@open-mercato/ai-assistant 0.4.9-develop-de525127d6 → 0.4.9-develop-31d1a87765

package/dist/modules/ai_assistant/lib/codemode-tools.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/lib/codemode-tools.ts"],
+  "sourcesContent": ["/**\n * Code Mode Tools\n *\n * Two meta-tools that replace all individual API/schema/module tools:\n * - search: Query the OpenAPI spec + entity graph programmatically\n * - execute: Make API calls via a sandboxed api.request() wrapper\n *\n * The AI writes JavaScript that runs in a node:vm sandbox with injected globals.\n */\n\nimport { z } from 'zod'\nimport { registerMcpTool } from './tool-registry'\nimport type { McpToolContext } from './types'\nimport { createSandbox } from './sandbox'\nimport { truncateResult } from './truncate'\nimport { getRawOpenApiSpec } from './api-endpoint-index'\nimport {\n  getCachedEntityGraph,\n  inferModuleFromEntity,\n  type EntityGraph,\n} from './entity-graph'\nimport {\n  lookupSearchCache,\n  storeSearchResult,\n  buildMemoryContext,\n  buildSearchLabel,\n  incrementToolCallCount,\n} from './session-memory'\n\n/**\n * Cached spec object combining OpenAPI paths + entity schemas.\n */\nlet cachedCodeModeSpec: Record<string, unknown> | null = null\n\n/**\n * Cached TypeScript type stubs for common CRUD endpoints.\n * Generated once at startup from the OpenAPI spec.\n */\nlet cachedCommonTypes: string | null = null\n\n/**\n * Build the merged spec object for the search tool.\n */\nasync function getCodeModeSpec(): Promise<Record<string, unknown>> {\n  if (cachedCodeModeSpec) return cachedCodeModeSpec\n\n  const rawSpec = await getRawOpenApiSpec()\n  const graph = getCachedEntityGraph()\n\n  const paths = (rawSpec?.paths ?? {}) as Record<string, Record<string, unknown>>\n  const entitySchemas = graph ? buildEntitySchemas(graph) : []\n\n  const spec: Record<string, unknown> = {\n    paths,\n    info: rawSpec?.info,\n    components: rawSpec?.components,\n    entitySchemas,\n  }\n\n  // --- Helper functions injected into sandbox ---\n\n  /**\n   * spec.findEndpoints(keyword) \u2014 find all endpoints matching a keyword.\n   * Returns compact list: [{ path, methods }]\n   */\n  spec.findEndpoints = (keyword: string) => {\n    const kw = keyword.toLowerCase()\n    return Object.entries(paths)\n      .filter(([path]) => path.toLowerCase().includes(kw))\n      .map(([path, methods]) => ({\n        path,\n        methods: Object.keys(methods).filter((m) => m !== 'parameters'),\n      }))\n  }\n\n  /**\n   * spec.describeEndpoint(path, method) \u2014 compact endpoint profile with working example.\n   * Returns: { path, method, summary, requiredFields, optionalFields, nestedCollections, example, relatedEndpoints, relatedEntity }\n   * For full schema access, use: spec.paths[path][method].requestBody\n   */\n  spec.describeEndpoint = (path: string, method: string) => {\n    const pathObj = paths[path] as Record<string, unknown> | undefined\n    if (!pathObj) return null\n\n    const endpoint = pathObj[method.toLowerCase()] as Record<string, unknown> | undefined\n    if (!endpoint) return null\n\n    // Extract requestBody JSON Schema\n    const bodySchema = extractRequestBodySchema(endpoint)\n    const bodyProps = (bodySchema?.properties ?? {}) as Record<string, Record<string, unknown>>\n    const bodyRequired = (bodySchema?.required ?? []) as string[]\n\n    // Split fields into required (with types) vs optional (names only)\n    const requiredFields: Array<{ name: string; type: string; format?: string }> = []\n    const optionalFields: string[] = []\n    const nestedCollections: Array<{\n      field: string\n      type: string\n      requiredFields: Array<{ name: string; type: string }>\n      commonFields: string[]\n    }> = []\n\n    for (const [name, prop] of Object.entries(bodyProps)) {\n      const propType = (prop.type as string) || 'string'\n\n      // Detect nested array collections (e.g. lines, items, addresses)\n      if (propType === 'array' && prop.items && (prop.items as Record<string, unknown>).type === 'object') {\n        const itemSchema = prop.items as Record<string, unknown>\n        const itemProps = (itemSchema.properties ?? {}) as Record<string, Record<string, unknown>>\n        const itemRequired = (itemSchema.required ?? []) as string[]\n\n        const nestedRequired = itemRequired.map((n) => ({\n          name: n,\n          type: ((itemProps[n]?.type as string) || 'string'),\n        }))\n\n        // Common fields: first few non-required fields that are likely user-provided\n        const nestedOptional = Object.keys(itemProps).filter((n) => !itemRequired.includes(n))\n        const commonFields = nestedOptional.slice(0, 6)\n\n        nestedCollections.push({\n          field: name,\n          type: 'array',\n          requiredFields: nestedRequired,\n          commonFields,\n        })\n        continue\n      }\n\n      if (bodyRequired.includes(name)) {\n        const field: { name: string; type: string; format?: string } = { name, type: propType }\n        if (prop.format) field.format = prop.format as string\n        requiredFields.push(field)\n      } else {\n        optionalFields.push(name)\n      }\n    }\n\n    // Generate minimal working example from required fields + nested collections\n    const example: Record<string, unknown> = {}\n    for (const field of requiredFields) {\n      example[field.name] = generatePlaceholder(field.type, field.format)\n    }\n    for (const collection of nestedCollections) {\n      const itemExample: Record<string, unknown> = {}\n      for (const field of collection.requiredFields) {\n        itemExample[field.name] = generatePlaceholder(field.type)\n      }\n      // Add first 2 common fields to the example\n      for (const name of collection.commonFields.slice(0, 2)) {\n        itemExample[name] = '<value>'\n      }\n      example[collection.field] = [itemExample]\n    }\n\n    // Find related endpoints sharing the same module prefix\n    const segments = path.replace('/api/', '').split('/')\n    const moduleSegment = segments[0]\n    const resourceName = segments[1] || segments[0]\n    const modulePrefix = `/api/${moduleSegment}/`\n    const relatedEndpoints = Object.entries(paths)\n      .filter(([p]) => p.startsWith(modulePrefix) && p !== path && !p.includes('{'))\n      .map(([p, methods]) => ({\n        path: p,\n        methods: Object.keys(methods as Record<string, unknown>).filter((m) => m !== 'parameters'),\n      }))\n      .slice(0, 8)\n\n    // Compact entity: className + relationship summary\n    const resourceNorm = resourceName.replace(/-/g, '_')\n    const resourceSingular = resourceNorm.endsWith('s') ? resourceNorm.slice(0, -1) : resourceNorm\n    const moduleSingular = moduleSegment.endsWith('s') ? moduleSegment.slice(0, -1) : moduleSegment\n    const prefixedTable = `${moduleSingular}_${resourceNorm}`\n\n    const entity = entitySchemas.find((e: Record<string, unknown>) => {\n      const table = ((e.tableName as string) || '').toLowerCase()\n      const cls = ((e.className as string) || '').toLowerCase()\n      const mod = ((e.module as string) || '').toLowerCase()\n      if (table === resourceNorm || table === prefixedTable) return true\n      if (cls.includes(moduleSingular) && cls.includes(resourceSingular)) return true\n      if (mod === moduleSegment && cls.includes(resourceSingular)) return true\n      if (cls === resourceSingular || cls.includes(resourceSingular)) return true\n      return false\n    }) || null\n\n    let relatedEntity: string | null = null\n    if (entity) {\n      const ent = entity as Record<string, unknown>\n      const rels = (ent.relationships as Array<{ relationship: string; target: string }>) || []\n      const relSummary = rels.map((r) => `${r.relationship}: ${r.target}`).join(', ')\n      relatedEntity = `${ent.className}${relSummary ? ` (${relSummary})` : ''}`\n    }\n\n    // GET endpoints: include query parameters compactly\n    const parameters = method.toLowerCase() === 'get'\n      ? (endpoint.parameters as Array<Record<string, unknown>> || [])\n          .filter((p) => p.in === 'query')\n          .map((p) => p.name as string)\n      : undefined\n\n    return {\n      path,\n      method: method.toUpperCase(),\n      summary: endpoint.summary || endpoint.description,\n      ...(parameters && parameters.length > 0 ? { queryParams: parameters } : {}),\n      ...(requiredFields.length > 0 ? { requiredFields } : {}),\n      ...(optionalFields.length > 0 ? { optionalFields } : {}),\n      ...(nestedCollections.length > 0 ? { nestedCollections } : {}),\n      ...(Object.keys(example).length > 0 ? { example } : {}),\n      ...(relatedEndpoints.length > 0 ? { relatedEndpoints } : {}),\n      relatedEntity,\n    }\n  }\n\n  /**\n   * spec.describeEntity(keyword) \u2014 find entity by keyword and return its full schema.\n   * Returns: { className, tableName, module, fields, relationships }\n   */\n  spec.describeEntity = (keyword: string) => {\n    const kw = keyword.toLowerCase()\n    return entitySchemas.find((e: Record<string, unknown>) => {\n      const cls = (e.className as string || '').toLowerCase()\n      const table = (e.tableName as string || '').toLowerCase()\n      return cls.includes(kw) || table.includes(kw)\n    }) || null\n  }\n\n  cachedCodeModeSpec = spec\n  return spec\n}\n\n/**\n * Extract the JSON Schema from an OpenAPI endpoint's requestBody.\n * Handles the common `content['application/json'].schema` path.\n */\nfunction extractRequestBodySchema(\n  endpoint: Record<string, unknown>\n): Record<string, unknown> | null {\n  const requestBody = endpoint.requestBody as Record<string, unknown> | undefined\n  if (!requestBody) return null\n\n  const content = requestBody.content as Record<string, Record<string, unknown>> | undefined\n  if (!content) return null\n\n  const jsonContent = content['application/json']\n  if (!jsonContent) return null\n\n  return (jsonContent.schema as Record<string, unknown>) || null\n}\n\n/**\n * Generate a placeholder value for a given JSON Schema type.\n */\nfunction generatePlaceholder(type: string, format?: string): unknown {\n  if (format === 'uuid' || format === 'objectId') return '<uuid>'\n  if (format === 'date-time' || format === 'date') return '<date>'\n  if (format === 'email') return '<email>'\n  switch (type) {\n    case 'string': return '<string>'\n    case 'number':\n    case 'integer': return 0\n    case 'boolean': return false\n    case 'array': return []\n    default: return '<value>'\n  }\n}\n\n/**\n * Common CRUD endpoints to pre-generate types for.\n * These are the endpoints the agent uses most and where debug spirals happen.\n */\nconst COMMON_ENDPOINTS: Array<{ path: string; method: string; typeName: string }> = [\n  { path: '/api/sales/quotes', method: 'post', typeName: 'CreateQuote' },\n  { path: '/api/sales/orders', method: 'post', typeName: 'CreateOrder' },\n  { path: '/api/sales/invoices', method: 'post', typeName: 'CreateInvoice' },\n  { path: '/api/customers/companies', method: 'post', typeName: 'CreateCompany' },\n  { path: '/api/customers/people', method: 'post', typeName: 'CreatePerson' },\n  { path: '/api/customers/deals', method: 'post', typeName: 'CreateDeal' },\n  { path: '/api/catalog/products', method: 'post', typeName: 'CreateProduct' },\n  { path: '/api/customers/companies', method: 'put', typeName: 'UpdateCompany' },\n  { path: '/api/customers/people', method: 'put', typeName: 'UpdatePerson' },\n  { path: '/api/sales/quotes', method: 'put', typeName: 'UpdateQuote' },\n]\n\n/**\n * Generate TypeScript-like type stubs from the OpenAPI spec for common endpoints.\n * This runs once at startup and injects types into the execute tool description\n * so the LLM sees the correct payload shape without needing to call describeEndpoint.\n */\nasync function generateCommonTypes(): Promise<string> {\n  if (cachedCommonTypes) return cachedCommonTypes\n\n  const rawSpec = await getRawOpenApiSpec()\n  if (!rawSpec?.paths) {\n    cachedCommonTypes = ''\n    return ''\n  }\n\n  const paths = rawSpec.paths as Record<string, Record<string, unknown>>\n  const typeLines: string[] = ['Available types for api.request() body:\\n']\n\n  for (const { path, method, typeName } of COMMON_ENDPOINTS) {\n    const pathObj = paths[path] as Record<string, unknown> | undefined\n    if (!pathObj) continue\n\n    const endpoint = pathObj[method] as Record<string, unknown> | undefined\n    if (!endpoint) continue\n\n    const bodySchema = extractRequestBodySchema(endpoint)\n    if (!bodySchema?.properties) continue\n\n    const typeStr = schemaToTypeString(\n      typeName,\n      bodySchema,\n      `${method.toUpperCase()} ${path}`,\n    )\n    if (typeStr) typeLines.push(typeStr)\n  }\n\n  if (typeLines.length <= 1) {\n    cachedCommonTypes = ''\n    return ''\n  }\n\n  cachedCommonTypes = typeLines.join('\\n')\n  console.error(`[Code Mode] Generated ${typeLines.length - 1} common type stubs`)\n  return cachedCommonTypes\n}\n\n/**\n * Convert a JSON Schema object to a compact TypeScript-like type string.\n * Produces a single-line or multi-line type declaration the LLM can use directly.\n */\nfunction schemaToTypeString(\n  typeName: string,\n  schema: Record<string, unknown>,\n  comment: string,\n): string | null {\n  const props = schema.properties as Record<string, Record<string, unknown>> | undefined\n  if (!props) return null\n\n  const required = new Set((schema.required as string[]) || [])\n\n  // Skip internal fields that the sandbox injects automatically\n  const skipFields = new Set(['tenantId', 'organizationId'])\n\n  const fields: string[] = []\n  const nestedTypes: string[] = []\n\n  for (const [name, prop] of Object.entries(props)) {\n    if (skipFields.has(name)) continue\n    if (!prop || typeof prop !== 'object') continue\n\n    const isRequired = required.has(name)\n    const optMark = isRequired ? '' : '?'\n\n    // Detect nested array of objects \u2192 extract as separate type\n    if (\n      prop.type === 'array' &&\n      prop.items &&\n      (prop.items as Record<string, unknown>).type === 'object'\n    ) {\n      const itemTypeName = `${typeName}${capitalize(singularize(name))}`\n      const itemSchema = prop.items as Record<string, unknown>\n      const nestedType = schemaToTypeString(itemTypeName, itemSchema, '')\n      if (nestedType) nestedTypes.push(nestedType)\n      fields.push(`${name}${optMark}: ${itemTypeName}[]`)\n      continue\n    }\n\n    const propType = resolvePropertyType(prop)\n    fields.push(`${name}${optMark}: ${propType}`)\n  }\n\n  if (fields.length === 0) return null\n\n  const commentLine = comment ? `// ${comment}\\n` : ''\n  const nested = nestedTypes.length > 0 ? nestedTypes.join('\\n') + '\\n' : ''\n  return `${nested}${commentLine}type ${typeName} = { ${fields.join('; ')} }`\n}\n\n/**\n * Resolve a JSON Schema property to a compact TypeScript type string.\n */\nfunction resolvePropertyType(prop: Record<string, unknown>): string {\n  // Handle anyOf (nullable types)\n  if (prop.anyOf && Array.isArray(prop.anyOf)) {\n    const variants = (prop.anyOf as Array<Record<string, unknown> | null>).filter(\n      (s): s is Record<string, unknown> => s != null,\n    )\n    const nonNull = variants.filter((s) => s.type !== 'null')\n    if (nonNull.length === 1) {\n      return resolvePropertyType(nonNull[0]) + ' | null'\n    }\n    if (nonNull.length > 1) {\n      return nonNull.map((s) => resolvePropertyType(s)).join(' | ')\n    }\n  }\n\n  // Handle enum\n  if (prop.enum && Array.isArray(prop.enum)) {\n    return (prop.enum as string[]).map((v) => `'${v}'`).join(' | ')\n  }\n\n  const type = prop.type as string\n  const format = prop.format as string | undefined\n\n  if (type === 'array') {\n    const items = prop.items as Record<string, unknown> | undefined\n    if (items) return `${resolvePropertyType(items)}[]`\n    return 'unknown[]'\n  }\n\n  if (type === 'object') return 'object'\n\n  if (format === 'uuid') return 'string /*uuid*/'\n  if (format === 'date-time') return 'string /*ISO date*/'\n  if (format === 'date') return 'string /*date*/'\n  if (format === 'email') return 'string /*email*/'\n\n  switch (type) {\n    case 'string': return 'string'\n    case 'number':\n    case 'integer': return 'number'\n    case 'boolean': return 'boolean'\n    default: return 'unknown'\n  }\n}\n\nfunction capitalize(s: string): string {\n  return s.charAt(0).toUpperCase() + s.slice(1)\n}\n\nfunction singularize(s: string): string {\n  if (s.endsWith('ies')) return s.slice(0, -3) + 'y'\n  if (s.endsWith('ses')) return s.slice(0, -2)\n  if (s.endsWith('s') && !s.endsWith('ss')) return s.slice(0, -1)\n  return s\n}\n\n/**\n * Format a 400 API error response into a human-readable fix instruction.\n * Parses Zod-style validation errors and produces a concise message the LLM can act on.\n */\nfunction formatValidationError(data: unknown): string {\n  if (!data || typeof data !