vantage-peers-mcp 2.4.1 → 2.4.3

package/README.md

@@ -400,6 +400,9 @@ All orchestrator names are open strings — any lowercase name is accepted. The
 
 ## Changelog
 
+### 2.4.3 — 2026-05-31 (Day 89)
+- fix(overflow): defensive byte-cap on all 17 `list_*` tools — `capListResponseBytes` truncates any list response above 60 KB and wraps the result in a `_meta` envelope (`_truncated`, `_showing`, `_total`, `_advice`) so MCP clients (Claude.ai, ChatGPT, Claude Code) never reject a list result for exceeding their token budget. Day 89 Pi 75,003-char `list_tasks` overflow incident reproduced and capped in regression test. PR #565.
+
 ### 2.4.1 — 2026-05-30 (Day 88)
 - fix(dcr): `oauthDcr:validateAccessToken` exposed as PUBLIC `query` (was `internalQuery`, unreachable via `ConvexHttpClient.query()` → Path 3 DCR returned 401 even with valid token) — issue #556 / PR #557.
 - fix(dcr): `WWW-Authenticate` header now emits `Bearer resource_metadata="..."` per MCP spec §Protected Resource Metadata Discovery (was `resource="..."` — broke Claude.ai PRM discovery bootstrap on 401) — PR #557.

package/dist/src/auth.js

@@ -119,8 +119,20 @@ export function checkNamespaceRead(ctx, namespace) {
         return null;
     if (isMasterScope(ctx))
         return null;
-    if (!namespace)
-        return null; // no namespace filter — list-across, which master-only in practice
+    if (!namespace) {
+        // Day 88 P0 fix: a list-across (namespace undefined) call from a
+        // non-master scope cannot be served safely — the underlying query
+        // returns rows across every tenant. Reject with an explicit message
+        // telling the caller to pass a namespace they own. Previously this
+        // returned null and leaked the whole memories/profiles/etc. table
+        // to any DCR-issued client.
+        const allowed = ctx.namespaceReadPrefixes.length > 0
+            ? ctx.namespaceReadPrefixes.join(", ")
+            : "(none — your client has no read scope)";
+        return ("Forbidden: this tool requires an explicit namespace argument when " +
+            `called with a non-master scope (current: ${ctx.scopeProfile}). ` +
+            `Pass namespace= one of: ${allowed}.`);
+    }
     if (checkNamespacePrefix(ctx.namespaceReadPrefixes, namespace))
         return null;
     return `Forbidden: namespace='${namespace}' is not readable by scope_profile=${ctx.scopeProfile}.`;

package/dist/src/tools.d.ts

@@ -21,6 +21,8 @@ export declare const MAX_CONTENT_BYTES = 900000;
  * @param toolName  Caller tool name (used only in the error message).
  */
 export declare function assertContentSize(content: string, toolName: string): number;
+export declare const MAX_LIST_RESPONSE_BYTES = 60000;
+export declare function capListResponseBytes(items: unknown, rawText: string, toolName: string, maxBytes?: number): string;
 /**
  * Convex document IDs are 32 lowercase alphanumeric characters (a-z0-9).
  * Exported so tests can validate the schema independently of the MCP server.

