@astrale-os/cli 1.0.0-beta.9 → 1.0.0-npm-deprecated.0

package/studio/server/api/documents.ts

@@ -1,55 +0,0 @@
-/** Context-document HTTP transport, including multipart uploads and raw bodies. */
-import {
-  addDocument,
-  deleteDocument,
-  listDocuments,
-  readDocument,
-  updateDocument,
-} from '../state/documents'
-import { json, notFound, type DomainRouteContext } from './http'
-
-/** Routes that must run before POST bodies are parsed as JSON. */
-export async function handleDocumentTransport(
-  req: Request,
-  rest: string,
-  root: string,
-): Promise<Response | null> {
-  if (rest === '/context/documents' && req.method === 'GET') return json(listDocuments(root))
-  if (rest === '/context/documents' && req.method === 'POST') {
-    const form = await req.formData()
-    const added = []
-    for (const value of form.getAll('files')) {
-      if (value instanceof File) {
-        added.push(
-          addDocument(root, value.name, value.type, new Uint8Array(await value.arrayBuffer())),
-        )
-      }
-    }
-    return json(added)
-  }
-
-  const raw = rest.match(/^\/context\/documents\/([^/]+)\/raw$/)
-  if (raw && req.method === 'GET') {
-    const document = readDocument(root, decodeURIComponent(raw[1]))
-    if (!document) return notFound()
-    return new Response(Bun.file(document.abs), {
-      headers: { 'content-type': document.meta.type },
-    })
-  }
-
-  return null
-}
-
-/** JSON document mutations dispatched with the rest of the domain routes. */
-export function handleDocumentMutation(context: DomainRouteContext): Response | null {
-  const { req, rest, body, handle } = context
-  const root = handle.root
-  if (rest === '/context/documents/delete' && req.method === 'POST') {
-    return json({ ok: deleteDocument(root, body.id) })
-  }
-  if (rest === '/context/documents/update' && req.method === 'POST') {
-    const meta = updateDocument(root, body.id, new TextEncoder().encode(String(body.content ?? '')))
-    return meta ? json(meta) : notFound()
-  }
-  return null
-}

package/studio/server/api/domain.ts

@@ -1,59 +0,0 @@
-import type { DomainHandle } from '../domain'
-import type { DomainRouteContext, Notify } from './http'
-
-/** Domain-scoped route composition and the multipart/JSON body boundary. */
-import { handleAgentRoute } from '../agent/routes'
-import { handleCanvasRoute } from './canvas'
-import { handleCommentRoute } from './comments'
-import { handleContextRoute } from './context'
-import { handleDeploymentRoute } from './deployment'
-import { handleDocumentMutation, handleDocumentTransport } from './documents'
-import { notFound } from './http'
-import { handleProjectRoute } from './project'
-import { handleSchemaRoute } from './schema'
-import { handleViewRoute } from './views'
-
-export async function handleDomainRoute(input: {
-  req: Request
-  url: URL
-  rest: string
-  handle: DomainHandle
-  notify: Notify
-}): Promise<Response> {
-  const { req, url, rest, handle, notify } = input
-
-  const documentTransport = await handleDocumentTransport(req, rest, handle.root)
-  if (documentTransport) return documentTransport
-
-  const body = req.method === 'POST' ? await req.json().catch(() => ({})) : {}
-  const context: DomainRouteContext = { req, url, rest, body, handle, notify }
-
-  const documentMutation = handleDocumentMutation(context)
-  if (documentMutation) return documentMutation
-
-  const schema = await handleSchemaRoute(context)
-  if (schema) return schema
-
-  const deployment = await handleDeploymentRoute(context)
-  if (deployment) return deployment
-
-  const view = await handleViewRoute(context)
-  if (view) return view
-
-  const comment = await handleCommentRoute(context)
-  if (comment) return comment
-
-  const agent = await handleAgentRoute({ req, url, rest, body, handle, notify })
-  if (agent) return agent
-
-  const contextResponse = await handleContextRoute(context)
-  if (contextResponse) return contextResponse
-
-  const project = await handleProjectRoute(context)
-  if (project) return project
-
-  const canvas = await handleCanvasRoute(context)
-  if (canvas) return canvas
-
-  return notFound()
-}

