@amodalai/runtime 0.1.0

package/dist/src/cron/heartbeat-scheduler.test.js

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { AutomationScheduler } from './heartbeat-scheduler.js';
+function makeAutomation(name, triggerType = 'cron', schedule = '*/5 * * * *') {
+    return {
+        name,
+        trigger: triggerType === 'cron'
+            ? { type: 'cron', schedule }
+            : { type: 'webhook', source: name },
+        prompt: `Run ${name}`,
+        tools: ['tool1'],
+        skills: ['*'],
+        output: { channel: 'slack', target: 'https://hooks.slack.com/abc' },
+        allow_writes: false,
+    };
+}
+describe('AutomationScheduler', () => {
+    let scheduler;
+    beforeEach(() => {
+        scheduler = new AutomationScheduler();
+        vi.spyOn(process.stderr, 'write').mockReturnValue(true);
+    });
+    afterEach(() => {
+        scheduler.stop();
+    });
+    it('registers cron automations', () => {
+        const mockRunner = vi.fn().mockResolvedValue({});
+        scheduler.start([makeAutomation('a1'), makeAutomation('a2')], mockRunner);
+        expect(scheduler.size).toBe(2);
+    });
+    it('ignores webhook automations', () => {
+        const mockRunner = vi.fn().mockResolvedValue({});
+        scheduler.start([
+            makeAutomation('cron-a'),
+            makeAutomation('webhook-a', 'webhook'),
+        ], mockRunner);
+        expect(scheduler.size).toBe(1);
+    });
+    it('skips invalid cron schedules', () => {
+        const mockRunner = vi.fn().mockResolvedValue({});
+        scheduler.start([makeAutomation('bad-a', 'cron', 'not-a-cron')], mockRunner);
+        expect(scheduler.size).toBe(0);
+    });
+    it('stops all jobs on stop()', () => {
+        const mockRunner = vi.fn().mockResolvedValue({});
+        scheduler.start([makeAutomation('a1')], mockRunner);
+        expect(scheduler.size).toBe(1);
+        scheduler.stop();
+        expect(scheduler.size).toBe(0);
+    });
+    it('handles empty automation list', () => {
+        const mockRunner = vi.fn().mockResolvedValue({});
+        scheduler.start([], mockRunner);
+        expect(scheduler.size).toBe(0);
+    });
+});
+//# sourceMappingURL=heartbeat-scheduler.test.js.map

package/dist/src/cron/heartbeat-scheduler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat-scheduler.test.js","sourceRoot":"","sources":["../../../src/cron/heartbeat-scheduler.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,SAAS,cAAc,CACrB,IAAY,EACZ,cAAkC,MAAM,EACxC,QAAQ,GAAG,aAAa;IAExB,OAAO;QACL,IAAI;QACJ,OAAO,EACL,WAAW,KAAK,MAAM;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QACvC,MAAM,EAAE,OAAO,IAAI,EAAE;QACrB,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,MAAM,EAAE,CAAC,GAAG,CAAC;QACb,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE;QACnE,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,SAA8B,CAAC;IAEnC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,SAAS,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,KAAK,CACb,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,EAC5C,UAAU,CACX,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,KAAK,CACb;YACE,cAAc,CAAC,QAAQ,CAAC;YACxB,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC;SACvC,EACD,UAAU,CACX,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,KAAK,CACb,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,EAC/C,UAAU,CACX,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/B,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export declare const SERVER_VERSION = "0.1.0";
+export { createServer } from './server.js';
+export type { ServerInstance, CreateServerOptions } from './server.js';
+export type { ServerConfig } from './types.js';
+export { createAIStreamRouter, type AIStreamRouterOptions } from './routes/ai-stream.js';
+export { createLocalServer } from './agent/local-server.js';
+export type { LocalServerConfig, AgentChatRequest, AgentSession } from './agent/agent-types.js';
+export { AgentSessionManager } from './agent/session-manager.js';
+export { ProactiveRunner } from './agent/proactive/proactive-runner.js';
+export type { AutomationInfo, ProactiveRunnerConfig } from './agent/proactive/proactive-runner.js';
+export { createSnapshotServer } from './agent/snapshot-server.js';
+export type { SnapshotServerConfig } from './agent/snapshot-server.js';
+export { createChatRouter } from './agent/routes/chat.js';
+export type { ChatRouterOptions, SessionCreator, SessionHydrator, TurnCompleteHandler } from './agent/routes/chat.js';
+export { createTaskRouter } from './agent/routes/task.js';
+export type { TaskRouterOptions } from './agent/routes/task.js';
+export { getAuthContext, createAuthMiddleware } from './middleware/auth.js';
+export type { AuthContext, AuthMiddlewareOptions } from './middleware/auth.js';
+export { errorHandler } from './middleware/error-handler.js';

