@aquex/cmos-mcp 1.0.0

package/dist/tools/cmos/dashboard-client.js

@@ -0,0 +1,800 @@
+"use strict";
+/**
+ * Dashboard HTTP Client & Credential-Based Authentication
+ *
+ * Reusable HTTP client for calling the cmos-dashboard REST API.
+ * Authenticates via POST /api/auth/login with user credentials,
+ * caches the JWT, and re-authenticates when it expires.
+ *
+ * @module tools/cmos/dashboard-client
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardClient = exports.CMOS_DASHBOARD_SECRET_ENV = exports.DEFAULT_DASHBOARD_URL = exports.CMOS_DASHBOARD_API_KEY_ENV = exports.CMOS_DASHBOARD_PASSWORD_ENV = exports.CMOS_DASHBOARD_USER_ENV = exports.CMOS_DASHBOARD_URL_ENV = void 0;
+exports.resolveDashboardBaseUrl = resolveDashboardBaseUrl;
+exports.__resetLegacyAuthWarnSeen = __resetLegacyAuthWarnSeen;
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const errors_1 = require("./errors");
+const credential_store_1 = require("../../intelligence/credential-store");
+// ─── Environment Variable Names ──────────────────────────────────────────────
+exports.CMOS_DASHBOARD_URL_ENV = 'CMOS_DASHBOARD_URL';
+exports.CMOS_DASHBOARD_USER_ENV = 'CMOS_DASHBOARD_USER';
+exports.CMOS_DASHBOARD_PASSWORD_ENV = 'CMOS_DASHBOARD_PASSWORD';
+exports.CMOS_DASHBOARD_API_KEY_ENV = 'CMOS_DASHBOARD_API_KEY';
+/**
+ * Default dashboard URL used when CMOS_DASHBOARD_URL is unset or empty.
+ * Sprint 62 m02: bakes the canonical aquex.ai endpoint into the npm-shipped
+ * package so fresh installs reach the right host without env config. The 402
+ * graceful-degradation path (m05) is the actual fresh-user UX when the user
+ * has no account yet — they hit the default URL, dashboard returns 402, and
+ * cmos_message etc surface https://cmos.aquex.ai for sign-up.
+ */
+exports.DEFAULT_DASHBOARD_URL = 'https://cmos.aquex.ai';
+/** @deprecated Use CMOS_DASHBOARD_USER_ENV + CMOS_DASHBOARD_PASSWORD_ENV instead */
+exports.CMOS_DASHBOARD_SECRET_ENV = 'CMOS_DASHBOARD_SECRET';
+/**
+ * Resolve the dashboard base URL from explicit override → env var → baked default.
+ * Treats empty string as unset (per IDE-spawn empty-string env trap).
+ *
+ * Exported so downstream tools (cmos_status, future hosts) can read the same
+ * effective URL without re-implementing the precedence chain.
+ */
+function resolveDashboardBaseUrl(override) {
+    if (override)
+        return override;
+    const envValue = process.env[exports.CMOS_DASHBOARD_URL_ENV];
+    if (envValue)
+        return envValue;
+    return exports.DEFAULT_DASHBOARD_URL;
+}
+// ─── Sprint 58 m02: legacy-auth migration WARN ───────────────────────────────
+/**
+ * Tracks whether we've already emitted a [WARN] line for each legacy arm in
+ * this process, so the warning fires exactly once per arm per run — loud
+ * enough to be seen, quiet enough that repeated calls don't spam logs.
+ *
+ * Visible to tests via `__resetLegacyAuthWarnSeen` so assertions can force
+ * a clean slate per case.
