@tryvira/mcp 0.1.9 → 0.1.12

package/dist/cli.js

@@ -1,2042 +1,2038 @@
-#!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res, err) => function __init() {
-  if (err) throw err[0];
-  try {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-  } catch (e) {
-    throw err = [e], e;
-  }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// ../domain/src/scope-composer.ts
-import { createHash } from "node:crypto";
-function canonical(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
-}
-function assertComposedScopeIntegrity(composed) {
-  const conflictSetDigest = digest(composed.conflicts);
-  if (conflictSetDigest !== composed.conflictSetDigest) throw new Error("SCOPE_CONFLICT_DIGEST_MISMATCH");
-  const compositionDigest = digest({ chain: composed.chain, permissions: composed.permissions, delegationIds: [...composed.delegationIds ?? []].sort(), conflictSetDigest, effectiveRevision: composed.effectiveRevision ?? null, sourceRevisionSetDigest: composed.sourceRevisionSetDigest ?? null, ancestorHardAuthorityDigest: composed.ancestorHardAuthorityDigest ?? null, effectiveProgramDigest: composed.effectiveProgramDigest ?? null });
-  if (compositionDigest !== composed.compositionDigest) throw new Error("SCOPE_COMPOSITION_DIGEST_MISMATCH");
-  return true;
-}
-var digest;
-var init_scope_composer = __esm({
-  "../domain/src/scope-composer.ts"() {
-    "use strict";
-    digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
-  }
-});
-
-// ../runtime/src/mcp-gateway.ts
-import { createHash as createHash2 } from "node:crypto";
-function canonicalMcpJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonicalMcpJson).join(",")}]`;
-  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalMcpJson(value[key])}`).join(",")}}`;
-}
-function verifyMcpResult(result) {
-  const { provenanceDigest, ...body } = result;
-  const expected = createHash2("sha256").update(canonicalMcpJson(body)).digest("hex");
-  if (provenanceDigest !== expected) throw new Error("MCP_PROVENANCE_DIGEST_INVALID");
-  return true;
-}
-function createMcpCancellationRegistry() {
-  const controllers = /* @__PURE__ */ new Map();
-  return { register(requestId) {
-    if (!requestId.trim()) throw new Error("MCP_REQUEST_ID_REQUIRED");
-    const previous = controllers.get(requestId);
-    previous?.abort();
-    const controller = new AbortController();
-    controllers.set(requestId, controller);
-    return controller.signal;
-  }, cancel(requestId) {
-    const controller = controllers.get(requestId);
-    if (!controller) return false;
-    controller.abort();
-    return true;
-  }, unregister(requestId, signal) {
-    const controller = controllers.get(requestId);
-    if (controller && (!signal || controller.signal === signal)) controllers.delete(requestId);
-  } };
-}
-function combineMcpAbortSignals(...signals) {
-  const active = signals.filter((signal) => Boolean(signal));
-  if (active.length === 0) return void 0;
-  if (active.length === 1) return active[0];
-  const controller = new AbortController();
-  const abort = () => controller.abort();
-  for (const signal of active) {
-    if (signal.aborted) {
-      controller.abort();
-      break;
-    }
-    signal.addEventListener("abort", abort, { once: true });
-  }
-  return controller.signal;
-}
-async function handleMcpJsonRpc(input) {
-  const { request, server, tools: tools2, transport } = input;
-  if (request.jsonrpc !== "2.0" || !request.method) throw new Error("MCP_JSONRPC_INVALID");
-  if (request.method === "initialize") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { protocolVersion: "2025-03-26", serverInfo: { name: server, version: "1" }, capabilities: { tools: {}, resources: input.resources ? {} : void 0, prompts: input.prompts ? {} : void 0 } } };
-  if (request.method === "notifications/initialized") return null;
-  if (request.method === "notifications/cancelled") {
-    const requestId2 = String(request.params?.requestId ?? "");
-    input.cancellationRegistry?.cancel(requestId2);
-    return null;
-  }
-  if (request.method === "tools/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { tools: tools2 } };
-  if (request.method === "resources/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { resources: input.resources ?? [] } };
-  if (request.method === "prompts/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { prompts: input.prompts ?? [] } };
-  if (request.method === "resources/read") {
-    const value = input.readResource ? await input.readResource(String(request.params?.uri ?? "")) : null;
-    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "RESOURCE_NOT_FOUND" } };
-  }
-  if (request.method === "prompts/get") {
-    const value = input.getPrompt ? await input.getPrompt(String(request.params?.name ?? ""), request.params?.arguments ?? {}) : null;
-    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "PROMPT_NOT_FOUND" } };
-  }
-  if (request.method !== "tools/call") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "METHOD_NOT_FOUND" } };
-  const tool = String(request.params?.name ?? "");
-  const definition = tools2.find((item) => item.name === tool);
-  if (!definition) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "TOOL_NOT_FOUND" } };
-  const invocation = { ...input.invocation, server, tool, arguments: request.params?.arguments ?? {} };
-  const authority = definition.effectful ? input.authorize ? await input.authorize({ invocation, definition }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
-  if (!authority.allowed) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32003, message: authority.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority.decisionDigest } } };
-  const requestId = String(request.id ?? "");
-  const requestSignal = input.cancellationRegistry && requestId ? input.cancellationRegistry.register(requestId) : void 0;
-  try {
-    const result = await invokeMcpTool({ invocation, transport, authority, signal: combineMcpAbortSignals(input.signal, requestSignal) });
-    return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } };
-  } finally {
-    if (requestSignal) input.cancellationRegistry?.unregister(requestId, requestSignal);
-  }
-}
-async function invokeMcpTool(input) {
-  const { invocation, transport } = input;
-  if (!invocation.id || !invocation.server || !invocation.tool || !invocation.receiptId || !invocation.idempotencyKey) throw new Error("MCP_INVOCATION_FIELDS_REQUIRED");
-  if (invocation.authorityDigest !== void 0 && !/^[a-f0-9]{64}$/.test(invocation.authorityDigest)) throw new Error("MCP_AUTHORITY_DIGEST_INVALID");
-  if (invocation.composedScope) {
-    assertComposedScopeIntegrity(invocation.composedScope);
-    if (invocation.authorityDigest !== void 0 && invocation.authorityDigest !== invocation.composedScope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
-    if (!invocation.composedScope.serveable) throw new Error("MCP_SCOPE_COMPOSITION_CONFLICT");
-  }
-  if (input.authority && !input.authority.allowed) throw new Error("MCP_AUTHORITY_DENIED");
-  if (!transport || typeof transport.call !== "function") throw new Error("MCP_TRANSPORT_REQUIRED");
-  let response;
-  try {
-    response = await transport.call({ server: invocation.server, tool: invocation.tool, arguments: structuredClone(invocation.arguments), signal: input.signal });
-  } catch {
-    if (input.signal?.aborted) throw new Error("MCP_INVOCATION_CANCELLED");
-    response = { error: "MCP_TRANSPORT_ERROR" };
-  }
-  const argumentsDigest = createHash2("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
-  const body = { invocationId: invocation.id, organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId, server: invocation.server, tool: invocation.tool, receiptId: invocation.receiptId, idempotencyKey: invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: invocation.authorityDigest ?? null, ok: !response.error, result: response.result, error: response.error };
-  return Object.freeze({ ...body, provenanceDigest: createHash2("sha256").update(canonicalMcpJson(body)).digest("hex") });
-}
-var init_mcp_gateway = __esm({
-  "../runtime/src/mcp-gateway.ts"() {
-    "use strict";
-    init_scope_composer();
-  }
-});
-
-// ../runtime/src/mcp-provenance.ts
-import { createHash as createHash3 } from "node:crypto";
-function verifyMcpResult2(result) {
-  const { provenanceDigest: stored, ...body } = result;
-  const expected = createHash3("sha256").update(canonicalMcpJson(body)).digest("hex");
-  if (stored !== expected) throw new Error("MCP_PROVENANCE_DIGEST_MISMATCH");
-  return true;
-}
-function createMcpResultFromResponse(input) {
-  const argumentsDigest = createHash3("sha256").update(canonicalMcpJson(input.invocation.arguments)).digest("hex");
-  const body = { invocationId: input.invocation.id, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId, server: input.invocation.server, tool: input.invocation.tool, receiptId: input.invocation.receiptId, idempotencyKey: input.invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: input.invocation.authorityDigest ?? null, ok: !input.response.error, result: input.response.result, error: input.response.error };
-  return Object.freeze({ ...body, provenanceDigest: createHash3("sha256").update(canonicalMcpJson(body)).digest("hex") });
-}
-var init_mcp_provenance = __esm({
-  "../runtime/src/mcp-provenance.ts"() {
-    "use strict";
-    init_mcp_gateway();
-  }
-});
-
-// ../runtime/src/mcp-session.ts
-import { createHash as createHash4, randomUUID } from "node:crypto";
-function assertMcpSession(session) {
-  const { sessionDigest, ...base } = session;
-  if (sessionDigest !== digest2(base)) throw new Error("MCP_SESSION_DIGEST_MISMATCH");
-  return true;
-}
-function assertMcpSessionActive(session) {
-  assertMcpSession(session);
-  if (session.status !== "ACTIVE") throw new Error(`MCP_SESSION_NOT_ACTIVE:${session.status}`);
-  return true;
-}
-var canonical2, digest2;
-var init_mcp_session = __esm({
-  "../runtime/src/mcp-session.ts"() {
-    "use strict";
-    canonical2 = (value) => value === null || typeof value !== "object" ? JSON.stringify(value) : Array.isArray(value) ? `[${value.map(canonical2).join(",")}]` : `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical2(value[key])}`).join(",")}}`;
-    digest2 = (value) => createHash4("sha256").update(canonical2(value)).digest("hex");
-  }
-});
-
-// ../../apps/mcp-server/server.ts
-import {
-  createServer
-} from "node:http";
-import { createInterface } from "node:readline";
-async function assertConfiguredSession(options, sessionId, scope) {
-  if (!options.sessionRepository) return;
-  if (!sessionId?.trim()) throw new Error("MCP_SESSION_REQUIRED");
-  const session = await options.sessionRepository.get(sessionId, scope);
-  if (!session) throw new Error("MCP_SESSION_NOT_FOUND");
-  assertMcpSessionActive(session);
-}
-async function persistVerifiedMcpResult(repository, result) {
-  const persisted = await repository.save(result);
-  if (persisted && typeof persisted === "object") verifyMcpResult(persisted);
-}
-function createMcpServer(options) {
-  if (options.requireInvocationExecutor && !options.invocationExecutor)
-    throw new Error("MCP_INVOCATION_EXECUTOR_REQUIRED");
-  const maxBodyBytes = options.maxBodyBytes ?? 128 * 1024;
-  const cancellationRegistry = options.cancellationRegistry ?? createMcpCancellationRegistry();
-  return createServer(async (request, response) => {
-    if (request.method !== "POST")
-      return send(response, 405, { error: { code: "METHOD_NOT_ALLOWED" } });
-    if (options.requestAuthToken) {
-      const authorization = request.headers.authorization ?? "";
-      const token = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
-      if (token !== options.requestAuthToken)
-        return send(response, 401, { error: { code: "MCP_AUTHENTICATION_REQUIRED" } });
-    }
-    const requestController = new AbortController();
-    const onAborted = () => requestController.abort();
-    request.once("aborted", onAborted);
-    try {
-      const body = JSON.parse(await readBody(request, maxBodyBytes));
-      const token = requestToken(body.id);
-      const requestInvocation = {
-        ...options.invocation,
-        id: `${options.invocation.id}:${token}`,
-        receiptId: `${options.invocation.receiptId}:${token}`,
-        idempotencyKey: `${options.invocation.idempotencyKey}:${token}`
-      };
-      const scope = {
-        organizationId: requestInvocation.organizationId,
-        projectId: requestInvocation.projectId,
-        environmentId: requestInvocation.environmentId
-      };
-      const sessionId = request.headers[(options.sessionHeader ?? "x-mcp-session-id").toLowerCase()];
-      await assertConfiguredSession(options, typeof sessionId === "string" ? sessionId : void 0, scope);
-      if (options.invocationExecutor && body.method === "tools/call") {
-        const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
-        if (definition) {
-          const invocation = { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} };
-          const authority2 = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
-          if (authority2.allowed) {
-            const result2 = await options.invocationExecutor({ invocation, authority: authority2, signal: requestController.signal });
-            if (!requestController.signal.aborted) send(response, 200, { jsonrpc: "2.0", id: body.id, result: { content: [{ type: "text", text: JSON.stringify(result2.result ?? result2.error ?? null) }], isError: !result2.ok, provenanceDigest: result2.provenanceDigest } });
-            return;
-          }
-          if (!requestController.signal.aborted) send(response, 403, { jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
-          return;
-        }
-      }
-      if (options.provenanceRepository && body.method === "tools/call") {
-        const replay = await claimInvocation(
-          options.provenanceRepository,
-          requestInvocation,
-          scope
-        );
-        if (replay) {
-          const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
-          if (definition?.effectful) {
-            const authority2 = await options.authorize?.({ invocation: { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} }, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" };
-            if (!authority2.allowed) {
-              if (!requestController.signal.aborted) send(response, 403, { jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
-              return;
-            }
-          }
-          if (!requestController.signal.aborted)
-            send(response, 200, {
-              jsonrpc: "2.0",
-              id: body.id,
-              result: {
-                content: [
-                  {
-                    type: "text",
-                    text: JSON.stringify(replay.result ?? replay.error ?? null)
-                  }
-                ],
-                isError: !replay.ok,
-                provenanceDigest: replay.provenanceDigest
-              }
-            });
-          return;
-        }
-      }
-      let upstreamResponse;
-      let authority;
-      const requestCancelled = new Promise(
-        (resolve3) => request.once(
-          "aborted",
-          () => resolve3({ error: "MCP_REQUEST_CANCELLED" })
-        )
-      );
-      const transport = {
-        call: async (input) => {
-          upstreamResponse = await Promise.race([
-            options.transport.call({
-              ...input,
-              signal: input.signal ?? requestController.signal
-            }),
-            requestCancelled
-          ]);
-          return upstreamResponse;
-        }
-      };
-      const result = await handleMcpJsonRpc({
-        request: body,
-        server: options.serverName,
-        tools: options.tools,
-        resources: options.resources,
-        prompts: options.prompts,
-        readResource: options.readResource,
-        getPrompt: options.getPrompt,
-        invocation: requestInvocation,
-        transport,
-        cancellationRegistry,
-        authorize: async (input) => {
-          authority = await options.authorize?.(input) ?? (input.definition.effectful ? {
-            allowed: false,
-            decisionDigest: "",
-            reason: "MCP_AUTHORITY_REQUIRED"
-          } : { allowed: true, decisionDigest: "read-only" });
-          return authority;
-        }
-      });
-      if (options.provenanceRepository && body.method === "tools/call") {
-        const tool = String(body.params?.name ?? "");
-        await persistVerifiedMcpResult(
-          options.provenanceRepository,
-          createMcpResultFromResponse({
-            invocation: {
-              ...requestInvocation,
-              server: options.serverName,
-              tool,
-              arguments: body.params?.arguments ?? {}
-            },
-            response: upstreamResponse ?? {
-              error: authority?.reason ?? "MCP_AUTHORITY_DENIED"
-            },
-            authority
-          })
-        );
-      }
-      if (!requestController.signal.aborted) send(response, 200, result);
-    } catch {
-      if (!requestController.signal.aborted)
-        send(response, 400, {
-          jsonrpc: "2.0",
-          id: null,
-          error: { code: -32600, message: "INVALID_MCP_REQUEST" }
-        });
-    } finally {
-      request.removeListener("aborted", onAborted);
-    }
-  });
-}
-function createMcpStdioServer(options, input = process.stdin, output = process.stdout) {
-  const cancellationRegistry = options.cancellationRegistry ?? createMcpCancellationRegistry();
-  const lines = createInterface({
-    input,
-    crlfDelay: Infinity
-  });
-  let closed = false;
-  const write = (body) => {
-    if (!closed) output.write(`${JSON.stringify(body)}
-`);
-  };
-  const processLine = async (line) => {
-    if (!line.trim()) return;
-    let body;
-    try {
-      body = JSON.parse(line);
-    } catch {
-      write({
-        jsonrpc: "2.0",
-        id: null,
-        error: { code: -32700, message: "PARSE_ERROR" }
-      });
-      return;
-    }
-    const token = requestToken(body.id);
-    const requestInvocation = {
-      ...options.invocation,
-      id: `${options.invocation.id}:${token}`,
-      receiptId: `${options.invocation.receiptId}:${token}`,
-      idempotencyKey: `${options.invocation.idempotencyKey}:${token}`
-    };
-    const scope = {
-      organizationId: requestInvocation.organizationId,
-      projectId: requestInvocation.projectId,
-      environmentId: requestInvocation.environmentId
-    };
-    try {
-      await assertConfiguredSession(options, options.sessionId, scope);
-    } catch {
-      if (body.id !== void 0)
-        write({
-          jsonrpc: "2.0",
-          id: body.id,
-          error: { code: -32001, message: "MCP_SESSION_NOT_ACTIVE" }
-        });
-      return;
-    }
-    if (options.invocationExecutor && body.method === "tools/call") {
-      const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
-      if (definition) {
-        const invocation = { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} };
-        const authority2 = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
-        if (authority2.allowed) {
-          const result = await options.invocationExecutor({ invocation, authority: authority2 });
-          if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } });
-          return;
-        }
-        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
-        return;
-      }
-    }
-    if (options.provenanceRepository && body.method === "tools/call") {
-      const replay = await claimInvocation(
-        options.provenanceRepository,
-        requestInvocation,
-        scope
-      );
-      if (replay) {
-        const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
-        if (definition?.effectful) {
-          const authority2 = await options.authorize?.({ invocation: { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} }, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" };
-          if (!authority2.allowed) {
-            write({ jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
-            return;
-          }
-        }
-        write({
-          jsonrpc: "2.0",
-          id: body.id,
-          result: {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify(replay.result ?? replay.error ?? null)
-              }
-            ],
-            isError: !replay.ok,
-            provenanceDigest: replay.provenanceDigest
-          }
-        });
-        return;
-      }
-    }
-    let upstreamResponse;
-    let authority;
-    const transport = {
-      call: async (value) => {
-        upstreamResponse = await options.transport.call({
-          ...value,
-          signal: value.signal
-        });
-        return upstreamResponse;
-      }
-    };
-    try {
-      if (body.method === "server/discover") {
-        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { supportedProtocolVersions: ["2026-07-28", "2025-11-25", "2025-03-26"], serverInfo: { name: options.serverName, version: "1.0.0" }, capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } } });
-        return;
-      }
-      if (body.method === "initialize") {
-        const requested = String(body.params?.protocolVersion ?? "");
-        const protocolVersion = ["2026-07-28", "2025-11-25", "2025-03-26"].includes(requested) ? requested : "2025-03-26";
-        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { protocolVersion, serverInfo: { name: options.serverName, version: "1.0.0" }, capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } } });
-        return;
-      }
-      const result = await handleMcpJsonRpc({
-        request: body,
-        server: options.serverName,
-        tools: options.tools,
-        resources: options.resources,
-        prompts: options.prompts,
-        readResource: options.readResource,
-        getPrompt: options.getPrompt,
-        invocation: requestInvocation,
-        transport,
-        cancellationRegistry,
-        authorize: async (value) => {
-          authority = await options.authorize?.(value) ?? (value.definition.effectful ? {
-            allowed: false,
-            decisionDigest: "",
-            reason: "MCP_AUTHORITY_REQUIRED"
-          } : { allowed: true, decisionDigest: "read-only" });
-          return authority;
-        }
-      });
-      if (options.provenanceRepository && body.method === "tools/call") {
-        const tool = String(body.params?.name ?? "");
-        await persistVerifiedMcpResult(
-          options.provenanceRepository,
-          createMcpResultFromResponse({
-            invocation: {
-              ...requestInvocation,
-              server: options.serverName,
-              tool,
-              arguments: body.params?.arguments ?? {}
-            },
-            response: upstreamResponse ?? {
-              error: authority?.reason ?? "MCP_AUTHORITY_DENIED"
-            },
-            authority
-          })
-        );
-      }
-      if (result !== null) write(result);
-    } catch {
-      if (body.id !== void 0)
-        write({
-          jsonrpc: "2.0",
-          id: body.id,
-          error: { code: -32600, message: "INVALID_MCP_REQUEST" }
-        });
-    }
-  };
-  lines.on("line", (line) => {
-    void processLine(line);
-  });
-  return {
-    close: () => {
-      closed = true;
-      lines.close();
-    }
-  };
-}
-function send(response, status, body) {
-  response.writeHead(status, {
-    "content-type": "application/json; charset=utf-8",
-    "cache-control": "no-store"
-  });
-  response.end(JSON.stringify(body));
-}
-function readBody(request, limit) {
-  return new Promise((resolve3, reject) => {
-    let size = 0;
-    const chunks = [];
-    request.on("data", (chunk) => {
-      size += chunk.length;
-      if (size > limit) {
-        reject(new Error("PAYLOAD_TOO_LARGE"));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    request.on("end", () => resolve3(Buffer.concat(chunks).toString("utf8")));
-    request.on("error", reject);
-  });
-}
-var requestToken, claimInvocation;
-var init_server = __esm({
-  "../../apps/mcp-server/server.ts"() {
-    "use strict";
-    init_mcp_gateway();
-    init_mcp_provenance();
-    init_mcp_session();
-    requestToken = (value) => String(
-      value ?? `notification-${Date.now()}-${Math.random().toString(16).slice(2)}`
-    );
-    claimInvocation = async (repository, invocation, scope) => {
-      const claim = await repository.claim?.({
-        invocationId: invocation.id,
-        idempotencyKey: invocation.idempotencyKey,
-        ...scope
-      });
-      if (claim?.status === "IN_FLIGHT")
-        throw new Error("MCP_INVOCATION_IN_FLIGHT");
-      return claim?.result ?? await repository.getByIdempotencyKey?.(invocation.idempotencyKey, scope) ?? null;
-    };
-  }
-});
-
-// ../runtime/src/mcp-invocation-service.ts
-import { createHash as createHash5 } from "node:crypto";
-function assertReplayIdentity(invocation, authority, result) {
-  const argumentsDigest = createHash5("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
-  const expectedAuthorityDecisionDigest = authority?.decisionDigest ?? "not-required";
-  if (result.organizationId !== invocation.organizationId || result.projectId !== invocation.projectId || result.environmentId !== invocation.environmentId || result.server !== invocation.server || result.tool !== invocation.tool || result.receiptId !== invocation.receiptId || result.idempotencyKey !== invocation.idempotencyKey || result.argumentsDigest !== argumentsDigest || result.authorityDecisionDigest !== expectedAuthorityDecisionDigest || result.authorityDigest !== (invocation.authorityDigest ?? null)) throw new Error("MCP_INVOCATION_REPLAY_MISMATCH");
-}
-async function executeMcpInvocation(input) {
-  const started = Date.now();
-  const claim = await input.store.claim({ invocationId: input.invocation.id, idempotencyKey: input.invocation.idempotencyKey, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId });
-  if (claim.status === "REPLAY" && claim.result) {
-    verifyMcpResult(claim.result);
-    assertReplayIdentity(input.invocation, input.authority, claim.result);
-    await input.observe?.({ result: claim.result, replay: true, durationMs: Date.now() - started });
-    return claim.result;
-  }
-  if (claim.status === "IN_FLIGHT") throw new Error("MCP_INVOCATION_IN_FLIGHT");
-  try {
-    const result = await invokeMcpTool({ invocation: input.invocation, transport: input.transport, authority: input.authority, signal: input.signal });
-    const persisted = await input.store.save(result);
-    verifyMcpResult(persisted);
-    await input.observe?.({ result: persisted, replay: false, durationMs: Date.now() - started });
-    return persisted;
-  } catch (error) {
-    if (input.signal?.aborted) await input.store.releaseClaim?.({ idempotencyKey: input.invocation.idempotencyKey, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId });
-    throw error;
-  }
-}
-var init_mcp_invocation_service = __esm({
-  "../runtime/src/mcp-invocation-service.ts"() {
-    "use strict";
-    init_mcp_gateway();
-    init_mcp_gateway();
-  }
-});
-
-// ../database/src/mcp-provenance-repository.ts
-var assertClaimInput, McpProvenanceRepository, SqlMcpProvenanceRepository;
-var init_mcp_provenance_repository = __esm({
-  "../database/src/mcp-provenance-repository.ts"() {
-    "use strict";
-    init_mcp_provenance();
-    init_scope_composer();
-    assertClaimInput = (input) => {
-      if (!input.invocationId?.trim() || !input.idempotencyKey?.trim() || !input.organizationId?.trim() || !input.projectId?.trim() || !input.environmentId?.trim()) throw new Error("MCP_CLAIM_INPUT_INVALID");
-    };
-    McpProvenanceRepository = class {
-      #items = /* @__PURE__ */ new Map();
-      #claims = /* @__PURE__ */ new Set();
-      claim(input) {
-        assertClaimInput(input);
-        const replay = this.getByIdempotencyKey(input.idempotencyKey, input);
-        if (replay) return { status: "REPLAY", result: replay };
-        const key = `${input.organizationId}:${input.projectId}:${input.environmentId}:${input.idempotencyKey}`;
-        if (this.#claims.has(key)) return { status: "IN_FLIGHT" };
-        this.#claims.add(key);
-        return { status: "CLAIMED" };
-      }
-      save(result) {
-        verifyMcpResult2(result);
-        const prior = this.#items.get(result.invocationId);
-        const byKey = this.getByIdempotencyKey(result.idempotencyKey, result);
