@aprovan/chat-backend 0.1.0-dev.99f9769 → 0.1.0-dev.9c336a0

package/dist/index.js

@@ -2,7 +2,7 @@
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono9 } from "hono";
 
 // src/middleware/auth.ts
 import { CognitoJwtVerifier } from "aws-jwt-verify";
@@ -32,11 +32,11 @@ var authMiddleware = async (c, next) => {
   }
 };
 
-// src/middleware/workspace.ts
+// src/middleware/plan.ts
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient, QueryCommand } from "@aws-sdk/lib-dynamodb";
-var MEMBERSHIP_CACHE_TTL_MS = 3e5;
-var membershipCache = /* @__PURE__ */ new Map();
+import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";
+var WORKSPACE_CACHE_TTL_MS = 6e4;
+var workspaceCache = /* @__PURE__ */ new Map();
 var ddbClient = null;
 function getDdb() {
   if (!ddbClient) {
@@ -46,57 +46,13 @@ function getDdb() {
   }
   return ddbClient;
 }
-async function resolveWorkspaceId(userSub) {
-  const now = Date.now();
-  const cached = membershipCache.get(userSub);
-  if (cached && now - cached.fetchedAt < MEMBERSHIP_CACHE_TTL_MS) {
-    return cached.workspaceId;
-  }
-  const result = await getDdb().send(
-    new QueryCommand({
-      TableName: process.env["MEMBERSHIPS_TABLE_NAME"],
-      IndexName: "ByUserSub",
-      KeyConditionExpression: "userSub = :sub",
-      ExpressionAttributeValues: { ":sub": userSub },
-      Limit: 1
-    })
-  );
-  const item = result.Items?.[0];
-  if (!item) return null;
-  membershipCache.set(userSub, { workspaceId: item.workspaceId, fetchedAt: now });
-  return item.workspaceId;
-}
-var workspaceMiddleware = async (c, next) => {
-  const claims = c.get("claims");
-  const workspaceId = await resolveWorkspaceId(claims.sub);
-  if (!workspaceId) {
-    return c.json({ error: "No workspace membership" }, 403);
-  }
-  c.set("workspaceId", workspaceId);
-  return next();
-};
-
-// src/middleware/plan.ts
-import { DynamoDBClient as DynamoDBClient2 } from "@aws-sdk/client-dynamodb";
-import { DynamoDBDocumentClient as DynamoDBDocumentClient2, GetCommand } from "@aws-sdk/lib-dynamodb";
-var WORKSPACE_CACHE_TTL_MS = 6e4;
-var workspaceCache = /* @__PURE__ */ new Map();
-var ddbClient2 = null;
-function getDdb2() {
-  if (!ddbClient2) {
-    ddbClient2 = DynamoDBDocumentClient2.from(
-      new DynamoDBClient2({ region: process.env["AWS_REGION"] })
-    );
-  }
-  return ddbClient2;
-}
 async function getWorkspace(workspaceId) {
   const now = Date.now();
   const cached = workspaceCache.get(workspaceId);
   if (cached && now - cached.fetchedAt < WORKSPACE_CACHE_TTL_MS) {
     return cached.workspace;
   }
-  const result = await getDdb2().send(
+  const result = await getDdb().send(
     new GetCommand({
       TableName: process.env["WORKSPACE_TABLE_NAME"],
       Key: { workspaceId }
@@ -123,10 +79,75 @@ var planMiddleware = async (c, next) => {
   return next();
 };
 
-// src/routes/health.ts
-import { Hono } from "hono";
-var health = new Hono();
-health.get("/health", (c) => c.json({ status: "ok" }));
+// src/middleware/workspace.ts
+import { DynamoDBClient as DynamoDBClient2 } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient as DynamoDBDocumentClient2, GetCommand as GetCommand2, QueryCommand } from "@aws-sdk/lib-dynamodb";
+var MEMBERSHIP_CACHE_TTL_MS = 3e5;
+var membershipCache = /* @__PURE__ */ new Map();
+var ddbClient2 = null;
+function getDdb2() {
+  if (!ddbClient2) {
+    ddbClient2 = DynamoDBDocumentClient2.from(
+      new DynamoDBClient2({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient2;
+}
+function evictWorkspaceCache(userSub) {
+  membershipCache.delete(userSub);
+}
+async function resolveWorkspaceId(userSub) {
+  const now = Date.now();
+  const cached = membershipCache.get(userSub);
