@binaryandthread/mcp 0.1.0

package/dist/bin.js

@@ -0,0 +1,1076 @@
+#!/usr/bin/env node
+
+// ../store-client/dist/index.js
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "authorization",
+  "token",
+  "access_token",
+  "refresh_token",
+  "jwt",
+  "idempotency-key",
+  "x-publishable-api-key",
+  "password",
+  "secret",
+  "cookie",
+  "set-cookie"
+]);
+var MASK = "[REDACTED]";
+var BEARER_RE = /Bearer\s+[A-Za-z0-9._\-]+/gi;
+var EMAIL_RE = /([^\s@]+)@([^\s@]+\.[^\s@]+)/g;
+function maskEmail(email) {
+  const at = email.indexOf("@");
+  if (at <= 0) {
+    return email;
+  }
+  const local = email.slice(0, at);
+  const host = email.slice(at + 1);
+  const localMasked = local[0] + "*".repeat(Math.max(2, local.length - 1));
+  const hostMasked = host.length > 0 ? host[0] : "x";
+  return `${localMasked}@${hostMasked}`;
+}
+function redactString(s) {
+  return s.replace(BEARER_RE, "Bearer [REDACTED]").replace(
+    EMAIL_RE,
+    (_m, _l, _h) => maskEmail(`${_l}@${_h}`)
+  );
+}
+function redact(input, _seen) {
+  if (input == null) {
+    return input;
+  }
+  if (typeof input === "string") {
+    return redactString(input);
+  }
+  if (typeof input !== "object") {
+    return input;
+  }
+  const seen = _seen ?? /* @__PURE__ */ new WeakSet();
+  if (seen.has(input)) {
+    return input;
+  }
+  seen.add(input);
+  if (Array.isArray(input)) {
+    return input.map((v) => redact(v, seen));
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (SENSITIVE_KEYS.has(key.toLowerCase())) {
+      out[key] = MASK;
+    } else if (key.toLowerCase() === "email" && typeof value === "string") {
+      out[key] = maskEmail(value);
+    } else {
+      out[key] = redact(value, seen);
+    }
+  }
+  return out;
+}
+var DEFAULT_RETRY = {
+  attempts: 3,
+  baseDelayMs: 200,
+  maxDelayMs: 2e3
+};
+var RETRY_AFTER_MAX_MS = 1e4;
+function parseRetryAfterMs(res) {
+  let raw = null;
+  try {
+    raw = res.headers?.get?.("retry-after") ?? null;
+  } catch {
+    return null;
+  }
+  if (!raw) {
+    return null;
+  }
+  const secs = Number(raw);
+  let ms;
+  if (Number.isFinite(secs)) {
+    ms = secs * 1e3;
+  } else {
+    const dateMs = Date.parse(raw);
+    if (!Number.isFinite(dateMs)) {
+      return null;
+    }
+    ms = dateMs - Date.now();
+  }
+  return Math.min(Math.max(0, ms), RETRY_AFTER_MAX_MS);
+}
+var RecoverableCartError = class extends Error {
+  recoverable = true;
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "RecoverableCartError";
+    this.status = status;
+  }
+};
+var StoreApiError = class extends Error {
+  status;
+  path;
+  constructor(message, status, path) {
+    super(message);
+    this.name = "StoreApiError";
+    this.status = status;
+    this.path = path;
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function newUuid() {
+  const g = globalThis;
+  if (g.crypto?.randomUUID) {
+    return g.crypto.randomUUID();
+  }
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    const v = c === "x" ? r : r & 3 | 8;
+    return v.toString(16);
+  });
+}
+var StoreClient = class {
+  baseUrl;
+  publishableKey;
+  jwt;
+  fetchImpl;
+  logger;
+  retry;
+  sleepImpl;
+  /** Cached resolved regions (read-only catalog optimisation). */
+  regionsCache = null;
+  constructor(opts) {
+    if (!opts.baseUrl) {
+      throw new Error("StoreClient: baseUrl is required");
+    }
+    if (!opts.publishableKey) {
+      throw new Error("StoreClient: publishableKey is required");
+    }
+    if (/^sk_/.test(opts.publishableKey)) {
+      throw new Error("StoreClient: refusing a secret key \u2014 the client carries only the publishable key (T6)");
+    }
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.publishableKey = opts.publishableKey;
+    this.jwt = opts.jwt;
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    this.logger = opts.logger ?? console;
+    this.retry = { ...DEFAULT_RETRY, ...opts.retry ?? {} };
+    this.sleepImpl = opts.sleepImpl ?? sleep;
+  }
+  // ----- the request engine --------------------------------------------------
+  buildUrl(path, query) {
+    const url = new URL(this.baseUrl + path);
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0 && v !== null && v !== "") {
+          url.searchParams.set(k, String(v));
+        }
+      }
+    }
+    return url.toString();
+  }
+  baseHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      "x-publishable-api-key": this.publishableKey
+    };
+    if (this.jwt) {
+      headers["Authorization"] = `Bearer ${this.jwt}`;
+    }
+    return headers;
+  }
+  backoffMs(attemptIndex) {
+    const exp = this.retry.baseDelayMs * 2 ** attemptIndex;
+    const capped = Math.min(exp, this.retry.maxDelayMs);
+    return Math.floor(Math.random() * (capped + 1));
+  }
+  async request(method, path, opts = {}) {
+    const headers = this.baseHeaders();
+    if (opts.idempotent) {
+      headers["Idempotency-Key"] = newUuid();
+    }
+    const url = this.buildUrl(path, opts.query);
+    const init = {
+      method,
+      headers,
+      ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+    };
+    let lastErr;
+    for (let attempt = 0; attempt < this.retry.attempts; attempt++) {
+      let retryAfterMs = null;
+      try {
+        const res = await this.fetchImpl(url, init);
+        if (res.ok) {
+          const text = await res.text();
