stackcanvas 0.2.0

package/dist/cli.js

@@ -0,0 +1,1042 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { fileURLToPath } from "url";
+import { dirname as dirname2, join as join4 } from "path";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// ../server/src/canvas-server.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
+import { extname, join as join3, resolve, sep as sep2 } from "path";
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+import { WebSocketServer, WebSocket } from "ws";
+import { z } from "zod";
+
+// ../core/src/derive.ts
+function deriveEdges(nodes) {
+  const byAddress = new Set(nodes.map((n) => n.id));
+  const byPhysicalId = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    const pid = n.attributes["id"];
+    if (typeof pid === "string" && pid.length > 0) byPhysicalId.set(pid, n.id);
+  }
+  const edges = /* @__PURE__ */ new Map();
+  const add = (source, target) => {
+    if (source === target) return;
+    const id = `${source}->${target}`;
+    edges.set(id, { id, source, target });
+  };
+  for (const n of nodes) {
+    for (const dep of n.dependsOn) if (byAddress.has(dep)) add(dep, n.id);
+    for (const [key, v] of Object.entries(n.attributes)) {
+      if (key === "id" || typeof v !== "string") continue;
+      const target = byPhysicalId.get(v);
+      if (target) add(target, n.id);
+    }
+  }
+  return [...edges.values()];
+}
+var DEFAULT_CONTAINMENT_RULES = [
+  { containerType: "aws_vpc", memberAttr: "vpc_id", kind: "vpc" },
+  { containerType: "aws_subnet", memberAttr: "subnet_id", kind: "subnet" }
+];
+function deriveContainment(g, rules = DEFAULT_CONTAINMENT_RULES) {
+  const groups = [...g.groups];
+  const nodes = g.nodes.map((n) => ({ ...n }));
+  for (const rule of rules) {
+    const groupByPhysicalId = /* @__PURE__ */ new Map();
+    for (const n of nodes.filter((n2) => n2.type === rule.containerType)) {
+      const pid = n.attributes["id"];
+      if (typeof pid !== "string") continue;
+      const gid = `${rule.kind}:${n.id}`;
+      groups.push({ id: gid, label: n.name, kind: rule.kind, parent: n.group });
+      groupByPhysicalId.set(pid, gid);
+      n.group = gid;
+    }
+    for (const n of nodes) {
+      if (n.type === rule.containerType) continue;
+      const ref = n.attributes[rule.memberAttr];
+      if (typeof ref === "string" && groupByPhysicalId.has(ref))
+        n.group = groupByPhysicalId.get(ref);
+    }
+  }
+  return { ...g, nodes, groups };
+}
+
+// ../core/src/parse-state.ts
+function shortProvider(providerName) {
+  if (!providerName) return "unknown";
+  const last = providerName.split("/").pop() ?? providerName;
+  return last;
+}
+function maskSensitiveElement(v, s) {
+  if (s === true) return "\u2022\u2022\u2022";
+  if (Array.isArray(s) && Array.isArray(v)) return v.map((el, i) => maskSensitiveElement(el, s[i]));
+  if (s && typeof s === "object" && v && typeof v === "object" && !Array.isArray(v))
+    return maskSensitive(v, s);
+  return v;
+}
+function maskSensitive(values, sensitive) {
+  if (!sensitive || typeof sensitive !== "object") return values;
+  const s = sensitive;
+  const out = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (s[k] === true) out[k] = "\u2022\u2022\u2022";
+    else if (Array.isArray(s[k]) && Array.isArray(v))
+      out[k] = v.map((el, i) => maskSensitiveElement(el, s[k][i]));
+    else if (s[k] && typeof s[k] === "object" && v && typeof v === "object" && !Array.isArray(v))
+      out[k] = maskSensitive(v, s[k]);
+    else out[k] = v;
+  }
+  return out;
+}
+function walkModule(mod, parentGroup, nodes, groups) {
+  let groupId = parentGroup;
+  if (mod.address) {
+    groupId = mod.address;
+    groups.push({
+      id: mod.address,
+      label: mod.address.split(".").pop() ?? mod.address,
+      kind: "module",
+      parent: parentGroup
+    });
+  }
+  for (const r of mod.resources ?? []) {
+    if (r.mode !== "managed") continue;
+    nodes.push({
+      id: r.address,
+      type: r.type,
+      name: r.name,
+      provider: shortProvider(r.provider_name),
+      group: groupId,
+      attributes: maskSensitive(r.values ?? {}, r.sensitive_values),
+      status: "noop",
+      dependsOn: r.depends_on ?? []
+    });
+  }
+  for (const child of mod.child_modules ?? []) walkModule(child, groupId, nodes, groups);
+}
+function parseState(showJson) {
+  const nodes = [];
+  const groups = [];
+  const root = showJson?.values?.root_module;
+  if (root) walkModule(root, null, nodes, groups);
+  const base = { nodes, edges: [], groups };
