@aprovan/chat-backend 0.1.0-dev.4d82df8 → 0.1.0-dev.67fbce2

package/dist/lambda.js

@@ -80,18 +80,10 @@ var planMiddleware = async (c, next) => {
 };
 
 // src/middleware/workspace.ts
-import { DynamoDBClient as DynamoDBClient3 } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient as DynamoDBDocumentClient3, QueryCommand } from "@aws-sdk/lib-dynamodb";
-
-// src/session.ts
 import { DynamoDBClient as DynamoDBClient2 } from "@aws-sdk/client-dynamodb";
-import {
-  DynamoDBDocumentClient as DynamoDBDocumentClient2,
-  GetCommand as GetCommand2,
-  PutCommand
-} from "@aws-sdk/lib-dynamodb";
-var SESSION_CACHE_TTL_MS = 15e3;
-var sessionCache = /* @__PURE__ */ new Map();
+import { DynamoDBDocumentClient as DynamoDBDocumentClient2, GetCommand as GetCommand2, QueryCommand } from "@aws-sdk/lib-dynamodb";
+var MEMBERSHIP_CACHE_TTL_MS = 3e5;
+var membershipCache = /* @__PURE__ */ new Map();
 var ddbClient2 = null;
 function getDdb2() {
   if (!ddbClient2) {
@@ -101,61 +93,43 @@ function getDdb2() {
   }
   return ddbClient2;
 }
-function tableName() {
-  return process.env["USER_SESSIONS_TABLE_NAME"];
+function evictWorkspaceCache(userSub) {
+  membershipCache.delete(userSub);
 }
-async function getSessionWorkspaceId(userSub) {
+async function resolveWorkspaceId(userSub) {
   const now = Date.now();
-  const cached = sessionCache.get(userSub);
-  if (cached && now - cached.fetchedAt < SESSION_CACHE_TTL_MS) {
-    return cached.activeWorkspaceId;
+  const cached = membershipCache.get(userSub);
+  if (cached && now - cached.fetchedAt < MEMBERSHIP_CACHE_TTL_MS) {
+    return cached.workspaceId;
   }
-  const result = await getDdb2().send(
+  const usersResult = await getDdb2().send(
     new GetCommand2({
-      TableName: tableName(),
-      Key: { userSub }
+      TableName: process.env["USERS_TABLE_NAME"],
+      Key: { sub: userSub },
+      ProjectionExpression: "activeWorkspaceId"
     })
   );
-  const activeWorkspaceId = result.Item?.activeWorkspaceId ?? null;
-  sessionCache.set(userSub, { activeWorkspaceId, fetchedAt: now });
-  return activeWorkspaceId;
-}
-async function setSessionWorkspaceId(userSub, workspaceId) {
-  await getDdb2().send(
-    new PutCommand({
-      TableName: tableName(),
-      Item: {
-        userSub,
-        activeWorkspaceId: workspaceId,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      }
+  const userItem = usersResult.Item;
+  if (userItem?.activeWorkspaceId) {
+    membershipCache.set(userSub, { workspaceId: userItem.activeWorkspaceId, fetchedAt: now });
+    return userItem.activeWorkspaceId;
+  }
+  const result = await getDdb2().send(
+    new QueryCommand({
+      TableName: process.env["MEMBERSHIPS_TABLE_NAME"],
+      IndexName: "ByUserSub",
+      KeyConditionExpression: "userSub = :sub",
+      ExpressionAttributeValues: { ":sub": userSub },
+      Limit: 1
     })
   );
-  sessionCache.set(userSub, {
-    activeWorkspaceId: workspaceId,
-    fetchedAt: Date.now()
-  });
-}
-
-// src/middleware/workspace.ts
-var MEMBERSHIP_CACHE_TTL_MS = 3e5;
-var membershipCache = /* @__PURE__ */ new Map();
-var ddbClient3 = null;
-function getDdb3() {
-  if (!ddbClient3) {
-    ddbClient3 = DynamoDBDocumentClient3.from(
-      new DynamoDBClient3({ region: process.env["AWS_REGION"] })
-    );
-  }
-  return ddbClient3;
+  const item = result.Items?.[0];
+  if (!item) return null;
+  membershipCache.set(userSub, { workspaceId: item.workspaceId, fetchedAt: now });
+  return item.workspaceId;
 }
 async function listWorkspaceMemberships(userSub) {
-  const now = Date.now();
-  const cached = membershipCache.get(userSub);
-  if (cached && now - cached.fetchedAt < MEMBERSHIP_CACHE_TTL_MS) {