+          return text ? JSON.parse(text) : {};
+        }
+        let parsed = {};
+        try {
+          const t = await res.text();
+          parsed = t ? JSON.parse(t) : {};
+        } catch {
+          parsed = {};
+        }
+        if (opts.cartRecovery && (res.status === 404 || res.status === 409 || String(parsed.type ?? "").includes("cart.completed") || /cart.*complete/i.test(String(parsed.message ?? "")))) {
+          throw new RecoverableCartError(
+            `cart is stale or completed (HTTP ${res.status})`,
+            res.status
+          );
+        }
+        if (res.status === 429) {
+          retryAfterMs = parseRetryAfterMs(res);
+          lastErr = new StoreApiError(`rate limited (HTTP 429)`, 429, path);
+          this.logWarn("store.request.rate_limited", {
+            path,
+            attempt: attempt + 1,
+            retryAfterMs
+          });
+        } else if (res.status >= 400 && res.status < 500) {
+          if (!(opts.expected4xx ?? []).includes(res.status)) {
+            this.logError("store.request.client_error", { path, status: res.status, body: parsed });
+          }
+          throw new StoreApiError(
+            `request failed (HTTP ${res.status})`,
+            res.status,
+            path
+          );
+        } else {
+          lastErr = new StoreApiError(`upstream error (HTTP ${res.status})`, res.status, path);
+          this.logWarn("store.request.retryable", { path, status: res.status, attempt: attempt + 1 });
+        }
+      } catch (e) {
+        if (e instanceof RecoverableCartError) {
+          throw e;
+        }
+        if (e instanceof StoreApiError && e.status >= 400 && e.status < 500) {
+          throw e;
+        }
+        lastErr = e;
+        this.logWarn("store.request.network_retry", { path, attempt: attempt + 1 });
+      }
+      if (attempt < this.retry.attempts - 1) {
+        await this.sleepImpl(retryAfterMs ?? this.backoffMs(attempt));
+      }
+    }
+    this.logError("store.request.exhausted", { path, attempts: this.retry.attempts });
+    if (lastErr instanceof StoreApiError) {
+      throw lastErr;
+    }
+    throw new StoreApiError(
+      `request failed after ${this.retry.attempts} attempts: ${path}`,
+      0,
+      path
+    );
+  }
+  logWarn(event, ctx) {
+    this.logger.warn(event, redact(ctx));
+  }
+  logError(event, ctx) {
+    this.logger.error(event, redact(ctx));
+  }
+  // ----- regions (F-A2 / INV-11) ---------------------------------------------
+  async getRegions() {
+    const data = await this.request("GET", "/store/regions");
+    this.regionsCache = data.regions ?? [];
+    return this.regionsCache;
+  }
+  /**
+   * Resolve a region by country code, falling back to region #1.
+   * SEK is region #1 by configuration — NEVER a hardcoded literal.
+   */
+  async resolveRegion(countryCode) {
+    const regions = this.regionsCache ?? await this.getRegions();
+    if (regions.length === 0) {
+      throw new Error("no regions configured \u2014 cannot resolve a region for pricing");
+    }
+    if (countryCode) {
+      const cc = countryCode.toLowerCase();
+      const match = regions.find(
+        (r) => (r.countries ?? []).some((c) => (c.iso_2 ?? "").toLowerCase() === cc)
+      );
+      if (match) {
+        return match;
+      }
+    }
+    return regions[0];
+  }
+  // ----- products (region resolved BEFORE pricing) ---------------------------
+  async listProducts(opts) {
+    const region = opts?.region ?? await this.resolveRegion(opts?.countryCode);
+    const data = await this.request("GET", "/store/products", {
+      query: { region_id: region.id, limit: 100 }
+    });
+    return data.products ?? [];
+  }
+  async getProduct(handle, opts) {
+    const region = opts?.region ?? await this.resolveRegion(opts?.countryCode);
+    const data = await this.request("GET", "/store/products", {
+      query: { handle, region_id: region.id, limit: 1 }
+    });
+    return (data.products ?? [])[0] ?? null;
+  }
+  // ----- cart (mutations carry Idempotency-Key) ------------------------------
+  async createCart(region) {
+    const data = await this.request("POST", "/store/carts", {
+      idempotent: true,
+      body: { region_id: region.id }
+    });
+    return data.cart;
+  }
+  async addLineItem(cartId, variantId, quantity) {
+    const data = await this.request(
+      "POST",
+      `/store/carts/${encodeURIComponent(cartId)}/line-items`,
+      {
+        idempotent: true,
+        cartRecovery: true,
+        body: { variant_id: variantId, quantity }
+      }
+    );
+    return data.cart;
+  }
+  async getCart(cartId) {
+    const data = await this.request(
+      "GET",
+      `/store/carts/${encodeURIComponent(cartId)}`,
+      { cartRecovery: true }
+    );
+    return data.cart;
+  }
+  /** Remove a staged line item (bt unstage). Returns the updated cart (Medusa's `parent`). */
+  async removeLineItem(cartId, itemId) {
+    const data = await this.request(
+      "DELETE",
+      `/store/carts/${encodeURIComponent(cartId)}/line-items/${encodeURIComponent(itemId)}`,
+      { idempotent: true, cartRecovery: true }
+    );
+    return data.parent ?? data.cart;
+  }
+  /**
+   * Ensure the cart has a shipping method before checkout (BUG 1 — the headless
+   * /store/headless/checkout route guards on it, and neither client ever set one).