== 'object') {\n    return `Validation error: ${JSON.stringify(data)}`\n  }\n\n  // Raw Zod v4 array format: [{ expected, code, path, message }]\n  if (Array.isArray(data)) {\n    const issues = data as Array<Record<string, unknown>>\n    const parts = issues.slice(0, 5).map((issue) => {\n      const path = Array.isArray(issue.path) ? issue.path.join('.') : ''\n      const msg = issue.message as string || `expected ${issue.expected}` || issue.code as string || 'invalid'\n      return path ? `${path}: ${msg}` : msg\n    })\n    if (parts.length > 0) {\n      return `Validation failed \u2014 ${parts.join('; ')}. Fix the listed fields and retry.`\n    }\n  }\n\n  const obj = data as Record<string, unknown>\n\n  // Zod v4 flat format: { fieldErrors: { field: [messages] }, formErrors: [messages] }\n  if (obj.fieldErrors && typeof obj.fieldErrors === 'object') {\n    const fieldErrors = obj.fieldErrors as Record<string, string[]>\n    const parts: string[] = []\n    for (const [field, messages] of Object.entries(fieldErrors)) {\n      if (Array.isArray(messages) && messages.length > 0) {\n        parts.push(`${field}: ${messages[0]}`)\n      }\n    }\n    const formErrors = obj.formErrors as string[] | undefined\n    if (Array.isArray(formErrors) && formErrors.length > 0) {\n      parts.push(formErrors[0])\n    }\n    if (parts.length > 0) {\n      return `Validation failed \u2014 ${parts.join('; ')}. Fix the listed fields and retry.`\n    }\n  }\n\n  // Zod v3 format: { issues: [{ path: [...], message, code }] }\n  if (obj.issues && Array.isArray(obj.issues)) {\n    const issues = obj.issues as Array<Record<string, unknown>>\n    const parts = issues.slice(0, 5).map((issue) => {\n      const path = Array.isArray(issue.path) ? issue.path.join('.') : ''\n      const msg = issue.message as string || issue.code as string || 'invalid'\n      return path ? `${path}: ${msg}` : msg\n    })\n    return `Validation failed \u2014 ${parts.join('; ')}. Fix the listed fields and retry.`\n  }\n\n  // Our API error format: { error: string, details: ... }\n  if (obj.error && typeof obj.error === 'string') {\n    const details = obj.details\n    if (details && typeof details === 'object') {\n      return formatValidationError(details)\n    }\n    return obj.error\n  }\n\n  // Generic: { message: string }\n  if (obj.message && typeof obj.message === 'string') {\n    return obj.message\n  }\n\n  // Fallback: compact JSON\n  const json = JSON.stringify(data)\n  if (json.length > 500) {\n    return `Validation error (truncated): ${json.slice(0, 500)}...`\n  }\n  return `Validation error: ${json}`\n}\n\n/**\n * Build entity schema array from the entity graph.\n * Same structure as buildEntityResult in entity-graph-tools.ts.\n */\nfunction buildEntitySchemas(graph: EntityGraph) {\n  return graph.nodes.map((node) => {\n    const relationships = graph.edges\n      .filter((edge) => edge.source === node.className)\n      .map((edge) => ({\n        relationship: edge.relationship,\n        target: edge.target,\n        property: edge.property,\n        nullable: edge.nullable,\n      }))\n\n    return {\n      className: node.className,\n      tableName: node.tableName,\n      module: inferModuleFromEntity(node.className, node.tableName),\n      fields: node.properties,\n      relationships,\n    }\n  })\n}\n\n/**\n * Detect mutation HTTP methods in code via static analysis.\n * Returns which methods were found (POST, PUT, PATCH, DELETE).\n */\nfunction detectMutationInCode(code: string): { hasMutation: boolean; methods: string[] } {\n  const methods: string[] = []\n  const pattern = /method:\\s*['\"](\\w+)['\"]/gi\n  let match\n  while ((match = pattern.exec(code)) !== null) {\n    const method = match[1].toUpperCase()\n    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {\n      methods.push(method)\n    }\n  }\n  return { hasMutation: methods.length > 0, methods }\n}\n\n/**\n * Load and register the two Code Mode tools.\n * Generates TypeScript type stubs for common endpoints at startup.\n * @returns Number of tools registered (always 2)\n */\nexport async function loadCodeModeTools(): Promise<number> {\n  const commonTypes = await generateCommonTypes()\n  registerSearchTool()\n  registerExecuteTool(commonTypes)\n  return 2\n}\n\n/**\n * search \u2014 Query the OpenAPI spec and entity graph programmatically.\n */\nfunction registerSearchTool(): void {\n  registerMcpTool(\n    {\n      name: 'search',\n      description: `Query the OpenAPI spec and entity schemas. READ-ONLY, no side effects.\nGlobals: spec.findEndpoints(keyword), spec.describeEndpoint(path, method), spec.describeEntity(keyword), spec.paths, spec.entitySchemas.\nUse BEFORE execute to learn endpoint schemas for CREATE/UPDATE. Skip for common paths (companies, people, orders, quotes, products).`,\n      inputSchema: z.object({\n        code: z\n          .string()\n          .describe(\n            'An async arrow function that queries spec, e.g. async () => spec.paths[\"/api/customers/companies\"]'\n          ),\n      }),\n      requiredFeatures: [],\n      handler: async (input: { code: string }, ctx: McpToolContext) => {\n        const codePreview = input.code.slice(0, 120).replace(/\\n/g, ' ')\n        console.error(`[AI Usage] search: code=\"${codePreview}${input.code.length > 120 ? '...' : ''}\"`)\n\n        // Check session memory for cached result\n        if (ctx.sessionId) {\n          const cached = lookupSearchCache(ctx.sessionId, input.code)\n          if (cached) {\n            console.error(`[AI Usage] search: CACHE HIT (label=\"${cached.label}\")`)\n            const memoryContext = buildMemoryContext(ctx.sessionId)\n            return {\n              success: true,\n              result: cached.result,\n              fromCache: true,\n              _memoryContext: memoryContext,\n            }\n          }\n\n          // Enforce tool call limit\n          const { count, exceeded } = incrementToolCallCount(ctx.sessionId)\n          if (exceeded) {\n            console.error(`[AI Usage] search: TOOL CALL LIMIT EXCEEDED (count=${count})`)\n            return {\n              success: false,\n              error: 'Tool call limit exceeded. Summarize what you know and respond to the user.',\n            }\n          }\n        }\n\n        const spec = await getCodeModeSpec()\n        const sandbox = createSandbox({ spec })\n        const result = await sandbox.execute(input.code)\n\n        if (result.error) {\n          console.error(`[AI Usage] search: ERROR in ${result.durationMs}ms \u2014 ${result.error}`)\n          return {\n            success: false,\n            error: result.error,\n            logs: result.logs,\n            durationMs: result.durationMs,\n          }\n        }\n\n        const truncated = truncateResult(result.result)\n        console.error(`[AI Usage] search: OK in ${result.durationMs}ms \u2014 ${truncated.length} chars`)\n\n        // Store in session memory\n        if (ctx.sessionId) {\n          const label = buildSearchLabel(input.code)\n          storeSearchResult(ctx.sessionId, input.code, truncated, label)\n        }\n\n        const memoryContext = ctx.sessionId ? buildMemoryContext(ctx.sessionId) : undefined\n        return {\n          success: true,\n          result: truncated,\n          logs: result.logs,\n          durationMs: result.durationMs,\n          _memoryContext: memoryContext,\n        }\n      },\n    },\n    { moduleId: 'codemode' }\n  )\n}\n\n/**\n * execute \u2014 Run JavaScript that can make API calls via api.request().\n */\nfunction registerExecuteTool(commonTypes: string): void {\n  const typesBlock = commonTypes\n    ? `\\n\\n${commonTypes}`\n    : ''\n\n  registerMcpTool(\n    {\n      name: 'execute',\n      description: `Make API calls. Returns JSON.\nGlobals: api.request({ method, path, query?, body? }) \u2192 { success, statusCode, data }, context { tenantId, organizationId, userId }.\nRULES: For FIND/LIST \u2192 GET only (1 call). For UPDATE \u2192 PUT to collection path with id in BODY. NEVER PUT/POST/DELETE unless user explicitly asked to change data. Before ANY write operation (POST/PUT/DELETE), you MUST use the AskUserQuestion tool to get explicit user confirmation. Do NOT just ask in text \u2014 use the tool so execution pauses until the user responds.${typesBlock}`,\n      inputSchema: z.object({\n        code: z\n          .string()\n          .describe(\n            'Async arrow function. For reads: async () => api.request({ method: \"GET\", path: \"/api/customers/companies\" }). For updates: async () => api.request({ method: \"PUT\", path: \"/api/customers/companies\", body: { id: \"<uuid>\", name: \"New Name\" } }). id goes in BODY not URL.'\n          ),\n      }),\n      requiredFeatures: [], // ACL checked at API level\n      handler: async (input: { code: string }, ctx: McpToolContext) => {\n        const codePreview = input.code.slice(0, 120).replace(/\\n/g, ' ')\n        console.error(`[AI Usage] execute: code=\"${codePreview}${input.code.length > 120 ? '...' : ''}\" user=${ctx.userId || 'unknown'}`)\n\n        // Enforce tool call limit\n        if (ctx.sessionId) {\n          const { count, exceeded } = incrementToolCallCount(ctx.sessionId)\n          if (exceeded) {\n            console.error(`[AI Usage] execute: TOOL CALL LIMIT EXCEEDED (count=${count})`)\n            return {\n              success: false,\n              error: 'Tool call limit exceeded. Summarize what you know and respond to the user.',\n            }\n          }\n        }\n\n        // Detect mutations via static analysis \u2014 cap API calls for safety\n        const mutationInfo = detectMutationInCode(input.code)\n        const maxApiCalls = mutationInfo.hasMutation ? 20 : 50\n        if (mutationInfo.hasMutation) {\n          console.error(`[AI Usage] execute: MUTATION DETECTED (${mutationInfo.methods.join(',')}) \u2014 capping API calls to ${maxApiCalls}`)\n        }\n        let apiCallCount = 0\n\n        const apiRequestFn = createApiRequestFn(ctx, () => {\n          apiCallCount++\n          if (apiCallCount > maxApiCalls) {\n            throw new Error(`API call limit exceeded (max ${maxApiCalls})`)\n          }\n        })\n\n        const context = {\n          tenantId: ctx.tenantId,\n          organizationId: ctx.organizationId,\n          userId: ctx.userId,\n        }\n\n        const sandbox = createSandbox(\n          { api: { request: apiRequestFn }, context },\n          { maxApiCalls }\n        )\n\n        const result = await sandbox.execute(input.code)\n\n        if (result.error) {\n          console.error(`[AI Usage] execute: ERROR in ${result.durationMs}ms \u2014 apiCalls=${apiCallCount} \u2014 ${result.error}`)\n          return {\n            success: false,\n            error: result.error,\n            logs: result.logs,\n            durationMs: result.durationMs,\n            apiCallCount,\n          }\n        }\n\n        const truncated = truncateResult(result.result)\n        console.error(`[AI Usage] execute: OK in ${result.durationMs}ms \u2014 apiCalls=${apiCallCount} \u2014 ${truncated.length} chars`)\n\n        const memoryContext = ctx.sessionId ? buildMemoryContext(ctx.sessionId) : undefined\n        return {\n          success: true,\n          result: truncated,\n          logs: result.logs,\n          durationMs: result.durationMs,\n          apiCallCount,\n          _memoryContext: memoryContext,\n        }\n      },\n    },\n    { moduleId: 'codemode' }\n  )\n}\n\n/**\n * Create the api.request() function for the execute sandbox.\n * Replicates the authenticated API call logic from api-discovery-tools.ts.\n */\nfunction createApiRequestFn(\n  ctx: McpToolContext,\n  onCall: () => void\n): (params: {\n  method: string\n  path: string\n  query?: Record<string, string>\n  body?: Record<string, unknown>\n}) => Promise<unknown> {\n  const baseUrl =\n    process.env.NEXT_PUBLIC_API_BASE_URL ||\n    process.env.NEXT_PUBLIC_APP_URL ||\n    process.env.APP_URL ||\n    'http://localhost:3000'\n\n  return async (params) => {\n    onCall()\n\n    const { method, path, query, body } = params\n    const callStart = Date.now()\n\n    // Ensure path starts with /api\n    const apiPath = path.startsWith('/api') ? path : `/api${path}`\n    let url = `${baseUrl}${apiPath}`\n\n    // Build query parameters\n    const queryParams: Record<string, string> = { ...query }\n\n    if (method === 'GET') {\n      if (ctx.tenantId) queryParams.tenantId = ctx.tenantId\n      if (ctx.organizationId) queryParams.organizationId = ctx.organizationId\n    }\n\n    if (Object.keys(queryParams).length > 0) {\n      const separator = url.includes('?') ? '&' : '?'\n      url += separator + new URLSearchParams(queryParams).toString()\n    }\n\n    // Build request body with context injection\n    let requestBody: Record<string, unknown> | undefined\n    if (['POST', 'PUT', 'PATCH'].includes(method.toUpperCase())) {\n      requestBody = { ...body }\n      if (ctx.tenantId) requestBody.tenantId = ctx.tenantId\n      if (ctx.organizationId) requestBody.organizationId = ctx.organizationId\n    }\n\n    // Build headers\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n    }\n    if (ctx.apiKeySecret) headers['X-API-Key'] = ctx.apiKeySecret\n    if (ctx.tenantId) headers['X-Tenant-Id'] = ctx.tenantId\n    if (ctx.organizationId) headers['X-Organization-Id'] = ctx.organizationId\n\n    // Execute request using host fetch (not sandbox)\n    const response = await globalThis.fetch(url, {\n      method: method.toUpperCase(),\n      headers,\n      body: requestBody ? JSON.stringify(requestBody) : undefined,\n    })\n\n    const responseText = await response.text()\n    const data = tryParseJson(responseText)\n    const callDuration = Date.now() - callStart\n\n    if (!response.ok) {\n      console.error(`[AI Usage] api.request: ${method.toUpperCase()} ${apiPath} \u2192 ${response.status} in ${callDuration}ms`)\n\n      // Format 400 validation errors into a clear fix instruction for the LLM\n      if (response.status === 400) {\n        return {\n          success: false,\n          statusCode: 400,\n          error: formatValidationError(data),\n        }\n      }\n\n      return {\n        success: false,\n        statusCode: response.status,\n        error: `API error ${response.status}`,\n        details: data,\n      }\n    }\n\n    console.error(`[AI Usage] api.request: ${method.toUpperCase()} ${apiPath} \u2192 ${response.status} in ${callDuration}ms (${responseText.length} bytes)`)\n\n    // Add mutation warning for non-GET calls\n    if (!['GET', 'HEAD', 'OPTIONS'].includes(method.toUpperCase())) {\n      return {\n        success: true,\n        statusCode: response.status,\n        data,\n        _note: 'WRITE operation performed. Only do writes when user explicitly requested data modification.',\n      }\n    }\n\n    return {\n      success: true,\n      statusCode: response.status,\n      data,\n    }\n  }\n}\n\nfunction tryParseJson(text: string): unknown {\n  try {\n    return JSON.parse(text)\n  } catch {\n    return text\n  }\n}\n"],
