCOL_VERSION = "2025-11-25";
-/**
-* Versions the client accepts from a server. Servers that do not support the requested version answer
-* with their own latest one, so older versions stay accepted for servers built on older SDKs.
-*/
-const SUPPORTED_PROTOCOL_VERSIONS = [
-	LATEST_PROTOCOL_VERSION,
-	"2025-06-18",
-	"2025-03-26",
-	"2024-11-05"
-];
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/client.js
-const DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-const MAX_LIST_PAGES = 1e3;
-function validateInitializeResult(value) {
-	if (!isObject(value) || typeof value.protocolVersion !== "string" || !isObject(value.capabilities) || !isObject(value.serverInfo) || typeof value.serverInfo.name !== "string" || typeof value.serverInfo.version !== "string" || value.instructions !== void 0 && typeof value.instructions !== "string") throw new McpError(JSON_RPC_ERROR_CODES.invalidRequest, "Invalid MCP initialize result");
-	return value;
-}
-function invalid(message) {
-	return new McpError(JSON_RPC_ERROR_CODES.invalidRequest, message);
-}
-/** One page of a paginated list: the items under `key`, each checked by `isItem`. */
-function validateListPage(method, key, value, isItem) {
-	const items = isObject(value) ? value[key] : void 0;
-	if (!isObject(value) || !Array.isArray(items)) throw invalid(`Invalid MCP ${method} result`);
-	for (const item of items) if (!isObject(item) || !isItem(item)) throw invalid(`Invalid entry in MCP ${method} result`);
-	const nextCursor = value.nextCursor === null || value.nextCursor === "" ? void 0 : value.nextCursor;
-	if (nextCursor !== void 0 && typeof nextCursor !== "string") throw invalid(`Invalid MCP ${method} cursor`);
-	return {
-		items,
-		...nextCursor === void 0 ? {} : { nextCursor }
-	};
-}
-const isTool = (tool) => typeof tool.name === "string" && isObject(tool.inputSchema);
-const isResource = (resource) => typeof resource.uri === "string" && (resource.name === void 0 || typeof resource.name === "string");
-const isResourceTemplate = (template) => typeof template.uriTemplate === "string" && (template.name === void 0 || typeof template.name === "string");
-function toResource(item) {
-	return {
-		...item,
-		name: item.name ?? item.uri
-	};
-}
-function toResourceTemplate(item) {
-	return {
-		...item,
-		name: item.name ?? item.uriTemplate
-	};
-}
-function pageCursor(page) {
-	return page.nextCursor === void 0 ? {} : { nextCursor: page.nextCursor };
-}
-function validateReadResourceResult(value) {
-	if (!isObject(value) || !Array.isArray(value.contents)) throw invalid("Invalid MCP resources/read result");
-	for (const contents of value.contents) if (!isObject(contents) || typeof contents.uri !== "string" || typeof contents.text !== "string" && typeof contents.blob !== "string") throw invalid("Invalid contents in MCP resources/read result");
-	return value;
-}
-/**
-* `content` is required by the spec, but servers that only return `structuredContent` omit it (the SDK defaults it too).
-* `structuredContent` may be any JSON value, as MCP 2026-07-28 allows.
-*/
-function validateCallToolResult(value) {
-	if (!isObject(value) || value.content !== void 0 && !Array.isArray(value.content)) throw new McpError(JSON_RPC_ERROR_CODES.invalidRequest, "Invalid MCP tools/call result");
-	return value.content === void 0 ? {
-		...value,
-		content: []
-	} : value;
-}
-var McpClient = class {
-	options;
-	state = "idle";
-	transport;
-	nextRequestId = 1;
-	serverInfoValue;
-	serverCapabilitiesValue;
-	instructionsValue;
-	protocolVersionValue;
-	pending = /* @__PURE__ */ new Map();
-	progressRequests = /* @__PURE__ */ new Map();
-	incoming = /* @__PURE__ */ new Map();
-	requestHandlers = /* @__PURE__ */ new Map();
-	notificationListeners = /* @__PURE__ */ new Map();
-	errorListeners = /* @__PURE__ */ new Set();
-	closeListeners = /* @__PURE__ */ new Set();
-	disposers = [];
-	constructor(options) {
-		this.options = Object.freeze({ ...options });
-		this.requestHandlers.set("ping", () => ({}));
-		const roots = options.roots;
-		if (roots) this.requestHandlers.set("roots/list", async () => ({ roots: [...typeof roots === "function" ? await roots() : roots] }));
-	}
-	get connectionState() {
-		return this.state;
-	}
-	get serverInfo() {
-		return this.serverInfoValue;
-	}
-	get serverCapabilities() {
-		return this.serverCapabilitiesValue;
-	}
-	get instructions() {
-		return this.instructionsValue;
-	}
-	get protocolVersion() {
-		return this.protocolVersionValue;
-	}
-	async connect(transport) {
-		if (this.state !== "idle") throw new Error(`Cannot connect MCP client in ${this.state} state`);
-		this.state = "connecting";
-		this.transport = transport;
-		this.disposers = [
-			transport.onMessage((message) => this.handleMessage(message)),
-			transport.onError((error) => this.emitError(error)),
-			transport.onClose(() => this.handleTransportClose())
-		];
-		try {
-			await transport.start();
-			const capabilities = { ...this.options.capabilities };
-			if (this.options.roots && capabilities.roots === void 0) capabilities.roots = {};
-			const result = validateInitializeResult(await this.requestInternal("initialize", {
-				protocolVersion: this.options.protocolVersion ?? "2025-11-25",
-				capabilities,
-				clientInfo: {
-					name: this.options.name,
-					version: this.options.version,
-					...this.options.title === void 0 ? {} : { title: this.options.title }
-				}
-			}, {}, true));
-			if (!SUPPORTED_PROTOCOL_VERSIONS.includes(result.protocolVersion)) throw new Error(`MCP server selected unsupported protocol version ${result.protocolVersion}`);
-			this.protocolVersionValue = result.protocolVersion;
-			this.serverInfoValue = result.serverInfo;
-			this.serverCapabilitiesValue = result.capabilities;
-			this.instructionsValue = result.instructions;
-			transport.setProtocolVersion?.(result.protocolVersion);
-			await this.notifyInternal("notifications/initialized", void 0, true);
-			this.state = "connected";
-			return result;
-		} catch (error) {
-			await this.close().catch(() => {});
-			throw error;
-		}
-	}
-	request(method, params, options = {}) {
-		return this.requestInternal(method, params, options, false);
-	}
-	notify(method, params) {
-		return this.notifyInternal(method, params, false);
-	}
-	setRequestHandler(method, handler) {
-		this.requestHandlers.set(method, handler);
-		return () => {
-			if (this.requestHandlers.get(method) === handler) this.requestHandlers.delete(method);
-		};
-	}
-	onNotification(method, listener) {
-		const listeners = this.notificationListeners.get(method) ?? /* @__PURE__ */ new Set();
-		this.notificationListeners.set(method, listeners);
-		listeners.add(listener);
-		return () => {
-			listeners.delete(listener);
-			if (listeners.size === 0) this.notificationListeners.delete(method);
-		};
-	}
-	onError(listener) {
-		this.errorListeners.add(listener);
-		return () => this.errorListeners.delete(listener);
-	}
-	/** Called once when the connection closes, whether the transport dropped or `close()` was called. */
-	onClose(listener) {
-		this.closeListeners.add(listener);
-		return () => this.closeListeners.delete(listener);
-	}
-	async ping(options = {}) {
-		await this.request("ping", void 0, options);
-	}
-	async listTools(options = {}) {
-		return await this.listAll("tools/list", "tools", isTool, options);
-	}
-	/** Every resource, following `nextCursor` through all pages. */
-	async listResources(options = {}) {
-		return (await this.listAll("resources/list", "resources", isResource, options)).map(toResource);
-	}
-	/** One page of resources, starting at `cursor`. */
-	async listResourcesPage(cursor, options = {}) {
-		const page = await this.listPage("resources/list", "resources", isResource, cursor, options);
-		return {
-			resources: page.items.map(toResource),
-			...pageCursor(page)
-		};
-	}
-	/** Every resource template, following `nextCursor` through all pages. */
-	async listResourceTemplates(options = {}) {
-		return (await this.listAll("resources/templates/list", "resourceTemplates", isResourceTemplate, options)).map(toResourceTemplate);
-	}
-	/** One page of resource templates, starting at `cursor`. */
-	async listResourceTemplatesPage(cursor, options = {}) {
-		const page = await this.listPage("resources/templates/list", "resourceTemplates", isResourceTemplate, cursor, options);
-		return {
-			resourceTemplates: page.items.map(toResourceTemplate),
-			...pageCursor(page)
-		};
-	}
-	async readResource(uri, options = {}) {
-		return validateReadResourceResult(await this.request("resources/read", { uri }, options));
-	}
-	async listPage(method, key, isItem, cursor, options) {
-		return validateListPage(method, key, await this.request(method, cursor === void 0 ? void 0 : { cursor }, options), isItem);
-	}
-	/** Every item of a paginated list method. */
-	async listAll(method, key, isItem, options) {
-		const items = [];
-		const cursors = /* @__PURE__ */ new Set();
-		let cursor;
-		for (let pageNumber = 0; pageNumber < MAX_LIST_PAGES; pageNumber++) {
-			const page = await this.listPage(method, key, isItem, cursor, options);
-			items.push(...page.items);
-			if (page.nextCursor === void 0) return items;
-			if (cursors.has(page.nextCursor)) throw new Error(`MCP ${method} returned duplicate cursor: ${page.nextCursor}`);
-			cursors.add(page.nextCursor);
-			cursor = page.nextCursor;
-		}
-		throw new Error(`MCP ${method} exceeded ${MAX_LIST_PAGES} pages`);
-	}
-	async callTool(name, args, options = {}) {
-		return validateCallToolResult(await this.request("tools/call", {
-			name,
-			...args === void 0 ? {} : { arguments: args }
-		}, options));
-	}
-	async close() {
-		const transport = this.transport;
-		this.transport = void 0;
-		this.disposeTransportListeners();
-		this.markClosed(new McpConnectionClosedError());
-		await transport?.close();
-	}
-	async requestInternal(method, params, options, allowConnecting) {
-		const transport = this.requireTransport(allowConnecting);
-		if (options.signal?.aborted) throw new McpAbortError();
-		const id = this.nextRequestId++;
-		const progressToken = options.onProgress ? id : void 0;
-		const requestParams = progressToken === void 0 ? params : {
-			...params,
-			_meta: {
-				...isObject(params?._meta) ? params._meta : {},
-				progressToken
-			}
-		};
-		const message = {
-			jsonrpc: "2.0",
-			id,
-			method,
-			...requestParams === void 0 ? {} : { params: requestParams }
-		};
-		return new Promise((resolve, reject) => {
-			const entry = {
-				resolve,
-				reject,
-				timeoutMs: options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
-				timer: void 0,
-				signal: options.signal,
-				onAbort: () => this.cancelPending(id, new McpAbortError(), method !== "initialize", String(options.signal?.reason ?? "Aborted")),
-				sendController: new AbortController(),
-				cancellable: method !== "initialize",
-				onProgress: options.onProgress,
-				progressToken
-			};
-			this.pending.set(id, entry);
-			if (progressToken !== void 0) this.progressRequests.set(progressToken, id);
-			options.signal?.addEventListener("abort", entry.onAbort, { once: true });
-			this.armTimeout(id, entry);
-			transport.send(message, { signal: entry.sendController.signal }).catch((error) => this.cancelPending(id, error, false));
-		});
-	}
-	async notifyInternal(method, params, allowConnecting) {
-		await this.requireTransport(allowConnecting).send({
-			jsonrpc: "2.0",
-			method,
-			...params === void 0 ? {} : { params }
-		});
-	}
-	requireTransport(allowConnecting) {
-		if (this.transport && (this.state === "connected" || allowConnecting && this.state === "connecting")) return this.transport;
-		throw new McpConnectionClosedError(`MCP client is ${this.state}`);
-	}
-	handleMessage(message) {
-		if (isJsonRpcResponse(message)) {
-			this.handleResponse(message);
-			return;
-		}
-		if (isJsonRpcRequest(message)) {
-			this.handleRequest(message);
-			return;
-		}
-		if (isJsonRpcNotification(message)) {
-			this.handleNotification(message.method, message.params);
-			return;
-		}
-		this.emitError(new McpError(JSON_RPC_ERROR_CODES.invalidRequest, "Received invalid JSON-RPC message"));
-	}
-	handleResponse(message) {
-		const entry = this.pending.get(message.id);
-		if (!entry) {
-			this.emitError(/* @__PURE__ */ new Error(`Received response for unknown MCP request ${String(message.id)}`));
-			return;
-		}
-		this.removePending(message.id, entry);
