mergen-server 1.4.0

package/dist/routes/incident-webhook.js

@@ -0,0 +1,63 @@
+import { Router } from "express";
+import { randomUUID } from "crypto";
+import { z } from "zod";
+import { getStores } from "../storage/store-registry.js";
+import { notify } from "../intelligence/notifications.js";
+import { runIncidentAutopilot } from "../intelligence/incident-autopilot.js";
+import { validateCwd } from "../intelligence/autonomy.js";
+import logger from "../sensor/logger.js";
+const IncidentBody = z.object({
+  title: z.string().min(1).max(500),
+  service: z.string().min(1).max(200),
+  severity: z.enum(["critical", "high", "medium", "low"]).optional().default("high"),
+  description: z.string().max(2e3).optional(),
+  source: z.string().max(100).optional(),
+  environment: z.string().max(100).optional().default("production"),
+  cwd: z.string().max(500).optional()
+});
+function createIncidentWebhookRouter() {
+  const router = Router();
+  router.post("/incident", async (req, res) => {
+    const parsed = IncidentBody.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ ok: false, error: parsed.error.issues.map((i) => i.message).join(", ") });
+      return;
+    }
+    const { title, service, severity, description, source, environment } = parsed.data;
+    const cwd = validateCwd(parsed.data.cwd);
+    const pid = randomUUID();
+    const firedAt = Date.now();
+    await getStores().incidents.upsert(pid, {
+      status: "open",
+      hypothesis: title,
+      tag: "generic_webhook",
+      environment: environment ?? null,
+      confidence: 0
+    }, req.tenantId);
+    logger.info({ pid, title, service, severity, source }, "incident-webhook: incident created");
+    const severityIcon = severity === "critical" ? "\u{1F6A8}" : severity === "high" ? "\u26A0\uFE0F" : "\u{1F514}";
+    const sourceLabel = source ? ` via ${source}` : "";
+    void notify(pid, [
+      `${severityIcon} *Incident Created${sourceLabel}* \u2014 ${service}`,
+      `*${title}*`,
+      description ? `
+${description}` : "",
+      `_Mergen autopilot starting\u2026_`
+    ].filter(Boolean).join("\n"), { priority: severity === "critical" ? "urgent" : "high", tags: ["rotating_light"] });
+    void runIncidentAutopilot({ service, pid, firedAt, cwd });
+    res.status(202).json({
+      ok: true,
+      pid,
+      message: "Incident created. Autopilot analysis started.",
+      links: {
+        status: `GET /incidents/${pid}`,
+        shadowReport: `GET /shadow-report/entries`,
+        impactReport: `GET /impact-report`
+      }
+    });
+  });
+  return router;
+}
+export {
+  createIncidentWebhookRouter
+};

package/dist/routes/incidents.js

@@ -0,0 +1,366 @@
+import { Router } from "express";
+import { getStores } from "../storage/store-registry.js";
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+import { memoryStore, inferResolutionType } from "../datadog/memory-store.js";
+import { getActiveIncident, clearActiveIncident } from "../datadog/incident-state.js";
+import { replayIncident, listSnapshotPids, replayAllSnapshots } from "../intelligence/incident-replay.js";
+import { postmortemStore } from "../intelligence/postmortem-store.js";
+import { commitContextStore } from "../sensor/commit-context-store.js";
+import logger from "../sensor/logger.js";
+import { getShadowLog } from "../intelligence/shadow-log.js";
+import { isShadowMode } from "../intelligence/execution-mode.js";
+function createIncidentsRouter() {
+  const router = Router();
+  router.get("/incidents", async (req, res) => {
+    const status = typeof req.query.status === "string" ? req.query.status : void 0;
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 50)));
+    res.json({ ok: true, incidents: await getStores().incidents.list(status, limit, req.tenantId) });