+  "mappings": "AAUA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAEhC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,IAAI,qBAAqD;AAMzD,IAAI,oBAAmC;AAKvC,eAAe,kBAAoD;AACjE,MAAI,mBAAoB,QAAO;AAE/B,QAAM,UAAU,MAAM,kBAAkB;AACxC,QAAM,QAAQ,qBAAqB;AAEnC,QAAM,QAAS,SAAS,SAAS,CAAC;AAClC,QAAM,gBAAgB,QAAQ,mBAAmB,KAAK,IAAI,CAAC;AAE3D,QAAM,OAAgC;AAAA,IACpC;AAAA,IACA,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB;AAAA,EACF;AAQA,OAAK,gBAAgB,CAAC,YAAoB;AACxC,UAAM,KAAK,QAAQ,YAAY;AAC/B,WAAO,OAAO,QAAQ,KAAK,EACxB,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,YAAY,EAAE,SAAS,EAAE,CAAC,EAClD,IAAI,CAAC,CAAC,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,SAAS,OAAO,KAAK,OAAO,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,IAChE,EAAE;AAAA,EACN;AAOA,OAAK,mBAAmB,CAAC,MAAc,WAAmB;AACxD,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,WAAW,QAAQ,OAAO,YAAY,CAAC;AAC7C,QAAI,CAAC,SAAU,QAAO;AAGtB,UAAM,aAAa,yBAAyB,QAAQ;AACpD,UAAM,YAAa,YAAY,cAAc,CAAC;AAC9C,UAAM,eAAgB,YAAY,YAAY,CAAC;AAG/C,UAAM,iBAAyE,CAAC;AAChF,UAAM,iBAA2B,CAAC;AAClC,UAAM,oBAKD,CAAC;AAEN,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,YAAM,WAAY,KAAK,QAAmB;AAG1C,UAAI,aAAa,WAAW,KAAK,SAAU,KAAK,MAAkC,SAAS,UAAU;AACnG,cAAM,aAAa,KAAK;AACxB,cAAM,YAAa,WAAW,cAAc,CAAC;AAC7C,cAAM,eAAgB,WAAW,YAAY,CAAC;AAE9C,cAAM,iBAAiB,aAAa,IAAI,CAAC,OAAO;AAAA,UAC9C,MAAM;AAAA,UACN,MAAQ,UAAU,CAAC,GAAG,QAAmB;AAAA,QAC3C,EAAE;AAGF,cAAM,iBAAiB,OAAO,KAAK,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,SAAS,CAAC,CAAC;AACrF,cAAM,eAAe,eAAe,MAAM,GAAG,CAAC;AAE9C,0BAAkB,KAAK;AAAA,UACrB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,gBAAgB;AAAA,UAChB;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAEA,UAAI,aAAa,SAAS,IAAI,GAAG;AAC/B,cAAM,QAAyD,EAAE,MAAM,MAAM,SAAS;AACtF,YAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AACrC,uBAAe,KAAK,KAAK;AAAA,MAC3B,OAAO;AACL,uBAAe,KAAK,IAAI;AAAA,MAC1B;AAAA,IACF;AAGA,UAAM,UAAmC,CAAC;AAC1C,eAAW,SAAS,gBAAgB;AAClC,cAAQ,MAAM,IAAI,IAAI,oBAAoB,MAAM,MAAM,MAAM,MAAM;AAAA,IACpE;AACA,eAAW,cAAc,mBAAmB;AAC1C,YAAM,cAAuC,CAAC;AAC9C,iBAAW,SAAS,WAAW,gBAAgB;AAC7C,oBAAY,MAAM,IAAI,IAAI,oBAAoB,MAAM,IAAI;AAAA,MAC1D;AAEA,iBAAW,QAAQ,WAAW,aAAa,MAAM,GAAG,CAAC,GAAG;AACtD,oBAAY,IAAI,IAAI;AAAA,MACtB;AACA,cAAQ,WAAW,KAAK,IAAI,CAAC,WAAW;AAAA,IAC1C;AAGA,UAAM,WAAW,KAAK,QAAQ,SAAS,EAAE,EAAE,MAAM,GAAG;AACpD,UAAM,gBAAgB,SAAS,CAAC;AAChC,UAAM,eAAe,SAAS,CAAC,KAAK,SAAS,CAAC;AAC9C,UAAM,eAAe,QAAQ,aAAa;AAC1C,UAAM,mBAAmB,OAAO,QAAQ,KAAK,EAC1C,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,YAAY,KAAK,MAAM,QAAQ,CAAC,EAAE,SAAS,GAAG,CAAC,EAC5E,IAAI,CAAC,CAAC,GAAG,OAAO,OAAO;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,OAAO,KAAK,OAAkC,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,IAC3F,EAAE,EACD,MAAM,GAAG,CAAC;AAGb,UAAM,eAAe,aAAa,QAAQ,MAAM,GAAG;AACnD,UAAM,mBAAmB,aAAa,SAAS,GAAG,IAAI,aAAa,MAAM,GAAG,EAAE,IAAI;AAClF,UAAM,iBAAiB,cAAc,SAAS,GAAG,IAAI,cAAc,MAAM,GAAG,EAAE,IAAI;AAClF,UAAM,gBAAgB,GAAG,cAAc,IAAI,YAAY;AAEvD,UAAM,SAAS,cAAc,KAAK,CAAC,MAA+B;AAChE,YAAM,SAAU,EAAE,aAAwB,IAAI,YAAY;AAC1D,YAAM,OAAQ,EAAE,aAAwB,IAAI,YAAY;AACxD,YAAM,OAAQ,EAAE,UAAqB,IAAI,YAAY;AACrD,UAAI,UAAU,gBAAgB,UAAU,cAAe,QAAO;AAC9D,UAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,gBAAgB,EAAG,QAAO;AAC3E,UAAI,QAAQ,iBAAiB,IAAI,SAAS,gBAAgB,EAAG,QAAO;AACpE,UAAI,QAAQ,oBAAoB,IAAI,SAAS,gBAAgB,EAAG,QAAO;AACvE,aAAO;AAAA,IACT,CAAC,KAAK;AAEN,QAAI,gBAA+B;AACnC,QAAI,QAAQ;AACV,YAAM,MAAM;AACZ,YAAM,OAAQ,IAAI,iBAAqE,CAAC;AACxF,YAAM,aAAa,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,YAAY,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI;AAC9E,sBAAgB,GAAG,IAAI,SAAS,GAAG,aAAa,KAAK,UAAU,MAAM,EAAE;AAAA,IACzE;AAGA,UAAM,aAAa,OAAO,YAAY,MAAM,SACvC,SAAS,cAAgD,CAAC,GACxD,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,EAC9B,IAAI,CAAC,MAAM,EAAE,IAAc,IAC9B;AAEJ,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,OAAO,YAAY;AAAA,MAC3B,SAAS,SAAS,WAAW,SAAS;AAAA,MACtC,GAAI,cAAc,WAAW,SAAS,IAAI,EAAE,aAAa,WAAW,IAAI,CAAC;AAAA,MACzE,GAAI,eAAe,SAAS,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,MACtD,GAAI,eAAe,SAAS,IAAI,EAAE,eAAe,IAAI,CAAC;AAAA,MACtD,GAAI,kBAAkB,SAAS,IAAI,EAAE,kBAAkB,IAAI,CAAC;AAAA,MAC5D,GAAI,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrD,GAAI,iBAAiB,SAAS,IAAI,EAAE,iBAAiB,IAAI,CAAC;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AAMA,OAAK,iBAAiB,CAAC,YAAoB;AACzC,UAAM,KAAK,QAAQ,YAAY;AAC/B,WAAO,cAAc,KAAK,CAAC,MAA+B;AACxD,YAAM,OAAO,EAAE,aAAuB,IAAI,YAAY;AACtD,YAAM,SAAS,EAAE,aAAuB,IAAI,YAAY;AACxD,aAAO,IAAI,SAAS,EAAE,KAAK,MAAM,SAAS,EAAE;AAAA,IAC9C,CAAC,KAAK;AAAA,EACR;AAEA,uBAAqB;AACrB,SAAO;AACT;AAMA,SAAS,yBACP,UACgC;AAChC,QAAM,cAAc,SAAS;AAC7B,MAAI,CAAC,YAAa,QAAO;AAEzB,QAAM,UAAU,YAAY;AAC5B,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,cAAc,QAAQ,kBAAkB;AAC9C,MAAI,CAAC,YAAa,QAAO;AAEzB,SAAQ,YAAY,UAAsC;AAC5D;AAKA,SAAS,oBAAoB,MAAc,QAA0B;AACnE,MAAI,WAAW,UAAU,WAAW,WAAY,QAAO;AACvD,MAAI,WAAW,eAAe,WAAW,OAAQ,QAAO;AACxD,MAAI,WAAW,QAAS,QAAO;AAC/B,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAU,aAAO;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAS,aAAO,CAAC;AAAA,IACtB;AAAS,aAAO;AAAA,EAClB;AACF;AAMA,MAAM,mBAA8E;AAAA,EAClF,EAAE,MAAM,qBAAqB,QAAQ,QAAQ,UAAU,cAAc;AAAA,EACrE,EAAE,MAAM,qBAAqB,QAAQ,QAAQ,UAAU,cAAc;AAAA,EACrE,EAAE,MAAM,uBAAuB,QAAQ,QAAQ,UAAU,gBAAgB;AAAA,EACzE,EAAE,MAAM,4BAA4B,QAAQ,QAAQ,UAAU,gBAAgB;AAAA,EAC9E,EAAE,MAAM,yBAAyB,QAAQ,QAAQ,UAAU,eAAe;AAAA,EAC1E,EAAE,MAAM,wBAAwB,QAAQ,QAAQ,UAAU,aAAa;AAAA,EACvE,EAAE,MAAM,yBAAyB,QAAQ,QAAQ,UAAU,gBAAgB;AAAA,EAC3E,EAAE,MAAM,4BAA4B,QAAQ,OAAO,UAAU,gBAAgB;AAAA,EAC7E,EAAE,MAAM,yBAAyB,QAAQ,OAAO,UAAU,eAAe;AAAA,EACzE,EAAE,MAAM,qBAAqB,QAAQ,OAAO,UAAU,cAAc;AACtE;AAOA,eAAe,sBAAuC;AACpD,MAAI,kBAAmB,QAAO;AAE9B,QAAM,UAAU,MAAM,kBAAkB;AACxC,MAAI,CAAC,SAAS,OAAO;AACnB,wBAAoB;AACpB,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,QAAQ;AACtB,QAAM,YAAsB,CAAC,2CAA2C;AAExE,aAAW,EAAE,MAAM,QAAQ,SAAS,KAAK,kBAAkB;AACzD,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,CAAC,QAAS;AAEd,UAAM,WAAW,QAAQ,MAAM;AAC/B,QAAI,CAAC,SAAU;AAEf,UAAM,aAAa,yBAAyB,QAAQ;AACpD,QAAI,CAAC,YAAY,WAAY;AAE7B,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,GAAG,OAAO,YAAY,CAAC,IAAI,IAAI;AAAA,IACjC;AACA,QAAI,QAAS,WAAU,KAAK,OAAO;AAAA,EACrC;AAEA,MAAI,UAAU,UAAU,GAAG;AACzB,wBAAoB;AACpB,WAAO;AAAA,EACT;AAEA,sBAAoB,UAAU,KAAK,IAAI;AACvC,UAAQ,MAAM,yBAAyB,UAAU,SAAS,CAAC,oBAAoB;AAC/E,SAAO;AACT;AAMA,SAAS,mBACP,UACA,QACA,SACe;AACf,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,WAAW,IAAI,IAAK,OAAO,YAAyB,CAAC,CAAC;AAG5D,QAAM,aAAa,oBAAI,IAAI,CAAC,YAAY,gBAAgB,CAAC;AAEzD,QAAM,SAAmB,CAAC;AAC1B,QAAM,cAAwB,CAAC;AAE/B,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,WAAW,IAAI,IAAI,EAAG;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AAEvC,UAAM,aAAa,SAAS,IAAI,IAAI;AACpC,UAAM,UAAU,aAAa,KAAK;AAGlC,QACE,KAAK,SAAS,WACd,KAAK,SACJ,KAAK,MAAkC,SAAS,UACjD;AACA,YAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,YAAY,IAAI,CAAC,CAAC;AAChE,YAAM,aAAa,KAAK;AACxB,YAAM,aAAa,mBAAmB,cAAc,YAAY,EAAE;AAClE,UAAI,WAAY,aAAY,KAAK,UAAU;AAC3C,aAAO,KAAK,GAAG,IAAI,GAAG,OAAO,KAAK,YAAY,IAAI;AAClD;AAAA,IACF;AAEA,UAAM,WAAW,oBAAoB,IAAI;AACzC,WAAO,KAAK,GAAG,IAAI,GAAG,OAAO,KAAK,QAAQ,EAAE;AAAA,EAC9C;AAEA,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,cAAc,UAAU,MAAM,OAAO;AAAA,IAAO;AAClD,QAAM,SAAS,YAAY,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO;AACxE,SAAO,GAAG,MAAM,GAAG,WAAW,QAAQ,QAAQ,QAAQ,OAAO,KAAK,IAAI,CAAC;AACzE;AAKA,SAAS,oBAAoB,MAAuC;AAElE,MAAI,KAAK,SAAS,MAAM,QAAQ,KAAK,KAAK,GAAG;AAC3C,UAAM,WAAY,KAAK,MAAgD;AAAA,MACrE,CAAC,MAAoC,KAAK;AAAA,IAC5C;AACA,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AACxD,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,oBAAoB,QAAQ,CAAC,CAAC,IAAI;AAAA,IAC3C;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,aAAO,QAAQ,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,KAAK;AAAA,IAC9D;AAAA,EACF;AAGA,MAAI,KAAK,QAAQ,MAAM,QAAQ,KAAK,IAAI,GAAG;AACzC,WAAQ,KAAK,KAAkB,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,KAAK;AAAA,EAChE;AAEA,QAAM,OAAO,KAAK;AAClB,QAAM,SAAS,KAAK;AAEpB,MAAI,SAAS,SAAS;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,MAAO,QAAO,GAAG,oBAAoB,KAAK,CAAC;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,SAAU,QAAO;AAE9B,MAAI,WAAW,OAAQ,QAAO;AAC9B,MAAI,WAAW,YAAa,QAAO;AACnC,MAAI,WAAW,OAAQ,QAAO;AAC9B,MAAI,WAAW,QAAS,QAAO;AAE/B,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAU,aAAO;AAAA,IACtB,KAAK;AAAA,IACL,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB;AAAS,aAAO;AAAA,EAClB;AACF;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAC9C;AAEA,SAAS,YAAY,GAAmB;AACtC,MAAI,EAAE,SAAS,KAAK,EAAG,QAAO,EAAE,MAAM,GAAG,EAAE,IAAI;AAC/C,MAAI,EAAE,SAAS,KAAK,EAAG,QAAO,EAAE,MAAM,GAAG,EAAE;AAC3C,MAAI,EAAE,SAAS,GAAG,KAAK,CAAC,EAAE,SAAS,IAAI,EAAG,QAAO,EAAE,MAAM,GAAG,EAAE;AAC9D,SAAO;AACT;AAMA,SAAS,sBAAsB,MAAuB;AACpD,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,qBAAqB,KAAK,UAAU,IAAI,CAAC;AAAA,EAClD;AAGA,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,UAAM,SAAS;AACf,UAAM,QAAQ,OAAO,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU;AAC9C,YAAM,OAAO,MAAM,QAAQ,MAAM,IAAI,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AAChE,YAAM,MAAM,MAAM,WAAqB,YAAY,MAAM,QAAQ,MAAM,MAAM,QAAkB;AAC/F,aAAO,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK;AAAA,IACpC,CAAC;AACD,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO,4BAAuB,MAAM,KAAK,IAAI,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,MAAM;AAGZ,MAAI,IAAI,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC1D,UAAM,cAAc,IAAI;AACxB,UAAM,QAAkB,CAAC;AACzB,eAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,WAAW,GAAG;AAC3D,UAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,GAAG;AAClD,cAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,EAAE;AAAA,MACvC;AAAA,IACF;AACA,UAAM,aAAa,IAAI;AACvB,QAAI,MAAM,QAAQ,UAAU,KAAK,WAAW,SAAS,GAAG;AACtD,YAAM,KAAK,WAAW,CAAC,CAAC;AAAA,IAC1B;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO,4BAAuB,MAAM,KAAK,IAAI,CAAC;AAAA,IAChD;AAAA,EACF;AAGA,MAAI,IAAI,UAAU,MAAM,QAAQ,IAAI,MAAM,GAAG;AAC3C,UAAM,SAAS,IAAI;AACnB,UAAM,QAAQ,OAAO,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU;AAC9C,YAAM,OAAO,MAAM,QAAQ,MAAM,IAAI,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AAChE,YAAM,MAAM,MAAM,WAAqB,MAAM,QAAkB;AAC/D,aAAO,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK;AAAA,IACpC,CAAC;AACD,WAAO,4BAAuB,MAAM,KAAK,IAAI,CAAC;AAAA,EAChD;AAGA,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,UAAM,UAAU,IAAI;AACpB,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,aAAO,sBAAsB,OAAO;AAAA,IACtC;AACA,WAAO,IAAI;AAAA,EACb;AAGA,MAAI,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;AAClD,WAAO,IAAI;AAAA,EACb;AAGA,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,MAAI,KAAK,SAAS,KAAK;AACrB,WAAO,iCAAiC,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,EAC5D;AACA,SAAO,qBAAqB,IAAI;AAClC;AAMA,SAAS,mBAAmB,OAAoB;AAC9C,SAAO,MAAM,MAAM,IAAI,CAAC,SAAS;AAC/B,UAAM,gBAAgB,MAAM,MACzB,OAAO,CAAC,SAAS,KAAK,WAAW,KAAK,SAAS,EAC/C,IAAI,CAAC,UAAU;AAAA,MACd,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,IACjB,EAAE;AAEJ,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,QAAQ,sBAAsB,KAAK,WAAW,KAAK,SAAS;AAAA,MAC5D,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAMA,SAAS,qBAAqB,MAA2D;AACvF,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAU;AAChB,MAAI;AACJ,UAAQ,QAAQ,QAAQ,KAAK,IAAI,OAAO,MAAM;AAC5C,UAAM,SAAS,MAAM,CAAC,EAAE,YAAY;AACpC,QAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,EAAE,SAAS,MAAM,GAAG;AACvD,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ,SAAS,GAAG,QAAQ;AACpD;AAOA,eAAsB,oBAAqC;AACzD,QAAM,cAAc,MAAM,oBAAoB;AAC9C,qBAAmB;AACnB,sBAAoB,WAAW;AAC/B,SAAO;AACT;AAKA,SAAS,qBAA2B;AAClC;AAAA,IACE;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA;AAAA;AAAA,MAGb,aAAa,EAAE,OAAO;AAAA,QACpB,MAAM,EACH,OAAO,EACP;AAAA,UACC;AAAA,QACF;AAAA,MACJ,CAAC;AAAA,MACD,kBAAkB,CAAC;AAAA,MACnB,SAAS,OAAO,OAAyB,QAAwB;AAC/D,cAAM,cAAc,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC/D,gBAAQ,MAAM,4BAA4B,WAAW,GAAG,MAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,GAAG;AAG/F,YAAI,IAAI,WAAW;AACjB,gBAAM,SAAS,kBAAkB,IAAI,WAAW,MAAM,IAAI;AAC1D,cAAI,QAAQ;AACV,oBAAQ,MAAM,wCAAwC,OAAO,KAAK,IAAI;AACtE,kBAAMA,iBAAgB,mBAAmB,IAAI,SAAS;AACtD,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,QAAQ,OAAO;AAAA,cACf,WAAW;AAAA,cACX,gBAAgBA;AAAA,YAClB;AAAA,UACF;AAGA,gBAAM,EAAE,OAAO,SAAS,IAAI,uBAAuB,IAAI,SAAS;AAChE,cAAI,UAAU;AACZ,oBAAQ,MAAM,sDAAsD,KAAK,GAAG;AAC5E,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAEA,cAAM,OAAO,MAAM,gBAAgB;AACnC,cAAM,UAAU,cAAc,EAAE,KAAK,CAAC;AACtC,cAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAE/C,YAAI,OAAO,OAAO;AAChB,kBAAQ,MAAM,+BAA+B,OAAO,UAAU,aAAQ,OAAO,KAAK,EAAE;AACpF,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO,OAAO;AAAA,YACd,MAAM,OAAO;AAAA,YACb,YAAY,OAAO;AAAA,UACrB;AAAA,QACF;AAEA,cAAM,YAAY,eAAe,OAAO,MAAM;AAC9C,gBAAQ,MAAM,4BAA4B,OAAO,UAAU,aAAQ,UAAU,MAAM,QAAQ;AAG3F,YAAI,IAAI,WAAW;AACjB,gBAAM,QAAQ,iBAAiB,MAAM,IAAI;AACzC,4BAAkB,IAAI,WAAW,MAAM,MAAM,WAAW,KAAK;AAAA,QAC/D;AAEA,cAAM,gBAAgB,IAAI,YAAY,mBAAmB,IAAI,SAAS,IAAI;AAC1E,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,MAAM,OAAO;AAAA,UACb,YAAY,OAAO;AAAA,UACnB,gBAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,UAAU,WAAW;AAAA,EACzB;AACF;AAKA,SAAS,oBAAoB,aAA2B;AACtD,QAAM,aAAa,cACf;AAAA;AAAA,EAAO,WAAW,KAClB;AAEJ;AAAA,IACE;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA;AAAA,6XAE2V,UAAU;AAAA,MAClX,aAAa,EAAE,OAAO;AAAA,QACpB,MAAM,EACH,OAAO,EACP;AAAA,UACC;AAAA,QACF;AAAA,MACJ,CAAC;AAAA,MACD,kBAAkB,CAAC;AAAA;AAAA,MACnB,SAAS,OAAO,OAAyB,QAAwB;AAC/D,cAAM,cAAc,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,QAAQ,OAAO,GAAG;AAC/D,gBAAQ,MAAM,6BAA6B,WAAW,GAAG,MAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,SAAS,EAAE;AAGhI,YAAI,IAAI,WAAW;AACjB,gBAAM,EAAE,OAAO,SAAS,IAAI,uBAAuB,IAAI,SAAS;AAChE,cAAI,UAAU;AACZ,oBAAQ,MAAM,uDAAuD,KAAK,GAAG;AAC7E,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,OAAO;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAGA,cAAM,eAAe,qBAAqB,MAAM,IAAI;AACpD,cAAM,cAAc,aAAa,cAAc,KAAK;AACpD,YAAI,aAAa,aAAa;AAC5B,kBAAQ,MAAM,0CAA0C,aAAa,QAAQ,KAAK,GAAG,CAAC,iCAA4B,WAAW,EAAE;AAAA,QACjI;AACA,YAAI,eAAe;AAEnB,cAAM,eAAe,mBAAmB,KAAK,MAAM;AACjD;AACA,cAAI,eAAe,aAAa;AAC9B,kBAAM,IAAI,MAAM,gCAAgC,WAAW,GAAG;AAAA,UAChE;AAAA,QACF,CAAC;AAED,cAAM,UAAU;AAAA,UACd,UAAU,IAAI;AAAA,UACd,gBAAgB,IAAI;AAAA,UACpB,QAAQ,IAAI;AAAA,QACd;AAEA,cAAM,UAAU;AAAA,UACd,EAAE,KAAK,EAAE,SAAS,aAAa,GAAG,QAAQ;AAAA,UAC1C,EAAE,YAAY;AAAA,QAChB;AAEA,cAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAE/C,YAAI,OAAO,OAAO;AAChB,kBAAQ,MAAM,gCAAgC,OAAO,UAAU,sBAAiB,YAAY,WAAM,OAAO,KAAK,EAAE;AAChH,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,OAAO,OAAO;AAAA,YACd,MAAM,OAAO;AAAA,YACb,YAAY,OAAO;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AAEA,cAAM,YAAY,eAAe,OAAO,MAAM;AAC9C,gBAAQ,MAAM,6BAA6B,OAAO,UAAU,sBAAiB,YAAY,WAAM,UAAU,MAAM,QAAQ;AAEvH,cAAM,gBAAgB,IAAI,YAAY,mBAAmB,IAAI,SAAS,IAAI;AAC1E,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,MAAM,OAAO;AAAA,UACb,YAAY,OAAO;AAAA,UACnB;AAAA,UACA,gBAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,UAAU,WAAW;AAAA,EACzB;AACF;AAMA,SAAS,mBACP,KACA,QAMqB;AACrB,QAAM,UACJ,QAAQ,IAAI,4BACZ,QAAQ,IAAI,uBACZ,QAAQ,IAAI,WACZ;AAEF,SAAO,OAAO,WAAW;AACvB,WAAO;AAEP,UAAM,EAAE,QAAQ,MAAM,OAAO,KAAK,IAAI;AACtC,UAAM,YAAY,KAAK,IAAI;AAG3B,UAAM,UAAU,KAAK,WAAW,MAAM,IAAI,OAAO,OAAO,IAAI;AAC5D,QAAI,MAAM,GAAG,OAAO,GAAG,OAAO;AAG9B,UAAM,cAAsC,EAAE,GAAG,MAAM;AAEvD,QAAI,WAAW,OAAO;AACpB,UAAI,IAAI,SAAU,aAAY,WAAW,IAAI;AAC7C,UAAI,IAAI,eAAgB,aAAY,iBAAiB,IAAI;AAAA,IAC3D;AAEA,QAAI,OAAO,KAAK,WAAW,EAAE,SAAS,GAAG;AACvC,YAAM,YAAY,IAAI,SAAS,GAAG,IAAI,MAAM;AAC5C,aAAO,YAAY,IAAI,gBAAgB,WAAW,EAAE,SAAS;AAAA,IAC/D;AAGA,QAAI;AACJ,QAAI,CAAC,QAAQ,OAAO,OAAO,EAAE,SAAS,OAAO,YAAY,CAAC,GAAG;AAC3D,oBAAc,EAAE,GAAG,KAAK;AACxB,UAAI,IAAI,SAAU,aAAY,WAAW,IAAI;AAC7C,UAAI,IAAI,eAAgB,aAAY,iBAAiB,IAAI;AAAA,IAC3D;AAGA,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,IAClB;AACA,QAAI,IAAI,aAAc,SAAQ,WAAW,IAAI,IAAI;AACjD,QAAI,IAAI,SAAU,SAAQ,aAAa,IAAI,IAAI;AAC/C,QAAI,IAAI,eAAgB,SAAQ,mBAAmB,IAAI,IAAI;AAG3D,UAAM,WAAW,MAAM,WAAW,MAAM,KAAK;AAAA,MAC3C,QAAQ,OAAO,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM,cAAc,KAAK,UAAU,WAAW,IAAI;AAAA,IACpD,CAAC;AAED,UAAM,eAAe,MAAM,SAAS,KAAK;AACzC,UAAM,OAAO,aAAa,YAAY;AACtC,UAAM,eAAe,KAAK,IAAI,IAAI;AAElC,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ,MAAM,2BAA2B,OAAO,YAAY,CAAC,IAAI,OAAO,WAAM,SAAS,MAAM,OAAO,YAAY,IAAI;AAGpH,UAAI,SAAS,WAAW,KAAK;AAC3B,eAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,OAAO,sBAAsB,IAAI;AAAA,QACnC;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY,SAAS;AAAA,QACrB,OAAO,aAAa,SAAS,MAAM;AAAA,QACnC,SAAS;AAAA,MACX;AAAA,IACF;AAEA,YAAQ,MAAM,2BAA2B,OAAO,YAAY,CAAC,IAAI,OAAO,WAAM,SAAS,MAAM,OAAO,YAAY,OAAO,aAAa,MAAM,SAAS;AAGnJ,QAAI,CAAC,CAAC,OAAO,QAAQ,SAAS,EAAE,SAAS,OAAO,YAAY,CAAC,GAAG;AAC9D,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY,SAAS;AAAA,QACrB;AAAA,QACA,OAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY,SAAS;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAuB;AAC3C,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": ["memoryContext"]
+}

package/dist/modules/ai_assistant/lib/http-server.js

@@ -57,7 +57,45 @@ async function resolveSessionContext(sessionToken, baseContext, debug) {
     return null;
   }
 }
-function createMcpServerForRequest(config, toolContext) {
+async function resolveApiKeyContext(apiKeyRecord, baseContext, debug) {
+  try {
+    const rbacService = baseContext.container.resolve("rbacService");
+    const userId = apiKeyRecord.sessionUserId ?? apiKeyRecord.createdBy;
+    if (!userId) {
+      if (debug) {
+        console.error(`[MCP HTTP] API key has no associated user`);
+      }
+      return null;
+    }
+    const acl = await rbacService.loadAcl(`api_key:${apiKeyRecord.id}`, {
+      tenantId: apiKeyRecord.tenantId ?? null,
+      organizationId: apiKeyRecord.organizationId ?? null
+    });
+    if (debug) {
+      console.error(`[MCP HTTP] API key context resolved for user ${userId}:`, {
+        tenantId: apiKeyRecord.tenantId,
+        organizationId: apiKeyRecord.organizationId,
+        features: acl.features.length,
+        isSuperAdmin: acl.isSuperAdmin
+      });
+    }
+    return {
+      tenantId: apiKeyRecord.tenantId ?? null,
+      organizationId: apiKeyRecord.organizationId ?? null,
+      userId,
+      container: baseContext.container,
+      userFeatures: acl.features,
+      isSuperAdmin: acl.isSuperAdmin,
+      apiKeySecret: baseContext.apiKeySecret
+    };
+  } catch (error) {
+    if (debug) {
+      console.error(`[MCP HTTP] Error resolving API key context:`, error);
+    }
+    return null;
+  }
+}
+function createMcpServerForRequest(config, toolContext, apiKeyRecord) {
   const server = new McpServer(
     { name: config.name, version: config.version },
     { capabilities: { tools: {} } }
@@ -78,7 +116,7 @@ function createMcpServerForRequest(config, toolContext) {
         const properties = jsonSchema.properties ?? {};
         properties._sessionToken = {
           type: "string",
-          description: "Session authorization token (REQUIRED for all tool calls)"
+          description: "Session authorization token. If omitted, the server API key roles are used instead."
