contextwise 0.1.0 → 0.2.0

package/dist/{chunk-P7JW7EPW.js → chunk-5ZMX5TEM.js}

@@ -1,329 +1,14 @@
-// src/config/schema.ts
-import { z } from "zod";
-var StdioUpstreamConfigSchema = z.object({
-  command: z.string(),
-  args: z.array(z.string()).default([]),
-  env: z.record(z.string()).default({}),
-  cwd: z.string().optional(),
-  autoRestart: z.boolean().default(true)
-});
-var HttpUpstreamConfigSchema = z.object({
-  url: z.string().url(),
-  headers: z.record(z.string()).default({}),
-  transport: z.enum(["streamable-http", "sse", "auto"]).default("auto"),
-  autoReconnect: z.boolean().default(true)
-});
-var UpstreamServerConfigSchema = z.union([
-  StdioUpstreamConfigSchema,
-  HttpUpstreamConfigSchema
-]);
-function warnIfInsecureHttp(urlStr, headers) {
-  try {
-    const parsed = new URL(urlStr);
-    if (parsed.protocol === "http:") {
-      const isLocalhost = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(parsed.hostname);
-      if (!isLocalhost && headers) {
-        const hasAuthHeader = Object.keys(headers).some(
-          (h) => ["authorization", "cookie", "x-api-key", "api-key", "token"].includes(h.toLowerCase())
-        );
-        if (hasAuthHeader) {
-          console.warn(
-            `[SECURITY WARNING] Upstream URL "${urlStr}" is using unencrypted HTTP with sensitive authentication headers to non-localhost destination "${parsed.hostname}".`
-          );
-        }
-      }
-    }
-  } catch {
-  }
-}
-function isStdioUpstream(config) {
-  return "command" in config;
-}
-function isHttpUpstream(config) {
-  return "url" in config;
-}
-var ProxyConfigSchema = z.object({
-  transport: z.enum(["stdio", "sse", "http"]).default("stdio"),
-  port: z.number().int().min(1024).max(65535).default(3456),
-  logLevel: z.enum(["debug", "info", "warn", "error", "silent"]).default("info")
-});
-var RoutingConfigSchema = z.object({
-  strategy: z.enum(["hybrid", "bm25", "vector", "passthrough"]).default("hybrid"),
-  topK: z.number().int().min(1).max(50).default(5),
-  similarityThreshold: z.number().min(0).max(1).default(0.45),
-  pinnedTools: z.array(z.string()).default([]),
-  maxActiveTools: z.number().int().min(1).max(100).default(10),
-  enableBrowseServers: z.boolean().default(false),
-  enableAddServer: z.boolean().default(false),
-  allowCustomCommands: z.boolean().default(false),
-  persistAddedServers: z.boolean().default(false)
-});
-var GuardrailsConfigSchema = z.object({
-  enableCache: z.boolean().default(true),
-  cacheTtlSeconds: z.number().int().min(1).default(120),
-  maxCallsPerMinute: z.number().int().min(1).default(60),
-  loopBreakerThreshold: z.number().int().min(1).default(3),
-  callTimeoutMs: z.number().int().min(1e3).default(3e4)
-});
-var ContextWiseConfigSchema = z.object({
-  $schema: z.string().optional(),
-  version: z.string().default("1.0.0"),
-  proxy: ProxyConfigSchema.default({}),
-  routing: RoutingConfigSchema.default({}),
-  guardrails: GuardrailsConfigSchema.default({}),
-  upstreams: z.record(UpstreamServerConfigSchema).default({})
-});
-
-// src/vault/redaction.ts
-var RedactionFilter = class _RedactionFilter {
-  static instance = null;
-  registeredSecrets = /* @__PURE__ */ new Set();
-  static getInstance() {
-    if (!_RedactionFilter.instance) {
-      _RedactionFilter.instance = new _RedactionFilter();
-    }
-    return _RedactionFilter.instance;
-  }
-  /**
-   * Registers a plaintext secret value to be masked across all output streams.
-   */
-  registerSecret(secret) {
-    if (secret && typeof secret === "string") {
-      const trimmed = secret.trim();
-      if (trimmed.length >= 4) {
-        this.registeredSecrets.add(trimmed);
-      }
-    }
-  }
-  registerSecrets(secrets) {
-    for (const s of secrets) {
-      this.registerSecret(s);
-    }
-  }
-  getRegisteredCount() {
-    return this.registeredSecrets.size;
-  }
-  clear() {
-    this.registeredSecrets.clear();
-  }
-  /**
-   * Redacts registered secrets and known API key patterns from an input string.
-   */
-  redact(input) {
-    if (!input || typeof input !== "string") {
-      return input;
-    }
-    let sanitized = input;
-    for (const secret of this.registeredSecrets) {
-      sanitized = sanitized.replaceAll(secret, "[REDACTED_SECRET]");
-    }
-    sanitized = sanitized.replace(/ghp_[a-zA-Z0-9]{36}/g, "ghp_[REDACTED_GITHUB_TOKEN]");
-    sanitized = sanitized.replace(/sk-ant-[a-zA-Z0-9_-]{20,}/g, "sk-ant-[REDACTED_ANTHROPIC_KEY]");
-    sanitized = sanitized.replace(/sk-[a-zA-Z0-9]{32,}/g, "sk-[REDACTED_OPENAI_KEY]");
-    sanitized = sanitized.replace(
-      /([a-zA-Z0-9+]+:\/\/[^:]+:)([^@]+)(@.+)/g,
-      "$1[REDACTED_PASSWORD]$3"
-    );
-    return sanitized;
-  }
-};
-var redactionFilter = RedactionFilter.getInstance();
-
-// src/utils/logger.ts
-var LOG_LEVELS = {
-  debug: 10,
-  info: 20,
-  warn: 30,
-  error: 40,
-  silent: 100
-};
-var Logger = class {
-  level = "info";
-  prefix;
-  constructor(prefix = "ContextWise", level = "info") {
-    this.prefix = prefix;
-    this.level = level;
-  }
-  setLevel(level) {
-    this.level = level;
-  }
-  getLevel() {
-    return this.level;
-  }
-  shouldLog(level) {
-    return LOG_LEVELS[level] >= LOG_LEVELS[this.level];
-  }
-  formatMessage(level, message, meta) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const metaStr = meta !== void 0 ? ` ${typeof meta === "object" ? JSON.stringify(meta) : String(meta)}` : "";
-    const raw = `[${timestamp}] [${level.toUpperCase()}] [${this.prefix}] ${message}${metaStr}
-`;
-    return redactionFilter.redact(raw);
-  }
-  debug(message, meta) {
-    if (this.shouldLog("debug")) {
-      process.stderr.write(this.formatMessage("DEBUG", message, meta));
-    }
-  }
-  info(message, meta) {
-    if (this.shouldLog("info")) {
-      process.stderr.write(this.formatMessage("INFO", message, meta));
-    }
-  }
-  warn(message, meta) {
-    if (this.shouldLog("warn")) {
-      process.stderr.write(this.formatMessage("WARN", message, meta));
-    }
-  }
-  error(message, meta) {
-    if (this.shouldLog("error")) {
-      process.stderr.write(this.formatMessage("ERROR", message, meta));
-    }
-  }
-};
-var logger = new Logger("ContextWise");
-
-// src/config/loader.ts
-import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { isAbsolute, join, resolve } from "path";
-var ConfigLoader = class {
-  /**
-   * Discovers and loads configuration from contextwise.json or imported client configs.
-   */
-  static load(options = {}) {
-    const cwd = options.cwd ?? process.cwd();
-    if (process.env.CONTEXTWISE_CONFIG && !options.configPath) {
-      const envPath = isAbsolute(process.env.CONTEXTWISE_CONFIG) ? process.env.CONTEXTWISE_CONFIG : resolve(cwd, process.env.CONTEXTWISE_CONFIG);
-      if (existsSync(envPath)) {
-        return this.parseConfigFile(envPath);
-      }
-    }
-    if (options.configPath) {
-      const explicitPath = isAbsolute(options.configPath) ? options.configPath : resolve(cwd, options.configPath);
-      if (existsSync(explicitPath)) {
-        return this.parseConfigFile(explicitPath);
-      }
-      throw new Error(`Configuration file not found at: ${explicitPath}`);
-    }
-    const candidatePaths = [
-      resolve(cwd, "contextwise.json"),
-      resolve(cwd, ".contextwise.json"),
-      resolve(cwd, ".contextwise/config.json"),
-      resolve(homedir(), ".contextwise/config.json")
-    ];
-    for (const candidate of candidatePaths) {
-      if (existsSync(candidate)) {
-        logger.debug(`Loaded configuration from ${candidate}`);
-        return this.parseConfigFile(candidate);
-      }
-    }
-    if (options.autoImport !== false) {
-      const imported = this.autoImportClientConfigs(cwd);
-      if (imported && Object.keys(imported.upstreams).length > 0) {
-        logger.info(`Auto-discovered MCP servers from existing client configurations`);
-        return imported;
-      }
-    }
-    logger.debug("No configuration file found. Using defaults.");
-    return ContextWiseConfigSchema.parse({});
-  }
-  /**
-   * Parses and validates a JSON file against ContextWiseConfigSchema.