+  if (cached && now - cached.fetchedAt < MEMBERSHIP_CACHE_TTL_MS) {
+    return cached.workspaceId;
+  }
+  const usersResult = await getDdb2().send(
+    new GetCommand2({
+      TableName: process.env["USERS_TABLE_NAME"],
+      Key: { sub: userSub },
+      ProjectionExpression: "activeWorkspaceId"
+    })
+  );
+  const userItem = usersResult.Item;
+  if (userItem?.activeWorkspaceId) {
+    membershipCache.set(userSub, { workspaceId: userItem.activeWorkspaceId, fetchedAt: now });
+    return userItem.activeWorkspaceId;
+  }
+  const result = await getDdb2().send(
+    new QueryCommand({
+      TableName: process.env["MEMBERSHIPS_TABLE_NAME"],
+      IndexName: "ByUserSub",
+      KeyConditionExpression: "userSub = :sub",
+      ExpressionAttributeValues: { ":sub": userSub },
+      Limit: 1
+    })
+  );
+  const item = result.Items?.[0];
+  if (!item) return null;
+  membershipCache.set(userSub, { workspaceId: item.workspaceId, fetchedAt: now });
+  return item.workspaceId;
+}
+async function listWorkspaceMemberships(userSub) {
+  const result = await getDdb2().send(
+    new QueryCommand({
+      TableName: process.env["MEMBERSHIPS_TABLE_NAME"],
+      IndexName: "ByUserSub",
+      KeyConditionExpression: "userSub = :sub",
+      ExpressionAttributeValues: { ":sub": userSub }
+    })
+  );
+  return (result.Items ?? []).map((item) => item.workspaceId);
+}
+var workspaceMiddleware = async (c, next) => {
+  const claims = c.get("claims");
+  const workspaceId = await resolveWorkspaceId(claims.sub);
+  if (!workspaceId) {
+    return c.json({ error: "No workspace membership" }, 403);
+  }
+  c.set("workspaceId", workspaceId);
+  return next();
+};
 
 // src/routes/chat.ts
 import { withTracing } from "@posthog/ai";
@@ -137,7 +158,7 @@ import {
   stepCountIs,
   jsonSchema
 } from "ai";
-import { Hono as Hono2 } from "hono";
+import { Hono } from "hono";
 import { z } from "zod";
 
 // src/fallback-prompts.ts
@@ -716,7 +737,7 @@ var retryAtStartMiddleware = {
     }
   }
 };
-var chatRoute = new Hono2();
+var chatRoute = new Hono();
 async function fetchGatewayTools(gatewayUrl2, bearerToken) {
   const res = await fetch(`${gatewayUrl2}/tools`, {
     headers: { Authorization: `Bearer ${bearerToken}` }
@@ -844,14 +865,14 @@ chatRoute.post("/", async (c) => {
 // src/routes/edit.ts
 import { withTracing as withTracing2 } from "@posthog/ai";
 import { streamText as streamText2 } from "ai";
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono2 } from "hono";
 import { z as z2 } from "zod";
 var editBodySchema = z2.object({
   code: z2.string(),
   prompt: z2.string()
 });
 var MODEL_ID = "openrouter/auto";
-var editRoute = new Hono3();
+var editRoute = new Hono2();
 editRoute.post("/", async (c) => {
   const body = await c.req.json().catch(() => null);
   const parsed = editBodySchema.safeParse(body);
@@ -881,12 +902,19 @@ editRoute.post("/", async (c) => {
   return result.toTextStreamResponse();
 });
 
-// src/routes/services.ts
+// src/routes/health.ts
+import { Hono as Hono3 } from "hono";
+var health = new Hono3();
+health.get("/health", (c) => c.json({ status: "ok" }));
+
+// src/routes/proxy.ts
 import { Hono as Hono4 } from "hono";
-var services = new Hono4();
-services.get("/", async (c) => {
+var proxy = new Hono4();
+proxy.post("/:ns/:proc{.*}", async (c) => {
   const claims = c.get("claims");
   const workspaceId = c.get("workspaceId");
+  const ns = c.req.param("ns");
+  const proc = c.req.param("proc");
   const authHeader = c.req.header("Authorization");
   const cognitoToken = authHeader.slice("Bearer ".length);
   let sessionToken;
@@ -899,37 +927,343 @@ services.get("/", async (c) => {
     }
     return c.json({ error: "Failed to connect to gateway" }, 502);