+ */
+const legacyAuthWarnSeen = new Set();
+function warnLegacyAuth(arm) {
+    if (legacyAuthWarnSeen.has(arm))
+        return;
+    legacyAuthWarnSeen.add(arm);
+    const armLabel = arm === 'legacy-env' ? 'legacy-env' : 'password-fallback';
+    process.stderr.write(`[WARN] cmos-mcp: authenticating via ${armLabel}; run cmos_auth(action="login") to migrate to device-code credentials\n`);
+}
+/** Test helper — reset the per-process WARN seen-set. */
+function __resetLegacyAuthWarnSeen() {
+    legacyAuthWarnSeen.clear();
+}
+function canonicalizeSlug(value) {
+    return value.trim().toLowerCase().replace(/\s+/g, '-');
+}
+function expectedSlugMismatchError(operation, expectedSlug, actualSlug) {
+    return (0, errors_1.createError)({
+        code: 'EXPECTED_SLUG_MISMATCH',
+        message: `Refusing ${operation}: expected slug '${expectedSlug}' but resolved '${actualSlug}'.`,
+        suggestion: 'Verify the call is targeting the intended project and pass the canonical slug from the trusted local project context.',
+    });
+}
+function pickNewestUserScopedKey(keys) {
+    const entries = Object.entries(keys);
+    if (entries.length === 0)
+        return undefined;
+    const best = entries.reduce((a, b) => ((b[1].issuedAt ?? '') > (a[1].issuedAt ?? '') ? b : a));
+    return { keyId: best[0], record: best[1] };
+}
+function parseOwnerFromAddress(address) {
+    if (!address || !address.startsWith('cmos://')) {
+        return undefined;
+    }
+    const body = address.slice('cmos://'.length);
+    const [owner] = body.split('/');
+    return owner && owner.trim().length > 0 ? owner.trim() : undefined;
+}
+function normalizeDirectoryProject(project) {
+    const address = project.address ?? project.cmosAddress ?? '';
+    const owner = project.owner ?? parseOwnerFromAddress(address) ?? 'unknown';
+    return {
+        id: project.id ?? '',
+        name: project.name ?? '',
+        address,
+        owner,
+        ...(project.description ? { description: project.description } : {}),
+        ...(project.slug ? { slug: project.slug } : {}),
+        ...(project.isOwner !== undefined ? { isOwner: project.isOwner } : {}),
+    };
+}
+function normalizeProjectListResult(data) {
+    const projects = (data.projects ?? []).map((project) => normalizeDirectoryProject(project));
+    return {
+        projects,
+        totalCount: data.totalCount ?? projects.length,
+    };
+}
+// ─── DashboardClient ─────────────────────────────────────────────────────────
+/**
+ * HTTP client for the cmos-dashboard REST API.
+ *
+ * Authenticates with user credentials via /api/auth/login,
+ * caches the JWT, and re-authenticates when expired.
+ * All methods return CmosToolResult for consistent error handling.
+ */
+class DashboardClient {
+    constructor(config) {
+        /** Cached auth token */
+        this.cachedToken = null;
+        /** Token expiry time (ms since epoch) */
+        this.tokenExpiresAt = 0;
+        /** Cached user identity from last login */
+        this.cachedIdentity = null;
+        this.baseUrl = config.baseUrl.replace(/\/+$/, '');
+        this.timeoutMs = config.timeoutMs ?? 10000;
+        if (config.apiKey) {
+            this.authMethod = 'apiKey';
+            this.cachedToken = config.apiKey;
+            this.tokenExpiresAt = Infinity;
+            this.email = '';
+            this.password = '';
+        }
+        else {
+            this.authMethod = 'jwt';
+            this.email = config.email ?? '';
+            this.password = config.password ?? '';
+        }
+    }
+    /**
+     * Create a DashboardClient from environment variables.
+     * Returns an error result if not configured.
+     */
+    static fromEnv(overrides) {
+        const baseUrl = resolveDashboardBaseUrl(overrides?.baseUrl);
+        const apiKey = overrides?.apiKey ?? process.env[exports.CMOS_DASHBOARD_API_KEY_ENV];
+        // API key auth takes precedence over email/password
+        if (apiKey) {
+            return (0, errors_1.createSuccess)(new DashboardClient({
+                baseUrl,
+                apiKey,
+                timeoutMs: overrides?.timeoutMs,
+            }));
+        }
+        // Fallback to email/password auth
+        const email = overrides?.email ?? process.env[exports.CMOS_DASHBOARD_USER_ENV];
+        const password = overrides?.password ?? process.env[exports.CMOS_DASHBOARD_PASSWORD_ENV];
+        if (!email || !password) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardNotConfigured());
+        }
+        return (0, errors_1.createSuccess)(new DashboardClient({
+            baseUrl,
+            email,
+            password,
+            timeoutMs: overrides?.timeoutMs,
+        }));
+    }
+    /**
+     * Create a DashboardClient using the local CredentialStore minted by the
+     * Sprint 57 device code flow.