+  const contained = deriveContainment(base);
+  return { ...contained, edges: deriveEdges(contained.nodes) };
+}
+
+// ../core/src/apply-plan.ts
+function maskChange(value, sensitive) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  return maskSensitive(value, sensitive);
+}
+function statusOf(actions) {
+  if (actions.includes("create") && actions.includes("delete")) return "replace";
+  if (actions.includes("create")) return "create";
+  if (actions.includes("delete")) return "delete";
+  if (actions.includes("update")) return "update";
+  return "noop";
+}
+function diffAttrs(rawBefore, rawAfter, maskedBefore, maskedAfter) {
+  const rb = rawBefore ?? {};
+  const ra = rawAfter ?? {};
+  const mb = maskedBefore ?? {};
+  const ma = maskedAfter ?? {};
+  const keys = [.../* @__PURE__ */ new Set([...Object.keys(rb), ...Object.keys(ra)])].sort();
+  const out = [];
+  for (const k of keys) {
+    if (JSON.stringify(rb[k]) !== JSON.stringify(ra[k]))
+      out.push({ key: k, before: mb[k] ?? null, after: ma[k] ?? null });
+  }
+  return out;
+}
+function moduleOf(address) {
+  const parts = address.split(".");
+  if (parts[0] !== "module") return null;
+  const chain = [];
+  for (let i = 0; i + 1 < parts.length && parts[i] === "module"; i += 2)
+    chain.push(`module.${parts[i + 1]}`);
+  return chain.length ? chain.join(".") : null;
+}
+function applyPlan(g, planJson) {
+  const changes = planJson?.resource_changes ?? [];
+  const nodes = new Map(
+    g.nodes.map((n) => [n.id, { ...n, status: "noop", attributeDiff: void 0 }])
+  );
+  const groups = [...g.groups];
+  for (const c of changes) {
+    const status = statusOf(c.change?.actions ?? []);
+    if (status === "noop") continue;
+    const before = maskChange(c.change?.before, c.change?.before_sensitive);
+    const after = maskChange(c.change?.after, c.change?.after_sensitive);
+    const existing = nodes.get(c.address);
+    if (existing) {
+      existing.status = status;
+      existing.attributeDiff = diffAttrs(c.change?.before, c.change?.after, before, after);
+    } else if (status === "create") {
+      const group = moduleOf(c.address);
+      if (group && !groups.some((x) => x.id === group)) {
+        const parentChain = group.split(".").slice(0, -2).join(".");
+        groups.push({
+          id: group,
+          label: group.split(".").pop() ?? group,
+          kind: "module",
+          parent: parentChain.startsWith("module.") ? parentChain : null
+        });
+      }
+      nodes.set(c.address, {
+        id: c.address,
+        type: c.type,
+        name: c.name,
+        provider: shortProvider(c.provider_name),
+        group,
+        attributes: after ?? {},
+        status: "create",
+        attributeDiff: diffAttrs(null, c.change?.after, null, after),
+        dependsOn: []
+      });
+    }
+  }
+  const merged = [...nodes.values()];
+  return { nodes: merged, edges: deriveEdges(merged), groups };
+}
+
+// ../core/src/summarize.ts
+function summarizeGraph(g) {
+  const byType = /* @__PURE__ */ new Map();
+  for (const n of g.nodes) byType.set(n.type, (byType.get(n.type) ?? 0) + 1);
+  const typeLines = [...byType.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([t, c]) => `  ${t}: ${c}`);
+  const changes = g.nodes.filter((n) => n.status !== "noop").map((n) => `  ${n.status}: ${n.id}`).sort();
+  return [
+    `${g.nodes.length} resources, ${g.edges.length} edges, ${g.groups.length} groups.`,
+    "By type:",
+    ...typeLines,
+    changes.length ? "Pending plan changes:" : "No pending plan changes.",
+    ...changes
+  ].join("\n");
+}
+
+// ../core/src/compose.ts
+function composeGraphs(snapshots) {
+  const nodes = /* @__PURE__ */ new Map();
+  const groups = /* @__PURE__ */ new Map();
+  const conflicts = [];
+  for (const snap of snapshots) {
+    for (const n of snap.graph.nodes) {
+      if (nodes.has(n.id)) {
+        conflicts.push({ id: n.id, origin: snap.origin });
+        continue;
+      }
+      nodes.set(n.id, { ...n, origin: snap.origin });
+    }
+    for (const g of snap.graph.groups) {
+      if (groups.has(g.id)) {
+        conflicts.push({ id: g.id, origin: snap.origin });
+        continue;
+      }
+      groups.set(g.id, { ...g, origin: snap.origin });
+    }
+  }
+  const edgesById = /* @__PURE__ */ new Map();
+  for (const snap of snapshots) {
+    for (const e of snap.graph.edges) {
+      if (!edgesById.has(e.id)) edgesById.set(e.id, e);
+    }
+  }
+  const edges = [...edgesById.values()].filter((e) => nodes.has(e.source) && nodes.has(e.target));
+  let stale;
+  if (snapshots.length === 1) {