   }
+  let body = {};
+  try {
+    body = await c.req.json();
+  } catch {
+  }
   const gatewayUrl2 = process.env["GATEWAY_URL"].replace(/\/$/, "");
-  const res = await fetch(`${gatewayUrl2}/tools`, {
-    headers: { Authorization: `Bearer ${sessionToken}` }
+  const res = await fetch(`${gatewayUrl2}/tools/${ns}/${proc}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${sessionToken}`
+    },
+    body: JSON.stringify(body)
   });
   if (res.status === 401) {
     evictGatewaySession(claims.sub);
     return c.json({ error: "Gateway authentication failed" }, 502);
   }
-  if (!res.ok) {
-    return c.json({ error: "Gateway tools fetch failed" }, 502);
+  const responseData = await res.json();
+  return c.json(responseData, res.status);
+});
+
+// src/routes/vfs.ts
+import { ConditionalCheckFailedException, DynamoDBClient as DynamoDBClient3 } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient as DynamoDBDocumentClient3,
+  DeleteCommand,
+  GetCommand as GetCommand3,
+  QueryCommand as QueryCommand2,
+  UpdateCommand
+} from "@aws-sdk/lib-dynamodb";
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client
+} from "@aws-sdk/client-s3";
+import { Hono as Hono5 } from "hono";
+var ddbClient3 = null;
+var s3Client = null;
+function getDdb3() {
+  if (!ddbClient3) {
+    ddbClient3 = DynamoDBDocumentClient3.from(
+      new DynamoDBClient3({ region: process.env["AWS_REGION"] })
+    );
   }
-  const data = await res.json();
-  const serviceList = data.tools.map((t) => ({
-    namespace: t.provider,
-    name: t.name,
-    procedure: t.operation,
-    description: t.description ?? "",
-    parameters: t.inputSchema
+  return ddbClient3;
+}
+function getS3() {
+  if (!s3Client) {
+    s3Client = new S3Client({ region: process.env["AWS_REGION"] });
+  }
+  return s3Client;
+}
+function vfsTableName() {
+  return process.env["VFS_TABLE_NAME"];
+}
+function vfsBucketName() {
+  return process.env["VFS_BUCKET_NAME"];
+}
+function pk(wsId) {
+  return `workspace#${wsId}`;
+}
+function sk(filePath) {
+  return `file#${filePath}`;
+}
+function s3Key(wsId, filePath) {
+  return `${wsId}/${filePath}`;
+}
+var vfsRoute = new Hono5();
+vfsRoute.get("/config", (c) => {
+  return c.json({ usePaths: true });
+});
+vfsRoute.get("/", async (c) => {
+  const since = c.req.query("since");
+  if (!since) {
+    return c.json({ error: "since query parameter is required" }, 400);
+  }
+  const sinceDate = new Date(since);
+  if (isNaN(sinceDate.getTime())) {
+    return c.json({ error: "since must be a valid RFC3339 timestamp" }, 400);
+  }
+  const tableName2 = vfsTableName();
+  if (!tableName2) {
+    return c.json([]);
+  }
+  const workspaceId = c.get("workspaceId");
+  const result = await getDdb3().send(
+    new QueryCommand2({
+      TableName: tableName2,
+      KeyConditionExpression: "PK = :pk",
+      FilterExpression: "#mtime > :since",
+      ExpressionAttributeNames: { "#mtime": "mtime" },
+      ExpressionAttributeValues: {
+        ":pk": pk(workspaceId),
+        ":since": sinceDate.toISOString()
+      }
+    })
+  );
+  const items = result.Items ?? [];
+  const changes = items.map((item) => ({
+    path: item.SK.replace(/^file#/, ""),
+    mtime: item.mtime,
+    version: item.version ?? 0,
+    size: item.size ?? 0
   }));
-  const namespaces = Array.from(new Set(data.tools.map((t) => t.provider)));
-  return c.json({ namespaces, services: serviceList });
+  return c.json(changes);
+});
+vfsRoute.on(["GET", "HEAD"], "/:path{.+}", async (c) => {
+  const isHead = c.req.method === "HEAD";
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (isHead) {
+    if (!tableName2) return c.body(null, 404);