+  });
+  router.post("/incidents", async (req, res) => {
+    const { pid, hypothesis, tag, sha, environment, confidence } = req.body ?? {};
+    if (!pid || typeof pid !== "string") {
+      res.status(400).json({ error: "pid is required" });
+      return;
+    }
+    const inc = await getStores().incidents.upsert(String(pid), {
+      hypothesis: hypothesis ? String(hypothesis) : "",
+      tag: tag ? String(tag) : "",
+      sha: sha ? String(sha) : null,
+      environment: environment ? String(environment) : null,
+      confidence: typeof confidence === "number" ? confidence : Number(confidence ?? 0)
+    }, req.tenantId);
+    logger.info({ pid: inc.pid }, "incident created");
+    res.json({ ok: true, incident: inc });
+  });
+  router.post("/incidents/:pid/mark-context-viewed", async (req, res) => {
+    const inc = await getStores().incidents.get(req.params.pid, req.tenantId);
+    if (!inc) {
+      res.status(404).json({ error: "not found" });
+      return;
+    }
+    await getStores().incidents.markContextViewed(req.params.pid, req.tenantId);
+    res.json({ ok: true, pid: req.params.pid, contextBriefViewedAt: inc.contextBriefViewedAt ?? Date.now() });
+  });
+  router.post("/incidents/:pid/acknowledge", async (req, res) => {
+    const { by } = req.body ?? {};
+    let inc = await getStores().incidents.get(req.params.pid, req.tenantId);
+    if (!inc) {
+      const { hypothesis, tag, sha, confidence } = req.body ?? {};
+      inc = await getStores().incidents.upsert(req.params.pid, {
+        hypothesis: hypothesis ? String(hypothesis) : "Unknown",
+        tag: tag ? String(tag) : "",
+        sha: sha ? String(sha) : null,
+        confidence: typeof confidence === "number" ? confidence : Number(confidence ?? 0)
+      }, req.tenantId);
+    }
+    const updated = await getStores().incidents.upsert(req.params.pid, {
+      status: "acknowledged",
+      acknowledgedBy: by ? String(by) : null
+    }, req.tenantId);
+    logger.info({ pid: req.params.pid, by }, "incident acknowledged");
+    res.json({ ok: true, incident: updated });
+  });
+  router.post("/incidents/:pid/assign", async (req, res) => {
+    const { to } = req.body ?? {};
+    if (!to) {
+      res.status(400).json({ error: "to is required" });
+      return;
+    }
+    const existing = await getStores().incidents.get(req.params.pid, req.tenantId) ?? await getStores().incidents.upsert(req.params.pid, { hypothesis: "Unknown" }, req.tenantId);
+    const updated = await getStores().incidents.upsert(req.params.pid, {
+      assignee: String(to),
+      status: existing.status === "open" ? "acknowledged" : existing.status
+    }, req.tenantId);
+    logger.info({ pid: req.params.pid, to }, "incident assigned");
+    res.json({ ok: true, incident: updated });
+  });
+  router.post("/incidents/:pid/resolve", async (req, res) => {
+    const { by, note } = req.body ?? {};
+    await getStores().incidents.upsert(req.params.pid, {
+      status: "resolved",
+      resolvedAt: Date.now()
+    }, req.tenantId);
+    if (note) await getStores().incidents.addNote(req.params.pid, `[resolved] ${note}`, by, req.tenantId);
+    const updated = await getStores().incidents.get(req.params.pid, req.tenantId);
+    logger.info({ pid: req.params.pid, by }, "incident resolved");
+    res.json({ ok: true, incident: updated });
+  });
+  router.post("/incidents/resolve-active", (req, res) => {
+    const { fixSummary, fixPrUrl, resolvedAt } = req.body ?? {};
+    const active = getActiveIncident();
+    const resType = fixPrUrl ? inferResolutionType(fixSummary ?? "") : "unknown";
+    const openRecs = memoryStore.listOpen();
+    if (openRecs.length === 0 && !active) {
+      res.status(404).json({ error: "no open incident found" });
