@darwinium/portal-mcp 0.0.1 → 0.0.2

package/dist/bin/server-CuNr9ZtJ.js

@@ -0,0 +1,702 @@
+import { t as VERSION } from "./portal-mcp.js";
+import { r as stopTakeoverPolling, t as createWsServer } from "./server-Beyo9MT8.js";
+import { n as readToken } from "./store-B3e4WCLw.js";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, InitializeRequestSchema, LATEST_PROTOCOL_VERSION, ListToolsRequestSchema, SUPPORTED_PROTOCOL_VERSIONS } from "@modelcontextprotocol/sdk/types.js";
+
+//#region src/server/tools.ts
+/**
+* STATIC THREE-TOOL SURFACE (ADR-001).
+*
+* Adding a 4th tool requires:
+* 1. Update ADR-001 with rationale.
+* 2. Update smoke-test.ts assertion `assert.equal(tools.length, 3)` to the new count.
+* 3. Justify in PR description why the dynamic surface (which lives in `get_page_commands` returns)
+*    cannot accommodate the new capability.
+*
+* Claude Desktop and Claude Code cache `tools/list` and do NOT honor `tools/list_changed`
+* (claude-code#7519, #13646). Adding tools without considering host cache behavior is unsafe.
+*
+* ANNOTATIONS ARE MANDATORY. Anthropic's directory review requires every tool to carry
+* a `title` plus the applicable `readOnlyHint` / `destructiveHint`; a tool without them
+* is rejected. `openWorldHint` is false throughout: this server has zero backend
+* connections and reaches nothing beyond the one browser tab it is paired with.
+*/
+const TOOLS = [
+	{
+		name: "get_page_commands",
+		annotations: {
+			title: "List portal page commands",
+			readOnlyHint: true,
+			idempotentHint: false,
+			openWorldHint: false
+		},
+		description: "Lists page commands available on the active Darwinium portal tab. Returns an array of { name, description, args, _pageId }. Call this FIRST in any session to discover what the active tab can do. The list is dynamic — it changes per page; always call this before invoking run_page_command.",
+		inputSchema: {
+			type: "object",
+			properties: {}
+		}
+	},
+	{
+		name: "run_page_command",
+		annotations: {
+			title: "Run a portal page command",
+			readOnlyHint: false,
+			destructiveHint: true,
+			idempotentHint: false,
+			openWorldHint: false
+		},
+		description: "Invokes a named page command on the active Darwinium portal tab with the given arguments. If `expected_page_id` is supplied, the binary checks the live page id first and returns a navigation-error on mismatch so the caller can retry against the new page. Use the exact `name` returned by get_page_commands.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				name: {
+					type: "string",
+					description: "The page-command name as returned by get_page_commands."
+				},
+				args: {
+					type: "object",
+					description: "Arguments to pass to the command (object; shape per the command's args schema)."
+				},
+				expected_page_id: {
+					type: "string",
+					description: "Optional: reject if the live page id no longer matches this value."
+				}
+			},
+			required: ["name"]
+		}
+	},
+	{
+		name: "get_context",
+		annotations: {
+			title: "Get portal instructions and page context",
+			readOnlyHint: true,
+			idempotentHint: false,
+			openWorldHint: false
+		},
+		description: "Returns combined static Darwinium instructions + current page Viper context for the active tab. Capped server-side at 50KB; if the payload would exceed the cap, lower-priority fields are dropped and a `_truncated` flag is set on the response.",
+		inputSchema: {
+			type: "object",
+			properties: {}
+		}
+	}
+];
+
+//#endregion
+//#region src/bridge/errorMapper.ts
+const MESSAGES = {
+	NO_TAB: () => "Not connected. Click Connect in the Darwinium extension popup.",
+	LOST_MID_CALL: () => "Lost connection to portal mid-call. Retry; the extension auto-reconnects within a few seconds.",
+	PAGE_NAVIGATED: (ctx) => `Page navigated. Current page is ${ctx?.newPageId ?? "<unknown>"}. Re-call get_page_commands and retry against the new page.`,
+	TOKEN_MISMATCH: () => "Extension token does not match the binary's token. Re-run install or rotate-token.",
+	TAB_STALE: () => "Extension was reloaded; refresh the connected portal tab to restore the bridge. Re-injection is being attempted automatically."
+};
+function mapError(mode, ctx) {
+	return {
+		content: [{
+			type: "text",
+			text: MESSAGES[mode](ctx)
+		}],
+		isError: true
+	};
+}
+
+//#endregion
+//#region src/bridge/Context.ts
+var Bridge = class {
+	_ws;
+	pending = /* @__PURE__ */ new Map();
+	wsReadyResolvers = [];
+	/**
+	* Whether THIS process owns the 127.0.0.1:9224 listener.
+	*
+	* Only one portal-mcp can own the bridge, but several may run at once (two
+	* MCP hosts, or one host restarting a server before the old process exits).
+	* A non-owner still serves MCP over its own stdio — it just cannot reach the
+	* browser, and says so instead of offering a pairing token that would not
+	* help. Set false while another live instance holds the port; flipped back by
+	* the takeover poll in ws/server.ts when that instance exits.
