@canonry/canonry 7.72.1 → 7.73.0

package/dist/{chunk-GPTRCOKV.js → chunk-HIGBV77K.js}

@@ -1,7 +1,7 @@
 import {
   answerServiceAdapters,
   answerServiceDescriptors
-} from "./chunk-XR6ZVMYK.js";
+} from "./chunk-6W5AR4IW.js";
 import {
   AeroLlmUsageFeatures,
   aeroTurnStatus,
@@ -18,7 +18,7 @@ import {
   isSystemMessage,
   loadAeroSystemPrompt,
   missingProviderMessage,
-  readAeroViewEvidence,
+  readAeroViewEvidenceForTurn,
   resolveAeroModel,
   resolveAgentAllowViewers,
   resolveAgentEnabled,
@@ -27,14 +27,14 @@ import {
   resolveConfiguredAgentProvider,
   resolveSessionProviderAndModel,
   setAeroSystemPrompt
-} from "./chunk-WJ2JU32O.js";
+} from "./chunk-GNBATQS3.js";
 import {
   AeroToolProfiles,
   AeroToolScopes,
   buildAeroStateTools,
   isAeroToolProfile,
   truncateToolResult
-} from "./chunk-P3UGNR2Y.js";
+} from "./chunk-ETVM3T7K.js";
 import {
   getGoogleAuthConfig,
   getGoogleConnection,
@@ -53,7 +53,7 @@ import {
   removeCloudflareTrafficConnection,
   removeCloudflareTrafficConnectionBySourceId,
   upsertCloudflareTrafficConnection
-} from "./chunk-BZZDFIY2.js";
+} from "./chunk-XDQJOZKJ.js";
 import {
   claudeAdapter,
   embedQueries,
@@ -64,7 +64,7 @@ import {
   openaiAdapter,
   openrouterAdapter,
   perplexityAdapter
-} from "./chunk-JO73L677.js";
+} from "./chunk-6ATKY252.js";
 import {
   classifyUsageSurface,
   createApiUsageTelemetry,
@@ -76,7 +76,7 @@ import {
   startOutcomeTimer,
   trackFeatureCompleted,
   trackInstallState
-} from "./chunk-4LTL5RNY.js";
+} from "./chunk-S77W2XSI.js";
 import {
   isLoopbackBindHost
 } from "./chunk-TSENU4GG.js";
@@ -84,7 +84,7 @@ import {
   isApiProviderRegistrable,
   isCdpProviderRegistrable,
   registeredProviderNames
-} from "./chunk-6MYHGP46.js";
+} from "./chunk-DLVGMRM5.js";
 import {
   checkLatestVersionForServer,
   getOrCreateAnonymousId,
@@ -95,17 +95,17 @@ import {
   recordDashboardEvent,
   setTelemetryPreference,
   trackEvent
-} from "./chunk-MJYO6UK2.js";
+} from "./chunk-PRSQ4R47.js";
 import {
   createCanonryMcpServer
-} from "./chunk-IV6VZ63E.js";
+} from "./chunk-F5D4GPZQ.js";
 import {
   CANONRY_MCP_TIERS,
   CANONRY_MCP_TOOLKIT_NAMES
 } from "./chunk-NDTU7FGL.js";
 import {
   ApiClient
-} from "./chunk-ATT3ZCSS.js";
+} from "./chunk-WH2M2MQF.js";
 import {
   AGENT_PROVIDERS,
   adapterSupportsBatch,
@@ -136,21 +136,21 @@ import {
   saveConfigPatch,
   sentimentInstallReadiness,
   updateSharedProviderExecutionGate
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-HKV4UWG5.js";
 import {
   getBundledSkillSnapshots
-} from "./chunk-PPM6Z7CM.js";
+} from "./chunk-HEL6DKDN.js";
 import {
   computeFactorAverages,
   deleteSiteCrawlGraphLayout,
   persistSiteCrawlGraphLayout,
   prepareSiteCrawlGraphLayout,
   recordedSharePct
-} from "./chunk-IZMT4WLZ.js";
+} from "./chunk-6YW24AUN.js";
 import {
   CanonryMcpToolNames,
   canonryMcpTools
-} from "./chunk-GA2EHZTI.js";
+} from "./chunk-3WPTMLQI.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
@@ -158,15 +158,17 @@ import {
   CliError
 } from "./chunk-HGMYEDAQ.js";
 import {
-  IntelligenceService,
+  IntelligenceService
+} from "./chunk-5PA7SJ2M.js";
+import {
   addLogListener,
   createFastifyLogger,
   createLogger
-} from "./chunk-QKMGGM4B.js";
+} from "./chunk-AZQNJX3T.js";
 import {
   computeCitedCompetitorDomains,
   determineCitationState
-} from "./chunk-DRGCVTYH.js";
+} from "./chunk-JPM3VC6A.js";
 import {
   BingApiError,
   CC_CACHE_DIR,
@@ -179,6 +181,7 @@ import {
   GbpApiError,
   GoogleApiError,
   GoogleAuthError,
+  MCP_DELEGATED_KEY_MAX_AGE_MS,
   PLUGIN_DIR,
   SITE_REACHABILITY_CHECKS,
   SITE_REACHABILITY_CHECK_ID,
@@ -286,7 +289,7 @@ import {
   webhookResponseReason,
   webhookTargetRefusalReason,
   writeAuditLog
-} from "./chunk-7KOAP47B.js";
+} from "./chunk-WLWOGBLJ.js";
 import {
   OperationalLogStore,
   SentimentIdempotencyConflict,
@@ -372,7 +375,7 @@ import {
   siteLivenessState,
   trafficSources,
   usageCounters
-} from "./chunk-O7WOCTBD.js";
+} from "./chunk-PAIYFNNY.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AI_ENGINE_DOMAINS,