-   */
-  static parseConfigFile(filePath) {
-    try {
-      const raw = readFileSync(filePath, "utf-8");
-      const parsed = JSON.parse(raw);
-      return ContextWiseConfigSchema.parse(parsed);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      throw new Error(`Failed to parse config at ${filePath}: ${msg}`);
-    }
-  }
-  /**
-   * Scans for Cursor and Claude Desktop configs to auto-import upstreams.
-   */
-  static autoImportClientConfigs(cwd) {
-    const upstreams = {};
-    const cursorMcp = resolve(cwd, ".cursor", "mcp.json");
-    if (existsSync(cursorMcp)) {
-      try {
-        const raw = JSON.parse(readFileSync(cursorMcp, "utf-8"));
-        if (raw.mcpServers && typeof raw.mcpServers === "object") {
-          for (const [name, server] of Object.entries(raw.mcpServers)) {
-            if (name === "contextwise") continue;
-            const s = server;
-            if (typeof s.command === "string") {
-              upstreams[name] = {
-                command: s.command,
-                args: Array.isArray(s.args) ? s.args : [],
-                env: s.env ?? {},
-                autoRestart: true
-              };
-            } else if (typeof s.url === "string") {
-              upstreams[name] = {
-                url: s.url,
-                headers: s.headers ?? {},
-                transport: "auto",
-                autoReconnect: true
-              };
-            }
-          }
-        }
-      } catch (err) {
-        logger.warn(`Failed reading ${cursorMcp}: ${err}`);
-      }
-    }
-    const claudePath = this.getClaudeDesktopConfigPath();
-    if (claudePath && existsSync(claudePath)) {
-      try {
-        const raw = JSON.parse(readFileSync(claudePath, "utf-8"));
-        if (raw.mcpServers && typeof raw.mcpServers === "object") {
-          for (const [name, server] of Object.entries(raw.mcpServers)) {
-            if (name === "contextwise") continue;
-            const s = server;
-            if (typeof s.command === "string" && !upstreams[name]) {
-              upstreams[name] = {
-                command: s.command,
-                args: Array.isArray(s.args) ? s.args : [],
-                env: s.env ?? {},
-                autoRestart: true
-              };
-            } else if (typeof s.url === "string" && !upstreams[name]) {
-              upstreams[name] = {
-                url: s.url,
-                headers: s.headers ?? {},
-                transport: "auto",
-                autoReconnect: true
-              };
-            }
-          }
-        }
-      } catch (err) {
-        logger.warn(`Failed reading Claude config at ${claudePath}: ${err}`);
-      }
-    }
-    if (Object.keys(upstreams).length === 0) {
-      return null;
-    }
-    return ContextWiseConfigSchema.parse({
-      upstreams
-    });
-  }
-  static getClaudeDesktopConfigPath() {
-    const platform3 = process.platform;
-    const home = homedir();
-    if (platform3 === "win32") {
-      const appData = process.env.APPDATA || join(home, "AppData", "Roaming");
-      return join(appData, "Claude", "claude_desktop_config.json");
-    } else if (platform3 === "darwin") {
-      return join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-    } else {
-      return join(home, ".config", "Claude", "claude_desktop_config.json");
-    }
-  }
-};
+import {
+  ContextWiseConfigSchema,
+  EncryptedFileVaultDriver,
+  isHttpUpstream,
+  isStdioUpstream,
+  warnIfInsecureHttp
+} from "./chunk-OYCA37PJ.js";
+import {
+  logger,
+  redactionFilter
+} from "./chunk-WP7RH2Z2.js";
 
 // src/core/supervisor.ts
 import { execSync } from "child_process";
@@ -419,239 +104,9 @@ var ProcessSupervisor = class _ProcessSupervisor {
 };
 var supervisor = ProcessSupervisor.getInstance();
 
-// src/vault/crypto.ts
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  createPrivateKey,
-  createPublicKey,
-  diffieHellman,
-  generateKeyPairSync,
-  pbkdf2,
-  randomBytes
-} from "crypto";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { arch, homedir as homedir2, hostname, platform, userInfo } from "os";
-import { join as join2 } from "path";
-function encryptAesGcm(plaintext, key) {
-  if (key.length !== 32) {
-    throw new Error(`Invalid AES-256 key length: expected 32 bytes, got ${key.length}`);
-  }
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  let ciphertext = cipher.update(plaintext, "utf-8", "base64");
-  ciphertext += cipher.final("base64");
-  const authTag = cipher.getAuthTag();
-  return {
-    iv: iv.toString("base64"),
-    authTag: authTag.toString("base64"),
-    ciphertext
-  };
-}
-function decryptAesGcm(ciphertext, key, ivBase64, authTagBase64) {
-  if (key.length !== 32) {
-    throw new Error(`Invalid AES-256 key length: expected 32 bytes, got ${key.length}`);
-  }
-  const iv = Buffer.from(ivBase64, "base64");
-  const authTag = Buffer.from(authTagBase64, "base64");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(authTag);
-  let decrypted = decipher.update(ciphertext, "base64", "utf-8");
-  decrypted += decipher.final("utf-8");
-  return decrypted;
-}
-var VAULT_PBKDF2_ITERATIONS = 21e4;
-function deriveKeyFromPassphrase(passphrase, salt, iterations = VAULT_PBKDF2_ITERATIONS) {
-  return new Promise((resolve4, reject) => {
-    pbkdf2(passphrase, salt, iterations, 32, "sha512", (err, derivedKey) => {
-      if (err) reject(err);
-      else resolve4(derivedKey);
-    });
-  });
-}
-async function getOrCreateMachineKey() {
-  const saltDir = join2(homedir2(), ".contextwise");
-  const saltPath = join2(saltDir, ".machine_salt");
-  let salt;
-  if (existsSync2(saltPath)) {
-    salt = readFileSync2(saltPath);
-  } else {
-    mkdirSync(saltDir, { recursive: true });
-    salt = randomBytes(32);
-    writeFileSync(saltPath, salt, { mode: 384 });
-  }
-  if (process.env.CONTEXTWISE_VAULT_PASSPHRASE) {
-    return deriveKeyFromPassphrase(process.env.CONTEXTWISE_VAULT_PASSPHRASE, salt, VAULT_PBKDF2_ITERATIONS);
-  }
-  const user = (() => {
-    try {
-      return userInfo().username;
-    } catch {
-      return "default_user";
-    }
-  })();
-  const machineId = `${hostname()}-${user}-${platform()}-${arch()}-contextwise-vault-v1`;
-  return deriveKeyFromPassphrase(machineId, salt, VAULT_PBKDF2_ITERATIONS);
-}
-function generateKeyPairX25519() {
-  const { publicKey, privateKey } = generateKeyPairSync("x25519", {
-    publicKeyEncoding: { type: "spki", format: "pem" },
-    privateKeyEncoding: { type: "pkcs8", format: "pem" }
-  });
-  return { publicKey, privateKey };
-}
-function deriveSharedSecretX25519(privateKeyPem, publicKeyPem) {
-  const privateKey = createPrivateKey(privateKeyPem);
-  const publicKey = createPublicKey(publicKeyPem);
-  const shared = diffieHellman({
-    privateKey,
-    publicKey
-  });
-  return createHash("sha256").update(shared).digest();
-}
-
-// src/vault/file_driver.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-function getDefaultVaultFilePath() {
-  if (process.env.CONTEXTWISE_VAULT_PATH) {
-    return process.env.CONTEXTWISE_VAULT_PATH;
-  }
-  if (process.env.CONTEXTWISE_STORAGE_DIR) {
-    return join3(process.env.CONTEXTWISE_STORAGE_DIR, "vault.enc.json");
-  }
-  return join3(homedir3(), ".contextwise", "vault.enc.json");
-}
-var EncryptedFileVaultDriver = class {
-  name = "encrypted_file";
-  filePath;
-  keyPromise;
-  cache = null;
-  constructor(filePath, customKey) {
-    this.filePath = filePath ?? getDefaultVaultFilePath();
-    this.keyPromise = customKey ? Promise.resolve(customKey) : getOrCreateMachineKey();
-  }
-  async isAvailable() {
-    return true;
-  }
-  async load() {
-    if (this.cache) {
-      return this.cache;
-    }
-    this.cache = /* @__PURE__ */ new Map();
-    if (!existsSync3(this.filePath)) {
-      return this.cache;
-    }
-    try {
-      const raw = readFileSync3(this.filePath, "utf-8");
-      const payload = JSON.parse(raw);
-      if (payload.cipher !== "aes-256-gcm" || !payload.data) {
