@productbrain/mcp 0.0.1-beta.111 → 0.0.1-beta.122

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 // src/cli/index.ts
 var subcommand = process.argv[2];
 if (subcommand === "setup") {
-  const { runSetup } = await import("../setup-GQ3LQS2L.js");
+  const { runSetup } = await import("../setup-2JWIZ3QO.js");
   await runSetup();
 } else {
   await import("../index.js");

package/dist/http.js

@@ -1,17 +1,17 @@
 import {
   SERVER_VERSION,
   createProductBrainServer
-} from "./chunk-O337N4MC.js";
+} from "./chunk-ZFODPVNH.js";
 import {
   bootstrapHttp,
   initFeatureFlags,
   runWithAuth
-} from "./chunk-DHBJFEAT.js";
+} from "./chunk-G4WJIWXX.js";
 import {
   getPostHogClient,
   initAnalytics,
   shutdownAnalytics
-} from "./chunk-RQXM3TCI.js";
+} from "./chunk-2ZWGQ6PK.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
@@ -431,8 +431,11 @@ async function gracefulShutdown() {
   }
   process.exit(0);
 }
-var httpServer = app.listen(PORT, "127.0.0.1", () => {
-  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);
+var LISTEN_HOST = "0.0.0.0";
+var httpServer = app.listen(PORT, LISTEN_HOST, () => {
+  console.log(
+    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`
+  );
 });
 httpServer.on("error", (err) => {
   console.error(`[MCP HTTP] Server error: ${err.message}`);

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/http.ts"],"sourcesContent":["/**\n * HTTP transport entry point for Product Brain MCP.\n *\n * Serves the MCP protocol over Streamable HTTP for web clients\n * (Claude web app, API consumers) that can't spawn local processes.\n *\n * Implements the full MCP OAuth 2.1 spec (Nov 2025):\n *   1. Protected Resource Metadata  (/.well-known/oauth-protected-resource)\n *   2. Authorization Server Metadata (/.well-known/oauth-authorization-server)\n *   3. Dynamic Client Registration   (POST /register)\n *   4. Authorization Code + PKCE     (GET/POST /authorize)\n *   5. Token Exchange                (POST /oauth/token)\n *\n * Env:\n *   CONVEX_SITE_URL  — Convex deployment URL (defaults to cloud)\n *   PORT / MCP_PORT  — Listen port (default 3000)\n *   CORS_ORIGINS     — Comma-separated allowed origins (default: all)\n *   PB_MODULES       — Comma-separated modules (default: core,gitchain,arch)\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport express from \"express\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport rateLimit from \"express-rate-limit\";\n\nimport { bootstrapHttp } from \"./client.js\";\nimport { runWithAuth } from \"./auth.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\nimport { initAnalytics, shutdownAnalytics, getPostHogClient } from \"./analytics.js\";\nimport { initFeatureFlags } from \"./featureFlags.js\";\n\n// ── Bootstrap ───────────────────────────────────────────────────────────\n\nbootstrapHttp();\ninitAnalytics();\ninitFeatureFlags(getPostHogClient());\n\nconst PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? \"3002\", 10);\n\nfunction baseUrl(req: any): string {\n  const proto = req.headers[\"x-forwarded-proto\"] ?? req.protocol ?? \"http\";\n  const host = req.headers.host ?? `localhost:${PORT}`;\n  return `${proto}://${host}`;\n}\n\n// ── Express App ─────────────────────────────────────────────────────────\n\nconst app = express();\n// Required when behind a reverse proxy (e.g. Railway): rate limiter uses X-Forwarded-For\n// and throws ERR_ERL_UNEXPECTED_X_FORWARDED_FOR if trust proxy is false.\napp.set(\"trust proxy\", 1);\napp.use(express.json());\n\n// CORS — fail-closed; requires CORS_ORIGINS to be explicitly configured.\nconst ALLOWED_ORIGINS = process.env.CORS_ORIGINS\n  ?.split(\",\")\n  .map((o) => o.trim())\n  .filter(Boolean);\n\napp.use((_req: any, res: any, next: any) => {\n  const origin = _req.headers.origin;\n  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {\n    res.setHeader(\"Access-Control-Allow-Origin\", origin);\n  }\n  res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n  res.setHeader(\n    \"Access-Control-Allow-Headers\",\n    \"Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id\",\n  );\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Mcp-Session-Id\");\n  if (_req.method === \"OPTIONS\") {\n    res.status(204).end();\n    return;\n  }\n  next();\n});\n\n// ── OAuth: Protected Resource Metadata (RFC 9728) ────────────────────────\n// Step 1 of MCP auth: Claude fetches this to discover the authorization server.\n\napp.get(\"/.well-known/oauth-protected-resource\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    resource: base,\n    authorization_servers: [base],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n    bearer_methods_supported: [\"header\"],\n  });\n});\n\n// ── OAuth: Authorization Server Metadata (RFC 8414) ──────────────────────\n// Step 2: Claude fetches this to discover authorize, token, and register endpoints.\n\napp.get(\"/.well-known/oauth-authorization-server\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    issuer: base,\n    authorization_endpoint: `${base}/authorize`,\n    token_endpoint: `${base}/oauth/token`,\n    registration_endpoint: `${base}/register`,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n  });\n});\n\n// ── OAuth: Dynamic Client Registration (RFC 7591) ────────────────────────\n// Step 3: Claude registers itself as a client before starting the auth flow.\n\ninterface RegisteredClient {\n  client_id: string;\n  redirect_uris: string[];\n  client_name?: string;\n  registeredAt: number;\n}\n\nconst registeredClients = new Map<string, RegisteredClient>();\n\napp.post(\n  \"/register\",\n  express.json(),\n  (req: any, res: any) => {\n    const { redirect_uris, client_name } = req.body;\n\n    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {\n      res.status(400).json({\n        error: \"invalid_client_metadata\",\n        error_description: \"redirect_uris is required\",\n      });\n      return;\n    }\n\n    const clientId = `pb_client_${randomUUID()}`;\n    const client: RegisteredClient = {\n      client_id: clientId,\n      redirect_uris,\n      client_name,\n      registeredAt: Date.now(),\n    };\n    registeredClients.set(clientId, client);\n\n    res.status(201).json({\n      client_id: clientId,\n      client_name: client_name ?? \"MCP Client\",\n      redirect_uris,\n      grant_types: [\"authorization_code\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\",\n    });\n  },\n);\n\n// ── OAuth: Authorization Code + PKCE ─────────────────────────────────────\n// Step 4: User enters their pb_sk_* key, server generates a one-time code.\n\ninterface PendingAuth {\n  apiKey: string;\n  codeChallenge: string;\n  redirectUri: string;\n  expiresAt: number;\n}\n\nconst pendingCodes = new Map<string, PendingAuth>();\n\n// Refresh token store — declared here so the cleanup interval can reference it.\nconst ACCESS_TOKEN_TTL = 3600; // 1 hour\nconst REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60_000; // 90 days\n\ninterface RefreshEntry {\n  apiKey: string;\n  createdAt: number;\n}\n\nconst refreshTokens = new Map<string, RefreshEntry>();\n\nsetInterval(() => {\n  const now = Date.now();\n  for (const [code, auth] of pendingCodes) {\n    if (now > auth.expiresAt) pendingCodes.delete(code);\n  }\n  for (const [id, client] of registeredClients) {\n    if (now - client.registeredAt > 24 * 60 * 60_000) registeredClients.delete(id);\n  }\n  for (const [token, entry] of refreshTokens) {\n    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);\n  }\n}, 60_000);\n\nfunction esc(s: unknown): string {\n  return String(s ?? \"\").replace(/[&\"<>]/g, (c) =>\n    ({ \"&\": \"&amp;\", '\"': \"&quot;\", \"<\": \"&lt;\", \">\": \"&gt;\" })[c]!,\n  );\n}\n\napp.get(\"/authorize\", (req: any, res: any) => {\n  const { redirect_uri, code_challenge, code_challenge_method, state } =\n    req.query;\n  res.type(\"html\").send(`<!DOCTYPE html>\n<html lang=\"en\"><head>\n<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>Authorize — Product Brain</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;\n  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}\n.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}\nh1{font-size:1.2rem;margin-bottom:.25rem}\n.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}\nlabel{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}\ninput[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;\n  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}\ninput:focus{outline:none;border-color:#7c3aed}\nbutton{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;\n  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}\nbutton:hover{background:#6d28d9}\n.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}\n</style></head><body>\n<div class=\"card\">\n<h1>Product Brain</h1>\n<p class=\"sub\">Enter your API key to connect Claude to your workspace.