@agent-relay/cloud 0.1.0

package/dist/api/admin.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin API Routes
+ *
+ * Administrative endpoints for managing workspaces at scale.
+ * Protected by admin secret (ADMIN_API_SECRET environment variable).
+ */
+export declare const adminRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=admin.d.ts.map

package/dist/api/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/api/admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,eAAO,MAAM,WAAW,4CAAW,CAAC"}

package/dist/api/admin.js

@@ -0,0 +1,225 @@
+/**
+ * Admin API Routes
+ *
+ * Administrative endpoints for managing workspaces at scale.
+ * Protected by admin secret (ADMIN_API_SECRET environment variable).
+ */
+import { Router } from 'express';
+import { getConfig } from '../config.js';
+import { getProvisioner, WorkspaceProvisioner } from '../provisioner/index.js';
+export const adminRouter = Router();
+/**
+ * Middleware to authenticate admin requests
+ * Requires ADMIN_API_SECRET header to match environment variable
+ */
+async function requireAdminAuth(req, res, next) {
+    const authHeader = req.headers['x-admin-secret'] || req.headers.authorization;
+    const adminSecret = process.env.ADMIN_API_SECRET;
+    if (!adminSecret) {
+        res.status(503).json({ error: 'Admin API not configured' });
+        return;
+    }
+    // Support both x-admin-secret header and Bearer token
+    const providedSecret = authHeader?.toString().replace('Bearer ', '');
+    if (!providedSecret || providedSecret !== adminSecret) {
+        res.status(401).json({ error: 'Invalid admin credentials' });
+        return;
+    }
+    next();
+}
+// Apply admin auth to all routes
+adminRouter.use(requireAdminAuth);
+/**
+ * POST /api/admin/workspaces/update-image
+ *
+ * Gracefully update workspace images across all or specific workspaces.
+ *
+ * Request body:
+ * - image: New Docker image to deploy (required)
+ * - workspaceIds?: Array of specific workspace IDs to update
+ * - userIds?: Array of user IDs whose workspaces to update
+ * - force?: Force update even if agents are active (default: false)
+ * - skipRestart?: Update config without restarting (default: false)
+ * - batchSize?: Number of concurrent updates (default: 5)
+ *
+ * Response:
+ * - summary: { total, updated, pendingRestart, skippedActiveAgents, skippedVerificationFailed, skippedNotRunning, errors }
+ * - results: Array of per-workspace results
+ */
+adminRouter.post('/workspaces/update-image', async (req, res) => {
+    const { image, workspaceIds, userIds, force = false, skipRestart = false, batchSize = 5, } = req.body;
+    if (!image) {
+        res.status(400).json({ error: 'image is required' });
+        return;
+    }
+    console.log(`[admin] Starting workspace image update to ${image}`, {
+        workspaceIds: workspaceIds?.length ?? 'all',
+        userIds: userIds?.length ?? 'all',
+        force,
+        skipRestart,
+        batchSize,
+    });
+    try {
+        const provisioner = getProvisioner();
+        const result = await provisioner.gracefulUpdateAllImages(image, {
+            workspaceIds,
+            userIds,
+            force,
+            skipRestart,
+            batchSize,
+        });
+        res.json(result);
+    }
+    catch (error) {
+        console.error('[admin] Error updating workspace images:', error);
+        res.status(500).json({
+            error: 'Failed to update workspace images',
+            details: error.message,
+        });
+    }
+});
+/**
+ * POST /api/admin/workspaces/:id/update-image
+ *
+ * Gracefully update a single workspace's image.
+ *
+ * Request body:
+ * - image: New Docker image to deploy (required)
+ * - force?: Force update even if agents are active (default: false)
+ * - skipRestart?: Update config without restarting (default: false)
+ *
+ * Response:
+ * - result: Update result code
+ * - workspaceId: Workspace ID
+ * - machineState?: Current machine state
+ * - agentCount?: Number of active agents (if applicable)
+ * - error?: Error message (if applicable)
+ */
+adminRouter.post('/workspaces/:id/update-image', async (req, res) => {
+    const id = req.params.id;
+    const { image, force = false, skipRestart = false, } = req.body;
+    if (!image) {
+        res.status(400).json({ error: 'image is required' });
+        return;