+    stale = snapshots[0].stale;
+  } else {
+    const parts = snapshots.filter((s) => s.stale !== null).map((s) => `${s.origin}: ${s.stale}`);
+    stale = parts.length > 0 ? parts.join("; ") : null;
+  }
+  return {
+    graph: { nodes: [...nodes.values()], edges, groups: [...groups.values()] },
+    stale,
+    conflicts
+  };
+}
+
+// ../server/src/find-port.ts
+import net from "net";
+async function findPort(start) {
+  for (let port = start; port < start + 50; port++) {
+    const free = await new Promise((resolve2) => {
+      const srv = net.createServer();
+      srv.once("error", () => resolve2(false));
+      srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
+    });
+    if (free) return port;
+  }
+  throw new Error(`No free port found in ${start}..${start + 49}`);
+}
+
+// ../server/src/intent-queue.ts
+var IntentQueue = class {
+  queue = [];
+  waiters = [];
+  push(intent) {
+    const waiter = this.waiters.shift();
+    if (waiter) waiter(intent);
+    else this.queue.push(intent);
+  }
+  take(timeoutMs) {
+    const queued = this.queue.shift();
+    if (queued) return Promise.resolve(queued);
+    return new Promise((resolve2) => {
+      const timer = setTimeout(() => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        resolve2(null);
+      }, timeoutMs);
+      const waiter = (i) => {
+        clearTimeout(timer);
+        resolve2(i);
+      };
+      this.waiters.push(waiter);
+    });
+  }
+};
+
+// ../server/src/telemetry.ts
+import { randomUUID } from "crypto";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function nodesBucket(n) {
+  if (n <= 0) return "0";
+  if (n <= 10) return "1-10";
+  if (n <= 50) return "11-50";
+  if (n <= 200) return "51-200";
+  return "200+";
+}
+var TELEMETRY_SCHEMA_VERSION = 1;
+var DEFAULT_ENDPOINT = "https://t.stackcanvas.dev/e";
+var defaultTransport = (input, init) => globalThis.fetch(input, init);
+function todayUtc() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function mapPlatform(p) {
+  if (p === "darwin" || p === "linux" || p === "win32") return p;
+  return "other";
+}
+function nodeMajor() {
+  return Number(process.versions.node.split(".")[0]);
+}
+function capCount(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(50, Math.trunc(n)));
+}
+function capPayload(props) {
+  if (props.event !== "intent_sent") return props;
+  return {
+    event: "intent_sent",
+    add: capCount(props.add),
+    modify: capCount(props.modify),
+    remove: capCount(props.remove),
+    adopt: capCount(props.adopt),
+    investigate: capCount(props.investigate)
+  };
+}
+var TelemetryClient = class {
+  configPath;
+  endpoint;
+  fetchImpl;
+  env;
+  appVersion;
+  constructor(opts) {
+    this.env = opts.env ?? process.env;
+    const configDir = this.env.STACKCANVAS_CONFIG_DIR || join(homedir(), ".stackcanvas");
+    this.configPath = opts.configPath ?? join(configDir, "config.json");
+    this.endpoint = opts.endpoint ?? DEFAULT_ENDPOINT;
+    this.fetchImpl = opts.fetchImpl ?? defaultTransport;
+    this.appVersion = opts.appVersion;
+  }
+  /** Never throws: unreadable/corrupt config is treated as an empty config. */
+  readConfig() {
+    try {
+      const raw = readFileSync(this.configPath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") return parsed;
+      return {};
+    } catch {
+      return {};
+    }
+  }
+  /** Atomic write (.tmp + rename); never throws — a write failure just means
+   *  the banner/consent may re-prompt next launch, which is acceptable. */
+  writeConfig(cfg) {
+    try {
+      const dir = dirname(this.configPath);
+      mkdirSync(dir, { recursive: true });
+      const tmp = `${this.configPath}.tmp`;
+      writeFileSync(tmp, JSON.stringify(cfg, null, 2));
+      renameSync(tmp, this.configPath);
+    } catch {
+    }
+  }
+  /** env overrides > config > 'unset'. DO_NOT_TRACK=1 / STACKCANVAS_TELEMETRY=0
+   *  always win, regardless of what's on disk. STACKCANVAS_TELEMETRY=1 is
+   *  deliberately NOT handled here — it only un-hides the consent banner
+   *  (PR#5 UI concern), it never grants consent by itself. */
+  getConsent() {
+    if (this.env.DO_NOT_TRACK === "1" || this.env.STACKCANVAS_TELEMETRY === "0") return "disabled_env";
+    const consent = this.readConfig().telemetry?.consent;
+    if (consent === "granted") return "granted";
+    if (consent === "denied") return "denied";
+    return "unset";
+  }
+  /** grant: mints a fresh anonId, emits 'install' exactly once ever (tracked
+   *  via installReportedAt, which survives a later deny).