</p>\n<form method=\"POST\" action=\"/authorize\">\n  <input type=\"hidden\" name=\"redirect_uri\" value=\"${esc(redirect_uri)}\">\n  <input type=\"hidden\" name=\"code_challenge\" value=\"${esc(code_challenge)}\">\n  <input type=\"hidden\" name=\"code_challenge_method\" value=\"${esc(code_challenge_method)}\">\n  <input type=\"hidden\" name=\"state\" value=\"${esc(state)}\">\n  <label for=\"k\">API Key</label>\n  <input type=\"password\" id=\"k\" name=\"api_key\" placeholder=\"pb_sk_…\" required autofocus>\n  <p class=\"err\" id=\"e\">Key must start with pb_sk_</p>\n  <button type=\"submit\">Authorize</button>\n</form>\n</div>\n<script>document.querySelector(\"form\").onsubmit=function(e){\nif(!document.getElementById(\"k\").value.startsWith(\"pb_sk_\")){\ne.preventDefault();document.getElementById(\"e\").style.display=\"block\"}}</script>\n</body></html>`);\n});\n\napp.post(\n  \"/authorize\",\n  express.urlencoded({ extended: false }),\n  (req: any, res: any) => {\n    const { api_key, redirect_uri, code_challenge, state } = req.body;\n\n    if (!api_key?.startsWith(\"pb_sk_\")) {\n      res.status(400).send(\"Invalid API key\");\n      return;\n    }\n\n    const code = randomUUID();\n    pendingCodes.set(code, {\n      apiKey: api_key,\n      codeChallenge: code_challenge,\n      redirectUri: redirect_uri,\n      expiresAt: Date.now() + 5 * 60_000,\n    });\n\n    const url = new URL(redirect_uri);\n    url.searchParams.set(\"code\", code);\n    if (state) url.searchParams.set(\"state\", state);\n    res.redirect(302, url.toString());\n  },\n);\n\n// ── OAuth: Token Exchange ────────────────────────────────────────────────\n// Step 5: Claude exchanges the authorization code (with PKCE verifier) for a token.\n// Supports both authorization_code and refresh_token grants.\n\nfunction issueTokens(apiKey: string): object {\n  const refreshToken = `pb_rt_${randomUUID()}`;\n  refreshTokens.set(refreshToken, { apiKey, createdAt: Date.now() });\n  return {\n    access_token: apiKey,\n    token_type: \"Bearer\",\n    expires_in: ACCESS_TOKEN_TTL,\n    refresh_token: refreshToken,\n  };\n}\n\napp.post(\n  \"/oauth/token\",\n  express.urlencoded({ extended: false }),\n  express.json(),\n  (req: any, res: any) => {\n    const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n      req.body;\n\n    if (grant_type === \"refresh_token\") {\n      const entry = refreshTokens.get(refresh_token);\n      if (!entry) {\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Invalid refresh token\" });\n        return;\n      }\n      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {\n        refreshTokens.delete(refresh_token);\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Refresh token expired\" });\n        return;\n      }\n      // Rotate: revoke old, issue new pair\n      const apiKey = entry.apiKey;\n      refreshTokens.delete(refresh_token);\n      res.json(issueTokens(apiKey));\n      return;\n    }\n\n    if (grant_type !== \"authorization_code\") {\n      res.status(400).json({ error: \"unsupported_grant_type\" });\n      return;\n    }\n\n    const pending = pendingCodes.get(code);\n    if (!pending || pending.redirectUri !== redirect_uri) {\n      res.status(400).json({ error: \"invalid_grant\" });\n      return;\n    }\n\n    // PKCE S256 validation\n    const challenge = createHash(\"sha256\")\n      .update(code_verifier ?? \"\")\n      .digest(\"base64url\");\n    if (challenge !== pending.codeChallenge) {\n      pendingCodes.delete(code);\n      res.status(400).json({\n        error: \"invalid_grant\",\n        error_description: \"PKCE verification failed\",\n      });\n      return;\n    }\n\n    pendingCodes.delete(code);\n    res.json(issueTokens(pending.apiKey));\n  },\n);\n\n// ── Rate Limiting ────────────────────────────────────────────────────────\n\nconst mcpLimiter = rateLimit({\n  windowMs: 60_000,\n  max: 120,\n  standardHeaders: true,\n  legacyHeaders: false,\n  message: { error: \"Too many requests. Try again later.\" },\n});\n\n// ── Health Check ─────────────────────────────────────────────────────────\n\napp.get(\"/health\", (_req: any, res: any) => {\n  res.json({ status: \"ok\", version: SERVER_VERSION, transport: \"http\" });\n});\n\n// ── Session Management ──────────────────────────────────────────────────\n\ninterface SessionEntry {\n  transport: StreamableHTTPServerTransport;\n  lastAccess: number;\n}\n\nconst sessions = new Map<string, SessionEntry>();\nconst SESSION_TTL_MS = 30 * 60 * 1000;\nconst MAX_SESSIONS = 200;\n\nfunction evictStaleSessions(): void {\n  const now = Date.now();\n  for (const [id, entry] of sessions) {\n    if (now - entry.lastAccess > SESSION_TTL_MS) {\n      logSessionLifecycle(\"session_deleted\", id, \"ttl\");\n      entry.transport.close().catch(() => {});\n      sessions.delete(id);\n    }\n  }\n  if (sessions.size > MAX_SESSIONS) {\n    const sorted = [...sessions.entries()].sort(\n      (a, b) => a[1].lastAccess - b[1].lastAccess,\n    );\n    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {\n      logSessionLifecycle(\"session_deleted\", sorted[i][0], \"eviction\");\n      sorted[i][1].transport.close().catch(() => {});\n      sessions.delete(sorted[i][0]);\n    }\n  }\n}\n\nsetInterval(evictStaleSessions, 60_000);\n\n// ── Auth Helpers ─────────────────────────────────────────────────────────\n\nfunction extractBearerKey(req: any): string | null {\n  const header = req.headers?.authorization;\n  if (typeof header !== \"string\" || !header.startsWith(\"Bearer \")) return null;\n  const token = header.slice(7).trim();\n  return token.startsWith(\"pb_sk_\") ? token : null;\n}\n\nfunction send401(req: any, res: any): void {\n  const base = baseUrl(req);\n  res\n    .status(401)\n    .set(\n      \"WWW-Authenticate\",\n      `Bearer resource_metadata=\"${base}/.well-known/oauth-protected-resource\"`,\n    )\n    .json({ error: \"unauthorized\" });\n}\n\nfunction logRequest(\n  method: string,\n  outcome: \"ok\" | \"auth_fail\" | \"error\",\n  sessionId?: string,\n  durationMs?: number,\n): void {\n  const ts = new Date().toISOString();\n  const sid = sessionId ? ` session=${sessionId}` : \"\";\n  const dur = durationMs != null ? ` duration=${durationMs}ms` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}${dur}\\n`);\n}\n\nfunction logSessionLifecycle(\n  event: \"session_created\" | \"session_deleted\",\n  sessionId: string,\n  reason?: \"ttl\" | \"eviction\" | \"onclose\",\n): void {\n  const ts = new Date().toISOString();\n  const r = reason ? ` reason=${reason}` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}\\n`);\n}\n\n// ── MCP Handlers ────────────────────────────────────────────────────────\n\napp.post(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"POST\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  const reqStart = Date.now();\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      if (sessionId && sessions.has(sessionId)) {\n        const entry = sessions.get(sessionId)!;\n        entry.lastAccess = Date.now();\n        await entry.transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", sessionId, Date.now() - reqStart);\n      } else if (!sessionId && isInitializeRequest(req.body)) {\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: () => randomUUID(),\n          onsessioninitialized: (sid: string) => {\n            sessions.set(sid, { transport, lastAccess: Date.now() });\n            logSessionLifecycle(\"session_created\", sid);\n          },\n        });\n\n        transport.onclose = () => {\n          const sid = transport.sessionId;\n          if (sid) {\n            logSessionLifecycle(\"session_deleted\", sid, \"onclose\");\n            sessions.delete(sid);\n          }\n        };\n\n        const server = createProductBrainServer();\n        await server.connect(transport);\n        await transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", transport.sessionId ?? undefined, Date.now() - reqStart);\n      } else {\n        process.stderr.write(\n          `[HTTP] ${new Date().toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)\\n`,\n        );\n        res.status(400).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Bad Request: no valid session ID provided\" },\n          id: null,\n        });\n      }\n    });\n  } catch (err: any) {\n    logRequest(\"POST\", \"error\", sessionId, Date.now() - reqStart);\n    if (!res.headersSent) {\n      res.status(500).json({\n        jsonrpc: \"2.0\",\n        error: { code: -32603, message: \"Internal server error\" },\n        id: null,\n      });\n    }\n  }\n});\n\napp.get(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"GET\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      entry.lastAccess = Date.now();\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"GET\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"GET\", \"error\", sessionId);\n  }\n});\n\napp.delete(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"DELETE\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"DELETE\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"DELETE\", \"error\", sessionId);\n  }\n});\n\n// ── Start ───────────────────────────────────────────────────────────────\n\nprocess.on(\"unhandledRejection\", (reason) => {\n  const msg = reason instanceof Error ? reason.message : String(reason);\n  console.error(`[MCP HTTP] Unhandled rejection: ${msg}`);\n});\n\nprocess.on(\"uncaughtException\", (err) => {\n  console.error(`[MCP HTTP] Uncaught exception: ${err.stack ?? err.message}`);\n  gracefulShutdown();\n});\n\nlet shuttingDown = false;\nasync function gracefulShutdown() {\n  if (shuttingDown) return;\n  shuttingDown = true;\n  setTimeout(() => process.exit(1), 3_000).unref();\n  console.log(\"Shutting down...