+      return;
+    }
+    const target = openRecs[0];
+    if (target) {
+      memoryStore.closeIncident({
+        id: target.id,
+        resolvedAt: resolvedAt ? Number(resolvedAt) : Date.now(),
+        fixSummary: fixSummary ?? void 0,
+        fixPrUrl: fixPrUrl ?? void 0,
+        resolutionType: resType
+      });
+    }
+    clearActiveIncident();
+    logger.info({ id: target?.id, fixSummary }, "incident resolved via CLI");
+    res.json({
+      ok: true,
+      id: target?.id,
+      attributionSha: target?.attributionSha ?? null,
+      attributionConfidence: target?.attributionConfidence ?? null
+    });
+  });
+  router.post("/incidents/resolve-active/attribution-feedback", (req, res) => {
+    const { id, attributionCorrect } = req.body ?? {};
+    if (id == null || attributionCorrect == null) {
+      res.status(400).json({ error: "id and attributionCorrect are required" });
+      return;
+    }
+    memoryStore.recordAttributionFeedback(Number(id), attributionCorrect ? 1 : 0);
+    logger.info({ id, attributionCorrect }, "explicit attribution feedback recorded");
+    res.json({ ok: true });
+  });
+  router.get("/incidents/impact-report", async (req, res) => {
+    const isShadow = isShadowMode();
+    const all = await getStores().incidents.list(void 0, 500, req.tenantId);
+    const resolved = all.filter((i) => i.status === "resolved" && i.resolvedAt !== null);
+    let autonomousCount = 0;
+    let manualCount = resolved.length;
+    let causallyCorrectCount = 0;
+    const wouldResolvePids = /* @__PURE__ */ new Set();
+    const approvedPids = /* @__PURE__ */ new Set();
+    if (isShadow) {
+      const shadowLog = getShadowLog();
+      for (const e of shadowLog) {
+        if (e.wouldHaveExecuted) {
+          wouldResolvePids.add(e.pid);
+        }
+        if (e.humanVerdict === "would-approve") {
+          approvedPids.add(e.pid);
+        }
+      }
+      autonomousCount = resolved.filter((i) => wouldResolvePids.has(i.pid)).length;
+      manualCount = resolved.length - autonomousCount;
+      causallyCorrectCount = resolved.filter((i) => approvedPids.has(i.pid)).length;
+    } else {
+      autonomousCount = resolved.filter((i) => i.resolvedAutonomously).length;
+      manualCount = resolved.length - autonomousCount;
+      causallyCorrectCount = resolved.filter((i) => i.causallyCorrect).length;
+    }
+    const causallyCorrectRate = autonomousCount > 0 ? Math.round(causallyCorrectCount / autonomousCount * 100) : 0;
+    const mttrMs = (incidents) => {
+      if (incidents.length === 0) return null;
+      const valid = incidents.filter((i) => i.resolvedAt !== null && i.createdAt > 0);
+      if (valid.length === 0) return null;
+      const total = valid.reduce((sum, i) => sum + (i.resolvedAt - i.createdAt), 0);
+      return Math.round(total / valid.length);
+    };
+    let autonomousIncidents = [];
+    let manualIncidents = [];
+    if (isShadow) {
+      autonomousIncidents = resolved.filter((i) => wouldResolvePids.has(i.pid));
+      manualIncidents = resolved.filter((i) => !wouldResolvePids.has(i.pid));
+    } else {
+      autonomousIncidents = resolved.filter((i) => i.resolvedAutonomously);
+      manualIncidents = resolved.filter((i) => !i.resolvedAutonomously);
+    }
+    res.json({
+      ok: true,
+      isShadowMode: isShadow,
+      totalResolved: resolved.length,
+      autonomousResolutions: autonomousCount,
+      manualResolutions: manualCount,
+      autonomousRate: resolved.length > 0 ? Math.round(autonomousCount / resolved.length * 100) : 0,
+      // ── The LeCun metric: fraction of autonomous fixes that were causally correct ──
+      // Not just "resolved fast" but "root cause was right and error rate dropped".