         };
         jsonSchema.properties = properties;
         const converted = jsonSchemaToZod(jsonSchema);
@@ -116,7 +154,7 @@ function createMcpServerForRequest(config, toolContext) {
           if (sessionToken) {
             const sessionContext = await resolveSessionContext(sessionToken, toolContext, config.debug);
             if (sessionContext) {
-              effectiveContext = sessionContext;
+              effectiveContext = { ...sessionContext, sessionId: sessionToken };
             } else {
               return {
                 content: [
@@ -132,13 +170,16 @@ function createMcpServerForRequest(config, toolContext) {
               };
             }
           } else {
-            if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {
+            const apiKeyContext = await resolveApiKeyContext(apiKeyRecord, toolContext, config.debug);
+            if (apiKeyContext) {
+              effectiveContext = apiKeyContext;
+            } else if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {
               return {
                 content: [
                   {
                     type: "text",
                     text: JSON.stringify({
-                      error: "Session token required (_sessionToken parameter)",
+                      error: "Authentication failed: provide a session token (_sessionToken) or a valid API key with assigned roles",
                       code: "UNAUTHORIZED"
                     })
                   }
@@ -146,6 +187,12 @@ function createMcpServerForRequest(config, toolContext) {
                 isError: true
               };
             }
+            if (!effectiveContext.sessionId && effectiveContext.apiKeySecret) {
+              effectiveContext = {
+                ...effectiveContext,
+                sessionId: "apikey_" + effectiveContext.apiKeySecret.slice(0, 16)
+              };
+            }
           }
           if (tool.requiredFeatures?.length) {
             const rbacService = effectiveContext.container.resolve("rbacService");
@@ -259,6 +306,17 @@ async function runMcpHttpServer(options) {
   } catch (error) {
     console.error("[MCP HTTP] Entity graph generation skipped:", error instanceof Error ? error.message : error);
   }
+  try {
+    const { loadRichOpenApiSpec } = await import("./api-endpoint-index.js");
+    const spec = await loadRichOpenApiSpec();
+    if (spec) {
+      console.error("[MCP HTTP] Rich OpenAPI spec cached for Code Mode (with requestBody schemas)");
+    } else {
+      console.error("[MCP HTTP] OpenAPI spec not available");
+    }
+  } catch (error) {
+    console.error("[MCP HTTP] OpenAPI spec caching skipped:", error instanceof Error ? error.message : error);
+  }
   try {
     const searchService = container.resolve("searchService");
     await indexToolsForSearch(searchService);
@@ -334,7 +392,7 @@ async function runMcpHttpServer(options) {
         sessionIdGenerator: void 0,
         enableJsonResponse: req.method === "POST"
       });
-      const mcpServer = createMcpServerForRequest(config, toolContext);
+      const mcpServer = createMcpServerForRequest(config, toolContext, apiKeyRecord);
       if (config.debug) {
         const registeredTools = mcpServer._registeredTools || {};
         console.error(`[MCP HTTP] Registered tools in McpServer:`, Object.keys(registeredTools));
@@ -383,7 +441,7 @@ async function runMcpHttpServer(options) {
   console.error(`[MCP HTTP] Tools registered: ${toolCount}`);
   console.error(`[MCP HTTP] Mode: Stateless (new server per request)`);
   console.error(`[MCP HTTP] Server Auth: API key validated against database (x-api-key header)`);
-  console.error(`[MCP HTTP] User Auth: Session token in _sessionToken parameter`);
+  console.error(`[MCP HTTP] User Auth: Session token (_sessionToken) preferred, falls back to API key roles`);
   return new Promise((resolve) => {
     httpServer.listen(port, () => {
       console.error(`[MCP HTTP] Server listening on port ${port}`);

package/dist/modules/ai_assistant/lib/http-server.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/ai_assistant/lib/http-server.ts"],
-  "sourcesContent": ["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z, type ZodType } from 'zod'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools, indexToolsForSearch } from './tool-loader'\nimport { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'\nimport { jsonSchemaToZod, toSafeZodSchema } from './schema-utils'\nimport type { McpServerConfig, McpToolContext } from './types'\nimport type { SearchService } from '@open-mercato/search/service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findApiKeyBySecret, findSessionApiKeyWithSecret } from '@open-mercato/core/modules/api_keys/services/apiKeyService'\n\n/**\n * Options for the HTTP MCP server.\n */\nexport type McpHttpServerOptions = {\n  config: McpServerConfig\n  container: AwilixContainer\n  port: number\n}\n\n/**\n * Resolve user context from session token.\n * Returns null if session token is invalid or expired.\n * Includes the decrypted API key secret for making authenticated API calls.\n */\nasync function resolveSessionContext(\n  sessionToken: string,\n  baseContext: McpToolContext,\n  debug?: boolean\n): Promise<McpToolContext | null> {\n  try {\n    const em = baseContext.container.resolve<EntityManager>('em')\n    const rbacService = baseContext.container.resolve<RbacService>('rbacService')\n\n    // Look up ephemeral key by session token with decrypted secret\n    const sessionResult = await findSessionApiKeyWithSecret(em, sessionToken)\n    if (!sessionResult) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session token not found, expired, or secret unavailable: ${sessionToken}`)\n      }\n      return null\n    }\n\n    const { key: sessionKey, secret: sessionSecret } = sessionResult\n\n    // Load ACL for the session user\n    const userId = sessionKey.sessionUserId || sessionKey.createdBy\n    if (!userId) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session key has no associated user`)\n      }\n      return null\n    }\n\n    const acl = await rbacService.loadAcl(`api_key:${sessionKey.id}`, {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n    })\n\n    if (debug) {\n      console.error(`[MCP HTTP] Session context resolved for user ${userId}:`, {\n        tenantId: sessionKey.tenantId,\n        organizationId: sessionKey.organizationId,\n        features: acl.features.length,\n        isSuperAdmin: acl.isSuperAdmin,\n        hasSessionSecret: !!sessionSecret,\n      })\n    }\n\n    return {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n      userId,\n      container: baseContext.container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n      // Use the decrypted session secret for API calls (not the MCP server key)\n      apiKeySecret: sessionSecret,\n    }\n  } catch (error) {\n    if (debug) {\n      console.error(`[MCP HTTP] Error resolving session context:`, error)\n    }\n    return null\n  }\n}\n\n/**\n * Create a stateless MCP server instance for a single request.\n * Tools are registered without pre-filtering - permission checks happen at execution time\n * based on the session token provided in each tool call.\n */\nfunction createMcpServerForRequest(\n  config: McpServerConfig,\n  toolContext: McpToolContext\n): McpServer {\n  const server = new McpServer(\n    { name: config.name, version: config.version },\n    { capabilities: { tools: {} } }\n  )\n\n  const registry = getToolRegistry()\n  const tools = Array.from(registry.getTools().values())\n\n  if (config.debug) {\n    console.error(`[MCP HTTP] Registering ${tools.length} tools (ACL checked per-call via session token)`)\n  }\n\n  // Register ALL tools - permission checks happen at execution time via session token\n  for (const tool of tools) {\n    if (config.debug) {\n      console.error(`[MCP HTTP] Registering tool: ${tool.name}`)\n    }\n\n    // Convert Zod schema to a \"safe\" schema without Date types\n    // This uses JSON Schema round-trip to avoid issues with MCP SDK's internal conversion\n    // Also inject _sessionToken as an optional parameter so the AI knows to pass it\n    let safeSchema: ZodType | undefined\n    if (tool.inputSchema) {\n      try {\n        // Convert to JSON Schema first\n        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: 'any' }) as Record<string, unknown>\n\n        // Inject _sessionToken into the JSON schema properties\n        const properties = (jsonSchema.properties ?? {}) as Record<string, unknown>\n        properties._sessionToken = {\n          type: 'string',\n          description: 'Session authorization token (REQUIRED for all tool calls)',\n        }\n        jsonSchema.properties = properties\n\n        // Convert back to Zod with passthrough to allow extra properties\n        const converted = jsonSchemaToZod(jsonSchema)\n        // Use type assertion since we know it's an object schema (we added properties above)\n        safeSchema = (converted as z.ZodObject<any>).passthrough()\n      } catch (error) {\n        if (config.debug) {\n          console.error(\n            `[MCP HTTP] Skipping tool ${tool.name} - schema conversion failed:`,\n            error instanceof Error ? error.message : error\n          )\n        }\n        continue\n      }\n    } else {\n      // If no schema, create one with just _sessionToken\n      safeSchema = z.object({\n        _sessionToken: z\n          .string()\n          .optional()\n          .describe('Session authorization token (REQUIRED for all tool calls)'),\n      })\n    }\n\n    // Wrap in try/catch to handle any remaining edge cases\n    try {\n      server.registerTool(\n        tool.name,\n        {\n          description: tool.description,\n          inputSchema: safeSchema,\n        },\n        async (args: unknown) => {\n          const toolArgs = (args ?? {}) as Record<string, unknown>\n\n          // Extract session token from args\n          const sessionToken = toolArgs._sessionToken as string | undefined\n          delete toolArgs._sessionToken // Remove before passing to tool handler\n\n          // Always log tool calls for debugging\n          console.error(`[MCP HTTP] \u25B6 Tool call: ${tool.name}`, {\n            hasSessionToken: !!sessionToken,\n            args: JSON.stringify(toolArgs).slice(0, 200),\n          })\n\n          // Resolve user context from session token\n          let effectiveContext = toolContext\n          if (sessionToken) {\n            const sessionContext = await resolveSessionContext(sessionToken, toolContext, config.debug)\n            if (sessionContext) {\n              // Session context includes the decrypted API key secret\n              effectiveContext = sessionContext\n            } else {\n              // Session token expired - return user-friendly error for AI to relay\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Your chat session has expired. Please close and reopen the chat window to continue.',\n                      code: 'SESSION_EXPIRED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          } else {\n            // No session token provided - reject if base context has no permissions\n            if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Session token required (_sessionToken parameter)',\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          }\n\n          // Check if user has required permissions for this tool\n          if (tool.requiredFeatures?.length) {\n            const rbacService = effectiveContext.container.resolve<RbacService>('rbacService')\n            const hasAccess = hasRequiredFeatures(\n              tool.requiredFeatures,\n              effectiveContext.userFeatures,\n              effectiveContext.isSuperAdmin,\n              rbacService\n            )\n            if (!hasAccess) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: `Insufficient permissions for tool \"${tool.name}\". Required: ${tool.requiredFeatures.join(', ')}`,\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          }\n\n          try {\n            const result = await executeTool(tool.name, toolArgs, effectiveContext)\n\n            if (!result.success) {\n              console.error(`[MCP HTTP] \u2717 Tool error: ${tool.name}`, { error: result.error, code: result.errorCode })\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({ error: result.error, code: result.errorCode }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n\n            console.error(`[MCP HTTP] \u2713 Tool success: ${tool.name}`, {\n              resultPreview: JSON.stringify(result.result).slice(0, 200)\n            })\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify(result.result, null, 2),\n                },\n              ],\n            }\n          } catch (err) {\n            console.error(`[MCP HTTP] \u2717 Tool exception: ${tool.name}`, err)\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ error: err instanceof Error ? err.message : 'Unknown error', code: 'EXCEPTION' }),\n                },\n              ],\n              isError: true,\n            }\n          }\n        }\n      )\n    } catch (error) {\n      // Skip tools with schemas that can't be registered\n      if (config.debug) {\n        console.error(\n          `[MCP HTTP] Skipping tool ${tool.name} - registration failed:`,\n          error instanceof Error ? error.message : error\n        )\n      }\n      continue\n    }\n  }\n\n  return server\n}\n\n/**\n * Maximum request body size (1MB).\n * Prevents memory exhaustion from oversized payloads.\n */\nconst MAX_BODY_SIZE = 1 * 1024 * 1024\n\n/**\n * Parse JSON body from request with size limit.\n */\nasync function parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let totalSize = 0\n\n    req.on('data', (chunk: Buffer) => {\n      totalSize += chunk.length\n      if (totalSize > MAX_BODY_SIZE) {\n        req.destroy()\n        reject(new Error('Request payload too large'))\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        const body = Buffer.concat(chunks).toString('utf-8')\n        resolve(body ? JSON.parse(body) : undefined)\n      } catch (error) {\n        reject(error)\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n/**\n * Run MCP server with HTTP transport (stateless mode).\n *\n * Each request creates a new MCP server instance and transport.\n * The server authenticates requests using API keys from the x-api-key header.\n */\nexport async function runMcpHttpServer(options: McpHttpServerOptions): Promise<void> {\n  const { config, container, port } = options\n\n  await loadAllModuleTools()\n\n  // Generate and cache entity graph for understand_entity tool\n  try {\n    const { extractEntityGraph, cacheEntityGraph } = await import('./entity-graph')\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n    cacheEntityGraph(graph)\n    console.error(`[MCP HTTP] Entity graph: ${graph.nodes.length} entities, ${graph.edges.length} relationships`)\n  } catch (error) {\n    console.error('[MCP HTTP] Entity graph generation skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Index tools, API endpoints, and entity schemas for hybrid search discovery (if search service available)\n  try {\n    const searchService = container.resolve('searchService') as SearchService\n\n    // Index MCP tools\n    await indexToolsForSearch(searchService)\n\n    // Index API endpoints for find_api\n    const { indexApiEndpoints } = await import('./api-endpoint-index')\n    const endpointCount = await indexApiEndpoints(searchService)\n    if (endpointCount > 0) {\n      console.error(`[MCP HTTP] Indexed ${endpointCount} API endpoints for hybrid search`)\n    }\n\n    // Index entity schemas for discover_schema\n    try {\n      const { getCachedEntityGraph } = await import('./entity-graph')\n      const { indexEntitiesForSearch } = await import('./entity-index')\n      const graph = getCachedEntityGraph()\n      if (graph) {\n        const { count } = await indexEntitiesForSearch(searchService, graph)\n        if (count > 0) {\n          console.error(`[MCP HTTP] Indexed ${count} entity schemas for hybrid search`)\n        }\n      }\n    } catch (entityError) {\n      console.error('[MCP HTTP] Entity schema indexing skipped:', entityError instanceof Error ? entityError.message : entityError)\n    }\n  } catch (error) {\n    // Search service might not be configured - discovery will use fallback\n    console.error('[MCP HTTP] Search indexing skipped (search service not available):', error)\n  }\n\n  const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url || '/', `http://localhost:${port}`)\n\n    // Health check endpoint\n    if (url.pathname === '/health') {\n      res.writeHead(200, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({\n        status: 'ok',\n        tools: getToolRegistry().listToolNames().length,\n        timestamp: new Date().toISOString(),\n      }))\n      return\n    }\n\n    if (url.pathname !== '/mcp') {\n      res.writeHead(404, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Not found' }))\n      return\n    }\n\n    console.error(`[MCP HTTP] \u2190 Request: ${req.method} ${url.pathname}`)\n\n    // Extract headers\n    const headers: Record<string, string | undefined> = {}\n    for (const [key, value] of Object.entries(req.headers)) {\n      headers[key] = Array.isArray(value) ? value[0] : value\n    }\n\n    // Server-level authentication via database lookup\n    const providedApiKey = extractApiKeyFromHeaders(headers)\n    if (!providedApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'API key required (x-api-key header)' }))\n      return\n    }\n\n    // Validate API key against database (prefix lookup + bcrypt verify + expiry check)\n    const em = container.resolve<EntityManager>('em')\n    const apiKeyRecord = await findApiKeyBySecret(em, providedApiKey)\n    if (!apiKeyRecord) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Invalid or expired API key' }))\n      return\n    }\n\n    if (config.debug) {\n      console.error(`[MCP HTTP] Server-level auth passed (${req.method}) - API key: ${apiKeyRecord.keyPrefix}...`)\n    }\n\n    // Create base tool context using API key's tenant/org scope\n    // Session tokens can override with user-specific permissions\n    const toolContext: McpToolContext = {\n      tenantId: apiKeyRecord.tenantId ?? null,\n      organizationId: apiKeyRecord.organizationId ?? null,\n      userId: apiKeyRecord.createdBy ?? null,\n      container,\n      userFeatures: [],\n      isSuperAdmin: false,\n      apiKeySecret: providedApiKey,\n    }\n\n    try {\n      // Create stateless transport (no session ID generator = stateless)\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        enableJsonResponse: req.method === 'POST',\n      })\n\n      // Create new server for this request\n      const mcpServer = createMcpServerForRequest(config, toolContext)\n\n      if (config.debug) {\n        // Check registered tools on the server\n        const registeredTools = (mcpServer as any)._registeredTools || {}\n        console.error(`[MCP HTTP] Registered tools in McpServer:`, Object.keys(registeredTools))\n        console.error(`[MCP HTTP] Tool handlers initialized:`, (mcpServer as any)._toolHandlersInitialized)\n      }\n\n      // Connect server to transport\n      await mcpServer.connect(transport)\n\n      // Handle the request\n      if (req.method === 'POST') {\n        const body = await parseJsonBody(req)\n        await transport.handleRequest(req, res, body)\n      } else {\n        await transport.handleRequest(req, res)\n      }\n\n      // Cleanup after response finishes\n      res.on('finish', () => {\n        transport.close()\n        mcpServer.close()\n        if (config.debug) {\n          console.error(`[MCP HTTP] Request completed, cleaned up`)\n        }\n      })\n    } catch (error) {\n      console.error('[MCP HTTP] Error handling request:', error)\n      if (!res.headersSent) {\n        // Handle payload too large error\n        if (error instanceof Error && error.message === 'Request payload too large') {\n          res.writeHead(413, { 'Content-Type': 'application/json' })\n          res.end(JSON.stringify({ error: 'Request payload too large (max 1MB)' }))\n          return\n        }\n\n        res.writeHead(500, { 'Content-Type': 'application/json' })\n        res.end(\n          JSON.stringify({\n            jsonrpc: '2.0',\n            error: {\n              code: -32603,\n              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,\n            },\n            id: null,\n          })\n        )\n      }\n    }\n  })\n\n  const toolCount = getToolRegistry().listToolNames().length\n\n  console.error(`[MCP HTTP] Starting ${config.name} v${config.version}`)\n  console.error(`[MCP HTTP] Endpoint: http://localhost:${port}/mcp`)\n  console.error(`[MCP HTTP] Health: http://localhost:${port}/health`)\n  console.error(`[MCP HTTP] Tools registered: ${toolCount}`)\n  console.error(`[MCP HTTP] Mode: Stateless (new server per request)`)\n  console.error(`[MCP HTTP] Server Auth: API key validated against database (x-api-key header)`)\n  console.error(`[MCP HTTP] User Auth: Session token in _sessionToken parameter`)\n\n  // Return a Promise that keeps the process alive until shutdown\n  return new Promise<void>((resolve) => {\n    httpServer.listen(port, () => {\n      console.error(`[MCP HTTP] Server listening on port ${port}`)\n    })\n\n    const shutdown = async () => {\n      console.error('[MCP HTTP] Shutting down...')