+   *
+   * - Idempotent: if the cart already carries a shipping method, no-op (no POST).
+   * - Lists options via the STANDARD store route GET /store/shipping-options?cart_id=…
+   *   (NOT a /headless route — standard routes are always available, no kill-switch).
+   * - Picks deterministically: exactly one → use it; several → the cheapest by amount.
+   * - The SE launch option is region-scoped (price_type:"flat"), so listing by cart_id
+   *   returns it without a shipping address being set first (confirmed: seed-shipping.ts).
+   *
+   * TODO(04.5): buyer-choice / intl multiple shipping options — today we auto-pick the
+   * cheapest; an explicit buyer chooser belongs to the Phase-6 international pass.
+   */
+  async ensureCartShippingMethod(cartId) {
+    const cart = await this.getCart(cartId);
+    if (cart.shipping_methods && cart.shipping_methods.length > 0) {
+      return cart;
+    }
+    const data = await this.request(
+      "GET",
+      "/store/shipping-options",
+      { query: { cart_id: cartId } }
+    );
+    const options = data.shipping_options ?? [];
+    if (options.length === 0) {
+      throw new Error(
+        "no shipping option is available for this cart \u2014 cannot attach a shipping method"
+      );
+    }
+    const chosen = options.length === 1 ? options[0] : [...options].sort(
+      (a, b) => (a.amount ?? Number.POSITIVE_INFINITY) - (b.amount ?? Number.POSITIVE_INFINITY)
+    )[0];
+    const res = await this.request(
+      "POST",
+      `/store/carts/${encodeURIComponent(cartId)}/shipping-methods`,
+      {
+        idempotent: true,
+        cartRecovery: true,
+        body: { option_id: chosen.id }
+      }
+    );
+    return res.cart;
+  }
+  // ----- headless contract (04.5-01) -----------------------------------------
+  async mintCheckout(cartId, email, channel = "cli") {
+    return this.request("POST", "/store/headless/checkout", {
+      idempotent: true,
+      body: { cart_id: cartId, email, channel }
+    });
+  }
+  async poll(sessionId) {
+    return this.request(
+      "GET",
+      `/store/headless/poll/${encodeURIComponent(sessionId)}`
+    );
+  }
+  /** JWT-bound: returns the authenticated customer's own profile (G2). */
+  async whoami() {
+    return this.request("GET", "/store/headless/whoami", { expected4xx: [401, 403] });
+  }
+  // ----- magic-link auth (04.5-05) -------------------------------------------
+  // Passwordless login — magic-link is the only grant (Medusa has no OAuth pairing-grant, G1).
+  // request-link emails a single-use link; verify exchanges the link's token for a customer-scoped
+  // JWT. The JWT is stored in the OS keychain by the CLI — never here, never in plaintext config (G7/G8).
+  /** Start a magic-link login. Returns a UNIFORM ack regardless of whether the email exists (G12). */
+  async requestMagicLink(email) {
+    return this.request("POST", "/store/headless/auth/request-link", {
+      idempotent: true,
+      body: { email }
+    });
+  }
+  /** Exchange a magic-link token for a customer-scoped JWT (the customer is materialized server-side). */
+  async verifyMagicLink(token) {
+    return this.request("POST", "/store/headless/auth/verify", {
+      idempotent: true,
+      body: { token }
+    });
+  }
+  async listDrops() {
+    const data = await this.request(
+      "GET",
+      "/store/headless/drops"
+    );
+    return data.drops ?? [];
+  }
+  /**
+   * File a developer bug report (d14 — `bt report` / MCP report_issue). Returns a correlation
+   * reference. Additive: no money/cart path. The backend redacts authoritatively; callers SHOULD
+   * pass an already-redacted context (the doctor snapshot). A mutation → carries an Idempotency-Key
+   * so a retry can't email the report twice.
+   */
+  async report(message, context) {
+    return this.request("POST", "/store/headless/report", {
+      idempotent: true,
+      body: { message, ...context !== void 0 ? { context } : {} }
+    });
+  }
+  /**
+   * The authenticated customer's order history (d13 — `bt log`). JWT-bound; the backend derives the
+   * customer from the bearer token and returns MINIMAL fields (status/timeline only — never
+   * email/address, F-H3). A guest (no/expired JWT) gets a 401 — the EXPECTED unauthenticated branch
+   * we turn into the honest empty history (`[]`), NOT an error to dump (BUG 3).