+      causallyCorrectFixes: causallyCorrectCount,
+      causallyCorrectRate,
+      // % of autonomous resolutions that were causally correct
+      mttr: {
+        overallMs: mttrMs(resolved),
+        autonomousMs: mttrMs(autonomousIncidents),
+        manualMs: mttrMs(manualIncidents)
+      },
+      recentResolutions: resolved.sort((a, b) => (b.resolvedAt ?? 0) - (a.resolvedAt ?? 0)).slice(0, 10).map((i) => ({
+        pid: i.pid,
+        tag: i.tag,
+        resolvedAt: i.resolvedAt,
+        resolvedAutonomously: isShadow ? wouldResolvePids.has(i.pid) : i.resolvedAutonomously,
+        causallyCorrect: isShadow ? approvedPids.has(i.pid) : i.causallyCorrect,
+        mttrMs: i.resolvedAt && i.createdAt ? i.resolvedAt - i.createdAt : null
+      }))
+    });
+  });
+  router.post("/incidents/:pid/note", async (req, res) => {
+    const { text, author } = req.body ?? {};
+    if (!text) {
+      res.status(400).json({ error: "text is required" });
+      return;
+    }
+    const updated = await getStores().incidents.addNote(req.params.pid, String(text), author, req.tenantId);
+    if (!updated) {
+      res.status(404).json({ error: "incident not found \u2014 POST /incidents first" });
+      return;
+    }
+    res.json({ ok: true, incident: updated });
+  });
+  router.get("/incidents/graph", async (req, res) => {
+    const all = await getStores().incidents.list(void 0, 1e3, req.tenantId);
+    const services = /* @__PURE__ */ new Map();
+    for (const inc of all) {
+      const svc = inc.service ?? "unknown";
+      if (!services.has(svc)) services.set(svc, /* @__PURE__ */ new Map());
+      const modes = services.get(svc);
+      const tag = inc.tag.replace(/^infra_/, "") || "unknown";
+      modes.set(tag, (modes.get(tag) ?? 0) + 1);
+    }
+    const graph = [...services.entries()].map(([service, modes]) => ({
+      service,
+      incidentCount: [...modes.values()].reduce((a, b) => a + b, 0),
+      failureModes: Object.fromEntries(modes)
+    })).sort((a, b) => b.incidentCount - a.incidentCount);
+    res.json({
+      ok: true,
+      serviceCount: graph.length,
+      totalIncidents: all.length,
+      graph
+    });
+  });
+  router.get("/services/interactions", async (req, res) => {
+    const service = typeof req.query.service === "string" ? req.query.service : void 0;
+    const edges = await getStores().incidents.getInteractionGraph(service, req.tenantId);
+    const services = [...new Set(edges.flatMap((e) => [e.source, e.target]))];
+    res.json({
+      ok: true,
+      service: service ?? null,
+      edgeCount: edges.length,
+      services,
+      edges
+    });
+  });
+  router.get("/commit-contexts", (req, res) => {
+    const repo = typeof req.query.repo === "string" ? req.query.repo : void 0;
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 50)));
+    const since = req.query.since ? Number(req.query.since) : void 0;
+    const until = req.query.until ? Number(req.query.until) : void 0;
+    const contexts = since != null || until != null ? commitContextStore.listByWindow(since ?? 0, until ?? Date.now(), repo, limit) : repo ? commitContextStore.listByRepo(repo, limit) : commitContextStore.listByWindow(0, Date.now(), void 0, limit);
+    res.json({
+      ok: true,
+      total: commitContextStore.count(),
+      count: contexts.length,
+      contexts
+    });
+  });
+  router.get("/commit-contexts/:sha", (req, res) => {
+    const ctx = commitContextStore.getBySha(req.params.sha);
+    if (!ctx) {
+      res.status(404).json({ ok: false, error: "not found" });
+      return;
+    }
+    res.json({ ok: true, context: ctx });
+  });
+  router.get("/incidents/postmortems", (req, res) => {
+    const tag = typeof req.query.tag === "string" ? req.query.tag : void 0;
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 20)));