@@ -624,7 +627,7 @@ import {
   winnabilityClassLabel,
   withRetry,
   withSkippedProviders
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/google-marketing-runtime.ts
 import crypto2 from "crypto";
@@ -3314,7 +3317,7 @@ import path5 from "path";
 import { isIP as isIP2 } from "net";
 import { fileURLToPath } from "url";
 import { setImmediate as yieldToEventLoop4 } from "timers/promises";
-import { and as and26, eq as eq33, isNotNull as isNotNull5, isNull as isNull7, lte as lte3, max, ne as ne4, or as or4, sql as sql13 } from "drizzle-orm";
+import { and as and27, eq as eq33, isNotNull as isNotNull5, isNull as isNull8, lte as lte3, max, ne as ne4, or as or4, sql as sql13 } from "drizzle-orm";
 
 // src/seo-runtime.ts
 import { eq, inArray } from "drizzle-orm";
@@ -5807,7 +5810,7 @@ function nonBlank(value) {
   return trimmed ? trimmed : void 0;
 }
 function resolveBuildCommit(env = process.env) {
-  const embedded = true ? "f363ee51db531415324bfdb27933588afe17a5f3" : void 0;
+  const embedded = true ? "a9c886130b3b0c74de10313ac5ebd1c0853664d0" : void 0;
   return nonBlank(embedded) ?? nonBlank(env.CANONRY_COMMIT);
 }
 function resolveInstanceIdentity(env = process.env) {
@@ -15636,8 +15639,7 @@ import { eq as eq27 } from "drizzle-orm";
 
 // src/agent/remote-mcp.ts
 import { Type } from "@earendil-works/pi-ai";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 var log24 = createLogger("RemoteMcp");
 var AERO_EXCLUDED_MCP_TOOLS = /* @__PURE__ */ new Set([]);
 async function connectStreamableHttp(server) {
@@ -15648,7 +15650,7 @@ async function connectStreamableHttp(server) {
   });
   const client = new Client(
     { name: "canonry-aero", version: "1.0.0" },
-    { capabilities: {} }
+    { capabilities: {}, versionNegotiation: { mode: "auto" } }
   );
   await client.connect(transport);
   return client;
@@ -16381,7 +16383,7 @@ ${lines.join("\n")}
       this.assertTurnProviderUsable(projectId);
       await this.mergeExternalTools(agent);
       const view = { client: this.opts.client, projectName, basePath: this.opts.config.basePath, context: preferences?.context };
-      const evidence = preferences?.context ? await readAeroViewEvidence(view) : void 0;
+      const evidence = preferences?.context ? await readAeroViewEvidenceForTurn(view, preferences?.signal) : void 0;
       preferences?.signal?.throwIfAborted();
       await this.maybeCompact(projectName, agent);
       preferences?.signal?.throwIfAborted();
@@ -16880,7 +16882,7 @@ var ViewerAeroSessions = class {
       const agent = this.sessions.get(key)?.agent ?? await this.createAgent(project, client, preferences.signal);
       agent.state.messages = trimViewerTranscript(agent.state.messages.filter((message) => message.role !== "system"));
       const view = { client, projectName: project.name, basePath: this.opts.config.basePath, context: preferences.context };
-      const evidence = preferences.context ? await readAeroViewEvidence(view) : void 0;
+      const evidence = preferences.context ? await readAeroViewEvidenceForTurn(view, preferences.signal) : void 0;
       preferences.signal?.throwIfAborted();
       const shape = aeroProjectShape(this.opts.db, project.id);
       setAeroSystemPrompt(agent, loadAeroSystemPrompt(void 0, { extras: false }) + VIEWER_AERO_PROMPT + shape.prompt + aeroViewPrompt(preferences.context));
@@ -16969,12 +16971,15 @@ var ViewerAeroSessions = class {
 // src/mcp-http.ts
 import crypto25 from "crypto";
 import { isIP } from "net";
-import { eq as eq29 } from "drizzle-orm";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { and as and24, eq as eq29, isNull as isNull6 } from "drizzle-orm";
+import { NodeStreamableHTTPServerTransport, toNodeHandler, toWebRequest } from "@modelcontextprotocol/node";
+import { McpServer, createMcpHandler, isInitializeRequest, isLegacyRequest } from "@modelcontextprotocol/server";
 var SESSION_IDLE_MS = 10 * 60 * 1e3;
 var SWEEP_INTERVAL_MS = 60 * 1e3;
-function mintSessionKey(db, scopes, userId) {
+var MAX_CLEANUP_RETRIES_PER_SWEEP = 8;
+var MAX_PENDING_KEY_RETIREMENTS = 256;