+   */
+  async listOrders() {
+    try {
+      const data = await this.request("GET", "/store/headless/orders", {
+        expected4xx: [401, 403]
+      });
+      return data.orders ?? [];
+    } catch (e) {
+      if (e instanceof StoreApiError && (e.status === 401 || e.status === 403)) {
+        return [];
+      }
+      throw e;
+    }
+  }
+  /**
+   * Guest order lookup — requires order display id + EXACT email (F-H1).
+   * The backend returns 404 on a mismatch (no enumeration); the client surfaces null.
+   */
+  async getOrder(displayId, email) {
+    try {
+      return await this.request("GET", "/store/orders", {
+        query: { display_id: String(displayId), email }
+      });
+    } catch (e) {
+      if (e instanceof StoreApiError && e.status === 404) {
+        return null;
+      }
+      throw e;
+    }
+  }
+};
+var BT_DEFAULT_STORE_URL = "https://backend-production-511f5.up.railway.app";
+var BT_DEFAULT_PUBLISHABLE_KEY = "pk_0d7d706860568a0414dff0436aadb9713a2609de3a1b153ef2a6f9694d23f907";
+var BLOB_HOST_ALLOWLIST = [
+  "blob.vercel-storage.com"
+  // matches the exact host + *.blob.vercel-storage.com (dot-delimited subdomains only)
+];
+function isAllowedImageHost(url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return BLOB_HOST_ALLOWLIST.some(
+    (allowed) => host === allowed || host.endsWith("." + allowed)
+  );
+}
+function variantColour(v) {
+  const opt = (v.options ?? []).find(
+    (o) => (o.option?.title ?? "").toLowerCase() === "colour" || (o.option?.title ?? "").toLowerCase() === "color"
+  );
+  if (opt && typeof opt.value === "string" && opt.value.trim()) {
+    return opt.value.trim().toLowerCase();
+  }
+  const title = (v.title ?? "").trim();
+  if (title.includes("/")) {
+    const parts = title.split("/").map((p) => p.trim());
+    const tail = parts[parts.length - 1];
+    if (tail) return tail.toLowerCase();
+  }
+  return null;
+}
+function productColours(p) {
+  const seen = [];
+  for (const v of p.variants ?? []) {
+    const c = variantColour(v);
+    if (c && !seen.includes(c)) {
+      seen.push(c);
+    }
+  }
+  return seen;
+}
+function sizesForColour(p, colour) {
+  const target = colour.trim().toLowerCase();
+  const sizes = [];
+  for (const v of p.variants ?? []) {
+    if (variantColour(v) !== target) continue;
+    const size = sizeOfVariant(v);
+    if (size && !sizes.includes(size)) {
+      sizes.push(size);
+    }
+  }
+  return sizes;
+}
+function sizeOfVariant(v) {
+  const opt = (v.options ?? []).find((o) => (o.option?.title ?? "").toLowerCase() === "size");
+  if (opt && typeof opt.value === "string" && opt.value.trim()) {
+    return opt.value.trim();
+  }
+  const title = (v.title ?? "").trim();
+  if (title.includes("/")) {
+    const head = title.split("/")[0]?.trim();
+    if (head) return head;
+  }
+  return title || null;
+}
+function findVariant(p, opts = {}) {
+  const variants = p.variants ?? [];
+  const size = opts.size?.trim().toLowerCase();
+  const colour = opts.colour?.trim().toLowerCase();
+  const sizeMatches = (v) => {
+    if (!size) return true;
+    return (sizeOfVariant(v) ?? "").toLowerCase() === size || (v.title ?? "").toLowerCase() === size;
+  };
+  const colourMatches = (v) => {
+    if (!colour) return true;
+    return variantColour(v) === colour;
+  };
+  if (size && colour) {
+    return variants.find((v) => sizeMatches(v) && colourMatches(v));
+  }
+  if (colour && !size) {
+    return variants.find((v) => colourMatches(v));
+  }
+  if (size && !colour) {
+    return variants.find((v) => sizeMatches(v)) ?? variants[0];
+  }
+  return variants[0];
+}
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+var SERVER_INFO = {
+  name: "binary-and-thread",
+  version: "0.1.0"
+};
+function buildServer(tools) {
+  const server = new McpServer(SERVER_INFO);
+  const toolNames = [];
+  const register = server.registerTool.bind(server);
+  for (const t of tools) {
+    register(
+      t.name,
+      { description: t.description, inputSchema: t.inputSchema },
+      // The SDK validates args against inputSchema before calling us. We hand the parsed args to
+      // the deterministic handler and return its content blocks (+ optional structuredContent, d9).