+    const result = await getDdb3().send(
+      new GetCommand3({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "SK"
+      })
+    );
+    return result.Item ? c.body(null, 200) : c.body(null, 404);
+  }
+  if (!tableName2) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+  if (c.req.query("stat") === "true") {
+    const result = await getDdb3().send(
+      new GetCommand3({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "#sz, #mt, version",
+        ExpressionAttributeNames: { "#sz": "size", "#mt": "mtime" }
+      })
+    );
+    if (!result.Item) return c.json({ error: "ENOENT" }, 404);
+    const item = result.Item;
+    return c.json({
+      size: item.size,
+      mtime: item.mtime,
+      isFile: true,
+      isDirectory: false
+    });
+  }
+  if (c.req.query("readdir") === "true") {
+    const prefix = filePath ? `file#${filePath}/` : "file#";
+    const result = await getDdb3().send(
+      new QueryCommand2({
+        TableName: tableName2,
+        KeyConditionExpression: "PK = :pk AND begins_with(SK, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": pk(workspaceId),
+          ":prefix": prefix
+        },
+        ProjectionExpression: "SK"
+      })
+    );
+    const items = result.Items ?? [];
+    const seen = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const relativePath = item.SK.slice(prefix.length);
+      const slashIdx = relativePath.indexOf("/");
+      if (slashIdx === -1) {
+        seen.set(relativePath, false);
+      } else {
+        const dirName = relativePath.slice(0, slashIdx);
+        if (!seen.has(dirName)) {
+          seen.set(dirName, true);
+        }
+      }
+    }
+    const entries = Array.from(seen.entries()).map(([name, isDirectory]) => ({
+      name,
+      isDirectory
+    }));
+    return c.json(entries);
+  }
+  if (!bucketName) {
+    return c.json({ error: "VFS storage not configured" }, 503);
+  }
+  const fileKey = s3Key(workspaceId, filePath);
+  try {
+    const obj = await getS3().send(
+      new GetObjectCommand({ Bucket: bucketName, Key: fileKey })
+    );
+    const body = await obj.Body?.transformToString("utf-8");
+    if (body === void 0) return c.json({ error: "ENOENT" }, 404);
+    return c.text(body, 200);
+  } catch (err) {
+    const code = err.name;
+    if (code === "NoSuchKey" || code === "NotFound") {
+      return c.json({ error: "ENOENT" }, 404);
+    }
+    throw err;
+  }
+});
+vfsRoute.put("/:path{.+}", async (c) => {
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName2 || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const content = await c.req.text();
+  const expectedVersionHeader = c.req.header("X-Vfs-Expected-Version");
+  const expectedVersion = expectedVersionHeader !== void 0 ? parseInt(expectedVersionHeader, 10) : void 0;
+  const fileKey = s3Key(workspaceId, filePath);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const byteSize = new TextEncoder().encode(content).length;
+  await getS3().send(
+    new PutObjectCommand({
+      Bucket: bucketName,
+      Key: fileKey,
+      Body: content,
+      ContentType: "text/plain; charset=utf-8"
+    })
+  );
+  try {
+    const condExpr = expectedVersion !== void 0 ? "attribute_not_exists(PK) OR version = :expected" : void 0;
+    const exprAttrValues = {
+      ":mtime": now,
+      ":sz": byteSize,
+      ":s3Key": fileKey,
+      ":inc": 1,
+      ":zero": 0
+    };
+    if (expectedVersion !== void 0) {
+      exprAttrValues[":expected"] = expectedVersion;
+    }
+    const result = await getDdb3().send(
+      new UpdateCommand({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        UpdateExpression: "SET #mt = :mtime, #sz = :sz, s3Key = :s3Key, version = if_not_exists(version, :zero) + :inc",
