@productbrain/mcp 0.0.1-beta.16 → 0.0.1-beta.161

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/http.ts"],"sourcesContent":["/**\n * HTTP transport entry point for Product Brain MCP.\n *\n * Serves the MCP protocol over Streamable HTTP for web clients\n * (Claude web app, API consumers) that can't spawn local processes.\n *\n * Implements the full MCP OAuth 2.1 spec (Nov 2025):\n *   1. Protected Resource Metadata  (/.well-known/oauth-protected-resource)\n *   2. Authorization Server Metadata (/.well-known/oauth-authorization-server)\n *   3. Dynamic Client Registration   (POST /register)\n *   4. Authorization Code + PKCE     (GET/POST /authorize)\n *   5. Token Exchange                (POST /oauth/token)\n *\n * Env:\n *   CONVEX_SITE_URL  — Convex deployment URL (defaults to cloud)\n *   PORT / MCP_PORT  — Listen port (default 3000)\n *   CORS_ORIGINS     — Comma-separated allowed origins (default: all)\n *   PB_MODULES       — Comma-separated modules (default: core,gitchain,arch)\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport express from \"express\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport rateLimit from \"express-rate-limit\";\n\nimport { bootstrapHttp } from \"./client.js\";\nimport { runWithAuth } from \"./auth.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\nimport { initAnalytics, shutdownAnalytics } from \"./analytics.js\";\n\n// ── Bootstrap ───────────────────────────────────────────────────────────\n\nbootstrapHttp();\ninitAnalytics();\n\nconst PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? \"3000\", 10);\n\nfunction baseUrl(req: any): string {\n  const proto = req.headers[\"x-forwarded-proto\"] ?? req.protocol ?? \"http\";\n  const host = req.headers.host ?? `localhost:${PORT}`;\n  return `${proto}://${host}`;\n}\n\n// ── Express App ─────────────────────────────────────────────────────────\n\nconst app = express();\napp.use(express.json());\n\n// CORS — allow any origin by default; auth is via Bearer token.\nconst ALLOWED_ORIGINS = process.env.CORS_ORIGINS\n  ?.split(\",\")\n  .map((o) => o.trim())\n  .filter(Boolean);\n\napp.use((_req: any, res: any, next: any) => {\n  const origin = _req.headers.origin;\n  if (!ALLOWED_ORIGINS || (origin && ALLOWED_ORIGINS.includes(origin))) {\n    res.setHeader(\"Access-Control-Allow-Origin\", origin ?? \"*\");\n  }\n  res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n  res.setHeader(\n    \"Access-Control-Allow-Headers\",\n    \"Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id\",\n  );\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Mcp-Session-Id\");\n  if (_req.method === \"OPTIONS\") {\n    res.status(204).end();\n    return;\n  }\n  next();\n});\n\n// ── OAuth: Protected Resource Metadata (RFC 9728) ────────────────────────\n// Step 1 of MCP auth: Claude fetches this to discover the authorization server.\n\napp.get(\"/.well-known/oauth-protected-resource\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    resource: base,\n    authorization_servers: [base],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n    bearer_methods_supported: [\"header\"],\n  });\n});\n\n// ── OAuth: Authorization Server Metadata (RFC 8414) ──────────────────────\n// Step 2: Claude fetches this to discover authorize, token, and register endpoints.\n\napp.get(\"/.well-known/oauth-authorization-server\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    issuer: base,\n    authorization_endpoint: `${base}/authorize`,\n    token_endpoint: `${base}/oauth/token`,\n    registration_endpoint: `${base}/register`,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n  });\n});\n\n// ── OAuth: Dynamic Client Registration (RFC 7591) ────────────────────────\n// Step 3: Claude registers itself as a client before starting the auth flow.\n\ninterface RegisteredClient {\n  client_id: string;\n  redirect_uris: string[];\n  client_name?: string;\n  registeredAt: number;\n}\n\nconst registeredClients = new Map<string, RegisteredClient>();\n\napp.post(\n  \"/register\",\n  express.json(),\n  (req: any, res: any) => {\n    const { redirect_uris, client_name } = req.body;\n\n    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {\n      res.status(400).json({\n        error: \"invalid_client_metadata\",\n        error_description: \"redirect_uris is required\",\n      });\n      return;\n    }\n\n    const clientId = `pb_client_${randomUUID()}`;\n    const client: RegisteredClient = {\n      client_id: clientId,\n      redirect_uris,\n      client_name,\n      registeredAt: Date.now(),\n    };\n    registeredClients.set(clientId, client);\n\n    res.status(201).json({\n      client_id: clientId,\n      client_name: client_name ?? \"MCP Client\",\n      redirect_uris,\n      grant_types: [\"authorization_code\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\",\n    });\n  },\n);\n\n// ── OAuth: Authorization Code + PKCE ─────────────────────────────────────\n// Step 4: User enters their pb_sk_* key, server generates a one-time code.\n\ninterface PendingAuth {\n  apiKey: string;\n  codeChallenge: string;\n  redirectUri: string;\n  expiresAt: number;\n}\n\nconst pendingCodes = new Map<string, PendingAuth>();\n\nsetInterval(() => {\n  const now = Date.now();\n  for (const [code, auth] of pendingCodes) {\n    if (now > auth.expiresAt) pendingCodes.delete(code);\n  }\n  for (const [id, client] of registeredClients) {\n    if (now - client.registeredAt > 24 * 60 * 60_000) registeredClients.delete(id);\n  }\n}, 60_000);\n\nfunction esc(s: unknown): string {\n  return String(s ?? \"\").replace(/[&\"<>]/g, (c) =>\n    ({ \"&\": \"&amp;\", '\"': \"&quot;\", \"<\": \"&lt;\", \">\": \"&gt;\" })[c]!,\n  );\n}\n\napp.get(\"/authorize\", (req: any, res: any) => {\n  const { redirect_uri, code_challenge, code_challenge_method, state } =\n    req.query;\n  res.type(\"html\").send(`<!DOCTYPE html>\n<html lang=\"en\"><head>\n<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>Authorize — Product Brain</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;\n  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}\n.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}\nh1{font-size:1.2rem;margin-bottom:.25rem}\n.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}\nlabel{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}\ninput[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;\n  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}\ninput:focus{outline:none;border-color:#7c3aed}\nbutton{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;\n  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}\nbutton:hover{background:#6d28d9}\n.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}\n</style></head><body>\n<div class=\"card\">\n<h1>Product Brain</h1>\n<p class=\"sub\">Enter your API key to connect Claude to your workspace.</p>\n<form method=\"POST\" action=\"/authorize\">\n  <input type=\"hidden\" name=\"redirect_uri\" value=\"${esc(redirect_uri)}\">\n  <input type=\"hidden\" name=\"code_challenge\" value=\"${esc(code_challenge)}\">\n  <input type=\"hidden\" name=\"code_challenge_method\" value=\"${esc(code_challenge_method)}\">\n  <input type=\"hidden\" name=\"state\" value=\"${esc(state)}\">\n  <label for=\"k\">API Key</label>\n  <input type=\"password\" id=\"k\" name=\"api_key\" placeholder=\"pb_sk_…\" required autofocus>\n  <p class=\"err\" id=\"e\">Key must start with pb_sk_</p>\n  <button type=\"submit\">Authorize</button>\n</form>\n</div>\n<script>document.querySelector(\"form\").onsubmit=function(e){\nif(!document.getElementById(\"k\").value.startsWith(\"pb_sk_\")){\ne.preventDefault();document.getElementById(\"e\").style.display=\"block\"}}</script>\n</body></html>`);\n});\n\napp.post(\n  \"/authorize\",\n  express.urlencoded({ extended: false }),\n  (req: any, res: any) => {\n    const { api_key, redirect_uri, code_challenge, state } = req.body;\n\n    if (!api_key?.startsWith(\"pb_sk_\")) {\n      res.status(400).send(\"Invalid API key\");\n      return;\n    }\n\n    const code = randomUUID();\n    pendingCodes.set(code, {\n      apiKey: api_key,\n      codeChallenge: code_challenge,\n      redirectUri: redirect_uri,\n      expiresAt: Date.now() + 5 * 60_000,\n    });\n\n    const url = new URL(redirect_uri);\n    url.searchParams.set(\"code\", code);\n    if (state) url.searchParams.set(\"state\", state);\n    res.redirect(302, url.toString());\n  },\n);\n\n// ── OAuth: Token Exchange ────────────────────────────────────────────────\n// Step 5: Claude exchanges the authorization code (with PKCE verifier) for a token.\n\napp.post(\n  \"/oauth/token\",\n  express.urlencoded({ extended: false }),\n  express.json(),\n  (req: any, res: any) => {\n    const { grant_type, code, code_verifier, redirect_uri } = req.body;\n\n    if (grant_type !== \"authorization_code\") {\n      res.status(400).json({ error: \"unsupported_grant_type\" });\n      return;\n    }\n\n    const pending = pendingCodes.get(code);\n    if (!pending || pending.redirectUri !== redirect_uri) {\n      res.status(400).json({ error: \"invalid_grant\" });\n      return;\n    }\n\n    // PKCE S256 validation\n    const challenge = createHash(\"sha256\")\n      .update(code_verifier ?? \"\")\n      .digest(\"base64url\");\n    if (challenge !== pending.codeChallenge) {\n      pendingCodes.delete(code);\n      res.status(400).json({\n        error: \"invalid_grant\",\n        error_description: \"PKCE verification failed\",\n      });\n      return;\n    }\n\n    pendingCodes.delete(code);\n    res.json({\n      access_token: pending.apiKey,\n      token_type: \"Bearer\",\n      expires_in: 3600,\n    });\n  },\n);\n\n// ── Rate Limiting ────────────────────────────────────────────────────────\n\nconst mcpLimiter = rateLimit({\n  windowMs: 60_000,\n  max: 120,\n  standardHeaders: true,\n  legacyHeaders: false,\n  message: { error: \"Too many requests. Try again later.\" },\n});\n\n// ── Health Check ─────────────────────────────────────────────────────────\n\napp.get(\"/health\", (_req: any, res: any) => {\n  res.json({ status: \"ok\", version: SERVER_VERSION, transport: \"http\" });\n});\n\n// ── Session Management ──────────────────────────────────────────────────\n\ninterface SessionEntry {\n  transport: StreamableHTTPServerTransport;\n  lastAccess: number;\n}\n\nconst sessions = new Map<string, SessionEntry>();\nconst SESSION_TTL_MS = 30 * 60 * 1000;\nconst MAX_SESSIONS = 200;\n\nfunction evictStaleSessions(): void {\n  const now = Date.now();\n  for (const [id, entry] of sessions) {\n    if (now - entry.lastAccess > SESSION_TTL_MS) {\n      entry.transport.close().catch(() => {});\n      sessions.delete(id);\n    }\n  }\n  if (sessions.size > MAX_SESSIONS) {\n    const sorted = [...sessions.entries()].sort(\n      (a, b) => a[1].lastAccess - b[1].lastAccess,\n    );\n    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {\n      sorted[i][1].transport.close().catch(() => {});\n      sessions.delete(sorted[i][0]);\n    }\n  }\n}\n\nsetInterval(evictStaleSessions, 60_000);\n\n// ── Auth Helpers ─────────────────────────────────────────────────────────\n\nfunction extractBearerKey(req: any): string | null {\n  const header = req.headers?.authorization;\n  if (typeof header !== \"string\" || !header.startsWith(\"Bearer \")) return null;\n  const token = header.slice(7).trim();\n  return token.startsWith(\"pb_sk_\") ? token : null;\n}\n\nfunction send401(req: any, res: any): void {\n  const base = baseUrl(req);\n  res\n    .status(401)\n    .set(\n      \"WWW-Authenticate\",\n      `Bearer resource_metadata=\"${base}/.well-known/oauth-protected-resource\"`,\n    )\n    .json({ error: \"unauthorized\" });\n}\n\nfunction logRequest(\n  method: string,\n  outcome: \"ok\" | \"auth_fail\" | \"error\",\n  sessionId?: string,\n): void {\n  const ts = new Date().toISOString();\n  const sid = sessionId ? ` session=${sessionId}` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}\\n`);\n}\n\n// ── MCP Handlers ────────────────────────────────────────────────────────\n\napp.post(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"POST\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      if (sessionId && sessions.has(sessionId)) {\n        const entry = sessions.get(sessionId)!;\n        entry.lastAccess = Date.now();\n        await entry.transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", sessionId);\n      } else if (!sessionId && isInitializeRequest(req.body)) {\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: () => randomUUID(),\n          onsessioninitialized: (sid: string) => {\n            sessions.set(sid, { transport, lastAccess: Date.now() });\n            logRequest(\"POST\", \"ok\", sid);\n          },\n        });\n\n        transport.onclose = () => {\n          const sid = transport.sessionId;\n          if (sid) sessions.delete(sid);\n        };\n\n        const server = createProductBrainServer();\n        await server.connect(transport);\n        await transport.handleRequest(req, res, req.body);\n      } else {\n        res.status(400).