\n      httpServer.close(() => {\n        console.error('[MCP HTTP] Server closed')\n        resolve()\n      })\n    }\n\n    process.on('SIGINT', shutdown)\n    process.on('SIGTERM', shutdown)\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAA+D;AACxE,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAG9C,SAAS,SAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB,2BAA2B;AACxD,SAAiC,0BAA0B,2BAA2B;AACtF,SAAS,uBAAwC;AAIjD,SAAS,oBAAoB,mCAAmC;AAgBhE,eAAe,sBACb,cACA,aACA,OACgC;AAChC,MAAI;AACF,UAAM,KAAK,YAAY,UAAU,QAAuB,IAAI;AAC5D,UAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAG5E,UAAM,gBAAgB,MAAM,4BAA4B,IAAI,YAAY;AACxE,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO;AACT,gBAAQ,MAAM,uEAAuE,YAAY,EAAE;AAAA,MACrG;AACA,aAAO;AAAA,IACT;AAEA,UAAM,EAAE,KAAK,YAAY,QAAQ,cAAc,IAAI;AAGnD,UAAM,SAAS,WAAW,iBAAiB,WAAW;AACtD,QAAI,CAAC,QAAQ;AACX,UAAI,OAAO;AACT,gBAAQ,MAAM,+CAA+C;AAAA,MAC/D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,MAAM,YAAY,QAAQ,WAAW,WAAW,EAAE,IAAI;AAAA,MAChE,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AAED,QAAI,OAAO;AACT,cAAQ,MAAM,gDAAgD,MAAM,KAAK;AAAA,QACvE,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,UAAU,IAAI,SAAS;AAAA,QACvB,cAAc,IAAI;AAAA,QAClB,kBAAkB,CAAC,CAAC;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,MAC7C;AAAA,MACA,WAAW,YAAY;AAAA,MACvB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA;AAAA,MAElB,cAAc;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,OAAO;AACT,cAAQ,MAAM,+CAA+C,KAAK;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AACF;AAOA,SAAS,0BACP,QACA,aACW;AACX,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ;AAAA,IAC7C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,QAAM,WAAW,gBAAgB;AACjC,QAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAErD,MAAI,OAAO,OAAO;AAChB,YAAQ,MAAM,0BAA0B,MAAM,MAAM,iDAAiD;AAAA,EACvG;AAGA,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,gCAAgC,KAAK,IAAI,EAAE;AAAA,IAC3D;AAKA,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,UAAI;AAEF,cAAM,aAAa,EAAE,aAAa,KAAK,aAAa,EAAE,iBAAiB,MAAM,CAAC;AAG9E,cAAM,aAAc,WAAW,cAAc,CAAC;AAC9C,mBAAW,gBAAgB;AAAA,UACzB,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AACA,mBAAW,aAAa;AAGxB,cAAM,YAAY,gBAAgB,UAAU;AAE5C,qBAAc,UAA+B,YAAY;AAAA,MAC3D,SAAS,OAAO;AACd,YAAI,OAAO,OAAO;AAChB,kBAAQ;AAAA,YACN,4BAA4B,KAAK,IAAI;AAAA,YACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UAC3C;AAAA,QACF;AACA;AAAA,MACF;AAAA,IACF,OAAO;AAEL,mBAAa,EAAE,OAAO;AAAA,QACpB,eAAe,EACZ,OAAO,EACP,SAAS,EACT,SAAS,2DAA2D;AAAA,MACzE,CAAC;AAAA,IACH;AAGA,QAAI;AACF,aAAO;AAAA,QACL,KAAK;AAAA,QACL;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,aAAa;AAAA,QACf;AAAA,QACA,OAAO,SAAkB;AACvB,gBAAM,WAAY,QAAQ,CAAC;AAG3B,gBAAM,eAAe,SAAS;AAC9B,iBAAO,SAAS;AAGhB,kBAAQ,MAAM,gCAA2B,KAAK,IAAI,IAAI;AAAA,YACpD,iBAAiB,CAAC,CAAC;AAAA,YACnB,MAAM,KAAK,UAAU,QAAQ,EAAE,MAAM,GAAG,GAAG;AAAA,UAC7C,CAAC;AAGD,cAAI,mBAAmB;AACvB,cAAI,cAAc;AAChB,kBAAM,iBAAiB,MAAM,sBAAsB,cAAc,aAAa,OAAO,KAAK;AAC1F,gBAAI,gBAAgB;AAElB,iCAAmB;AAAA,YACrB,OAAO;AAEL,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF,OAAO;AAEL,gBAAI,CAAC,iBAAiB,UAAU,iBAAiB,aAAa,WAAW,GAAG;AAC1E,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAGA,cAAI,KAAK,kBAAkB,QAAQ;AACjC,kBAAM,cAAc,iBAAiB,UAAU,QAAqB,aAAa;AACjF,kBAAM,YAAY;AAAA,cAChB,KAAK;AAAA,cACL,iBAAiB;AAAA,cACjB,iBAAiB;AAAA,cACjB;AAAA,YACF;AACA,gBAAI,CAAC,WAAW;AACd,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO,sCAAsC,KAAK,IAAI,gBAAgB,KAAK,iBAAiB,KAAK,IAAI,CAAC;AAAA,sBACtG,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,SAAS,MAAM,YAAY,KAAK,MAAM,UAAU,gBAAgB;AAEtE,gBAAI,CAAC,OAAO,SAAS;AACnB,sBAAQ,MAAM,iCAA4B,KAAK,IAAI,IAAI,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AACtG,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AAAA,kBACtE;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAEA,oBAAQ,MAAM,mCAA8B,KAAK,IAAI,IAAI;AAAA,cACvD,eAAe,KAAK,UAAU,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,YAC3D,CAAC;AACD,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAAA,gBAC7C;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAAS,KAAK;AACZ,oBAAQ,MAAM,qCAAgC,KAAK,IAAI,IAAI,GAAG;AAC9D,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,iBAAiB,MAAM,YAAY,CAAC;AAAA,gBACzG;AAAA,cACF;AAAA,cACA,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,OAAO,OAAO;AAChB,gBAAQ;AAAA,UACN,4BAA4B,KAAK,IAAI;AAAA,UACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAC3C;AAAA,MACF;AACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,MAAM,gBAAgB,IAAI,OAAO;AAKjC,eAAe,cAAc,KAAwC;AACnE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,YAAY;AAEhB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,mBAAa,MAAM;AACnB,UAAI,YAAY,eAAe;AAC7B,YAAI,QAAQ;AACZ,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAC7C;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AACnD,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,MAAS;AAAA,MAC7C,SAAS,OAAO;AACd,eAAO,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAQA,eAAsB,iBAAiB,SAA8C;AACnF,QAAM,EAAE,QAAQ,WAAW,KAAK,IAAI;AAEpC,QAAM,mBAAmB;AAGzB,MAAI;AACF,UAAM,EAAE,oBAAoB,iBAAiB,IAAI,MAAM,OAAO,gBAAgB;AAC9E,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AAEnE,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAC1C,qBAAiB,KAAK;AACtB,YAAQ,MAAM,4BAA4B,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,MAAM,gBAAgB;AAAA,EAC9G,SAAS,OAAO;AACd,YAAQ,MAAM,+CAA+C,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EAC7G;AAGA,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,eAAe;AAGvD,UAAM,oBAAoB,aAAa;AAGvC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAsB;AACjE,UAAM,gBAAgB,MAAM,kBAAkB,aAAa;AAC3D,QAAI,gBAAgB,GAAG;AACrB,cAAQ,MAAM,sBAAsB,aAAa,kCAAkC;AAAA,IACrF;AAGA,QAAI;AACF,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,gBAAgB;AAC9D,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,gBAAgB;AAChE,YAAM,QAAQ,qBAAqB;AACnC,UAAI,OAAO;AACT,cAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,eAAe,KAAK;AACnE,YAAI,QAAQ,GAAG;AACb,kBAAQ,MAAM,sBAAsB,KAAK,mCAAmC;AAAA,QAC9E;AAAA,MACF;AAAA,IACF,SAAS,aAAa;AACpB,cAAQ,MAAM,8CAA8C,uBAAuB,QAAQ,YAAY,UAAU,WAAW;AAAA,IAC9H;AAAA,EACF,SAAS,OAAO;AAEd,YAAQ,MAAM,sEAAsE,KAAK;AAAA,EAC3F;AAEA,QAAM,aAAa,aAAa,OAAO,KAAsB,QAAwB;AACnF,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,IAAI,EAAE;AAG9D,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO,gBAAgB,EAAE,cAAc,EAAE;AAAA,QACzC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,QAAI,IAAI,aAAa,QAAQ;AAC3B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;AAC9C;AAAA,IACF;AAEA,YAAQ,MAAM,8BAAyB,IAAI,MAAM,IAAI,IAAI,QAAQ,EAAE;AAGnE,UAAM,UAA8C,CAAC;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,cAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IACnD;AAGA,UAAM,iBAAiB,yBAAyB,OAAO;AACvD,QAAI,CAAC,gBAAgB;AACnB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,IACF;AAGA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,eAAe,MAAM,mBAAmB,IAAI,cAAc;AAChE,QAAI,CAAC,cAAc;AACjB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;AAC/D;AAAA,IACF;AAEA,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,wCAAwC,IAAI,MAAM,gBAAgB,aAAa,SAAS,KAAK;AAAA,IAC7G;AAIA,UAAM,cAA8B;AAAA,MAClC,UAAU,aAAa,YAAY;AAAA,MACnC,gBAAgB,aAAa,kBAAkB;AAAA,MAC/C,QAAQ,aAAa,aAAa;AAAA,MAClC;AAAA,MACA,cAAc,CAAC;AAAA,MACf,cAAc;AAAA,MACd,cAAc;AAAA,IAChB;AAEA,QAAI;AAEF,YAAM,YAAY,IAAI,8BAA8B;AAAA,QAClD,oBAAoB;AAAA,QACpB,oBAAoB,IAAI,WAAW;AAAA,MACrC,CAAC;AAGD,YAAM,YAAY,0BAA0B,QAAQ,WAAW;AAE/D,UAAI,OAAO,OAAO;AAEhB,cAAM,kBAAmB,UAAkB,oBAAoB,CAAC;AAChE,gBAAQ,MAAM,6CAA6C,OAAO,KAAK,eAAe,CAAC;AACvF,gBAAQ,MAAM,yCAA0C,UAAkB,wBAAwB;AAAA,MACpG;AAGA,YAAM,UAAU,QAAQ,SAAS;AAGjC,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,OAAO,MAAM,cAAc,GAAG;AACpC,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,MAC9C,OAAO;AACL,cAAM,UAAU,cAAc,KAAK,GAAG;AAAA,MACxC;AAGA,UAAI,GAAG,UAAU,MAAM;AACrB,kBAAU,MAAM;AAChB,kBAAU,MAAM;AAChB,YAAI,OAAO,OAAO;AAChB,kBAAQ,MAAM,0CAA0C;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,sCAAsC,KAAK;AACzD,UAAI,CAAC,IAAI,aAAa;AAEpB,YAAI,iBAAiB,SAAS,MAAM,YAAY,6BAA6B;AAC3E,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,QACF;AAEA,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU;AAAA,YACb,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,YAC3F;AAAA,YACA,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,gBAAgB,EAAE,cAAc,EAAE;AAEpD,UAAQ,MAAM,uBAAuB,OAAO,IAAI,KAAK,OAAO,OAAO,EAAE;AACrE,UAAQ,MAAM,yCAAyC,IAAI,MAAM;AACjE,UAAQ,MAAM,uCAAuC,IAAI,SAAS;AAClE,UAAQ,MAAM,gCAAgC,SAAS,EAAE;AACzD,UAAQ,MAAM,qDAAqD;AACnE,UAAQ,MAAM,+EAA+E;AAC7F,UAAQ,MAAM,gEAAgE;AAG9E,SAAO,IAAI,QAAc,CAAC,YAAY;AACpC,eAAW,OAAO,MAAM,MAAM;AAC5B,cAAQ,MAAM,uCAAuC,IAAI,EAAE;AAAA,IAC7D,CAAC;AAED,UAAM,WAAW,YAAY;AAC3B,cAAQ,MAAM,6BAA6B;AAC3C,iBAAW,MAAM,MAAM;AACrB,gBAAQ,MAAM,0BAA0B;AACxC,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACH;",
+  "sourcesContent": ["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z, type ZodType } from 'zod'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools, indexToolsForSearch } from './tool-loader'\nimport { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'\nimport { jsonSchemaToZod, toSafeZodSchema } from './schema-utils'\nimport type { McpServerConfig, McpToolContext } from './types'\nimport type { SearchService } from '@open-mercato/search/service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findApiKeyBySecret, findSessionApiKeyWithSecret } from '@open-mercato/core/modules/api_keys/services/apiKeyService'\n\n/**\n * Options for the HTTP MCP server.\n */\nexport type McpHttpServerOptions = {\n  config: McpServerConfig\n  container: AwilixContainer\n  port: number\n}\n\n/**\n * Resolve user context from session token.\n * Returns null if session token is invalid or expired.\n * Includes the decrypted API key secret for making authenticated API calls.\n */\nasync function resolveSessionContext(\n  sessionToken: string,\n  baseContext: McpToolContext,\n  debug?: boolean\n): Promise<McpToolContext | null> {\n  try {\n    const em = baseContext.container.resolve<EntityManager>('em')\n    const rbacService = baseContext.container.resolve<RbacService>('rbacService')\n\n    // Look up ephemeral key by session token with decrypted secret\n    const sessionResult = await findSessionApiKeyWithSecret(em, sessionToken)\n    if (!sessionResult) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session token not found, expired, or secret unavailable: ${sessionToken}`)\n      }\n      return null\n    }\n\n    const { key: sessionKey, secret: sessionSecret } = sessionResult\n\n    // Load ACL for the session user\n    const userId = sessionKey.sessionUserId || sessionKey.createdBy\n    if (!userId) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session key has no associated user`)\n      }\n      return null\n    }\n\n    const acl = await rbacService.loadAcl(`api_key:${sessionKey.id}`, {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n    })\n\n    if (debug) {\n      console.error(`[MCP HTTP] Session context resolved for user ${userId}:`, {\n        tenantId: sessionKey.tenantId,\n        organizationId: sessionKey.organizationId,\n        features: acl.features.length,\n        isSuperAdmin: acl.isSuperAdmin,\n        hasSessionSecret: !!sessionSecret,\n      })\n    }\n\n    return {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n      userId,\n      container: baseContext.container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n      // Use the decrypted session secret for API calls (not the MCP server key)\n      apiKeySecret: sessionSecret,\n    }\n  } catch (error) {\n    if (debug) {\n      console.error(`[MCP HTTP] Error resolving session context:`, error)\n    }\n    return null\n  }\n}\n\n/**\n * Resolve user context from the server-level API key (header-based auth fallback).\n * Used when no session token is provided \u2014 loads the API key's ACL for RBAC.\n */\nasync function resolveApiKeyContext(\n  apiKeyRecord: ApiKey,\n  baseContext: McpToolContext,\n  debug?: boolean\n): Promise<McpToolContext | null> {\n  try {\n    const rbacService = baseContext.container.resolve<RbacService>('rbacService')\n    const userId = apiKeyRecord.sessionUserId ?? apiKeyRecord.createdBy\n    if (!userId) {\n      if (debug) {\n        console.error(`[MCP HTTP] API key has no associated user`)\n      }\n      return null\n    }\n\n    const acl = await rbacService.loadAcl(`api_key:${apiKeyRecord.id}`, {\n      tenantId: apiKeyRecord.tenantId ?? null,\n      organizationId: apiKeyRecord.organizationId ?? null,\n    })\n\n    if (debug) {\n      console.error(`[MCP HTTP] API key context resolved for user ${userId}:`, {\n        tenantId: apiKeyRecord.tenantId,\n        organizationId: apiKeyRecord.organizationId,\n        features: acl.features.length,\n        isSuperAdmin: acl.isSuperAdmin,\n      })\n    }\n\n    return {\n      tenantId: apiKeyRecord.tenantId ?? null,\n      organizationId: apiKeyRecord.organizationId ?? null,\n      userId,\n      container: baseContext.container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n      apiKeySecret: baseContext.apiKeySecret,\n    }\n  } catch (error) {\n    if (debug) {\n      console.error(`[MCP HTTP] Error resolving API key context:`, error)\n    }\n    return null\n  }\n}\n\n/**\n * Create a stateless MCP server instance for a single request.\n * Tools are registered without pre-filtering - permission checks happen at execution time\n * based on the session token provided in each tool call.\n */\nfunction createMcpServerForRequest(\n  config: McpServerConfig,\n  toolContext: McpToolContext,\n  apiKeyRecord: ApiKey\n): McpServer {\n  const server = new McpServer(\n    { name: config.name, version: config.version },\n    { capabilities: { tools: {} } }\n  )\n\n  const registry = getToolRegistry()\n  const tools = Array.from(registry.getTools().values())\n\n  if (config.debug) {\n    console.error(`[MCP HTTP] Registering ${tools.length} tools (ACL checked per-call via session token)`)\n  }\n\n  // Register ALL tools - permission checks happen at execution time via session token\n  for (const tool of tools) {\n    if (config.debug) {\n      console.error(`[MCP HTTP] Registering tool: ${tool.name}`)\n    }\n\n    // Convert Zod schema to a \"safe\" schema without Date types\n    // This uses JSON Schema round-trip to avoid issues with MCP SDK's internal conversion\n    // Also inject _sessionToken as an optional parameter so the AI knows to pass it\n    let safeSchema: ZodType | undefined\n    if (tool.inputSchema) {\n      try {\n        // Convert to JSON Schema first\n        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: 'any' }) as Record<string, unknown>\n\n        // Inject _sessionToken into the JSON schema properties\n        const properties = (jsonSchema.properties ?? {}) as Record<string, unknown>\n        properties._sessionToken = {\n          type: 'string',\n          description: 'Session authorization token. If omitted, the server API key roles are used instead.',\n        }\n        jsonSchema.properties = properties\n\n        // Convert back to Zod with passthrough to allow extra properties\n        const converted = jsonSchemaToZod(jsonSchema)\n        // Use type assertion since we know it's an object schema (we added properties above)\n        safeSchema = (converted as z.ZodObject<any>).passthrough()\n      } catch (error) {\n        if (config.debug) {\n          console.error(\n            `[MCP HTTP] Skipping tool ${tool.name} - schema conversion failed:`,\n            error instanceof Error ? error.message : error\n          )\n        }\n        continue\n      }\n    } else {\n      // If no schema, create one with just _sessionToken\n      safeSchema = z.object({\n        _sessionToken: z\n          .string()\n          .optional()\n          .describe('Session authorization token (REQUIRED for all tool calls)'),\n      })\n    }\n\n    // Wrap in try/catch to handle any remaining edge cases\n    try {\n      server.registerTool(\n        tool.name,\n        {\n          description: tool.description,\n          inputSchema: safeSchema,\n        },\n        async (args: unknown) => {\n          const toolArgs = (args ?? {}) as Record<string, unknown>\n\n          // Extract session token from args\n          const sessionToken = toolArgs._sessionToken as string | undefined\n          delete toolArgs._sessionToken // Remove before passing to tool handler\n\n          // Always log tool calls for debugging\n          console.error(`[MCP HTTP] \u25B6 Tool call: ${tool.name}`, {\n            hasSessionToken: !!sessionToken,\n            args: JSON.stringify(toolArgs).slice(0, 200),\n          })\n\n          // Resolve user context from session token\n          let effectiveContext = toolContext\n          if (sessionToken) {\n            const sessionContext = await resolveSessionContext(sessionToken, toolContext, config.debug)\n            if (sessionContext) {\n              // Session context includes the decrypted API key secret + session ID for memory layer\n              effectiveContext = { ...sessionContext, sessionId: sessionToken }\n            } else {\n              // Session token expired - return user-friendly error for AI to relay\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Your chat session has expired. Please close and reopen the chat window to continue.',\n                      code: 'SESSION_EXPIRED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          } else {\n            // No session token \u2014 fall back to header API key auth\n            const apiKeyContext = await resolveApiKeyContext(apiKeyRecord, toolContext, config.debug)\n            if (apiKeyContext) {\n              effectiveContext = apiKeyContext\n            } else if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Authentication failed: provide a session token (_sessionToken) or a valid API key with assigned roles',\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n\n            // Derive a fallback sessionId from the API key so all tool calls\n            // within the same MCP connection share a session memory cache\n            if (!effectiveContext.sessionId && effectiveContext.apiKeySecret) {\n              effectiveContext = {\n                ...effectiveContext,\n                sessionId: 'apikey_' + effectiveContext.apiKeySecret.slice(0, 16),\n              }\n            }\n          }\n\n          // Check if user has required permissions for this tool\n          if (tool.requiredFeatures?.length) {\n            const rbacService = effectiveContext.container.resolve<RbacService>('rbacService')\n            const hasAccess = hasRequiredFeatures(\n              tool.requiredFeatures,\n              effectiveContext.userFeatures,\n              effectiveContext.isSuperAdmin,\n              rbacService\n            )\n            if (!hasAccess) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: `Insufficient permissions for tool \"${tool.name}\". Required: ${tool.requiredFeatures.join(', ')}`,\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          }\n\n          try {\n            const result = await executeTool(tool.name, toolArgs, effectiveContext)\n\n            if (!result.success) {\n              console.error(`[MCP HTTP] \u2717 Tool error: ${tool.name}`, { error: result.error, code: result.errorCode })\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({ error: result.error, code: result.errorCode }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n\n            console.error(`[MCP HTTP] \u2713 Tool success: ${tool.name}`, {\n              resultPreview: JSON.stringify(result.result).slice(0, 200)\n            })\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify(result.result, null, 2),\n                },\n              ],\n            }\n          } catch (err) {\n            console.error(`[MCP HTTP] \u2717 Tool exception: ${tool.name}`, err)\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ error: err instanceof Error ? err.message : 'Unknown error', code: 'EXCEPTION' }),\n                },\n              ],\n              isError: true,\n            }\n          }\n        }\n      )\n    } catch (error) {\n      // Skip tools with schemas that can't be registered\n      if (config.debug) {\n        console.error(\n          `[MCP HTTP] Skipping tool ${tool.name} - registration failed:`,\n          error instanceof Error ? error.message : error\n        )\n      }\n      continue\n    }\n  }\n\n  return server\n}\n\n/**\n * Maximum request body size (1MB).\n * Prevents memory exhaustion from oversized payloads.\n */\nconst MAX_BODY_SIZE = 1 * 1024 * 1024\n\n/**\n * Parse JSON body from request with size limit.