+    }
+    console.log(`[admin] Updating workspace ${id} image to ${image}`, { force, skipRestart });
+    try {
+        const provisioner = getProvisioner();
+        const result = await provisioner.gracefulUpdateImage(id, image, {
+            force,
+            skipRestart,
+        });
+        // Return appropriate status code based on result
+        if (result.result === WorkspaceProvisioner.UpdateResult.ERROR) {
+            res.status(500).json(result);
+        }
+        else if (result.result === WorkspaceProvisioner.UpdateResult.NOT_SUPPORTED) {
+            res.status(400).json(result);
+        }
+        else {
+            res.json(result);
+        }
+    }
+    catch (error) {
+        console.error(`[admin] Error updating workspace ${id}:`, error);
+        res.status(500).json({
+            error: 'Failed to update workspace image',
+            details: error.message,
+        });
+    }
+});
+/**
+ * GET /api/admin/workspaces/:id/agents
+ *
+ * Check active agents in a workspace.
+ * Useful for pre-flight checks before updates.
+ *
+ * Response:
+ * - hasActiveAgents: boolean
+ * - agentCount: number
+ * - agents: Array of { name, status }
+ */
+adminRouter.get('/workspaces/:id/agents', async (req, res) => {
+    const id = req.params.id;
+    try {
+        // Query workspace directly from DB and check agents via daemon API
+        const workspace = await (await import('../db/index.js')).db.workspaces.findById(id);
+        if (!workspace) {
+            res.status(404).json({ error: 'Workspace not found' });
+            return;
+        }
+        if (workspace.computeProvider !== 'fly') {
+            res.status(400).json({ error: 'Only Fly.io workspaces support agent checking' });
+            return;
+        }
+        // Query the workspace daemon directly
+        const baseUrl = workspace.publicUrl;
+        if (!baseUrl) {
+            res.json({ hasActiveAgents: false, agentCount: 0, agents: [] });
+            return;
+        }
+        try {
+            // Use /api/data endpoint which returns { agents: [...], ... }
+            // Note: /api/agents doesn't exist on the workspace dashboard-server
+            const response = await fetch(`${baseUrl}/api/data`, {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok) {
+                res.json({ hasActiveAgents: false, agentCount: 0, agents: [], error: `Daemon returned ${response.status}` });
+                return;
+            }
+            const data = await response.json();
+            const agents = data.agents || [];
+            const activeAgents = agents.filter(a => {
+                const status = (a.status ?? '').toLowerCase();
+                const activityState = (a.activityState ?? '').toLowerCase();
+                const isProcessing = a.isProcessing === true;
+                if (activityState === 'active' || activityState === 'idle')
+                    return true;
+                if (status && status !== 'disconnected' && status !== 'offline')
+                    return true;
+                if (isProcessing)
+                    return true;
+                return false;
+            });
+            res.json({
+                hasActiveAgents: activeAgents.length > 0,
+                agentCount: activeAgents.length,
+                agents: agents.map(a => ({ name: a.name, status: a.status || a.activityState || 'unknown' })),
+            });
+        }
+        catch (error) {
+            // Workspace might be stopped
+            res.json({
+                hasActiveAgents: false,
+                agentCount: 0,
+                agents: [],
+                error: `Could not reach workspace: ${error.message}`,
+            });
+        }
+    }
+    catch (error) {
+        console.error(`[admin] Error checking agents for workspace ${id}:`, error);
+        res.status(500).json({
+            error: 'Failed to check workspace agents',
+            details: error.message,
+        });
+    }
+});
+/**
+ * GET /api/admin/health
+ *
+ * Health check for admin API.
+ */
+adminRouter.get('/health', (_req, res) => {
+    res.json({
+        status: 'ok',
+        timestamp: new Date().toISOString(),
+        config: {
+            computeProvider: getConfig().compute.provider,
+        },
+    });
+});
+//# sourceMappingURL=admin.js.map