+   *  deny: deletes anonId, leaves installReportedAt untouched. */
+  setConsent(granted) {
+    const cfg = this.readConfig();
+    const prevInstallReportedAt = cfg.telemetry?.installReportedAt;
+    const today = todayUtc();
+    if (granted) {
+      const shouldReportInstall = !prevInstallReportedAt;
+      const telemetry = {
+        consent: "granted",
+        anonId: randomUUID(),
+        decidedAt: today,
+        ...shouldReportInstall ? { installReportedAt: today } : { installReportedAt: prevInstallReportedAt }
+      };
+      this.writeConfig({ ...cfg, telemetry });
+      if (shouldReportInstall) this.emit({ event: "install" });
+    } else {
+      const telemetry = {
+        consent: "denied",
+        decidedAt: today,
+        ...prevInstallReportedAt ? { installReportedAt: prevInstallReportedAt } : {}
+      };
+      this.writeConfig({ ...cfg, telemetry });
+    }
+  }
+  /** No-op unless consent === 'granted'. Fire-and-forget: no retries, no
+   *  queue, no logging (stdout is the MCP transport). Never throws. */
+  emit(props) {
+    if (this.getConsent() !== "granted") return;
+    const anonId = this.readConfig().telemetry?.anonId;
+    if (!anonId) return;
+    const envelope = {
+      schema: TELEMETRY_SCHEMA_VERSION,
+      anon_id: anonId,
+      day: todayUtc(),
+      app_version: this.appVersion,
+      platform: mapPlatform(process.platform),
+      node_major: nodeMajor(),
+      payload: capPayload(props)
+    };
+    try {
+      const result = this.fetchImpl(this.endpoint, {
+        method: "POST",
+        body: JSON.stringify(envelope),
+        signal: AbortSignal.timeout(3e3)
+      });
+      void Promise.resolve(result).catch(() => {
+      });
+    } catch {
+    }
+  }
+};
+
+// ../server/src/providers/terraform.ts
+import { execFile } from "child_process";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { basename, join as join2, sep } from "path";
+import { promisify } from "util";
+import chokidar from "chokidar";
+var execFileAsync = promisify(execFile);
+async function defaultProbe(bin) {
+  try {
+    await execFileAsync(bin, ["version"], { timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveTfBinary(explicit, opts = {}) {
+  if (explicit) return explicit;
+  const envBin = process.env.STACKCANVAS_TF_BIN;
+  if (envBin) return envBin;
+  const probe = opts.probe ?? defaultProbe;
+  if (await probe("terraform")) return "terraform";
+  if (await probe("tofu")) return "tofu";
+  return null;
+}
+function createShowRunner(getBinary) {
+  return async (cwd, planPath) => {
+    const bin = getBinary();
+    if (bin === null)
+      throw new Error("No terraform or tofu binary found in PATH. Install one or set STACKCANVAS_TF_BIN.");
+    const args = ["show", "-json", ...planPath ? [planPath] : []];
+    try {
+      const { stdout } = await execFileAsync(bin, args, { cwd, maxBuffer: 256 * 1024 * 1024 });
+      return stdout;
+    } catch (err) {
+      const e = err;
+      if (e.code === "ENOENT")
+        throw new Error(`${bin} binary not found in PATH. Install Terraform or add it to PATH.`);
+      throw new Error(`${bin} show failed: ${err.message}`);
+    }
+  };
+}
+function binaryKind(binaryUsed) {
+  if (!binaryUsed) return "unknown";
+  const name = basename(binaryUsed).toLowerCase().replace(/\.exe$/, "");
+  if (name === "terraform") return "terraform";
+  if (name === "tofu") return "tofu";
+  return "unknown";
+}
+var TerraformProvider = class {
+  origin = "terraform";
+  dir;
+  /** Always true — terraform state is local and cheap to read, so it keeps
+   *  today's zero-config auto-refresh-on-start behavior. */
+  refreshOnStart = true;
+  /** Resolved by init() (and re-resolved by refresh() while still null); null
+   *  = none found (or runShow injected, which skips detection entirely).
+   *  Telemetry's `tf_bin` event property reads this via `binaryKind()`. */
+  binaryUsed = null;
+  get label() {
+    return this.binaryUsed ? `Terraform (${this.dir}) via ${this.binaryUsed}` : `Terraform (${this.dir})`;
+  }
+  run;
+  injectedRunShow;
+  explicitBinary;
+  binaryResolveAttempted = false;
+  graph = { nodes: [], edges: [], groups: [] };
+  stale = null;
+  planJson = null;
+  planPath = null;
+  watcher = null;
+  refreshTimer = null;
+  disposed = false;
+  pushFn = null;
+  debounceMs;
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.injectedRunShow = opts.runShow !== void 0;
+    this.explicitBinary = opts.binary;
+    this.run = opts.runShow ?? createShowRunner(() => this.binaryUsed);
+    this.debounceMs = opts.debounceMs ?? 300;
+  }
+  snapshot() {
+    return { origin: this.origin, graph: this.graph, stale: this.stale };
+  }
+  /** Re-resolves `binaryUsed` if binary detection hasn't been attempted yet
+   *  and no runShow was injected (which bypasses detection entirely). Called
+   *  from both init() (once, up front) and refresh() (only while still null,
+   *  so installing terraform/tofu after a failed resolution recovers on the
+   *  next refresh without a restart — resolveTfBinary itself has no cache,
+   *  so a fresh probe is exactly what re-running it gives us). */
+  async resolveBinary() {
+    this.binaryResolveAttempted = true;
+    if (this.injectedRunShow) return;
+    this.binaryUsed = await resolveTfBinary(this.explicitBinary);
+  }
+  /** Validate config and detect tooling: resolves the terraform/tofu binary
+   *  (skipped when runShow was injected) and (re)creates the chokidar
+   *  watcher, awaiting its 'ready' event: inotify (Linux) delivers no events
+   *  for writes that land before the watcher is ready, so callers that await
+   *  init() before mutating the watched directory don't lose that first
+   *  change — the same guarantee today's canvas-server.ts got by awaiting
+   *  'ready' directly in start(). SourceProvider.watch() itself must stay
+   *  synchronous per the interface, so this is the one place that can still
+   *  block on it. Never throws for a missing binary — that surfaces as
+   *  `stale` on refresh(), same as before this detection was added.