-        logger.warn(`Corrupt or incompatible vault file at ${this.filePath}`);
-        return this.cache;
-      }
-      const key = await this.keyPromise;
-      const decryptedJson = decryptAesGcm(payload.data, key, payload.iv, payload.authTag);
-      const entries = JSON.parse(decryptedJson);
-      for (const [k, v] of Object.entries(entries)) {
-        this.cache.set(k, v);
-      }
-    } catch (err) {
-      logger.warn(`Failed to decrypt vault file at ${this.filePath}: ${err}`);
-    }
-    return this.cache;
-  }
-  async persist() {
-    if (!this.cache) return;
-    const dir = dirname2(this.filePath);
-    if (!existsSync3(dir)) {
-      mkdirSync2(dir, { recursive: true });
-    }
-    const key = await this.keyPromise;
-    const entries = {};
-    for (const [k, v] of this.cache.entries()) {
-      entries[k] = v;
-    }
-    const plaintext = JSON.stringify(entries);
-    const { iv, authTag, ciphertext } = encryptAesGcm(plaintext, key);
-    const payload = {
-      version: 1,
-      kdf: {
-        algorithm: "pbkdf2-sha512",
-        salt: "machine-bound",
-        iterations: VAULT_PBKDF2_ITERATIONS
-      },
-      cipher: "aes-256-gcm",
-      iv,
-      authTag,
-      data: ciphertext
-    };
-    const tempPath = `${this.filePath}.${Date.now()}.tmp`;
-    writeFileSync2(tempPath, JSON.stringify(payload, null, 2), { mode: 384, encoding: "utf-8" });
-    try {
-      renameSync(tempPath, this.filePath);
-    } catch {
-      writeFileSync2(this.filePath, JSON.stringify(payload, null, 2), { mode: 384, encoding: "utf-8" });
-      try {
-        unlinkSync(tempPath);
-      } catch {
-      }
-    }
-  }
-  async get(key) {
-    const store = await this.load();
-    const entry = store.get(key);
-    return entry ? entry.value : null;
-  }
-  async set(key, value, scope = "personal") {
-    const store = await this.load();
-    const now = Date.now();
-    const existing = store.get(key);
-    store.set(key, {
-      value,
-      metadata: {
-        key,
-        scope,
-        backend: this.name,
-        createdAt: existing?.metadata.createdAt ?? now,
-        updatedAt: now
-      }
-    });
-    await this.persist();
-    logger.debug(`Stored secret "${key}" in ${this.name} vault`);
-  }
-  async delete(key) {
-    const store = await this.load();
-    if (!store.has(key)) {
-      return false;
-    }
-    store.delete(key);
-    await this.persist();
-    logger.debug(`Deleted secret "${key}" from ${this.name} vault`);
-    return true;
-  }
-  async list() {
-    const store = await this.load();
-    return Array.from(store.values()).map((e) => e.metadata);
-  }
-  /**
-   * Resets and clears all cached and persisted secrets.
-   */
-  async clear() {
-    this.cache = /* @__PURE__ */ new Map();
-    if (existsSync3(this.filePath)) {
-      try {
-        unlinkSync(this.filePath);
-      } catch {
-      }
-    }
-  }
-};
-
 // src/vault/os_driver.ts
 import { execFileSync } from "child_process";
-import { platform as platform2 } from "os";
+import { platform } from "os";
 var OsKeystoreDriver = class {
   name = "os_keystore";
   available = null;
@@ -660,7 +115,7 @@ var OsKeystoreDriver = class {
     if (this.available !== null) {
       return this.available;
     }
-    const currentPlatform = platform2();
+    const currentPlatform = platform();
     try {
       if (currentPlatform === "darwin") {
         execFileSync("/usr/bin/security", ["list-keychains"], { stdio: "ignore" });
@@ -678,7 +133,7 @@ var OsKeystoreDriver = class {
     if (!await this.isAvailable()) {
       return null;
     }
-    const currentPlatform = platform2();
+    const currentPlatform = platform();
     try {
       if (currentPlatform === "darwin") {
         const stdout = execFileSync(
@@ -697,7 +152,7 @@ var OsKeystoreDriver = class {
     if (!await this.isAvailable()) {
       throw new Error("OS Keystore driver is not available on this system.");
     }
-    const currentPlatform = platform2();
+    const currentPlatform = platform();
     if (currentPlatform === "darwin") {
       execFileSync(
         "/usr/bin/security",
@@ -712,7 +167,7 @@ var OsKeystoreDriver = class {
     if (!await this.isAvailable()) {
       return false;
     }
-    const currentPlatform = platform2();
+    const currentPlatform = platform();
     try {
       if (currentPlatform === "darwin") {
         execFileSync(
@@ -889,9 +344,9 @@ var VaultAuditor = class {
 };
 
 // src/vault/resolver.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 var SecretResolver = class {
   /**
    * Resolves a single secret token reference (vault://, auth://, env://).
@@ -927,10 +382,10 @@ var SecretResolver = class {
       if (!serverKey) {
         throw new Error('Invalid auth reference format: expected "auth://<server>"');
       }
-      const mcpAuthPath = join4(homedir4(), ".local", "share", "opencode", "mcp-auth.json");
-      if (existsSync4(mcpAuthPath)) {
+      const mcpAuthPath = join(homedir(), ".local", "share", "opencode", "mcp-auth.json");
+      if (existsSync(mcpAuthPath)) {
         try {
-          const authData = JSON.parse(readFileSync4(mcpAuthPath, "utf-8"));
+          const authData = JSON.parse(readFileSync(mcpAuthPath, "utf-8"));
           const token = authData[serverKey]?.tokens?.accessToken;
           if (token) {
             redactionFilter.registerSecret(token);
@@ -1731,7 +1186,7 @@ var ToolRegistry = class {
 var toolRegistry = new ToolRegistry();
 
 // src/guardrails/validator.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
 var ToolArgumentValidator = class {
@@ -1750,7 +1205,7 @@ var ToolArgumentValidator = class {
   }
   computeSchemaHash(schema) {
     try {
-      return createHash2("sha256").update(JSON.stringify(schema ?? "")).digest("hex").slice(0, 16);
+      return createHash("sha256").update(JSON.stringify(schema ?? "")).digest("hex").slice(0, 16);
     } catch {
       return "static";
     }
@@ -1797,7 +1252,7 @@ var ToolArgumentValidator = class {
 var argumentValidator = new ToolArgumentValidator();
 
 // src/utils/hash.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function canonicalJsonStringify(obj, seen = /* @__PURE__ */ new WeakSet()) {
   if (obj === null || obj === void 0) {
     return "null";
@@ -1823,7 +1278,7 @@ function canonicalJsonStringify(obj, seen = /* @__PURE__ */ new WeakSet()) {
   return "{" + pairs.join(",") + "}";
 }
 function sha256(input) {
-  return createHash3("sha256").update(input).digest("hex");
+  return createHash2("sha256").update(input).digest("hex");
 }
 function generateToolCallCacheKey(serverName, toolName, args = {}) {
   const canonicalArgs = canonicalJsonStringify(args);
@@ -2015,9 +1470,9 @@ var RunawayLoopBreaker = class {
 var loopBreaker = new RunawayLoopBreaker();
 
 // src/metrics/collector.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
 var SCHEMA_TOKENS_PER_TOOL = 150;
 var CACHE_TOKENS_PER_HIT = 800;
 var LOOP_PREVENTION_TOKENS_PER_TRIP = 2500;
@@ -2043,7 +1498,7 @@ function getDefaultMetricsPath() {
   if (process.env.CONTEXTWISE_METRICS_PATH) {
     return process.env.CONTEXTWISE_METRICS_PATH;
   }
-  return join5(homedir5(), ".contextwise", "metrics.json");
+  return join2(homedir2(), ".contextwise", "metrics.json");
 }
 var MetricsCollector = class {
   storagePath;
@@ -2091,8 +1546,8 @@ var MetricsCollector = class {
   }
   loadFromDisk() {
     try {
-      if (existsSync5(this.storagePath)) {
-        const raw = readFileSync5(this.storagePath, "utf-8");
+      if (existsSync2(this.storagePath)) {
+        const raw = readFileSync2(this.storagePath, "utf-8");
         const parsed = JSON.parse(raw);
         if (parsed && typeof parsed === "object") {
           this.data = {
@@ -2126,17 +1581,17 @@ var MetricsCollector = class {
       this.debounceTimer = null;
     }
     try {
-      const dir = dirname3(this.storagePath);
-      if (!existsSync5(dir)) {
-        mkdirSync3(dir, { recursive: true });
+      const dir = dirname(this.storagePath);