package/dist/api/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/api/admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;AAEpC;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,GAAa,EACb,IAAgB;IAEhB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAEjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,cAAc,GAAG,UAAU,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAErE,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,iCAAiC;AACjC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,WAAW,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjF,MAAM,EACJ,KAAK,EACL,YAAY,EACZ,OAAO,EACP,KAAK,GAAG,KAAK,EACb,WAAW,GAAG,KAAK,EACnB,SAAS,GAAG,CAAC,GACd,GAAG,GAAG,CAAC,IAOP,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8CAA8C,KAAK,EAAE,EAAE;QACjE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,KAAK;QAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;QACjC,KAAK;QACL,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,KAAK,EAAE;YAC9D,YAAY;YACZ,OAAO;YACP,KAAK;YACL,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,mCAAmC;YAC1C,OAAO,EAAG,KAAe,CAAC,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,WAAW,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACrF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;IACnC,MAAM,EACJ,KAAK,EACL,KAAK,GAAG,KAAK,EACb,WAAW,GAAG,KAAK,GACpB,GAAG,GAAG,CAAC,IAIP,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,aAAa,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE;YAC9D,KAAK;YACL,WAAW;SACZ,CAAC,CAAC;QAEH,iDAAiD;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAG,KAAe,CAAC,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,WAAW,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC9E,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;IAEnC,IAAI,CAAC;QACH,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;gBAClD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBACzC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAE/B,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACrC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5D,MAAM,YAAY,GAAI,CAAgC,CAAC,YAAY,KAAK,IAAI,CAAC;gBAE7E,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACxE,IAAI,MAAM,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAC7E,IAAI,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC;gBACP,eAAe,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;gBACxC,UAAU,EAAE,YAAY,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC;aAC9F,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6BAA6B;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,eAAe,EAAE,KAAK;gBACtB,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAG,KAAe,CAAC,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAC1D,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE;YACN,eAAe,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,QAAQ;SAC9C;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/api/auth.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Auth API Routes
+ *
+ * Session management routes.
+ * User login is handled via Nango (see nango-auth.ts).
+ * GitHub repo operations are in github-app.ts.
+ */
+import { Request, Response } from 'express';
+export declare const authRouter: import("express-serve-static-core").Router;
+declare module 'express-session' {
+    interface SessionData {
+        userId?: string;
+        githubToken?: string;
+    }
+}
+/**
+ * Middleware to require authentication
+ */
+export declare function requireAuth(req: Request, res: Response, next: () => void): Response<any, Record<string, any>> | undefined;
+//# sourceMappingURL=auth.d.ts.map

package/dist/api/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAU,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGpD,eAAO,MAAM,UAAU,4CAAW,CAAC;AAGnC,OAAO,QAAQ,iBAAiB,CAAC;IAC/B,UAAU,WAAW;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB;CACF;AAsED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,kDASxE"}

