@bpmnkit/proxy 0.0.16 → 0.0.21

package/dist/index.js

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import http from "node:http";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, extname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Bpmn, expand, optimize } from "@bpmnkit/core";
+import { Bpmn, applyOperations, compactify, expand, optimize } from "@bpmnkit/core";
 import { createClientFromProfile } from "@bpmnkit/profiles";
 import { getActiveName, getActiveProfile, getAuthHeader, getProfile, listProfiles, } from "@bpmnkit/profiles";
 import * as claude from "./adapters/claude.js";
 import * as copilot from "./adapters/copilot.js";
 import * as gemini from "./adapters/gemini.js";
-import { buildIncidentSystemPrompt, buildIncidentUserMessage, buildMcpExplainPrompt, buildMcpImprovePrompt, buildMcpSystemPrompt, buildOperateChatSystemPrompt, buildSearchSystemPrompt, buildSystemPrompt, } from "./prompt.js";
+import { buildImproveSystemPrompt, buildImproveUserMessage, buildIncidentSystemPrompt, buildIncidentUserMessage, buildMcpExplainPrompt, buildMcpImprovePrompt, buildMcpSystemPrompt, buildOperateChatSystemPrompt, buildSearchSystemPrompt, buildSystemPrompt, } from "./prompt.js";
+import { handleDeleteRunHistory, handleGetRunHistory, handleGetRunHistoryDetail, handleRerunHistory, matchRerunHistoryRoute, matchRunHistoryRoute, } from "./routes/run-history.js";
+import { handleWebhook, matchWebhookRoute, startTriggers } from "./triggers/index.js";
+import { WORKER_TEMPLATES } from "./worker-templates.js";
+import { startWorkerDaemon, workerState } from "./worker.js";
 const PORT = process.env.AI_SERVER_PORT ? Number(process.env.AI_SERVER_PORT) : 3033;
 // Resolve the compiled mcp-server entry point relative to this file.
 // When bundled as bundle.cjs, import.meta.url ends with .cjs → use mcp-server.cjs.
@@ -62,9 +66,132 @@ function extractCompactDiagram(text) {
     }
     return null;
 }
+/**
+ * Extract a BpmnOperation[] from LLM text output.
+ * Looks for the first ```json block containing a JSON array.
+ */
+function extractOperations(text) {
+    const match = /```json\s*\n([\s\S]*?)\n```/.exec(text);
+    if (!match?.[1])
+        return null;
+    try {
+        const parsed = JSON.parse(match[1]);
+        if (Array.isArray(parsed))
+            return parsed;
+    }
+    catch {
+        /* invalid JSON */
+    }
+    return null;
+}
+// ── File System helpers ───────────────────────────────────────────────────────
+const SUPPORTED_EXTS = new Set([".bpmn", ".dmn", ".form", ".md"]);
+/** Expand a leading `~` to the user's home directory. */
+function expandHome(p) {
+    if (p === "~" || p.startsWith("~/"))
+        return homedir() + p.slice(1);
+    return p;
+}
+/** Reject any path that escapes the root via `..` or is outside it. */
+function fsValidate(root, target) {
+    const normRoot = root.endsWith(sep) ? root : root + sep;
+    const normTarget = target + (statSync(target, { throwIfNoEntry: false })?.isDirectory() ? sep : "");
+    return (!target.includes("..") &&
+        (target === root || target.startsWith(normRoot) || normTarget.startsWith(normRoot)));
+}
+function sidecarPath(filePath) {
+    return join(dirname(filePath), ".bpmnkit", `${basename(filePath)}.meta.json`);
+}
+function readMeta(filePath) {
+    const sp = sidecarPath(filePath);
+    try {
+        if (!existsSync(sp))
+            return null;
+        return JSON.parse(readFileSync(sp, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeMeta(filePath, meta) {
+    const sp = sidecarPath(filePath);
+    const dir = dirname(sp);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(sp, JSON.stringify(meta, null, 2), "utf8");
+}
+function buildTree(root, dir) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    }
+    catch {
+        return [];
+    }
+    const result = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        const abs = join(dir, entry.name);
+        const rel = relative(root, abs);
+        if (entry.isDirectory()) {
+            result.push({
+                name: entry.name,
+                relativePath: rel,
+                type: "dir",
+                children: buildTree(root, abs),
+            });
+        }
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            if (!SUPPORTED_EXTS.has(ext))