+        ExpressionAttributeNames: { "#mt": "mtime", "#sz": "size" },
+        ExpressionAttributeValues: exprAttrValues,
+        ...condExpr ? { ConditionExpression: condExpr } : {},
+        ReturnValues: "ALL_NEW"
+      })
+    );
+    const newVersion = result.Attributes?.version ?? 1;
+    return c.json({ ok: true, version: newVersion });
+  } catch (err) {
+    if (err instanceof ConditionalCheckFailedException) {
+      const metaResult = await getDdb3().send(
+        new GetCommand3({
+          TableName: tableName2,
+          Key: { PK: pk(workspaceId), SK: sk(filePath) },
+          ProjectionExpression: "version, etag"
+        })
+      );
+      const item = metaResult.Item;
+      return c.json(
+        {
+          ok: false,
+          conflict: {
+            serverVersion: item?.version ?? 0,
+            serverEtag: item?.etag
+          }
+        },
+        409
+      );
+    }
+    throw err;
+  }
+});
+vfsRoute.delete("/:path{.+}", async (c) => {
+  const tableName2 = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName2 || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const fileKey = s3Key(workspaceId, filePath);
+  await Promise.all([
+    getDdb3().send(
+      new DeleteCommand({
+        TableName: tableName2,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) }
+      })
+    ),
+    getS3().send(
+      new DeleteObjectCommand({ Bucket: bucketName, Key: fileKey })
+    )
+  ]);
+  return c.body(null, 204);
+});
+vfsRoute.post("/:path{.+}", (c) => {
+  if (c.req.query("mkdir") === "true") {
+    return c.body(null, 204);
+  }
+  return c.json({ error: "unsupported operation" }, 400);
 });
 
-// src/routes/proxy.ts
-import { Hono as Hono5 } from "hono";
-var proxy = new Hono5();
-proxy.post("/:ns/:proc{.*}", async (c) => {
+// src/routes/workspace.ts
+import { DynamoDBClient as DynamoDBClient4 } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient as DynamoDBDocumentClient4, UpdateCommand as UpdateCommand2 } from "@aws-sdk/lib-dynamodb";
+import { Hono as Hono6 } from "hono";
+var ddbClient4 = null;
+function getDdb4() {
+  if (!ddbClient4) {
+    ddbClient4 = DynamoDBDocumentClient4.from(
+      new DynamoDBClient4({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient4;
+}
+var workspaceRoute = new Hono6();
+workspaceRoute.post("/", async (c) => {
+  const claims = c.get("claims");
+  const body = await c.req.json();
+  const workspaceId = body?.workspaceId;
+  if (!workspaceId || typeof workspaceId !== "string") {
+    return c.json({ error: "workspaceId is required" }, 400);
+  }
+  await getDdb4().send(
+    new UpdateCommand2({
+      TableName: process.env["USERS_TABLE_NAME"],
+      Key: { sub: claims.sub },
+      UpdateExpression: "SET activeWorkspaceId = :ws",
+      ExpressionAttributeValues: { ":ws": workspaceId }
+    })
+  );
+  evictWorkspaceCache(claims.sub);
+  return c.json({ activeWorkspaceId: workspaceId });
+});
+
+// src/routes/services.ts
+import { Hono as Hono7 } from "hono";
+var services = new Hono7();
+services.get("/", async (c) => {
   const claims = c.get("claims");
   const workspaceId = c.get("workspaceId");
-  const ns = c.req.param("ns");
-  const proc = c.req.param("proc");
   const authHeader = c.req.header("Authorization");
   const cognitoToken = authHeader.slice("Bearer ".length);
   let sessionToken;
@@ -942,57 +1276,195 @@ proxy.post("/:ns/:proc{.*}", async (c) => {
     }
     return c.json({ error: "Failed to connect to gateway" }, 502);
   }
-  let body = {};
-  try {
-    body = await c.req.json();
-  } catch {
-  }
   const gatewayUrl2 = process.env["GATEWAY_URL"].replace(/\/$/, "");