package/studio/server/api/http.ts

@@ -1,45 +0,0 @@
-/** Internal HTTP contract shared by Studio API route modules. */
-import type { StudioEvent } from '../../shared/types'
-import type { DomainHandle } from '../domain'
-
-export type Notify = (event: StudioEvent) => void
-
-export interface DomainRouteContext {
-  req: Request
-  url: URL
-  rest: string
-  body: any
-  handle: DomainHandle
-  notify: Notify
-}
-
-export function json(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-}
-
-export const notFound = () => json({ error: 'not found' }, 404)
-export const badRequest = (message: string) => json({ error: message }, 400)
-
-/**
- * Block cross-site state-changing requests. Same-origin browser requests and
- * non-browser clients without Origin/Sec-Fetch-Site remain allowed.
- */
-export function crossSiteBlocked(req: Request, url: URL): boolean {
-  if (req.method === 'GET' || req.method === 'HEAD') return false
-  const site = req.headers.get('sec-fetch-site')
-  if (site) return !(site === 'same-origin' || site === 'none')
-  const origin = req.headers.get('origin')
-  if (origin) {
-    try {
-      // Same-origin includes the scheme as well as host and effective port.
-      // Comparing only `host` would accept an HTTPS origin for an HTTP Studio.
-      return new URL(origin).origin !== url.origin
-    } catch {
-      return true
-    }
-  }
-  return false
-}

package/studio/server/api/project.ts

@@ -1,57 +0,0 @@
-/** Domain project configuration routes: integrations, settings, and env files. */
-import { getAnatomy, invalidate } from '../cache'
-import { isEnvName, readEnvModel, writeEnvUpdates } from '../environment/files'
-import { deleteIntegration, readIntegrations, upsertIntegration } from '../state/integrations'
-import { readSettings, updateSettings } from '../state/settings'
-import { badRequest, json, type DomainRouteContext } from './http'
-
-export async function handleProjectRoute(context: DomainRouteContext): Promise<Response | null> {
-  const { req, url, rest, body, handle, notify } = context
-  const id = handle.id
-  const root = handle.root
-
-  if (rest === '/integrations') {
-    const detected = (await getAnatomy(id))?.detectedIntegrations ?? []
-    if (req.method === 'GET') return json(readIntegrations(root, detected))
-    if (body.action === 'upsert') return json(upsertIntegration(root, body))
-    if (body.action === 'delete') return json({ ok: deleteIntegration(root, body.id) })
-    return badRequest('unknown integrations action')
-  }
-
-  if (rest === '/settings') {
-    if (req.method === 'GET') return json(readSettings(root))
-    if (body.action === 'update') {
-      const next = updateSettings(root, body.settings ?? {})
-      invalidate(id, 'anatomy')
-      notify({ type: 'anatomy-diff', domainId: id })
-      return json(next)
-    }
-    return badRequest('unknown settings action')
-  }
-
-  if (rest === '/env') {
-    const envName = req.method === 'GET' ? url.searchParams.get('env') : body.env
-    if (!isEnvName(envName)) return badRequest('env must be "dev" or "prod"')
-    if (req.method === 'GET') return json(readEnvModel(root, envName))
-    if (req.method === 'POST') {
-      if (!body.updates || typeof body.updates !== 'object') {
-        return badRequest('updates object required')
-      }
-      const updates: Record<string, string | null> = {}
-      for (const [key, value] of Object.entries(body.updates as Record<string, unknown>)) {
-        if (!/^[A-Za-z_]\w*$/.test(key)) continue
-        updates[key] = value === null ? null : String(value)
-      }
-      try {
-        const model = writeEnvUpdates(root, envName, updates)
-        notify({ type: 'anatomy-diff', domainId: id })
-        return json(model)
-      } catch (error: any) {
-        return badRequest(String(error?.message ?? error))
-      }
-    }
-    return badRequest('GET or POST')
-  }
-
-  return null
-}