-		if ("error" in message) entry.reject(new McpError(message.error.code, message.error.message, message.error.data));
-		else entry.resolve(message.result);
-	}
-	async handleRequest(message) {
-		const transport = this.transport;
-		if (!transport) return;
-		const handler = this.requestHandlers.get(message.method);
-		if (!handler) {
-			await transport.send({
-				jsonrpc: "2.0",
-				id: message.id,
-				error: {
-					code: JSON_RPC_ERROR_CODES.methodNotFound,
-					message: `Method not found: ${message.method}`
-				}
-			}).catch((error) => this.emitError(error));
-			return;
-		}
-		const controller = new AbortController();
-		this.incoming.set(message.id, controller);
-		try {
-			const result = await handler(message.params, { signal: controller.signal });
-			await transport.send({
-				jsonrpc: "2.0",
-				id: message.id,
-				result: result ?? {}
-			});
-		} catch (error) {
-			const responseError = error instanceof McpError ? {
-				code: error.code,
-				message: error.message,
-				data: error.data
-			} : {
-				code: JSON_RPC_ERROR_CODES.internalError,
-				message: toError(error).message
-			};
-			await transport.send({
-				jsonrpc: "2.0",
-				id: message.id,
-				error: responseError
-			}).catch((sendError) => this.emitError(sendError));
-		} finally {
-			this.incoming.delete(message.id);
-		}
-	}
-	handleNotification(method, params) {
-		if (method === "notifications/progress") this.handleProgress(params);
-		else if (method === "notifications/cancelled") this.handleCancelled(params);
-		for (const listener of this.notificationListeners.get(method) ?? []) try {
-			listener(params);
-		} catch (error) {
-			this.emitError(error);
-		}
-	}
-	handleProgress(params) {
-		if (!isObject(params) || !isJsonRpcId(params.progressToken) || typeof params.progress !== "number") return;
-		const requestId = this.progressRequests.get(params.progressToken);
-		const entry = requestId === void 0 ? void 0 : this.pending.get(requestId);
-		if (requestId === void 0 || !entry) return;
-		this.armTimeout(requestId, entry);
-		try {
-			entry.onProgress?.(params);
-		} catch (error) {
-			this.emitError(error);
-		}
-	}
-	handleCancelled(params) {
-		if (isObject(params) && isJsonRpcId(params.requestId)) this.incoming.get(params.requestId)?.abort(params.reason);
-	}
-	armTimeout(id, entry) {
-		if (entry.timer) clearTimeout(entry.timer);
-		if (!Number.isFinite(entry.timeoutMs) || entry.timeoutMs <= 0) return;
-		entry.timer = setTimeout(() => {
-			this.cancelPending(id, new McpTimeoutError(entry.timeoutMs), entry.cancellable, "Request timed out");
-		}, entry.timeoutMs);
-	}
-	cancelPending(id, error, notifyServer, reason) {
-		const entry = this.pending.get(id);
-		if (!entry) return;
-		this.removePending(id, entry);
-		entry.reject(error);
-		if (notifyServer && this.transport) this.transport.send({
-			jsonrpc: "2.0",
-			method: "notifications/cancelled",
-			params: {
-				requestId: id,
-				...reason ? { reason } : {}
-			}
-		}).catch((sendError) => this.emitError(sendError));
-	}
-	removePending(id, entry) {
-		this.pending.delete(id);
-		if (entry.timer) clearTimeout(entry.timer);
-		if (entry.progressToken !== void 0) this.progressRequests.delete(entry.progressToken);
-		entry.signal?.removeEventListener("abort", entry.onAbort);
-		entry.sendController.abort();
-	}
-	rejectPending(error) {
-		for (const [id, entry] of this.pending) {
-			this.removePending(id, entry);
-			entry.reject(error);
-		}
-	}
-	handleTransportClose() {
-		this.markClosed(new McpConnectionClosedError());
-	}
-	/** Idempotent: rejects in-flight requests, aborts server requests we are serving, and flips the state. */
-	markClosed(error) {
-		const wasClosed = this.state === "closed";
-		this.state = "closed";
-		this.rejectPending(error);
-		for (const controller of this.incoming.values()) controller.abort(error);
-		this.incoming.clear();
-		if (wasClosed) return;
-		for (const listener of [...this.closeListeners]) try {
-			listener();
-		} catch (listenerError) {
-			this.emitError(listenerError);
-		}
-	}
-	emitError(error) {
-		const normalized = toError(error);
-		for (const listener of this.errorListeners) listener(normalized);
-	}
-	disposeTransportListeners() {
-		for (const dispose of this.disposers.splice(0)) dispose();
-	}
-};
-/** Listener bookkeeping shared by transports. `emitClose` fires at most once per transport. */
-var TransportEvents = class {
-	messageListeners = /* @__PURE__ */ new Set();
-	errorListeners = /* @__PURE__ */ new Set();
-	closeListeners = /* @__PURE__ */ new Set();
-	closeEmitted = false;
-	onMessage(listener) {
-		this.messageListeners.add(listener);
-		return () => this.messageListeners.delete(listener);
-	}
-	onError(listener) {
-		this.errorListeners.add(listener);
-		return () => this.errorListeners.delete(listener);
-	}
-	onClose(listener) {
-		this.closeListeners.add(listener);
-		return () => this.closeListeners.delete(listener);
-	}
-	emitMessage(message) {
-		for (const listener of this.messageListeners) listener(message);
-	}
-	emitError(error) {
-		const normalized = toError(error);
-		for (const listener of this.errorListeners) listener(normalized);
-	}
-	emitClose() {
-		if (this.closeEmitted) return;
-		this.closeEmitted = true;
-		for (const listener of this.closeListeners) listener();
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/transports/stdio.js
-var import_cross_spawn = /* @__PURE__ */ __toESM(require_cross_spawn(), 1);
-const DEFAULT_MAX_STDERR_BYTES = 65536;
-const DEFAULT_CLOSE_TIMEOUT_MS = 2e3;
-/** How long a server gets to exit on its own after stdin closes, before it is sent SIGTERM. */
-const STDIN_CLOSE_GRACE_MS = 500;
-const USE_PROCESS_GROUPS = fE.platform !== "win32";
-/** Process groups of running servers, killed if the host exits without closing them. */
-const liveProcessGroups = /* @__PURE__ */ new Set();
-let exitHookInstalled = false;
-function killProcessTree(child, signal) {
-	const pid = child.pid;
-	if (fE.platform === "win32" && pid !== void 0) {
-		if (child.exitCode !== null) return;
-		spawn("taskkill", [
-			"/pid",
-			String(pid),
-			"/T",
-			"/F"
-		], {
-			stdio: "ignore",
-			windowsHide: true
-		}).on("error", () => {});
-		return;
-	}
-	if (USE_PROCESS_GROUPS && pid !== void 0) try {
-		fE.kill(-pid, signal);
-		return;
-	} catch {}
-	try {
-		child.kill(signal);
-	} catch {}
-}
-function installExitHook() {
-	if (exitHookInstalled) return;
-	exitHookInstalled = true;
-	fE.once("exit", () => {
-		for (const pid of liveProcessGroups) try {
-			fE.kill(-pid, "SIGTERM");
-		} catch {}
-	});
-}
-var StdioTransport = class extends TransportEvents {
-	options;
-	child;
-	stdoutBuffer = Buffer.alloc(0);
-	stderrBuffer = Buffer.alloc(0);
-	started = false;
-	closed = false;
-	constructor(options) {
-		super();
-		this.options = Object.freeze({
-			...options,
-			args: options.args ? [...options.args] : void 0
-		});
-	}
-	get pid() {
-		return this.child?.pid;
-	}
-	get stderr() {
-		return this.stderrBuffer.toString("utf8");
-	}
-	async start() {
-		if (this.started) throw new Error("MCP stdio transport already started");
-		if (this.closed) throw new McpConnectionClosedError();
-		this.started = true;
-		const env = this.options.inheritEnv === false ? { ...this.options.env } : {
-			...fE.env,
-			...this.options.env
-		};
-		const child = (0, import_cross_spawn.default)(this.options.command, this.options.args ?? [], {
-			cwd: this.options.cwd,
-			env,
-			stdio: [
-				"pipe",
-				"pipe",
-				this.options.stderr === "inherit" ? "inherit" : "pipe"
-			],
-			windowsHide: true,
-			detached: USE_PROCESS_GROUPS
-		});
-		this.child = child;
-		const pid = child.pid;
-		if (USE_PROCESS_GROUPS && pid !== void 0) {
-			installExitHook();
-			liveProcessGroups.add(pid);
-			child.once("exit", () => liveProcessGroups.delete(pid));
-		}
-		child.stdout?.on("data", (chunk) => this.handleStdout(chunk));
-		child.stdout?.on("error", (error) => this.emitError(error));
-		child.stdin?.on("error", (error) => {
-			if (!this.closed) this.emitError(error);
-		});
-		child.stderr?.on("data", (chunk) => this.handleStderr(chunk));
-		child.stderr?.on("error", (error) => this.emitError(error));
-		child.on("close", () => {
-			this.child = void 0;
-			if (this.stdoutBuffer.toString("utf8").trim()) this.emitError(/* @__PURE__ */ new Error("MCP stdio server closed with an incomplete JSON-RPC message"));
-			this.stdoutBuffer = Buffer.alloc(0);
-			this.emitClose();
-		});
-		await new Promise((resolve, reject) => {
-			const onSpawn = () => {
-				child.off("error", onError);
-				resolve();
-			};
-			const onError = (error) => {
-				child.off("spawn", onSpawn);
-				reject(error);
-			};
-			child.once("spawn", onSpawn);
-			child.once("error", onError);
-		});
-		child.on("error", (error) => {
-			if (!this.closed) this.emitError(error);
-		});
-	}
-	async send(message) {
-		const stdin = this.child?.stdin;
-		if (!this.started || this.closed || !stdin?.writable) throw new McpConnectionClosedError();
-		const payload = `${JSON.stringify(message)}\n`;
-		await new Promise((resolve, reject) => {
-			stdin.write(payload, (error) => error ? reject(error) : resolve());
-		});
-	}
-	async close() {
-		if (this.closed) return;
-		this.closed = true;
-		const child = this.child;
-		if (!child) {
-			this.emitClose();
-			return;
-		}
-		if (child.exitCode !== null || child.signalCode !== null) {
-			child.stdin?.end();
-			return;
-		}
-		const closeTimeoutMs = this.options.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
-		await new Promise((resolve) => {
-			const timers = [];
-			child.once("close", () => {
-				for (const timer of timers) clearTimeout(timer);
-				killProcessTree(child, "SIGTERM");
-				resolve();
-			});
-			const grace = Math.min(STDIN_CLOSE_GRACE_MS, closeTimeoutMs);
-			timers.push(setTimeout(() => killProcessTree(child, "SIGTERM"), grace));
-			timers.push(setTimeout(() => killProcessTree(child, "SIGKILL"), grace + closeTimeoutMs));
-			child.stdin?.end();
-		});
-	}
-	handleStdout(chunk) {
-		this.stdoutBuffer = Buffer.concat([this.stdoutBuffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
-		const maxMessageBytes = this.options.maxMessageBytes ?? 16777216;
-		while (true) {
-			const newline = this.stdoutBuffer.indexOf(10);
-			if (newline < 0) {
-				if (this.stdoutBuffer.length > maxMessageBytes) {
-					this.stdoutBuffer = Buffer.alloc(0);
-					this.emitError(/* @__PURE__ */ new Error(`MCP stdio message exceeds ${maxMessageBytes} bytes`));
-				}
-				return;
-			}
-			const line = this.stdoutBuffer.subarray(0, newline);
-			this.stdoutBuffer = this.stdoutBuffer.subarray(newline + 1);
-			if (line.length > maxMessageBytes) {
-				this.emitError(/* @__PURE__ */ new Error(`MCP stdio message exceeds ${maxMessageBytes} bytes`));
-				continue;
-			}
-			const text = line.toString("utf8").replace(/\r$/, "");
-			if (!text.trim()) continue;
-			try {
-				this.emitMessage(parseJsonRpcMessage(JSON.parse(text)));
-			} catch (error) {
-				this.emitError(error);
-			}
-		}
-	}
-	handleStderr(chunk) {
-		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-		const maxStderrBytes = this.options.maxStderrBytes ?? DEFAULT_MAX_STDERR_BYTES;
-		this.stderrBuffer = Buffer.concat([this.stderrBuffer, buffer]);
-		if (this.stderrBuffer.length > maxStderrBytes) this.stderrBuffer = this.stderrBuffer.subarray(-maxStderrBytes);
-		this.options.onStderr?.(buffer.toString("utf8"));
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/transports/streamable-http.js
-const MAX_ERROR_BODY_BYTES = 8192;
-const ERROR_MESSAGE_BODY_CHARS = 500;
-const DEFAULT_RECONNECT_INITIAL_DELAY_MS = 1e3;
-const DEFAULT_RECONNECT_MAX_DELAY_MS = 3e4;
-const DEFAULT_RECONNECT_MAX_RETRIES = 5;
-async function consumeSseStream(stream, options) {
-	const reader = stream.getReader();
-	const decoder = new TextDecoder();
-	let buffered = "";
-	let eventName;
-	let eventId;
-	let dataLines = [];
-	let dataBytes = 0;
-	const maxEventBytes = options.maxEventBytes ?? 16777216;
-	const dispatch = () => {
-		if (dataLines.length === 0) {
-			eventName = void 0;
-			eventId = void 0;
-			return;
-		}
-		const data = dataLines.join("\n");
-		options.onEvent({
-			...eventName ? { event: eventName } : {},
-			data,
-			...eventId ? { id: eventId } : {}
-		});
-		eventName = void 0;
-		eventId = void 0;
-		dataLines = [];