+    const postmortems = tag ? postmortemStore.getByTag(tag, limit) : postmortemStore.list(limit);
+    res.json({
+      ok: true,
+      count: postmortems.length,
+      total: postmortemStore.count(),
+      tagStats: postmortemStore.tagStats(),
+      postmortems
+    });
+  });
+  router.get("/incidents/replay-snapshots", (_req, res) => {
+    const pids = listSnapshotPids();
+    res.json({ ok: true, count: pids.length, pids });
+  });
+  router.get("/incidents/replay-all", (req, res) => {
+    const limit = Math.min(500, Math.max(1, Number(req.query.limit ?? 100)));
+    const excludePrefix = typeof req.query.excludePrefix === "string" ? req.query.excludePrefix : void 0;
+    const confidenceThreshold = req.query.confidenceThreshold !== void 0 ? Number(req.query.confidenceThreshold) : void 0;
+    replayAllSnapshots({ limit, excludePrefix, confidenceThreshold }).then((report) => {
+      res.json({ ok: true, ...report });
+    }).catch((err) => {
+      logger.warn({ err }, "incidents: batch replay failed");
+      res.status(500).json({ ok: false, error: "Batch replay failed" });
+    });
+  });
+  router.get("/incidents/:pid", async (req, res) => {
+    const inc = await getStores().incidents.get(req.params.pid, req.tenantId);
+    if (!inc) {
+      res.status(404).json({ error: "not found" });
+      return;
+    }
+    res.json({ ok: true, incident: inc });
+  });
+  router.get("/incidents/:pid/brief", async (req, res) => {
+    const inc = await getStores().incidents.get(req.params.pid, req.tenantId);
+    if (!inc) {
+      res.status(404).send("<h1>Incident not found</h1>");
+      return;
+    }
+    const firedMin = Math.round((Date.now() - inc.createdAt) / 6e4);
+    const mttrMin = inc.resolvedAt ? Math.round((inc.resolvedAt - inc.createdAt) / 6e4) : null;
+    const statusColor = inc.status === "resolved" ? "#22c55e" : inc.status === "acknowledged" ? "#f59e0b" : "#ef4444";
+    const pct = inc.confidence != null ? Math.round(inc.confidence * 100) : null;
+    const resolvedByLabel = inc.resolvedAutonomously ? "autopilot" : inc.assignee ?? null;
+    const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Incident Brief \u2014 ${inc.service ?? "unknown"}</title>
+<style>
+  body { font-family: system-ui, sans-serif; max-width: 680px; margin: 40px auto; padding: 0 20px; color: #1a1a1a; }
+  h1 { font-size: 1.4rem; margin-bottom: 4px; }
+  .badge { display:inline-block; padding: 2px 10px; border-radius: 12px; font-size: 0.8rem;
+           font-weight: 600; color: #fff; background: ${statusColor}; vertical-align: middle; margin-left: 8px; }
+  .meta { color: #6b7280; font-size: 0.85rem; margin: 8px 0 24px; }
+  table { border-collapse: collapse; width: 100%; }
+  td { padding: 8px 12px; border-bottom: 1px solid #e5e7eb; font-size: 0.9rem; }
+  td:first-child { font-weight: 600; width: 160px; color: #374151; }
+  .footer { margin-top: 32px; font-size: 0.75rem; color: #9ca3af; }
+</style>
+</head>
+<body>
+<h1>${inc.service ?? "Unknown Service"} <span class="badge">${inc.status}</span></h1>
+<div class="meta">Incident ID: ${req.params["pid"]}</div>
+<table>
+  <tr><td>Fired</td><td>${new Date(inc.createdAt).toUTCString()} (${firedMin} min ago)</td></tr>
+  ${inc.hypothesis ? `<tr><td>Root Cause</td><td>${escapeHtml(inc.hypothesis)}</td></tr>` : ""}
+  ${pct != null ? `<tr><td>Confidence</td><td>${pct}%</td></tr>` : ""}
+  ${inc.tag ? `<tr><td>Pattern Tag</td><td><code>${escapeHtml(inc.tag)}</code></td></tr>` : ""}
+  ${resolvedByLabel ? `<tr><td>Resolved By</td><td>${escapeHtml(resolvedByLabel)}</td></tr>` : ""}
+  ${mttrMin != null ? `<tr><td>MTTR</td><td>${mttrMin} min</td></tr>` : ""}
+  ${inc.notes.length > 0 ? `<tr><td>Notes</td><td>${escapeHtml(inc.notes.slice(-1)[0] ?? "")}</td></tr>` : ""}
+</table>