+      if (!existsSync2(dir)) {
+        mkdirSync(dir, { recursive: true });
       }
       const tempFile = `${this.storagePath}.${Date.now()}.tmp`;
       const json = JSON.stringify(this.data, null, 2);
-      writeFileSync3(tempFile, json, "utf-8");
-      renameSync2(tempFile, this.storagePath);
+      writeFileSync(tempFile, json, "utf-8");
+      renameSync(tempFile, this.storagePath);
     } catch {
       try {
-        writeFileSync3(this.storagePath, JSON.stringify(this.data, null, 2), "utf-8");
+        writeFileSync(this.storagePath, JSON.stringify(this.data, null, 2), "utf-8");
       } catch (err) {
         logger.debug(`Failed persisting metrics: ${err}`);
       }
@@ -2272,6 +1727,9 @@ var SEARCH_TOOLS_NAME = "contextwise_search_tools";
 var EXECUTE_TOOL_NAME = "contextwise_execute_tool";
 var BROWSE_SERVERS_NAME = "contextwise_browse_servers";
 var ADD_SERVER_NAME = "contextwise_add_server";
+var CLOUD_PUSH_NAME = "contextwise_cloud_push";
+var CLOUD_PULL_NAME = "contextwise_cloud_pull";
+var SYNC_STATUS_NAME = "contextwise_sync_status";
 var SEARCH_TOOLS_DEFINITION = {
   name: SEARCH_TOOLS_NAME,
   description: "Searches ContextWise tool catalog for relevant tools based on natural language intent. Returns matched tool signatures, parameter descriptions, and automatically makes them available to invoke.",
@@ -2383,6 +1841,40 @@ var ADD_SERVER_DEFINITION = {
     required: ["name"]
   }
 };
+var CLOUD_PUSH_DEFINITION = {
+  name: CLOUD_PUSH_NAME,
+  description: "Pushes the host ContextWise workspace snapshot (config + encrypted vault) to ContextWise Cloud. Usage-metered via MCPaid.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      workspaceId: {
+        type: "string",
+        description: "Optional workspace ID (defaults to the active workspace)"
+      }
+    }
+  }
+};
+var CLOUD_PULL_DEFINITION = {
+  name: CLOUD_PULL_NAME,
+  description: "Pulls and applies the latest ContextWise Cloud workspace revision to the host. Usage-metered via MCPaid.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      workspaceId: {
+        type: "string",
+        description: "Optional workspace ID (defaults to the active workspace)"
+      }
+    }
+  }
+};
+var SYNC_STATUS_DEFINITION = {
+  name: SYNC_STATUS_NAME,
+  description: "Reports ContextWise Cloud sync status for the host instance (login state, workspace, local revision). Always free.",
+  inputSchema: {
+    type: "object",
+    properties: {}
+  }
+};
 
 // src/registry/known_servers.ts
 var KNOWN_SERVERS = [
@@ -2939,25 +2431,25 @@ var ServerRecommender = class {
 };
 
 // src/registry/manager.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve } from "path";
 var ServerManager = class {
   /**
    * Finds the path to contextwise.json in the current working directory.
    */
   static findConfigPath(customPath, cwd = process.cwd()) {
     if (customPath) {
-      return resolve2(cwd, customPath);
+      return resolve(cwd, customPath);
     }
     if (process.env.CONTEXTWISE_CONFIG) {
-      return resolve2(cwd, process.env.CONTEXTWISE_CONFIG);
+      return resolve(cwd, process.env.CONTEXTWISE_CONFIG);
     }
-    const standardPath = resolve2(cwd, "contextwise.json");
-    if (existsSync6(standardPath)) {
+    const standardPath = resolve(cwd, "contextwise.json");
+    if (existsSync3(standardPath)) {
       return standardPath;
     }
-    const dotPath = resolve2(cwd, ".contextwise.json");
-    if (existsSync6(dotPath)) {
+    const dotPath = resolve(cwd, ".contextwise.json");
+    if (existsSync3(dotPath)) {
       return dotPath;
     }
     return standardPath;
@@ -2967,14 +2459,14 @@ var ServerManager = class {
    */
   static loadConfig(configPath, cwd = process.cwd()) {
     const filePath = this.findConfigPath(configPath, cwd);
-    if (!existsSync6(filePath)) {
+    if (!existsSync3(filePath)) {
       return {
         config: ContextWiseConfigSchema.parse({}),
         path: filePath
       };
     }
     try {
-      const raw = readFileSync6(filePath, "utf-8");
+      const raw = readFileSync3(filePath, "utf-8");
       return {
         config: ContextWiseConfigSchema.parse(JSON.parse(raw)),
         path: filePath
@@ -2993,11 +2485,11 @@ var ServerManager = class {
   static saveUpstream(name, serverConfig, configPath, cwd = process.cwd()) {
     const { config, path: filePath } = this.loadConfig(configPath, cwd);
     config.upstreams[name] = serverConfig;
-    const dir = dirname4(filePath);
-    if (!existsSync6(dir)) {
-      mkdirSync4(dir, { recursive: true });
+    const dir = dirname2(filePath);
+    if (!existsSync3(dir)) {
+      mkdirSync2(dir, { recursive: true });
     }
-    writeFileSync4(filePath, JSON.stringify(config, null, 2), "utf-8");
+    writeFileSync2(filePath, JSON.stringify(config, null, 2), "utf-8");
     logger.info(`Persisted upstream "${name}" into ${filePath}`);
     return filePath;
   }
@@ -3010,15 +2502,15 @@ var ServerManager = class {
       return false;
     }
     delete config.upstreams[name];
-    writeFileSync4(filePath, JSON.stringify(config, null, 2), "utf-8");
+    writeFileSync2(filePath, JSON.stringify(config, null, 2), "utf-8");
     logger.info(`Removed upstream "${name}" from ${filePath}`);
     return true;
   }
 };
 
 // src/router/workspace.ts
-import { existsSync as existsSync7, readdirSync } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync4, readdirSync } from "fs";
+import { resolve as resolve2 } from "path";
 var WorkspaceContextPrimer = class {
   /**
    * Scans a workspace directory to detect technical domains and pre-prime relevant tools.
@@ -3027,14 +2519,14 @@ var WorkspaceContextPrimer = class {
     const domains = /* @__PURE__ */ new Set();
     const queries = /* @__PURE__ */ new Set();
     try {
-      if (!existsSync7(dirPath)) {
+      if (!existsSync4(dirPath)) {
         return { detectedDomains: [], suggestedQueries: [] };
       }
-      if (existsSync7(resolve3(dirPath, ".git"))) {
+      if (existsSync4(resolve2(dirPath, ".git"))) {
         domains.add("git");
         queries.add("git status and diff tools");
       }
-      if (existsSync7(resolve3(dirPath, "Dockerfile")) || existsSync7(resolve3(dirPath, "docker-compose.yml")) || existsSync7(resolve3(dirPath, "compose.yaml"))) {
+      if (existsSync4(resolve2(dirPath, "Dockerfile")) || existsSync4(resolve2(dirPath, "docker-compose.yml")) || existsSync4(resolve2(dirPath, "compose.yaml"))) {
         domains.add("docker");
         queries.add("docker and container tools");
       }
@@ -3072,6 +2564,7 @@ var ContextRouter = class {
       maxActiveTools: config.maxActiveTools ?? 10,
       enableBrowseServers: config.enableBrowseServers ?? false,
       enableAddServer: config.enableAddServer ?? false,
+      enableCloudSync: config.enableCloudSync ?? true,
       allowCustomCommands: config.allowCustomCommands ?? false,
       persistAddedServers: config.persistAddedServers ?? false
     };
@@ -3170,6 +2663,9 @@ ${manifest}` : SEARCH_TOOLS_DEFINITION.description
     if (this.config.enableAddServer) {
       metaTools.push(ADD_SERVER_DEFINITION);
     }
+    if (this.config.enableCloudSync) {
+      metaTools.push(CLOUD_PUSH_DEFINITION, CLOUD_PULL_DEFINITION, SYNC_STATUS_DEFINITION);
+    }
     const metaToolNames = new Set(metaTools.map((m) => m.name));
     const safeActiveTools = activeTools.filter((t) => !metaToolNames.has(t.name));
     return [...metaTools, ...safeActiveTools];
@@ -3247,15 +2743,33 @@ import {
   CallToolRequestSchema,
   ListToolsRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
+import { AsyncLocalStorage } from "async_hooks";
+import { parseAndVerifyEdgeReceipt, MemoryReceiptStore } from "@mcpaid/sdk";
+var requestContext = new AsyncLocalStorage();
 var ContextWiseProxy = class {
   server;
   multiplexer;
   router;
   transport;
+  httpServers = [];
+  httpTransports = [];
   config;
   isRunning = false;
+  // Single-use receipt registry: bounded (FIFO cap) with expired-first eviction.