-		dataBytes = 0;
-	};
-	const processLine = (rawLine) => {
-		const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-		if (line === "") {
-			dispatch();
-			return;
-		}
-		if (line.startsWith(":")) return;
-		const colon = line.indexOf(":");
-		const field = colon < 0 ? line : line.slice(0, colon);
-		let value = colon < 0 ? "" : line.slice(colon + 1);
-		if (value.startsWith(" ")) value = value.slice(1);
-		if (field === "data") {
-			dataBytes += Buffer.byteLength(value) + (dataLines.length > 0 ? 1 : 0);
-			if (dataBytes > maxEventBytes) throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
-			dataLines.push(value);
-		} else if (field === "event") eventName = value;
-		else if (field === "id" && !value.includes("\0")) {
-			eventId = value;
-			options.onId?.(value);
-		} else if (field === "retry" && /^\d+$/.test(value)) options.onRetry?.(Number(value));
-	};
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			buffered += decoder.decode(value, { stream: true });
-			let newline = buffered.indexOf("\n");
-			while (newline >= 0) {
-				processLine(buffered.slice(0, newline));
-				buffered = buffered.slice(newline + 1);
-				newline = buffered.indexOf("\n");
-			}
-			if (Buffer.byteLength(buffered) > maxEventBytes) throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
-		}
-		buffered += decoder.decode();
-		if (buffered) processLine(buffered);
-		dispatch();
-	} finally {
-		reader.releaseLock();
-	}
-}
-var McpHttpError = class extends Error {
-	status;
-	body;
-	constructor(status, message, body = "") {
-		super(message);
-		this.name = "McpHttpError";
-		this.status = status;
-		this.body = body;
-	}
-};
-var McpAuthRequiredError = class extends McpHttpError {
-	wwwAuthenticate;
-	constructor(response, body = "") {
-		super(401, "MCP server requires authentication", body);
-		this.name = "McpAuthRequiredError";
-		this.wwwAuthenticate = response.headers.get("www-authenticate");
-	}
-};
-var McpSessionExpiredError = class extends McpHttpError {
-	constructor(body = "") {
-		super(404, "MCP session expired", body);
-		this.name = "McpSessionExpiredError";
-	}
-};
-function contentType(response) {
-	return response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-}
-/** 401, or 403 with an `insufficient_scope` bearer challenge (step-up authorization). */
-function needsAuthorization(response) {
-	if (response.status === 401) return true;
-	if (response.status !== 403) return false;
-	return /(?:^|[\s,])error="?insufficient_scope"?/i.test(response.headers.get("www-authenticate") ?? "");
-}
-/** Statuses worth retrying when a stream fails to (re)open. */
-function isTransientStatus(status) {
-	return status === 408 || status === 429 || status >= 500;
-}
-function discard$1(response) {
-	return response.body?.cancel().catch(() => {}) ?? Promise.resolve();
-}
-function describeHttpFailure(status, body) {
-	const text = body.trim();
-	const snippet = text.length > ERROR_MESSAGE_BODY_CHARS ? `${text.slice(0, 497)}...` : text;
-	return `MCP HTTP request failed with status ${status}${snippet ? `: ${snippet}` : ""}`;
-}
-var StreamableHttpTransport = class extends TransportEvents {
-	url;
-	options;
-	fetch;
-	controller = new AbortController();
-	started = false;
-	closed = false;
-	sessionIdValue;
-	protocolVersion;
-	getStreamStarted = false;
-	/** Access token of the latest request, which `close()` reuses instead of asking the auth provider. */
-	lastToken;
-	constructor(options) {
-		super();
-		this.options = Object.freeze({
-			...options,
-			headers: options.headers ? { ...options.headers } : void 0
-		});
-		this.url = new URL(options.url);
-		const fetch = options.fetch ?? globalThis.fetch;
-		this.fetch = (input, init) => fetch(input, init);
-	}
-	get sessionId() {
-		return this.sessionIdValue;
-	}
-	async start() {
-		if (this.started) throw new Error("MCP Streamable HTTP transport already started");
-		if (this.closed) throw new McpConnectionClosedError();
-		this.started = true;
-	}
-	setProtocolVersion(version) {
-		this.protocolVersion = version;
-	}
-	async send(message, { signal } = {}) {
-		if (!this.started || this.closed) throw new McpConnectionClosedError();
-		const response = await this.authorizedFetch("POST", {
-			headers: {
-				accept: "application/json, text/event-stream",
-				"content-type": "application/json"
-			},
-			body: JSON.stringify(message)
-		}, signal);
-		await this.checkResponse(response);
-		this.captureSession(response);
-		if (!isJsonRpcRequest(message)) {
-			await discard$1(response);
-			if ("method" in message && message.method === "notifications/initialized") this.startGetStream();
-			return;
-		}
-		if (response.status === 202 || response.status === 204) throw new McpHttpError(response.status, `MCP server accepted request ${message.method} without a response`);
-		const type = contentType(response);
-		if (type === "application/json") {
-			const body = await response.json();
-			for (const item of Array.isArray(body) ? body : [body]) this.emitMessage(parseJsonRpcMessage(item));
-			return;
-		}
-		if (type === "text/event-stream" && response.body) {
-			this.consumeResponseStream(response.body, message.id);
-			return;
-		}
-		await discard$1(response);
-		throw new McpHttpError(response.status, `Unsupported MCP response content type: ${type ?? "missing"}`);
-	}
-	async close() {
-		if (this.closed) return;
-		this.closed = true;
-		this.controller.abort();
-		if (this.started && this.sessionIdValue) try {
-			await discard$1(await this.fetch(this.url, {
-				method: "DELETE",
-				headers: this.buildHeaders({}, this.lastToken),
-				signal: AbortSignal.timeout(1e3)
-			}));
-		} catch {}
-		this.emitClose();
-	}
-	/**
-	* Fetch with auth headers. A 401 (or a 403 asking for more scope) is handed to the auth provider
-	* once, and the request is retried with whatever credentials it left behind.
-	*
-	* `signal` only stops dispatch: getting a token or the authorization recovery can take a while, and a
-	* request its sender gave up on in the meantime must not reach the server. It does not abort the shared
-	* recovery, which other requests may wait for.
-	*/
-	async authorizedFetch(method, init, signal) {
-		const onUnauthorized = this.options.authProvider?.onUnauthorized?.bind(this.options.authProvider);
-		for (let attempt = 0;; attempt++) {
-			const { headers, token } = await this.headers(init.headers);
-			if (signal?.aborted) throw new McpAbortError();
-			const response = await this.fetch(this.url, {
-				method,
-				headers,
-				body: init.body,
-				signal: this.controller.signal
-			});
-			if (attempt > 0 || !onUnauthorized || !needsAuthorization(response)) return response;
-			try {
-				await onUnauthorized({
-					response,
-					serverUrl: this.url,
-					fetch: this.fetch,
-					token
-				});
-			} finally {
-				await discard$1(response);
-			}
-		}
-	}
-	async headers(extra = {}) {
-		const token = await this.options.authProvider?.token();
-		this.lastToken = token;
-		return {
-			headers: this.buildHeaders(extra, token),
-			...token ? { token } : {}
-		};
-	}
-	buildHeaders(extra, token) {
-		const headers = new Headers(this.options.headers);
-		for (const [name, value] of Object.entries(extra)) headers.set(name, value);
-		if (this.sessionIdValue) headers.set("Mcp-Session-Id", this.sessionIdValue);
-		if (this.protocolVersion) headers.set("MCP-Protocol-Version", this.protocolVersion);
-		if (token) headers.set("Authorization", `Bearer ${token}`);
-		return headers;
-	}
-	captureSession(response) {
-		const sessionId = response.headers.get("mcp-session-id");
-		if (sessionId) this.sessionIdValue = sessionId;
-	}
-	async checkResponse(response) {
-		if (response.ok) return;
-		const body = (await response.text().catch(() => "")).slice(0, MAX_ERROR_BODY_BYTES);
-		if (response.status === 401) throw new McpAuthRequiredError(response, body);
-		if (response.status === 404 && this.sessionIdValue) throw new McpSessionExpiredError(body);
-		throw new McpHttpError(response.status, describeHttpFailure(response.status, body), body);
-	}
-	async consumeSse(stream, cursor, onMessage) {
-		await consumeSseStream(stream, {
-			maxEventBytes: this.options.maxMessageBytes ?? 16777216,
-			onId: (id) => {
-				cursor.lastEventId = id;
-			},
-			onRetry: (delayMs) => {
-				cursor.retryMs = delayMs;
-			},
-			onEvent: (event) => {
-				cursor.received = true;
-				if (!event.data.trim() || event.event !== void 0 && event.event !== "message") return;
-				let message;
-				try {
-					message = parseJsonRpcMessage(JSON.parse(event.data));
-				} catch (error) {
-					this.emitError(error);
-					return;
-				}
-				onMessage?.(message);
-				this.emitMessage(message);
-			}
-		});
-	}
-	/**
-	* Read the SSE stream answering one request. When the stream ends or breaks before the response
-	* arrives and the server assigned event IDs, resume it with GET and `Last-Event-ID`, as the
-	* server may close response streams at will. Otherwise only this request fails.
-	*/
-	async consumeResponseStream(body, requestId) {
-		const cursor = {
-			lastEventId: void 0,
-			retryMs: void 0,
-			received: false
-		};
-		let answered = false;
-		const onMessage = (message) => {
-			if (isJsonRpcResponse(message) && message.id === requestId) answered = true;
-		};
-		let stream = body;
-		let failure;
-		for (let attempt = 0;;) {
-			if (stream) try {
-				await this.consumeSse(stream, cursor, onMessage);
-				failure = void 0;
-			} catch (error) {
-				failure = error;
-			}
-			if (answered || this.closed) return;
-			if (failure !== void 0 && !this.isRetryable(failure)) break;
-			if (cursor.lastEventId === void 0 || attempt >= this.maxRetries()) break;
-			if (cursor.received) attempt = 0;
-			cursor.received = false;
-			if (!await this.sleep(this.reconnectDelay(attempt++, cursor.retryMs))) return;
-			try {
-				stream = await this.openSseStream(cursor.lastEventId);
-			} catch (error) {
-				failure = error;
-				if (!this.isRetryable(error)) break;
-				stream = void 0;
-			}
-		}
-		if (this.closed) return;
-		const reason = failure === void 0 ? "stream ended without a response" : toError(failure).message;
-		this.emitMessage({
-			jsonrpc: "2.0",
-			id: requestId,
-			error: {
-				code: JSON_RPC_ERROR_CODES.internalError,
-				message: `MCP response stream failed: ${reason}`
-			}
-		});
-	}
-	startGetStream() {
-		if (this.options.openGetStream === false || this.getStreamStarted || this.closed) return;
-		this.getStreamStarted = true;
-		this.runGetStream();
-	}
-	/** Keep the server-to-client stream open, reconnecting with backoff when it drops. */
-	async runGetStream() {
-		const cursor = {
-			lastEventId: void 0,
-			retryMs: void 0,
-			received: false
-		};
-		for (let attempt = 0; !this.closed;) {
-			try {
-				const stream = await this.openSseStream(cursor.lastEventId);
-				if (!stream) return;
-				const openedAt = Date.now();
-				await this.consumeSse(stream, cursor);
-				if (cursor.received || Date.now() - openedAt > this.maxDelay()) attempt = 0;
-			} catch (error) {
-				if (this.closed) return;
-				if (!this.isRetryable(error)) {
-					this.emitError(error);
-					return;
-				}
-			}
-			cursor.received = false;
-			if (attempt >= this.maxRetries()) {
-				this.emitError(/* @__PURE__ */ new Error("MCP server-to-client stream dropped and could not be reopened"));
-				return;
-			}
-			if (!await this.sleep(this.reconnectDelay(attempt++, cursor.retryMs))) return;
-		}
-	}
-	/** Open a GET SSE stream. Resolves to undefined when the server answers 405 (no GET stream). */
-	async openSseStream(lastEventId) {
-		const response = await this.authorizedFetch("GET", { headers: {
-			accept: "text/event-stream",
-			...lastEventId === void 0 ? {} : { "last-event-id": lastEventId }
-		} });
-		if (response.status === 405) {
-			await discard$1(response);
-			return;
-		}
-		await this.checkResponse(response);
-		this.captureSession(response);
-		const type = contentType(response);
-		if (type !== "text/event-stream" || !response.body) {
-			await discard$1(response);
-			throw new McpHttpError(response.status, `Unsupported MCP GET response content type: ${type ?? "missing"}`);
-		}
-		return response.body;
-	}
-	/**
-	* Network failures and transient statuses are retried; auth, session, and protocol errors are not.
-	* `fetch` reports network failures, including a connection dropped mid-body, as `TypeError`.
