@almadar/server 1.0.17 → 1.2.1

package/dist/middleware/multi-user.d.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from 'express';
+
+/**
+ * Multi-User Middleware
+ *
+ * Provides user isolation and session ownership using Firebase Auth.
+ *
+ * @packageDocumentation
+ */
+
+declare global {
+    namespace Express {
+        interface Request {
+            user?: {
+                uid: string;
+                email?: string;
+                roles?: string[];
+                orgId?: string;
+            };
+            userContext?: {
+                userId: string;
+                orgId?: string;
+                roles?: string[];
+            };
+        }
+    }
+}
+/**
+ * Middleware to set up user context from Firebase Auth
+ */
+declare function multiUserMiddleware(req: Request, res: Response, next: NextFunction): Promise<void>;
+/**
+ * Verify Firebase Auth token from Authorization header
+ */
+declare function verifyFirebaseAuth(req: Request, res: Response, next: NextFunction): Promise<void>;
+
+export { multiUserMiddleware, verifyFirebaseAuth };

package/dist/middleware/multi-user.js

@@ -0,0 +1,150 @@
+import { createUserContext, getMultiUserManager } from '@almadar/agent';
+import admin from 'firebase-admin';
+import { z } from 'zod';
+import dotenv from 'dotenv';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+dotenv.config();
+var envSchema = z.object({
+  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+  PORT: z.string().default("3030").transform((val) => parseInt(val, 10)),
+  CORS_ORIGIN: z.string().default("http://localhost:5173").transform((val) => val.includes(",") ? val.split(",").map((s) => s.trim()) : val),
+  // Database (Prisma/SQL) - optional
+  DATABASE_URL: z.string().optional(),
+  // Firebase/Firestore configuration
+  FIREBASE_PROJECT_ID: z.string().optional(),
+  FIREBASE_CLIENT_EMAIL: z.string().optional(),
+  FIREBASE_PRIVATE_KEY: z.string().optional(),
+  FIREBASE_SERVICE_ACCOUNT_PATH: z.string().optional(),
+  FIRESTORE_EMULATOR_HOST: z.string().optional(),
+  FIREBASE_AUTH_EMULATOR_HOST: z.string().optional(),
+  // API configuration
+  API_PREFIX: z.string().default("/api"),
+  // Mock data configuration
+  USE_MOCK_DATA: z.string().default("true").transform((v) => v === "true"),
+  MOCK_SEED: z.string().optional().transform((v) => v ? parseInt(v, 10) : void 0)
+});
+var parsed = envSchema.safeParse(process.env);
+if (!parsed.success) {
+  console.error("\u274C Invalid environment variables:", parsed.error.flatten().fieldErrors);
+  throw new Error("Invalid environment variables");
+}
+var env = parsed.data;
+
+// src/lib/db.ts
+var firebaseApp = null;
+function initializeFirebase() {
+  if (firebaseApp) {
+    return firebaseApp;
+  }
+  if (admin.apps.length > 0) {
+    firebaseApp = admin.apps[0];
+    return firebaseApp;
+  }
+  if (env.FIRESTORE_EMULATOR_HOST) {
+    firebaseApp = admin.initializeApp({
+      projectId: env.FIREBASE_PROJECT_ID || "demo-project"
+    });
+    console.log(`\u{1F527} Firebase Admin initialized for emulator: ${env.FIRESTORE_EMULATOR_HOST}`);
+    return firebaseApp;
+  }
+  const serviceAccountPath = env.FIREBASE_SERVICE_ACCOUNT_PATH;
+  if (serviceAccountPath) {
+    const serviceAccount = __require(serviceAccountPath);
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.cert(serviceAccount),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else if (env.FIREBASE_PROJECT_ID && env.FIREBASE_CLIENT_EMAIL && env.FIREBASE_PRIVATE_KEY) {
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.cert({
+        projectId: env.FIREBASE_PROJECT_ID,
+        clientEmail: env.FIREBASE_CLIENT_EMAIL,
+        privateKey: env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, "\n")
+      }),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else if (env.FIREBASE_PROJECT_ID) {
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.applicationDefault(),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else {
+    firebaseApp = admin.initializeApp({
+      projectId: "demo-project"
+    });
+  }
+  return firebaseApp;
+}
+function getFirestore() {
+  const app = initializeFirebase();
+  const db2 = app.firestore();
+  if (env.FIRESTORE_EMULATOR_HOST) {
+    db2.settings({
+      host: env.FIRESTORE_EMULATOR_HOST,
+      ssl: false
+    });
+  }
+  return db2;
+}
+function getAuth() {
+  const app = initializeFirebase();
+  return app.auth();
+}
+getFirestore();
+
+// src/middleware/multi-user.ts
+async function multiUserMiddleware(req, res, next) {
+  const userId = req.user?.uid;
+  if (!userId) {
+    res.status(401).json({ error: "Authentication required" });
+    return;
+  }
+  req.userContext = createUserContext(userId, {
+    orgId: req.user?.orgId,
+    roles: req.user?.roles ?? ["user"]
+  });
+  const originalJson = res.json.bind(res);
+  res.json = (body) => {
+    if (body && typeof body === "object" && "threadId" in body) {
+      const multiUser = getMultiUserManager();
+      multiUser.assignSessionOwnership(
+        body.threadId,
+        userId
+      );
+    }
+    return originalJson(body);
+  };
+  next();
+}
+async function verifyFirebaseAuth(req, res, next) {
+  const authHeader = req.headers.authorization;
+  if (!authHeader?.startsWith("Bearer ")) {
+    res.status(401).json({ error: "No token provided" });
+    return;
+  }
+  const token = authHeader.split("Bearer ")[1];
+  try {
+    const decodedToken = await getAuth().verifyIdToken(token);
+    const user = await getAuth().getUser(decodedToken.uid);
+    req.user = {
+      uid: decodedToken.uid,
+      email: decodedToken.email,
+      roles: user.customClaims?.roles ?? ["user"],
+      orgId: user.customClaims?.orgId
+    };
+    next();
+  } catch (error) {
+    console.error("Token verification failed:", error);
+    res.status(401).json({ error: "Invalid token" });
+  }
+}
+
+export { multiUserMiddleware, verifyFirebaseAuth };
+//# sourceMappingURL=multi-user.js.map
+//# sourceMappingURL=multi-user.js.map

