@autobe/agent 0.18.0 → 0.19.1

package/src/orchestrate/realize/histories/transformRealizeCorrectHistories.ts

@@ -5,6 +5,7 @@ import {
 } from "@autobe/interface";
 import { v4 } from "uuid";
 
+import { AutoBeSystemPromptConstant } from "../../../constants/AutoBeSystemPromptConstant";
 import { AutoBeState } from "../../../context/AutoBeState";
 import { IAutoBeTestScenarioArtifacts } from "../../test/structures/IAutoBeTestScenarioArtifacts";
 import { IAutoBeRealizeScenarioApplication } from "../structures/IAutoBeRealizeScenarioApplication";
@@ -15,6 +16,7 @@ export function transformRealizeCorrectHistories(props: {
   scenario: IAutoBeRealizeScenarioApplication.IProps;
   artifacts: IAutoBeTestScenarioArtifacts;
   authorization: AutoBeRealizeAuthorization | null;
+  totalAuthorizations: AutoBeRealizeAuthorization[];
   code: string;
   diagnostic: IAutoBeTypeScriptCompileResult.IDiagnostic;
 }): Array<
@@ -32,7 +34,7 @@ export function transformRealizeCorrectHistories(props: {
         "```",
         `The code has a compilation error:`,
         "```json",
-        JSON.stringify(props.diagnostic, null, 2),
+        JSON.stringify(props.diagnostic),
         "",
       ].join("\n"),
       created_at: new Date().toISOString(),
@@ -40,7 +42,7 @@ export function transformRealizeCorrectHistories(props: {
     {
       id: v4(),
       type: "systemMessage",
-      text: `You are an expert TypeScript developer. You will review the code and correct`,
+      text: AutoBeSystemPromptConstant.REALIZE_CORRECT,
       created_at: new Date().toISOString(),
     },
   ];

package/src/orchestrate/realize/histories/transformRealizeWriteAuthorizationsHistories.ts