-	*/
-	isRetryable(error) {
-		if (error instanceof McpHttpError) return isTransientStatus(error.status);
-		if (error instanceof TypeError) return true;
-		const code = error?.code;
-		return typeof code === "string" && (code.startsWith("E") || code.startsWith("UND_ERR"));
-	}
-	reconnectDelay(attempt, serverDelayMs) {
-		if (serverDelayMs !== void 0) return serverDelayMs;
-		const initial = this.options.reconnect?.initialDelayMs ?? DEFAULT_RECONNECT_INITIAL_DELAY_MS;
-		return Math.min(initial * 2 ** attempt, this.maxDelay());
-	}
-	maxDelay() {
-		return this.options.reconnect?.maxDelayMs ?? DEFAULT_RECONNECT_MAX_DELAY_MS;
-	}
-	maxRetries() {
-		return this.options.reconnect?.maxRetries ?? DEFAULT_RECONNECT_MAX_RETRIES;
-	}
-	/** Resolves false when the transport closed while waiting. */
-	sleep(ms) {
-		const signal = this.controller.signal;
-		if (signal.aborted) return Promise.resolve(false);
-		return new Promise((resolve) => {
-			const onAbort = () => {
-				clearTimeout(timer);
-				resolve(false);
-			};
-			const timer = setTimeout(() => {
-				signal.removeEventListener("abort", onAbort);
-				resolve(true);
-			}, ms);
-			timer.unref?.();
-			signal.addEventListener("abort", onAbort, { once: true });
-		});
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/callback.js
-function plainText(page) {
-	if (page.ok) return "Authorization complete. You may close this window.";
-	return page.details ? `${page.message}\n\n${page.details}` : page.message;
-}
-var OAuthCallbackServer = class OAuthCallbackServer {
-	redirectUrl;
-	server;
-	paths;
-	timeoutMs;
-	renderPage;
-	pending = /* @__PURE__ */ new Map();
-	constructor(server, redirectUrl, paths, timeoutMs, renderPage) {
-		this.server = server;
-		this.redirectUrl = redirectUrl;
-		this.paths = paths;
-		this.timeoutMs = timeoutMs;
-		this.renderPage = renderPage;
-	}
-	static async listen(options = {}) {
-		const host = options.host ?? "127.0.0.1";
-		const redirectHost = options.redirectHost ?? host;
-		const path = options.path ?? "/callback";
-		let instance;
-		const server = createServer((request, response) => instance?.handle(request.url ?? "/", response));
-		await new Promise((resolve, reject) => {
-			server.once("error", reject);
-			server.listen(options.port ?? 0, host, () => {
-				server.off("error", reject);
-				resolve();
-			});
-		});
-		const address = server.address();
-		if (!address || typeof address === "string") throw new Error("OAuth callback server did not bind to TCP");
-		instance = new OAuthCallbackServer(server, `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${path}`, [path, ...options.extraPaths ?? []], options.timeoutMs ?? 3e5, options.renderPage);
-		return instance;
-	}
-	/**
-	* Wait for the authorization response with `state`. With `path`, a response on another path fails, so
-	* a server-specific redirect URI can tell authorization servers apart (RFC 9700 section 4.4.2.2).
-	*/
-	waitForCallback(state, path) {
-		if (this.pending.has(state)) throw new Error("OAuth state is already pending");
-		return new Promise((resolve, reject) => {
-			const timer = setTimeout(() => {
-				this.pending.delete(state);
-				reject(/* @__PURE__ */ new Error("OAuth callback timed out"));
-			}, this.timeoutMs);
-			this.pending.set(state, {
-				resolve,
-				reject,
-				timer,
-				path
-			});
-		});
-	}
-	async close() {
-		for (const pending of this.pending.values()) {
-			clearTimeout(pending.timer);
-			pending.reject(/* @__PURE__ */ new Error("OAuth callback server closed"));
-		}
-		this.pending.clear();
-		await new Promise((resolve, reject) => {
-			this.server.close((error) => error ? reject(error) : resolve());
-		});
-	}
-	reply(response, status, page) {
-		if (this.renderPage) {
-			response.writeHead(status, {
-				"content-type": "text/html; charset=utf-8",
-				"cache-control": "no-store"
-			});
-			response.end(this.renderPage(page));
-		} else response.writeHead(status, { "content-type": "text/plain; charset=utf-8" }).end(plainText(page));
-	}
-	handle(rawUrl, response) {
-		const url = new URL(rawUrl, this.redirectUrl);
-		if (!this.paths.includes(url.pathname)) {
-			this.reply(response, 404, {
-				ok: false,
-				message: "Not found"
-			});
-			return;
-		}
-		const state = url.searchParams.get("state");
-		const pending = state ? this.pending.get(state) : void 0;
-		if (!state || !pending) {
-			this.reply(response, 400, {
-				ok: false,
-				message: "Invalid or expired OAuth state"
-			});
-			return;
-		}
-		clearTimeout(pending.timer);
-		this.pending.delete(state);
-		if (pending.path !== void 0 && url.pathname !== pending.path) {
-			pending.reject(/* @__PURE__ */ new Error("The authorization response arrived on another redirect URI"));
-			this.reply(response, 400, {
-				ok: false,
-				message: "Unexpected redirect URI"
-			});
-			return;
-		}
-		const error = url.searchParams.get("error");
-		if (error) {
-			const description = url.searchParams.get("error_description") ?? error;
-			pending.reject(new Error(description));
-			this.reply(response, 200, {
-				ok: false,
-				message: "Authorization failed. You may close this window.",
-				details: description
-			});
-			return;
-		}
-		const code = url.searchParams.get("code");
-		if (!code) {
-			pending.reject(/* @__PURE__ */ new Error("OAuth callback did not include an authorization code"));
-			this.reply(response, 400, {
-				ok: false,
-				message: "Missing authorization code"
-			});
-			return;
-		}
-		const iss = url.searchParams.get("iss");
-		pending.resolve({
-			code,
-			state,
-			...iss ? { iss } : {}
-		});
-		this.reply(response, 200, { ok: true });
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/errors.js
-var OAuthError = class extends Error {
-	code;
-	errorUri;
-	constructor(code, message, errorUri) {
-		super(message || code);
-		this.name = "OAuthError";
-		this.code = code;
-		this.errorUri = errorUri;
-	}
-};
-var OAuthIssuerMismatchError = class extends Error {
-	/** `undefined` when no authorization server metadata was discovered. */
-	expected;
-	/** `undefined` when an authorization response lacks the `iss` parameter its server promised (RFC 9207). */
-	received;
-	constructor(expected, received) {
-		const format = (issuer) => issuer === void 0 ? "none" : JSON.stringify(issuer);
-		super(`OAuth issuer mismatch: expected ${format(expected)}, received ${format(received)}`);
-		this.name = "OAuthIssuerMismatchError";
-		this.expected = expected;
-		this.received = received;
-	}
-};
-var OAuthInsecureEndpointError = class extends Error {
-	endpoint;
-	constructor(endpoint) {
-		super(`Refusing to send OAuth credentials to non-HTTPS endpoint ${endpoint}`);
-		this.name = "OAuthInsecureEndpointError";
-		this.endpoint = endpoint;
-	}
-};
-var OAuthRegistrationError = class extends Error {
-	status;
-	body;
-	constructor(status, body) {
-		super(`OAuth dynamic client registration failed with status ${status}: ${body}`);
-		this.name = "OAuthRegistrationError";
-		this.status = status;
-		this.body = body;
-	}
-};
-var McpOAuthAuthorizationRequiredError = class extends Error {
-	constructor() {
-		super("MCP OAuth authorization requires user interaction");
-		this.name = "McpOAuthAuthorizationRequiredError";
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/types.js
-function object(value, name) {
-	if (!isObject(value)) throw new Error(`Invalid ${name}`);
-	return value;
-}
-/** Drops `undefined` values so optional fields are absent rather than present-but-undefined. */
-function compact(value) {
-	return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
-}
-function requiredString(value, name) {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`Invalid ${name}`);
-	return value;
-}
-/** Treats `null` and `""` as absent: servers send them for fields they have no value for, like `scope: ""`. */
-function absent(value) {
-	return value === void 0 || value === null || value === "";
-}
-function optionalString(value, name) {
-	if (absent(value)) return void 0;
-	return requiredString(value, name);
-}
-function optionalStrings(value, name) {
-	if (value === void 0 || value === null) return void 0;
-	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new Error(`Invalid ${name}`);
-	return [...value];
-}
-function safeUrl(value, name) {
-	const text = requiredString(value, name);
-	if (!URL.canParse(text)) throw new Error(`Invalid ${name}`);
-	const url = new URL(text);
-	if ([
-		"javascript:",
-		"data:",
-		"vbscript:"
-	].includes(url.protocol)) throw new Error(`Invalid ${name}`);
-	return text;
-}
-function optionalUrl(value, name) {
-	return absent(value) ? void 0 : safeUrl(value, name);
-}
-function parseProtectedResourceMetadata(value) {
-	const input = object(value, "OAuth protected resource metadata");
-	return compact({
-		...input,
-		resource: safeUrl(input.resource, "OAuth protected resource metadata resource"),
-		authorization_servers: optionalStrings(input.authorization_servers, "authorization_servers")?.map((url) => safeUrl(url, "authorization server URL")),
-		scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported")
-	});
-}
-function parseAuthorizationServerMetadata(value) {
-	const input = object(value, "authorization server metadata");
-	const responseTypes = optionalStrings(input.response_types_supported, "response_types_supported");
-	if (!responseTypes) throw new Error("Invalid response_types_supported");
-	return compact({
-		...input,
-		issuer: safeUrl(input.issuer, "authorization server issuer"),
-		authorization_endpoint: safeUrl(input.authorization_endpoint, "authorization endpoint"),
-		token_endpoint: safeUrl(input.token_endpoint, "token endpoint"),
-		registration_endpoint: optionalUrl(input.registration_endpoint, "registration endpoint"),
-		scopes_supported: optionalStrings(input.scopes_supported, "scopes_supported"),
-		response_types_supported: responseTypes,
-		grant_types_supported: optionalStrings(input.grant_types_supported, "grant_types_supported"),
-		token_endpoint_auth_methods_supported: optionalStrings(input.token_endpoint_auth_methods_supported, "token_endpoint_auth_methods_supported"),
-		code_challenge_methods_supported: optionalStrings(input.code_challenge_methods_supported, "code_challenge_methods_supported"),
-		client_id_metadata_document_supported: typeof input.client_id_metadata_document_supported === "boolean" ? input.client_id_metadata_document_supported : void 0,
-		authorization_response_iss_parameter_supported: typeof input.authorization_response_iss_parameter_supported === "boolean" ? input.authorization_response_iss_parameter_supported : void 0
-	});
-}
-function parseOAuthTokens(value) {
-	const input = object(value, "OAuth token response");
-	const expires = absent(input.expires_in) ? void 0 : Number(input.expires_in);
-	if (expires !== void 0 && !Number.isFinite(expires)) throw new Error("Invalid expires_in");
-	return compact({
-		access_token: requiredString(input.access_token, "access_token"),
-		token_type: requiredString(input.token_type, "token_type"),
-		expires_in: expires,
-		scope: optionalString(input.scope, "scope"),
-		refresh_token: optionalString(input.refresh_token, "refresh_token"),
-		id_token: optionalString(input.id_token, "id_token")
-	});
-}
-function parseClientInformation(value) {
-	const input = object(value, "OAuth client registration response");
-	return compact({
-		...input,
-		client_id: requiredString(input.client_id, "client_id"),
-		client_secret: optionalString(input.client_secret, "client_secret"),
-		client_id_issued_at: typeof input.client_id_issued_at === "number" ? input.client_id_issued_at : void 0,
-		client_secret_expires_at: typeof input.client_secret_expires_at === "number" ? input.client_secret_expires_at : void 0,
-		redirect_uris: optionalStrings(input.redirect_uris, "redirect_uris") ?? []
-	});
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/discovery.js
-function discard(response) {
-	response?.body?.cancel().catch(() => {});
-}
-/** 4xx and 502 mean "not here", so discovery tries the next candidate URL. */
-function isDiscoveryMiss(status) {
-	return status >= 400 && status < 500 || status === 502;
-}
-/** Path suffix for `/.well-known/<kind><path>`; empty for the root path. */
-function pathSuffix(pathname) {
-	return pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
-}
-function field(header, name) {
-	const match = header.match(new RegExp(String.raw`(?:^|[,\s])${name}=(?:"([^"]*)"|([^\s,]+))`, "i"));
-	return match?.[1] || match?.[2] || void 0;
-}
-function parseWwwAuthenticate(header) {
-	if (!header) return {};
-	const scheme = header.trimStart().split(/\s+/, 1)[0]?.toLowerCase();
-	if (scheme !== "bearer" && scheme !== "dpop") return {};
-	const resourceMetadata = field(header, "resource_metadata");
-	let resourceMetadataUrl;
-	if (resourceMetadata) try {
-		resourceMetadataUrl = new URL(resourceMetadata);
-	} catch {}
-	return {
-		resourceMetadataUrl,
-		scope: field(header, "scope"),
-		error: field(header, "error"),
-		errorDescription: field(header, "error_description")
-	};
-}
-async function fetchMetadata(url, fetch, protocolVersion, signal) {
-	return fetch(url, {
-		headers: {
-			Accept: "application/json",
-			"MCP-Protocol-Version": protocolVersion
-		},
-		signal
-	});
-}
-async function discoverProtectedResourceMetadata(serverUrl, options = {}) {
-	const server = new URL(serverUrl);
-	const fetch = options.fetch ?? globalThis.fetch;
-	const version = options.protocolVersion ?? "2025-11-25";
-	let response = await fetchMetadata(options.resourceMetadataUrl ? new URL(options.resourceMetadataUrl) : new URL(`/.well-known/oauth-protected-resource${pathSuffix(server.pathname)}`, server.origin), fetch, version, options.signal);
-	if (!options.resourceMetadataUrl && server.pathname !== "/" && isDiscoveryMiss(response.status)) {
-		discard(response);
-		response = await fetchMetadata(new URL("/.well-known/oauth-protected-resource", server.origin), fetch, version, options.signal);
-	}
-	if (!response.ok) {
-		discard(response);
-		throw new Error(`HTTP ${response.status} loading OAuth protected resource metadata`);
-	}
-	return parseProtectedResourceMetadata(await response.json());
-}
-function buildAuthorizationServerDiscoveryUrls(authorizationServerUrl) {
-	const issuer = new URL(authorizationServerUrl);
-	const path = pathSuffix(issuer.pathname);
-	const urls = [{
-		url: new URL(`/.well-known/oauth-authorization-server${path}`, issuer.origin),
-		type: "oauth"
-	}, {
-		url: new URL(`/.well-known/openid-configuration${path}`, issuer.origin),
-		type: "oidc"
-	}];
-	if (path) urls.push({
-		url: new URL(`${path}/.well-known/openid-configuration`, issuer.origin),
-		type: "oidc"
-	});
-	return urls;
-}
-async function discoverAuthorizationServerMetadata(authorizationServerUrl, options = {}) {
-	const fetch = options.fetch ?? globalThis.fetch;
-	for (const { url } of buildAuthorizationServerDiscoveryUrls(authorizationServerUrl)) {
-		const response = await fetchMetadata(url, fetch, options.protocolVersion ?? "2025-11-25", options.signal);
-		if (!response.ok) {
-			discard(response);
-			if (isDiscoveryMiss(response.status)) continue;
-			throw new Error(`HTTP ${response.status} loading authorization server metadata from ${url}`);
-		}
-		const metadata = parseAuthorizationServerMetadata(await response.json());
-		if (!options.skipIssuerValidation) {
-			const expected = String(authorizationServerUrl);
-			const trim = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
-			if (trim(metadata.issuer) !== trim(expected)) throw new OAuthIssuerMismatchError(expected, metadata.issuer);
-		}
-		return metadata;
-	}
-}
-async function discoverOAuthServerInfo(serverUrl, options = {}) {
-	let resourceMetadata;
-	try {
-		resourceMetadata = await discoverProtectedResourceMetadata(serverUrl, {
-			resourceMetadataUrl: options.resourceMetadataUrl,
-			fetch: options.fetch,
-			signal: options.signal
-		});
-	} catch (error) {
-		if (error instanceof TypeError) throw error;
-	}
-	if (options.authorizationServerMetadataUrl) {
-		const url = options.authorizationServerMetadataUrl;
-		const response = await fetchMetadata(url, options.fetch ?? globalThis.fetch, LATEST_PROTOCOL_VERSION, options.signal);
-		if (!response.ok) {
-			discard(response);
-			throw new Error(`HTTP ${response.status} loading authorization server metadata from ${url}`);
-		}
-		const metadata = parseAuthorizationServerMetadata(await response.json());
-		return {
-			authorizationServerUrl: metadata.issuer,
-			authorizationServerMetadata: metadata,
-			resourceMetadata
-		};
-	}
-	const authorizationServerUrl = resourceMetadata?.authorization_servers?.[0] ?? String(new URL("/", serverUrl));
-	return {
-		authorizationServerUrl,
-		authorizationServerMetadata: await discoverAuthorizationServerMetadata(authorizationServerUrl, {
-			fetch: options.fetch,
-			skipIssuerValidation: options.skipIssuerValidation,
-			signal: options.signal
-		}),
-		resourceMetadata
-	};
-}
-function resourceUrlFromServerUrl(value) {
-	const url = new URL(value);
-	url.hash = "";
-	return url;
-}
-function selectResource(serverUrl, metadata) {
-	if (!metadata) return void 0;
-	const requested = resourceUrlFromServerUrl(serverUrl);
-	const configured = new URL(metadata.resource);
-	if (requested.origin !== configured.origin) throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
-	const requestedPath = requested.pathname.endsWith("/") ? requested.pathname : `${requested.pathname}/`;
-	const configuredPath = configured.pathname.endsWith("/") ? configured.pathname : `${configured.pathname}/`;
-	if (!requestedPath.startsWith(configuredPath)) throw new Error(`Protected resource ${metadata.resource} does not match MCP server ${requested}`);
-	return metadata.resource;
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/flow.js
-function loopback(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
-}
-/**
-* The OpenID Connect `application_type` for `redirect_uris` (MCP SEP-837). Without one, OpenID Connect servers
-* assume `web`, which rejects http loopback redirect URIs. Loopback hosts and custom schemes are native (RFC 8252).