package/dist/middleware/multi-user.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/env.ts","../../src/lib/db.ts","../../src/middleware/multi-user.ts"],"names":["db"],"mappings":";;;;;;;;;;;AAIA,MAAA,CAAO,MAAA,EAAO;AAEd,IAAM,SAAA,GAAY,EAAE,MAAA,CAAO;AAAA,EACzB,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAM,CAAA,CACH,MAAA,EAAO,CACP,OAAA,CAAQ,MAAM,CAAA,CACd,SAAA,CAAU,CAAC,GAAA,KAAQ,QAAA,CAAS,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACvC,WAAA,EAAa,CAAA,CACV,MAAA,EAAO,CACP,OAAA,CAAQ,uBAAuB,CAAA,CAC/B,SAAA,CAAU,CAAC,GAAA,KAAS,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,GAAI,GAAI,CAAA;AAAA;AAAA,EAGrF,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAGlC,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzC,qBAAA,EAAuB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3C,oBAAA,EAAsB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1C,6BAAA,EAA+B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,uBAAA,EAAyB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7C,2BAAA,EAA6B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAGjD,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA;AAAA;AAAA,EAGrC,aAAA,EAAe,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,KAAM,MAAM,CAAA;AAAA,EACvE,SAAA,EAAW,CAAA,CACR,MAAA,EAAO,CACP,UAAS,CACT,SAAA,CAAU,CAAC,CAAA,KAAO,CAAA,GAAI,QAAA,CAAS,CAAA,EAAG,EAAE,IAAI,MAAU;AACvD,CAAC,CAAA;AAED,IAAM,MAAA,GAAS,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE9C,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,EAAA,OAAA,CAAQ,MAAM,uCAAA,EAAoC,MAAA,CAAO,KAAA,CAAM,OAAA,GAAU,WAAW,CAAA;AACpF,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,MAAM,MAAA,CAAO,IAAA;;;AClC1B,IAAI,WAAA,GAAoC,IAAA;AAKxC,SAAS,kBAAA,GAAoC;AAC3C,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AACzB,IAAA,WAAA,GAAc,KAAA,CAAM,KAAK,CAAC,CAAA;AAC1B,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,IAAI,IAAI,uBAAA,EAAyB;AAE/B,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,SAAA,EAAW,IAAI,mBAAA,IAAuB;AAAA,KACvC,CAAA;AACD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,mDAAA,EAA+C,GAAA,CAAI,uBAAuB,CAAA,CAAE,CAAA;AACxF,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,MAAM,qBAAqB,GAAA,CAAI,6BAAA;AAE/B,EAAA,IAAI,kBAAA,EAAoB;AAGtB,IAAA,MAAM,cAAA,GAAiB,UAAQ,kBAAkB,CAAA;AACjD,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,cAAc,CAAA;AAAA,MAChD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,WAAW,GAAA,CAAI,mBAAA,IAAuB,GAAA,CAAI,qBAAA,IAAyB,IAAI,oBAAA,EAAsB;AAE3F,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK;AAAA,QAChC,WAAW,GAAA,CAAI,mBAAA;AAAA,QACf,aAAa,GAAA,CAAI,qBAAA;AAAA,QACjB,UAAA,EAAY,GAAA,CAAI,oBAAA,CAAqB,OAAA,CAAQ,QAAQ,IAAI;AAAA,OAC1D,CAAA;AAAA,MACD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,CAAA,MAAA,IAAW,IAAI,mBAAA,EAAqB;AAElC,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,kBAAA,EAAmB;AAAA,MAChD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,CAAA,MAAO;AAEL,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,WAAA;AACT;AAKO,SAAS,YAAA,GAA0C;AACxD,EAAA,MAAM,MAAM,kBAAA,EAAmB;AAC/B,EAAA,MAAMA,GAAAA,GAAK,IAAI,SAAA,EAAU;AAGzB,EAAA,IAAI,IAAI,uBAAA,EAAyB;AAC/B,IAAAA,IAAG,QAAA,CAAS;AAAA,MACV,MAAM,GAAA,CAAI,uBAAA;AAAA,MACV,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,EACH;AAEA,EAAA,OAAOA,GAAAA;AACT;AAKO,SAAS,OAAA,GAA2B;AACzC,EAAA,MAAM,MAAM,kBAAA,EAAmB;AAC/B,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AA8BkB,YAAA;;;AC/FlB,eAAsB,mBAAA,CACpB,GAAA,EACA,GAAA,EACA,IAAA,EACe;AACf,EAAA,MAAM,MAAA,GAAS,IAAI,IAAA,EAAM,GAAA;AAEzB,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAA2B,CAAA;AACzD,IAAA;AAAA,EACF;AAGA,EAAA,GAAA,CAAI,WAAA,GAAc,kBAAkB,MAAA,EAAQ;AAAA,IAC1C,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,IACjB,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,KAAA,IAAS,CAAC,MAAM;AAAA,GAClC,CAAA;AAGD,EAAA,MAAM,YAAA,GAAe,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA;AACtC,EAAA,GAAA,CAAI,IAAA,GAAO,CAAC,IAAA,KAAkB;AAC5B,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,cAAc,IAAA,EAAM;AAC1D,MAAA,MAAM,YAAY,mBAAA,EAAoB;AACtC,MAAA,SAAA,CAAU,sBAAA;AAAA,QACP,IAAA,CAA8B,QAAA;AAAA,QAC/B;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,aAAa,IAAI,CAAA;AAAA,EAC1B,CAAA;AAEA,EAAA,IAAA,EAAK;AACP;AAKA,eAAsB,kBAAA,CACpB,GAAA,EACA,GAAA,EACA,IAAA,EACe;AACf,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAE/B,EAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACtC,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAqB,CAAA;AACnD,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,SAAS,EAAE,CAAC,CAAA;AAE3C,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAQ,CAAE,cAAc,KAAK,CAAA;AAGxD,IAAA,MAAM,OAAO,MAAM,OAAA,EAAQ,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AAErD,IAAA,GAAA,CAAI,IAAA,GAAO;AAAA,MACT,KAAK,YAAA,CAAa,GAAA;AAAA,MAClB,OAAO,YAAA,CAAa,KAAA;AAAA,MACpB,KAAA,EAAQ,IAAA,CAAK,YAAA,EAAc,KAAA,IAAsB,CAAC,MAAM,CAAA;AAAA,MACxD,KAAA,EAAO,KAAK,YAAA,EAAc;AAAA,KAC5B;AAEA,IAAA,IAAA,EAAK;AAAA,EACP,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iBAAiB,CAAA;AAAA,EACjD;AACF","file":"multi-user.js","sourcesContent":["import { z } from 'zod';\nimport dotenv from 'dotenv';\n\n// Load environment variables\ndotenv.config();\n\nconst envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z\n    .string()\n    .default('3030')\n    .transform((val) => parseInt(val, 10)),\n  CORS_ORIGIN: z\n    .string()\n    .default('http://localhost:5173')\n    .transform((val) => (val.includes(',') ? val.split(',').map((s) => s.trim()) : val)),\n  \n  // Database (Prisma/SQL) - optional\n  DATABASE_URL: z.string().optional(),\n  \n  // Firebase/Firestore configuration\n  FIREBASE_PROJECT_ID: z.string().optional(),\n  FIREBASE_CLIENT_EMAIL: z.string().optional(),\n  FIREBASE_PRIVATE_KEY: z.string().optional(),\n  FIREBASE_SERVICE_ACCOUNT_PATH: z.string().optional(),\n  FIRESTORE_EMULATOR_HOST: z.string().optional(),\n  FIREBASE_AUTH_EMULATOR_HOST: z.string().optional(),\n  \n  // API configuration\n  API_PREFIX: z.string().default('/api'),\n\n  // Mock data configuration\n  USE_MOCK_DATA: z.string().default('true').transform((v) => v === 'true'),\n  MOCK_SEED: z\n    .string()\n    .optional()\n    .transform((v) => (v ? parseInt(v, 10) : undefined)),\n});\n\nconst parsed = envSchema.safeParse(process.env);\n\nif (!parsed.success) {\n  console.error('❌ Invalid environment variables:', parsed.error.flatten().fieldErrors);\n  throw new Error('Invalid environment variables');\n}\n\nexport const env = parsed.data;\n","/**\n * Database Configuration\n * \n * Supports both Prisma (SQL) and Firebase Admin (Firestore)\n * Generated apps can use either depending on the database option\n */\n\nimport admin from 'firebase-admin';\nimport { env } from './env.js';\n\n// ============ Firebase Admin / Firestore ============\n\nlet firebaseApp: admin.app.App | null = null;\n\n/**\n * Initialize Firebase Admin SDK\n */\nfunction initializeFirebase(): admin.app.App {\n  if (firebaseApp) {\n    return firebaseApp;\n  }\n\n  // Check if already initialized\n  if (admin.apps.length > 0) {\n    firebaseApp = admin.apps[0]!;\n    return firebaseApp;\n  }\n\n  // Check for emulator mode FIRST (no credentials needed)\n  if (env.FIRESTORE_EMULATOR_HOST) {\n    // Emulator mode - no credentials needed\n    firebaseApp = admin.initializeApp({\n      projectId: env.FIREBASE_PROJECT_ID || 'demo-project',\n    });\n    console.log(`🔧 Firebase Admin initialized for emulator: ${env.FIRESTORE_EMULATOR_HOST}`);\n    return firebaseApp;\n  }\n\n  // Production mode - need credentials\n  const serviceAccountPath = env.FIREBASE_SERVICE_ACCOUNT_PATH;\n  \n  if (serviceAccountPath) {\n    // Use service account file\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const serviceAccount = require(serviceAccountPath);\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.cert(serviceAccount),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else if (env.FIREBASE_PROJECT_ID && env.FIREBASE_CLIENT_EMAIL && env.FIREBASE_PRIVATE_KEY) {\n    // Use inline service account credentials\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.cert({\n        projectId: env.FIREBASE_PROJECT_ID,\n        clientEmail: env.FIREBASE_CLIENT_EMAIL,\n        privateKey: env.FIREBASE_PRIVATE_KEY.replace(/\\\\n/g, '\\n'),\n      }),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else if (env.FIREBASE_PROJECT_ID) {\n    // Use application default credentials (for Cloud Run, etc.)\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.applicationDefault(),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else {\n    // Emulator mode - use default credentials\n    firebaseApp = admin.initializeApp({\n      projectId: 'demo-project',\n    });\n  }\n\n  return firebaseApp;\n}\n\n/**\n * Get Firestore instance\n */\nexport function getFirestore(): admin.firestore.Firestore {\n  const app = initializeFirebase();\n  const db = app.firestore();\n  \n  // Connect to emulator if configured\n  if (env.FIRESTORE_EMULATOR_HOST) {\n    db.settings({\n      host: env.FIRESTORE_EMULATOR_HOST,\n      ssl: false,\n    });\n  }\n  \n  return db;\n}\n\n/**\n * Get Firebase Auth instance\n */\nexport function getAuth(): admin.auth.Auth {\n  const app = initializeFirebase();\n  return app.auth();\n}\n\n// ============ Prisma (Optional - for SQL databases) ============\n\n// Uncomment if using Prisma with SQL database\n/*\nimport { PrismaClient } from '@prisma/client';\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __db: PrismaClient | undefined;\n}\n\nconst createPrismaClient = () => {\n  return new PrismaClient({\n    log: env.NODE_ENV === 'development' ? ['query', 'error', 'warn'] : ['error'],\n  });\n};\n\nexport const db = globalThis.__db ?? createPrismaClient();\n\nif (env.NODE_ENV !== 'production') {\n  globalThis.__db = db;\n}\n*/\n\n// Re-export admin for convenience\nexport { admin };\n\n// Export db instance for handler convenience\nexport const db = getFirestore();\n","/**\n * Multi-User Middleware\n *\n * Provides user isolation and session ownership using Firebase Auth.\n *\n * @packageDocumentation\n */\n\nimport { getMultiUserManager, createUserContext } from '@almadar/agent';\nimport { getAuth } from '../lib/db.js';\nimport type { Request, Response, NextFunction } from 'express';\n\n// Extend Express Request to include Firebase user\ndeclare global {\n  namespace Express {\n    interface Request {\n      user?: {\n        uid: string;\n        email?: string;\n        roles?: string[];\n        orgId?: string;\n      };\n      userContext?: {\n        userId: string;\n        orgId?: string;\n        roles?: string[];\n      };\n    }\n  }\n}\n\n/**\n * Middleware to set up user context from Firebase Auth\n */\nexport async function multiUserMiddleware(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n): Promise<void> {\n  const userId = req.user?.uid;\n\n  if (!userId) {\n    res.status(401).json({ error: 'Authentication required' });\n    return;\n  }\n\n  // Create user context\n  req.userContext = createUserContext(userId, {\n    orgId: req.user?.orgId,\n    roles: req.user?.roles ?? ['user'],\n  });\n\n  // Assign session ownership when creating new sessions\n  const originalJson = res.json.bind(res);\n  res.json = (body: unknown) => {\n    if (body && typeof body === 'object' && 'threadId' in body) {\n      const multiUser = getMultiUserManager();\n      multiUser.assignSessionOwnership(\n        (body as { threadId: string }).threadId,\n        userId,\n      );\n    }\n    return originalJson(body);\n  };\n\n  next();\n}\n\n/**\n * Verify Firebase Auth token from Authorization header\n */\nexport async function verifyFirebaseAuth(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n): Promise<void> {\n  const authHeader = req.headers.authorization;\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    res.status(401).json({ error: 'No token provided' });\n    return;\n  }\n\n  const token = authHeader.split('Bearer ')[1];\n\n  try {\n    const decodedToken = await getAuth().verifyIdToken(token);\n\n    // Get custom claims for roles/org\n    const user = await getAuth().getUser(decodedToken.uid);\n\n    req.user = {\n      uid: decodedToken.uid,\n      email: decodedToken.email,\n      roles: (user.customClaims?.roles as string[]) ?? ['user'],\n      orgId: user.customClaims?.orgId as string,\n    };\n\n    next();\n  } catch (error) {\n    console.error('Token verification failed:', error);\n    res.status(401).json({ error: 'Invalid token' });\n  }\n}\n"]}