+	*/
+	_ownsPort = true;
+	hasWs() {
+		return this._ws?.readyState === 1;
+	}
+	/** False when another live portal-mcp instance owns the WS port. */
+	ownsPort() {
+		return this._ownsPort;
+	}
+	setOwnsPort(owns) {
+		this._ownsPort = owns;
+	}
+	/** Wait up to timeoutMs for an extension WS to be attached. Resolves true on attach, false on timeout. */
+	waitForWs(timeoutMs) {
+		if (this.hasWs()) return Promise.resolve(true);
+		return new Promise((resolve) => {
+			const resolveOnce = () => {
+				clearTimeout(timer);
+				resolve(true);
+			};
+			const timer = setTimeout(() => {
+				this.wsReadyResolvers = this.wsReadyResolvers.filter((r) => r !== resolveOnce);
+				resolve(false);
+			}, timeoutMs);
+			this.wsReadyResolvers.push(resolveOnce);
+		});
+	}
+	attach(ws) {
+		if (this._ws) try {
+			this._ws.close(1e3, "replaced");
+		} catch {}
+		this._ws = ws;
+		ws.on("message", (raw) => this.onMessage(raw));
+		ws.on("close", () => {
+			this.rejectPendingFor(ws, /* @__PURE__ */ new Error("LOST_MID_CALL"));
+			if (this._ws === ws) this._ws = void 0;
+		});
+		ws.on("error", () => {});
+		const resolvers = this.wsReadyResolvers;
+		this.wsReadyResolvers = [];
+		for (const r of resolvers) r();
+	}
+	send(op, args, timeoutMs = 3e4) {
+		if (!this.hasWs()) return Promise.reject(/* @__PURE__ */ new Error("NO_TAB"));
+		const owner = this._ws;
+		const id = randomUUID();
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.pending.delete(id);
+				reject(/* @__PURE__ */ new Error("LOST_MID_CALL"));
+			}, timeoutMs);
+			this.pending.set(id, {
+				resolve,
+				reject,
+				timer,
+				ws: owner
+			});
+			try {
+				owner.send(JSON.stringify({
+					id,
+					type: "req",
+					op,
+					args
+				}));
+			} catch (err) {
+				const pending = this.pending.get(id);
+				if (pending) {
+					clearTimeout(pending.timer);
+					this.pending.delete(id);
+				}
+				reject(/* @__PURE__ */ new Error(`Bridge.send failed: ${err.message}`));
+			}
+		});
+	}
+	/** Map an internal error mode to a user-facing structured tool response. */
+	errorResponse(mode, ctx) {
+		return mapError(mode, ctx);
+	}
+	onMessage(raw) {
+		try {
+			const msg = JSON.parse(typeof raw === "string" ? raw : raw.toString());
+			if (msg.type === "resp") {
+				const id = msg.id;
+				const p = this.pending.get(id);
+				if (p) {
+					clearTimeout(p.timer);
+					this.pending.delete(id);
+					if (msg.error) p.reject(new Error(String(msg.error)));
+					else p.resolve(msg.result);
+				}
+			} else if (msg.type === "pageIdChanged") {} else if (msg.type === "ping") try {
+				this._ws?.send(JSON.stringify({ type: "pong" }));
+			} catch {}
+			else if (msg.type === "pong") {}
+		} catch {}
+	}
+	rejectAllPending(err) {
+		for (const p of this.pending.values()) {
+			clearTimeout(p.timer);
+			p.reject(err);
+		}
+		this.pending.clear();
+	}
+	rejectPendingFor(owner, err) {
+		for (const [id, p] of this.pending.entries()) {
+			if (p.ws !== owner) continue;
+			clearTimeout(p.timer);
+			this.pending.delete(id);
+			p.reject(err);
+		}
+	}
+};
+
+//#endregion
+//#region src/server/get-context.ts
+/**
+* 50KB cap + field-drop policy for `get_context` tool responses.
+*
+* The drop paths follow the actual `ConditionerResult` shape
+* (darwinium-node-context/src/types.ts): `featuresExplained` is one key with
+* `globalJourneyMetadata` / `journeyMetadata` sub-arrays.
+*
+* Drop order:
+*   featuresExplained.globalJourneyMetadata → featuresExplained.journeyMetadata →
+*   signals → contexts → stepNames
+* Always retain: viper, page, route, _pageId, instructions.
+* Last-resort: pop viper[] elements until under cap (preserves valid JSON).
+* NEVER byte-truncate JSON.stringify output (would produce invalid JSON).
+*/
+const MAX_BYTES = 5e4;
+const DROP_ORDER = [
+	["featuresExplained", "globalJourneyMetadata"],
+	["featuresExplained", "journeyMetadata"],
+	["signals"],
+	["contexts"],
+	["stepNames"]
+];
+function capContextResponse(input) {
+	const work = JSON.parse(JSON.stringify(input));
+	const truncatedFields = [];
+	let attempt = 0;
+	while (Buffer.byteLength(JSON.stringify(work), "utf8") > MAX_BYTES) {
+		if (attempt >= DROP_ORDER.length) {
+			const viper = work.viper;
+			if (Array.isArray(viper)) {
+				while (viper.length > 0 && Buffer.byteLength(JSON.stringify(work), "utf8") > MAX_BYTES) viper.pop();
+				truncatedFields.push("viper[]");
+			}
+			break;
+		}
+		const path = DROP_ORDER[attempt];
+		deletePath(work, path);
+		truncatedFields.push(path.join("."));
+		attempt++;
+	}
+	if (truncatedFields.length === 0) return work;
+	return {
+		...work,
+		_truncated: true,
+		_truncatedFields: truncatedFields
+	};
+}
+function deletePath(obj, path) {
+	let cur = obj;
+	for (let i = 0; i < path.length - 1; i++) {
+		if (cur == null || typeof cur !== "object") return;
+		cur = cur[path[i]];
+	}
+	if (cur && typeof cur === "object") delete cur[path[path.length - 1]];
+}
+
+//#endregion
+//#region src/server/pairingMessage.ts
+/**
+* Pairing-message builders — surface the per-machine pairing token to the LLM so
+* the user can connect the extension by simply *asking Claude for the token*.
+*
+* The binary (`serve`) reads/generates the token at startup, but the interactive
+* 6-digit OOB pairing flow runs ONLY during `install` / `rotate-token` — a plain
+* Claude Desktop / Claude Code launch (which runs `serve`) has no other delivery
+* path. So the token is embedded in the MCP `initialize.instructions` and in the
+* "not connected" tool responses, where the host LLM can read it out of its own
+* context and hand it to the user on request.
+*
+* Security note: the token is a LOCAL secret that only authorizes a WebSocket on
+* 127.0.0.1:9224. It already lives in the binary's process and the user's own MCP
+* session context — surfacing it to that same user's LLM does not widen the trust
+* boundary. It must NOT be sent anywhere off-machine.
+*/
+/**
+* Instruction block embedded in `initialize.instructions` when the extension is
+* not yet connected. Written so the LLM both (a) understands portal tools are
+* unavailable until pairing, and (b) can answer "what's my token / how do I
+* connect?" directly from context without any tool call.
+*/
+function buildPairingInstructions(token) {
+	return [
+		"The Darwinium Portal browser extension is not connected to this MCP server yet.",
+		"Portal tools (get_page_commands, run_page_command, get_context) will not work until the user pairs the extension.",
+		"",
+		"To connect, the user should:",
+		"  1. Open their Darwinium portal in Chrome (a *.darwinium.com or *.int.darwinium.io tab).",
+		"  2. Click the \"Darwinium Portal MCP\" extension icon in the toolbar.",
+		"  3. Paste the pairing token below into the popup and click \"Save & Connect\".",
+		"",
+		`Pairing token for this machine: ${token}`,
+		"",
+		"When the user asks how to connect, how to pair, or what their pairing token is,",
+		"give them this token and these steps. The token is a local secret valid only on",
+		"127.0.0.1 — it is safe to show to this user, but must never be sent anywhere else."
+	].join("\n");
+}
+/**
+* Shared body for the "another instance owns the bridge" state.