+  claimedReceiptNonces = new MemoryReceiptStore();
   constructor() {
-    this.server = new Server(
+    this.server = this.createSessionServer();
+    this.multiplexer = new UpstreamMultiplexer();
+    this.router = contextRouter;
+  }
+  /**
+   * Builds a Session-scoped MCP Server whose handlers delegate to the shared
+   * engine (router, multiplexer, cloud clients). One instance per HTTP
+   * session — the MCP SDK binds a Server to a single transport, and sharing
+   * one Server across sessions breaks repeat handshakes.
+   */
+  createSessionServer() {
+    const server = new Server(
       {
         name: "contextwise",
         version: "0.1.0"
@@ -3268,12 +2782,12 @@ var ContextWiseProxy = class {
         }
       }
     );
-    this.multiplexer = new UpstreamMultiplexer();
-    this.router = contextRouter;
-    this.setupRequestHandlers();
+    this.setupRequestHandlers(server);
+    return server;
   }
-  setupRequestHandlers() {
-    this.server.setRequestHandler(ListToolsRequestSchema, async () => {
+  setupRequestHandlers(server) {
+    const target = server ?? this.server;
+    target.setRequestHandler(ListToolsRequestSchema, async () => {
       const exposedTools = this.router.getExposedTools();
       const allToolsCount = toolRegistry.getAllTools().length;
       metricsCollector.updateToolCounts(allToolsCount, exposedTools.length);
@@ -3285,7 +2799,7 @@ var ContextWiseProxy = class {
         tools: exposedTools
       };
     });
-    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    target.setRequestHandler(CallToolRequestSchema, async (request) => {
       const { name, arguments: args = {} } = request.params;
       return this.handleToolCall(name, args);
     });
@@ -3293,7 +2807,7 @@ var ContextWiseProxy = class {
   /**
    * Main tool execution pipeline handling meta-tools and proxied calls.
    */
-  async handleToolCall(name, args = {}) {
+  async handleToolCall(name, args = {}, receipt) {
     if (name === SEARCH_TOOLS_NAME) {
       return this.handleSearchToolsCall(args);
     }
@@ -3319,6 +2833,15 @@ var ContextWiseProxy = class {
     if (name === ADD_SERVER_NAME) {
       return this.handleAddServerCall(args);
     }
+    if (name === CLOUD_PUSH_NAME) {
+      return this.handleCloudPushCall(args, receipt);
+    }
+    if (name === CLOUD_PULL_NAME) {
+      return this.handleCloudPullCall(args, receipt);
+    }
+    if (name === SYNC_STATUS_NAME) {
+      return this.handleSyncStatusCall();
+    }
     return this.dispatchProxiedToolCall(name, args);
   }
   /**
@@ -3576,6 +3099,68 @@ These tools are now indexed, ${persistMsg}and ready for immediate invocation in
       ]
     };
   }
+  /**
+   * Handles metered cloud-sync meta-tool calls. These operate on the host
+   * instance's workspace via its stored ContextWise Cloud session.
+   */
+  async handleCloudPushCall(args, receipt) {
+    const { syncManager } = await import("./sync_manager-2WYXXGCN.js");
+    const { cloudClient } = await import("./client-3GQWPGI3.js");
+    if (!cloudClient.isAuthenticated()) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: 'Error: Host instance is not logged in to ContextWise Cloud. Run "contextwise login" on the host.' }]
+      };
+    }
+    try {
+      const workspaceId = typeof args.workspaceId === "string" ? args.workspaceId : void 0;
+      const effectiveReceipt = receipt || requestContext.getStore()?.receipt;
+      const res = await syncManager.push(workspaceId, effectiveReceipt);
+      if (res.status === "committed") {
+        return { content: [{ type: "text", text: `Cloud sync push committed as revision #${res.revision}.` }] };
+      }
+      return {
+        isError: true,
+        content: [{ type: "text", text: `Push conflict: server has revision #${res.serverRevision}. Pull first, then retry.` }]
+      };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { isError: true, content: [{ type: "text", text: redactionFilter.redact(`Cloud push failed: ${msg}`) }] };
+    }
+  }
+  async handleCloudPullCall(args, receipt) {
+    const { syncManager } = await import("./sync_manager-2WYXXGCN.js");
+    const { cloudClient } = await import("./client-3GQWPGI3.js");
+    if (!cloudClient.isAuthenticated()) {
+      return {
+        isError: true,
+        content: [{ type: "text", text: 'Error: Host instance is not logged in to ContextWise Cloud. Run "contextwise login" on the host.' }]
+      };
+    }
+    try {
+      const workspaceId = typeof args.workspaceId === "string" ? args.workspaceId : void 0;
+      const effectiveReceipt = receipt || requestContext.getStore()?.receipt;
+      const res = await syncManager.pull(workspaceId, effectiveReceipt);
+      if (res) {
+        return { content: [{ type: "text", text: `Applied cloud revision #${res.revision} to host workspace.` }] };
+      }
+      return { content: [{ type: "text", text: "Host workspace is already up to date." }] };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      return { isError: true, content: [{ type: "text", text: redactionFilter.redact(`Cloud pull failed: ${msg}`) }] };
+    }
+  }
+  async handleSyncStatusCall() {
+    const { syncManager } = await import("./sync_manager-2WYXXGCN.js");
+    const status = syncManager.getStatus();
+    const lines = [
+      `Logged in: ${status.isLoggedIn ? "yes" : "no"}`,
+      `Workspace: ${status.workspaceId}`,
+      `Local revision: ${status.revision}`,
+      `Last synced: ${status.lastSyncedAt > 0 ? new Date(status.lastSyncedAt).toISOString() : "never"}`
+    ];
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  }
   /**
    * Dispatches tool call through guardrails and upstream multiplexer.
    */
@@ -3698,9 +3283,9 @@ ${validation.errors?.join("\n")}`;
     }
   }
   /**
-   * Starts ContextWise proxy using given configuration.
+   * Shared boot: config, guardrails, upstreams, catalog. Transport-agnostic.
    */
-  async start(config) {
+  async boot(config) {
     this.config = config;
     this.isRunning = true;
     logger.setLevel(config.proxy.logLevel);
@@ -3723,605 +3308,225 @@ ${validation.errors?.join("\n")}`;
       }
     });
     this.router.primeWorkspace(process.cwd());
-    this.transport = new StdioServerTransport();
-    await this.server.connect(this.transport);
-    logger.info("ContextWise MCP Proxy is running and ready for client connections.");
   }
   /**
-   * Gracefully shuts down proxy and upstream connections.
+   * Starts ContextWise proxy over stdio (default: local AI clients).
    */
-  async stop() {
-    if (!this.isRunning) return;
-    this.isRunning = false;
-    metricsCollector.flushSync();
-    logger.info("Shutting down ContextWise proxy...");
-    await this.multiplexer.closeAll();
-    if (this.transport) {
-      await this.transport.close();
-    }
-    await this.server.close();
-    logger.info("ContextWise proxy stopped cleanly.");
-  }
-  getMultiplexer() {
-    return this.multiplexer;
-  }
-  getRouter() {
-    return this.router;
-  }
-};
-var proxy = new ContextWiseProxy();
-
-// src/cloud/client.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join6 } from "path";
-var ContextWiseCloudClient = class {
-  apiUrl;
-  storageDir;
-  allowOfflineSimulation;
-  token = null;
-  constructor(options = {}) {
-    this.apiUrl = options.apiUrl || process.env.CONTEXTWISE_API_URL || "https://contextwise.dev";
-    this.storageDir = options.storageDir || process.env.CONTEXTWISE_STORAGE_DIR || join6(homedir6(), ".contextwise");
-    this.allowOfflineSimulation = options.allowOfflineSimulation ?? false;
-    this.loadToken();
-  }
-  getTokenPath() {
-    return join6(this.storageDir, "auth.json");
-  }
-  loadToken() {
-    const tokenPath = this.getTokenPath();
-    if (existsSync8(tokenPath)) {
-      try {
-        const raw = readFileSync7(tokenPath, "utf-8");
-        this.token = JSON.parse(raw);
-      } catch {
-        this.token = null;
-      }
-    }
-  }
-  saveToken(token) {
-    if (!existsSync8(this.storageDir)) {
-      mkdirSync5(this.storageDir, { recursive: true });
-    }
-    this.token = token;
-    writeFileSync5(this.getTokenPath(), JSON.stringify(token, null, 2), {
-      mode: 384,
-      encoding: "utf-8"
-    });
-  }
-  clearToken() {
-    this.token = null;
-    const tokenPath = this.getTokenPath();
-    if (existsSync8(tokenPath)) {
-      try {
-        unlinkSync2(tokenPath);
-      } catch {
-      }
-    }
-  }
-  getToken() {
-    if (!this.token) {
-      this.loadToken();
-    }
-    return this.token;
-  }
-  isAuthenticated() {
-    const token = this.getToken();
-    if (!token) return false;
-    return token.expiresAt > Date.now();
+  async start(config) {
+    await this.boot(config);
+    this.transport = new StdioServerTransport();
+    await this.server.connect(this.transport);
+    logger.info("ContextWise MCP Proxy is running and ready for client connections.");
   }
   /**
-   * Starts RFC 8628 device authorization flow.