-        if (prior && prior.provenanceDigest !== result.provenanceDigest || byKey && byKey.provenanceDigest !== result.provenanceDigest)
-          throw new Error("MCP_PROVENANCE_CONFLICT");
-        this.#items.set(result.invocationId, structuredClone(result));
-        this.#claims.delete(
-          `${result.organizationId}:${result.projectId}:${result.environmentId}:${result.idempotencyKey}`
-        );
-        return structuredClone(prior ?? byKey ?? result);
-      }
-      releaseClaim(input) {
-        assertClaimInput({ ...input, invocationId: "release-claim" });
-        this.#claims.delete(`${input.organizationId}:${input.projectId}:${input.environmentId}:${input.idempotencyKey}`);
-      }
-      saveComposed(scope, result) {
-        assertComposedScopeIntegrity(scope);
-        const projected = { organizationId: scope.chain.find((item) => item.level === "organization")?.id ?? "", projectId: scope.chain.find((item) => item.level === "project")?.id ?? "", environmentId: scope.chain.find((item) => item.level === "application")?.id ?? "" };
-        if (result.organizationId !== projected.organizationId || result.projectId !== projected.projectId || result.environmentId !== projected.environmentId) throw new Error("MCP_SCOPE_MISMATCH");
-        if (result.authorityDigest !== scope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
-        return this.save(result);
-      }
-      get(invocationId) {
-        const result = this.#items.get(invocationId);
-        if (!result) return null;
-        verifyMcpResult2(result);
-        return structuredClone(result);
-      }
-      getByIdempotencyKey(key, scope) {
-        const result = [...this.#items.values()].find(
-          (item) => item.idempotencyKey === key && item.organizationId === scope.organizationId && item.projectId === scope.projectId && item.environmentId === scope.environmentId
-        );
-        if (!result) return null;
-        verifyMcpResult2(result);
-        return structuredClone(result);
-      }
-      list(scope, limit = 100) {
-        return [...this.#items.values()].filter((item) => item.organizationId === scope.organizationId && item.projectId === scope.projectId && item.environmentId === scope.environmentId).slice(0, Math.max(0, Math.min(500, limit))).map((item) => {
-          verifyMcpResult2(item);
-          return structuredClone(item);
-        });
-      }
-    };
-    SqlMcpProvenanceRepository = class {
-      db;
-      constructor(db) {
-        this.db = db;
-        this.db.run(
-          "CREATE TABLE IF NOT EXISTS mcp_invocation_claims (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, invocation_id TEXT NOT NULL, claimed_at TEXT NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, idempotency_key))",
-          []
-        );
-      }
-      releaseClaim(input) {
-        assertClaimInput({ ...input, invocationId: "release-claim" });
-        this.db.run("DELETE FROM mcp_invocation_claims WHERE organization_id=? AND project_id=? AND environment_id=? AND idempotency_key=?", [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey]);
-      }
-      claim(input) {
-        assertClaimInput(input);
-        const replay = this.getByIdempotencyKey(input.idempotencyKey, input);
-        if (replay) return { status: "REPLAY", result: replay };
-        try {
-          this.db.run(
-            "INSERT INTO mcp_invocation_claims (organization_id, project_id, environment_id, idempotency_key, invocation_id, claimed_at) VALUES (?, ?, ?, ?, ?, ?)",
-            [
-              input.organizationId,
-              input.projectId,
-              input.environmentId,
-              input.idempotencyKey,
-              input.invocationId,
-              (/* @__PURE__ */ new Date()).toISOString()
-            ]
-          );
-          return { status: "CLAIMED" };
-        } catch {
-          const after = this.getByIdempotencyKey(input.idempotencyKey, input);
-          return after ? { status: "REPLAY", result: after } : { status: "IN_FLIGHT" };
-        }
-      }
-      save(result) {
-        verifyMcpResult2(result);
-        const prior = this.getForScope(result, result.invocationId);
-        const byKey = this.getByIdempotencyKey(result.idempotencyKey, result);
-        const existing = prior ?? byKey;
-        if (existing) {
-          if (existing.provenanceDigest !== result.provenanceDigest)
-            throw new Error("MCP_PROVENANCE_CONFLICT");
-          return existing;
-        }
-        this.db.run(
-          "DELETE FROM mcp_invocation_claims WHERE organization_id=? AND project_id=? AND environment_id=? AND idempotency_key=?",
-          [
-            result.organizationId,
-            result.projectId,
-            result.environmentId,
-            result.idempotencyKey
-          ]
-        );
-        this.db.run(
-          "INSERT INTO mcp_invocation_provenance (invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-          [
-            result.invocationId,
-            result.organizationId,
-            result.projectId,
-            result.environmentId,
-            result.server,
-            result.tool,
-            result.receiptId,
-            result.idempotencyKey,
-            result.argumentsDigest,
-            result.ok ? 1 : 0,
-            result.result === void 0 ? null : JSON.stringify(result.result),
-            result.error ?? null,
-            result.authorityDecisionDigest,
-            result.authorityDigest ?? null,
-            result.provenanceDigest
-          ]
-        );
-        const persisted = this.getForScope(result, result.invocationId);
-        if (!persisted || persisted.provenanceDigest !== result.provenanceDigest || persisted.receiptId !== result.receiptId || persisted.argumentsDigest !== result.argumentsDigest || persisted.authorityDecisionDigest !== result.authorityDecisionDigest || persisted.authorityDigest !== result.authorityDigest) throw new Error("MCP_PROVENANCE_READBACK_MISMATCH");
-        return persisted;
-      }
-      saveComposed(scope, result) {
-        assertComposedScopeIntegrity(scope);
-        const projected = { organizationId: scope.chain.find((item) => item.level === "organization")?.id ?? "", projectId: scope.chain.find((item) => item.level === "project")?.id ?? "", environmentId: scope.chain.find((item) => item.level === "application")?.id ?? "" };
-        if (result.organizationId !== projected.organizationId || result.projectId !== projected.projectId || result.environmentId !== projected.environmentId) throw new Error("MCP_SCOPE_MISMATCH");
-        if (result.authorityDigest !== scope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
-        return this.save(result);
-      }
-      get(invocationId) {
-        const row = this.db.exec(
-          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE invocation_id = ?",
-          [invocationId]
-        )[0]?.values[0];
-        return row ? this.fromRow(row) : null;
-      }
-      getByIdempotencyKey(key, scope) {
-        const row = this.db.exec(
-          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE idempotency_key = ? AND organization_id = ? AND project_id = ? AND environment_id = ?",
-          [key, scope.organizationId, scope.projectId, scope.environmentId]
-        )[0]?.values[0];
-        return row ? this.fromRow(row) : null;
-      }
-      getForScope(scope, invocationId) {
-        const row = this.db.exec(
-          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE invocation_id = ? AND organization_id = ? AND project_id = ? AND environment_id = ?",
-          [
-            invocationId,
-            scope.organizationId,
-            scope.projectId,
-            scope.environmentId
-          ]
-        )[0]?.values[0];
-        return row ? this.fromRow(row) : null;
-      }
-      list(scope, limit = 100) {
-        const bounded = Math.max(0, Math.min(500, limit));
-        const rows = this.db.exec("SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE organization_id=? AND project_id=? AND environment_id=? ORDER BY invocation_id DESC LIMIT ?", [scope.organizationId, scope.projectId, scope.environmentId, bounded])[0]?.values ?? [];
-        return rows.map((row) => this.fromRow(row));
-      }
-      fromRow(row) {
-        const result = {
-          invocationId: String(row[0]),
-          organizationId: String(row[1]),
-          projectId: String(row[2]),
-          environmentId: String(row[3]),
-          server: String(row[4]),
-          tool: String(row[5]),
-          receiptId: String(row[6]),
-          idempotencyKey: String(row[7]),
-          argumentsDigest: String(row[8]),
-          ok: Number(row[9]) === 1,
-          result: row[10] === null || row[10] === void 0 ? void 0 : JSON.parse(String(row[10])),
-          error: row[11] === null || row[11] === void 0 ? void 0 : String(row[11]),
-          authorityDecisionDigest: String(row[12]),
-          authorityDigest: row[13] === null || row[13] === void 0 ? null : String(row[13]),
-          provenanceDigest: String(row[14])
-        };
-        verifyMcpResult2(result);
-        return result;
-      }
-    };
-  }
-});
-
-// ../../apps/mcp-server/vira-server.ts
-function resolveViraMcpConfig(environment = process.env) {
-  const baseUrl = (environment.VIRA_API_URL ?? "http://127.0.0.1:4185").replace(/\/$/, "");
-  const apiKey = environment.VIRA_API_KEY ?? (environment.NODE_ENV === "production" ? "" : "vira_dev_local.local-development-only-32chars");
-  if (!apiKey) throw new Error("VIRA_API_KEY_REQUIRED_IN_PRODUCTION");
-  const authorityUrl = environment.VIRA_MCP_AUTHORITY_URL;
-  return { baseUrl, apiKey, authorityUrl, serverName: environment.VIRA_MCP_SERVER_NAME ?? "vira-behavior-control", requestAuthToken: environment.VIRA_MCP_AUTH_TOKEN, ...authorityUrl ? { authorizeEffectful: async (input) => {
-    const response = await fetch(`${authorityUrl}`, { method: "POST", headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" }, body: JSON.stringify(input) });
-    const payload = await response.json().catch(() => null);
-    return { allowed: response.ok && payload?.allowed === true, decisionDigest: payload?.decisionDigest ?? "", ...payload?.reason ? { reason: payload.reason } : {} };
-  } } : {} };
-}
-function assertScope(input, scope) {
-  for (const key of ["organizationId", "projectId", "environmentId"]) if (input[key] !== scope[key]) throw new Error("MCP_VIRA_SCOPE_MISMATCH");
-}
-function createViraMcpServer(config) {
-  return createMcpServer(createViraMcpOptions(config));
-}
-function createViraMcpOptions(config) {
-  if (!config.baseUrl?.trim() || !config.apiKey?.trim()) throw new Error("VIRA_MCP_CONFIG_REQUIRED");
-  const fetcher = config.fetcher ?? fetch;
-  const api = async (path, body, requestId) => {
-    const response = await fetcher(`${config.baseUrl.replace(/\/$/, "")}${path}`, { method: body ? "POST" : "GET", headers: { authorization: `Bearer ${config.apiKey}`, "content-type": "application/json", "idempotency-key": requestId }, ...body ? { body: JSON.stringify(body) } : {} });
-    const payload = await response.json().catch(() => null);
-    if (!response.ok) return { error: `VIRA_API_${response.status}`, result: payload };
-    return { result: payload };
-  };
-  const options = { serverName: config.serverName ?? "vira-behavior-control", requestAuthToken: config.requestAuthToken, tools, invocation: { ...config.scope, id: "mcp-vira", receiptId: "mcp-vira", idempotencyKey: "mcp-vira" }, transport: { call: async ({ tool, arguments: args }) => {
-    assertScope(args, config.scope);
-    const scopeQuery = `organizationId=${encodeURIComponent(config.scope.organizationId)}&projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`;
-    if (tool === "list_behavior_programs") return api(`/v1/behavior-programs?projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "list_behavior_strategies") return api(`/v1/behavior-strategies?${scopeQuery}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "get_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.strategyId)}`);
-    if (tool === "simulate_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}/simulate?${scopeQuery}`, { initialState: args.initialState ?? {} }, `mcp:${tool}:${String(args.strategyId)}`);
-    if (tool === "start_strategy_execution") return api("/v1/runtime/strategy-executions", args, `mcp:${tool}:${String(args.executionId ?? args.artifactDigest)}`);
-    if (tool === "get_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.executionId)}`);
-    if (tool === "get_strategy_execution_trace") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/trace?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.executionId)}`);
-    if (tool === "continue_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/continue`, args.authorityDigest ? { authorityDigest: args.authorityDigest } : {}, `mcp:${tool}:${String(args.executionId)}`);
-    if (tool === "cancel_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/cancel`, {}, `mcp:${tool}:${String(args.executionId)}`);
-    if (tool === "list_ai_systems") return api(`/v1/ai-systems?${scopeQuery}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "list_discovery_candidates") return api(`/v1/discovery/candidates?${scopeQuery}${args.reviewState ? `&reviewState=${encodeURIComponent(String(args.reviewState))}` : ""}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "review_discovery_candidate") return api(`/v1/discovery/candidates/${encodeURIComponent(String(args.kind))}/${encodeURIComponent(String(args.key))}/review`, { ...args }, `mcp:${tool}:${String(args.kind)}:${String(args.key)}`);
-    if (tool === "create_observation") return api("/v1/observations", args, `mcp:${tool}:${String(args.id)}`);
-    if (tool === "start_evaluation") return api("/v1/evaluations", args, `mcp:${tool}:${String(args.id)}`);
-    if (tool === "compile_behavior_capsule") return api("/v1/runtime/behavior-capsule", args, `mcp:${tool}:${String(args.programId)}`);
-    if (tool === "serve_behavior_projection") return api("/v1/runtime/behavior-projection", args, `mcp:${tool}:${String(args.programId ?? "active")}`);
-    throw new Error("MCP_TOOL_NOT_IMPLEMENTED");
-  } }, authorize: ({ invocation, definition }) => definition.effectful ? config.authorizeEffectful ? config.authorizeEffectful({ tool: definition.name, arguments: invocation.arguments, scope: { organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId } }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" }, ...config.provenanceRepository ? { provenanceRepository: config.provenanceRepository } : {}, ...config.sessionRepository ? { sessionRepository: config.sessionRepository } : {}, ...config.sessionId ? { sessionId: config.sessionId } : {}, ...config.invocationExecutor ? { invocationExecutor: config.invocationExecutor } : {} };
-  const originalTransport = options.transport;
-  const originalCall = originalTransport.call;
-  options.transport = { ...originalTransport, call: async (input) => {
-    const { tool, arguments: args } = input;
-    if (tool === "list_packs") return api("/v1/packs", void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "import_pack") return api("/v1/packs/import", args, `mcp:${tool}:${config.scope.projectId}`);
-    if (["install_pack", "evaluate_pack", "approve_pack", "release_pack", "preview_pack_upgrade"].includes(tool)) {
-      const action = { install_pack: "install", evaluate_pack: "evaluate", approve_pack: "approve", release_pack: "release", preview_pack_upgrade: "upgrade-preview" }[tool];
-      const { packId, ...body } = args;
-      return api(`/v1/packs/${encodeURIComponent(String(packId))}/${action}`, body, `mcp:${tool}:${String(packId)}`);
-    }
-    return originalCall(input);
-  } };
-  originalTransport.call = options.transport.call;
-  options.transport = { ...originalTransport, call: async (input) => {
-    if (input.tool === "resolve_semantic" || input.tool === "resolve_runtime") assertScope(input.arguments, config.scope);
-    return input.tool === "resolve_semantic" ? api("/v1/semantic/resolve", input.arguments, `mcp:resolve_semantic:${String(input.arguments.input)}`) : input.tool === "resolve_runtime" ? api("/v1/runtime/resolve", input.arguments, `mcp:resolve_runtime:${String(input.arguments.behaviorPoint)}`) : originalTransport.call(input);
-  } };
-  const signalTransport = options.transport;
-  options.transport = { ...signalTransport, call: async (input) => {
-    const { tool, arguments: args } = input;
-    if (tool.startsWith("signal_") || tool === "create_signal_discovery_proposal" || tool === "review_signal_discovery_proposal" || tool === "materialize_signal_discovery" || tool === "create_signal_mapping" || tool === "get_signal_mapping" || tool === "review_signal_mapping") assertScope(args, config.scope);
-    const scopeQuery = `organizationId=${encodeURIComponent(config.scope.organizationId)}&projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`;
-    if (tool === "create_signal_discovery_proposal") return api("/v1/signals/discovery-proposals", args, `mcp:${tool}:${String(args.signalStableKey)}`);
-    if (tool === "review_signal_discovery_proposal") return api(`/v1/signals/discovery-proposals/${encodeURIComponent(String(args.proposalId))}/review`, { decision: args.decision }, `mcp:${tool}:${String(args.proposalId)}`);
-    if (tool === "materialize_signal_discovery") {
-      const { proposalId, ...body } = args;
-      return api(`/v1/signals/discovery-proposals/${encodeURIComponent(String(proposalId))}/materialize`, body, `mcp:${tool}:${String(proposalId)}`);
-    }
-    if (tool === "create_signal_mapping") return api("/v1/signals/mappings", args, `mcp:${tool}:${String(args.signalStableKey)}`);
-    if (tool === "get_signal_mapping") return api(`/v1/signals/mappings/${encodeURIComponent(String(args.mappingId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.mappingId)}`);
-    if (tool === "review_signal_mapping") {
-      const { mappingId, ...body } = args;
-      return api(`/v1/signals/mappings/${encodeURIComponent(String(mappingId))}/review`, body, `mcp:${tool}:${String(mappingId)}`);
-    }
-    return signalTransport.call(input);
-  } };
-  const authoringTransport = options.transport;
-  options.transport = { ...authoringTransport, call: async (input) => {
-    const { tool, arguments: args } = input;
-    if (tool === "list_capabilities") return api(`/v1/capabilities${args.surface ? `?surface=${encodeURIComponent(String(args.surface))}` : ""}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "list_semantic_tasks") return api("/v1/semantic-tasks", void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "create_semantic_task") return api("/v1/semantic-tasks", args, `mcp:${tool}:${String(args.taskKey)}`);
-    if (tool === "list_behavior_points") return api("/v1/behavior-points", void 0, `mcp:${tool}:${config.scope.projectId}`);
-    if (tool === "create_behavior_point") return api("/v1/behavior-points", args, `mcp:${tool}:${String(args.key)}`);
-    if (tool === "activate_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}/activate`, {}, `mcp:${tool}:${String(args.strategyId)}`);
-    return authoringTransport.call(input);
-  } };
-  const lifecycleTransport = options.transport;
-  options.transport = { ...lifecycleTransport, call: async (input) => {
-    const { tool, arguments: args } = input;
-    if (tool === "submit_teach_evidence") return api("/v1/teach/evidence", args, `mcp:${tool}:${String(args.id)}`);
-    if (tool === "create_teach_proposal") return api("/v1/teach/proposals", args, `mcp:${tool}:${String(args.evidenceId)}`);
-    if (tool === "transition_teach_proposal") {
-      const { proposalId, transition, ...body } = args;
-      return api(`/v1/teach/proposals/${encodeURIComponent(String(proposalId))}/${encodeURIComponent(String(transition))}`, body, `mcp:${tool}:${String(proposalId)}`);
-    }
-    if (tool === "create_release") return api("/v1/releases", args, `mcp:${tool}:${String(args.releaseId ?? args.artifactId)}`);
-    return lifecycleTransport.call(input);
-  } };
-  const continuationTransport = options.transport;
-  options.transport = { ...continuationTransport, call: async (input) => {
-    if (input.tool === "continue_strategy_execution") {
-      const args = input.arguments;
-      const body = {
-        ...typeof args.authorityDigest === "string" ? { authorityDigest: args.authorityDigest } : {},
-        ...args.state && typeof args.state === "object" && !Array.isArray(args.state) ? { state: args.state } : {},
-        ...args.references && typeof args.references === "object" && !Array.isArray(args.references) ? { references: args.references } : {}
-      };
-      return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/continue`, body, `mcp:${input.tool}:${String(args.executionId)}`);
-    }
-    return continuationTransport.call(input);
-  } };
-  const configuredRepository = config.provenanceRepository;
-  if (configuredRepository && typeof configuredRepository.claim !== "function") throw new Error("MCP_PROVENANCE_CLAIM_REQUIRED");
-  const provenanceRepository = configuredRepository ?? new McpProvenanceRepository();
-  options.provenanceRepository = provenanceRepository;
-  options.invocationExecutor ??= ({ invocation, authority, signal }) => executeMcpInvocation({ invocation, authority, signal, transport: options.transport, store: provenanceRepository });
-  options.requireInvocationExecutor = true;
-  return options;
-}
-var tools;
-var init_vira_server = __esm({
-  "../../apps/mcp-server/vira-server.ts"() {
-    "use strict";
-    init_server();
-    init_mcp_invocation_service();
-    init_mcp_provenance_repository();
-    tools = Object.freeze([
-      { name: "list_capabilities", description: "Show which Vira capabilities this scoped credential can use and on which public surfaces.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, surface: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "list_semantic_tasks", description: "Read scoped Semantic Tasks.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "create_semantic_task", description: "Create a scoped Semantic Task for later review/activation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, taskKey: { type: "string" }, description: { type: "string" }, version: { type: "number" }, aliases: { type: "array" }, examples: { type: "array" }, negativeExamples: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "taskKey"] } },
-      { name: "list_behavior_points", description: "Read scoped canonical BehaviorPoints.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "create_behavior_point", description: "Create a scoped BehaviorPoint bound to one or more Semantic Tasks.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, key: { type: "string" }, taskId: { type: "string" }, taskIds: { type: "array" }, constraints: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "key"] } },
-      { name: "activate_behavior_strategy", description: "Activate a validated scoped Behavior Strategy revision.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
-      { name: "submit_teach_evidence", description: "Submit scoped evidence to the Teach lifecycle.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, source: { type: "string" }, content: { type: "string" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
-      { name: "create_teach_proposal", description: "Create a reviewed Teach proposal from admitted evidence.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, evidenceId: { type: "string" }, controlPointId: { type: "string" }, summary: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "evidenceId", "controlPointId", "summary"] } },
-      { name: "transition_teach_proposal", description: "Review, evaluate, or promote a Teach proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, transition: { type: "string" }, decision: { type: "string" }, score: { type: "number" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "transition"] } },
-      { name: "create_release", description: "Create a scoped release after evaluation and approval.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, releaseId: { type: "string" }, artifactId: { type: "string" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "artifactId"] } },
-      { name: "resolve_semantic", description: "Resolve input through the governed semantic runtime.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, input: { type: "string" }, sessionId: { type: "string" }, profile: { type: "object" }, selection: { type: "object" }, candidates: { type: "array" }, timeoutMs: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "input"] } },
-      { name: "resolve_runtime", description: "Resolve a persisted BehaviorPoint through the governed runtime boundary. behaviorPoint may be omitted when semanticContext supplies the selected canonical route.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, behaviorPoint: { type: "string" }, executionBoundary: { type: "object" }, semanticContext: { type: "object" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "create_signal_discovery_proposal", description: "Propose a discovered signal for scoped human review.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, signalStableKey: { type: "string" }, evidenceEventIds: { type: "array", items: { type: "string" } }, suggestedProducerType: { type: "string" }, suggestedProducerKey: { type: "string" }, confidence: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "signalStableKey", "evidenceEventIds"] } },
-      { name: "review_signal_discovery_proposal", description: "Approve or reject a discovered signal proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, decision: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "decision"] } },
-      { name: "materialize_signal_discovery", description: "Materialize an approved signal into a definition and producer mapping.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, valueType: { type: "string" }, description: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId"] } },
-      { name: "create_signal_mapping", description: "Create a scoped signal producer mapping proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, signalStableKey: { type: "string" }, signalVersion: { type: "number" }, producerType: { type: "string" }, producerKey: { type: "string" }, sourceEventType: { type: "string" }, evidenceEventIds: { type: "array", items: { type: "string" } } }, required: ["organizationId", "projectId", "environmentId", "signalStableKey", "signalVersion", "producerType", "producerKey"] } },
-      { name: "get_signal_mapping", description: "Read one scoped signal producer mapping.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, mappingId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "mappingId"] } },
-      { name: "review_signal_mapping", description: "Approve or reject a scoped signal producer mapping.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, mappingId: { type: "string" }, decision: { type: "string" }, eventId: { type: "string" }, definition: { type: "object" }, teachConsentRecord: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "mappingId", "decision"] } },
-      { name: "list_behavior_programs", description: "Read scoped canonical behavior programs.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "list_behavior_strategies", description: "Read persisted immutable Behavior Strategy revisions in the configured scope.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "get_behavior_strategy", description: "Read one persisted Behavior Strategy definition and artifact binding.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
-      { name: "simulate_behavior_strategy", description: "Run the explicit structural dry-run for a persisted Behavior Strategy.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" }, initialState: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
-      { name: "start_strategy_execution", description: "Start a persisted Strategy execution through the governed runtime boundary.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, behaviorPoint: { type: "string" }, executionBoundary: { type: "object" }, revisionId: { type: "string" }, idempotencyKey: { type: "string" }, nonce: { type: "string" }, expiresAt: { type: "number" }, decisionPlanId: { type: "string" }, candidates: { type: "array", items: { type: "object" } }, policy: { type: "string" }, allowedIds: { type: "array", items: { type: "string" } }, calibrationId: { type: "string" }, postModelJudge: { type: "object" }, shadow: { type: "object" }, artifactDigest: { type: "string" }, traceId: { type: "string" }, executionId: { type: "string" }, state: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "revisionId", "idempotencyKey", "nonce", "expiresAt", "decisionPlanId", "candidates", "policy", "artifactDigest"] } },