package/dist/src/index.js

@@ -0,0 +1,118 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { createServer } from './server.js';
+export const SERVER_VERSION = '0.1.0';
+// Re-export for consumers
+export { createServer } from './server.js';
+export { createAIStreamRouter } from './routes/ai-stream.js';
+// Local mode
+export { createLocalServer } from './agent/local-server.js';
+export { AgentSessionManager } from './agent/session-manager.js';
+export { ProactiveRunner } from './agent/proactive/proactive-runner.js';
+// Snapshot mode
+export { createSnapshotServer } from './agent/snapshot-server.js';
+// Route creators (used by hosted-runtime to build its own server)
+export { createChatRouter } from './agent/routes/chat.js';
+export { createTaskRouter } from './agent/routes/task.js';
+// Auth
+export { getAuthContext, createAuthMiddleware } from './middleware/auth.js';
+// Error handler
+export { errorHandler } from './middleware/error-handler.js';
+// ---------------------------------------------------------------------------
+// Environment variable parsing
+// ---------------------------------------------------------------------------
+function getEnvOrDefault(key, defaultValue) {
+    return process.env[key] ?? defaultValue;
+}
+function getEnvInt(key, defaultValue) {
+    const val = process.env[key];
+    if (!val)
+        return defaultValue;
+    const parsed = parseInt(val, 10);
+    return isNaN(parsed) ? defaultValue : parsed;
+}
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+async function main() {
+    // Parse env vars
+    const port = getEnvInt('PORT', 3000);
+    const host = getEnvOrDefault('HOST', '0.0.0.0');
+    const sessionTtlMs = getEnvInt('SESSION_TTL_MS', 30 * 60 * 1000);
+    // Platform API URL — used for auth (validating ak_ keys from requests)
+    // and for loading org-specific config per session.
+    // No API key needed at startup — keys come from request headers.
+    const platformApiUrl = process.env['PLATFORM_API_URL'];
+    // JWKS URL for JWT verification (defaults to platformApiUrl/.well-known/jwks.json)
+    const jwksUrl = process.env['JWT_JWKS_URL'] || undefined;
+    // LLM config comes from env. Default matches the platform API default.
+    const model = getEnvOrDefault('MODEL', 'claude-sonnet-4-20250514');
+    // WORKSPACE_DIR scopes file tools and shell_exec. In Docker, set to
+    // /workspace so the agent cannot read server source code. When unset,
+    // falls back to process.cwd() for local dev.
+    const workspaceDir = process.env['WORKSPACE_DIR'] || process.cwd();
+    // Base config params — minimal, org-agnostic defaults.
+    // Org-specific config (tools, skills, knowledge, base_prompt, agent_context)
+    // loaded per session using the API key from each request.
+    const baseParams = {
+        sessionId: 'server-init',
+        model,
+        cwd: workspaceDir,
+        targetDir: workspaceDir,
+        debugMode: process.env['DEBUG'] === 'true',
+        interactive: false,
+        noBrowser: true,
+    };
+    // Create and start server
+    let serverInstance;
+    try {
+        const corsOrigin = process.env['CORS_ORIGIN'] || undefined;
+        serverInstance = createServer({
+            baseParams,
+            config: {
+                port,
+                host,
+                sessionTtlMs,
+                automations: [],
+                corsOrigin,
+            },
+            version: SERVER_VERSION,
+            platformApiUrl,
+            jwksUrl,
+        });
+        await serverInstance.start();
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[FATAL] Failed to start server: ${message}\n`);
+        process.exit(1);
+    }
+    // Graceful shutdown
+    const shutdown = async (signal) => {
+        process.stderr.write(`[INFO] Received ${signal}, shutting down...\n`);