+*
+* Distinct from the pairing state on purpose: the extension may be perfectly
+* paired, but THIS process lost the race for 127.0.0.1:9224. Handing over a
+* pairing token here would send the user round a loop that cannot succeed —
+* the browser is already talking to the other instance.
+*/
+const PEER_INSTANCE_BODY = [
+	"Another copy of the Darwinium Portal bridge is already running on this machine",
+	"and owns the local connection to the browser (127.0.0.1:9224). Only one copy can",
+	"hold it at a time.",
+	"",
+	"Portal tools will not work in THIS session until that copy exits. To fix it:",
+	"  - Use the portal tools from the Claude session that is already connected, OR",
+	"  - Quit the other Claude client (Claude Desktop, or Claude Code in a terminal)",
+	"    and this session will take over the bridge automatically within a few seconds.",
+	"",
+	"Do NOT tell the user to re-pair or paste a pairing token — the extension is not",
+	"the problem here, and pairing again will not resolve it."
+];
+/** `initialize.instructions` variant for the peer-owns-the-bridge state. */
+function buildPeerInstanceInstructions() {
+	return [
+		"The Darwinium Portal MCP server started, but could not claim the browser bridge.",
+		"",
+		...PEER_INSTANCE_BODY
+	].join("\n");
+}
+/** Tool-result variant for the peer-owns-the-bridge state. */
+function buildPeerInstanceMessage() {
+	return [
+		"The Darwinium Portal bridge is not available to this session.",
+		"",
+		...PEER_INSTANCE_BODY
+	].join("\n");
+}
+/**
+* Text returned in place of the NO_TAB error when a tool is called while the
+* extension is not connected. Same token + steps as the instructions block, kept
+* short for an inline tool result.
+*/
+function buildPairingMessage(token) {
+	return [
+		"The Darwinium Portal browser extension is not connected yet.",
+		"",
+		"To connect: open your Darwinium portal tab (*.darwinium.com or *.int.darwinium.io), click the",
+		"\"Darwinium Portal MCP\" extension icon, paste this pairing token, and click",
+		"\"Save & Connect\":",
+		"",
+		`    ${token}`,
+		"",
+		"Then retry your request. (This token is a local pairing secret for 127.0.0.1 —",
+		"safe to share with the user, but not off-machine.)"
+	].join("\n");
+}
+
+//#endregion
+//#region src/server/bridgeCallHandler.ts
+/**
+* MCP `tools/call` handler for the static three-tool surface (ADR-001):
+* get_page_commands, run_page_command, get_context. Tool-name strings MUST
+* match tools.ts exactly. The binary keeps no page-id cache — expected_page_id
+* is checked via a live listCommands probe (see run_page_command below).
+*/
+/**
+* Zod arg schema for `run_page_command`. A malicious or buggy MCP host could
+* send ill-typed `name`/`expected_page_id` values that mis-route the call or
+* trigger stack-trace-eliciting code paths on the page side, so the schema
+* validates the trust-boundary fields we control. Page-command payload
+* (`args.args`) stays `unknown` — page-side commands have their own arg
+* shapes; the binary's job is to forward, not to validate the entire matrix.
+* `passthrough()` keeps unknown sibling fields rather than stripping them.
+*/
+const RunPageCommandArgsSchema = z.object({
+	name: z.string(),
+	args: z.unknown().optional(),
+	expected_page_id: z.string().optional()
+}).passthrough();
+/**
+* Key a page command sets to return a picture rather than a description of one.
+* Must match IMAGE_ENVELOPE_KEY in aphex-frontend's common/mcp/screenshot.ts.
+*/
+const IMAGE_ENVELOPE_KEY = "__image";
+/** Base64 above this is refused: it would blow the host's response budget for no gain. */
+const MAX_IMAGE_BASE64_BYTES = 4 * 1024 * 1024;
+const readImageEnvelope = (result) => {
+	if (!result || typeof result !== "object") return null;
+	const envelope = result[IMAGE_ENVELOPE_KEY];
+	if (!envelope || typeof envelope !== "object") return null;
+	const { mimeType, base64 } = envelope;
+	if (typeof mimeType !== "string" || !mimeType.startsWith("image/")) return null;
+	if (typeof base64 !== "string" || base64 === "") return null;
+	return {
+		mimeType,
+		base64
+	};
+};
+/**
+* Splits an image-carrying result into an MCP image block plus the remaining
+* fields as text. The base64 is never repeated in the text half — that is the
+* whole point: as JSON it is unreadable bulk, as an image block it is something
+* the model can look at.
+*/
+const buildImageResponse = (result, image) => {
+	const { [IMAGE_ENVELOPE_KEY]: envelope, ...rest } = result;
+	const { base64: _omitted, ...meta } = envelope ?? {};
+	if (image.base64.length > MAX_IMAGE_BASE64_BYTES) return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({
+				...rest,
+				...meta,
+				error: `the capture is ${Math.round(image.base64.length / 1024)}KB, above the ${MAX_IMAGE_BASE64_BYTES / 1024 / 1024}MB limit`,
+				hint: "Re-run with a smaller maxWidth, format \"jpeg\", or a cardTitle to capture one card instead of the board."