\");\n  for (const [, entry] of sessions) {\n    await entry.transport.close().catch(() => {});\n  }\n  try {\n    await shutdownAnalytics();\n  } catch {\n    /* best-effort */\n  }\n  process.exit(0);\n}\n\nconst httpServer = app.listen(PORT, \"127.0.0.1\", () => {\n  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);\n});\nhttpServer.on(\"error\", (err) => {\n  console.error(`[MCP HTTP] Server error: ${err.message}`);\n  process.exit(1);\n});\n\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,SAAS,YAAY,kBAAkB;AACvC,OAAO,aAAa;AACpB,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AACpC,OAAO,eAAe;AAUtB,cAAc;AACd,cAAc;AACd,iBAAiB,iBAAiB,CAAC;AAEnC,IAAM,OAAO,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY,QAAQ,EAAE;AAE5E,SAAS,QAAQ,KAAkB;AACjC,QAAM,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,IAAI,YAAY;AAClE,QAAM,OAAO,IAAI,QAAQ,QAAQ,aAAa,IAAI;AAClD,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAIA,IAAM,MAAM,QAAQ;AAGpB,IAAI,IAAI,eAAe,CAAC;AACxB,IAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,IAAM,kBAAkB,QAAQ,IAAI,cAChC,MAAM,GAAG,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,IAAI,IAAI,CAAC,MAAW,KAAU,SAAc;AAC1C,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,mBAAmB,UAAU,gBAAgB,SAAS,MAAM,GAAG;AACjE,QAAI,UAAU,+BAA+B,MAAM;AAAA,EACrD;AACA,MAAI,UAAU,gCAAgC,4BAA4B;AAC1E,MAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,iCAAiC,gBAAgB;AAC/D,MAAI,KAAK,WAAW,WAAW;AAC7B,QAAI,OAAO,GAAG,EAAE,IAAI;AACpB;AAAA,EACF;AACA,OAAK;AACP,CAAC;AAKD,IAAI,IAAI,yCAAyC,CAAC,KAAU,QAAa;AACvE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,UAAU;AAAA,IACV,uBAAuB,CAAC,IAAI;AAAA,IAC5B,kBAAkB,CAAC,aAAa,eAAe;AAAA,IAC/C,0BAA0B,CAAC,QAAQ;AAAA,EACrC,CAAC;AACH,CAAC;AAKD,IAAI,IAAI,2CAA2C,CAAC,KAAU,QAAa;AACzE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,QAAQ;AAAA,IACR,wBAAwB,GAAG,IAAI;AAAA,IAC/B,gBAAgB,GAAG,IAAI;AAAA,IACvB,uBAAuB,GAAG,IAAI;AAAA,IAC9B,0BAA0B,CAAC,MAAM;AAAA,IACjC,uBAAuB,CAAC,sBAAsB,eAAe;AAAA,IAC7D,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA,IAC9C,kBAAkB,CAAC,aAAa,eAAe;AAAA,EACjD,CAAC;AACH,CAAC;AAYD,IAAM,oBAAoB,oBAAI,IAA8B;AAE5D,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,eAAe,YAAY,IAAI,IAAI;AAE3C,QAAI,CAAC,MAAM,QAAQ,aAAa,KAAK,cAAc,WAAW,GAAG;AAC/D,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,WAAW,CAAC;AAC1C,UAAM,SAA2B;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,IACzB;AACA,sBAAkB,IAAI,UAAU,MAAM;AAEtC,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACnB,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,CAAC,oBAAoB;AAAA,MAClC,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;AAYA,IAAM,eAAe,oBAAI,IAAyB;AAGlD,IAAM,mBAAmB;AACzB,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAO5C,IAAM,gBAAgB,oBAAI,IAA0B;AAEpD,YAAY,MAAM;AAChB,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACvC,QAAI,MAAM,KAAK,UAAW,cAAa,OAAO,IAAI;AAAA,EACpD;AACA,aAAW,CAAC,IAAI,MAAM,KAAK,mBAAmB;AAC5C,QAAI,MAAM,OAAO,eAAe,KAAK,KAAK,IAAQ,mBAAkB,OAAO,EAAE;AAAA,EAC/E;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,eAAe;AAC1C,QAAI,MAAM,MAAM,YAAY,qBAAsB,eAAc,OAAO,KAAK;AAAA,EAC9E;AACF,GAAG,GAAM;AAET,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,KAAK,EAAE,EAAE;AAAA,IAAQ;AAAA,IAAW,CAAC,OACxC,EAAE,KAAK,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAK,OAAO,GAAG,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,IAAI,cAAc,CAAC,KAAU,QAAa;AAC5C,QAAM,EAAE,cAAc,gBAAgB,uBAAuB,MAAM,IACjE,IAAI;AACN,MAAI,KAAK,MAAM,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oDAwB4B,IAAI,YAAY,CAAC;AAAA,sDACf,IAAI,cAAc,CAAC;AAAA,6DACZ,IAAI,qBAAqB,CAAC;AAAA,6CAC1C,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAUxC;AACf,CAAC;AAED,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,SAAS,cAAc,gBAAgB,MAAM,IAAI,IAAI;AAE7D,QAAI,CAAC,SAAS,WAAW,QAAQ,GAAG;AAClC,UAAI,OAAO,GAAG,EAAE,KAAK,iBAAiB;AACtC;AAAA,IACF;AAEA,UAAM,OAAO,WAAW;AACxB,iBAAa,IAAI,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW,KAAK,IAAI,IAAI,IAAI;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,IAAI,YAAY;AAChC,QAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,QAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,QAAI,SAAS,KAAK,IAAI,SAAS,CAAC;AAAA,EAClC;AACF;AAMA,SAAS,YAAY,QAAwB;AAC3C,QAAM,eAAe,SAAS,WAAW,CAAC;AAC1C,gBAAc,IAAI,cAAc,EAAE,QAAQ,WAAW,KAAK,IAAI,EAAE,CAAC;AACjE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB;AACF;AAEA,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,YAAY,MAAM,eAAe,cAAc,cAAc,IACnE,IAAI;AAEN,QAAI,eAAe,iBAAiB;AAClC,YAAM,QAAQ,cAAc,IAAI,aAAa;AAC7C,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,MAAM,YAAY,sBAAsB;AACvD,sBAAc,OAAO,aAAa;AAClC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AACrB,oBAAc,OAAO,aAAa;AAClC,UAAI,KAAK,YAAY,MAAM,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,eAAe,sBAAsB;AACvC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,IAAI,IAAI;AACrC,QAAI,CAAC,WAAW,QAAQ,gBAAgB,cAAc;AACpD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC/C;AAAA,IACF;AAGA,UAAM,YAAY,WAAW,QAAQ,EAClC,OAAO,iBAAiB,EAAE,EAC1B,OAAO,WAAW;AACrB,QAAI,cAAc,QAAQ,eAAe;AACvC,mBAAa,OAAO,IAAI;AACxB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,iBAAa,OAAO,IAAI;AACxB,QAAI,KAAK,YAAY,QAAQ,MAAM,CAAC;AAAA,EACtC;AACF;AAIA,IAAM,aAAa,UAAU;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,sCAAsC;AAC1D,CAAC;AAID,IAAI,IAAI,WAAW,CAAC,MAAW,QAAa;AAC1C,MAAI,KAAK,EAAE,QAAQ,MAAM,SAAS,gBAAgB,WAAW,OAAO,CAAC;AACvE,CAAC;AASD,IAAM,WAAW,oBAAI,IAA0B;AAC/C,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,eAAe;AAErB,SAAS,qBAA2B;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,IAAI,KAAK,KAAK,UAAU;AAClC,QAAI,MAAM,MAAM,aAAa,gBAAgB;AAC3C,0BAAoB,mBAAmB,IAAI,KAAK;AAChD,YAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACtC,eAAS,OAAO,EAAE;AAAA,IACpB;AAAA,EACF;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,UAAM,SAAS,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE;AAAA,MACrC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;AAAA,IACnC;AACA,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,cAAc,KAAK;AACrD,0BAAoB,mBAAmB,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU;AAC/D,aAAO,CAAC,EAAE,CAAC,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC7C,eAAS,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,YAAY,oBAAoB,GAAM;AAItC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,SAAS;AAC5B,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AACxE,QAAM,QAAQ,OAAO,MAAM,CAAC,EAAE,KAAK;AACnC,SAAO,MAAM,WAAW,QAAQ,IAAI,QAAQ;AAC9C;AAEA,SAAS,QAAQ,KAAU,KAAgB;AACzC,QAAM,OAAO,QAAQ,GAAG;AACxB,MACG,OAAO,GAAG,EACV;AAAA,IACC;AAAA,IACA,6BAA6B,IAAI;AAAA,EACnC,EACC,KAAK,EAAE,OAAO,eAAe,CAAC;AACnC;AAEA,SAAS,WACP,QACA,SACA,WACA,YACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,MAAM,YAAY,YAAY,SAAS,KAAK;AAClD,QAAM,MAAM,cAAc,OAAO,aAAa,UAAU,OAAO;AAC/D,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,OAAO,GAAG,GAAG,GAAG,GAAG;AAAA,CAAI;AACxE;AAEA,SAAS,oBACP,OACA,WACA,QACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,IAAI,SAAS,WAAW,MAAM,KAAK;AACzC,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,KAAK,YAAY,SAAS,GAAG,CAAC;AAAA,CAAI;AACzE;AAIA,IAAI,KAAK,QAAQ,YAAY,OAAO,KAAU,QAAa;AACzD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,QAAQ,WAAW;AAC9B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,QAAM,WAAW,KAAK,IAAI;AAE1B,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,UAAI,aAAa,SAAS,IAAI,SAAS,GAAG;AACxC,cAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,cAAM,aAAa,KAAK,IAAI;AAC5B,cAAM,MAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AACtD,mBAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAC3D,WAAW,CAAC,aAAa,oBAAoB,IAAI,IAAI,GAAG;AACtD,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB,MAAM,WAAW;AAAA,UACrC,sBAAsB,CAAC,QAAgB;AACrC,qBAAS,IAAI,KAAK,EAAE,WAAW,YAAY,KAAK,IAAI,EAAE,CAAC;AACvD,gCAAoB,mBAAmB,GAAG;AAAA,UAC5C;AAAA,QACF,CAAC;AAED,kBAAU,UAAU,MAAM;AACxB,gBAAM,MAAM,UAAU;AACtB,cAAI,KAAK;AACP,gCAAoB,mBAAmB,KAAK,SAAS;AACrD,qBAAS,OAAO,GAAG;AAAA,UACrB;AAAA,QACF;AAEA,cAAM,SAAS,yBAAyB;AACxC,cAAM,OAAO,QAAQ,SAAS;AAC9B,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAChD,mBAAW,QAAQ,MAAM,UAAU,aAAa,QAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAClF,OAAO;AACL,gBAAQ,OAAO;AAAA,UACb,WAAU,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA,QACpC;AACA,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,4CAA4C;AAAA,UAC5E,IAAI;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,eAAW,QAAQ,SAAS,WAAW,KAAK,IAAI,IAAI,QAAQ;AAC5D,QAAI,CAAC,IAAI,aAAa;AACpB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,QACxD,IAAI;AAAA,MACN,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,QAAQ,YAAY,OAAO,KAAU,QAAa;AACxD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,OAAO,WAAW;AAC7B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,aAAa,KAAK,IAAI;AAC5B,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,OAAO,MAAM,SAAS;AAAA,IACnC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,OAAO,SAAS,SAAS;AAAA,EACtC;AACF,CAAC;AAED,IAAI,OAAO,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC3D,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,UAAU,WAAW;AAChC,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,UAAU,MAAM,SAAS;AAAA,IACtC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,UAAU,SAAS,SAAS;AAAA,EACzC;AACF,CAAC;AAID,QAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,QAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACpE,UAAQ,MAAM,mCAAmC,GAAG,EAAE;AACxD,CAAC;AAED,QAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,UAAQ,MAAM,kCAAkC,IAAI,SAAS,IAAI,OAAO,EAAE;AAC1E,mBAAiB;AACnB,CAAC;AAED,IAAI,eAAe;AACnB,eAAe,mBAAmB;AAChC,MAAI,aAAc;AAClB,iBAAe;AACf,aAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAK,EAAE,MAAM;AAC/C,UAAQ,IAAI,kBAAkB;AAC9B,aAAW,CAAC,EAAE,KAAK,KAAK,UAAU;AAChC,UAAM,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC9C;AACA,MAAI;AACF,UAAM,kBAAkB;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,aAAa,IAAI,OAAO,MAAM,aAAa,MAAM;AACrD,UAAQ,IAAI,kCAAkC,cAAc,sBAAsB,IAAI,EAAE;AAC1F,CAAC;AACD,WAAW,GAAG,SAAS,CAAC,QAAQ;AAC9B,UAAQ,MAAM,4BAA4B,IAAI,OAAO,EAAE;AACvD,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/http.ts"],"sourcesContent":["/**\n * HTTP transport entry point for Product Brain MCP.