package/dist/routes/observability.d.ts

@@ -0,0 +1,12 @@
+import * as express_serve_static_core from 'express-serve-static-core';
+
+/**
+ * Observability Routes
+ *
+ * Provides endpoints for metrics, health checks, and telemetry.
+ *
+ * @packageDocumentation
+ */
+declare const router: express_serve_static_core.Router;
+
+export { router as default };

package/dist/routes/observability.js

@@ -0,0 +1,62 @@
+import { Router } from 'express';
+import { getObservabilityCollector } from '@almadar/agent';
+
+// src/routes/observability.ts
+var router = Router();
+router.get("/metrics", async (req, res) => {
+  try {
+    const collector = getObservabilityCollector();
+    const snapshot = collector.getPerformanceSnapshot();
+    res.json(snapshot);
+  } catch (error) {
+    console.error("Metrics error:", error);
+    res.status(500).json({ error: "Failed to get metrics" });
+  }
+});
+router.get("/health", async (req, res) => {
+  try {
+    const collector = getObservabilityCollector();
+    const health = await collector.healthCheck();
+    const allHealthy = health.every((h) => h.status === "healthy");
+    res.status(allHealthy ? 200 : 503).json({
+      status: allHealthy ? "healthy" : "degraded",
+      timestamp: Date.now(),
+      checks: health
+    });
+  } catch (error) {
+    console.error("Health check error:", error);
+    res.status(500).json({
+      status: "unhealthy",
+      error: "Health check failed"
+    });
+  }
+});
+router.get("/sessions/:threadId/telemetry", async (req, res) => {
+  try {
+    const collector = getObservabilityCollector();
+    const telemetry = collector.getSessionTelemetry(req.params.threadId);
+    if (!telemetry) {
+      res.status(404).json({ error: "Session not found" });
+      return;
+    }
+    res.json(telemetry);
+  } catch (error) {
+    console.error("Telemetry error:", error);
+    res.status(500).json({ error: "Failed to get telemetry" });
+  }
+});
+router.get("/active-sessions", async (req, res) => {
+  try {
+    const collector = getObservabilityCollector();
+    const sessions = collector.getActiveSessions();
+    res.json(sessions);
+  } catch (error) {
+    console.error("Active sessions error:", error);
+    res.status(500).json({ error: "Failed to get active sessions" });
+  }
+});
+var observability_default = router;
+
+export { observability_default as default };
+//# sourceMappingURL=observability.js.map
+//# sourceMappingURL=observability.js.map

package/dist/routes/observability.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/observability.ts"],"names":[],"mappings":";;;;AAWA,IAAM,SAAS,MAAA,EAAO;AAKtB,MAAA,CAAO,GAAA,CAAI,UAAA,EAAY,OAAO,GAAA,EAAK,GAAA,KAAQ;AACzC,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,yBAAA,EAA0B;AAC5C,IAAA,MAAM,QAAA,GAAW,UAAU,sBAAA,EAAuB;AAClD,IAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,EACnB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,kBAAkB,KAAK,CAAA;AACrC,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,yBAAyB,CAAA;AAAA,EACzD;AACF,CAAC,CAAA;AAKD,MAAA,CAAO,GAAA,CAAI,SAAA,EAAW,OAAO,GAAA,EAAK,GAAA,KAAQ;AACxC,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,yBAAA,EAA0B;AAC5C,IAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,WAAA,EAAY;AAC3C,IAAA,MAAM,aAAa,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,SAAS,CAAA;AAE7D,IAAA,GAAA,CAAI,MAAA,CAAO,UAAA,GAAa,GAAA,GAAM,GAAG,EAAE,IAAA,CAAK;AAAA,MACtC,MAAA,EAAQ,aAAa,SAAA,GAAY,UAAA;AAAA,MACjC,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,uBAAuB,KAAK,CAAA;AAC1C,IAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,MACnB,MAAA,EAAQ,WAAA;AAAA,MACR,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AACF,CAAC,CAAA;AAKD,MAAA,CAAO,GAAA,CAAI,+BAAA,EAAiC,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,yBAAA,EAA0B;AAC5C,IAAA,MAAM,SAAA,GAAY,SAAA,CAAU,mBAAA,CAAoB,GAAA,CAAI,OAAO,QAAQ,CAAA;AAEnE,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAqB,CAAA;AACnD,MAAA;AAAA,IACF;AAEA,IAAA,GAAA,CAAI,KAAK,SAAS,CAAA;AAAA,EACpB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,oBAAoB,KAAK,CAAA;AACvC,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,2BAA2B,CAAA;AAAA,EAC3D;AACF,CAAC,CAAA;AAKD,MAAA,CAAO,GAAA,CAAI,kBAAA,EAAoB,OAAO,GAAA,EAAK,GAAA,KAAQ;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,yBAAA,EAA0B;AAC5C,IAAA,MAAM,QAAA,GAAW,UAAU,iBAAA,EAAkB;AAC7C,IAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,EACnB,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,KAAK,CAAA;AAC7C,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iCAAiC,CAAA;AAAA,EACjE;AACF,CAAC,CAAA;AAED,IAAO,qBAAA,GAAQ","file":"observability.js","sourcesContent":["/**\n * Observability Routes\n *\n * Provides endpoints for metrics, health checks, and telemetry.\n *\n * @packageDocumentation\n */\n\nimport { Router } from 'express';\nimport { getObservabilityCollector } from '@almadar/agent';\n\nconst router = Router();\n\n/**\n * GET /metrics - Get performance snapshot\n */\nrouter.get('/metrics', async (req, res) => {\n  try {\n    const collector = getObservabilityCollector();\n    const snapshot = collector.getPerformanceSnapshot();\n    res.json(snapshot);\n  } catch (error) {\n    console.error('Metrics error:', error);\n    res.status(500).json({ error: 'Failed to get metrics' });\n  }\n});\n\n/**\n * GET /health - Get health check\n */\nrouter.get('/health', async (req, res) => {\n  try {\n    const collector = getObservabilityCollector();\n    const health = await collector.healthCheck();\n    const allHealthy = health.every((h) => h.status === 'healthy');\n\n    res.status(allHealthy ? 200 : 503).json({\n      status: allHealthy ? 'healthy' : 'degraded',\n      timestamp: Date.now(),\n      checks: health,\n    });\n  } catch (error) {\n    console.error('Health check error:', error);\n    res.status(500).json({\n      status: 'unhealthy',\n      error: 'Health check failed',\n    });\n  }\n});\n\n/**\n * GET /sessions/:threadId/telemetry - Get session telemetry\n */\nrouter.get('/sessions/:threadId/telemetry', async (req, res) => {\n  try {\n    const collector = getObservabilityCollector();\n    const telemetry = collector.getSessionTelemetry(req.params.threadId);\n\n    if (!telemetry) {\n      res.status(404).json({ error: 'Session not found' });\n      return;\n    }\n\n    res.json(telemetry);\n  } catch (error) {\n    console.error('Telemetry error:', error);\n    res.status(500).json({ error: 'Failed to get telemetry' });\n  }\n});\n\n/**\n * GET /active-sessions - Get active sessions\n */\nrouter.get('/active-sessions', async (req, res) => {\n  try {\n    const collector = getObservabilityCollector();\n    const sessions = collector.getActiveSessions();\n    res.json(sessions);\n  } catch (error) {\n    console.error('Active sessions error:', error);\n    res.status(500).json({ error: 'Failed to get active sessions' });\n  }\n});\n\nexport default router;\n"]}