package/dist/src/tools.js

@@ -71,6 +71,56 @@ export function assertContentSize(content, toolName) {
     return contentBytes;
 }
 // ─────────────────────────────────────────────────────────────────────────────
+// List response byte cap (overflow protection for MCP clients)
+//
+// MCP clients (Claude.ai, ChatGPT, Claude Code) reject tool results that
+// exceed their token budget — typical ceiling ~25k tokens ≈ 75 KB JSON.
+// When that happens the entire response is lost to a downstream truncation
+// error and the user must fall back to reading the on-disk overflow file.
+//
+// `capListResponseBytes` guards every bulk list_* tool: if the serialized
+// payload exceeds MAX_LIST_RESPONSE_BYTES (60 KB), it truncates the items
+// array (halving until it fits) and wraps the result in a _meta envelope
+// that tells the caller exactly how to refine the query.
+//
+// 60 KB leaves headroom for tool-call JSON framing and the UI stream marker
+// before any MCP client hits its own ceiling. The cap is byte-counted on the
+// raw JSON string, not on item count, because content-heavy rows
+// (memories / diaries / briefing notes) blow past 30 items easily.
+// ─────────────────────────────────────────────────────────────────────────────
+export const MAX_LIST_RESPONSE_BYTES = 60_000;
+export function capListResponseBytes(items, rawText, toolName, maxBytes = MAX_LIST_RESPONSE_BYTES) {
+    const byteLen = Buffer.byteLength(rawText, "utf8");
+    if (byteLen <= maxBytes)
+        return rawText;
+    if (!Array.isArray(items) || items.length === 0)
+        return rawText;
+    let n = items.length;
+    let truncated = items;
+    let truncatedText = rawText;
+    while (n > 1) {
+        n = Math.max(1, Math.floor(n / 2));
+        truncated = items.slice(0, n);
+        truncatedText = JSON.stringify(truncated, null, 2);
+        if (Buffer.byteLength(truncatedText, "utf8") <= maxBytes - 600)
+            break;
+    }
+    const envelope = {
+        _meta: {
+            _truncated: true,
+            _showing: truncated.length,
+            _total: items.length,
+            _bytesOriginal: byteLen,
+            _bytesCap: maxBytes,
+            _tool: toolName,
+            _advice: `Response exceeded ${maxBytes} bytes. Showing first ${truncated.length}/${items.length}. ` +
+                `Pass fields="lite", a smaller limit, stricter filters (status, assignedTo, project, namespace, updatedSince), or paginate.`,
+        },
+        items: truncated,
+    };
+    return JSON.stringify(envelope, null, 2);
+}
+// ─────────────────────────────────────────────────────────────────────────────
 // Shared Zod schemas
 // ─────────────────────────────────────────────────────────────────────────────
 /**
@@ -508,6 +558,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get memory",
     }, async ({ memoryId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_memory");
+            if (_scopeDenied)
+                return _scopeDenied;
             const memory = await convex.query("memories:getMemory", {
                 memoryId,
             });
@@ -725,6 +778,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get orchestrator profile",
     }, async ({ orchestratorId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_profile");
+            if (_scopeDenied)
+                return _scopeDenied;
             const profile = await convex.query("profiles:getProfile", {
                 orchestratorId,
             });
@@ -837,7 +893,7 @@ export function registerTools(server, convex, oauthCtx) {
                 : Array.isArray(memories?.page)
                     ? memories.page
                     : [];
-            const baseText = JSON.stringify(memories, null, 2);
+            const baseText = capListResponseBytes(memories, JSON.stringify(memories, null, 2), "list_memories");
             const text = appendMarkerIfEnabled(baseText, () => ({
                 kind: "memory-quote",
                 items: rawList.map((m) => ({
@@ -944,6 +1000,13 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Check messages",
     }, async ({ recipient, recipientInstanceId, tenantId, since }) => {
         try {
+            // Non-master: force recipient to caller's own userId. Anything else
+            // would let the client read another tenant's inbox.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (recipient !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: check_messages can only read messages for your own identity ('${oauthCtx.userId}'), not '${recipient}'.`);
+                }
+            }
             const messages = await convex.query("messages:checkNewMessages", {
                 recipient,
                 recipientInstanceId,
@@ -1105,6 +1168,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List peers",
     }, async () => {
         try {
+            const _scopeDenied = guardMasterOnly("list_peers");
+            if (_scopeDenied)
+                return _scopeDenied;
             const profiles = await convex.query("profiles:listProfiles", {});
             const peers = profiles.map((p) => ({
                 id: p.orchestratorId,
@@ -1120,7 +1186,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(peers, null, 2),
+                        text: capListResponseBytes(peers, JSON.stringify(peers, null, 2), "list_peers"),
                     },
                 ],
             };
