feat(mcp): live airspace + maritime tools; fix OAuth consent UI (koala73#2442)

* fix(oauth): fix CSS arrow bullets + add MCP branding to consent page

- CSS content:'\2192' (not HTML entity which doesn't work in CSS)
- Rename logo/title to "WorldMonitor MCP" on both consent and error pages
- Inject real news headlines into get_country_brief to prevent hallucination
  Fetches list-feed-digest (4s budget), passes top-15 headlines as ?context=
  to get-country-intel-brief; brief timeout reduced to 24s to stay under Edge ceiling

* feat(mcp): add get_airspace + get_maritime_activity live query tools

New tools answer real-time positional questions via existing bbox RPCs:
- get_airspace: civilian ADS-B (OpenSky) + military flights over any country
  parallel-fetches track-aircraft + list-military-flights, capped at 100 each
- get_maritime_activity: AIS density zones + disruptions for a country's waters
  calls get-vessel-snapshot with country bbox

Country → bounding box resolved via shared/country-bboxes.json (167 entries,
generated from public/data/countries.geojson by scripts/generate-country-bboxes.cjs).
Both API calls use 8s AbortSignal.timeout; get_airspace uses Promise.allSettled
so one failure doesn't block the other.

* docs: fix markdown lint in airspace/maritime plan (blank lines around lists)

* fix(oauth): use literal → in CSS content (\2192 is invalid JS octal in ESM)

* fix(hooks): extend bundle check to api/oauth/ subdirectory (was api/*.js, now uses find)

* fix(mcp): address P1 review findings from PR 2442

- JSON import: add 'with { type: json }' so node --test works without tsx loader
- get_airspace: surface upstream failures; partial outage => partial:true+warnings,
  total outage => throw (prevents misleading zero-aircraft response)
- pre-push hook: add #!/usr/bin/env bash shebang (was no shebang, ran as /bin/sh
  on Linux CI/contributors; process substitution + [[ ]] require bash)

* fix(mcp): replace JSON import attribute with TS module for Vercel compat

Vercel's esbuild bundler does not support `with { type: 'json' }` import
attributes, causing builds to fail with "Expected ';' but found 'with'".

Fix: generate shared/country-bboxes.ts (typed TS module) alongside the
existing JSON file. The TS import has no attributes and bundles cleanly
with all esbuild versions.

Also extend the pre-push bundle check to include api/*.ts root-level files
so this class of error is caught locally before push.

* fix(mcp): reduce get_country_brief timing budget to 24 s (6 s Edge margin)

Digest pre-fetch: 4 s → 2 s (cached endpoint, silent fallback on miss)
Brief call: 24 s → 22 s
Total worst-case: 24 s vs Vercel Edge 30 s hard kill — was 28 s (2 s margin)

* test(mcp): add coverage for get_airspace and get_maritime_activity

9 new tests:
- get_airspace: happy path, unknown code, partial failure (mil down),
  total failure (-32603), type=civilian skips military fetch
- get_maritime_activity: happy path, unknown code, API failure (-32603),
  empty snapshot handled gracefully

Also fixes import to use .ts extension so Node --test resolver finds the
country-bboxes module (tsx resolves .ts directly; .js alias only works
under moduleResolution:bundler at typecheck time)

* fix(mcp): use .js + .d.ts for country-bboxes — Vercel rejects .ts imports

Vercel edge bundler refuses .ts extension imports even from .ts edge
functions. Plain .js is the only safe runtime import for edge functions.

Pattern: generate shared/country-bboxes.js (pure ESM, no TS syntax) +
shared/country-bboxes.d.ts (type declaration). TypeScript uses the .d.ts
for tuple types at check time; Vercel and Node --test load the .js at
runtime. The previous .ts module is removed.