+   *  Idempotent: binary resolution runs once; the watcher setup is a no-op
+   *  once the watcher exists. */
+  async init() {
+    if (!this.binaryResolveAttempted) await this.resolveBinary();
+    if (this.watcher) return;
+    const planPath = join2(this.dir, ".stackcanvas", "plan.json");
+    const watcher = chokidar.watch(this.dir, {
+      ignoreInitial: true,
+      ignored: (path, stats) => {
+        if (path.includes(`${sep}.terraform${sep}`) || path.endsWith(`${sep}.terraform`)) return true;
+        if (stats && !stats.isDirectory() && !path.endsWith(".tfstate") && path !== planPath) return true;
+        return false;
+      }
+    });
+    watcher.on("all", () => this.scheduleRefresh());
+    watcher.on("error", (err) => {
+      this.stale = err.message;
+      if (!this.disposed) this.pushFn?.(this.snapshot());
+    });
+    await new Promise((res) => watcher.once("ready", () => res()));
+    this.watcher = watcher;
+    this.disposed = false;
+  }
+  /** `force` ignored (no cache to bypass); `onProgress`, if passed, is never
+   *  invoked — a terraform `show` read has no meaningful sub-steps to report. */
+  async refresh(_opts) {
+    if (this.binaryUsed === null && !this.injectedRunShow) await this.resolveBinary();
+    try {
+      const stateJson = JSON.parse(await this.run(this.dir));
+      let g = parseState(stateJson);
+      if (this.planJson) g = applyPlan(g, this.planJson);
+      this.graph = g;
+      this.stale = null;
+    } catch (err) {
+      this.stale = err.message;
+    }
+    return this.snapshot();
+  }
+  /** Arms the delivery callback for (debounced) watcher-driven snapshots.
+   *  Watching itself starts in init() (see above); this just registers where
+   *  pushes land, so it's trivially idempotent and safe to call repeatedly. */
+  watch(push) {
+    this.pushFn = push;
+  }
+  /** Terraform-specific — deliberately NOT on SourceProvider. Same body as
+   *  today's CanvasServer.loadPlan: .json → readFileSync+JSON.parse, else
+   *  run(dir, path). THROWS on failure (MCP load_plan relies on it), then
+   *  returns the refreshed snapshot. */
+  async loadPlan(path) {
+    if (path.endsWith(".json")) this.planJson = JSON.parse(readFileSync2(path, "utf8"));
+    else this.planJson = JSON.parse(await this.run(this.dir, path));
+    this.planPath = path;
+    return this.refresh();
+  }
+  scheduleRefresh() {
+    if (this.refreshTimer) clearTimeout(this.refreshTimer);
+    this.refreshTimer = setTimeout(() => {
+      void (async () => {
+        try {
+          const autoPlan = join2(this.dir, ".stackcanvas", "plan.json");
+          if (this.planPath === null && existsSync(autoPlan)) await this.loadPlan(autoPlan);
+          else if (this.planPath?.endsWith(".json") && existsSync(this.planPath))
+            this.planJson = JSON.parse(readFileSync2(this.planPath, "utf8"));
+          const snap = await this.refresh();
+          if (!this.disposed) this.pushFn?.(snap);
+        } catch (err) {
+          this.stale = err.message;
+          if (!this.disposed) this.pushFn?.(this.snapshot());
+        }
+      })();
+    }, this.debounceMs);
+  }
+  async dispose() {
+    if (this.refreshTimer) clearTimeout(this.refreshTimer);
+    this.refreshTimer = null;
+    this.disposed = true;
+    await this.watcher?.close();
+    this.watcher = null;
+  }
+};
+
+// ../server/src/canvas-server.ts
+var intentSchema = z.object({
+  add: z.array(z.object({
+    type: z.string().min(1),
+    name: z.string().optional(),
+    wishes: z.string().optional(),
+    connect_to: z.array(z.string())
+  })),
+  modify: z.array(z.object({ address: z.string().min(1), wishes: z.string() })),
+  remove: z.array(z.object({ address: z.string().min(1) }))
+});
+var MIME = {
+  ".html": "text/html",
+  ".js": "text/javascript",
+  ".css": "text/css",
+  ".svg": "image/svg+xml",
+  ".json": "application/json",
+  ".ico": "image/x-icon"
+};
+var BROWSER_TELEMETRY_EVENTS = /* @__PURE__ */ new Set(["drift_opened"]);
+var CanvasServer = class {
+  dir;
+  uiDist;
+  fixedPort;
+  portRangeStart;
+  graph = { nodes: [], edges: [], groups: [] };
+  stale = null;
+  httpServer = null;
+  onGraphChange = [];
+  wss = null;
+  intents = new IntentQueue();
+  agentStatus = "idle";
+  telemetry;
+  tf;
+  providers;
+  extraProviders;
+  snapshots = /* @__PURE__ */ new Map();
+  conflicts = [];
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.uiDist = opts.uiDist;
+    this.fixedPort = opts.port;
+    this.portRangeStart = opts.portRangeStart ?? 4680;
+    this.telemetry = opts.telemetry ?? new TelemetryClient({ appVersion: "0.1.0" });
+    this.tf = new TerraformProvider({ dir: opts.dir, runShow: opts.runTerraformShow, binary: opts.tfBinary });
+    this.providers = [this.tf];
+    this.extraProviders = opts.extraProviders ?? [];
+    this.subscribe((graph, stale) => this.broadcast({ type: "graph", graph, stale }));
+  }
+  getGraph() {