package/studio/server/api/schema.ts

@@ -1,12 +0,0 @@
-/** Canonical schema, anatomy, and genesis inspection routes. */
-import { getAnatomy, getBundle, getCore } from '../cache'
-import { json, type DomainRouteContext } from './http'
-
-export async function handleSchemaRoute(context: DomainRouteContext): Promise<Response | null> {
-  const { rest, url, handle } = context
-  const fresh = url.searchParams.has('fresh')
-  if (rest === '/bundle') return json(await getBundle(handle.id, fresh))
-  if (rest === '/anatomy') return json(await getAnatomy(handle.id, fresh))
-  if (rest === '/core') return json(await getCore(handle.id, fresh))
-  return null
-}

package/studio/server/api/views.ts

@@ -1,57 +0,0 @@
-/** CLI-resolved View target discovery and Shell session routes. */
-import { getAnatomy, getBundle } from '../cache'
-import { readSettings } from '../state/settings'
-import { getViewRuntime } from '../views/runtime'
-import { closeViewSession, launchViewSession } from '../views/session'
-import { badRequest, json, notFound, type DomainRouteContext } from './http'
-
-const VALID_SLUG = /^[a-z][a-z0-9-]*$/
-
-export async function handleViewRoute(context: DomainRouteContext): Promise<Response | null> {
-  const { req, rest, body, handle } = context
-  const id = handle.id
-  const root = handle.root
-
-  if (rest === '/views/sessions/close' && req.method === 'POST') {
-    return json(await closeViewSession(String(body.sessionId ?? '')))
-  }
-
-  const runtimeMatch = rest.match(/^\/views\/([^/]+)\/runtime$/)
-  if (runtimeMatch && req.method === 'GET') {
-    const slug = decodeURIComponent(runtimeMatch[1])
-    if (!VALID_SLUG.test(slug)) return badRequest('invalid view slug')
-    const anatomy = await getAnatomy(id)
-    const view = anatomy?.views.find((candidate) => candidate.slug === slug)
-    if (!view) return notFound()
-    const bundle = await getBundle(id)
-    const origin = bundle?.overlay.origin || anatomy?.overview.origin
-    if (!origin) return badRequest('domain origin is unavailable')
-    return json(
-      await getViewRuntime(root, origin, view, bundle, readSettings(root).viewProbeTimeoutMs),
-    )
-  }
-
-  const sessionMatch = rest.match(/^\/views\/([^/]+)\/session$/)
-  if (sessionMatch && req.method === 'POST') {
-    const slug = decodeURIComponent(sessionMatch[1])
-    if (!VALID_SLUG.test(slug)) return badRequest('invalid view slug')
-    const anatomy = await getAnatomy(id)
-    const view = anatomy?.views.find((candidate) => candidate.slug === slug)
-    if (!view) return notFound()
-    const bundle = await getBundle(id)
-    const origin = bundle?.overlay.origin || anatomy?.overview.origin
-    if (!origin) return badRequest('domain origin is unavailable')
-    return json(
-      await launchViewSession(
-        root,
-        origin,
-        view,
-        bundle,
-        body,
-        readSettings(root).viewProbeTimeoutMs,
-      ),
-    )
-  }
-
-  return null
-}

