@almadar/orb 3.3.0 → 3.5.0

package/shells/almadar-shell-hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/shell-hono",
-  "version": "0.1.40",
+  "version": "0.1.54",
   "description": "Minimal full-stack shell template for Almadar applications (Hono server)",
   "workspaces": [
     "packages/*"

package/shells/almadar-shell-hono/packages/client/package.json

@@ -13,11 +13,11 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/ui": "^5.147.0",
+    "@almadar/ui": "^5.159.0",
     "@almadar/syntax": "^1.15.0",
-    "@almadar/evaluator": "^2.40.0",
+    "@almadar/evaluator": "^2.42.0",
     "@almadar/patterns": "^2.101.0",
-    "@almadar/core": "^10.57.0",
+    "@almadar/core": "^10.69.0",
     "firebase": "^11.4.0",
     "@tanstack/react-query": "^5.67.3",
     "react": "^19.0.0",

package/shells/almadar-shell-hono/packages/server/package.json

@@ -13,10 +13,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/server-hono": "^0.4.11",
-    "@almadar/evaluator": "^2.40.0",
-    "@almadar/core": "^10.57.0",
-    "@almadar/integrations": "^2.23.0",
+    "@almadar/server-hono": "^0.4.12",
+    "@almadar/evaluator": "^2.42.0",
+    "@almadar/core": "^10.69.0",
+    "@almadar/integrations": "^2.27.0",
     "hono": "^4.7.0",
     "@hono/node-server": "^1.14.0",
     "@hono/zod-validator": "^0.4.0",

package/shells/almadar-shell-hono/packages/server/src/app.ts

@@ -8,8 +8,15 @@ import {
   errorHandler,
   notFoundHandler,
   debugEventsRouter,
+  pushRouter,
+  pushServiceWorkerHandler,
+  PUSH_SERVICE_WORKER_PATH,
+  reportsRouter,
+  createHooksRouter,
   type AppEnv,
 } from '@almadar/server-hono';
+import { hookProviders } from './hooks-providers.js';
+import { broadcastBusEvent } from './sse.js';
 import { registerRoutes } from './routes.js';
 
 export const app = new Hono<AppEnv>();
@@ -23,9 +30,41 @@ app.get('/health', (c) => c.json({ status: 'ok' }));
 // Debug event bus endpoints (dev-only, no-op in production)
 app.route('/api/debug', debugEventsRouter());
 
+// Web Push surface (browser/push-subscribe): public VAPID key + the shared
+// service worker (root-scoped — a SW's max scope is its own directory).
+app.route('/api/push', pushRouter);
+app.get(PUSH_SERVICE_WORKER_PATH, pushServiceWorkerHandler);
+
+// Inbound webhook ingress (I-19 decision): mounted BEFORE the authenticated
+// /api routes — hook senders (Google Calendar watch channels, e-sign status,
+// banking callbacks) cannot present a Firebase token, so each provider
+// VERIFIES its own signature/channel token and unverified requests get 400.
+// Dispatch = SSE bus broadcast to every connected client, so client circuits'
+// `listens` fire; the cron pull cycle stays the no-client backstop.
+app.route(
+  '/api/hooks',
+  createHooksRouter({
+    // Derived from this app's invoked services (generated hooks-providers.ts, I-26).
+    providers: hookProviders(),
+    dispatch: (event, payload) => {
+      broadcastBusEvent(undefined, {
+        type: 'bus',
+        event,
+        payload,
+        source: { orbital: 'webhook', trait: 'ingress' },
+        timestamp: Date.now(),
+      });
+    },
+  }),
+);
+
 // Register generated routes
 registerRoutes(app);
 
+// Server-side report export (Excel/PDF/CSV). Mounted AFTER registerRoutes so
+// the /api/* auth middleware it registers covers this route too.
+app.route('/api/reports', reportsRouter);
+
 // Error handling
 app.notFound(notFoundHandler);
 app.onError(errorHandler);

package/shells/almadar-shell-hono/packages/server/src/hooks-providers.ts

@@ -0,0 +1,11 @@
+/**
+ * Hook Providers
+ *
+ * Checked-in stub so the template builds standalone in CI; the compiler
+ * overwrites it with the provider map derived from the app's invoked
+ * services × the registry's hook declarations (I-26).
+ */
+
+export function hookProviders() {
+  return {};
+}

package/shells/almadar-shell-hono/packages/server/src/index.ts

@@ -22,11 +22,36 @@ try {
 }
 
 import { serve } from '@hono/node-server';
+import { validateIntegrationEnv, FirestoreCredentialPersistence } from '@almadar/server-hono';
 import { app } from './app.js';
+import { invokedServices, installTenantCredentialStore } from './services/clients.js';
+
+// Fail fast in production when a required integration credential is missing
+// (see SECRETS.md); registers the invoked services for /health reporting.
+validateIntegrationEnv(invokedServices);
 
 const PORT = env.PORT || 3030;
 
 async function start(): Promise<void> {
+  // W4 tenant credential store: with a master key configured, stored
+  // credentials (Firestore rows, AES-256-GCM) layer over the env —
+  // store → env → unconfigured — and go live on change without restart.
+  if (process.env.ALMADAR_CREDENTIAL_MASTER_KEY) {
+    try {
+      await installTenantCredentialStore(new FirestoreCredentialPersistence());
+      logger.info('Tenant credential store installed');
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      // A configured master key IS the deployment's statement that the store
+      // is in use — failing to serve it in production is a boot failure.
+      if (env.NODE_ENV === 'production') {
+        logger.error(`Tenant credential store failed to initialize — refusing to start: ${message}`);
+        throw e;
+      }
+      logger.warn(`Tenant credential store unavailable — falling back to env credentials: ${message}`);
+    }
+  }
+
   // Seed mock data when USE_MOCK_DATA is enabled
   if (env.USE_MOCK_DATA) {
     try {

package/shells/almadar-shell-hono/packages/server/src/services/clients.ts

@@ -0,0 +1,17 @@
+/**
+ * Service Clients — placeholder
+ *
+ * Compiler generates the real service clients here (delegating to
+ * @almadar/integrations; see orbital-shell-typescript codegen/service.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export const declaredServices = [] as const;
+
+export const invokedServices = [] as const;
+
+/** Overwritten at emit time with the RuntimeIntegrationManager-backed store install. */
+export async function installTenantCredentialStore(_adapter: object): Promise<void> {
+  // {{GENERATED_SERVICE_CLIENTS}}
+}

package/shells/almadar-shell-hono/packages/server/src/sse.ts

@@ -0,0 +1,20 @@
+/**
+ * Live-push SSE channel — placeholder
+ *
+ * Compiler generates the real SSE module here (connection registry +
+ * cross-client broadcast; see orbital-shell-typescript backend/server/sse.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export interface BusBroadcastItem {
+  type: 'bus';
+  event: string;
+  payload?: object;
+  source: { orbital: string; trait: string };
+  timestamp: number;
+}
+
+export function broadcastBusEvent(_originClientId: string | undefined, _item: BusBroadcastItem): void {
+  // {{GENERATED_SSE_BROADCAST}}
+}