+			}, null, 2)
+		}],
+		isError: true
+	};
+	return { content: [{
+		type: "text",
+		text: JSON.stringify({
+			...rest,
+			...meta
+		}, null, 2)
+	}, {
+		type: "image",
+		data: image.base64,
+		mimeType: image.mimeType
+	}] };
+};
+function makeBridgeCallHandler(bridge, token) {
+	return async (req) => {
+		const { name, arguments: rawArgs } = req.params;
+		const args = rawArgs ?? {};
+		if (!bridge.ownsPort()) return {
+			content: [{
+				type: "text",
+				text: buildPeerInstanceMessage()
+			}],
+			isError: true
+		};
+		if (!bridge.hasWs()) return {
+			content: [{
+				type: "text",
+				text: buildPairingMessage(token)
+			}],
+			isError: true
+		};
+		try {
+			switch (name) {
+				case "get_page_commands": {
+					const result = await bridge.send("listCommands", {}, 1e4);
+					return { content: [{
+						type: "text",
+						text: JSON.stringify(result, null, 2)
+					}] };
+				}
+				case "run_page_command": {
+					const parsed = RunPageCommandArgsSchema.safeParse(args);
+					if (!parsed.success) return {
+						content: [{
+							type: "text",
+							text: `Invalid run_page_command args: ${parsed.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ")}`
+						}],
+						isError: true
+					};
+					const validated = parsed.data;
+					if (typeof validated.expected_page_id === "string") {
+						const commands = await bridge.send("listCommands", {}, 1e4);
+						const currentPageId = Array.isArray(commands) ? commands.map((c) => c._pageId).find((pid) => typeof pid === "string" && pid !== "" && pid !== "global") ?? null : null;
+						if (currentPageId !== null && currentPageId !== validated.expected_page_id) return bridge.errorResponse("PAGE_NAVIGATED", { newPageId: currentPageId });
+					}
+					const result = await bridge.send("runCommand", {
+						name: validated.name,
+						args: validated.args
+					}, 6e4);
+					const image = readImageEnvelope(result);
+					if (image) return buildImageResponse(result, image);
+					return { content: [{
+						type: "text",
+						text: JSON.stringify(result, null, 2)
+					}] };
+				}
+				case "get_context": {
+					const [contextResult, instructionsResult] = await Promise.all([bridge.send("runCommand", {
+						name: "getCurrentNodeContext",
+						args: {}
+					}, 1e4), bridge.send("runCommand", {
+						name: "getDarwiniumInstructions",
+						args: {}
+					}, 1e4)]);
+					const capped = capContextResponse({
+						...contextResult ?? {},
+						instructions: instructionsResult?.instructions ?? ""
+					});
+					return { content: [{
+						type: "text",
+						text: JSON.stringify(capped, null, 2)
+					}] };
+				}
+			}
+			throw new Error(`Unknown tool: ${name}`);
+		} catch (err) {
+			const msg = err.message;
+			if (msg === "NO_TAB") return bridge.errorResponse("NO_TAB");
+			if (msg === "LOST_MID_CALL") return bridge.errorResponse("LOST_MID_CALL");
+			if (msg === "TAB_STALE") return bridge.errorResponse("TAB_STALE");
+			return {
+				content: [{
+					type: "text",
+					text: `Tool error: ${msg}`
+				}],
+				isError: true
+			};
+		}
+	};
+}
+
+//#endregion
+//#region src/vendor/darwinium-instructions/__generated__/assets.ts
+const SYNTAX_MD = "Darwinium has it's Query Syntax used for:\n\n- Searching Data in Investigations\n- Defining signals in rules\n\nThe query syntax was designed to be _portable_ - meaning that in most occasions it can be interchanged between a query in the **Investigations view** and a condition in the **rules editor**.\n\n<h2> Quick Start </h2>\n```sql\n// Simple search\nevent_type = 'misc_other'\n\n// Most attribute have dots in their name, based on their attribute group\nprofiling.javascript.os= \"Mac OS X\"\nprofiling.javascript.browser= \"Firefox\"\n\n// Some attributes have CONTEXTs, accessed with \\[' ']\nidentity\\['ACCOUNT'].email\\['PERSONAL'].email = '[test@test.com](mailto:test@test.com)'\noutcome\\['CHAMPION'].decision_strategy.result = 'reject'\n\n// Can combine logic; AND, OR, (brackets).\n// Logic can be UPPER or lower. Attributes are lower only.\nevent_type = 'misc_other' OR step_name = 'Login'\n\n// IN can be used to check many values in a list.\n// Single or double quotes work for strings.\nevent_type IN ('account_login_success', \"account_login_failed\")\n\n// Logical negative is done with NOT or ! character\nstep_url != \"/login\"\nstep_url NOT IN (\"/login\", \"/register\")\n\n// Empty attribute values are checked with null keyword\nstep_url = null\nstep_url != null\n// Empty string attributes can also be searched with\nstep_url = ''\n\n// Mathematical operators work on numerical attributes\npayment.amount >= 10\n\n// Maps eg. feature\\:value dicts can be accessed with attr\\['keyvalue']\n// Note: This is true of attribute CONTEXTs too.\noutcome\\['CHAMPION'].features.general\\['cnt_dvcid_for_eml_inc'] != null\noutcome\\['CHAMPION'].features.general\\['cnt_dvcid_for_eml_inc'] > 2\n\n// Presence in an Array eg. signals can be checked with has function\n// Functions are camelCase\nhas(outcome\\['CHAMPION'].models.signals, \"Device used first time\")\n!has(outcome\\['CHAMPION'].models.signals, \"Device used first time\")\n\n```\n\n<h2> Contexts </h2>\nYou may notice in [Attribute Reference](/v1/docs/attribute-reference) that a number of attributes have *contexts*. For example:\n```\n\n```\nidentity['ACCOUNT'].email['PERSONAL'].email\n```\n\n````\nin this case, `identity[]` has the following possible values:\n* `ACCOUNT`\n* `BENEFICIARY`\n* `BILLING`\n* `ORIGINATOR`\n..and `.email[]` has the following possible values:\n* `PERSONAL`\n* `WORK`\nThese *contexts* help to namespace attribute values such that you can store information on multiple accounts, for example - a Primary account (`identity['ACCOUNT']`) and a beneficiary (`identity['BENEFICIARY']`) at the same time, in the same event. This is inherently useful for developing rules around these specific contexts, as is the case with multi-party payments, for example.