-    return cached.workspaceIds;
-  }
-  const result = await getDdb3().send(
+  const result = await getDdb2().send(
     new QueryCommand({
       TableName: process.env["MEMBERSHIPS_TABLE_NAME"],
       IndexName: "ByUserSub",
@@ -163,22 +137,7 @@ async function listWorkspaceMemberships(userSub) {
       ExpressionAttributeValues: { ":sub": userSub }
     })
   );
-  const workspaceIds = (result.Items ?? []).map(
-    (item) => item.workspaceId
-  );
-  membershipCache.set(userSub, { workspaceIds, fetchedAt: now });
-  return workspaceIds;
-}
-async function resolveWorkspaceId(userSub) {
-  const [sessionWsId, workspaceIds] = await Promise.all([
-    getSessionWorkspaceId(userSub),
-    listWorkspaceMemberships(userSub)
-  ]);
-  if (workspaceIds.length === 0) return null;
-  if (sessionWsId && workspaceIds.includes(sessionWsId)) {
-    return sessionWsId;
-  }
-  return workspaceIds[0] ?? null;
+  return (result.Items ?? []).map((item) => item.workspaceId);
 }
 var workspaceMiddleware = async (c, next) => {
   const claims = c.get("claims");
@@ -553,7 +512,7 @@ var CHAT_PROMPT_ALLOWLIST = /* @__PURE__ */ new Set(["chat-patchwork-widget", "c
 var EDIT_PROMPT_ID = "edit-patchwork-widget";
 
 // src/gateway-session.ts
-var sessionCache2 = /* @__PURE__ */ new Map();
+var sessionCache = /* @__PURE__ */ new Map();
 var toolsCache = /* @__PURE__ */ new Map();
 function getCachedTools(sub) {
   return toolsCache.get(sub);
@@ -569,12 +528,12 @@ function gatewayUrl() {
 async function getGatewaySession(claims, workspaceId, cognitoToken) {
   const sub = claims.sub;
   const now = Math.floor(Date.now() / 1e3);
-  const cached = sessionCache2.get(sub);
+  const cached = sessionCache.get(sub);
   if (cached && cached.expires_at > now + 60) {
     return cached;
   }
   const entry = await exchangeSession(cognitoToken, workspaceId, claims.exp);
-  sessionCache2.set(sub, entry);
+  sessionCache.set(sub, entry);
   return entry;
 }
 async function exchangeSession(cognitoToken, workspaceId, exp) {
@@ -616,7 +575,7 @@ async function callAuthSessions(cognitoToken, workspaceId) {
   });
 }
 function evictGatewaySession(sub) {
-  sessionCache2.delete(sub);
+  sessionCache.delete(sub);
   toolsCache.delete(sub);
 }
 var GatewaySessionError = class extends Error {
@@ -948,95 +907,286 @@ import { Hono as Hono3 } from "hono";
 var health = new Hono3();
 health.get("/health", (c) => c.json({ status: "ok" }));
 
-// src/routes/proxy.ts
+// src/routes/vfs.ts
+import { ConditionalCheckFailedException, DynamoDBClient as DynamoDBClient3 } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient as DynamoDBDocumentClient3,
+  DeleteCommand,
+  GetCommand as GetCommand3,
+  QueryCommand as QueryCommand2,
+  UpdateCommand
+} from "@aws-sdk/lib-dynamodb";
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client
+} from "@aws-sdk/client-s3";
 import { Hono as Hono4 } from "hono";
-var proxy = new Hono4();
-proxy.post("/:ns/:proc{.*}", async (c) => {
-  const claims = c.get("claims");
+var ddbClient3 = null;
+var s3Client = null;
+function getDdb3() {
+  if (!ddbClient3) {
+    ddbClient3 = DynamoDBDocumentClient3.from(
+      new DynamoDBClient3({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient3;
+}
+function getS3() {
+  if (!s3Client) {
+    s3Client = new S3Client({ region: process.env["AWS_REGION"] });
+  }
+  return s3Client;
+}
+function vfsTableName() {
+  return process.env["VFS_TABLE_NAME"];
+}
+function vfsBucketName() {
+  return process.env["VFS_BUCKET_NAME"];
+}
+function pk(wsId) {
+  return `workspace#${wsId}`;
+}
+function sk(filePath) {
+  return `file#${filePath}`;
+}
+function s3Key(wsId, filePath) {
+  return `${wsId}/${filePath}`;
+}