-      { name: "get_strategy_execution", description: "Read one scoped Strategy execution.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
-      { name: "get_strategy_execution_trace", description: "Read persisted Strategy step receipts and trace evidence.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
-      { name: "continue_strategy_execution", description: "Continue a waiting Strategy execution with the same pinned artifact, state, and external references.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" }, authorityDigest: { type: "string" }, state: { type: "object", additionalProperties: true }, references: { type: "object", additionalProperties: true } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
-      { name: "cancel_strategy_execution", description: "Cancel a non-terminal scoped Strategy execution.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
-      { name: "list_ai_systems", description: "Read connected AI systems in the configured scope.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "list_discovery_candidates", description: "Read evidence-backed discovery candidates awaiting human review.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, reviewState: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "review_discovery_candidate", description: "Record a human review decision for a scoped discovery candidate.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, kind: { type: "string" }, key: { type: "string" }, decision: { type: "string" }, payload: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "kind", "key", "decision"] } },
-      { name: "create_observation", description: "Submit one scoped observation for discovery; it does not publish behavior.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, content: { type: "object" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
-      { name: "start_evaluation", description: "Start a local evaluation for an existing artifact.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, targetArtifact: { type: "string" }, dataset: { type: "array" }, assertions: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "id", "targetArtifact", "dataset", "assertions"] } },
-      { name: "compile_behavior_capsule", description: "Compile a persisted scoped Behavior VM capsule and return its receipt.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, selection: { type: "object" }, candidates: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "programId", "input"] } },
-      { name: "serve_behavior_projection", description: "Serve the active scoped behavior projection through the governed runtime boundary.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, provider: { type: "string" }, protocol: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "input", "provider"] } },
-      { name: "list_packs", description: "Read scoped behavior packs.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
-      { name: "import_pack", description: "Import and validate a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, manifest: { type: "object" }, objects: { type: "object" }, archiveBase64: { type: "string" }, fileName: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "manifest"] } },
-      { name: "install_pack", description: "Install a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, variables: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
-      { name: "evaluate_pack", description: "Evaluate a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, passed: { type: "boolean" }, score: { type: "number" }, runId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId", "passed"] } },
-      { name: "approve_pack", description: "Approve a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
-      { name: "release_pack", description: "Release a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
-      { name: "preview_pack_upgrade", description: "Preview a scoped behavior pack upgrade.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, incoming: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "packId", "incoming"] } }
-    ]);
-  }
-});
-
-// ../database/src/mcp-session-repository.ts
-var SqlMcpSessionRepository;
-var init_mcp_session_repository = __esm({
-  "../database/src/mcp-session-repository.ts"() {
-    "use strict";
-    init_mcp_session();
-    SqlMcpSessionRepository = class {
-      db;
-      constructor(db) {
-        this.db = db;
-      }
-      save(session) {
-        assertMcpSession(session);
-        const row = this.db.exec("SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=?", [session.id])[0]?.values[0];
-        if (row) {
-          const prior = this.mapRow(row);
-          if (prior.organizationId !== session.organizationId || prior.projectId !== session.projectId || prior.environmentId !== session.environmentId) throw new Error("MCP_SESSION_SCOPE_CONFLICT");
-          if (prior.sessionDigest === session.sessionDigest) return prior;
-          if (session.generation < prior.generation || session.generation === prior.generation && prior.status === "CLOSED") throw new Error("MCP_SESSION_CONFLICT");
-          this.db.run("UPDATE mcp_sessions SET server=?,endpoint=?,protocol_version=?,status=?,auth_digest=?,generation=?,updated_at=?,session_digest=? WHERE id=? AND organization_id=? AND project_id=? AND environment_id=?", [session.server, session.endpoint, session.protocolVersion, session.status, session.authDigest, session.generation, session.updatedAt, session.sessionDigest, session.id, session.organizationId, session.projectId, session.environmentId]);
-          const persisted2 = this.get(session.id, { organizationId: session.organizationId, projectId: session.projectId, environmentId: session.environmentId });
-          if (!persisted2 || persisted2.sessionDigest !== session.sessionDigest || persisted2.generation !== session.generation || persisted2.status !== session.status) throw new Error("MCP_SESSION_READBACK_MISMATCH");
-          return persisted2;
-        }
-        this.db.run("INSERT INTO mcp_sessions (id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)", [session.id, session.organizationId, session.projectId, session.environmentId, session.server, session.endpoint, session.protocolVersion, session.status, session.authDigest, session.generation, session.createdAt, session.updatedAt, session.sessionDigest]);
-        const persisted = this.get(session.id, { organizationId: session.organizationId, projectId: session.projectId, environmentId: session.environmentId });
-        if (!persisted || persisted.sessionDigest !== session.sessionDigest) throw new Error("MCP_SESSION_READBACK_MISMATCH");
-        return persisted;
-      }
-      mapRow(row) {
-        const session = { id: String(row[0]), organizationId: String(row[1]), projectId: String(row[2]), environmentId: String(row[3]), server: String(row[4]), endpoint: String(row[5]), protocolVersion: String(row[6]), authDigest: String(row[8]), status: String(row[7]), generation: Number(row[9]), createdAt: String(row[10]), updatedAt: String(row[11]), sessionDigest: String(row[12]) };
-        assertMcpSession(session);
-        return session;
-      }
-      get(id, scope) {
-        const row = this.db.exec("SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=? AND organization_id=? AND project_id=? AND environment_id=?", [id, scope.organizationId, scope.projectId, scope.environmentId])[0]?.values[0];
-        return row ? this.mapRow(row) : null;
-      }
-    };
-  }
-});
-
-// ../../apps/mcp-server/official-stdio.ts
-import { McpServer } from "@modelcontextprotocol/server";
-import { serveStdio } from "@modelcontextprotocol/server/stdio";
-import { z } from "zod";
-function serveOfficialViraMcp(options) {
-  return serveStdio(() => {
-    const server = new McpServer({ name: options.serverName, version: "1.0.0" }, { capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } });
-    for (const definition of options.tools) {
-      server.registerTool(definition.name, { description: definition.description, inputSchema: z.record(z.string(), z.unknown()) }, async (argumentsValue) => {
-        const invocation = { ...options.invocation, server: options.serverName, tool: definition.name, arguments: argumentsValue };
-        const authority = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
-        if (!authority.allowed) return { isError: true, content: [{ type: "text", text: authority.reason ?? "MCP_AUTHORITY_DENIED" }] };
-        const result = options.invocationExecutor ? await options.invocationExecutor({ invocation, authority }) : await invokeMcpTool({ invocation, authority, transport: options.transport });
-        return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }] };
-      });
-    }
-    return server;
-  });
-}
-var init_official_stdio = __esm({
-  "../../apps/mcp-server/official-stdio.ts"() {
-    "use strict";
-    init_mcp_gateway();
-  }
-});
-
-// ../database/src/postgres-adapter.ts
-import { Pool } from "pg";
-function validateSql(sql) {
-  if (!sql.trim()) throw new Error("POSTGRES_SQL_REQUIRED");
-  if (sql.includes("\0")) throw new Error("POSTGRES_SQL_INVALID");
-}
-function createPostgresDatabase(input) {
-  if (!input.pool || typeof input.pool.query !== "function" || typeof input.pool.connect !== "function") throw new Error("POSTGRES_POOL_INVALID");
-  if (!input.databaseUrl?.trim() && !process.env.DATABASE_URL?.trim()) throw new Error("DATABASE_URL_REQUIRED");
-  return { mode: "production", query: async (sql, params = []) => {
-    validateSql(sql);
-    return input.pool.query(sql, params);
-  }, transaction: async (work) => {
-    if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
-    const client = await input.pool.connect();
-    try {
-      await client.query("BEGIN");
-      const result = await work(client);
-      await client.query("COMMIT");
-      return result;
-    } catch (error) {
-      try {
-        await client.query("ROLLBACK");
-      } catch {
-      }
-      throw error;
-    } finally {
-      client.release();
-    }
-  }, health: () => ({ ready: true, mode: "production" }) };
-}
-function createPostgresPool(input = {}) {
-  const connectionString = input.databaseUrl ?? process.env.DATABASE_URL;
-  if (!connectionString?.startsWith("postgres")) throw new Error("POSTGRES_DATABASE_URL_REQUIRED");
-  const config = { connectionString, max: input.max ?? 10, idleTimeoutMillis: 3e4, connectionTimeoutMillis: 1e4, ...input.ssl ? { ssl: { rejectUnauthorized: false } } : {} };
-  const pool = new Pool(config);
-  return { pool, close: () => pool.end() };
-}
-var init_postgres_adapter = __esm({
-  "../database/src/postgres-adapter.ts"() {
-    "use strict";
-  }
-});
-
-// ../database/src/postgres-migrations.ts
-import { createHash as createHash6 } from "node:crypto";
-function splitSql(sql) {
-  const statements = [];
-  let start = 0;
-  let quote = null;
-  let dollarQuote = null;
-  let lineComment = false;
-  let blockComment = false;
-  for (let i = 0; i < sql.length; i += 1) {
-    const ch = sql[i];
-    const next = sql[i + 1];
-    if (dollarQuote) {
-      if (sql.startsWith(dollarQuote, i)) {
-        i += dollarQuote.length - 1;
-        dollarQuote = null;
-      }
-      continue;
-    }
-    if (lineComment) {
-      if (ch === "\n") lineComment = false;
-      continue;
-    }
-    if (blockComment) {
-      if (ch === "*" && next === "/") {
-        blockComment = false;
-        i += 1;
-      }
-      continue;
-    }
-    if (!quote && ch === "-" && next === "-") {
-      lineComment = true;
-      i += 1;
-      continue;
-    }
-    if (!quote && ch === "/" && next === "*") {
-      blockComment = true;
-      i += 1;
-      continue;
-    }
-    if (quote) {
-      if (ch === quote && sql[i - 1] !== "\\") quote = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"' || ch === "`") {
-      quote = ch;
-      continue;
-    }
-    if (ch === "$") {
-      const match = sql.slice(i).match(/^\$[A-Za-z_0-9]*\$/);
-      if (match) {
-        dollarQuote = match[0];
-        i += match[0].length - 1;
-        continue;
-      }
-    }
-    if (ch === ";") {
-      const statement = sql.slice(start, i).trim();
-      if (statement) statements.push(statement);
-      start = i + 1;
-    }
-  }
-  const tail = sql.slice(start).trim();
-  if (tail) statements.push(tail);
-  return statements;
-}
-function normalizePostgresMigrationSql(sql) {
-  if (!sql.trim()) throw new Error("POSTGRES_MIGRATION_SQL_REQUIRED");
-  if (/\bINSERT\s+OR\s+(?:REPLACE|IGNORE)\b/i.test(sql)) throw new Error("POSTGRES_MIGRATION_CONFLICT_SEMANTICS_UNSUPPORTED");
-  if (/[?]|\$\d+/.test(sql)) throw new Error("POSTGRES_MIGRATION_PARAMETERS_UNSUPPORTED");
-  if (/\bPRAGMA\b/i.test(sql)) throw new Error("POSTGRES_MIGRATION_SQLITE_PRAGMA_UNSUPPORTED");
-  const hasWorkerLeaseTriggers = /CREATE\s+TRIGGER\s+worker_jobs_assign_default_lease/i.test(sql) || /CREATE\s+TRIGGER\s+worker_jobs_clear_lease/i.test(sql);
-  if (/\bCREATE\s+TRIGGER\b/i.test(sql) && !hasWorkerLeaseTriggers) throw new Error("POSTGRES_MIGRATION_SQLITE_TRIGGER_UNSUPPORTED");
-  const normalized = sql.replace(/\bINTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/gi, "BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY");
-  if (/\bAUTOINCREMENT\b/i.test(normalized)) throw new Error("POSTGRES_MIGRATION_AUTOINCREMENT_UNSUPPORTED");
-  const withoutWorkerTriggers = normalized.replace(/CREATE\s+TRIGGER\s+worker_jobs_assign_default_lease[\s\S]*?END\s*;?/i, "").replace(/CREATE\s+TRIGGER\s+worker_jobs_clear_lease[\s\S]*?END\s*;?/i, "");
-  if (/\b(?:INSERT|UPDATE|DELETE|UPSERT)\b/i.test(withoutWorkerTriggers)) throw new Error("POSTGRES_MIGRATION_DML_UNSUPPORTED");
-  if (!hasWorkerLeaseTriggers) return withoutWorkerTriggers;
-  return `${withoutWorkerTriggers}
-CREATE OR REPLACE FUNCTION worker_jobs_assign_default_lease_fn() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-  IF NEW.state = 'RUNNING' AND NEW.lease_owner IS NULL THEN
-    NEW.lease_owner := 'worker-default';
-    NEW.lease_expires_at := CURRENT_TIMESTAMP + INTERVAL '60 seconds';
-  END IF;
-  RETURN NEW;
-END;
-$$;
-DROP TRIGGER IF EXISTS worker_jobs_assign_default_lease ON worker_jobs;
-CREATE TRIGGER worker_jobs_assign_default_lease BEFORE UPDATE OF state ON worker_jobs
-FOR EACH ROW EXECUTE FUNCTION worker_jobs_assign_default_lease_fn();
-CREATE OR REPLACE FUNCTION worker_jobs_clear_lease_fn() RETURNS trigger LANGUAGE plpgsql AS $$
-BEGIN
-  IF NEW.state <> 'RUNNING' THEN
-    NEW.lease_owner := NULL;
-    NEW.lease_expires_at := NULL;
-  END IF;
-  RETURN NEW;
-END;
-$$;
-DROP TRIGGER IF EXISTS worker_jobs_clear_lease ON worker_jobs;
-CREATE TRIGGER worker_jobs_clear_lease BEFORE UPDATE OF state ON worker_jobs
-FOR EACH ROW EXECUTE FUNCTION worker_jobs_clear_lease_fn();`;
-}
-function migrationChecksums(sql) {
-  const normalized = normalizePostgresMigrationSql(sql);
-  const canonical3 = createHash6("sha256").update(normalized.replace(/\r\n?/g, "\n")).digest("hex");
-  const legacy = createHash6("sha256").update(normalized.replace(/\r?\n/g, "\r\n")).digest("hex");
-  return { canonical: canonical3, legacy };
-}
-async function applyPostgresMigrations(client, migrations) {
-  if (!client || typeof client.query !== "function") throw new Error("POSTGRES_CLIENT_INVALID");
-  await client.query("BEGIN");
-  try {
-    await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", ["vira:schema:migrations"]);
-    await client.query(`CREATE TABLE IF NOT EXISTS vira_schema_migrations (
-      id TEXT PRIMARY KEY,
-      applied_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
-      checksum TEXT,
-      code_version TEXT
-    )`);
-    await client.query("ALTER TABLE vira_schema_migrations ADD COLUMN IF NOT EXISTS checksum TEXT");
-    await client.query("ALTER TABLE vira_schema_migrations ADD COLUMN IF NOT EXISTS code_version TEXT");
-    const applied = await client.query("SELECT id, checksum FROM vira_schema_migrations");
-    const appliedIds = new Map(applied.rows.map((row) => [row.id, row.checksum]));
-    for (const migration of migrations) {
-      if (!migration.id.trim() || !migration.sql.trim()) throw new Error("POSTGRES_MIGRATION_INVALID");
-      const { canonical: checksum, legacy: legacyChecksum } = migrationChecksums(migration.sql);
-      if (appliedIds.has(migration.id)) {
-        const previous = appliedIds.get(migration.id);
-        if (previous && previous !== checksum) {
-          if (previous !== legacyChecksum) throw new Error(`POSTGRES_MIGRATION_CHECKSUM_MISMATCH:${migration.id}`);
-          await client.query("UPDATE vira_schema_migrations SET checksum=$1, code_version=$2 WHERE id=$3", [checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null, migration.id]);
-        }
-        if (!previous) await client.query("UPDATE vira_schema_migrations SET checksum=$1, code_version=$2 WHERE id=$3", [checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null, migration.id]);
-        continue;
-      }
-      for (const statement of splitSql(normalizePostgresMigrationSql(migration.sql))) await client.query(statement);
-      await client.query("INSERT INTO vira_schema_migrations (id, checksum, code_version) VALUES ($1, $2, $3)", [migration.id, checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null]);
-    }
-    await client.query("COMMIT");
-  } catch (error) {
-    try {
-      await client.query("ROLLBACK");
-    } catch {
-    }
-    throw error;
-  }
-}
-var init_postgres_migrations = __esm({
-  "../database/src/postgres-migrations.ts"() {
-    "use strict";
-  }
-});
-
-// ../database/src/postgres-runtime.ts
-import { readFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-async function openPostgresRuntime(options = {}) {
-  const { pool, close } = createPostgresPool({ databaseUrl: options.databaseUrl, max: options.maxConnections, ssl: options.ssl });
-  const database = createPostgresDatabase({ pool, databaseUrl: options.databaseUrl });
-  try {
-    const migrations = [];
-    const migrationPaths = options.migrationPaths ?? [...defaultMigrationPaths, resolve(here, "../migrations/006_postgres_control_plane_repositories.sql")];
-    for (const path of migrationPaths) migrations.push({ id: path.split(/[\\/]/).pop().replace(/\.sql$/i, ""), sql: await readFile(path, "utf8") });
-    const client = await pool.connect();
-    try {
-      await applyPostgresMigrations(client, migrations);
-    } finally {
-      client.release();
-    }
-    return { ...database, close };
-  } catch (error) {
-    await close();
-    throw error;
-  }
-}
-var here, defaultMigrationPaths;
-var init_postgres_runtime = __esm({
-  "../database/src/postgres-runtime.ts"() {
-    "use strict";
-    init_postgres_adapter();
-    init_postgres_migrations();
-    here = dirname(fileURLToPath(import.meta.url));
-    defaultMigrationPaths = [
-      resolve(here, "../migrations/001_vnext_foundation.sql"),
-      resolve(here, "../migrations/002_session_handoff_approvals.sql"),
-      resolve(here, "../migrations/003_mfa_totp.sql"),
-      resolve(here, "../migrations/004_behavior_strategy_execution.sql"),
-      resolve(here, "../migrations/005_postgres_runtime_completeness.sql"),
-      resolve(here, "../migrations/007_postgres_native_support_repositories.sql"),
-      resolve(here, "../migrations/008_postgres_identity_session_repositories.sql"),
-      resolve(here, "../migrations/009_postgres_runtime_repair.sql"),
-      resolve(here, "../migrations/010_postgres_receipt_lineage_repair.sql"),
-      resolve(here, "../migrations/011_postgres_semantic_activation_receipts.sql"),
-      resolve(here, "../migrations/012_strategy_release_lineage.sql"),
-      resolve(here, "../migrations/013_strategy_variant_definition.sql"),
-      resolve(here, "../migrations/014_strategy_step_recovery_action.sql"),
-      resolve(here, "../migrations/015_strategy_total_recoveries.sql"),
-      resolve(here, "../migrations/016_postgres_studio_tenant_auth.sql"),
-      resolve(here, "../migrations/017_postgres_security_advisor_hardening.sql"),
-      resolve(here, "../migrations/018_postgres_foreign_key_indexes.sql"),
-      resolve(here, "../migrations/019_postgres_explicit_public_deny_policies.sql"),
-      resolve(here, "../migrations/020_semantic_registry_task_index.sql"),
-      resolve(here, "../migrations/021_unique_ai_system_names.sql")
-    ];
-  }
-});
-
-// ../database/src/production-sqlite.ts
-import { access, readFile as readFile2, writeFile } from "node:fs/promises";
-import { existsSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname2, resolve as resolve2 } from "node:path";
-import { createRequire } from "node:module";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import initSqlJs from "sql.js";
-function ensureColumn(database, table, column, definition) {
-  try {
-    database.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
-  } catch (error) {
-    const message = String(error);
-    if (!message.includes("duplicate column name")) throw error;
-  }
-}
-function reconcilePackSchema(database) {
-  database.run(`CREATE TABLE IF NOT EXISTS control_point_tasks (
-    control_point_id TEXT NOT NULL, task_id TEXT NOT NULL,
-    organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL,
-    PRIMARY KEY (control_point_id, task_id)
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS behavior_packs (
-    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
-    environment_id TEXT NOT NULL, digest TEXT NOT NULL, status TEXT NOT NULL,
-    payload_json TEXT NOT NULL, updated_at TEXT NOT NULL
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS execution_receipts (
-    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
-    environment_id TEXT NOT NULL, revision_id TEXT NOT NULL, actor_id TEXT NOT NULL,
-    idempotency_key TEXT NOT NULL, decision TEXT NOT NULL, reason TEXT NOT NULL,
-    created_at TEXT NOT NULL,
-    UNIQUE (organization_id, project_id, environment_id, idempotency_key)
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS execution_receipt_authority (
-    receipt_id TEXT PRIMARY KEY, authority_digest TEXT NOT NULL,
-    FOREIGN KEY (receipt_id) REFERENCES execution_receipts(id)
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS execution_receipt_semantic (
-    receipt_id TEXT PRIMARY KEY, semantic_task_ref TEXT NOT NULL,
-    semantic_task_version INTEGER NOT NULL, semantic_task_digest TEXT NOT NULL,
-    FOREIGN KEY (receipt_id) REFERENCES execution_receipts(id)
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS runtime_decision_plans (
-    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
-    environment_id TEXT NOT NULL, plan_json TEXT NOT NULL, decision_right_json TEXT NOT NULL,
-    provider_health TEXT NOT NULL, fallback TEXT NOT NULL, authority_digest TEXT,
-    plan_digest TEXT NOT NULL, created_at TEXT NOT NULL,
-    UNIQUE (organization_id, project_id, environment_id, id)
-  )`);
-  database.run(`CREATE TABLE IF NOT EXISTS runtime_decisions (
-    request_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
-    environment_id TEXT NOT NULL, decision_json TEXT NOT NULL, created_at TEXT NOT NULL,
-    PRIMARY KEY (organization_id, project_id, environment_id, request_id)
-  )`);
-  const columns = [
-    ["behavior_programs", "modules_json", "TEXT NOT NULL DEFAULT '[]'"],
-    ["behavior_programs", "provenance_json", "TEXT"],
-    ["behavior_programs", "temporal_contract_digest", "TEXT"],
-    ["behavior_programs", "temporal_contracts_json", "TEXT"],
-    ["behavior_programs", "recovery_plans_json", "TEXT"],
-    ["ai_system_connections", "config_json", "TEXT NOT NULL DEFAULT '{}'"]
-  ];
-  for (const [table, column, definition] of columns) ensureColumn(database, table, column, definition);
-}
-function reconcileStrategySchema(database) {
-  const columns = [
-    ["behavior_strategies", "definition_json", "TEXT"],
-    ["behavior_strategies", "definition_digest", "TEXT"],
-    ["behavior_strategies", "control_point_id", "TEXT"],
-    ["behavior_variants", "content_type", "TEXT NOT NULL DEFAULT 'legacy'"],
-    ["behavior_variants", "definition_schema_version", "INTEGER"],
-    ["behavior_variants", "revision_number", "INTEGER"],
-    ["behavior_variants", "definition_digest", "TEXT"],
-    ["behavior_variants", "program_id", "TEXT"],
-    ["behavior_variants", "program_digest", "TEXT"],
-    ["behavior_variants", "provenance_json", "TEXT"],
-    ["behavior_variants", "definition_json", "TEXT"],
-    ["behavior_variants", "immutable", "INTEGER NOT NULL DEFAULT 1"]
-  ];
-  for (const [table, column, definition] of columns) ensureColumn(database, table, column, definition);
-  database.run("CREATE UNIQUE INDEX IF NOT EXISTS behavior_variants_strategy_revision ON behavior_variants(strategy_id, revision_number) WHERE revision_number IS NOT NULL");
-  database.run(`CREATE TABLE IF NOT EXISTS strategy_executions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, trace_id TEXT NOT NULL, behavior_point_id TEXT NOT NULL, canonical_revision_id TEXT NOT NULL, program_id TEXT NOT NULL, program_digest TEXT NOT NULL, strategy_id TEXT NOT NULL, variant_id TEXT NOT NULL, strategy_digest TEXT NOT NULL, behavior_artifact_digest TEXT, strategy_artifact_digest TEXT, composition_digest TEXT, authority_digest TEXT NOT NULL, mode TEXT NOT NULL, status TEXT NOT NULL, current_step_key TEXT, state_json TEXT NOT NULL, references_json TEXT NOT NULL DEFAULT '{}', state_digest TEXT NOT NULL, step_executions INTEGER NOT NULL DEFAULT 0, model_calls INTEGER NOT NULL DEFAULT 0, tool_calls INTEGER NOT NULL DEFAULT 0, decision_calls INTEGER NOT NULL DEFAULT 0, repair_attempts INTEGER NOT NULL DEFAULT 0, cost_micros INTEGER NOT NULL DEFAULT 0, sequence INTEGER NOT NULL DEFAULT 0, idempotency_key TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, expires_at TEXT, UNIQUE(organization_id,project_id,environment_id,idempotency_key))`);
-  ensureColumn(database, "strategy_executions", "references_json", "TEXT NOT NULL DEFAULT '{}'");
-  database.run(`CREATE TABLE IF NOT EXISTS strategy_step_receipts (id TEXT PRIMARY KEY, execution_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, step_key TEXT NOT NULL, step_type TEXT NOT NULL, attempt INTEGER NOT NULL, status TEXT NOT NULL, input_state_digest TEXT NOT NULL, output_digest TEXT, verification_digest TEXT, transition_key TEXT, next_step_key TEXT, model_request_id TEXT, tool_invocation_id TEXT, decision_receipt_digest TEXT, recovery_action TEXT, usage_json TEXT NOT NULL DEFAULT '{}', latency_ms INTEGER, receipt_digest TEXT NOT NULL UNIQUE, created_at TEXT NOT NULL, FOREIGN KEY(execution_id) REFERENCES strategy_executions(id), UNIQUE(execution_id,step_key,attempt))`);
-  try {
-    database.run("ALTER TABLE strategy_step_receipts ADD COLUMN recovery_action TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run(`CREATE TABLE IF NOT EXISTS strategy_artifact_blobs (artifact_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, strategy_digest TEXT NOT NULL, bytes TEXT NOT NULL, created_at TEXT NOT NULL)`);
-}
-function persistFile(filePath, data) {
-  const maxBytes = Number(process.env.VIRA_SQLITE_MAX_BYTES ?? 5 * 1024 * 1024 * 1024);
-  if (!Number.isFinite(maxBytes) || maxBytes < 64 * 1024 * 1024) throw new Error("SQLITE_STORAGE_LIMIT_INVALID");
-  if (data.byteLength > maxBytes) throw new Error("SQLITE_STORAGE_LIMIT_EXCEEDED");
-  const directory = dirname2(filePath);
-  const prefix = `${filePath}.tmp-`;
-  const staleBefore = Date.now() - 60 * 60 * 1e3;
-  for (const name of readdirSync(directory)) {
-    const candidate = resolve2(directory, name);
-    if (!candidate.startsWith(prefix)) continue;
-    try {
-      if (statSync(candidate).mtimeMs < staleBefore) unlinkSync(candidate);
-    } catch {
-    }
-  }
-  const temporaryPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  writeFileSync(temporaryPath, Buffer.from(data));
-  renameSync(temporaryPath, filePath);
-}
-async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } = {}) {
-  if (typeof databaseUrl !== "string" || !databaseUrl.startsWith("file:")) throw new Error("DATABASE_URL_FILE_REQUIRED");
-  const filePath = fileURLToPath2(new URL(databaseUrl));
-  if (!filePath || filePath === "/") throw new Error("DATABASE_PATH_REQUIRED");
-  const migrationPath = migrationCandidates.find((candidate) => existsSync(candidate));
-  if (!migrationPath) throw new Error("DATABASE_MIGRATION_ASSET_MISSING");