package/studio/server/api/workspace.ts

@@ -1,60 +0,0 @@
-/** Workspace-wide routes that do not require a DomainHandle. */
-import { getBundle } from '../cache'
-import { allDomains, depsInstalled } from '../domain'
-import { activeInstanceName, listInstances, setActiveInstance } from '../instances/active'
-import { buildCatalog } from '../workspace/catalog'
-import { createDomain } from '../workspace/create'
-import { detectGit } from '../workspace/git'
-import { badRequest, json, type Notify } from './http'
-
-export async function handleWorkspaceRoute(
-  req: Request,
-  path: string,
-  notify: Notify,
-): Promise<Response | null> {
-  if (path === '/api/workspace') {
-    const domains = await Promise.all(
-      allDomains().map(async (handle) => {
-        const bundle = await getBundle(handle.id)
-        return {
-          id: handle.id,
-          origin: bundle?.overlay.origin || handle.origin || handle.id,
-          path: handle.root,
-          schemaDir: handle.schemaDirName,
-          depsInstalled: depsInstalled(handle.root),
-          hasGit: detectGit(handle.root).hasGit,
-          configFile: handle.configFile,
-        }
-      }),
-    )
-    return json(domains)
-  }
-
-  if (path === '/api/workspace/create' && req.method === 'POST') {
-    const body = await req.json().catch(() => ({}))
-    const result = await createDomain(String(body.name ?? ''), await activeInstanceName())
-    if (result.ok) notify({ type: 'workspace', domains: allDomains().map((domain) => domain.id) })
-    return json(result)
-  }
-
-  if (path === '/api/catalog') {
-    return json(
-      buildCatalog(
-        allDomains().map((handle) => ({
-          origin: handle.origin ?? handle.id,
-          id: handle.id,
-        })),
-      ),
-    )
-  }
-
-  if (path === '/api/instances' && req.method === 'GET') return json(await listInstances())
-  if (path === '/api/instances/use' && req.method === 'POST') {
-    const body = await req.json().catch(() => ({}))
-    const name = String(body.name ?? '').trim()
-    if (!name) return badRequest('name is required')
-    return json(await setActiveInstance(name))
-  }
-
-  return null
-}

package/studio/server/api-agent-loadout.test.ts

@@ -1,69 +0,0 @@
-import { afterEach, expect, test } from 'bun:test'
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { setHarnessGateway } from './agent/harness/gateway/config'
-import { getHarness } from './agent/harness/selection'
-import { handleApi } from './api'
-import { registerDomain, unregisterDomain } from './domain'
-
-const roots: string[] = []
-const domainIds: string[] = []
-const originalHarness = process.env.DOMAIN_STUDIO_HARNESS
-let restoreLoadout: (() => void) | undefined
-
-afterEach(() => {
-  restoreLoadout?.()
-  restoreLoadout = undefined
-  if (originalHarness === undefined) delete process.env.DOMAIN_STUDIO_HARNESS
-  else process.env.DOMAIN_STUDIO_HARNESS = originalHarness
-  while (domainIds.length) unregisterDomain(domainIds.pop()!)
-  while (roots.length) rmSync(roots.pop()!, { recursive: true, force: true })
-})
-
-test('loadout fails closed instead of probing ambient Claude when gateway auth fails', async () => {
-  const root = mkdtempSync(join(tmpdir(), 'studio-loadout-gateway-'))
-  roots.push(root)
-  mkdirSync(join(root, 'schema'))
-  writeFileSync(join(root, 'astrale.config.ts'), 'export default {}\n')
-  writeFileSync(join(root, 'application.ts'), 'export default {}\n')
-  writeFileSync(join(root, 'schema/index.ts'), 'export const Test = {}\n')
-  const handle = registerDomain(root)!
-  domainIds.push(handle.id)
-
-  process.env.DOMAIN_STUDIO_HARNESS = 'claude'
-  const harness = getHarness(root)
-  const originalLoadout = harness.loadout
-  let probes = 0
-  harness.loadout = async () => {
-    probes += 1
-    throw new Error('ambient Claude must not be probed')
-  }
-  restoreLoadout = () => {
-    harness.loadout = originalLoadout
-  }
-  setHarnessGateway(root, {
-    scope: 'domain',
-    config: {
-      enabled: true,
-      baseUrl: 'https://gateway.example/v1/models/test',
-      auth: { mode: 'host' },
-    },
-  })
-
-  const url = new URL(`http://127.0.0.1/api/domain/${encodeURIComponent(handle.id)}/agent/loadout`)
-  const response = await handleApi(new Request(url), url, () => {})
-  expect(response?.status).toBe(200)
-  const body = await response!.json()
-  expect(body).toMatchObject({
-    ok: false,
-    tools: [],
-    mcpServers: [],
-    skills: [],
-    agents: [],
-  })
-  expect(body.detail).toContain('model gateway auth failed')
-  expect(body.detail).toContain('no valid host-supplied token')
-  expect(probes).toBe(0)
-})