* test(mcp): update tool count to 26 (main added search_flights + search_flight_prices_by_date)

Author: koala73

.husky/pre-push

@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 # Ensure dependencies are installed (worktrees start with no node_modules)
 if [ ! -d node_modules ]; then
   echo "node_modules missing, running npm install..."
@@ -65,14 +66,13 @@ echo "Running architectural boundary check..."
 npm run lint:boundaries || exit 1
 
 echo "Running edge function bundle check..."
-for f in api/*.js; do
-  case "$(basename "$f")" in _*) continue;; esac
+while IFS= read -r f; do
   npx esbuild "$f" --bundle --format=esm --platform=browser --outfile=/dev/null 2>/dev/null || {
     echo "ERROR: esbuild failed to bundle $f — this will break Vercel deployment"
     npx esbuild "$f" --bundle --format=esm --platform=browser --outfile=/dev/null
     exit 1
   }
-done
+done < <(find api/ -name "*.js" -not -name "_*"; find api/ -maxdepth 1 -name "*.ts" -not -name "_*")
 
 echo "Running unit tests..."
 npm run test:data || exit 1

api/mcp.ts

@@ -10,6 +10,7 @@ import { readJsonFromUpstash } from './_upstash-json.js';
 import { resolveApiKeyFromBearer } from './_oauth-token.js';
 // @ts-expect-error — JS module, no declaration file
 import { timingSafeIncludes } from './_crypto.js';
+import COUNTRY_BBOXES from '../shared/country-bboxes.js';
 
 export const config = { runtime: 'edge' };
 