-*/
-function applicationType(redirectUris) {
-	return redirectUris.some((uri) => {
-		if (!URL.canParse(uri)) return false;
-		const url = new URL(uri);
-		return url.protocol !== "http:" && url.protocol !== "https:" || loopback(url.hostname);
-	}) ? "native" : "web";
-}
-function secureEndpoint(value) {
-	const url = new URL(value);
-	if (url.protocol !== "https:" && !loopback(url.hostname)) throw new OAuthInsecureEndpointError(url.href);
-	return url;
-}
-function selectClientAuthMethod(information, supported) {
-	const hinted = "token_endpoint_auth_method" in information ? information.token_endpoint_auth_method : void 0;
-	if (hinted && [
-		"client_secret_basic",
-		"client_secret_post",
-		"none"
-	].includes(hinted) && (supported.length === 0 || supported.includes(hinted))) return hinted;
-	if (supported.length === 0) return information.client_secret ? "client_secret_basic" : "none";
-	if (information.client_secret && supported.includes("client_secret_basic")) return "client_secret_basic";
-	if (information.client_secret && supported.includes("client_secret_post")) return "client_secret_post";
-	if (supported.includes("none")) return "none";
-	return information.client_secret ? "client_secret_post" : "none";
-}
-function applyClientAuthentication(method, information, headers, params) {
-	if (method === "client_secret_basic") {
-		if (!information.client_secret) throw new Error("client_secret_basic requires a client secret");
-		headers.set("Authorization", `Basic ${Buffer.from(`${information.client_id}:${information.client_secret}`).toString("base64")}`);
-	} else {
-		params.set("client_id", information.client_id);
-		if (method === "client_secret_post" && information.client_secret) params.set("client_secret", information.client_secret);
-	}
-}
-async function pkce() {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-	const verifier = Buffer.from(bytes).toString("base64url");
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-	return {
-		verifier,
-		challenge: Buffer.from(digest).toString("base64url")
-	};
-}
-async function startAuthorization(authorizationServerUrl, options) {
-	const metadata = options.metadata;
-	if (metadata && !metadata.response_types_supported.includes("code")) throw new Error("Authorization server does not support authorization codes");
-	if (metadata?.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes("S256")) throw new Error("Authorization server does not support PKCE S256");
-	const url = new URL(metadata?.authorization_endpoint ?? new URL("/authorize", authorizationServerUrl));
-	const { verifier, challenge } = await pkce();
-	url.searchParams.set("response_type", "code");
-	url.searchParams.set("client_id", options.clientInformation.client_id);
-	url.searchParams.set("code_challenge", challenge);
-	url.searchParams.set("code_challenge_method", "S256");
-	url.searchParams.set("redirect_uri", String(options.redirectUrl));
-	if (options.state) url.searchParams.set("state", options.state);
-	if (options.scope) url.searchParams.set("scope", options.scope);
-	if (options.scope?.split(/\s+/).includes("offline_access")) url.searchParams.set("prompt", "consent");
-	if (options.resource) url.searchParams.set("resource", options.resource);
-	return {
-		authorizationUrl: url,
-		codeVerifier: verifier
-	};
-}
-async function tokenRequest(authorizationServerUrl, options, params) {
-	const url = secureEndpoint(options.metadata?.token_endpoint ?? new URL("/token", authorizationServerUrl));
-	const headers = new Headers({
-		Accept: "application/json",
-		"content-type": "application/x-www-form-urlencoded"
-	});
-	if (options.resource) params.set("resource", options.resource);
-	if (options.addClientAuthentication) await options.addClientAuthentication(headers, params, url, options.metadata);
-	else applyClientAuthentication(selectClientAuthMethod(options.clientInformation, options.metadata?.token_endpoint_auth_methods_supported ?? []), options.clientInformation, headers, params);
-	const response = await (options.fetch ?? globalThis.fetch)(url, {
-		method: "POST",
-		headers,
-		body: params,
-		signal: options.signal
-	});
-	const text = await response.text();
-	let value;
-	try {
-		value = JSON.parse(text);
-	} catch {}
-	if (isObject(value) && typeof value.error === "string") throw new OAuthError(value.error, typeof value.error_description === "string" ? value.error_description : value.error, typeof value.error_uri === "string" ? value.error_uri : void 0);
-	if (!response.ok) throw new OAuthError("server_error", `HTTP ${response.status}: ${text}`);
-	return parseOAuthTokens(value);
-}
-async function registerClient(authorizationServerUrl, options) {
-	const endpoint = options.metadata?.registration_endpoint;
-	if (options.metadata && !endpoint) throw new Error("Authorization server does not support dynamic client registration");
-	const response = await (options.fetch ?? globalThis.fetch)(new URL(endpoint ?? new URL("/register", authorizationServerUrl)), {
-		method: "POST",
-		headers: {
-			Accept: "application/json",
-			"content-type": "application/json"
-		},
-		body: JSON.stringify({
-			...options.clientMetadata,
-			application_type: options.clientMetadata.application_type ?? applicationType(options.clientMetadata.redirect_uris),
-			...options.scope ? { scope: options.scope } : {}
-		}),
-		signal: options.signal
-	});
-	if (!response.ok) throw new OAuthRegistrationError(response.status, await response.text());
-	return parseClientInformation(await response.json());
-}
-async function exchangeAuthorizationCode(authorizationServerUrl, options) {
-	return tokenRequest(authorizationServerUrl, options, new URLSearchParams({
-		grant_type: "authorization_code",
-		code: options.code,
-		code_verifier: options.codeVerifier,
-		redirect_uri: String(options.redirectUrl)
-	}));
-}
-async function refreshAuthorization(authorizationServerUrl, options) {
-	const tokens = await tokenRequest(authorizationServerUrl, options, new URLSearchParams({
-		grant_type: "refresh_token",
-		refresh_token: options.refreshToken
-	}));
-	return {
-		refresh_token: options.refreshToken,
-		...tokens
-	};
-}
-function withScope(tokens, scope) {
-	return tokens.scope === void 0 && scope ? {
-		...tokens,
-		scope
-	} : tokens;
-}
-/**
-* Scopes for a step-up authorization: the challenged scopes plus the ones granted so far, since a
-* challenge may list only the missing scopes and a token with just those would lose access the old
-* one had (SEP-2350). Without challenged scopes, `undefined` lets the flow pick its default.