\n */\nasync function parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let totalSize = 0\n\n    req.on('data', (chunk: Buffer) => {\n      totalSize += chunk.length\n      if (totalSize > MAX_BODY_SIZE) {\n        req.destroy()\n        reject(new Error('Request payload too large'))\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        const body = Buffer.concat(chunks).toString('utf-8')\n        resolve(body ? JSON.parse(body) : undefined)\n      } catch (error) {\n        reject(error)\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n/**\n * Run MCP server with HTTP transport (stateless mode).\n *\n * Each request creates a new MCP server instance and transport.\n * The server authenticates requests using API keys from the x-api-key header.\n */\nexport async function runMcpHttpServer(options: McpHttpServerOptions): Promise<void> {\n  const { config, container, port } = options\n\n  await loadAllModuleTools()\n\n  // Generate and cache entity graph for understand_entity tool\n  try {\n    const { extractEntityGraph, cacheEntityGraph } = await import('./entity-graph')\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n    cacheEntityGraph(graph)\n    console.error(`[MCP HTTP] Entity graph: ${graph.nodes.length} entities, ${graph.edges.length} relationships`)\n  } catch (error) {\n    console.error('[MCP HTTP] Entity graph generation skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Pre-cache rich OpenAPI spec for Code Mode search tool (prefers runtime module registry over static JSON)\n  try {\n    const { loadRichOpenApiSpec } = await import('./api-endpoint-index')\n    const spec = await loadRichOpenApiSpec()\n    if (spec) {\n      console.error('[MCP HTTP] Rich OpenAPI spec cached for Code Mode (with requestBody schemas)')\n    } else {\n      console.error('[MCP HTTP] OpenAPI spec not available')\n    }\n  } catch (error) {\n    console.error('[MCP HTTP] OpenAPI spec caching skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Index tools, API endpoints, and entity schemas for hybrid search discovery (if search service available)\n  try {\n    const searchService = container.resolve('searchService') as SearchService\n\n    // Index MCP tools\n    await indexToolsForSearch(searchService)\n\n    // Index API endpoints for find_api\n    const { indexApiEndpoints } = await import('./api-endpoint-index')\n    const endpointCount = await indexApiEndpoints(searchService)\n    if (endpointCount > 0) {\n      console.error(`[MCP HTTP] Indexed ${endpointCount} API endpoints for hybrid search`)\n    }\n\n    // Index entity schemas for discover_schema\n    try {\n      const { getCachedEntityGraph } = await import('./entity-graph')\n      const { indexEntitiesForSearch } = await import('./entity-index')\n      const graph = getCachedEntityGraph()\n      if (graph) {\n        const { count } = await indexEntitiesForSearch(searchService, graph)\n        if (count > 0) {\n          console.error(`[MCP HTTP] Indexed ${count} entity schemas for hybrid search`)\n        }\n      }\n    } catch (entityError) {\n      console.error('[MCP HTTP] Entity schema indexing skipped:', entityError instanceof Error ? entityError.message : entityError)\n    }\n  } catch (error) {\n    // Search service might not be configured - discovery will use fallback\n    console.error('[MCP HTTP] Search indexing skipped (search service not available):', error)\n  }\n\n  const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url || '/', `http://localhost:${port}`)\n\n    // Health check endpoint\n    if (url.pathname === '/health') {\n      res.writeHead(200, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({\n        status: 'ok',\n        tools: getToolRegistry().listToolNames().length,\n        timestamp: new Date().toISOString(),\n      }))\n      return\n    }\n\n    if (url.pathname !== '/mcp') {\n      res.writeHead(404, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Not found' }))\n      return\n    }\n\n    console.error(`[MCP HTTP] \u2190 Request: ${req.method} ${url.pathname}`)\n\n    // Extract headers\n    const headers: Record<string, string | undefined> = {}\n    for (const [key, value] of Object.entries(req.headers)) {\n      headers[key] = Array.isArray(value) ? value[0] : value\n    }\n\n    // Server-level authentication via database lookup\n    const providedApiKey = extractApiKeyFromHeaders(headers)\n    if (!providedApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'API key required (x-api-key header)' }))\n      return\n    }\n\n    // Validate API key against database (prefix lookup + bcrypt verify + expiry check)\n    const em = container.resolve<EntityManager>('em')\n    const apiKeyRecord = await findApiKeyBySecret(em, providedApiKey)\n    if (!apiKeyRecord) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Invalid or expired API key' }))\n      return\n    }\n\n    if (config.debug) {\n      console.error(`[MCP HTTP] Server-level auth passed (${req.method}) - API key: ${apiKeyRecord.keyPrefix}...`)\n    }\n\n    // Create base tool context using API key's tenant/org scope\n    // Session tokens can override with user-specific permissions\n    const toolContext: McpToolContext = {\n      tenantId: apiKeyRecord.tenantId ?? null,\n      organizationId: apiKeyRecord.organizationId ?? null,\n      userId: apiKeyRecord.createdBy ?? null,\n      container,\n      userFeatures: [],\n      isSuperAdmin: false,\n      apiKeySecret: providedApiKey,\n    }\n\n    try {\n      // Create stateless transport (no session ID generator = stateless)\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        enableJsonResponse: req.method === 'POST',\n      })\n\n      // Create new server for this request\n      const mcpServer = createMcpServerForRequest(config, toolContext, apiKeyRecord)\n\n      if (config.debug) {\n        // Check registered tools on the server\n        const registeredTools = (mcpServer as any)._registeredTools || {}\n        console.error(`[MCP HTTP] Registered tools in McpServer:`, Object.keys(registeredTools))\n        console.error(`[MCP HTTP] Tool handlers initialized:`, (mcpServer as any)._toolHandlersInitialized)\n      }\n\n      // Connect server to transport\n      await mcpServer.connect(transport)\n\n      // Handle the request\n      if (req.method === 'POST') {\n        const body = await parseJsonBody(req)\n        await transport.handleRequest(req, res, body)\n      } else {\n        await transport.handleRequest(req, res)\n      }\n\n      // Cleanup after response finishes\n      res.on('finish', () => {\n        transport.close()\n        mcpServer.close()\n        if (config.debug) {\n          console.error(`[MCP HTTP] Request completed, cleaned up`)\n        }\n      })\n    } catch (error) {\n      console.error('[MCP HTTP] Error handling request:', error)\n      if (!res.headersSent) {\n        // Handle payload too large error\n        if (error instanceof Error && error.message === 'Request payload too large') {\n          res.writeHead(413, { 'Content-Type': 'application/json' })\n          res.end(JSON.stringify({ error: 'Request payload too large (max 1MB)' }))\n          return\n        }\n\n        res.writeHead(500, { 'Content-Type': 'application/json' })\n        res.end(\n          JSON.stringify({\n            jsonrpc: '2.0',\n            error: {\n              code: -32603,\n              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,\n            },\n            id: null,\n          })\n        )\n      }\n    }\n  })\n\n  const toolCount = getToolRegistry().listToolNames().length\n\n  console.error(`[MCP HTTP] Starting ${config.name} v${config.version}`)\n  console.error(`[MCP HTTP] Endpoint: http://localhost:${port}/mcp`)\n  console.error(`[MCP HTTP] Health: http://localhost:${port}/health`)\n  console.error(`[MCP HTTP] Tools registered: ${toolCount}`)\n  console.error(`[MCP HTTP] Mode: Stateless (new server per request)`)\n  console.error(`[MCP HTTP] Server Auth: API key validated against database (x-api-key header)`)\n  console.error(`[MCP HTTP] User Auth: Session token (_sessionToken) preferred, falls back to API key roles`)\n\n  // Return a Promise that keeps the process alive until shutdown\n  return new Promise<void>((resolve) => {\n    httpServer.listen(port, () => {\n      console.error(`[MCP HTTP] Server listening on port ${port}`)\n    })\n\n    const shutdown = async () => {\n      console.error('[MCP HTTP] Shutting down...')\n      httpServer.close(() => {\n        console.error('[MCP HTTP] Server closed')\n        resolve()\n      })\n    }\n\n    process.on('SIGINT', shutdown)\n    process.on('SIGTERM', shutdown)\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAA+D;AACxE,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAG9C,SAAS,SAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB,2BAA2B;AACxD,SAAiC,0BAA0B,2BAA2B;AACtF,SAAS,uBAAwC;AAKjD,SAAS,oBAAoB,mCAAmC;AAgBhE,eAAe,sBACb,cACA,aACA,OACgC;AAChC,MAAI;AACF,UAAM,KAAK,YAAY,UAAU,QAAuB,IAAI;AAC5D,UAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAG5E,UAAM,gBAAgB,MAAM,4BAA4B,IAAI,YAAY;AACxE,QAAI,CAAC,eAAe;AAClB,UAAI,OAAO;AACT,gBAAQ,MAAM,uEAAuE,YAAY,EAAE;AAAA,MACrG;AACA,aAAO;AAAA,IACT;AAEA,UAAM,EAAE,KAAK,YAAY,QAAQ,cAAc,IAAI;AAGnD,UAAM,SAAS,WAAW,iBAAiB,WAAW;AACtD,QAAI,CAAC,QAAQ;AACX,UAAI,OAAO;AACT,gBAAQ,MAAM,+CAA+C;AAAA,MAC/D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,MAAM,YAAY,QAAQ,WAAW,WAAW,EAAE,IAAI;AAAA,MAChE,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AAED,QAAI,OAAO;AACT,cAAQ,MAAM,gDAAgD,MAAM,KAAK;AAAA,QACvE,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,UAAU,IAAI,SAAS;AAAA,QACvB,cAAc,IAAI;AAAA,QAClB,kBAAkB,CAAC,CAAC;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,MAC7C;AAAA,MACA,WAAW,YAAY;AAAA,MACvB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA;AAAA,MAElB,cAAc;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,OAAO;AACT,cAAQ,MAAM,+CAA+C,KAAK;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AACF;AAMA,eAAe,qBACb,cACA,aACA,OACgC;AAChC,MAAI;AACF,UAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAC5E,UAAM,SAAS,aAAa,iBAAiB,aAAa;AAC1D,QAAI,CAAC,QAAQ;AACX,UAAI,OAAO;AACT,gBAAQ,MAAM,2CAA2C;AAAA,MAC3D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,MAAM,YAAY,QAAQ,WAAW,aAAa,EAAE,IAAI;AAAA,MAClE,UAAU,aAAa,YAAY;AAAA,MACnC,gBAAgB,aAAa,kBAAkB;AAAA,IACjD,CAAC;AAED,QAAI,OAAO;AACT,cAAQ,MAAM,gDAAgD,MAAM,KAAK;AAAA,QACvE,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,QAC7B,UAAU,IAAI,SAAS;AAAA,QACvB,cAAc,IAAI;AAAA,MACpB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,UAAU,aAAa,YAAY;AAAA,MACnC,gBAAgB,aAAa,kBAAkB;AAAA,MAC/C;AAAA,MACA,WAAW,YAAY;AAAA,MACvB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,MAClB,cAAc,YAAY;AAAA,IAC5B;AAAA,EACF,SAAS,OAAO;AACd,QAAI,OAAO;AACT,cAAQ,MAAM,+CAA+C,KAAK;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AACF;AAOA,SAAS,0BACP,QACA,aACA,cACW;AACX,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ;AAAA,IAC7C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,QAAM,WAAW,gBAAgB;AACjC,QAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAErD,MAAI,OAAO,OAAO;AAChB,YAAQ,MAAM,0BAA0B,MAAM,MAAM,iDAAiD;AAAA,EACvG;AAGA,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,gCAAgC,KAAK,IAAI,EAAE;AAAA,IAC3D;AAKA,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,UAAI;AAEF,cAAM,aAAa,EAAE,aAAa,KAAK,aAAa,EAAE,iBAAiB,MAAM,CAAC;AAG9E,cAAM,aAAc,WAAW,cAAc,CAAC;AAC9C,mBAAW,gBAAgB;AAAA,UACzB,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AACA,mBAAW,aAAa;AAGxB,cAAM,YAAY,gBAAgB,UAAU;AAE5C,qBAAc,UAA+B,YAAY;AAAA,MAC3D,SAAS,OAAO;AACd,YAAI,OAAO,OAAO;AAChB,kBAAQ;AAAA,YACN,4BAA4B,KAAK,IAAI;AAAA,YACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UAC3C;AAAA,QACF;AACA;AAAA,MACF;AAAA,IACF,OAAO;AAEL,mBAAa,EAAE,OAAO;AAAA,QACpB,eAAe,EACZ,OAAO,EACP,SAAS,EACT,SAAS,2DAA2D;AAAA,MACzE,CAAC;AAAA,IACH;AAGA,QAAI;AACF,aAAO;AAAA,QACL,KAAK;AAAA,QACL;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,aAAa;AAAA,QACf;AAAA,QACA,OAAO,SAAkB;AACvB,gBAAM,WAAY,QAAQ,CAAC;AAG3B,gBAAM,eAAe,SAAS;AAC9B,iBAAO,SAAS;AAGhB,kBAAQ,MAAM,gCAA2B,KAAK,IAAI,IAAI;AAAA,YACpD,iBAAiB,CAAC,CAAC;AAAA,YACnB,MAAM,KAAK,UAAU,QAAQ,EAAE,MAAM,GAAG,GAAG;AAAA,UAC7C,CAAC;AAGD,cAAI,mBAAmB;AACvB,cAAI,cAAc;AAChB,kBAAM,iBAAiB,MAAM,sBAAsB,cAAc,aAAa,OAAO,KAAK;AAC1F,gBAAI,gBAAgB;AAElB,iCAAmB,EAAE,GAAG,gBAAgB,WAAW,aAAa;AAAA,YAClE,OAAO;AAEL,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF,OAAO;AAEL,kBAAM,gBAAgB,MAAM,qBAAqB,cAAc,aAAa,OAAO,KAAK;AACxF,gBAAI,eAAe;AACjB,iCAAmB;AAAA,YACrB,WAAW,CAAC,iBAAiB,UAAU,iBAAiB,aAAa,WAAW,GAAG;AACjF,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAIA,gBAAI,CAAC,iBAAiB,aAAa,iBAAiB,cAAc;AAChE,iCAAmB;AAAA,gBACjB,GAAG;AAAA,gBACH,WAAW,YAAY,iBAAiB,aAAa,MAAM,GAAG,EAAE;AAAA,cAClE;AAAA,YACF;AAAA,UACF;AAGA,cAAI,KAAK,kBAAkB,QAAQ;AACjC,kBAAM,cAAc,iBAAiB,UAAU,QAAqB,aAAa;AACjF,kBAAM,YAAY;AAAA,cAChB,KAAK;AAAA,cACL,iBAAiB;AAAA,cACjB,iBAAiB;AAAA,cACjB;AAAA,YACF;AACA,gBAAI,CAAC,WAAW;AACd,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO,sCAAsC,KAAK,IAAI,gBAAgB,KAAK,iBAAiB,KAAK,IAAI,CAAC;AAAA,sBACtG,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,SAAS,MAAM,YAAY,KAAK,MAAM,UAAU,gBAAgB;AAEtE,gBAAI,CAAC,OAAO,SAAS;AACnB,sBAAQ,MAAM,iCAA4B,KAAK,IAAI,IAAI,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AACtG,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AAAA,kBACtE;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAEA,oBAAQ,MAAM,mCAA8B,KAAK,IAAI,IAAI;AAAA,cACvD,eAAe,KAAK,UAAU,OAAO,MAAM,EAAE,MAAM,GAAG,GAAG;AAAA,YAC3D,CAAC;AACD,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAAA,gBAC7C;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAAS,KAAK;AACZ,oBAAQ,MAAM,qCAAgC,KAAK,IAAI,IAAI,GAAG;AAC9D,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,iBAAiB,MAAM,YAAY,CAAC;AAAA,gBACzG;AAAA,cACF;AAAA,cACA,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,OAAO,OAAO;AAChB,gBAAQ;AAAA,UACN,4BAA4B,KAAK,IAAI;AAAA,UACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAC3C;AAAA,MACF;AACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,MAAM,gBAAgB,IAAI,OAAO;AAKjC,eAAe,cAAc,KAAwC;AACnE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,YAAY;AAEhB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,mBAAa,MAAM;AACnB,UAAI,YAAY,eAAe;AAC7B,YAAI,QAAQ;AACZ,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAC7C;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AACnD,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,MAAS;AAAA,MAC7C,SAAS,OAAO;AACd,eAAO,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAQA,eAAsB,iBAAiB,SAA8C;AACnF,QAAM,EAAE,QAAQ,WAAW,KAAK,IAAI;AAEpC,QAAM,mBAAmB;AAGzB,MAAI;AACF,UAAM,EAAE,oBAAoB,iBAAiB,IAAI,MAAM,OAAO,gBAAgB;AAC9E,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AAEnE,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAC1C,qBAAiB,KAAK;AACtB,YAAQ,MAAM,4BAA4B,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,MAAM,gBAAgB;AAAA,EAC9G,SAAS,OAAO;AACd,YAAQ,MAAM,+CAA+C,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EAC7G;AAGA,MAAI;AACF,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAAsB;AACnE,UAAM,OAAO,MAAM,oBAAoB;AACvC,QAAI,MAAM;AACR,cAAQ,MAAM,8EAA8E;AAAA,IAC9F,OAAO;AACL,cAAQ,MAAM,uCAAuC;AAAA,IACvD;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4CAA4C,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EAC1G;AAGA,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,eAAe;AAGvD,UAAM,oBAAoB,aAAa;AAGvC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAsB;AACjE,UAAM,gBAAgB,MAAM,kBAAkB,aAAa;AAC3D,QAAI,gBAAgB,GAAG;AACrB,cAAQ,MAAM,sBAAsB,aAAa,kCAAkC;AAAA,IACrF;AAGA,QAAI;AACF,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,gBAAgB;AAC9D,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,gBAAgB;AAChE,YAAM,QAAQ,qBAAqB;AACnC,UAAI,OAAO;AACT,cAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,eAAe,KAAK;AACnE,YAAI,QAAQ,GAAG;AACb,kBAAQ,MAAM,sBAAsB,KAAK,mCAAmC;AAAA,QAC9E;AAAA,MACF;AAAA,IACF,SAAS,aAAa;AACpB,cAAQ,MAAM,8CAA8C,uBAAuB,QAAQ,YAAY,UAAU,WAAW;AAAA,IAC9H;AAAA,EACF,SAAS,OAAO;AAEd,YAAQ,MAAM,sEAAsE,KAAK;AAAA,EAC3F;AAEA,QAAM,aAAa,aAAa,OAAO,KAAsB,QAAwB;AACnF,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,IAAI,EAAE;AAG9D,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO,gBAAgB,EAAE,cAAc,EAAE;AAAA,QACzC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,QAAI,IAAI,aAAa,QAAQ;AAC3B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;AAC9C;AAAA,IACF;AAEA,YAAQ,MAAM,8BAAyB,IAAI,MAAM,IAAI,IAAI,QAAQ,EAAE;AAGnE,UAAM,UAA8C,CAAC;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,cAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IACnD;AAGA,UAAM,iBAAiB,yBAAyB,OAAO;AACvD,QAAI,CAAC,gBAAgB;AACnB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,IACF;AAGA,UAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,UAAM,eAAe,MAAM,mBAAmB,IAAI,cAAc;AAChE,QAAI,CAAC,cAAc;AACjB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,6BAA6B,CAAC,CAAC;AAC/D;AAAA,IACF;AAEA,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,wCAAwC,IAAI,MAAM,gBAAgB,aAAa,SAAS,KAAK;AAAA,IAC7G;AAIA,UAAM,cAA8B;AAAA,MAClC,UAAU,aAAa,YAAY;AAAA,MACnC,gBAAgB,aAAa,kBAAkB;AAAA,MAC/C,QAAQ,aAAa,aAAa;AAAA,MAClC;AAAA,MACA,cAAc,CAAC;AAAA,MACf,cAAc;AAAA,MACd,cAAc;AAAA,IAChB;AAEA,QAAI;AAEF,YAAM,YAAY,IAAI,8BAA8B;AAAA,QAClD,oBAAoB;AAAA,QACpB,oBAAoB,IAAI,WAAW;AAAA,MACrC,CAAC;AAGD,YAAM,YAAY,0BAA0B,QAAQ,aAAa,YAAY;AAE7E,UAAI,OAAO,OAAO;AAEhB,cAAM,kBAAmB,UAAkB,oBAAoB,CAAC;AAChE,gBAAQ,MAAM,6CAA6C,OAAO,KAAK,eAAe,CAAC;AACvF,gBAAQ,MAAM,yCAA0C,UAAkB,wBAAwB;AAAA,MACpG;AAGA,YAAM,UAAU,QAAQ,SAAS;AAGjC,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,OAAO,MAAM,cAAc,GAAG;AACpC,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,MAC9C,OAAO;AACL,cAAM,UAAU,cAAc,KAAK,GAAG;AAAA,MACxC;AAGA,UAAI,GAAG,UAAU,MAAM;AACrB,kBAAU,MAAM;AAChB,kBAAU,MAAM;AAChB,YAAI,OAAO,OAAO;AAChB,kBAAQ,MAAM,0CAA0C;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,sCAAsC,KAAK;AACzD,UAAI,CAAC,IAAI,aAAa;AAEpB,YAAI,iBAAiB,SAAS,MAAM,YAAY,6BAA6B;AAC3E,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,QACF;AAEA,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU;AAAA,YACb,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,YAC3F;AAAA,YACA,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,gBAAgB,EAAE,cAAc,EAAE;AAEpD,UAAQ,MAAM,uBAAuB,OAAO,IAAI,KAAK,OAAO,OAAO,EAAE;AACrE,UAAQ,MAAM,yCAAyC,IAAI,MAAM;AACjE,UAAQ,MAAM,uCAAuC,IAAI,SAAS;AAClE,UAAQ,MAAM,gCAAgC,SAAS,EAAE;AACzD,UAAQ,MAAM,qDAAqD;AACnE,UAAQ,MAAM,+EAA+E;AAC7F,UAAQ,MAAM,4FAA4F;AAG1G,SAAO,IAAI,QAAc,CAAC,YAAY;AACpC,eAAW,OAAO,MAAM,MAAM;AAC5B,cAAQ,MAAM,uCAAuC,IAAI,EAAE;AAAA,IAC7D,CAAC;AAED,UAAM,WAAW,YAAY;AAC3B,cAAQ,MAAM,6BAA6B;AAC3C,iBAAW,MAAM,MAAM;AACrB,gBAAQ,MAAM,0BAA0B;AACxC,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACH;",
   "names": []
 }

package/dist/modules/ai_assistant/lib/mcp-dev-server.js

@@ -196,6 +196,17 @@ async function runMcpDevServer() {
   } catch (error) {
     log("Entity graph generation skipped:", error instanceof Error ? error.message : error);
   }
+  try {
+    const { loadRichOpenApiSpec } = await import("./api-endpoint-index.js");
+    const spec = await loadRichOpenApiSpec();
+    if (spec) {
+      log("Rich OpenAPI spec cached for Code Mode (with requestBody schemas)");
+    } else {
+      log("OpenAPI spec not available");
+    }
+  } catch (error) {
+    log("OpenAPI spec caching skipped:", error instanceof Error ? error.message : error);
+  }
   try {
     const searchService = container.resolve("searchService");
     await indexToolsForSearch(searchService);
@@ -220,6 +231,9 @@ async function runMcpDevServer() {
   } catch {
     log("Search indexing skipped (search service not available)");
   }
+  const { randomBytes } = await import("node:crypto");
+  const devSessionId = "dev_" + randomBytes(8).toString("hex");
+  log(`Session ID: ${devSessionId} (stable for this server instance)`);
   const toolContext = {
     tenantId: authResult.tenantId,
     organizationId: authResult.organizationId,
@@ -227,7 +241,8 @@ async function runMcpDevServer() {
     container,
     userFeatures: authResult.features,
     isSuperAdmin: authResult.isSuperAdmin,
-    apiKeySecret: apiKey
+    apiKeySecret: apiKey,
+    sessionId: devSessionId
   };
   const httpServer = createServer(async (req, res) => {
     const url = new URL(req.url || "/", `http://localhost:${port}`);

package/dist/modules/ai_assistant/lib/mcp-dev-server.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/ai_assistant/lib/mcp-dev-server.ts"],