+        try {
+            await serverInstance.stop();
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[ERROR] Shutdown error: ${message}\n`);
+        }
+        process.exit(0);
+    };
+    process.on('SIGTERM', () => void shutdown('SIGTERM'));
+    process.on('SIGINT', () => void shutdown('SIGINT'));
+}
+// Only run main when this file is the entry point (the runtime package itself)
+const isMainModule = process.argv[1] &&
+    (process.argv[1].includes('@amodalai/runtime') ||
+        process.argv[1].includes('packages/runtime/'));
+if (isMainModule) {
+    main().catch((err) => {
+        process.stderr.write(`[FATAL] ${err}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAuB,MAAM,aAAa,CAAC;AAEhE,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,0BAA0B;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AAEzF,aAAa;AACb,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAGxE,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,kEAAkE;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO;AACP,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5E,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAW,EAAE,YAAoB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,YAAoB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACjB,iBAAiB;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,SAAS,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjE,uEAAuE;IACvE,mDAAmD;IACnD,iEAAiE;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEvD,mFAAmF;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAEzD,uEAAuE;IACvE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAEnE,oEAAoE;IACpE,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnE,uDAAuD;IACvD,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,UAAU,GAA8B;QAC5C,SAAS,EAAE,aAAa;QACxB,KAAK;QACL,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM;QAC1C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,0BAA0B;IAC1B,IAAI,cAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;QAE3D,cAAc,GAAG,YAAY,CAAC;YAC5B,UAAU;YACV,MAAM,EAAE;gBACN,IAAI;gBACJ,IAAI;gBACJ,YAAY;gBACZ,WAAW,EAAE,EAAE;gBACf,UAAU;aACX;YACD,OAAO,EAAE,cAAc;YACvB,cAAc;YACd,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,OAAO,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,sBAAsB,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,YAAY,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAEnD,IAAI,YAAY,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/middleware/auth.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { Request, Response, NextFunction } from 'express';
+/**
+ * Auth context attached to `res.locals.authContext` after successful auth.
+ * Contains the caller's API key and resolved platform context from /api/me.
+ */
+export interface AuthContext {
+    apiKey?: string;
+    /** Raw Bearer token (JWT or ak_ key) for forwarding to platform API */
+    token?: string;
+    orgId: string;
+    applicationId: string;
+    tenantId: string;
+    authMethod: 'api_key' | 'platform_jwt';
+    actor?: string;
+}
+export interface AuthMiddlewareOptions {
+    /** Platform API base URL (e.g., "http://localhost:4000") */
+    platformApiUrl: string;
+    /** TTL in ms for cached key validations (default: 5 minutes) */
+    cacheTtlMs?: number;
+    /** JWKS URL for JWT verification (defaults to platformApiUrl/.well-known/jwks.json) */
+    jwksUrl?: string;
+}
+/**
+ * Get the auth context from response locals.
+ */
+export declare function getAuthContext(res: Response): AuthContext | undefined;
+/**
+ * Express middleware that validates Bearer tokens.
+ *
+ * Supports dual auth:
+ * - `ak_` prefixed keys: validated via `GET /api/me` on the platform API (cached)
+ * - JWTs: validated locally via JWKS (zero network overhead per request)
+ */
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => void;