+var MAX_CLEANUP_BACKOFF_MS = 10 * 60 * 1e3;
+function mintSessionKey(db, scopes, userId, oauthGrantId, createdAt) {
   const raw = `cnry_${crypto25.randomBytes(24).toString("hex")}`;
   const id = crypto25.randomUUID();
   db.insert(apiKeys).values({
@@ -16984,18 +16989,10 @@ function mintSessionKey(db, scopes, userId) {
     keyPrefix: raw.slice(0, 9),
     scopes: [...scopes],
     delegatedUserId: userId,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    delegatedOAuthGrantId: oauthGrantId,
+    createdAt: new Date(createdAt).toISOString()
   }).run();
-  return { id, raw };
-}
-function revokeSessionKey(db, id) {
-  try {
-    db.transaction((tx) => {
-      tx.delete(dashboardSessions).where(eq29(dashboardSessions.apiKeyId, id)).run();
-      tx.update(apiKeys).set({ revokedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq29(apiKeys.id, id)).run();
-    });
-  } catch {
-  }
+  return { id, raw, expiresAt: createdAt + MCP_DELEGATED_KEY_MAX_AGE_MS };
 }
 function mcpTransportPaths() {
   const paths = ["/mcp", "/mcp/readonly"];
@@ -17050,18 +17047,95 @@ function mcpHttpHealth(app, apiPrefix, hosted) {
 }
 function registerMcpHttpRoutes(scope, opts) {
   const sessions = /* @__PURE__ */ new Map();
+  const legacyServers = /* @__PURE__ */ new Set();
+  const modernExchanges = /* @__PURE__ */ new Set();
   const now = opts.now ?? (() => Date.now());
+  const pendingKeyRetirements = /* @__PURE__ */ new Map();
+  let shuttingDown = false;
+  function withoutLockWait(work) {
+    const timeout = opts.db.$client.pragma("busy_timeout", { simple: true });
+    try {
+      opts.db.$client.pragma("busy_timeout = 0");
+      return work();
+    } finally {
+      opts.db.$client.pragma(`busy_timeout = ${timeout}`);
+    }
+  }
+  function attemptKeyRetirement(id, remove) {
+    try {
+      withoutLockWait(() => {
+        opts.db.transaction((tx) => {
+          tx.delete(dashboardSessions).where(eq29(dashboardSessions.apiKeyId, id)).run();
+          tx.update(apiKeys).set({ revokedAt: new Date(now()).toISOString() }).where(and24(eq29(apiKeys.id, id), isNull6(apiKeys.revokedAt))).run();
+        });
+        if (remove) {
+          try {
+            opts.db.delete(apiKeys).where(eq29(apiKeys.id, id)).run();
+          } catch (error) {
+            scope.log.warn({ err: error, keyId: id }, "Retained revoked MCP request key after deletion failed");
+          }
+        }
+      });
+      return true;
+    } catch (error) {
+      scope.log.error({ err: error, keyId: id }, "Failed to retire MCP key; cleanup remains bounded by its expiry");
+      return false;
+    }
+  }
+  function retireSessionKey(key, remove = false) {
+    const queued = pendingKeyRetirements.get(key.id);
+    if (queued) {
+      queued.remove ||= remove;
+      return;
+    }
+    if (attemptKeyRetirement(key.id, remove)) return;
+    if (pendingKeyRetirements.size >= MAX_PENDING_KEY_RETIREMENTS) {
+      const oldest = pendingKeyRetirements.keys().next().value;
+      if (oldest !== void 0) pendingKeyRetirements.delete(oldest);
+      scope.log.warn("MCP cleanup queue is full; oldest credential remains bounded by its expiry");
+    }
+    pendingKeyRetirements.set(key.id, { remove, expiresAt: key.expiresAt, nextAttemptAt: now() + SWEEP_INTERVAL_MS, attempts: 1 });
+  }
+  function retryKeyRetirements() {
+    let attempted = 0;
+    for (const [id, queued] of pendingKeyRetirements) {
+      if (queued.expiresAt <= now()) {
+        pendingKeyRetirements.delete(id);
+        continue;
+      }
+      if (queued.nextAttemptAt > now()) continue;
+      if (attempted++ >= MAX_CLEANUP_RETRIES_PER_SWEEP) break;
+      if (attemptKeyRetirement(id, queued.remove)) pendingKeyRetirements.delete(id);
+      else {
+        queued.nextAttemptAt = now() + Math.min(SWEEP_INTERVAL_MS * 2 ** queued.attempts, MAX_CLEANUP_BACKOFF_MS);
+        queued.attempts++;
+      }
+    }
+  }
   async function dropSession(id) {
-    const session = sessions.get(id);
-    if (!session) return;
-    sessions.delete(id);
-    await session.close().catch(() => {