+     *
+     * Resolution order:
+     *   1. Explicit `apiKey` override (tests / callers bypassing the store).
+     *   2. Project-scoped key in CredentialStore for `projectRoot` (set by m02
+     *      auto-issue capture on `POST /api/projects/register`).
+     *   3. Newest user-scoped key in CredentialStore (minted by device code
+     *      flow; used before a project-scoped key has been issued for this root).
+     *   4. Legacy `CMOS_DASHBOARD_API_KEY` env var — carried forward so users
+     *      who configured the env var directly before device code landed keep
+     *      working.
+     *   5. Email/password env vars — terminal fallback.
+     *
+     * `keySource` surfaces which arm fired so the eventual whoami + onboard
+     * surface (m04) can show identitySource to the agent.
+     */
+    static async fromEnvForProject(projectRoot, overrides) {
+        const baseUrl = resolveDashboardBaseUrl(overrides?.baseUrl);
+        const buildConfig = (apiKey) => ({
+            baseUrl,
+            apiKey,
+            ...(overrides?.timeoutMs !== undefined ? { timeoutMs: overrides.timeoutMs } : {}),
+        });
+        // (1) Explicit override.
+        if (overrides?.apiKey) {
+            return (0, errors_1.createSuccess)({
+                client: new DashboardClient(buildConfig(overrides.apiKey)),
+                keySource: 'user-scoped',
+                matchedProjectRoot: null,
+            });
+        }
+        const store = overrides?.credentialStore ?? (await credential_store_1.CredentialStore.create());
+        // (2) Project-scoped key in the credential store.
+        if (projectRoot) {
+            const projectKey = await store.getProjectKey(projectRoot);
+            if (projectKey) {
+                return (0, errors_1.createSuccess)({
+                    client: new DashboardClient(buildConfig(projectKey.key)),
+                    keySource: 'project-scoped',
+                    matchedProjectRoot: path_1.default.resolve(projectRoot),
+                });
+            }
+        }
+        // (3) Newest user-scoped key in the credential store.
+        const userScopedKeys = await store.listUserScopedKeys();
+        const pick = pickNewestUserScopedKey(userScopedKeys);
+        if (pick) {
+            const client = new DashboardClient(buildConfig(pick.record.key));
+            client.setAuthenticatingKeyId(pick.keyId);
+            return (0, errors_1.createSuccess)({
+                client,
+                keySource: 'user-scoped',
+                matchedProjectRoot: null,
+            });
+        }
+        // (4) Legacy env-var user-scoped key.
+        const envKey = process.env[exports.CMOS_DASHBOARD_API_KEY_ENV];
+        if (envKey) {
+            warnLegacyAuth('legacy-env');
+            return (0, errors_1.createSuccess)({
+                client: new DashboardClient(buildConfig(envKey)),
+                keySource: 'legacy-env',
+                matchedProjectRoot: null,
+            });
+        }
+        // (5) Email/password terminal fallback.
+        const email = overrides?.email ?? process.env[exports.CMOS_DASHBOARD_USER_ENV];
+        const password = overrides?.password ?? process.env[exports.CMOS_DASHBOARD_PASSWORD_ENV];
+        if (!email || !password) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardNotConfigured());
+        }
+        warnLegacyAuth('password-fallback');
+        return (0, errors_1.createSuccess)({
+            client: new DashboardClient({
+                baseUrl,
+                email,
+                password,
+                ...(overrides?.timeoutMs !== undefined ? { timeoutMs: overrides.timeoutMs } : {}),
+            }),
+            keySource: 'password-fallback',
+            matchedProjectRoot: null,
+        });
+    }
+    /**
+     * Authenticate with the dashboard and cache the token.