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Bad Request: no valid session ID provided\" },\n          id: null,\n        });\n      }\n    });\n  } catch (err: any) {\n    logRequest(\"POST\", \"error\", sessionId);\n    if (!res.headersSent) {\n      res.status(500).json({\n        jsonrpc: \"2.0\",\n        error: { code: -32603, message: \"Internal server error\" },\n        id: null,\n      });\n    }\n  }\n});\n\napp.get(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"GET\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      entry.lastAccess = Date.now();\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"GET\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"GET\", \"error\", sessionId);\n  }\n});\n\napp.delete(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"DELETE\", \"auth_fail\");\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"DELETE\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"DELETE\", \"error\", sessionId);\n  }\n});\n\n// ── Start ───────────────────────────────────────────────────────────────\n\napp.listen(PORT, \"0.0.0.0\", () => {\n  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);\n});\n\nasync function gracefulShutdown() {\n  console.log(\"Shutting down...\");\n  for (const [, entry] of sessions) {\n    await entry.transport.close().catch(() => {});\n  }\n  await shutdownAnalytics();\n  process.exit(0);\n}\n\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\n"],"mappings":";;;;;;;;;;;;;;AAoBA,SAAS,YAAY,kBAAkB;AACvC,OAAO,aAAa;AACpB,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AACpC,OAAO,eAAe;AAStB,cAAc;AACd,cAAc;AAEd,IAAM,OAAO,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY,QAAQ,EAAE;AAE5E,SAAS,QAAQ,KAAkB;AACjC,QAAM,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,IAAI,YAAY;AAClE,QAAM,OAAO,IAAI,QAAQ,QAAQ,aAAa,IAAI;AAClD,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAIA,IAAM,MAAM,QAAQ;AACpB,IAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,IAAM,kBAAkB,QAAQ,IAAI,cAChC,MAAM,GAAG,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,IAAI,IAAI,CAAC,MAAW,KAAU,SAAc;AAC1C,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,mBAAoB,UAAU,gBAAgB,SAAS,MAAM,GAAI;AACpE,QAAI,UAAU,+BAA+B,UAAU,GAAG;AAAA,EAC5D;AACA,MAAI,UAAU,gCAAgC,4BAA4B;AAC1E,MAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,iCAAiC,gBAAgB;AAC/D,MAAI,KAAK,WAAW,WAAW;AAC7B,QAAI,OAAO,GAAG,EAAE,IAAI;AACpB;AAAA,EACF;AACA,OAAK;AACP,CAAC;AAKD,IAAI,IAAI,yCAAyC,CAAC,KAAU,QAAa;AACvE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,UAAU;AAAA,IACV,uBAAuB,CAAC,IAAI;AAAA,IAC5B,kBAAkB,CAAC,aAAa,eAAe;AAAA,IAC/C,0BAA0B,CAAC,QAAQ;AAAA,EACrC,CAAC;AACH,CAAC;AAKD,IAAI,IAAI,2CAA2C,CAAC,KAAU,QAAa;AACzE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,QAAQ;AAAA,IACR,wBAAwB,GAAG,IAAI;AAAA,IAC/B,gBAAgB,GAAG,IAAI;AAAA,IACvB,uBAAuB,GAAG,IAAI;AAAA,IAC9B,0BAA0B,CAAC,MAAM;AAAA,IACjC,uBAAuB,CAAC,oBAAoB;AAAA,IAC5C,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA,IAC9C,kBAAkB,CAAC,aAAa,eAAe;AAAA,EACjD,CAAC;AACH,CAAC;AAYD,IAAM,oBAAoB,oBAAI,IAA8B;AAE5D,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,eAAe,YAAY,IAAI,IAAI;AAE3C,QAAI,CAAC,MAAM,QAAQ,aAAa,KAAK,cAAc,WAAW,GAAG;AAC/D,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,WAAW,CAAC;AAC1C,UAAM,SAA2B;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,IACzB;AACA,sBAAkB,IAAI,UAAU,MAAM;AAEtC,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACnB,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,CAAC,oBAAoB;AAAA,MAClC,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;AAYA,IAAM,eAAe,oBAAI,IAAyB;AAElD,YAAY,MAAM;AAChB,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACvC,QAAI,MAAM,KAAK,UAAW,cAAa,OAAO,IAAI;AAAA,EACpD;AACA,aAAW,CAAC,IAAI,MAAM,KAAK,mBAAmB;AAC5C,QAAI,MAAM,OAAO,eAAe,KAAK,KAAK,IAAQ,mBAAkB,OAAO,EAAE;AAAA,EAC/E;AACF,GAAG,GAAM;AAET,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,KAAK,EAAE,EAAE;AAAA,IAAQ;AAAA,IAAW,CAAC,OACxC,EAAE,KAAK,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAK,OAAO,GAAG,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,IAAI,cAAc,CAAC,KAAU,QAAa;AAC5C,QAAM,EAAE,cAAc,gBAAgB,uBAAuB,MAAM,IACjE,IAAI;AACN,MAAI,KAAK,MAAM,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oDAwB4B,IAAI,YAAY,CAAC;AAAA,sDACf,IAAI,cAAc,CAAC;AAAA,6DACZ,IAAI,qBAAqB,CAAC;AAAA,6CAC1C,IAAI,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAUxC;AACf,CAAC;AAED,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,SAAS,cAAc,gBAAgB,MAAM,IAAI,IAAI;AAE7D,QAAI,CAAC,SAAS,WAAW,QAAQ,GAAG;AAClC,UAAI,OAAO,GAAG,EAAE,KAAK,iBAAiB;AACtC;AAAA,IACF;AAEA,UAAM,OAAO,WAAW;AACxB,iBAAa,IAAI,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW,KAAK,IAAI,IAAI,IAAI;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,IAAI,YAAY;AAChC,QAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,QAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,QAAI,SAAS,KAAK,IAAI,SAAS,CAAC;AAAA,EAClC;AACF;AAKA,IAAI;AAAA,EACF;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,YAAY,MAAM,eAAe,aAAa,IAAI,IAAI;AAE9D,QAAI,eAAe,sBAAsB;AACvC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,IAAI,IAAI;AACrC,QAAI,CAAC,WAAW,QAAQ,gBAAgB,cAAc;AACpD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC/C;AAAA,IACF;AAGA,UAAM,YAAY,WAAW,QAAQ,EAClC,OAAO,iBAAiB,EAAE,EAC1B,OAAO,WAAW;AACrB,QAAI,cAAc,QAAQ,eAAe;AACvC,mBAAa,OAAO,IAAI;AACxB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,iBAAa,OAAO,IAAI;AACxB,QAAI,KAAK;AAAA,MACP,cAAc,QAAQ;AAAA,MACtB,YAAY;AAAA,MACZ,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAIA,IAAM,aAAa,UAAU;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,sCAAsC;AAC1D,CAAC;AAID,IAAI,IAAI,WAAW,CAAC,MAAW,QAAa;AAC1C,MAAI,KAAK,EAAE,QAAQ,MAAM,SAAS,gBAAgB,WAAW,OAAO,CAAC;AACvE,CAAC;AASD,IAAM,WAAW,oBAAI,IAA0B;AAC/C,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,eAAe;AAErB,SAAS,qBAA2B;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,IAAI,KAAK,KAAK,UAAU;AAClC,QAAI,MAAM,MAAM,aAAa,gBAAgB;AAC3C,YAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACtC,eAAS,OAAO,EAAE;AAAA,IACpB;AAAA,EACF;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,UAAM,SAAS,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE;AAAA,MACrC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;AAAA,IACnC;AACA,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,cAAc,KAAK;AACrD,aAAO,CAAC,EAAE,CAAC,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC7C,eAAS,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,YAAY,oBAAoB,GAAM;AAItC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,SAAS;AAC5B,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AACxE,QAAM,QAAQ,OAAO,MAAM,CAAC,EAAE,KAAK;AACnC,SAAO,MAAM,WAAW,QAAQ,IAAI,QAAQ;AAC9C;AAEA,SAAS,QAAQ,KAAU,KAAgB;AACzC,QAAM,OAAO,QAAQ,GAAG;AACxB,MACG,OAAO,GAAG,EACV;AAAA,IACC;AAAA,IACA,6BAA6B,IAAI;AAAA,EACnC,EACC,KAAK,EAAE,OAAO,eAAe,CAAC;AACnC;AAEA,SAAS,WACP,QACA,SACA,WACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,MAAM,YAAY,YAAY,SAAS,KAAK;AAClD,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,OAAO,GAAG,GAAG;AAAA,CAAI;AAClE;AAIA,IAAI,KAAK,QAAQ,YAAY,OAAO,KAAU,QAAa;AACzD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,QAAQ,WAAW;AAC9B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAE9C,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,UAAI,aAAa,SAAS,IAAI,SAAS,GAAG;AACxC,cAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,cAAM,aAAa,KAAK,IAAI;AAC5B,cAAM,MAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AACtD,mBAAW,QAAQ,MAAM,SAAS;AAAA,MACpC,WAAW,CAAC,aAAa,oBAAoB,IAAI,IAAI,GAAG;AACtD,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB,MAAM,WAAW;AAAA,UACrC,sBAAsB,CAAC,QAAgB;AACrC,qBAAS,IAAI,KAAK,EAAE,WAAW,YAAY,KAAK,IAAI,EAAE,CAAC;AACvD,uBAAW,QAAQ,MAAM,GAAG;AAAA,UAC9B;AAAA,QACF,CAAC;AAED,kBAAU,UAAU,MAAM;AACxB,gBAAM,MAAM,UAAU;AACtB,cAAI,IAAK,UAAS,OAAO,GAAG;AAAA,QAC9B;AAEA,cAAM,SAAS,yBAAyB;AACxC,cAAM,OAAO,QAAQ,SAAS;AAC9B,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAAA,MAClD,OAAO;AACL,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,4CAA4C;AAAA,UAC5E,IAAI;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,eAAW,QAAQ,SAAS,SAAS;AACrC,QAAI,CAAC,IAAI,aAAa;AACpB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,QACxD,IAAI;AAAA,MACN,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,QAAQ,YAAY,OAAO,KAAU,QAAa;AACxD,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,OAAO,WAAW;AAC7B,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,aAAa,KAAK,IAAI;AAC5B,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,OAAO,MAAM,SAAS;AAAA,IACnC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,OAAO,SAAS,SAAS;AAAA,EACtC;AACF,CAAC;AAED,IAAI,OAAO,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC3D,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,UAAU,WAAW;AAChC,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,UAAU,MAAM,SAAS;AAAA,IACtC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,UAAU,SAAS,SAAS;AAAA,EACzC;AACF,CAAC;AAID,IAAI,OAAO,MAAM,WAAW,MAAM;AAChC,UAAQ,IAAI,kCAAkC,cAAc,sBAAsB,IAAI,EAAE;AAC1F,CAAC;AAED,eAAe,mBAAmB;AAChC,UAAQ,IAAI,kBAAkB;AAC9B,aAAW,CAAC,EAAE,KAAK,KAAK,UAAU;AAChC,UAAM,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC9C;AACA,QAAM,kBAAkB;AACxB,UAAQ,KAAK,CAAC;AAChB;AAEA,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/http.ts"],"sourcesContent":["/**\n * HTTP transport entry point for Product Brain MCP.\n *\n * Serves the MCP protocol over Streamable HTTP for web clients\n * (Claude web app, API consumers) that can't spawn local processes.\n *\n * Implements the full MCP OAuth 2.1 spec (Nov 2025):\n *   1. Protected Resource Metadata  (/.well-known/oauth-protected-resource)\n *   2. Authorization Server Metadata (/.well-known/oauth-authorization-server)\n *   3. Dynamic Client Registration   (POST /register)\n *   4. Authorization Code + PKCE     (GET/POST /authorize)\n *   5. Token Exchange                (POST /oauth/token)\n *\n * Env:\n *   CONVEX_SITE_URL  — Convex deployment URL (defaults to cloud)\n *   PORT / MCP_PORT  — Listen port (default 3000)\n *   CORS_ORIGINS     — Comma-separated allowed origins (default: all)\n *   PB_MODULES       — Comma-separated modules (default: core,gitchain,arch)\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport express from \"express\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport rateLimit from \"express-rate-limit\";\n\nimport { bootstrapHttp } from \"./client.js\";\nimport { runWithAuth, hashKey } from \"./auth.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\nimport { initAnalytics, shutdownAnalytics, getPostHogClient } from \"./analytics.js\";\nimport { initFeatureFlags } from \"./featureFlags.js\";\n\n// ── Bootstrap ───────────────────────────────────────────────────────────\n\nbootstrapHttp();\ninitAnalytics();\ninitFeatureFlags(getPostHogClient());\n\nconst PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? \"3002\", 10);\n\nfunction baseUrl(req: any): string {\n  const proto = req.headers[\"x-forwarded-proto\"] ?? req.protocol ?? \"http\";\n  const host = req.headers.host ?? `localhost:${PORT}`;\n  return `${proto}://${host}`;\n}\n\n// ── Express App ─────────────────────────────────────────────────────────\n\nconst app = express();\n// Required when behind a reverse proxy (e.g. Railway): rate limiter uses X-Forwarded-For\n// and throws ERR_ERL_UNEXPECTED_X_FORWARDED_FOR if trust proxy is false.\napp.set(\"trust proxy\", 1);\napp.use(express.json());\n\n// CORS — fail-closed; requires CORS_ORIGINS to be explicitly configured.\nconst ALLOWED_ORIGINS = process.env.CORS_ORIGINS\n  ?.split(\",\")\n  .map((o) => o.trim())\n  .filter(Boolean);\n\napp.use((_req: any, res: any, next: any) => {\n  const origin = _req.headers.origin;\n  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {\n    res.setHeader(\"Access-Control-Allow-Origin\", origin);\n  }\n  res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n  res.setHeader(\n    \"Access-Control-Allow-Headers\",\n    \"Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id\",\n  );\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Mcp-Session-Id\");\n  if (_req.method === \"OPTIONS\") {\n    res.status(204).end();\n    return;\n  }\n  next();\n});\n\n// ── OAuth: Protected Resource Metadata (RFC 9728) ────────────────────────\n// Step 1 of MCP auth: Claude fetches this to discover the authorization server.\n\napp.get(\"/.well-known/oauth-protected-resource\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    resource: base,\n    authorization_servers: [base],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n    bearer_methods_supported: [\"header\"],\n  });\n});\n\n// ── OAuth: Authorization Server Metadata (RFC 8414) ──────────────────────\n// Step 2: Claude fetches this to discover authorize, token, and register endpoints.\n\napp.get(\"/.well-known/oauth-authorization-server\", (req: any, res: any) => {\n  const base = baseUrl(req);\n  res.json({\n    issuer: base,\n    authorization_endpoint: `${base}/authorize`,\n    token_endpoint: `${base}/oauth/token`,\n    registration_endpoint: `${base}/register`,\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n    code_challenge_methods_supported: [\"S256\"],\n    token_endpoint_auth_methods_supported: [\"none\"],\n    scopes_supported: [\"mcp:tools\", \"mcp:resources\"],\n  });\n});\n\n// ── OAuth: Rate Limiting (Fix 2) ─────────────────────────────────────────\n// Separate, stricter limiter for auth endpoints to prevent brute-force and\n// enumeration attacks on the OAuth flow.