-    });
+    await sessions.get(id)?.close().catch((error) => scope.log.error({ err: error }, "Failed to close legacy MCP session"));
   }
   const sweep = setInterval(() => {
-    const cutoff = now() - SESSION_IDLE_MS;
-    for (const [id, session] of sessions) {
-      if (session.lastSeenAt < cutoff) void dropSession(id);
+    try {
+      retryKeyRetirements();
+      withoutLockWait(() => {
+        const cutoff = now() - SESSION_IDLE_MS;
+        for (const session of legacyServers) {
+          const key = session.sessionKeyId ? opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq29(apiKeys.id, session.sessionKeyId)).get() : void 0;
+          if (session.lastSeenAt < cutoff || session.expiresAt !== void 0 && session.expiresAt <= now() || session.sessionKeyId && (!key || key.revokedAt)) {
+            void session.close().catch((error) => scope.log.error({ err: error }, "Failed to close expired MCP session"));
+          }
+        }
+        for (const exchange of modernExchanges) {
+          if (!exchange.sessionKey) continue;
+          const key = opts.db.select({ revokedAt: apiKeys.revokedAt }).from(apiKeys).where(eq29(apiKeys.id, exchange.sessionKey.id)).get();
+          if (!key || key.revokedAt || exchange.sessionKey.expiresAt <= now()) {
+            void exchange.close().catch((error) => scope.log.error({ err: error }, "Failed to close expired MCP request"));
+          }
+        }
+      });
+    } catch (error) {
+      scope.log.error({ err: error }, "MCP lifecycle sweep failed; will retry on the next interval");
     }
   }, SWEEP_INTERVAL_MS);
   sweep.unref();
@@ -17075,9 +17149,15 @@ function registerMcpHttpRoutes(scope, opts) {
       return payload;
     });
   }
-  scope.addHook("onClose", async () => {
+  scope.addHook("preClose", async () => {
+    shuttingDown = true;
     clearInterval(sweep);
-    await Promise.all([...sessions.keys()].map((id) => dropSession(id)));
+    await Promise.all([...legacyServers].map((session) => session.close().catch((error) => scope.log.error({ err: error }, "Failed to close MCP session during shutdown"))));
+    await Promise.all([...modernExchanges].map((exchange) => exchange.close().catch((error) => scope.log.error({ err: error }, "Failed to close MCP request during shutdown"))));
+    retryKeyRetirements();
+    if (pendingKeyRetirements.size > 0) {
+      scope.log.warn({ count: pendingKeyRetirements.size }, "MCP credential cleanup remains pending at shutdown; credentials remain bounded by expiry");
+    }
   });
   function callerBearer(request) {
     const header = request.headers.authorization;
@@ -17088,53 +17168,74 @@ function registerMcpHttpRoutes(scope, opts) {
     if (trimmed.slice(0, prefix.length).toLowerCase() !== prefix) return null;
     return trimmed.slice(prefix.length).trim() || null;
   }
-  async function openSession(request, authorizationId, segment) {
-    const bearer = callerBearer(request);
-    if (!bearer) return null;
+  function createAuthorizedServer(request, segment, bearer, signal, modern = false, needsApiCredential = true) {
+    if (shuttingDown) throw new Error("MCP server is shutting down");
     const scopes = request.principal?.scopes ?? request.apiKey?.scopes ?? [];
     let sessionKey = null;
-    if (!request.apiKey && request.principal?.kind === "user") {
-      sessionKey = mintSessionKey(opts.db, scopes, request.principal.id);
+    if (needsApiCredential && !request.apiKey && request.principal?.kind === "user") {
+      if (!request.principal.oauthGrantId) throw forbidden("MCP OAuth credentials require an active authorization grant.");
+      sessionKey = mintSessionKey(opts.db, segment.readOnly ? ["read"] : scopes, request.principal.id, request.principal.oauthGrantId, now());
     }
     const client = new ApiClient(opts.selfApiUrl, sessionKey?.raw ?? bearer, {
       skipProbe: true,
+      storedOnly: segment.readOnly,
+      signal,
       clientName: `canonry-mcp/${PACKAGE_VERSION}`,
       surface: "mcp-http",
       // Correlation only: this is never accepted as caller identity or authority.
