@productbrain/mcp 0.0.1-beta.1815 → 0.0.1-beta.1821

package/dist/{chunk-AMJILQKI.js → chunk-6JNK5DIZ.js}

@@ -1049,4 +1049,4 @@ export {
   requireWriteAccess,
   recoverSessionState
 };
-//# sourceMappingURL=chunk-AMJILQKI.js.map
+//# sourceMappingURL=chunk-6JNK5DIZ.js.map

package/dist/chunk-6JNK5DIZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.ts","../src/auth.ts","../src/cli/config-writer.ts","../src/client.ts","../src/prod-fallthrough.ts"],"sourcesContent":["/**\n * PostHog analytics for SynergyOS maintainers — tracks MCP usage (sessions, tool calls).\n * Not user-facing. Key is injected at build time via SYNERGYOS_POSTHOG_KEY.\n * Override with POSTHOG_MCP_KEY for self-hosted deployments.\n */\n\nimport { userInfo } from \"node:os\";\nimport { PostHog } from \"posthog-node\";\n\nlet client: PostHog | null = null;\nlet distinctId = \"anonymous\";\n\nconst POSTHOG_HOST = \"https://eu.i.posthog.com\";\n\n/** Injected at build time: SYNERGYOS_POSTHOG_KEY env when running `npm run build`/publish. */\ndeclare const __SYNERGYOS_POSTHOG_KEY__: string;\n\n/** Only write to stderr when MCP_DEBUG=1 for quieter default DX. */\nfunction log(msg: string): void {\n  if (process.env.MCP_DEBUG === \"1\") {\n    process.stderr.write(msg);\n  }\n}\n\nfunction getBuildTimeKey(): string {\n  try {\n    return __SYNERGYOS_POSTHOG_KEY__;\n  } catch {\n    // Not replaced by bundler (e.g. running via tsx in tests) — treat as absent.\n    return \"\";\n  }\n}\n\nexport function initAnalytics(): void {\n  const apiKey = process.env.POSTHOG_MCP_KEY || getBuildTimeKey();\n  if (!apiKey) {\n    log(\"[MCP-ANALYTICS] No PostHog key — tracking disabled (set SYNERGYOS_POSTHOG_KEY at build time for publish)\\n\");\n    return;\n  }\n\n  client = new PostHog(apiKey, {\n    host: POSTHOG_HOST,\n    flushAt: 1,\n    flushInterval: 5000,\n    featureFlagsPollingInterval: 30_000,\n  });\n  distinctId = process.env.MCP_USER_ID || fallbackDistinctId();\n\n  log(`[MCP-ANALYTICS] Initialized — host=${POSTHOG_HOST} distinctId=${distinctId}\\n`);\n}\n\nfunction fallbackDistinctId(): string {\n  try {\n    return userInfo().username;\n  } catch {\n    return `os-${process.pid}`;\n  }\n}\n\nexport function trackSessionStarted(\n  workspaceId: string,\n  serverVersion: string,\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_session_started\",\n    properties: {\n      workspace_id: workspaceId,\n      server_version: serverVersion,\n      source: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport function trackToolCall(\n  fn: string,\n  status: \"ok\" | \"error\",\n  durationMs: number,\n  workspaceId: string,\n  errorMsg?: string,\n): void {\n  const properties: Record<string, unknown> = {\n    tool: fn,\n    status,\n    duration_ms: durationMs,\n    workspace_id: workspaceId,\n    source: \"mcp-server\",\n    $groups: { workspace: workspaceId },\n  };\n  if (errorMsg) properties.error = errorMsg;\n\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_tool_called\",\n    properties,\n  });\n}\n\nexport function trackSetupStarted(): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_setup_started\",\n    properties: {\n      source: \"mcp-server\",\n      platform: process.platform,\n    },\n  });\n}\n\nexport function trackSetupCompleted(\n  chosenClient: string,\n  outcome: \"config_written\" | \"config_existed\" | \"snippet_shown\" | \"write_error\",\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_setup_completed\",\n    properties: {\n      client: chosenClient,\n      outcome,\n      source: \"mcp-server\",\n      platform: process.platform,\n    },\n  });\n}\n\nexport function trackQualityVerdict(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    entry_type: string;\n    tier: string;\n    context: string;\n    passed: boolean;\n    source: string;\n    criteria_total: number;\n    criteria_failed: number;\n    llm_scheduled: boolean;\n    /** WP-475 E3: rubric methodology that produced the verdict (v1-vs-v2 seam). */\n    methodology_version?: string;\n  },\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"quality_verdict_generated\",\n    properties: {\n      ...props,\n      workspace_id: workspaceId,\n      source_system: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport function trackQualityCheck(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    entry_type: string;\n    tier: string;\n    passed: boolean;\n    source: string;\n    llm_status?: string;\n    llm_duration_ms?: number;\n    llm_error?: string;\n    has_roger_martin: boolean;\n  },\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"quality_verdict_checked\",\n    properties: {\n      ...props,\n      workspace_id: workspaceId,\n      source_system: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport type ClassifierReasonCategory =\n  | \"auto-routed\"\n  | \"low-confidence\"\n  | \"ambiguous\"\n  | \"non-provisioned\";\n\ntype CaptureClassifierTelemetryProps = {\n  predicted_collection: string;\n  confidence: number;\n  auto_routed: boolean;\n  reason_category: ClassifierReasonCategory;\n  explicit_collection_provided: boolean;\n};\n\nfunction trackCaptureClassifierEvent(\n  event: \"mcp_capture_classifier_evaluated\" | \"mcp_capture_classifier_auto_routed\" | \"mcp_capture_classifier_fallback\",\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event,\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics are advisory and must never break capture flow.\n  }\n}\n\nexport function trackCaptureClassifierEvaluated(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_evaluated\", workspaceId, props);\n}\n\nexport function trackCaptureClassifierAutoRouted(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_auto_routed\", workspaceId, props);\n}\n\nexport function trackCaptureClassifierFallback(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_fallback\", workspaceId, props);\n}\n\n/** GLO-26 / TEN-156: every SSOT commit for PostHog funnels (split auto vs manual). */\nexport function trackChainEntryCommitted(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    collection?: string;\n    commit_method: \"auto\" | \"manual\";\n    surface:\n      | \"mcp_commit_tool\"\n      | \"mcp_capture\"\n      | \"mcp_wrapup\";\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"chain_entry_committed\",\n      properties: {\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n        ...props,\n      },\n    });\n  } catch {\n    // Analytics must never break the tool path.\n  }\n}\n\nexport function trackKnowledgeGap(\n  workspaceId: string,\n  props: {\n    query: string;\n    tool: string;\n    action: string;\n    gap_type: \"search_zero\" | \"context_task_empty\" | \"context_entry_isolated\" | \"context_graph_empty\";\n    collection_scope?: string;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"knowledge_gap_detected\",\n      properties: {\n        ...props,\n        query: props.query.slice(0, 200),\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the tool response path.\n  }\n}\n\n// ── BET-272 S6 / STD-155: Capture intelligence observability ────────────────\n\n/** Fires when formative quality hints are returned at capture time. */\nexport function trackCaptureQualityHints(\n  workspaceId: string,\n  props: {\n    collection: string;\n    hint_count: number;\n    hint_fields: string[];\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"mcp_capture_quality_hints\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break capture flow.\n  }\n}\n\n/** Fires when relation suggestions are returned at capture time. */\nexport function trackCaptureRelationSuggestions(\n  workspaceId: string,\n  props: {\n    collection: string;\n    suggestion_count: number;\n    relation_types: string[];\n    avg_confidence: number;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"mcp_capture_relation_suggestions\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break capture flow.\n  }\n}\n\n// ── BET-288 S0: Collection classification confusion matrix telemetry ────────\n\n/**\n * Fires on every collection classification (auto-routed, fallback, explicit-provided).\n * Captures the full confusion signal: predicted collection, runner-up, thinkingLayer,\n * and confidence scores. This is the baseline measurement for BET-288 algorithm changes.\n */\nexport function trackCollectionClassified(\n  workspaceId: string,\n  props: {\n    collection_slug: string;\n    thinking_layer: string | null;\n    confidence: number;\n    classified_by: \"llm\" | \"heuristic\";\n    confidence_tier: \"high\" | \"medium\" | \"low\";\n    alternative_slug: string | null;\n    alternative_confidence: number | null;\n    explicit_collection_provided: boolean;\n    auto_routed: boolean;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"collection_classified\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the capture flow.\n  }\n}\n\n// ── BET-289 S5: Field-level writing guidance telemetry ────────────────────────\n\n/** Fires when field guidance is injected into a capture prompt or response. */\nexport function trackFieldGuidanceApplied(\n  workspaceId: string,\n  props: {\n    collection: string;\n    guided_field_count: number;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"field_guidance_applied\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the capture flow.