\n\nconst authLimiter = rateLimit({\n  windowMs: 60_000,\n  max: 20,\n  standardHeaders: true,\n  legacyHeaders: false,\n  message: { error: \"Too many auth requests. Try again later.\" },\n});\n\n// ── OAuth: Dynamic Client Registration (RFC 7591) ────────────────────────\n// Step 3: Claude registers itself as a client before starting the auth flow.\n\ninterface RegisteredClient {\n  client_id: string;\n  redirect_uris: string[];\n  client_name?: string;\n  registeredAt: number;\n}\n\nconst registeredClients = new Map<string, RegisteredClient>();\n// Fix 4 — Cap client registrations at 500 to prevent unbounded memory growth.\nconst MAX_REGISTERED_CLIENTS = 500;\n\napp.post(\n  \"/register\",\n  authLimiter,\n  express.json(),\n  (req: any, res: any) => {\n    // Fix 4 — Reject registration when cap is reached.\n    if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {\n      res.status(503).json({\n        error: \"server_error\",\n        error_description: \"Registration limit reached. Try again later.\",\n      });\n      return;\n    }\n\n    const { redirect_uris, client_name } = req.body;\n\n    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {\n      res.status(400).json({\n        error: \"invalid_client_metadata\",\n        error_description: \"redirect_uris is required\",\n      });\n      return;\n    }\n\n    const clientId = `pb_client_${randomUUID()}`;\n    const client: RegisteredClient = {\n      client_id: clientId,\n      redirect_uris,\n      client_name,\n      registeredAt: Date.now(),\n    };\n    registeredClients.set(clientId, client);\n\n    res.status(201).json({\n      client_id: clientId,\n      client_name: client_name ?? \"MCP Client\",\n      redirect_uris,\n      grant_types: [\"authorization_code\"],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\",\n    });\n  },\n);\n\n// ── OAuth: Authorization Code + PKCE ─────────────────────────────────────\n// Step 4: User enters their pb_sk_* key, server generates a one-time code.\n\ninterface PendingAuth {\n  apiKey: string;\n  codeChallenge: string;\n  redirectUri: string;\n  expiresAt: number;\n}\n\nconst pendingCodes = new Map<string, PendingAuth>();\n\n// Refresh token store — declared here so the cleanup interval can reference it.\nconst ACCESS_TOKEN_TTL = 3600; // 1 hour\nconst ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1000;\nconst REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60_000; // 90 days\n\ninterface RefreshEntry {\n  apiKey: string;\n  createdAt: number;\n}\n\nconst refreshTokens = new Map<string, RefreshEntry>();\nconst MAX_REFRESH_TOKENS = 2000;\n// Per-key cap mirrors MAX_SESSIONS_PER_KEY (see ~line 524): prevents any single\n// API key from monopolising the global refresh-token budget. PR #34 review Finding 3.\nconst MAX_REFRESH_TOKENS_PER_KEY = 20;\n\n// Fix 1 — Opaque access token store.\n// Maps pb_at_<uuid> → { apiKey, createdAt } so the raw pb_sk_* key is never\n// exposed through the OAuth flow. Capped at 1000 entries with LRU eviction.\ninterface AccessTokenEntry {\n  apiKey: string;\n  createdAt: number;\n}\nconst accessTokens = new Map<string, AccessTokenEntry>();\nconst MAX_ACCESS_TOKENS = 1000;\n\nsetInterval(() => {\n  const now = Date.now();\n  for (const [code, auth] of pendingCodes) {\n    if (now > auth.expiresAt) pendingCodes.delete(code);\n  }\n  for (const [id, client] of registeredClients) {\n    if (now - client.registeredAt > 24 * 60 * 60_000) registeredClients.delete(id);\n  }\n  for (const [token, entry] of refreshTokens) {\n    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);\n  }\n  if (refreshTokens.size > MAX_REFRESH_TOKENS) {\n    const sorted = [...refreshTokens.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);\n    for (let i = 0; i < sorted.length - MAX_REFRESH_TOKENS; i++) {\n      refreshTokens.delete(sorted[i][0]);\n    }\n  }\n  // Fix 1 — Evict expired opaque access tokens.\n  for (const [token, entry] of accessTokens) {\n    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);\n  }\n  // Fix 5 — Clean up stale auth failure tracking entries.\n  for (const [ip, rec] of authFailures) {\n    if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {\n      authFailures.delete(ip);\n    }\n  }\n  // Cap authFailures map size.\n  if (authFailures.size > MAX_AUTH_FAILURE_ENTRIES) {\n    const sorted = [...authFailures.entries()].sort((a, b) => a[1].firstFailure - b[1].firstFailure);\n    for (let i = 0; i < sorted.length - MAX_AUTH_FAILURE_ENTRIES; i++) {\n      authFailures.delete(sorted[i][0]);\n    }\n  }\n}, 60_000);\n\nfunction esc(s: unknown): string {\n  return String(s ?? \"\").replace(/[&\"<>]/g, (c) =>\n    ({ \"&\": \"&amp;\", '\"': \"&quot;\", \"<\": \"&lt;\", \">\": \"&gt;\" })[c]!,\n  );\n}\n\napp.get(\"/authorize\", authLimiter, (req: any, res: any) => {\n  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } =\n    req.query;\n  res.type(\"html\").send(`<!DOCTYPE html>\n<html lang=\"en\"><head>\n<meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>Authorize — Product Brain</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#e5e5e5;\n  display:flex;align-items:center;justify-content:center;min-height:100vh;padding:1rem}\n.card{background:#1a1a1a;border:1px solid #333;border-radius:12px;padding:2rem;max-width:400px;width:100%}\nh1{font-size:1.2rem;margin-bottom:.25rem}\n.sub{color:#999;font-size:.85rem;margin-bottom:1.5rem}\nlabel{display:block;font-size:.85rem;margin-bottom:.4rem;color:#ccc}\ninput[type=password]{width:100%;padding:.6rem .75rem;background:#111;border:1px solid #444;\n  border-radius:8px;color:#e5e5e5;font:.85rem/1.4 monospace}\ninput:focus{outline:none;border-color:#7c3aed}\nbutton{width:100%;padding:.6rem;background:#7c3aed;color:#fff;border:none;\n  border-radius:8px;font-size:.85rem;cursor:pointer;margin-top:1rem}\nbutton:hover{background:#6d28d9}\n.err{color:#ef4444;font-size:.8rem;margin-top:.5rem;display:none}\n</style></head><body>\n<div class=\"card\">\n<h1>Product Brain</h1>\n<p class=\"sub\">Enter your API key to connect Claude to your workspace.</p>\n<form method=\"POST\" action=\"/authorize\">\n  <input type=\"hidden\" name=\"redirect_uri\" value=\"${esc(redirect_uri)}\">\n  <input type=\"hidden\" name=\"code_challenge\" value=\"${esc(code_challenge)}\">\n  <input type=\"hidden\" name=\"code_challenge_method\" value=\"${esc(code_challenge_method)}\">\n  <input type=\"hidden\" name=\"state\" value=\"${esc(state)}\">\n  <input type=\"hidden\" name=\"client_id\" value=\"${esc(client_id)}\">\n  <label for=\"k\">API Key</label>\n  <input type=\"password\" id=\"k\" name=\"api_key\" placeholder=\"pb_sk_…\" required autofocus>\n  <p class=\"err\" id=\"e\">Key must start with pb_sk_</p>\n  <button type=\"submit\">Authorize</button>\n</form>\n</div>\n<script>document.querySelector(\"form\").onsubmit=function(e){\nif(!document.getElementById(\"k\").value.startsWith(\"pb_sk_\")){\ne.preventDefault();document.getElementById(\"e\").style.display=\"block\"}}</script>\n</body></html>`);\n});\n\napp.post(\n  \"/authorize\",\n  authLimiter,\n  express.urlencoded({ extended: false }),\n  (req: any, res: any) => {\n    const { api_key, redirect_uri, code_challenge, state, client_id } = req.body;\n\n    if (!api_key?.startsWith(\"pb_sk_\")) {\n      res.status(400).send(\"Invalid API key\");\n      return;\n    }\n\n    // Validate redirect_uri against the registered client's allowed redirects.\n    // Open redirect prevention: never trust a request-supplied redirect_uri without\n    // checking it was pre-registered during dynamic client registration (RFC 7591).\n    if (!client_id || !registeredClients.has(client_id)) {\n      res.status(400).json({\n        error: \"invalid_request\",\n        error_description: \"Unknown or missing client_id\",\n      });\n      return;\n    }\n\n    const client = registeredClients.get(client_id)!;\n    if (!client.redirect_uris.includes(redirect_uri)) {\n      res.status(400).json({\n        error: \"invalid_request\",\n        error_description: \"redirect_uri does not match any registered redirect for this client\",\n      });\n      return;\n    }\n\n    const code = randomUUID();\n    pendingCodes.set(code, {\n      apiKey: api_key,\n      codeChallenge: code_challenge,\n      redirectUri: redirect_uri,\n      expiresAt: Date.now() + 5 * 60_000,\n    });\n\n    const url = new URL(redirect_uri);\n    url.searchParams.set(\"code\", code);\n    if (state) url.searchParams.set(\"state\", state);\n    res.redirect(302, url.toString());\n  },\n);\n\n// ── OAuth: Token Exchange ────────────────────────────────────────────────\n// Step 5: Claude exchanges the authorization code (with PKCE verifier) for a token.\n// Supports both authorization_code and refresh_token grants.\n\nfunction issueTokens(apiKey: string): object {\n  // Fix 1 — Generate an opaque pb_at_* access token so the raw pb_sk_* key\n  // is never returned through the OAuth flow.\n  const opaqueToken = `pb_at_${randomUUID()}`;\n  const now = Date.now();\n\n  // LRU eviction: if at cap, remove the oldest entry before inserting.\n  if (accessTokens.size >= MAX_ACCESS_TOKENS) {\n    let oldestKey = \"\";\n    let oldestTime = Infinity;\n    for (const [k, v] of accessTokens) {\n      if (v.createdAt < oldestTime) {\n        oldestTime = v.createdAt;\n        oldestKey = k;\n      }\n    }\n    if (oldestKey) accessTokens.delete(oldestKey);\n  }\n\n  accessTokens.set(opaqueToken, { apiKey, createdAt: now });\n\n  const refreshToken = `pb_rt_${randomUUID()}`;\n\n  // Per-key cap (Finding 3, PR #34): before the global backstop kicks in, ensure\n  // no single apiKey holds more than MAX_REFRESH_TOKENS_PER_KEY entries. Mirrors\n  // MAX_SESSIONS_PER_KEY. Prevents one abusive/leaked key from evicting every\n  // other tenant's refresh tokens via the global FIFO backstop below.\n  let perKeyCount = 0;\n  let oldestKeyForApiKey: string | null = null;\n  let oldestAtForApiKey = Infinity;\n  for (const [k, v] of refreshTokens) {\n    if (v.apiKey === apiKey) {\n      perKeyCount++;\n      if (v.createdAt < oldestAtForApiKey) {\n        oldestAtForApiKey = v.createdAt;\n        oldestKeyForApiKey = k;\n      }\n    }\n  }\n  if (perKeyCount >= MAX_REFRESH_TOKENS_PER_KEY && oldestKeyForApiKey) {\n    refreshTokens.delete(oldestKeyForApiKey);\n  }\n\n  // Global backstop — unchanged behaviour.\n  if (refreshTokens.size >= MAX_REFRESH_TOKENS) {\n    let oldestKey: string | null = null;\n    let oldestAt = Infinity;\n    for (const [k, v] of refreshTokens) {\n      if (v.createdAt < oldestAt) {\n        oldestAt = v.createdAt;\n        oldestKey = k;\n      }\n    }\n    if (oldestKey) refreshTokens.delete(oldestKey);\n  }\n  refreshTokens.set(refreshToken, { apiKey, createdAt: now });\n  return {\n    access_token: opaqueToken,\n    token_type: \"Bearer\",\n    expires_in: ACCESS_TOKEN_TTL,\n    refresh_token: refreshToken,\n  };\n}\n\napp.post(\n  \"/oauth/token\",\n  authLimiter,\n  express.urlencoded({ extended: false }),\n  express.json(),\n  (req: any, res: any) => {\n    const { grant_type, code, code_verifier, redirect_uri, refresh_token } =\n      req.body;\n\n    if (grant_type === \"refresh_token\") {\n      const entry = refreshTokens.get(refresh_token);\n      if (!entry) {\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Invalid refresh token\" });\n        return;\n      }\n      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {\n        refreshTokens.delete(refresh_token);\n        res.status(400).json({ error: \"invalid_grant\", error_description: \"Refresh token expired\" });\n        return;\n      }\n      // Rotate: revoke old, issue new pair\n      const apiKey = entry.apiKey;\n      refreshTokens.delete(refresh_token);\n      res.json(issueTokens(apiKey));\n      return;\n    }\n\n    if (grant_type !== \"authorization_code\") {\n      res.status(400).json({ error: \"unsupported_grant_type\" });\n      return;\n    }\n\n    const pending = pendingCodes.get(code);\n    if (!pending || pending.redirectUri !== redirect_uri) {\n      res.status(400).json({ error: \"invalid_grant\" });\n      return;\n    }\n\n    // PKCE S256 validation\n    const challenge = createHash(\"sha256\")\n      .update(code_verifier ?? \"\")\n      .digest(\"base64url\");\n    if (challenge !== pending.codeChallenge) {\n      pendingCodes.delete(code);\n      res.status(400).json({\n        error: \"invalid_grant\",\n        error_description: \"PKCE verification failed\",\n      });\n      return;\n    }\n\n    pendingCodes.delete(code);\n    res.json(issueTokens(pending.apiKey));\n  },\n);\n\n// ── Rate Limiting ────────────────────────────────────────────────────────\n\nconst mcpLimiter = rateLimit({\n  windowMs: 60_000,\n  max: 120,\n  standardHeaders: true,\n  legacyHeaders: false,\n  message: { error: \"Too many requests. Try again later.