studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/server/routes/insights-api.js

@@ -4,64 +4,323 @@
  * Per-user AI insights and home screen preferences.
  */
 import { join } from 'path';
-import { existsSync, readFileSync } from 'fs';
-import { isAdminOrOwner } from '../../services/auth-service.js';
-import { generateBriefing } from '../../services/briefing.js';
+import { homedir } from 'os';
+import { existsSync, readdirSync, rmSync } from 'fs';
+import * as access from '../../services/access-control.js';
+import { findPersonRefForUser } from '../../services/user-person-bridge.js';
+import { parseRef, formatUserRef } from '../../core/refs.js';
+import { ensurePersonalFolder } from '../../services/personal-folder.js';
+import { Workspace } from '../../core/workspace.js';
+import { reqGitUser } from './graph-api-access.js';
+import { log } from '../../utils/log.js';
+/** Slugify a free-text task title into a filesystem-safe entity id. */
+export function slugifyTitle(title) {
+    const base = title
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 60);
+    return base || 'task';
+}
+/** A person/repo id is a kebab/alphanumeric slug — no path, spaces, or dots. */
+export function isValidSlug(s) {
+    return /^[a-z0-9][a-z0-9-]*$/i.test(s);
+}
+/** True when a repo-relative folder path contains a traversal segment — the
+ *  guard for the capture surface's folder override before it reaches the graph. */
+export function isUnsafeFolderPath(folderPath) {
+    return folderPath.split('/').some((seg) => seg === '..' || seg === '.');
+}
 function getUserId(req) {
     return req.user?.id ?? 0;
 }
 function getAccessibleRepoNames(req, wm, authService) {
-    const allRepos = wm.getAllRepoConfigs();
     const user = req.user;
+    // Open mode (no user) keeps the legacy filter that excludes personal folders.
+    // System folders (the asset store) are excluded from graph-health too.
     if (!user)
-        return allRepos.filter(r => !r.private).map(r => r.name);
-    if (isAdminOrOwner(user.role))
-        return allRepos.filter(r => !r.private || r.owner_id === user.id).map(r => r.name);
-    const allowed = new Set(authService.getUserCollections(user.id));
-    return allRepos.filter(r => (r.private && r.owner_id === user.id) || allowed.has(r.name)).map(r => r.name);
+        return wm.getAllRepoConfigs().filter(r => !r.personal && !r.system).map(r => r.name);
+    // Authed: delegate to access-control so personal-folder restrictions and
+    // owner-on-shared-folder semantics match the HTTP read endpoints; drop the
+    // system asset store so it doesn't skew lint/orphan/graph-health.
+    return access.getAccessibleRepos(user, wm, authService).filter(r => !r.system).map(r => r.name);
 }
-export async function registerBriefingApiRoutes(fastify, workspaceManager, authService, workspacePath, wsHub, getTools) {
-    function loadWorkspaceConfig() {
-        const cfgPath = join(workspacePath, '.studiograph', 'workspace.json');
-        if (!existsSync(cfgPath))
-            return undefined;
+export async function registerInsightsApiRoutes(fastify, workspaceManager, authService, workspacePath, wsHub, chatSessionService) {
+    // GET /api/home — aggregated homepage data: the caller's open tasks (full,
+    // not windowed — feeds the triage list incl. overdue + undated) plus all
+    // meetings within a date window (feeds the week calendar). One round trip
+    // across every accessible folder.
+    //
+    // Filtering is server-side (the bridge is resolved here anyway): when authed
+    // we return only the caller's tasks; in open mode (no user) we return all.
+    // The CLIENT owns week boundaries and "today" — it passes weekStart/weekEnd
+    // and the server does a pure string-range compare on the meeting date, so a
+    // server-vs-client timezone difference can't shift a meeting into the wrong
+    // week. When the params are absent (very first paint) we fall back to a
+    // server-today 3-week window; the client immediately re-fetches with explicit
+    // bounds, so the fallback is never load-bearing.