@@ -306,16 +307,187 @@ const TOOL_REGISTRY: ToolDef[] = [
       required: ['country_code'],
     },
     _execute: async (params, base, apiKey) => {
-      const res = await fetch(`${base}/api/intelligence/v1/get-country-intel-brief`, {
+      const UA = 'worldmonitor-mcp-edge/1.0';
+      const countryCode = String(params.country_code ?? '').toUpperCase().slice(0, 2);
+
+      // Fetch current geopolitical headlines to ground the LLM (budget: 2 s — cached endpoint).
+      // Without context the model hallucinates events — real headlines anchor it.
+      // 2 s + 22 s brief = 24 s worst-case; 6 s margin before the 30 s Edge kill.
+      let contextParam = '';
+      try {
+        const digestRes = await fetch(`${base}/api/news/v1/list-feed-digest?variant=geo&lang=en`, {
+          headers: { 'X-WorldMonitor-Key': apiKey, 'User-Agent': UA },
+          signal: AbortSignal.timeout(2_000),
+        });
+        if (digestRes.ok) {
+          type DigestPayload = { categories?: Record<string, { items?: { title?: string }[] }> };
+          const digest = await digestRes.json() as DigestPayload;
+          const headlines = Object.values(digest.categories ?? {})
+            .flatMap(cat => cat.items ?? [])
+            .map(item => item.title ?? '')
+            .filter(Boolean)
+            .slice(0, 15)
+            .join('\n');
+          if (headlines) contextParam = encodeURIComponent(headlines.slice(0, 4000));
+        }
+      } catch { /* proceed without context — better than failing */ }
+
+      const briefUrl = contextParam
+        ? `${base}/api/intelligence/v1/get-country-intel-brief?context=${contextParam}`
+        : `${base}/api/intelligence/v1/get-country-intel-brief`;
+
+      const res = await fetch(briefUrl, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'X-WorldMonitor-Key': apiKey, 'User-Agent': 'worldmonitor-mcp-edge/1.0' },
-        body: JSON.stringify({ country_code: String(params.country_code ?? ''), framework: String(params.framework ?? '') }),
-        signal: AbortSignal.timeout(25_000),
+        headers: { 'Content-Type': 'application/json', 'X-WorldMonitor-Key': apiKey, 'User-Agent': UA },
+        body: JSON.stringify({ country_code: countryCode, framework: String(params.framework ?? '') }),
+        signal: AbortSignal.timeout(22_000),
       });
       if (!res.ok) throw new Error(`get-country-intel-brief HTTP ${res.status}`);
       return res.json();
     },
   },
+  {
+    name: 'get_airspace',
+    description: 'Live ADS-B aircraft over a country. Returns civilian flights (OpenSky) and identified military aircraft with callsigns, positions, altitudes, and headings. Answers questions like "how many planes are over the UAE right now?" or "are there military aircraft over Taiwan?"',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        country_code: {
+          type: 'string',
+          description: 'ISO 3166-1 alpha-2 country code (e.g. "AE", "US", "GB", "JP")',
+        },
+        type: {
+          type: 'string',
+          enum: ['all', 'civilian', 'military'],
+          description: 'Filter: all flights (default), civilian only, or military only',
+        },
+      },
+      required: ['country_code'],
+    },
+    _execute: async (params, base, apiKey) => {
+      const code = String(params.country_code ?? '').toUpperCase().slice(0, 2);
+      const bbox = COUNTRY_BBOXES[code];
+      if (!bbox) return { error: `Unknown country code: ${code}. Use ISO 3166-1 alpha-2 (e.g. "AE", "US", "GB").` };
+      const [sw_lat, sw_lon, ne_lat, ne_lon] = bbox;
+      const type = String(params.type ?? 'all');
+      const UA = 'worldmonitor-mcp-edge/1.0';
+      const headers = { 'X-WorldMonitor-Key': apiKey, 'User-Agent': UA };
+      const bboxQ = `sw_lat=${sw_lat}&sw_lon=${sw_lon}&ne_lat=${ne_lat}&ne_lon=${ne_lon}`;
+
+      type CivilianResp = {
+        positions?: { callsign: string; icao24: string; lat: number; lon: number; altitude_m: number; ground_speed_kts: number; track_deg: number; on_ground: boolean }[];
+        source?: string;
+        updated_at?: number;
+      };
+      type MilResp = {
+        flights?: { callsign: string; hex_code: string; aircraft_type: string; aircraft_model: string; operator: string; operator_country: string; location?: { latitude: number; longitude: number }; altitude: number; heading: number; speed: number; is_interesting: boolean; note: string }[];
+      };
+
+      const [civResult, milResult] = await Promise.allSettled([
+        type === 'military'
+          ? Promise.resolve(null)
+          : fetch(`${base}/api/aviation/v1/track-aircraft?${bboxQ}`, { headers, signal: AbortSignal.timeout(8_000) })
+              .then(r => r.ok ? r.json() as Promise<CivilianResp> : Promise.reject(new Error(`HTTP ${r.status}`))),
+        type === 'civilian'
+          ? Promise.resolve(null)
+          : fetch(`${base}/api/military/v1/list-military-flights?${bboxQ}&page_size=100`, { headers, signal: AbortSignal.timeout(8_000) })