+var vfsRoute = new Hono4();
+vfsRoute.get("/config", (c) => {
+  return c.json({ usePaths: true });
+});
+vfsRoute.get("/", async (c) => {
+  const since = c.req.query("since");
+  if (!since) {
+    return c.json({ error: "since query parameter is required" }, 400);
+  }
+  const sinceDate = new Date(since);
+  if (isNaN(sinceDate.getTime())) {
+    return c.json({ error: "since must be a valid RFC3339 timestamp" }, 400);
+  }
+  const tableName2 = vfsTableName();
+  if (!tableName2) {
+    return c.json([]);
+  }
   const workspaceId = c.get("workspaceId");
-  const ns = c.req.param("ns");
-  const proc = c.req.param("proc");
-  const authHeader = c.req.header("Authorization");
-  const cognitoToken = authHeader.slice("Bearer ".length);
-  let sessionToken;
-  try {
-    const session = await getGatewaySession(claims, workspaceId, cognitoToken);
-    sessionToken = session.token;
-  } catch (err) {
-    if (err instanceof GatewaySessionError && err.status === 401) {
-      return c.json({ error: "Gateway session setup failed" }, 401);
+  const result = await getDdb3().send(
+    new QueryCommand2({
+      TableName: tableName2,
+      KeyConditionExpression: "PK = :pk",
+      FilterExpression: "#mtime > :since",
+      ExpressionAttributeNames: { "#mtime": "mtime" },
+      ExpressionAttributeValues: {
+        ":pk": pk(workspaceId),
+        ":since": sinceDate.toISOString()
+      }
+    })
+  );
+  const items = result.Items ?? [];
+  const changes = items.map((item) => ({
+    path: item.SK.replace(/^file#/, ""),
+    mtime: item.mtime,
+    version: item.version ?? 0,
+    size: item.size ?? 0
+  }));
+  return c.json(changes);
+});
+vfsRoute.on(["GET", "HEAD"], "/:path{.+}", async (c) => {
+  const isHead = c.req.method === "HEAD";
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (isHead) {
+    if (!tableName2) return c.body(null, 404);
+    const result = await getDdb3().send(
+      new GetCommand3({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "SK"
+      })
+    );
+    return result.Item ? c.body(null, 200) : c.body(null, 404);
+  }
+  if (!tableName2) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+  if (c.req.query("stat") === "true") {
+    const result = await getDdb3().send(
+      new GetCommand3({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "#sz, #mt, version",
+        ExpressionAttributeNames: { "#sz": "size", "#mt": "mtime" }
+      })
+    );
+    if (!result.Item) return c.json({ error: "ENOENT" }, 404);
+    const item = result.Item;
+    return c.json({
+      size: item.size,
+      mtime: item.mtime,
+      isFile: true,
+      isDirectory: false
+    });
+  }
+  if (c.req.query("readdir") === "true") {
+    const prefix = filePath ? `file#${filePath}/` : "file#";
+    const result = await getDdb3().send(
+      new QueryCommand2({
+        TableName: tableName2,
+        KeyConditionExpression: "PK = :pk AND begins_with(SK, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": pk(workspaceId),
+          ":prefix": prefix
+        },
+        ProjectionExpression: "SK"
+      })
+    );
+    const items = result.Items ?? [];
+    const seen = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const relativePath = item.SK.slice(prefix.length);
+      const slashIdx = relativePath.indexOf("/");
+      if (slashIdx === -1) {
+        seen.set(relativePath, false);
+      } else {
+        const dirName = relativePath.slice(0, slashIdx);
+        if (!seen.has(dirName)) {
+          seen.set(dirName, true);
+        }
+      }
     }
-    return c.json({ error: "Failed to connect to gateway" }, 502);
+    const entries = Array.from(seen.entries()).map(([name, isDirectory]) => ({