+    fastify.get('/api/home', async (req, reply) => {
+        const repoNames = getAccessibleRepoNames(req, workspaceManager, authService);
+        const user = req.user;
+        const openMode = !user;
+        const isYmd = (s) => typeof s === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(s);
+        const ymd = (d) => `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+        let { weekStart, weekEnd } = req.query;
+        if (!isYmd(weekStart) || !isYmd(weekEnd)) {
+            const t = new Date();
+            const start = new Date(t);
+            start.setDate(t.getDate() - 7);
+            const end = new Date(t);
+            end.setDate(t.getDate() + 13);
+            weekStart = ymd(start);
+            weekEnd = ymd(end);
+        }
+        // "Completed today" window as UTC instants. The client sends its local
+        // midnight boundaries (timezone-correct, since completed_at is UTC); fall
+        // back to the server-local day on first paint (client refetches immediately).
+        const isIso = (s) => typeof s === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(s);
+        let dayStart = req.query.dayStart;
+        let dayEnd = req.query.dayEnd;
+        if (!isIso(dayStart) || !isIso(dayEnd)) {
+            const t = new Date();
+            const s = new Date(t.getFullYear(), t.getMonth(), t.getDate());
+            const e = new Date(s);
+            e.setDate(s.getDate() + 1);
+            dayStart = s.toISOString();
+            dayEnd = e.toISOString();
+        }
+        // Resolve the bridge first so we can scope tasks server-side. Null when the
+        // user has no linked person record, or the record lives in a repo they
+        // can't read (would leak membership otherwise).
+        const myPersonRef = user ? findPersonRefForUser(workspaceManager, user.handle) : null;
+        const currentUserPersonId = myPersonRef && (!user || access.hasRepoAccess(user, myPersonRef.repo, workspaceManager, authService))
+            ? myPersonRef.entityId
+            : null;
+        // Account identity is the source of truth. A task is mine if its assignee is
+        // my account ref (`[[user:<id>]]`) OR — for legacy data — my linked person
+        // entity (`[[my-person]]`). Both forms union to "me". Account-ref matching
+        // needs no person record + no repo-access gate, so My Tasks works for every
+        // authed user with zero setup. Open mode → all.
+        const currentUserId = user ? String(user.id) : null;
+        const taskIsMine = (assignee) => {
+            if (openMode)
+                return true;
+            const ref = parseRef(assignee);
+            if (!ref)
+                return false;
+            if (ref.kind === 'user')
+                return currentUserId != null && ref.userId === currentUserId;
+            return currentUserPersonId != null && ref.id === currentUserPersonId;
+        };
+        const myOpenTasks = [];
+        // Tasks the caller completed today — shown struck-through at the bottom of
+        // My Tasks so the day's progress stays visible. Keyed off completed_at
+        // (auto-stamped on status → done), not the due date.
+        const completedToday = [];
+        const meetings = [];
+        for (const name of repoNames) {
+            let graph;
+            try {
+                graph = workspaceManager.getGraph(name);
+            }
+            catch {
+                continue;
+            }
+            for (const entity of graph.search({ entityType: 'task' })) {
+                const d = entity.data;
+                // Enum: backlog/todo/in-progress/in-review/done/cancelled.
+                const status = typeof d.status === 'string' ? d.status : 'todo';
+                if (status === 'cancelled')
+                    continue;
+                if (!taskIsMine(d.assignee))
+                    continue;
+                const completedAt = typeof d.completed_at === 'string' ? d.completed_at : undefined;
+                const base = {
+                    id: entity.id,
+                    title: d.name ?? entity.id,
+                    repo: name,
+                    status,
+                    priority: d.priority,
+                    assignee: d.assignee,
+                    dueDate: typeof d.date === 'string' ? d.date : undefined,
+                    completedAt,
+                };
+                if (status === 'done') {
+                    // Only today's completions surface; older done tasks stay hidden.
+                    // ISO-UTC instants compare lexicographically, so a string range works.