-  const SQL = await initSqlJs({ locateFile: (file) => {
-    const moduleAsset = resolve2(dirname2(require2.resolve("sql.js")), file);
-    if (existsSync(moduleAsset)) return moduleAsset;
-    const dependency = resolve2(root, "../../../node_modules/sql.js/dist", file);
-    if (existsSync(dependency)) return dependency;
-    const packagedDependency = resolve2(root, "../../../sql.js/dist", file);
-    if (existsSync(packagedDependency)) return packagedDependency;
-    const packaged = resolve2(root, "sql.js", file);
-    if (existsSync(packaged)) return packaged;
-    return dependency;
-  } });
-  let database;
-  let existing = true;
-  try {
-    await access(filePath);
-    database = new SQL.Database(new Uint8Array(await readFile2(filePath)));
-  } catch {
-    existing = false;
-    database = new SQL.Database();
-  }
-  if (!existing) database.run(await readFile2(migrationPath, "utf8"));
-  reconcilePackSchema(database);
-  reconcileStrategySchema(database);
-  try {
-    database.run("ALTER TABLE session_states ADD COLUMN application_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE behavior_programs ADD COLUMN provenance_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE worker_jobs ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE worker_jobs ADD COLUMN trace_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE worker_jobs ADD COLUMN available_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE strategy_executions ADD COLUMN total_recoveries INTEGER NOT NULL DEFAULT 0");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE learning_evidence ADD COLUMN outcome TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE learning_evidence ADD COLUMN provenance_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN idempotency_key TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN arguments_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE ai_system_connections ADD COLUMN config_json TEXT NOT NULL DEFAULT '{}'");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS session_handoff_approvals (id TEXT PRIMARY KEY, source_session_id TEXT NOT NULL, target_session_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('PENDING','APPROVED','REJECTED','CONSUMED')), requested_at TEXT NOT NULL, decided_at TEXT, expires_at TEXT NOT NULL, decision_digest TEXT NOT NULL UNIQUE)");
-  database.run(`CREATE TABLE IF NOT EXISTS release_manifests (
-    id TEXT PRIMARY KEY,
-    surfaces_json TEXT NOT NULL,
-    content_digest TEXT NOT NULL,
-    approved_by TEXT NOT NULL,
-    approved_at TEXT NOT NULL,
-    status TEXT NOT NULL,
-    organization_id TEXT,
-    project_id TEXT,
-    environment_id TEXT,
-    authority_digest TEXT,
-    artifact_id TEXT,
-    promotion_version INTEGER
-  )`);
-  for (const statement of [
-    "ALTER TABLE release_manifests ADD COLUMN authority_digest TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN artifact_id TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN promotion_version INTEGER",
-    "ALTER TABLE release_manifests ADD COLUMN strategy_id TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN strategy_variant_id TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN strategy_digest TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN strategy_artifact_digest TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN program_digest TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN evaluation_digest TEXT"
-  ]) {
-    try {
-      database.run(statement);
-    } catch (error) {
-      if (!String(error).includes("duplicate column name")) throw error;
-    }
-  }
-  database.run("CREATE TABLE IF NOT EXISTS telemetry_release_markers (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, release_id TEXT NOT NULL, service TEXT NOT NULL, deployment_environment TEXT NOT NULL, revision TEXT NOT NULL, deployment_id TEXT NOT NULL, occurred_at TEXT NOT NULL, trace_id TEXT, marker_digest TEXT NOT NULL, PRIMARY KEY (organization_id,project_id,environment_id,release_id,service,deployment_id))");
-  database.run(`CREATE TABLE IF NOT EXISTS optimization_artifacts (
-    id TEXT PRIMARY KEY,
-    idempotency_key TEXT UNIQUE,
-    organization_id TEXT NOT NULL,
-    project_id TEXT NOT NULL,
-    environment_id TEXT NOT NULL,
-    canonical_digest TEXT NOT NULL,
-    policy_digest TEXT NOT NULL,
-    target_model TEXT NOT NULL,
-    dataset_digest TEXT NOT NULL,
-    metric TEXT NOT NULL,
-    baseline REAL NOT NULL,
-    optimized_result REAL NOT NULL,
-    provenance TEXT NOT NULL,
-    status TEXT NOT NULL,
-    payload_json TEXT NOT NULL DEFAULT '{}'
-  )`);
-  for (const [column, definition] of [["stable_key", "TEXT"], ["parent_authority_level", "TEXT"], ["child_scope_kind", "TEXT"], ["child_scope_digest", "TEXT"], ["parent_revision_digest", "TEXT"], ["exception_effect_types_json", "TEXT"], ["when_json", "TEXT"]]) {
-    try {
-      database.run(`ALTER TABLE scope_delegations ADD COLUMN ${column} ${definition}`);
-    } catch (error) {
-      if (!String(error).includes("duplicate column name")) throw error;
-    }
-  }
-  database.run("CREATE TABLE IF NOT EXISTS evaluation_artifacts (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, target_artifact TEXT NOT NULL, dataset_digest TEXT NOT NULL, evaluator_version TEXT NOT NULL, score REAL NOT NULL, threshold REAL NOT NULL, status TEXT NOT NULL, failed_assertions_json TEXT NOT NULL, created_at TEXT NOT NULL)");
-  try {
-    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN holdout_commitment_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN grader_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_version TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE artifact_shadow_evidence ADD COLUMN release_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE artifact_shadow_evidence ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS gtm_funnel_events (event_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, event_digest TEXT NOT NULL, source TEXT NOT NULL, stage TEXT NOT NULL, journey_key TEXT NOT NULL, occurred_at TEXT NOT NULL, event_json TEXT NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, event_id))");
-  database.run("CREATE INDEX IF NOT EXISTS gtm_funnel_events_window ON gtm_funnel_events (organization_id, project_id, environment_id, occurred_at)");
-  for (const column of ["organization_id", "project_id", "environment_id"]) {
-    try {
-      database.run(`ALTER TABLE release_manifests ADD COLUMN ${column} TEXT`);
-    } catch (error) {
-      if (!String(error).includes("duplicate column name")) throw error;
-    }
-  }
-  try {
-    database.run("ALTER TABLE release_manifests ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE accelerator_residency_leases ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE trace_events ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  for (const column of ["authority_digest", "evidence_json"]) {
-    try {
-      database.run(`ALTER TABLE decision_evidence ADD COLUMN ${column} TEXT`);
-    } catch (error) {
-      if (!String(error).includes("duplicate column name")) throw error;
-    }
-  }
-  try {
-    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE activation_decisions ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE impact_attributions ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE decision_calibration_snapshots ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE optimization_artifacts ADD COLUMN idempotency_key TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE optimization_artifacts ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN selection_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN expansion_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN provider_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN provider_request_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN provider_usage_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE teach_runs ADD COLUMN semantic_stages_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS scope_bindings (id TEXT PRIMARY KEY, level TEXT NOT NULL, parent_id TEXT, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, workspace_id TEXT, user_id TEXT, session_id TEXT, created_at TEXT NOT NULL)");
-  database.run("CREATE TABLE IF NOT EXISTS organization_intelligence_snapshots (snapshot_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, as_of TEXT NOT NULL, evidence_digest TEXT NOT NULL, payload_json TEXT NOT NULL, created_at TEXT NOT NULL)");
-  database.run("CREATE TABLE IF NOT EXISTS mcp_sessions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, endpoint TEXT NOT NULL, protocol_version TEXT NOT NULL, status TEXT NOT NULL, auth_digest TEXT NOT NULL, generation INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, session_digest TEXT NOT NULL UNIQUE)");
-  database.run("CREATE TABLE IF NOT EXISTS oauth_states (state TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, provider TEXT NOT NULL, redirect_uri TEXT NOT NULL, scopes_json TEXT NOT NULL, expires_at TEXT NOT NULL, consumed_at TEXT)");
-  database.run("CREATE TABLE IF NOT EXISTS optimization_runs (id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, canonical_digest TEXT NOT NULL, policy_digest TEXT NOT NULL, dataset_digest TEXT NOT NULL, engine TEXT NOT NULL, status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, cancel_requested INTEGER NOT NULL DEFAULT 0, lease_owner TEXT, lease_expires_at TEXT, search_result_digest TEXT, error_code TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, authority_digest TEXT)");
-  try {
-    database.run("ALTER TABLE optimization_runs ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS optimization_run_attempts (id TEXT PRIMARY KEY, run_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, attempt INTEGER NOT NULL, worker_id TEXT NOT NULL, status TEXT NOT NULL, request_digest TEXT, response_digest TEXT, error_code TEXT, claimed_at TEXT NOT NULL, finished_at TEXT, authority_digest TEXT)");
-  try {
-    database.run("ALTER TABLE optimization_run_attempts ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS optimization_cost_reservations (run_id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, reserved_micros INTEGER NOT NULL, actual_micros INTEGER, state TEXT NOT NULL, created_at TEXT NOT NULL, settled_at TEXT, authority_digest TEXT)");
-  try {
-    database.run("ALTER TABLE optimization_cost_reservations ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS recovery_runtime_states (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, trajectory_key TEXT NOT NULL, recovery_plan_key TEXT NOT NULL, recovery_plan_digest TEXT NOT NULL, attempt INTEGER NOT NULL, next_step_index INTEGER NOT NULL, total_execution_attempts INTEGER NOT NULL, status TEXT NOT NULL, started_at TEXT NOT NULL, updated_at TEXT NOT NULL, step_results_json TEXT NOT NULL, pending_approval_json TEXT, authority_digest TEXT, state_digest TEXT NOT NULL UNIQUE)");
-  try {
-    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN pending_approval_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS recovery_runtime_receipts (id TEXT PRIMARY KEY, runtime_state_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, status TEXT NOT NULL, attempt INTEGER NOT NULL, step_results_json TEXT NOT NULL, recovery_plan_digest TEXT NOT NULL, authority_digest TEXT, completed_at TEXT NOT NULL, receipt_digest TEXT NOT NULL UNIQUE)");
-  database.run("CREATE TABLE IF NOT EXISTS behavior_artifact_blobs (artifact_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, bytes TEXT NOT NULL)");
-  try {
-    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN application_id TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  try {
-    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN authority_digest TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  database.run("CREATE TABLE IF NOT EXISTS conflict_resolutions (inspection_digest TEXT PRIMARY KEY, resolution_digest TEXT NOT NULL, payload_json TEXT NOT NULL)");
-  try {
-    database.run("ALTER TABLE conflict_inspections ADD COLUMN payload_json TEXT");
-  } catch (error) {
-    if (!String(error).includes("duplicate column name")) throw error;
-  }
-  const persist = async () => {
-    persistFile(filePath, database.export());
-  };
-  let transactionDepth = 0;
-  const runtime = {
-    mode: "production",
-    exec: (sql, params) => {
-      const result = database.exec(sql, params);
-      if (transactionDepth === 0 && /^\s*(INSERT|UPDATE|DELETE|REPLACE)\b/i.test(sql)) persistFile(filePath, database.export());
-      return result;
-    },
-    run: (sql, params) => {
-      const result = database.run(sql, params);
-      if (transactionDepth === 0) persistFile(filePath, database.export());
-      return result;
-    },
-    async transaction(work) {
-      if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
-      transactionDepth += 1;
-      database.run("BEGIN");
-      try {
-        const result = await work(runtime);
-        database.run("COMMIT");
-        transactionDepth -= 1;
-        await persist();
-        return result;
-      } catch (error) {
-        try {
-          database.run("ROLLBACK");
-        } catch {
-        }
-        transactionDepth = Math.max(0, transactionDepth - 1);
-        throw error;
-      }
-    },
-    transactionSync(work) {
-      if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
-      transactionDepth += 1;
-      database.run("BEGIN");
-      try {
-        const result = work(runtime);
-        database.run("COMMIT");
-        transactionDepth -= 1;
-        persistFile(filePath, database.export());
-        return result;
-      } catch (error) {
-        try {
-          database.run("ROLLBACK");
-        } catch {
-        }
-        transactionDepth = Math.max(0, transactionDepth - 1);
-        throw error;
-      }
-    },
-    async persist() {
-      await persist();
-    },
-    async reloadFromDisk() {
-      const bytes = new Uint8Array(await readFile2(filePath));
-      database.close();
-      database = new SQL.Database(bytes);
-    },
-    async backup(destination) {
-      if (!destination?.trim()) throw new Error("BACKUP_PATH_REQUIRED");
-      await writeFile(destination, Buffer.from(database.export()));
-      return destination;
-    },
-    health: () => ({ ready: true, mode: "production", storage: "file" }),
-    close: () => database.close()
-  };
-  return runtime;
-}
-var root, require2, migrationCandidates;
-var init_production_sqlite = __esm({
-  "../database/src/production-sqlite.ts"() {
-    "use strict";
-    root = dirname2(fileURLToPath2(import.meta.url));
-    require2 = createRequire(import.meta.url);
-    migrationCandidates = [
-      resolve2(root, "../migrations/001_vnext_foundation.sql"),
-      resolve2(root, "migrations/001_vnext_foundation.sql")
-    ];
-  }
-});
-
-// ../database/src/runtime-database.ts
-var runtime_database_exports = {};
-__export(runtime_database_exports, {
-  createProductionDatabase: () => createProductionDatabase,
-  openRuntimeDatabase: () => openRuntimeDatabase
-});
-async function createProductionDatabase(options = {}) {
-  const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
-  if (typeof databaseUrl !== "string" || !/^postgres(?:ql)?:\/\//.test(databaseUrl)) throw new Error("PRODUCTION_POSTGRES_DATABASE_REQUIRED");
-  return openRuntimeDatabase({ ...options, databaseUrl });
-}
-async function openRuntimeDatabase(options = {}) {
-  const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
-  if (typeof databaseUrl !== "string" || !databaseUrl.trim()) throw new Error("DATABASE_URL_REQUIRED");
-  if (databaseUrl.startsWith("file:")) {
-    if (process.env.NODE_ENV === "production" || process.env.VIRA_STACK_PROFILE === "production") throw new Error("SQLITE_FORBIDDEN_IN_PRODUCTION");
-    const database = await openProductionSqlite({ databaseUrl, ...options.sqlite });
-    return {
-      mode: "sqlite",
-      database,
-      health: () => ({ ready: true, mode: "sqlite" }),
-      close: async () => {
-        database.close();
-      }
-    };
-  }
-  if (databaseUrl.startsWith("postgres://") || databaseUrl.startsWith("postgresql://")) {
-    const database = await openPostgresRuntime({ databaseUrl, ...options.postgres });
-    return {
-      mode: "postgres",
-      database,
-      health: () => ({ ready: true, mode: "postgres" }),
-      close: async () => {
-        await database.close();
-      }
-    };
-  }
-  throw new Error("DATABASE_URL_UNSUPPORTED");
-}
-var init_runtime_database = __esm({
-  "../database/src/runtime-database.ts"() {
-    "use strict";
-    init_postgres_runtime();
-    init_production_sqlite();
-  }
-});
-
-// ../database/src/postgres-mcp-repository.ts
-var postgres_mcp_repository_exports = {};
-__export(postgres_mcp_repository_exports, {
-  PostgresMcpProvenanceRepository: () => PostgresMcpProvenanceRepository,
-  PostgresMcpSessionRepository: () => PostgresMcpSessionRepository
-});
-var provenanceSelect, PostgresMcpProvenanceRepository, PostgresMcpSessionRepository;
-var init_postgres_mcp_repository = __esm({
-  "../database/src/postgres-mcp-repository.ts"() {
-    "use strict";
-    init_mcp_provenance();
-    init_mcp_session();
-    provenanceSelect = `SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance`;
-    PostgresMcpProvenanceRepository = class {
-      constructor(db) {
-        this.db = db;
-      }
-      db;
-      async init() {
-        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_invocation_claims (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, invocation_id TEXT NOT NULL, claimed_at TIMESTAMPTZ NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, idempotency_key))`);
-        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_invocation_provenance (invocation_id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, tool TEXT NOT NULL, receipt_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, arguments_digest TEXT NOT NULL, ok BOOLEAN NOT NULL, result_json JSONB, error TEXT, authority_decision_digest TEXT NOT NULL, authority_digest TEXT, provenance_digest TEXT NOT NULL, UNIQUE (organization_id, project_id, environment_id, idempotency_key))`);
-      }
-      async claim(input) {
-        const replay = await this.getByIdempotencyKey(input.idempotencyKey, input);
-        if (replay) return { status: "REPLAY", result: replay };
-        try {
-          await this.db.query(`INSERT INTO mcp_invocation_claims (organization_id,project_id,environment_id,idempotency_key,invocation_id,claimed_at) VALUES ($1,$2,$3,$4,$5,NOW())`, [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey, input.invocationId]);
-          return { status: "CLAIMED" };
-        } catch {
-          const after = await this.getByIdempotencyKey(input.idempotencyKey, input);
-          return after ? { status: "REPLAY", result: after } : { status: "IN_FLIGHT" };
-        }
-      }
-      async releaseClaim(input) {
-        await this.db.query(`DELETE FROM mcp_invocation_claims WHERE organization_id=$1 AND project_id=$2 AND environment_id=$3 AND idempotency_key=$4`, [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey]);
-      }
-      async save(result) {
-        verifyMcpResult2(result);
-        const existing = await this.get(result.invocationId);
-        const byKey = await this.getByIdempotencyKey(result.idempotencyKey, result);
-        if (existing || byKey) {
-          const prior = existing ?? byKey;
-          if (prior.provenanceDigest !== result.provenanceDigest) throw new Error("MCP_PROVENANCE_CONFLICT");
-          return prior;
-        }
-        await this.db.query(`DELETE FROM mcp_invocation_claims WHERE organization_id=$1 AND project_id=$2 AND environment_id=$3 AND idempotency_key=$4`, [result.organizationId, result.projectId, result.environmentId, result.idempotencyKey]);
-        await this.db.query(`INSERT INTO mcp_invocation_provenance (invocation_id,organization_id,project_id,environment_id,server,tool,receipt_id,idempotency_key,arguments_digest,ok,result_json,error,authority_decision_digest,authority_digest,provenance_digest) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`, [result.invocationId, result.organizationId, result.projectId, result.environmentId, result.server, result.tool, result.receiptId, result.idempotencyKey, result.argumentsDigest, result.ok, result.result === void 0 ? null : JSON.stringify(result.result), result.error ?? null, result.authorityDecisionDigest, result.authorityDigest, result.provenanceDigest]);
-        const persisted = await this.get(result.invocationId);
-        if (!persisted || persisted.provenanceDigest !== result.provenanceDigest) throw new Error("MCP_PROVENANCE_READBACK_MISMATCH");
-        return persisted;
-      }
-      async get(invocationId) {
-        const row = (await this.db.query(`${provenanceSelect} WHERE invocation_id=$1`, [invocationId])).rows[0];
-        return row ? this.fromRow(row) : null;
-      }
-      async getByIdempotencyKey(key, scope) {
-        const row = (await this.db.query(`${provenanceSelect} WHERE idempotency_key=$1 AND organization_id=$2 AND project_id=$3 AND environment_id=$4`, [key, scope.organizationId, scope.projectId, scope.environmentId])).rows[0];
-        return row ? this.fromRow(row) : null;
-      }
-      fromRow(row) {
-        const result = { invocationId: String(row.invocation_id), organizationId: String(row.organization_id), projectId: String(row.project_id), environmentId: String(row.environment_id), server: String(row.server), tool: String(row.tool), receiptId: String(row.receipt_id), idempotencyKey: String(row.idempotency_key), argumentsDigest: String(row.arguments_digest), ok: Boolean(row.ok), result: row.result_json ?? void 0, error: row.error == null ? void 0 : String(row.error), authorityDecisionDigest: String(row.authority_decision_digest), authorityDigest: row.authority_digest == null ? null : String(row.authority_digest), provenanceDigest: String(row.provenance_digest) };
-        verifyMcpResult2(result);
-        return result;
-      }
-    };
-    PostgresMcpSessionRepository = class {
-      constructor(db) {
-        this.db = db;
-      }
-      db;
-      async init() {
-        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_sessions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, endpoint TEXT NOT NULL, protocol_version TEXT NOT NULL, status TEXT NOT NULL, auth_digest TEXT NOT NULL, generation INTEGER NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, session_digest TEXT NOT NULL)`);
-      }
-      async get(id, scope) {
-        const row = (await this.db.query(`SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=$1 AND organization_id=$2 AND project_id=$3 AND environment_id=$4`, [id, scope.organizationId, scope.projectId, scope.environmentId])).rows[0];
-        if (!row) return null;
-        const session = { id: String(row.id), organizationId: String(row.organization_id), projectId: String(row.project_id), environmentId: String(row.environment_id), server: String(row.server), endpoint: String(row.endpoint), protocolVersion: String(row.protocol_version), status: String(row.status), authDigest: String(row.auth_digest), generation: Number(row.generation), createdAt: new Date(String(row.created_at)).toISOString(), updatedAt: new Date(String(row.updated_at)).toISOString(), sessionDigest: String(row.session_digest) };
-        assertMcpSession(session);
-        return session;
-      }
-    };
-  }
-});
-
-// ../../apps/mcp-server/start.ts
-var start_exports = {};
-__export(start_exports, {
-  startMcpStdio: () => startMcpStdio
-});
-async function startMcpStdio() {
-  const base = resolveViraMcpConfig();
-  const required = ["VIRA_ORGANIZATION_ID", "VIRA_PROJECT_ID", "VIRA_ENVIRONMENT_ID"];
-  const missing = required.filter((name) => !process.env[name]?.trim());
-  if (missing.length) throw new Error(`VIRA_MCP_SCOPE_REQUIRED:${missing.join(",")}`);
-  const organizationId = process.env.VIRA_ORGANIZATION_ID;
-  const projectId = process.env.VIRA_PROJECT_ID;
-  const environmentId = process.env.VIRA_ENVIRONMENT_ID;
-  const runtime = process.env.DATABASE_URL ? await (await Promise.resolve().then(() => (init_runtime_database(), runtime_database_exports))).openRuntimeDatabase() : null;
-  const database = runtime?.mode === "sqlite" ? runtime.database : null;
-  const postgres = runtime?.mode === "postgres" ? runtime.database : null;
-  const postgresRepositories = postgres ? await Promise.resolve().then(() => (init_postgres_mcp_repository(), postgres_mcp_repository_exports)) : null;
-  const provenanceRepository = database ? new SqlMcpProvenanceRepository(database) : postgres && postgresRepositories ? new postgresRepositories.PostgresMcpProvenanceRepository(postgres) : new McpProvenanceRepository();
-  if (postgres && postgresRepositories) {
-    await new postgresRepositories.PostgresMcpProvenanceRepository(postgres).init();
-  }
-  const options = createViraMcpOptions({
-    ...base,
-    scope: {
-      organizationId,
-      projectId,
-      environmentId
-    },
-    ...database || postgres ? {
-      provenanceRepository,
-      sessionRepository: database ? new SqlMcpSessionRepository(database) : new postgresRepositories.PostgresMcpSessionRepository(postgres),
-      sessionId: process.env.VIRA_MCP_SESSION_ID
-    } : {}
-  });
-  options.invocationExecutor = ({ invocation, authority, signal }) => executeMcpInvocation({ invocation, authority, signal, transport: options.transport, store: provenanceRepository });
-  options.requireInvocationExecutor = true;
-  const useLegacy = process.env.VIRA_MCP_PROTOCOL_MODE === "legacy";
-  const stdio = useLegacy ? createMcpStdioServer(options) : serveOfficialViraMcp(options);
-  const close = () => {
-    stdio.close();
-    void runtime?.close();
-  };
-  process.once("SIGTERM", close);
-  process.once("SIGINT", close);
-}
-var init_start = __esm({
-  "../../apps/mcp-server/start.ts"() {
-    "use strict";
-    init_server();
-    init_vira_server();
-    init_mcp_session_repository();
-    init_mcp_provenance_repository();
-    init_mcp_provenance_repository();
-    init_mcp_invocation_service();
-    init_official_stdio();
-  }
-});
-
-// src/cli.ts
-init_vira_server();
-if (process.argv.includes("--http") || process.env.VIRA_MCP_TRANSPORT === "http") {
-  await startHttp();
-} else {
-  const { startMcpStdio: startMcpStdio2 } = await Promise.resolve().then(() => (init_start(), start_exports));
-  await startMcpStdio2();
-}
-async function startHttp() {
-  const base = resolveViraMcpConfig();
-  if (!base.requestAuthToken?.trim()) throw new Error("VIRA_MCP_AUTH_TOKEN_REQUIRED");
-  const scope = { organizationId: process.env.VIRA_ORGANIZATION_ID ?? "", projectId: process.env.VIRA_PROJECT_ID ?? "", environmentId: process.env.VIRA_ENVIRONMENT_ID ?? "" };
-  for (const value of Object.values(scope)) if (!value.trim()) throw new Error("VIRA_MCP_SCOPE_REQUIRED");
-  const allowLocalEffects = process.env.VIRA_MCP_ALLOW_EFFECTFUL === "true" && process.env.NODE_ENV !== "production";
-  const server = createViraMcpServer({ ...base, scope, ...allowLocalEffects ? { authorizeEffectful: () => ({ allowed: true, decisionDigest: "explicit-local-opt-in" }) } : {} });
-  const port = Number(process.env.PORT ?? 4195);
-  const host = process.env.VIRA_MCP_BIND_PUBLIC === "true" ? process.env.HOST ?? "0.0.0.0" : process.env.HOST ?? "127.0.0.1";
-  server.listen(port, host, () => console.error(JSON.stringify({ status: "VIRA_MCP_STARTED", port, host, upstream: base.baseUrl, effectful: allowLocalEffects })));
-}
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../domain/src/scope-composer.ts
+import { createHash } from "node:crypto";
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+}
+function assertComposedScopeIntegrity(composed) {
+  const conflictSetDigest = digest(composed.conflicts);
+  if (conflictSetDigest !== composed.conflictSetDigest) throw new Error("SCOPE_CONFLICT_DIGEST_MISMATCH");
+  const compositionDigest = digest({ chain: composed.chain, permissions: composed.permissions, delegationIds: [...composed.delegationIds ?? []].sort(), conflictSetDigest, effectiveRevision: composed.effectiveRevision ?? null, sourceRevisionSetDigest: composed.sourceRevisionSetDigest ?? null, ancestorHardAuthorityDigest: composed.ancestorHardAuthorityDigest ?? null, effectiveProgramDigest: composed.effectiveProgramDigest ?? null });
+  if (compositionDigest !== composed.compositionDigest) throw new Error("SCOPE_COMPOSITION_DIGEST_MISMATCH");
+  return true;
+}
+var digest;