+     */
+    async authenticate() {
+        const url = `${this.baseUrl}/api/auth/login`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                },
+                body: JSON.stringify({ email: this.email, password: this.password }),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (response.status === 401 || response.status === 403) {
+                this.cachedToken = null;
+                this.tokenExpiresAt = 0;
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardAuthFailed(this.baseUrl));
+            }
+            if (!response.ok) {
+                const text = await response.text().catch(() => 'Unknown error');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`Login failed: HTTP ${response.status}: ${text}`));
+            }
+            const loginResponse = (await response.json());
+            this.cachedToken = loginResponse.data.token;
+            this.tokenExpiresAt = new Date(loginResponse.data.expiresAt).getTime();
+            this.cachedIdentity = {
+                userId: loginResponse.data.user.id,
+                email: loginResponse.data.user.email,
+                username: loginResponse.data.user.username ?? null,
+            };
+            return (0, errors_1.createSuccess)(this.cachedToken);
+        }
+        catch (error) {
+            clearTimeout(timeout);
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, `Login timed out after ${this.timeoutMs}ms`));
+                }
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, error.message));
+            }
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, 'Unknown network error'));
+        }
+    }
+    /**
+     * Get a valid auth token, re-authenticating if needed.
+     */
+    async getAuthToken() {
+        // API keys are permanent — no expiry check, no login needed
+        if (this.authMethod === 'apiKey') {
+            return (0, errors_1.createSuccess)(this.cachedToken);
+        }
+        const now = Date.now();
+        if (this.cachedToken && now < this.tokenExpiresAt - DashboardClient.EXPIRY_BUFFER_MS) {
+            return (0, errors_1.createSuccess)(this.cachedToken);
+        }
+        return this.authenticate();
+    }
+    /**
+     * Make an authenticated HTTP request to the dashboard.
+     */
+    async request(method, path, body) {
+        const tokenResult = await this.getAuthToken();
+        if (!tokenResult.success) {
+            return (0, errors_1.createError)(tokenResult.error);
+        }
+        const url = `${this.baseUrl}${path}`;
+        const token = tokenResult.data;
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        };
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await fetch(url, {
+                method,
+                headers,
+                body: body ? JSON.stringify(body) : undefined,
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (response.status === 401 || response.status === 403) {
+                // Token may have expired server-side — clear cache and retry once
+                this.cachedToken = null;
+                this.tokenExpiresAt = 0;
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardAuthFailed(this.baseUrl));
+            }
+            if (response.status === 402) {
+                const text = await response.text().catch(() => '');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUpgradeRequired(text || undefined));
+            }
+            if (response.status === 404) {
+                const errorBody = (await response.json().catch(() => null));
+                const detail = errorBody?.error ? String(errorBody.error) : undefined;
+                const hint = errorBody?.hint ? String(errorBody.hint) : undefined;
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardNotFound(path, detail, hint));
+            }
+            if (response.status >= 500) {
+                const text = await response.text().catch(() => 'Unknown server error');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`Server error ${response.status}: ${text}`));
+            }
+            if (!response.ok) {
+                const text = await response.text().catch(() => 'Unknown error');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`HTTP ${response.status}: ${text}`));
+            }
+            const json = (await response.json());
+            // Dashboard API wraps responses in {success, data} envelope — unwrap it
+            const data = (json && typeof json === 'object' && 'data' in json ? json.data : json);
+            return (0, errors_1.createSuccess)(data);
+        }
+        catch (error) {
+            clearTimeout(timeout);
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, `Request timed out after ${this.timeoutMs}ms`));
+                }
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, error.message));
+            }
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, 'Unknown network error'));
+        }
+    }
+    // ─── Public API Methods ──────────────────────────────────────────────────
+    /**
+     * Get the cached user identity from the last login.
+     * Returns null if not yet authenticated.
+     */
+    get userIdentity() {
+        return this.cachedIdentity;
+    }
+    /**
+     * `keyId` of the user-scoped credential that authenticated this client, if known.