+      async (args) => {
+        const res = await t.handler(args ?? {});
+        return {
+          content: res.content,
+          ...res.isError ? { isError: true } : {},
+          ...res.structuredContent ? { structuredContent: res.structuredContent } : {}
+        };
+      }
+    );
+    toolNames.push(t.name);
+  }
+  return { server, toolNames };
+}
+async function startServer(tools) {
+  const { server } = buildServer(tools);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  return server;
+}
+
+// src/tools.ts
+import { z } from "zod";
+
+// src/sanitize.ts
+var DEFAULT_MAX = 500;
+var CONTROL_RE = /[\x00-\x1F\x7F-\x9F]/g;
+function sanitize(s, max = DEFAULT_MAX) {
+  if (typeof s !== "string") {
+    return "";
+  }
+  const stripped = s.replace(CONTROL_RE, " ").replace(/\s+/g, " ").trim();
+  if (stripped.length <= max) {
+    return stripped;
+  }
+  return stripped.slice(0, max) + "\u2026";
+}
+function redactForOutput(obj) {
+  return redact(obj);
+}
+
+// src/images.ts
+var IMAGE_BYTE_CAP = 2 * 1024 * 1024;
+var IMAGE_FETCH_TIMEOUT_MS = 5e3;
+function urlOnly(blobUrl) {
+  return [{ type: "text", text: blobUrl }];
+}
+function unavailable(blobUrl) {
+  return [{ type: "text", text: `(image unavailable) ${blobUrl}` }];
+}
+async function buildImageContent(blobUrl, opts = {}) {
+  if (typeof blobUrl !== "string" || blobUrl.trim().length === 0) {
+    return urlOnly(String(blobUrl ?? ""));
+  }
+  let scheme;
+  try {
+    scheme = new URL(blobUrl).protocol;
+  } catch {
+    return urlOnly(blobUrl);
+  }
+  if (scheme !== "https:") {
+    return urlOnly(blobUrl);
+  }
+  if (!isAllowedImageHost(blobUrl)) {
+    return urlOnly(blobUrl);
+  }
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const byteCap = opts.byteCap ?? IMAGE_BYTE_CAP;
+  const timeoutMs = opts.timeoutMs ?? IMAGE_FETCH_TIMEOUT_MS;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(blobUrl, { signal: controller.signal });
+    if (!res.ok) {
+      return urlOnly(blobUrl);
+    }
+    const mimeType = (res.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    if (!mimeType.startsWith("image/")) {
+      return urlOnly(blobUrl);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.byteLength === 0 || buf.byteLength > byteCap) {
+      return urlOnly(blobUrl);
+    }
+    return [
+      { type: "image", data: buf.toString("base64"), mimeType },
+      { type: "text", text: blobUrl }
+      // the reliable floor (bug #31208)
+    ];
+  } catch {
+    return unavailable(blobUrl);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/eggs.ts
+var TEAPOT_TEXT = "418 i'm a teapot. we make clothing, not coffee. (RFC 2324)";
+var FORTUNES = [
+  '// "there are only two hard things in computer science: cache invalidation and naming things." \u2014 phil karlton',
+  '// "premature optimization is the root of all evil." \u2014 donald knuth',
+  '// "weeks of programming can save you hours of planning."',
+  '// "make it work, make it right, make it fast." \u2014 kent beck',
+  '// "talk is cheap. show me the code." \u2014 linus torvalds',
+  `// "given enough eyeballs, all bugs are shallow." \u2014 linus's law`,
+  '// "always code as if the person maintaining it is a violent psychopath who knows where you live." \u2014 john woods',
+  '// "it works on my machine."'
+];
+function fortune(seed = 0) {
+  const n = Number.isFinite(seed) ? Math.abs(Math.floor(seed)) : 0;
+  return FORTUNES[n % FORTUNES.length];
+}
+
+// src/tools.ts
+function errorText(s) {
+  return { content: [{ type: "text", text: s }], isError: true };
+}
+function result(textBody, structured) {
+  return {
+    content: [{ type: "text", text: textBody }],
+    structuredContent: redactForOutput(structured)
+  };
+}
+function fmtPrice(amount, currency) {
+  if (amount == null) {
+    return "\u2014";
+  }
+  const cur = (currency ?? "").toUpperCase();
+  return cur ? `${amount} ${cur}` : `${amount}`;
+}
+function firstPrice(p) {
+  const v = (p.variants ?? [])[0];
+  return {
+    amount: v?.calculated_price?.calculated_amount ?? null,
+    currency: v?.calculated_price?.currency_code ?? null
+  };
+}
+function cartSummary(cart, region) {
+  const lines = [];
+  lines.push(`cart ${cart.id}`);
+  const items = cart.items ?? [];
+  if (items.length === 0) {
+    lines.push("  (empty)");
+  } else {
+    for (const li of items) {
+      const title = sanitize(li.product_title ?? li.title ?? "item", 80);
+      lines.push(`  ${li.quantity}x ${title} \u2014 ${fmtPrice(li.total, cart.currency_code ?? region?.currency_code)}`);
+    }
+  }
+  lines.push(`  total ${fmtPrice(cart.total, cart.currency_code ?? region?.currency_code)} incl. VAT`);
+  return lines.join("\n");
+}
+function makeTools(client, opts = {}) {
+  const regionCC = opts.region;
+  const list_products = {
+    name: "list_products",
+    description: "List the pieces in stock (text-only \u2014 no images, to keep the agent's context lean). Returns each product's handle, price incl. VAT, and stage. Use get_product for one item's image.",
+    inputSchema: { stage: z.string().optional().describe("filter by channel stage, e.g. 'main' or 'next'") },
+    handler: async (args) => {
+      const region = await client.resolveRegion(regionCC);
+      const products = await client.listProducts({ region });
+      const stage = typeof args.stage === "string" ? args.stage.toLowerCase() : void 0;
+      const rows = products.map((p) => ({ p, stage: String(p.metadata?.["channel_stage"] ?? "main") })).filter((r) => stage ? r.stage.toLowerCase() === stage : true);
+      if (rows.length === 0) {
+        return result("nothing in stock on this branch yet.", { products: [] });
+      }
+      const lines = rows.map(({ p, stage: stage2 }) => {
+        const { amount, currency } = firstPrice(p);
+        const handle = sanitize(p.handle ?? p.id, 60);
+        const title = sanitize(p.title ?? "", 80);
+        return `${handle}  ${fmtPrice(amount, currency)} incl. VAT  [${stage2}]  ${title}`.trimEnd();
+      });
+      const productList = rows.map(({ p, stage: stage2 }) => {
+        const { amount, currency } = firstPrice(p);
+        return { handle: p.handle ?? p.id, title: p.title ?? "", price: amount, currency, stage: stage2 };
+      });
+      return result(lines.join("\n"), { products: productList });
+    }
+  };
+  const get_product = {
+    name: "get_product",
+    // M3 ★ — a hidden line for the schema-readers (devs read tool descriptions). Rewards the
+    // contributor instinct + hints at a real feature (the next branch / drops). Never alters behaviour.