\n *\n * Serves the MCP protocol over Streamable HTTP for web clients\n * (Claude web app, API consumers) that can't spawn local processes.\n *\n * Implements the full MCP OAuth 2.1 spec (Nov 2025):\n *   1. Protected Resource Metadata  (/.well-known/oauth-protected-resource)\n *   2. Authorization Server Metadata (/.well-known/oauth-authorization-server)\n *   3. Dynamic Client Registration   (POST /register)\n *   4. Authorization Code + PKCE     (GET/POST /authorize)\n *   5. Token Exchange                (POST /oauth/token)\n *\n * Env:\n *   CONVEX_SITE_URL  — Convex deployment URL (defaults to cloud)\n *   PORT / MCP_PORT  — Listen port (default 3000)\n *   CORS_ORIGINS     — Comma-separated allowed origins (default: all)\n *   PB_MODULES       — Comma-separated modules (default: core,gitchain,arch)\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport express from \"express\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport rateLimit from \"express-rate-limit\";\n\nimport { bootstrapHttp } from \"./client.js\";\nimport { runWithAuth } from \"./auth.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\nimport { initAnalytics, shutdownAnalytics, getPostHogClient } from \"./analytics.js\";\nimport { initFeatureFlags } from \"./featureFlags.js\";\n\n// ── Bootstrap ───────────────────────────────────────────────────────────\n\nbootstrapHttp();\ninitAnalytics();\ninitFeatureFlags(getPostHogClient());\n\nconst PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? \"3002\", 10);\n\nfunction baseUrl(req: any): string {\n  const proto = req.headers[\"x-forwarded-proto\"] ?? req.protocol ?? \"http\";\n  const host = req.headers.host ?? `localhost:${PORT}`;\n  return `${proto}://${host}`;\n}\n\n// ── Express App ─────────────────────────────────────────────────────────\n\nconst app = express();\n// Required when behind a reverse proxy (e.g. Railway): rate limiter uses X-Forwarded-For\n// and throws ERR_ERL_UNEXPECTED_X_FORWARDED_FOR if trust proxy is false.\napp.set(\"trust proxy\", 1);\napp.use(express.json());\n\n// CORS — fail-closed; requires CORS_ORIGINS to be explicitly configured.\nconst ALLOWED_ORIGINS = process.env.CORS_ORIGINS\n  ?.split(\",\")\n  .map((o) => o.trim())\n  .filter(Boolean);\n\napp.use((_req: any, res: any, next: any) => {\n  const origin = _req.headers.origin;\n  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {\n    res.setHeader(\"Access-Control-Allow-Origin\", origin);\n  }\n  res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n  res.setHeader(\n    \"Access-Control-Allow-Headers\",\n    \"Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id\",\n  );\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Mcp-Session-Id\");\n  if (_req.method === \"OPTIONS\") {\n    res.status(204).end();\n    return;\n  }\n  next();\n});\n\n// ── OAuth: Protected Resource Metadata (RFC 9728) ────────────────────────\n// Step 1 of MCP auth: Claude fetches this to discover the authorization server.\n\napp.get(\"/.well-known/oauth-protected-resource\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    resource: base,\n    authorization_servers: [base],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n    bearer_methods_supported: [\"header\"],\n  });\n});\n\n// ── OAuth: Authorization Server Metadata (RFC 8414) ──────────────────────\n// Step 2: Claude fetches this to discover authorize, token, and register endpoints.\n\napp.get(\"/.well-known/oauth-authorization-server\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    issuer: base,\n    authorization_endpoint: `${base}/authorize`,\n    token_endpoint: `${base}/oauth/token`,\n    registration_endpoint: `${base}/register`,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n  });\n});\n\n// ── OAuth: Dynamic Client Registration (RFC 7591) ────────────────────────\n// Step 3: Claude registers itself as a client before starting the auth flow.\n\ninterface RegisteredClient {\n  client_id: string;\n  redirect_uris: string[];\n  client_name?: string;\n  registeredAt: number;\n}\n\nconst registeredClients = new Map<string, RegisteredClient>();\n\napp.post(\n  \"/register\",\n  express.json(),\n  (req: any, res: any) => {\n    const { redirect_uris, client_name } = req.body;\n\n    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {\n      res.status(400).json({\n        error: \"invalid_client_metadata\",\n        error_description: \"redirect_uris is required\",\n      });\n      return;\n    }\n\n    const clientId = `pb_client_${randomUUID()}`;\n    const client: RegisteredClient = {\n      client_id: clientId,\n      redirect_uris,\n      client_name,\n      registeredAt: Date.now(),\n    };\n    registeredClients.set(clientId, client);\n\n    res.status(201).json({\n      client_id: clientId,\n      client_name: client_name ?? \"MCP Client\",\n      redirect_uris,\n      grant_types: [\"authorization_code\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\",\n    });\n  },\n);\n\n// ── OAuth: Authorization Code + PKCE ─────────────────────────────────────\n// Step 4: User enters their pb_sk_* key, server generates a one-time code.\n\ninterface PendingAuth {\n  apiKey: string;\n  codeChallenge: string;\n  redirectUri: string;\n  expiresAt: number;\n}\n\nconst pendingCodes = new Map<string, PendingAuth>();\n\n// Refresh token store — declared here so the cleanup interval can reference it.\nconst ACCESS_TOKEN_TTL = 3600; // 1 hour\nconst REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60_000; // 90 days\n\ninterface RefreshEntry {\n  apiKey: string;\n  createdAt: number;\n}\n\nconst refreshTokens = new Map<string, RefreshEntry>();\n\nsetInterval(() => {\n  const now = Date.now();\n  for (const [code, auth] of pendingCodes) {\n    if (now > auth.expiresAt) pendingCodes.delete(code);\n  }\n  for (const [id, client] of registeredClients) {\n    if (now - client.registeredAt > 24 * 60 * 60_000) registeredClients.delete(id);\n  }\n  for (const [token, entry] of refreshTokens) {\n    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);\n  }\n}, 60_000);\n\nfunction esc(s: unknown): string {\n  return String(s ?? \"\").replace(/[&\"<>]/g, (c) =>\n    ({ \"&\": \"&amp;\", '\"': \"&quot;\", \"<\": \"&lt;\", \">\": \"&gt;\" })[c]!,\n  );\n}\n\napp.get(\"/authorize\", (req: any, res: any) => {\n  const { redirect_uri, code_challenge, code_challenge_method, state } =\n    req.query;\n  res.type(\"html\").send(`<!DOCTYPE html>\n<html lang=\"en\"><head>\n<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>Authorize — Product Brain</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;\n  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}\n.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}\nh1{font-size:1.2rem;margin-bottom:.25rem}\n.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}\nlabel{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}\ninput[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;\n  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}\ninput:focus{outline:none;border-color:#7c3aed}\nbutton{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;\n  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}\nbutton:hover{background:#6d28d9}\n.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}\n</style></head><body>\n<div class=\"card\">\n<h1>Product Brain</h1>\n<p class=\"sub\">Enter your API key to connect Claude to your workspace.</p>\n<form method=\"POST\" action=\"/authorize\">\n  <input type=\"hidden\" name=\"redirect_uri\" value=\"${esc(redirect_uri)}\">\n  <input type=\"hidden\" name=\"code_challenge\" value=\"${esc(code_challenge)}\">\n  <input type=\"hidden\" name=\"code_challenge_method\" value=\"${esc(code_challenge_method)}\">\n  <input type=\"hidden\" name=\"state\" value=\"${esc(state)}\">\n  <label for=\"k\">API Key</label>\n  <input type=\"password\" id=\"k\" name=\"api_key\" placeholder=\"pb_sk_…\" required autofocus>\n  <p class=\"err\" id=\"e\">Key must start with pb_sk_</p>\n  <button type=\"submit\">Authorize</button>\n</form>\n</div>\n<script>document.querySelector(\"form\").onsubmit=function(e){\nif(!document.getElementById(\"k\").value.startsWith(\"pb_sk_\")){\ne.preventDefault();document.getElementById(\"e\").style.display=\"block\"}}</script>\n</body></html>`);\n});\n\napp.post(\n  \"/authorize\",\n  express.urlencoded({ extended: false }),\n  (req: any, res: any) => {\n    const { api_key, redirect_uri, code_challenge, state } = req.body;\n\n    if (!api_key?.startsWith(\"pb_sk_\")) {\n      res.status(400).send(\"Invalid API key\");\n      return;\n    }\n\n    const code = randomUUID();\n    pendingCodes.set(code, {\n      apiKey: api_key,\n      codeChallenge: code_challenge,\n      redirectUri: redirect_uri,\n      expiresAt: Date.now() + 5 * 60_000,\n    });\n\n    const url = new URL(redirect_uri);\n    url.searchParams.set(\"code\", code);\n    if (state) url.searchParams.set(\"state\", state);\n    res.redirect(302, url.toString());\n  },\n);\n\n// ── OAuth: Token Exchange ────────────────────────────────────────────────\n// Step 5: Claude exchanges the authorization code (with PKCE verifier) for a token.