+<div class="footer">Generated by Mergen \xB7 ${(/* @__PURE__ */ new Date()).toUTCString()}</div>
+</body>
+</html>`;
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.send(html);
+  });
+  router.post("/incidents/:pid/replay", (req, res) => {
+    const { pid } = req.params;
+    replayIncident(pid).then((result) => {
+      if (!result) {
+        res.status(404).json({ ok: false, error: `No replay snapshot found for pid ${pid}. Snapshots are captured automatically when autopilot runs.` });
+        return;
+      }
+      res.json({ ok: true, ...result });
+    }).catch((err) => {
+      logger.warn({ err, pid }, "incidents: replay failed");
+      res.status(500).json({ ok: false, error: "Replay analysis failed" });
+    });
+  });
+  return router;
+}
+export {
+  createIncidentsRouter
+};

package/dist/routes/layers.js

@@ -0,0 +1,62 @@
+import { Router } from "express";
+import { layer2Store } from "../sensor/layer2-store.js";
+import { layer3Store } from "../sensor/layer3-store.js";
+const layersRouter = Router();
+layersRouter.get("/commands", (_req, res) => {
+  const commands = layer3Store.getPendingCommands();
+  res.json({ commands });
+});
+layersRouter.post("/log-capture", (req, res) => {
+  const { id, data } = req.body;
+  if (!id) {
+    res.status(400).json({ error: "Missing id" });
+    return;
+  }
+  layer3Store.captureLogData(id, data);
+  res.status(204).end();
+});
+layersRouter.post("/mock-hit", (req, res) => {
+  const { url, method } = req.body;
+  if (!url || !method) {
+    res.status(400).json({ error: "Missing url or method" });
+    return;
+  }
+  const mock = layer3Store.getMock(url, method);
+  if (mock) {
+    res.json(mock);
+  } else {
+    res.status(404).json({ error: "No mock found" });
+  }
+});
+layersRouter.get("/snapshots", (_req, res) => {
+  const snaps = layer3Store.listSnapshots().map((s) => ({
+    id: s.id,
+    capturedAt: s.capturedAt,
+    capturedAtIso: new Date(s.capturedAt).toISOString(),
+    trigger: s.trigger,
+    logCount: s.recentLogs.length,
+    netCount: s.recentNetwork.length,
+    hasContext: !!s.contextSnapshot
+  }));
+  res.json({ ok: true, count: snaps.length, snapshots: snaps });
+});
+layersRouter.get("/snapshots/:id", (req, res) => {
+  const snap = layer3Store.getSnapshot(req.params["id"] ?? "");
+  if (!snap) {
+    res.status(404).json({ error: "snapshot not found" });
+    return;
+  }
+  res.setHeader("Content-Disposition", `attachment; filename="mergen-snapshot-${snap.id}.json"`);
+  res.json(snap);
+});
+layersRouter.delete("/snapshots", (_req, res) => {
+  layer3Store.clearSnapshots();
+  res.json({ ok: true });
+});
+setInterval(() => {
+  layer2Store.pruneEventIndex();
+  layer3Store.pruneOldCommands();
+}, 3e4);
+export {
+  layersRouter
+};

package/dist/routes/license.js

@@ -0,0 +1,187 @@
+import { Router } from "express";
+import { getLicenseState, activateKey, deactivateKey, getActivePlanId } from "../intelligence/license.js";
+import { getPlan, PLANS, PLAN_ORDER } from "../intelligence/plans.js";
+import { requestDeviceCode, pollDeviceToken, DeviceAuthError } from "../intelligence/device-auth.js";
+import logger from "../sensor/logger.js";
+function activationApiUrl() {
+  return process.env.MERGEN_API_URL ?? "https://api.mergen.app";
+}
+let _pendingDevice = null;
+function createLicenseRouter() {
+  const router = Router();
+  router.get("/license", (_req, res) => {
+    const state = getLicenseState();
+    const planId = getActivePlanId();
+    const plan = getPlan(planId);
+    const nextPlanId = PLAN_ORDER.find((id) => PLANS[id].rank === plan.rank + 1);
+    const nextPlan = nextPlanId ? getPlan(nextPlanId) : null;
+    res.json({
+      plan: {
+        id: plan.id,
+        name: plan.name,
+        rank: plan.rank,
+        bufferSize: plan.bufferSize,
+        maxServices: plan.maxServices === Infinity ? null : plan.maxServices,
