prism-mcp-server 20.21.6 → 20.21.8

package/README.md

@@ -149,6 +149,23 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.8
+
+### Dashboard graphs use the authenticated Portal
+
+- The selected cloud project now shows its real session nodes and stored links
+  instead of collapsing to a keyword-only project bubble.
+- **Synthesize Edges** uses the authenticated Synalux Portal embedding contract;
+  the Prism dashboard process does not need a Google or Gemini API key.
+- Existing vectors and links are reused on repeat runs, synthesis fan-out is
+  bounded, and Portal failures are shown rather than rendered as an empty graph.
+- **Account & Settings** now shows the current user, role, and Free, Standard,
+  Advanced, or Enterprise plan, with visible sign-in, upgrade, billing, and
+  sign-out actions.
+- A selected paid plan survives the Portal sign-in round trip, live and test
+  Stripe catalogs resolve every paid tier, and localized checkout never reuses
+  a USD Price for another currency.
+
 ## What's New in v20.18.1
 
 ### Task skills survive compaction and update in place

package/dist/connect.js

@@ -1250,6 +1250,7 @@ function getHostDefinitions(homeDir, platform, env, includeSystemPaths) {
         label: "Gemini CLI",
         format: "json",
         configPath: join(homeDir, ".gemini", "settings.json"),
+        additionalConfigPaths: antigravityMcpConfigPaths(homeDir),
         detectionPaths: [join(homeDir, ".gemini")],
         executables: ["gemini"],
     }, {
@@ -1304,6 +1305,22 @@ function executableExists(name, platform, pathEnv) {
     }
     return false;
 }
+/**
+ * Antigravity has used three user-level MCP locations across releases. Keep
+ * the Gemini CLI settings registration as the primary result, and converge
+ * only Antigravity paths whose parent directory already exists. That avoids
+ * creating an unrelated host config on a Gemini-CLI-only installation while
+ * repairing an existing Antigravity installation, including the legacy IDE
+ * path that can otherwise continue launching an old server indefinitely.
+ */
+function antigravityMcpConfigPaths(homeDir) {
+    const geminiDir = join(homeDir, ".gemini");
+    return [
+        join(geminiDir, "config", "mcp_config.json"),
+        join(geminiDir, "antigravity", "mcp_config.json"),
+        join(geminiDir, "antigravity-ide", "mcp_config.json"),
+    ].filter((configPath) => existsSync(configPath) || existsSync(dirname(configPath)));
+}
 function buildMcpEntry(nodePath, serverPath, env) {
     const storage = env.PRISM_STORAGE ?? "auto";
     if (!CONNECT_STORAGE_BACKENDS.includes(storage)) {
@@ -1331,10 +1348,42 @@ function registerHost(definition, entry, dryRun, refresh, beforeCommit) {
     if (definition.configurationError) {
         return result(definition, "error", definition.configurationError);
     }
-    if (definition.format === "codex-toml") {
-        return registerCodexTomlHost(definition, entry, dryRun, refresh, beforeCommit);
+    const configDefinitions = [
+        definition,
+        ...(definition.additionalConfigPaths ?? []).map((configPath) => ({ ...definition, configPath })),
+    ];
+    const registerOne = (configDefinition) => {
+        if (configDefinition.format === "codex-toml") {
+            return registerCodexTomlHost(configDefinition, entry, dryRun, refresh, beforeCommit);
+        }
+        return registerJsonHost(configDefinition, entry, dryRun, refresh, beforeCommit);
+    };
+    const primary = registerOne(configDefinitions[0]);
+    if (primary.status === "error")
+        return primary;
+    const registrations = [primary, ...configDefinitions.slice(1).map(registerOne)];
+    const failures = registrations.slice(1).filter((registration) => registration.status === "error");
+    if (failures.length > 0) {
+        return {
+            ...primary,
+            status: "error",
+            startupCompatible: false,
+            message: `additional config registration failed: ${failures.map((failure) => `${failure.path}: ${failure.message || "unknown error"}`).join("; ")}`,
+        };
     }
-    return registerJsonHost(definition, entry, dryRun, refresh, beforeCommit);
+    const additionalChanges = registrations.slice(1).filter((registration) => registration.status !== "existing");
+    const incompatible = registrations.filter((registration) => !registration.startupCompatible);
+    const additionalMessage = additionalChanges.length > 0
+        ? `also ${additionalChanges.map((registration) => `${registration.status} ${registration.path}`).join(", ")}`
+        : undefined;
+    const incompatibleMessage = incompatible.length > 0
+        ? `retained incompatible or unmanaged registration(s): ${incompatible.map((registration) => registration.path).join(", ")}`
+        : undefined;
+    return {
+        ...primary,
+        startupCompatible: registrations.every((registration) => registration.startupCompatible),
+        message: [primary.message, additionalMessage, incompatibleMessage].filter(Boolean).join("; ") || undefined,
+    };
 }
 function registerJsonHost(definition, entry, dryRun, refresh, beforeCommit) {
     const { configPath } = definition;