+      name,
+      isDirectory
+    }));
+    return c.json(entries);
   }
-  let body = {};
-  try {
-    body = await c.req.json();
-  } catch {
+  if (!bucketName) {
+    return c.json({ error: "VFS storage not configured" }, 503);
   }
-  const gatewayUrl2 = process.env["GATEWAY_URL"].replace(/\/$/, "");
-  const res = await fetch(`${gatewayUrl2}/tools/${ns}/${proc}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${sessionToken}`
-    },
-    body: JSON.stringify(body)
-  });
-  if (res.status === 401) {
-    evictGatewaySession(claims.sub);
-    return c.json({ error: "Gateway authentication failed" }, 502);
+  const fileKey = s3Key(workspaceId, filePath);
+  try {
+    const obj = await getS3().send(
+      new GetObjectCommand({ Bucket: bucketName, Key: fileKey })
+    );
+    const body = await obj.Body?.transformToString("utf-8");
+    if (body === void 0) return c.json({ error: "ENOENT" }, 404);
+    return c.text(body, 200);
+  } catch (err) {
+    const code = err.name;
+    if (code === "NoSuchKey" || code === "NotFound") {
+      return c.json({ error: "ENOENT" }, 404);
+    }
+    throw err;
   }
-  const responseData = await res.json();
-  return c.json(responseData, res.status);
 });
-
-// src/routes/services.ts
-import { Hono as Hono5 } from "hono";
-var services = new Hono5();
-services.get("/", async (c) => {
-  const claims = c.get("claims");
+vfsRoute.put("/:path{.+}", async (c) => {
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName2 || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+  const filePath = c.req.param("path");
   const workspaceId = c.get("workspaceId");
-  const authHeader = c.req.header("Authorization");
-  const cognitoToken = authHeader.slice("Bearer ".length);
-  let sessionToken;
+  const content = await c.req.text();
+  const expectedVersionHeader = c.req.header("X-Vfs-Expected-Version");
+  const expectedVersion = expectedVersionHeader !== void 0 ? parseInt(expectedVersionHeader, 10) : void 0;
+  const fileKey = s3Key(workspaceId, filePath);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const byteSize = new TextEncoder().encode(content).length;
+  await getS3().send(
+    new PutObjectCommand({
+      Bucket: bucketName,
+      Key: fileKey,
+      Body: content,
+      ContentType: "text/plain; charset=utf-8"
+    })
+  );
   try {
-    const session = await getGatewaySession(claims, workspaceId, cognitoToken);
-    sessionToken = session.token;
+    const condExpr = expectedVersion !== void 0 ? "attribute_not_exists(PK) OR version = :expected" : void 0;
+    const exprAttrValues = {
+      ":mtime": now,
+      ":sz": byteSize,
+      ":s3Key": fileKey,
+      ":inc": 1,
+      ":zero": 0
+    };
+    if (expectedVersion !== void 0) {
+      exprAttrValues[":expected"] = expectedVersion;
+    }
+    const result = await getDdb3().send(
+      new UpdateCommand({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        UpdateExpression: "SET #mt = :mtime, #sz = :sz, s3Key = :s3Key, version = if_not_exists(version, :zero) + :inc",
+        ExpressionAttributeNames: { "#mt": "mtime", "#sz": "size" },
+        ExpressionAttributeValues: exprAttrValues,
+        ...condExpr ? { ConditionExpression: condExpr } : {},
+        ReturnValues: "ALL_NEW"
+      })
+    );
+    const newVersion = result.Attributes?.version ?? 1;
+    return c.json({ ok: true, version: newVersion });
   } catch (err) {
-    if (err instanceof GatewaySessionError && err.status === 401) {
-      return c.json({ error: "Gateway session setup failed" }, 401);
+    if (err instanceof ConditionalCheckFailedException) {
+      const metaResult = await getDdb3().send(
+        new GetCommand3({