package/dist/websocket/state-sync.d.ts

@@ -0,0 +1,39 @@
+/**
+ * State Sync WebSocket Handler
+ *
+ * Provides real-time state synchronization using Socket.IO.
+ *
+ * @packageDocumentation
+ */
+interface Socket {
+    data: {
+        user: {
+            uid: string;
+            roles: string[];
+            orgId?: string;
+        };
+    };
+    handshake: {
+        auth: {
+            token: string;
+            clientId: string;
+        };
+    };
+    join: (room: string) => void;
+    leave: (room: string) => void;
+    on: (event: string, handler: (...args: unknown[]) => void) => void;
+    emit: (event: string, ...args: unknown[]) => void;
+    to: (room: string) => {
+        emit: (event: string, ...args: unknown[]) => void;
+    };
+}
+interface SocketServer {
+    use: (middleware: (socket: Socket, next: (err?: Error) => void) => void) => void;
+    on: (event: string, handler: (socket: Socket) => void) => void;
+}
+/**
+ * Set up state sync WebSocket with Firebase Auth
+ */
+declare function setupStateSyncWebSocket(io: SocketServer): void;
+
+export { setupStateSyncWebSocket };

package/dist/websocket/state-sync.js

@@ -0,0 +1,151 @@
+import { getStateSyncManager, getMultiUserManager } from '@almadar/agent';
+import admin from 'firebase-admin';
+import { z } from 'zod';
+import dotenv from 'dotenv';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+dotenv.config();
+var envSchema = z.object({
+  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+  PORT: z.string().default("3030").transform((val) => parseInt(val, 10)),
+  CORS_ORIGIN: z.string().default("http://localhost:5173").transform((val) => val.includes(",") ? val.split(",").map((s) => s.trim()) : val),
+  // Database (Prisma/SQL) - optional
+  DATABASE_URL: z.string().optional(),
+  // Firebase/Firestore configuration
+  FIREBASE_PROJECT_ID: z.string().optional(),
+  FIREBASE_CLIENT_EMAIL: z.string().optional(),
+  FIREBASE_PRIVATE_KEY: z.string().optional(),
+  FIREBASE_SERVICE_ACCOUNT_PATH: z.string().optional(),
+  FIRESTORE_EMULATOR_HOST: z.string().optional(),
+  FIREBASE_AUTH_EMULATOR_HOST: z.string().optional(),
+  // API configuration
+  API_PREFIX: z.string().default("/api"),
+  // Mock data configuration
+  USE_MOCK_DATA: z.string().default("true").transform((v) => v === "true"),
+  MOCK_SEED: z.string().optional().transform((v) => v ? parseInt(v, 10) : void 0)
+});
+var parsed = envSchema.safeParse(process.env);
+if (!parsed.success) {
+  console.error("\u274C Invalid environment variables:", parsed.error.flatten().fieldErrors);
+  throw new Error("Invalid environment variables");
+}
+var env = parsed.data;
+
+// src/lib/db.ts
+var firebaseApp = null;
+function initializeFirebase() {
+  if (firebaseApp) {
+    return firebaseApp;
+  }
+  if (admin.apps.length > 0) {
+    firebaseApp = admin.apps[0];
+    return firebaseApp;
+  }
+  if (env.FIRESTORE_EMULATOR_HOST) {
+    firebaseApp = admin.initializeApp({
+      projectId: env.FIREBASE_PROJECT_ID || "demo-project"
+    });
+    console.log(`\u{1F527} Firebase Admin initialized for emulator: ${env.FIRESTORE_EMULATOR_HOST}`);
+    return firebaseApp;
+  }
+  const serviceAccountPath = env.FIREBASE_SERVICE_ACCOUNT_PATH;
+  if (serviceAccountPath) {
+    const serviceAccount = __require(serviceAccountPath);
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.cert(serviceAccount),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else if (env.FIREBASE_PROJECT_ID && env.FIREBASE_CLIENT_EMAIL && env.FIREBASE_PRIVATE_KEY) {
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.cert({
+        projectId: env.FIREBASE_PROJECT_ID,
+        clientEmail: env.FIREBASE_CLIENT_EMAIL,
+        privateKey: env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, "\n")
+      }),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else if (env.FIREBASE_PROJECT_ID) {
+    firebaseApp = admin.initializeApp({
+      credential: admin.credential.applicationDefault(),
+      projectId: env.FIREBASE_PROJECT_ID
+    });
+  } else {
+    firebaseApp = admin.initializeApp({
+      projectId: "demo-project"
+    });
+  }
+  return firebaseApp;
+}
+function getFirestore() {
+  const app = initializeFirebase();
+  const db2 = app.firestore();
+  if (env.FIRESTORE_EMULATOR_HOST) {
+    db2.settings({
+      host: env.FIRESTORE_EMULATOR_HOST,
+      ssl: false
+    });
+  }
+  return db2;
+}
+function getAuth() {
+  const app = initializeFirebase();
+  return app.auth();
+}
+getFirestore();
+
+// src/websocket/state-sync.ts
+function setupStateSyncWebSocket(io) {
+  const stateSync = getStateSyncManager();
+  io.use(async (socket, next) => {
+    try {
+      const token = socket.handshake.auth.token;
+      if (!token) {
+        return next(new Error("Authentication required"));
+      }
+      const decodedToken = await getAuth().verifyIdToken(token);
+      const user = await getAuth().getUser(decodedToken.uid);
+      socket.data.user = {
+        uid: decodedToken.uid,
+        roles: user.customClaims?.roles ?? ["user"],
+        orgId: user.customClaims?.orgId
+      };
+      next();
+    } catch (error) {
+      console.error("Socket auth failed:", error);
+      next(new Error("Invalid token"));
+    }
+  });
+  io.on("connection", (socket) => {
+    const userId = socket.data.user.uid;
+    const clientId = socket.handshake.auth.clientId;
+    console.log(`[StateSync] Client ${clientId} connected for user ${userId}`);
+    stateSync.updateConfig({ clientId });
+    socket.join(`user:${userId}`);
+    socket.on("stateChange", (...args) => {
+      const event = args[0];
+      const multiUser = getMultiUserManager();
+      if (!multiUser.isSessionOwner(event.threadId, userId)) {
+        socket.emit("error", { message: "Not session owner" });
+        return;
+      }
+      stateSync.receiveRemoteChange(event);
+      socket.to(`user:${userId}`).emit("remoteChange", event);
+    });
+    stateSync.on("syncRequired", (changes) => {
+      socket.emit("syncBatch", changes);
+    });
+    socket.on("disconnect", () => {
+      console.log(`[StateSync] Client ${clientId} disconnected`);
+      socket.leave(`user:${userId}`);
+    });
+  });
+}
+
+export { setupStateSyncWebSocket };
+//# sourceMappingURL=state-sync.js.map
+//# sourceMappingURL=state-sync.js.map