\n// Supports both authorization_code and refresh_token grants.\n\nfunction issueTokens(apiKey: string): object {\n  const refreshToken = `pb_rt_${randomUUID()}`;\n  refreshTokens.set(refreshToken, { apiKey, createdAt: Date.now() });\n  return {\n    access_token: apiKey,\n    token_type: \"Bearer\",\n    expires_in: ACCESS_TOKEN_TTL,\n    refresh_token: refreshToken,\n  };\n}\n\napp.post(\n  \"/oauth/token\",\n  express.urlencoded({ extended: false }),\n  express.json(),\n  (req: any, res: any) => {\n    const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n      req.body;\n\n    if (grant_type === \"refresh_token\") {\n      const entry = refreshTokens.get(refresh_token);\n      if (!entry) {\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Invalid refresh token\" });\n        return;\n      }\n      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {\n        refreshTokens.delete(refresh_token);\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Refresh token expired\" });\n        return;\n      }\n      // Rotate: revoke old, issue new pair\n      const apiKey = entry.apiKey;\n      refreshTokens.delete(refresh_token);\n      res.json(issueTokens(apiKey));\n      return;\n    }\n\n    if (grant_type !== \"authorization_code\") {\n      res.status(400).json({ error: \"unsupported_grant_type\" });\n      return;\n    }\n\n    const pending = pendingCodes.get(code);\n    if (!pending || pending.redirectUri !== redirect_uri) {\n      res.status(400).json({ error: \"invalid_grant\" });\n      return;\n    }\n\n    // PKCE S256 validation\n    const challenge = createHash(\"sha256\")\n      .update(code_verifier ?? \"\")\n      .digest(\"base64url\");\n    if (challenge !== pending.codeChallenge) {\n      pendingCodes.delete(code);\n      res.status(400).json({\n        error: \"invalid_grant\",\n        error_description: \"PKCE verification failed\",\n      });\n      return;\n    }\n\n    pendingCodes.delete(code);\n    res.json(issueTokens(pending.apiKey));\n  },\n);\n\n// ── Rate Limiting ────────────────────────────────────────────────────────\n\nconst mcpLimiter = rateLimit({\n  windowMs: 60_000,\n  max: 120,\n  standardHeaders: true,\n  legacyHeaders: false,\n  message: { error: \"Too many requests. Try again later.\" },\n});\n\n// ── Health Check ─────────────────────────────────────────────────────────\n\napp.get(\"/health\", (_req: any, res: any) => {\n  res.json({ status: \"ok\", version: SERVER_VERSION, transport: \"http\" });\n});\n\n// ── Session Management ──────────────────────────────────────────────────\n\ninterface SessionEntry {\n  transport: StreamableHTTPServerTransport;\n  lastAccess: number;\n}\n\nconst sessions = new Map<string, SessionEntry>();\nconst SESSION_TTL_MS = 30 * 60 * 1000;\nconst MAX_SESSIONS = 200;\n\nfunction evictStaleSessions(): void {\n  const now = Date.now();\n  for (const [id, entry] of sessions) {\n    if (now - entry.lastAccess > SESSION_TTL_MS) {\n      logSessionLifecycle(\"session_deleted\", id, \"ttl\");\n      entry.transport.close().catch(() => {});\n      sessions.delete(id);\n    }\n  }\n  if (sessions.size > MAX_SESSIONS) {\n    const sorted = [...sessions.entries()].sort(\n      (a, b) => a[1].lastAccess - b[1].lastAccess,\n    );\n    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {\n      logSessionLifecycle(\"session_deleted\", sorted[i][0], \"eviction\");\n      sorted[i][1].transport.close().catch(() => {});\n      sessions.delete(sorted[i][0]);\n    }\n  }\n}\n\nsetInterval(evictStaleSessions, 60_000);\n\n// ── Auth Helpers ─────────────────────────────────────────────────────────\n\nfunction extractBearerKey(req: any): string | null {\n  const header = req.headers?.authorization;\n  if (typeof header !== \"string\" || !header.startsWith(\"Bearer \")) return null;\n  const token = header.slice(7).trim();\n  return token.startsWith(\"pb_sk_\") ? token : null;\n}\n\nfunction send401(req: any, res: any): void {\n  const base = baseUrl(req);\n  res\n    .status(401)\n    .set(\n      \"WWW-Authenticate\",\n      `Bearer resource_metadata=\"${base}/.well-known/oauth-protected-resource\"`,\n    )\n    .json({ error: \"unauthorized\" });\n}\n\nfunction logRequest(\n  method: string,\n  outcome: \"ok\" | \"auth_fail\" | \"error\",\n  sessionId?: string,\n  durationMs?: number,\n): void {\n  const ts = new Date().toISOString();\n  const sid = sessionId ? ` session=${sessionId}` : \"\";\n  const dur = durationMs != null ? ` duration=${durationMs}ms` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}${dur}\\n`);\n}\n\nfunction logSessionLifecycle(\n  event: \"session_created\" | \"session_deleted\",\n  sessionId: string,\n  reason?: \"ttl\" | \"eviction\" | \"onclose\",\n): void {\n  const ts = new Date().toISOString();\n  const r = reason ? ` reason=${reason}` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}\\n`);\n}\n\n// ── MCP Handlers ────────────────────────────────────────────────────────\n\napp.post(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"POST\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  const reqStart = Date.now();\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      if (sessionId && sessions.has(sessionId)) {\n        const entry = sessions.get(sessionId)!;\n        entry.lastAccess = Date.now();\n        await entry.transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", sessionId, Date.now() - reqStart);\n      } else if (!sessionId && isInitializeRequest(req.body)) {\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: () => randomUUID(),\n          onsessioninitialized: (sid: string) => {\n            sessions.set(sid, { transport, lastAccess: Date.now() });\n            logSessionLifecycle(\"session_created\", sid);\n          },\n        });\n\n        transport.onclose = () => {\n          const sid = transport.sessionId;\n          if (sid) {\n            logSessionLifecycle(\"session_deleted\", sid, \"onclose\");\n            sessions.delete(sid);\n          }\n        };\n\n        const server = createProductBrainServer();\n        await server.connect(transport);\n        await transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", transport.sessionId ?? undefined, Date.now() - reqStart);\n      } else {\n        process.stderr.write(\n          `[HTTP] ${new Date().toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)\\n`,\n        );\n        res.status(400).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Bad Request: no valid session ID provided\" },\n          id: null,\n        });\n      }\n    });\n  } catch (err: any) {\n    logRequest(\"POST\", \"error\", sessionId, Date.now() - reqStart);\n    if (!res.headersSent) {\n      res.status(500).json({\n        jsonrpc: \"2.0\",\n        error: { code: -32603, message: \"Internal server error\" },\n        id: null,\n      });\n    }\n  }\n});\n\napp.get(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"GET\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      entry.lastAccess = Date.now();\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"GET\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"GET\", \"error\", sessionId);\n  }\n});\n\napp.delete(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"DELETE\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"DELETE\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"DELETE\", \"error\", sessionId);\n  }\n});\n\n// ── Start ───────────────────────────────────────────────────────────────\n\nprocess.on(\"unhandledRejection\", (reason) => {\n  const msg = reason instanceof Error ? reason.message : String(reason);\n  console.error(`[MCP HTTP] Unhandled rejection: ${msg}`);\n});\n\nprocess.on(\"uncaughtException\", (err) => {\n  console.error(`[MCP HTTP] Uncaught exception: ${err.stack ?? err.message}`);\n  gracefulShutdown();\n});\n\nlet shuttingDown = false;\nasync function gracefulShutdown() {\n  if (shuttingDown) return;\n  shuttingDown = true;\n  setTimeout(() => process.exit(1), 3_000).unref();\n  console.log(\"Shutting down...\");\n  for (const [, entry] of sessions) {\n    await entry.transport.close().catch(() => {});\n  }\n  try {\n    await shutdownAnalytics();\n  } catch {\n    /* best-effort */\n  }\n  process.exit(0);\n}\n\n// Bind all interfaces — Railway/Cloudflare reach the container on its non-loopback IP.\n// Loopback-only (127.0.0.1) causes edge 502: the proxy never connects to localhost inside the pod.