+                    if (completedAt && completedAt >= dayStart && completedAt < dayEnd)
+                        completedToday.push(base);
+                    continue;
+                }
+                myOpenTasks.push(base);
+            }
+            for (const entity of graph.search({ entityType: 'event' })) {
+                const d = entity.data;
+                const date = typeof d.date === 'string' ? d.date : '';
+                const day = date.slice(0, 10);
+                // Pure string-range compare — no server-side Date math on the boundary.
+                if (!day || day < weekStart || day > weekEnd)
+                    continue;
+                meetings.push({
+                    id: entity.id,
+                    title: d.name ?? entity.id,
+                    repo: name,
+                    date,
+                    attendees: d.attendees,
+                });
+            }
+        }
+        meetings.sort((a, b) => a.date.localeCompare(b.date));
+        return reply.send({
+            myOpenTasks,
+            completedToday,
+            meetings,
+            currentUserPersonId,
+            currentUserId,
+            windowStart: weekStart,
+            windowEnd: weekEnd,
+            openMode,
+        });
+    });
+    // POST /api/home/tasks — fast inline task capture from the homepage.
+    // Opinionated: always status=todo, assigned to the caller, dropped into the
+    // caller's personal folder (auto-provisioned if missing). The server owns the
+    // entity id (slug the title + de-collide) so a double-submit can't create two
+    // and a free-text title can't smuggle a path. Disabled for callers without a
+    // Assigned to the caller's account by default (account identity is the source
+    // of truth — no person entity required, so this works for every authed user).
+    fastify.post('/api/home/tasks', async (req, reply) => {
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'Authentication required' });
+        const title = (req.body?.title ?? '').trim();
+        if (!title)
+            return reply.status(400).send({ error: 'Task title is required' });
+        const date = req.body?.date;
+        if (date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+            return reply.status(400).send({ error: 'date must be YYYY-MM-DD' });
+        }
+        const body = req.body?.body;
+        if (body !== undefined && typeof body !== 'string') {
+            return reply.status(400).send({ error: 'body must be a string' });
+        }
+        // Assignee: the caller's own account by default (`[[user:<id>|@handle]]`).
+        // An override can target another account (userId) or an external person
+        // entity (entityId, written as a bare-slug wikilink). Account identity needs
+        // no person record, so there's no bridge precondition here anymore.
+        let assignee = formatUserRef(user.id, user.handle);
+        const ao = req.body?.assignee;
+        if (ao && ao.userId != null) {
+            const target = authService.findUserById(Number(ao.userId));
+            if (!target) {
+                return reply.status(400).send({ error: 'Invalid assignee user' });
+            }
+            assignee = formatUserRef(target.id, target.handle);
+        }
+        else if (ao && ao.entityId) {
+            const e = String(ao.entityId).trim();
+            const r = String(ao.repo ?? '').trim();
+            if (!isValidSlug(e) || (r && !isValidSlug(r))) {
+                return reply.status(400).send({ error: 'Invalid assignee reference' });
+            }
+            assignee = `[[${e}]]`;
+        }
+        // Destination: a validated folder the caller can write to, else the
+        // caller's personal folder (auto-provisioned if missing).
+        const fo = req.body?.folder;
+        let targetRepoName;
+        let targetFolderPath = '';
+        if (fo && fo.repo) {
+            const repo = String(fo.repo).trim();
+            const folderPath = String(fo.folderPath ?? '').trim();
+            if (isUnsafeFolderPath(folderPath)) {
+                return reply.status(400).send({ error: 'Invalid folder path' });
+            }
+            // The caller's own personal folder isn't a "shared" write per the access
+            // model — allow it directly; any other repo goes through the write gate.