-*/
-function stepUpScope(granted, challenged) {
-	if (!challenged) return void 0;
-	const scopes = [granted, challenged].flatMap((scope) => scope?.split(/\s+/).filter(Boolean) ?? []);
-	return [...new Set(scopes)].join(" ");
-}
-async function runFlow(provider, options) {
-	const metadataUrl = options.authorizationServerMetadataUrl && secureEndpoint(options.authorizationServerMetadataUrl);
-	const cached = metadataUrl ? void 0 : await provider.discoveryState?.();
-	const discovered = cached?.authorizationServerUrl ? {
-		authorizationServerUrl: cached.authorizationServerUrl,
-		authorizationServerMetadata: cached.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(cached.authorizationServerUrl, {
-			fetch: options.fetch,
-			skipIssuerValidation: options.skipIssuerValidation,
-			signal: options.signal
-		}),
-		resourceMetadata: cached.resourceMetadata
-	} : await discoverOAuthServerInfo(options.serverUrl, {
-		resourceMetadataUrl: options.resourceMetadataUrl,
-		authorizationServerMetadataUrl: metadataUrl,
-		fetch: options.fetch,
-		skipIssuerValidation: options.skipIssuerValidation,
-		signal: options.signal
-	});
-	if (!metadataUrl) await provider.saveDiscoveryState?.({
-		...discovered,
-		...options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl.href } : {}
-	});
-	const metadata = discovered.authorizationServerMetadata;
-	const resource = selectResource(options.serverUrl, discovered.resourceMetadata);
-	const scope = options.scope || discovered.resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-	const stored = await provider.clientInformation();
-	const clientDocument = stored ? void 0 : provider.clientMetadataDocument?.(metadata);
-	if (clientDocument) {
-		const url = new URL(clientDocument.url);
-		if (url.protocol !== "https:" || url.pathname === "/") throw new Error("Invalid OAuth client metadata URL");
-	}
-	let client = stored ?? (clientDocument && { client_id: clientDocument.url });
-	if (!client) {
-		if (options.authorizationCode) throw new Error("OAuth client information is missing during code exchange");
-		if (!provider.saveClientInformation) throw new Error("OAuth client information cannot be persisted");
-		client = await registerClient(discovered.authorizationServerUrl, {
-			metadata,
-			clientMetadata: provider.clientMetadata,
-			scope,
-			fetch: options.fetch,
-			signal: options.signal
-		});
-		await provider.saveClientInformation(client);
-	}
-	const redirectUrl = clientDocument?.redirectUrl ?? provider.redirectUrl;
-	const tokenOptions = {
-		metadata,
-		clientInformation: client,
-		resource,
-		addClientAuthentication: provider.addClientAuthentication,
-		fetch: options.fetch,
-		signal: options.signal
-	};
-	if (options.authorizationCode) {
-		const iss = options.iss;
-		if (iss !== void 0 || metadata?.authorization_response_iss_parameter_supported) {
-			if (iss !== metadata?.issuer) throw new OAuthIssuerMismatchError(metadata?.issuer, iss);
-		}
-		const tokens = await exchangeAuthorizationCode(discovered.authorizationServerUrl, {
-			...tokenOptions,
-			code: options.authorizationCode,
-			codeVerifier: await provider.codeVerifier(),
-			redirectUrl
-		});
-		await provider.saveTokens(withScope(tokens, scope));
-		return "AUTHORIZED";
-	}
-	const existing = options.skipRefresh ? void 0 : await provider.tokens();
-	if (existing?.refresh_token) try {
-		const tokens = await refreshAuthorization(discovered.authorizationServerUrl, {
-			...tokenOptions,
-			refreshToken: existing.refresh_token
-		});
-		await provider.saveTokens(withScope(tokens, existing.scope));
-		return "AUTHORIZED";
-	} catch (error) {
-		if (options.signal?.aborted || error instanceof OAuthInsecureEndpointError) throw error;
-		if (error instanceof OAuthError && error.code !== "server_error") throw error;
-	}
-	const state = await provider.state?.();
-	const authorization = await startAuthorization(discovered.authorizationServerUrl, {
-		metadata,
-		clientInformation: client,
-		redirectUrl,
-		scope,
-		state,
-		resource
-	});
-	await provider.saveCodeVerifier(authorization.codeVerifier);
-	await provider.redirectToAuthorization(authorization.authorizationUrl);
-	return "REDIRECT";
-}
-async function authorizeMcp(provider, options) {
-	try {
-		return await runFlow(provider, options);
-	} catch (error) {
-		if (error instanceof OAuthError && ["invalid_client", "unauthorized_client"].includes(error.code)) {
-			await provider.invalidateCredentials?.("all");
-			return runFlow(provider, options);
-		}
-		if (error instanceof OAuthError && error.code === "invalid_grant") {
-			await provider.invalidateCredentials?.("tokens");
-			return runFlow(provider, options);
-		}
-		throw error;
-	}
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-mcp@1.2.0/node_modules/@earendil-works/pi-mcp/dist/oauth/provider.js
-var MemoryOAuthStateStore = class {
-	value;
-	load() {
-		return this.value === void 0 ? void 0 : structuredClone(this.value);
-	}
-	save(state) {
-		this.value = structuredClone(state);
-	}
-};
-/** Default stateful provider for one exact MCP server URL. Applications inject durable storage if needed. */
-var McpOAuthProvider = class {
-	redirectUrl;
-	clientMetadata;
-	clientMetadataDocument;
-	serverUrl;
-	configuredClient;
-	store;
-	onRedirect;
-	writes = Promise.resolve();
-	constructor(options) {
-		this.serverUrl = String(new URL(options.serverUrl));
-		this.redirectUrl = String(options.redirectUrl);
-		this.clientMetadata = {
-			...options.clientMetadata,
-			redirect_uris: options.clientMetadata.redirect_uris ?? [this.redirectUrl],
-			grant_types: options.clientMetadata.grant_types ?? ["authorization_code", "refresh_token"],
-			response_types: options.clientMetadata.response_types ?? ["code"],
-			token_endpoint_auth_method: options.clientMetadata.token_endpoint_auth_method ?? (options.clientSecret ? "client_secret_post" : "none")
-		};
-		this.clientMetadataDocument = options.clientMetadataDocument;
-		this.configuredClient = options.clientId ? {
-			client_id: options.clientId,
-			...options.clientSecret ? { client_secret: options.clientSecret } : {}
-		} : void 0;
-		this.store = options.store ?? new MemoryOAuthStateStore();
-		this.onRedirect = options.onRedirect;
-	}
-	async state() {
-		const existing = (await this.load()).oauthState;
-		if (existing) return existing;
-		const state = Buffer.from(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32))).toString("hex");
-		await this.update((value) => ({
-			...value,
-			oauthState: state
-		}));
-		return state;
-	}
-	async clientInformation() {
-		return this.configuredClient ?? (await this.load()).clientInformation;
-	}
-	async saveClientInformation(information) {
-		if (this.configuredClient) return;
-		await this.update((value) => ({
-			...value,
-			clientInformation: information
-		}));
-	}
-	async tokens() {
-		return (await this.load()).tokens;
-	}
-	async saveTokens(tokens) {
-		const expiresAt = tokens.expires_in === void 0 ? void 0 : Date.now() + tokens.expires_in * 1e3;
-		await this.update((value) => {
-			const next = {
-				...value,
-				tokens
-			};
-			if (expiresAt === void 0) delete next.tokensExpireAt;
-			else next.tokensExpireAt = expiresAt;
-			return next;
-		});
-	}
-	async redirectToAuthorization(url) {
-		await this.onRedirect(url);
-	}
-	async saveCodeVerifier(verifier) {
-		await this.update((value) => ({
-			...value,
-			codeVerifier: verifier
-		}));
-	}
-	async codeVerifier() {
-		const verifier = (await this.load()).codeVerifier;
-		if (!verifier) throw new Error("No OAuth PKCE code verifier is stored");
-		return verifier;
-	}
-	async invalidateCredentials(kind) {
-		await this.update((value) => {
-			const next = { ...value };
-			if (kind === "all" || kind === "client") delete next.clientInformation;
-			if (kind === "all" || kind === "tokens") {
-				delete next.tokens;
-				delete next.tokensExpireAt;
-			}
-			if (kind === "all" || kind === "verifier") delete next.codeVerifier;
-			if (kind === "all" || kind === "discovery") delete next.discovery;
-			if (kind === "all") delete next.oauthState;
-			return next;
-		});
-	}
-	async saveDiscoveryState(discovery) {
-		await this.update((value) => ({
-			...value,
-			discovery
-		}));
-	}
-	async discoveryState() {
-		return (await this.load()).discovery;
-	}
-	async load() {
-		await this.writes;
-		return this.own(await this.store.load());
-	}
-	async update(update) {
-		this.writes = this.writes.then(async () => {
-			await this.store.save(update(this.own(await this.store.load())));
-		});
-		await this.writes;
-	}
-	/** Stored state for another server URL is ignored so credentials never leak across servers. */
-	own(state) {
-		return state?.serverUrl === this.serverUrl ? state : { serverUrl: this.serverUrl };
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-ai@1.2.0_@aws-sdk+credential-provider-node@3.972.86_@modelcontextpro_dcf109e705e96235bfb9a180457030de/node_modules/@earendil-works/pi-ai/dist/utils/oauth-page.js
-const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#F09082" d="M165.29 165.29H517.36V400H400V282.65H165.29Z"/><path fill="#4D9ABF" d="M165.29 282.65H282.65V400H400V517.36H282.65V634.72H165.29Z"/><path fill="#F1BE58" d="M517.36 400H634.72V634.72H517.36Z"/></svg>`;
-function escapeHtml(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
-}
-function renderPage(options) {
-	const title = escapeHtml(options.title);
-	const heading = escapeHtml(options.heading);
-	const message = escapeHtml(options.message);
-	const details = options.details ? escapeHtml(options.details) : void 0;
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${title}</title>
-  <style>
-    :root {
-      --text: #fafafa;
-      --text-dim: #a1a1aa;
-      --page-bg: #09090b;
-      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
-      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
-    }
-    * { box-sizing: border-box; }
-    html { color-scheme: dark; }
-    body {
-      margin: 0;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      padding: 24px;
-      background: var(--page-bg);
-      color: var(--text);
-      font-family: var(--font-sans);
-      text-align: center;
-    }
-    main {
-      width: 100%;
-      max-width: 560px;
-      display: flex;
-      flex-direction: column;
-      align-items: center;
-      justify-content: center;
-    }
-    .logo {
-      width: 72px;
-      height: 72px;
-      display: block;
-      margin-bottom: 24px;
-    }
-    h1 {
-      margin: 0 0 10px;
-      font-size: 28px;
-      line-height: 1.15;
-      font-weight: 650;
-      color: var(--text);
-    }
-    p {
-      margin: 0;
-      line-height: 1.7;
-      color: var(--text-dim);
-      font-size: 15px;
-    }
-    .details {
-      margin-top: 16px;
-      font-family: var(--font-mono);
-      font-size: 13px;
-      color: var(--text-dim);
-      white-space: pre-wrap;
-      word-break: break-word;
-    }
-  </style>
-</head>
-<body>
-  <main>
-    <div class="logo">${LOGO_SVG}</div>
-    <h1>${heading}</h1>
-    <p>${message}</p>
-    ${details ? `<div class="details">${details}</div>` : ""}
-  </main>
-</body>
-</html>`;
-}
-function oauthSuccessHtml(message) {
-	return renderPage({
-		title: "Authentication successful",
-		heading: "Authentication successful",
-		message
-	});
-}
-function oauthErrorHtml(message, details) {
-	return renderPage({
-		title: "Authentication failed",
-		heading: "Authentication failed",
-		message,
-		details
-	});
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-coding-agent@1.2.0_@aws-sdk+credential-provider-node@3.972.86_@model_cb83c1bd7a7ff5cede8c43e329c5cf76/node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/oauth.js
-/**
-* OAuth sign-in for remote MCP servers.
-*
-* Connections never start a browser flow on their own. They send the stored access token and, after
-* a 401, try the stored refresh token. When that is not possible they fail with
-* `McpOAuthAuthorizationRequiredError`, and the user signs in through `/mcp`, which runs
-* the authorization code flow (PKCE, a Client ID Metadata Document or dynamic client registration)
-* against a loopback callback.
-*
-* Credentials live in `<agent-dir>/mcp-auth.json`, keyed by server name and URL.
-*/
-var import_proper_lockfile = /* @__PURE__ */ __toESM(require_proper_lockfile(), 1);
-const CALLBACK_HOST = "127.0.0.1";
-const CALLBACK_PATH = "/callback";
-/** Where pi.dev serves pi's Client ID Metadata Documents: `client.json` and `<callback ID>/client.json`. */
-const CLIENT_METADATA_BASE_URL = "https://pi.dev/oauth";
-/** Redirect URI for refreshes when none is stored. Refreshing never redirects the user. */
-const FALLBACK_REDIRECT_URL = `http://${CALLBACK_HOST}${CALLBACK_PATH}`;
-/** Access tokens this close to expiry are refreshed before they are sent. */
-const REFRESH_SKEW_MS = 3e4;
-/**
-* Bounds each request to the authorization server, so an unresponsive one cannot hold the refresh lock,
-* delay shutdown, or keep a sign-in waiting for long.
-*/
-const OAUTH_REQUEST_TIMEOUT_MS = 15e3;
-/** A refresh lock that its holder stopped renewing (the process was killed) is taken over after this. */
-const REFRESH_LOCK_STALE_MS = 2e4;
-/** How long to wait for another process's refresh: longer than a stale lock lives. */
-const REFRESH_LOCK_WAIT_MS = 25e3;
-const REFRESH_LOCK_RETRY_MS = 100;
-function callbackSettings(settings) {
-	const url = new URL(settings.callbackUrl ?? `http://${CALLBACK_HOST}${CALLBACK_PATH}`);
-	const address = url.hostname.replace(/^\[|\]$/g, "");
-	const port = url.port ? Number(url.port) : settings.callbackPort;
-	let fixedRedirectUrl;
-	if (url.port) fixedRedirectUrl = settings.callbackUrl;
-	else if (port !== void 0) {
-		url.port = String(port);
-		fixedRedirectUrl = url.href;
-	}
-	return {
-		host: address === "localhost" ? CALLBACK_HOST : address,
-		redirectHost: address,
-		port,
-		path: url.pathname,
-		fixedRedirectUrl
-	};
-}
-/** Scopes of both lists, each once. */
-function mergeScopes(...scopes) {
-	const merged = [...new Set(scopes.flatMap((scope) => scope?.split(/\s+/).filter(Boolean) ?? []))];
-	return merged.length > 0 ? merged.join(" ") : void 0;
-}
-function parseStates(content) {
-	if (!content?.trim()) return {};
-	const parsed = JSON.parse(content);
-	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-}
-function serializeStates(states) {
-	return `${JSON.stringify(states, null, 2)}\n`;
-}
-/**
-* Keys of a server's state: by name and URL, so servers sharing a URL keep separate accounts, and the
-* legacy key by URL alone, written by older versions.
-*/
-function storeKeys(name, serverUrl) {
-	const legacyKey = String(new URL(serverUrl));
-	return {
-		key: `${mcpNamespace(name)}|${legacyKey}`,
-		legacyKey
-	};
-}
-/** Per-server OAuth state (client registration, tokens, pending PKCE verifier) in `mcp-auth.json`. */
-var McpOAuthCredentialStore = class {
-	backend;
-	/** Directory for the refresh lock files. Without one, refreshes are only serialized in this process. */
-	lockDir;
-	constructor(backend, lockDir) {
-		this.backend = backend ?? new FileAuthStorageBackend(join(getAgentDir(), "mcp-auth.json"));
-		this.lockDir = backend ? lockDir : getAgentDir();
-	}
-	forServer(name, serverUrl) {
-		const { key, legacyKey } = storeKeys(name, serverUrl);
-		return {
-			load: () => this.backend.withLock((current) => {
-				const states = parseStates(current);
-				if (states[key] || !states[legacyKey]) return { result: states[key] };
-				states[key] = states[legacyKey];
-				delete states[legacyKey];
-				return {
-					result: states[key],
-					next: serializeStates(states)
-				};
-			}),
-			save: (state) => this.write((states) => {
-				states[key] = state;
-			}),
-			withRefreshLock: (fn) => this.withRefreshLock(key, fn)
-		};
-	}
-	/**
-	* A lock file per server. When the process exits, proper-lockfile removes the locks it holds; when
-	* it is killed, the lock goes stale because it is no longer renewed, and the next process takes it over.