-      actorSession: crypto25.randomUUID()
+      ...modern ? {} : { actorSession: crypto25.randomUUID() }
     });
     let server;
     try {
       server = createCanonryMcpServer({
-        scope: segment.readOnly || isReadOnlyKey(scopes) ? "read-only" : "all",
+        scope: segment.readOnly ? "stored-only" : isReadOnlyKey(scopes) ? "read-only" : "all",
         credentialScopes: scopes,
         operator: request.operatorAccess === true,
+        connectionProfile: Boolean(opts.issuer && !request.principal?.projectId && (request.principal?.kind === "user" || request.principal?.delegatedUser) && scopes.some((scope2) => scope2 === "read" || scope2 === "*")),
         tiers: segment.tiers,
         clientFactory: () => client,
         updateAvailable: opts.getUpdateAvailable
       });
+      server.server.registerCapabilities({ tools: { listChanged: false }, resources: { listChanged: false, subscribe: false } });
     } catch (error) {
-      if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
+      if (sessionKey) retireSessionKey(sessionKey, modern);
       throw error;
     }
-    const transport = new StreamableHTTPServerTransport({
+    return { server, sessionKey };
+  }
+  async function openSession(request, authorizationId, segment) {
+    const bearer = callerBearer(request);
+    if (!bearer) return null;
+    const { server, sessionKey } = createAuthorizedServer(request, segment, bearer);
+    const transport = new NodeStreamableHTTPServerTransport({
       sessionIdGenerator: () => crypto25.randomUUID(),
       onsessioninitialized: (id) => {
-        sessions.set(id, { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() });
+        if (!shuttingDown && !closing) sessions.set(id, session);
       }
     });
-    async function close() {
-      if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
-      try {
-        await transport.close();
-      } finally {
-        await server.close();
-      }
+    let closing;
+    const session = { transport, close, authorizationId, segmentId: segment.id, sessionKeyId: sessionKey?.id, expiresAt: sessionKey?.expiresAt, lastSeenAt: now() };
+    legacyServers.add(session);
+    function close() {
+      if (closing) return closing;
+      closing = Promise.resolve().then(async () => {
+        if (sessionKey) retireSessionKey(sessionKey);
+        const id = transport.sessionId;
+        if (id) sessions.delete(id);
+        try {
+          await transport.close();
+        } finally {
+          try {
+            await server.close();
+          } finally {
+            legacyServers.delete(session);
+          }
+        }
+      });
+      return closing;
     }
     transport.onclose = () => {
-      const id = transport.sessionId;
-      if (id) sessions.delete(id);
-      if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
+      void close().catch((error) => scope.log.error({ err: error }, "Failed to close legacy MCP transport"));
     };
     try {
       await server.connect(transport);
@@ -17143,15 +17244,68 @@ function registerMcpHttpRoutes(scope, opts) {
       });
       throw error;
     }
-    return { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() };
+    return session;
+  }
+  async function handleModern(request, reply, segment, bearer) {
+    const abort = new AbortController();
+    let closing;
+    const exchange = {
+      close: () => {
+        if (closing) return closing;
+        abort.abort();
+        if (exchange.sessionKey) retireSessionKey(exchange.sessionKey, true);
+        modernExchanges.delete(exchange);
+        closing = handler.close().catch((error) => {
+          scope.log.error({ err: error }, "Failed to close MCP request transport");
+          throw error;
+        });
+        return closing;
+      }
+    };
+    const reportError = (error) => scope.log.error({ err: error }, "Modern MCP request failed");
+    const handler = createMcpHandler(({ requestInfo }) => {
+      if (shuttingDown) throw new Error("MCP server is shutting down");
+      const body = request.body;
+      const method = body && typeof body === "object" ? body.method : void 0;
+      if (method === "subscriptions/listen") {
+        return new McpServer({ name: "canonry", version: PACKAGE_VERSION });
+      }
+      const signal = requestInfo ? AbortSignal.any([abort.signal, requestInfo.signal]) : abort.signal;
+      const opened = createAuthorizedServer(request, segment, bearer, signal, true, method === "tools/call");
+      exchange.sessionKey = opened.sessionKey ?? void 0;
+      return opened.server;
+    }, { legacy: "reject", onerror: reportError });
+    modernExchanges.add(exchange);
+    try {
+      await toNodeHandler(handler, { onerror: reportError })(request.raw, reply.raw, request.body);