\" },\n});\n\n// ── Auth Failure Backoff (Fix 5) ──────────────────────────────────────────\n// Per-IP progressive lockout for failed API key auth attempts to prevent\n// brute-force attacks through the MCP endpoints.\n\ninterface AuthFailureRecord {\n  count: number;\n  firstFailure: number;\n  blockedUntil: number;\n}\n\nconst authFailures = new Map<string, AuthFailureRecord>();\nconst AUTH_FAILURE_MAX = 10;\nconst AUTH_FAILURE_WINDOW_MS = 5 * 60_000;  // 5 minutes\nconst AUTH_BLOCK_DURATION_MS = 15 * 60_000; // 15 minutes\nconst MAX_AUTH_FAILURE_ENTRIES = 10_000;\n\nfunction checkAuthBlock(ip: string): boolean {\n  const rec = authFailures.get(ip);\n  if (!rec) return false;\n  return rec.blockedUntil > Date.now();\n}\n\nfunction recordAuthFailure(ip: string): void {\n  const now = Date.now();\n  const rec = authFailures.get(ip);\n\n  if (!rec) {\n    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });\n    return;\n  }\n\n  // Reset window if the first failure is outside the tracking window.\n  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {\n    rec.count = 1;\n    rec.firstFailure = now;\n    rec.blockedUntil = 0;\n  } else {\n    rec.count++;\n    if (rec.count >= AUTH_FAILURE_MAX) {\n      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;\n    }\n  }\n}\n\n// ── Health Check ─────────────────────────────────────────────────────────\n\napp.get(\"/health\", (_req: any, res: any) => {\n  res.json({ status: \"ok\", version: SERVER_VERSION, transport: \"http\" });\n});\n\n// ── Session Management ──────────────────────────────────────────────────\n\ninterface SessionEntry {\n  transport: StreamableHTTPServerTransport;\n  lastAccess: number;\n  // Fix 3 — short hash of the API key that created this session. Used to\n  // detect session hijacking when subsequent requests arrive with a different key.\n  keyHash: string;\n}\n\nconst sessions = new Map<string, SessionEntry>();\nconst SESSION_TTL_MS = 30 * 60 * 1000;\nconst MAX_SESSIONS = 200;\n// Fix 6 — prevent a single API key from monopolising all session slots.\nconst MAX_SESSIONS_PER_KEY = 5;\n\nfunction evictStaleSessions(): void {\n  const now = Date.now();\n  for (const [id, entry] of sessions) {\n    if (now - entry.lastAccess > SESSION_TTL_MS) {\n      logSessionLifecycle(\"session_deleted\", id, \"ttl\");\n      entry.transport.close().catch(() => {});\n      sessions.delete(id);\n    }\n  }\n  if (sessions.size > MAX_SESSIONS) {\n    const sorted = [...sessions.entries()].sort(\n      (a, b) => a[1].lastAccess - b[1].lastAccess,\n    );\n    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {\n      logSessionLifecycle(\"session_deleted\", sorted[i][0], \"eviction\");\n      sorted[i][1].transport.close().catch(() => {});\n      sessions.delete(sorted[i][0]);\n    }\n  }\n}\n\nsetInterval(evictStaleSessions, 60_000);\n\n// ── Auth Helpers ─────────────────────────────────────────────────────────\n\nfunction extractBearerKey(req: any): string | null {\n  const header = req.headers?.authorization;\n  if (typeof header !== \"string\" || !header.startsWith(\"Bearer \")) return null;\n  const token = header.slice(7).trim();\n\n  // Fix 1 — Support both direct API keys (stdio/backward compat) and opaque\n  // OAuth access tokens issued by issueTokens().\n  if (token.startsWith(\"pb_sk_\")) {\n    // Direct API key — accepted for stdio and backward compatibility.\n    return token;\n  }\n  if (token.startsWith(\"pb_at_\")) {\n    // Opaque OAuth access token — resolve to the underlying API key.\n    const entry = accessTokens.get(token);\n    if (!entry) return null;\n    const now = Date.now();\n    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {\n      // Expired — remove and reject.\n      accessTokens.delete(token);\n      return null;\n    }\n    return entry.apiKey;\n  }\n  return null;\n}\n\nfunction send401(req: any, res: any): void {\n  const base = baseUrl(req);\n  res\n    .status(401)\n    .set(\n      \"WWW-Authenticate\",\n      `Bearer resource_metadata=\"${base}/.well-known/oauth-protected-resource\"`,\n    )\n    .json({ error: \"unauthorized\" });\n}\n\nfunction logRequest(\n  method: string,\n  outcome: \"ok\" | \"auth_fail\" | \"error\",\n  sessionId?: string,\n  durationMs?: number,\n): void {\n  const ts = new Date().toISOString();\n  const sid = sessionId ? ` session=${sessionId}` : \"\";\n  const dur = durationMs != null ? ` duration=${durationMs}ms` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}${dur}\\n`);\n}\n\nfunction logSessionLifecycle(\n  event: \"session_created\" | \"session_deleted\",\n  sessionId: string,\n  reason?: \"ttl\" | \"eviction\" | \"onclose\",\n): void {\n  const ts = new Date().toISOString();\n  const r = reason ? ` reason=${reason}` : \"\";\n  process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}\\n`);\n}\n\n// ── MCP Handlers ────────────────────────────────────────────────────────\n\napp.post(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  // Fix 5 — Block IPs that have exceeded the auth failure threshold.\n  const reqIp: string = req.ip ?? \"unknown\";\n  if (checkAuthBlock(reqIp)) {\n    res.status(429).json({ error: \"Too many failed auth attempts. Try again later.\" });\n    return;\n  }\n\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"POST\", \"auth_fail\");\n    // Fix 5 — Record the auth failure for progressive lockout.\n    recordAuthFailure(reqIp);\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  const reqStart = Date.now();\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      if (sessionId && sessions.has(sessionId)) {\n        const entry = sessions.get(sessionId)!;\n        // Fix 3 — Verify the session belongs to the presenting key.\n        if (entry.keyHash !== hashKey(apiKey)) {\n          res.status(403).json({\n            jsonrpc: \"2.0\",\n            error: { code: -32000, message: \"Session key mismatch\" },\n            id: null,\n          });\n          return;\n        }\n        entry.lastAccess = Date.now();\n        await entry.transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", sessionId, Date.now() - reqStart);\n      } else if (!sessionId && isInitializeRequest(req.body)) {\n        // Fix 6 — Enforce per-key session cap before creating a new session.\n        const keyH = hashKey(apiKey);\n        let keySessionCount = 0;\n        for (const entry of sessions.values()) {\n          if (entry.keyHash === keyH) keySessionCount++;\n        }\n        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {\n          res.status(429).json({\n            jsonrpc: \"2.0\",\n            error: { code: -32000, message: \"Too many sessions for this API key\" },\n            id: null,\n          });\n          return;\n        }\n\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: () => randomUUID(),\n          onsessioninitialized: (sid: string) => {\n            // Fix 3 — Store a key hash with the session entry.\n            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });\n            logSessionLifecycle(\"session_created\", sid);\n          },\n        });\n\n        transport.onclose = () => {\n          const sid = transport.sessionId;\n          if (sid) {\n            logSessionLifecycle(\"session_deleted\", sid, \"onclose\");\n            sessions.delete(sid);\n          }\n        };\n\n        const server = createProductBrainServer();\n        await server.connect(transport);\n        await transport.handleRequest(req, res, req.body);\n        logRequest(\"POST\", \"ok\", transport.sessionId ?? undefined, Date.now() - reqStart);\n      } else {\n        process.stderr.write(\n          `[HTTP] ${new Date().toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)\\n`,\n        );\n        res.status(400).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Bad Request: no valid session ID provided\" },\n          id: null,\n        });\n      }\n    });\n  } catch (err: any) {\n    logRequest(\"POST\", \"error\", sessionId, Date.now() - reqStart);\n    if (!res.headersSent) {\n      res.status(500).json({\n        jsonrpc: \"2.0\",\n        error: { code: -32603, message: \"Internal server error\" },\n        id: null,\n      });\n    }\n  }\n});\n\napp.get(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  // Fix 5 — Block IPs that have exceeded the auth failure threshold.\n  const reqIp: string = req.ip ?? \"unknown\";\n  if (checkAuthBlock(reqIp)) {\n    res.status(429).json({ error: \"Too many failed auth attempts. Try again later.\" });\n    return;\n  }\n\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"GET\", \"auth_fail\");\n    // Fix 5 — Record the auth failure for progressive lockout.\n    recordAuthFailure(reqIp);\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      // Fix 3 — Verify the session belongs to the presenting key.\n      if (entry.keyHash !== hashKey(apiKey)) {\n        res.status(403).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Session key mismatch\" },\n          id: null,\n        });\n        return;\n      }\n      entry.lastAccess = Date.now();\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"GET\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"GET\", \"error\", sessionId);\n  }\n});\n\napp.delete(\"/mcp\", mcpLimiter, async (req: any, res: any) => {\n  // Fix 5 — Block IPs that have exceeded the auth failure threshold.\n  const reqIp: string = req.ip ?? \"unknown\";\n  if (checkAuthBlock(reqIp)) {\n    res.status(429).json({ error: \"Too many failed auth attempts. Try again later.\" });\n    return;\n  }\n\n  const apiKey = extractBearerKey(req);\n  if (!apiKey) {\n    logRequest(\"DELETE\", \"auth_fail\");\n    // Fix 5 — Record the auth failure for progressive lockout.\n    recordAuthFailure(reqIp);\n    send401(req, res);\n    return;\n  }\n\n  const sessionId = req.headers[\"mcp-session-id\"] as string | undefined;\n  if (!sessionId || !sessions.has(sessionId)) {\n    res.status(400).send(\"Invalid or missing session ID\");\n    return;\n  }\n\n  try {\n    await runWithAuth({ apiKey }, async () => {\n      const entry = sessions.get(sessionId)!;\n      // Fix 3 — Verify the session belongs to the presenting key.\n      if (entry.keyHash !== hashKey(apiKey)) {\n        res.status(403).json({\n          jsonrpc: \"2.0\",\n          error: { code: -32000, message: \"Session key mismatch\" },\n          id: null,\n        });\n        return;\n      }\n      await entry.transport.handleRequest(req, res);\n      logRequest(\"DELETE\", \"ok\", sessionId);\n    });\n  } catch {\n    logRequest(\"DELETE\", \"error\", sessionId);\n  }\n});\n\n// ── Start ───────────────────────────────────────────────────────────────\n\nprocess.on(\"unhandledRejection\", (reason) => {\n  const msg = reason instanceof Error ? reason.message : String(reason);\n  console.error(`[MCP HTTP] Unhandled rejection: ${msg}`);\n});\n\nprocess.on(\"uncaughtException\", (err) => {\n  console.error(`[MCP HTTP] Uncaught exception: ${err.stack ?? err.message}`);\n  gracefulShutdown();\n});\n\nlet shuttingDown = false;\nasync function gracefulShutdown() {\n  if (shuttingDown) return;\n  shuttingDown = true;\n  setTimeout(() => process.exit(1), 3_000).unref();\n  console.log(\"Shutting down...\");\n  for (const [, entry] of sessions) {\n    await entry.transport.close().catch(() => {});\n  }\n  try {\n    await shutdownAnalytics();\n  } catch {\n    /* best-effort */\n  }\n  process.exit(0);\n}\n\n// Bind all interfaces — Railway/Cloudflare reach the container on its non-loopback IP.\n// Loopback-only (127.0.0.1) causes edge 502: the proxy never connects to localhost inside the pod.