-  "sourcesContent": ["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport { z, type ZodType } from 'zod'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools, indexToolsForSearch } from './tool-loader'\nimport { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'\nimport { jsonSchemaToZod } from './schema-utils'\nimport type { McpToolContext } from './types'\nimport type { SearchService } from '@open-mercato/search/service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\nconst DEFAULT_PORT = 3001\n\nconst log = (message: string, ...args: unknown[]) => {\n  console.error(`[MCP Dev] ${message}`, ...args)\n}\n\nasync function getApiKeyFromMcpJson(): Promise<string | undefined> {\n  const { readFile, access } = await import('node:fs/promises')\n  const { resolve, dirname } = await import('node:path')\n\n  // Search for .mcp.json starting from cwd and walking up to project root\n  const findMcpJson = async (startDir: string): Promise<string | null> => {\n    let dir = startDir\n    const root = resolve('/')\n    while (dir !== root) {\n      const candidate = resolve(dir, '.mcp.json')\n      try {\n        await access(candidate)\n        return candidate\n      } catch {\n        dir = dirname(dir)\n      }\n    }\n    return null\n  }\n\n  try {\n    const mcpJsonPath = await findMcpJson(process.cwd())\n    if (!mcpJsonPath) {\n      return undefined\n    }\n\n    const content = await readFile(mcpJsonPath, 'utf-8')\n    const config = JSON.parse(content)\n    const serverConfig = config?.mcpServers?.['open-mercato']\n\n    return serverConfig?.headers?.['x-api-key']\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Maximum request body size (1MB).\n */\nconst MAX_BODY_SIZE = 1 * 1024 * 1024\n\n/**\n * Parse JSON body from request with size limit.\n */\nasync function parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let totalSize = 0\n\n    req.on('data', (chunk: Buffer) => {\n      totalSize += chunk.length\n      if (totalSize > MAX_BODY_SIZE) {\n        req.destroy()\n        reject(new Error('Request payload too large'))\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        const body = Buffer.concat(chunks).toString('utf-8')\n        resolve(body ? JSON.parse(body) : undefined)\n      } catch (error) {\n        reject(error)\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n/**\n * Create MCP server with tools pre-authenticated for dev use.\n * No session tokens required - uses API key authentication directly.\n */\nfunction createDevMcpServer(\n  toolContext: McpToolContext,\n  authFeatures: string[],\n  isSuperAdmin: boolean,\n  debug: boolean\n): McpServer {\n  const server = new McpServer(\n    { name: 'open-mercato-mcp-dev', version: '0.1.0' },\n    { capabilities: { tools: {} } }\n  )\n\n  const registry = getToolRegistry()\n  const tools = Array.from(registry.getTools().values())\n\n  // Filter tools based on API key permissions\n  const rbacService = toolContext.container.resolve<RbacService>('rbacService')\n  const accessibleTools = tools.filter((tool) =>\n    hasRequiredFeatures(tool.requiredFeatures, authFeatures, isSuperAdmin, rbacService)\n  )\n\n  if (debug) {\n    log(`Registering ${accessibleTools.length}/${tools.length} tools (filtered by API key permissions)`)\n  }\n\n  for (const tool of accessibleTools) {\n    if (debug) {\n      log(`Registering tool: ${tool.name}`)\n    }\n\n    // Convert Zod schema to safe schema without Date types\n    let safeSchema: ZodType | undefined\n    if (tool.inputSchema) {\n      try {\n        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: 'any' }) as Record<string, unknown>\n        const converted = jsonSchemaToZod(jsonSchema)\n        safeSchema = (converted as z.ZodObject<any>).passthrough()\n      } catch (error) {\n        if (debug) {\n          log(`Skipping tool ${tool.name} - schema conversion failed:`, error instanceof Error ? error.message : error)\n        }\n        continue\n      }\n    } else {\n      safeSchema = z.object({}).passthrough()\n    }\n\n    try {\n      server.registerTool(\n        tool.name,\n        {\n          description: tool.description,\n          inputSchema: safeSchema,\n        },\n        async (args: unknown) => {\n          const toolArgs = (args ?? {}) as Record<string, unknown>\n\n          if (debug) {\n            log(`Calling tool: ${tool.name}`, JSON.stringify(toolArgs))\n          }\n\n          const result = await executeTool(tool.name, toolArgs, toolContext)\n\n          if (!result.success) {\n            log(`Tool error: ${result.error}`)\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ error: result.error, code: result.errorCode }),\n                },\n              ],\n              isError: true,\n            }\n          }\n\n          return {\n            content: [\n              {\n                type: 'text' as const,\n                text: JSON.stringify(result.result, null, 2),\n              },\n            ],\n          }\n        }\n      )\n    } catch (error) {\n      if (debug) {\n        log(`Skipping tool ${tool.name} - registration failed:`, error instanceof Error ? error.message : error)\n      }\n      continue\n    }\n  }\n\n  return server\n}\n\n/**\n * Development MCP server for Claude Code integration.\n *\n * This server uses HTTP transport and authenticates via the\n * x-api-key header configured in .mcp.json file.\n *\n * Usage:\n *   yarn mcp:dev\n *\n * Configure in .mcp.json for Claude Code with HTTP transport.\n */\nexport async function runMcpDevServer(): Promise<void> {\n  const apiKey = await getApiKeyFromMcpJson()\n  const port = parseInt(process.env.MCP_DEV_PORT ?? '', 10) || DEFAULT_PORT\n  const debug = process.env.MCP_DEBUG === 'true'\n\n  if (!apiKey) {\n    log('Error: API key not found in .mcp.json')\n    log('')\n    log('To get an API key:')\n    log('  1. Log into Open Mercato as an admin')\n    log('  2. Go to Settings > API Keys')\n    log('  3. Create a new key with the required permissions')\n    log('')\n    log('Then configure in .mcp.json:')\n    log('  {')\n    log('    \"mcpServers\": {')\n    log('      \"open-mercato\": {')\n    log('        \"type\": \"http\",')\n    log('        \"url\": \"http://localhost:3001/mcp\",')\n    log('        \"headers\": {')\n    log('          \"x-api-key\": \"omk_your_api_key_here\"')\n    log('        }')\n    log('      }')\n    log('    }')\n    log('  }')\n    process.exit(1)\n  }\n\n  log('Starting development MCP HTTP server...')\n\n  // Create DI container\n  const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n  const container = await createRequestContainer()\n\n  // Authenticate the API key upfront\n  log('Authenticating API key...')\n  const authResult = await authenticateMcpRequest(apiKey, container)\n\n  if (!authResult.success) {\n    log(`Authentication failed: ${authResult.error}`)\n    process.exit(1)\n  }\n\n  log(`Authenticated as: ${authResult.keyName}`)\n  log(`Tenant: ${authResult.tenantId ?? '(global)'}`)\n  log(`Organization: ${authResult.organizationId ?? '(none)'}`)\n  log(`Super admin: ${authResult.isSuperAdmin}`)\n  log(`Features: ${authResult.features.length > 0 ? authResult.features.join(', ') : '(none)'}`)\n\n  // Load tools\n  log('Loading tools...')\n  await loadAllModuleTools()\n\n  // Generate and cache entity graph\n  try {\n    const { extractEntityGraph, cacheEntityGraph } = await import('./entity-graph')\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n\n    log('Generating entity relationship graph...')\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n    cacheEntityGraph(graph)\n    log(`Entity graph: ${graph.nodes.length} entities, ${graph.edges.length} relationships`)\n  } catch (error) {\n    log('Entity graph generation skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Index tools, API endpoints, and entity schemas for search (if search service available)\n  try {\n    const searchService = container.resolve('searchService') as SearchService\n    await indexToolsForSearch(searchService)\n\n    const { indexApiEndpoints } = await import('./api-endpoint-index')\n    const endpointCount = await indexApiEndpoints(searchService)\n    if (endpointCount > 0) {\n      log(`Indexed ${endpointCount} API endpoints for discovery`)\n    }\n\n    // Index entity schemas for discover_schema tool\n    try {\n      const { getCachedEntityGraph } = await import('./entity-graph')\n      const { indexEntitiesForSearch } = await import('./entity-index')\n      const graph = getCachedEntityGraph()\n      if (graph) {\n        const { count } = await indexEntitiesForSearch(searchService, graph)\n        if (count > 0) {\n          log(`Indexed ${count} entity schemas for discovery`)\n        }\n      }\n    } catch (entityError) {\n      log('Entity schema indexing skipped:', entityError instanceof Error ? entityError.message : entityError)\n    }\n  } catch {\n    log('Search indexing skipped (search service not available)')\n  }\n\n  // Create tool context from auth result\n  const toolContext: McpToolContext = {\n    tenantId: authResult.tenantId,\n    organizationId: authResult.organizationId,\n    userId: authResult.userId,\n    container,\n    userFeatures: authResult.features,\n    isSuperAdmin: authResult.isSuperAdmin,\n    apiKeySecret: apiKey,\n  }\n\n  const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url || '/', `http://localhost:${port}`)\n\n    // Health check endpoint\n    if (url.pathname === '/health') {\n      res.writeHead(200, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({\n        status: 'ok',\n        mode: 'development',\n        tools: getToolRegistry().listToolNames().length,\n        tenant: authResult.tenantId,\n        timestamp: new Date().toISOString(),\n      }))\n      return\n    }\n\n    if (url.pathname !== '/mcp') {\n      res.writeHead(404, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Not found' }))\n      return\n    }\n\n    // Extract and validate API key from header\n    const headers: Record<string, string | undefined> = {}\n    for (const [key, value] of Object.entries(req.headers)) {\n      headers[key] = Array.isArray(value) ? value[0] : value\n    }\n\n    const providedApiKey = extractApiKeyFromHeaders(headers)\n    if (!providedApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'API key required (x-api-key header)' }))\n      return\n    }\n\n    // Validate against the configured API key\n    if (providedApiKey !== apiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Invalid API key' }))\n      return\n    }\n\n    if (debug) {\n      log(`Authenticated request (${req.method})`)\n    }\n\n    try {\n      // Create stateless transport\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        enableJsonResponse: req.method === 'POST',\n      })\n\n      // Create server with pre-authenticated context (no session tokens needed)\n      const mcpServer = createDevMcpServer(toolContext, authResult.features, authResult.isSuperAdmin, debug)\n\n      // Connect server to transport\n      await mcpServer.connect(transport)\n\n      // Handle the request\n      if (req.method === 'POST') {\n        const body = await parseJsonBody(req)\n        await transport.handleRequest(req, res, body)\n      } else {\n        await transport.handleRequest(req, res)\n      }\n\n      // Cleanup after response finishes\n      res.on('finish', () => {\n        transport.close()\n        mcpServer.close()\n        if (debug) {\n          log(`Request completed, cleaned up`)\n        }\n      })\n    } catch (error) {\n      log('Error handling request:', error)\n      if (!res.headersSent) {\n        if (error instanceof Error && error.message === 'Request payload too large') {\n          res.writeHead(413, { 'Content-Type': 'application/json' })\n          res.end(JSON.stringify({ error: 'Request payload too large (max 1MB)' }))\n          return\n        }\n\n        res.writeHead(500, { 'Content-Type': 'application/json' })\n        res.end(\n          JSON.stringify({\n            jsonrpc: '2.0',\n            error: {\n              code: -32603,\n              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,\n            },\n            id: null,\n          })\n        )\n      }\n    }\n  })\n\n  const toolCount = getToolRegistry().listToolNames().length\n\n  log(`Tools registered: ${toolCount}`)\n  log(`Endpoint: http://localhost:${port}/mcp`)\n  log(`Health: http://localhost:${port}/health`)\n  log(`Mode: Development (API key auth, no session tokens)`)\n\n  return new Promise<void>((resolve) => {\n    httpServer.listen(port, () => {\n      log(`Server listening on port ${port}`)\n      log('Ready for Claude Code connections')\n    })\n\n    const shutdown = async () => {\n      log('Shutting down...')\n      httpServer.close(() => {\n        log('Server closed')\n        resolve()\n      })\n    }\n\n    process.on('SIGINT', shutdown)\n    process.on('SIGTERM', shutdown)\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAA+D;AACxE,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAC9C,SAAS,SAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB,2BAA2B;AACxD,SAAS,wBAAwB,0BAA0B,2BAA2B;AACtF,SAAS,uBAAuB;AAKhC,MAAM,eAAe;AAErB,MAAM,MAAM,CAAC,YAAoB,SAAoB;AACnD,UAAQ,MAAM,aAAa,OAAO,IAAI,GAAG,IAAI;AAC/C;AAEA,eAAe,uBAAoD;AACjE,QAAM,EAAE,UAAU,OAAO,IAAI,MAAM,OAAO,kBAAkB;AAC5D,QAAM,EAAE,SAAS,QAAQ,IAAI,MAAM,OAAO,WAAW;AAGrD,QAAM,cAAc,OAAO,aAA6C;AACtE,QAAI,MAAM;AACV,UAAM,OAAO,QAAQ,GAAG;AACxB,WAAO,QAAQ,MAAM;AACnB,YAAM,YAAY,QAAQ,KAAK,WAAW;AAC1C,UAAI;AACF,cAAM,OAAO,SAAS;AACtB,eAAO;AAAA,MACT,QAAQ;AACN,cAAM,QAAQ,GAAG;AAAA,MACnB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,MAAM,YAAY,QAAQ,IAAI,CAAC;AACnD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,SAAS,aAAa,OAAO;AACnD,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAM,eAAe,QAAQ,aAAa,cAAc;AAExD,WAAO,cAAc,UAAU,WAAW;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,MAAM,gBAAgB,IAAI,OAAO;AAKjC,eAAe,cAAc,KAAwC;AACnE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,YAAY;AAEhB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,mBAAa,MAAM;AACnB,UAAI,YAAY,eAAe;AAC7B,YAAI,QAAQ;AACZ,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAC7C;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AACnD,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,MAAS;AAAA,MAC7C,SAAS,OAAO;AACd,eAAO,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAMA,SAAS,mBACP,aACA,cACA,cACA,OACW;AACX,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AAAA,IACjD,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,QAAM,WAAW,gBAAgB;AACjC,QAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAGrD,QAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAC5E,QAAM,kBAAkB,MAAM;AAAA,IAAO,CAAC,SACpC,oBAAoB,KAAK,kBAAkB,cAAc,cAAc,WAAW;AAAA,EACpF;AAEA,MAAI,OAAO;AACT,QAAI,eAAe,gBAAgB,MAAM,IAAI,MAAM,MAAM,0CAA0C;AAAA,EACrG;AAEA,aAAW,QAAQ,iBAAiB;AAClC,QAAI,OAAO;AACT,UAAI,qBAAqB,KAAK,IAAI,EAAE;AAAA,IACtC;AAGA,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,UAAI;AACF,cAAM,aAAa,EAAE,aAAa,KAAK,aAAa,EAAE,iBAAiB,MAAM,CAAC;AAC9E,cAAM,YAAY,gBAAgB,UAAU;AAC5C,qBAAc,UAA+B,YAAY;AAAA,MAC3D,SAAS,OAAO;AACd,YAAI,OAAO;AACT,cAAI,iBAAiB,KAAK,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,QAC9G;AACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,mBAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACxC;AAEA,QAAI;AACF,aAAO;AAAA,QACL,KAAK;AAAA,QACL;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,aAAa;AAAA,QACf;AAAA,QACA,OAAO,SAAkB;AACvB,gBAAM,WAAY,QAAQ,CAAC;AAE3B,cAAI,OAAO;AACT,gBAAI,iBAAiB,KAAK,IAAI,IAAI,KAAK,UAAU,QAAQ,CAAC;AAAA,UAC5D;AAEA,gBAAM,SAAS,MAAM,YAAY,KAAK,MAAM,UAAU,WAAW;AAEjE,cAAI,CAAC,OAAO,SAAS;AACnB,gBAAI,eAAe,OAAO,KAAK,EAAE;AACjC,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AAAA,gBACtE;AAAA,cACF;AAAA,cACA,SAAS;AAAA,YACX;AAAA,UACF;AAEA,iBAAO;AAAA,YACL,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,MAAM,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAAA,cAC7C;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,OAAO;AACT,YAAI,iBAAiB,KAAK,IAAI,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,MACzG;AACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,kBAAiC;AACrD,QAAM,SAAS,MAAM,qBAAqB;AAC1C,QAAM,OAAO,SAAS,QAAQ,IAAI,gBAAgB,IAAI,EAAE,KAAK;AAC7D,QAAM,QAAQ,QAAQ,IAAI,cAAc;AAExC,MAAI,CAAC,QAAQ;AACX,QAAI,uCAAuC;AAC3C,QAAI,EAAE;AACN,QAAI,oBAAoB;AACxB,QAAI,wCAAwC;AAC5C,QAAI,gCAAgC;AACpC,QAAI,qDAAqD;AACzD,QAAI,EAAE;AACN,QAAI,8BAA8B;AAClC,QAAI,KAAK;AACT,QAAI,qBAAqB;AACzB,QAAI,yBAAyB;AAC7B,QAAI,yBAAyB;AAC7B,QAAI,6CAA6C;AACjD,QAAI,sBAAsB;AAC1B,QAAI,gDAAgD;AACpD,QAAI,WAAW;AACf,QAAI,SAAS;AACb,QAAI,OAAO;AACX,QAAI,KAAK;AACT,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,yCAAyC;AAG7C,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,QAAM,YAAY,MAAM,uBAAuB;AAG/C,MAAI,2BAA2B;AAC/B,QAAM,aAAa,MAAM,uBAAuB,QAAQ,SAAS;AAEjE,MAAI,CAAC,WAAW,SAAS;AACvB,QAAI,0BAA0B,WAAW,KAAK,EAAE;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,qBAAqB,WAAW,OAAO,EAAE;AAC7C,MAAI,WAAW,WAAW,YAAY,UAAU,EAAE;AAClD,MAAI,iBAAiB,WAAW,kBAAkB,QAAQ,EAAE;AAC5D,MAAI,gBAAgB,WAAW,YAAY,EAAE;AAC7C,MAAI,aAAa,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,KAAK,IAAI,IAAI,QAAQ,EAAE;AAG7F,MAAI,kBAAkB;AACtB,QAAM,mBAAmB;AAGzB,MAAI;AACF,UAAM,EAAE,oBAAoB,iBAAiB,IAAI,MAAM,OAAO,gBAAgB;AAC9E,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AAEnE,QAAI,yCAAyC;AAC7C,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAC1C,qBAAiB,KAAK;AACtB,QAAI,iBAAiB,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,MAAM,gBAAgB;AAAA,EACzF,SAAS,OAAO;AACd,QAAI,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EACxF;AAGA,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,eAAe;AACvD,UAAM,oBAAoB,aAAa;AAEvC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAsB;AACjE,UAAM,gBAAgB,MAAM,kBAAkB,aAAa;AAC3D,QAAI,gBAAgB,GAAG;AACrB,UAAI,WAAW,aAAa,8BAA8B;AAAA,IAC5D;AAGA,QAAI;AACF,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,gBAAgB;AAC9D,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,gBAAgB;AAChE,YAAM,QAAQ,qBAAqB;AACnC,UAAI,OAAO;AACT,cAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,eAAe,KAAK;AACnE,YAAI,QAAQ,GAAG;AACb,cAAI,WAAW,KAAK,+BAA+B;AAAA,QACrD;AAAA,MACF;AAAA,IACF,SAAS,aAAa;AACpB,UAAI,mCAAmC,uBAAuB,QAAQ,YAAY,UAAU,WAAW;AAAA,IACzG;AAAA,EACF,QAAQ;AACN,QAAI,wDAAwD;AAAA,EAC9D;AAGA,QAAM,cAA8B;AAAA,IAClC,UAAU,WAAW;AAAA,IACrB,gBAAgB,WAAW;AAAA,IAC3B,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA,cAAc,WAAW;AAAA,IACzB,cAAc,WAAW;AAAA,IACzB,cAAc;AAAA,EAChB;AAEA,QAAM,aAAa,aAAa,OAAO,KAAsB,QAAwB;AACnF,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,IAAI,EAAE;AAG9D,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO,gBAAgB,EAAE,cAAc,EAAE;AAAA,QACzC,QAAQ,WAAW;AAAA,QACnB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,QAAI,IAAI,aAAa,QAAQ;AAC3B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;AAC9C;AAAA,IACF;AAGA,UAAM,UAA8C,CAAC;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,cAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IACnD;AAEA,UAAM,iBAAiB,yBAAyB,OAAO;AACvD,QAAI,CAAC,gBAAgB;AACnB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,IACF;AAGA,QAAI,mBAAmB,QAAQ;AAC7B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AACpD;AAAA,IACF;AAEA,QAAI,OAAO;AACT,UAAI,0BAA0B,IAAI,MAAM,GAAG;AAAA,IAC7C;AAEA,QAAI;AAEF,YAAM,YAAY,IAAI,8BAA8B;AAAA,QAClD,oBAAoB;AAAA,QACpB,oBAAoB,IAAI,WAAW;AAAA,MACrC,CAAC;AAGD,YAAM,YAAY,mBAAmB,aAAa,WAAW,UAAU,WAAW,cAAc,KAAK;AAGrG,YAAM,UAAU,QAAQ,SAAS;AAGjC,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,OAAO,MAAM,cAAc,GAAG;AACpC,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,MAC9C,OAAO;AACL,cAAM,UAAU,cAAc,KAAK,GAAG;AAAA,MACxC;AAGA,UAAI,GAAG,UAAU,MAAM;AACrB,kBAAU,MAAM;AAChB,kBAAU,MAAM;AAChB,YAAI,OAAO;AACT,cAAI,+BAA+B;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK;AACpC,UAAI,CAAC,IAAI,aAAa;AACpB,YAAI,iBAAiB,SAAS,MAAM,YAAY,6BAA6B;AAC3E,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,QACF;AAEA,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU;AAAA,YACb,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,YAC3F;AAAA,YACA,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,gBAAgB,EAAE,cAAc,EAAE;AAEpD,MAAI,qBAAqB,SAAS,EAAE;AACpC,MAAI,8BAA8B,IAAI,MAAM;AAC5C,MAAI,4BAA4B,IAAI,SAAS;AAC7C,MAAI,qDAAqD;AAEzD,SAAO,IAAI,QAAc,CAAC,YAAY;AACpC,eAAW,OAAO,MAAM,MAAM;AAC5B,UAAI,4BAA4B,IAAI,EAAE;AACtC,UAAI,mCAAmC;AAAA,IACzC,CAAC;AAED,UAAM,WAAW,YAAY;AAC3B,UAAI,kBAAkB;AACtB,iBAAW,MAAM,MAAM;AACrB,YAAI,eAAe;AACnB,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACH;",