+     * Sprint 57 m02 — populated by `fromEnvForProject()` when a user-scoped key is
+     * picked from the credential store. Callers capturing the auto-issued register
+     * response stamp this into `parentKeyId` on the resulting project-scoped record.
+     */
+    get authenticatingKeyId() {
+        return this._authenticatingKeyId;
+    }
+    /** Internal setter used by the factories when they know the keyId. */
+    setAuthenticatingKeyId(keyId) {
+        this._authenticatingKeyId = keyId;
+    }
+    /**
+     * Send a message to a target address.
+     */
+    async sendMessage(params) {
+        const body = {
+            targetAddress: params.targetAddress,
+            type: params.type,
+            summary: params.summary,
+            body: params.body,
+            evidence: params.evidence,
+        };
+        if (params.senderProjectId) {
+            body.senderProjectId = params.senderProjectId;
+        }
+        if (params.fromProjectId) {
+            body.fromProjectId = params.fromProjectId;
+        }
+        if (params.toProjectId) {
+            body.toProjectId = params.toProjectId;
+        }
+        if (params.senderAddress) {
+            body.senderAddress = params.senderAddress;
+        }
+        const result = await this.request('POST', '/api/messages', body);
+        if (result.success &&
+            result.data &&
+            params.senderAddress &&
+            result.data.senderAddress &&
+            result.data.senderAddress !== params.senderAddress) {
+            console.warn(`[dashboard-client] senderAddress echo mismatch: sent ${params.senderAddress}, dashboard echoed ${result.data.senderAddress}`);
+        }
+        // Sprint 57 m04: capture the dashboard's identitySource ACK so whoami +
+        // onboard can surface "still on legacy user-scoped key" as a warning.
+        if (result.success && result.data?.deliveryAck?.identitySource) {
+            // Lazy import to keep the dashboard-client free of upstream auth coupling
+            // and to avoid a require cycle with src/auth.
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const { recordDeliveryAck } = require('../../auth/delivery-ack-cache');
+            recordDeliveryAck(result.data.deliveryAck.identitySource);
+        }
+        return result;
+    }
+    /**
+     * List messages (inbox or sent).
+     */
+    async listMessages(params) {
+        const query = new URLSearchParams();
+        if (params?.tab)
+            query.set('tab', params.tab);
+        if (params?.status)
+            query.set('status', params.status);
+        if (params?.limit !== undefined)
+            query.set('limit', String(params.limit));
+        const queryString = query.toString();
+        const path = `/api/messages${queryString ? `?${queryString}` : ''}`;
+        return this.request('GET', path);
+    }
+    /**
+     * Respond to a message (accept, decline, or reply).
+     */
+    async respondToMessage(params) {
+        return this.request('POST', `/api/messages/${params.messageId}/respond`, {
+            status: params.status,
+            notes: params.notes,
+        });
+    }
+    /**
+     * Resolve a cmos:// address to verify it exists.
+     */
+    async resolveAddress(params) {
+        return this.request('GET', `/api/messages/resolve?address=${encodeURIComponent(params.address)}`);
+    }
+    /**
+     * List all addressable projects in the dashboard directory.
+     */
+    async listDirectory() {
+        const result = await this.request('GET', '/api/projects/directory/public');
+        if (!result.success || !result.data) {
+            return result;
+        }
+        return (0, errors_1.createSuccess)(normalizeProjectListResult(result.data));
+    }
+    /**
+     * Get projects owned by the authenticated user.
+     */
+    async getMyProjects() {
+        const result = await this.request('GET', '/api/projects/me');
+        if (!result.success || !result.data) {
+            return result;
+        }
+        return (0, errors_1.createSuccess)(normalizeProjectListResult(result.data));
+    }
+    /**
+     * Push a sync event to the dashboard.
+     * Used by checkpoint backfill.
+     */
+    async pushSyncEvent(envelope) {
+        return this.request('POST', '/api/sync/events', envelope);
+    }
+    /**
+     * Get sync reconciliation status from the dashboard.