+              .then(r => r.ok ? r.json() as Promise<MilResp> : Promise.reject(new Error(`HTTP ${r.status}`))),
+      ]);
+
+      const civOk = type === 'military' || civResult.status === 'fulfilled';
+      const milOk = type === 'civilian' || milResult.status === 'fulfilled';
+
+      // Both sources down — total outage, don't return misleading empty data
+      if (!civOk && !milOk) throw new Error('Airspace data unavailable: both civilian and military sources failed');
+
+      const civ = civResult.status === 'fulfilled' ? civResult.value : null;
+      const mil = milResult.status === 'fulfilled' ? milResult.value : null;
+      const warnings: string[] = [];
+      if (!civOk) warnings.push('civilian ADS-B data unavailable');
+      if (!milOk) warnings.push('military flight data unavailable');
+
+      const civilianFlights = (civ?.positions ?? []).slice(0, 100).map(p => ({
+        callsign: p.callsign, icao24: p.icao24,
+        lat: p.lat, lon: p.lon,
+        altitude_m: p.altitude_m, speed_kts: p.ground_speed_kts,
+        heading_deg: p.track_deg, on_ground: p.on_ground,
+      }));
+      const militaryFlights = (mil?.flights ?? []).slice(0, 100).map(f => ({
+        callsign: f.callsign, hex_code: f.hex_code,
+        aircraft_type: f.aircraft_type, aircraft_model: f.aircraft_model,
+        operator: f.operator, operator_country: f.operator_country,
+        lat: f.location?.latitude, lon: f.location?.longitude,
+        altitude: f.altitude, heading: f.heading, speed: f.speed,
+        is_interesting: f.is_interesting, ...(f.note ? { note: f.note } : {}),
+      }));
+
+      return {
+        country_code: code,
+        bounding_box: { sw_lat, sw_lon, ne_lat, ne_lon },
+        civilian_count: civilianFlights.length,
+        military_count: militaryFlights.length,
+        ...(type !== 'military' && { civilian_flights: civilianFlights }),
+        ...(type !== 'civilian' && { military_flights: militaryFlights }),
+        ...(warnings.length > 0 && { partial: true, warnings }),
+        source: civ?.source ?? 'opensky',
+        updated_at: civ?.updated_at ? new Date(civ.updated_at).toISOString() : new Date().toISOString(),
+      };
+    },
+  },
+  {
+    name: 'get_maritime_activity',
+    description: "Live vessel traffic and maritime disruptions for a country's waters. Returns AIS density zones (ships-per-day, intensity score), dark ship events, and chokepoint congestion from AIS tracking.",
+    inputSchema: {
+      type: 'object',
+      properties: {
+        country_code: {
+          type: 'string',
+          description: 'ISO 3166-1 alpha-2 country code (e.g. "AE", "SA", "JP", "EG")',
+        },
+      },
+      required: ['country_code'],
+    },
+    _execute: async (params, base, apiKey) => {
+      const code = String(params.country_code ?? '').toUpperCase().slice(0, 2);
+      const bbox = COUNTRY_BBOXES[code];
+      if (!bbox) return { error: `Unknown country code: ${code}. Use ISO 3166-1 alpha-2 (e.g. "AE", "SA", "JP").` };
+      const [sw_lat, sw_lon, ne_lat, ne_lon] = bbox;
+      const bboxQ = `sw_lat=${sw_lat}&sw_lon=${sw_lon}&ne_lat=${ne_lat}&ne_lon=${ne_lon}`;
+      const headers = { 'X-WorldMonitor-Key': apiKey, 'User-Agent': 'worldmonitor-mcp-edge/1.0' };
+
+      type VesselResp = {
+        snapshot?: {
+          snapshot_at?: number;
+          density_zones?: { name: string; intensity: number; ships_per_day: number; delta_pct: number; note: string }[];
+          disruptions?: { name: string; type: string; severity: string; dark_ships: number; vessel_count: number; region: string; description: string }[];
+        };
+      };
+
+      const res = await fetch(`${base}/api/maritime/v1/get-vessel-snapshot?${bboxQ}`, {
+        headers, signal: AbortSignal.timeout(8_000),
+      });
+      if (!res.ok) throw new Error(`get-vessel-snapshot HTTP ${res.status}`);
+      const data = await res.json() as VesselResp;
+      const snap = data.snapshot ?? {};
+
+      return {
+        country_code: code,
+        bounding_box: { sw_lat, sw_lon, ne_lat, ne_lon },
+        snapshot_at: snap.snapshot_at ? new Date(snap.snapshot_at).toISOString() : new Date().toISOString(),
+        total_zones: (snap.density_zones ?? []).length,
+        total_disruptions: (snap.disruptions ?? []).length,
+        density_zones: (snap.density_zones ?? []).map(z => ({
+          name: z.name, intensity: z.intensity, ships_per_day: z.ships_per_day,
+          delta_pct: z.delta_pct, ...(z.note ? { note: z.note } : {}),
+        })),
+        disruptions: (snap.disruptions ?? []).map(d => ({
+          name: d.name, type: d.type, severity: d.severity,
+          dark_ships: d.dark_ships, vessel_count: d.vessel_count,
+          region: d.region, description: d.description,
+        })),
+      };
+    },
+  },
   {
     name: 'analyze_situation',
     description: 'AI geopolitical situation analysis (DeductionPanel). Provide a query and optional geo-political context; returns an LLM-powered analytical deduction with confidence and supporting signals.',