+                continue;
+            const fileType = ext.slice(1);
+            result.push({ name: entry.name, relativePath: rel, type: "file", fileType });
+        }
+    }
+    return result;
+}
+function collectFiles(root, dir) {
+    const results = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            results.push(...collectFiles(root, abs));
+        }
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            if (!SUPPORTED_EXTS.has(ext))
+                continue;
+            const rel = relative(root, abs);
+            const fileType = ext.slice(1);
+            let content = "";
+            try {
+                content = readFileSync(abs, "utf8");
+            }
+            catch {
+                /* skip unreadable files */
+            }
+            const meta = readMeta(abs);
+            const nameNoExt = basename(entry.name, extname(entry.name));
+            results.push({ relativePath: rel, name: nameNoExt, absPath: abs, fileType, content, meta });
+        }
+    }
+    return results;
+}
+// ─────────────────────────────────────────────────────────────────────────────
 const server = http.createServer(async (req, res) => {
     res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
     res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-Profile");
     if (req.method === "OPTIONS") {
         res.writeHead(204);
@@ -78,7 +205,48 @@ const server = http.createServer(async (req, res) => {
         const names = available.map((a) => a.name);
         console.log(`[server] /status → available: [${names.join(", ")}]`);
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ready: available.length > 0, backend: names[0] ?? null, available: names }));
+        res.end(JSON.stringify({
+            ready: available.length > 0,
+            backend: names[0] ?? null,
+            available: names,
+            workers: {
+                active: workerState.active,
+                jobTypes: workerState.jobTypes,
+                pollCount: workerState.pollCount,
+                lastError: workerState.lastError,
+            },
+        }));
+        return;
+    }
+    // ── GET /worker-templates — built-in element templates for Studio ────────
+    if (url.pathname === "/worker-templates" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(WORKER_TEMPLATES));
+        return;
+    }
+    // ── Run history routes ────────────────────────────────────────────────────
+    if (url.pathname === "/run-history" && req.method === "GET") {
+        handleGetRunHistory(req, res);
+        return;
+    }
+    if (url.pathname === "/run-history" && req.method === "DELETE") {
+        handleDeleteRunHistory(req, res);
+        return;
+    }
+    const rerunMatch = matchRerunHistoryRoute(req);
+    if (rerunMatch) {
+        await handleRerunHistory(req, res, rerunMatch.id);
+        return;
+    }
+    const runHistoryMatch = matchRunHistoryRoute(req);
+    if (runHistoryMatch && req.method === "GET") {
+        handleGetRunHistoryDetail(req, res, runHistoryMatch.id);
+        return;
+    }
+    // ── POST /webhooks/:processId — webhook trigger ───────────────────────────
+    const webhookMatch = matchWebhookRoute(req);
+    if (webhookMatch) {
+        await handleWebhook(req, res, webhookMatch.processId);
         return;
     }
     if (url.pathname === "/chat" && req.method === "POST") {
@@ -260,6 +428,8 @@ const server = http.createServer(async (req, res) => {
             apiType: p.apiType,
             baseUrl: p.config.baseUrl ?? null,
             authType: p.config.auth?.type ?? "none",
+            description: p.description,
+            tags: p.tags,
         }));
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(payload));
@@ -731,15 +901,136 @@ const server = http.createServer(async (req, res) => {
         res.end(JSON.stringify({ endpoint: finalSpec.endpoint, filter: finalSpec.filter, items, total }));
         return;
     }
+    // ── POST /improve — structured AI-assisted BPMN improvement ─────────────────
+    // Token-efficient alternative to /chat?action=improve.
+    // Phase 1: optimize() auto-fix (no AI). Phase 2: AI outputs BpmnOperation[].
+    // Emits SSE: tokens (explanation) + ops event + xml event + done.