package/dist/src/middleware/auth.js

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { AppError } from './error-handler.js';
+import { createJWTVerifier } from '../utils/jwt-verify.js';
+const AUTH_CONTEXT_KEY = 'authContext';
+/**
+ * Get the auth context from response locals.
+ */
+export function getAuthContext(res) {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    return res.locals[AUTH_CONTEXT_KEY];
+}
+/**
+ * Express middleware that validates Bearer tokens.
+ *
+ * Supports dual auth:
+ * - `ak_` prefixed keys: validated via `GET /api/me` on the platform API (cached)
+ * - JWTs: validated locally via JWKS (zero network overhead per request)
+ */
+export function createAuthMiddleware(options) {
+    const { platformApiUrl, cacheTtlMs = 5 * 60 * 1000 } = options;
+    const cache = new Map();
+    // Set up JWT verifier if JWKS URL available
+    const jwksUrl = options.jwksUrl ?? `${platformApiUrl}/.well-known/jwks.json`;
+    let verifyJWT = null;
+    try {
+        verifyJWT = createJWTVerifier({ jwksUrl });
+    }
+    catch {
+        // JWKS URL invalid — JWT verification disabled
+    }
+    return (req, res, next) => {
+        const authHeader = req.headers['authorization'];
+        if (!authHeader) {
+            next(new AppError(401, 'UNAUTHORIZED', 'Missing Authorization header'));
+            return;
+        }
+        if (!authHeader.startsWith('Bearer ')) {
+            next(new AppError(401, 'UNAUTHORIZED', 'Authorization header must use Bearer scheme'));
+            return;
+        }
+        const token = authHeader.slice(7);
+        if (token.startsWith('ak_')) {
+            // API key flow — validate via /api/me (cached)
+            const cached = cache.get(token);
+            if (cached && cached.expiresAt > Date.now()) {
+                res.locals[AUTH_CONTEXT_KEY] = {
+                    apiKey: token,
+                    token,
+                    orgId: cached.orgId,
+                    applicationId: cached.applicationId,
+                    tenantId: cached.tenantId,
+                    authMethod: 'api_key',
+                };
+                next();
+                return;
+            }
+            void validateKey(platformApiUrl, token).then((result) => {
+                if (!result) {
+                    next(new AppError(401, 'UNAUTHORIZED', 'Invalid API key'));
+                    return;
+                }
+                cache.set(token, { ...result, expiresAt: Date.now() + cacheTtlMs });
+                res.locals[AUTH_CONTEXT_KEY] = {
+                    apiKey: token,
+                    token,
+                    ...result,
+                    authMethod: 'api_key',
+                };
+                next();
+            }, (err) => {
+                next(new AppError(502, 'AUTH_UPSTREAM_ERROR', `Failed to validate API key: ${err instanceof Error ? err.message : 'Unknown error'}`));
+            });
+        }
+        else if (verifyJWT) {
+            // JWT flow — validate locally via JWKS
+            void verifyJWT(token).then((claims) => {
+                if (!claims) {
+                    next(new AppError(401, 'UNAUTHORIZED', 'Invalid or expired token'));
+                    return;
+                }
+                res.locals[AUTH_CONTEXT_KEY] = {
+                    token,
+                    orgId: claims.org_id,
+                    applicationId: claims.app_id,
+                    tenantId: claims.tenant_id,
+                    authMethod: 'platform_jwt',
+                    ...(claims.actor ? { actor: claims.actor } : {}),
+                };
+                next();
+            }, () => {
+                next(new AppError(401, 'UNAUTHORIZED', 'Token verification failed'));
+            });
+        }
+        else {
+            next(new AppError(401, 'UNAUTHORIZED', 'Invalid API key format'));
+        }
+    };
+}
+/**
+ * Validate an API key by calling the platform API's /api/me endpoint.
+ * Returns org/app/tenant context if valid, null if invalid.
+ */
+async function validateKey(platformApiUrl, apiKey) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 10000);
+    try {
+        const response = await fetch(`${platformApiUrl}/api/me`, {
+            signal: controller.signal,
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                Accept: 'application/json',
+            },
+        });
+        clearTimeout(timer);
+        if (!response.ok) {
+            return null;
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+        const data = (await response.json());
+        // Prefer singular fields, fall back to arrays
+        const orgId = data.org?.id ?? '';
+        const applicationId = data.app?.id ?? data.apps?.[0]?.id ?? '';
+        const tenantId = data.tenant?.id ?? data.tenants?.[0]?.id ?? '';
+        return { orgId, applicationId, tenantId };
+    }
+    catch {
+        clearTimeout(timer);
+        throw new Error('Platform API unreachable');
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA0C3D,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAa;IAC1C,uEAAuE;IACvE,OAAO,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAA4B,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA8B;IAE9B,MAAM,EAAE,cAAc,EAAE,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,4CAA4C;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,cAAc,wBAAwB,CAAC;IAC7E,IAAI,SAAS,GAAkE,IAAI,CAAC;IACpF,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,8BAA8B,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,IAAI,CACF,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,6CAA6C,CAAC,CACjF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,+CAA+C;YAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG;oBAC7B,MAAM,EAAE,KAAK;oBACb,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,SAAS;iBACtB,CAAC;gBACF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAED,KAAK,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,IAAI,CAC1C,CAAC,MAAM,EAAE,EAAE;gBACT,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG;oBAC7B,MAAM,EAAE,KAAK;oBACb,KAAK;oBACL,GAAG,MAAM;oBACT,UAAU,EAAE,SAAS;iBACtB,CAAC;gBACF,IAAI,EAAE,CAAC;YACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;gBACf,IAAI,CACF,IAAI,QAAQ,CACV,GAAG,EACH,qBAAqB,EACrB,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CACF,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,uCAAuC;YACvC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CACxB,CAAC,MAAM,EAAE,EAAE;gBACT,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG;oBAC7B,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,aAAa,EAAE,MAAM,CAAC,MAAM;oBAC5B,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,UAAU,EAAE,cAAc;oBAC1B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjD,CAAC;gBACF,IAAI,EAAE,CAAC;YACT,CAAC,EACD,GAAG,EAAE;gBACH,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,2BAA2B,CAAC,CAAC,CAAC;YACvE,CAAC,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,cAAsB,EACtB,MAAc;IAEd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,SAAS,EAAE;YACvD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uEAAuE;QACvE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;QACnD,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/src/middleware/auth.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};