+   * Starts ContextWise proxy over Streamable HTTP (for MCPaid edge publishing
+   * via `mcpaid publish`, or any remote MCP client). Stateless: each request
+   * gets its own transport, so no session affinity is required.
    */
-  async startDeviceFlow() {
-    const res = await fetch(`${this.apiUrl}/v1/auth/device/code`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" }
-    });
-    if (!res.ok) {
-      throw new Error(`Failed to initiate device login: HTTP ${res.status}`);
+  async startHttp(config, options = {}) {
+    const { createServer } = await import("http");
+    let StreamableHTTPServerTransport;
+    try {
+      ({ StreamableHTTPServerTransport } = await import("@modelcontextprotocol/sdk/server/streamableHttp.js"));
+    } catch {
+      throw new Error(
+        "HTTP transport requires @modelcontextprotocol/sdk with Streamable HTTP support. Run: npm install @modelcontextprotocol/sdk@latest"
+      );
     }
-    return await res.json();
-  }
-  /**
-   * Polls device token until user approves the code in their browser.
-   */
-  async pollDeviceToken(deviceCode, intervalSeconds = 5, maxWaitMs = 15 * 60 * 1e3) {
-    const start = Date.now();
-    const intervalMs = Math.max(intervalSeconds * 1e3, 2e3);
-    while (Date.now() - start < maxWaitMs) {
-      await new Promise((r) => setTimeout(r, intervalMs));
+    await this.boot(config);
+    const port = options.port ?? 3e3;
+    const mcpPath = options.path ?? "/mcp";
+    const { randomUUID } = await import("crypto");
+    const { isInitializeRequest } = await import("@modelcontextprotocol/sdk/types.js");
+    const httpSessions = /* @__PURE__ */ new Map();
+    this.httpTransports.push(httpSessions);
+    const httpServer = createServer(async (req, res) => {
       try {
-        const res = await fetch(`${this.apiUrl}/v1/auth/device/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ device_code: deviceCode })
-        });
-        if (res.ok) {
-          const data = await res.json();
-          const authToken = {
-            token: data.token,
-            userId: data.userId,
-            email: data.email,
-            expiresAt: data.expiresAt
-          };
-          this.saveToken(authToken);
-          return authToken;
+        const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+        if (url.pathname !== mcpPath) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "not_found", message: `Expected POST ${mcpPath}` }));
+          return;
         }
-        if (res.status === 428) {
-          continue;
+        if (req.method !== "POST" && req.method !== "GET" && req.method !== "DELETE") {
+          res.writeHead(405, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "method_not_allowed" }));
+          return;
         }
-        const errData = await res.json().catch(() => ({}));
-        throw new Error(errData.message || `Device authorization failed: HTTP ${res.status}`);
-      } catch (err) {
-        if (err instanceof Error && err.message.includes("Device authorization failed")) {
-          throw err;
+        let body;
+        if (req.method === "POST") {
+          const chunks = [];
+          for await (const chunk of req) chunks.push(chunk);
+          try {
+            body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+          } catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "invalid_json" }));
+            return;
+          }
         }
-      }
-    }
-    throw new Error("Device authorization timed out. Please try logging in again.");
-  }
-  /**
-   * Authenticates using a user API token or personal access key.
-   */
-  async loginWithKey(apiKey) {
-    const trimmed = apiKey.trim();
-    if (!trimmed) {
-      throw new Error("API key cannot be empty");
-    }
-    try {
-      const res = await fetch(`${this.apiUrl}/v1/auth/verify`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${trimmed}`
+        const rawReceipt = req.headers["x-mcpaid-receipt"];
+        const receiptHeader = Array.isArray(rawReceipt) ? rawReceipt[0] : rawReceipt;
+        const receiptSecret = (process.env.MCPAID_RECEIPT_SECRET || "").trim();
+        const previousReceiptSecret = (process.env.MCPAID_PREVIOUS_RECEIPT_SECRET || "").trim();
+        if (receiptSecret && body && typeof body === "object") {
+          const rpcRequests = Array.isArray(body) ? body : [body];
+          for (const rpc of rpcRequests) {
+            if (rpc && typeof rpc === "object" && rpc.method === "tools/call" && rpc.params?.name) {
+              const toolName = String(rpc.params.name);
+              if (toolName === CLOUD_PUSH_NAME || toolName === CLOUD_PULL_NAME) {
+                const minAmountMicro = toolName === CLOUD_PUSH_NAME ? 10000n : 5000n;
+                const verifyResult = await parseAndVerifyEdgeReceipt(
+                  {
+                    secret: receiptSecret,
+                    previousSecret: previousReceiptSecret || void 0,
+                    store: this.claimedReceiptNonces
+                  },
+                  {
+                    receipt: receiptHeader,
+                    expectedServer: "contextwise",
+                    expectedTool: toolName,
+                    minAmountMicro
+                  }
+                );
+                if (!verifyResult.valid) {
+                  logger.warn(`Rejected unverified tool call [${toolName}]: ${verifyResult.error}`);
+                  res.writeHead(402, { "Content-Type": "application/json" });
+                  res.end(
+                    JSON.stringify({
+                      jsonrpc: "2.0",
+                      id: rpc.id ?? null,
+                      error: {
+                        code: -32002,
+                        message: `Payment Required: ${verifyResult.error}`
+                      }
+                    })
+                  );
+                  return;
+                }
+              }
+            }
+          }
         }
-      });
-      if (!res.ok) {
-        if (res.status === 401 || res.status === 403) {
-          throw new Error("Invalid or expired ContextWise Cloud API key.");
+        const isGatewayOrigin = req.headers["x-mcpaid-gateway"] === "true";
+        const rawSession = req.headers["mcp-session-id"];
+        const sessionId = Array.isArray(rawSession) ? rawSession[0] : rawSession;
+        let session = sessionId && httpSessions.get(sessionId) || void 0;
+        if (!session && isGatewayOrigin && req.method === "POST") {
+          const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: void 0
+          });
+          const server = this.createSessionServer();
+          session = { transport, server };
+          await server.connect(transport);
+          try {
+            await requestContext.run({ receipt: receiptHeader }, async () => {
+              await session.transport.handleRequest(req, res, body);
+            });
+          } finally {
+            try {
+              await transport.close();
+            } catch {
+            }
+            try {
+              await server.close();
+            } catch {
+            }
+          }
+          return;
         }
-        throw new Error(`Cloud API returned HTTP ${res.status}: ${res.statusText}`);
-      }
-      const data = await res.json();
-      const authToken = {
-        token: trimmed,
-        userId: data.userId,
-        email: data.email,
-        expiresAt: data.expiresAt || Date.now() + 30 * 24 * 3600 * 1e3
-      };
-      this.saveToken(authToken);
-      return authToken;
-    } catch (err) {
-      if (this.allowOfflineSimulation && (trimmed.startsWith("cw_test_") || trimmed.startsWith("cw_live_"))) {
-        const dummyToken = {
-          token: trimmed,
-          userId: "usr_dev_" + trimmed.slice(-6),
-          email: "developer@contextwise.dev",
-          expiresAt: Date.now() + 30 * 24 * 3600 * 1e3
-        };
-        this.saveToken(dummyToken);
-        return dummyToken;
-      }
-      throw err;
-    }
-  }
-  /**
-   * Retrieves profile information for current authenticated account.