package/studio/server/api.test.ts

@@ -1,147 +0,0 @@
-import { afterEach, expect, test } from 'bun:test'
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-
-import { handleApi } from './api'
-import { registerDomain, unregisterDomain } from './domain'
-
-const roots: string[] = []
-const domainIds: string[] = []
-
-afterEach(() => {
-  while (domainIds.length) unregisterDomain(domainIds.pop()!)
-  while (roots.length) rmSync(roots.pop()!, { recursive: true, force: true })
-})
-
-function fixture() {
-  const root = mkdtempSync(join(tmpdir(), 'studio-api-contract-'))
-  roots.push(root)
-  mkdirSync(join(root, 'schema'))
-  writeFileSync(join(root, 'astrale.config.ts'), 'export default {}\n')
-  writeFileSync(join(root, 'application.ts'), 'export default {}\n')
-  writeFileSync(join(root, 'schema/index.ts'), 'export const Test = {}\n')
-  const handle = registerDomain(root)!
-  domainIds.push(handle.id)
-  return handle
-}
-
-async function route(path: string, init?: RequestInit) {
-  const url = new URL(`http://127.0.0.1${path}`)
-  return handleApi(new Request(url, init), url, () => {})
-}
-
-test('router ignores non-api paths and returns the stable JSON 404 for unknown API paths', async () => {
-  expect(await route('/assets/app.js')).toBeNull()
-
-  const response = await route('/api/unknown')
-  expect(response?.status).toBe(404)
-  expect(response?.headers.get('content-type')).toBe('application/json')
-  expect(await response?.json()).toEqual({ error: 'not found' })
-})
-
-test('router blocks cross-site mutations before route dispatch but permits same-origin requests', async () => {
-  const blocked = await route('/api/unknown', {
-    method: 'POST',
-    headers: { origin: 'https://malicious.example' },
-  })
-  expect(blocked?.status).toBe(403)
-  expect(await blocked?.json()).toEqual({ error: 'cross-site request blocked' })
-
-  const sameOrigin = await route('/api/unknown', {
-    method: 'POST',
-    headers: { origin: 'http://127.0.0.1' },
-  })
-  expect(sameOrigin?.status).toBe(404)
-})
-
-test('cross-site protection compares the complete origin and leaves mutation state unchanged', async () => {
-  const handle = fixture()
-  const contextPath = `/api/domain/${encodeURIComponent(handle.id)}/context`
-  const mutation = {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      // The host matches Studio, but the scheme does not: this is not same-origin.
-      origin: 'https://127.0.0.1',
-    },
-    body: JSON.stringify({ action: 'add', title: 'Injected', body: 'Must not persist' }),
-  }
-
-  const blocked = await route(contextPath, mutation)
-  expect(blocked?.status).toBe(403)
-  expect(await blocked?.json()).toEqual({ error: 'cross-site request blocked' })
-
-  const wrongPort = await route(contextPath, {
-    ...mutation,
-    headers: { ...mutation.headers, origin: 'http://127.0.0.1:3000' },
-  })
-  expect(wrongPort?.status).toBe(403)
-
-  const unchanged = await route(contextPath)
-  expect(await unchanged?.json()).toEqual({ user: [], auto: [] })
-
-  const allowed = await route(contextPath, {
-    ...mutation,
-    headers: { ...mutation.headers, origin: 'http://127.0.0.1' },
-  })
-  expect(allowed?.status).toBe(200)
-  const stored = (await (await route(contextPath))?.json()) as { user: unknown[] }
-  expect(stored.user).toHaveLength(1)
-})
-
-test('domain dispatch preserves context success, validation, and unknown-domain responses', async () => {
-  const handle = fixture()
-  const base = `/api/domain/${encodeURIComponent(handle.id)}`
-
-  const context = await route(`${base}/context`)
-  expect(context?.status).toBe(200)
-  expect(await context?.json()).toEqual({ user: [], auto: [] })
-
-  const invalid = await route(`${base}/context`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ action: 'invalid' }),
-  })
-  expect(invalid?.status).toBe(400)
-  expect(await invalid?.json()).toEqual({ error: 'unknown context action' })
-
-  const missing = await route('/api/domain/not-registered/context')
-  expect(missing?.status).toBe(404)
-  expect(await missing?.json()).toEqual({ error: 'not found' })
-})
-
-test('workspace dispatch preserves catalog responses and instance request validation', async () => {
-  const handle = fixture()
-
-  const catalog = await route('/api/catalog')
-  expect(catalog?.status).toBe(200)
-  const origins = (await catalog?.json()).map((entry: { origin: string }) => entry.origin)
-  expect(origins[0]).toBe('kernel.astrale.ai')
-  expect(origins).toContain(handle.id)
-
-  const invalidInstance = await route('/api/instances/use', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ name: '   ' }),
-  })
-  expect(invalidInstance?.status).toBe(400)
-  expect(await invalidInstance?.json()).toEqual({ error: 'name is required' })
-})
-
-test('multipart document upload remains ahead of JSON parsing and raw download keeps its media type', async () => {
-  const handle = fixture()
-  const base = `/api/domain/${encodeURIComponent(handle.id)}`
-  const form = new FormData()
-  form.append('files', new File(['contract body'], 'contract.txt', { type: 'text/plain' }))
-
-  const uploaded = await route(`${base}/context/documents`, { method: 'POST', body: form })
-  expect(uploaded?.status).toBe(200)
-  const documents = (await uploaded?.json()) as Array<{ id: string; type: string }>
-  expect(documents).toHaveLength(1)
-
-  const raw = await route(`${base}/context/documents/${encodeURIComponent(documents[0]!.id)}/raw`)
-  expect(raw?.status).toBe(200)
-  expect(raw?.headers.get('content-type')).toBe('text/plain;charset=utf-8')
-  expect(await raw?.text()).toBe('contract body')
-})