-	*/
-	async withRefreshLock(key, fn) {
-		if (!this.lockDir) return fn();
-		mkdirSync(this.lockDir, {
-			recursive: true,
-			mode: 448
-		});
-		const hash = createHash("sha256").update(key).digest("hex").slice(0, 16);
-		const release = await import_proper_lockfile.default.lock(join(this.lockDir, `mcp-auth-refresh-${hash}`), {
-			realpath: false,
-			stale: REFRESH_LOCK_STALE_MS,
-			retries: {
-				retries: REFRESH_LOCK_WAIT_MS / REFRESH_LOCK_RETRY_MS,
-				factor: 1,
-				minTimeout: REFRESH_LOCK_RETRY_MS,
-				maxTimeout: REFRESH_LOCK_RETRY_MS
-			},
-			onCompromised: () => {}
-		});
-		try {
-			return await fn();
-		} finally {
-			await release().catch(() => void 0);
-		}
-	}
-	/** The stored tokens of a server, for noticing sign-ins done by another process. Does not take over legacy state. */
-	tokens(name, serverUrl) {
-		const { key, legacyKey } = storeKeys(name, serverUrl);
-		const states = this.backend.withLock((current) => ({ result: parseStates(current) }));
-		return (states[key] ?? states[legacyKey])?.tokens;
-	}
-	/** Returns whether credentials were stored for the server. Removes legacy state the server would take over. */
-	remove(name, serverUrl) {
-		const { key, legacyKey } = storeKeys(name, serverUrl);
-		return this.backend.withLock((current) => {
-			const states = parseStates(current);
-			const stored = key in states ? key : legacyKey in states ? legacyKey : void 0;
-			if (!stored) return { result: false };
-			delete states[stored];
-			return {
-				result: true,
-				next: serializeStates(states)
-			};
-		});
-	}
-	write(update) {
-		this.backend.withLock((current) => {
-			const states = parseStates(current);
-			update(states);
-			return {
-				result: void 0,
-				next: serializeStates(states)
-			};
-		});
-	}
-};
-/** `fetch` with `OAUTH_REQUEST_TIMEOUT_MS` per request, on top of the request's own signal. */
-function timedFetch(fetch = globalThis.fetch) {
-	return (input, init) => {
-		const timeout = AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS);
-		return fetch(input, {
-			...init,
-			signal: init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout
-		});
-	};
-}
-function registeredRedirectUrls(client) {
-	return client && "redirect_uris" in client ? client.redirect_uris : [];
-}
-/** 12 characters identifying an MCP server URL in callback paths, computed like Codex does. */
-function callbackId(serverUrl) {
-	const url = new URL(serverUrl);
-	url.hash = "";
-	return createHash("sha256").update(url.href).digest().subarray(0, 9).toString("base64url");
-}
-/**
-* pi's Client ID Metadata Document, for `clientRegistration: "cimd"`, chosen like Codex chooses its own.
-* The configuration ensures the default callback path. Without the `iss` parameter in authorization
-* responses (RFC 9207), the redirect URI and the document are specific to the MCP server, so a response
-* cannot be mixed up with one from another authorization server (RFC 9700 section 4.4.2.2).
-*/
-function clientMetadataDocument(serverUrl, redirectUrl, metadata) {
-	if (!metadata?.client_id_metadata_document_supported || !metadata.token_endpoint_auth_methods_supported?.includes("none")) throw new Error("The authorization server does not support Client ID Metadata Documents for public clients; remove oauth.clientRegistration \"cimd\"");
-	if (metadata.authorization_response_iss_parameter_supported) return {
-		url: `${CLIENT_METADATA_BASE_URL}/client.json`,
-		redirectUrl
-	};
-	const id = callbackId(serverUrl);
-	const redirect = new URL(redirectUrl);
-	redirect.pathname = `${CALLBACK_PATH}/${id}`;
-	return {
-		url: `${CLIENT_METADATA_BASE_URL}/${id}/client.json`,
-		redirectUrl: redirect.href
-	};
-}
-function createProvider(serverUrl, store, settings, redirectUrl, onRedirect) {
-	return new McpOAuthProvider({
-		serverUrl,
-		redirectUrl,
-		clientMetadata: { client_name: settings.clientName ?? APP_NAME },
-		clientMetadataDocument: settings.clientRegistration === "cimd" ? (metadata) => clientMetadataDocument(serverUrl, redirectUrl, metadata) : void 0,
-		clientId: settings.clientId,
-		clientSecret: settings.clientSecret,
-		store,
-		onRedirect
-	});
-}
-/**
-* Auth provider for MCP connections: sends the stored access token and refreshes it when it is about
-* to expire or after a 401. Throws `McpOAuthAuthorizationRequiredError` when the user has to sign in,
-* including when the server asks for more scope (`insufficient_scope`). `onChallenge` receives the
-* server's `WWW-Authenticate` challenge so sign-in can use its resource metadata URL and scope.
-* `settings` is only called when a refresh is needed, so a secret that fails to resolve fails the
-* refresh instead of the whole connection setup.
-*
-* Many servers rotate refresh tokens, so two refreshes with the same refresh token lose the grant.
-* Requests in this process share one refresh, and other processes are kept out by the store's
-* refresh lock, held from reading the tokens to saving new ones. Tokens that changed meanwhile
-* (another process refreshed them, or the user signed in) are used without refreshing.
-*/
-function createMcpAuthProvider(options) {
-	const { serverUrl, store } = options;
-	let refreshing;
-	/** Replace `staleToken`, the access token that expired or was rejected. */
-	const refresh = (staleToken, fetch = globalThis.fetch, challenge) => {
-		refreshing ??= store.withRefreshLock(async () => {
-			const state = await store.load();
-			if (state?.tokens?.access_token !== staleToken) return;
-			if (!state?.tokens?.refresh_token) throw new McpOAuthAuthorizationRequiredError();
-			const settings = options.settings();
-			const redirectUrl = callbackSettings(settings).fixedRedirectUrl ?? registeredRedirectUrls(state.clientInformation)[0] ?? FALLBACK_REDIRECT_URL;
-			if (await authorizeMcp(createProvider(serverUrl, store, settings, redirectUrl, () => {}), {
-				serverUrl,
-				resourceMetadataUrl: challenge?.resourceMetadataUrl,
-				authorizationServerMetadataUrl: settings.authServerMetadataUrl,
-				scope: challenge?.scope,
-				fetch: timedFetch(fetch)
-			}) === "REDIRECT") throw new McpOAuthAuthorizationRequiredError();
-		}).finally(() => {
-			refreshing = void 0;
-		});
-		return refreshing;
-	};
-	return {
-		token: async () => {
-			await refreshing?.catch(() => void 0);
-			const state = await store.load();
-			const token = state?.tokens?.access_token;
-			if (!(state?.tokensExpireAt !== void 0 && state.tokensExpireAt - REFRESH_SKEW_MS <= Date.now()) || !state?.tokens?.refresh_token) return token;
-			await refresh(token).catch(() => void 0);
-			return (await store.load())?.tokens?.access_token;
-		},
-		onUnauthorized: async (context) => {
-			const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
-			options.onChallenge(challenge);
-			if (challenge.error === "insufficient_scope") throw new McpOAuthAuthorizationRequiredError();
-			await refresh(context.token, context.fetch, challenge);
-		},
-		settled: async () => {
-			await refreshing?.catch(() => void 0);
-		}
-	};
-}
-var McpSignInCancelledError = class extends Error {
-	constructor() {
-		super("Sign-in cancelled");
-		this.name = "McpSignInCancelledError";
-	}
-};
-function responseFromRedirectUrl(input, state, redirectUrl) {
-	let url;
-	try {
-		url = new URL(input.trim());
-	} catch {
-		throw new Error("Expected the full redirect URL from the browser address bar");
-	}
-	if (url.origin !== redirectUrl.origin || url.pathname !== redirectUrl.pathname) throw new Error("The redirect URL does not match this sign-in's redirect URI");
-	const error = url.searchParams.get("error");
-	if (error) throw new Error(url.searchParams.get("error_description") ?? error);
-	if (url.searchParams.get("state") !== state) throw new Error("The redirect URL belongs to a different sign-in");
-	const code = url.searchParams.get("code");
-	if (!code) throw new Error("The redirect URL does not contain an authorization code");
-	return {
-		code,
-		iss: url.searchParams.get("iss") ?? void 0
-	};
-}
-/**
-* Wait for the browser callback or a pasted redirect URL, whichever comes first. Aborting `signal`
-* aborts the prompt, which then cancels the sign-in.
-*/
-async function waitForAuthorizationResponse(callback, state, redirectUrl, prompt, signal) {
-	const controller = new AbortController();
-	const promptSignal = signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;
-	const fromBrowser = callback.waitForCallback(state, redirectUrl.pathname);
-	const fromUser = prompt.promptForRedirectUrl(promptSignal).then((input) => {
-		if (!input?.trim()) throw new McpSignInCancelledError();
-		return responseFromRedirectUrl(input, state, redirectUrl);
-	});
-	try {
-		return await Promise.race([fromBrowser, fromUser]);
-	} finally {
-		controller.abort();
-		fromBrowser.catch(() => void 0);
-		fromUser.catch(() => void 0);
-	}
-}
-/** Listen on `port`, or on a free port when it is taken and not `required`. */
-async function listenForCallback(settings, extraPaths, port, required) {
-	const options = {
-		host: settings.host,
-		redirectHost: settings.redirectHost,
-		path: settings.path,
-		extraPaths,
-		renderPage: (page) => page.ok ? oauthSuccessHtml("Signed in to the MCP server. You may now close this page.") : oauthErrorHtml(page.message, page.details)
-	};
-	try {
-		return await OAuthCallbackServer.listen({
-			...options,
-			port: port ?? 0
-		});
-	} catch (error) {
-		if (required || port === void 0) throw error;
-		return OAuthCallbackServer.listen(options);
-	}
-}
-/**
-* Sign in to an MCP server. Uses the stored refresh token when possible; otherwise runs the browser
-* authorization code flow. Tokens are saved to `store`. Aborting `signal` stops the sign-in at any
-* step with `McpSignInCancelledError`; requests to the authorization server are also time-limited.
-*/
-async function signInMcpServer(options) {
-	const { serverUrl, store, settings, signal } = options;
-	if (signal?.aborted) throw new McpSignInCancelledError();
-	const stored = await store.load();
-	const stepUp = options.challenge?.error === "insufficient_scope";
-	const callbackOptions = callbackSettings(settings);
-	const registered = registeredRedirectUrls(stored?.clientInformation)[0];
-	const preferredPort = callbackOptions.port ?? (registered ? Number(new URL(registered).port) || void 0 : void 0);
-	const cimd = settings.clientRegistration === "cimd";
-	const callback = await listenForCallback(callbackOptions, cimd ? [`${CALLBACK_PATH}/${callbackId(serverUrl)}`] : [], preferredPort, callbackOptions.port !== void 0);
-	const redirectUrl = callbackOptions.fixedRedirectUrl ?? callback.redirectUrl;
-	try {
-		if (stored) {
-			const next = { ...stored };
-			delete next.oauthState;
-			if (!(settings.clientId || (cimd ? !stored.clientInformation : registeredRedirectUrls(stored.clientInformation).includes(redirectUrl)))) {
-				delete next.clientInformation;
-				delete next.tokens;
-				delete next.tokensExpireAt;
-			}
-			await store.save(next);
-		}
-		let authorizationUrl;
-		const provider = createProvider(serverUrl, store, settings, redirectUrl, (url) => {
-			authorizationUrl = url;
-		});
-		const flow = {
-			serverUrl,
-			fetch: timedFetch(),
-			signal,
-			resourceMetadataUrl: options.challenge?.resourceMetadataUrl,
-			authorizationServerMetadataUrl: settings.authServerMetadataUrl,
-			scope: mergeScopes(settings.scope, stepUp ? stepUpScope(stored?.tokens?.scope, options.challenge?.scope) : options.challenge?.scope)
-		};
-		const skipRefresh = stepUp;
-		if (await authorizeMcp(provider, {
-			...flow,
-			skipRefresh
-		}) === "AUTHORIZED") return;
-		if (!authorizationUrl) throw new Error("OAuth flow did not produce an authorization URL");
-		const state = await provider.state();
-		const authorizationRedirectUrl = new URL(authorizationUrl.searchParams.get("redirect_uri") ?? redirectUrl);
-		options.prompt.showAuthorizationUrl(authorizationUrl);
-		const { code, iss } = await waitForAuthorizationResponse(callback, state, authorizationRedirectUrl, options.prompt, signal);
-		await authorizeMcp(provider, {
-			...flow,
-			authorizationCode: code,
-			iss
-		});
-	} catch (error) {
-		if (signal?.aborted) throw new McpSignInCancelledError();
-		throw error;
-	} finally {
-		await callback.close();
-	}
-}
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-coding-agent@1.2.0_@aws-sdk+credential-provider-node@3.972.86_@model_cb83c1bd7a7ff5cede8c43e329c5cf76/node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/log.js
-/**
-* Log messages MCP servers send with `notifications/message`, appended to `mcp.log` in the agent
-* directory. Several pi processes may write to the same file, so every message is one synchronous
-* append. The file is rotated to `mcp.log.1` once it grows past `MAX_LOG_BYTES`.
-*/
-const MAX_LOG_BYTES = 5242880;
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function formatData(data) {
-	if (typeof data === "string") return data;
-	try {
-		return JSON.stringify(data) ?? String(data);
-	} catch {
-		return String(data);
-	}
-}
-/** Format one `notifications/message` from `server` as a log line; continuation lines are indented. */
-function formatMcpLogMessage(server, params, now = /* @__PURE__ */ new Date()) {
-	const message = isRecord(params) ? params : { data: params };
-	const level = typeof message.level === "string" ? message.level : "info";
-	const logger = typeof message.logger === "string" && message.logger ? ` ${message.logger}:` : "";
-	const text = formatData(message.data).replace(/\r?\n/g, "\n    ");
-	return `${now.toISOString()} [${server}] ${level}${logger} ${text}\n`;
-}
-/** Appends server log messages to one file. Write errors are ignored: logging must not break tools. */
-var McpServerLog = class {
-	path;
-	size;
-	constructor(path) {
-		this.path = path;
-	}
-	write(server, params) {
-		const line = formatMcpLogMessage(server, params);
-		try {
-			if (this.size === void 0) {
-				mkdirSync(dirname(this.path), { recursive: true });
-				this.size = this.currentSize();
-			}
-			if (this.size > MAX_LOG_BYTES) {
-				if (this.currentSize() > MAX_LOG_BYTES) renameSync(this.path, `${this.path}.1`);
-				this.size = this.currentSize();
-			}
-			appendFileSync(this.path, line);
-			this.size += Buffer.byteLength(line);
-		} catch {}
-	}
-	currentSize() {
-		try {
-			return statSync(this.path).size;
-		} catch {
-			return 0;
-		}
-	}
-};
-//#endregion
-//#region node_modules/.pnpm/@earendil-works+pi-coding-agent@1.2.0_@aws-sdk+credential-provider-node@3.972.86_@model_cb83c1bd7a7ff5cede8c43e329c5cf76/node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/runtime.js
-/**
-* The part of the MCP integration that talks to servers: connections, transports, and OAuth
-* sign-in. It pulls in the MCP client, so index.ts loads it through runtime.lazy.ts only when a
-* server is configured.