-  const res = await fetch(`${gatewayUrl2}/tools/${ns}/${proc}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${sessionToken}`
-    },
-    body: JSON.stringify(body)
+  const res = await fetch(`${gatewayUrl2}/tools`, {
+    headers: { Authorization: `Bearer ${sessionToken}` }
   });
   if (res.status === 401) {
     evictGatewaySession(claims.sub);
     return c.json({ error: "Gateway authentication failed" }, 502);
   }
-  const responseData = await res.json();
-  return c.json(responseData, res.status);
+  if (!res.ok) {
+    return c.json({ error: "Gateway tools fetch failed" }, 502);
+  }
+  const data = await res.json();
+  const serviceList = data.tools.map((t) => ({
+    namespace: t.provider,
+    name: t.name,
+    procedure: t.operation,
+    description: t.description ?? "",
+    parameters: t.inputSchema
+  }));
+  const namespaces = Array.from(new Set(data.tools.map((t) => t.provider)));
+  return c.json({ namespaces, services: serviceList });
+});
+
+// src/routes/workspaces.ts
+import { DynamoDBClient as DynamoDBClient6 } from "@aws-sdk/client-dynamodb";
+import { BatchGetCommand, DynamoDBDocumentClient as DynamoDBDocumentClient6 } from "@aws-sdk/lib-dynamodb";
+import { zValidator } from "@hono/zod-validator";
+import { Hono as Hono8 } from "hono";
+import { z as z3 } from "zod";
+
+// src/session.ts
+import { DynamoDBClient as DynamoDBClient5 } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient as DynamoDBDocumentClient5,
+  GetCommand as GetCommand4,
+  PutCommand
+} from "@aws-sdk/lib-dynamodb";
+var SESSION_CACHE_TTL_MS = 15e3;
+var sessionCache2 = /* @__PURE__ */ new Map();
+var ddbClient5 = null;
+function getDdb5() {
+  if (!ddbClient5) {
+    ddbClient5 = DynamoDBDocumentClient5.from(
+      new DynamoDBClient5({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient5;
+}
+function tableName() {
+  return process.env["USER_SESSIONS_TABLE_NAME"];
+}
+async function getSessionWorkspaceId(userSub) {
+  const now = Date.now();
+  const cached = sessionCache2.get(userSub);
+  if (cached && now - cached.fetchedAt < SESSION_CACHE_TTL_MS) {
+    return cached.activeWorkspaceId;
+  }
+  const result = await getDdb5().send(
+    new GetCommand4({
+      TableName: tableName(),
+      Key: { userSub }
+    })
+  );
+  const activeWorkspaceId = result.Item?.activeWorkspaceId ?? null;
+  sessionCache2.set(userSub, { activeWorkspaceId, fetchedAt: now });
+  return activeWorkspaceId;
+}
+async function setSessionWorkspaceId(userSub, workspaceId) {
+  await getDdb5().send(
+    new PutCommand({
+      TableName: tableName(),
+      Item: {
+        userSub,
+        activeWorkspaceId: workspaceId,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    })
+  );
+  sessionCache2.set(userSub, {
+    activeWorkspaceId: workspaceId,
+    fetchedAt: Date.now()
+  });
+}
+
+// src/routes/workspaces.ts
+var ddbClient6 = null;
+function getDdb6() {
+  if (!ddbClient6) {
+    ddbClient6 = DynamoDBDocumentClient6.from(
+      new DynamoDBClient6({ region: process.env["AWS_REGION"] })
+    );
+  }
+  return ddbClient6;
+}
+async function batchGetWorkspaces(workspaceIds) {
+  if (workspaceIds.length === 0) return [];
+  const tableName2 = process.env["WORKSPACE_TABLE_NAME"];
+  const result = await getDdb6().send(
+    new BatchGetCommand({
+      RequestItems: {
+        [tableName2]: { Keys: workspaceIds.map((id) => ({ workspaceId: id })) }
+      }
+    })
+  );
+  return result.Responses?.[tableName2] ?? [];
+}
+var workspacesRoute = new Hono8();
+workspacesRoute.get("/", async (c) => {
+  const claims = c.get("claims");
+  const userSub = claims.sub;
+  const [workspaceIds, activeWorkspaceId] = await Promise.all([
+    listWorkspaceMemberships(userSub),
+    getSessionWorkspaceId(userSub)
+  ]);