+          TableName: tableName2,
+          Key: { PK: pk(workspaceId), SK: sk(filePath) },
+          ProjectionExpression: "version, etag"
+        })
+      );
+      const item = metaResult.Item;
+      return c.json(
+        {
+          ok: false,
+          conflict: {
+            serverVersion: item?.version ?? 0,
+            serverEtag: item?.etag
+          }
+        },
+        409
+      );
     }
-    return c.json({ error: "Failed to connect to gateway" }, 502);
+    throw err;
   }
-  const gatewayUrl2 = process.env["GATEWAY_URL"].replace(/\/$/, "");
-  const res = await fetch(`${gatewayUrl2}/tools`, {
-    headers: { Authorization: `Bearer ${sessionToken}` }
-  });
-  if (res.status === 401) {
-    evictGatewaySession(claims.sub);
-    return c.json({ error: "Gateway authentication failed" }, 502);
+});
+vfsRoute.delete("/:path{.+}", async (c) => {
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName2 || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
   }
-  if (!res.ok) {
-    return c.json({ error: "Gateway tools fetch failed" }, 502);
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const fileKey = s3Key(workspaceId, filePath);
+  await Promise.all([
+    getDdb3().send(
+      new DeleteCommand({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) }
+      })
+    ),
+    getS3().send(
+      new DeleteObjectCommand({ Bucket: bucketName, Key: fileKey })
+    )
+  ]);
+  return c.body(null, 204);
+});
+vfsRoute.post("/:path{.+}", (c) => {
+  if (c.req.query("mkdir") === "true") {
+    return c.body(null, 204);
   }
-  const data = await res.json();
-  const serviceList = data.tools.map((t) => ({
-    namespace: t.provider,
-    name: t.name,
-    procedure: t.operation,
-    description: t.description ?? "",
-    parameters: t.inputSchema
-  }));
-  const namespaces = Array.from(new Set(data.tools.map((t) => t.provider)));
-  return c.json({ namespaces, services: serviceList });
+  return c.json({ error: "unsupported operation" }, 400);
 });
 
-// src/routes/workspaces.ts
+// src/routes/workspace.ts
 import { DynamoDBClient as DynamoDBClient4 } from "@aws-sdk/client-dynamodb";
-import { BatchGetCommand, DynamoDBDocumentClient as DynamoDBDocumentClient4 } from "@aws-sdk/lib-dynamodb";
-import { zValidator } from "@hono/zod-validator";
-import { Hono as Hono6 } from "hono";
-import { z as z3 } from "zod";
+import { DynamoDBDocumentClient as DynamoDBDocumentClient4, UpdateCommand as UpdateCommand2 } from "@aws-sdk/lib-dynamodb";
+import { Hono as Hono5 } from "hono";
 var ddbClient4 = null;
 function getDdb4() {
   if (!ddbClient4) {
@@ -1046,10 +1196,101 @@ function getDdb4() {
   }
   return ddbClient4;
 }
+var workspaceRoute = new Hono5();
+workspaceRoute.post("/", async (c) => {
+  const claims = c.get("claims");
+  const body = await c.req.json();
+  const workspaceId = body?.workspaceId;
+  if (!workspaceId || typeof workspaceId !== "string") {
+    return c.json({ error: "workspaceId is required" }, 400);
+  }
+  await getDdb4().send(
+    new UpdateCommand2({
+      TableName: process.env["USERS_TABLE_NAME"],
+      Key: { sub: claims.sub },
+      UpdateExpression: "SET activeWorkspaceId = :ws",
+      ExpressionAttributeValues: { ":ws": workspaceId }
+    })
+  );
+  evictWorkspaceCache(claims.sub);
+  return c.json({ activeWorkspaceId: workspaceId });
+});
+
+// src/routes/workspaces.ts
+import { DynamoDBClient as DynamoDBClient6 } from "@aws-sdk/client-dynamodb";
+import { BatchGetCommand, DynamoDBDocumentClient as DynamoDBDocumentClient6 } from "@aws-sdk/lib-dynamodb";
+import { zValidator } from "@hono/zod-validator";
+import { Hono as Hono6 } from "hono";
+import { z as z3 } from "zod";