\n\n<h2>Query Operators</h2>\nAll operators are case insensitive\n| Operator | Behavior | Example |\n| --- | --- | --- |\n| `<`, `>`, `<=`, `>=` | Mathematical comparison on numeric data, returning boolean | `time_since_last_step > 10000` |\n| `=` , `!=` | Equality and Inequality operators, returning boolean. Inequality _includes_ empty data.| ```previous_step != 'HomePage'``` <br> (will return events where step is named something else INCLUDING where empty)|\n| `+` (add), `-` (minus), `*` (multiply), `/` (divide), `%` (modulo) | Mathematical operators on numeric data, returning numeric. | `time_since_last_step > 10000 * 60` |\n| `(` , `)` | Brackets either for expression evaluation priority or to define lists of values | `(transaction.amount+1)/100 > 1`|\n| `TRUE`, `FALSE` | Boolean literals | |\n| `NULL` | Expression for checking NULL. <br> <span style=\"color:red\">Note: Should instead use empty string `\"\"` for absent data in string types.</span> | |\n| `AND`, `OR` | Logical operators to combine boolean expressions. Returns boolean. | `step_method = 'post' AND event_type = 'PreAuthentication'` |\n|`IN`,  `NOT` | Check if attribute value is in or not in a list of possibilities. Concise way of multiple equality checks linked with or. _Can also be used to match a value  with wildcard contexts_.  Returns boolean. | <ul> <li>`step_name not in ('ChangeDetails', 'ChangeDetailsPage')`</li><li>`'foo@bar.com' in identity['*'].email['*'].email`</li></ul> |\n| `AS` | Casts a value of one type to another type | <ul><li>`'true' as boolean`</li><li> `3.14 as string = \"3.14\"`</li><li>`'3.14' as number > 3` </li><li>`timestamp as int` </li><li>`1726055925860 as datetime` </li></ul> |\n\n<h2>Logic & String Functions</h2>\n| Operator | Behavior | Example |\n| --- | --- | --- |\n| `has(arrayAttribute, value)` | Checks if value is present in the arrayAttribute. Returns boolean; true if value is present, false otherwise. | `has(previous_steps, 'ChangeDetails')` |\n| `if(condition, valueIfTrue, valueIfFalse)` | Inline If. Condition is any boolean expression. Returns type given in valueIfTrue or valueIfFalse.| `if(previous_step = 'LoginAttempt', 1, 0)` |\n| `regexMatch(attribute, regexString)` | Check if an attribute matches a regex pattern. Returns boolean. Note - this will not work in the query editor for PII attributes (but will in rules and features) | `regexMatch(auction.title, '.*fluff'` |\n| `concat(...values)` | Concatenates multiple strings into a single string | `concat(\"hello\", \"world\") = \"helloworld\"` |\n\n<h2> Date Functions </h2>\n| Operator | Behavior | Example |\n| --- | --- | --- |\n| `now()` | Returns a date containing the current timestamp in milliseconds since epoch, January 1, 1970 | `timestamp < now()` |\n| `day(dateAttribute)` | Returns the day of month | `day(timestamp) = 6`|\n| `month(dateAttribute)`| Returns the month of a year for the input date | `month(timestamp) = 2`|\n| `year(dateAttribute)`| Returns the year of an input date or timestamp | `year(timestamp) = 2024` |\n\n<h2> Math Functions </h2>\n| Operator | Behavior | Example |\n| --- | --- | --- |\n| `random()` | Returns a random number between 0 and 1 | |\n| `floor(x)` | Takes as input a real number x, and gives as output the greatest integer less than or equal to `x` | `floor(2.35) = 2` |\n| `ceil(x)` | computes the smallest integer that is greater than or equal to `x` | `ceil(2.35) = 3` |\n| `log(x)` | Log natural of `x` | `log(1) = 0` |\n| `log2(x)` | log2 of `x` | `log2(16) = 4` |\n| `log10(x)` | log10 of `x` | `log10(100) = 2` |\n| `abs(x)` | absolute value of `x` | <ul><li> `abs(-1) = 1` </li><li> `abs(1) = 1`</li></ul> |\n| `sqrt(x)` | square root of `x` | `sqrt(4) = 2` |\n| `cos(x)` | cosine of `x` | |\n| `sin(x)` | sine of `x` | |\n| `tan(x)` | tangent of `x`| |\n| `acos(x)` | arc-cosine of `x`| |\n| `asin(x)` | arc-sine of `x` | |\n| `atan(x)` | arc-tan of `x` | |\n| `cosh(x)` | hyperbolic cosine of `x` | |\n| `sinh(x)` | hyperbolic sine of `x`| |\n| `tanh(x)` | hyperbolic tangent of `x`| |\n| `acosh(x)` | arc-hyperbolic cosine of `x` | |\n| `asinh(x)` | arc-hyperbolic sine of `x`| |\n| `atanh(x)` | arc-hyperbolic tangent of `x`| |\n\n<h2> Geographic Functions </h2>\n| Operator | Behavior | Example |\n| --- | --- | --- |\n| `distance(coordinate1, coordinate2, \"miles\"\\|\"kilometers\")` | Calculates the distance between 2 coordinate pairs in miles or kilometers | `distance([profiling.tcp_connection['PRIMARY'].ipdb.latitude, profiling.tcp_connection['PRIMARY'].ipdb.longitude] , [profiling.tcp_connection['DNS'].ipdb.latitude, profiling.tcp_connection['DNS'].ipdb.longitude] , \"kilometers\") > 1000` |\n\n<h2> Data Type Considerations </h2>\n| Data Type | Description |\n| --- | --- |\n| String Literal | Contain within quotes eg. `journey_name = 'marketplace'`. Absent data can be searched with: `= \"\"` |\n| Maps | Use square brackets and quotes to access values for certain keys eg. `custom.general_purpose['valid'] = 'yes'` |\n| Arrays | <ul> <li> use an index to reference the exact value. e.g `previous_steps[0] = 'MyLogin'`</li><li> use `has` to check for the presence of a value in an array. eg `has(previous_steps, 'MyLogin')`\n````\n";
