@almadar/orb 3.4.0 → 3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/orb",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Orb CLI - deterministic when it can be, intelligent when it needs to be",
   "license": "BSL-1.1",
   "repository": {
@@ -49,10 +49,10 @@
     "node": ">=16.0.0"
   },
   "optionalDependencies": {
-    "@almadar/orb-darwin-x64": "3.4.0",
-    "@almadar/orb-darwin-arm64": "3.4.0",
-    "@almadar/orb-linux-x64": "3.4.0",
-    "@almadar/orb-linux-arm64": "3.4.0",
-    "@almadar/orb-windows-x64": "3.4.0"
+    "@almadar/orb-darwin-x64": "3.5.0",
+    "@almadar/orb-darwin-arm64": "3.5.0",
+    "@almadar/orb-linux-x64": "3.5.0",
+    "@almadar/orb-linux-arm64": "3.5.0",
+    "@almadar/orb-windows-x64": "3.5.0"
   }
 }

package/shells/almadar-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/shell",
-  "version": "2.64.0",
+  "version": "2.78.0",
   "private": false,
   "description": "Minimal full-stack shell template for Almadar applications",
   "packageManager": "pnpm@10.30.3",

package/shells/almadar-shell/packages/client/package.json

@@ -13,12 +13,12 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/core": "^10.57.0",
-    "@almadar/evaluator": "^2.40.0",
+    "@almadar/core": "^10.69.0",
+    "@almadar/evaluator": "^2.42.0",
     "@almadar/logger": "^1.11.0",
     "@almadar/patterns": "^2.101.0",
     "@almadar/syntax": "^1.15.0",
-    "@almadar/ui": "^5.147.0",
+    "@almadar/ui": "^5.159.0",
     "@monaco-editor/react": "^4.7.0",
     "@react-three/drei": "^9.92.0",
     "@react-three/fiber": "^9.0.0",

package/shells/almadar-shell/packages/server/package.json

@@ -13,12 +13,12 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/core": "^10.57.0",
-    "@almadar/evaluator": "^2.40.0",
-    "@almadar/integrations": "^2.23.0",
+    "@almadar/core": "^10.69.0",
+    "@almadar/evaluator": "^2.42.0",
+    "@almadar/integrations": "^2.27.0",
     "@almadar/logger": "^1.11.0",
-    "@almadar/runtime": "^6.53.0",
-    "@almadar/server": "^2.34.0",
+    "@almadar/runtime": "^6.60.0",
+    "@almadar/server": "^2.38.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",

package/shells/almadar-shell/packages/server/src/app.ts

@@ -13,7 +13,14 @@ import {
   notFoundHandler,
   debugEventsRouter,
   personasRouter,
+  pushRouter,
+  pushServiceWorkerHandler,
+  PUSH_SERVICE_WORKER_PATH,
+  reportsRouter,
+  createHooksRouter,
 } from '@almadar/server';
+import { hookProviders } from './hooks-providers.js';
+import { broadcastBusEvent } from './sse.js';
 import { registerRoutes } from './routes.js';
 
 export const app: Express = express();
@@ -24,7 +31,12 @@ app.use(helmet());
 app.use(cors({ origin: env.CORS_ORIGIN, credentials: true }));
 app.use(express.json({ limit: '1mb' }));
 app.use(express.urlencoded({ extended: true, limit: '1mb' }));
-app.use('/api', rateLimit({ windowMs: 15 * 60 * 1000, max: 300, standardHeaders: true, legacyHeaders: false }));
+// Rate limiting protects deployed apps; verification walkers and local dev
+// fire hundreds of bridge events per minute and must not be throttled —
+// ORB_DISABLE_RATE_LIMIT=1 (set by the verify harness) bypasses it.
+if (process.env.ORB_DISABLE_RATE_LIMIT !== '1') {
+  app.use('/api', rateLimit({ windowMs: 15 * 60 * 1000, max: 300, standardHeaders: true, legacyHeaders: false }));
+}
 
 // Health check
 app.get('/health', (_req, res) => {
@@ -34,6 +46,34 @@ app.get('/health', (_req, res) => {
 // Debug event bus endpoints (dev-only, no-op in production)
 app.use('/api/debug', debugEventsRouter());
 