@@ -0,0 +1,285 @@
+import { IAgenticaHistoryJson } from "@agentica/core";
+import { AutoBeOpenApi } from "@autobe/interface";
+import { StringUtil } from "@autobe/utils";
+import { v4 } from "uuid";
+
+export const transformRealizeWriteAuthorizationsHistories = (
+  operation: AutoBeOpenApi.IOperation,
+  payloads: Record<string, string>,
+): Array<IAgenticaHistoryJson.ISystemMessage> => {
+  // Login operation 가이드
+  const loginGuide =
+    operation.authorizationType === "login"
+      ? [
+          {
+            id: v4(),
+            created_at: new Date().toISOString(),
+            type: "systemMessage" as const,
+            text: StringUtil.trim`
+              # Authorization Type: Login
+
+              This is a **login** operation that authenticates users.
+
+              ## Implementation Guidelines for Login:
+
+              ### Login Operation Requirements
+              - This is a login endpoint that authenticates users
+              - Must validate credentials (username/email and password)
+              - Should return authentication tokens (access and refresh tokens)
+              - Must NOT require authentication decorator (this endpoint creates authentication)
+              - Should check if user exists and password matches
+
+              ### MANDATORY: Use MyGlobal.password for Password Verification
+              
+              **CRITICAL**: You MUST use MyGlobal.password utilities for password verification to ensure consistency with the join operation:
+
+              \`\`\`typescript
+              // Example: Password verification in login
+              const isValid = await MyGlobal.password.verify(
+                body.password,           // plain password from request
+                user.password_hash       // hashed password from database
+              );
+              
+              if (!isValid) {
+                throw new Error("Invalid credentials");
+              }
+              \`\`\`
+
+              ### JWT Token Generation
+              
+              **NOTE**: The jsonwebtoken library is automatically imported as jwt. Use it to generate tokens with the EXACT payload structure:
+
+              **CRITICAL**: Use the predefined payload structures for consistency:
+              ${JSON.stringify(payloads)}
+
+              // JWT is already imported: import jwt from "jsonwebtoken";
+              
+              // Generate access token with the EXACT payload structure for the user type
+              // DO NOT use type annotations like: const payload: MemberPayload = {...}
+              // Just create the payload object directly
+              
+              const accessToken = jwt.sign(
+                {
+                  userId: user.id,
+                  email: user.email,
+                  // ... other required fields from the payload structure above
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '1h',
+                  issuer: 'autobe'  // MUST use 'autobe' as issuer
+                }
+              );
+
+              // Generate refresh token (optional)
+              const refreshToken = jwt.sign(
+                {
+                  userId: user.id,
+                  tokenType: 'refresh'
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '7d',
+                  issuer: 'autobe'  // MUST use 'autobe' as issuer
+                }
+              );
+
+              // Decode tokens if needed (e.g., for verification)
+              const decoded = jwt.verify(token, MyGlobal.env.JWT_SECRET_KEY, {
+                issuer: 'autobe'  // Verify issuer is 'autobe'
+              });
+
+              **DO NOT**:
+              - Implement your own password hashing logic
+              - Use bcrypt, argon2, or any other hashing library directly
+              - Try to hash and compare manually
+
+              **IMPORTANT**: Since this is a login operation, it must be publicly accessible without authentication.
+            `,
+          },
+        ]
+      : [];
+
+  // Join (registration) operation 가이드
+  const joinGuide =
+    operation.authorizationType === "join"
+      ? [
+          {
+            id: v4(),
+            created_at: new Date().toISOString(),
+            type: "systemMessage" as const,
+            text: StringUtil.trim`
+              # Authorization Type: Join (Registration)
+
+              This is a **join** operation for user registration.
+
+              ## Implementation Guidelines for Join:
+
+              ### Join (Registration) Operation Requirements
+              - This is a user registration endpoint
+              - Must validate all required user information
+              - Should check for duplicate accounts (email, username, etc.)
+              - Must hash passwords before storing (NEVER store plain passwords)
+              - Should create a new user record in the database
+              - Must NOT require authentication decorator (public endpoint)
+
+              ### MANDATORY: Use MyGlobal.password for Password Hashing
+              
+              **CRITICAL**: You MUST use MyGlobal.password utilities for password hashing to ensure consistency across all authentication operations:
+
+              \`\`\`typescript
+              // Example: Password hashing in join/registration
+              const hashedPassword = await MyGlobal.password.hash(body.password);
+              
+              // Store the hashed password in database
+              await MyGlobal.prisma.users.create({
+                data: {
+                  email: body.email,
+                  password_hash: hashedPassword,  // Store the hash, never plain password
+                  // ... other fields
+                }
+              });
+              \`\`\`
+
+              **DO NOT**:
+              - Store plain passwords in the database
+              - Use bcrypt, argon2, or any other hashing library directly
+              - Implement your own hashing logic
+
+              ### JWT Token Generation After Registration
+              
+              **NOTE**: The jsonwebtoken library is automatically imported as jwt. After successful registration, generate tokens with the EXACT payload structure:
+
+              **CRITICAL**: Use the predefined payload structures for consistency:
+              ${JSON.stringify(payloads)}
+
+              // JWT is already imported: import jwt from "jsonwebtoken";
+              
+              // After creating the user, generate tokens with EXACT payload structure
+              // DO NOT use type annotations like: const payload: UserPayload = {...}
+              // Just create the payload object directly in jwt.sign()
+              
+              const accessToken = jwt.sign(
+                {
+                  userId: newUser.id,
+                  email: newUser.email,
+                  // ... other required fields from the payload structure above
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '1h',
+                  issuer: 'autobe'  // MUST use 'autobe' as issuer
+                }
+              );
+
+              const refreshToken = jwt.sign(
+                {
+                  userId: newUser.id,
+                  tokenType: 'refresh'
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '7d',
+                  issuer: 'autobe'  // MUST use 'autobe' as issuer
+                }
+              );
+
+              **IMPORTANT**: Since this is a registration operation, it must be publicly accessible. Always hash passwords before storing.
+            `,
+          },
+        ]
+      : [];
+
+  // Refresh token operation 가이드
+  const refreshGuide =
+    operation.authorizationType === "refresh"
+      ? [
+          {
+            id: v4(),
+            created_at: new Date().toISOString(),
+            type: "systemMessage" as const,
+            text: StringUtil.trim`
+              # Authorization Type: Refresh Token
+
+              This is a **refresh** token operation for renewing expired access tokens.
+
+              ## Implementation Guidelines for Refresh:
+
+              ### Refresh Token Operation Requirements
+              - This endpoint refreshes expired access tokens
+              - Must validate the refresh token first
+              - Should check if refresh token is not expired or revoked
+              - Must generate a new access token with THE SAME payload structure
+              - May also rotate the refresh token for security
+              - Should handle invalid/expired refresh tokens gracefully
+              - Typically requires the refresh token in request body or headers
+              - Must NOT require standard authentication (uses refresh token instead)
+
+              ### CRITICAL: Refresh Token Implementation
+
+              **IMPORTANT**: When refreshing tokens, you MUST:
+              1. Decode and verify the refresh token
+              2. Extract the user information from the decoded token
+              3. Generate a new access token with THE SAME payload structure as the original
+
+              **CRITICAL**: Use the predefined payload structures for consistency:
+              ${JSON.stringify(payloads)}
+
+              // JWT is already imported: import jwt from "jsonwebtoken";
+              
+              // Step 1: Verify and decode the refresh token
+              const decoded = jwt.verify(body.refreshToken, MyGlobal.env.JWT_SECRET_KEY, {
+                issuer: 'autobe'
+              });
+              
+              // Step 2: Get user data (from decoded token or database)
+              const user = await MyGlobal.prisma.users.findUnique({
+                where: { id: decoded.userId }
+              });
+              
+              if (!user) {
+                throw new Error("User not found");
+              }
+              
+              // Step 3: Generate new access token with SAME payload structure as login/join
+              const newAccessToken = jwt.sign(
+                {
+                  userId: user.id,
+                  email: user.email,
+                  // ... other required fields from the payload structure above
+                  // MUST match the structure used in login/join operations
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '1h',
+                  issuer: 'autobe'
+                }
+              );
+              
+              // Optional: Rotate refresh token
+              const newRefreshToken = jwt.sign(
+                {
+                  userId: user.id,
+                  tokenType: 'refresh'
+                },
+                MyGlobal.env.JWT_SECRET_KEY,
+                {
+                  expiresIn: '7d',
+                  issuer: 'autobe'
+                }
+              );
+
+              **DO NOT**:
+              - Generate new access tokens with different payload structures
+              - Use random IDs like v4() in the payload
+              - Create tokens without verifying the refresh token first
+              - Use type annotations like: const payload: UserPayload = {...}
+
+              **IMPORTANT**: The new access token MUST have the same payload structure as the original token from login/join operations.
+            `,
+          },
+        ]
+      : [];
+
+  return [...loginGuide, ...joinGuide, ...refreshGuide];
+};