\n  }\n}\n\n/** Fires when commit-time heuristic detects field guidance violations. */\nexport function trackFieldQualityWarning(\n  workspaceId: string,\n  props: {\n    warning_count: number;\n    warning_types: string[];\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"field_quality_warning\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the commit flow.\n  }\n}\n\n/** Fires when skipGuidanceCheck is used to bypass guidance validation. */\nexport function trackFieldQualityOverride(\n  workspaceId: string,\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"field_quality_override\",\n      properties: {\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the commit flow.\n  }\n}\n\n// ── WP-306 S3: Write-Back Measurement (capture rate insights) ──────────────\n\n/** Fires on session close to track session capture rate. */\nexport function trackSessionCaptureRate(\n  workspaceId: string,\n  props: {\n    entries_created: number;\n    entries_modified: number;\n    relations_created: number;\n    had_captures: boolean;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"session_capture_rate\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break session closure.\n  }\n}\n\n/** Fires when captureAudit is triggered (activity but no captures). */\nexport function trackZeroCaptureAuditFired(\n  workspaceId: string,\n  props: {\n    suggestion_count: number;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"zero_capture_audit_fired\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break wrapup flow.\n  }\n}\n\n// ── WP-316 S1b: Capture contract observability ──────────────────────────────\n\n/** Fires when a capture-contract resource request references an unknown collection slug. */\nexport function trackCaptureContractMiss(\n  workspaceId: string,\n  props: {\n    slug: string;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"capture_contract_miss\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the resource response path.\n  }\n}\n\n/** Fires when writeBackHints are included in an orient response. */\nexport function trackWriteBackHintServed(\n  workspaceId: string,\n  props: {\n    hint_count: number;\n    has_task: boolean;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"write_back_hint_served\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break orient flow.\n  }\n}\n\n/**\n * WP-316 S1a: Fires when commit-entry fails with a structured error code.\n * Enables observability on which validation errors block commits most often.\n */\nexport function trackCommitErrorByCode(\n  workspaceId: string,\n  props: {\n    error_code: string;\n    missing_field_count: number;\n    field_error_count: number;\n    entry_id: string;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"commit_error_by_code\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the commit error path.\n  }\n}\n\n// ── WP-316 S2: Classifier divergence tracking ─────────────────────────────\n\n/**\n * Fires when an agent provides an explicit collection that differs from the\n * classifier's top suggestion. Measures how often agents override the classifier\n * and whether those overrides are to known alternatives or completely off-roster.\n */\nexport function trackClassifierDivergence(\n  workspaceId: string,\n  props: {\n    classifier_collection: string;\n    agent_collection: string;\n    classifier_confidence: number;\n    classifier_tier: string;\n    agent_in_candidates: boolean;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"classifier_divergence\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the capture flow.\n  }\n}\n\nexport function getPostHogClient(): PostHog | null {\n  return client;\n}\n\nexport async function shutdownAnalytics(): Promise<void> {\n  await client?.shutdown();\n}\n","/**\n * Request-scoped auth for HTTP transport mode.\n *\n * stdio: API key from PRODUCTBRAIN_API_KEY env, one user per process.\n * http:  API key from Bearer header per request, many users per process.\n *\n * AsyncLocalStorage propagates the token through the async call chain\n * so client.ts resolves the correct API key and state per request.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createHash } from \"node:crypto\";\n\n// ── Key Hashing (Fix 3 — session binding) ───────────────────────────────\n\n/**\n * Short one-way hash of an API key used to bind MCP sessions to a specific key.\n * Not a secret — stored in the session entry to detect session hijacking.\n */\nexport function hashKey(key: string): string {\n  return createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 16);\n}\n\n// ── Request Context ─────────────────────────────────────────────────────\n\ninterface RequestAuth {\n  apiKey: string;\n}\n\nconst requestStore = new AsyncLocalStorage<RequestAuth>();\n\nexport function runWithAuth<T>(auth: RequestAuth, fn: () => T | Promise<T>): T | Promise<T> {\n  return requestStore.run(auth, fn);\n}\n\nexport function getRequestApiKey(): string | undefined {\n  return requestStore.getStore()?.apiKey;\n}\n\n// ── Per-Key State (HTTP mode) ───────────────────────────────────────────\n\nexport interface KeyState {\n  workspaceId: string | null;\n  workspaceSlug: string | null;\n  workspaceName: string | null;\n  workspaceCreatedAt: number | null;\n  /** BET-76 FEAT-111: Cached at workspace resolution time. Defaults to 'open'. */\n  workspaceGovernanceMode: \"open\" | \"consensus\" | \"role\" | null;\n  agentSessionId: string | null;\n  apiKeyId: string | null;\n  apiKeyScope: \"read\" | \"readwrite\";\n  sessionOriented: boolean;\n  sessionClosed: boolean;\n  lastAccess: number;\n  /** DEC-789 S2: Convex deployment URL this key belongs to, resolved at key-check time. */\n  deploymentUrl: string | null;\n}\n\nconst SESSION_TTL_MS = 30 * 60 * 1000;\nconst MAX_KEYS = 100;\nconst keyStateMap = new Map<string, KeyState>();\n\nfunction newKeyState(): KeyState {\n  return {\n    workspaceId: null,\n    workspaceSlug: null,\n    workspaceName: null,\n    workspaceCreatedAt: null,\n    workspaceGovernanceMode: null,\n    agentSessionId: null,\n    apiKeyId: null,\n    apiKeyScope: \"readwrite\",\n    sessionOriented: false,\n    sessionClosed: false,\n    lastAccess: Date.now(),\n    deploymentUrl: null,\n  };\n}\n\nexport function getKeyState(apiKey: string): KeyState {\n  let s = keyStateMap.get(apiKey);\n  if (!s) {\n    s = newKeyState();\n    keyStateMap.set(apiKey, s);\n    evictStale();\n  }\n  s.lastAccess = Date.now();\n  return s;\n}\n\nfunction evictStale(): void {\n  if (keyStateMap.size <= MAX_KEYS) return;\n  const now = Date.now();\n  for (const [key, s] of keyStateMap) {\n    if (now - s.lastAccess > SESSION_TTL_MS) keyStateMap.delete(key);\n  }\n  if (keyStateMap.size > MAX_KEYS) {\n    const sorted = [...keyStateMap.entries()].sort((a, b) => a[1].lastAccess - b[1].lastAccess);\n    for (let i = 0; i < sorted.length - MAX_KEYS; i++) {\n      keyStateMap.delete(sorted[i][0]);\n    }\n  }\n}\n","/**\n * Multi-client MCP config detection and writer.\n *\n * Supports:\n *  - Cursor: .cursor/mcp.json in cwd (project-level)\n *  - Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)\n *                    %APPDATA%/Claude/claude_desktop_config.json (Windows)\n *\n * The writer reads existing config, merges the new server entry (never\n * overwrites existing entries), and writes back. Falls back to printing\n * a snippet for unsupported OS or unknown formats.\n */\n\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport { join, dirname } from \"node:path\";\nimport { homedir, platform } from \"node:os\";\n\nexport interface McpClientInfo {\n  name: string;\n  configPath: string;\n}\n\nconst SERVER_ENTRY_KEY = \"Product Brain\";\nconst LEGACY_ENTRY_KEY = \"productbrain\";\n\n/**\n * Canonical npx package specifier. Update here when exiting beta.\n * Frontend mirror: src/lib/constants/mcp.ts\n * Business rule: BR-84 (Chain)\n */\nexport const MCP_NPX_PACKAGE = \"@productbrain/mcp@beta\";\n\nfunction buildServerEntry(apiKey: string) {\n  return {\n    command: \"npx\",\n    args: [\"-y\", MCP_NPX_PACKAGE],\n    env: { PRODUCTBRAIN_API_KEY: apiKey },\n  };\n}\n\n// ── Detection ───────────────────────────────────────────────────────────\n\nfunction getCursorConfigPath(): string {\n  return join(process.cwd(), \".cursor\", \"mcp.json\");\n}\n\nfunction getClaudeDesktopConfigPath(): string | null {\n  const os = platform();\n  if (os === \"darwin\") {\n    return join(\n      homedir(),\n      \"Library\",\n      \"Application Support\",\n      \"Claude\",\n      \"claude_desktop_config.json\",\n    );\n  }\n  if (os === \"win32\") {\n    const appData = process.env.APPDATA ?? join(homedir(), \"AppData\", \"Roaming\");\n    return join(appData, \"Claude\", \"claude_desktop_config.json\");\n  }\n  // Linux: no official Claude Desktop location yet\n  return null;\n}\n\nexport function resolveClient(name: \"Cursor\" | \"Claude Desktop\"): McpClientInfo | null {\n  if (name === \"Cursor\") {\n    return { name, configPath: getCursorConfigPath() };\n  }\n  const configPath = getClaudeDesktopConfigPath();\n  return configPath ? { name, configPath } : null;\n}\n\n// ── Writing ─────────────────────────────────────────────────────────────\n\nfunction readJsonSafe(path: string): Record<string, any> {\n  if (!existsSync(path)) return {};\n  try {\n    return JSON.parse(readFileSync(path, \"utf-8\"));\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Write or merge the Product Brain server entry into a client config file.