+const FEATURES_TS = "export type InUnits = 'kilometers' | 'miles';\n\nexport const ALL_EVENT_TYPES = [\n  'account_address_change',\n  'account_creation',\n  'account_deactivate',\n  'account_details_change',\n  'account_forgot_user_id',\n  'account_login',\n  'account_login_failed',\n  'account_login_success',\n  'account_logout',\n  'account_password_change',\n  'account_password_reset',\n  'account_settings',\n  'add_to_cart',\n  'api_request',\n  'auction_bid',\n  'auction_delete_listing',\n  'auction_listing',\n  'auth_challenge',\n  'auth_challenge_pass',\n  'balance',\n  'billing_add_payment_method',\n  'billing_manage_payment_method',\n  'billing_remove_payment_method',\n  'bind_policy',\n  'browse_site',\n  'checkout',\n  'contact_details_change_address',\n  'contact_details_change_email',\n  'contact_details_change_other',\n  'contact_details_change_phone',\n  'contact_us',\n  'deposit',\n  'digital_download',\n  'digital_stream',\n  'home_page',\n  'image_upload',\n  'insurance_claim',\n  'insurance_get_quote',\n  'insurance_new_policy',\n  'insurance_policy_ammend',\n  'intervention',\n  'loan_acceptance',\n  'message',\n  'misc_other',\n  'monitor',\n  'page_land',\n  'payment',\n  'pre_authentication',\n  'profiling',\n  'purchase',\n  'remove_from_cart',\n  'transaction_history',\n  'withdrawal',\n  'transfer',\n  'bot_check',\n];\n\ntype EventTypeTuple = typeof ALL_EVENT_TYPES;\nexport type EventType = EventTypeTuple[number];\n\nexport const HTTP_METHODS = ['GET', 'POST', 'PUT', 'OPTIONS', 'PATCH', 'DELETE'];\ntype HttpMehodTuple = typeof HTTP_METHODS;\nexport type HttpMethod = HttpMehodTuple[number];\n\nexport const URL_MATCH_TYPES = ['Prefix', 'Exact', 'ExactWithQuery', 'Glob'];\ntype UrlMatchTypeTuple = typeof URL_MATCH_TYPES;\nexport type UrlMatchType = UrlMatchTypeTuple[number];\n\nexport const ALL_TIMEZONE_OFFSETS = [\n  'UTC-12:00',\n  'UTC-11:00',\n  'UTC-10:00',\n  'UTC-09:30',\n  'UTC-09:00',\n  'UTC-08:00',\n  'UTC-07:00',\n  'UTC-06:00',\n  'UTC-05:00',\n  'UTC-04:00',\n  'UTC-03:30',\n  'UTC-03:00',\n  'UTC-02:00',\n  'UTC-01:00',\n  'UTC+00:00',\n  'UTC+01:00',\n  'UTC+02:00',\n  'UTC+03:00',\n  'UTC+03:30',\n  'UTC+04:00',\n  'UTC+04:30',\n  'UTC+05:00',\n  'UTC+05:30',\n  'UTC+05:45',\n  'UTC+06:00',\n  'UTC+06:30',\n  'UTC+07:00',\n  'UTC+08:00',\n  'UTC+08:45',\n  'UTC+09:00',\n  'UTC+09:30',\n  'UTC+10:00',\n  'UTC+10:30',\n  'UTC+11:00',\n  'UTC+12:00',\n  'UTC+12:45',\n  'UTC+13:00',\n  'UTC+14:00',\n];\n\ntype TimezoneTuple = typeof ALL_TIMEZONE_OFFSETS;\nexport type TimezoneOffset = TimezoneTuple[number];\n\n/* Directive for autocomplete : this only applies to identifiers or subject */\n/* drop down needs to NOT provide normal attribs */\nexport type Attribute = string;\nexport type NumericAttribute = string;\nexport type CoordinateAttribute = string;\n\nexport interface Features {\n  features: Feature[];\n}\n\nexport interface Events {\n  event_type: EventType[] | 'all' | 'same_type';\n  include_current_event?: boolean | undefined;\n  condition?: string | null;\n  with_the_same: Attribute[];\n  with_similarity?: number;\n}\n\nexport interface IntoFeatures {\n  count?: Attribute | null;\n  sum?: Attribute | null;\n  minimum?: Attribute | null;\n  maximum?: Attribute | null;\n  average?: Attribute | null;\n  range?: Attribute | null;\n  mode?: Attribute | null;\n  median?: Attribute | null;\n  standard_deviation?: Attribute | null;\n  average_deviation?: Attribute | null;\n  variance?: Attribute | null;\n  coefficient_of_variation?: Attribute | null;\n  sample_variance?: Attribute | null;\n  sample_standard_deviation?: Attribute | null;\n  z_score?: Attribute | null;\n  quantile?: Attribute | null;\n}\n\nexport type ExcludeDays = 'weekdays' | 'weekends';\n\nexport interface ApproximateDistinctCountOf {\n  attributes: Attribute[]; //can be any attribute\n  event_type: EventType[] | 'all' | 'same_type';\n}\n\nexport interface SpecificityOf extends ApproximateDistinctCountOf {\n  normalize: boolean;\n}\n\nexport interface VelocityOf {\n  // attributes: Attribute[] // any identiers or subjects\n  for_events: Events;\n}\n\nexport interface DistinctCountOf {\n  attributes: Attribute[]; // identifiers or subjects\n  for_events: Events;\n}\n\nexport interface TimeSinceFirst {\n  events: Events;\n}\n\nexport interface TimeSinceLast {\n  events: Events;\n}\n\nexport interface DistanceFromFirst {\n  events: Events;\n  coordinate: string;\n  in_units: InUnits;\n}\n\nexport interface DistanceFromLast {\n  events: Events;\n  coordinate: string;\n  in_units: InUnits;\n}\n\nexport interface StatisticOfNumeric {\n  attribute: NumericAttribute; // Must be a integer or real SUBJECT\n  for_events: Events;\n  into_features: IntoFeatures;\n}\n\nexport interface StatisticOfExpression {\n  expression: string;\n  for_events: Events;\n  into_features: IntoFeatures;\n}\n\nexport interface ProbabilityOfTime {\n  for_events: Events;\n  bucket: TimeWindow;\n  periodicity: TimeWindow;\n  exclude?: ExcludeDays;\n}\n\nexport interface TimeBetween {\n  events: Events;\n  into_features: IntoFeatures;\n}\n\nexport interface DistanceBetween {\n  events: Events;\n  coordinate: CoordinateAttribute;\n  in_units: InUnits;\n  into_features: IntoFeatures;\n}\n\nexport interface DistanceFrom {\n  events: Events;\n  coordinate: CoordinateAttribute;\n  in_units: InUnits;\n  into_features: IntoFeatures;\n}\n\nexport interface DistanceBetweenPointsWithin {\n  events: Events;\n  coordinate: CoordinateAttribute;\n  and: CoordinateAttribute;\n  in_units: InUnits;\n  into_features: IntoFeatures;\n}\n\nexport interface QuantileOfNumeric {\n  attribute: NumericAttribute;\n}\n\nexport interface QuantileValue {\n  attribute: NumericAttribute;\n  quantile: number;\n}\n\nexport interface ApproximateTotalCount {\n  attribute: NumericAttribute;\n}\n\nexport interface EnrichmentValue {\n  attribute: Attribute;\n  reference_key: string;\n}\n\nexport interface FindThe {\n  velocity_of?: VelocityOf;\n  distinct_count_of?: DistinctCountOf;\n  time_since_first?: TimeSinceFirst;\n  time_since_last?: TimeSinceLast;\n  distance_from_first?: DistanceFromFirst;\n  distance_from_last?: DistanceFromLast;\n  statistic_of_numeric?: StatisticOfNumeric;\n  time_between?: TimeBetween;\n  distance_between?: DistanceBetween;\n  distance_from?: DistanceFrom;\n  distance_between_points_within?: DistanceBetweenPointsWithin;\n  approx_distinct_count_of?: ApproximateDistinctCountOf;\n  approx_total_count_of?: ApproximateTotalCount;\n  specificity_of?: SpecificityOf;\n  quantile_of_numeric?: QuantileOfNumeric;\n  quantile_value?: QuantileValue;\n  enrichment_value?: EnrichmentValue;\n  result_of_expression?: string;\n  statistic_of_expression?: StatisticOfExpression;\n  