package/src/orchestrate/realize/histories/transformRealizeWriteHistories.ts

@@ -6,15 +6,20 @@ import { AutoBeSystemPromptConstant } from "../../../constants/AutoBeSystemPromp
 import { AutoBeState } from "../../../context/AutoBeState";
 import { IAutoBeTestScenarioArtifacts } from "../../test/structures/IAutoBeTestScenarioArtifacts";
 import { IAutoBeRealizeScenarioApplication } from "../structures/IAutoBeRealizeScenarioApplication";
+import { transformRealizeWriteAuthorizationsHistories } from "./transformRealizeWriteAuthorizationsHistories";
 
-export const transformRealizeWriteHistories = (props: {
-  state: AutoBeState;
-  scenario: IAutoBeRealizeScenarioApplication.IProps;
-  artifacts: IAutoBeTestScenarioArtifacts;
-  authorization: AutoBeRealizeAuthorization | null;
-}): Array<
+export const transformRealizeWriteHistories = (
+  props: IProps,
+): Array<
   IAgenticaHistoryJson.IAssistantMessage | IAgenticaHistoryJson.ISystemMessage
 > => {
+  const payloads = Object.fromEntries(
+    props.totalAuthorizations.map((el) => [
+      el.payload.location,
+      el.payload.content,
+    ]),
+  );
+
   const [operation] = props.artifacts.document.operations;
 
   const propsFields: string[] = [];
@@ -113,18 +118,24 @@ export const transformRealizeWriteHistories = (props: {
       },
     ];
 
+  // Get authorization-specific histories if authorizationType is set
+  const authorizationHistories = operation.authorizationType
+    ? transformRealizeWriteAuthorizationsHistories(operation, payloads)
+    : [];
+
   return [
     {
       id: v4(),
       created_at: new Date().toISOString(),
       type: "systemMessage",
-      text: AutoBeSystemPromptConstant.REALIZE_CODER_TOTAL,
+      text: AutoBeSystemPromptConstant.REALIZE_WRITE_TOTAL,
     },
+    ...authorizationHistories,
     {
       id: v4(),
       created_at: new Date().toISOString(),
       type: "systemMessage",
-      text: AutoBeSystemPromptConstant.REALIZE_CODER_ARTIFACT.replaceAll(
+      text: AutoBeSystemPromptConstant.REALIZE_WRITE_ARTIFACT.replaceAll(
         `{prisma_schemas}`,
         JSON.stringify(props.state.prisma.schemas),
       )
@@ -132,7 +143,6 @@ export const transformRealizeWriteHistories = (props: {
         .replaceAll(`{artifacts_dto}`, JSON.stringify(props.artifacts.dto))
         .replaceAll(`{input}`, input),
     },
-
     {
       id: v4(),
       created_at: new Date().toISOString(),
@@ -162,23 +172,13 @@ export const transformRealizeWriteHistories = (props: {
         `I'll make sure to follow all these rules strictly. Let’s proceed with this in mind.`,
       ].join("\n"),
     },
-    {
-      id: v4(),
-      created_at: new Date().toISOString(),
-      type: "assistantMessage",
-      text: [
-        `I understand your request.`,
-        ``,
-        `To summarize:`,
-        `- I must **never use the native \`Date\` type** in any code or type definitions.`,
-        `- Instead, all date and datetime values must be handled as \`string & tags.Format<'date-time'>\`.`,
-        `- This rule is **strict** and applies everywhere, including domain types, API inputs/outputs, and Prisma models.`,
-        `- Even if a library or tool returns a \`Date\`, I must convert it to the correct string format before use.`,
-        ``,
-        `Especially regarding the \`Date\` type: I understand that using it can lead to type inconsistency and runtime issues, so I will completely avoid it in all circumstances.`,
-        ``,
-        `I'll make sure to follow all these rules strictly. Let’s proceed with this in mind.`,
-      ].join("\n"),
-    },
   ];
 };
+
+interface IProps {
+  state: AutoBeState;
+  scenario: IAutoBeRealizeScenarioApplication.IProps;
+  artifacts: IAutoBeTestScenarioArtifacts;
+  authorization: AutoBeRealizeAuthorization | null;
+  totalAuthorizations: AutoBeRealizeAuthorization[];
+}