\n * Migrates legacy \"productbrain\" key to \"Product Brain\" when present.\n * Returns true if the config was written, false if already present.\n */\nexport async function writeClientConfig(\n  client: McpClientInfo,\n  apiKey: string,\n): Promise<boolean> {\n  const config = readJsonSafe(client.configPath);\n\n  const serversKey = \"mcpServers\";\n  if (!config[serversKey]) config[serversKey] = {};\n\n  // Migrate legacy \"productbrain\" key or update existing Product Brain with new API key\n  if (config[serversKey][LEGACY_ENTRY_KEY]) {\n    const legacy = config[serversKey][LEGACY_ENTRY_KEY];\n    config[serversKey][SERVER_ENTRY_KEY] = {\n      ...buildServerEntry(apiKey),\n      env: { ...legacy.env, PRODUCTBRAIN_API_KEY: legacy.env?.PRODUCTBRAIN_API_KEY ?? apiKey },\n    };\n    delete config[serversKey][LEGACY_ENTRY_KEY];\n  } else {\n    const existing = config[serversKey][SERVER_ENTRY_KEY];\n    config[serversKey][SERVER_ENTRY_KEY] = existing\n      ? { ...existing, env: { ...existing.env, PRODUCTBRAIN_API_KEY: apiKey } }\n      : buildServerEntry(apiKey);\n  }\n\n  const dir = dirname(client.configPath);\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n\n  writeFileSync(client.configPath, JSON.stringify(config, null, 2) + \"\\n\", \"utf-8\");\n  return true;\n}\n","/**\n * MCP client — communicates with the Convex HTTP Action gateway.\n *\n * Dual mode:\n *   stdio — single user, API key from env, module-level state\n *   http  — multi-user, API key from AsyncLocalStorage, per-key state\n *\n * Configuration:\n *   PRODUCTBRAIN_API_KEY  — pb_sk_* key (stdio mode; http mode gets it per-request)\n *   CONVEX_SITE_URL       — (optional) Convex deployment URL, defaults to cloud\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { trackToolCall } from \"./analytics.js\";\nimport { getRequestApiKey, getKeyState, hashKey, type KeyState } from \"./auth.js\";\nimport type { NextAction } from \"./envelope.js\";\nimport { MCP_NPX_PACKAGE } from \"./cli/config-writer.js\";\nimport { warnOnProdFallthrough } from \"./prod-fallthrough.js\";\n\n// ─── Tool Context (for audit action logging) ─────────────────────────────\n\nconst toolContextStore = new AsyncLocalStorage<{ tool: string; action?: string }>();\n\n/**\n * Run a callback with tool context for audit logging.\n * Compound tools should wrap their handler with this so health action=audit can distinguish\n * e.g. entries action=get from entries action=search.\n */\nexport function runWithToolContext<T>(\n  ctx: { tool: string; action?: string },\n  fn: () => T | Promise<T>,\n): T | Promise<T> {\n  return toolContextStore.run(ctx, fn);\n}\n\nfunction getToolContext(): { tool: string; action?: string } | null {\n  return toolContextStore.getStore() ?? null;\n}\n\nexport const DEFAULT_CLOUD_URL = \"https://gateway.productbrain.io\";\n\n/** Convex `/api/aki` error body — 4xx/5xx include `error`; structured codes include `code`. */\nexport class KernelCallError extends Error {\n  readonly status: number;\n  readonly code?: string;\n  /** WP-316 S1a: Structured commit validation — required field keys missing from entry.data. */\n  readonly missingRequiredFields?: string[];\n  /** WP-316 S1a: Structured commit validation — field-level data errors. */\n  readonly fieldErrors?: string[];\n  /**\n   * WP-465 slice ⑤: structured diagnostics carried by an `ok:false` kernel envelope\n   * (e.g. `coherencyRefusals`, `blockers`). The gateway forwards these verbatim at\n   * HTTP 200; without preserving them here a refused/blocked envelope would collapse\n   * into a bare code+message and the caller could not surface the per-offender routes.\n   */\n  readonly diagnostics?: Record<string, unknown>;\n  constructor(\n    message: string,\n    status: number,\n    code?: string,\n    missingRequiredFields?: string[],\n    fieldErrors?: string[],\n    diagnostics?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = \"KernelCallError\";\n    this.status = status;\n    this.code = code;\n    this.missingRequiredFields = missingRequiredFields;\n    this.fieldErrors = fieldErrors;\n    this.diagnostics = diagnostics;\n  }\n}\n\n// ─── Read Cache (Batch A: sub-200ms repeat calls) ─────────────────────\n\nconst CACHE_TTL_MS = 60_000; // 60s per plan\nconst CACHEABLE_FNS = [\n  \"chain.getOrientEntries\",\n  \"chain.gatherContext\",\n  \"chain.graphGatherContext\",\n  \"chain.taskAwareGatherContext\",\n  \"chain.journeyAwareGatherContext\",\n  \"chain.assembleBuildContext\",\n] as const;\n\nfunction isCacheable(fn: string): boolean {\n  return (CACHEABLE_FNS as readonly string[]).includes(fn);\n}\n\nconst READ_PATTERN =\n  /^(chain\\.(get|list|search|batchGet|gather|graph|task|journey|assemble|workspace|score|absence)|chainwork\\.(get|list|score)|maps\\.(get|list)|gitchain\\.(get|list|diff|history|runGate))/i;\n\nfunction isWrite(fn: string): boolean {\n  if (fn.startsWith(\"agent.\")) return false;\n  return !READ_PATTERN.test(fn);\n}\n\ninterface CacheEntry<T> {\n  data: T;\n  expiresAt: number;\n}\n\nconst readCache = new Map<string, CacheEntry<unknown>>();\n\nfunction cacheKey(fn: string, args: Record<string, unknown>): string {\n  return `${fn}:${JSON.stringify(args)}`;\n}\n\nfunction getCached<T>(fn: string, args: Record<string, unknown>): T | undefined {\n  if (!isCacheable(fn)) return undefined;\n  const key = cacheKey(fn, args);\n  const entry = readCache.get(key) as CacheEntry<T> | undefined;\n  if (!entry || Date.now() > entry.expiresAt) {\n    if (entry) readCache.delete(key);\n    return undefined;\n  }\n  return entry.data;\n}\n\nfunction setCached<T>(fn: string, args: Record<string, unknown>, data: T): void {\n  if (!isCacheable(fn)) return;\n  const key = cacheKey(fn, args);\n  readCache.set(key, { data, expiresAt: Date.now() + CACHE_TTL_MS });\n}\n\nfunction invalidateReadCache(): void {\n  readCache.clear();\n}\n\n// ─── State Management ─────────────────────────────────────────────────\n\nconst _stdioState: KeyState = {\n  workspaceId: null,\n  workspaceSlug: null,\n  workspaceName: null,\n  workspaceCreatedAt: null,\n  workspaceGovernanceMode: null,\n  agentSessionId: null,\n  apiKeyId: null,\n  apiKeyScope: \"readwrite\",\n  sessionOriented: false,\n  sessionClosed: false,\n  lastAccess: 0,\n  deploymentUrl: null,\n};\n\n/**\n * Returns the active client state.\n * stdio: module-level singleton. http: per-API-key state from AsyncLocalStorage.\n */\nfunction state(): KeyState {\n  const reqKey = getRequestApiKey();\n  if (reqKey) return getKeyState(reqKey);\n  return _stdioState;\n}\n\n/**\n * Cache partition key for the current request.\n *   http  — hashed API key (per-workspace isolation; hashKey is already used for\n *           session binding in auth.ts, so the raw secret is never used as a map key).\n *   stdio — fixed \"stdio\" sentinel (single user per process).\n *\n * The OAuth access_token IS the permanent pb_sk_ API key (stable per workspace\n * across refreshes — TEN-1143), so this key never churns mid-session.\n * Every per-workspace cache (collectionCache, smart-capture profile/hub) keys on this.\n */\nexport function cacheScope(): string {\n  const key = getRequestApiKey();\n  return key ? hashKey(key) : \"stdio\";\n}\n\n/**\n * Returns the active API key (request-scoped in HTTP mode, env in stdio mode).\n */\nfunction getActiveApiKey(): string {\n  const fromRequest = getRequestApiKey();\n  if (fromRequest) return fromRequest;\n  const fromEnv = process.env.PRODUCTBRAIN_API_KEY;\n  if (!fromEnv) throw new Error(\"No API key available — set PRODUCTBRAIN_API_KEY or provide Bearer token\");\n  return fromEnv;\n}\n\n// ─── Agent Session State ──────────────────────────────────────────────\n\nexport function getAgentSessionId(): string | null {\n  return state().agentSessionId;\n}\n\nexport function isSessionOriented(): boolean {\n  return state().sessionOriented;\n}\n\nexport function setSessionOriented(value: boolean): void {\n  state().sessionOriented = value;\n}\n\nexport function getApiKeyScope(): \"read\" | \"readwrite\" {\n  return state().apiKeyScope;\n}\n\nexport function isSessionClosed(): boolean {\n  return state().sessionClosed;\n}\n\nexport interface AgentSessionStartResult {\n  sessionId: string;\n  initiatedBy: string;\n  toolsScope: \"read\" | \"readwrite\";\n  workspaceName: string;\n  superseded: {\n    previousSessionId: string;\n    startedAt: string;\n    initiatedBy: string;\n  } | null;\n}\n\n/**\n * Start an agent session. Creates a session record in Convex.\n * toolsScope is derived server-side from the API key — not passed as a parameter.\n * If an active session exists, it gets superseded.\n */\nexport async function startAgentSession(): Promise<AgentSessionStartResult> {\n  const workspaceId = await getWorkspaceId();\n  const s = state();\n  if (!s.apiKeyId) {\n    throw new Error(\"Cannot start session: API key ID not resolved. Ensure workspace resolution completed.\");\n  }\n\n  const result = await kernelCall<AgentSessionStartResult>(\"agent.startSession\", {\n    workspaceId,\n    apiKeyId: s.apiKeyId,\n    clientKind: \"mcp\",\n  });\n\n  if (s.agentSessionId) {\n    resetTouchThrottle(s.agentSessionId);\n  }\n  s.agentSessionId = result.sessionId;\n  s.apiKeyScope = result.toolsScope;\n  s.sessionOriented = false;\n  s.sessionClosed = false;\n  resetTouchThrottle(result.sessionId);\n\n  return result;\n}\n\n/**\n * Close the current agent session. After this, write tools are blocked\n * even if the MCP connection stays open.