package/dist/dashboard/accountRouter.js

@@ -0,0 +1,328 @@
+import { invalidateEntitlements } from "../utils/entitlements.js";
+import { getSynaluxJwt, invalidateSynaluxJwt } from "../utils/synaluxJwt.js";
+import { resolvePortalBaseUrl, usablePortalKey } from "../utils/synaluxSearch.js";
+import { isSynaluxSignedOut, setSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
+import { upgradeInsecureCloudUrl } from "../utils/secureUrl.js";
+const DEFAULT_PORTAL_URL = "https://synalux.ai";
+const MAX_BODY_BYTES = 16 * 1024;
+const VALID_PLANS = new Set(["free", "standard", "advanced", "enterprise"]);
+let accountMutationQueue = Promise.resolve();
+async function serializeAccountMutation(operation) {
+    const previous = accountMutationQueue;
+    let release;
+    accountMutationQueue = new Promise((resolve) => { release = resolve; });
+    await previous.catch(() => { });
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+    }
+}
+const defaultDeps = {
+    fetcher: fetch,
+    getSetting: async (key, defaultValue) => (await import("../storage/configStorage.js")).getSetting(key, defaultValue),
+    setSetting: async (key, value) => (await import("../storage/configStorage.js")).setSetting(key, value),
+    getJwt: getSynaluxJwt,
+    invalidateJwt: invalidateSynaluxJwt,
+    invalidateEntitlements,
+    closeStorage: async () => (await import("../storage/index.js")).closeStorage(),
+    resolvePortalBaseUrl,
+    usablePortalKey,
+};
+function json(res, status, body) {
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Cache-Control": "private, no-store",
+    });
+    res.end(JSON.stringify(body));
+}
+async function readJson(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > MAX_BODY_BYTES)
+            throw new Error("Request body too large");
+        chunks.push(buffer);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw)
+        return {};
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Body must be a JSON object");
+    }
+    return value;
+}
+function safePortalOrigin(raw) {
+    if (!raw)
+        return null;
+    try {
+        const upgraded = upgradeInsecureCloudUrl(raw.trim());
+        const parsed = new URL(upgraded);
+        if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["localhost", "127.0.0.1", "::1", "[::1]"].includes(parsed.hostname))) {
+            return null;
+        }
+        return parsed.origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function portalOrigin(deps) {
+    return safePortalOrigin(deps.resolvePortalBaseUrl())
+        ?? safePortalOrigin(await deps.getSetting("PRISM_SYNALUX_BASE_URL", ""))
+        ?? safePortalOrigin(await deps.getSetting("SYNALUX_BASE_URL", ""))
+        ?? DEFAULT_PORTAL_URL;
+}
+async function applyStoredSignOut(deps) {
+    const signedOut = (await deps.getSetting("PRISM_SYNALUX_SIGNED_OUT", "")) === "true";
+    setSynaluxSignedOut(signedOut);
+    if (signedOut)
+        delete process.env.PRISM_SYNALUX_API_KEY;
+    return signedOut;
+}
+function authUrl(origin) {
+    return `${origin}/auth?source=prism`;
+}
+function signedOutAccount(origin) {
+    return {
+        signed_in: false,
+        configured: false,
+        name: null,
+        role_key: null,
+        plan: "free",
+        billing: { action: "upgrade", url: `${origin}/pricing` },
+        auth_url: authUrl(origin),
+    };
+}
+function normalizeAccount(value, origin) {
+    if (!value || typeof value !== "object")
+        throw new Error("Portal returned an invalid account response");
+    const raw = value;
+    const plan = typeof raw.plan === "string" && VALID_PLANS.has(raw.plan) ? raw.plan : "free";
+    const billingRaw = raw.billing && typeof raw.billing === "object"
+        ? raw.billing
+        : {};
+    const action = billingRaw.action === "manage" || billingRaw.action === "included"
+        ? billingRaw.action
+        : "upgrade";
+    const url = typeof billingRaw.url === "string" && isAllowedBillingUrl(billingRaw.url, origin)
+        ? billingRaw.url
+        : null;
+    return {
+        signed_in: raw.signed_in === true,
+        configured: true,
+        name: typeof raw.name === "string" ? raw.name.slice(0, 160) : null,
+        role_key: typeof raw.role_key === "string" ? raw.role_key.slice(0, 80) : null,
+        plan: plan,
+        plan_source: raw.plan_source === "managed" ? "managed" : "stripe",
+        billing: { action, url },
+        auth_url: authUrl(origin),
+    };
+}
+function isAllowedBillingUrl(raw, origin) {
+    try {
+        const url = new URL(raw);
+        return url.origin === origin
+            || (url.protocol === "https:" && url.hostname === "billing.stripe.com");
+    }
+    catch {
+        return false;
+    }
+}
+async function accountWithJwt(deps, origin) {
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    if (!response.ok)
+        throw new Error(`Unable to load Synalux account (HTTP ${response.status})`);
+    const data = await response.json();
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    return normalizeAccount(data, origin);
+}
+export async function loadDashboardAccount(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps))
+        return signedOutAccount(origin);
+    if (!deps.usablePortalKey())
+        return signedOutAccount(origin);
+    return accountWithJwt(deps, origin);
+}
+async function revokeRawToken(deps, origin, token) {
+    try {
+        const response = await deps.fetcher(`${origin}/api/v1/prism/account`, {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        return response.ok || response.status === 401;
+    }
+    catch {
+        return false;
+    }
+}
+export async function connectDashboardAccount(code, overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        if (typeof code !== "string" || !code.startsWith("synalux_code_") || code.length > 256) {