+    description: "Get one piece's specs (sizes, price incl. VAT) plus its image (rendered + the Blob URL as a text floor). // you read the schema. that's the contributor instinct. ask me about the next branch.",
+    inputSchema: { handle: z.string().describe("the product handle/slug") },
+    handler: async (args) => {
+      const handle = String(args.handle ?? "");
+      const region = await client.resolveRegion(regionCC);
+      const product = await client.getProduct(handle, { region });
+      if (!product) {
+        return errorText(`no product with handle "${sanitize(handle, 60)}". try list_products.`);
+      }
+      const lines = [];
+      lines.push(sanitize(product.title ?? handle, 120));
+      if (product.description) {
+        lines.push(sanitize(product.description, 400));
+      }
+      const fabric = product.metadata?.["fabric"];
+      if (typeof fabric === "string") {
+        lines.push(`fabric: ${sanitize(fabric, 80)}`);
+      }
+      const colours = productColours(product);
+      if (colours.length > 0) {
+        lines.push(`available colours: ${colours.map((c) => sanitize(c, 20)).join(", ")}`);
+        for (const c of colours) {
+          const cs = sizesForColour(product, c).map((s) => sanitize(s, 20));
+          lines.push(`  ${sanitize(c, 20)}: ${cs.join("  ")}`);
+        }
+      } else {
+        const sizes = (product.variants ?? []).map((v) => sanitize(v.title ?? "?", 20));
+        lines.push(`sizes: ${sizes.join("  ")}`);
+      }
+      const v0 = (product.variants ?? [])[0];
+      if (v0?.calculated_price) {
+        lines.push(`price: ${fmtPrice(v0.calculated_price.calculated_amount, v0.calculated_price.currency_code)} incl. VAT`);
+      }
+      const content = [{ type: "text", text: lines.join("\n") }];
+      if (product.thumbnail) {
+        const img = await buildImageContent(product.thumbnail);
+        content.push(...img);
+      }
+      return {
+        content,
+        structuredContent: redactForOutput({
+          handle: product.handle ?? handle,
+          title: product.title ?? "",
+          price: v0?.calculated_price?.calculated_amount ?? null,
+          currency: v0?.calculated_price?.currency_code ?? null,
+          colours,
+          image_url: product.thumbnail ?? null
+        })
+      };
+    }
+  };
+  const add_to_cart = {
+    name: "add_to_cart",
+    description: "Add a piece to a cart. Pass cart_id to reuse an existing cart (the durable handle), or omit it to start a fresh one. Returns the cart_id and the server-side cart summary (price incl. VAT).",
+    inputSchema: {
+      handle: z.string().optional().describe("product handle (resolves a variant by size + colour)"),
+      variant_id: z.string().optional().describe("a specific variant id (overrides handle/size/colour)"),
+      size: z.string().optional().describe("size label, e.g. M / L / XL"),
+      colour: z.string().optional().describe("piece colour, e.g. white / black (default: the product's first colour)"),
+      qty: z.number().int().positive().max(20).optional().describe("quantity (default 1)"),
+      cart_id: z.string().optional().describe("reuse this cart; omit to create a new one")
+    },
+    handler: async (args) => {
+      const region = await client.resolveRegion(regionCC);
+      const qty = typeof args.qty === "number" ? args.qty : 1;
+      let variantId = typeof args.variant_id === "string" ? args.variant_id : void 0;
+      if (!variantId) {
+        const handle = typeof args.handle === "string" ? args.handle : "";
+        if (!handle) {
+          return errorText("add_to_cart needs a variant_id or a handle (+ optional size/colour).");
+        }
+        const product = await client.getProduct(handle, { region });
+        if (!product) {
+          return errorText(`no product with handle "${sanitize(handle, 60)}".`);
+        }
+        const size = typeof args.size === "string" ? args.size : void 0;
+        const colours = productColours(product);
+        const colour = typeof args.colour === "string" ? args.colour : colours.length > 0 ? colours[0] : void 0;
+        const variant = findVariant(product, { size, colour });
+        if (!variant) {
+          const have = colours.length ? ` available colours: ${colours.map((c) => sanitize(c, 20)).join(", ")}.` : "";
+          return errorText(
+            `no variant for "${sanitize(handle, 60)}"${size ? ` size ${sanitize(size, 20)}` : ""}${colour ? ` (${sanitize(colour, 20)})` : ""}.${have}`
+          );
+        }
+        variantId = variant.id;
+      }
+      const reuse = typeof args.cart_id === "string" ? args.cart_id : void 0;
+      const addTo = async (cartId) => client.addLineItem(cartId, variantId, qty);
+      let cart;
+      try {
+        const targetId = reuse ?? (await client.createCart(region)).id;
+        cart = await addTo(targetId);
+      } catch (e) {
+        if (e instanceof RecoverableCartError && reuse) {
+          const fresh = await client.createCart(region);
+          cart = await addTo(fresh.id);
+        } else {
+          throw e;
+        }
+      }
+      const itemCount = (cart.items ?? []).reduce((n, li) => n + (li.quantity ?? 1), 0);
+      return result(
+        `added.