+// Web Push surface (browser/push-subscribe): public VAPID key + the shared
+// service worker (root-scoped — a SW's max scope is its own directory).
+app.use('/api/push', pushRouter);
+app.get(PUSH_SERVICE_WORKER_PATH, pushServiceWorkerHandler);
+
+// Inbound webhook ingress (I-19 decision): mounted BEFORE the authenticated
+// /api routes — hook senders (Google Calendar watch channels, e-sign status,
+// banking callbacks) cannot present a Firebase token, so each provider
+// VERIFIES its own signature/channel token and unverified requests get 400.
+// Providers are DERIVED from this app's invoked services (generated
+// hooks-providers.ts, I-26). Dispatch = SSE bus broadcast to every connected
+// client, so client circuits' `listens` fire; cron pull stays the backstop.
+app.use(
+  '/api/hooks',
+  createHooksRouter({
+    providers: hookProviders(),
+    dispatch: (event, payload) => {
+      broadcastBusEvent(undefined, {
+        type: 'bus',
+        event,
+        payload,
+        source: { orbital: 'webhook', trait: 'ingress' },
+        timestamp: Date.now(),
+      });
+    },
+  }),
+);
+
 // Dev persona roster (no-op unless ALLOW_DEV_AUTH_BYPASS). Mounted BEFORE
 // registerRoutes, which applies authenticateFirebase to /api — a pre-login
 // persona picker cannot present a token it does not have yet.
@@ -42,6 +82,10 @@ app.use('/api', personasRouter());
 // Register generated routes
 registerRoutes(app);
 
+// Server-side report export (Excel/PDF/CSV). Mounted AFTER registerRoutes so
+// the /api auth middleware it registers covers this route too.
+app.use('/api/reports', reportsRouter);
+
 // Error handling
 app.use(notFoundHandler);
 app.use(errorHandler);

package/shells/almadar-shell/packages/server/src/hooks-providers.ts

@@ -0,0 +1,11 @@
+/**
+ * Hook Providers
+ *
+ * Checked-in stub so the template builds standalone in CI; the compiler
+ * overwrites it with the provider map derived from the app's invoked
+ * services × the registry's hook declarations (I-26).
+ */
+
+export function hookProviders() {
+  return {};
+}

package/shells/almadar-shell/packages/server/src/index.ts

@@ -21,11 +21,36 @@ try {
   logger.warn(`Firebase not configured — auth/db routes disabled: ${message}`);
 }
 
+import { validateIntegrationEnv, FirestoreCredentialPersistence } from '@almadar/server';
 import { app } from './app.js';
+import { invokedServices, installTenantCredentialStore } from './services/clients.js';
+
+// Fail fast in production when a required integration credential is missing
+// (see SECRETS.md); registers the invoked services for /health reporting.
+validateIntegrationEnv(invokedServices);
 
 const PORT = env.PORT || 3030;
 
 async function start(): Promise<void> {
+  // W4 tenant credential store: with a master key configured, stored
+  // credentials (Firestore rows, AES-256-GCM) layer over the env —
+  // store → env → unconfigured — and go live on change without restart.
+  if (process.env.ALMADAR_CREDENTIAL_MASTER_KEY) {
+    try {
+      await installTenantCredentialStore(new FirestoreCredentialPersistence());
+      logger.info('Tenant credential store installed');
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      // A configured master key IS the deployment's statement that the store
+      // is in use — failing to serve it in production is a boot failure.
+      if (env.NODE_ENV === 'production') {
+        logger.error(`Tenant credential store failed to initialize — refusing to start: ${message}`);
+        throw e;
+      }
+      logger.warn(`Tenant credential store unavailable — falling back to env credentials: ${message}`);
+    }
+  }
+
   // Seed mock data when USE_MOCK_DATA is enabled
   if (env.USE_MOCK_DATA) {
     try {

package/shells/almadar-shell/packages/server/src/services/clients.ts

@@ -0,0 +1,17 @@
+/**
+ * Service Clients — placeholder
+ *
+ * Compiler generates the real service clients here (delegating to
+ * @almadar/integrations; see orbital-shell-typescript codegen/service.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export const declaredServices = [] as const;
+
+export const invokedServices = [] as const;
+
+/** Overwritten at emit time with the RuntimeIntegrationManager-backed store install. */
+export async function installTenantCredentialStore(_adapter: object): Promise<void> {
+  // {{GENERATED_SERVICE_CLIENTS}}
+}

package/shells/almadar-shell/packages/server/src/sse.ts

@@ -0,0 +1,20 @@
+/**
+ * Live-push SSE channel — placeholder
+ *
+ * Compiler generates the real SSE module here (connection registry +
+ * cross-client broadcast; see orbital-shell-typescript backend/server/sse.rs).
+ * This stub only lets the template build standalone; an emitted app
+ * overwrites it wholesale.
+ */
+
+export interface BusBroadcastItem {
+  type: 'bus';
+  event: string;
+  payload?: object;
+  source: { orbital: string; trait: string };
+  timestamp: number;
+}
+
+export function broadcastBusEvent(_originClientId: string | undefined, _item: BusBroadcastItem): void {
+  // {{GENERATED_SSE_BROADCAST}}
+}

package/shells/almadar-shell/packages/shared/package.json

@@ -5,7 +5,7 @@
   "main": "src/index.ts",
   "types": "src/index.ts",
   "dependencies": {
-    "@almadar/core": "^10.57.0",
+    "@almadar/core": "^10.69.0",
     "zod": "^3.22.0"
   }
 }