+            throw new Error("Enter a valid one-time Prism sign-in code");
+        }
+        const origin = await portalOrigin(deps);
+        const response = await deps.fetcher(`${origin}/api/v1/auth/code-exchange`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Prism-Client": "prism-dashboard" },
+            body: JSON.stringify({ code, client: "prism" }),
+            signal: AbortSignal.timeout(10_000),
+            redirect: "error",
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw new Error(typeof data.error === "string" ? data.error : "Prism sign-in failed");
+        const token = typeof data.api_token === "string" ? data.api_token : "";
+        if (!token.startsWith("synalux_sk_") || token.length > 512) {
+            throw new Error("Portal returned an invalid Prism credential");
+        }
+        try {
+            await deps.setSetting("PRISM_SYNALUX_BASE_URL", origin);
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "false");
+        }
+        catch (error) {
+            await revokeRawToken(deps, origin, token);
+            await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true").catch(() => { });
+            await deps.setSetting("PRISM_SYNALUX_API_KEY", "").catch(() => { });
+            throw new Error(`Could not save Prism sign-in: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        setSynaluxSignedOut(false);
+        process.env.PRISM_SYNALUX_BASE_URL = origin;
+        process.env.PRISM_SYNALUX_API_KEY = token;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.closeStorage();
+        return accountWithJwt(deps, origin);
+    });
+}
+export async function openDashboardBilling(overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const origin = await portalOrigin(deps);
+    if (await applyStoredSignOut(deps) || !deps.usablePortalKey()) {
+        return { url: `${origin}/pricing`, action: "upgrade" };
+    }
+    let jwt = await deps.getJwt();
+    if (!jwt || isSynaluxSignedOut())
+        throw new Error("Synalux sign-in expired. Sign in again.");
+    const send = (token) => deps.fetcher(`${origin}/api/v1/prism/account`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "X-Prism-Client": "prism-dashboard" },
+        signal: AbortSignal.timeout(10_000),
+        redirect: "error",
+    });
+    let response = await send(jwt);
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (response.status === 401) {
+        deps.invalidateJwt();
+        jwt = await deps.getJwt();
+        if (!jwt)
+            throw new Error("Synalux sign-in expired. Sign in again.");
+        response = await send(jwt);
+        if (isSynaluxSignedOut())
+            throw new Error("Synalux account is signed out");
+    }
+    const data = await response.json().catch(() => ({}));
+    if (isSynaluxSignedOut())
+        throw new Error("Synalux account is signed out");
+    if (!response.ok)
+        throw new Error(typeof data.error === "string" ? data.error : `Billing unavailable (HTTP ${response.status})`);
+    if (typeof data.url !== "string" || !isAllowedBillingUrl(data.url, origin)) {
+        throw new Error("Portal returned an unsafe billing URL");
+    }
+    return { url: data.url, action: typeof data.action === "string" ? data.action : "manage" };
+}
+export async function signOutDashboardAccount(overrides = {}) {
+    return serializeAccountMutation(async () => {
+        const deps = { ...defaultDeps, ...overrides };
+        const origin = await portalOrigin(deps);
+        const token = deps.usablePortalKey() ?? (await deps.getSetting("PRISM_SYNALUX_API_KEY", "")).trim();
+        // Cut off every local credential path before waiting on the network. The
+        // storage singleton captures its refresh token at construction, so clearing
+        // only process.env would leave an already-created backend signed in.
+        setSynaluxSignedOut(true);
+        delete process.env.PRISM_SYNALUX_API_KEY;
+        deps.invalidateJwt();
+        deps.invalidateEntitlements();
+        await deps.setSetting("PRISM_SYNALUX_SIGNED_OUT", "true");
+        await deps.setSetting("PRISM_SYNALUX_API_KEY", "");
+        await deps.closeStorage();
+        const revoked = token ? await revokeRawToken(deps, origin, token) : true;
+        return { signed_out: true, revoked };
+    });
+}
+export async function handleAccountRoutes(url, req, res) {
+    if (url.pathname === "/api/account" && req.method === "GET") {
+        try {
+            json(res, 200, await loadDashboardAccount());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Unable to load account" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/connect" && req.method === "POST") {
+        try {
+            const body = await readJson(req);
+            json(res, 200, await connectDashboardAccount(body.code));
+        }
+        catch (error) {
+            json(res, 400, { error: error instanceof Error ? error.message : "Prism sign-in failed" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/billing" && req.method === "POST") {
+        try {
+            json(res, 200, await openDashboardBilling());
+        }
+        catch (error) {
+            json(res, 502, { error: error instanceof Error ? error.message : "Billing unavailable" });
+        }
+        return true;
+    }
+    if (url.pathname === "/api/account/signout" && req.method === "POST") {
+        try {
+            const result = await signOutDashboardAccount();
+            json(res, result.revoked ? 200 : 502, {
+                ...result,
+                ...(result.revoked ? {} : { warning: "Signed out locally, but remote token revocation could not be confirmed" }),
+            });
+        }
+        catch (error) {
+            json(res, 500, { error: error instanceof Error ? error.message : "Sign-out failed" });
+        }
+        return true;
+    }
+    return false;
+}