\n */\nexport async function closeAgentSession(): Promise<void> {\n  const s = state();\n  if (!s.agentSessionId) return;\n  const sessionId = s.agentSessionId;\n  try {\n    await kernelCall(\"agent.closeSession\", {\n      sessionId,\n      status: \"closed\",\n    });\n  } finally {\n    resetTouchThrottle(sessionId);\n    s.sessionClosed = true;\n    s.agentSessionId = null;\n    s.sessionOriented = false;\n  }\n}\n\n/**\n * Mark current session as orphaned (used on disconnect/crash).\n */\nexport async function orphanAgentSession(): Promise<void> {\n  const s = state();\n  if (!s.agentSessionId) return;\n  const sessionId = s.agentSessionId;\n  try {\n    await kernelCall(\"agent.closeSession\", {\n      sessionId,\n      status: \"orphaned\",\n    });\n  } catch {\n    // Best-effort on disconnect\n  } finally {\n    resetTouchThrottle(sessionId);\n    s.agentSessionId = null;\n    s.sessionOriented = false;\n  }\n}\n\n/**\n * Touch the session to update lastToolCallAt. Fire-and-forget.\n * Throttled to at most once per 5s to prevent OCC conflicts when\n * multiple tool calls complete in parallel.\n */\nconst _lastTouchAtBySession = new Map<string, number>();\nconst TOUCH_THROTTLE_MS = 5_000;\n\nexport function touchSessionActivity(): void {\n  const s = state();\n  const sessionId = s.agentSessionId;\n  if (!sessionId) return;\n\n  const now = Date.now();\n  const lastTouchAt = _lastTouchAtBySession.get(sessionId) ?? 0;\n  if (now - lastTouchAt < TOUCH_THROTTLE_MS) return;\n  _lastTouchAtBySession.set(sessionId, now);\n\n  kernelCall(\"agent.touchSession\", {\n    sessionId,\n  }).catch(() => {});\n}\n\nexport function resetTouchThrottle(sessionId?: string | null): void {\n  if (sessionId) {\n    _lastTouchAtBySession.delete(sessionId);\n    return;\n  }\n  _lastTouchAtBySession.clear();\n}\n\n/**\n * Record structured activity on the current session.\n */\nexport async function recordSessionActivity(activity: {\n  entryCreated?: string;\n  entryModified?: string;\n  relationCreated?: boolean;\n  gateFailure?: boolean;\n  contradictionWarning?: boolean;\n  strategyLinkWarnedForEntryId?: string;\n}): Promise<void> {\n  const s = state();\n  if (!s.agentSessionId) return;\n  try {\n    await kernelCall(\"agent.recordActivity\", {\n      sessionId: s.agentSessionId,\n      ...activity,\n    });\n  } catch {\n    // Non-critical — don't fail the tool call over activity tracking\n  }\n}\n\n// ─── Audit ────────────────────────────────────────────────────────────\n\nexport interface AuditEntry {\n  ts: string;\n  fn: string;\n  workspace: string;\n  status: \"ok\" | \"error\";\n  durationMs: number;\n  error?: string;\n  /** For compound tools: tool name and action for audit display */\n  toolContext?: { tool: string; action?: string };\n}\n\nconst AUDIT_BUFFER_SIZE = 50;\nconst auditBuffer: AuditEntry[] = [];\n\n/**\n * Bootstrap for stdio mode: set CONVEX_SITE_URL default and warn on missing key.\n * API key is validated lazily on first kernelCall so the server can start and handle\n * signals (SIGTERM) even before credentials are provided (e.g. in tests).\n */\nexport function bootstrap(): void {\n  const explicit = process.env.CONVEX_SITE_URL ?? process.env.PRODUCTBRAIN_URL;\n  process.env.CONVEX_SITE_URL ??= process.env.PRODUCTBRAIN_URL ?? DEFAULT_CLOUD_URL;\n  warnOnProdFallthrough(process.env.CONVEX_SITE_URL, { explicit: explicit != null });\n  const pbKey = process.env.PRODUCTBRAIN_API_KEY;\n  if (!pbKey?.startsWith(\"pb_sk_\")) {\n    process.stderr.write(\n      \"[MCP] Warning: PRODUCTBRAIN_API_KEY is not set or invalid. \" +\n      \"Tool calls will fail until a valid key is provided.\\n\"\n    );\n  }\n}\n\n/**\n * Bootstrap for HTTP mode: only set CONVEX_SITE_URL.\n * API key validation happens per-request via Bearer token.\n */\nexport function bootstrapHttp(): void {\n  const explicit = process.env.CONVEX_SITE_URL ?? process.env.PRODUCTBRAIN_URL;\n  process.env.CONVEX_SITE_URL ??= process.env.PRODUCTBRAIN_URL ?? DEFAULT_CLOUD_URL;\n  warnOnProdFallthrough(process.env.CONVEX_SITE_URL, { explicit: explicit != null });\n}\n\n/** @deprecated Use bootstrap() instead. Alias kept for callers in transition. */\nexport const bootstrapCloudMode = bootstrap;\n\nfunction getEnv(key: string): string {\n  const value = process.env[key];\n  if (!value) throw new Error(`${key} environment variable is required`);\n  return value;\n}\n\n/**\n * DEC-789 S2: Parse comma-separated fallback deployment URLs from env.\n * Used by resolveDeploymentUrl() for cold-start probing after Railway restarts.\n */\nfunction parseFallbackUrls(): string[] {\n  const raw = process.env.CONVEX_FALLBACK_URLS;\n  if (!raw) return [];\n  return raw.split(\",\").map((u) => u.trim()).filter(Boolean);\n}\n\n/**\n * DEC-789 S2: Resolve the Convex deployment URL for the active API key.\n *\n * Warm path (normal): key-check already ran during OAuth authorize, so\n * state().deploymentUrl is set — return it immediately.\n *\n * No-fallback path (default / single-deployment): when CONVEX_FALLBACK_URLS\n * is not set, return CONVEX_SITE_URL directly without probing. This preserves\n * the original single-URL behavior and avoids extra fetch calls in tests and\n * stdio mode.\n *\n * Cold-start path (after Railway restart with CONVEX_FALLBACK_URLS configured):\n * keyStateMap was wiped; probe candidate URLs in order until one responds\n * ok:true to /api/key-check, store the result so subsequent calls are instant.\n *\n * Must be called from within a runWithAuth context (state() and\n * getActiveApiKey() both require it).\n */\nasync function resolveDeploymentUrl(): Promise<string> {\n  const s = state();\n  if (s.deploymentUrl) return s.deploymentUrl;\n\n  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\\/$/, \"\");\n  const fallbacks = parseFallbackUrls();\n\n  // No fallbacks configured — single-deployment setup, use primary directly.\n  // This is the common case: preserves the original behavior, no extra fetch calls.\n  if (fallbacks.length === 0) {\n    return primaryUrl;\n  }\n\n  // Multi-deployment cold-start: probe candidates in order.\n  const candidates = [primaryUrl, ...fallbacks.map((u) => u.replace(/\\/$/, \"\"))];\n\n  let apiKey: string;\n  try {\n    apiKey = getActiveApiKey();\n  } catch {\n    // No API key available — return primary and let the tool call fail normally.\n    return primaryUrl;\n  }\n\n  for (const candidate of candidates) {\n    try {\n      const probeRes = await fetch(`${candidate}/api/key-check`, {\n        method: \"POST\",\n        headers: { \"Authorization\": `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n        signal: AbortSignal.timeout(3000),\n      });\n      if (probeRes.ok) {\n        const data = await probeRes.json() as { ok: boolean };\n        if (data.ok) {\n          s.deploymentUrl = candidate;\n          return candidate;\n        }\n      }\n    } catch {\n      // Probe failed (timeout, network error, etc.) — try next candidate.\n    }\n  }\n\n  // All probes failed — return the first candidate and let the tool call fail with its normal error.\n  return candidates[0];\n}\n\nfunction shouldLogAudit(status: \"ok\" | \"error\"): boolean {\n  return status === \"error\" || process.env.MCP_DEBUG === \"1\";\n}\n\nfunction audit(fn: string, status: \"ok\" | \"error\", durationMs: number, errorMsg?: string): void {\n  const ts = new Date().toISOString();\n  const workspace = state().workspaceId ?? \"unresolved\";\n  const toolCtx = getToolContext();\n\n  const entry: AuditEntry = { ts, fn, workspace, status, durationMs };\n  if (errorMsg) entry.error = errorMsg;\n  if (toolCtx) entry.toolContext = toolCtx;\n  auditBuffer.push(entry);\n  if (auditBuffer.length > AUDIT_BUFFER_SIZE) auditBuffer.shift();\n\n  trackToolCall(fn, status, durationMs, workspace, errorMsg);\n\n  if (!shouldLogAudit(status)) return;\n\n  const base = `[MCP-AUDIT] ${ts} fn=${fn} workspace=${workspace} status=${status} duration=${durationMs}ms`;\n  if (status === \"error\" && errorMsg) {\n    process.stderr.write(`${base} error=${JSON.stringify(errorMsg)}\\n`);\n  } else {\n    process.stderr.write(`${base}\\n`);\n  }\n}\n\nexport function getAuditLog(): readonly AuditEntry[] {\n  return auditBuffer;\n}\n\n// ─── HTTP Client ──────────────────────────────────────────────────────\n\n// NextAction imported from ./envelope.js — local MCP-layer definition (mirrors convex/lib/envelopeContract.ts;\n// BR-113 prevents direct convex/ imports from MCP package, so shape is kept in sync manually)\n\ninterface GatewaySuccessResponse<T> {\n  ok: true;\n  summary: string;\n  data: T;\n  next?: NextAction[];\n  _meta?: { durationMs?: number };\n}\n\ninterface GatewayErrorResponse {\n  ok: false;\n  code?: string;\n  message?: string;\n  error?: string;\n  missingRequiredFields?: string[];\n  fieldErrors?: unknown[];\n  /** WP-465 slice ⑤: structured per-offender diagnostics (coherencyRefusals, blockers, …). */\n  diagnostics?: Record<string, unknown>;\n}\n\ntype GatewayResponse<T> = GatewaySuccessResponse<T> | GatewayErrorResponse;\n\n// STD-101: Single SSOT for TOUCH_EXCLUDED — shared by kernelCall (callGateway) and kernelCallEnvelope.\n// Exported for testability — tests assert membership to prevent OCC cascade regressions.