package/studio/server/api.ts

@@ -1,34 +0,0 @@
-/**
- * Studio JSON API composition root. It owns only the public `/api/` boundary,
- * cross-site mutation guard, workspace-vs-domain addressing, and final 404.
- * Capability modules under `api/` own the route implementations.
- */
-import { handleDomainRoute } from './api/domain'
-import { crossSiteBlocked, json, notFound, type Notify } from './api/http'
-import { handleWorkspaceRoute } from './api/workspace'
-import { getDomain } from './domain'
-
-export type { Notify } from './api/http'
-
-export async function handleApi(req: Request, url: URL, notify: Notify): Promise<Response | null> {
-  const path = url.pathname
-  if (!path.startsWith('/api/')) return null
-  if (crossSiteBlocked(req, url)) return json({ error: 'cross-site request blocked' }, 403)
-
-  const workspace = await handleWorkspaceRoute(req, path, notify)
-  if (workspace) return workspace
-
-  const match = path.match(/^\/api\/domain\/([^/]+)(\/.*)?$/)
-  if (!match) return notFound()
-  const id = decodeURIComponent(match[1])
-  const handle = getDomain(id)
-  if (!handle) return notFound()
-
-  return handleDomainRoute({
-    req,
-    url,
-    rest: match[2] ?? '',
-    handle,
-    notify,
-  })
-}