+    return this.graph;
+  }
+  getStale() {
+    return this.stale;
+  }
+  subscribe(fn) {
+    this.onGraphChange.push(fn);
+  }
+  awaitIntent(timeoutMs) {
+    return this.intents.take(timeoutMs);
+  }
+  setAgentStatus(s) {
+    this.agentStatus = s;
+    this.broadcast({ type: "agent_status", status: s });
+  }
+  /** Kept public, same signature as today. Targets the typed `tf` reference
+   *  directly — plan concepts never leak onto the SourceProvider interface. */
+  async loadPlan(path) {
+    this.onSnapshot(await this.tf.loadPlan(path));
+  }
+  recompose() {
+    const snaps = this.providers.map((p) => this.snapshots.get(p.origin)).filter((s) => s !== void 0);
+    const composed = composeGraphs(snaps);
+    this.graph = composed.graph;
+    this.stale = composed.stale;
+    this.conflicts = composed.conflicts;
+    if (this.conflicts.length > 0)
+      console.error(`stackcanvas: dropped id conflicts during compose: ${JSON.stringify(this.conflicts)}`);
+    for (const fn of this.onGraphChange) fn(this.graph, this.stale);
+  }
+  onSnapshot(s) {
+    this.snapshots.set(s.origin, s);
+    this.recompose();
+  }
+  /** @experimental Registers (or replaces, if `p.origin` is already present)
+   *  a SourceProvider: awaits init(), refreshes it up front when
+   *  `refreshOnStart` is true (mirroring refreshGraph()'s own filter),
+   *  subscribes to watch(), then recomposes so the change — a populated
+   *  graph, or the still-empty last-good graph for a live provider that
+   *  hasn't scanned yet — reaches WS subscribers immediately. */
+  async addProvider(p) {
+    const existingIdx = this.providers.findIndex((x) => x.origin === p.origin);
+    if (existingIdx !== -1) {
+      await this.providers[existingIdx].dispose();
+      this.providers.splice(existingIdx, 1);
+      this.snapshots.delete(p.origin);
+    }
+    await p.init();
+    if (p.refreshOnStart) this.snapshots.set(p.origin, await p.refresh());
+    this.providers.push(p);
+    p.watch((s) => this.onSnapshot(s));
+    this.recompose();
+  }
+  /** @experimental Disposes and drops `origin` from composition; no-op if
+   *  it isn't currently registered. */
+  async removeProvider(origin) {
+    const idx = this.providers.findIndex((p2) => p2.origin === origin);
+    if (idx === -1) return;
+    const [p] = this.providers.splice(idx, 1);
+    await p.dispose();
+    this.snapshots.delete(origin);
+    this.recompose();
+  }
+  broadcast(msg) {
+    const data = JSON.stringify(msg);
+    for (const client of this.wss?.clients ?? [])
+      if (client.readyState === WebSocket.OPEN) client.send(data);
+  }
+  /** Kept public name/signature — tests and callers rely on it. Refreshes
+   *  only providers where `refreshOnStart` is true; a `refreshOnStart: false`
+   *  provider (e.g. a future live-scan source) is skipped here — its
+   *  snapshot is only ever surfaced via addProvider() or an explicit,
+   *  provider-targeted `refresh({force: true})` — so this never triggers an
+   *  implicit scan-like call. */
+  async refreshGraph() {
+    const targets = this.providers.filter((p) => p.refreshOnStart);
+    const snaps = await Promise.all(targets.map((p) => p.refresh()));
+    for (const s of snaps) this.snapshots.set(s.origin, s);
+    this.recompose();
+  }
+  buildApp() {
+    const app = new Hono();
+    app.use("/api/*", async (c, next) => {
+      if (c.req.method !== "POST") return next();
+      const host = c.req.header("host") ?? "";
+      const hostname = host.split(":")[0];
+      if (hostname !== "127.0.0.1" && hostname !== "localhost")
+        return c.json({ error: "forbidden origin" }, 403);
+      const origin = c.req.header("origin");
+      if (origin) {
+        try {
+          const originUrl = new URL(origin);
+          if (originUrl.protocol !== "http:" || originUrl.hostname !== "127.0.0.1" && originUrl.hostname !== "localhost") return c.json({ error: "forbidden origin" }, 403);
+        } catch {
+          return c.json({ error: "forbidden origin" }, 403);
+        }
+      }
+      return next();
+    });
+    app.get("/api/graph", (c) => c.json(this.graph));
+    app.get("/api/meta", (c) => c.json({
+      dir: this.dir,
+      stale: this.stale,
+      providers: this.providers.map((p) => {
+        const snap = this.snapshots.get(p.origin);
+        const entry = { origin: p.origin, label: p.label, stale: snap?.stale ?? null };
+        if (snap?.meta?.scannedAt !== void 0) entry.scannedAt = snap.meta.scannedAt;
+        if (snap?.meta?.errors !== void 0) entry.errors = snap.meta.errors;
+        return entry;
+      }),
+      conflicts: this.conflicts
+    }));
+    app.post("/api/intent", async (c) => {
+      const parsed = intentSchema.safeParse(await c.req.json().catch(() => null));
+      if (!parsed.success) return c.json({ error: "invalid intent" }, 400);
+      this.intents.push(parsed.data);
+      this.telemetry.emit({