+            const ownPersonal = workspaceManager.getUserPersonalRepo(user.id)?.name;
+            if (repo !== ownPersonal && !access.canWriteRepo(user, repo, workspaceManager, authService)) {
+                return reply.status(403).send({ error: 'No write access to the selected folder', code: 'NO_FOLDER_ACCESS' });
+            }
+            targetRepoName = repo;
+            targetFolderPath = folderPath;
+        }
+        else {
+            let personalRepo = workspaceManager.getUserPersonalRepo(user.id);
+            if (!personalRepo) {
+                try {
+                    const ws = new Workspace(workspaceManager.getWorkspacePath());
+                    await ensurePersonalFolder(ws, authService, user);
+                    workspaceManager.reloadConfig();
+                    personalRepo = workspaceManager.getUserPersonalRepo(user.id);
+                }
+                catch (err) {
+                    log.error(`[home] personal-folder provision failed: ${err?.message ?? err}`);
+                }
+            }
+            if (!personalRepo) {
+                return reply.status(500).send({ error: 'Could not resolve a personal folder for this task' });
+            }
+            targetRepoName = personalRepo.name;
+        }
+        let graph;
         try {
-            return JSON.parse(readFileSync(cfgPath, 'utf-8'));
+            graph = workspaceManager.getGraph(targetRepoName);
         }
         catch {
-            return undefined;
+            return reply.status(500).send({ error: 'Target folder graph unavailable' });
         }
-    }
-    // GET /api/briefing — return cached briefing memo for current user
-    fastify.get('/api/briefing', async (req, reply) => {
-        const userId = getUserId(req);
-        const cached = authService.getCachedBriefing(userId);
-        return reply.send({ briefingText: cached.briefingText, generatedAt: cached.generatedAt });
-    });
-    // POST /api/briefing/generate — regenerate briefing memo for current user
-    fastify.post('/api/briefing/generate', async (req, reply) => {
-        const userId = getUserId(req);
-        const repoNames = getAccessibleRepoNames(req, workspaceManager, authService);
-        const brief = authService.getHomeBrief(userId);
+        // Server-owned id: slug the title, de-collide against existing tasks.
+        const baseId = slugifyTitle(title);
+        let entityId = baseId;
+        for (let i = 2;; i++) {
+            try {
+                graph.get('task', entityId);
+                entityId = `${baseId}-${i}`;
+            }
+            catch {
+                break;
+            }
+            if (i > 50) {
+                entityId = `${baseId}-${Date.now()}`;
+                break;
+            }
+        }
+        const now = new Date().toISOString();
+        const data = {
+            entity_type: 'task',
+            entity_id: entityId,
+            name: title,
+            status: 'todo',
+            assignee,
+            created_at: now,
+            updated_at: now,
+            created_by: 'web',
+            updated_by: 'web',
+        };
+        if (date)
+            data.date = date;
         try {
-            const tools = getTools?.(userId) ?? [];
-            const data = await generateBriefing(workspaceManager, repoNames, brief, authService, userId, loadWorkspaceConfig(), tools);
-            wsHub?.broadcastToUser?.(String(userId), {
-                type: 'briefing_updated', timestamp: new Date().toISOString(),
+            const entity = await graph.create({
+                entityType: 'task',
+                entityId,
+                data,
+                content: typeof body === 'string' ? body : '',
+                folderPath: targetFolderPath || undefined,
+                commitMessage: `Create task/${entityId} from homepage capture`,
+                user: reqGitUser(req),
+            });
+            const actor = user.displayName ?? 'API';
+            wsHub?.broadcast({
+                type: 'entity_change', action: 'created', repo: targetRepoName,
+                entityType: 'task', entityId, actor, source: 'api', timestamp: now,
             });
-            return reply.send(data);
+            return reply.status(201).send({ repo: targetRepoName, entityId, entity });
         }
         catch (err) {
-            console.error('[briefing] Generation failed:', err.message);
-            return reply.status(500).send({ error: 'Failed to generate briefing' });
+            return reply.status(400).send({ error: err?.message ?? 'Failed to create task' });
         }
     });