package/dist/websocket/state-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/env.ts","../../src/lib/db.ts","../../src/websocket/state-sync.ts"],"names":["db"],"mappings":";;;;;;;;;;;AAIA,MAAA,CAAO,MAAA,EAAO;AAEd,IAAM,SAAA,GAAY,EAAE,MAAA,CAAO;AAAA,EACzB,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAM,CAAA,CACH,MAAA,EAAO,CACP,OAAA,CAAQ,MAAM,CAAA,CACd,SAAA,CAAU,CAAC,GAAA,KAAQ,QAAA,CAAS,GAAA,EAAK,EAAE,CAAC,CAAA;AAAA,EACvC,WAAA,EAAa,CAAA,CACV,MAAA,EAAO,CACP,OAAA,CAAQ,uBAAuB,CAAA,CAC/B,SAAA,CAAU,CAAC,GAAA,KAAS,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,GAAI,GAAI,CAAA;AAAA;AAAA,EAGrF,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAGlC,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzC,qBAAA,EAAuB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3C,oBAAA,EAAsB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1C,6BAAA,EAA+B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,uBAAA,EAAyB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7C,2BAAA,EAA6B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAGjD,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA;AAAA;AAAA,EAGrC,aAAA,EAAe,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAC,CAAA,KAAM,CAAA,KAAM,MAAM,CAAA;AAAA,EACvE,SAAA,EAAW,CAAA,CACR,MAAA,EAAO,CACP,UAAS,CACT,SAAA,CAAU,CAAC,CAAA,KAAO,CAAA,GAAI,QAAA,CAAS,CAAA,EAAG,EAAE,IAAI,MAAU;AACvD,CAAC,CAAA;AAED,IAAM,MAAA,GAAS,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE9C,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,EAAA,OAAA,CAAQ,MAAM,uCAAA,EAAoC,MAAA,CAAO,KAAA,CAAM,OAAA,GAAU,WAAW,CAAA;AACpF,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,MAAM,MAAA,CAAO,IAAA;;;AClC1B,IAAI,WAAA,GAAoC,IAAA;AAKxC,SAAS,kBAAA,GAAoC;AAC3C,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AACzB,IAAA,WAAA,GAAc,KAAA,CAAM,KAAK,CAAC,CAAA;AAC1B,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,IAAI,IAAI,uBAAA,EAAyB;AAE/B,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,SAAA,EAAW,IAAI,mBAAA,IAAuB;AAAA,KACvC,CAAA;AACD,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,mDAAA,EAA+C,GAAA,CAAI,uBAAuB,CAAA,CAAE,CAAA;AACxF,IAAA,OAAO,WAAA;AAAA,EACT;AAGA,EAAA,MAAM,qBAAqB,GAAA,CAAI,6BAAA;AAE/B,EAAA,IAAI,kBAAA,EAAoB;AAGtB,IAAA,MAAM,cAAA,GAAiB,UAAQ,kBAAkB,CAAA;AACjD,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK,cAAc,CAAA;AAAA,MAChD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,WAAW,GAAA,CAAI,mBAAA,IAAuB,GAAA,CAAI,qBAAA,IAAyB,IAAI,oBAAA,EAAsB;AAE3F,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,IAAA,CAAK;AAAA,QAChC,WAAW,GAAA,CAAI,mBAAA;AAAA,QACf,aAAa,GAAA,CAAI,qBAAA;AAAA,QACjB,UAAA,EAAY,GAAA,CAAI,oBAAA,CAAqB,OAAA,CAAQ,QAAQ,IAAI;AAAA,OAC1D,CAAA;AAAA,MACD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,CAAA,MAAA,IAAW,IAAI,mBAAA,EAAqB;AAElC,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,UAAA,EAAY,KAAA,CAAM,UAAA,CAAW,kBAAA,EAAmB;AAAA,MAChD,WAAW,GAAA,CAAI;AAAA,KAChB,CAAA;AAAA,EACH,CAAA,MAAO;AAEL,IAAA,WAAA,GAAc,MAAM,aAAA,CAAc;AAAA,MAChC,SAAA,EAAW;AAAA,KACZ,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,WAAA;AACT;AAKO,SAAS,YAAA,GAA0C;AACxD,EAAA,MAAM,MAAM,kBAAA,EAAmB;AAC/B,EAAA,MAAMA,GAAAA,GAAK,IAAI,SAAA,EAAU;AAGzB,EAAA,IAAI,IAAI,uBAAA,EAAyB;AAC/B,IAAAA,IAAG,QAAA,CAAS;AAAA,MACV,MAAM,GAAA,CAAI,uBAAA;AAAA,MACV,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,EACH;AAEA,EAAA,OAAOA,GAAAA;AACT;AAKO,SAAS,OAAA,GAA2B;AACzC,EAAA,MAAM,MAAM,kBAAA,EAAmB;AAC/B,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AA8BkB,YAAA;;;AClGX,SAAS,wBAAwB,EAAA,EAAwB;AAC9D,EAAA,MAAM,YAAY,mBAAA,EAAoB;AAGtC,EAAA,EAAA,CAAG,GAAA,CAAI,OAAO,MAAA,EAAQ,IAAA,KAAS;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,SAAA,CAAU,IAAA,CAAK,KAAA;AACpC,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO,IAAA,CAAK,IAAI,KAAA,CAAM,yBAAyB,CAAC,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAQ,CAAE,cAAc,KAAK,CAAA;AACxD,MAAA,MAAM,OAAO,MAAM,OAAA,EAAQ,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AAErD,MAAA,MAAA,CAAO,KAAK,IAAA,GAAO;AAAA,QACjB,KAAK,YAAA,CAAa,GAAA;AAAA,QAClB,KAAA,EAAQ,IAAA,CAAK,YAAA,EAAc,KAAA,IAAsB,CAAC,MAAM,CAAA;AAAA,QACxD,KAAA,EAAO,KAAK,YAAA,EAAc;AAAA,OAC5B;AAEA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,uBAAuB,KAAK,CAAA;AAC1C,MAAA,IAAA,CAAK,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,IACjC;AAAA,EACF,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,YAAA,EAAc,CAAC,MAAA,KAAmB;AACtC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,GAAA;AAChC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,IAAA,CAAK,QAAA;AAEvC,IAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,mBAAA,EAAsB,QAAQ,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAE,CAAA;AAGzE,IAAA,SAAA,CAAU,YAAA,CAAa,EAAE,QAAA,EAAU,CAAA;AAGnC,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAA;AAG5B,IAAA,MAAA,CAAO,EAAA,CAAG,aAAA,EAAe,CAAA,GAAI,IAAA,KAAoB;AAC/C,MAAA,MAAM,KAAA,GAAQ,KAAK,CAAC,CAAA;AAGpB,MAAA,MAAM,YAAY,mBAAA,EAAoB;AACtC,MAAA,IAAI,CAAC,SAAA,CAAU,cAAA,CAAe,KAAA,CAAM,QAAA,EAAU,MAAM,CAAA,EAAG;AACrD,QAAA,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,EAAE,OAAA,EAAS,qBAAqB,CAAA;AACrD,QAAA;AAAA,MACF;AAGA,MAAA,SAAA,CAAU,oBAAoB,KAA6D,CAAA;AAG3F,MAAA,MAAA,CAAO,GAAG,CAAA,KAAA,EAAQ,MAAM,EAAE,CAAA,CAAE,IAAA,CAAK,gBAAgB,KAAK,CAAA;AAAA,IACxD,CAAC,CAAA;AAGD,IAAA,SAAA,CAAU,EAAA,CAAG,cAAA,EAAgB,CAAC,OAAA,KAAuB;AACnD,MAAA,MAAA,CAAO,IAAA,CAAK,aAAa,OAAO,CAAA;AAAA,IAClC,CAAC,CAAA;AAED,IAAA,MAAA,CAAO,EAAA,CAAG,cAAc,MAAM;AAC5B,MAAA,OAAA,CAAQ,GAAA,CAAI,CAAA,mBAAA,EAAsB,QAAQ,CAAA,aAAA,CAAe,CAAA;AACzD,MAAA,MAAA,CAAO,KAAA,CAAM,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAE,CAAA;AAAA,IAC/B,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"state-sync.js","sourcesContent":["import { z } from 'zod';\nimport dotenv from 'dotenv';\n\n// Load environment variables\ndotenv.config();\n\nconst envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z\n    .string()\n    .default('3030')\n    .transform((val) => parseInt(val, 10)),\n  CORS_ORIGIN: z\n    .string()\n    .default('http://localhost:5173')\n    .transform((val) => (val.includes(',') ? val.split(',').map((s) => s.trim()) : val)),\n  \n  // Database (Prisma/SQL) - optional\n  DATABASE_URL: z.string().optional(),\n  \n  // Firebase/Firestore configuration\n  FIREBASE_PROJECT_ID: z.string().optional(),\n  FIREBASE_CLIENT_EMAIL: z.string().optional(),\n  FIREBASE_PRIVATE_KEY: z.string().optional(),\n  FIREBASE_SERVICE_ACCOUNT_PATH: z.string().optional(),\n  FIRESTORE_EMULATOR_HOST: z.string().optional(),\n  FIREBASE_AUTH_EMULATOR_HOST: z.string().optional(),\n  \n  // API configuration\n  API_PREFIX: z.string().default('/api'),\n\n  // Mock data configuration\n  USE_MOCK_DATA: z.string().default('true').transform((v) => v === 'true'),\n  MOCK_SEED: z\n    .string()\n    .optional()\n    .transform((v) => (v ? parseInt(v, 10) : undefined)),\n});\n\nconst parsed = envSchema.safeParse(process.env);\n\nif (!parsed.success) {\n  console.error('❌ Invalid environment variables:', parsed.error.flatten().fieldErrors);\n  throw new Error('Invalid environment variables');\n}\n\nexport const env = parsed.data;\n","/**\n * Database Configuration\n * \n * Supports both Prisma (SQL) and Firebase Admin (Firestore)\n * Generated apps can use either depending on the database option\n */\n\nimport admin from 'firebase-admin';\nimport { env } from './env.js';\n\n// ============ Firebase Admin / Firestore ============\n\nlet firebaseApp: admin.app.App | null = null;\n\n/**\n * Initialize Firebase Admin