package/dist/dashboard/dashboardToken.js

@@ -20,24 +20,30 @@ export function resolveDashboardToken(cfg) {
     return randomBytes(32).toString("hex");
 }
 /** Extract the prism_dashboard_token cookie value, if present. */
-export function tokenFromCookie(cookieHeader) {
+export function dashboardTokenCookieName(port) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid dashboard port');
+    return `prism_dashboard_token_${port}`;
+}
+export function tokenFromCookie(cookieHeader, cookieName = 'prism_dashboard_token') {
     // Capture the whole value (any run of non-";", non-space) so pinned tokens
     // with hyphens/underscores match; the name is anchored to start-or-"; " so a
     // look-alike cookie (evil_prism_dashboard_token=…) cannot match.
-    const m = (cookieHeader || "").match(/(?:^|;\s*)prism_dashboard_token=([^;\s]+)/);
-    return m ? m[1] : null;
+    const entry = (cookieHeader || '').split(';').map(c => c.trim()).find(c => c.startsWith(`${cookieName}=`));
+    const value = entry?.slice(cookieName.length + 1);
+    return value && !/\s/.test(value) ? value : null;
 }
 /**
  * True when the request presents the active token via the cookie, the
  * X-Prism-Dashboard-Token header, or a ?token= query param. Every comparison is
  * timing-safe and only runs against the single active token.
  */
-export function requestHasToken(headers, queryToken, activeToken) {
-    const candidates = [tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
+export function requestHasToken(headers, queryToken, activeToken, cookieName = 'prism_dashboard_token') {
+    const candidates = [tokenFromCookie(headers.cookie, cookieName), tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
     return candidates.some((c) => c !== null && safeCompare(c, activeToken));
 }
 /** Build the Set-Cookie value that stores the token for a browser session. */
-export function buildTokenCookie(token, maxAgeMs, secure) {
-    return (`prism_dashboard_token=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
+export function buildTokenCookie(token, maxAgeMs, secure, cookieName = 'prism_dashboard_token') {
+    return (`${cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
         `Max-Age=${Math.floor(maxAgeMs / 1000)}${secure ? "; Secure" : ""}`);
 }