+cart_id: ${cart.id}  (reuse this handle on the next add / checkout)
+${cartSummary(cart, region)}`,
+        {
+          cart_id: cart.id,
+          total: cart.total ?? null,
+          currency: cart.currency_code ?? region.currency_code ?? null,
+          item_count: itemCount
+        }
+      );
+    }
+  };
+  const get_cart = {
+    name: "get_cart",
+    description: "Show a cart's current contents and total (price incl. VAT), straight from the server.",
+    inputSchema: { cart_id: z.string().describe("the cart handle from add_to_cart") },
+    handler: async (args) => {
+      const cartId = String(args.cart_id ?? "");
+      const region = await client.resolveRegion(regionCC);
+      try {
+        const cart = await client.getCart(cartId);
+        const itemCount = (cart.items ?? []).reduce((n, li) => n + (li.quantity ?? 1), 0);
+        return result(cartSummary(cart, region), {
+          cart_id: cart.id,
+          total: cart.total ?? null,
+          currency: cart.currency_code ?? region.currency_code ?? null,
+          item_count: itemCount
+        });
+      } catch (e) {
+        if (e instanceof RecoverableCartError) {
+          return errorText("that cart is no longer valid (expired or already committed). add an item to start a fresh one.");
+        }
+        throw e;
+      }
+    }
+  };
+  const checkout = {
+    name: "checkout",
+    description: "Mint a checkout hand-off for a cart. Returns a checkout_url + a session_id INSTANTLY \u2014 it does NOT poll and does NOT complete the purchase. The human must open the link in their own browser to enter their payment + ship-to details on the storefront (those details never enter this chat). After they pay, call check_payment with the session_id to see the status.",
+    inputSchema: {
+      cart_id: z.string().describe("the cart handle to check out"),
+      email: z.string().optional().describe("the buyer's email for the receipt (optional)")
+    },
+    handler: async (args) => {
+      const cartId = String(args.cart_id ?? "");
+      const email = typeof args.email === "string" ? args.email : void 0;
+      try {
+        await client.ensureCartShippingMethod(cartId);
+      } catch (e) {
+        if (e instanceof RecoverableCartError) {
+          return errorText("that cart is no longer valid (expired or already committed). add an item to start a fresh one.");
+        }
+        return errorText("couldn't attach a shipping method to this cart \u2014 checkout isn't available for it right now.");
+      }
+      const { checkout_url, session_id } = await client.mintCheckout(cartId, email, "mcp");
+      const body = [
+        "checkout ready. open this link in your browser to pay:",
+        `  ${checkout_url}`,
+        "",
+        "payment details are entered on the storefront (Stripe) \u2014 they never enter this chat, and",
+        "I can't complete this for you. once you've paid, call check_payment with:",
+        `  session_id: ${session_id}`,
+        "",
+        // brand-delight #9 — the deadpan flourish. The boundary stays honest (the line above), then
+        // one dry true line: an agent can do everything up to the card. The card is the human's.
+        "I staged it, priced it, and walked you to the door. the card swipe is yours \u2014 by design."