+    } finally {
+      await exchange.close();
+    }
   }
   async function handle(request, reply, segment) {
+    if (shuttingDown) {
+      await reply.status(503).send({ jsonrpc: "2.0", id: null, error: { code: -32e3, message: "MCP server is shutting down." } });
+      return;
+    }
     const principal = request.principal ?? request.apiKey;
     const bearer = callerBearer(request);
     if (!principal || !bearer) {
       await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
       return;
     }
+    if (segment.readOnly && !request.apiKey && request.principal?.kind === "user" && !principal.scopes.some((scope2) => scope2 === "read" || scope2 === "*")) {
+      throw forbidden('The hosted read-only MCP endpoint requires the "read" scope.');
+    }
+    const webRequest = await toWebRequest(request.raw, request.body);
+    const legacy = await isLegacyRequest(webRequest, request.body);
+    if (shuttingDown) {
+      await reply.status(503).send({ jsonrpc: "2.0", id: null, error: { code: -32e3, message: "MCP server is shutting down." } });
+      return;
+    }
+    if (!legacy) {
+      await handleModern(request, reply, segment, bearer);
+      return;
+    }
     const authorizationId = hashApiKey(JSON.stringify({
       bearerHash: hashApiKey(bearer),
       kind: request.principal?.kind ?? "api-key",
@@ -17163,6 +17317,11 @@ function registerMcpHttpRoutes(scope, opts) {
     const sessionId = request.headers["mcp-session-id"];
     const existing = typeof sessionId === "string" ? sessions.get(sessionId) : void 0;
     if (existing) {
+      if (existing.expiresAt !== void 0 && existing.expiresAt <= now() && typeof sessionId === "string") {
+        await dropSession(sessionId);
+        await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
+        return;
+      }
       if (existing.authorizationId !== authorizationId || existing.segmentId !== segment.id) {
         await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
         return;
@@ -17184,6 +17343,11 @@ function registerMcpHttpRoutes(scope, opts) {
       await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
       return;
     }
+    if (shuttingDown) {
+      await opened.close();
+      await reply.status(503).send({ jsonrpc: "2.0", id: null, error: { code: -32e3, message: "MCP server is shutting down." } });
+      return;
+    }
     let handled = false;
     try {
       await opened.transport.handleRequest(request.raw, reply.raw, request.body);
@@ -18399,7 +18563,7 @@ function clipText(value, length) {
 }
 
 // src/research-runner.ts
-import { and as and24, eq as eq31, inArray as inArray13, sql as sql11 } from "drizzle-orm";
+import { and as and25, eq as eq31, inArray as inArray13, sql as sql11 } from "drizzle-orm";
 var unfinishedResearchQueryStatuses = [ResearchQueryStatuses.queued, ResearchQueryStatuses.running];
 function finalResearchRunStatus(completed, failed, waiting) {
   if (waiting > 0) return ResearchRunStatuses["waiting-upstream"];
@@ -18407,13 +18571,13 @@ function finalResearchRunStatus(completed, failed, waiting) {
   return completed > 0 ? ResearchRunStatuses.partial : ResearchRunStatuses.failed;
 }
 async function executeResearchRun(db, registry, runId, projectId, options = {}) {
-  const run = db.select().from(researchRuns).where(and24(eq31(researchRuns.id, runId), eq31(researchRuns.projectId, projectId))).get();
+  const run = db.select().from(researchRuns).where(and25(eq31(researchRuns.id, runId), eq31(researchRuns.projectId, projectId))).get();
   if (!run || run.status !== ResearchRunStatuses.queued) return;
   const project = db.select().from(projects).where(eq31(projects.id, projectId)).get();
   if (!project) return;
   const provider = registry.get(run.provider);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and24(eq31(researchRuns.id, runId), eq31(researchRuns.status, ResearchRunStatuses.queued))).run();
+  const claim = db.update(researchRuns).set({ status: ResearchRunStatuses.running, startedAt: now }).where(and25(eq31(researchRuns.id, runId), eq31(researchRuns.status, ResearchRunStatuses.queued))).run();
   if (claim.changes !== 1) return;
   const elapsed = startOutcomeTimer();
   const requested = currentOutcomeOrigin();
@@ -18458,7 +18622,7 @@ async function executeResearchRun(db, registry, runId, projectId, options = {})
     await mapWithConcurrency(rows, Math.max(1, provider.config.quotaPolicy.maxConcurrency), async (row) => {
       try {
         const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and24(eq31(researchRunQueries.id, row.id), eq31(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
+        db.update(researchRunQueries).set({ status: ResearchQueryStatuses.running, startedAt }).where(and25(eq31(researchRunQueries.id, row.id), eq31(researchRunQueries.status, ResearchQueryStatuses.queued))).run();