\nconst LISTEN_HOST = \"0.0.0.0\";\nconst httpServer = app.listen(PORT, LISTEN_HOST, () => {\n  console.log(\n    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`,\n  );\n});\nhttpServer.on(\"error\", (err) => {\n  console.error(`[MCP HTTP] Server error: ${err.message}`);\n  process.exit(1);\n});\n\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,SAAS,YAAY,kBAAkB;AACvC,OAAO,aAAa;AACpB,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AACpC,OAAO,eAAe;AAUtB,cAAc;AACd,cAAc;AACd,iBAAiB,iBAAiB,CAAC;AAEnC,IAAM,OAAO,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY,QAAQ,EAAE;AAE5E,SAAS,QAAQ,KAAkB;AACjC,QAAM,QAAQ,IAAI,QAAQ,mBAAmB,KAAK,IAAI,YAAY;AAClE,QAAM,OAAO,IAAI,QAAQ,QAAQ,aAAa,IAAI;AAClD,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAIA,IAAM,MAAM,QAAQ;AAGpB,IAAI,IAAI,eAAe,CAAC;AACxB,IAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,IAAM,kBAAkB,QAAQ,IAAI,cAChC,MAAM,GAAG,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,IAAI,IAAI,CAAC,MAAW,KAAU,SAAc;AAC1C,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,mBAAmB,UAAU,gBAAgB,SAAS,MAAM,GAAG;AACjE,QAAI,UAAU,+BAA+B,MAAM;AAAA,EACrD;AACA,MAAI,UAAU,gCAAgC,4BAA4B;AAC1E,MAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU,iCAAiC,gBAAgB;AAC/D,MAAI,KAAK,WAAW,WAAW;AAC7B,QAAI,OAAO,GAAG,EAAE,IAAI;AACpB;AAAA,EACF;AACA,OAAK;AACP,CAAC;AAKD,IAAI,IAAI,yCAAyC,CAAC,KAAU,QAAa;AACvE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,UAAU;AAAA,IACV,uBAAuB,CAAC,IAAI;AAAA,IAC5B,kBAAkB,CAAC,aAAa,eAAe;AAAA,IAC/C,0BAA0B,CAAC,QAAQ;AAAA,EACrC,CAAC;AACH,CAAC;AAKD,IAAI,IAAI,2CAA2C,CAAC,KAAU,QAAa;AACzE,QAAM,OAAO,QAAQ,GAAG;AACxB,MAAI,KAAK;AAAA,IACP,QAAQ;AAAA,IACR,wBAAwB,GAAG,IAAI;AAAA,IAC/B,gBAAgB,GAAG,IAAI;AAAA,IACvB,uBAAuB,GAAG,IAAI;AAAA,IAC9B,0BAA0B,CAAC,MAAM;AAAA,IACjC,uBAAuB,CAAC,sBAAsB,eAAe;AAAA,IAC7D,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA,IAC9C,kBAAkB,CAAC,aAAa,eAAe;AAAA,EACjD,CAAC;AACH,CAAC;AAMD,IAAM,cAAc,UAAU;AAAA,EAC5B,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,2CAA2C;AAC/D,CAAC;AAYD,IAAM,oBAAoB,oBAAI,IAA8B;AAE5D,IAAM,yBAAyB;AAE/B,IAAI;AAAA,EACF;AAAA,EACA;AAAA,EACA,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AAEtB,QAAI,kBAAkB,QAAQ,wBAAwB;AACpD,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,EAAE,eAAe,YAAY,IAAI,IAAI;AAE3C,QAAI,CAAC,MAAM,QAAQ,aAAa,KAAK,cAAc,WAAW,GAAG;AAC/D,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,WAAW,CAAC;AAC1C,UAAM,SAA2B;AAAA,MAC/B,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,IACzB;AACA,sBAAkB,IAAI,UAAU,MAAM;AAEtC,QAAI,OAAO,GAAG,EAAE,KAAK;AAAA,MACnB,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,aAAa,CAAC,oBAAoB;AAAA,MAClC,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;AAYA,IAAM,eAAe,oBAAI,IAAyB;AAGlD,IAAM,mBAAmB;AACzB,IAAM,sBAAsB,mBAAmB;AAC/C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAO5C,IAAM,gBAAgB,oBAAI,IAA0B;AACpD,IAAM,qBAAqB;AAG3B,IAAM,6BAA6B;AASnC,IAAM,eAAe,oBAAI,IAA8B;AACvD,IAAM,oBAAoB;AAE1B,YAAY,MAAM;AAChB,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACvC,QAAI,MAAM,KAAK,UAAW,cAAa,OAAO,IAAI;AAAA,EACpD;AACA,aAAW,CAAC,IAAI,MAAM,KAAK,mBAAmB;AAC5C,QAAI,MAAM,OAAO,eAAe,KAAK,KAAK,IAAQ,mBAAkB,OAAO,EAAE;AAAA,EAC/E;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,eAAe;AAC1C,QAAI,MAAM,MAAM,YAAY,qBAAsB,eAAc,OAAO,KAAK;AAAA,EAC9E;AACA,MAAI,cAAc,OAAO,oBAAoB;AAC3C,UAAM,SAAS,CAAC,GAAG,cAAc,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS;AAC1F,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,oBAAoB,KAAK;AAC3D,oBAAc,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IACnC;AAAA,EACF;AAEA,aAAW,CAAC,OAAO,KAAK,KAAK,cAAc;AACzC,QAAI,MAAM,MAAM,YAAY,oBAAqB,cAAa,OAAO,KAAK;AAAA,EAC5E;AAEA,aAAW,CAAC,IAAI,GAAG,KAAK,cAAc;AACpC,QAAI,IAAI,eAAe,OAAO,IAAI,eAAe,yBAAyB,KAAK;AAC7E,mBAAa,OAAO,EAAE;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,aAAa,OAAO,0BAA0B;AAChD,UAAM,SAAS,CAAC,GAAG,aAAa,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,YAAY;AAC/F,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,0BAA0B,KAAK;AACjE,mBAAa,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IAClC;AAAA,EACF;AACF,GAAG,GAAM;AAET,SAAS,IAAI,GAAoB;AAC/B,SAAO,OAAO,KAAK,EAAE,EAAE;AAAA,IAAQ;AAAA,IAAW,CAAC,OACxC,EAAE,KAAK,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAK,OAAO,GAAG,CAAC;AAAA,EAC/D;AACF;AAEA,IAAI,IAAI,cAAc,aAAa,CAAC,KAAU,QAAa;AACzD,QAAM,EAAE,cAAc,gBAAgB,uBAAuB,OAAO,UAAU,IAC5E,IAAI;AACN,MAAI,KAAK,MAAM,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oDAwB4B,IAAI,YAAY,CAAC;AAAA,sDACf,IAAI,cAAc,CAAC;AAAA,6DACZ,IAAI,qBAAqB,CAAC;AAAA,6CAC1C,IAAI,KAAK,CAAC;AAAA,iDACN,IAAI,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAUhD;AACf,CAAC;AAED,IAAI;AAAA,EACF;AAAA,EACA;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,SAAS,cAAc,gBAAgB,OAAO,UAAU,IAAI,IAAI;AAExE,QAAI,CAAC,SAAS,WAAW,QAAQ,GAAG;AAClC,UAAI,OAAO,GAAG,EAAE,KAAK,iBAAiB;AACtC;AAAA,IACF;AAKA,QAAI,CAAC,aAAa,CAAC,kBAAkB,IAAI,SAAS,GAAG;AACnD,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,SAAS,kBAAkB,IAAI,SAAS;AAC9C,QAAI,CAAC,OAAO,cAAc,SAAS,YAAY,GAAG;AAChD,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,UAAM,OAAO,WAAW;AACxB,iBAAa,IAAI,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW,KAAK,IAAI,IAAI,IAAI;AAAA,IAC9B,CAAC;AAED,UAAM,MAAM,IAAI,IAAI,YAAY;AAChC,QAAI,aAAa,IAAI,QAAQ,IAAI;AACjC,QAAI,MAAO,KAAI,aAAa,IAAI,SAAS,KAAK;AAC9C,QAAI,SAAS,KAAK,IAAI,SAAS,CAAC;AAAA,EAClC;AACF;AAMA,SAAS,YAAY,QAAwB;AAG3C,QAAM,cAAc,SAAS,WAAW,CAAC;AACzC,QAAM,MAAM,KAAK,IAAI;AAGrB,MAAI,aAAa,QAAQ,mBAAmB;AAC1C,QAAI,YAAY;AAChB,QAAI,aAAa;AACjB,eAAW,CAAC,GAAG,CAAC,KAAK,cAAc;AACjC,UAAI,EAAE,YAAY,YAAY;AAC5B,qBAAa,EAAE;AACf,oBAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,UAAW,cAAa,OAAO,SAAS;AAAA,EAC9C;AAEA,eAAa,IAAI,aAAa,EAAE,QAAQ,WAAW,IAAI,CAAC;AAExD,QAAM,eAAe,SAAS,WAAW,CAAC;AAM1C,MAAI,cAAc;AAClB,MAAI,qBAAoC;AACxC,MAAI,oBAAoB;AACxB,aAAW,CAAC,GAAG,CAAC,KAAK,eAAe;AAClC,QAAI,EAAE,WAAW,QAAQ;AACvB;AACA,UAAI,EAAE,YAAY,mBAAmB;AACnC,4BAAoB,EAAE;AACtB,6BAAqB;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,8BAA8B,oBAAoB;AACnE,kBAAc,OAAO,kBAAkB;AAAA,EACzC;AAGA,MAAI,cAAc,QAAQ,oBAAoB;AAC5C,QAAI,YAA2B;AAC/B,QAAI,WAAW;AACf,eAAW,CAAC,GAAG,CAAC,KAAK,eAAe;AAClC,UAAI,EAAE,YAAY,UAAU;AAC1B,mBAAW,EAAE;AACb,oBAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,UAAW,eAAc,OAAO,SAAS;AAAA,EAC/C;AACA,gBAAc,IAAI,cAAc,EAAE,QAAQ,WAAW,IAAI,CAAC;AAC1D,SAAO;AAAA,IACL,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB;AACF;AAEA,IAAI;AAAA,EACF;AAAA,EACA;AAAA,EACA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC;AAAA,EACtC,QAAQ,KAAK;AAAA,EACb,CAAC,KAAU,QAAa;AACtB,UAAM,EAAE,YAAY,MAAM,eAAe,cAAc,cAAc,IACnE,IAAI;AAEN,QAAI,eAAe,iBAAiB;AAClC,YAAM,QAAQ,cAAc,IAAI,aAAa;AAC7C,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,MAAM,YAAY,sBAAsB;AACvD,sBAAc,OAAO,aAAa;AAClC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAC3F;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AACrB,oBAAc,OAAO,aAAa;AAClC,UAAI,KAAK,YAAY,MAAM,CAAC;AAC5B;AAAA,IACF;AAEA,QAAI,eAAe,sBAAsB;AACvC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACxD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,IAAI,IAAI;AACrC,QAAI,CAAC,WAAW,QAAQ,gBAAgB,cAAc;AACpD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAC/C;AAAA,IACF;AAGA,UAAM,YAAY,WAAW,QAAQ,EAClC,OAAO,iBAAiB,EAAE,EAC1B,OAAO,WAAW;AACrB,QAAI,cAAc,QAAQ,eAAe;AACvC,mBAAa,OAAO,IAAI;AACxB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAEA,iBAAa,OAAO,IAAI;AACxB,QAAI,KAAK,YAAY,QAAQ,MAAM,CAAC;AAAA,EACtC;AACF;AAIA,IAAM,aAAa,UAAU;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,SAAS,EAAE,OAAO,sCAAsC;AAC1D,CAAC;AAYD,IAAM,eAAe,oBAAI,IAA+B;AACxD,IAAM,mBAAmB;AACzB,IAAM,yBAAyB,IAAI;AACnC,IAAM,yBAAyB,KAAK;AACpC,IAAM,2BAA2B;AAEjC,SAAS,eAAe,IAAqB;AAC3C,QAAM,MAAM,aAAa,IAAI,EAAE;AAC/B,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,IAAI,eAAe,KAAK,IAAI;AACrC;AAEA,SAAS,kBAAkB,IAAkB;AAC3C,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,aAAa,IAAI,EAAE;AAE/B,MAAI,CAAC,KAAK;AACR,iBAAa,IAAI,IAAI,EAAE,OAAO,GAAG,cAAc,KAAK,cAAc,EAAE,CAAC;AACrE;AAAA,EACF;AAGA,MAAI,MAAM,IAAI,eAAe,wBAAwB;AACnD,QAAI,QAAQ;AACZ,QAAI,eAAe;AACnB,QAAI,eAAe;AAAA,EACrB,OAAO;AACL,QAAI;AACJ,QAAI,IAAI,SAAS,kBAAkB;AACjC,UAAI,eAAe,MAAM;AAAA,IAC3B;AAAA,EACF;AACF;AAIA,IAAI,IAAI,WAAW,CAAC,MAAW,QAAa;AAC1C,MAAI,KAAK,EAAE,QAAQ,MAAM,SAAS,gBAAgB,WAAW,OAAO,CAAC;AACvE,CAAC;AAYD,IAAM,WAAW,oBAAI,IAA0B;AAC/C,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,eAAe;AAErB,IAAM,uBAAuB;AAE7B,SAAS,qBAA2B;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,IAAI,KAAK,KAAK,UAAU;AAClC,QAAI,MAAM,MAAM,aAAa,gBAAgB;AAC3C,0BAAoB,mBAAmB,IAAI,KAAK;AAChD,YAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACtC,eAAS,OAAO,EAAE;AAAA,IACpB;AAAA,EACF;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,UAAM,SAAS,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE;AAAA,MACrC,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;AAAA,IACnC;AACA,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,cAAc,KAAK;AACrD,0BAAoB,mBAAmB,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU;AAC/D,aAAO,CAAC,EAAE,CAAC,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAC7C,eAAS,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,YAAY,oBAAoB,GAAM;AAItC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,SAAS;AAC5B,MAAI,OAAO,WAAW,YAAY,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AACxE,QAAM,QAAQ,OAAO,MAAM,CAAC,EAAE,KAAK;AAInC,MAAI,MAAM,WAAW,QAAQ,GAAG;AAE9B,WAAO;AAAA,EACT;AACA,MAAI,MAAM,WAAW,QAAQ,GAAG;AAE9B,UAAM,QAAQ,aAAa,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,MAAM,MAAM,YAAY,qBAAqB;AAE/C,mBAAa,OAAO,KAAK;AACzB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAAU,KAAgB;AACzC,QAAM,OAAO,QAAQ,GAAG;AACxB,MACG,OAAO,GAAG,EACV;AAAA,IACC;AAAA,IACA,6BAA6B,IAAI;AAAA,EACnC,EACC,KAAK,EAAE,OAAO,eAAe,CAAC;AACnC;AAEA,SAAS,WACP,QACA,SACA,WACA,YACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,MAAM,YAAY,YAAY,SAAS,KAAK;AAClD,QAAM,MAAM,cAAc,OAAO,aAAa,UAAU,OAAO;AAC/D,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,MAAM,IAAI,OAAO,GAAG,GAAG,GAAG,GAAG;AAAA,CAAI;AACxE;AAEA,SAAS,oBACP,OACA,WACA,QACM;AACN,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,IAAI,SAAS,WAAW,MAAM,KAAK;AACzC,UAAQ,OAAO,MAAM,UAAU,EAAE,IAAI,KAAK,YAAY,SAAS,GAAG,CAAC;AAAA,CAAI;AACzE;AAIA,IAAI,KAAK,QAAQ,YAAY,OAAO,KAAU,QAAa;AAEzD,QAAM,QAAgB,IAAI,MAAM;AAChC,MAAI,eAAe,KAAK,GAAG;AACzB,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kDAAkD,CAAC;AACjF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,QAAQ,WAAW;AAE9B,sBAAkB,KAAK;AACvB,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,QAAM,WAAW,KAAK,IAAI;AAE1B,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,UAAI,aAAa,SAAS,IAAI,SAAS,GAAG;AACxC,cAAM,QAAQ,SAAS,IAAI,SAAS;AAEpC,YAAI,MAAM,YAAY,QAAQ,MAAM,GAAG;AACrC,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,OAAQ,SAAS,uBAAuB;AAAA,YACvD,IAAI;AAAA,UACN,CAAC;AACD;AAAA,QACF;AACA,cAAM,aAAa,KAAK,IAAI;AAC5B,cAAM,MAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AACtD,mBAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAC3D,WAAW,CAAC,aAAa,oBAAoB,IAAI,IAAI,GAAG;AAEtD,cAAM,OAAO,QAAQ,MAAM;AAC3B,YAAI,kBAAkB;AACtB,mBAAW,SAAS,SAAS,OAAO,GAAG;AACrC,cAAI,MAAM,YAAY,KAAM;AAAA,QAC9B;AACA,YAAI,mBAAmB,sBAAsB;AAC3C,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,SAAS;AAAA,YACT,OAAO,EAAE,MAAM,OAAQ,SAAS,qCAAqC;AAAA,YACrE,IAAI;AAAA,UACN,CAAC;AACD;AAAA,QACF;AAEA,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB,MAAM,WAAW;AAAA,UACrC,sBAAsB,CAAC,QAAgB;AAErC,qBAAS,IAAI,KAAK,EAAE,WAAW,YAAY,KAAK,IAAI,GAAG,SAAS,KAAK,CAAC;AACtE,gCAAoB,mBAAmB,GAAG;AAAA,UAC5C;AAAA,QACF,CAAC;AAED,kBAAU,UAAU,MAAM;AACxB,gBAAM,MAAM,UAAU;AACtB,cAAI,KAAK;AACP,gCAAoB,mBAAmB,KAAK,SAAS;AACrD,qBAAS,OAAO,GAAG;AAAA,UACrB;AAAA,QACF;AAEA,cAAM,SAAS,yBAAyB;AACxC,cAAM,OAAO,QAAQ,SAAS;AAC9B,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI,IAAI;AAChD,mBAAW,QAAQ,MAAM,UAAU,aAAa,QAAW,KAAK,IAAI,IAAI,QAAQ;AAAA,MAClF,OAAO;AACL,gBAAQ,OAAO;AAAA,UACb,WAAU,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA,QACpC;AACA,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,4CAA4C;AAAA,UAC5E,IAAI;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,eAAW,QAAQ,SAAS,WAAW,KAAK,IAAI,IAAI,QAAQ;AAC5D,QAAI,CAAC,IAAI,aAAa;AACpB,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,QAAQ,SAAS,wBAAwB;AAAA,QACxD,IAAI;AAAA,MACN,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,IAAI,IAAI,QAAQ,YAAY,OAAO,KAAU,QAAa;AAExD,QAAM,QAAgB,IAAI,MAAM;AAChC,MAAI,eAAe,KAAK,GAAG;AACzB,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kDAAkD,CAAC;AACjF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,OAAO,WAAW;AAE7B,sBAAkB,KAAK;AACvB,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AAEpC,UAAI,MAAM,YAAY,QAAQ,MAAM,GAAG;AACrC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,uBAAuB;AAAA,UACvD,IAAI;AAAA,QACN,CAAC;AACD;AAAA,MACF;AACA,YAAM,aAAa,KAAK,IAAI;AAC5B,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,OAAO,MAAM,SAAS;AAAA,IACnC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,OAAO,SAAS,SAAS;AAAA,EACtC;AACF,CAAC;AAED,IAAI,OAAO,QAAQ,YAAY,OAAO,KAAU,QAAa;AAE3D,QAAM,QAAgB,IAAI,MAAM;AAChC,MAAI,eAAe,KAAK,GAAG;AACzB,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kDAAkD,CAAC;AACjF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,CAAC,QAAQ;AACX,eAAW,UAAU,WAAW;AAEhC,sBAAkB,KAAK;AACvB,YAAQ,KAAK,GAAG;AAChB;AAAA,EACF;AAEA,QAAM,YAAY,IAAI,QAAQ,gBAAgB;AAC9C,MAAI,CAAC,aAAa,CAAC,SAAS,IAAI,SAAS,GAAG;AAC1C,QAAI,OAAO,GAAG,EAAE,KAAK,+BAA+B;AACpD;AAAA,EACF;AAEA,MAAI;AACF,UAAM,YAAY,EAAE,OAAO,GAAG,YAAY;AACxC,YAAM,QAAQ,SAAS,IAAI,SAAS;AAEpC,UAAI,MAAM,YAAY,QAAQ,MAAM,GAAG;AACrC,YAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACnB,SAAS;AAAA,UACT,OAAO,EAAE,MAAM,OAAQ,SAAS,uBAAuB;AAAA,UACvD,IAAI;AAAA,QACN,CAAC;AACD;AAAA,MACF;AACA,YAAM,MAAM,UAAU,cAAc,KAAK,GAAG;AAC5C,iBAAW,UAAU,MAAM,SAAS;AAAA,IACtC,CAAC;AAAA,EACH,QAAQ;AACN,eAAW,UAAU,SAAS,SAAS;AAAA,EACzC;AACF,CAAC;AAID,QAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,QAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACpE,UAAQ,MAAM,mCAAmC,GAAG,EAAE;AACxD,CAAC;AAED,QAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,UAAQ,MAAM,kCAAkC,IAAI,SAAS,IAAI,OAAO,EAAE;AAC1E,mBAAiB;AACnB,CAAC;AAED,IAAI,eAAe;AACnB,eAAe,mBAAmB;AAChC,MAAI,aAAc;AAClB,iBAAe;AACf,aAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAK,EAAE,MAAM;AAC/C,UAAQ,IAAI,kBAAkB;AAC9B,aAAW,CAAC,EAAE,KAAK,KAAK,UAAU;AAChC,UAAM,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC9C;AACA,MAAI;AACF,UAAM,kBAAkB;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,UAAQ,KAAK,CAAC;AAChB;AAIA,IAAM,cAAc;AACpB,IAAM,aAAa,IAAI,OAAO,MAAM,aAAa,MAAM;AACrD,UAAQ;AAAA,IACN,kCAAkC,cAAc,iBAAiB,WAAW,IAAI,IAAI;AAAA,EACtF;AACF,CAAC;AACD,WAAW,GAAG,SAAS,CAAC,QAAQ;AAC9B,UAAQ,MAAM,4BAA4B,IAAI,OAAO,EAAE;AACvD,UAAQ,KAAK,CAAC;AAChB,CAAC;AAED,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;","names":[]}