-    // Legacy: GET /api/insights — return cached insights (backward compat)
-    fastify.get('/api/insights', async (req, reply) => {
-        const userId = getUserId(req);
-        const cached = authService.getCachedInsights(userId);
-        return reply.send(cached);
-    });
     // GET /api/graph/health — graph health report (lint, orphans, stale, broken links)
     fastify.get('/api/graph/health', async (req, reply) => {
         try {
@@ -77,7 +336,6 @@ export async function registerBriefingApiRoutes(fastify, workspaceManager, authS
     fastify.get('/api/preferences', async (req, reply) => {
         const userId = getUserId(req);
         return reply.send({
-            home_brief: authService.getHomeBrief(userId),
             accent_color: authService.getAccentColor(userId),
             onboarded: authService.getOnboarded(userId),
         });
@@ -85,33 +343,22 @@ export async function registerBriefingApiRoutes(fastify, workspaceManager, authS
     // PUT /api/preferences — update user preferences
     fastify.put('/api/preferences', async (req, reply) => {
         const userId = getUserId(req);
-        const briefChanged = req.body?.home_brief !== undefined && req.body.home_brief !== authService.getHomeBrief(userId);
-        if (req.body?.home_brief !== undefined) {
-            authService.setHomeBrief(userId, req.body.home_brief);
-        }
         if (req.body?.accent_color !== undefined) {
             authService.setAccentColor(userId, req.body.accent_color);
         }
         if (req.body?.onboarded !== undefined) {
             authService.setOnboarded(userId, req.body.onboarded);
         }
-        // When brief changes, clear stale briefing and trigger background regeneration
-        if (briefChanged && req.body.home_brief) {
-            authService.setCachedBriefing(userId, '');
-            const repoNames = getAccessibleRepoNames(req, workspaceManager, authService);
-            const tools = getTools?.(userId) ?? [];
-            const brief = req.body.home_brief;
-            // Fire-and-forget — don't block the response
-            generateBriefing(workspaceManager, repoNames, brief, authService, userId, loadWorkspaceConfig(), tools)
-                .then(() => {
-                wsHub?.broadcastToUser?.(String(userId), { type: 'briefing_updated', timestamp: new Date().toISOString() });
-                console.log(`[briefing] Regenerated after brief change for user ${userId}`);
-            })
-                .catch((err) => console.error(`[briefing] Brief-change regeneration failed:`, err.message));
-        }
         return reply.send({ ok: true });
     });
-    // ── Meeting capture: per-user settings (Deepgram key, calendar, default collection) ──
+    // ── Generic per-user settings (today: Deepgram key, calendar, default folder — all meeting-capture) ──
+    // Storage is generic JSON; meeting-capture UI is the only current consumer and is itself feature-gated.
+    // If future features add their own keys, gate at the key level in their own handlers, not here.
+    //
+    // Phase 8: `authService.setUserSettings()` partitions keys by Key Registry
+    // classification — `user-secret` keys land in `settings_ciphertext`, the
+    // rest stay in `settings_json`. `getUserSettings()` decrypts and merges
+    // both halves so this endpoint's wire contract is unchanged.
     // GET /api/preferences/settings — get all per-user settings
     fastify.get('/api/preferences/settings', async (req, reply) => {
         const userId = getUserId(req);
@@ -123,8 +370,55 @@ export async function registerBriefingApiRoutes(fastify, workspaceManager, authS
         if (!req.body || typeof req.body !== 'object') {
             return reply.status(400).send({ error: 'Body must be a JSON object' });
         }
+        // setUserSettings is registry-aware: it classifies each merged key via
+        // getKeyDef and routes user-secret entries through the encrypted column.
         authService.setUserSettings(userId, req.body);
         return reply.send(authService.getUserSettings(userId));
     });
+    // POST /api/reset — full per-user fresh-start. Wipes sessions + memory
+    // AND resets DB-backed agent state: onboarded flag and meeting-capture
+    // settings. Preserves the user account, accent color, and API tokens.
+    // Use this for QA flows where a tester needs to re-experience onboarding
+    // from scratch.
+    //
+    // (Pre-C5 there was also a `/api/clear` route for the narrower "wipe
+    // sessions/memory only" case. It was removed when `studiograph clear`
+    // was folded into `studiograph reset` — see cli-owner-audit §3.3.)