         const raw = await gate.run(async () => {
           dispatched++;
           return provider.adapter.executeTrackedQuery({ query: row.queryText, canonicalDomains: domains, competitorDomains, ...run.location ? { location: run.location } : {} }, config);
@@ -18489,7 +18653,7 @@ async function executeResearchRun(db, registry, runId, projectId, options = {})
           rawResponse: raw.rawResponse,
           answerEvidence: raw.evidence ?? null,
           finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(and24(eq31(researchRunQueries.id, row.id), eq31(researchRunQueries.status, ResearchQueryStatuses.running))).run();
+        }).where(and25(eq31(researchRunQueries.id, row.id), eq31(researchRunQueries.status, ResearchQueryStatuses.running))).run();
         if (completed.changes === 1) incrementResearchProgress(db, runId, "completedQueries");
       } catch (error) {
         if (!(error instanceof IncompleteAnswerError && error.resumable)) queryFailure ??= error;
@@ -18544,7 +18708,7 @@ function incrementResearchProgress(db, runId, column) {
 }
 function markResearchQueryFailed(db, runId, queryId, error) {
   const message = describeError(error);
-  const unfinished = and24(eq31(researchRunQueries.id, queryId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses));
+  const unfinished = and25(eq31(researchRunQueries.id, queryId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses));
   if (error instanceof IncompleteAnswerError && error.resumable) {
     db.update(researchRunQueries).set({
       status: ResearchQueryStatuses["waiting-upstream"],
@@ -18560,7 +18724,7 @@ function markResearchQueryFailed(db, runId, queryId, error) {
   if (failed.changes === 1) incrementResearchProgress(db, runId, "failedQueries");
 }
 function markUnfinishedResearchQueriesFailed(db, runId, error) {
-  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and24(eq31(researchRunQueries.researchRunId, runId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
+  db.update(researchRunQueries).set({ status: ResearchQueryStatuses.failed, error, finishedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and25(eq31(researchRunQueries.researchRunId, runId), inArray13(researchRunQueries.status, unfinishedResearchQueryStatuses))).run();
 }
 function finalizeResearchRun(db, runId, fatalError) {
   const rows = db.select({ status: researchRunQueries.status }).from(researchRunQueries).where(eq31(researchRunQueries.researchRunId, runId)).all();
@@ -18580,7 +18744,7 @@ function finalizeResearchRun(db, runId, fatalError) {
 }
 
 // src/google-marketing-sync.ts
-import { and as and25, eq as eq32, isNull as isNull6, sql as sql12 } from "drizzle-orm";
+import { and as and26, eq as eq32, isNull as isNull7, sql as sql12 } from "drizzle-orm";
 var RUNTIME_FAILURE_REASONS = {
   INVALID_INPUT: OutcomeReasonCodes.VALIDATION,
   NOT_CONFIGURED: OutcomeReasonCodes.NOT_CONNECTED,
@@ -18617,7 +18781,7 @@ function assertSnapshotContext(metadata, expected) {
   }
 }
 function requireSyncRun(db, runId, projectId, kind) {
-  const run = db.select().from(runs).where(and25(
+  const run = db.select().from(runs).where(and26(
     eq32(runs.id, runId),
     eq32(runs.projectId, projectId),
     eq32(runs.kind, kind)
@@ -18636,7 +18800,7 @@ function markFailed(db, runId, projectId, kind, expectedStatus, error) {
     status: RunStatuses.failed,
     error: serializeRunError({ message: safeErrorMessage(error) }),
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).where(and25(
+  }).where(and26(
     eq32(runs.id, runId),
     eq32(runs.projectId, projectId),
     eq32(runs.kind, kind),
@@ -18644,7 +18808,7 @@ function markFailed(db, runId, projectId, kind, expectedStatus, error) {
   )).run();
 }
 function claimSyncRun(db, runId, projectId, kind, startedAt) {
-  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and25(
+  const claim = db.update(runs).set({ status: RunStatuses.running, startedAt, error: null }).where(and26(
     eq32(runs.id, runId),
     eq32(runs.projectId, projectId),
     eq32(runs.kind, kind),
@@ -18712,7 +18876,7 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and25(
+      }).where(and26(
         eq32(runs.id, runId),
         eq32(runs.projectId, projectId),
         eq32(runs.kind, RunKinds["google-ads-sync"]),
@@ -18736,11 +18900,11 @@ async function executeGoogleAdsMarketingSync(db, runtime, runId, projectId) {
         lastMetricsSnapshotAt: result.metrics?.metadata.capturedAt ?? connection.lastMetricsSnapshotAt,
         lastMetricsSnapshotId: result.metrics?.metadata.id ?? connection.lastMetricsSnapshotId,
         updatedAt: finishedAt
-      }).where(and25(
+      }).where(and26(
         eq32(googleAdsConnections.id, connection.id),