\nconst LISTEN_HOST = \"0.0.0.0\";\nconst httpServer = app.listen(PORT, LISTEN_HOST, () => {\n  console.log(\n    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`,\n  );\n});\nhttpServer.on(\"error\", (err) => {\n  console.error(`[MCP HTTP] Server error: ${err.message}`);\n  process.exit(1);\n});\n\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,SAAS,YAAY,kBAAkB;AACvC,OAAO,aAAa;AACpB,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AACpC,OAAO,eAAe;AAUtB,cAAc;AACd,cAAc;AACd,iBAAiB,iBAAiB,CAAC;AAEnC,IAAM,OAAO,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY,QAAQ,EAAE;AAE5E,SAAS,QAAQ,KAAkB;AACjC,QAAM,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,IAAI,YAAY;AAClE,QAAM,OAAO,IAAI,QAAQ,QAAQ,aAAa,IAAI;AAClD,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAIA,IAAM,MAAM,QAAQ;AAGpB,IAAI,IAAI,eAAe,CAAC;AACxB,IAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,IAAM,kBAAkB,QAAQ,IAAI,cAChC,MAAM,GAAG,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,IAAI,IAAI,CAAC,MAAW,KAAU,SAAc;AAC1C,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,mBAAmB,UAAU,gBAAgB,SAAS,MAAM,GAAG;AACjE,QAAI,UAAU,+BAA+B,MAAM;AAAA,EACrD;AACA,MAAI,UAAU,gCAAgC,4BAA4B;AAC1E,MAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,iCAAiC,gBAAgB;AAC/D,MAAI,KAAK,WAAW,WAAW;AAC7B,QAAI,OAAO,GAAG,EAAE,IAAI;AACpB;AAAA,EACF;AACA,OAAK;AACP,CAAC;AAKD,IAAI,IAAI,yCAAyC,CAAC,KAAU,QAAa;AACvE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,UAAU;AAAA,IACV,uBAAuB,CAAC,IAAI;AAAA,IAC5B,kBAAkB,CAAC,aAAa,eAAe;AAAA,IAC/C,0BAA0B,CAAC,QAAQ;AAAA,EACrC,CAAC;AACH,CAAC;AAKD,IAAI,IAAI,2CAA2C,CAAC,KAAU,QAAa;AACzE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,QAAQ;AAAA,IACR,wBAAwB,GAAG,IAAI;AAAA,IAC/B,gBAAgB,GAAG,IAAI;AAAA,IACvB,uBAAuB,GAAG,IAAI;AAAA,IAC9B,0BAA0B,CAAC,MAAM;AAAA,IACjC,uBAAuB,CAAC,sBAAsB,eAAe;AAAA,IAC7D,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA,IAC9C,kBAAkB,CAAC,aAAa,eAAe;AAAA,EACjD,CAAC;AACH,CAAC;AAYD,IAAM,oBAAoB,oBAAI,IAA8B;AAE5D,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,eAAe,YAAY,IAAI,IAAI;AAE3C,QAAI,CAAC,MAAM,QAAQ,aAAa,KAAK,cAAc,WAAW,GAAG;AAC/D,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,WAAW,CAAC;AAC1C,UAAM,SAA2B;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,IACzB;AACA,sBAAkB,IAAI,UAAU,MAAM;AAEtC,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACnB,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,CAAC,oBAAoB;AAAA,MAClC,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;AAYA,IAAM,eAAe,oBAAI,IAAyB;AAGlD,IAAM,mBAAmB;AACzB,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAO5C,IAAM,gBAAgB,oBAAI,IAA0B;AAEpD,YAAY,MAAM;AAChB,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACvC,QAAI,MAAM,KAAK,UAAW,cAAa,OAAO,IAAI;AAAA,EACpD;AACA,aAAW,CAAC,IAAI,MAAM,KAAK,mBAAmB;AAC5C,QAAI,MAAM,OAAO,eAAe,KAAK,KAAK,IAAQ,mBAAkB,OAAO,EAAE;AAAA,EAC/E;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,eAAe;AAC1C,QAAI,MAAM,MAAM,YAAY,qBAAsB,eAAc,OAAO,KAAK;AAAA,EAC9E;AACF,GAAG,GAAM;AAET,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,KAAK,EAAE,EAAE;AAAA,IAAQ;AAAA,IAAW,CAAC,OACxC,EAAE,KAAK,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAK,OAAO,GAAG,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,IAAI,cAAc,CAAC,KAAU,QAAa;AAC5C,QAAM,EAAE,cAAc,gBAAgB,uBAAuB,MAAM,IACjE,IAAI;AACN,MAAI,KAAK,MAAM,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oDAwB4B,IAAI,YAAY,CAAC;AAAA,sDACf,IAAI,cAAc,CAAC;AAAA,6DACZ,IAAI,qBAAqB,CAAC;AAAA,6CAC1C,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAUxC;AACf,CAAC;AAED,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,SAAS,cAAc,gBAAgB,MAAM,IAAI,IAAI;AAE7D,QAAI,CAAC,SAAS,WAAW,QAAQ,GAAG;AAClC,UAAI,OAAO,GAAG,EAAE,KAAK,iBAAiB;AACtC;AAAA,IACF;AAEA,UAAM,OAAO,WAAW;AACxB,iBAAa,IAAI,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW,KAAK,IAAI,IAAI,IAAI;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,IAAI,YAAY;AAChC,QAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,QAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,QAAI,SAAS,KAAK,IAAI,SAAS,CAAC;AAAA,EAClC;AACF;AAMA,SAAS,YAAY,QAAwB;AAC3C,QAAM,eAAe,SAAS,WAAW,CAAC;AAC1C,gBAAc,IAAI,cAAc,EAAE,QAAQ,WAAW,KAAK,IAAI,EAAE,CAAC;AACjE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB;AACF;AAEA,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,YAAY,MAAM,eAAe,cAAc,cAAc,IACnE,IAAI;AAEN,QAAI,eAAe,iBAAiB;AAClC,YAAM,QAAQ,cAAc,IAAI,aAAa;AAC7C,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,MAAM,YAAY,sBAAsB;AACvD,sBAAc,OAAO,aAAa;AAClC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AACrB,oBAAc,OAAO,aAAa;AAClC,UAAI,KAAK,YAAY,MAAM,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,eAAe,sBAAsB;AACvC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,IAAI,IAAI;AACrC,QAAI,CAAC,WAAW,QAAQ,gBAAgB,cAAc;AACpD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC/C;AAAA,IACF;AAGA,UAAM,YAAY,WAAW,QAAQ,EAClC,OAAO,iBAAiB,EAAE,EAC1B,OAAO,WAAW;AACrB,QAAI,cAAc,QAAQ,eAAe;AACvC,mBAAa,OAAO,IAAI;AACxB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,iBAAa,OAAO,IAAI;AACxB,QAAI,KAAK,YAAY,QAAQ,MAAM,CAAC;AAAA,EACtC;AACF;AAIA,IAAM,aAAa,UAAU;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,sCAAsC;AAC1D,CAAC;AAID,IAAI,IAAI,WAAW,CAAC,MAAW,QAAa;AAC1C,MAAI,KAAK,EAAE,QAAQ,MAAM,SAAS,gBAAgB,WAAW,OAAO,CAAC;AACvE,CAAC;AASD,IAAM,WAAW,oBAAI,IAA0B;AAC/C,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,eAAe;AAErB,SAAS,qBAA2B;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,IAAI,KAAK,KAAK,UAAU;AAClC,QAAI,MAAM,MAAM,aAAa,gBAAgB;AAC3C,0BAAoB,mBAAmB,IAAI,KAAK;AAChD,YAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACtC,eAAS,OAAO,EAAE;AAAA,IACpB;AAAA,EACF;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,UAAM,SAAS,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE;AAAA,MACrC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;AAAA,IACnC;AACA,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,cAAc,KAAK;AACrD,0BAAoB,mBAAmB,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU;AAC/D,aAAO,CAAC,EAAE,CAAC,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC7C,eAAS,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,YAAY,oBAAoB,GAAM;AAItC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,SAAS;AAC5B,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AACxE,QAAM,QAAQ,OAAO,MAAM,CAAC,EAAE,KAAK;AACnC,SAAO,MAAM,WAAW,QAAQ,IAAI,QAAQ;AAC9C;AAEA,SAAS,QAAQ,KAAU,KAAgB;AACzC,QAAM,OAAO,QAAQ,GAAG;AACxB,MACG,OAAO,GAAG,EACV;AAAA,IACC;AAAA,IACA,6BAA6B,IAAI;AAAA,EACnC,EACC,KAAK,EAAE,OAAO,eAAe,CAAC;AACnC;AAEA,SAAS,WACP,QACA,SACA,WACA,YACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,MAAM,YAAY,YAAY,SAAS,KAAK;AAClD,QAAM,MAAM,cAAc,OAAO,aAAa,UAAU,OAAO;AAC/D,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,OAAO,GAAG,GAAG,GAAG,GAAG;AAAA,CAAI;AACxE;AAEA,SAAS,oBACP,OACA,WACA,QACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,IAAI,SAAS,WAAW,MAAM,KAAK;AACzC,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,KAAK,YAAY,SAAS,GAAG,CAAC;AAAA,CAAI;AACzE;AAIA,IAAI,KAAK,QAAQ,YAAY,OAAO,KAAU,QAAa;AACzD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,QAAQ,WAAW;AAC9B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,QAAM,WAAW,KAAK,IAAI;AAE1B,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,UAAI,aAAa,SAAS,IAAI,SAAS,GAAG;AACxC,cAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,cAAM,aAAa,KAAK,IAAI;AAC5B,cAAM,MAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AACtD,mBAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAC3D,WAAW,CAAC,aAAa,oBAAoB,IAAI,IAAI,GAAG;AACtD,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB,MAAM,WAAW;AAAA,UACrC,sBAAsB,CAAC,QAAgB;AACrC,qBAAS,IAAI,KAAK,EAAE,WAAW,YAAY,KAAK,IAAI,EAAE,CAAC;AACvD,gCAAoB,mBAAmB,GAAG;AAAA,UAC5C;AAAA,QACF,CAAC;AAED,kBAAU,UAAU,MAAM;AACxB,gBAAM,MAAM,UAAU;AACtB,cAAI,KAAK;AACP,gCAAoB,mBAAmB,KAAK,SAAS;AACrD,qBAAS,OAAO,GAAG;AAAA,UACrB;AAAA,QACF;AAEA,cAAM,SAAS,yBAAyB;AACxC,cAAM,OAAO,QAAQ,SAAS;AAC9B,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAChD,mBAAW,QAAQ,MAAM,UAAU,aAAa,QAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAClF,OAAO;AACL,gBAAQ,OAAO;AAAA,UACb,WAAU,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA,QACpC;AACA,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,4CAA4C;AAAA,UAC5E,IAAI;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,eAAW,QAAQ,SAAS,WAAW,KAAK,IAAI,IAAI,QAAQ;AAC5D,QAAI,CAAC,IAAI,aAAa;AACpB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,QACxD,IAAI;AAAA,MACN,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,QAAQ,YAAY,OAAO,KAAU,QAAa;AACxD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,OAAO,WAAW;AAC7B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,aAAa,KAAK,IAAI;AAC5B,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,OAAO,MAAM,SAAS;AAAA,IACnC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,OAAO,SAAS,SAAS;AAAA,EACtC;AACF,CAAC;AAED,IAAI,OAAO,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC3D,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,UAAU,WAAW;AAChC,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,UAAU,MAAM,SAAS;AAAA,IACtC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,UAAU,SAAS,SAAS;AAAA,EACzC;AACF,CAAC;AAID,QAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,QAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACpE,UAAQ,MAAM,mCAAmC,GAAG,EAAE;AACxD,CAAC;AAED,QAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,UAAQ,MAAM,kCAAkC,IAAI,SAAS,IAAI,OAAO,EAAE;AAC1E,mBAAiB;AACnB,CAAC;AAED,IAAI,eAAe;AACnB,eAAe,mBAAmB;AAChC,MAAI,aAAc;AAClB,iBAAe;AACf,aAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAK,EAAE,MAAM;AAC/C,UAAQ,IAAI,kBAAkB;AAC9B,aAAW,CAAC,EAAE,KAAK,KAAK,UAAU;AAChC,UAAM,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC9C;AACA,MAAI;AACF,UAAM,kBAAkB;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,UAAQ,KAAK,CAAC;AAChB;AAIA,IAAM,cAAc;AACpB,IAAM,aAAa,IAAI,OAAO,MAAM,aAAa,MAAM;AACrD,UAAQ;AAAA,IACN,kCAAkC,cAAc,iBAAiB,WAAW,IAAI,IAAI;AAAA,EACtF;AACF,CAAC;AACD,WAAW,GAAG,SAAS,CAAC,QAAQ;AAC9B,UAAQ,MAAM,4BAA4B,IAAI,OAAO,EAAE;AACvD,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;","names":[]}

package/dist/index.js

@@ -2,7 +2,7 @@
 import {
   SERVER_VERSION,
   createProductBrainServer
-} from "./chunk-O337N4MC.js";
+} from "./chunk-ZFODPVNH.js";
 import {
   bootstrap,
   getAgentSessionId,
@@ -11,13 +11,13 @@ import {
   orphanAgentSession,
   recoverSessionState,
   startAgentSession
-} from "./chunk-DHBJFEAT.js";
+} from "./chunk-G4WJIWXX.js";
 import {
   getPostHogClient,