-   */
-  async whoami() {
-    const token = this.getToken();
-    if (!token) {
-      throw new Error('Not logged in. Run "contextwise login" first.');
-    }
-    try {
-      const res = await fetch(`${this.apiUrl}/v1/user/profile`, {
-        headers: { Authorization: `Bearer ${token.token}` }
-      });
-      if (res.ok) {
-        return await res.json();
-      }
-      if (!this.allowOfflineSimulation) {
-        throw new Error(`Failed to fetch profile: HTTP ${res.status} ${res.statusText}`);
-      }
-    } catch (err) {
-      if (!this.allowOfflineSimulation) {
-        throw err;
-      }
-    }
-    return {
-      userId: token.userId,
-      email: token.email,
-      plan: "free",
-      subscriptionStatus: "inactive",
-      currentPeriodEnd: null,
-      workspaces: [
-        {
-          id: "ws_default",
-          name: "Personal Workspace",
-          role: "owner",
-          activeRevision: 1,
-          updatedAt: Date.now()
+        if (!session) {
+          if (req.method === "POST" && body && typeof body === "object" && isInitializeRequest(body)) {
+            const transport = new StreamableHTTPServerTransport({
+              sessionIdGenerator: () => randomUUID(),
+              onsessioninitialized: (sid) => {
+                httpSessions.set(sid, session);
+              }
+            });
+            const server = this.createSessionServer();
+            session = { transport, server };
+            transport.onclose = () => {
+              const sid = transport.sessionId;
+              if (sid && httpSessions.get(sid)?.transport === transport) {
+                httpSessions.delete(sid);
+              }
+            };
+            await server.connect(transport);
+          } else {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(
+              JSON.stringify({
+                jsonrpc: "2.0",
+                id: null,
+                error: { code: -32e3, message: "Bad Request: No valid session ID provided" }
+              })
+            );
+            return;
+          }
         }
-      ],
-      devices: []
-    };
-  }
-  /**
-   * Initiates Stripe Checkout session for Pro or Team upgrade.
-   */
-  async createCheckoutSession(plan = "pro", interval = "month") {
-    const token = this.getToken();
-    if (!token) {
-      throw new Error('Not logged in. Run "contextwise login" first.');
-    }
-    const res = await fetch(`${this.apiUrl}/v1/billing/checkout`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${token.token}`
-      },
-      body: JSON.stringify({ plan, interval })
-    });
-    if (!res.ok) {
-      const errData = await res.json().catch(() => ({}));
-      throw new Error(errData.message || `Failed to create checkout session: HTTP ${res.status}`);
-    }
-    return await res.json();
-  }
-  /**
-   * Generates Stripe Customer Portal session to manage subscription and invoices.
-   */
-  async createPortalSession() {
-    const token = this.getToken();
-    if (!token) {
-      throw new Error('Not logged in. Run "contextwise login" first.');
-    }
-    const res = await fetch(`${this.apiUrl}/v1/billing/portal`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${token.token}`
-      }
-    });
-    if (!res.ok) {
-      const errData = await res.json().catch(() => ({}));
-      throw new Error(errData.message || `Failed to open billing portal: HTTP ${res.status}`);
-    }
-    return await res.json();
-  }
-  /**
-   * Pushes a workspace snapshot (config + encrypted vault) to the Cloudflare Workers / D1 backend.
-   */
-  async pushSync(payload) {
-    const token = this.getToken();
-    if (!token) {
-      throw new Error('Not logged in. Run "contextwise login" first.');
-    }
-    try {
-      const res = await fetch(`${this.apiUrl}/v1/sync/push`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token.token}`
-        },
-        body: JSON.stringify(payload)
-      });
-      if (res.ok) {
-        return await res.json();
-      }
-      if (res.status === 402) {
-        const payData = await res.json().catch(() => ({}));
-        throw new Error(
-          `${payData.message || "Cloud Sync requires an upgraded subscription."}
-Upgrade at: ${payData.upgradeUrl || "https://contextwise.dev/#pricing"}`
-        );
-      }
-      if (res.status === 409) {
-        const conflictData = await res.json();
-        return {
-          status: "conflict",
-          revision: payload.baseRevision,
-          serverRevision: conflictData.serverRevision,
-          serverPayload: conflictData.serverPayload
-        };
-      }
-      throw new Error(`Push sync failed: HTTP ${res.status} ${res.statusText}`);
-    } catch (err) {
-      if (err instanceof Error && (err.message.includes("requires an upgraded subscription") || err.message.includes("Cloud Sync requires"))) {
-        throw err;
-      }
-      if (this.allowOfflineSimulation) {
-        logger.debug(`Cloud API push endpoint unreachable (${err}). Using local snapshot commit.`);
-        return {
-          status: "committed",
-          revision: payload.baseRevision + 1
-        };
-      }
-      throw err;
-    }
-  }
-  /**
-   * Pulls the latest workspace snapshot (config + encrypted vault) from the cloud backend.
-   */
-  async pullSync(workspaceId, sinceRevision = 0) {
-    const token = this.getToken();
-    if (!token) {
-      throw new Error('Not logged in. Run "contextwise login" first.');
-    }
-    try {
-      const res = await fetch(
-        `${this.apiUrl}/v1/sync/pull?workspaceId=${encodeURIComponent(
-          workspaceId
-        )}&since=${sinceRevision}`,
-        {
-          headers: { Authorization: `Bearer ${token.token}` }
+        await requestContext.run({ receipt: receiptHeader }, async () => {
+          await session.transport.handleRequest(req, res, body);
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logger.error(`HTTP transport error: ${msg}`);
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+        }
+        try {
+          res.end(JSON.stringify({ error: "internal_error", message: msg }));
+        } catch {
         }
-      );
-      if (res.ok) {
-        return await res.json();
-      }
-      if (res.status === 304) {
-        return null;
-      }
-    } catch (err) {
-      logger.debug(`Cloud API pull endpoint unreachable: ${err}`);
-    }
-    return null;
-  }
-};
-var cloudClient = new ContextWiseCloudClient();
-
-// src/cloud/crypto.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join7 } from "path";
-import { randomBytes as randomBytes2 } from "crypto";
-function createEnvelope(workspaceKey, recipientPublicKeyPem) {
-  const ephemeral = generateKeyPairX25519();
-  const sharedKey = deriveSharedSecretX25519(ephemeral.privateKey, recipientPublicKeyPem);
-  const { iv, authTag, ciphertext } = encryptAesGcm(
-    workspaceKey.toString("base64"),
-    sharedKey
-  );
-  return {
-    recipientPublicKey: recipientPublicKeyPem,
-    ephemeralPublicKey: ephemeral.publicKey,
-    iv,
-    authTag,
-    ciphertext
-  };
-}
-function openEnvelope(envelope, recipientPrivateKeyPem) {
-  const sharedKey = deriveSharedSecretX25519(
-    recipientPrivateKeyPem,
-    envelope.ephemeralPublicKey
-  );
-  const decryptedBase64 = decryptAesGcm(
-    envelope.ciphertext,
-    sharedKey,
-    envelope.iv,
-    envelope.authTag
-  );
-  return Buffer.from(decryptedBase64, "base64");
-}
-function getOrCreateDeviceIdentity(storageDir) {
-  const dir = storageDir || process.env.CONTEXTWISE_STORAGE_DIR || join7(homedir7(), ".contextwise");
-  const filePath = join7(dir, "device.json");
-  if (existsSync9(filePath)) {
-    try {
-      const data = JSON.parse(readFileSync8(filePath, "utf-8"));
-      if (data.deviceId && data.publicKey && data.privateKey) {
-        return data;
-      }
-    } catch {
-    }
-  }
-  if (!existsSync9(dir)) {
-    mkdirSync6(dir, { recursive: true });
-  }
-  const { publicKey, privateKey } = generateKeyPairX25519();
-  const deviceId = `cw_dev_${randomBytes2(8).toString("hex")}`;
-  const identity = {
-    deviceId,
-    publicKey,
-    privateKey
-  };
-  writeFileSync6(filePath, JSON.stringify(identity, null, 2), {
-    mode: 384,
-    encoding: "utf-8"
-  });
-  return identity;
-}
-
-// src/cloud/sync_manager.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join8 } from "path";
-var SyncManager = class {
-  syncStatePath;
-  localConfigPath;
-  constructor(storageDir, localConfigPath) {
-    const dir = storageDir || process.env.CONTEXTWISE_STORAGE_DIR || join8(homedir8(), ".contextwise");
-    this.syncStatePath = join8(dir, "sync.json");
-    this.localConfigPath = localConfigPath;
-  }
-  loadSyncState() {
-    if (existsSync10(this.syncStatePath)) {
-      try {
-        const raw = readFileSync9(this.syncStatePath, "utf-8");
-        return JSON.parse(raw);
-      } catch {
       }
-    }
-    return {
-      workspaceId: "ws_default",
-      revision: 0,
-      lastSyncedAt: 0
-    };
-  }
-  saveSyncState(state) {
-    writeFileSync7(this.syncStatePath, JSON.stringify(state, null, 2), {
-      mode: 384,
-      encoding: "utf-8"
     });
+    await new Promise((resolve3) => httpServer.listen(port, "127.0.0.1", resolve3));
+    this.httpServers.push(httpServer);
+    logger.info(`ContextWise MCP Proxy listening on http://127.0.0.1:${port}${mcpPath} (Streamable HTTP).`);
+    return httpServer;
   }
   /**
-   * Pushes local configuration and encrypted vault payload to the cloud.