         eq32(googleAdsConnections.projectId, projectId),
         eq32(googleAdsConnections.selectedCustomerId, connection.selectedCustomerId),
-        connection.selectedLoginCustomerId === null ? isNull6(googleAdsConnections.selectedLoginCustomerId) : eq32(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
+        connection.selectedLoginCustomerId === null ? isNull7(googleAdsConnections.selectedLoginCustomerId) : eq32(googleAdsConnections.selectedLoginCustomerId, connection.selectedLoginCustomerId),
         eq32(googleAdsConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
@@ -18821,7 +18985,7 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         status: RunStatuses.completed,
         finishedAt,
         error: null
-      }).where(and25(
+      }).where(and26(
         eq32(runs.id, runId),
         eq32(runs.projectId, projectId),
         eq32(runs.kind, RunKinds["gtm-sync"]),
@@ -18846,12 +19010,12 @@ async function executeGtmMarketingSync(db, runtime, runId, projectId) {
         lastSnapshotAt: snapshot.metadata.capturedAt,
         lastSnapshotId: snapshot.metadata.id,
         updatedAt: finishedAt
-      }).where(and25(
+      }).where(and26(
         eq32(gtmConnections.id, connection.id),
         eq32(gtmConnections.projectId, projectId),
         eq32(gtmConnections.selectedAccountId, connection.selectedAccountId),
         eq32(gtmConnections.selectedContainerId, connection.selectedContainerId),
-        connection.selectedWorkspaceId === null ? isNull6(gtmConnections.selectedWorkspaceId) : eq32(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
+        connection.selectedWorkspaceId === null ? isNull7(gtmConnections.selectedWorkspaceId) : eq32(gtmConnections.selectedWorkspaceId, connection.selectedWorkspaceId),
         eq32(gtmConnections.selectionGeneration, connection.selectionGeneration)
       )).run();
       if (connectionClaim.changes !== 1) {
@@ -20260,13 +20424,13 @@ async function createServer(opts) {
   const currentPasswordFingerprint = () => hashSessionToken(opts.config.dashboardPasswordHash ?? "");
   opts.db.delete(dashboardSessions).where(or4(
     eq33(dashboardSessions.apiKeyHash, ""),
-    and26(
+    and27(
       isNotNull5(dashboardSessions.passwordFingerprint),
       ne4(dashboardSessions.passwordFingerprint, currentPasswordFingerprint())
     )
   )).run();
   if (!opts.config.dashboardPasswordHash) {
-    const lastPasswordEventAt = (action) => opts.db.select({ at: max(auditLog.createdAt) }).from(auditLog).where(and26(eq33(auditLog.entityType, "dashboard-password"), eq33(auditLog.action, action))).get()?.at ?? null;
+    const lastPasswordEventAt = (action) => opts.db.select({ at: max(auditLog.createdAt) }).from(auditLog).where(and27(eq33(auditLog.entityType, "dashboard-password"), eq33(auditLog.action, action))).get()?.at ?? null;
     const createdAt = lastPasswordEventAt("dashboard-password.created");
     const clearedAt = lastPasswordEventAt("dashboard-password.cleared");
     if (createdAt !== null && (clearedAt === null || clearedAt < createdAt)) {
@@ -20300,7 +20464,7 @@ async function createServer(opts) {
       currentApiKeyHash: apiKeys.keyHash,
       passwordFingerprint: dashboardSessions.passwordFingerprint,
       expiresAt: dashboardSessions.expiresAt
-    }).from(dashboardSessions).innerJoin(apiKeys, eq33(apiKeys.id, dashboardSessions.apiKeyId)).where(and26(eq33(dashboardSessions.tokenHash, tokenHash), isNull7(apiKeys.revokedAt))).get();
+    }).from(dashboardSessions).innerJoin(apiKeys, eq33(apiKeys.id, dashboardSessions.apiKeyId)).where(and27(eq33(dashboardSessions.tokenHash, tokenHash), isNull8(apiKeys.revokedAt))).get();
     if (!session) return null;
     const expiresAt = Date.parse(session.expiresAt);
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || session.apiKeyHash !== session.currentApiKeyHash || session.passwordFingerprint !== null && session.passwordFingerprint !== currentPasswordFingerprint()) {
@@ -20579,7 +20743,7 @@ async function createServer(opts) {
             opts.db.update(projects).set({ answerFieldsRecompute: null }).where(eq33(projects.id, projectId)).run();
             if (recomputeDebts.get(projectId) === debt) recomputeDebts.delete(projectId);
           } else if (debt.latestFull === 0) {
-            opts.db.update(projects).set({ answerFieldsRecompute: "competitors" }).where(and26(eq33(projects.id, projectId), eq33(projects.answerFieldsRecompute, "full"))).run();
+            opts.db.update(projects).set({ answerFieldsRecompute: "competitors" }).where(and27(eq33(projects.id, projectId), eq33(projects.answerFieldsRecompute, "full"))).run();
           }
         } catch (err) {
           app.log.error({ err, projectId }, "could not clear the owed answer field recompute");