+
+// src/session.ts
+import { DynamoDBClient as DynamoDBClient5 } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient as DynamoDBDocumentClient5,
+  GetCommand as GetCommand4,
+  PutCommand
+} from "@aws-sdk/lib-dynamodb";
+var SESSION_CACHE_TTL_MS = 15e3;
+var sessionCache2 = /* @__PURE__ */ new Map();
+var ddbClient5 = null;
+function getDdb5() {
+  if (!ddbClient5) {
+    ddbClient5 = DynamoDBDocumentClient5.from(
+      new DynamoDBClient5({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient5;
+}
+function tableName() {
+  return process.env["USER_SESSIONS_TABLE_NAME"];
+}
+async function getSessionWorkspaceId(userSub) {
+  const now = Date.now();
+  const cached = sessionCache2.get(userSub);
+  if (cached && now - cached.fetchedAt < SESSION_CACHE_TTL_MS) {
+    return cached.activeWorkspaceId;
+  }
+  const result = await getDdb5().send(
+    new GetCommand4({
+      TableName: tableName(),
+      Key: { userSub }
+    })
+  );
+  const activeWorkspaceId = result.Item?.activeWorkspaceId ?? null;
+  sessionCache2.set(userSub, { activeWorkspaceId, fetchedAt: now });
+  return activeWorkspaceId;
+}
+async function setSessionWorkspaceId(userSub, workspaceId) {
+  await getDdb5().send(
+    new PutCommand({
+      TableName: tableName(),
+      Item: {
+        userSub,
+        activeWorkspaceId: workspaceId,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    })
+  );
+  sessionCache2.set(userSub, {
+    activeWorkspaceId: workspaceId,
+    fetchedAt: Date.now()
+  });
+}
+
+// src/routes/workspaces.ts
+var ddbClient6 = null;
+function getDdb6() {
+  if (!ddbClient6) {
+    ddbClient6 = DynamoDBDocumentClient6.from(
+      new DynamoDBClient6({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient6;
+}
 async function batchGetWorkspaces(workspaceIds) {
   if (workspaceIds.length === 0) return [];
   const tableName2 = process.env["WORKSPACE_TABLE_NAME"];
-  const result = await getDdb4().send(
+  const result = await getDdb6().send(
     new BatchGetCommand({
       RequestItems: {
         [tableName2]: { Keys: workspaceIds.map((id) => ({ workspaceId: id })) }
@@ -1102,13 +1343,20 @@ workspacesRoute.put(
 function createChatApp() {
   const app2 = new Hono7();
   app2.route("/", health);
-  const api = app2.basePath("/api");
-  api.use(authMiddleware, workspaceMiddleware, planMiddleware);
+  const authOnly = new Hono7();
+  authOnly.use("/*", authMiddleware);
+  authOnly.route("/workspace", workspaceRoute);
+  app2.route("/api", authOnly);
+  const vfs = new Hono7();
+  vfs.use("/*", authMiddleware, workspaceMiddleware);
+  vfs.route("/", vfsRoute);
+  app2.route("/vfs", vfs);
+  const api = new Hono7();
+  api.use("/*", authMiddleware, workspaceMiddleware, planMiddleware);
   api.route("/chat", chatRoute);
   api.route("/edit", editRoute);
-  api.route("/services", services);
-  api.route("/proxy", proxy);
   api.route("/workspaces", workspacesRoute);
+  app2.route("/api", api);
   return app2;
 }
 
@@ -1122,9 +1370,12 @@ var envSchema = z4.object({
   AWS_REGION: z4.string().default("us-east-1"),
   WORKSPACE_TABLE_NAME: z4.string().min(1),
   MEMBERSHIPS_TABLE_NAME: z4.string().min(1),
-  USER_SESSIONS_TABLE_NAME: z4.string().min(1),
+  USERS_TABLE_NAME: z4.string().min(1),
   OPENROUTER_SECRET_ARN: z4.string().min(1),
   GATEWAY_URL: z4.string().url(),
+  // VFS backing store (optional — routes degrade gracefully when unset)
+  VFS_TABLE_NAME: z4.string().optional(),
+  VFS_BUCKET_NAME: z4.string().optional(),
   // PostHog prompt management (optional — falls back to code prompts when absent)
   POSTHOG_PROJECT_API_KEY: z4.string().optional(),
   POSTHOG_PERSONAL_API_KEY: z4.string().optional(),