+     * Returns per-table row counts in the PG mirror.
+     */
+    async getSyncStatus(projectSlug) {
+        const query = projectSlug ? `?projectSlug=${encodeURIComponent(projectSlug)}` : '';
+        return this.request('GET', `/api/sync/status${query}`);
+    }
+    /**
+     * Get full project sync state from the dashboard.
+     * Returns all synced entities for a specific project.
+     */
+    async getSyncProjectState(slug) {
+        return this.request('GET', `/api/sync/projects/${encodeURIComponent(slug)}/state`);
+    }
+    /**
+     * Purge all mirrored data for a project from the PG mirror.
+     * Used before re-backfill to ensure clean state.
+     */
+    async purgeMirror(projectSlug, expectedSlug) {
+        if (expectedSlug && canonicalizeSlug(projectSlug) !== canonicalizeSlug(expectedSlug)) {
+            return expectedSlugMismatchError('mirror purge', canonicalizeSlug(expectedSlug), canonicalizeSlug(projectSlug));
+        }
+        const result = await this.request('POST', '/api/sync/purge', {
+            projectSlug,
+            confirm: true,
+        });
+        // 404 means the project doesn't exist in PG yet — nothing to purge, treat as success
+        if (!result.success && result.error?.code === 'DASHBOARD_NOT_FOUND') {
+            return (0, errors_1.createSuccess)({
+                purgedProject: projectSlug,
+                tablesCleared: [],
+                rowsDeleted: 0,
+            });
+        }
+        return result;
+    }
+    /**
+     * Register a project with the dashboard by uploading the SQLite database.
+     * Used for auto-registration on first checkpoint.
+     *
+     * Endpoint: POST /api/projects/register (multipart/form-data)
+     * - 201: New registration
+     * - 200: Re-registration (purges and re-backfills)
+     */
+    /**
+     * POST the local SQLite file as multipart/form-data to /api/sync/sqlite-backfill.
+     * This is the bulk reconciliation path — idempotent, returns per-entity counts.
+     * Uses an extended timeout (60s minimum) to accommodate large file uploads.
+     */
+    async syncSqliteFile(filePath, projectSlug, expectedSlug) {
+        if (expectedSlug && canonicalizeSlug(projectSlug) !== canonicalizeSlug(expectedSlug)) {
+            return expectedSlugMismatchError('SQLite sync', canonicalizeSlug(expectedSlug), canonicalizeSlug(projectSlug));
+        }
+        const tokenResult = await this.getAuthToken();
+        if (!tokenResult.success) {
+            return (0, errors_1.createError)(tokenResult.error);
+        }
+        // Read the SQLite file
+        let fileBuffer;
+        try {
+            fileBuffer = (0, fs_1.readFileSync)(filePath);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`Failed to read SQLite file: ${msg}`));
+        }
+        // Build multipart form
+        const blob = new Blob([fileBuffer], { type: 'application/x-sqlite3' });
+        const formData = new FormData();
+        formData.append('database', blob, 'cmos.sqlite');
+        formData.append('projectSlug', projectSlug);
+        const url = `${this.baseUrl}/api/sync/sqlite-backfill`;
+        const token = tokenResult.data;
+        const controller = new AbortController();
+        // Use longer timeout for file upload (60s minimum)
+        const uploadTimeoutMs = Math.max(this.timeoutMs, 60000);
+        const timeout = setTimeout(() => controller.abort(), uploadTimeoutMs);
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/json',
+                    // Content-Type is set automatically by fetch for FormData
+                },
+                body: formData,
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (response.status === 401 || response.status === 403) {
+                this.cachedToken = null;
+                this.tokenExpiresAt = 0;
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardAuthFailed(this.baseUrl));
+            }
+            if (response.status === 402) {
+                const text = await response.text().catch(() => '');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUpgradeRequired(text || undefined));
+            }
+            if (!response.ok) {
+                const text = await response.text().catch(() => 'Unknown error');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`SQLite backfill failed: HTTP ${response.status}: ${text}`));
+            }
+            const json = (await response.json());
+            const data = (json && typeof json === 'object' && 'data' in json ? json.data : json);
+            return (0, errors_1.createSuccess)(data);
+        }
+        catch (error) {
+            clearTimeout(timeout);