\nexport const TOUCH_EXCLUDED = new Set([\n  \"agent.touchSession\",\n  \"agent.startSession\",\n  \"agent.markOriented\",\n  \"agent.recordActivity\",\n  \"agent.recordWrapup\",\n  \"agent.closeSession\",\n  // WP-376 α.3: orient byte report is itself a heartbeat-equivalent observability\n  // write that already patches the same agentSessions row. A follow-up touchSession\n  // would create a redundant second write per orient call (DEC-50 OCC anti-pattern).\n  \"agent.reportOrientMetric\",\n]);\n\n/**\n * Private: shared HTTP fetch + error handling for kernelCall and kernelCallEnvelope.\n * Returns the parsed envelope fields without touching the read cache or session.\n */\n/**\n * Connector identity for the gateway's context.served shared seam (DEC-1207). Sent as the\n * `x-pb-source` header so the server-side emit attributes MCP — the dominant agent surface\n * (INS-1706) that emitted nothing under the prior CLI-only seam.\n */\nconst MCP_TELEMETRY_SOURCE = \"mcp\";\n\nasync function callGateway<T>(fn: string, args: Record<string, unknown>): Promise<{\n  data: T;\n  summary: string;\n  next?: NextAction[];\n  _meta?: { durationMs?: number };\n}> {\n  const siteUrl = await resolveDeploymentUrl();\n  const apiKey = getActiveApiKey();\n\n  const start = Date.now();\n\n  let res: Response;\n  try {\n    res = await fetch(`${siteUrl}/api/aki`, {\n      method: \"POST\",\n      signal: AbortSignal.timeout(10_000),\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${apiKey}`,\n        // DEC-1207: attribute this connector for the gateway's context.served seam. MCP is\n        // the dominant agent surface (INS-1706); without this header it was emitting nothing.\n        \"x-pb-source\": MCP_TELEMETRY_SOURCE,\n      },\n      body: JSON.stringify({ fn, args }),\n    });\n  } catch (err: any) {\n    audit(fn, \"error\", Date.now() - start, err.message);\n    throw new Error(`MCP call \"${fn}\" network error: ${err.message}`);\n  }\n\n  const json = (await res.json()) as GatewayResponse<T>;\n\n  if (!res.ok || json.ok === false) {\n    const errJson = json as GatewayErrorResponse;\n    const msg = errJson.error ?? errJson.message ?? \"unknown error\";\n    audit(fn, \"error\", Date.now() - start, errJson.code ? `${msg} [${errJson.code}]` : msg);\n    throw new KernelCallError(\n      `MCP call \"${fn}\" failed (${res.status}): ${msg}`,\n      res.status,\n      errJson.code,\n      Array.isArray(errJson.missingRequiredFields) ? errJson.missingRequiredFields : undefined,\n      Array.isArray(errJson.fieldErrors) ? (errJson.fieldErrors as string[]) : undefined,\n      errJson.diagnostics && typeof errJson.diagnostics === \"object\" ? errJson.diagnostics : undefined,\n    );\n  }\n\n  audit(fn, \"ok\", Date.now() - start);\n\n  const { data, summary, next, _meta } = json as GatewaySuccessResponse<T>;\n  return {\n    data: data as T,\n    summary: summary || fn,\n    next,\n    _meta,\n  };\n}\n\n/**\n * Low-level call to the HTTP Action gateway.\n * Workspace scoping is enforced server-side from the API key — callers\n * don't need to (and can't) override the workspace.\n *\n * Read cache: orient and context-gather responses are cached for 60s.\n * Cache is invalidated on any write (safe-by-default: everything not\n * matching a known read pattern is treated as a write).\n */\nexport async function kernelCall<T>(fn: string, args: Record<string, unknown> = {}): Promise<T> {\n  const cached = getCached<T>(fn, args);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  const { data } = await callGateway<T>(fn, args);\n\n  if (isWrite(fn)) {\n    invalidateReadCache();\n  } else {\n    setCached(fn, args, data);\n  }\n\n  const s = state();\n  // Exclude session bookkeeping calls from the heartbeat touch. These mutations\n  // already target the active session document, so immediately heartbeating after\n  // them only adds avoidable OCC pressure on the same row.\n  if (s.agentSessionId && !TOUCH_EXCLUDED.has(fn)) {\n    touchSessionActivity();\n  }\n\n  return data;\n}\n\n/**\n * Calls the gateway and returns the kernel success envelope\n * ({ ok: true, summary, data, next?, _meta? }) instead of stripping to just data.\n *\n * Use for MCP tools that need thin passthrough — forwarding summary, next actions,\n * or timing metadata to the MCP client.\n *\n * Note: Throws KernelCallError on gateway errors (non-200 responses). Full\n * envelope error passthrough (ok:false at HTTP 200) deferred to WP-321 S6+\n * when DEC-571 HTTP semantics are activated on error paths.\n *\n * Does NOT use the read cache (kernel _meta.durationMs would be stale from cache;\n * thin passthrough tools need fresh timing). Does NOT call invalidateReadCache\n * (read-only by contract).\n */\nexport async function kernelCallEnvelope<T>(\n  fn: string,\n  args: Record<string, unknown> = {},\n): Promise<{\n  ok: true;\n  summary: string;\n  data: T;\n  next?: NextAction[];\n  _meta?: { durationMs?: number };\n}> {\n  const { data, summary, next, _meta } = await callGateway<T>(fn, args);\n\n  const s = state();\n  if (s.agentSessionId && !TOUCH_EXCLUDED.has(fn)) {\n    touchSessionActivity();\n  }\n\n  return { ok: true, summary, data, next, _meta };\n}\n\n// ─── Workspace Resolution ─────────────────────────────────────────────\n\nconst resolveInFlightMap = new Map<string, Promise<string>>();\n\nexport async function getWorkspaceId(): Promise<string> {\n  const s = state();\n  if (s.workspaceId) return s.workspaceId;\n\n  const apiKey = getActiveApiKey();\n  const existing = resolveInFlightMap.get(apiKey);\n  if (existing) return existing;\n\n  const promise = resolveWorkspaceWithRetry().finally(() => resolveInFlightMap.delete(apiKey));\n  resolveInFlightMap.set(apiKey, promise);\n  return promise;\n}\n\nasync function resolveWorkspaceWithRetry(maxRetries = 2): Promise<string> {\n  let lastError: Error | null = null;\n\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\n    try {\n      const workspace = await kernelCall<{\n        _id: string;\n        name: string;\n        slug: string;\n        createdAt?: number;\n        keyScope?: string;\n        keyId?: string;\n        governanceMode?: \"open\" | \"consensus\" | \"role\";\n      } | null>(\"resolveWorkspace\", {});\n\n      if (!workspace) {\n        throw new Error(\n          \"API key is valid but no workspace is associated. \" +\n          `Run \\`npx ${MCP_NPX_PACKAGE} setup\\` or regenerate your key.`\n        );\n      }\n\n      const s = state();\n      s.workspaceId = workspace._id;\n      s.workspaceSlug = workspace.slug;\n      s.workspaceName = workspace.name;\n      s.workspaceCreatedAt = workspace.createdAt ?? null;\n      s.workspaceGovernanceMode = workspace.governanceMode ?? \"open\";\n      if (workspace.keyScope) s.apiKeyScope = workspace.keyScope as \"read\" | \"readwrite\";\n      if (workspace.keyId) s.apiKeyId = workspace.keyId;\n      return s.workspaceId;\n    } catch (err: any) {\n      lastError = err;\n      const isTransient = /network error|fetch failed|ECONNREFUSED|ETIMEDOUT/i.test(err.message);\n      if (!isTransient || attempt === maxRetries) break;\n      const delay = 1000 * (attempt + 1);\n      process.stderr.write(\n        `[MCP] Workspace resolution failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms...\\n`\n      );\n      await new Promise((r) => setTimeout(r, delay));\n    }\n  }\n\n  throw lastError!;\n}\n\nexport interface WorkspaceContext {\n  workspaceId: string;\n  workspaceSlug: string;\n  workspaceName: string;\n  createdAt: number | null;\n  /** BET-76 FEAT-111: Cached from workspace resolution. Defaults to 'open'. */\n  governanceMode: \"open\" | \"consensus\" | \"role\";\n}\n\nexport async function getWorkspaceContext(): Promise<WorkspaceContext> {\n  const workspaceId = await getWorkspaceId();\n  const s = state();\n  return {\n    workspaceId,\n    workspaceSlug: s.workspaceSlug ?? \"unknown\",\n    workspaceName: s.workspaceName ?? \"unknown\",\n    createdAt: s.workspaceCreatedAt,\n    governanceMode: s.workspaceGovernanceMode ?? \"open\",\n  };\n}\n\n/**\n * TEN-1810: Re-fetches only governanceMode from the workspace without invalidating\n * stable identifiers (workspaceId, slug, name). Safe to call before every capture.\n * Single round-trip, no retry loop — workspace is already known at this point.\n */\nexport async function refreshWorkspaceGovernanceMode(): Promise<\"open\" | \"consensus\" | \"role\"> {\n  const workspace = await kernelCall<{\n    governanceMode?: \"open\" | \"consensus\" | \"role\";\n  } | null>(\"resolveWorkspace\", {});\n  const mode: \"open\" | \"consensus\" | \"role\" = workspace?.governanceMode ?? \"open\";\n  const s = state();\n  s.workspaceGovernanceMode = mode;\n  return mode;\n}\n\nexport async function kernelQuery<T>(fn: string, args: Record<string, unknown> = {}): Promise<T> {\n  const workspaceId = await getWorkspaceId();\n  return kernelCall<T>(fn, { ...args, workspaceId });\n}\n\nexport async function kernelMutation<T>(fn: string, args: Record<string, unknown> = {}): Promise<T> {\n  const workspaceId = await getWorkspaceId();\n  return kernelCall<T>(fn, { ...args, workspaceId });\n}\n\n/**\n * @deprecated Use kernelQuery (reads) or kernelMutation (writes) instead.\n * Kept temporarily for backward compatibility — identical to both.