+    if (url.pathname === "/improve" && req.method === "POST") {
+        const body = await readBody(req);
+        let context;
+        let instruction;
+        let backend;
+        try {
+            const parsed = JSON.parse(body);
+            context = parsed.context;
+            instruction = parsed.instruction ?? null;
+            backend = parsed.backend ?? null;
+        }
+        catch {
+            res.writeHead(400);
+            res.end("Bad Request");
+            return;
+        }
+        const available = await detectAll();
+        const detected = backend
+            ? (available.find((a) => a.name === backend) ?? available[0])
+            : available[0];
+        if (!detected) {
+            res.writeHead(503);
+            res.end("No AI CLI available. Install claude, copilot, or gemini.");
+            return;
+        }
+        // ── Phase 1: auto-fix ─────────────────────────────────────────────────
+        let fixedCompact = context;
+        let autoFixCount = 0;
+        try {
+            const defs = expand(context);
+            const report = optimize(defs);
+            const fixable = report.findings
+                .filter((f) => f.applyFix)
+                .sort((a, b) => {
+                const ord = { error: 0, warning: 1, info: 2 };
+                return (ord[a.severity] ?? 2) - (ord[b.severity] ?? 2);
+            });
+            for (const f of fixable)
+                f.applyFix?.(defs);
+            autoFixCount = fixable.length;
+            if (autoFixCount > 0) {
+                fixedCompact = compactify(defs);
+                console.log(`[server] /improve → auto-fixed ${autoFixCount} issue(s)`);
+            }
+        }
+        catch (err) {
+            console.error("[server] /improve auto-fix failed:", String(err));
+        }
+        // ── Phase 2: collect remaining findings ───────────────────────────────
+        const findings = [];
+        try {
+            const remaining = optimize(expand(fixedCompact));
+            for (const f of remaining.findings) {
+                findings.push({
+                    category: f.category,
+                    severity: f.severity,
+                    message: f.message,
+                    suggestion: f.suggestion,
+                    elementIds: f.elementIds,
+                });
+            }
+        }
+        catch {
+            /* non-fatal */
+        }
+        console.log(`[server] /improve → adapter: ${detected.name}, findings: ${findings.length}, autoFix: ${autoFixCount}`);
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+        });
+        // ── Phase 3: AI call — outputs explanation + ```json operations block ─
+        const systemPrompt = buildImproveSystemPrompt();
+        const improveCtx = {
+            compact: fixedCompact,
+            findings,
+            autoFixCount,
+            instruction,
+        };
+        const userMessage = buildImproveUserMessage(improveCtx);
+        const accumulated = [];
+        try {
+            await detected.adapter.stream([{ role: "user", content: userMessage }], systemPrompt, null, (token) => {
+                accumulated.push(token);
+                res.write(`data: ${JSON.stringify({ type: "token", text: token })}\n\n`);
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[server] /improve adapter error: ${msg}`);
+            res.write(`data: ${JSON.stringify({ type: "error", message: msg })}\n\n`);
+            res.write(`data: ${JSON.stringify({ type: "done" })}\n\n`);
+            res.end();
+            return;
+        }
+        // ── Phase 4: parse ops, apply, expand, emit ───────────────────────────
+        const fullText = accumulated.join("");
+        const ops = extractOperations(fullText) ?? [];
+        res.write(`data: ${JSON.stringify({ type: "ops", ops, autoFixCount })}\n\n`);
+        if (ops.length > 0 || autoFixCount > 0) {
+            try {
+                const finalCompact = ops.length > 0 ? applyOperations(fixedCompact, ops) : fixedCompact;
+                const xml = Bpmn.export(expand(finalCompact));
+                res.write(`data: ${JSON.stringify({ type: "xml", xml })}\n\n`);
+                console.log(`[server] /improve → ${ops.length} ops applied, XML emitted`);
+            }
+            catch (err) {
+                console.error("[server] /improve expand failed:", String(err));
+                res.write(`data: ${JSON.stringify({ type: "error", message: `Failed to apply operations: ${String(err)}` })}\n\n`);
+            }
+        }
+        res.write(`data: ${JSON.stringify({ type: "done" })}\n\n`);
+        res.end();
+        return;
+    }
     // ── POST /operate/chat — operations-context AI chat ──────────────────────────
     if (url.pathname === "/operate/chat" && req.method === "POST") {
         const body = await readBody(req);
         let messages;
         let stats;
+        let backend;
         try {
             const parsed = JSON.parse(body);
             messages = parsed.messages;
             stats = parsed.stats ?? null;
+            backend = parsed.backend ?? null;
         }
         catch {
             res.writeHead(400);
@@ -747,7 +1038,9 @@ const server = http.createServer(async (req, res) => {
             return;
         }
         const available = await detectAll();
-        const detected = available[0];
+        const detected = backend
+            ? (available.find((a) => a.name === backend) ?? available[0])
+            : available[0];
         if (!detected) {
             res.writeHead(503);
             res.end("No AI adapter available. Install claude, copilot, or gemini.");