+        capabilities: plan.capabilities,
+        ctaUrl: plan.ctaUrl,
+        analyzeCreditsPerMonth: plan.analyzeCreditsPerMonth === Infinity ? null : plan.analyzeCreditsPerMonth,
+        seatCap: isFinite(plan.seatCap) ? plan.seatCap : null,
+        overageCentsPerSeat: plan.overageCentsPerSeat,
+        includedToolCallsPerMonth: plan.includedToolCallsPerMonth === 0 ? null : plan.includedToolCallsPerMonth,
+        overageCentsPerThousandToolCalls: plan.overageCentsPerThousandToolCalls
+      },
+      nextPlan: nextPlan ? {
+        id: nextPlan.id,
+        name: nextPlan.name,
+        tagline: nextPlan.tagline,
+        priceDescription: nextPlan.priceDescription,
+        ctaUrl: nextPlan.ctaUrl,
+        capabilities: nextPlan.capabilities
+      } : null,
+      license: state ? {
+        status: state.status ?? "active",
+        email: state.customerEmail ?? null,
+        name: state.customerName ?? null,
+        activatedAt: state.validatedAt ?? null
+      } : null
+    });
+  });
+  router.post("/license", async (req, res) => {
+    const { key } = req.body;
+    if (!key || typeof key !== "string" || key.trim().length === 0) {
+      res.status(400).json({ error: "key is required" });
+      return;
+    }
+    try {
+      const result = await activateKey(key.trim());
+      res.json({ ok: true, plan: result["planId"], email: result["email"] });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "activation failed";
+      logger.warn({ err }, "license activation failed");
+      res.status(422).json({ error: msg });
+    }
+  });
+  router.delete("/license", async (_req, res) => {
+    await deactivateKey();
+    res.json({ ok: true, plan: "free" });
+  });
+  router.post("/license/device/start", async (_req, res) => {
+    try {
+      const code = await requestDeviceCode(activationApiUrl());
+      _pendingDevice = { deviceCode: code.deviceCode, userCode: code.userCode, expiresAt: Date.now() + code.expiresIn * 1e3 };
+      res.json({
+        ok: true,
+        userCode: code.userCode,
+        verificationUri: code.verificationUri,
+        verificationUriComplete: code.verificationUriComplete,
+        expiresIn: code.expiresIn,
+        intervalMs: code.interval * 1e3
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "could not start sign-in";
+      logger.warn({ err }, "license: device/start failed");
+      res.status(502).json({ ok: false, error: msg });
+    }
+  });
+  router.post("/license/device/poll", async (_req, res) => {
+    if (!_pendingDevice) {
+      res.status(409).json({ ok: false, status: "no_pending", error: "no sign-in in progress" });
+      return;
+    }
+    if (_pendingDevice.expiresAt < Date.now()) {
+      _pendingDevice = null;
+      res.json({ ok: true, status: "expired" });
+      return;
+    }
+    try {
+      const result = await pollDeviceToken(activationApiUrl(), _pendingDevice.deviceCode);
+      if (result.status === "approved") {
+        const activated = await activateKey(result.activation.key);
+        _pendingDevice = null;
+        res.json({ ok: true, status: "approved", plan: activated["planId"], email: activated["email"] });
+        return;
+      }
+      if (result.status === "denied" || result.status === "expired") _pendingDevice = null;
+      res.json({ ok: true, status: result.status });
+    } catch (err) {
+      if (err instanceof DeviceAuthError && err.reason === "network") {
+        res.json({ ok: true, status: "pending" });
+        return;
+      }
+      const msg = err instanceof Error ? err.message : "poll failed";
+      logger.warn({ err }, "license: device/poll failed");
+      res.status(502).json({ ok: false, status: "error", error: msg });
+    }
+  });
+  router.get("/activate", (req, res) => {