   initAnalytics,
   shutdownAnalytics,
   trackSessionStarted
-} from "./chunk-RQXM3TCI.js";
+} from "./chunk-2ZWGQ6PK.js";
 
 // src/index.ts
 import { readFileSync } from "fs";

package/dist/{setup-GQ3LQS2L.js → setup-2JWIZ3QO.js}

@@ -7,14 +7,14 @@ import {
   trackSetupCompleted,
   trackSetupStarted,
   writeClientConfig
-} from "./chunk-RQXM3TCI.js";
+} from "./chunk-2ZWGQ6PK.js";
 
 // src/cli/setup.ts
 import { execSync } from "child_process";
 import { createInterface } from "readline";
 import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
-var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://productbrain.io";
+var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://work.productbrain.io";
 function bold(s) {
   return `\x1B[1m${s}\x1B[0m`;
 }
@@ -294,4 +294,4 @@ function printClaudeSnippet() {
 export {
   runSetup
 };
-//# sourceMappingURL=setup-GQ3LQS2L.js.map
+//# sourceMappingURL=setup-2JWIZ3QO.js.map

package/dist/setup-2JWIZ3QO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/setup.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * `npx @productbrain/mcp setup`\n *\n * Guided onboarding: get API key from the app, paste it, write MCP config,\n * and optionally install Cursor rules/skills (additive-only).\n */\n\nimport { execSync } from \"node:child_process\";\nimport { createInterface } from \"node:readline\";\nimport { existsSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { resolveClient, writeClientConfig, MCP_NPX_PACKAGE, type McpClientInfo } from \"./config-writer.js\";\nimport { initAnalytics, trackSetupStarted, trackSetupCompleted, shutdownAnalytics } from \"../analytics.js\";\n\nconst APP_URL =\n  process.env.PRODUCTBRAIN_APP_URL ?? \"https://work.productbrain.io\";\n\n// ── Helpers ─────────────────────────────────────────────────────────────\n\nfunction bold(s: string) {\n  return `\\x1b[1m${s}\\x1b[0m`;\n}\nfunction green(s: string) {\n  return `\\x1b[32m${s}\\x1b[0m`;\n}\nfunction dim(s: string) {\n  return `\\x1b[2m${s}\\x1b[0m`;\n}\nfunction orange(s: string) {\n  return `\\x1b[33m${s}\\x1b[0m`;\n}\n\nfunction log(msg: string) {\n  process.stdout.write(`${msg}\\n`);\n}\n\nfunction openBrowser(url: string) {\n  const platform = process.platform;\n  try {\n    if (platform === \"darwin\") execSync(`open \"${url}\"`);\n    else if (platform === \"win32\") execSync(`start \"\" \"${url}\"`);\n    else execSync(`xdg-open \"${url}\"`);\n  } catch {\n    log(dim(`  Could not open browser automatically.`));\n    log(`  Open this URL manually: ${url}`);\n  }\n}\n\nfunction prompt(question: string): Promise<string> {\n  return new Promise((resolve) => {\n    const rl = createInterface({ input: process.stdin, output: process.stdout });\n    rl.question(question, (answer) => {\n      rl.close();\n      resolve(answer.trim());\n    });\n  });\n}\n\nfunction promptChoice(question: string, choices: string[]): Promise<number> {\n  return new Promise((resolve) => {\n    log(\"\");\n    log(bold(question));\n    choices.forEach((c, i) => log(`  ${i + 1}) ${c}`));\n    const rl = createInterface({ input: process.stdin, output: process.stdout });\n    rl.question(`\\n  ${dim(\"Choice [1]:\")} `, (line) => {\n      rl.close();\n      const n = parseInt(line.trim(), 10);\n      if (isNaN(n) || n < 1 || n > choices.length) {\n        resolve(0);\n      } else {\n        resolve(n - 1);\n      }\n    });\n  });\n}\n\n// ── Workspace Verification ───────────────────────────────────────────────\n\nconst DEFAULT_CLOUD_URL = \"https://trustworthy-kangaroo-277.convex.site\";\n\nasync function verifyWorkspace(\n  apiKey: string,\n): Promise<{ name: string; slug: string } | null> {\n  const siteUrl = process.env.CONVEX_SITE_URL\n    ?? process.env.PRODUCTBRAIN_URL\n    ?? DEFAULT_CLOUD_URL;\n\n  try {\n    const res = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify({ fn: \"resolveWorkspace\", args: {} }),\n    });\n\n    if (!res.ok) return null;\n    const json = (await res.json()) as {\n      data?: { name: string; slug: string } | null;\n      error?: string;\n    };\n    return json.data ?? null;\n  } catch {\n    return null;\n  }\n}\n\n// ── Main ────────────────────────────────────────────────────────────────\n\nexport async function runSetup() {\n  initAnalytics();\n  trackSetupStarted();\n\n  log(\"\");\n  log(bold(`  Product${orange(\"Brain\")} Setup`));\n  log(dim(\"  Connect your AI assistant to your chain\\n\"));\n\n  const apiKeysUrl = `${APP_URL}/settings/api-keys`;\n\n  log(`  ${dim(\"1. Get your API key from Settings → API Keys\")}`);\n  log(`     ${dim(apiKeysUrl)}\\n`);\n\n  const openNow = await prompt(`  Open this URL in your browser? [Y/n]: `);\n  if (openNow.toLowerCase() !== \"n\" && openNow.toLowerCase() !== \"no\") {\n    openBrowser(apiKeysUrl);\n  }\n\n  log(\"\");\n  log(`  ${dim(\"2. Generate a key (if you don't have one), then copy it.\\n\")}`);\n\n  const apiKey = await prompt(`  Paste your API key (pb_sk_...): `);\n\n  if (!apiKey || !apiKey.startsWith(\"pb_sk_\")) {\n    log(`  ${orange(\"!\")} Invalid key format. Keys start with pb_sk_.`);\n    log(`  Get one at ${apiKeysUrl}\\n`);\n    await shutdownAnalytics();\n    process.exit(1);\n  }\n\n  log(`  ${green(\"✓\")} Key received`);\n\n  const workspace = await verifyWorkspace(apiKey);\n  if (workspace) {\n    log(`  ${green(\"✓\")} Connected to workspace: ${bold(workspace.name)} ${dim(`(${workspace.slug})`)}`);\n  } else {\n    log(`  ${orange(\"!\")} Could not verify workspace. Check your key at ${apiKeysUrl}`);\n  }\n  log(\"\");\n\n  const CLIENT_NAMES = [\"Cursor\", \"Claude Desktop\"] as const;\n  const options = [...CLIENT_NAMES, \"Other\"];\n\n  const choice = await promptChoice(\"Where do you want to set up Product Brain?\", options);\n\n  if (choice === 2) {\n    printConfigSnippet(apiKey);\n    trackSetupCompleted(\"Other\", \"snippet_shown\");\n  } else {\n    const client = resolveClient(CLIENT_NAMES[choice]);\n    if (client) {\n      const outcome = await writeConfig(client, apiKey);\n      trackSetupCompleted(CLIENT_NAMES[choice], outcome);\n    } else {\n      log(`  ${orange(\"!\")} ${CLIENT_NAMES[choice]} config path not available on this platform.`);\n      printConfigSnippet(apiKey);\n      trackSetupCompleted(CLIENT_NAMES[choice], \"write_error\");\n    }\n  }\n\n  // Cursor-specific: offer to install rule (additive-only)\n  if (choice === 0) {\n    await offerCursorRulesInstall();\n    printDeeplink(apiKey);\n  }\n\n  // Claude-specific: print snippet (never write to CLAUDE.md)\n  if (choice === 1) {\n    printClaudeSnippet();\n  }\n\n  log(\"\");\n  log(\n    `  ${green(\"✓\")} Done! Restart your AI assistant and try: ${bold('\"Start PB\"')}`,\n  );\n  printHelpLink();\n  await shutdownAnalytics();\n}\n\nasync function writeConfig(\n  client: McpClientInfo,\n  apiKey: string,\n): Promise<\"config_written\" | \"config_existed\" | \"write_error\"> {\n  try {\n    const wrote = await writeClientConfig(client, apiKey);\n    if (wrote) {\n      log(`  ${green(\"✓\")} Wrote config to ${dim(client.configPath)}`);\n      return \"config_written\";\n    } else {\n      log(`  ${dim(\"ℹ\")} ${client.name} already configured — skipped`);\n      return \"config_existed\";\n    }\n  } catch (err: any) {\n    log(`  ${orange(\"!\")} Could not write ${client.name} config: ${err.message}`);\n    printConfigSnippet(apiKey);\n    return \"write_error\";\n  }\n}\n\nfunction printHelpLink() {\n  log(`  ${dim(`Need help? See ${APP_URL}/settings/api-keys`)}`);\n  log(\"\");\n}\n\nfunction printConfigSnippet(apiKey: string) {\n  log(\"\");\n  log(bold(\"  Add this to your MCP client config:\\n\"));\n  const snippet = JSON.stringify(\n    {\n      mcpServers: {\n        \"Product Brain\": {\n          command: \"npx\",\n          args: [\"-y\", MCP_NPX_PACKAGE],\n          env: { PRODUCTBRAIN_API_KEY: apiKey },\n        },\n      },\n    },\n    null,\n    2,\n  );\n  for (const line of snippet.split(\"\\n\")) {\n    log(`    ${line}`);\n  }\n  log(\"\");\n}\n\n// ── Cursor Rules/Skills Install (additive-only) ─────────────────────────\n\nconst CURSOR_RULE_FILENAME = \"product-brain.mdc\";\n\nconst CURSOR_RULE_CONTENT = `---\ndescription: Product Brain MCP — single source of truth for product knowledge\nglobs:\nalwaysApply: true\n---\n\n# Product Brain MCP\n\nProduct Brain is your product knowledge base. The Chain is the single source of truth.\n\nEvery entry is either a **draft** (captured but not committed) or **committed** (on the Chain, SSOT).\nCommitting to the Chain is the compounding act.\n\n## Quick Start\n\nSay **\"Start PB\"** or **\"Start Product Brain\"** to begin. This single call:\n- Orients you to the workspace (readiness, gaps, planned work)\n- Unlocks write tools for the session\n- Surfaces your next recommended action\n\n## Tool Workflow\n\n1. **Start here**: \\`start\\` — workspace context + next action\n2. **Search**: \\`entries action=search\\` — find entries across all collections\n3. **Drill in**: \\`entries action=get\\` — full record with data, labels, relations\n4. **Context**: \\`context action=gather\\` — related knowledge around an entry or task\n5. **Capture**: \\`capture\\` — create knowledge with auto-linking + quality score\n6. **Commit**: \\`commit-entry\\` — promote drafts to SSOT when confirmation is still required\n7. **Connect**: \\`graph action=suggest\\` then \\`relations action=create\\` to build the graph\n\n## Bulk Knowledge Input\n\nWhen given a document or batch of knowledge to capture:\n1. Scan the input — identify all collections needed\n2. Call \\`collections action=list\\` — compare against what exists\n3. Propose missing collections to the user for confirmation\n4. Call \\`collections action=create\\` for each confirmed collection\n5. Then capture entries into the correct collections\n\nNever stuff entries into the wrong collection. Never silently skip knowledge.