+        event: "intent_sent",
+        add: parsed.data.add.length,
+        modify: parsed.data.modify.length,
+        remove: parsed.data.remove.length,
+        adopt: 0,
+        investigate: 0
+      });
+      return c.json({ queued: true }, 202);
+    });
+    app.get("/api/telemetry", (c) => c.json({ consent: this.telemetry.getConsent() }));
+    app.post("/api/telemetry", async (c) => {
+      const body = await c.req.json().catch(() => null);
+      if (!body || typeof body.granted !== "boolean") return c.json({ error: "invalid body" }, 400);
+      this.telemetry.setConsent(body.granted);
+      return c.json({ consent: this.telemetry.getConsent() }, 200);
+    });
+    app.post("/api/telemetry/event", async (c) => {
+      const body = await c.req.json().catch(() => null);
+      const name = body?.name;
+      if (typeof name !== "string" || !BROWSER_TELEMETRY_EVENTS.has(name))
+        return c.json({ error: "unknown event" }, 400);
+      if (this.telemetry.getConsent() === "granted") {
+        this.telemetry.emit({ event: "drift_opened", nodes_bucket: nodesBucket(this.graph.nodes.length) });
+      }
+      return c.json({ ok: true }, 200);
+    });
+    if (this.uiDist) {
+      const dist = resolve(this.uiDist);
+      app.get("*", (c) => {
+        const decoded = decodeURIComponent(c.req.path);
+        const reqPath = decoded === "/" ? "/index.html" : decoded;
+        const file = resolve(dist, "." + reqPath);
+        const contained = file === dist || file.startsWith(dist + sep2);
+        if (contained && existsSync2(file) && statSync(file).isFile()) {
+          return c.body(readFileSync3(file), 200, {
+            "content-type": MIME[extname(file)] ?? "application/octet-stream"
+          });
+        }
+        return c.body(readFileSync3(join3(dist, "index.html")), 200, { "content-type": "text/html" });
+      });
+    }
+    return app;
+  }
+  bindServer(port, app) {
+    return new Promise((resolve2, reject) => {
+      const srv = serve({ fetch: app.fetch, port, hostname: "127.0.0.1" });
+      const onError = (err) => {
+        srv.removeListener("listening", onListening);
+        reject(err);
+      };
+      const onListening = () => {
+        srv.removeListener("error", onError);
+        resolve2(srv);
+      };
+      srv.once("error", onError);
+      srv.once("listening", onListening);
+    });
+  }
+  async start() {
+    if (this.httpServer) throw new Error("CanvasServer already started");
+    if (!existsSync2(this.dir)) throw new Error(`Directory not found: ${this.dir}`);
+    await this.tf.init();
+    await this.refreshGraph();
+    const explicitPort = this.fixedPort !== void 0;
+    let port = this.fixedPort ?? await findPort(this.portRangeStart);
+    const app = this.buildApp();
+    const maxAttempts = 10;
+    let httpServer;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      try {
+        httpServer = await this.bindServer(port, app);
+        break;
+      } catch (err) {
+        const e = err;
+        if (e.code === "EADDRINUSE" && !explicitPort && attempt < maxAttempts - 1) {
+          port++;
+          continue;
+        }
+        throw err;
+      }
+    }
+    this.httpServer = httpServer;
+    this.wss = new WebSocketServer({ noServer: true });
+    this.httpServer.on("upgrade", (req, socket, head) => {
+      if (req.url === "/ws") {
+        this.wss.handleUpgrade(req, socket, head, (ws) => {
+          ws.send(JSON.stringify({ type: "graph", graph: this.graph, stale: this.stale }));
+          ws.send(JSON.stringify({ type: "agent_status", status: this.agentStatus }));
+        });
+      } else socket.destroy();
+    });
+    this.tf.watch((s) => this.onSnapshot(s));
+    this.telemetry.emit({
+      event: "canvas_opened",
+      nodes_bucket: nodesBucket(this.graph.nodes.length),
+      tf_bin: binaryKind(this.tf.binaryUsed)
+    });
+    await Promise.all(this.extraProviders.map((p) => this.addProvider(p)));
+    return { port, url: `http://127.0.0.1:${port}` };
+  }
+  async stop() {
+    await Promise.all(this.providers.map((p) => p.dispose()));
+    for (const c of this.wss?.clients ?? []) c.terminate();
+    this.wss?.close();
+    this.wss = null;
+    await new Promise((resolve2) => {
+      if (!this.httpServer) return resolve2();
+      const srv = this.httpServer;
+      srv.closeAllConnections?.();
+      srv.close(() => resolve2());
+    });
+    this.httpServer = null;
+  }
+};
+
+// src/server.ts
+import { existsSync as existsSync3, readdirSync } from "fs";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z as z2 } from "zod";
+
+// src/open-browser.ts
+import { execFile as execFile2 } from "child_process";
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  execFile2(cmd, args, () => {
+  });
+}
+
+// src/version.ts
+var VERSION = "0.2.0";
+
+// src/server.ts
+function looksLikeTerraformRoot(dir) {
+  if (!existsSync3(dir)) return false;
+  const entries = readdirSync(dir);