+    fastify.post('/api/reset', async (req, reply) => {
+        const userId = getUserId(req);
+        if (!userId)
+            return reply.status(401).send({ error: 'Authentication required' });
+        try {
+            const baseDir = join(homedir(), '.studiograph');
+            const sessions = clearUserDir(join(baseDir, 'sessions', String(userId)), '.json');
+            const memory = clearUserDir(join(baseDir, 'memory', String(userId)), '.md');
+            authService.resetUserState(userId);
+            // Also wipe the server-stored chat history (sessions + messages). Without
+            // this the rail's transcript rows would survive a "fresh start" and
+            // re-hydrate on the next list fetch.
+            chatSessionService?.deleteAllForUser(userId);
+            // See note in /api/clear above — broadcast so any open tabs drop
+            // their localStorage transcript and re-fetch the user's now-reset
+            // state (onboarded flag, etc.).
+            wsHub?.broadcastToUser?.(String(userId), {
+                type: 'state_cleared',
+                target: 'all',
+                timestamp: new Date().toISOString(),
+            });
+            return reply.send({ ok: true, cleared: { sessions, memory }, dbStateReset: true });
+        }
+        catch (err) {
+            log.error('[reset] failed:', err?.stack || err?.message || err);
+            return reply.status(500).send({ error: err?.message || 'Reset failed' });
+        }
+    });
+}
+function clearUserDir(dirPath, ext) {
+    if (!existsSync(dirPath))
+        return 0;
+    const files = readdirSync(dirPath).filter(f => f.endsWith(ext));
+    for (const f of files)
+        rmSync(join(dirPath, f));
+    return files.length;
 }
 //# sourceMappingURL=insights-api.js.map

package/dist/server/routes/insights-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"insights-api.js","sourceRoot":"","sources":["../../../src/server/routes/insights-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAI9C,OAAO,EAAe,cAAc,EAAiB,MAAM,gCAAgC,CAAC;AAE5F,OAAO,EAAE,gBAAgB,EAAuB,MAAM,4BAA4B,CAAC;AAGnF,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAmB,EAAE,EAAoB,EAAE,WAAwB;IACjG,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAK,CAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAS,CAAC,OAAO,IAAK,CAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,aAAqB,EACrB,KAAoB,EACpB,QAA+C;IAG/C,SAAS,mBAAmB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IACxF,CAAC;IAED,mEAAmE;IACnE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,CACtF,CAAC;YACF,KAAK,EAAE,eAAe,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACvC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC;YAC5C,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAuF,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACzI,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACpH,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,+EAA+E;QAC/E,IAAI,YAAY,IAAI,GAAG,CAAC,IAAK,CAAC,UAAU,EAAE,CAAC;YACzC,WAAW,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,UAAU,CAAC;YACnC,6CAA6C;YAC7C,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,CAAC;iBACpG,IAAI,CAAC,GAAG,EAAE;gBACT,KAAK,EAAE,eAAe,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAC5G,OAAO,CAAC,GAAG,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,wFAAwF;IAExF,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,OAAO,CAAC,KAAK,CAAgC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"insights-api.js","sourceRoot":"","sources":["../../../src/server/routes/insights-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAIrD,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAInD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,KAAK;SACf,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,MAAM,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB;IACpC,OAAS,GAAW,CAAC,IAA6B,EAAE,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAmB,EAAE,EAAoB,EAAE,WAAwB;IACjG,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChG,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,aAAqB,EACrB,KAAoB,EACpB,kBAA8C;IAG9C,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,kCAAkC;IAClC,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAgG,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3I,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC;QAEvB,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,GAAG,GAAG,CAAC,CAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACnI,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,IAAI,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAClD,QAAQ,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAED,4EAA4E;QAC5E,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,mBAAmB,GAAG,WAAW,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC/H,CAAC,CAAC,WAAW,CAAC,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC;QACT,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,UAAU,GAAG,CAAC,QAAiB,EAAW,EAAE;YAChD,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,aAAa,