package/dist/index.js

@@ -1,71 +1,91 @@
 #!/usr/bin/env node
 import {
   SERVER_VERSION,
-  createProductBrainServer
-} from "./chunk-5V4JXM4G.js";
-import {
   bootstrap,
+  createProductBrainServer,
   getAgentSessionId,
   getWorkspaceId,
+  initFeatureFlags,
   orphanAgentSession,
-  recoverSessionState,
-  startAgentSession
-} from "./chunk-47LO6K2R.js";
+  recoverSessionState
+} from "./chunk-6E6HZFTX.js";
 import {
+  getPostHogClient,
   initAnalytics,
   shutdownAnalytics,
   trackSessionStarted
-} from "./chunk-XBMI6QHR.js";
+} from "./chunk-YMF3IQ5E.js";
 
 // src/index.ts
 import { readFileSync } from "fs";
 import { resolve } from "path";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-if (!process.env.CONVEX_SITE_URL && !process.env.PRODUCTBRAIN_API_KEY) {
+try {
+  const envPath = resolve(process.cwd(), ".env.mcp");
+  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    process.env[trimmed.slice(0, eqIdx)] ??= trimmed.slice(eqIdx + 1);
+  }
+} catch {
+}
+var withTimeout = (p, ms) => Promise.race([p, new Promise((r) => setTimeout(r, ms))]);
+var shuttingDown = false;
+async function gracefulShutdown() {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  process.stderr.write("[MCP] Graceful shutdown initiated.\n");
+  const hardExit = setTimeout(() => {
+    process.stderr.write("[MCP] Hard exit after shutdown timeout.\n");
+    process.exit(0);
+  }, 3e3);
+  try {
+    if (getAgentSessionId()) await withTimeout(orphanAgentSession(), 1500);
+  } catch {
+  }
   try {
-    const envPath = resolve(process.cwd(), ".env.mcp");
-    for (const line of readFileSync(envPath, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx === -1) continue;
-      process.env[trimmed.slice(0, eqIdx)] ??= trimmed.slice(eqIdx + 1);
-    }
+    await withTimeout(shutdownAnalytics(), 1e3);
   } catch {
   }
+  clearTimeout(hardExit);
+  process.exit(0);
 }
+process.on("SIGINT", gracefulShutdown);
+process.on("SIGTERM", gracefulShutdown);
+process.on("unhandledRejection", (reason) => {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  process.stderr.write(`[MCP] Unhandled rejection: ${msg}
+`);
+});
+process.on("uncaughtException", (err) => {
+  process.stderr.write(`[MCP] Uncaught exception: ${err.stack ?? err.message}
+`);
+  gracefulShutdown();
+});
 bootstrap();
 initAnalytics();
+initFeatureFlags(getPostHogClient());
 var server = createProductBrainServer();
 var transport = new StdioServerTransport();
+transport.onerror = (error) => {
+  process.stderr.write(`[MCP] Transport error: ${error.message}
+`);
+};
+process.stderr.write("[MCP] Starting server.\n");
 await server.connect(transport);
+process.stderr.write("[MCP] Server connected.\n");
+process.stdin.on("end", () => {
+  gracefulShutdown();
+});
 getWorkspaceId().then(async (wsId) => {
   trackSessionStarted(wsId, SERVER_VERSION);
   try {
-    await startAgentSession();
-    process.stderr.write("[MCP] Agent session started automatically.\n");
-  } catch (err) {
-    process.stderr.write(`[MCP] Auto session start failed: ${err.message}. Call agent-start manually.
-`);
     await recoverSessionState();
+  } catch {
   }
 }).catch(() => {
   process.stderr.write("[MCP] Workspace resolution deferred \u2014 will retry on first tool call.\n");
 });
-async function gracefulShutdown() {
-  if (getAgentSessionId()) {
-    await orphanAgentSession();
-  }
-  await shutdownAnalytics();
-  process.exit(0);
-}
-process.on("SIGINT", gracefulShutdown);
-process.on("SIGTERM", gracefulShutdown);
-process.stdin.on("end", async () => {
-  if (getAgentSessionId()) {
-    await orphanAgentSession();
-  }
-  await shutdownAnalytics();
-  process.exit(0);
-});
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\n\nimport {\n  getWorkspaceId,\n  bootstrap,\n  orphanAgentSession,\n  startAgentSession,\n  getAgentSessionId,\n  recoverSessionState,\n} from \"./client.js\";\nimport { initAnalytics, trackSessionStarted, shutdownAnalytics } from \"./analytics.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\n\nif (!process.env.CONVEX_SITE_URL && !process.env.PRODUCTBRAIN_API_KEY) {\n  try {\n    const envPath = resolve(process.cwd(), \".env.mcp\");\n    for (const line of readFileSync(envPath, \"utf-8\").split(\"\\n\")) {\n      const trimmed = line.trim();\n      if (!trimmed || trimmed.startsWith(\"#\")) continue;\n      const eqIdx = trimmed.indexOf(\"=\");\n      if (eqIdx === -1) continue;\n      process.env[trimmed.slice(0, eqIdx)] ??= trimmed.slice(eqIdx + 1);\n    }\n  } catch {\n    // .env.mcp not found — rely on env vars being set by the launcher\n  }\n}\n\nbootstrap();\ninitAnalytics();\n\nconst server = createProductBrainServer();\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n\ngetWorkspaceId()\n  .then(async (wsId) => {\n    trackSessionStarted(wsId, SERVER_VERSION);\n    try {\n      await startAgentSession();\n      process.stderr.write(\"[MCP] Agent session started automatically.\\n\");\n    } catch (err: any) {\n      process.stderr.write(`[MCP] Auto session start failed: ${err.message}. Call agent-start manually.\\n`);\n      await recoverSessionState();\n    }\n  })\n  .catch(() => {\n    process.stderr.write(\"[MCP] Workspace resolution deferred — will retry on first tool call.\\n\");\n  });\n\nasync function gracefulShutdown() {\n  if (getAgentSessionId()) {\n    await orphanAgentSession();\n  }\n  await shutdownAnalytics();\n  process.exit(0);\n}\n\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\n\nprocess.stdin.on(\"end\", async () => {\n  if (getAgentSessionId()) {\n    await orphanAgentSession();\n  }\n  await shutdownAnalytics();\n  process.exit(0);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,4BAA4B;AAarC,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,IAAI,sBAAsB;AACrE,MAAI;AACF,UAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,UAAU;AACjD,eAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,YAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,UAAI,UAAU,GAAI;AAClB,cAAQ,IAAI,QAAQ,MAAM,GAAG,KAAK,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAClE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,UAAU;AACV,cAAc;AAEd,IAAM,SAAS,yBAAyB;AACxC,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;AAE9B,eAAe,EACZ,KAAK,OAAO,SAAS;AACpB,sBAAoB,MAAM,cAAc;AACxC,MAAI;AACF,UAAM,kBAAkB;AACxB,YAAQ,OAAO,MAAM,8CAA8C;AAAA,EACrE,SAAS,KAAU;AACjB,YAAQ,OAAO,MAAM,oCAAoC,IAAI,OAAO;AAAA,CAAgC;AACpG,UAAM,oBAAoB;AAAA,EAC5B;AACF,CAAC,EACA,MAAM,MAAM;AACX,UAAQ,OAAO,MAAM,6EAAwE;AAC/F,CAAC;AAEH,eAAe,mBAAmB;AAChC,MAAI,kBAAkB,GAAG;AACvB,UAAM,mBAAmB;AAAA,EAC3B;AACA,QAAM,kBAAkB;AACxB,UAAQ,KAAK,CAAC;AAChB;AAEA,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;AAEtC,QAAQ,MAAM,GAAG,OAAO,YAAY;AAClC,MAAI,kBAAkB,GAAG;AACvB,UAAM,mBAAmB;AAAA,EAC3B;AACA,QAAM,kBAAkB;AACxB,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\n\nimport {\n  getWorkspaceId,\n  bootstrap,\n  orphanAgentSession,\n  getAgentSessionId,\n  recoverSessionState,\n} from \"./client.js\";\nimport { initAnalytics, trackSessionStarted, shutdownAnalytics, getPostHogClient } from \"./analytics.js\";\nimport { initFeatureFlags } from \"./featureFlags.js\";\nimport { createProductBrainServer, SERVER_VERSION } from \"./server.js\";\n\ntry {\n  const envPath = resolve(process.cwd(), \".env.mcp\");\n  for (const line of readFileSync(envPath, \"utf-8\").split(\"\\n\")) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eqIdx = trimmed.indexOf(\"=\");\n    if (eqIdx === -1) continue;\n    process.env[trimmed.slice(0, eqIdx)] ??= trimmed.slice(eqIdx + 1);\n  }\n} catch {\n  // .env.mcp not found — rely on env vars being set by the launcher\n}\n\nconst withTimeout = <T>(p: Promise<T>, ms: number): Promise<T | void> =>\n  Promise.race([p, new Promise<void>((r) => setTimeout(r, ms))]);\n\nlet shuttingDown = false;\nasync function gracefulShutdown() {\n  if (shuttingDown) return;\n  shuttingDown = true;\n  process.stderr.write(\"[MCP] Graceful shutdown initiated.\\n\");\n  // Hard-exit guard — fires if async cleanup exceeds budget.\n  // Still exits 0: SIGTERM/stdin-close is an intentional shutdown regardless.\n  const hardExit = setTimeout(() => {\n    process.stderr.write(\"[MCP] Hard exit after shutdown timeout.\\n\");\n    process.exit(0);\n  }, 3_000);\n  try {\n    if (getAgentSessionId()) await withTimeout(orphanAgentSession(), 1_500);\n  } catch {\n    /* best-effort */\n  }\n  try {\n    await withTimeout(shutdownAnalytics(), 1_000);\n  } catch {\n    /* best-effort */\n  }\n  clearTimeout(hardExit);\n  process.exit(0);\n}\n\n// Register signal handlers BEFORE server.connect so they are always active\nprocess.on(\"SIGINT\", gracefulShutdown);\nprocess.on(\"SIGTERM\", gracefulShutdown);\nprocess.on(\"unhandledRejection\", (reason) => {\n  const msg = reason instanceof Error ? reason.message : String(reason);\n  process.stderr.write(`[MCP] Unhandled rejection: ${msg}\\n`);\n});\nprocess.on(\"uncaughtException\", (err) => {\n  process.stderr.write(`[MCP] Uncaught exception: ${err.stack ?? err.message}\\n`);\n  gracefulShutdown();\n});\n\nbootstrap();\ninitAnalytics();\ninitFeatureFlags(getPostHogClient());\n\nconst server = createProductBrainServer();\nconst transport = new StdioServerTransport();\ntransport.onerror = (error) => {\n  process.stderr.write(`[MCP] Transport error: ${error.message}\\n`);\n};\nprocess.stderr.write(\"[MCP] Starting server.\\n\");\nawait server.connect(transport);\nprocess.stderr.write(\"[MCP] Server connected.\\n\");\n\nprocess.stdin.on(\"end\", () => {\n  gracefulShutdown();\n});\n\n// Do not auto-start agent sessions here: a second concurrent startAgentSession (e.g. from\n// `session action=start` right after connect) can supersede the first session while client\n// state still holds the stale id — markOriented then fails with \"superseded, not active\".\n// Call `session action=start` or `start` explicitly (STD-135).\ngetWorkspaceId()\n  .then(async (wsId) => {\n    trackSessionStarted(wsId, SERVER_VERSION);\n    try {\n      await recoverSessionState();\n    } catch {\n      /* best-effort — fresh stdio has nothing to recover */\n    }\n  })\n  .catch(() => {\n    process.stderr.write(\"[MCP] Workspace resolution deferred — will retry on first tool call.\\n\");\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,4BAA4B;AAarC,IAAI;AACF,QAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,UAAU;AACjD,aAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,UAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,QAAI,UAAU,GAAI;AAClB,YAAQ,IAAI,QAAQ,MAAM,GAAG,KAAK,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,EAClE;AACF,QAAQ;AAER;AAEA,IAAM,cAAc,CAAI,GAAe,OACrC,QAAQ,KAAK,CAAC,GAAG,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;AAE/D,IAAI,eAAe;AACnB,eAAe,mBAAmB;AAChC,MAAI,aAAc;AAClB,iBAAe;AACf,UAAQ,OAAO,MAAM,sCAAsC;AAG3D,QAAM,WAAW,WAAW,MAAM;AAChC,YAAQ,OAAO,MAAM,2CAA2C;AAChE,YAAQ,KAAK,CAAC;AAAA,EAChB,GAAG,GAAK;AACR,MAAI;AACF,QAAI,kBAAkB,EAAG,OAAM,YAAY,mBAAmB,GAAG,IAAK;AAAA,EACxE,QAAQ;AAAA,EAER;AACA,MAAI;AACF,UAAM,YAAY,kBAAkB,GAAG,GAAK;AAAA,EAC9C,QAAQ;AAAA,EAER;AACA,eAAa,QAAQ;AACrB,UAAQ,KAAK,CAAC;AAChB;AAGA,QAAQ,GAAG,UAAU,gBAAgB;AACrC,QAAQ,GAAG,WAAW,gBAAgB;AACtC,QAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,QAAM,MAAM,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACpE,UAAQ,OAAO,MAAM,8BAA8B,GAAG;AAAA,CAAI;AAC5D,CAAC;AACD,QAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,UAAQ,OAAO,MAAM,6BAA6B,IAAI,SAAS,IAAI,OAAO;AAAA,CAAI;AAC9E,mBAAiB;AACnB,CAAC;AAED,UAAU;AACV,cAAc;AACd,iBAAiB,iBAAiB,CAAC;AAEnC,IAAM,SAAS,yBAAyB;AACxC,IAAM,YAAY,IAAI,qBAAqB;AAC3C,UAAU,UAAU,CAAC,UAAU;AAC7B,UAAQ,OAAO,MAAM,0BAA0B,MAAM,OAAO;AAAA,CAAI;AAClE;AACA,QAAQ,OAAO,MAAM,0BAA0B;AAC/C,MAAM,OAAO,QAAQ,SAAS;AAC9B,QAAQ,OAAO,MAAM,2BAA2B;AAEhD,QAAQ,MAAM,GAAG,OAAO,MAAM;AAC5B,mBAAiB;AACnB,CAAC;AAMD,eAAe,EACZ,KAAK,OAAO,SAAS;AACpB,sBAAoB,MAAM,cAAc;AACxC,MAAI;AACF,UAAM,oBAAoB;AAAA,EAC5B,QAAQ;AAAA,EAER;AACF,CAAC,EACA,MAAM,MAAM;AACX,UAAQ,OAAO,MAAM,6EAAwE;AAC/F,CAAC;","names":[]}

package/dist/{setup-GZ5OZ5OP.js → setup-BPZMFI56.js}

@@ -1,90 +1,20 @@
 #!/usr/bin/env node
 import {
+  MCP_NPX_PACKAGE,
   initAnalytics,
+  resolveClient,
   shutdownAnalytics,
   trackSetupCompleted,
-  trackSetupStarted
-} from "./chunk-XBMI6QHR.js";
+  trackSetupStarted,
+  writeClientConfig
+} from "./chunk-YMF3IQ5E.js";
 