package/dist/api/auth.js

@@ -0,0 +1,136 @@
+/**
+ * Auth API Routes
+ *
+ * Session management routes.
+ * User login is handled via Nango (see nango-auth.ts).
+ * GitHub repo operations are in github-app.ts.
+ */
+import { Router } from 'express';
+import { db } from '../db/index.js';
+export const authRouter = Router();
+/**
+ * GET /api/auth/github
+ * Redirect to Nango login flow
+ * @deprecated Use /api/auth/nango/login-session instead
+ */
+authRouter.get('/github', (_req, res) => {
+    res.redirect('/api/auth/nango/login-session');
+});
+/**
+ * POST /api/auth/logout
+ * Logout user
+ */
+authRouter.post('/logout', (req, res) => {
+    req.session.destroy((err) => {
+        if (err) {
+            return res.status(500).json({ error: 'Failed to logout' });
+        }
+        res.json({ success: true });
+    });
+});
+/**
+ * GET /api/auth/me
+ * Get current user
+ */
+authRouter.get('/me', async (req, res) => {
+    if (!req.session.userId) {
+        return res.status(401).json({ error: 'Not authenticated' });
+    }
+    try {
+        const user = await db.users.findById(req.session.userId);
+        if (!user) {
+            return res.status(401).json({ error: 'User not found' });
+        }
+        // Get connected providers
+        const credentials = await db.credentials.findByUserId(user.id);
+        const connectedProviders = credentials.map((c) => ({
+            provider: c.provider,
+            email: c.providerAccountEmail,
+            connectedAt: c.createdAt,
+        }));
+        // Get pending invites
+        const pendingInvites = await db.workspaceMembers.getPendingInvites(user.id);
+        // Check for pending GitHub installation request
+        const pendingGitHubApproval = !!user.pendingInstallationRequest;
+        res.json({
+            id: user.id,
+            githubUsername: user.githubUsername,
+            email: user.email,
+            avatarUrl: user.avatarUrl,
+            plan: user.plan,
+            connectedProviders,
+            pendingInvites: pendingInvites.length,
+            pendingGitHubApproval,
+            onboardingCompleted: !!user.onboardingCompletedAt,
+        });
+    }
+    catch (error) {
+        console.error('Error getting user:', error);
+        res.status(500).json({ error: 'Failed to get user' });
+    }
+});
+/**
+ * Middleware to require authentication
+ */
+export function requireAuth(req, res, next) {
+    if (!req.session.userId) {
+        return res.status(401).json({
+            error: 'Authentication required',
+            code: 'SESSION_EXPIRED',
+            message: 'Your session has expired. Please log in again.',
+        });
+    }
+    next();
+}
+/**
+ * GET /api/auth/session
+ * Check if current session is valid
+ */
+authRouter.get('/session', async (req, res) => {
+    if (!req.session.userId) {
+        return res.json({
+            authenticated: false,
+            code: 'SESSION_EXPIRED',
+            message: 'Your session has expired. Please log in again.',
+        });
+    }
+    try {
+        // Verify user still exists
+        const user = await db.users.findById(req.session.userId);
+        if (!user) {
+            req.session.destroy(() => { });
+            return res.json({
+                authenticated: false,
+                code: 'USER_NOT_FOUND',
+                message: 'User account not found. Please log in again.',
+            });
+        }
+        // Get connected providers
+        const credentials = await db.credentials.findByUserId(user.id);
+        const connectedProviders = credentials.map((c) => ({
+            provider: c.provider,
+            email: c.providerAccountEmail,
+            connectedAt: c.createdAt,
+        }));
+        res.json({
+            authenticated: true,
+            user: {
+                id: user.id,
+                githubUsername: user.githubUsername,
+                email: user.email,
+                avatarUrl: user.avatarUrl,
+                plan: user.plan,
+            },
+            connectedProviders,
+        });
+    }
+    catch (error) {
+        console.error('Session check error:', error);
+        res.status(500).json({
+            authenticated: false,
+            code: 'SESSION_ERROR',
+            message: 'An error occurred while checking your session.',
+        });
+    }
+});
+//# sourceMappingURL=auth.js.map

package/dist/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAEpC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAUnC;;;;GAIG;AACH,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACzD,GAAG,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACzD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC1D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,oBAAoB;YAC7B,WAAW,EAAE,CAAC,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;QAEJ,sBAAsB;QACtB,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5E,gDAAgD;QAChD,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;QAEhE,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,kBAAkB;YAClB,cAAc,EAAE,cAAc,CAAC,MAAM;YACrC,qBAAqB;YACrB,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAgB;IACvE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC/D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC;YACd,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,2BAA2B;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,oBAAoB;YAC7B,WAAW,EAAE,CAAC,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;YACD,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/api/billing.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Agent Relay Cloud - Billing API
+ *
+ * REST API for subscription and billing management.
+ */
+export declare const billingRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=billing.d.ts.map

package/dist/api/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../../src/api/billing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,eAAO,MAAM,aAAa,4CAAW,CAAC"}