+  const workspaces = await batchGetWorkspaces(workspaceIds);
+  const effectiveActiveId = activeWorkspaceId && workspaceIds.includes(activeWorkspaceId) ? activeWorkspaceId : workspaceIds[0] ?? null;
+  const sorted = workspaceIds.map((id) => workspaces.find((w) => w.workspaceId === id)).filter((w) => w !== void 0);
+  return c.json({
+    workspaces: sorted.map((w) => ({
+      workspaceId: w.workspaceId,
+      name: w.name,
+      plan: w.plan,
+      active: w.workspaceId === effectiveActiveId
+    })),
+    activeWorkspaceId: effectiveActiveId
+  });
 });
+var setActiveSchema = z3.object({
+  workspaceId: z3.string().min(1)
+});
+workspacesRoute.put(
+  "/active",
+  zValidator("json", setActiveSchema),
+  async (c) => {
+    const claims = c.get("claims");
+    const userSub = claims.sub;
+    const { workspaceId } = c.req.valid("json");
+    const workspaceIds = await listWorkspaceMemberships(userSub);
+    if (!workspaceIds.includes(workspaceId)) {
+      return c.json({ error: "Not a member of this workspace" }, 403);
+    }
+    await setSessionWorkspaceId(userSub, workspaceId);
+    return c.json({ activeWorkspaceId: workspaceId });
+  }
+);
 
 // src/app.ts
 function createChatApp() {
-  const app2 = new Hono6();
+  const app2 = new Hono9();
   app2.route("/", health);
-  const api = app2.basePath("/api");
-  api.use(authMiddleware, workspaceMiddleware, planMiddleware);
+  const authOnly = new Hono9();
+  authOnly.use("/*", authMiddleware);
+  authOnly.route("/workspace", workspaceRoute);
+  app2.route("/api", authOnly);
+  const vfs = new Hono9();
+  vfs.use("/*", authMiddleware, workspaceMiddleware);
+  vfs.route("/", vfsRoute);
+  app2.route("/vfs", vfs);
+  const api = new Hono9();
+  api.use("/*", authMiddleware, workspaceMiddleware, planMiddleware);
   api.route("/chat", chatRoute);
   api.route("/edit", editRoute);
   api.route("/services", services);
   api.route("/proxy", proxy);
+  api.route("/workspaces", workspacesRoute);
+  app2.route("/api", api);
   return app2;
 }
 
 // src/env.ts
-import { z as z3 } from "zod";
-var envSchema = z3.object({
-  NODE_ENV: z3.enum(["development", "production", "test"]).default("development"),
-  PORT: z3.coerce.number().default(3001),
-  COGNITO_USER_POOL_ID: z3.string().min(1),
-  COGNITO_CLIENT_ID: z3.string().min(1),
-  AWS_REGION: z3.string().default("us-east-1"),
-  WORKSPACE_TABLE_NAME: z3.string().min(1),
-  MEMBERSHIPS_TABLE_NAME: z3.string().min(1),
-  OPENROUTER_SECRET_ARN: z3.string().min(1),
-  GATEWAY_URL: z3.string().url(),
+import { z as z4 } from "zod";
+var envSchema = z4.object({
+  NODE_ENV: z4.enum(["development", "production", "test"]).default("development"),
+  PORT: z4.coerce.number().default(3001),
+  COGNITO_USER_POOL_ID: z4.string().min(1),
+  COGNITO_CLIENT_ID: z4.string().min(1),
+  AWS_REGION: z4.string().default("us-east-1"),
+  WORKSPACE_TABLE_NAME: z4.string().min(1),
+  MEMBERSHIPS_TABLE_NAME: z4.string().min(1),
+  USERS_TABLE_NAME: z4.string().min(1),
+  OPENROUTER_SECRET_ARN: z4.string().min(1),
+  GATEWAY_URL: z4.string().url(),
+  // VFS backing store (optional — routes degrade gracefully when unset)
+  VFS_TABLE_NAME: z4.string().optional(),
+  VFS_BUCKET_NAME: z4.string().optional(),
   // PostHog prompt management (optional — falls back to code prompts when absent)
-  POSTHOG_PROJECT_API_KEY: z3.string().optional(),
-  POSTHOG_PERSONAL_API_KEY: z3.string().optional(),
-  POSTHOG_HOST: z3.string().default("https://us.posthog.com")
+  POSTHOG_PROJECT_API_KEY: z4.string().optional(),
+  POSTHOG_PERSONAL_API_KEY: z4.string().optional(),
+  POSTHOG_HOST: z4.string().default("https://us.posthog.com")
 });
 function parseEnv(raw) {
   return envSchema.parse(raw);