-   */
-  async push(workspaceId) {
-    const state = this.loadSyncState();
-    const wsId = workspaceId || state.workspaceId;
-    const device = getOrCreateDeviceIdentity();
-    const localConfig = ConfigLoader.load();
-    const vaultPath = getDefaultVaultFilePath();
-    let encryptedVault;
-    if (existsSync10(vaultPath)) {
-      try {
-        const rawVault = readFileSync9(vaultPath, "utf-8");
-        encryptedVault = JSON.parse(rawVault);
-      } catch {
-        encryptedVault = this.createEmptyEncryptedVault();
-      }
-    } else {
-      encryptedVault = this.createEmptyEncryptedVault();
-    }
-    const payload = {
-      workspaceId: wsId,
-      deviceId: device.deviceId,
-      baseRevision: state.revision,
-      config: localConfig,
-      encryptedVault,
-      timestamp: Date.now()
-    };
-    const result = await cloudClient.pushSync(payload);
-    if (result.status === "committed") {
-      state.workspaceId = wsId;
-      state.revision = result.revision;
-      state.lastSyncedAt = Date.now();
-      this.saveSyncState(state);
-      logger.info(`Successfully pushed revision #${result.revision} to ContextWise Cloud.`);
-    }
-    return result;
-  }
-  /**
-   * Pulls the latest cloud configuration and merges upstream servers.
-   */
-  async pull(workspaceId) {
-    const state = this.loadSyncState();
-    const wsId = workspaceId || state.workspaceId;
-    const pullResult = await cloudClient.pullSync(wsId, state.revision);
-    if (!pullResult) {
-      logger.info("Local configuration is already up to date.");
-      return null;
-    }
-    if (pullResult.config && pullResult.config.upstreams) {
-      this.mergeConfigIntoLocal(pullResult.config);
-    }
-    if (pullResult.encryptedVault && pullResult.encryptedVault.data) {
-      const vaultPath = getDefaultVaultFilePath();
-      writeFileSync7(vaultPath, JSON.stringify(pullResult.encryptedVault, null, 2), {
-        mode: 384,
-        encoding: "utf-8"
-      });
-    }
-    state.revision = pullResult.revision;
-    state.lastSyncedAt = Date.now();
-    this.saveSyncState(state);
-    logger.info(`Pulled and applied cloud revision #${pullResult.revision}.`);
-    return pullResult;
-  }
-  /**
-   * Semantically merges remote configuration into local contextwise.json.
+   * Gracefully shuts down proxy and upstream connections.
    */
-  mergeConfigIntoLocal(remoteConfig) {
-    const validatedRemote = ContextWiseConfigSchema.parse(remoteConfig);
-    const configPath = this.localConfigPath || process.env.CONTEXTWISE_CONFIG || join8(process.cwd(), "contextwise.json");
-    let localConfig;
-    if (existsSync10(configPath)) {
-      try {
-        localConfig = ContextWiseConfigSchema.parse(JSON.parse(readFileSync9(configPath, "utf-8")));
-      } catch {
-        localConfig = ContextWiseConfigSchema.parse({});
+  async stop() {
+    if (!this.isRunning) return;
+    this.isRunning = false;
+    metricsCollector.flushSync();
+    logger.info("Shutting down ContextWise proxy...");
+    await this.multiplexer.closeAll();
+    for (const srv of this.httpServers) {
+      await new Promise((resolve3) => srv.close(() => resolve3()));
+    }
+    this.httpServers = [];
+    for (const t of this.httpTransports) {
+      if (t instanceof Map) {
+        for (const { transport } of t.values()) {
+          await transport.close().catch(() => {
+          });
+        }
+      } else {
+        await t.close().catch(() => {
+        });
       }
-    } else {
-      localConfig = ContextWiseConfigSchema.parse({});
     }
-    for (const [name, s] of Object.entries(validatedRemote.upstreams || {})) {
-      if (isStdioUpstream(s) && !localConfig.upstreams[name]) {
-        logger.warn(
-          `[Cloud Sync Security] Remote configuration contains new stdio upstream "${name}" (${s.command}). Verify this server in contextwise.json before execution.`
-        );
-      }
+    this.httpTransports = [];
+    if (this.transport) {
+      await this.transport.close();
     }
-    const mergedUpstreams = {
-      ...validatedRemote.upstreams || {},
-      ...localConfig.upstreams || {}
-    };
-    const merged = {
-      ...localConfig,
-      upstreams: mergedUpstreams
-    };
-    writeFileSync7(configPath, JSON.stringify(merged, null, 2), "utf-8");
+    await this.server.close();
+    logger.info("ContextWise proxy stopped cleanly.");
   }
-  createEmptyEncryptedVault() {
-    return {
-      version: 1,
-      kdf: {
-        algorithm: "pbkdf2-sha512",
-        salt: "empty",
-        iterations: 5e4
-      },
-      cipher: "aes-256-gcm",
-      iv: "",
-      authTag: "",
-      data: ""
-    };
+  getMultiplexer() {
+    return this.multiplexer;
   }
-  getStatus() {
-    const token = cloudClient.getToken();
-    const state = this.loadSyncState();
-    const device = getOrCreateDeviceIdentity();
-    return {
-      isLoggedIn: cloudClient.isAuthenticated(),
-      userEmail: token?.email,
-      workspaceId: state.workspaceId,
-      revision: state.revision,
-      lastSyncedAt: state.lastSyncedAt,
-      deviceId: device.deviceId
-    };
+  getRouter() {
+    return this.router;
   }
 };
-var syncManager = new SyncManager();
+var proxy = new ContextWiseProxy();
 
 export {
-  StdioUpstreamConfigSchema,
-  HttpUpstreamConfigSchema,
-  UpstreamServerConfigSchema,
-  warnIfInsecureHttp,
-  isStdioUpstream,
-  isHttpUpstream,
-  ProxyConfigSchema,
-  RoutingConfigSchema,
-  GuardrailsConfigSchema,
-  ContextWiseConfigSchema,
-  RedactionFilter,
-  redactionFilter,
-  Logger,
-  logger,
-  ConfigLoader,
   ProcessSupervisor,
   supervisor,
-  encryptAesGcm,
-  decryptAesGcm,
-  VAULT_PBKDF2_ITERATIONS,
-  deriveKeyFromPassphrase,
-  getOrCreateMachineKey,
-  generateKeyPairX25519,
-  deriveSharedSecretX25519,
-  getDefaultVaultFilePath,
-  EncryptedFileVaultDriver,
   OsKeystoreDriver,
   SecretVault,
   secretVault,
@@ -4356,10 +3561,16 @@ export {
   EXECUTE_TOOL_NAME,
   BROWSE_SERVERS_NAME,
   ADD_SERVER_NAME,
+  CLOUD_PUSH_NAME,
+  CLOUD_PULL_NAME,
+  SYNC_STATUS_NAME,
   SEARCH_TOOLS_DEFINITION,
   EXECUTE_TOOL_DEFINITION,
   BROWSE_SERVERS_DEFINITION,
   ADD_SERVER_DEFINITION,
+  CLOUD_PUSH_DEFINITION,
+  CLOUD_PULL_DEFINITION,
+  SYNC_STATUS_DEFINITION,
   KNOWN_SERVERS,
   KnownServerRegistry,
   OfficialRegistryClient,
@@ -4370,14 +3581,8 @@ export {
   WorkspaceContextPrimer,
   ContextRouter,
   contextRouter,
+  requestContext,
   ContextWiseProxy,
-  proxy,
-  ContextWiseCloudClient,
-  cloudClient,
-  createEnvelope,
-  openEnvelope,
-  getOrCreateDeviceIdentity,
-  SyncManager,
-  syncManager
+  proxy
 };
-//# sourceMappingURL=chunk-P7JW7EPW.js.map
+//# sourceMappingURL=chunk-5ZMX5TEM.js.map