@debian777/kairos-mcp 3.0.1-beta.6

package/dist/http/http-api-next.js

@@ -0,0 +1,193 @@
+import { structuredLogger } from '../utils/structured-logger.js';
+import { resolveChainNextStep, resolveChainPreviousStep } from '../services/chain-utils.js';
+import { extractMemoryBody } from '../utils/memory-body.js';
+import { proofOfWorkStore } from '../services/proof-of-work-store.js';
+import { buildChallenge, handleProofSubmission, GENESIS_HASH } from '../tools/kairos_next-pow-helpers.js';
+import { updateStepQuality } from '../tools/kairos_next.js';
+import { tryApplySolutionToPreviousStep } from '../tools/kairos_next-previous-step.js';
+/**
+ * Set up API route for kairos_next (V2: no next_step/protocol_status/attest_required/final_challenge,
+ * proof_hash replaces last_proof_hash, two-phase retry escalation)
+ */
+export function setupNextRoute(app, memoryStore, qdrantService) {
+    app.post('/api/kairos_next', async (req, res) => {
+        const startTime = Date.now();
+        try {
+            const { uri, solution } = req.body;
+            if (!uri || typeof uri !== 'string') {
+                res.status(400).json({
+                    error: 'INVALID_INPUT',
+                    message: 'uri is required and must be a string'
+                });
+                return;
+            }
+            structuredLogger.info(`-> POST /api/kairos_next (uri: ${uri})`);
+            const normalizeMemoryUri = (value) => {
+                const normalized = (value || '').trim();
+                const uuid = normalized.split('/').pop();
+                if (!uuid) {
+                    throw new Error('Invalid kairos://mem URI');
+                }
+                const memUri = normalized.startsWith('kairos://mem/') ? normalized : `kairos://mem/${uuid}`;
+                return { uuid, uri: memUri };
+            };
+            const { uuid, uri: requestedUri } = normalizeMemoryUri(uri);
+            const memory = await memoryStore.getMemory(uuid);
+            // When requested step has no proof_of_work (e.g. last step), apply solution to previous step (MISSING_PROOF fix)
+            if (memory && !memory.proof_of_work && solution) {
+                const prevResult = await tryApplySolutionToPreviousStep(memory, solution, (id) => memoryStore.getMemory(id), qdrantService);
+                if (prevResult.applied) {
+                    if (prevResult.outcome.blockedPayload) {
+                        await updateStepQuality(qdrantService, prevResult.prevMemory, 'failure', 'http');
+                        const duration = Date.now() - startTime;
+                        return res.status(200).json({
+                            ...prevResult.outcome.blockedPayload,
+                            metadata: { duration_ms: duration }
+                        });
+                    }
+                    if (!prevResult.outcome.alreadyRecorded) {
+                        await updateStepQuality(qdrantService, prevResult.prevMemory, 'success', 'http');
+                    }
+                    const nextFromRequested = await resolveChainNextStep(memory, qdrantService);
+                    const nextStepUri = nextFromRequested?.uuid
+                        ? `kairos://mem/${nextFromRequested.uuid}`
+                        : null;
+                    const current_step = {
+                        uri: requestedUri,
+                        content: memory ? extractMemoryBody(memory.text) : '',
+                        mimeType: 'text/markdown'
+                    };
+                    const challenge = await buildChallenge(memory, undefined);
+                    const output = {
+                        must_obey: true,
+                        current_step,
+                        challenge
+                    };
+                    if (nextStepUri) {
+                        output.next_action = `call kairos_next with ${nextStepUri} and solution matching challenge`;
+                    }
+                    else {
+                        output.message = 'Protocol steps complete. Call kairos_attest to finalize.';
+                        output.next_action = `call kairos_attest with ${requestedUri} and outcome (success or failure) and message to complete the protocol`;
+                    }
+                    if (prevResult.outcome.proofHash)
+                        output.proof_hash = prevResult.outcome.proofHash;
+                    const duration = Date.now() - startTime;
+                    return res.status(200).json({ ...output, metadata: { duration_ms: duration } });
+                }
+            }
+            // Solution is required for steps 2+
+            if (!solution) {
+                const retryCount = await proofOfWorkStore.incrementRetry(uuid);
+                const noSolChallenge = await buildChallenge(null, undefined);
+                const duration = Date.now() - startTime;
+                return res.status(200).json({
+                    must_obey: retryCount < 3,
+                    current_step: {
+                        uri: requestedUri,
+                        content: memory ? extractMemoryBody(memory.text) : '',
+                        mimeType: 'text/markdown'
+                    },
+                    challenge: noSolChallenge,
+                    message: 'Solution is required for steps 2+. Use kairos_begin for step 1.',
+                    next_action: `retry kairos_next with ${requestedUri} -- include solution matching challenge`,
+                    error_code: 'MISSING_FIELD',
+                    retry_count: retryCount,
+                    metadata: { duration_ms: duration }
+                });
+            }
+            let submissionOutcome;
+            if (memory?.proof_of_work) {
+                const isStep1 = !memory.chain || memory.chain.step_index <= 1;
+                let expectedPreviousHash;
+                if (isStep1) {
+                    expectedPreviousHash = GENESIS_HASH;
+                }
+                else {
+                    const prev = await resolveChainPreviousStep(memory, qdrantService);
+                    const prevHash = prev?.uuid ? await proofOfWorkStore.getProofHash(prev.uuid) : null;
+                    expectedPreviousHash = prevHash ?? GENESIS_HASH;
+                }
+                submissionOutcome = await handleProofSubmission(solution, memory, { expectedPreviousHash });
+                if (submissionOutcome.blockedPayload) {
+                    await updateStepQuality(qdrantService, memory, 'failure', 'http');
+                    const duration = Date.now() - startTime;
+                    return res.status(200).json({
+                        ...submissionOutcome.blockedPayload,
+                        metadata: { duration_ms: duration }
+                    });
+                }
+            }
+            if (!memory) {
+                const duration = Date.now() - startTime;
+                return res.status(200).json({
+                    must_obey: true,
+                    current_step: {
+                        uri: requestedUri,
+                        content: '',
+                        mimeType: 'text/markdown'
+                    },
+                    challenge: await buildChallenge(null, undefined),
+                    message: 'Protocol steps complete. Call kairos_attest to finalize.',
+                    next_action: `call kairos_attest with ${requestedUri} and outcome (success or failure) and message to complete the protocol`,
+                    metadata: { duration_ms: duration }
+                });
+            }
+            if (memory.proof_of_work && submissionOutcome?.proofHash && !submissionOutcome.alreadyRecorded) {
+                await updateStepQuality(qdrantService, memory, 'success', 'http');
+            }
+            // Resolve next step for display
+            const nextStepInfo = await resolveChainNextStep(memory, qdrantService);
+            const nextMemory = nextStepInfo
+                ? await memoryStore.getMemory(nextStepInfo.uuid)
+                : null;
+            const displayMemory = nextMemory ?? memory;
+            const challengeProof = nextMemory?.proof_of_work ?? memory?.proof_of_work;
+            const displayUri = nextStepInfo ? `kairos://mem/${nextStepInfo.uuid}` : requestedUri;
+            // Resolve the step AFTER display to get next_action URI
+            const nextFromDisplay = displayMemory ? await resolveChainNextStep(displayMemory, qdrantService) : undefined;
+            const nextStepUri = nextFromDisplay?.uuid
+                ? `kairos://mem/${nextFromDisplay.uuid}`
+                : null;
+            const current_step = {
+                uri: displayUri,
+                content: displayMemory ? extractMemoryBody(displayMemory.text) : '',
+                mimeType: 'text/markdown'
+            };
+            const challenge = await buildChallenge(displayMemory, challengeProof);
+            const output = {
+                must_obey: true,
+                current_step,
+                challenge
+            };
+            if (nextStepUri) {
+                output.next_action = `call kairos_next with ${nextStepUri} and solution matching challenge`;
+            }
+            else {
+                output.message = 'Protocol steps complete. Call kairos_attest to finalize.';
+                output.next_action = `call kairos_attest with ${requestedUri} and outcome (success or failure) and message to complete the protocol`;
+            }
+            if (submissionOutcome?.proofHash) {
+                output.proof_hash = submissionOutcome.proofHash;
+            }
+            const duration = Date.now() - startTime;
+            structuredLogger.info(`kairos_next completed in ${duration}ms`);
+            res.status(200).json({
+                ...output,
+                metadata: { duration_ms: duration }
+            });
+            return;
+        }
+        catch (error) {
+            const duration = Date.now() - startTime;
+            structuredLogger.error(`kairos_next failed in ${duration}ms`, error);
+            res.status(500).json({
+                error: 'NEXT_FAILED',
+                message: error instanceof Error ? error.message : 'Failed to get next step',
+                duration_ms: duration
+            });
+            return;
+        }
+    });
+}
+//# sourceMappingURL=http-api-next.js.map