@@ -1152,12 +1218,15 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List messages",
     }, async ({ sessionDay, from, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_messages");
+            if (_scopeDenied)
+                return _scopeDenied;
             const messages = await convex.query("messages:listMessages", {
                 sessionDay,
                 from,
                 limit: limit ?? 100,
             });
-            const baseText = JSON.stringify(messages, null, 2);
+            const baseText = capListResponseBytes(messages, JSON.stringify(messages, null, 2), "list_messages");
             const text = appendMarkerIfEnabled(baseText, () => ({
                 kind: "messages-feed",
                 items: Array.isArray(messages)
@@ -1190,6 +1259,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List broadcast status",
     }, async ({ messageId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_broadcast_status");
+            if (_scopeDenied)
+                return _scopeDenied;
             const status = await convex.query("messages:listBroadcastStatus", {
                 messageId,
             });
@@ -1197,7 +1269,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(status, null, 2),
+                        text: capListResponseBytes(status, JSON.stringify(status, null, 2), "list_broadcast_status"),
                     },
                 ],
             };
@@ -1314,6 +1386,16 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List tasks",
     }, async ({ assignedTo, assignedToInstance, status, project, limit, fields, createdBy, updatedSince, }) => {
         try {
+            // Non-master: must scope to own identity. If neither assignedTo
+            // nor createdBy matches the caller's userId, reject — otherwise
+            // the query would span the whole tenant table.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                const myId = oauthCtx.userId;
+                const scopedToSelf = assignedTo === myId || createdBy === myId;
+                if (!scopedToSelf) {
+                    return mcpError(`Forbidden: list_tasks requires assignedTo='${myId}' or createdBy='${myId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const tasks = await convex.query("tasks:list", {
                 assignedTo,
                 assignedToInstance,
@@ -1324,7 +1406,7 @@ export function registerTools(server, convex, oauthCtx) {
                 createdBy,
                 updatedSince,
             });
-            const baseText = JSON.stringify(tasks, null, 2);
+            const baseText = capListResponseBytes(tasks, JSON.stringify(tasks, null, 2), "list_tasks");
             const text = appendMarkerIfEnabled(baseText, () => ({
                 kind: "tasks-table",
                 items: Array.isArray(tasks)
@@ -1695,6 +1777,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List tasks by mission",
     }, async ({ missionId, status, limit, fields, createdBy, updatedSince }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_tasks_by_mission");
+            if (_scopeDenied)
+                return _scopeDenied;
             const tasks = await convex.query("tasks:listByMission", {
                 missionId: missionId,
                 status,
@@ -1707,7 +1792,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(tasks, null, 2),
+                        text: capListResponseBytes(tasks, JSON.stringify(tasks, null, 2), "list_tasks_by_mission"),
                     },
                 ],
             };
@@ -1802,6 +1887,13 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List missions",
     }, async ({ project, pilot, status, limit, fields, updatedSince }) => {
         try {
+            // Non-master: must pilot=<own-userId>. Otherwise the query spans
+            // every tenant's missions.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (pilot !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: list_missions requires pilot='${oauthCtx.userId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const missions = await convex.query("missions:list", {
                 project,
                 pilot,
@@ -1810,7 +1902,7 @@ export function registerTools(server, convex, oauthCtx) {
                 fields,
                 updatedSince,
             });
-            const baseText = JSON.stringify(missions, null, 2);
+            const baseText = capListResponseBytes(missions, JSON.stringify(missions, null, 2), "list_missions");
             const text = appendMarkerIfEnabled(baseText, () => ({
                 kind: "mission-timeline",
                 items: Array.isArray(missions)
@@ -1843,6 +1935,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get mission",
     }, async ({ missionId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_mission");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mission = await convex.query("missions:get", {
                 missionId: missionId,
             });
@@ -2002,6 +2097,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get diary entry",
     }, async ({ date, orchestrator }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_diary");
+            if (_scopeDenied)
+                return _scopeDenied;
             const entry = await convex.query("diary:get", {
                 date,
                 orchestrator,
@@ -2050,6 +2148,12 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List diary entries",
     }, async ({ orchestrator, limit }) => {