-*/
-const DEFAULT_TIMEOUT_SECONDS = 60;
-/** Delays between attempts to connect to an HTTP server that failed with a transient error. */
-const CONNECT_RETRY_DELAYS_MS = [250, 1e3];
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-/** Network failures and overloaded or restarting servers, which are worth another attempt. */
-function isTransientError(error) {
-	if (error instanceof McpHttpError) return error.status === 408 || error.status === 429 || error.status >= 500 && error.status !== 501;
-	return error instanceof TypeError;
-}
-function signInRequiredMessage(entry) {
-	const provider = "url" in entry.config ? entry.config.auth?.provider : void 0;
-	return `MCP server "${entry.name}" requires sign-in. Run ${provider ? `/login ${provider}` : "/mcp"} to sign in.`;
-}
-/** HTTP servers authenticate with OAuth unless the config supplies an `Authorization` header or `auth`. */
-function usesOAuth(entry) {
-	const { config } = entry;
-	if (!("url" in config) || config.auth) return false;
-	return !Object.keys(config.headers ?? {}).some((header) => header.toLowerCase() === "authorization");
-}
-/** `~` and `~/…` (also `~\…` on Windows) name the home directory, like in a shell. */
-function expandHome(value) {
-	if (value === "~") return homedir();
-	if (value.startsWith("~/") || process.platform === "win32" && value.startsWith("~\\")) return join(homedir(), value.slice(2));
-	return value;
-}
-function createDefaultTransport(entry, cwd, authProvider) {
-	const { config, name } = entry;
-	if ("url" in config) return new StreamableHttpTransport({
-		url: config.url,
-		headers: resolveHeadersOrThrow(config.headers, `MCP server "${name}"`),
-		authProvider
-	});
-	const env = {};
-	for (const [key, value] of Object.entries(config.env ?? {})) env[key] = resolveConfigValueOrThrow(value, `MCP server "${name}" env "${key}"`);
-	return new StdioTransport({
-		command: expandHome(config.command),
-		args: config.args?.map(expandHome),
-		cwd: resolve(cwd, expandHome(config.cwd ?? ".")),
-		env,
-		stderr: "pipe"
-	});
-}
-/** Servers that do not implement `resources/templates/list` have no templates. */
-async function withoutTemplates(list, empty) {
-	try {
-		return await list();
-	} catch (error) {
-		if (error instanceof McpError && error.code === JSON_RPC_ERROR_CODES.methodNotFound) return empty;
-		throw error;
-	}
-}
-function listTemplates(client, options = {}) {
-	return withoutTemplates(() => client.listResourceTemplates(options), []);
-}
-/** One configured server. Reconnects lazily when a call finds the connection gone. */
-var McpServerConnection = class {
-	entry;
-	state = "connecting";
-	error;
-	tools = [];
-	/**
-	* Whether the server offers resources, which the resource tools list and read on demand. They are
-	* not listed at connect: listing every resource can take long (a large drive, say).
-	*/
-	hasResources = false;
-	/** Server instructions from `initialize`, describing its tools as a group. */
-	instructions;
-	/** Last OAuth challenge from the server; sign-in uses its resource metadata URL and scope. */
-	challenge;
-	client;
-	opening;
-	/** Aborted by `close()`; cancels a connect in progress, including the wait between retries. */
-	shutdown = new AbortController();
-	/** Stderr of the last stdio server that failed to connect. */
-	stderrTail;
-	cwd;
-	createTransport;
-	authProvider;
-	onTools;
-	onChange;
-	log;
-	constructor(options) {
-		this.entry = options.entry;
-		this.cwd = options.cwd;
-		this.createTransport = options.createTransport;
-		this.onTools = options.onTools;
-		this.onChange = options.onChange;
-		this.log = options.log;
-		const url = this.oauthUrl;
-		const provider = "url" in this.entry.config ? this.entry.config.auth?.provider : void 0;
-		this.authProvider = url ? createMcpAuthProvider({
-			serverUrl: url,
-			store: options.credentials.forServer(this.entry.name, url),
-			settings: () => this.oauthSettings(),
-			onChallenge: (challenge) => {
-				this.challenge = challenge;
-			}
-		}) : provider ? {
-			token: async () => options.providerToken?.(provider),
-			settled: async () => {}
-		} : void 0;
-	}
-	get name() {
-		return this.entry.name;
-	}
-	get closed() {
-		return this.shutdown.signal.aborted;
-	}
-	get timeoutMs() {
-		return (this.entry.config.timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1e3;
-	}
-	/** Server URL when the server authenticates with OAuth. */
-	get oauthUrl() {
-		return usesOAuth(this.entry) && "url" in this.entry.config ? this.entry.config.url : void 0;
-	}
-	oauthSettings() {
-		const oauth = "url" in this.entry.config ? this.entry.config.oauth : void 0;
-		if (!oauth) return {};
-		return {
-			clientId: oauth.clientId,
-			clientSecret: oauth.clientSecret === void 0 ? void 0 : resolveConfigValueOrThrow(oauth.clientSecret, `MCP server "${this.entry.name}" oauth.clientSecret`),
-			callbackPort: oauth.callbackPort,
-			callbackUrl: oauth.callbackUrl,
-			scope: oauth.scope,
-			clientName: oauth.clientName,
-			clientRegistration: oauth.clientRegistration,
-			authServerMetadataUrl: oauth.authServerMetadataUrl ? new URL(oauth.authServerMetadataUrl) : void 0
-		};
-	}
-	getClient() {
-		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error(`MCP server "${this.entry.name}" is shut down`));
-		if (this.client?.connectionState === "connected") return Promise.resolve(this.client);
-		this.opening ??= this.open().finally(() => {
-			this.opening = void 0;
-		});
-		return this.opening;
-	}
-	callTool(name, args, options) {
-		return this.withClient((client) => client.callTool(name, args, options));
-	}
-	readResource(uri, options) {
-		return this.withClient((client) => client.readResource(uri, options), true);
-	}
-	resourcesPage(cursor, options) {
-		return this.withClient((client) => client.listResourcesPage(cursor, options), true);
-	}
-	resourceTemplatesPage(cursor, options) {
-		return this.withClient((client) => withoutTemplates(() => client.listResourceTemplatesPage(cursor, options), { resourceTemplates: [] }), true);
-	}
-	allResources(options) {
-		return this.withClient((client) => client.listResources(options), true);
-	}
-	allResourceTemplates(options) {
-		return this.withClient((client) => listTemplates(client, options), true);
-	}
-	/**
-	* Run a request, reconnecting when needed. `readOnly` requests are retried once after a transient
-	* HTTP error; tool calls are not, since they may have run.
-	*/
-	async withClient(run, readOnly = false) {
-		for (let attempt = 1;; attempt++) {
-			const client = await this.getClient();
-			try {
-				return await run(client);
-			} catch (error) {
-				if (readOnly && attempt === 1 && error instanceof McpHttpError && isTransientError(error)) {
-					await new Promise((resolve) => setTimeout(resolve, CONNECT_RETRY_DELAYS_MS[0]));
-					continue;
-				}
-				if (error instanceof McpSessionExpiredError && attempt === 1) {
-					if (this.client === client) this.client = void 0;
-					continue;
-				}
-				if (!this.needsSignIn(error)) throw error;
-				await this.dropClient(client);
-				this.markNeedsAuth();
-				throw new Error(signInRequiredMessage(this.entry));
-			}
-		}
-	}
-	/** Connect again with fresh credentials, for example after signing in. */
-	async reconnect() {
-		await this.opening?.catch(() => void 0);
-		if (this.client) await this.dropClient(this.client);
-		await this.getClient();
-	}
-	/** Disconnect after the stored credentials were removed. */
-	async signOut() {
-		await this.opening?.catch(() => void 0);
-		if (this.client) await this.dropClient(this.client);
-		if (!this.closed) this.markNeedsAuth();
-	}
-	/** OAuth servers that still reject the request after a refresh need the user to sign in again. */
-	needsSignIn(error) {
-		return error instanceof McpOAuthAuthorizationRequiredError || this.authProvider !== void 0 && error instanceof McpAuthRequiredError;
-	}
-	markNeedsAuth() {
-		this.state = "needs-auth";
-		this.error = void 0;
-		this.changed();
-	}
-	changed() {
-		this.onChange?.(this);
-	}
-	async dropClient(client) {
-		if (this.client === client) this.client = void 0;
-		await client.close().catch(() => void 0);
-	}
-	async open() {
-		this.state = "connecting";
-		this.changed();
-		const retries = "url" in this.entry.config ? CONNECT_RETRY_DELAYS_MS : [];
-		for (let attempt = 0;; attempt++) {
-			this.stderrTail = void 0;
-			try {
-				return await this.connectOnce();
-			} catch (error) {
-				const delay = retries[attempt];
-				if (this.closed || delay === void 0 || !isTransientError(error)) throw this.connectFailed(error);
-				await setTimeout$1(delay, void 0, { signal: this.shutdown.signal }).catch(() => void 0);
-				if (this.closed) throw this.connectFailed(error);
-			}
-		}
-	}
-	async connectOnce() {
-		const client = new McpClient({
-			name: "pi",
-			version: VERSION,
-			requestTimeoutMs: this.timeoutMs,
-			roots: [{
-				uri: pathToFileURL(this.cwd).href,
-				name: basename(this.cwd)
-			}]
-		});
-		const log = this.log;
-		if (log) client.onNotification("notifications/message", (params) => log.write(this.entry.name, params));
-		let closing;
-		const closeClient = () => {
-			closing ??= client.close().catch(() => void 0);
-			return closing;
-		};
-		this.shutdown.signal.addEventListener("abort", closeClient, { once: true });
-		let transport;
-		try {
-			transport = this.createTransport(this.entry, this.cwd, this.authProvider);
-			await client.connect(transport);
-			client.onNotification("notifications/tools/list_changed", () => {
-				this.refreshTools(client);
-			});
-			const stdio = transport instanceof StdioTransport ? transport : void 0;
-			client.onClose(() => this.handleClientClose(client, stdio));
-			const tools = client.serverCapabilities?.tools ? await client.listTools() : [];
-			if (this.closed) throw new Error("shut down while connecting");
-			if (client.connectionState !== "connected") throw new Error("connection closed during setup");
-			this.client = client;
-			this.tools = tools;
-			this.hasResources = client.serverCapabilities?.resources !== void 0;
-			this.instructions = client.instructions?.trim() || void 0;
-			this.state = "connected";
-			this.error = void 0;
-			this.onTools(this);
-			this.changed();
-			return client;
-		} catch (error) {
-			await closeClient();
-			if (transport instanceof StdioTransport) this.stderrTail = transport.stderr.trim().slice(-2e3) || void 0;
-			throw error;
-		} finally {
-			this.shutdown.signal.removeEventListener("abort", closeClient);
-		}
-	}
-	connectFailed(error) {
-		if (this.needsSignIn(error) && !this.closed) {
-			this.markNeedsAuth();
-			return new Error(signInRequiredMessage(this.entry));
-		}
-		this.state = this.closed ? "closed" : "failed";
-		this.error = this.stderrTail ? `${errorMessage(error)}\n${this.stderrTail}` : errorMessage(error);
-		this.changed();
-		return /* @__PURE__ */ new Error(`MCP server "${this.entry.name}" failed to connect: ${this.error}`);
-	}
-	/** The transport dropped. The next call reconnects; until then the status shows why. */
-	handleClientClose(client, stdio) {
-		if (this.client !== client || this.closed) return;
-		this.client = void 0;
-		this.state = "disconnected";
-		const stderr = stdio?.stderr.trim().slice(-2e3);
-		this.error = stderr ? `Connection closed\n${stderr}` : "Connection closed";
-		this.changed();
-	}
-	async refreshTools(client) {
-		try {
-			const tools = await client.listTools();
-			if (this.client !== client || this.closed) return;
-			this.tools = tools;
-			this.onTools(this);
-		} catch (error) {
-			this.error = `Failed to refresh tools: ${errorMessage(error)}`;
-		}
-		this.changed();
-	}
-	/** Resolves once no transport of this server is open, including one that was still connecting. */
-	async close() {
-		this.shutdown.abort();
-		this.state = "closed";
-		this.changed();
-		const client = this.client;
-		this.client = void 0;
-		await Promise.all([client?.close().catch(() => void 0), this.opening?.catch(() => void 0)]);
-		await this.authProvider?.settled();
-	}
-};
-//#endregion
-export { McpOAuthCredentialStore, McpServerConnection, McpServerLog, McpSignInCancelledError, createDefaultTransport, signInMcpServer };