@@ -772,6 +1065,245 @@ const server = http.createServer(async (req, res) => {
         res.end();
         return;
     }
+    // ── File System API (/fs/*) ───────────────────────────────────────────────
+    if (url.pathname.startsWith("/fs/")) {
+        const fsPath = url.pathname.slice("/fs".length); // e.g. "/tree", "/list", "/read"
+        // GET /fs/tree?root=<abs> — lightweight directory tree
+        if (fsPath === "/tree" && req.method === "GET") {
+            const rawRoot = url.searchParams.get("root") ?? "";
+            const root = expandHome(rawRoot);
+            const rootExists = root !== "" && existsSync(root);
+            console.log(`[fs/tree] raw param: ${JSON.stringify(rawRoot)}`);
+            console.log(`[fs/tree] expanded:  ${JSON.stringify(root)}`);
+            console.log(`[fs/tree] existsSync: ${rootExists}`);
+            if (!rootExists) {
+                console.log("[fs/tree] → 404 not found");
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Project root not found" }));
+                return;
+            }
+            const tree = buildTree(root, root);
+            console.log(`[fs/tree] → 200 ok, ${tree.length} entries`);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(tree));
+            return;
+        }
+        // GET /fs/list?root=<abs> — all files with content + metadata
+        if (fsPath === "/list" && req.method === "GET") {
+            const root = expandHome(url.searchParams.get("root") ?? "");
+            if (!root || !existsSync(root)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Project root not found" }));
+                return;
+            }
+            const files = collectFiles(root, root);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(files));
+            return;
+        }
+        // GET /fs/read?path=<abs> — read single file content
+        if (fsPath === "/read" && req.method === "GET") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath || !existsSync(filePath)) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "File not found" }));
+                return;
+            }
+            let content;
+            try {
+                content = readFileSync(filePath, "utf8");
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ content }));
+            return;
+        }
+        // POST /fs/write — write file (creates parent directories)
+        if (fsPath === "/write" && req.method === "POST") {
+            const body = await readBody(req);
+            let filePath;
+            let content;
+            try {
+                const parsed = JSON.parse(body);
+                filePath = expandHome(parsed.path);
+                content = parsed.content;
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                const dir = dirname(filePath);
+                if (!existsSync(dir))
+                    mkdirSync(dir, { recursive: true });
+                writeFileSync(filePath, content, "utf8");
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // DELETE /fs/file?path=<abs> — delete file and its sidecar
+        if (fsPath === "/file" && req.method === "DELETE") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                if (existsSync(filePath))
+                    unlinkSync(filePath);
+                const sp = sidecarPath(filePath);
+                if (existsSync(sp))
+                    unlinkSync(sp);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // POST /fs/move — rename/move file and its sidecar
+        if (fsPath === "/move" && req.method === "POST") {
+            const body = await readBody(req);
+            let from;
+            let to;
+            try {
+                const parsed = JSON.parse(body);
+                from = expandHome(parsed.from);
+                to = expandHome(parsed.to);
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!from || !to) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing from/to" }));
+                return;
+            }
+            try {
+                const toDir = dirname(to);
+                if (!existsSync(toDir))
+                    mkdirSync(toDir, { recursive: true });
+                renameSync(from, to);
+                // Move sidecar if it exists
+                const fromSidecar = sidecarPath(from);
+                const toSidecar = sidecarPath(to);
+                if (existsSync(fromSidecar)) {
+                    const toSidecarDir = dirname(toSidecar);
+                    if (!existsSync(toSidecarDir))
+                        mkdirSync(toSidecarDir, { recursive: true });
+                    renameSync(fromSidecar, toSidecar);
+                }
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // POST /fs/mkdir — create directory
+        if (fsPath === "/mkdir" && req.method === "POST") {
+            const body = await readBody(req);
+            let dirPath;
+            try {
+                const parsed = JSON.parse(body);
+                dirPath = expandHome(parsed.path);
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!dirPath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            try {
+                mkdirSync(dirPath, { recursive: true });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        // GET /fs/meta?path=<abs> — read sidecar metadata
+        if (fsPath === "/meta" && req.method === "GET") {
+            const filePath = expandHome(url.searchParams.get("path") ?? "");
+            if (!filePath) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path" }));
+                return;
+            }
+            const meta = readMeta(filePath);