+  return entries.some((f) => f.endsWith(".tf") || f.endsWith(".tfstate"));
+}
+var ok = (msg) => ({ content: [{ type: "text", text: msg }] });
+var fail = (msg) => ({ content: [{ type: "text", text: msg }], isError: true });
+function createMcpServer(deps = {}) {
+  const makeCanvas = deps.makeCanvas ?? ((dir) => new CanvasServer({ dir }));
+  const open = deps.openBrowser ?? openBrowser;
+  let canvas = null;
+  let url = null;
+  const mcp = new McpServer({ name: "stackcanvas", version: VERSION });
+  mcp.registerTool("open_canvas", {
+    description: "Start (or reuse) the stackcanvas live infrastructure canvas for a Terraform root directory. Opens the UI in the browser and returns its URL.",
+    inputSchema: { dir: z2.string().describe("Absolute path to the Terraform root directory") }
+  }, async ({ dir }) => {
+    if (!looksLikeTerraformRoot(dir))
+      return fail(`${dir} does not look like a Terraform root (no .tf or .tfstate files). Pass the directory that contains the Terraform configuration.`);
+    if (canvas && canvas.dir !== dir) {
+      await canvas.stop();
+      canvas = null;
+    }
+    if (!canvas) {
+      const next = makeCanvas(dir);
+      try {
+        const started = await next.start();
+        url = started.url;
+      } catch (err) {
+        await next.stop().catch(() => {
+        });
+        return fail(`Failed to start canvas: ${err.message}`);
+      }
+      canvas = next;
+      canvas.setAgentStatus("idle");
+      open(url);
+    }
+    return ok(`Canvas running at ${url}. The graph live-updates as tfstate changes. Run \`terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json\` (or \`tofu plan \u2026\` with OpenTofu) to show the plan diff, then call await_canvas_intent to receive user edits.`);
+  });
+  mcp.registerTool("load_plan", {
+    description: "Register a Terraform plan for diff highlighting on the canvas. Accepts a JSON plan (terraform show -json output) or a binary plan file.",
+    inputSchema: { path: z2.string().describe("Path to plan file (.json preferred)") }
+  }, async ({ path }) => {
+    if (!canvas) return fail("No canvas open. Call open_canvas first.");
+    canvas.setAgentStatus("planning");
+    try {
+      await canvas.loadPlan(path);
+      return ok("Plan loaded; canvas now highlights pending changes.");
+    } catch (err) {
+      return fail(`Failed to load plan: ${err.message}`);
+    } finally {
+      canvas.setAgentStatus("idle");
+    }
+  });
+  mcp.registerTool("get_graph_summary", {
+    description: "Get a compact text summary of the current infrastructure graph.",
+    inputSchema: {}
+  }, async () => {
+    if (!canvas) return fail("No canvas open. Call open_canvas first.");
+    return ok(summarizeGraph(canvas.getGraph()));
+  });
+  mcp.registerTool("await_canvas_intent", {
+    description: "Block until the user clicks Apply on the canvas, then return their requested changes as intent JSON: {intent: {add, modify, remove} | null}. null = timeout, call again in a loop to keep waiting. After receiving an intent, write the Terraform code for it.",
+    inputSchema: {
+      timeoutSeconds: z2.number().positive().max(3600).default(45).describe("How long to wait before returning {intent: null}. Default 45s: MCP clients commonly abort requests after 60s, so keep this under your client's request timeout and call the tool in a loop instead of passing large values.")
+    }
+  }, async ({ timeoutSeconds }) => {
+    if (!canvas) return fail("No canvas open. Call open_canvas first.");
+    canvas.setAgentStatus("idle");
+    const intent = await canvas.awaitIntent(timeoutSeconds * 1e3);
+    if (intent) canvas.setAgentStatus("writing");
+    return ok(JSON.stringify({ intent }));
+  });
+  return mcp;
+}
+
+// src/cli.ts
+var uiDist = join4(dirname2(fileURLToPath(import.meta.url)), "..", "ui-dist");
+function arg(name) {
+  const i = process.argv.indexOf(`--${name}`);
+  return i >= 0 ? process.argv[i + 1] : void 0;
+}
+async function main() {
+  const telemetry = new TelemetryClient({ appVersion: VERSION });
+  if (process.argv[2] === "serve") {
+    const dir = arg("dir") ?? process.cwd();
+    const fixture = arg("fixture");
+    const port = arg("port");
+    const tfBin = arg("tf-bin");
+    if (port !== void 0 && Number.isNaN(Number(port))) {
+      console.error("invalid --port");
+      process.exit(1);
+    }
+    const server = new CanvasServer({
+      dir,
+      uiDist,
+      port: port ? Number(port) : void 0,
+      runTerraformShow: fixture ? async () => readFileSync4(fixture, "utf8") : void 0,
+      tfBinary: tfBin,
+      telemetry
+    });
+    const { url } = await server.start();
+    console.log(`stackcanvas serving ${dir} at ${url}`);
+    return;
+  }
+  const mcp = createMcpServer({
+    makeCanvas: (dir) => new CanvasServer({ dir, uiDist, telemetry })
+  });
+  await mcp.connect(new StdioServerTransport());
+}
+void main();