package/dist/dashboard/graphRouter.js

@@ -65,16 +65,70 @@ export async function handleGraphRoutes(url, req, res, getStorageSafe) {
         else {
             params.limit = "200"; // Bump limit when exploring specific filters
         }
+        let createdAfter;
         if (project)
             params.project = `eq.${project}`;
         if (days) {
             const past = new Date();
             past.setDate(past.getDate() - parseInt(days, 10));
-            params.created_at = `gte.${past.toISOString()}`;
+            createdAfter = past.toISOString();
+            params.created_at = `gte.${createdAfter}`;
         }
         if (min_importance)
             params.importance = `gte.${parseInt(min_importance, 10)}`;
-        const entries = await s.getLedgerEntries(params);
+        const graphLimit = !project && !days && !min_importance ? 30 : 200;
+        if (project && s.getDashboardMemoryGraph) {
+            const graph = await s.getDashboardMemoryGraph({
+                project,
+                ...(createdAfter ? { createdAfter } : {}),
+                ...(min_importance ? { minImportance: parseInt(min_importance, 10) } : {}),
+                limit: graphLimit,
+            });
+            const now = Date.now();
+            const nodes = graph.nodes.map((row) => {
+                const accessedAt = row.last_accessed_at || row.created_at;
+                const daysSince = accessedAt
+                    ? Math.max(0, Math.floor((now - new Date(accessedAt).getTime()) / (1000 * 60 * 60 * 24)))
+                    : 999;
+                const baseImportance = typeof row.importance === "number" ? row.importance : 0;
+                return {
+                    id: row.id,
+                    label: typeof row.summary === "string" && row.summary.trim() ? row.summary.trim() : String(row.id),
+                    group: "memory",
+                    days_since_access: daysSince,
+                    decayed_importance: baseImportance > 0
+                        ? Math.round(baseImportance * Math.pow(0.95, daysSince) * 100) / 100
+                        : 0,
+                    base_importance: baseImportance,
+                };
+            });
+            const nodeIds = new Set(nodes.map(node => node.id));
+            const edges = graph.edges
+                .filter((edge) => nodeIds.has(edge.source_id) && nodeIds.has(edge.target_id))
+                .map((edge) => ({
+                from: edge.source_id,
+                to: edge.target_id,
+                label: edge.link_type,
+                value: typeof edge.strength === "number" ? edge.strength : 1,
+            }));
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                graphType: "memory",
+                entryCount: nodes.length,
+                truncated: graph.truncated,
+                nodes,
+                edges,
+            }));
+            return true;
+        }
+        const entries = s.getDashboardGraphEntries
+            ? await s.getDashboardGraphEntries({
+                ...(project ? { project } : {}),
+                ...(createdAfter ? { createdAfter } : {}),
+                ...(min_importance ? { minImportance: parseInt(min_importance, 10) } : {}),
+                limit: graphLimit,
+            })
+            : await s.getLedgerEntries(params);
         const now = Date.now();
         // ── Decay tracking: aggregate per-keyword and per-project ──
         // For each keyword/project, track the *freshest* entry's decay info

package/dist/dashboard/ledgerReader.js

@@ -0,0 +1,9 @@
+/** Paid clients have Portal credentials, not direct Supabase credentials. */
+export async function readDashboardLedger(storage, backend, project, order, limit) {
+    if (backend !== "synalux") {
+        return storage.getLedgerEntries({ project: `eq.${project}`, order, limit: String(limit) });
+    }
+    if (!storage.getDashboardLedger)
+        throw new Error("Cloud dashboard ledger reader unavailable");
+    return storage.getDashboardLedger(project, order, limit);
+}