probability_of_time?: ProbabilityOfTime;\n}\n\nexport type TimeWindow =\n  | 'all'\n  | {\n      mins?: number;\n      hours?: number;\n      days?: number;\n      weeks?: number;\n      months?: number;\n      events?: number;\n      since_last_event?: 'all' | EventType[];\n      since_beginning_of_calendar_month?: TimezoneOffset;\n      since_beginning_of_calendar_day?: TimezoneOffset;\n    };\n\nexport type Starting =\n  | 'immediately'\n  | {\n      mins_in_the_past?: number;\n      hours_in_the_past?: number;\n      days_in_the_past?: number;\n      months_in_the_past?: number;\n      events_in_the_past?: number;\n    };\n\nexport type WithScope =\n  | 'global'\n  | 'same_organization'\n  | 'same_primary_industry'\n  | 'same_primary_and_secondary_industry'\n  | 'same_node_instance';\nexport interface Feature {\n  name: string;\n  default_value?: number;\n  find_the: FindThe;\n  time_window?: TimeWindow;\n  starting?: Starting;\n  with_scope?: WithScope;\n  calculate_quantile?: boolean;\n}\n";
+
+//#endregion
+//#region src/vendor/darwinium-instructions/labelList.ts
+const STATIC_LABEL_LIST = `* there's a function called checkLabel to check for labels on Darwinium. it takes the form \`checkLabel(\"label name\", [attributes, relevant, here], [contexts, go, here])\`  . For now, make contexts irrelevant. Here is some possible label names:\n\n\`\`\`'[\"second_party_fraud\",\"speed_tester\",\"watch_list\",\"open_proxy\",\"mail_attack\",\"purchase_scam\",\"spam_outbound\",\"advance_fee_scam\",\"monitor_list\",\"open_socks_proxy\",\"challenged\",\"click_fraud\",\"fake_review\",\"spam_inbound\",\"self_excluded\",\"malware\",\"incorrect_format\",\"bonus_abuse\",\"challenge_timeout\",\"operator_review_passed\",\"site_monitor\",\"anon_vpn_service\",\"romance_scam\",\"additional_payload\",\"chargebacks_payment_fraud\",\"claims_fraud\",\"identity_theft\",\"onion_router\",\"voip_fraud\",\"challenge_passed\",\"feed_fetcher\",\"schema_validated\",\"false_positive\",\"fake_listing\",\"data_breach\",\"block_list\",\"impersonation_scam\",\"identity_fraud_stolen_credentials\",\"link_checker\",\"marketing_crawler\",\"cybercrime\",\"phishing_content\",\"uncategorized_crawler\",\"scripted_attack_fraud\",\"ghost_broker_fraud\",\"bitcoin_node\",\"problem_gambler\",\"account_takeover_social_engineering\",\"web_attack\",\"login_failed\",\"account_lock\",\"screenshot_creator\",\"schema_violation\",\"self_excluded_linked_identifier\",\"cgi_proxy\",\"fake_crawler\",\"click_and_collect_fraud\",\"false_negative\",\"marked_for_operator_review\",\"first_party_fraud\",\"bot_abuse\",\"vip_list\",\"web_scraper\",\"trusted_identity\",\"login_passed\",\"promo_abuse\",\"sim_swap_fraud\",\"tor_exit_node\",\"ssh_attack\",\"other_app_scam\",\"challenge_failed\",\"account_takeover_change_of_details\",\"redirect_scam\",\"search_engine_crawler\",\"tools_crawler\",\"virus_scanner_crawler\",\"allow_list\",\"anon_proxy\",\"reseller_abuse\",\"money_mule_money_laundering\",\"synthetic_identity_fraud\",\"investment_scam\",\"cookie_copy\",\"account_takeover\",\"toxic_content_abuse\",\"collusive_payment_fraud\",\"benefit_theft_fraud\",\"subscription_fraud\",\"vulnerability_scanner\",\"legacy_connection\",\"legacy_device\"]'\`\`\``;
+
+//#endregion
+//#region src/vendor/darwinium-instructions/promptBlocks.ts
+const SEPARATOR = "\n\n---\n\n";
+function getStaticInstructions() {
+	return [
+		`*Instructions:*`,
+		`* If a user appears to be asking for documentation, you should use the \`get_documentation\` tool. Just return that as a response.`,
+		`<queries>`,
+		`* To find attributes for use in queries, use the \`get_attribute\` tool with a search term (e.g., "ip address", "device", "email", "geolocation", "browser", "user agent"). This will return matching attributes with their proper syntax, data types, descriptions, and example values.`,
+		`* query syntax:\n\`\`\`\n${SYNTAX_MD}\n\`\`\``,
+		`* ignore ipdb and integrations.*; event disposition in outcome['CHAMPION'].decision_strategy.result`,
+		`* don't use event_type in the query. You dont know what its possible values are`,
+		`* NEVER Make up feature names. Use the feature definitions and signals to get names. If none exist, suggest code for them in YAML. Prefix this with "I couldnt find any features that to what you want"`,
+		`* // Comments prohibited; wildcards only with IN operator`,
+		`* NEVER MAKE UP SIGNAL NAMES. Use only the signal names defined below `,
+		`* ALWAYS TRY to use \`get_attribute\` to find inbuilt attributes before using features or signals `,
+		`* ALWAYS use \`get_attribute\` to look up the correct attribute syntax before building queries. Do not guess attribute names.`,
+		`* prefer device SIGNATURE over profiling.device.identifier whenever possible`,
+		`* wildcards can be used. for example:
+    "192.168.0.1" in profiling.tcp_connection['*'].ip_address
+     "ben@cool.com" in identity['*'].email['PERSONAL'].email
+     * wildcards CAN ONLY BE used in conjunction with the 'IN' operator (see above). Where non-wildcard attributes are used, the "=" operator can be used instead.`,
+		`* Model scores: outcome['CHAMPION'].models.score['<model>'] < -500`,
+		`* Biometrics: null‐check before use (see docs)`,
+		STATIC_LABEL_LIST,
+		`* checkLabel must include at LEAST ONE attribute in the 2nd argument. Common options are device signature, email, username and login
+     * checkLabel returns a Boolean. The result is always Boolean. If it is not a Boolean you are doing something wrong.
+     * events are rarely labelled by customer. You should avoid RELYING on checkLabel to get results. ie. use it with OR to get more results`,
+		`* signals in $.journeyMetadata are accessed using \`has(outcome['CHAMPION'].models.signals, "<signal_name>")\`
+     * signals in $.globalJourneyMetadata are accessed using \`has(profiling.device.signals, "<signal_name>")\`
+     * DO NOT GUESS SIGNAL NAMES. Use the signals in the arrays above to get the names.