+  "sourcesContent": ["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport { z, type ZodType } from 'zod'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools, indexToolsForSearch } from './tool-loader'\nimport { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'\nimport { jsonSchemaToZod } from './schema-utils'\nimport type { McpToolContext } from './types'\nimport type { SearchService } from '@open-mercato/search/service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\nconst DEFAULT_PORT = 3001\n\nconst log = (message: string, ...args: unknown[]) => {\n  console.error(`[MCP Dev] ${message}`, ...args)\n}\n\nasync function getApiKeyFromMcpJson(): Promise<string | undefined> {\n  const { readFile, access } = await import('node:fs/promises')\n  const { resolve, dirname } = await import('node:path')\n\n  // Search for .mcp.json starting from cwd and walking up to project root\n  const findMcpJson = async (startDir: string): Promise<string | null> => {\n    let dir = startDir\n    const root = resolve('/')\n    while (dir !== root) {\n      const candidate = resolve(dir, '.mcp.json')\n      try {\n        await access(candidate)\n        return candidate\n      } catch {\n        dir = dirname(dir)\n      }\n    }\n    return null\n  }\n\n  try {\n    const mcpJsonPath = await findMcpJson(process.cwd())\n    if (!mcpJsonPath) {\n      return undefined\n    }\n\n    const content = await readFile(mcpJsonPath, 'utf-8')\n    const config = JSON.parse(content)\n    const serverConfig = config?.mcpServers?.['open-mercato']\n\n    return serverConfig?.headers?.['x-api-key']\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Maximum request body size (1MB).\n */\nconst MAX_BODY_SIZE = 1 * 1024 * 1024\n\n/**\n * Parse JSON body from request with size limit.\n */\nasync function parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let totalSize = 0\n\n    req.on('data', (chunk: Buffer) => {\n      totalSize += chunk.length\n      if (totalSize > MAX_BODY_SIZE) {\n        req.destroy()\n        reject(new Error('Request payload too large'))\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        const body = Buffer.concat(chunks).toString('utf-8')\n        resolve(body ? JSON.parse(body) : undefined)\n      } catch (error) {\n        reject(error)\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n/**\n * Create MCP server with tools pre-authenticated for dev use.\n * No session tokens required - uses API key authentication directly.\n */\nfunction createDevMcpServer(\n  toolContext: McpToolContext,\n  authFeatures: string[],\n  isSuperAdmin: boolean,\n  debug: boolean\n): McpServer {\n  const server = new McpServer(\n    { name: 'open-mercato-mcp-dev', version: '0.1.0' },\n    { capabilities: { tools: {} } }\n  )\n\n  const registry = getToolRegistry()\n  const tools = Array.from(registry.getTools().values())\n\n  // Filter tools based on API key permissions\n  const rbacService = toolContext.container.resolve<RbacService>('rbacService')\n  const accessibleTools = tools.filter((tool) =>\n    hasRequiredFeatures(tool.requiredFeatures, authFeatures, isSuperAdmin, rbacService)\n  )\n\n  if (debug) {\n    log(`Registering ${accessibleTools.length}/${tools.length} tools (filtered by API key permissions)`)\n  }\n\n  for (const tool of accessibleTools) {\n    if (debug) {\n      log(`Registering tool: ${tool.name}`)\n    }\n\n    // Convert Zod schema to safe schema without Date types\n    let safeSchema: ZodType | undefined\n    if (tool.inputSchema) {\n      try {\n        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: 'any' }) as Record<string, unknown>\n        const converted = jsonSchemaToZod(jsonSchema)\n        safeSchema = (converted as z.ZodObject<any>).passthrough()\n      } catch (error) {\n        if (debug) {\n          log(`Skipping tool ${tool.name} - schema conversion failed:`, error instanceof Error ? error.message : error)\n        }\n        continue\n      }\n    } else {\n      safeSchema = z.object({}).passthrough()\n    }\n\n    try {\n      server.registerTool(\n        tool.name,\n        {\n          description: tool.description,\n          inputSchema: safeSchema,\n        },\n        async (args: unknown) => {\n          const toolArgs = (args ?? {}) as Record<string, unknown>\n\n          if (debug) {\n            log(`Calling tool: ${tool.name}`, JSON.stringify(toolArgs))\n          }\n\n          const result = await executeTool(tool.name, toolArgs, toolContext)\n\n          if (!result.success) {\n            log(`Tool error: ${result.error}`)\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ error: result.error, code: result.errorCode }),\n                },\n              ],\n              isError: true,\n            }\n          }\n\n          return {\n            content: [\n              {\n                type: 'text' as const,\n                text: JSON.stringify(result.result, null, 2),\n              },\n            ],\n          }\n        }\n      )\n    } catch (error) {\n      if (debug) {\n        log(`Skipping tool ${tool.name} - registration failed:`, error instanceof Error ? error.message : error)\n      }\n      continue\n    }\n  }\n\n  return server\n}\n\n/**\n * Development MCP server for Claude Code integration.\n *\n * This server uses HTTP transport and authenticates via the\n * x-api-key header configured in .mcp.json file.\n *\n * Usage:\n *   yarn mcp:dev\n *\n * Configure in .mcp.json for Claude Code with HTTP transport.\n */\nexport async function runMcpDevServer(): Promise<void> {\n  const apiKey = await getApiKeyFromMcpJson()\n  const port = parseInt(process.env.MCP_DEV_PORT ?? '', 10) || DEFAULT_PORT\n  const debug = process.env.MCP_DEBUG === 'true'\n\n  if (!apiKey) {\n    log('Error: API key not found in .mcp.json')\n    log('')\n    log('To get an API key:')\n    log('  1. Log into Open Mercato as an admin')\n    log('  2. Go to Settings > API Keys')\n    log('  3. Create a new key with the required permissions')\n    log('')\n    log('Then configure in .mcp.json:')\n    log('  {')\n    log('    \"mcpServers\": {')\n    log('      \"open-mercato\": {')\n    log('        \"type\": \"http\",')\n    log('        \"url\": \"http://localhost:3001/mcp\",')\n    log('        \"headers\": {')\n    log('          \"x-api-key\": \"omk_your_api_key_here\"')\n    log('        }')\n    log('      }')\n    log('    }')\n    log('  }')\n    process.exit(1)\n  }\n\n  log('Starting development MCP HTTP server...')\n\n  // Create DI container\n  const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n  const container = await createRequestContainer()\n\n  // Authenticate the API key upfront\n  log('Authenticating API key...')\n  const authResult = await authenticateMcpRequest(apiKey, container)\n\n  if (!authResult.success) {\n    log(`Authentication failed: ${authResult.error}`)\n    process.exit(1)\n  }\n\n  log(`Authenticated as: ${authResult.keyName}`)\n  log(`Tenant: ${authResult.tenantId ?? '(global)'}`)\n  log(`Organization: ${authResult.organizationId ?? '(none)'}`)\n  log(`Super admin: ${authResult.isSuperAdmin}`)\n  log(`Features: ${authResult.features.length > 0 ? authResult.features.join(', ') : '(none)'}`)\n\n  // Load tools\n  log('Loading tools...')\n  await loadAllModuleTools()\n\n  // Generate and cache entity graph\n  try {\n    const { extractEntityGraph, cacheEntityGraph } = await import('./entity-graph')\n    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')\n\n    log('Generating entity relationship graph...')\n    const orm = await getOrm()\n    const graph = await extractEntityGraph(orm)\n    cacheEntityGraph(graph)\n    log(`Entity graph: ${graph.nodes.length} entities, ${graph.edges.length} relationships`)\n  } catch (error) {\n    log('Entity graph generation skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Pre-cache rich OpenAPI spec for Code Mode search tool (prefers runtime module registry over static JSON)\n  try {\n    const { loadRichOpenApiSpec } = await import('./api-endpoint-index')\n    const spec = await loadRichOpenApiSpec()\n    if (spec) {\n      log('Rich OpenAPI spec cached for Code Mode (with requestBody schemas)')\n    } else {\n      log('OpenAPI spec not available')\n    }\n  } catch (error) {\n    log('OpenAPI spec caching skipped:', error instanceof Error ? error.message : error)\n  }\n\n  // Index tools, API endpoints, and entity schemas for search (if search service available)\n  try {\n    const searchService = container.resolve('searchService') as SearchService\n    await indexToolsForSearch(searchService)\n\n    const { indexApiEndpoints } = await import('./api-endpoint-index')\n    const endpointCount = await indexApiEndpoints(searchService)\n    if (endpointCount > 0) {\n      log(`Indexed ${endpointCount} API endpoints for discovery`)\n    }\n\n    // Index entity schemas for discover_schema tool\n    try {\n      const { getCachedEntityGraph } = await import('./entity-graph')\n      const { indexEntitiesForSearch } = await import('./entity-index')\n      const graph = getCachedEntityGraph()\n      if (graph) {\n        const { count } = await indexEntitiesForSearch(searchService, graph)\n        if (count > 0) {\n          log(`Indexed ${count} entity schemas for discovery`)\n        }\n      }\n    } catch (entityError) {\n      log('Entity schema indexing skipped:', entityError instanceof Error ? entityError.message : entityError)\n    }\n  } catch {\n    log('Search indexing skipped (search service not available)')\n  }\n\n  // Generate a stable session ID for dev mode (enables session memory / caching)\n  const { randomBytes } = await import('node:crypto')\n  const devSessionId = 'dev_' + randomBytes(8).toString('hex')\n  log(`Session ID: ${devSessionId} (stable for this server instance)`)\n\n  // Create tool context from auth result\n  const toolContext: McpToolContext = {\n    tenantId: authResult.tenantId,\n    organizationId: authResult.organizationId,\n    userId: authResult.userId,\n    container,\n    userFeatures: authResult.features,\n    isSuperAdmin: authResult.isSuperAdmin,\n    apiKeySecret: apiKey,\n    sessionId: devSessionId,\n  }\n\n  const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url || '/', `http://localhost:${port}`)\n\n    // Health check endpoint\n    if (url.pathname === '/health') {\n      res.writeHead(200, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({\n        status: 'ok',\n        mode: 'development',\n        tools: getToolRegistry().listToolNames().length,\n        tenant: authResult.tenantId,\n        timestamp: new Date().toISOString(),\n      }))\n      return\n    }\n\n    if (url.pathname !== '/mcp') {\n      res.writeHead(404, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Not found' }))\n      return\n    }\n\n    // Extract and validate API key from header\n    const headers: Record<string, string | undefined> = {}\n    for (const [key, value] of Object.entries(req.headers)) {\n      headers[key] = Array.isArray(value) ? value[0] : value\n    }\n\n    const providedApiKey = extractApiKeyFromHeaders(headers)\n    if (!providedApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'API key required (x-api-key header)' }))\n      return\n    }\n\n    // Validate against the configured API key\n    if (providedApiKey !== apiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Invalid API key' }))\n      return\n    }\n\n    if (debug) {\n      log(`Authenticated request (${req.method})`)\n    }\n\n    try {\n      // Create stateless transport\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        enableJsonResponse: req.method === 'POST',\n      })\n\n      // Create server with pre-authenticated context (no session tokens needed)\n      const mcpServer = createDevMcpServer(toolContext, authResult.features, authResult.isSuperAdmin, debug)\n\n      // Connect server to transport\n      await mcpServer.connect(transport)\n\n      // Handle the request\n      if (req.method === 'POST') {\n        const body = await parseJsonBody(req)\n        await transport.handleRequest(req, res, body)\n      } else {\n        await transport.handleRequest(req, res)\n      }\n\n      // Cleanup after response finishes\n      res.on('finish', () => {\n        transport.close()\n        mcpServer.close()\n        if (debug) {\n          log(`Request completed, cleaned up`)\n        }\n      })\n    } catch (error) {\n      log('Error handling request:', error)\n      if (!res.headersSent) {\n        if (error instanceof Error && error.message === 'Request payload too large') {\n          res.writeHead(413, { 'Content-Type': 'application/json' })\n          res.end(JSON.stringify({ error: 'Request payload too large (max 1MB)' }))\n          return\n        }\n\n        res.writeHead(500, { 'Content-Type': 'application/json' })\n        res.end(\n          JSON.stringify({\n            jsonrpc: '2.0',\n            error: {\n              code: -32603,\n              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,\n            },\n            id: null,\n          })\n        )\n      }\n    }\n  })\n\n  const toolCount = getToolRegistry().listToolNames().length\n\n  log(`Tools registered: ${toolCount}`)\n  log(`Endpoint: http://localhost:${port}/mcp`)\n  log(`Health: http://localhost:${port}/health`)\n  log(`Mode: Development (API key auth, no session tokens)`)\n\n  return new Promise<void>((resolve) => {\n    httpServer.listen(port, () => {\n      log(`Server listening on port ${port}`)\n      log('Ready for Claude Code connections')\n    })\n\n    const shutdown = async () => {\n      log('Shutting down...')\n      httpServer.close(() => {\n        log('Server closed')\n        resolve()\n      })\n    }\n\n    process.on('SIGINT', shutdown)\n    process.on('SIGTERM', shutdown)\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAA+D;AACxE,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAC9C,SAAS,SAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB,2BAA2B;AACxD,SAAS,wBAAwB,0BAA0B,2BAA2B;AACtF,SAAS,uBAAuB;AAKhC,MAAM,eAAe;AAErB,MAAM,MAAM,CAAC,YAAoB,SAAoB;AACnD,UAAQ,MAAM,aAAa,OAAO,IAAI,GAAG,IAAI;AAC/C;AAEA,eAAe,uBAAoD;AACjE,QAAM,EAAE,UAAU,OAAO,IAAI,MAAM,OAAO,kBAAkB;AAC5D,QAAM,EAAE,SAAS,QAAQ,IAAI,MAAM,OAAO,WAAW;AAGrD,QAAM,cAAc,OAAO,aAA6C;AACtE,QAAI,MAAM;AACV,UAAM,OAAO,QAAQ,GAAG;AACxB,WAAO,QAAQ,MAAM;AACnB,YAAM,YAAY,QAAQ,KAAK,WAAW;AAC1C,UAAI;AACF,cAAM,OAAO,SAAS;AACtB,eAAO;AAAA,MACT,QAAQ;AACN,cAAM,QAAQ,GAAG;AAAA,MACnB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,MAAM,YAAY,QAAQ,IAAI,CAAC;AACnD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,MAAM,SAAS,aAAa,OAAO;AACnD,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAM,eAAe,QAAQ,aAAa,cAAc;AAExD,WAAO,cAAc,UAAU,WAAW;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,MAAM,gBAAgB,IAAI,OAAO;AAKjC,eAAe,cAAc,KAAwC;AACnE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,YAAY;AAEhB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,mBAAa,MAAM;AACnB,UAAI,YAAY,eAAe;AAC7B,YAAI,QAAQ;AACZ,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAC7C;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AACnD,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,MAAS;AAAA,MAC7C,SAAS,OAAO;AACd,eAAO,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAMA,SAAS,mBACP,aACA,cACA,cACA,OACW;AACX,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AAAA,IACjD,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,QAAM,WAAW,gBAAgB;AACjC,QAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAGrD,QAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAC5E,QAAM,kBAAkB,MAAM;AAAA,IAAO,CAAC,SACpC,oBAAoB,KAAK,kBAAkB,cAAc,cAAc,WAAW;AAAA,EACpF;AAEA,MAAI,OAAO;AACT,QAAI,eAAe,gBAAgB,MAAM,IAAI,MAAM,MAAM,0CAA0C;AAAA,EACrG;AAEA,aAAW,QAAQ,iBAAiB;AAClC,QAAI,OAAO;AACT,UAAI,qBAAqB,KAAK,IAAI,EAAE;AAAA,IACtC;AAGA,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,UAAI;AACF,cAAM,aAAa,EAAE,aAAa,KAAK,aAAa,EAAE,iBAAiB,MAAM,CAAC;AAC9E,cAAM,YAAY,gBAAgB,UAAU;AAC5C,qBAAc,UAA+B,YAAY;AAAA,MAC3D,SAAS,OAAO;AACd,YAAI,OAAO;AACT,cAAI,iBAAiB,KAAK,IAAI,gCAAgC,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,QAC9G;AACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,mBAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACxC;AAEA,QAAI;AACF,aAAO;AAAA,QACL,KAAK;AAAA,QACL;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,aAAa;AAAA,QACf;AAAA,QACA,OAAO,SAAkB;AACvB,gBAAM,WAAY,QAAQ,CAAC;AAE3B,cAAI,OAAO;AACT,gBAAI,iBAAiB,KAAK,IAAI,IAAI,KAAK,UAAU,QAAQ,CAAC;AAAA,UAC5D;AAEA,gBAAM,SAAS,MAAM,YAAY,KAAK,MAAM,UAAU,WAAW;AAEjE,cAAI,CAAC,OAAO,SAAS;AACnB,gBAAI,eAAe,OAAO,KAAK,EAAE;AACjC,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AAAA,gBACtE;AAAA,cACF;AAAA,cACA,SAAS;AAAA,YACX;AAAA,UACF;AAEA,iBAAO;AAAA,YACL,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,MAAM,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAAA,cAC7C;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,OAAO;AACT,YAAI,iBAAiB,KAAK,IAAI,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,MACzG;AACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAaA,eAAsB,kBAAiC;AACrD,QAAM,SAAS,MAAM,qBAAqB;AAC1C,QAAM,OAAO,SAAS,QAAQ,IAAI,gBAAgB,IAAI,EAAE,KAAK;AAC7D,QAAM,QAAQ,QAAQ,IAAI,cAAc;AAExC,MAAI,CAAC,QAAQ;AACX,QAAI,uCAAuC;AAC3C,QAAI,EAAE;AACN,QAAI,oBAAoB;AACxB,QAAI,wCAAwC;AAC5C,QAAI,gCAAgC;AACpC,QAAI,qDAAqD;AACzD,QAAI,EAAE;AACN,QAAI,8BAA8B;AAClC,QAAI,KAAK;AACT,QAAI,qBAAqB;AACzB,QAAI,yBAAyB;AAC7B,QAAI,yBAAyB;AAC7B,QAAI,6CAA6C;AACjD,QAAI,sBAAsB;AAC1B,QAAI,gDAAgD;AACpD,QAAI,WAAW;AACf,QAAI,SAAS;AACb,QAAI,OAAO;AACX,QAAI,KAAK;AACT,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,yCAAyC;AAG7C,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,QAAM,YAAY,MAAM,uBAAuB;AAG/C,MAAI,2BAA2B;AAC/B,QAAM,aAAa,MAAM,uBAAuB,QAAQ,SAAS;AAEjE,MAAI,CAAC,WAAW,SAAS;AACvB,QAAI,0BAA0B,WAAW,KAAK,EAAE;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,qBAAqB,WAAW,OAAO,EAAE;AAC7C,MAAI,WAAW,WAAW,YAAY,UAAU,EAAE;AAClD,MAAI,iBAAiB,WAAW,kBAAkB,QAAQ,EAAE;AAC5D,MAAI,gBAAgB,WAAW,YAAY,EAAE;AAC7C,MAAI,aAAa,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,KAAK,IAAI,IAAI,QAAQ,EAAE;AAG7F,MAAI,kBAAkB;AACtB,QAAM,mBAAmB;AAGzB,MAAI;AACF,UAAM,EAAE,oBAAoB,iBAAiB,IAAI,MAAM,OAAO,gBAAgB;AAC9E,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,mCAAmC;AAEnE,QAAI,yCAAyC;AAC7C,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,QAAQ,MAAM,mBAAmB,GAAG;AAC1C,qBAAiB,KAAK;AACtB,QAAI,iBAAiB,MAAM,MAAM,MAAM,cAAc,MAAM,MAAM,MAAM,gBAAgB;AAAA,EACzF,SAAS,OAAO;AACd,QAAI,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EACxF;AAGA,MAAI;AACF,UAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAAsB;AACnE,UAAM,OAAO,MAAM,oBAAoB;AACvC,QAAI,MAAM;AACR,UAAI,mEAAmE;AAAA,IACzE,OAAO;AACL,UAAI,4BAA4B;AAAA,IAClC;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,EACrF;AAGA,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,eAAe;AACvD,UAAM,oBAAoB,aAAa;AAEvC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAsB;AACjE,UAAM,gBAAgB,MAAM,kBAAkB,aAAa;AAC3D,QAAI,gBAAgB,GAAG;AACrB,UAAI,WAAW,aAAa,8BAA8B;AAAA,IAC5D;AAGA,QAAI;AACF,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,gBAAgB;AAC9D,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,gBAAgB;AAChE,YAAM,QAAQ,qBAAqB;AACnC,UAAI,OAAO;AACT,cAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,eAAe,KAAK;AACnE,YAAI,QAAQ,GAAG;AACb,cAAI,WAAW,KAAK,+BAA+B;AAAA,QACrD;AAAA,MACF;AAAA,IACF,SAAS,aAAa;AACpB,UAAI,mCAAmC,uBAAuB,QAAQ,YAAY,UAAU,WAAW;AAAA,IACzG;AAAA,EACF,QAAQ;AACN,QAAI,wDAAwD;AAAA,EAC9D;AAGA,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,aAAa;AAClD,QAAM,eAAe,SAAS,YAAY,CAAC,EAAE,SAAS,KAAK;AAC3D,MAAI,eAAe,YAAY,oCAAoC;AAGnE,QAAM,cAA8B;AAAA,IAClC,UAAU,WAAW;AAAA,IACrB,gBAAgB,WAAW;AAAA,IAC3B,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA,cAAc,WAAW;AAAA,IACzB,cAAc,WAAW;AAAA,IACzB,cAAc;AAAA,IACd,WAAW;AAAA,EACb;AAEA,QAAM,aAAa,aAAa,OAAO,KAAsB,QAAwB;AACnF,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,IAAI,EAAE;AAG9D,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU;AAAA,QACrB,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,OAAO,gBAAgB,EAAE,cAAc,EAAE;AAAA,QACzC,QAAQ,WAAW;AAAA,QACnB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,QAAI,IAAI,aAAa,QAAQ;AAC3B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;AAC9C;AAAA,IACF;AAGA,UAAM,UAA8C,CAAC;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,cAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IACnD;AAEA,UAAM,iBAAiB,yBAAyB,OAAO;AACvD,QAAI,CAAC,gBAAgB;AACnB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,IACF;AAGA,QAAI,mBAAmB,QAAQ;AAC7B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AACpD;AAAA,IACF;AAEA,QAAI,OAAO;AACT,UAAI,0BAA0B,IAAI,MAAM,GAAG;AAAA,IAC7C;AAEA,QAAI;AAEF,YAAM,YAAY,IAAI,8BAA8B;AAAA,QAClD,oBAAoB;AAAA,QACpB,oBAAoB,IAAI,WAAW;AAAA,MACrC,CAAC;AAGD,YAAM,YAAY,mBAAmB,aAAa,WAAW,UAAU,WAAW,cAAc,KAAK;AAGrG,YAAM,UAAU,QAAQ,SAAS;AAGjC,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,OAAO,MAAM,cAAc,GAAG;AACpC,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,MAC9C,OAAO;AACL,cAAM,UAAU,cAAc,KAAK,GAAG;AAAA,MACxC;AAGA,UAAI,GAAG,UAAU,MAAM;AACrB,kBAAU,MAAM;AAChB,kBAAU,MAAM;AAChB,YAAI,OAAO;AACT,cAAI,+BAA+B;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK;AACpC,UAAI,CAAC,IAAI,aAAa;AACpB,YAAI,iBAAiB,SAAS,MAAM,YAAY,6BAA6B;AAC3E,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,QACF;AAEA,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU;AAAA,YACb,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,YAC3F;AAAA,YACA,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,gBAAgB,EAAE,cAAc,EAAE;AAEpD,MAAI,qBAAqB,SAAS,EAAE;AACpC,MAAI,8BAA8B,IAAI,MAAM;AAC5C,MAAI,4BAA4B,IAAI,SAAS;AAC7C,MAAI,qDAAqD;AAEzD,SAAO,IAAI,QAAc,CAAC,YAAY;AACpC,eAAW,OAAO,MAAM,MAAM;AAC5B,UAAI,4BAA4B,IAAI,EAAE;AACtC,UAAI,mCAAmC;AAAA,IACzC,CAAC;AAED,UAAM,WAAW,YAAY;AAC3B,UAAI,kBAAkB;AACtB,iBAAW,MAAM,MAAM;AACrB,YAAI,eAAe;AACnB,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACH;",
   "names": []
 }

package/dist/modules/ai_assistant/lib/mcp-server.js

@@ -114,6 +114,23 @@ async function createMcpServer(options) {
   return server;
 }
 async function runMcpServer(options) {
+  try {
+    const { extractEntityGraph, cacheEntityGraph } = await import("./entity-graph.js");
+    const { getOrm } = await import("@open-mercato/shared/lib/db/mikro");
+    const orm = await getOrm();
+    const graph = await extractEntityGraph(orm);
+    cacheEntityGraph(graph);
+    console.error(`[MCP Server] Entity graph: ${graph.nodes.length} entities`);
+  } catch (error) {
+    console.error("[MCP Server] Entity graph skipped:", error instanceof Error ? error.message : error);
+  }
+  try {
+    const { getRawOpenApiSpec } = await import("./api-endpoint-index.js");
+    await getRawOpenApiSpec();
+    console.error("[MCP Server] Raw OpenAPI spec cached for Code Mode");
+  } catch (error) {
+    console.error("[MCP Server] Raw OpenAPI spec caching skipped:", error instanceof Error ? error.message : error);
+  }
   await loadAllModuleTools();
   try {
     const searchService = options.container.resolve("searchService");