SDK\n */\nfunction initializeFirebase(): admin.app.App {\n  if (firebaseApp) {\n    return firebaseApp;\n  }\n\n  // Check if already initialized\n  if (admin.apps.length > 0) {\n    firebaseApp = admin.apps[0]!;\n    return firebaseApp;\n  }\n\n  // Check for emulator mode FIRST (no credentials needed)\n  if (env.FIRESTORE_EMULATOR_HOST) {\n    // Emulator mode - no credentials needed\n    firebaseApp = admin.initializeApp({\n      projectId: env.FIREBASE_PROJECT_ID || 'demo-project',\n    });\n    console.log(`🔧 Firebase Admin initialized for emulator: ${env.FIRESTORE_EMULATOR_HOST}`);\n    return firebaseApp;\n  }\n\n  // Production mode - need credentials\n  const serviceAccountPath = env.FIREBASE_SERVICE_ACCOUNT_PATH;\n  \n  if (serviceAccountPath) {\n    // Use service account file\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const serviceAccount = require(serviceAccountPath);\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.cert(serviceAccount),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else if (env.FIREBASE_PROJECT_ID && env.FIREBASE_CLIENT_EMAIL && env.FIREBASE_PRIVATE_KEY) {\n    // Use inline service account credentials\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.cert({\n        projectId: env.FIREBASE_PROJECT_ID,\n        clientEmail: env.FIREBASE_CLIENT_EMAIL,\n        privateKey: env.FIREBASE_PRIVATE_KEY.replace(/\\\\n/g, '\\n'),\n      }),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else if (env.FIREBASE_PROJECT_ID) {\n    // Use application default credentials (for Cloud Run, etc.)\n    firebaseApp = admin.initializeApp({\n      credential: admin.credential.applicationDefault(),\n      projectId: env.FIREBASE_PROJECT_ID,\n    });\n  } else {\n    // Emulator mode - use default credentials\n    firebaseApp = admin.initializeApp({\n      projectId: 'demo-project',\n    });\n  }\n\n  return firebaseApp;\n}\n\n/**\n * Get Firestore instance\n */\nexport function getFirestore(): admin.firestore.Firestore {\n  const app = initializeFirebase();\n  const db = app.firestore();\n  \n  // Connect to emulator if configured\n  if (env.FIRESTORE_EMULATOR_HOST) {\n    db.settings({\n      host: env.FIRESTORE_EMULATOR_HOST,\n      ssl: false,\n    });\n  }\n  \n  return db;\n}\n\n/**\n * Get Firebase Auth instance\n */\nexport function getAuth(): admin.auth.Auth {\n  const app = initializeFirebase();\n  return app.auth();\n}\n\n// ============ Prisma (Optional - for SQL databases) ============\n\n// Uncomment if using Prisma with SQL database\n/*\nimport { PrismaClient } from '@prisma/client';\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __db: PrismaClient | undefined;\n}\n\nconst createPrismaClient = () => {\n  return new PrismaClient({\n    log: env.NODE_ENV === 'development' ? ['query', 'error', 'warn'] : ['error'],\n  });\n};\n\nexport const db = globalThis.__db ?? createPrismaClient();\n\nif (env.NODE_ENV !== 'production') {\n  globalThis.__db = db;\n}\n*/\n\n// Re-export admin for convenience\nexport { admin };\n\n// Export db instance for handler convenience\nexport const db = getFirestore();\n","/**\n * State Sync WebSocket Handler\n *\n * Provides real-time state synchronization using Socket.IO.\n *\n * @packageDocumentation\n */\n\nimport { getStateSyncManager } from '@almadar/agent';\nimport { getMultiUserManager } from '@almadar/agent';\nimport { getAuth } from '../lib/db.js';\n\n// Type definitions for Socket.IO (to avoid dependency)\ninterface Socket {\n  data: { user: { uid: string; roles: string[]; orgId?: string } };\n  handshake: { auth: { token: string; clientId: string } };\n  join: (room: string) => void;\n  leave: (room: string) => void;\n  on: (event: string, handler: (...args: unknown[]) => void) => void;\n  emit: (event: string, ...args: unknown[]) => void;\n  to: (room: string) => { emit: (event: string, ...args: unknown[]) => void };\n}\n\ninterface SocketServer {\n  use: (middleware: (socket: Socket, next: (err?: Error) => void) => void) => void;\n  on: (event: string, handler: (socket: Socket) => void) => void;\n}\n\n/**\n * Set up state sync WebSocket with Firebase Auth\n */\nexport function setupStateSyncWebSocket(io: SocketServer): void {\n  const stateSync = getStateSyncManager();\n\n  // Firebase Auth middleware for Socket.IO\n  io.use(async (socket, next) => {\n    try {\n      const token = socket.handshake.auth.token as string;\n      if (!token) {\n        return next(new Error('Authentication required'));\n      }\n\n      const decodedToken = await getAuth().verifyIdToken(token);\n      const user = await getAuth().getUser(decodedToken.uid);\n\n      socket.data.user = {\n        uid: decodedToken.uid,\n        roles: (user.customClaims?.roles as string[]) ?? ['user'],\n        orgId: user.customClaims?.orgId as string,\n      };\n\n      next();\n    } catch (error) {\n      console.error('Socket auth failed:', error);\n      next(new Error('Invalid token'));\n    }\n  });\n\n  io.on('connection', (socket: Socket) => {\n    const userId = socket.data.user.uid;\n    const clientId = socket.handshake.auth.clientId;\n\n    console.log(`[StateSync] Client ${clientId} connected for user ${userId}`);\n\n    // Update client ID in sync manager\n    stateSync.updateConfig({ clientId });\n\n    // Join user's room for targeted updates\n    socket.join(`user:${userId}`);\n\n    // Listen for state changes from client\n    socket.on('stateChange', (...args: unknown[]) => {\n      const event = args[0] as { threadId: string };\n      \n      // Verify ownership\n      const multiUser = getMultiUserManager();\n      if (!multiUser.isSessionOwner(event.threadId, userId)) {\n        socket.emit('error', { message: 'Not session owner' });\n        return;\n      }\n\n      // Process through sync manager\n      stateSync.receiveRemoteChange(event as unknown as import('@almadar/agent').StateChangeEvent);\n\n      // Broadcast to other clients of same user\n      socket.to(`user:${userId}`).emit('remoteChange', event);\n    });\n\n    // Handle sync required events from agent\n    stateSync.on('syncRequired', (changes: unknown[]) => {\n      socket.emit('syncBatch', changes);\n    });\n\n    socket.on('disconnect', () => {\n      console.log(`[StateSync] Client ${clientId} disconnected`);\n      socket.leave(`user:${userId}`);\n    });\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/server",
-  "version": "1.0.17",
+  "version": "1.2.1",
   "description": "Shared server infrastructure for Almadar applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,14 +38,23 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "tsup",
+    "build:watch": "tsup --watch",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest --run --passWithNoTests",
+    "prepublishOnly": "pnpm run build"
+  },
   "dependencies": {
+    "@almadar/agent": "^1.2.1",
+    "@almadar/core": "^1.0.17",
     "@faker-js/faker": "^9.3.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.0",
     "helmet": "^8.0.0",
     "ws": "^8.18.0",
-    "zod": "^3.24.0",
-    "@almadar/core": "1.0.17"
+    "zod": "^3.24.0"
   },
   "peerDependencies": {
     "express": "^4.0.0",
@@ -78,12 +87,5 @@
     "server",
     "express",
     "middleware"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "build:watch": "tsup --watch",
-    "lint": "eslint src/",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest --run --passWithNoTests"
-  }
-}
+  ]
+}