package/dist/dashboard/server.js

@@ -22,19 +22,21 @@ import * as os from "os";
 import * as fs from "fs";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { createServer, getAllPossibleTools } from "../server.js";
-import { getStorage } from "../storage/index.js";
+import { getStorage, activeStorageBackend } from "../storage/index.js";
+import { readDashboardLedger } from "./ledgerReader.js";
 import { PRISM_USER_ID, SERVER_CONFIG } from "../config.js";
 import { renderDashboardHTML } from "./ui.js";
 import { computeIntentHealth } from "./intentHealth.js";
 import { getAllSettings, setSetting, getSetting, getSettingSync } from "../storage/configStorage.js";
 import { compactLedgerHandler } from "../tools/compactionHandler.js";
-import { getLLMProvider } from "../utils/llm/factory.js";
+import { getEmbeddingProvider } from "../utils/llm/factory.js";
 import { buildVaultDirectory } from "../utils/vaultExporter.js";
 import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
+import { handleAccountRoutes } from "./accountRouter.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
-import { resolveDashboardToken, requestHasToken, buildTokenCookie, } from "./dashboardToken.js";
+import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
@@ -238,7 +240,7 @@ return false;}
                 reqUrl.searchParams.delete("token");
                 const cleanTarget = reqUrl.pathname + (reqUrl.search ? reqUrl.search : "");
                 res.writeHead(302, {
-                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE),
+                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE, dashboardTokenCookieName(req.socket.localPort)),
                     Location: cleanTarget,
                 });
                 return res.end();
@@ -247,7 +249,7 @@ return false;}
                 !requestHasToken({
                     cookie: req.headers.cookie,
                     headerToken: req.headers["x-prism-dashboard-token"] || null,
-                }, qToken, DASHBOARD_TOKEN)) {
+                }, qToken, DASHBOARD_TOKEN, dashboardTokenCookieName(req.socket.localPort))) {
                 res.writeHead(401, { "Content-Type": "application/json" });
                 return res.end(JSON.stringify({
                     error: "Dashboard token required — open the tokenized URL printed in the Prism startup log.",
@@ -482,11 +484,7 @@ return false;}
                     return res.end(JSON.stringify({ error: "Storage initializing..." }));
                 }
                 const context = await s.loadContext(projectName, "deep", PRISM_USER_ID);
-                const ledger = await s.getLedgerEntries({
-                    project: `eq.${projectName}`,
-                    order: "created_at.desc",
-                    limit: "20",
-                });
+                const ledger = await readDashboardLedger(s, activeStorageBackend, projectName, "created_at.desc", 20);
                 let history = [];
                 try {
                     history = await s.getHistory(projectName, PRISM_USER_ID, 10);
@@ -643,6 +641,11 @@ return false;}
                 res.writeHead(200, { "Content-Type": "application/json" });
                 return res.end(JSON.stringify({ ok: true, role, namespace: "user_skill" }));
             }
+            // ─── API: Synalux Account & Subscription ───
+            if (url.pathname.startsWith("/api/account")) {
+                if (await handleAccountRoutes(url, req, res))
+                    return;
+            }
             // ─── API: Knowledge Graph (v6.2 — extracted to graphRouter.ts) ───
             if (url.pathname.startsWith("/api/graph")) {
                 if (await handleGraphRoutes(url, req, res, getStorageSafe))
@@ -824,11 +827,7 @@ return false;}
                     }
                     // Gather data (mirrors sessionExportMemoryHandler)
                     const ctx = await s.loadContext(projectName, "deep", PRISM_USER_ID);
-                    const rawLedger = await s.getLedgerEntries({
-                        project: `eq.${projectName}`,
-                        order: "created_at.asc",
-                        limit: "1000",
-                    });
+                    const rawLedger = await readDashboardLedger(s, activeStorageBackend, projectName, "created_at.asc", 1000);
                     // Strip binary embedding fields
                     const cleanLedger = rawLedger.map(({ embedding: _e, embedding_compressed: _ec, ...rest }) => rest);
                     const rawSettings = await getAllSettings();
@@ -1014,7 +1013,7 @@ return false;}
                     // Check LLM provider availability before attempting embedding
                     let llm;
                     try {
-                        llm = getLLMProvider();
+                        llm = getEmbeddingProvider();
                     }
                     catch {
                         res.writeHead(503, { "Content-Type": "application/json" });