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC;YACtF,OAAO,mBAAmB,IAAI,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,mBAAmB,CAAC;QACvE,CAAC,CAAC;QAKF,MAAM,WAAW,GAAe,EAAE,CAAC;QACnC,2EAA2E;QAC3E,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,cAAc,GAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAEpE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAA+B,CAAC;gBACjD,2DAA2D;gBAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBAChE,IAAI,MAAM,KAAK,WAAW;oBAAE,SAAS;gBACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACtC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpF,MAAM,IAAI,GAAa;oBACrB,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAG,CAAC,CAAC,IAAe,IAAI,MAAM,CAAC,EAAE;oBACtC,IAAI,EAAE,IAAI;oBACV,MAAM;oBACN,QAAQ,EAAE,CAAC,CAAC,QAA8B;oBAC1C,QAAQ,EAAE,CAAC,CAAC,QAA8B;oBAC1C,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACxD,WAAW;iBACZ,CAAC;gBACF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,kEAAkE;oBAClE,uEAAuE;oBACvE,IAAI,WAAW,IAAI,WAAW,IAAI,QAAQ,IAAI,WAAW,GAAG,MAAM;wBAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9F,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,IAA+B,CAAC;gBACjD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,wEAAwE;gBACxE,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,SAAS,IAAI,GAAG,GAAG,OAAO;oBAAE,SAAS;gBACvD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAG,CAAC,CAAC,IAAe,IAAI,MAAM,CAAC,EAAE;oBACtC,IAAI,EAAE,IAAI;oBACV,IAAI;oBACJ,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,WAAW;YACX,cAAc;YACd,QAAQ;YACR,mBAAmB;YACnB,aAAa;YACb,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,OAAO;YAClB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAMP,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAE/E,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC9B,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5B,IAAI,cAAsB,CAAC;QAC3B,IAAI,gBAAgB,GAAG,EAAE,CAAC;QAC1B,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,WAAW,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC;YACxE,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,cAAc,GAAG,IAAI,CAAC;YACtB,gBAAgB,GAAG,UAAU,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,YAAY,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC;oBAC9D,MAAM,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;oBAClD,gBAAgB,CAAC,YAAY,EAAE,CAAC;oBAChC,YAAY,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,GAAG,CAAC,KAAK,CAAC,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC;QACrC,CAAC;QAED,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAAC,CAAC;QAC1D,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAAC,CAAC;QAEtF,sEAAsE;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,MAAM,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,MAAoB,EAAE,QAAQ,CAAC,CAAC;gBAAC,QAAQ,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC;YAC/E,MAAM,CAAC;gBAAC,MAAM;YAAC,CAAC;YAChB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAAC,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM;YACd,QAAQ;YACR,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,KAAK;SAClB,CAAC;QACF,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAChC,UAAU,EAAE,MAAoB;gBAChC,QAAQ;gBACR,IAAI;gBACJ,OAAO,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC7C,UAAU,EAAE,gBAAgB,IAAI,SAAS;gBACzC,aAAa,EAAE,eAAe,QAAQ,wBAAwB;gBAC9D,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;aACtB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC;YACxC,KAAK,EAAE,SAAS,CAAC;gBACf,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc;gBAC9D,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG;aACnE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAkE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACpH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,wGAAwG;IACxG,wGAAwG;IACxG,gGAAgG;IAChG,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,6DAA6D;IAE7D,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,OAAO,CAAC,KAAK,CAAgC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,gBAAgB;IAChB,EAAE;IACF,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5E,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,0EAA0E;YAC1E,oEAAoE;YACpE,qCAAqC;YACrC,kBAAkB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAE7C,iEAAiE;YACjE,kEAAkE;YAClE,gCAAgC;YAChC,KAAK,EAAE,eAAe,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACvC,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC"}

package/dist/server/routes/mcp.d.ts

@@ -4,10 +4,14 @@
  * Exposes Studiograph's MCP tools over HTTP at /mcp so external clients
  * (Claude Code, Cursor, etc.) can connect to a remote Studiograph server.
  *
- * Uses stateless mode — each request creates a fresh MCP server instance.
- * Auth is handled by the existing Fastify auth hook (Bearer token or JWT cookie).
+ * Uses stateless mode — each request creates a fresh MCP server instance
+ * bound to the caller's identity. The Bearer header MUST resolve to a
+ * real user (JWT or per-user API token). There is no workspace-wide
+ * shared key anywhere in the system — every MCP call carries a user.