+    const secret = typeof req.query["secret"] === "string" ? req.query["secret"] : "";
+    res.type("html").send(activatePage(secret));
+  });
+  return router;
+}
+function activatePage(secret) {
+  const s = JSON.stringify(secret).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Activate Mergen</title>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>
+  body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#07080e;color:#fff;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
+  .card{background:#11121a;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:2.5rem;max-width:440px;width:90%;box-shadow:0 8px 32px rgba(0,0,0,.4)}
+  h1{font-size:1.35rem;margin:0 0 .5rem}
+  p{color:#9aa0ac;font-size:.9rem;line-height:1.55}
+  .code{font-family:ui-monospace,monospace;font-size:1.6rem;letter-spacing:.25em;text-align:center;background:#0a0a0a;border:1px solid #2a2d38;border-radius:8px;padding:1rem;margin:1.25rem 0}
+  a.btn,button{display:inline-block;width:100%;box-sizing:border-box;text-align:center;padding:13px;border-radius:6px;border:none;font-weight:700;font-size:.9rem;cursor:pointer;background:#fff;color:#000;text-decoration:none}
+  .status{margin-top:1.25rem;font-size:.85rem;color:#9aa0ac;text-align:center}
+  .ok{color:#22c55e}.err{color:#ef4444}
+  .muted{font-size:.75rem;color:#6b7280;margin-top:1rem}
+</style></head><body>
+<div class="card" id="card">
+  <h1>Activate Mergen</h1>
+  <p>Sign in to activate your plan \u2014 no license key required. Click below, approve the device in your browser, and this page will finish automatically.</p>
+  <button id="start" onclick="start()">Start sign-in</button>
+  <div class="status" id="status"></div>
+  <p class="muted">Prefer the terminal? Run <code>mergen-server login</code>.</p>
+</div>
+<script>
+  var SECRET=${s};
+  function hdrs(){var h={'content-type':'application/json'};if(SECRET)h['x-mergen-secret']=SECRET;return h;}
+  var timer=null;
+  async function start(){
+    var st=document.getElementById('status');var btn=document.getElementById('start');
+    btn.disabled=true;st.className='status';st.textContent='Starting\u2026';
+    try{
+      var r=await fetch('/license/device/start',{method:'POST',headers:hdrs()});
+      var d=await r.json();
+      if(!d.ok)throw new Error(d.error||'could not start');
+      st.innerHTML='Your device code:<div class="code">'+d.userCode+'</div>'+
+        '<a class="btn" href="'+d.verificationUriComplete+'" target="_blank" rel="noopener">Approve in browser \u2197</a>'+
+        '<div style="margin-top:1rem">Waiting for approval\u2026</div>';
+      try{window.open(d.verificationUriComplete,'_blank','noopener');}catch(e){}
+      poll(d.intervalMs||2000,Date.now()+(d.expiresIn||600)*1000);
+    }catch(e){st.className='status err';st.textContent='Failed: '+e.message;btn.disabled=false;}
+  }
+  function poll(iv,deadline){
+    clearTimeout(timer);
+    timer=setTimeout(async function(){
+      if(Date.now()>deadline){done(false,'Timed out before approval.');return;}
+      try{
+        var r=await fetch('/license/device/poll',{method:'POST',headers:hdrs()});
+        var d=await r.json();
+        if(d.status==='approved'){done(true,'Activated \u2014 plan: '+(d.plan||'updated')+'. You can close this tab.');return;}
+        if(d.status==='denied'){done(false,'Sign-in was denied.');return;}
+        if(d.status==='expired'||d.status==='no_pending'){done(false,'Session expired \u2014 start again.');return;}
+      }catch(e){/* keep polling */}
+      poll(iv,deadline);
+    },iv);
+  }
+  function done(ok,msg){
+    clearTimeout(timer);
+    var st=document.getElementById('status');
+    st.className='status '+(ok?'ok':'err');st.textContent=msg;
+    document.getElementById('start').disabled=!ok?false:true;
+  }
+</script>
+</body></html>`;
+}
+export {
+  createLicenseRouter
+};