package/LICENSE

@@ -1,72 +0,0 @@
-Business Source License 1.1
-
-Parameters
-
-Licensor:             Almadar FZE
-Licensed Work:        KFlow Builder / Almadar
-                      The Licensed Work is (c) 2025-2026 Almadar FZE.
-Additional Use Grant: You may make production use of the Licensed Work for
-                      non-commercial purposes and for internal evaluation.
-                      Production use for commercial purposes requires a
-                      commercial license from the Licensor.
-Change Date:          2030-02-01
-Change License:       Apache License, Version 2.0
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative
-works, redistribute, and make non-production use of the Licensed Work. The
-Licensor may make an Additional Use Grant, above, permitting limited
-production use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly
-available distribution of a specific version of the Licensed Work under this
-License, whichever comes first, the Licensor hereby grants you rights under
-the terms of the Change License, and the rights granted in the paragraph
-above terminate.
-
-If your use of the Licensed Work does not comply with the requirements
-currently in effect as described in this License, you must purchase a
-commercial license from the Licensor, its affiliated entities, or authorized
-resellers, or you must refrain from using the Licensed Work.
-
-All copies of the original and modified Licensed Work, and derivative works
-of the Licensed Work, are subject to this License. This License applies
-separately for each version of the Licensed Work and the Change Date may vary
-for each version of the Licensed Work released by Licensor.
-
-You must conspicuously display this License on each original or modified copy
-of the Licensed Work. If you receive the Licensed Work in original or
-modified form from a third party, the terms and conditions set forth in this
-License apply to your use of that work.
-
-Any use of the Licensed Work in violation of this License will automatically
-terminate your rights under this License for the current and all other
-versions of the Licensed Work.
-
-This License does not grant you any right in any trademark or logo of
-Licensor or its affiliates (provided that you may use a trademark or logo of
-Licensor as expressly required by this License).
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
-AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
-EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
-TITLE.
-
----
-
-License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
-"Business Source License" is a trademark of MariaDB Corporation Ab.
-
-ADDITIONAL TERMS:
-
-Documentation (builder/packages/website/docs/) is licensed under CC BY 4.0.
-
-TRADEMARKS:
-
-"Orbital", "KFlow", "Almadar", and the Almadar logo are trademarks of
-Almadar FZE. You may not use these trademarks without prior written
-permission from Almadar FZE.
-
-For licensing inquiries: licensing@almadar.io