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, `SQLite backfill timed out after ${uploadTimeoutMs}ms`));
+                }
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, error.message));
+            }
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, 'Unknown network error'));
+        }
+    }
+    async registerProject(params) {
+        const derivedSlug = canonicalizeSlug(params.projectName);
+        if (params.expectedSlug && derivedSlug !== canonicalizeSlug(params.expectedSlug)) {
+            return expectedSlugMismatchError('project registration', canonicalizeSlug(params.expectedSlug), derivedSlug);
+        }
+        const tokenResult = await this.getAuthToken();
+        if (!tokenResult.success) {
+            return (0, errors_1.createError)(tokenResult.error);
+        }
+        // Read the SQLite file
+        let fileBuffer;
+        try {
+            fileBuffer = (0, fs_1.readFileSync)(params.sqlitePath);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'Unknown error';
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`Failed to read SQLite file: ${msg}`));
+        }
+        // Build multipart form
+        const blob = new Blob([fileBuffer], { type: 'application/x-sqlite3' });
+        const formData = new FormData();
+        formData.append('database', blob, 'cmos.sqlite');
+        formData.append('projectName', params.projectName);
+        if (params.localDbPath) {
+            formData.append('localDbPath', params.localDbPath);
+        }
+        const url = `${this.baseUrl}/api/projects/register`;
+        const token = tokenResult.data;
+        const controller = new AbortController();
+        // Use longer timeout for file upload (60s minimum)
+        const uploadTimeoutMs = Math.max(this.timeoutMs, 60000);
+        const timeout = setTimeout(() => controller.abort(), uploadTimeoutMs);
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/json',
+                    // Content-Type is set automatically by fetch for FormData
+                },
+                body: formData,
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (response.status === 401 || response.status === 403) {
+                this.cachedToken = null;
+                this.tokenExpiresAt = 0;
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardAuthFailed(this.baseUrl));
+            }
+            if (response.status === 402) {
+                const text = await response.text().catch(() => '');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUpgradeRequired(text || undefined));
+            }
+            if (!response.ok) {
+                const text = await response.text().catch(() => 'Unknown error');
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError(`Registration failed: HTTP ${response.status}: ${text}`));
+            }
+            const json = (await response.json());
+            const data = (json && typeof json === 'object' && 'data' in json ? json.data : json);
+            return (0, errors_1.createSuccess)(data);
+        }
+        catch (error) {
+            clearTimeout(timeout);
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, `Registration timed out after ${uploadTimeoutMs}ms`));
+                }
+                return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, error.message));
+            }
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardUnreachable(this.baseUrl, 'Unknown network error'));
+        }
+    }
+    /**
+     * Reissue a project-scoped key after partial-failure recovery.
+     *
+     * POSTs `/api/projects/:id/keys/reissue` with user-scoped `cmk_...` Bearer
+     * auth (same auth mode as `/rotate`, `/revoke`, `/register`, `/keys`).
+     * Dashboard revokes all prior project-scoped keys bound to the caller's
+     * `parent_key_id` for this project and mints a fresh one, returning the
+     * plaintext exactly once in the response body. No grace window — reissue
+     * implies the current key is lost or compromised.
+     *
+     * Originally landed in Sprint 57 m02. Sprint 58 m03 live verification
+     * (2026-04-22) exposed that the dashboard endpoint was rejecting user-scoped
+     * Bearer with HTTP 400 "Reissue requires a logged-in dashboard session".
+     * Sprint 59 m01 + dashboard s34-m02 (2026-04-23) fixed the drift — removed
+     * the api-key rejection at dashboard projects.ts:740 and added an ownership
+     * check matching the existing revoke route. The MCP-side contract
+     * (cmk_ Bearer + `{key, keyId, label, revokedKeyIds}` response) did not
+     * change — only the dashboard-side acceptance did.