\n */\nexport async function mcpAction<T>(fn: string, args: Record<string, unknown> = {}): Promise<T> {\n  const workspaceId = await getWorkspaceId();\n  return kernelCall<T>(fn, { ...args, workspaceId });\n}\n\n/**\n * Gate check: throws if no active, oriented session exists.\n *\n * Used for read tools that require session context per SOS-iszqu7:\n * structured Chain data for agent consumption requires an active session.\n * Lighter than requireWriteAccess — does not check key scope.\n */\nexport function requireActiveSession(): void {\n  const s = state();\n\n  if (!s.agentSessionId) {\n    throw new Error(\n      \"Active session required (SOS-iszqu7). Call `session action=start` then `orient` first.\"\n    );\n  }\n\n  if (s.sessionClosed) {\n    throw new Error(\n      \"Session has been closed (SOS-iszqu7). Start a new session with `session action=start`.\"\n    );\n  }\n\n  if (!s.sessionOriented) {\n    throw new Error(\n      \"Orientation required before accessing build context (SOS-iszqu7). Call `orient` first.\"\n    );\n  }\n}\n\n/**\n * Gate check: throws if the agent is not allowed to write.\n *\n * Enforces:\n * 1. Session must exist (always required — no REQUIRE_AGENT_SESSION flag)\n * 2. Session must not be closed\n * 3. Session must be oriented\n * 4. Key scope must be readwrite\n */\nexport function requireWriteAccess(): void {\n  const s = state();\n\n  if (!s.agentSessionId) {\n    throw new Error(\n      \"Agent session required for write operations. Call `session action=start` first.\"\n    );\n  }\n\n  if (s.sessionClosed) {\n    throw new Error(\n      \"Agent session has been closed. Write tools are no longer available.\"\n    );\n  }\n\n  if (!s.sessionOriented) {\n    throw new Error(\n      \"Orientation required before writing to the Chain. Call 'orient' first.\"\n    );\n  }\n\n  if (s.apiKeyScope === \"read\") {\n    throw new Error(\n      \"This API key has read-only scope. Write tools are not available.\"\n    );\n  }\n}\n\n/**\n * Recover session orientation state from Convex on restart.\n * If the session is active and oriented in Convex, restore local state.\n */\nexport async function recoverSessionState(): Promise<void> {\n  const s = state();\n  if (!s.workspaceId) return;\n  try {\n    const session = await kernelCall<{\n      _id: string;\n      status: string;\n      oriented: boolean;\n      toolsScope: string;\n    } | null>(\"agent.getActiveSession\", { workspaceId: s.workspaceId });\n\n    if (session && session.status === \"active\") {\n      s.agentSessionId = session._id;\n      s.sessionOriented = session.oriented;\n      s.apiKeyScope = session.toolsScope as \"read\" | \"readwrite\";\n      s.sessionClosed = false;\n    }\n  } catch {\n    // Recovery is best-effort\n  }\n}\n","/**\n * TEN-2382: dev/prod isolation guard for URL resolution.\n *\n * The MCP server resolves its deployment URL from env vars only and falls back to\n * the hardcoded production gateway (DEFAULT_CLOUD_URL) when nothing is set. That\n * fall-through is silent today, so a misconfigured deployment quietly talks to\n * production. This makes it loud.\n *\n * Constraint (settled by review): the mcp-server has NO signal for \"a repo-local\n * binding was expected\" — it sees only env. So the warn fires on ANY fall-through\n * to the hardcoded default (Option A), not on an unimplementable \"binding expected\n * but absent\" condition.\n *\n * stderr ONLY — never stdout: stdio transport reserves stdout for MCP protocol bytes.\n */\nimport { DEFAULT_CLOUD_URL } from \"./client.js\";\n\n/**\n * Warn (on stderr) when `resolved` is the hardcoded production gateway because no\n * deployment URL was set explicitly. No-op when a URL was configured, or when the\n * resolved URL is anything other than the hardcoded default.\n */\nexport function warnOnProdFallthrough(\n  resolved: string,\n  opts: { explicit: boolean },\n): void {\n  if (opts.explicit) return;\n  if (resolved.replace(/\\/$/, \"\") !== DEFAULT_CLOUD_URL.replace(/\\/$/, \"\")) return;\n  process.stderr.write(\n    `[MCP] No deployment URL configured — defaulting to the production gateway ` +\n      `${DEFAULT_CLOUD_URL}. Set CONVEX_SITE_URL or PRODUCTBRAIN_URL to target a ` +\n      `different deployment.\\n`,\n  );\n}\n"],"mappings":";AAMA,SAAS,gBAAgB;AACzB,SAAS,eAAe;AAExB,IAAI,SAAyB;AAC7B,IAAI,aAAa;AAEjB,IAAM,eAAe;AAMrB,SAAS,IAAI,KAAmB;AAC9B,MAAI,QAAQ,IAAI,cAAc,KAAK;AACjC,YAAQ,OAAO,MAAM,GAAG;AAAA,EAC1B;AACF;AAEA,SAAS,kBAA0B;AACjC,MAAI;AACF,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAsB;AACpC,QAAM,SAAS,QAAQ,IAAI,mBAAmB,gBAAgB;AAC9D,MAAI,CAAC,QAAQ;AACX,QAAI,iHAA4G;AAChH;AAAA,EACF;AAEA,WAAS,IAAI,QAAQ,QAAQ;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,eAAe;AAAA,IACf,6BAA6B;AAAA,EAC/B,CAAC;AACD,eAAa,QAAQ,IAAI,eAAe,mBAAmB;AAE3D,MAAI,2CAAsC,YAAY,eAAe,UAAU;AAAA,CAAI;AACrF;AAEA,SAAS,qBAA6B;AACpC,MAAI;AACF,WAAO,SAAS,EAAE;AAAA,EACpB,QAAQ;AACN,WAAO,MAAM,QAAQ,GAAG;AAAA,EAC1B;AACF;AAEO,SAAS,oBACd,aACA,eACM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,cACd,IACA,QACA,YACA,aACA,UACM;AACN,QAAM,aAAsC;AAAA,IAC1C,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,SAAS,EAAE,WAAW,YAAY;AAAA,EACpC;AACA,MAAI,SAAU,YAAW,QAAQ;AAEjC,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBAA0B;AACxC,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,cACA,SACM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,aACA,OAaM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,GAAG;AAAA,MACH,cAAc;AAAA,MACd,eAAe;AAAA,MACf,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kBACd,aACA,OAWM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,GAAG;AAAA,MACH,cAAc;AAAA,MACd,eAAe;AAAA,MACf,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAgBA,SAAS,4BACP,OACA,aACA,OACM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA;AAAA,MACA,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,gCACd,aACA,OACM;AACN,8BAA4B,oCAAoC,aAAa,KAAK;AACpF;AAEO,SAAS,iCACd,aACA,OACM;AACN,8BAA4B,sCAAsC,aAAa,KAAK;AACtF;AAEO,SAAS,+BACd,aACA,OACM;AACN,8BAA4B,mCAAmC,aAAa,KAAK;AACnF;AAGO,SAAS,yBACd,aACA,OASM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,QAClC,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBACd,aACA,OAOM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,OAAO,MAAM,MAAM,MAAM,GAAG,GAAG;AAAA,QAC/B,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAKO,SAAS,yBACd,aACA,OAKM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,gCACd,aACA,OAMM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AASO,SAAS,0BACd,aACA,OAWM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAKO,SAAS,0BACd,aACA,OAIM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,yBACd,aACA,OAIM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAyBO,SAAS,wBACd,aACA,OAMM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,2BACd,aACA,OAGM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAKO,SAAS,yBACd,aACA,OAGM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,yBACd,aACA,OAIM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAMO,SAAS,uBACd,aACA,OAMM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AASO,SAAS,0BACd,aACA,OAOM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmC;AACjD,SAAO;AACT;AAEA,eAAsB,oBAAmC;AACvD,QAAM,QAAQ,SAAS;AACzB;;;ACtnBA,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAQpB,SAAS,QAAQ,KAAqB;AAC3C,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACnE;AAQA,IAAM,eAAe,IAAI,kBAA+B;AAEjD,SAAS,YAAe,MAAmB,IAA0C;AAC1F,SAAO,aAAa,IAAI,MAAM,EAAE;AAClC;AAEO,SAAS,mBAAuC;AACrD,SAAO,aAAa,SAAS,GAAG;AAClC;AAqBA,IAAM,iBAAiB,KAAK,KAAK;AACjC,IAAM,WAAW;AACjB,IAAM,cAAc,oBAAI,IAAsB;AAE9C,SAAS,cAAwB;AAC/B,SAAO;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,IACf,eAAe;AAAA,IACf,oBAAoB;AAAA,IACpB,yBAAyB;AAAA,IACzB,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,YAAY,KAAK,IAAI;AAAA,IACrB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,YAAY,QAA0B;AACpD,MAAI,IAAI,YAAY,IAAI,MAAM;AAC9B,MAAI,CAAC,GAAG;AACN,QAAI,YAAY;AAChB,gBAAY,IAAI,QAAQ,CAAC;AACzB,eAAW;AAAA,EACb;AACA,IAAE,aAAa,KAAK,IAAI;AACxB,SAAO;AACT;AAEA,SAAS,aAAmB;AAC1B,MAAI,YAAY,QAAQ,SAAU;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,aAAW,CAAC,KAAK,CAAC,KAAK,aAAa;AAClC,QAAI,MAAM,EAAE,aAAa,eAAgB,aAAY,OAAO,GAAG;AAAA,EACjE;AACA,MAAI,YAAY,OAAO,UAAU;AAC/B,UAAM,SAAS,CAAC,GAAG,YAAY,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU;AAC1F,aAAS,IAAI,GAAG,IAAI,OAAO,SAAS,UAAU,KAAK;AACjD,kBAAY,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AACF;;;ACzFA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,eAAe;AAC9B,SAAS,SAAS,gBAAgB;AAOlC,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAOlB,IAAM,kBAAkB;AAE/B,SAAS,iBAAiB,QAAgB;AACxC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,CAAC,MAAM,eAAe;AAAA,IAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,EACtC;AACF;AAIA,SAAS,sBAA8B;AACrC,SAAO,KAAK,QAAQ,IAAI,GAAG,WAAW,UAAU;AAClD;AAEA,SAAS,6BAA4C;AACnD,QAAM,KAAK,SAAS;AACpB,MAAI,OAAO,UAAU;AACnB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,SAAS;AAClB,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,QAAQ,GAAG,WAAW,SAAS;AAC3E,WAAO,KAAK,SAAS,UAAU,4BAA4B;AAAA,EAC7D;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,MAAyD;AACrF,MAAI,SAAS,UAAU;AACrB,WAAO,EAAE,MAAM,YAAY,oBAAoB,EAAE;AAAA,EACnD;AACA,QAAM,aAAa,2BAA2B;AAC9C,SAAO,aAAa,EAAE,MAAM,WAAW,IAAI;AAC7C;AAIA,SAAS,aAAa,MAAmC;AACvD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAOA,eAAsB,kBACpBA,SACA,QACkB;AAClB,QAAM,SAAS,aAAaA,QAAO,UAAU;AAE7C,QAAM,aAAa;AACnB,MAAI,CAAC,OAAO,UAAU,EAAG,QAAO,UAAU,IAAI,CAAC;AAG/C,MAAI,OAAO,UAAU,EAAE,gBAAgB,GAAG;AACxC,UAAM,SAAS,OAAO,UAAU,EAAE,gBAAgB;AAClD,WAAO,UAAU,EAAE,gBAAgB,IAAI;AAAA,MACrC,GAAG,iBAAiB,MAAM;AAAA,MAC1B,KAAK,EAAE,GAAG,OAAO,KAAK,sBAAsB,OAAO,KAAK,wBAAwB,OAAO;AAAA,IACzF;AACA,WAAO,OAAO,UAAU,EAAE,gBAAgB;AAAA,EAC5C,OAAO;AACL,UAAM,WAAW,OAAO,UAAU,EAAE,gBAAgB;AACpD,WAAO,UAAU,EAAE,gBAAgB,IAAI,WACnC,EAAE,GAAG,UAAU,KAAK,EAAE,GAAG,SAAS,KAAK,sBAAsB,OAAO,EAAE,IACtE,iBAAiB,MAAM;AAAA,EAC7B;AAEA,QAAM,MAAM,QAAQA,QAAO,UAAU;AACrC,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACpC;AAEA,gBAAcA,QAAO,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM,OAAO;AAChF,SAAO;AACT;;;AC5GA,SAAS,qBAAAC,0BAAyB;AASlC,IAAM,mBAAmB,IAAIC,mBAAqD;AAO3E,SAAS,mBACd,KACA,IACgB;AAChB,SAAO,iBAAiB,IAAI,KAAK,EAAE;AACrC;AAEA,SAAS,iBAA2D;AAClE,SAAO,iBAAiB,SAAS,KAAK;AACxC;AAEO,IAAM,oBAAoB;AAG1B,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,EACT,YACE,SACA,QACA,MACA,uBACA,aACA,aACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AACZ,SAAK,wBAAwB;AAC7B,SAAK,cAAc;AACnB,SAAK,cAAc;AAAA,EACrB;AACF;AAIA,IAAM,eAAe;AACrB,IAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,YAAY,IAAqB;AACxC,SAAQ,cAAoC,SAAS,EAAE;AACzD;AAEA,IAAM,eACJ;AAEF,SAAS,QAAQ,IAAqB;AACpC,MAAI,GAAG,WAAW,QAAQ,EAAG,QAAO;AACpC,SAAO,CAAC,aAAa,KAAK,EAAE;AAC9B;AAOA,IAAM,YAAY,oBAAI,IAAiC;AAEvD,SAAS,SAAS,IAAY,MAAuC;AACnE,SAAO,GAAG,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC;AACtC;AAEA,SAAS,UAAa,IAAY,MAA8C;AAC9E,MAAI,CAAC,YAAY,EAAE,EAAG,QAAO;AAC7B,QAAM,MAAM,SAAS,IAAI,IAAI;AAC7B,QAAM,QAAQ,UAAU,IAAI,GAAG;AAC/B,MAAI,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,WAAW;AAC1C,QAAI,MAAO,WAAU,OAAO,GAAG;AAC/B,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AACf;AAEA,SAAS,UAAa,IAAY,MAA+B,MAAe;AAC9E,MAAI,CAAC,YAAY,EAAE,EAAG;AACtB,QAAM,MAAM,SAAS,IAAI,IAAI;AAC7B,YAAU,IAAI,KAAK,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,aAAa,CAAC;AACnE;AAEA,SAAS,sBAA4B;AACnC,YAAU,MAAM;AAClB;AAIA,IAAM,cAAwB;AAAA,EAC5B,aAAa;AAAA,EACb,eAAe;AAAA,EACf,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,eAAe;AACjB;AAMA,SAAS,QAAkB;AACzB,QAAM,SAAS,iBAAiB;AAChC,MAAI,OAAQ,QAAO,YAAY,MAAM;AACrC,SAAO;AACT;AAYO,SAAS,aAAqB;AACnC,QAAM,MAAM,iBAAiB;AAC7B,SAAO,MAAM,QAAQ,GAAG,IAAI;AAC9B;AAKA,SAAS,kBAA0B;AACjC,QAAM,cAAc,iBAAiB;AACrC,MAAI,YAAa,QAAO;AACxB,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,8EAAyE;AACvG,SAAO;AACT;AAIO,SAAS,oBAAmC;AACjD,SAAO,MAAM,EAAE;AACjB;AAEO,SAAS,oBAA6B;AAC3C,SAAO,MAAM,EAAE;AACjB;AAEO,SAAS,mBAAmB,OAAsB;AACvD,QAAM,EAAE,kBAAkB;AAC5B;AAEO,SAAS,iBAAuC;AACrD,SAAO,MAAM,EAAE;AACjB;AAuBA,eAAsB,oBAAsD;AAC1E,QAAM,cAAc,MAAM,eAAe;AACzC,QAAM,IAAI,MAAM;AAChB,MAAI,CAAC,EAAE,UAAU;AACf,UAAM,IAAI,MAAM,uFAAuF;AAAA,EACzG;AAEA,QAAM,SAAS,MAAM,WAAoC,sBAAsB;AAAA,IAC7E;AAAA,IACA,UAAU,EAAE;AAAA,IACZ,YAAY;AAAA,EACd,CAAC;AAED,MAAI,EAAE,gBAAgB;AACpB,uBAAmB,EAAE,cAAc;AAAA,EACrC;AACA,IAAE,iBAAiB,OAAO;AAC1B,IAAE,cAAc,OAAO;AACvB,IAAE,kBAAkB;AACpB,IAAE,gBAAgB;AAClB,qBAAmB,OAAO,SAAS;AAEnC,SAAO;AACT;AAMA,eAAsB,oBAAmC;AACvD,QAAM,IAAI,MAAM;AAChB,MAAI,CAAC,EAAE,eAAgB;AACvB,QAAM,YAAY,EAAE;AACpB,MAAI;AACF,UAAM,WAAW,sBAAsB;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,UAAE;AACA,uBAAmB,SAAS;AAC5B,MAAE,gBAAgB;AAClB,MAAE,iBAAiB;AACnB,MAAE,kBAAkB;AAAA,EACtB;AACF;AAKA,eAAsB,qBAAoC;AACxD,QAAM,IAAI,MAAM;AAChB,MAAI,CAAC,EAAE,eAAgB;AACvB,QAAM,YAAY,EAAE;AACpB,MAAI;AACF,UAAM,WAAW,sBAAsB;AAAA,MACrC;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,QAAQ;AAAA,EAER,UAAE;AACA,uBAAmB,SAAS;AAC5B,MAAE,iBAAiB;AACnB,MAAE,kBAAkB;AAAA,EACtB;AACF;AAOA,IAAM,wBAAwB,oBAAI,IAAoB;AACtD,IAAM,oBAAoB;AAEnB,SAAS,uBAA6B;AAC3C,QAAM,IAAI,MAAM;AAChB,QAAM,YAAY,EAAE;AACpB,MAAI,CAAC,UAAW;AAEhB,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,cAAc,sBAAsB,IAAI,SAAS,KAAK;AAC5D,MAAI,MAAM,cAAc,kBAAmB;AAC3C,wBAAsB,IAAI,WAAW,GAAG;AAExC,aAAW,sBAAsB;AAAA,IAC/B;AAAA,EACF,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB;AAEO,SAAS,mBAAmB,WAAiC;AAClE,MAAI,WAAW;AACb,0BAAsB,OAAO,SAAS;AACtC;AAAA,EACF;AACA,wBAAsB,MAAM;AAC9B;AAKA,eAAsB,sBAAsB,UAO1B;AAChB,QAAM,IAAI,MAAM;AAChB,MAAI,CAAC,EAAE,eAAgB;AACvB,MAAI;AACF,UAAM,WAAW,wBAAwB;AAAA,MACvC,WAAW,EAAE;AAAA,MACb,GAAG;AAAA,IACL,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAeA,IAAM,oBAAoB;AAC1B,IAAM,cAA4B,CAAC;AAO5B,SAAS,YAAkB;AAChC,QAAM,WAAW,QAAQ,IAAI,mBAAmB,QAAQ,IAAI;AAC5D,UAAQ,IAAI,oBAAoB,QAAQ,IAAI,oBAAoB;AAChE,wBAAsB,QAAQ,IAAI,iBAAiB,EAAE,UAAU,YAAY,KAAK,CAAC;AACjF,QAAM,QAAQ,QAAQ,IAAI;AAC1B,MAAI,CAAC,OAAO,WAAW,QAAQ,GAAG;AAChC,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AAAA,EACF;AACF;AAMO,SAAS,gBAAsB;AACpC,QAAM,WAAW,QAAQ,IAAI,mBAAmB,QAAQ,IAAI;AAC5D,UAAQ,IAAI,oBAAoB,QAAQ,IAAI,oBAAoB;AAChE,wBAAsB,QAAQ,IAAI,iBAAiB,EAAE,UAAU,YAAY,KAAK,CAAC;AACnF;AAeA,SAAS,oBAA8B;AACrC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC3D;AAoBA,eAAe,uBAAwC;AACrD,QAAM,IAAI,MAAM;AAChB,MAAI,EAAE,cAAe,QAAO,EAAE;AAE9B,QAAM,cAAc,QAAQ,IAAI,mBAAmB,mBAAmB,QAAQ,OAAO,EAAE;AACvF,QAAM,YAAY,kBAAkB;AAIpC,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,CAAC,YAAY,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AAE7E,MAAI;AACJ,MAAI;AACF,aAAS,gBAAgB;AAAA,EAC3B,QAAQ;AAEN,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,YAAY;AAClC,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,SAAS,kBAAkB;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS,EAAE,iBAAiB,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,QACnF,QAAQ,YAAY,QAAQ,GAAI;AAAA,MAClC,CAAC;AACD,UAAI,SAAS,IAAI;AACf,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAI,KAAK,IAAI;AACX,YAAE,gBAAgB;AAClB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,SAAO,WAAW,CAAC;AACrB;AAEA,SAAS,eAAe,QAAiC;AACvD,SAAO,WAAW,WAAW,QAAQ,IAAI,cAAc;AACzD;AAEA,SAAS,MAAM,IAAY,QAAwB,YAAoB,UAAyB;AAC9F,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,YAAY,MAAM,EAAE,eAAe;AACzC,QAAM,UAAU,eAAe;AAE/B,QAAM,QAAoB,EAAE,IAAI,IAAI,WAAW,QAAQ,WAAW;AAClE,MAAI,SAAU,OAAM,QAAQ;AAC5B,MAAI,QAAS,OAAM,cAAc;AACjC,cAAY,KAAK,KAAK;AACtB,MAAI,YAAY,SAAS,kBAAmB,aAAY,MAAM;AAE9D,gBAAc,IAAI,QAAQ,YAAY,WAAW,QAAQ;AAEzD,MAAI,CAAC,eAAe,MAAM,EAAG;AAE7B,QAAM,OAAO,eAAe,EAAE,OAAO,EAAE,cAAc,SAAS,WAAW,MAAM,aAAa,UAAU;AACtG,MAAI,WAAW,WAAW,UAAU;AAClC,YAAQ,OAAO,MAAM,GAAG,IAAI,UAAU,KAAK,UAAU,QAAQ,CAAC;AAAA,CAAI;AAAA,EACpE,OAAO;AACL,YAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAAA,EAClC;AACF;AAEO,SAAS,cAAqC;AACnD,SAAO;AACT;AA8BO,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAC;AAWD,IAAM,uBAAuB;AAE7B,eAAe,YAAe,IAAY,MAKvC;AACD,QAAM,UAAU,MAAM,qBAAqB;AAC3C,QAAM,SAAS,gBAAgB;AAE/B,QAAM,QAAQ,KAAK,IAAI;AAEvB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,OAAO,YAAY;AAAA,MACtC,QAAQ;AAAA,MACR,QAAQ,YAAY,QAAQ,GAAM;AAAA,MAClC,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,MAAM;AAAA;AAAA;AAAA,QAG/B,eAAe;AAAA,MACjB;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,IACnC,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,UAAM,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,OAAO;AAClD,UAAM,IAAI,MAAM,aAAa,EAAE,oBAAoB,IAAI,OAAO,EAAE;AAAA,EAClE;AAEA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAE7B,MAAI,CAAC,IAAI,MAAM,KAAK,OAAO,OAAO;AAChC,UAAM,UAAU;AAChB,UAAM,MAAM,QAAQ,SAAS,QAAQ,WAAW;AAChD,UAAM,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,QAAQ,OAAO,GAAG,GAAG,KAAK,QAAQ,IAAI,MAAM,GAAG;AACtF,UAAM,IAAI;AAAA,MACR,aAAa,EAAE,aAAa,IAAI,MAAM,MAAM,GAAG;AAAA,MAC/C,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM,QAAQ,QAAQ,qBAAqB,IAAI,QAAQ,wBAAwB;AAAA,MAC/E,MAAM,QAAQ,QAAQ,WAAW,IAAK,QAAQ,cAA2B;AAAA,MACzE,QAAQ,eAAe,OAAO,QAAQ,gBAAgB,WAAW,QAAQ,cAAc;AAAA,IACzF;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;AAElC,QAAM,EAAE,MAAM,SAAS,MAAM,MAAM,IAAI;AACvC,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACF;AAWA,eAAsB,WAAc,IAAY,OAAgC,CAAC,GAAe;AAC9F,QAAM,SAAS,UAAa,IAAI,IAAI;AACpC,MAAI,WAAW,QAAW;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,KAAK,IAAI,MAAM,YAAe,IAAI,IAAI;AAE9C,MAAI,QAAQ,EAAE,GAAG;AACf,wBAAoB;AAAA,EACtB,OAAO;AACL,cAAU,IAAI,MAAM,IAAI;AAAA,EAC1B;AAEA,QAAM,IAAI,MAAM;AAIhB,MAAI,EAAE,kBAAkB,CAAC,eAAe,IAAI,EAAE,GAAG;AAC/C,yBAAqB;AAAA,EACvB;AAEA,SAAO;AACT;AAiBA,eAAsB,mBACpB,IACA,OAAgC,CAAC,GAOhC;AACD,QAAM,EAAE,MAAM,SAAS,MAAM,MAAM,IAAI,MAAM,YAAe,IAAI,IAAI;AAEpE,QAAM,IAAI,MAAM;AAChB,MAAI,EAAE,kBAAkB,CAAC,eAAe,IAAI,EAAE,GAAG;AAC/C,yBAAqB;AAAA,EACvB;AAEA,SAAO,EAAE,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM;AAChD;AAIA,IAAM,qBAAqB,oBAAI,IAA6B;AAE5D,eAAsB,iBAAkC;AACtD,QAAM,IAAI,MAAM;AAChB,MAAI,EAAE,YAAa,QAAO,EAAE;AAE5B,QAAM,SAAS,gBAAgB;AAC/B,QAAM,WAAW,mBAAmB,IAAI,MAAM;AAC9C,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,0BAA0B,EAAE,QAAQ,MAAM,mBAAmB,OAAO,MAAM,CAAC;AAC3F,qBAAmB,IAAI,QAAQ,OAAO;AACtC,SAAO;AACT;AAEA,eAAe,0BAA0B,aAAa,GAAoB;AACxE,MAAI,YAA0B;AAE9B,WAAS,UAAU,GAAG,WAAW,YAAY,WAAW;AACtD,QAAI;AACF,YAAM,YAAY,MAAM,WAQd,oBAAoB,CAAC,CAAC;AAEhC,UAAI,CAAC,WAAW;AACd,cAAM,IAAI;AAAA,UACR,8DACa,eAAe;AAAA,QAC9B;AAAA,MACF;AAEA,YAAM,IAAI,MAAM;AAChB,QAAE,cAAc,UAAU;AAC1B,QAAE,gBAAgB,UAAU;AAC5B,QAAE,gBAAgB,UAAU;AAC5B,QAAE,qBAAqB,UAAU,aAAa;AAC9C,QAAE,0BAA0B,UAAU,kBAAkB;AACxD,UAAI,UAAU,SAAU,GAAE,cAAc,UAAU;AAClD,UAAI,UAAU,MAAO,GAAE,WAAW,UAAU;AAC5C,aAAO,EAAE;AAAA,IACX,SAAS,KAAU;AACjB,kBAAY;AACZ,YAAM,cAAc,qDAAqD,KAAK,IAAI,OAAO;AACzF,UAAI,CAAC,eAAe,YAAY,WAAY;AAC5C,YAAM,QAAQ,OAAQ,UAAU;AAChC,cAAQ,OAAO;AAAA,QACb,8CAA8C,UAAU,CAAC,IAAI,aAAa,CAAC,kBAAkB,KAAK;AAAA;AAAA,MACpG;AACA,YAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM;AACR;AAWA,eAAsB,sBAAiD;AACrE,QAAM,cAAc,MAAM,eAAe;AACzC,QAAM,IAAI,MAAM;AAChB,SAAO;AAAA,IACL;AAAA,IACA,eAAe,EAAE,iBAAiB;AAAA,IAClC,eAAe,EAAE,iBAAiB;AAAA,IAClC,WAAW,EAAE;AAAA,IACb,gBAAgB,EAAE,2BAA2B;AAAA,EAC/C;AACF;AAOA,eAAsB,iCAAyE;AAC7F,QAAM,YAAY,MAAM,WAEd,oBAAoB,CAAC,CAAC;AAChC,QAAM,OAAsC,WAAW,kBAAkB;AACzE,QAAM,IAAI,MAAM;AAChB,IAAE,0BAA0B;AAC5B,SAAO;AACT;AAEA,eAAsB,YAAe,IAAY,OAAgC,CAAC,GAAe;AAC/F,QAAM,cAAc,MAAM,eAAe;AACzC,SAAO,WAAc,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;AACnD;AAEA,eAAsB,eAAkB,IAAY,OAAgC,CAAC,GAAe;AAClG,QAAM,cAAc,MAAM,eAAe;AACzC,SAAO,WAAc,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;AACnD;AAkBO,SAAS,uBAA6B;AAC3C,QAAM,IAAI,MAAM;AAEhB,MAAI,CAAC,EAAE,gBAAgB;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,EAAE,eAAe;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,EAAE,iBAAiB;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,qBAA2B;AACzC,QAAM,IAAI,MAAM;AAEhB,MAAI,CAAC,EAAE,gBAAgB;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,EAAE,eAAe;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,EAAE,iBAAiB;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,EAAE,gBAAgB,QAAQ;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAsB,sBAAqC;AACzD,QAAM,IAAI,MAAM;AAChB,MAAI,CAAC,EAAE,YAAa;AACpB,MAAI;AACF,UAAM,UAAU,MAAM,WAKZ,0BAA0B,EAAE,aAAa,EAAE,YAAY,CAAC;AAElE,QAAI,WAAW,QAAQ,WAAW,UAAU;AAC1C,QAAE,iBAAiB,QAAQ;AAC3B,QAAE,kBAAkB,QAAQ;AAC5B,QAAE,cAAc,QAAQ;AACxB,QAAE,gBAAgB;AAAA,IACpB;AAAA,EACF,QAAQ;AAAA,EAER;AACF;;;ACl2BO,SAAS,sBACd,UACA,MACM;AACN,MAAI,KAAK,SAAU;AACnB,MAAI,SAAS,QAAQ,OAAO,EAAE,MAAM,kBAAkB,QAAQ,OAAO,EAAE,EAAG;AAC1E,UAAQ,OAAO;AAAA,IACb,kFACK,iBAAiB;AAAA;AAAA,EAExB;AACF;","names":["client","AsyncLocalStorage","AsyncLocalStorage"]}

package/dist/{chunk-VRAAJA3M.js → chunk-FLEY5LXQ.js}

@@ -37,7 +37,7 @@ import {
   trackSessionCaptureRate,
   trackWriteBackHintServed,
   trackZeroCaptureAuditFired
-} from "./chunk-AMJILQKI.js";
+} from "./chunk-6JNK5DIZ.js";
 
 // src/server.ts
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -1751,6 +1751,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
       const linksCreated = [];
       const linksSuggested = [];
       const userLinkResults = [];
+      const advisedLinks = [];
       let conflictCandidates = [];
       const pendingRelations = [];
       const skipAutoDiscovery = links && links.length > 0;
@@ -1871,6 +1872,12 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
                 relationType: pending.type,
                 linkReason: pending.meta.linkReason
               });
+            } else if (result.status === "advised") {
+              advisedLinks.push({
+                targetName: pending.meta.targetName,
+                targetCollection: pending.meta.targetCollection,
+                relationType: pending.type
+              });
             }
           } else {
             if (result.ok) {
@@ -1887,6 +1894,9 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
           }
         }
       }
+      if (advisedLinks.length > 0) {
+        entryWarnings.push(`${advisedLinks.length} auto-link(s) advised, not written (untypeable) \u2014 accept with \`relations action=create\` to promote.`);
+      }
       const captureCtx = {
         collection: resolvedCollection,
         name,
@@ -1923,7 +1933,8 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             source: verdictResult.source ?? "heuristic",
             criteria_total: v.criteria?.length ?? 0,
             criteria_failed: failedCount,
-            llm_scheduled: v.tier !== "passive"
+            llm_scheduled: v.tier !== "passive",
+            methodology_version: v.methodologyVersion
           });
         } catch {
         }
@@ -2385,6 +2396,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             entryId: "",
             ok: false,
             autoLinks: 0,
+            advisedLinks: 0,
             status: "draft",
             classifiedBy,
             confidence,
@@ -2400,6 +2412,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             entryId: "",
             ok: false,
             autoLinks: 0,
+            advisedLinks: 0,
             status: "draft",
             classifiedBy,
             confidence,
@@ -2508,6 +2521,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             });
           }
           let autoLinkCount = 0;
+          let advisedLinkCount = 0;
           let entryOverlapCount = 0;
           const searchQuery = extractSearchTerms(entry.name, entry.description);
           if (searchQuery) {
@@ -2532,6 +2546,10 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
                   sessionId: agentId ?? void 0
                 });
                 autoLinkCount = batchRes.created;
+                advisedLinkCount = batchRes.advised ?? 0;
+                if (advisedLinkCount > 0) {
+                  batchEntryWarnings.push(`${advisedLinkCount} auto-link(s) advised, not written (untypeable) \u2014 accept with \`relations action=create\` to promote.`);
+                }
               }
             } catch {
             }
@@ -2581,6 +2599,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             entryId: finalEntryId,
             ok: true,
             autoLinks: autoLinkCount,
+            advisedLinks: advisedLinkCount,
             status: finalStatus,
             classifiedBy,
             confidence,
@@ -2605,6 +2624,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
             entryId: "",
             ok: false,
             autoLinks: 0,
+            advisedLinks: 0,
             status: "draft",
             classifiedBy,
             confidence,
@@ -2626,6 +2646,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
         logger: "product-brain"
       });
       const totalAutoLinks = created.reduce((sum, r) => sum + r.autoLinks, 0);
+      const totalAdvisedLinks = created.reduce((sum, r) => sum + r.advisedLinks, 0);
       const byCollection = /* @__PURE__ */ new Map();
       for (const r of created) {
         byCollection.set(r.collection, (byCollection.get(r.collection) ?? 0) + 1);
@@ -2633,7 +2654,7 @@ Use \`entries action=get\` to inspect the existing entry, or \`update-entry\` to
       const lines = [
         `# Batch Capture Complete`,
         `**${created.length}** created, **${failed.length}** failed, **${skippedLowConfidence.length}** skipped out of ${entries.length} total.`,
-        `**Auto-links created:** ${totalAutoLinks}`,
+        `**Auto-links created:** ${totalAutoLinks}${totalAdvisedLinks > 0 ? `, ${totalAdvisedLinks} advised` : ""}`,
         ""
       ];
       if (classifiedCount > 0) {
@@ -3487,7 +3508,8 @@ No DB writes \u2014 call without \`preview:true\` to accept for real.` }],
             source: coachingResult.source ?? "heuristic",
             criteria_total: v.criteria?.length ?? 0,
             criteria_failed: failedCount,
-            llm_scheduled: v.tier !== "passive"
+            llm_scheduled: v.tier !== "passive",
+            methodology_version: v.methodologyVersion
           });
         } catch {
         }
@@ -7133,6 +7155,7 @@ async function runWrapupCommitAll(data, cachedSuggestions) {
   const results = [];
   let linksCreated = 0;
   let linksFailed = 0;
+  let linksAdvised = 0;
   const linkFailureDetails = [];
   let proposalsCreated = 0;
   const allDrafts = [...data.drafts, ...data.overflowDrafts ?? []];
@@ -7197,9 +7220,10 @@ async function runWrapupCommitAll(data, cachedSuggestions) {
         sessionId
       });
       linksCreated += batchResult?.created ?? 0;
+      linksAdvised += batchResult?.advised ?? 0;
       if (batchResult && batchResult.failed > 0) {
         linksFailed += batchResult.failed;
-        const failedResults = batchResult.results.map((r, i) => ({ ...r, index: i })).filter((r) => !r.ok);
+        const failedResults = batchResult.results.map((r, i) => ({ ...r, index: i })).filter((r) => !r.ok && r.status !== "advised");
         for (const fr of failedResults) {
           const rel = batchRels[fr.index];
           if (rel) {
@@ -7226,7 +7250,10 @@ async function runWrapupCommitAll(data, cachedSuggestions) {
         ...s.confidence !== void 0 ? { confidence: s.confidence } : {},
         sessionId
       });
-      if (result?.status !== "proposal_created") {
+      if (result?.status === "proposal_created") {
+      } else if (result?.advised) {
+        linksAdvised++;
+      } else {
         linksCreated++;
       }
     } catch (err) {
@@ -7254,6 +7281,9 @@ async function runWrapupCommitAll(data, cachedSuggestions) {
   if (linksFailed > 0) {
     lines.push(`**${linksFailed}** link${linksFailed === 1 ? "" : "s"} failed to create.`);
   }
+  if (linksAdvised > 0) {
+    lines.push(`**${linksAdvised}** auto-link(s) advised, not written (untypeable) \u2014 accept with \`relations action=create\` to promote.`);
+  }
   if (failed.length > 0) {
     lines.push("");
     lines.push("### Failed to accept");
@@ -7745,7 +7775,8 @@ async function handleReEvaluate(entryId, context) {
       source: "heuristic",
       criteria_total: result.verdict.criteria?.length ?? 0,
       criteria_failed: result.verdict.criteria?.filter((c) => !c.passed).length ?? 0,
-      llm_scheduled: llmScheduled
+      llm_scheduled: llmScheduled,
+      methodology_version: result.verdict.methodologyVersion
     });
   } catch {
   }
@@ -14711,4 +14742,4 @@ export {
   createProductBrainServer,
   initFeatureFlags
 };
-//# sourceMappingURL=chunk-VRAAJA3M.js.map
+//# sourceMappingURL=chunk-FLEY5LXQ.js.map