+var init_scope_composer = __esm({
+  "../domain/src/scope-composer.ts"() {
+    "use strict";
+    digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
+  }
+});
+
+// ../runtime/src/mcp-gateway.ts
+import { createHash as createHash2 } from "node:crypto";
+function canonicalMcpJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalMcpJson).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalMcpJson(value[key])}`).join(",")}}`;
+}
+function verifyMcpResult(result) {
+  const { provenanceDigest, ...body } = result;
+  const expected = createHash2("sha256").update(canonicalMcpJson(body)).digest("hex");
+  if (provenanceDigest !== expected) throw new Error("MCP_PROVENANCE_DIGEST_INVALID");
+  return true;
+}
+function createMcpCancellationRegistry() {
+  const controllers = /* @__PURE__ */ new Map();
+  return { register(requestId) {
+    if (!requestId.trim()) throw new Error("MCP_REQUEST_ID_REQUIRED");
+    const previous = controllers.get(requestId);
+    previous?.abort();
+    const controller = new AbortController();
+    controllers.set(requestId, controller);
+    return controller.signal;
+  }, cancel(requestId) {
+    const controller = controllers.get(requestId);
+    if (!controller) return false;
+    controller.abort();
+    return true;
+  }, unregister(requestId, signal) {
+    const controller = controllers.get(requestId);
+    if (controller && (!signal || controller.signal === signal)) controllers.delete(requestId);
+  } };
+}
+function combineMcpAbortSignals(...signals) {
+  const active = signals.filter((signal) => Boolean(signal));
+  if (active.length === 0) return void 0;
+  if (active.length === 1) return active[0];
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  for (const signal of active) {
+    if (signal.aborted) {
+      controller.abort();
+      break;
+    }
+    signal.addEventListener("abort", abort, { once: true });
+  }
+  return controller.signal;
+}
+async function handleMcpJsonRpc(input) {
+  const { request, server, tools: tools2, transport } = input;
+  if (request.jsonrpc !== "2.0" || !request.method) throw new Error("MCP_JSONRPC_INVALID");
+  if (request.method === "initialize") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { protocolVersion: "2025-03-26", serverInfo: { name: server, version: "1" }, capabilities: { tools: {}, resources: input.resources ? {} : void 0, prompts: input.prompts ? {} : void 0 } } };
+  if (request.method === "notifications/initialized") return null;
+  if (request.method === "notifications/cancelled") {
+    const requestId2 = String(request.params?.requestId ?? "");
+    input.cancellationRegistry?.cancel(requestId2);
+    return null;
+  }
+  if (request.method === "tools/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { tools: tools2 } };
+  if (request.method === "resources/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { resources: input.resources ?? [] } };
+  if (request.method === "prompts/list") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { prompts: input.prompts ?? [] } };
+  if (request.method === "resources/read") {
+    const value = input.readResource ? await input.readResource(String(request.params?.uri ?? "")) : null;
+    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "RESOURCE_NOT_FOUND" } };
+  }
+  if (request.method === "prompts/get") {
+    const value = input.getPrompt ? await input.getPrompt(String(request.params?.name ?? ""), request.params?.arguments ?? {}) : null;
+    return request.id === void 0 ? null : value ? { jsonrpc: "2.0", id: request.id, result: value } : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "PROMPT_NOT_FOUND" } };
+  }
+  if (request.method !== "tools/call") return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32601, message: "METHOD_NOT_FOUND" } };
+  const tool = String(request.params?.name ?? "");
+  const definition = tools2.find((item) => item.name === tool);
+  if (!definition) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32602, message: "TOOL_NOT_FOUND" } };
+  const invocation = { ...input.invocation, server, tool, arguments: request.params?.arguments ?? {} };
+  const authority = definition.effectful ? input.authorize ? await input.authorize({ invocation, definition }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
+  if (!authority.allowed) return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, error: { code: -32003, message: authority.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority.decisionDigest } } };
+  const requestId = String(request.id ?? "");
+  const requestSignal = input.cancellationRegistry && requestId ? input.cancellationRegistry.register(requestId) : void 0;
+  try {
+    const result = await invokeMcpTool({ invocation, transport, authority, signal: combineMcpAbortSignals(input.signal, requestSignal) });
+    return request.id === void 0 ? null : { jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } };
+  } finally {
+    if (requestSignal) input.cancellationRegistry?.unregister(requestId, requestSignal);
+  }
+}
+async function invokeMcpTool(input) {
+  const { invocation, transport } = input;
+  if (!invocation.id || !invocation.server || !invocation.tool || !invocation.receiptId || !invocation.idempotencyKey) throw new Error("MCP_INVOCATION_FIELDS_REQUIRED");
+  if (invocation.authorityDigest !== void 0 && !/^[a-f0-9]{64}$/.test(invocation.authorityDigest)) throw new Error("MCP_AUTHORITY_DIGEST_INVALID");
+  if (invocation.composedScope) {
+    assertComposedScopeIntegrity(invocation.composedScope);
+    if (invocation.authorityDigest !== void 0 && invocation.authorityDigest !== invocation.composedScope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
+    if (!invocation.composedScope.serveable) throw new Error("MCP_SCOPE_COMPOSITION_CONFLICT");
+  }
+  if (input.authority && !input.authority.allowed) throw new Error("MCP_AUTHORITY_DENIED");
+  if (!transport || typeof transport.call !== "function") throw new Error("MCP_TRANSPORT_REQUIRED");
+  let response;
+  try {
+    response = await transport.call({ server: invocation.server, tool: invocation.tool, arguments: structuredClone(invocation.arguments), signal: input.signal });
+  } catch {
+    if (input.signal?.aborted) throw new Error("MCP_INVOCATION_CANCELLED");
+    response = { error: "MCP_TRANSPORT_ERROR" };
+  }
+  const argumentsDigest = createHash2("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
+  const body = { invocationId: invocation.id, organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId, server: invocation.server, tool: invocation.tool, receiptId: invocation.receiptId, idempotencyKey: invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: invocation.authorityDigest ?? null, ok: !response.error, result: response.result, error: response.error };
+  return Object.freeze({ ...body, provenanceDigest: createHash2("sha256").update(canonicalMcpJson(body)).digest("hex") });
+}
+var init_mcp_gateway = __esm({
+  "../runtime/src/mcp-gateway.ts"() {
+    "use strict";
+    init_scope_composer();
+  }
+});
+
+// ../runtime/src/mcp-provenance.ts
+import { createHash as createHash3 } from "node:crypto";
+function verifyMcpResult2(result) {
+  const { provenanceDigest: stored, ...body } = result;
+  const expected = createHash3("sha256").update(canonicalMcpJson(body)).digest("hex");
+  if (stored !== expected) throw new Error("MCP_PROVENANCE_DIGEST_MISMATCH");
+  return true;
+}
+function createMcpResultFromResponse(input) {
+  const argumentsDigest = createHash3("sha256").update(canonicalMcpJson(input.invocation.arguments)).digest("hex");
+  const body = { invocationId: input.invocation.id, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId, server: input.invocation.server, tool: input.invocation.tool, receiptId: input.invocation.receiptId, idempotencyKey: input.invocation.idempotencyKey, argumentsDigest, authorityDecisionDigest: input.authority?.decisionDigest ?? "not-required", authorityDigest: input.invocation.authorityDigest ?? null, ok: !input.response.error, result: input.response.result, error: input.response.error };
+  return Object.freeze({ ...body, provenanceDigest: createHash3("sha256").update(canonicalMcpJson(body)).digest("hex") });
+}
+var init_mcp_provenance = __esm({
+  "../runtime/src/mcp-provenance.ts"() {
+    "use strict";
+    init_mcp_gateway();
+  }
+});
+
+// ../runtime/src/mcp-session.ts
+import { createHash as createHash4, randomUUID } from "node:crypto";
+function assertMcpSession(session) {
+  const { sessionDigest, ...base } = session;
+  if (sessionDigest !== digest2(base)) throw new Error("MCP_SESSION_DIGEST_MISMATCH");
+  return true;
+}
+function assertMcpSessionActive(session) {
+  assertMcpSession(session);
+  if (session.status !== "ACTIVE") throw new Error(`MCP_SESSION_NOT_ACTIVE:${session.status}`);
+  return true;
+}
+var canonical2, digest2;
+var init_mcp_session = __esm({
+  "../runtime/src/mcp-session.ts"() {
+    "use strict";
+    canonical2 = (value) => value === null || typeof value !== "object" ? JSON.stringify(value) : Array.isArray(value) ? `[${value.map(canonical2).join(",")}]` : `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical2(value[key])}`).join(",")}}`;
+    digest2 = (value) => createHash4("sha256").update(canonical2(value)).digest("hex");
+  }
+});
+
+// ../../apps/mcp-server/server.ts
+import {
+  createServer
+} from "node:http";
+import { createInterface } from "node:readline";
+async function assertConfiguredSession(options, sessionId, scope) {
+  if (!options.sessionRepository) return;
+  if (!sessionId?.trim()) throw new Error("MCP_SESSION_REQUIRED");
+  const session = await options.sessionRepository.get(sessionId, scope);
+  if (!session) throw new Error("MCP_SESSION_NOT_FOUND");
+  assertMcpSessionActive(session);
+}
+async function persistVerifiedMcpResult(repository, result) {
+  const persisted = await repository.save(result);
+  if (persisted && typeof persisted === "object") verifyMcpResult(persisted);
+}
+function createMcpServer(options) {
+  if (options.requireInvocationExecutor && !options.invocationExecutor)
+    throw new Error("MCP_INVOCATION_EXECUTOR_REQUIRED");
+  const maxBodyBytes = options.maxBodyBytes ?? 128 * 1024;
+  const cancellationRegistry = options.cancellationRegistry ?? createMcpCancellationRegistry();
+  return createServer(async (request, response) => {
+    if (request.method !== "POST")
+      return send(response, 405, { error: { code: "METHOD_NOT_ALLOWED" } });
+    if (options.requestAuthToken) {
+      const authorization = request.headers.authorization ?? "";
+      const token = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
+      if (token !== options.requestAuthToken)
+        return send(response, 401, { error: { code: "MCP_AUTHENTICATION_REQUIRED" } });
+    }
+    const requestController = new AbortController();
+    const onAborted = () => requestController.abort();
+    request.once("aborted", onAborted);
+    try {
+      const body = JSON.parse(await readBody(request, maxBodyBytes));
+      const token = requestToken(body.id);
+      const requestInvocation = {
+        ...options.invocation,
+        id: `${options.invocation.id}:${token}`,
+        receiptId: `${options.invocation.receiptId}:${token}`,
+        idempotencyKey: `${options.invocation.idempotencyKey}:${token}`
+      };
+      const scope = {
+        organizationId: requestInvocation.organizationId,
+        projectId: requestInvocation.projectId,
+        environmentId: requestInvocation.environmentId
+      };
+      const sessionId = request.headers[(options.sessionHeader ?? "x-mcp-session-id").toLowerCase()];
+      await assertConfiguredSession(options, typeof sessionId === "string" ? sessionId : void 0, scope);
+      if (options.invocationExecutor && body.method === "tools/call") {
+        const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
+        if (definition) {
+          const invocation = { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} };
+          const authority2 = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
+          if (authority2.allowed) {
+            const result2 = await options.invocationExecutor({ invocation, authority: authority2, signal: requestController.signal });
+            if (!requestController.signal.aborted) send(response, 200, { jsonrpc: "2.0", id: body.id, result: { content: [{ type: "text", text: JSON.stringify(result2.result ?? result2.error ?? null) }], isError: !result2.ok, provenanceDigest: result2.provenanceDigest } });
+            return;
+          }
+          if (!requestController.signal.aborted) send(response, 403, { jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
+          return;
+        }
+      }
+      if (options.provenanceRepository && body.method === "tools/call") {
+        const replay = await claimInvocation(
+          options.provenanceRepository,
+          requestInvocation,
+          scope
+        );
+        if (replay) {
+          const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
+          if (definition?.effectful) {
+            const authority2 = await options.authorize?.({ invocation: { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} }, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" };
+            if (!authority2.allowed) {
+              if (!requestController.signal.aborted) send(response, 403, { jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
+              return;
+            }
+          }
+          if (!requestController.signal.aborted)
+            send(response, 200, {
+              jsonrpc: "2.0",
+              id: body.id,
+              result: {
+                content: [
+                  {
+                    type: "text",
+                    text: JSON.stringify(replay.result ?? replay.error ?? null)
+                  }
+                ],
+                isError: !replay.ok,
+                provenanceDigest: replay.provenanceDigest
+              }
+            });
+          return;
+        }
+      }
+      let upstreamResponse;
+      let authority;
+      const requestCancelled = new Promise(
+        (resolve3) => request.once(
+          "aborted",
+          () => resolve3({ error: "MCP_REQUEST_CANCELLED" })
+        )
+      );
+      const transport = {
+        call: async (input) => {
+          upstreamResponse = await Promise.race([
+            options.transport.call({
+              ...input,
+              signal: input.signal ?? requestController.signal
+            }),
+            requestCancelled
+          ]);
+          return upstreamResponse;
+        }
+      };
+      const result = await handleMcpJsonRpc({
+        request: body,
+        server: options.serverName,
+        tools: options.tools,
+        resources: options.resources,
+        prompts: options.prompts,
+        readResource: options.readResource,
+        getPrompt: options.getPrompt,
+        invocation: requestInvocation,
+        transport,
+        cancellationRegistry,
+        authorize: async (input) => {
+          authority = await options.authorize?.(input) ?? (input.definition.effectful ? {
+            allowed: false,
+            decisionDigest: "",
+            reason: "MCP_AUTHORITY_REQUIRED"
+          } : { allowed: true, decisionDigest: "read-only" });
+          return authority;
+        }
+      });
+      if (options.provenanceRepository && body.method === "tools/call") {
+        const tool = String(body.params?.name ?? "");
+        await persistVerifiedMcpResult(
+          options.provenanceRepository,
+          createMcpResultFromResponse({
+            invocation: {
+              ...requestInvocation,
+              server: options.serverName,
+              tool,
+              arguments: body.params?.arguments ?? {}
+            },
+            response: upstreamResponse ?? {
+              error: authority?.reason ?? "MCP_AUTHORITY_DENIED"
+            },
+            authority
+          })
+        );
+      }
+      if (!requestController.signal.aborted) send(response, 200, result);
+    } catch {
+      if (!requestController.signal.aborted)
+        send(response, 400, {
+          jsonrpc: "2.0",
+          id: null,
+          error: { code: -32600, message: "INVALID_MCP_REQUEST" }
+        });
+    } finally {
+      request.removeListener("aborted", onAborted);
+    }
+  });
+}
+function createMcpStdioServer(options, input = process.stdin, output = process.stdout) {
+  const cancellationRegistry = options.cancellationRegistry ?? createMcpCancellationRegistry();
+  const lines = createInterface({
+    input,
+    crlfDelay: Infinity
+  });
+  let closed = false;
+  const write = (body) => {
+    if (!closed) output.write(`${JSON.stringify(body)}
+`);
+  };
+  const processLine = async (line) => {
+    if (!line.trim()) return;
+    let body;
+    try {
+      body = JSON.parse(line);
+    } catch {
+      write({
+        jsonrpc: "2.0",
+        id: null,
+        error: { code: -32700, message: "PARSE_ERROR" }
+      });
+      return;
+    }
+    const token = requestToken(body.id);
+    const requestInvocation = {
+      ...options.invocation,
+      id: `${options.invocation.id}:${token}`,
+      receiptId: `${options.invocation.receiptId}:${token}`,
+      idempotencyKey: `${options.invocation.idempotencyKey}:${token}`
+    };
+    const scope = {
+      organizationId: requestInvocation.organizationId,
+      projectId: requestInvocation.projectId,
+      environmentId: requestInvocation.environmentId
+    };
+    try {
+      await assertConfiguredSession(options, options.sessionId, scope);
+    } catch {
+      if (body.id !== void 0)
+        write({
+          jsonrpc: "2.0",
+          id: body.id,
+          error: { code: -32001, message: "MCP_SESSION_NOT_ACTIVE" }
+        });
+      return;
+    }
+    if (options.invocationExecutor && body.method === "tools/call") {
+      const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
+      if (definition) {
+        const invocation = { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} };
+        const authority2 = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
+        if (authority2.allowed) {
+          const result = await options.invocationExecutor({ invocation, authority: authority2 });
+          if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }], isError: !result.ok, provenanceDigest: result.provenanceDigest } });
+          return;
+        }
+        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
+        return;
+      }
+    }
+    if (options.provenanceRepository && body.method === "tools/call") {
+      const replay = await claimInvocation(
+        options.provenanceRepository,
+        requestInvocation,
+        scope
+      );
+      if (replay) {
+        const definition = options.tools.find((item) => item.name === String(body.params?.name ?? ""));
+        if (definition?.effectful) {
+          const authority2 = await options.authorize?.({ invocation: { ...requestInvocation, server: options.serverName, tool: definition.name, arguments: body.params?.arguments ?? {} }, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" };
+          if (!authority2.allowed) {
+            write({ jsonrpc: "2.0", id: body.id, error: { code: -32003, message: authority2.reason ?? "MCP_AUTHORITY_DENIED", data: { decisionDigest: authority2.decisionDigest } } });
+            return;
+          }
+        }
+        write({
+          jsonrpc: "2.0",
+          id: body.id,
+          result: {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(replay.result ?? replay.error ?? null)
+              }
+            ],
+            isError: !replay.ok,
+            provenanceDigest: replay.provenanceDigest
+          }
+        });
+        return;
+      }
+    }
+    let upstreamResponse;
+    let authority;
+    const transport = {
+      call: async (value) => {
+        upstreamResponse = await options.transport.call({
+          ...value,
+          signal: value.signal
+        });
+        return upstreamResponse;
+      }
+    };
+    try {
+      if (body.method === "server/discover") {
+        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { supportedProtocolVersions: ["2026-07-28", "2025-11-25", "2025-03-26"], serverInfo: { name: options.serverName, version: "1.0.0" }, capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } } });
+        return;
+      }
+      if (body.method === "initialize") {
+        const requested = String(body.params?.protocolVersion ?? "");
+        const protocolVersion = ["2026-07-28", "2025-11-25", "2025-03-26"].includes(requested) ? requested : "2025-03-26";
+        if (body.id !== void 0) write({ jsonrpc: "2.0", id: body.id, result: { protocolVersion, serverInfo: { name: options.serverName, version: "1.0.0" }, capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } } });
+        return;
+      }
+      const result = await handleMcpJsonRpc({
+        request: body,
+        server: options.serverName,
+        tools: options.tools,
+        resources: options.resources,
+        prompts: options.prompts,
+        readResource: options.readResource,
+        getPrompt: options.getPrompt,
+        invocation: requestInvocation,
+        transport,
+        cancellationRegistry,
+        authorize: async (value) => {
+          authority = await options.authorize?.(value) ?? (value.definition.effectful ? {
+            allowed: false,
+            decisionDigest: "",
+            reason: "MCP_AUTHORITY_REQUIRED"
+          } : { allowed: true, decisionDigest: "read-only" });
+          return authority;
+        }
+      });
+      if (options.provenanceRepository && body.method === "tools/call") {
+        const tool = String(body.params?.name ?? "");
+        await persistVerifiedMcpResult(
+          options.provenanceRepository,
+          createMcpResultFromResponse({
+            invocation: {
+              ...requestInvocation,
+              server: options.serverName,
+              tool,
+              arguments: body.params?.arguments ?? {}
+            },
+            response: upstreamResponse ?? {
+              error: authority?.reason ?? "MCP_AUTHORITY_DENIED"
+            },
+            authority
+          })
+        );
+      }
+      if (result !== null) write(result);
+    } catch {
+      if (body.id !== void 0)
+        write({
+          jsonrpc: "2.0",
+          id: body.id,
+          error: { code: -32600, message: "INVALID_MCP_REQUEST" }
+        });
+    }
+  };
+  lines.on("line", (line) => {
+    void processLine(line);
+  });
+  return {
+    close: () => {
+      closed = true;
+      lines.close();
+    }
+  };
+}
+function send(response, status, body) {
+  response.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  response.end(JSON.stringify(body));
+}
+function readBody(request, limit) {
+  return new Promise((resolve3, reject) => {
+    let size = 0;
+    const chunks = [];
+    request.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > limit) {
+        reject(new Error("PAYLOAD_TOO_LARGE"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => resolve3(Buffer.concat(chunks).toString("utf8")));
+    request.on("error", reject);
+  });
+}
+var requestToken, claimInvocation;
+var init_server = __esm({
+  "../../apps/mcp-server/server.ts"() {
+    "use strict";
+    init_mcp_gateway();
+    init_mcp_provenance();
+    init_mcp_session();
+    requestToken = (value) => String(
+      value ?? `notification-${Date.now()}-${Math.random().toString(16).slice(2)}`
+    );
+    claimInvocation = async (repository, invocation, scope) => {
+      const claim = await repository.claim?.({
+        invocationId: invocation.id,
+        idempotencyKey: invocation.idempotencyKey,
+        ...scope
+      });
+      if (claim?.status === "IN_FLIGHT")
+        throw new Error("MCP_INVOCATION_IN_FLIGHT");
+      return claim?.result ?? await repository.getByIdempotencyKey?.(invocation.idempotencyKey, scope) ?? null;
+    };
+  }
+});
+
+// ../runtime/src/mcp-invocation-service.ts
+import { createHash as createHash5 } from "node:crypto";
+function assertReplayIdentity(invocation, authority, result) {
+  const argumentsDigest = createHash5("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
+  const expectedAuthorityDecisionDigest = authority?.decisionDigest ?? "not-required";
+  if (result.organizationId !== invocation.organizationId || result.projectId !== invocation.projectId || result.environmentId !== invocation.environmentId || result.server !== invocation.server || result.tool !== invocation.tool || result.receiptId !== invocation.receiptId || result.idempotencyKey !== invocation.idempotencyKey || result.argumentsDigest !== argumentsDigest || result.authorityDecisionDigest !== expectedAuthorityDecisionDigest || result.authorityDigest !== (invocation.authorityDigest ?? null)) throw new Error("MCP_INVOCATION_REPLAY_MISMATCH");
+}
+async function executeMcpInvocation(input) {
+  const started = Date.now();
+  const claim = await input.store.claim({ invocationId: input.invocation.id, idempotencyKey: input.invocation.idempotencyKey, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId });
+  if (claim.status === "REPLAY" && claim.result) {
+    verifyMcpResult(claim.result);
+    assertReplayIdentity(input.invocation, input.authority, claim.result);
+    await input.observe?.({ result: claim.result, replay: true, durationMs: Date.now() - started });
+    return claim.result;
+  }
+  if (claim.status === "IN_FLIGHT") throw new Error("MCP_INVOCATION_IN_FLIGHT");
+  try {
+    const result = await invokeMcpTool({ invocation: input.invocation, transport: input.transport, authority: input.authority, signal: input.signal });
+    const persisted = await input.store.save(result);
+    verifyMcpResult(persisted);
+    await input.observe?.({ result: persisted, replay: false, durationMs: Date.now() - started });
+    return persisted;
+  } catch (error) {
+    if (input.signal?.aborted) await input.store.releaseClaim?.({ idempotencyKey: input.invocation.idempotencyKey, organizationId: input.invocation.organizationId, projectId: input.invocation.projectId, environmentId: input.invocation.environmentId });
+    throw error;
+  }
+}
+var init_mcp_invocation_service = __esm({
+  "../runtime/src/mcp-invocation-service.ts"() {
+    "use strict";
+    init_mcp_gateway();
+    init_mcp_gateway();
+  }
+});
+
+// ../database/src/mcp-provenance-repository.ts
+var assertClaimInput, McpProvenanceRepository, SqlMcpProvenanceRepository;
+var init_mcp_provenance_repository = __esm({
+  "../database/src/mcp-provenance-repository.ts"() {
+    "use strict";
+    init_mcp_provenance();
+    init_scope_composer();
+    assertClaimInput = (input) => {
+      if (!input.invocationId?.trim() || !input.idempotencyKey?.trim() || !input.organizationId?.trim() || !input.projectId?.trim() || !input.environmentId?.trim()) throw new Error("MCP_CLAIM_INPUT_INVALID");
+    };
+    McpProvenanceRepository = class {
+      #items = /* @__PURE__ */ new Map();
+      #claims = /* @__PURE__ */ new Set();
+      claim(input) {
+        assertClaimInput(input);
+        const replay = this.getByIdempotencyKey(input.idempotencyKey, input);
+        if (replay) return { status: "REPLAY", result: replay };
+        const key = `${input.organizationId}:${input.projectId}:${input.environmentId}:${input.idempotencyKey}`;
+        if (this.#claims.has(key)) return { status: "IN_FLIGHT" };
+        this.#claims.add(key);
+        return { status: "CLAIMED" };
+      }
+      save(result) {
+        verifyMcpResult2(result);
+        const prior = this.#items.get(result.invocationId);
+        const byKey = this.getByIdempotencyKey(result.idempotencyKey, result);
+        if (prior && prior.provenanceDigest !== result.provenanceDigest || byKey && byKey.provenanceDigest !== result.provenanceDigest)
+          throw new Error("MCP_PROVENANCE_CONFLICT");
+        this.#items.set(result.invocationId, structuredClone(result));
+        this.#claims.delete(
+          `${result.organizationId}:${result.projectId}:${result.environmentId}:${result.idempotencyKey}`
+        );
+        return structuredClone(prior ?? byKey ?? result);
+      }
+      releaseClaim(input) {
+        assertClaimInput({ ...input, invocationId: "release-claim" });
+        this.#claims.delete(`${input.organizationId}:${input.projectId}:${input.environmentId}:${input.idempotencyKey}`);
+      }
+      saveComposed(scope, result) {
+        assertComposedScopeIntegrity(scope);