api/oauth/authorize.js

@@ -87,9 +87,9 @@ const GLOBE_SVG = '<svg width="20" height="20" viewBox="0 0 24 24" fill="none" s
 const PAGE_HEADERS = { 'Content-Type': 'text/html; charset=utf-8', 'X-Frame-Options': 'DENY', 'Cache-Control': 'no-store', 'Pragma': 'no-cache' };
 
 function htmlError(title, detail) {
-  return new Response(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Error &#x2014; WorldMonitor</title>
+  return new Response(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Error &#x2014; WorldMonitor MCP</title>
 <style>*{box-sizing:border-box;margin:0;padding:0}body{font-family:ui-monospace,'SF Mono','Cascadia Code',monospace;background:#0a0a0a;color:#e8e8e8;min-height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;padding:1.5rem}.wm-logo{display:flex;align-items:center;gap:.5rem;margin-bottom:2rem;text-decoration:none}.wm-logo svg{color:#2d8a6e}.wm-logo-text{font-size:.75rem;color:#555;letter-spacing:.1em;text-transform:uppercase}.card{width:100%;max-width:420px;background:#111;border:1px solid #1e1e1e;padding:2rem}h1{font-size:.95rem;font-weight:600;color:#ef4444;margin-bottom:.75rem;letter-spacing:.02em}p{font-size:.85rem;color:#666;line-height:1.6}.back{display:inline-block;margin-top:1.5rem;font-size:.75rem;color:#444;text-decoration:none;letter-spacing:.03em}.back:hover{color:#888}.footer{margin-top:1.5rem;font-size:.7rem;color:#2a2a2a;text-align:center}.footer a{color:#333;text-decoration:none}.footer a:hover{color:#555}</style></head>
-<body><a href="https://www.worldmonitor.app" class="wm-logo" target="_blank" rel="noopener">${GLOBE_SVG}<span class="wm-logo-text">WorldMonitor</span></a>
+<body><a href="https://www.worldmonitor.app" class="wm-logo" target="_blank" rel="noopener">${GLOBE_SVG}<span class="wm-logo-text">WorldMonitor MCP</span></a>
 <div class="card"><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p><a href="javascript:history.back()" class="back">&#8592; go back</a></div>
 <p class="footer"><a href="https://www.worldmonitor.app" target="_blank" rel="noopener">worldmonitor.app</a></p>
 </body></html>`, { status: 400, headers: PAGE_HEADERS });
@@ -100,7 +100,7 @@ function consentPage(params, nonce, errorMsg = '') {
   const redirectHost = new URL(redirect_uri).hostname;
   return new Response(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Authorize &#x2014; WorldMonitor</title>
+<title>Authorize &#x2014; WorldMonitor MCP</title>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
 body{font-family:ui-monospace,'SF Mono','Cascadia Code',monospace;background:#0a0a0a;color:#e8e8e8;min-height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;padding:1.5rem}
@@ -115,7 +115,7 @@ hr{border:none;border-top:1px solid #1e1e1e;margin:1.25rem 0}
 .scope-label{font-size:.65rem;text-transform:uppercase;letter-spacing:.1em;color:#444;margin-bottom:.6rem}
 .scope-list{list-style:none}
 .scope-list li{font-size:.8rem;color:#666;padding:.2rem 0;display:flex;align-items:flex-start;gap:.5rem}
-.scope-list li::before{content:'&#x2192;';color:#2d8a6e;flex-shrink:0;margin-top:.05em}
+.scope-list li::before{content:'→';color:#2d8a6e;flex-shrink:0;margin-top:.05em}
 label{display:block;font-size:.65rem;text-transform:uppercase;letter-spacing:.1em;color:#444;margin-bottom:.4rem}
 input[type=password]{width:100%;padding:.65rem .75rem;background:#0a0a0a;border:1px solid #2a2a2a;color:#e8e8e8;font-family:inherit;font-size:.9rem;outline:none;border-radius:0}
 input[type=password]:focus{border-color:#2d8a6e}
@@ -131,7 +131,7 @@ button:disabled{opacity:.5;cursor:default}
 .footer a:hover{color:#555}
 </style></head>
 <body>
-<a href="https://www.worldmonitor.app" class="wm-logo" target="_blank" rel="noopener">${GLOBE_SVG}<span class="wm-logo-text">WorldMonitor</span></a>
+<a href="https://www.worldmonitor.app" class="wm-logo" target="_blank" rel="noopener">${GLOBE_SVG}<span class="wm-logo-text">WorldMonitor MCP</span></a>
 <div class="card">
 <div class="client-hd">
 <div class="client-name">${escapeHtml(client_name)} wants access</div>