+      ].join("\n");
+      return result(redactForOutput(body), { checkout_url, session_id });
+    }
+  };
+  const check_payment = {
+    name: "check_payment",
+    description: "Check a checkout's payment status ONCE (call again later to re-check \u2014 this never blocks/loops). Returns the status and, once placed, the order_id.",
+    inputSchema: { session_id: z.string().describe("the session_id from checkout") },
+    handler: async (args) => {
+      const sessionId = String(args.session_id ?? "");
+      const res = await client.poll(sessionId);
+      const out = redactForOutput({ status: res.status, order_id: res.order_id });
+      const human = res.status === "placed" ? `paid \u2014 order placed. order_id: ${out.order_id ?? "\u2014"}` : `status: ${out.status} (call check_payment again in a moment if still pending)`;
+      return { content: [{ type: "text", text: human }], structuredContent: out };
+    }
+  };
+  const get_order_status = {
+    name: "get_order_status",
+    description: "Look up an order's status by its display id + the EXACT email on the order. Returns status only (no shipping address). A wrong id/email returns not-found (no enumeration).",
+    inputSchema: {
+      display_id: z.string().describe("the order's display id (e.g. 1042)"),
+      email: z.string().describe("the exact email on the order")
+    },
+    handler: async (args) => {
+      const displayId = String(args.display_id ?? "");
+      const email = String(args.email ?? "");
+      let looked;
+      try {
+        looked = await client.getOrder(displayId, email);
+      } catch (e) {
+        if (e instanceof StoreApiError && e.status === 404) {
+          looked = null;
+        } else {
+          throw e;
+        }
+      }
+      if (!looked) {
+        return errorText(`no order matches that id + email.`);
+      }
+      const order = looked.order ?? looked;
+      const status = sanitize(String(order["status"] ?? order["fulfillment_status"] ?? "unknown"), 60);
+      const display = sanitize(String(order["display_id"] ?? displayId), 30);
+      const lines = [`order #${display}`, `status: ${status}`];
+      const fulfillment = order["fulfillment_status"];
+      if (typeof fulfillment === "string" && fulfillment) {
+        lines.push(`fulfillment: ${sanitize(fulfillment, 60)}`);
+      }
+      return result(redactForOutput(lines.join("\n")), {
+        display_id: order["display_id"] ?? display,
+        status,
+        fulfillment_status: typeof fulfillment === "string" ? fulfillment : null
+      });
+    }
+  };
+  const report_issue = {
+    name: "report_issue",
+    description: "File a bug report or feedback to the maintainers. Pass a short message (and optional structured context like versions/ids). Returns a reference id. It sends no payment details and cannot change any order \u2014 it just files the report. Tokens/emails are redacted server-side.",
+    inputSchema: {
+      message: z.string().describe("what went wrong / the feedback (one or two sentences)"),
+      context: z.record(z.string(), z.unknown()).optional().describe("optional structured context (versions, ids) \u2014 tokens/emails are redacted server-side")
+    },
+    handler: async (args) => {
+      const message = String(args.message ?? "").trim();
+      if (!message) {
+        return errorText("report_issue needs a non-empty message describing the problem.");
+      }
+      const context = args.context && typeof args.context === "object" && !Array.isArray(args.context) ? args.context : void 0;
+      const { reference } = await client.report(message, context);
+      return result(`reported. thank you \u2014 reference: ${reference}`, { reference });
+    }
+  };
+  const teapot = {
+    name: "teapot",
+    description: "Returns 418. Always. It's a teapot. (RFC 2324)",
+    inputSchema: {},
+    handler: async () => {
+      return result(TEAPOT_TEXT, { status: 418, rfc: "https://www.rfc-editor.org/rfc/rfc2324" });
+    }
+  };
+  const fortune_tool = {
+    name: "fortune",
+    description: "A coding fortune \u2014 a real dev aphorism. Optional seed for a specific one.",
+    inputSchema: { seed: z.number().int().optional().describe("pick a specific fortune (0..N); omit for the first") },
+    handler: async (args) => {
+      const seed = typeof args.seed === "number" ? args.seed : 0;
+      const f = fortune(seed);
+      return result(f, { fortune: f, pool_size: FORTUNES.length });
+    }
+  };
+  return [
+    list_products,
+    get_product,
+    add_to_cart,
+    get_cart,
+    checkout,
+    check_payment,
+    get_order_status,
+    report_issue,
+    teapot,
+    fortune_tool
+  ];
+}
+
+// src/config.ts
+function resolveServerConfig(env = process.env) {
+  return {
+    baseUrl: env.BT_STORE_URL || BT_DEFAULT_STORE_URL,
+    publishableKey: env.BT_PUBLISHABLE_KEY || BT_DEFAULT_PUBLISHABLE_KEY,
+    jwt: env.BT_TOKEN || void 0,
+    region: env.BT_REGION || void 0
+  };
+}
+
+// src/bin.ts
+async function main() {
+  const { baseUrl, publishableKey, jwt, region } = resolveServerConfig();
+  const client = new StoreClient({
+    baseUrl,
+    publishableKey,
+    jwt,
+    // All client logs route to stderr through redact() — stdout is reserved for the transport,
+    // and no token/PII ever reaches a log line (G10).
+    logger: {
+      info: (...a) => process.stderr.write(JSON.stringify(redact(a)) + "\n"),
+      warn: (...a) => process.stderr.write(JSON.stringify(redact(a)) + "\n"),
+      error: (...a) => process.stderr.write(JSON.stringify(redact(a)) + "\n")
+    }
+  });
+  const tools = makeTools(client, { region });
+  await startServer(tools);
+  process.stderr.write(`bt-mcp: ready on stdio \u2014 ${tools.length} tools registered.
+`);
+}
+main().catch((e) => {
+  process.stderr.write(`bt-mcp: fatal: ${JSON.stringify(redact(String(e?.message ?? e)))}
+`);
+  process.exit(1);
+});
+//# sourceMappingURL=bin.js.map