\n\n## Rules\n\n- In Open mode, user-authored captures can commit immediately unless the user asks to keep them as drafts.\n- In consensus/role modes, only call \\`commit-entry\\` when the user confirms.\n- Use \\`graph action=suggest\\` after capturing to discover and create relations.\n- Collections are dynamic — use \\`collections action=create\\` when the workspace needs new ones.\n- When lost, fetch \\`productbrain://orientation\\` for the full system map.\n`;\n\nfunction isCursorProject(): boolean {\n  return existsSync(join(process.cwd(), \".cursor\")) || existsSync(join(process.cwd(), \".cursorignore\"));\n}\n\nasync function offerCursorRulesInstall(): Promise<void> {\n  if (!isCursorProject()) return;\n\n  const answer = await prompt(`\\n  Install Product Brain rule for Cursor? [Y/n]: `);\n  if (answer.toLowerCase() === \"n\" || answer.toLowerCase() === \"no\") {\n    log(dim(\"  Skipped rule install.\"));\n    return;\n  }\n\n  const rulesDir = join(process.cwd(), \".cursor\", \"rules\");\n  const rulePath = join(rulesDir, CURSOR_RULE_FILENAME);\n\n  if (existsSync(rulePath)) {\n    log(`  ${dim(\"ℹ\")} Rule already exists at ${dim(rulePath)} — skipped`);\n    return;\n  }\n\n  if (!existsSync(rulesDir)) {\n    mkdirSync(rulesDir, { recursive: true });\n  }\n\n  writeFileSync(rulePath, CURSOR_RULE_CONTENT, \"utf-8\");\n  log(`  ${green(\"✓\")} Installed rule at ${dim(rulePath)}`);\n}\n\nfunction buildDeeplink(apiKey: string): string {\n  const config = JSON.stringify({\n    command: \"npx\",\n    args: [\"-y\", MCP_NPX_PACKAGE],\n    env: { PRODUCTBRAIN_API_KEY: apiKey },\n  });\n  const encoded = Buffer.from(config).toString(\"base64url\");\n  return `cursor://anysphere.cursor-deeplink/mcp/install?name=${encodeURIComponent(\"Product Brain\")}&config=${encoded}`;\n}\n\nfunction printDeeplink(apiKey: string): void {\n  const link = buildDeeplink(apiKey);\n  log(\"\");\n  log(`  ${dim(\"One-click install for Cursor (paste in browser):\")}`);\n  log(`  ${link}`);\n}\n\nfunction printClaudeSnippet(): void {\n  log(\"\");\n  log(bold(\"  For Claude Code / CLAUDE.md:\"));\n  log(dim(\"  Add this line to your ~/.claude/CLAUDE.md:\"));\n  log(\"\");\n  log(`    When Product Brain MCP is available, say \"Start PB\" at the beginning`);\n  log(`    of each session to orient to the workspace and unlock write tools.`);\n  log(`    In Open mode, user-authored captures can commit immediately unless the user asks to keep drafts.`);\n  log(`    In consensus/role modes, only commit when the user confirms.`);\n  log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;AASA,SAAS,gBAAgB;AACzB,SAAS,uBAAuB;AAChC,SAAS,YAAY,eAAe,iBAAiB;AACrD,SAAS,YAAY;AAIrB,IAAM,UACJ,QAAQ,IAAI,wBAAwB;AAItC,SAAS,KAAK,GAAW;AACvB,SAAO,UAAU,CAAC;AACpB;AACA,SAAS,MAAM,GAAW;AACxB,SAAO,WAAW,CAAC;AACrB;AACA,SAAS,IAAI,GAAW;AACtB,SAAO,UAAU,CAAC;AACpB;AACA,SAAS,OAAO,GAAW;AACzB,SAAO,WAAW,CAAC;AACrB;AAEA,SAAS,IAAI,KAAa;AACxB,UAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AACjC;AAEA,SAAS,YAAY,KAAa;AAChC,QAAM,WAAW,QAAQ;AACzB,MAAI;AACF,QAAI,aAAa,SAAU,UAAS,SAAS,GAAG,GAAG;AAAA,aAC1C,aAAa,QAAS,UAAS,aAAa,GAAG,GAAG;AAAA,QACtD,UAAS,aAAa,GAAG,GAAG;AAAA,EACnC,QAAQ;AACN,QAAI,IAAI,yCAAyC,CAAC;AAClD,QAAI,6BAA6B,GAAG,EAAE;AAAA,EACxC;AACF;AAEA,SAAS,OAAO,UAAmC;AACjD,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,OAAG,SAAS,UAAU,CAAC,WAAW;AAChC,SAAG,MAAM;AACT,cAAQ,OAAO,KAAK,CAAC;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,aAAa,UAAkB,SAAoC;AAC1E,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,EAAE;AACN,QAAI,KAAK,QAAQ,CAAC;AAClB,YAAQ,QAAQ,CAAC,GAAG,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,OAAG,SAAS;AAAA,IAAO,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS;AAClD,SAAG,MAAM;AACT,YAAM,IAAI,SAAS,KAAK,KAAK,GAAG,EAAE;AAClC,UAAI,MAAM,CAAC,KAAK,IAAI,KAAK,IAAI,QAAQ,QAAQ;AAC3C,gBAAQ,CAAC;AAAA,MACX,OAAO;AACL,gBAAQ,IAAI,CAAC;AAAA,MACf;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAIA,IAAM,oBAAoB;AAE1B,eAAe,gBACb,QACgD;AAChD,QAAM,UAAU,QAAQ,IAAI,mBACvB,QAAQ,IAAI,oBACZ;AAEL,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC,YAAY;AAAA,MAC/D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,IAAI,oBAAoB,MAAM,CAAC,EAAE,CAAC;AAAA,IAC3D,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAI7B,WAAO,KAAK,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,WAAW;AAC/B,gBAAc;AACd,oBAAkB;AAElB,MAAI,EAAE;AACN,MAAI,KAAK,YAAY,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC7C,MAAI,IAAI,6CAA6C,CAAC;AAEtD,QAAM,aAAa,GAAG,OAAO;AAE7B,MAAI,KAAK,IAAI,mDAA8C,CAAC,EAAE;AAC9D,MAAI,QAAQ,IAAI,UAAU,CAAC;AAAA,CAAI;AAE/B,QAAM,UAAU,MAAM,OAAO,0CAA0C;AACvE,MAAI,QAAQ,YAAY,MAAM,OAAO,QAAQ,YAAY,MAAM,MAAM;AACnE,gBAAY,UAAU;AAAA,EACxB;AAEA,MAAI,EAAE;AACN,MAAI,KAAK,IAAI,4DAA4D,CAAC,EAAE;AAE5E,QAAM,SAAS,MAAM,OAAO,oCAAoC;AAEhE,MAAI,CAAC,UAAU,CAAC,OAAO,WAAW,QAAQ,GAAG;AAC3C,QAAI,KAAK,OAAO,GAAG,CAAC,8CAA8C;AAClE,QAAI,gBAAgB,UAAU;AAAA,CAAI;AAClC,UAAM,kBAAkB;AACxB,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,KAAK,MAAM,QAAG,CAAC,eAAe;AAElC,QAAM,YAAY,MAAM,gBAAgB,MAAM;AAC9C,MAAI,WAAW;AACb,QAAI,KAAK,MAAM,QAAG,CAAC,4BAA4B,KAAK,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,UAAU,IAAI,GAAG,CAAC,EAAE;AAAA,EACrG,OAAO;AACL,QAAI,KAAK,OAAO,GAAG,CAAC,kDAAkD,UAAU,EAAE;AAAA,EACpF;AACA,MAAI,EAAE;AAEN,QAAM,eAAe,CAAC,UAAU,gBAAgB;AAChD,QAAM,UAAU,CAAC,GAAG,cAAc,OAAO;AAEzC,QAAM,SAAS,MAAM,aAAa,8CAA8C,OAAO;AAEvF,MAAI,WAAW,GAAG;AAChB,uBAAmB,MAAM;AACzB,wBAAoB,SAAS,eAAe;AAAA,EAC9C,OAAO;AACL,UAAM,SAAS,cAAc,aAAa,MAAM,CAAC;AACjD,QAAI,QAAQ;AACV,YAAM,UAAU,MAAM,YAAY,QAAQ,MAAM;AAChD,0BAAoB,aAAa,MAAM,GAAG,OAAO;AAAA,IACnD,OAAO;AACL,UAAI,KAAK,OAAO,GAAG,CAAC,IAAI,aAAa,MAAM,CAAC,8CAA8C;AAC1F,yBAAmB,MAAM;AACzB,0BAAoB,aAAa,MAAM,GAAG,aAAa;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,WAAW,GAAG;AAChB,UAAM,wBAAwB;AAC9B,kBAAc,MAAM;AAAA,EACtB;AAGA,MAAI,WAAW,GAAG;AAChB,uBAAmB;AAAA,EACrB;AAEA,MAAI,EAAE;AACN;AAAA,IACE,KAAK,MAAM,QAAG,CAAC,6CAA6C,KAAK,YAAY,CAAC;AAAA,EAChF;AACA,gBAAc;AACd,QAAM,kBAAkB;AAC1B;AAEA,eAAe,YACb,QACA,QAC8D;AAC9D,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AACpD,QAAI,OAAO;AACT,UAAI,KAAK,MAAM,QAAG,CAAC,oBAAoB,IAAI,OAAO,UAAU,CAAC,EAAE;AAC/D,aAAO;AAAA,IACT,OAAO;AACL,UAAI,KAAK,IAAI,QAAG,CAAC,IAAI,OAAO,IAAI,oCAA+B;AAC/D,aAAO;AAAA,IACT;AAAA,EACF,SAAS,KAAU;AACjB,QAAI,KAAK,OAAO,GAAG,CAAC,oBAAoB,OAAO,IAAI,YAAY,IAAI,OAAO,EAAE;AAC5E,uBAAmB,MAAM;AACzB,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB;AACvB,MAAI,KAAK,IAAI,kBAAkB,OAAO,oBAAoB,CAAC,EAAE;AAC7D,MAAI,EAAE;AACR;AAEA,SAAS,mBAAmB,QAAgB;AAC1C,MAAI,EAAE;AACN,MAAI,KAAK,yCAAyC,CAAC;AACnD,QAAM,UAAU,KAAK;AAAA,IACnB;AAAA,MACE,YAAY;AAAA,QACV,iBAAiB;AAAA,UACf,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,eAAe;AAAA,UAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,OAAO,IAAI,EAAE;AAAA,EACnB;AACA,MAAI,EAAE;AACR;AAIA,IAAM,uBAAuB;AAE7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkD5B,SAAS,kBAA2B;AAClC,SAAO,WAAW,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC,KAAK,WAAW,KAAK,QAAQ,IAAI,GAAG,eAAe,CAAC;AACtG;AAEA,eAAe,0BAAyC;AACtD,MAAI,CAAC,gBAAgB,EAAG;AAExB,QAAM,SAAS,MAAM,OAAO;AAAA,iDAAoD;AAChF,MAAI,OAAO,YAAY,MAAM,OAAO,OAAO,YAAY,MAAM,MAAM;AACjE,QAAI,IAAI,yBAAyB,CAAC;AAClC;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,QAAQ,IAAI,GAAG,WAAW,OAAO;AACvD,QAAM,WAAW,KAAK,UAAU,oBAAoB;AAEpD,MAAI,WAAW,QAAQ,GAAG;AACxB,QAAI,KAAK,IAAI,QAAG,CAAC,2BAA2B,IAAI,QAAQ,CAAC,iBAAY;AACrE;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,cAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAAA,EACzC;AAEA,gBAAc,UAAU,qBAAqB,OAAO;AACpD,MAAI,KAAK,MAAM,QAAG,CAAC,sBAAsB,IAAI,QAAQ,CAAC,EAAE;AAC1D;AAEA,SAAS,cAAc,QAAwB;AAC7C,QAAM,SAAS,KAAK,UAAU;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,MAAM,eAAe;AAAA,IAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,EACtC,CAAC;AACD,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,WAAW;AACxD,SAAO,uDAAuD,mBAAmB,eAAe,CAAC,WAAW,OAAO;AACrH;AAEA,SAAS,cAAc,QAAsB;AAC3C,QAAM,OAAO,cAAc,MAAM;AACjC,MAAI,EAAE;AACN,MAAI,KAAK,IAAI,kDAAkD,CAAC,EAAE;AAClE,MAAI,KAAK,IAAI,EAAE;AACjB;AAEA,SAAS,qBAA2B;AAClC,MAAI,EAAE;AACN,MAAI,KAAK,gCAAgC,CAAC;AAC1C,MAAI,IAAI,8CAA8C,CAAC;AACvD,MAAI,EAAE;AACN,MAAI,0EAA0E;AAC9E,MAAI,wEAAwE;AAC5E,MAAI,sGAAsG;AAC1G,MAAI,kEAAkE;AACtE,MAAI,EAAE;AACR;","names":[]}

package/dist/{smart-capture-ATJ5F7R2.js → smart-capture-CVZ5PLUZ.js}

@@ -16,8 +16,8 @@ import {
   isClassificationAmbiguous,
   registerSmartCaptureTools,
   runContradictionCheck
-} from "./chunk-DHBJFEAT.js";
-import "./chunk-RQXM3TCI.js";
+} from "./chunk-G4WJIWXX.js";
+import "./chunk-2ZWGQ6PK.js";
 export {
   CLASSIFIABLE_COLLECTIONS,
   CLASSIFIER_AUTO_ROUTE_THRESHOLD,
@@ -38,4 +38,4 @@ export {
   registerSmartCaptureTools,
   runContradictionCheck
 };
-//# sourceMappingURL=smart-capture-ATJ5F7R2.js.map
+//# sourceMappingURL=smart-capture-CVZ5PLUZ.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productbrain/mcp",
-  "version": "0.0.1-beta.111",
+  "version": "0.0.1-beta.122",
   "description": "Product Brain — MCP server for AI-assisted product knowledge management",
   "type": "module",
   "engines": {