 // src/cli/setup.ts
 import { execSync } from "child_process";
 import { createInterface } from "readline";
-import { existsSync as existsSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join2 } from "path";
-
-// src/cli/config-writer.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
-import { join, dirname } from "path";
-import { homedir, platform } from "os";
-var SERVER_ENTRY_KEY = "Product Brain";
-var LEGACY_ENTRY_KEY = "productbrain";
-function buildServerEntry(apiKey) {
-  return {
-    command: "npx",
-    args: ["-y", "@productbrain/mcp@beta"],
-    env: { PRODUCTBRAIN_API_KEY: apiKey }
-  };
-}
-function getCursorConfigPath() {
-  return join(process.cwd(), ".cursor", "mcp.json");
-}
-function getClaudeDesktopConfigPath() {
-  const os = platform();
-  if (os === "darwin") {
-    return join(
-      homedir(),
-      "Library",
-      "Application Support",
-      "Claude",
-      "claude_desktop_config.json"
-    );
-  }
-  if (os === "win32") {
-    const appData = process.env.APPDATA ?? join(homedir(), "AppData", "Roaming");
-    return join(appData, "Claude", "claude_desktop_config.json");
-  }
-  return null;
-}
-function resolveClient(name) {
-  if (name === "Cursor") {
-    return { name, configPath: getCursorConfigPath() };
-  }
-  const configPath = getClaudeDesktopConfigPath();
-  return configPath ? { name, configPath } : null;
-}
-function readJsonSafe(path) {
-  if (!existsSync(path)) return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-async function writeClientConfig(client, apiKey) {
-  const config = readJsonSafe(client.configPath);
-  const serversKey = "mcpServers";
-  if (!config[serversKey]) config[serversKey] = {};
-  if (config[serversKey][LEGACY_ENTRY_KEY]) {
-    const legacy = config[serversKey][LEGACY_ENTRY_KEY];
-    config[serversKey][SERVER_ENTRY_KEY] = {
-      ...buildServerEntry(apiKey),
-      env: { ...legacy.env, PRODUCTBRAIN_API_KEY: legacy.env?.PRODUCTBRAIN_API_KEY ?? apiKey }
-    };
-    delete config[serversKey][LEGACY_ENTRY_KEY];
-  } else {
-    const existing = config[serversKey][SERVER_ENTRY_KEY];
-    config[serversKey][SERVER_ENTRY_KEY] = existing ? { ...existing, env: { ...existing.env, PRODUCTBRAIN_API_KEY: apiKey } } : buildServerEntry(apiKey);
-  }
-  const dir = dirname(client.configPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  writeFileSync(client.configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-  return true;
-}
-
-// src/cli/setup.ts
-var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://productbrain.io";
+import { existsSync, writeFileSync, mkdirSync } from "fs";
+import { join } from "path";
+var APP_URL = process.env.PRODUCTBRAIN_APP_URL ?? "https://work.productbrain.io";
 function bold(s) {
   return `\x1B[1m${s}\x1B[0m`;
 }
@@ -102,10 +32,10 @@ function log(msg) {
 `);
 }
 function openBrowser(url) {
-  const platform2 = process.platform;
+  const platform = process.platform;
   try {
-    if (platform2 === "darwin") execSync(`open "${url}"`);
-    else if (platform2 === "win32") execSync(`start "" "${url}"`);
+    if (platform === "darwin") execSync(`open "${url}"`);
+    else if (platform === "win32") execSync(`start "" "${url}"`);
     else execSync(`xdg-open "${url}"`);
   } catch {
     log(dim(`  Could not open browser automatically.`));
@@ -139,7 +69,7 @@ function promptChoice(question, choices) {
     });
   });
 }
-var DEFAULT_CLOUD_URL = "https://trustworthy-kangaroo-277.convex.site";
+var DEFAULT_CLOUD_URL = "https://gateway.productbrain.io";
 async function verifyWorkspace(apiKey) {
   const siteUrl = process.env.CONVEX_SITE_URL ?? process.env.PRODUCTBRAIN_URL ?? DEFAULT_CLOUD_URL;
   try {
@@ -249,7 +179,7 @@ function printConfigSnippet(apiKey) {
       mcpServers: {
         "Product Brain": {
           command: "npx",
-          args: ["-y", "@productbrain/mcp@beta"],
+          args: ["-y", MCP_NPX_PACKAGE],
           env: { PRODUCTBRAIN_API_KEY: apiKey }
         }
       }
@@ -285,34 +215,35 @@ Say **"Start PB"** or **"Start Product Brain"** to begin. This single call:
 
 ## Tool Workflow
 
-1. **Start here**: \`orient\` or \`start\` \u2014 workspace context + next action
-2. **Search**: \`search\` \u2014 find entries across all collections
-3. **Drill in**: \`get-entry\` \u2014 full record with data, labels, relations
-4. **Context**: \`gather-context\` \u2014 related knowledge around an entry or task
-5. **Capture**: \`capture\` \u2014 create a draft with auto-linking + quality score
-6. **Commit**: \`commit-entry\` \u2014 promote draft to SSOT (only when user confirms)
-7. **Connect**: \`suggest-links\` then \`relate-entries\` to build the graph
+1. **Start here**: \`start\` \u2014 workspace context + next action
+2. **Search**: \`entries action=search\` \u2014 find entries across all collections
+3. **Drill in**: \`entries action=get\` \u2014 full record with data, labels, relations
+4. **Context**: \`context action=gather\` \u2014 related knowledge around an entry or task
+5. **Capture**: \`capture\` \u2014 create knowledge with auto-linking + quality score
+6. **Commit**: \`commit-entry\` \u2014 promote drafts to SSOT when confirmation is still required
+7. **Connect**: \`graph action=suggest\` then \`relations action=create\` to build the graph
 
 ## Bulk Knowledge Input
 
 When given a document or batch of knowledge to capture:
 1. Scan the input \u2014 identify all collections needed
-2. Call \`list-collections\` \u2014 compare against what exists
+2. Call \`collections action=list\` \u2014 compare against what exists
 3. Propose missing collections to the user for confirmation
-4. Call \`create-collection\` for each confirmed collection
+4. Call \`collections action=create\` for each confirmed collection
 5. Then capture entries into the correct collections
 
 Never stuff entries into the wrong collection. Never silently skip knowledge.
 
 ## Rules
 
-- Always capture as draft first. Only call \`commit-entry\` when the user confirms.
-- Use \`suggest-links\` after capturing to discover and create relations.
-- Collections are dynamic \u2014 use \`create-collection\` when the workspace needs new ones.
+- In Open mode, user-authored captures can commit immediately unless the user asks to keep them as drafts.
+- In consensus/role modes, only call \`commit-entry\` when the user confirms.
+- Use \`graph action=suggest\` after capturing to discover and create relations.
+- Collections are dynamic \u2014 use \`collections action=create\` when the workspace needs new ones.
 - When lost, fetch \`productbrain://orientation\` for the full system map.
 `;
 function isCursorProject() {
-  return existsSync2(join2(process.cwd(), ".cursor")) || existsSync2(join2(process.cwd(), ".cursorignore"));
+  return existsSync(join(process.cwd(), ".cursor")) || existsSync(join(process.cwd(), ".cursorignore"));
 }
 async function offerCursorRulesInstall() {
   if (!isCursorProject()) return;
@@ -322,22 +253,22 @@ async function offerCursorRulesInstall() {
     log(dim("  Skipped rule install."));
     return;
   }
-  const rulesDir = join2(process.cwd(), ".cursor", "rules");
-  const rulePath = join2(rulesDir, CURSOR_RULE_FILENAME);
-  if (existsSync2(rulePath)) {
+  const rulesDir = join(process.cwd(), ".cursor", "rules");
+  const rulePath = join(rulesDir, CURSOR_RULE_FILENAME);
+  if (existsSync(rulePath)) {
     log(`  ${dim("\u2139")} Rule already exists at ${dim(rulePath)} \u2014 skipped`);
     return;
   }
-  if (!existsSync2(rulesDir)) {
-    mkdirSync2(rulesDir, { recursive: true });
+  if (!existsSync(rulesDir)) {
+    mkdirSync(rulesDir, { recursive: true });
   }
-  writeFileSync2(rulePath, CURSOR_RULE_CONTENT, "utf-8");
+  writeFileSync(rulePath, CURSOR_RULE_CONTENT, "utf-8");
   log(`  ${green("\u2713")} Installed rule at ${dim(rulePath)}`);
 }
 function buildDeeplink(apiKey) {
   const config = JSON.stringify({
     command: "npx",
-    args: ["-y", "@productbrain/mcp@beta"],
+    args: ["-y", MCP_NPX_PACKAGE],
     env: { PRODUCTBRAIN_API_KEY: apiKey }
   });
   const encoded = Buffer.from(config).toString("base64url");
@@ -356,10 +287,11 @@ function printClaudeSnippet() {
   log("");
   log(`    When Product Brain MCP is available, say "Start PB" at the beginning`);
   log(`    of each session to orient to the workspace and unlock write tools.`);
-  log(`    Always capture as draft first; only commit when the user confirms.`);
+  log(`    In Open mode, user-authored captures can commit immediately unless the user asks to keep drafts.`);
+  log(`    In consensus/role modes, only commit when the user confirms.`);
   log("");
 }
 export {
   runSetup
 };
-//# sourceMappingURL=setup-GZ5OZ5OP.js.map
+//# sourceMappingURL=setup-BPZMFI56.js.map