+            if (!meta) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "No metadata found" }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(meta));
+            return;
+        }
+        // POST /fs/meta — write sidecar metadata
+        if (fsPath === "/meta" && req.method === "POST") {
+            const body = await readBody(req);
+            let filePath;
+            let meta;
+            try {
+                const parsed = JSON.parse(body);
+                filePath = expandHome(parsed.path);
+                meta = parsed.meta;
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+                return;
+            }
+            if (!filePath || !meta) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Missing path or meta" }));
+                return;
+            }
+            try {
+                writeMeta(filePath, meta);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch (err) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: String(err) }));
+            }
+            return;
+        }
+        res.writeHead(404);
+        res.end("FS route not found");
+        return;
+    }
     // ── ALL /api/* — transparent Camunda API proxy ─────────────────────────────
     if (url.pathname.startsWith("/api/")) {
         const profileName = req.headers["x-profile"];
@@ -823,11 +1355,116 @@ const server = http.createServer(async (req, res) => {
         res.end(await upstream.text());
         return;
     }
+    // ── POST /secrets/check — bulk existence check for secret names ───────────
+    if (url.pathname === "/secrets/check" && req.method === "POST") {
+        const body = await readBody(req);
+        let names = [];
+        try {
+            names = (JSON.parse(body).names ?? []);
+        }
+        catch {
+            /* treat as empty list */
+        }
+        const result = {};
+        for (const name of names) {
+            result[name] = process.env[name] !== undefined;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(result));
+        return;
+    }
+    // ── POST /secrets/:name — resolve and encrypt a secret for the client ─────
+    if (url.pathname.startsWith("/secrets/") && req.method === "POST") {
+        const name = url.pathname.slice("/secrets/".length);
+        if (!name) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Secret name required" }));
+            return;
+        }
+        const secretValue = process.env[name];
+        if (secretValue === undefined) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `Secret "${name}" is not configured` }));
+            return;
+        }
+        const body = await readBody(req);
+        let keyBase64;
+        try {
+            const parsed = JSON.parse(body);
+            if (typeof parsed.key !== "string" || !parsed.key)
+                throw new Error("missing key");
+            keyBase64 = parsed.key;
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Body must be { key: string } with a base64 AES-256 key" }));
+            return;
+        }
+        try {
+            const rawKey = Buffer.from(keyBase64, "base64");
+            const cryptoKey = await globalThis.crypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["encrypt"]);
+            const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+            const encrypted = await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv }, cryptoKey, new TextEncoder().encode(secretValue));
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                encrypted: Buffer.from(encrypted).toString("base64"),
+                iv: Buffer.from(iv).toString("base64"),
+            }));
+        }
+        catch (err) {
+            console.error(`[secrets] encryption failed for "${name}":`, err);
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Encryption failed" }));
+        }
+        return;
+    }
+    // ── POST /http-request — CORS bypass for wasm worker REST connectors ─────
+    if (url.pathname === "/http-request" && req.method === "POST") {
+        const body = await readBody(req);
+        let targetUrl;
+        let method;
+        let headers;
+        let reqBody;
+        try {
+            const parsed = JSON.parse(body);
+            targetUrl = parsed.url;
+            method = (parsed.method ?? "GET").toUpperCase();
+            headers = parsed.headers ?? {};
+            reqBody = parsed.body;
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Invalid JSON body" }));
+            return;
+        }
+        console.log(`[http-request] ${method} ${targetUrl}`);
+        try {
+            const upstream = await fetch(targetUrl, {
+                method,
+                headers,
+                body: method !== "GET" && method !== "HEAD" ? reqBody : undefined,
+            });
+            const responseText = await upstream.text();
+            const contentType = upstream.headers.get("content-type") ?? "application/json";
+            res.writeHead(upstream.status, {
+                "Content-Type": contentType,
+                "Access-Control-Allow-Origin": "*",
+            });
+            res.end(responseText);
+        }
+        catch (err) {
+            res.writeHead(502, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: `Upstream unreachable: ${String(err)}` }));
+        }
+        return;
+    }
     res.writeHead(404);
     res.end("Not Found");
 });
 server.listen(PORT, () => {
     console.log(`BPMN Kit AI Server running at http://localhost:${PORT}`);
     console.log("Press Ctrl+C to stop");
+    startWorkerDaemon();
+    startTriggers();
 });
 //# sourceMappingURL=index.js.map