+        const projected = { organizationId: scope.chain.find((item) => item.level === "organization")?.id ?? "", projectId: scope.chain.find((item) => item.level === "project")?.id ?? "", environmentId: scope.chain.find((item) => item.level === "application")?.id ?? "" };
+        if (result.organizationId !== projected.organizationId || result.projectId !== projected.projectId || result.environmentId !== projected.environmentId) throw new Error("MCP_SCOPE_MISMATCH");
+        if (result.authorityDigest !== scope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
+        return this.save(result);
+      }
+      get(invocationId) {
+        const result = this.#items.get(invocationId);
+        if (!result) return null;
+        verifyMcpResult2(result);
+        return structuredClone(result);
+      }
+      getByIdempotencyKey(key, scope) {
+        const result = [...this.#items.values()].find(
+          (item) => item.idempotencyKey === key && item.organizationId === scope.organizationId && item.projectId === scope.projectId && item.environmentId === scope.environmentId
+        );
+        if (!result) return null;
+        verifyMcpResult2(result);
+        return structuredClone(result);
+      }
+      list(scope, limit = 100) {
+        return [...this.#items.values()].filter((item) => item.organizationId === scope.organizationId && item.projectId === scope.projectId && item.environmentId === scope.environmentId).slice(0, Math.max(0, Math.min(500, limit))).map((item) => {
+          verifyMcpResult2(item);
+          return structuredClone(item);
+        });
+      }
+    };
+    SqlMcpProvenanceRepository = class {
+      db;
+      constructor(db) {
+        this.db = db;
+        this.db.run(
+          "CREATE TABLE IF NOT EXISTS mcp_invocation_claims (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, invocation_id TEXT NOT NULL, claimed_at TEXT NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, idempotency_key))",
+          []
+        );
+      }
+      releaseClaim(input) {
+        assertClaimInput({ ...input, invocationId: "release-claim" });
+        this.db.run("DELETE FROM mcp_invocation_claims WHERE organization_id=? AND project_id=? AND environment_id=? AND idempotency_key=?", [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey]);
+      }
+      claim(input) {
+        assertClaimInput(input);
+        const replay = this.getByIdempotencyKey(input.idempotencyKey, input);
+        if (replay) return { status: "REPLAY", result: replay };
+        try {
+          this.db.run(
+            "INSERT INTO mcp_invocation_claims (organization_id, project_id, environment_id, idempotency_key, invocation_id, claimed_at) VALUES (?, ?, ?, ?, ?, ?)",
+            [
+              input.organizationId,
+              input.projectId,
+              input.environmentId,
+              input.idempotencyKey,
+              input.invocationId,
+              (/* @__PURE__ */ new Date()).toISOString()
+            ]
+          );
+          return { status: "CLAIMED" };
+        } catch {
+          const after = this.getByIdempotencyKey(input.idempotencyKey, input);
+          return after ? { status: "REPLAY", result: after } : { status: "IN_FLIGHT" };
+        }
+      }
+      save(result) {
+        verifyMcpResult2(result);
+        const prior = this.getForScope(result, result.invocationId);
+        const byKey = this.getByIdempotencyKey(result.idempotencyKey, result);
+        const existing = prior ?? byKey;
+        if (existing) {
+          if (existing.provenanceDigest !== result.provenanceDigest)
+            throw new Error("MCP_PROVENANCE_CONFLICT");
+          return existing;
+        }
+        this.db.run(
+          "DELETE FROM mcp_invocation_claims WHERE organization_id=? AND project_id=? AND environment_id=? AND idempotency_key=?",
+          [
+            result.organizationId,
+            result.projectId,
+            result.environmentId,
+            result.idempotencyKey
+          ]
+        );
+        this.db.run(
+          "INSERT INTO mcp_invocation_provenance (invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          [
+            result.invocationId,
+            result.organizationId,
+            result.projectId,
+            result.environmentId,
+            result.server,
+            result.tool,
+            result.receiptId,
+            result.idempotencyKey,
+            result.argumentsDigest,
+            result.ok ? 1 : 0,
+            result.result === void 0 ? null : JSON.stringify(result.result),
+            result.error ?? null,
+            result.authorityDecisionDigest,
+            result.authorityDigest ?? null,
+            result.provenanceDigest
+          ]
+        );
+        const persisted = this.getForScope(result, result.invocationId);
+        if (!persisted || persisted.provenanceDigest !== result.provenanceDigest || persisted.receiptId !== result.receiptId || persisted.argumentsDigest !== result.argumentsDigest || persisted.authorityDecisionDigest !== result.authorityDecisionDigest || persisted.authorityDigest !== result.authorityDigest) throw new Error("MCP_PROVENANCE_READBACK_MISMATCH");
+        return persisted;
+      }
+      saveComposed(scope, result) {
+        assertComposedScopeIntegrity(scope);
+        const projected = { organizationId: scope.chain.find((item) => item.level === "organization")?.id ?? "", projectId: scope.chain.find((item) => item.level === "project")?.id ?? "", environmentId: scope.chain.find((item) => item.level === "application")?.id ?? "" };
+        if (result.organizationId !== projected.organizationId || result.projectId !== projected.projectId || result.environmentId !== projected.environmentId) throw new Error("MCP_SCOPE_MISMATCH");
+        if (result.authorityDigest !== scope.compositionDigest) throw new Error("MCP_AUTHORITY_MISMATCH");
+        return this.save(result);
+      }
+      get(invocationId) {
+        const row = this.db.exec(
+          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE invocation_id = ?",
+          [invocationId]
+        )[0]?.values[0];
+        return row ? this.fromRow(row) : null;
+      }
+      getByIdempotencyKey(key, scope) {
+        const row = this.db.exec(
+          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE idempotency_key = ? AND organization_id = ? AND project_id = ? AND environment_id = ?",
+          [key, scope.organizationId, scope.projectId, scope.environmentId]
+        )[0]?.values[0];
+        return row ? this.fromRow(row) : null;
+      }
+      getForScope(scope, invocationId) {
+        const row = this.db.exec(
+          "SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE invocation_id = ? AND organization_id = ? AND project_id = ? AND environment_id = ?",
+          [
+            invocationId,
+            scope.organizationId,
+            scope.projectId,
+            scope.environmentId
+          ]
+        )[0]?.values[0];
+        return row ? this.fromRow(row) : null;
+      }
+      list(scope, limit = 100) {
+        const bounded = Math.max(0, Math.min(500, limit));
+        const rows = this.db.exec("SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance WHERE organization_id=? AND project_id=? AND environment_id=? ORDER BY invocation_id DESC LIMIT ?", [scope.organizationId, scope.projectId, scope.environmentId, bounded])[0]?.values ?? [];
+        return rows.map((row) => this.fromRow(row));
+      }
+      fromRow(row) {
+        const result = {
+          invocationId: String(row[0]),
+          organizationId: String(row[1]),
+          projectId: String(row[2]),
+          environmentId: String(row[3]),
+          server: String(row[4]),
+          tool: String(row[5]),
+          receiptId: String(row[6]),
+          idempotencyKey: String(row[7]),
+          argumentsDigest: String(row[8]),
+          ok: Number(row[9]) === 1,
+          result: row[10] === null || row[10] === void 0 ? void 0 : JSON.parse(String(row[10])),
+          error: row[11] === null || row[11] === void 0 ? void 0 : String(row[11]),
+          authorityDecisionDigest: String(row[12]),
+          authorityDigest: row[13] === null || row[13] === void 0 ? null : String(row[13]),
+          provenanceDigest: String(row[14])
+        };
+        verifyMcpResult2(result);
+        return result;
+      }
+    };
+  }
+});
+
+// ../../apps/mcp-server/vira-server.ts
+function resolveViraMcpConfig(environment = process.env) {
+  const baseUrl = (environment.VIRA_API_URL ?? "http://127.0.0.1:4185").replace(/\/$/, "");
+  const apiKey = environment.VIRA_API_KEY ?? (environment.NODE_ENV === "production" ? "" : "vira_dev_local.local-development-only-32chars");
+  if (!apiKey) throw new Error("VIRA_API_KEY_REQUIRED_IN_PRODUCTION");
+  const authorityUrl = environment.VIRA_MCP_AUTHORITY_URL;
+  return { baseUrl, apiKey, authorityUrl, serverName: environment.VIRA_MCP_SERVER_NAME ?? "vira-behavior-control", requestAuthToken: environment.VIRA_MCP_AUTH_TOKEN, ...authorityUrl ? { authorizeEffectful: async (input) => {
+    const response = await fetch(`${authorityUrl}`, { method: "POST", headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" }, body: JSON.stringify(input) });
+    const payload = await response.json().catch(() => null);
+    return { allowed: response.ok && payload?.allowed === true, decisionDigest: payload?.decisionDigest ?? "", ...payload?.reason ? { reason: payload.reason } : {} };
+  } } : {} };
+}
+function assertScope(input, scope) {
+  for (const key of ["organizationId", "projectId", "environmentId"]) if (input[key] !== scope[key]) throw new Error("MCP_VIRA_SCOPE_MISMATCH");
+}
+function createViraMcpServer(config) {
+  return createMcpServer(createViraMcpOptions(config));
+}
+function createViraMcpOptions(config) {
+  if (!config.baseUrl?.trim() || !config.apiKey?.trim()) throw new Error("VIRA_MCP_CONFIG_REQUIRED");
+  const fetcher = config.fetcher ?? fetch;
+  const api = async (path, body, requestId, method) => {
+    const response = await fetcher(`${config.baseUrl.replace(/\/$/, "")}${path}`, { method: method ?? (body ? "POST" : "GET"), headers: { authorization: `Bearer ${config.apiKey}`, "content-type": "application/json", "idempotency-key": requestId }, ...body ? { body: JSON.stringify(body) } : {} });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) return { error: `VIRA_API_${response.status}`, result: payload };
+    return { result: payload };
+  };
+  const options = { serverName: config.serverName ?? "vira-behavior-control", requestAuthToken: config.requestAuthToken, tools, invocation: { ...config.scope, id: "mcp-vira", receiptId: "mcp-vira", idempotencyKey: "mcp-vira" }, transport: { call: async ({ tool, arguments: args }) => {
+    assertScope(args, config.scope);
+    const scopeQuery = `organizationId=${encodeURIComponent(config.scope.organizationId)}&projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`;
+    if (tool === "list_behavior_programs") return api(`/v1/behavior-programs?projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "list_behavior_strategies") return api(`/v1/behavior-strategies?${scopeQuery}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "get_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.strategyId)}`);
+    if (tool === "simulate_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}/simulate?${scopeQuery}`, { initialState: args.initialState ?? {} }, `mcp:${tool}:${String(args.strategyId)}`);
+    if (tool === "start_strategy_execution") return api("/v1/runtime/strategy-executions", args, `mcp:${tool}:${String(args.executionId ?? args.artifactDigest)}`);
+    if (tool === "get_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.executionId)}`);
+    if (tool === "get_strategy_execution_trace") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/trace?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.executionId)}`);
+    if (tool === "continue_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/continue`, args.authorityDigest ? { authorityDigest: args.authorityDigest } : {}, `mcp:${tool}:${String(args.executionId)}`);
+    if (tool === "cancel_strategy_execution") return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/cancel`, {}, `mcp:${tool}:${String(args.executionId)}`);
+    if (tool === "list_ai_systems") return api(`/v1/ai-systems?${scopeQuery}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "list_discovery_candidates") return api(`/v1/discovery/candidates?${scopeQuery}${args.reviewState ? `&reviewState=${encodeURIComponent(String(args.reviewState))}` : ""}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "review_discovery_candidate") return api(`/v1/discovery/candidates/${encodeURIComponent(String(args.kind))}/${encodeURIComponent(String(args.key))}/review`, { ...args }, `mcp:${tool}:${String(args.kind)}:${String(args.key)}`);
+    if (tool === "create_observation") return api("/v1/observations", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "start_evaluation") return api("/v1/evaluations", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "compile_behavior_capsule") return api("/v1/runtime/behavior-capsule", args, `mcp:${tool}:${String(args.programId)}`);
+    if (tool === "serve_behavior_projection") return api("/v1/runtime/behavior-projection", args, `mcp:${tool}:${String(args.programId ?? "active")}`);
+    throw new Error("MCP_TOOL_NOT_IMPLEMENTED");
+  } }, authorize: ({ invocation, definition }) => definition.effectful ? config.authorizeEffectful ? config.authorizeEffectful({ tool: definition.name, arguments: invocation.arguments, scope: { organizationId: invocation.organizationId, projectId: invocation.projectId, environmentId: invocation.environmentId } }) : { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" }, ...config.provenanceRepository ? { provenanceRepository: config.provenanceRepository } : {}, ...config.sessionRepository ? { sessionRepository: config.sessionRepository } : {}, ...config.sessionId ? { sessionId: config.sessionId } : {}, ...config.invocationExecutor ? { invocationExecutor: config.invocationExecutor } : {} };
+  const originalTransport = options.transport;
+  const originalCall = originalTransport.call;
+  options.transport = { ...originalTransport, call: async (input) => {
+    const { tool, arguments: args } = input;
+    if (tool === "list_packs") return api("/v1/packs", void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "import_pack") return api("/v1/packs/import", args, `mcp:${tool}:${config.scope.projectId}`);
+    if (["install_pack", "evaluate_pack", "approve_pack", "release_pack", "preview_pack_upgrade"].includes(tool)) {
+      const action = { install_pack: "install", evaluate_pack: "evaluate", approve_pack: "approve", release_pack: "release", preview_pack_upgrade: "upgrade-preview" }[tool];
+      const { packId, ...body } = args;
+      return api(`/v1/packs/${encodeURIComponent(String(packId))}/${action}`, body, `mcp:${tool}:${String(packId)}`);
+    }
+    return originalCall(input);
+  } };
+  originalTransport.call = options.transport.call;
+  options.transport = { ...originalTransport, call: async (input) => {
+    if (input.tool === "resolve_semantic" || input.tool === "resolve_runtime") assertScope(input.arguments, config.scope);
+    return input.tool === "resolve_semantic" ? api("/v1/semantic/resolve", input.arguments, `mcp:resolve_semantic:${String(input.arguments.input)}`) : input.tool === "resolve_runtime" ? api("/v1/runtime/resolve", input.arguments, `mcp:resolve_runtime:${String(input.arguments.behaviorPoint)}`) : originalTransport.call(input);
+  } };
+  const signalTransport = options.transport;
+  options.transport = { ...signalTransport, call: async (input) => {
+    const { tool, arguments: args } = input;
+    if (tool.startsWith("signal_") || tool === "create_signal_discovery_proposal" || tool === "review_signal_discovery_proposal" || tool === "materialize_signal_discovery" || tool === "create_signal_mapping" || tool === "get_signal_mapping" || tool === "review_signal_mapping") assertScope(args, config.scope);
+    const scopeQuery = `organizationId=${encodeURIComponent(config.scope.organizationId)}&projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`;
+    if (tool === "create_signal_discovery_proposal") return api("/v1/signals/discovery-proposals", args, `mcp:${tool}:${String(args.signalStableKey)}`);
+    if (tool === "review_signal_discovery_proposal") return api(`/v1/signals/discovery-proposals/${encodeURIComponent(String(args.proposalId))}/review`, { decision: args.decision }, `mcp:${tool}:${String(args.proposalId)}`);
+    if (tool === "materialize_signal_discovery") {
+      const { proposalId, ...body } = args;
+      return api(`/v1/signals/discovery-proposals/${encodeURIComponent(String(proposalId))}/materialize`, body, `mcp:${tool}:${String(proposalId)}`);
+    }
+    if (tool === "create_signal_mapping") return api("/v1/signals/mappings", args, `mcp:${tool}:${String(args.signalStableKey)}`);
+    if (tool === "get_signal_mapping") return api(`/v1/signals/mappings/${encodeURIComponent(String(args.mappingId))}?${scopeQuery}`, void 0, `mcp:${tool}:${String(args.mappingId)}`);
+    if (tool === "review_signal_mapping") {
+      const { mappingId, ...body } = args;
+      return api(`/v1/signals/mappings/${encodeURIComponent(String(mappingId))}/review`, body, `mcp:${tool}:${String(mappingId)}`);
+    }
+    return signalTransport.call(input);
+  } };
+  const authoringTransport = options.transport;
+  options.transport = { ...authoringTransport, call: async (input) => {
+    const { tool, arguments: args } = input;
+    if (tool === "list_capabilities") return api(`/v1/capabilities${args.surface ? `?surface=${encodeURIComponent(String(args.surface))}` : ""}`, void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "list_semantic_tasks") return api("/v1/semantic-tasks", void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "create_semantic_task") return api("/v1/semantic-tasks", args, `mcp:${tool}:${String(args.taskKey)}`);
+    if (tool === "list_behavior_points") return api("/v1/behavior-points", void 0, `mcp:${tool}:${config.scope.projectId}`);
+    if (tool === "create_behavior_point") return api("/v1/behavior-points", args, `mcp:${tool}:${String(args.key)}`);
+    if (tool === "delete_ai_system") return api(`/v1/ai-systems/${encodeURIComponent(String(args.systemId))}`, { confirm: args.confirm === true }, `mcp:${tool}:${String(args.systemId)}`, "DELETE");
+    if (tool === "delete_semantic_task") return api(`/v1/semantic-tasks/${encodeURIComponent(String(args.taskId))}`, { confirm: args.confirm === true }, `mcp:${tool}:${String(args.taskId)}`, "DELETE");
+    if (tool === "delete_behavior_point") return api(`/v1/behavior-points/${encodeURIComponent(String(args.pointId))}`, { confirm: args.confirm === true }, `mcp:${tool}:${String(args.pointId)}`, "DELETE");
+    if (tool === "delete_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}`, { confirm: args.confirm === true }, `mcp:${tool}:${String(args.strategyId)}`, "DELETE");
+    if (tool === "activate_behavior_strategy") return api(`/v1/behavior-strategies/${encodeURIComponent(String(args.strategyId))}/activate`, {}, `mcp:${tool}:${String(args.strategyId)}`);
+    return authoringTransport.call(input);
+  } };
+  const lifecycleTransport = options.transport;
+  options.transport = { ...lifecycleTransport, call: async (input) => {
+    const { tool, arguments: args } = input;
+    if (tool === "submit_teach_evidence") return api("/v1/teach/evidence", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "create_teach_proposal") return api("/v1/teach/proposals", args, `mcp:${tool}:${String(args.evidenceId)}`);
+    if (tool === "transition_teach_proposal") {
+      const { proposalId, transition, ...body } = args;
+      return api(`/v1/teach/proposals/${encodeURIComponent(String(proposalId))}/${encodeURIComponent(String(transition))}`, body, `mcp:${tool}:${String(proposalId)}`);
+    }
+    if (tool === "create_release") return api("/v1/releases", args, `mcp:${tool}:${String(args.releaseId ?? args.artifactId)}`);
+    return lifecycleTransport.call(input);
+  } };
+  const continuationTransport = options.transport;
+  options.transport = { ...continuationTransport, call: async (input) => {
+    if (input.tool === "continue_strategy_execution") {
+      const args = input.arguments;
+      const body = {
+        ...typeof args.authorityDigest === "string" ? { authorityDigest: args.authorityDigest } : {},
+        ...args.state && typeof args.state === "object" && !Array.isArray(args.state) ? { state: args.state } : {},
+        ...args.references && typeof args.references === "object" && !Array.isArray(args.references) ? { references: args.references } : {}
+      };
+      return api(`/v1/runtime/strategy-executions/${encodeURIComponent(String(args.executionId))}/continue`, body, `mcp:${input.tool}:${String(args.executionId)}`);
+    }
+    return continuationTransport.call(input);
+  } };
+  const configuredRepository = config.provenanceRepository;
+  if (configuredRepository && typeof configuredRepository.claim !== "function") throw new Error("MCP_PROVENANCE_CLAIM_REQUIRED");
+  const provenanceRepository = configuredRepository ?? new McpProvenanceRepository();
+  options.provenanceRepository = provenanceRepository;
+  options.invocationExecutor ??= ({ invocation, authority, signal }) => executeMcpInvocation({ invocation, authority, signal, transport: options.transport, store: provenanceRepository });
+  options.requireInvocationExecutor = true;
+  return options;
+}
+var tools;
+var init_vira_server = __esm({
+  "../../apps/mcp-server/vira-server.ts"() {
+    "use strict";
+    init_server();
+    init_mcp_invocation_service();
+    init_mcp_provenance_repository();
+    tools = Object.freeze([
+      { name: "list_capabilities", description: "Show which Vira capabilities this scoped credential can use and on which public surfaces.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, surface: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "list_semantic_tasks", description: "Read scoped Semantic Tasks.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "create_semantic_task", description: "Create a scoped Semantic Task for later review/activation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, taskKey: { type: "string" }, description: { type: "string" }, version: { type: "number" }, aliases: { type: "array" }, examples: { type: "array" }, negativeExamples: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "taskKey"] } },
+      { name: "list_behavior_points", description: "Read scoped canonical BehaviorPoints.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "create_behavior_point", description: "Create a scoped BehaviorPoint bound to one or more Semantic Tasks.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, key: { type: "string" }, taskId: { type: "string" }, taskIds: { type: "array" }, constraints: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "key"] } },
+      { name: "activate_behavior_strategy", description: "Activate a validated scoped Behavior Strategy revision.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
+      { name: "submit_teach_evidence", description: "Submit scoped evidence to the Teach lifecycle.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, source: { type: "string" }, content: { type: "string" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
+      { name: "create_teach_proposal", description: "Create a reviewed Teach proposal from admitted evidence.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, evidenceId: { type: "string" }, controlPointId: { type: "string" }, summary: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "evidenceId", "controlPointId", "summary"] } },
+      { name: "transition_teach_proposal", description: "Review, evaluate, or promote a Teach proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, transition: { type: "string" }, decision: { type: "string" }, score: { type: "number" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "transition"] } },
+      { name: "create_release", description: "Create a scoped release after evaluation and approval.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, releaseId: { type: "string" }, artifactId: { type: "string" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "artifactId"] } },
+      { name: "resolve_semantic", description: "Resolve input through the governed semantic runtime.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, input: { type: "string" }, sessionId: { type: "string" }, profile: { type: "object" }, selection: { type: "object" }, candidates: { type: "array" }, timeoutMs: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "input"] } },
+      { name: "resolve_runtime", description: "Resolve a persisted BehaviorPoint through the governed runtime boundary. behaviorPoint may be omitted when semanticContext supplies the selected canonical route.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, behaviorPoint: { type: "string" }, executionBoundary: { type: "object" }, semanticContext: { type: "object" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "create_signal_discovery_proposal", description: "Propose a discovered signal for scoped human review.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, signalStableKey: { type: "string" }, evidenceEventIds: { type: "array", items: { type: "string" } }, suggestedProducerType: { type: "string" }, suggestedProducerKey: { type: "string" }, confidence: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "signalStableKey", "evidenceEventIds"] } },
+      { name: "review_signal_discovery_proposal", description: "Approve or reject a discovered signal proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, decision: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "decision"] } },
+      { name: "materialize_signal_discovery", description: "Materialize an approved signal into a definition and producer mapping.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, valueType: { type: "string" }, description: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId"] } },
+      { name: "create_signal_mapping", description: "Create a scoped signal producer mapping proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, signalStableKey: { type: "string" }, signalVersion: { type: "number" }, producerType: { type: "string" }, producerKey: { type: "string" }, sourceEventType: { type: "string" }, evidenceEventIds: { type: "array", items: { type: "string" } } }, required: ["organizationId", "projectId", "environmentId", "signalStableKey", "signalVersion", "producerType", "producerKey"] } },
+      { name: "get_signal_mapping", description: "Read one scoped signal producer mapping.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, mappingId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "mappingId"] } },
+      { name: "review_signal_mapping", description: "Approve or reject a scoped signal producer mapping.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, mappingId: { type: "string" }, decision: { type: "string" }, eventId: { type: "string" }, definition: { type: "object" }, teachConsentRecord: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "mappingId", "decision"] } },
+      { name: "list_behavior_programs", description: "Read scoped canonical behavior programs.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "list_behavior_strategies", description: "Read persisted immutable Behavior Strategy revisions in the configured scope.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "get_behavior_strategy", description: "Read one persisted Behavior Strategy definition and artifact binding.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
+      { name: "simulate_behavior_strategy", description: "Run the explicit structural dry-run for a persisted Behavior Strategy.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" }, initialState: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "strategyId"] } },
+      { name: "start_strategy_execution", description: "Start a persisted Strategy execution through the governed runtime boundary.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, behaviorPoint: { type: "string" }, executionBoundary: { type: "object" }, revisionId: { type: "string" }, idempotencyKey: { type: "string" }, nonce: { type: "string" }, expiresAt: { type: "number" }, decisionPlanId: { type: "string" }, candidates: { type: "array", items: { type: "object" } }, policy: { type: "string" }, allowedIds: { type: "array", items: { type: "string" } }, calibrationId: { type: "string" }, postModelJudge: { type: "object" }, shadow: { type: "object" }, artifactDigest: { type: "string" }, traceId: { type: "string" }, executionId: { type: "string" }, state: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "revisionId", "idempotencyKey", "nonce", "expiresAt", "decisionPlanId", "candidates", "policy", "artifactDigest"] } },