+     * has() only takes a single signal name, not an array`,
+		`* you should ALWAYS use tools provided to validate queries and get counts. You may want to break your query down into smaller tokens you use in multiple tool calls so you can get a sense of the counts for smaller parts of an overall query. A query that returns a count > 0 is a good query.`,
+		`* Output: wrap query in markdown code block (backticked as \`\`\`astifier\n {{result}} \n \`\`\`, SINGLE LINE ONLY), then one‐sentence explanation. Include the count of events matching the query (from the validate_query tool. This is for the last 30 days. make that clear to the user)`,
+		`</queries>`,
+		`<features>`,
+		`* if generating features, output YAML in a format that strictly matches the following typescript schema:\n\`\`\`typescript\n${FEATURES_TS}\n\`\`\``,
+		`* if you use a tool to create features you MUST validate any \`condition\` or \`result_of_expression\` that is returned. If it is not valid, you must fix it before returning the feature`,
+		`* if generating features code it must ALWAYS be backticked as \`\`\`features\n{{result}}\n\`\`\``,
+		`* there is a dedicated tool for generating features called \`generate_features\`. You should use this tool and validate any inline queries if they are present`,
+		`</features>`,
+		`<tool_calling>`,
+		`* ALWAYS follow the tool call schema exactly as specified and make sure to provide all necessary parameters.`,
+		`* there is a tool called \`get_page_commands\` that returns the tools available on the current page. You should ALWAYS call this tool first to see what tools are available. If workflow/policy editing is in play, the page may expose a page command named \`getWorkspaceProblems\` — treat it the same way you treat \`validate_query\` for queries: a required sanity check, but invoke it via \`run_page_command\`.`,
+		`* If the user mentions errors, validation failures, red squiggles, "it's broken", "why won't it compile", or is iterating on a policy / workflow / Journey file, you MUST call \`get_page_commands\` and then, if \`getWorkspaceProblems\` is available, call \`run_page_command\` with \`{ commandName: "getWorkspaceProblems", args: {} }\` before answering. Do not guess at errors — the Journey language server is authoritative and its diagnostics are reachable via that page command.`,
+		`* After any tool-driven edit to workspace files (e.g. feature/policy changes), re-run the page command via \`run_page_command\` with \`{ commandName: "getWorkspaceProblems", args: {} }\` to confirm the workspace is clean before telling the user the change is done. If diagnostics are present, summarize them (file, line, message) and propose a fix rather than claiming success.`,
+		`* When \`run_page_command\` for \`getWorkspaceProblems\` returns nothing, say so explicitly — "no diagnostics reported by the language server" — so the user knows you checked.`,
+		`* Prefer \`run_page_command\` with \`{ commandName: "getWorkspaceProblems", args: {} }\` for a workspace-wide sweep; pass \`{ commandName: "getWorkspaceProblems", args: { uri: "<relative path>" } }\` only when the user has scoped the question to one file.`,
+		`* if a user asks you to analyze a graph, you should ALWAYS use the \`listGraphsByName\` command first to see what graphs are available. The user may not have provided the name of the graph properly, and the graph names are case sensitive (which they will not be aware of)`,
+		`* If graphs are available, you should check whether a \`getGraphScreenshotByName\` command is available. Screenshots often disclose interesting insights on the data and help you understand what is being rendered. `,
+		`* if graphs are available you should run BOTH \`getGraphScreenshotByName\` and \`getGraphDataByName\` to get the data and the screenshot. You should then analyze the screenshot and data to provide insights to the user.`,
+		`* when selecting columns on the table/grid using the \`selectColumns\` command, you should ALWAYS select \`identifier\` and \`timestamp\` columns.`,
+		`* NEVER embed any screeenshots you capture in your response. Just provide your insights on the image and/or graph data.`,
+		`</tool_calling>`
+	].join(SEPARATOR);
+}
+
+//#endregion
+//#region src/server/instructions.ts
+/**
+* Marks the static block as a snapshot rather than live portal state, so the model
+* does not report stale signal or label names as authoritative.
+*/
+const STATIC_FALLBACK_NOTE = [
+	"",
+	"---",
+	"",
+	"NOTE: the Darwinium guidance above is a static snapshot bundled with this server,",
+	"not live state read from the portal. Query syntax and general guidance are reliable.",
+	"Signal names, feature names and label lists may be out of date — once the extension",
+	"is connected, call get_context to refresh them before relying on them."
+].join("\n");
+/**
+* Static instructions plus the snapshot caveat. Wrapped so a defect in the vendored
+* data can never take down `initialize` — degrading to the old error string is bad,
+* but failing the handshake outright would leave the client with no server at all.
+*/
+function staticInstructionsBlock(reason) {
+	try {
+		return getStaticInstructions() + STATIC_FALLBACK_NOTE;
+	} catch (err) {
+		return `[portal-mcp ERROR initialize] Could not fetch Darwinium instructions: ${reason}, and the bundled fallback failed to load: ${err.message}. Call get_context to retrieve them on demand. Do not act as if this is portal guidance.`;
+	}
+}
+async function resolveInitializeInstructions(bridge, token, opts) {
+	if (!bridge.ownsPort()) return buildPeerInstanceInstructions();
+	if (!await bridge.waitForWs(opts.timeoutMs)) return `${buildPairingInstructions(token)}\n\n${staticInstructionsBlock("extension not connected")}`;
+	try {
+		return (await bridge.send("runCommand", {
+			name: "getDarwiniumInstructions",
+			args: {}
+		}, 3e3)).instructions || staticInstructionsBlock("page returned no instructions");
+	} catch (err) {
+		return staticInstructionsBlock(err.message);
+	}
+}
+
+//#endregion
+//#region src/server/index.ts
+async function runServer() {
+	const server = new Server({
+		name: "darwinium-portal-mcp",
+		version: VERSION
+	}, { capabilities: { tools: {} } });
+	const bridge = new Bridge();
+	const expectedToken = readToken();
+	server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+	server.setRequestHandler(InitializeRequestSchema, async (request) => {
+		const requestedVersion = request.params.protocolVersion;
+		const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion) ? requestedVersion : LATEST_PROTOCOL_VERSION;
+		const instructions = await resolveInitializeInstructions(bridge, expectedToken, { timeoutMs: 5e3 });
+		return {
+			protocolVersion,
+			capabilities: { tools: {} },
+			serverInfo: {
+				name: "darwinium-portal-mcp",
+				version: VERSION
+			},
+			...instructions && { instructions }
+		};
+	});
+	server.setRequestHandler(CallToolRequestSchema, makeBridgeCallHandler(bridge, expectedToken));
+	try {
+		await createWsServer(bridge, expectedToken);
+	} catch (err) {
+		bridge.setOwnsPort(false);
+		console.error(`portal-mcp: WS bridge unavailable: ${err.message}`);
+	}
+	await server.connect(new StdioServerTransport());
+	const shutdown = () => {
+		stopTakeoverPolling();
+		process.exit(0);
+	};
+	server.onclose = shutdown;
+	process.stdin.on("end", shutdown);
+	process.stdin.on("close", shutdown);
+}
+
+//#endregion
+export { runServer };
+//# sourceMappingURL=server-CuNr9ZtJ.js.map