package/dist/setup-BPZMFI56.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/setup.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * `npx @productbrain/mcp@beta setup`\n *\n * Guided onboarding: get API key from the app, paste it, write MCP config,\n * and optionally install Cursor rules/skills (additive-only).\n */\n\nimport { execSync } from \"node:child_process\";\nimport { createInterface } from \"node:readline\";\nimport { existsSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { resolveClient, writeClientConfig, MCP_NPX_PACKAGE, type McpClientInfo } from \"./config-writer.js\";\nimport { initAnalytics, trackSetupStarted, trackSetupCompleted, shutdownAnalytics } from \"../analytics.js\";\n\nconst APP_URL =\n  process.env.PRODUCTBRAIN_APP_URL ?? \"https://work.productbrain.io\";\n\n// ── Helpers ─────────────────────────────────────────────────────────────\n\nfunction bold(s: string) {\n  return `\\x1b[1m${s}\\x1b[0m`;\n}\nfunction green(s: string) {\n  return `\\x1b[32m${s}\\x1b[0m`;\n}\nfunction dim(s: string) {\n  return `\\x1b[2m${s}\\x1b[0m`;\n}\nfunction orange(s: string) {\n  return `\\x1b[33m${s}\\x1b[0m`;\n}\n\nfunction log(msg: string) {\n  process.stdout.write(`${msg}\\n`);\n}\n\nfunction openBrowser(url: string) {\n  const platform = process.platform;\n  try {\n    if (platform === \"darwin\") execSync(`open \"${url}\"`);\n    else if (platform === \"win32\") execSync(`start \"\" \"${url}\"`);\n    else execSync(`xdg-open \"${url}\"`);\n  } catch {\n    log(dim(`  Could not open browser automatically.`));\n    log(`  Open this URL manually: ${url}`);\n  }\n}\n\nfunction prompt(question: string): Promise<string> {\n  return new Promise((resolve) => {\n    const rl = createInterface({ input: process.stdin, output: process.stdout });\n    rl.question(question, (answer) => {\n      rl.close();\n      resolve(answer.trim());\n    });\n  });\n}\n\nfunction promptChoice(question: string, choices: string[]): Promise<number> {\n  return new Promise((resolve) => {\n    log(\"\");\n    log(bold(question));\n    choices.forEach((c, i) => log(`  ${i + 1}) ${c}`));\n    const rl = createInterface({ input: process.stdin, output: process.stdout });\n    rl.question(`\\n  ${dim(\"Choice [1]:\")} `, (line) => {\n      rl.close();\n      const n = parseInt(line.trim(), 10);\n      if (isNaN(n) || n < 1 || n > choices.length) {\n        resolve(0);\n      } else {\n        resolve(n - 1);\n      }\n    });\n  });\n}\n\n// ── Workspace Verification ───────────────────────────────────────────────\n\nconst DEFAULT_CLOUD_URL = \"https://gateway.productbrain.io\";\n\nasync function verifyWorkspace(\n  apiKey: string,\n): Promise<{ name: string; slug: string } | null> {\n  const siteUrl = process.env.CONVEX_SITE_URL\n    ?? process.env.PRODUCTBRAIN_URL\n    ?? DEFAULT_CLOUD_URL;\n\n  try {\n    const res = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${apiKey}`,\n      },\n      body: JSON.stringify({ fn: \"resolveWorkspace\", args: {} }),\n    });\n\n    if (!res.ok) return null;\n    const json = (await res.json()) as {\n      data?: { name: string; slug: string } | null;\n      error?: string;\n    };\n    return json.data ?? null;\n  } catch {\n    return null;\n  }\n}\n\n// ── Main ────────────────────────────────────────────────────────────────\n\nexport async function runSetup() {\n  initAnalytics();\n  trackSetupStarted();\n\n  log(\"\");\n  log(bold(`  Product${orange(\"Brain\")} Setup`));\n  log(dim(\"  Connect your AI assistant to your chain\\n\"));\n\n  const apiKeysUrl = `${APP_URL}/settings/api-keys`;\n\n  log(`  ${dim(\"1. Get your API key from Settings → API Keys\")}`);\n  log(`     ${dim(apiKeysUrl)}\\n`);\n\n  const openNow = await prompt(`  Open this URL in your browser? [Y/n]: `);\n  if (openNow.toLowerCase() !== \"n\" && openNow.toLowerCase() !== \"no\") {\n    openBrowser(apiKeysUrl);\n  }\n\n  log(\"\");\n  log(`  ${dim(\"2. Generate a key (if you don't have one), then copy it.\\n\")}`);\n\n  const apiKey = await prompt(`  Paste your API key (pb_sk_...): `);\n\n  if (!apiKey || !apiKey.startsWith(\"pb_sk_\")) {\n    log(`  ${orange(\"!\")} Invalid key format. Keys start with pb_sk_.`);\n    log(`  Get one at ${apiKeysUrl}\\n`);\n    await shutdownAnalytics();\n    process.exit(1);\n  }\n\n  log(`  ${green(\"✓\")} Key received`);\n\n  const workspace = await verifyWorkspace(apiKey);\n  if (workspace) {\n    log(`  ${green(\"✓\")} Connected to workspace: ${bold(workspace.name)} ${dim(`(${workspace.slug})`)}`);\n  } else {\n    log(`  ${orange(\"!\")} Could not verify workspace. Check your key at ${apiKeysUrl}`);\n  }\n  log(\"\");\n\n  const CLIENT_NAMES = [\"Cursor\", \"Claude Desktop\"] as const;\n  const options = [...CLIENT_NAMES, \"Other\"];\n\n  const choice = await promptChoice(\"Where do you want to set up Product Brain?\", options);\n\n  if (choice === 2) {\n    printConfigSnippet(apiKey);\n    trackSetupCompleted(\"Other\", \"snippet_shown\");\n  } else {\n    const client = resolveClient(CLIENT_NAMES[choice]);\n    if (client) {\n      const outcome = await writeConfig(client, apiKey);\n      trackSetupCompleted(CLIENT_NAMES[choice], outcome);\n    } else {\n      log(`  ${orange(\"!\")} ${CLIENT_NAMES[choice]} config path not available on this platform.`);\n      printConfigSnippet(apiKey);\n      trackSetupCompleted(CLIENT_NAMES[choice], \"write_error\");\n    }\n  }\n\n  // Cursor-specific: offer to install rule (additive-only)\n  if (choice === 0) {\n    await offerCursorRulesInstall();\n    printDeeplink(apiKey);\n  }\n\n  // Claude-specific: print snippet (never write to CLAUDE.md)\n  if (choice === 1) {\n    printClaudeSnippet();\n  }\n\n  log(\"\");\n  log(\n    `  ${green(\"✓\")} Done! Restart your AI assistant and try: ${bold('\"Start PB\"')}`,\n  );\n  printHelpLink();\n  await shutdownAnalytics();\n}\n\nasync function writeConfig(\n  client: McpClientInfo,\n  apiKey: string,\n): Promise<\"config_written\" | \"config_existed\" | \"write_error\"> {\n  try {\n    const wrote = await writeClientConfig(client, apiKey);\n    if (wrote) {\n      log(`  ${green(\"✓\")} Wrote config to ${dim(client.configPath)}`);\n      return \"config_written\";\n    } else {\n      log(`  ${dim(\"ℹ\")} ${client.name} already configured — skipped`);\n      return \"config_existed\";\n    }\n  } catch (err: any) {\n    log(`  ${orange(\"!\")} Could not write ${client.name} config: ${err.message}`);\n    printConfigSnippet(apiKey);\n    return \"write_error\";\n  }\n}\n\nfunction printHelpLink() {\n  log(`  ${dim(`Need help? See ${APP_URL}/settings/api-keys`)}`);\n  log(\"\");\n}\n\nfunction printConfigSnippet(apiKey: string) {\n  log(\"\");\n  log(bold(\"  Add this to your MCP client config:\\n\"));\n  const snippet = JSON.stringify(\n    {\n      mcpServers: {\n        \"Product Brain\": {\n          command: \"npx\",\n          args: [\"-y\", MCP_NPX_PACKAGE],\n          env: { PRODUCTBRAIN_API_KEY: apiKey },\n        },\n      },\n    },\n    null,\n    2,\n  );\n  for (const line of snippet.split(\"\\n\")) {\n    log(`    ${line}`);\n  }\n  log(\"\");\n}\n\n// ── Cursor Rules/Skills Install (additive-only) ─────────────────────────\n\nconst CURSOR_RULE_FILENAME = \"product-brain.mdc\";\n\nconst CURSOR_RULE_CONTENT = `---\ndescription: Product Brain MCP — single source of truth for product knowledge\nglobs:\nalwaysApply: true\n---\n\n# Product Brain MCP\n\nProduct Brain is your product knowledge base. The Chain is the single source of truth.\n\nEvery entry is either a **draft** (captured but not committed) or **committed** (on the Chain, SSOT).\nCommitting to the Chain is the compounding act.\n\n## Quick Start\n\nSay **\"Start PB\"** or **\"Start Product Brain\"** to begin. This single call:\n- Orients you to the workspace (readiness, gaps, planned work)\n- Unlocks write tools for the session\n- Surfaces your next recommended action\n\n## Tool Workflow\n\n1. **Start here**: \\`start\\` — workspace context + next action\n2. **Search**: \\`entries action=search\\` — find entries across all collections\n3. **Drill in**: \\`entries action=get\\` — full record with data, labels, relations\n4. **Context**: \\`context action=gather\\` — related knowledge around an entry or task\n5. **Capture**: \\`capture\\` — create knowledge with auto-linking + quality score\n6. **Commit**: \\`commit-entry\\` — promote drafts to SSOT when confirmation is still required\n7. **Connect**: \\`graph action=suggest\\` then \\`relations action=create\\` to build the graph\n\n## Bulk Knowledge Input\n\nWhen given a document or batch of knowledge to capture:\n1. Scan the input — identify all collections needed\n2. Call \\`collections action=list\\` — compare against what exists\n3. Propose missing collections to the user for confirmation\n4. Call \\`collections action=create\\` for each confirmed collection\n5. Then capture entries into the correct collections\n\nNever stuff entries into the wrong collection. Never silently skip knowledge.\n\n## Rules\n\n- In Open mode, user-authored captures can commit immediately unless the user asks to keep them as drafts.\n- In consensus/role modes, only call \\`commit-entry\\` when the user confirms.\n- Use \\`graph action=suggest\\` after capturing to discover and create relations.\n- Collections are dynamic — use \\`collections action=create\\` when the workspace needs new ones.\n- When lost, fetch \\`productbrain://orientation\\` for the full system map.\n`;\n\nfunction isCursorProject(): boolean {\n  return existsSync(join(process.cwd(), \".cursor\")) || existsSync(join(process.cwd(), \".cursorignore\"));\n}\n\nasync function offerCursorRulesInstall(): Promise<void> {\n  if (!isCursorProject()) return;\n\n  const answer = await prompt(`\\n  Install Product Brain rule for Cursor? [Y/n]: `);\n  if (answer.toLowerCase() === \"n\" || answer.toLowerCase() === \"no\") {\n    log(dim(\"  Skipped rule install.\"));\n    return;\n  }\n\n  const rulesDir = join(process.cwd(), \".cursor\", \"rules\");\n  const rulePath = join(rulesDir, CURSOR_RULE_FILENAME);\n\n  if (existsSync(rulePath)) {\n    log(`  ${dim(\"ℹ\")} Rule already exists at ${dim(rulePath)} — skipped`);\n    return;\n  }\n\n  if (!existsSync(rulesDir)) {\n    mkdirSync(rulesDir, { recursive: true });\n  }\n\n  writeFileSync(rulePath, CURSOR_RULE_CONTENT, \"utf-8\");\n  log(`  ${green(\"✓\")} Installed rule at ${dim(rulePath)}`);\n}\n\nfunction buildDeeplink(apiKey: string): string {\n  const config = JSON.stringify({\n    command: \"npx\",\n    args: [\"-y\", MCP_NPX_PACKAGE],\n    env: { PRODUCTBRAIN_API_KEY: apiKey },\n  });\n  const encoded = Buffer.from(config).toString(\"base64url\");\n  return `cursor://anysphere.cursor-deeplink/mcp/install?name=${encodeURIComponent(\"Product Brain\")}&config=${encoded}`;\n}\n\nfunction printDeeplink(apiKey: string): void {\n  const link = buildDeeplink(apiKey);\n  log(\"\");\n  log(`  ${dim(\"One-click install for Cursor (paste in browser):\")}`);\n  log(`  ${link}`);\n}\n\nfunction printClaudeSnippet(): void {\n  log(\"\");\n  log(bold(\"  For Claude Code / CLAUDE.md:\"));\n  log(dim(\"  Add this line to your ~/.claude/CLAUDE.md:\"));\n  log(\"\");\n  log(`    When Product Brain MCP is available, say \"Start PB\" at the beginning`);\n  log(`    of each session to orient to the workspace and unlock write tools.`);\n  log(`    In Open mode, user-authored captures can commit immediately unless the user asks to keep drafts.`);\n  log(`    In consensus/role modes, only commit when the user confirms.`);\n  log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;AASA,SAAS,gBAAgB;AACzB,SAAS,uBAAuB;AAChC,SAAS,YAAY,eAAe,iBAAiB;AACrD,SAAS,YAAY;AAIrB,IAAM,UACJ,QAAQ,IAAI,wBAAwB;AAItC,SAAS,KAAK,GAAW;AACvB,SAAO,UAAU,CAAC;AACpB;AACA,SAAS,MAAM,GAAW;AACxB,SAAO,WAAW,CAAC;AACrB;AACA,SAAS,IAAI,GAAW;AACtB,SAAO,UAAU,CAAC;AACpB;AACA,SAAS,OAAO,GAAW;AACzB,SAAO,WAAW,CAAC;AACrB;AAEA,SAAS,IAAI,KAAa;AACxB,UAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AACjC;AAEA,SAAS,YAAY,KAAa;AAChC,QAAM,WAAW,QAAQ;AACzB,MAAI;AACF,QAAI,aAAa,SAAU,UAAS,SAAS,GAAG,GAAG;AAAA,aAC1C,aAAa,QAAS,UAAS,aAAa,GAAG,GAAG;AAAA,QACtD,UAAS,aAAa,GAAG,GAAG;AAAA,EACnC,QAAQ;AACN,QAAI,IAAI,yCAAyC,CAAC;AAClD,QAAI,6BAA6B,GAAG,EAAE;AAAA,EACxC;AACF;AAEA,SAAS,OAAO,UAAmC;AACjD,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,OAAG,SAAS,UAAU,CAAC,WAAW;AAChC,SAAG,MAAM;AACT,cAAQ,OAAO,KAAK,CAAC;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,aAAa,UAAkB,SAAoC;AAC1E,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,EAAE;AACN,QAAI,KAAK,QAAQ,CAAC;AAClB,YAAQ,QAAQ,CAAC,GAAG,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC3E,OAAG,SAAS;AAAA,IAAO,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS;AAClD,SAAG,MAAM;AACT,YAAM,IAAI,SAAS,KAAK,KAAK,GAAG,EAAE;AAClC,UAAI,MAAM,CAAC,KAAK,IAAI,KAAK,IAAI,QAAQ,QAAQ;AAC3C,gBAAQ,CAAC;AAAA,MACX,OAAO;AACL,gBAAQ,IAAI,CAAC;AAAA,MACf;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAIA,IAAM,oBAAoB;AAE1B,eAAe,gBACb,QACgD;AAChD,QAAM,UAAU,QAAQ,IAAI,mBACvB,QAAQ,IAAI,oBACZ;AAEL,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC,YAAY;AAAA,MAC/D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,IAAI,oBAAoB,MAAM,CAAC,EAAE,CAAC;AAAA,IAC3D,CAAC;AAED,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAI7B,WAAO,KAAK,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,WAAW;AAC/B,gBAAc;AACd,oBAAkB;AAElB,MAAI,EAAE;AACN,MAAI,KAAK,YAAY,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC7C,MAAI,IAAI,6CAA6C,CAAC;AAEtD,QAAM,aAAa,GAAG,OAAO;AAE7B,MAAI,KAAK,IAAI,mDAA8C,CAAC,EAAE;AAC9D,MAAI,QAAQ,IAAI,UAAU,CAAC;AAAA,CAAI;AAE/B,QAAM,UAAU,MAAM,OAAO,0CAA0C;AACvE,MAAI,QAAQ,YAAY,MAAM,OAAO,QAAQ,YAAY,MAAM,MAAM;AACnE,gBAAY,UAAU;AAAA,EACxB;AAEA,MAAI,EAAE;AACN,MAAI,KAAK,IAAI,4DAA4D,CAAC,EAAE;AAE5E,QAAM,SAAS,MAAM,OAAO,oCAAoC;AAEhE,MAAI,CAAC,UAAU,CAAC,OAAO,WAAW,QAAQ,GAAG;AAC3C,QAAI,KAAK,OAAO,GAAG,CAAC,8CAA8C;AAClE,QAAI,gBAAgB,UAAU;AAAA,CAAI;AAClC,UAAM,kBAAkB;AACxB,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,KAAK,MAAM,QAAG,CAAC,eAAe;AAElC,QAAM,YAAY,MAAM,gBAAgB,MAAM;AAC9C,MAAI,WAAW;AACb,QAAI,KAAK,MAAM,QAAG,CAAC,4BAA4B,KAAK,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,UAAU,IAAI,GAAG,CAAC,EAAE;AAAA,EACrG,OAAO;AACL,QAAI,KAAK,OAAO,GAAG,CAAC,kDAAkD,UAAU,EAAE;AAAA,EACpF;AACA,MAAI,EAAE;AAEN,QAAM,eAAe,CAAC,UAAU,gBAAgB;AAChD,QAAM,UAAU,CAAC,GAAG,cAAc,OAAO;AAEzC,QAAM,SAAS,MAAM,aAAa,8CAA8C,OAAO;AAEvF,MAAI,WAAW,GAAG;AAChB,uBAAmB,MAAM;AACzB,wBAAoB,SAAS,eAAe;AAAA,EAC9C,OAAO;AACL,UAAM,SAAS,cAAc,aAAa,MAAM,CAAC;AACjD,QAAI,QAAQ;AACV,YAAM,UAAU,MAAM,YAAY,QAAQ,MAAM;AAChD,0BAAoB,aAAa,MAAM,GAAG,OAAO;AAAA,IACnD,OAAO;AACL,UAAI,KAAK,OAAO,GAAG,CAAC,IAAI,aAAa,MAAM,CAAC,8CAA8C;AAC1F,yBAAmB,MAAM;AACzB,0BAAoB,aAAa,MAAM,GAAG,aAAa;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,WAAW,GAAG;AAChB,UAAM,wBAAwB;AAC9B,kBAAc,MAAM;AAAA,EACtB;AAGA,MAAI,WAAW,GAAG;AAChB,uBAAmB;AAAA,EACrB;AAEA,MAAI,EAAE;AACN;AAAA,IACE,KAAK,MAAM,QAAG,CAAC,6CAA6C,KAAK,YAAY,CAAC;AAAA,EAChF;AACA,gBAAc;AACd,QAAM,kBAAkB;AAC1B;AAEA,eAAe,YACb,QACA,QAC8D;AAC9D,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AACpD,QAAI,OAAO;AACT,UAAI,KAAK,MAAM,QAAG,CAAC,oBAAoB,IAAI,OAAO,UAAU,CAAC,EAAE;AAC/D,aAAO;AAAA,IACT,OAAO;AACL,UAAI,KAAK,IAAI,QAAG,CAAC,IAAI,OAAO,IAAI,oCAA+B;AAC/D,aAAO;AAAA,IACT;AAAA,EACF,SAAS,KAAU;AACjB,QAAI,KAAK,OAAO,GAAG,CAAC,oBAAoB,OAAO,IAAI,YAAY,IAAI,OAAO,EAAE;AAC5E,uBAAmB,MAAM;AACzB,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gBAAgB;AACvB,MAAI,KAAK,IAAI,kBAAkB,OAAO,oBAAoB,CAAC,EAAE;AAC7D,MAAI,EAAE;AACR;AAEA,SAAS,mBAAmB,QAAgB;AAC1C,MAAI,EAAE;AACN,MAAI,KAAK,yCAAyC,CAAC;AACnD,QAAM,UAAU,KAAK;AAAA,IACnB;AAAA,MACE,YAAY;AAAA,QACV,iBAAiB;AAAA,UACf,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,eAAe;AAAA,UAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,OAAO,IAAI,EAAE;AAAA,EACnB;AACA,MAAI,EAAE;AACR;AAIA,IAAM,uBAAuB;AAE7B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkD5B,SAAS,kBAA2B;AAClC,SAAO,WAAW,KAAK,QAAQ,IAAI,GAAG,SAAS,CAAC,KAAK,WAAW,KAAK,QAAQ,IAAI,GAAG,eAAe,CAAC;AACtG;AAEA,eAAe,0BAAyC;AACtD,MAAI,CAAC,gBAAgB,EAAG;AAExB,QAAM,SAAS,MAAM,OAAO;AAAA,iDAAoD;AAChF,MAAI,OAAO,YAAY,MAAM,OAAO,OAAO,YAAY,MAAM,MAAM;AACjE,QAAI,IAAI,yBAAyB,CAAC;AAClC;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,QAAQ,IAAI,GAAG,WAAW,OAAO;AACvD,QAAM,WAAW,KAAK,UAAU,oBAAoB;AAEpD,MAAI,WAAW,QAAQ,GAAG;AACxB,QAAI,KAAK,IAAI,QAAG,CAAC,2BAA2B,IAAI,QAAQ,CAAC,iBAAY;AACrE;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,cAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAAA,EACzC;AAEA,gBAAc,UAAU,qBAAqB,OAAO;AACpD,MAAI,KAAK,MAAM,QAAG,CAAC,sBAAsB,IAAI,QAAQ,CAAC,EAAE;AAC1D;AAEA,SAAS,cAAc,QAAwB;AAC7C,QAAM,SAAS,KAAK,UAAU;AAAA,IAC5B,SAAS;AAAA,IACT,MAAM,CAAC,MAAM,eAAe;AAAA,IAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,EACtC,CAAC;AACD,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,WAAW;AACxD,SAAO,uDAAuD,mBAAmB,eAAe,CAAC,WAAW,OAAO;AACrH;AAEA,SAAS,cAAc,QAAsB;AAC3C,QAAM,OAAO,cAAc,MAAM;AACjC,MAAI,EAAE;AACN,MAAI,KAAK,IAAI,kDAAkD,CAAC,EAAE;AAClE,MAAI,KAAK,IAAI,EAAE;AACjB;AAEA,SAAS,qBAA2B;AAClC,MAAI,EAAE;AACN,MAAI,KAAK,gCAAgC,CAAC;AAC1C,MAAI,IAAI,8CAA8C,CAAC;AACvD,MAAI,EAAE;AACN,MAAI,0EAA0E;AAC9E,MAAI,wEAAwE;AAC5E,MAAI,sGAAsG;AAC1G,MAAI,kEAAkE;AACtE,MAAI,EAAE;AACR;","names":[]}