+      { name: "get_strategy_execution", description: "Read one scoped Strategy execution.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
+      { name: "get_strategy_execution_trace", description: "Read persisted Strategy step receipts and trace evidence.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
+      { name: "continue_strategy_execution", description: "Continue a waiting Strategy execution with the same pinned artifact, state, and external references.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" }, authorityDigest: { type: "string" }, state: { type: "object", additionalProperties: true }, references: { type: "object", additionalProperties: true } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
+      { name: "cancel_strategy_execution", description: "Cancel a non-terminal scoped Strategy execution.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, executionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "executionId"] } },
+      { name: "list_ai_systems", description: "Read connected AI systems in the configured scope.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "delete_ai_system", description: "Delete an unused scoped AI system after explicit confirmation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, systemId: { type: "string" }, confirm: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "systemId", "confirm"] } },
+      { name: "delete_semantic_task", description: "Delete an unused scoped Semantic Task after explicit confirmation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, taskId: { type: "string" }, confirm: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "taskId", "confirm"] } },
+      { name: "delete_behavior_point", description: "Delete an unused scoped BehaviorPoint after explicit confirmation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, pointId: { type: "string" }, confirm: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "pointId", "confirm"] } },
+      { name: "delete_behavior_strategy", description: "Delete a non-active unused scoped Behavior Strategy after explicit confirmation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, strategyId: { type: "string" }, confirm: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "strategyId", "confirm"] } },
+      { name: "list_discovery_candidates", description: "Read evidence-backed discovery candidates awaiting human review.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, reviewState: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "review_discovery_candidate", description: "Record a human review decision for a scoped discovery candidate.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, kind: { type: "string" }, key: { type: "string" }, decision: { type: "string" }, payload: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "kind", "key", "decision"] } },
+      { name: "create_observation", description: "Submit one scoped observation for discovery; it does not publish behavior.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, content: { type: "object" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
+      { name: "start_evaluation", description: "Start a local evaluation for an existing artifact.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, targetArtifact: { type: "string" }, dataset: { type: "array" }, assertions: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "id", "targetArtifact", "dataset", "assertions"] } },
+      { name: "compile_behavior_capsule", description: "Compile a persisted scoped Behavior VM capsule and return its receipt.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, selection: { type: "object" }, candidates: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "programId", "input"] } },
+      { name: "serve_behavior_projection", description: "Serve the active scoped behavior projection through the governed runtime boundary.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, provider: { type: "string" }, protocol: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "input", "provider"] } },
+      { name: "list_packs", description: "Read scoped behavior packs.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
+      { name: "import_pack", description: "Import and validate a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, manifest: { type: "object" }, objects: { type: "object" }, archiveBase64: { type: "string" }, fileName: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "manifest"] } },
+      { name: "install_pack", description: "Install a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, variables: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
+      { name: "evaluate_pack", description: "Evaluate a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, passed: { type: "boolean" }, score: { type: "number" }, runId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId", "passed"] } },
+      { name: "approve_pack", description: "Approve a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
+      { name: "release_pack", description: "Release a scoped behavior pack.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "packId"] } },
+      { name: "preview_pack_upgrade", description: "Preview a scoped behavior pack upgrade.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, packId: { type: "string" }, incoming: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "packId", "incoming"] } }
+    ]);
+  }
+});
+
+// ../database/src/mcp-session-repository.ts
+var SqlMcpSessionRepository;
+var init_mcp_session_repository = __esm({
+  "../database/src/mcp-session-repository.ts"() {
+    "use strict";
+    init_mcp_session();
+    SqlMcpSessionRepository = class {
+      db;
+      constructor(db) {
+        this.db = db;
+      }
+      save(session) {
+        assertMcpSession(session);
+        const row = this.db.exec("SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=?", [session.id])[0]?.values[0];
+        if (row) {
+          const prior = this.mapRow(row);
+          if (prior.organizationId !== session.organizationId || prior.projectId !== session.projectId || prior.environmentId !== session.environmentId) throw new Error("MCP_SESSION_SCOPE_CONFLICT");
+          if (prior.sessionDigest === session.sessionDigest) return prior;
+          if (session.generation < prior.generation || session.generation === prior.generation && prior.status === "CLOSED") throw new Error("MCP_SESSION_CONFLICT");
+          this.db.run("UPDATE mcp_sessions SET server=?,endpoint=?,protocol_version=?,status=?,auth_digest=?,generation=?,updated_at=?,session_digest=? WHERE id=? AND organization_id=? AND project_id=? AND environment_id=?", [session.server, session.endpoint, session.protocolVersion, session.status, session.authDigest, session.generation, session.updatedAt, session.sessionDigest, session.id, session.organizationId, session.projectId, session.environmentId]);
+          const persisted2 = this.get(session.id, { organizationId: session.organizationId, projectId: session.projectId, environmentId: session.environmentId });
+          if (!persisted2 || persisted2.sessionDigest !== session.sessionDigest || persisted2.generation !== session.generation || persisted2.status !== session.status) throw new Error("MCP_SESSION_READBACK_MISMATCH");
+          return persisted2;
+        }
+        this.db.run("INSERT INTO mcp_sessions (id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)", [session.id, session.organizationId, session.projectId, session.environmentId, session.server, session.endpoint, session.protocolVersion, session.status, session.authDigest, session.generation, session.createdAt, session.updatedAt, session.sessionDigest]);
+        const persisted = this.get(session.id, { organizationId: session.organizationId, projectId: session.projectId, environmentId: session.environmentId });
+        if (!persisted || persisted.sessionDigest !== session.sessionDigest) throw new Error("MCP_SESSION_READBACK_MISMATCH");
+        return persisted;
+      }
+      mapRow(row) {
+        const session = { id: String(row[0]), organizationId: String(row[1]), projectId: String(row[2]), environmentId: String(row[3]), server: String(row[4]), endpoint: String(row[5]), protocolVersion: String(row[6]), authDigest: String(row[8]), status: String(row[7]), generation: Number(row[9]), createdAt: String(row[10]), updatedAt: String(row[11]), sessionDigest: String(row[12]) };
+        assertMcpSession(session);
+        return session;
+      }
+      get(id, scope) {
+        const row = this.db.exec("SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=? AND organization_id=? AND project_id=? AND environment_id=?", [id, scope.organizationId, scope.projectId, scope.environmentId])[0]?.values[0];
+        return row ? this.mapRow(row) : null;
+      }
+    };
+  }
+});
+
+// ../../apps/mcp-server/official-stdio.ts
+import { McpServer } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { z } from "zod";
+function serveOfficialViraMcp(options) {
+  return serveStdio(() => {
+    const server = new McpServer({ name: options.serverName, version: "1.0.0" }, { capabilities: { tools: {}, resources: options.resources ? {} : void 0, prompts: options.prompts ? {} : void 0 } });
+    for (const definition of options.tools) {
+      server.registerTool(definition.name, { description: definition.description, inputSchema: z.record(z.string(), z.unknown()) }, async (argumentsValue) => {
+        const invocation = { ...options.invocation, server: options.serverName, tool: definition.name, arguments: argumentsValue };
+        const authority = definition.effectful ? await options.authorize?.({ invocation, definition }) ?? { allowed: false, decisionDigest: "", reason: "MCP_AUTHORITY_REQUIRED" } : { allowed: true, decisionDigest: "read-only" };
+        if (!authority.allowed) return { isError: true, content: [{ type: "text", text: authority.reason ?? "MCP_AUTHORITY_DENIED" }] };
+        const result = options.invocationExecutor ? await options.invocationExecutor({ invocation, authority }) : await invokeMcpTool({ invocation, authority, transport: options.transport });
+        return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result.result ?? result.error ?? null) }] };
+      });
+    }
+    return server;
+  });
+}
+var init_official_stdio = __esm({
+  "../../apps/mcp-server/official-stdio.ts"() {
+    "use strict";
+    init_mcp_gateway();
+  }
+});
+
+// ../database/src/postgres-adapter.ts
+import { Pool } from "pg";
+function validateSql(sql) {
+  if (!sql.trim()) throw new Error("POSTGRES_SQL_REQUIRED");
+  if (sql.includes("\0")) throw new Error("POSTGRES_SQL_INVALID");
+}
+function createPostgresDatabase(input) {
+  if (!input.pool || typeof input.pool.query !== "function" || typeof input.pool.connect !== "function") throw new Error("POSTGRES_POOL_INVALID");
+  if (!input.databaseUrl?.trim() && !process.env.DATABASE_URL?.trim()) throw new Error("DATABASE_URL_REQUIRED");
+  return { mode: "production", query: async (sql, params = []) => {
+    validateSql(sql);
+    return input.pool.query(sql, params);
+  }, transaction: async (work) => {
+    if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
+    const client = await input.pool.connect();
+    const timeoutMs = Math.max(1e3, Number(process.env.VIRA_DB_STATEMENT_TIMEOUT_MS ?? 6e5));
+    try {
+      await client.query("BEGIN");
+      await client.query(`SET LOCAL statement_timeout = ${timeoutMs}`);
+      const result = await work(client);
+      await client.query("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    } finally {
+      client.release();
+    }
+  }, health: () => ({ ready: true, mode: "production" }) };
+}
+function createPostgresPool(input = {}) {
+  const connectionString = input.databaseUrl ?? process.env.DATABASE_URL;
+  if (!connectionString?.startsWith("postgres")) throw new Error("POSTGRES_DATABASE_URL_REQUIRED");
+  const statementTimeoutMs = Math.max(1e3, Number(process.env.VIRA_DB_STATEMENT_TIMEOUT_MS ?? 6e5));
+  const config = { connectionString, max: input.max ?? 10, idleTimeoutMillis: 3e4, connectionTimeoutMillis: 1e4, statement_timeout: statementTimeoutMs, ...input.ssl ? { ssl: { rejectUnauthorized: false } } : {} };
+  const pool = new Pool(config);
+  return { pool, close: () => pool.end() };
+}
+var init_postgres_adapter = __esm({
+  "../database/src/postgres-adapter.ts"() {
+    "use strict";
+  }
+});
+
+// ../database/src/postgres-migrations.ts
+import { createHash as createHash6 } from "node:crypto";
+function splitSql(sql) {
+  const statements = [];
+  let start = 0;
+  let quote = null;
+  let dollarQuote = null;
+  let lineComment = false;
+  let blockComment = false;
+  for (let i = 0; i < sql.length; i += 1) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (dollarQuote) {
+      if (sql.startsWith(dollarQuote, i)) {
+        i += dollarQuote.length - 1;
+        dollarQuote = null;
+      }
+      continue;
+    }
+    if (lineComment) {
+      if (ch === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "*" && next === "/") {
+        blockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (!quote && ch === "-" && next === "-") {
+      lineComment = true;
+      i += 1;
+      continue;
+    }
+    if (!quote && ch === "/" && next === "*") {
+      blockComment = true;
+      i += 1;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote && sql[i - 1] !== "\\") quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "$") {
+      const match = sql.slice(i).match(/^\$[A-Za-z_0-9]*\$/);
+      if (match) {
+        dollarQuote = match[0];
+        i += match[0].length - 1;
+        continue;
+      }
+    }
+    if (ch === ";") {
+      const statement = sql.slice(start, i).trim();
+      if (statement) statements.push(statement);
+      start = i + 1;
+    }
+  }
+  const tail = sql.slice(start).trim();
+  if (tail) statements.push(tail);
+  return statements;
+}
+function normalizePostgresMigrationSql(sql) {
+  if (!sql.trim()) throw new Error("POSTGRES_MIGRATION_SQL_REQUIRED");
+  if (/\bINSERT\s+OR\s+(?:REPLACE|IGNORE)\b/i.test(sql)) throw new Error("POSTGRES_MIGRATION_CONFLICT_SEMANTICS_UNSUPPORTED");
+  if (/[?]|\$\d+/.test(sql)) throw new Error("POSTGRES_MIGRATION_PARAMETERS_UNSUPPORTED");
+  if (/\bPRAGMA\b/i.test(sql)) throw new Error("POSTGRES_MIGRATION_SQLITE_PRAGMA_UNSUPPORTED");
+  const hasWorkerLeaseTriggers = /CREATE\s+TRIGGER\s+worker_jobs_assign_default_lease/i.test(sql) || /CREATE\s+TRIGGER\s+worker_jobs_clear_lease/i.test(sql);
+  if (/\bCREATE\s+TRIGGER\b/i.test(sql) && !hasWorkerLeaseTriggers) throw new Error("POSTGRES_MIGRATION_SQLITE_TRIGGER_UNSUPPORTED");
+  const normalized = sql.replace(/\bINTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/gi, "BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY");
+  if (/\bAUTOINCREMENT\b/i.test(normalized)) throw new Error("POSTGRES_MIGRATION_AUTOINCREMENT_UNSUPPORTED");
+  const withoutWorkerTriggers = normalized.replace(/CREATE\s+TRIGGER\s+worker_jobs_assign_default_lease[\s\S]*?END\s*;?/i, "").replace(/CREATE\s+TRIGGER\s+worker_jobs_clear_lease[\s\S]*?END\s*;?/i, "");
+  if (/\b(?:INSERT|UPDATE|DELETE|UPSERT)\b/i.test(withoutWorkerTriggers)) throw new Error("POSTGRES_MIGRATION_DML_UNSUPPORTED");
+  if (!hasWorkerLeaseTriggers) return withoutWorkerTriggers;
+  return `${withoutWorkerTriggers}
+CREATE OR REPLACE FUNCTION worker_jobs_assign_default_lease_fn() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF NEW.state = 'RUNNING' AND NEW.lease_owner IS NULL THEN
+    NEW.lease_owner := 'worker-default';
+    NEW.lease_expires_at := CURRENT_TIMESTAMP + INTERVAL '60 seconds';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+DROP TRIGGER IF EXISTS worker_jobs_assign_default_lease ON worker_jobs;
+CREATE TRIGGER worker_jobs_assign_default_lease BEFORE UPDATE OF state ON worker_jobs
+FOR EACH ROW EXECUTE FUNCTION worker_jobs_assign_default_lease_fn();
+CREATE OR REPLACE FUNCTION worker_jobs_clear_lease_fn() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF NEW.state <> 'RUNNING' THEN
+    NEW.lease_owner := NULL;
+    NEW.lease_expires_at := NULL;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+DROP TRIGGER IF EXISTS worker_jobs_clear_lease ON worker_jobs;
+CREATE TRIGGER worker_jobs_clear_lease BEFORE UPDATE OF state ON worker_jobs
+FOR EACH ROW EXECUTE FUNCTION worker_jobs_clear_lease_fn();`;
+}
+function migrationChecksums(sql) {
+  const normalized = normalizePostgresMigrationSql(sql);
+  const canonical3 = createHash6("sha256").update(normalized.replace(/\r\n?/g, "\n")).digest("hex");
+  const legacy = createHash6("sha256").update(normalized.replace(/\r?\n/g, "\r\n")).digest("hex");
+  return { canonical: canonical3, legacy };
+}
+async function applyPostgresMigrations(client, migrations) {
+  if (!client || typeof client.query !== "function") throw new Error("POSTGRES_CLIENT_INVALID");
+  await client.query("BEGIN");
+  try {
+    await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", ["vira:schema:migrations"]);
+    await client.query(`CREATE TABLE IF NOT EXISTS vira_schema_migrations (
+      id TEXT PRIMARY KEY,
+      applied_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      checksum TEXT,
+      code_version TEXT
+    )`);
+    await client.query("ALTER TABLE vira_schema_migrations ADD COLUMN IF NOT EXISTS checksum TEXT");
+    await client.query("ALTER TABLE vira_schema_migrations ADD COLUMN IF NOT EXISTS code_version TEXT");
+    const applied = await client.query("SELECT id, checksum FROM vira_schema_migrations");
+    const appliedIds = new Map(applied.rows.map((row) => [row.id, row.checksum]));
+    for (const migration of migrations) {
+      if (!migration.id.trim() || !migration.sql.trim()) throw new Error("POSTGRES_MIGRATION_INVALID");
+      const { canonical: checksum, legacy: legacyChecksum } = migrationChecksums(migration.sql);
+      if (appliedIds.has(migration.id)) {
+        const previous = appliedIds.get(migration.id);
+        if (previous && previous !== checksum) {
+          if (previous !== legacyChecksum && !migration.legacyChecksums?.includes(previous)) throw new Error(`POSTGRES_MIGRATION_CHECKSUM_MISMATCH:${migration.id}`);
+          await client.query("UPDATE vira_schema_migrations SET checksum=$1, code_version=$2 WHERE id=$3", [checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null, migration.id]);
+        }
+        if (!previous) await client.query("UPDATE vira_schema_migrations SET checksum=$1, code_version=$2 WHERE id=$3", [checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null, migration.id]);
+        continue;
+      }
+      for (const statement of splitSql(normalizePostgresMigrationSql(migration.sql))) await client.query(statement);
+      await client.query("INSERT INTO vira_schema_migrations (id, checksum, code_version) VALUES ($1, $2, $3)", [migration.id, checksum, migration.codeVersion ?? process.env.VIRA_VERSION ?? null]);
+    }
+    await client.query("COMMIT");
+  } catch (error) {
+    try {
+      await client.query("ROLLBACK");
+    } catch {
+    }
+    throw error;
+  }
+}
+var init_postgres_migrations = __esm({
+  "../database/src/postgres-migrations.ts"() {
+    "use strict";
+  }
+});
+
+// ../database/src/postgres-runtime.ts
+import { readFile, readdir } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+async function defaultMigrationPaths() {
+  const migrationDirectory = resolve(here, "../migrations");
+  const entries = await readdir(migrationDirectory, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && /^\d+_.+\.sql$/i.test(entry.name)).map((entry) => resolve(migrationDirectory, entry.name)).sort((left, right) => left.localeCompare(right, "en"));
+}
+async function openPostgresRuntime(options = {}) {
+  const { pool, close } = createPostgresPool({ databaseUrl: options.databaseUrl, max: options.maxConnections, ssl: options.ssl });
+  const database = createPostgresDatabase({ pool, databaseUrl: options.databaseUrl });
+  try {
+    if (!options.skipMigrations && process.env.VIRA_WORKER_SKIP_MIGRATIONS !== "true") {
+      const migrations = [];
+      const migrationPaths = options.migrationPaths ?? await defaultMigrationPaths();
+      for (const path of migrationPaths) migrations.push({ id: path.split(/[\\/]/).pop().replace(/\.sql$/i, ""), sql: await readFile(path, "utf8") });
+      const client = await pool.connect();
+      try {
+        await applyPostgresMigrations(client, migrations);
+      } finally {
+        client.release();
+      }
+    }
+    return { ...database, close };
+  } catch (error) {
+    await close();
+    throw error;
+  }
+}
+var here;
+var init_postgres_runtime = __esm({
+  "../database/src/postgres-runtime.ts"() {
+    "use strict";
+    init_postgres_adapter();
+    init_postgres_migrations();
+    here = dirname(fileURLToPath(import.meta.url));
+  }
+});
+
+// ../database/src/production-sqlite.ts
+import { access, readFile as readFile2, writeFile } from "node:fs/promises";
+import { existsSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import initSqlJs from "sql.js";
+function ensureColumn(database, table, column, definition) {
+  try {
+    database.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  } catch (error) {
+    const message = String(error);
+    if (!message.includes("duplicate column name")) throw error;
+  }
+}
+function reconcilePackSchema(database) {
+  database.run(`CREATE TABLE IF NOT EXISTS control_point_tasks (
+    control_point_id TEXT NOT NULL, task_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL,
+    PRIMARY KEY (control_point_id, task_id)
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS behavior_packs (
+    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL, digest TEXT NOT NULL, status TEXT NOT NULL,
+    payload_json TEXT NOT NULL, updated_at TEXT NOT NULL
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS execution_receipts (
+    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL, revision_id TEXT NOT NULL, actor_id TEXT NOT NULL,
+    idempotency_key TEXT NOT NULL, decision TEXT NOT NULL, reason TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    UNIQUE (organization_id, project_id, environment_id, idempotency_key)
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS execution_receipt_authority (
+    receipt_id TEXT PRIMARY KEY, authority_digest TEXT NOT NULL,
+    FOREIGN KEY (receipt_id) REFERENCES execution_receipts(id)
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS execution_receipt_semantic (
+    receipt_id TEXT PRIMARY KEY, semantic_task_ref TEXT NOT NULL,
+    semantic_task_version INTEGER NOT NULL, semantic_task_digest TEXT NOT NULL,
+    FOREIGN KEY (receipt_id) REFERENCES execution_receipts(id)
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS runtime_decision_plans (
+    id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL, plan_json TEXT NOT NULL, decision_right_json TEXT NOT NULL,
+    provider_health TEXT NOT NULL, fallback TEXT NOT NULL, authority_digest TEXT,
+    plan_digest TEXT NOT NULL, created_at TEXT NOT NULL,
+    UNIQUE (organization_id, project_id, environment_id, id)
+  )`);
+  database.run(`CREATE TABLE IF NOT EXISTS runtime_decisions (
+    request_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL, decision_json TEXT NOT NULL, created_at TEXT NOT NULL,
+    PRIMARY KEY (organization_id, project_id, environment_id, request_id)
+  )`);
+  const columns = [
+    ["behavior_programs", "modules_json", "TEXT NOT NULL DEFAULT '[]'"],
+    ["behavior_programs", "provenance_json", "TEXT"],
+    ["behavior_programs", "temporal_contract_digest", "TEXT"],
+    ["behavior_programs", "temporal_contracts_json", "TEXT"],
+    ["behavior_programs", "recovery_plans_json", "TEXT"],
+    ["ai_system_connections", "config_json", "TEXT NOT NULL DEFAULT '{}'"]
+  ];
+  for (const [table, column, definition] of columns) ensureColumn(database, table, column, definition);
+}
+function reconcileStrategySchema(database) {
+  const columns = [
+    ["behavior_strategies", "definition_json", "TEXT"],
+    ["behavior_strategies", "definition_digest", "TEXT"],
+    ["behavior_strategies", "control_point_id", "TEXT"],
+    ["behavior_variants", "content_type", "TEXT NOT NULL DEFAULT 'legacy'"],
+    ["behavior_variants", "definition_schema_version", "INTEGER"],
+    ["behavior_variants", "revision_number", "INTEGER"],
+    ["behavior_variants", "definition_digest", "TEXT"],
+    ["behavior_variants", "program_id", "TEXT"],
+    ["behavior_variants", "program_digest", "TEXT"],
+    ["behavior_variants", "provenance_json", "TEXT"],
+    ["behavior_variants", "definition_json", "TEXT"],
+    ["behavior_variants", "immutable", "INTEGER NOT NULL DEFAULT 1"]
+  ];
+  for (const [table, column, definition] of columns) ensureColumn(database, table, column, definition);
+  database.run("CREATE UNIQUE INDEX IF NOT EXISTS behavior_variants_strategy_revision ON behavior_variants(strategy_id, revision_number) WHERE revision_number IS NOT NULL");
+  database.run(`CREATE TABLE IF NOT EXISTS strategy_executions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, trace_id TEXT NOT NULL, behavior_point_id TEXT NOT NULL, canonical_revision_id TEXT NOT NULL, program_id TEXT NOT NULL, program_digest TEXT NOT NULL, strategy_id TEXT NOT NULL, variant_id TEXT NOT NULL, strategy_digest TEXT NOT NULL, behavior_artifact_digest TEXT, strategy_artifact_digest TEXT, composition_digest TEXT, authority_digest TEXT NOT NULL, mode TEXT NOT NULL, status TEXT NOT NULL, current_step_key TEXT, state_json TEXT NOT NULL, references_json TEXT NOT NULL DEFAULT '{}', state_digest TEXT NOT NULL, step_executions INTEGER NOT NULL DEFAULT 0, model_calls INTEGER NOT NULL DEFAULT 0, tool_calls INTEGER NOT NULL DEFAULT 0, decision_calls INTEGER NOT NULL DEFAULT 0, repair_attempts INTEGER NOT NULL DEFAULT 0, cost_micros INTEGER NOT NULL DEFAULT 0, sequence INTEGER NOT NULL DEFAULT 0, idempotency_key TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, expires_at TEXT, UNIQUE(organization_id,project_id,environment_id,idempotency_key))`);
+  ensureColumn(database, "strategy_executions", "references_json", "TEXT NOT NULL DEFAULT '{}'");
+  database.run(`CREATE TABLE IF NOT EXISTS strategy_step_receipts (id TEXT PRIMARY KEY, execution_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, step_key TEXT NOT NULL, step_type TEXT NOT NULL, attempt INTEGER NOT NULL, status TEXT NOT NULL, input_state_digest TEXT NOT NULL, output_digest TEXT, verification_digest TEXT, transition_key TEXT, next_step_key TEXT, model_request_id TEXT, tool_invocation_id TEXT, decision_receipt_digest TEXT, recovery_action TEXT, usage_json TEXT NOT NULL DEFAULT '{}', latency_ms INTEGER, receipt_digest TEXT NOT NULL UNIQUE, created_at TEXT NOT NULL, FOREIGN KEY(execution_id) REFERENCES strategy_executions(id), UNIQUE(execution_id,step_key,attempt))`);
+  try {
+    database.run("ALTER TABLE strategy_step_receipts ADD COLUMN recovery_action TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run(`CREATE TABLE IF NOT EXISTS strategy_artifact_blobs (artifact_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, strategy_digest TEXT NOT NULL, bytes TEXT NOT NULL, created_at TEXT NOT NULL)`);
+}
+function persistFile(filePath, data) {
+  const maxBytes = Number(process.env.VIRA_SQLITE_MAX_BYTES ?? 5 * 1024 * 1024 * 1024);
+  if (!Number.isFinite(maxBytes) || maxBytes < 64 * 1024 * 1024) throw new Error("SQLITE_STORAGE_LIMIT_INVALID");
+  if (data.byteLength > maxBytes) throw new Error("SQLITE_STORAGE_LIMIT_EXCEEDED");
+  const directory = dirname2(filePath);
+  const prefix = `${filePath}.tmp-`;
+  const staleBefore = Date.now() - 60 * 60 * 1e3;
+  for (const name of readdirSync(directory)) {
+    const candidate = resolve2(directory, name);
+    if (!candidate.startsWith(prefix)) continue;
+    try {
+      if (statSync(candidate).mtimeMs < staleBefore) unlinkSync(candidate);
+    } catch {
+    }
+  }
+  const temporaryPath = `${filePath}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  writeFileSync(temporaryPath, Buffer.from(data));
+  renameSync(temporaryPath, filePath);
+}
+async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } = {}) {
+  if (typeof databaseUrl !== "string" || !databaseUrl.startsWith("file:")) throw new Error("DATABASE_URL_FILE_REQUIRED");