  */
 import type { FastifyInstance } from 'fastify';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import type { AuthService } from '../../services/auth-service.js';
-export declare function registerMcpRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService?: AuthService | null): Promise<void>;
+import type { WsHub } from '../ws-hub.js';
+import type { CommentService } from '../../services/comment-service.js';
+export declare function registerMcpRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, wsHub?: WsHub, commentService?: CommentService): Promise<void>;

package/dist/server/routes/mcp.js

@@ -4,17 +4,33 @@
  * Exposes Studiograph's MCP tools over HTTP at /mcp so external clients
  * (Claude Code, Cursor, etc.) can connect to a remote Studiograph server.
  *
- * Uses stateless mode — each request creates a fresh MCP server instance.
- * Auth is handled by the existing Fastify auth hook (Bearer token or JWT cookie).
+ * Uses stateless mode — each request creates a fresh MCP server instance
+ * bound to the caller's identity. The Bearer header MUST resolve to a
+ * real user (JWT or per-user API token). There is no workspace-wide
+ * shared key anywhere in the system — every MCP call carries a user.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { registerTools } from '../../mcp/tools.js';
-export async function registerMcpRoutes(fastify, workspaceManager, authService) {
+import { registerTools, MCP_SERVER_INFO, MCP_INSTRUCTIONS } from '../../mcp/tools.js';
+export async function registerMcpRoutes(fastify, workspaceManager, authService, wsHub, commentService) {
     // POST /mcp — handle MCP JSON-RPC requests (tool calls, initialization, etc.)
     fastify.post('/mcp', async (req, reply) => {
-        const server = new McpServer({ name: 'studiograph', version: '1.0.0' });
-        registerTools(server, workspaceManager, authService);
+        const user = req.user;
+        if (!user) {
+            return reply.status(401).send({
+                error: 'MCP requires a user-scoped Bearer token. Generate one at POST /api/auth/tokens.',
+            });
+        }
+        // The auth hook stashes the api_tokens.name on req when the request was
+        // bearer-authenticated against a named token (the typical MCP path).
+        // We thread it through so mutation broadcasts are labeled with the
+        // integration name (e.g. "Christian's Cursor" rather than just the user).
+        const apiTokenName = req.apiTokenName;
+        const server = new McpServer(MCP_SERVER_INFO, { instructions: MCP_INSTRUCTIONS });
+        // Passing wsHub in the context lets create_entity / update_entity
+        // broadcast entity_change events so connected web clients refresh
+        // their views live when an MCP agent mutates a folder.
+        registerTools(server, workspaceManager, authService, { user, wsHub, apiTokenName, commentService });
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
         await server.connect(transport);
         // Hijack the response so Fastify doesn't interfere with the MCP transport's writes
@@ -25,11 +41,11 @@ export async function registerMcpRoutes(fastify, workspaceManager, authService)
     });
     // GET /mcp — SSE endpoint for server-initiated notifications (stateless: returns 405)
     fastify.get('/mcp', async (_req, reply) => {
-        reply.status(405).send({ error: 'SSE not available in stateless mode. Use POST.' });
+        return reply.status(405).send({ error: 'SSE not available in stateless mode. Use POST.' });
     });
     // DELETE /mcp — session cleanup (stateless: returns 405)
     fastify.delete('/mcp', async (_req, reply) => {
-        reply.status(405).send({ error: 'No sessions in stateless mode.' });
+        return reply.status(405).send({ error: 'No sessions in stateless mode.' });
     });
 }
 //# sourceMappingURL=mcp.js.map

package/dist/server/routes/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,gBAAkC,EAClC,WAAgC;IAGhC,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,mFAAmF;QACnF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/server/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAKnG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,gBAAkC,EAClC,WAAwB,EACxB,KAAa,EACb,cAA+B;IAG/B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,iFAAiF;aACzF,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,YAAY,GAAI,GAAW,CAAC,YAAkC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClF,kEAAkE;QAClE,kEAAkE;QAClE,uDAAuD;QACvD,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,mFAAmF;QACnF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC"}