+     */
+    async reissueProjectKey(projectId) {
+        if (!projectId) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError('reissueProjectKey: projectId is required'));
+        }
+        return this.request('POST', `/api/projects/${encodeURIComponent(projectId)}/keys/reissue`, {});
+    }
+    /**
+     * Rotate a project-scoped key with an optional grace window.
+     *
+     * Sprint 57 m03 — `POST /api/projects/:id/keys/rotate` mints a new project
+     * key and schedules the old one for revocation in `graceSeconds` (default
+     * 300 dashboard-side). Response fields: `newKey`, `newKeyId`, `oldKeyId`,
+     * `revokeAt`. Local callers store the new key and hold the old one in
+     * `pendingRevoke` so in-flight requests survive the grace window.
+     */
+    async rotateProjectKey(projectId, options = {}) {
+        if (!projectId) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError('rotateProjectKey: projectId is required'));
+        }
+        const body = {};
+        if (options.graceSeconds !== undefined) {
+            body.graceSeconds = options.graceSeconds;
+        }
+        return this.request('POST', `/api/projects/${encodeURIComponent(projectId)}/keys/rotate`, body);
+    }
+    /**
+     * Scope-aware unified revoke.
+     *
+     * Sprint 59 m02 / dashboard s34-m03 — `POST /api/keys/:keyId/revoke`. Works
+     * for both user-scoped (`projectId IS NULL`) and project-scoped rows; the
+     * dashboard infers scope from the key row and enforces ownership:
+     *   - user-scoped: requester's `userId` must equal the key row's `user_id`
+     *   - project-scoped: requester must own the project (same check as
+     *     `/api/projects/:id/keys/revoke/:keyId`)
+     *
+     * Response envelope `{keyId, revokedAt}` matches the legacy project-scoped
+     * endpoint byte-for-byte — deliberate parser-reuse per dashboard team
+     * message 335c3a34 (2026-04-23). The inferred scope is NOT echoed back;
+     * callers determine it from their own credential store before invoking.
+     *
+     * No grace window — the key is invalid as soon as this returns. Use `rotate`
+     * when a grace window is wanted instead.
+     */
+    async revokeKey(keyId) {
+        if (!keyId) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError('revokeKey: keyId is required'));
+        }
+        return this.request('POST', `/api/keys/${encodeURIComponent(keyId)}/revoke`, {});
+    }
+    /**
+     * Hard-revoke a project-scoped key immediately via the legacy project-scoped endpoint.
+     *
+     * Sprint 57 m03 — `POST /api/projects/:id/keys/revoke/:keyId`. No grace
+     * window; the key is invalid from the dashboard's perspective as soon as
+     * this returns. Kept unchanged per dashboard team commitment — the
+     * profile.ejs key-management UI calls this endpoint directly and existing
+     * callers keep working. New callers should prefer `revokeKey(keyId)` (the
+     * Sprint 59 m02 unified surface), which also handles user-scoped rows.
+     */
+    async revokeProjectKey(projectId, keyId) {
+        if (!projectId || !keyId) {
+            return (0, errors_1.createError)(errors_1.CmosErrors.dashboardError('revokeProjectKey: projectId and keyId are required'));
+        }
+        return this.request('POST', `/api/projects/${encodeURIComponent(projectId)}/keys/revoke/${encodeURIComponent(keyId)}`, {});
+    }
+    /**
+     * List every key the authenticated credential can see.
+     *
+     * Sprint 57 m03 — `GET /api/keys`. Response is the full credential tree
+     * (user-scoped rows where `projectId === null` plus their spawned
+     * project-scoped children via `parentKeyId`). Callers apply the "mine-only"
+     * filter locally by matching `parentKeyId` against their own credential
+     * store's `userScopedKeys`.
+     */
+    async listKeys() {
+        return this.request('GET', '/api/keys');
+    }
+}
+exports.DashboardClient = DashboardClient;
+/** Buffer before expiry to trigger re-auth (30 seconds) */
+DashboardClient.EXPIRY_BUFFER_MS = 30000;
+//# sourceMappingURL=dashboard-client.js.map