+  const filePath = fileURLToPath2(new URL(databaseUrl));
+  if (!filePath || filePath === "/") throw new Error("DATABASE_PATH_REQUIRED");
+  const migrationPath = migrationCandidates.find((candidate) => existsSync(candidate));
+  if (!migrationPath) throw new Error("DATABASE_MIGRATION_ASSET_MISSING");
+  const SQL = await initSqlJs({ locateFile: (file) => {
+    const moduleAsset = resolve2(dirname2(require2.resolve("sql.js")), file);
+    if (existsSync(moduleAsset)) return moduleAsset;
+    const dependency = resolve2(root, "../../../node_modules/sql.js/dist", file);
+    if (existsSync(dependency)) return dependency;
+    const packagedDependency = resolve2(root, "../../../sql.js/dist", file);
+    if (existsSync(packagedDependency)) return packagedDependency;
+    const packaged = resolve2(root, "sql.js", file);
+    if (existsSync(packaged)) return packaged;
+    return dependency;
+  } });
+  let database;
+  let existing = true;
+  try {
+    await access(filePath);
+    database = new SQL.Database(new Uint8Array(await readFile2(filePath)));
+  } catch {
+    existing = false;
+    database = new SQL.Database();
+  }
+  if (!existing) database.run(await readFile2(migrationPath, "utf8"));
+  reconcilePackSchema(database);
+  reconcileStrategySchema(database);
+  try {
+    database.run("ALTER TABLE session_states ADD COLUMN application_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE behavior_programs ADD COLUMN provenance_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE worker_jobs ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE worker_jobs ADD COLUMN trace_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE worker_jobs ADD COLUMN available_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE strategy_executions ADD COLUMN total_recoveries INTEGER NOT NULL DEFAULT 0");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE learning_evidence ADD COLUMN outcome TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE learning_evidence ADD COLUMN provenance_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN idempotency_key TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN arguments_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE ai_system_connections ADD COLUMN config_json TEXT NOT NULL DEFAULT '{}'");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS session_handoff_approvals (id TEXT PRIMARY KEY, source_session_id TEXT NOT NULL, target_session_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('PENDING','APPROVED','REJECTED','CONSUMED')), requested_at TEXT NOT NULL, decided_at TEXT, expires_at TEXT NOT NULL, decision_digest TEXT NOT NULL UNIQUE)");
+  database.run(`CREATE TABLE IF NOT EXISTS release_manifests (
+    id TEXT PRIMARY KEY,
+    surfaces_json TEXT NOT NULL,
+    content_digest TEXT NOT NULL,
+    approved_by TEXT NOT NULL,
+    approved_at TEXT NOT NULL,
+    status TEXT NOT NULL,
+    organization_id TEXT,
+    project_id TEXT,
+    environment_id TEXT,
+    authority_digest TEXT,
+    artifact_id TEXT,
+    promotion_version INTEGER
+  )`);
+  for (const statement of [
+    "ALTER TABLE release_manifests ADD COLUMN authority_digest TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN artifact_id TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN promotion_version INTEGER",
+    "ALTER TABLE release_manifests ADD COLUMN strategy_id TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN strategy_variant_id TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN strategy_digest TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN strategy_artifact_digest TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN program_digest TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN evaluation_digest TEXT"
+  ]) {
+    try {
+      database.run(statement);
+    } catch (error) {
+      if (!String(error).includes("duplicate column name")) throw error;
+    }
+  }
+  database.run("CREATE TABLE IF NOT EXISTS telemetry_release_markers (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, release_id TEXT NOT NULL, service TEXT NOT NULL, deployment_environment TEXT NOT NULL, revision TEXT NOT NULL, deployment_id TEXT NOT NULL, occurred_at TEXT NOT NULL, trace_id TEXT, marker_digest TEXT NOT NULL, PRIMARY KEY (organization_id,project_id,environment_id,release_id,service,deployment_id))");
+  database.run(`CREATE TABLE IF NOT EXISTS optimization_artifacts (
+    id TEXT PRIMARY KEY,
+    idempotency_key TEXT UNIQUE,
+    organization_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    environment_id TEXT NOT NULL,
+    canonical_digest TEXT NOT NULL,
+    policy_digest TEXT NOT NULL,
+    target_model TEXT NOT NULL,
+    dataset_digest TEXT NOT NULL,
+    metric TEXT NOT NULL,
+    baseline REAL NOT NULL,
+    optimized_result REAL NOT NULL,
+    provenance TEXT NOT NULL,
+    status TEXT NOT NULL,
+    payload_json TEXT NOT NULL DEFAULT '{}'
+  )`);
+  for (const [column, definition] of [["stable_key", "TEXT"], ["parent_authority_level", "TEXT"], ["child_scope_kind", "TEXT"], ["child_scope_digest", "TEXT"], ["parent_revision_digest", "TEXT"], ["exception_effect_types_json", "TEXT"], ["when_json", "TEXT"]]) {
+    try {
+      database.run(`ALTER TABLE scope_delegations ADD COLUMN ${column} ${definition}`);
+    } catch (error) {
+      if (!String(error).includes("duplicate column name")) throw error;
+    }
+  }
+  database.run("CREATE TABLE IF NOT EXISTS evaluation_artifacts (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, target_artifact TEXT NOT NULL, dataset_digest TEXT NOT NULL, evaluator_version TEXT NOT NULL, score REAL NOT NULL, threshold REAL NOT NULL, status TEXT NOT NULL, failed_assertions_json TEXT NOT NULL, created_at TEXT NOT NULL)");
+  try {
+    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN holdout_commitment_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN grader_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_version TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE evaluation_artifacts ADD COLUMN suite_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE artifact_shadow_evidence ADD COLUMN release_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE artifact_shadow_evidence ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS gtm_funnel_events (event_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, event_digest TEXT NOT NULL, source TEXT NOT NULL, stage TEXT NOT NULL, journey_key TEXT NOT NULL, occurred_at TEXT NOT NULL, event_json TEXT NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, event_id))");
+  database.run("CREATE INDEX IF NOT EXISTS gtm_funnel_events_window ON gtm_funnel_events (organization_id, project_id, environment_id, occurred_at)");
+  for (const column of ["organization_id", "project_id", "environment_id"]) {
+    try {
+      database.run(`ALTER TABLE release_manifests ADD COLUMN ${column} TEXT`);
+    } catch (error) {
+      if (!String(error).includes("duplicate column name")) throw error;
+    }
+  }
+  try {
+    database.run("ALTER TABLE release_manifests ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE accelerator_residency_leases ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE trace_events ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  for (const column of ["authority_digest", "evidence_json"]) {
+    try {
+      database.run(`ALTER TABLE decision_evidence ADD COLUMN ${column} TEXT`);
+    } catch (error) {
+      if (!String(error).includes("duplicate column name")) throw error;
+    }
+  }
+  try {
+    database.run("ALTER TABLE mcp_invocation_provenance ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE activation_decisions ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE impact_attributions ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE decision_calibration_snapshots ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE optimization_artifacts ADD COLUMN idempotency_key TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE optimization_artifacts ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN selection_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN expansion_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN provider_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN provider_request_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN provider_usage_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE teach_runs ADD COLUMN semantic_stages_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS scope_bindings (id TEXT PRIMARY KEY, level TEXT NOT NULL, parent_id TEXT, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, workspace_id TEXT, user_id TEXT, session_id TEXT, created_at TEXT NOT NULL)");
+  database.run("CREATE TABLE IF NOT EXISTS organization_intelligence_snapshots (snapshot_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, as_of TEXT NOT NULL, evidence_digest TEXT NOT NULL, payload_json TEXT NOT NULL, created_at TEXT NOT NULL)");
+  database.run("CREATE TABLE IF NOT EXISTS mcp_sessions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, endpoint TEXT NOT NULL, protocol_version TEXT NOT NULL, status TEXT NOT NULL, auth_digest TEXT NOT NULL, generation INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, session_digest TEXT NOT NULL UNIQUE)");
+  database.run("CREATE TABLE IF NOT EXISTS oauth_states (state TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, provider TEXT NOT NULL, redirect_uri TEXT NOT NULL, scopes_json TEXT NOT NULL, expires_at TEXT NOT NULL, consumed_at TEXT)");
+  database.run("CREATE TABLE IF NOT EXISTS optimization_runs (id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, canonical_digest TEXT NOT NULL, policy_digest TEXT NOT NULL, dataset_digest TEXT NOT NULL, engine TEXT NOT NULL, status TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, cancel_requested INTEGER NOT NULL DEFAULT 0, lease_owner TEXT, lease_expires_at TEXT, search_result_digest TEXT, error_code TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, authority_digest TEXT)");
+  try {
+    database.run("ALTER TABLE optimization_runs ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS optimization_run_attempts (id TEXT PRIMARY KEY, run_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, attempt INTEGER NOT NULL, worker_id TEXT NOT NULL, status TEXT NOT NULL, request_digest TEXT, response_digest TEXT, error_code TEXT, claimed_at TEXT NOT NULL, finished_at TEXT, authority_digest TEXT)");
+  try {
+    database.run("ALTER TABLE optimization_run_attempts ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS optimization_cost_reservations (run_id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, reserved_micros INTEGER NOT NULL, actual_micros INTEGER, state TEXT NOT NULL, created_at TEXT NOT NULL, settled_at TEXT, authority_digest TEXT)");
+  try {
+    database.run("ALTER TABLE optimization_cost_reservations ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS recovery_runtime_states (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, trajectory_key TEXT NOT NULL, recovery_plan_key TEXT NOT NULL, recovery_plan_digest TEXT NOT NULL, attempt INTEGER NOT NULL, next_step_index INTEGER NOT NULL, total_execution_attempts INTEGER NOT NULL, status TEXT NOT NULL, started_at TEXT NOT NULL, updated_at TEXT NOT NULL, step_results_json TEXT NOT NULL, pending_approval_json TEXT, authority_digest TEXT, state_digest TEXT NOT NULL UNIQUE)");
+  try {
+    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN pending_approval_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS recovery_runtime_receipts (id TEXT PRIMARY KEY, runtime_state_id TEXT NOT NULL, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, application_id TEXT, environment_id TEXT NOT NULL, status TEXT NOT NULL, attempt INTEGER NOT NULL, step_results_json TEXT NOT NULL, recovery_plan_digest TEXT NOT NULL, authority_digest TEXT, completed_at TEXT NOT NULL, receipt_digest TEXT NOT NULL UNIQUE)");
+  database.run("CREATE TABLE IF NOT EXISTS behavior_artifact_blobs (artifact_digest TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, bytes TEXT NOT NULL)");
+  try {
+    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN application_id TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  try {
+    database.run("ALTER TABLE recovery_runtime_states ADD COLUMN authority_digest TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  database.run("CREATE TABLE IF NOT EXISTS conflict_resolutions (inspection_digest TEXT PRIMARY KEY, resolution_digest TEXT NOT NULL, payload_json TEXT NOT NULL)");
+  try {
+    database.run("ALTER TABLE conflict_inspections ADD COLUMN payload_json TEXT");
+  } catch (error) {
+    if (!String(error).includes("duplicate column name")) throw error;
+  }
+  const persist = async () => {
+    persistFile(filePath, database.export());
+  };
+  let transactionDepth = 0;
+  const runtime = {
+    mode: "production",
+    exec: (sql, params) => {
+      const result = database.exec(sql, params);
+      if (transactionDepth === 0 && /^\s*(INSERT|UPDATE|DELETE|REPLACE)\b/i.test(sql)) persistFile(filePath, database.export());
+      return result;
+    },
+    run: (sql, params) => {
+      const result = database.run(sql, params);
+      if (transactionDepth === 0) persistFile(filePath, database.export());
+      return result;
+    },
+    async transaction(work) {
+      if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
+      transactionDepth += 1;
+      database.run("BEGIN");
+      try {
+        const result = await work(runtime);
+        database.run("COMMIT");
+        transactionDepth -= 1;
+        await persist();
+        return result;
+      } catch (error) {
+        try {
+          database.run("ROLLBACK");
+        } catch {
+        }
+        transactionDepth = Math.max(0, transactionDepth - 1);
+        throw error;
+      }
+    },
+    transactionSync(work) {
+      if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
+      transactionDepth += 1;
+      database.run("BEGIN");
+      try {
+        const result = work(runtime);
+        database.run("COMMIT");
+        transactionDepth -= 1;
+        persistFile(filePath, database.export());
+        return result;
+      } catch (error) {
+        try {
+          database.run("ROLLBACK");
+        } catch {
+        }
+        transactionDepth = Math.max(0, transactionDepth - 1);
+        throw error;
+      }
+    },
+    async persist() {
+      await persist();
+    },
+    async reloadFromDisk() {
+      const bytes = new Uint8Array(await readFile2(filePath));
+      database.close();
+      database = new SQL.Database(bytes);
+    },
+    async backup(destination) {
+      if (!destination?.trim()) throw new Error("BACKUP_PATH_REQUIRED");
+      await writeFile(destination, Buffer.from(database.export()));
+      return destination;
+    },
+    health: () => ({ ready: true, mode: "production", storage: "file" }),
+    close: () => database.close()
+  };
+  return runtime;
+}
+var root, require2, migrationCandidates;
+var init_production_sqlite = __esm({
+  "../database/src/production-sqlite.ts"() {
+    "use strict";
+    root = dirname2(fileURLToPath2(import.meta.url));
+    require2 = createRequire(import.meta.url);
+    migrationCandidates = [
+      resolve2(root, "../migrations/001_vnext_foundation.sql"),
+      resolve2(root, "migrations/001_vnext_foundation.sql")
+    ];
+  }
+});
+
+// ../database/src/runtime-database.ts
+var runtime_database_exports = {};
+__export(runtime_database_exports, {
+  createProductionDatabase: () => createProductionDatabase,
+  openRuntimeDatabase: () => openRuntimeDatabase
+});
+async function createProductionDatabase(options = {}) {
+  const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
+  if (typeof databaseUrl !== "string" || !/^postgres(?:ql)?:\/\//.test(databaseUrl)) throw new Error("PRODUCTION_POSTGRES_DATABASE_REQUIRED");
+  return openRuntimeDatabase({ ...options, databaseUrl });
+}
+async function openRuntimeDatabase(options = {}) {
+  const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
+  if (typeof databaseUrl !== "string" || !databaseUrl.trim()) throw new Error("DATABASE_URL_REQUIRED");
+  if (databaseUrl.startsWith("file:")) {
+    if (process.env.NODE_ENV === "production" || process.env.VIRA_STACK_PROFILE === "production") throw new Error("SQLITE_FORBIDDEN_IN_PRODUCTION");
+    const database = await openProductionSqlite({ databaseUrl, ...options.sqlite });
+    return {
+      mode: "sqlite",
+      database,
+      health: () => ({ ready: true, mode: "sqlite" }),
+      close: async () => {
+        database.close();
+      }
+    };
+  }
+  if (databaseUrl.startsWith("postgres://") || databaseUrl.startsWith("postgresql://")) {
+    const database = await openPostgresRuntime({ databaseUrl, ...options.postgres });
+    return {
+      mode: "postgres",
+      database,
+      health: () => ({ ready: true, mode: "postgres" }),
+      close: async () => {
+        await database.close();
+      }
+    };
+  }
+  throw new Error("DATABASE_URL_UNSUPPORTED");
+}
+var init_runtime_database = __esm({
+  "../database/src/runtime-database.ts"() {
+    "use strict";
+    init_postgres_runtime();
+    init_production_sqlite();
+  }
+});
+
+// ../database/src/postgres-mcp-repository.ts
+var postgres_mcp_repository_exports = {};
+__export(postgres_mcp_repository_exports, {
+  PostgresMcpProvenanceRepository: () => PostgresMcpProvenanceRepository,
+  PostgresMcpSessionRepository: () => PostgresMcpSessionRepository
+});
+var provenanceSelect, PostgresMcpProvenanceRepository, PostgresMcpSessionRepository;
+var init_postgres_mcp_repository = __esm({
+  "../database/src/postgres-mcp-repository.ts"() {
+    "use strict";
+    init_mcp_provenance();
+    init_mcp_session();
+    provenanceSelect = `SELECT invocation_id, organization_id, project_id, environment_id, server, tool, receipt_id, idempotency_key, arguments_digest, ok, result_json, error, authority_decision_digest, authority_digest, provenance_digest FROM mcp_invocation_provenance`;
+    PostgresMcpProvenanceRepository = class {
+      constructor(db) {
+        this.db = db;
+      }
+      db;
+      async init() {
+        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_invocation_claims (organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, invocation_id TEXT NOT NULL, claimed_at TIMESTAMPTZ NOT NULL, PRIMARY KEY (organization_id, project_id, environment_id, idempotency_key))`);
+        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_invocation_provenance (invocation_id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, tool TEXT NOT NULL, receipt_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, arguments_digest TEXT NOT NULL, ok BOOLEAN NOT NULL, result_json JSONB, error TEXT, authority_decision_digest TEXT NOT NULL, authority_digest TEXT, provenance_digest TEXT NOT NULL, UNIQUE (organization_id, project_id, environment_id, idempotency_key))`);
+      }
+      async claim(input) {
+        const replay = await this.getByIdempotencyKey(input.idempotencyKey, input);
+        if (replay) return { status: "REPLAY", result: replay };
+        try {
+          await this.db.query(`INSERT INTO mcp_invocation_claims (organization_id,project_id,environment_id,idempotency_key,invocation_id,claimed_at) VALUES ($1,$2,$3,$4,$5,NOW())`, [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey, input.invocationId]);
+          return { status: "CLAIMED" };
+        } catch {
+          const after = await this.getByIdempotencyKey(input.idempotencyKey, input);
+          return after ? { status: "REPLAY", result: after } : { status: "IN_FLIGHT" };
+        }
+      }
+      async releaseClaim(input) {
+        await this.db.query(`DELETE FROM mcp_invocation_claims WHERE organization_id=$1 AND project_id=$2 AND environment_id=$3 AND idempotency_key=$4`, [input.organizationId, input.projectId, input.environmentId, input.idempotencyKey]);
+      }
+      async save(result) {
+        verifyMcpResult2(result);
+        const existing = await this.get(result.invocationId);
+        const byKey = await this.getByIdempotencyKey(result.idempotencyKey, result);
+        if (existing || byKey) {
+          const prior = existing ?? byKey;
+          if (prior.provenanceDigest !== result.provenanceDigest) throw new Error("MCP_PROVENANCE_CONFLICT");
+          return prior;
+        }
+        await this.db.query(`DELETE FROM mcp_invocation_claims WHERE organization_id=$1 AND project_id=$2 AND environment_id=$3 AND idempotency_key=$4`, [result.organizationId, result.projectId, result.environmentId, result.idempotencyKey]);
+        await this.db.query(`INSERT INTO mcp_invocation_provenance (invocation_id,organization_id,project_id,environment_id,server,tool,receipt_id,idempotency_key,arguments_digest,ok,result_json,error,authority_decision_digest,authority_digest,provenance_digest) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`, [result.invocationId, result.organizationId, result.projectId, result.environmentId, result.server, result.tool, result.receiptId, result.idempotencyKey, result.argumentsDigest, result.ok, result.result === void 0 ? null : JSON.stringify(result.result), result.error ?? null, result.authorityDecisionDigest, result.authorityDigest, result.provenanceDigest]);
+        const persisted = await this.get(result.invocationId);
+        if (!persisted || persisted.provenanceDigest !== result.provenanceDigest) throw new Error("MCP_PROVENANCE_READBACK_MISMATCH");
+        return persisted;
+      }
+      async get(invocationId) {
+        const row = (await this.db.query(`${provenanceSelect} WHERE invocation_id=$1`, [invocationId])).rows[0];
+        return row ? this.fromRow(row) : null;
+      }
+      async getByIdempotencyKey(key, scope) {
+        const row = (await this.db.query(`${provenanceSelect} WHERE idempotency_key=$1 AND organization_id=$2 AND project_id=$3 AND environment_id=$4`, [key, scope.organizationId, scope.projectId, scope.environmentId])).rows[0];
+        return row ? this.fromRow(row) : null;
+      }
+      fromRow(row) {
+        const result = { invocationId: String(row.invocation_id), organizationId: String(row.organization_id), projectId: String(row.project_id), environmentId: String(row.environment_id), server: String(row.server), tool: String(row.tool), receiptId: String(row.receipt_id), idempotencyKey: String(row.idempotency_key), argumentsDigest: String(row.arguments_digest), ok: Boolean(row.ok), result: row.result_json ?? void 0, error: row.error == null ? void 0 : String(row.error), authorityDecisionDigest: String(row.authority_decision_digest), authorityDigest: row.authority_digest == null ? null : String(row.authority_digest), provenanceDigest: String(row.provenance_digest) };
+        verifyMcpResult2(result);
+        return result;
+      }
+    };
+    PostgresMcpSessionRepository = class {
+      constructor(db) {
+        this.db = db;
+      }
+      db;
+      async init() {
+        await this.db.query(`CREATE TABLE IF NOT EXISTS mcp_sessions (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL, project_id TEXT NOT NULL, environment_id TEXT NOT NULL, server TEXT NOT NULL, endpoint TEXT NOT NULL, protocol_version TEXT NOT NULL, status TEXT NOT NULL, auth_digest TEXT NOT NULL, generation INTEGER NOT NULL, created_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL, session_digest TEXT NOT NULL)`);
+      }
+      async get(id, scope) {
+        const row = (await this.db.query(`SELECT id,organization_id,project_id,environment_id,server,endpoint,protocol_version,status,auth_digest,generation,created_at,updated_at,session_digest FROM mcp_sessions WHERE id=$1 AND organization_id=$2 AND project_id=$3 AND environment_id=$4`, [id, scope.organizationId, scope.projectId, scope.environmentId])).rows[0];
+        if (!row) return null;
+        const session = { id: String(row.id), organizationId: String(row.organization_id), projectId: String(row.project_id), environmentId: String(row.environment_id), server: String(row.server), endpoint: String(row.endpoint), protocolVersion: String(row.protocol_version), status: String(row.status), authDigest: String(row.auth_digest), generation: Number(row.generation), createdAt: new Date(String(row.created_at)).toISOString(), updatedAt: new Date(String(row.updated_at)).toISOString(), sessionDigest: String(row.session_digest) };
+        assertMcpSession(session);
+        return session;
+      }
+    };
+  }
+});
+
+// ../../apps/mcp-server/start.ts
+var start_exports = {};
+__export(start_exports, {
+  startMcpStdio: () => startMcpStdio
+});
+async function startMcpStdio() {
+  const base = resolveViraMcpConfig();
+  const required = ["VIRA_ORGANIZATION_ID", "VIRA_PROJECT_ID", "VIRA_ENVIRONMENT_ID"];
+  const missing = required.filter((name) => !process.env[name]?.trim());
+  if (missing.length) throw new Error(`VIRA_MCP_SCOPE_REQUIRED:${missing.join(",")}`);
+  const organizationId = process.env.VIRA_ORGANIZATION_ID;
+  const projectId = process.env.VIRA_PROJECT_ID;
+  const environmentId = process.env.VIRA_ENVIRONMENT_ID;
+  const runtime = process.env.DATABASE_URL ? await (await Promise.resolve().then(() => (init_runtime_database(), runtime_database_exports))).openRuntimeDatabase() : null;
+  const database = runtime?.mode === "sqlite" ? runtime.database : null;
+  const postgres = runtime?.mode === "postgres" ? runtime.database : null;
+  const postgresRepositories = postgres ? await Promise.resolve().then(() => (init_postgres_mcp_repository(), postgres_mcp_repository_exports)) : null;
+  const provenanceRepository = database ? new SqlMcpProvenanceRepository(database) : postgres && postgresRepositories ? new postgresRepositories.PostgresMcpProvenanceRepository(postgres) : new McpProvenanceRepository();
+  if (postgres && postgresRepositories) {
+    await new postgresRepositories.PostgresMcpProvenanceRepository(postgres).init();
+  }
+  const options = createViraMcpOptions({
+    ...base,
+    scope: {
+      organizationId,
+      projectId,
+      environmentId
+    },
+    ...database || postgres ? {
+      provenanceRepository,
+      sessionRepository: database ? new SqlMcpSessionRepository(database) : new postgresRepositories.PostgresMcpSessionRepository(postgres),
+      sessionId: process.env.VIRA_MCP_SESSION_ID
+    } : {}
+  });
+  options.invocationExecutor = ({ invocation, authority, signal }) => executeMcpInvocation({ invocation, authority, signal, transport: options.transport, store: provenanceRepository });
+  options.requireInvocationExecutor = true;
+  const useLegacy = process.env.VIRA_MCP_PROTOCOL_MODE === "legacy";
+  const stdio = useLegacy ? createMcpStdioServer(options) : serveOfficialViraMcp(options);
+  const close = () => {
+    stdio.close();
+    void runtime?.close();
+  };
+  process.once("SIGTERM", close);
+  process.once("SIGINT", close);
+}
+var init_start = __esm({
+  "../../apps/mcp-server/start.ts"() {
+    "use strict";
+    init_server();
+    init_vira_server();
+    init_mcp_session_repository();
+    init_mcp_provenance_repository();
+    init_mcp_provenance_repository();
+    init_mcp_invocation_service();
+    init_official_stdio();
+  }
+});
+
+// src/cli.ts
+init_vira_server();
+if (process.argv.includes("--http") || process.env.VIRA_MCP_TRANSPORT === "http") {
+  await startHttp();
+} else {
+  const { startMcpStdio: startMcpStdio2 } = await Promise.resolve().then(() => (init_start(), start_exports));
+  await startMcpStdio2();
+}
+async function startHttp() {
+  const base = resolveViraMcpConfig();
+  if (!base.requestAuthToken?.trim()) throw new Error("VIRA_MCP_AUTH_TOKEN_REQUIRED");
+  const scope = { organizationId: process.env.VIRA_ORGANIZATION_ID ?? "", projectId: process.env.VIRA_PROJECT_ID ?? "", environmentId: process.env.VIRA_ENVIRONMENT_ID ?? "" };
+  for (const value of Object.values(scope)) if (!value.trim()) throw new Error("VIRA_MCP_SCOPE_REQUIRED");
+  const allowLocalEffects = process.env.VIRA_MCP_ALLOW_EFFECTFUL === "true" && process.env.NODE_ENV !== "production";
+  const server = createViraMcpServer({ ...base, scope, ...allowLocalEffects ? { authorizeEffectful: () => ({ allowed: true, decisionDigest: "explicit-local-opt-in" }) } : {} });
+  const port = Number(process.env.PORT ?? 4195);
+  const host = process.env.VIRA_MCP_BIND_PUBLIC === "true" ? process.env.HOST ?? "0.0.0.0" : process.env.HOST ?? "127.0.0.1";
+  server.listen(port, host, () => console.error(JSON.stringify({ status: "VIRA_MCP_STARTED", port, host, upstream: base.baseUrl, effectful: allowLocalEffects })));
+}