package/src/orchestrate/realize/internal/compile.ts

@@ -1,47 +1,53 @@
 import {
   AutoBeRealizeAuthorization,
+  AutoBeRealizeFunction,
   AutoBeRealizeValidateEvent,
   IAutoBeTypeScriptCompileResult,
 } from "@autobe/interface";
 import { ILlmSchema } from "@samchon/openapi";
 
 import { AutoBeContext } from "../../../context/AutoBeContext";
-import { IAutoBeRealizeCompile } from "../structures/IAutoBeRealizeCompile";
 
 export async function compile<Model extends ILlmSchema.Model>(
   ctx: AutoBeContext<Model>,
   props: {
     authorizations: AutoBeRealizeAuthorization[];
-    providers: Record<string, string>;
+    functions: AutoBeRealizeFunction[];
   },
-): Promise<
-  IAutoBeTypeScriptCompileResult.ISuccess | AutoBeRealizeValidateEvent
-> {
+): Promise<IAutoBeTypeScriptCompileResult> {
   const prisma = ctx.state().prisma?.compiled;
   const payloads: Record<string, string> = Object.fromEntries(
     props.authorizations.map((el) => [el.payload.location, el.payload.content]),
   );
-  const templateFiles = await getTemplates(ctx);
-  const nodeModules = prisma?.type === "success" ? prisma.nodeModules : {};
   const compiler = await ctx.compiler();
-  const compiled = await compiler.typescript.compile({
-    files: {
-      ...nodeModules,
-      ...payloads,
-      ...Object.fromEntries(
-        Object.entries(await ctx.files({ dbms: "sqlite" })).filter(([key]) =>
-          key.startsWith("src"),
-        ),
-      ),
-      ...Object.fromEntries(
-        templateFiles.map((file) => [file.location, file.content]),
+  const templateFiles = await compiler.realize.getTemplate();
+  const nodeModules = prisma?.type === "success" ? prisma.nodeModules : {};
+
+  const filterTsFiles = (location: string) => location.endsWith(".ts");
+
+  const files: Record<string, string> = {
+    ...nodeModules,
+    ...payloads,
+    ...Object.fromEntries(
+      Object.entries(await ctx.files({ dbms: "sqlite" })).filter(([key]) =>
+        filterTsFiles(key),
       ),
-      ...props.providers,
-    },
+    ),
+    ...Object.fromEntries(
+      Object.entries(templateFiles).filter(([key]) => filterTsFiles(key)),
+    ),
+    ...Object.fromEntries(
+      props.functions.map((el) => [el.location, el.content]),
+    ),
+  };
+
+  const compiled = await compiler.typescript.compile({
+    files: files,
   });
 
   if (compiled.type === "success") {
     return compiled;
+  } else if (compiled.type === "failure") {
   }
 
   const event: AutoBeRealizeValidateEvent = {
@@ -55,30 +61,7 @@ export async function compile<Model extends ILlmSchema.Model>(
     step: ctx.state().analyze?.step ?? 0,
     created_at: new Date().toISOString(),
   };
+  ctx.dispatch(event);
 
-  return event;
-}
-
-/**
- * Loads template files for the realize agent These files are essential for the
- * realize coder to pass compilation
- *
- * @param ctx Context of agent
- * @returns Template file infomations
- */
-async function getTemplates<Model extends ILlmSchema.Model>(
-  ctx: AutoBeContext<Model>,
-): Promise<IAutoBeRealizeCompile.CodeArtifact[]> {
-  const compiler = await ctx.compiler();
-  const templateFiles = await compiler.realize.getTemplate();
-  const pathnames = ["src/MyGlobal.ts", "src/util/toISOStringSafe.ts"] as const;
-
-  return pathnames.map((pathname): IAutoBeRealizeCompile.CodeArtifact => {
-    return {
-      content: templateFiles[pathname],
-      result: "success",
-      location: pathname,
-      role: null, // template files doesn't have role.
-    } as const;
-  });
+  return compiled;
 }