         try {
+            // Non-master: must scope to own orchestrator id.
+            if (oauthCtx && !isMasterScope(oauthCtx)) {
+                if (orchestrator !== oauthCtx.userId) {
+                    return mcpError(`Forbidden: list_diaries requires orchestrator='${oauthCtx.userId}' for non-master scope (current: ${oauthCtx.scopeProfile}).`);
+                }
+            }
             const entries = await convex.query("diary:list", {
                 orchestrator,
                 limit: limit ?? 20,
@@ -2058,7 +2162,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(entries, null, 2),
+                        text: capListResponseBytes(entries, JSON.stringify(entries, null, 2), "list_diaries"),
                     },
                 ],
             };
@@ -2203,13 +2307,16 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List briefing notes",
     }, async ({ topic, limit, fields, updatedSince }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_briefing_notes");
+            if (_scopeDenied)
+                return _scopeDenied;
             const notes = await convex.query("briefingNotes:list", {
                 topic,
                 limit,
                 fields,
                 updatedSince,
             });
-            const baseText = JSON.stringify(notes, null, 2);
+            const baseText = capListResponseBytes(notes, JSON.stringify(notes, null, 2), "list_briefing_notes");
             const text = appendMarkerIfEnabled(baseText, () => {
                 const items = Array.isArray(notes) ? notes : [];
                 if (items.length === 0)
@@ -2316,6 +2423,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List components",
     }, async ({ type, team, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_components");
+            if (_scopeDenied)
+                return _scopeDenied;
             const components = await convex.query("components:list", {
                 type,
                 team,
@@ -2325,7 +2435,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(components, null, 2),
+                        text: capListResponseBytes(components, JSON.stringify(components, null, 2), "list_components"),
                     },
                 ],
             };
@@ -2345,6 +2455,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get component",
     }, async ({ name, type }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_component");
+            if (_scopeDenied)
+                return _scopeDenied;
             const component = await convex.query("components:get", {
                 name,
                 type,
@@ -2442,6 +2555,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Search components",
     }, async ({ query, type, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("search_components");
+            if (_scopeDenied)
+                return _scopeDenied;
             const results = await convex.query("components:search", {
                 query,
                 type,
@@ -2532,13 +2648,16 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List recurring tasks",
     }, async ({ assignedTo, active, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_recurring_tasks");
+            if (_scopeDenied)
+                return _scopeDenied;
             const tasks = await convex.query("recurringTasks:list", {
                 assignedTo,
                 active,
                 limit: limit ?? 50,
             });
             return {
-                content: [{ type: "text", text: JSON.stringify(tasks, null, 2) }],
+                content: [{ type: "text", text: capListResponseBytes(tasks, JSON.stringify(tasks, null, 2), "list_recurring_tasks") }],
             };
         }
         catch (error) {
@@ -2875,6 +2994,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List mandates",
     }, async ({ requestedBy, fulfilledBy, status, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_mandates");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mandates = await convex.query("mandates:list", {
                 requestedBy,
                 fulfilledBy,
@@ -2885,7 +3007,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(mandates, null, 2),
+                        text: capListResponseBytes(mandates, JSON.stringify(mandates, null, 2), "list_mandates"),
                     },
                 ],
             };
@@ -3041,6 +3163,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get BU",
     }, async ({ buId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_bu");
+            if (_scopeDenied)
+                return _scopeDenied;
             const bu = await convex.query("businessUnits:get", {
                 buId: buId,
             });
@@ -3080,6 +3205,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List BUs",
     }, async ({ orchestratorId, status, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_bus");
+            if (_scopeDenied)
+                return _scopeDenied;
             const bus = await convex.query("businessUnits:list", {
                 orchestratorId,
                 status,
@@ -3089,7 +3217,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(bus, null, 2),
+                        text: capListResponseBytes(bus, JSON.stringify(bus, null, 2), "list_bus"),
                     },
                 ],
             };
@@ -3176,12 +3304,15 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List repo mappings",
     }, async () => {
         try {
+            const _scopeDenied = guardMasterOnly("list_repo_mappings");
+            if (_scopeDenied)
+                return _scopeDenied;
             const mappings = await convex.query("githubRepoMapping:list", {});
             return {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(mappings, null, 2),
+                        text: capListResponseBytes(mappings, JSON.stringify(mappings, null, 2), "list_repo_mappings"),
                     },
                 ],
             };
@@ -3247,6 +3378,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List issues",
     }, async ({ project, status, assignedTo, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_issues");
+            if (_scopeDenied)
+                return _scopeDenied;
             let results;
             if (assignedTo) {
                 results = await convex.query("issues:listByOrchestrator", {
@@ -3278,7 +3412,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify({ count: results.length, issues: results }, null, 2),
+                        text: capListResponseBytes(results, JSON.stringify({ count: results.length, issues: results }, null, 2), "list_issues"),
                     },
                 ],
             };
@@ -3300,6 +3434,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get issue",
     }, async ({ repo, issueNumber }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_issue");
+            if (_scopeDenied)
+                return _scopeDenied;
             const issue = await convex.query("issues:getByRepoNumber", {
                 repo,
                 issueNumber,
@@ -3434,6 +3571,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Issue statistics",
     }, async ({ project }) => {
         try {
+            const _scopeDenied = guardMasterOnly("issue_stats");
+            if (_scopeDenied)
+                return _scopeDenied;
             const stats = await convex.query("issues:getStats", {
                 project,
             });
@@ -3590,6 +3730,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Search fix patterns",
     }, async ({ query, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("search_fix_patterns");
+            if (_scopeDenied)
+                return _scopeDenied;
             const results = await convex.action("search:searchFixPatterns", {
                 query,
                 limit,
@@ -3621,13 +3764,16 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List fix patterns",
     }, async ({ project, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_fix_patterns");
+            if (_scopeDenied)
+                return _scopeDenied;
             if (project) {
                 const results = await convex.query("fixPatterns:listByProject", {
                     sourceProject: project,
                     limit,
                 });
                 return {
-                    content: [{ type: "text", text: JSON.stringify(results, null, 2) }],
+                    content: [{ type: "text", text: capListResponseBytes(results, JSON.stringify(results, null, 2), "list_fix_patterns") }],
                 };
             }
             const allResults = await convex.query("fixPatterns:listAll", {
@@ -3635,7 +3781,7 @@ export function registerTools(server, convex, oauthCtx) {
             });
             return {
                 content: [
-                    { type: "text", text: JSON.stringify(allResults, null, 2) },
+                    { type: "text", text: capListResponseBytes(allResults, JSON.stringify(allResults, null, 2), "list_fix_patterns") },
                 ],
             };
         }
@@ -3682,6 +3828,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get mission template",
     }, async ({ name }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_mission_template");
+            if (_scopeDenied)
+                return _scopeDenied;
             const template = await convex.query("missionTemplates:getByName", { name });
             return {
                 content: [
@@ -3908,6 +4057,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "List errors",
     }, async ({ deployment, limit }) => {
         try {
+            const _scopeDenied = guardMasterOnly("list_errors");
+            if (_scopeDenied)
+                return _scopeDenied;
             const errors = await convex.query("errorMonitor:listErrors", {
                 deployment,
                 limit: limit ?? 50,
@@ -3916,7 +4068,7 @@ export function registerTools(server, convex, oauthCtx) {
                 content: [
                     {
                         type: "text",
-                        text: JSON.stringify(errors, null, 2),
+                        text: capListResponseBytes(errors, JSON.stringify(errors, null, 2), "list_errors"),
                     },
                 ],
             };
@@ -3935,6 +4087,9 @@ export function registerTools(server, convex, oauthCtx) {
         title: "Get error",
     }, async ({ errorId }) => {
         try {
+            const _scopeDenied = guardMasterOnly("get_error");
+            if (_scopeDenied)
+                return _scopeDenied;
             const error = await convex.query("errorMonitor:getError", {
                 errorId: errorId,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vantage-peers-mcp",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
   "type": "module",
   "main": "./dist/server.js",