package/dist/http/http-api-next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-next.js","sourceRoot":"","sources":["../../src/http/http-api-next.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY,EAA0B,MAAM,qCAAqC,CAAC;AAClI,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAEvF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,WAA8B,EAAE,aAA4B;IAC7G,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAEnC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACjB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,sCAAsC;iBAClD,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,gBAAgB,CAAC,IAAI,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;YAEhE,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAiC,EAAE;gBACxE,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;gBAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;oBACR,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAChD,CAAC;gBACD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAC5F,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC,CAAC;YAEF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEjD,iHAAiH;YACjH,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,MAAM,8BAA8B,CACnD,MAAM,EACN,QAAQ,EACR,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EACjC,aAAa,CAChB,CAAC;gBACF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACrB,IAAI,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;wBACpC,MAAM,iBAAiB,CAAC,aAAa,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;wBACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;wBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;4BACxB,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc;4BACpC,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;yBACtC,CAAC,CAAC;oBACP,CAAC;oBACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;wBACtC,MAAM,iBAAiB,CAAC,aAAa,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;oBACrF,CAAC;oBACD,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;oBAC5E,MAAM,WAAW,GAAG,iBAAiB,EAAE,IAAI;wBACvC,CAAC,CAAC,gBAAgB,iBAAiB,CAAC,IAAI,EAAE;wBAC1C,CAAC,CAAC,IAAI,CAAC;oBACX,MAAM,YAAY,GAAG;wBACjB,GAAG,EAAE,YAAY;wBACjB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;wBACrD,QAAQ,EAAE,eAAwB;qBACrC,CAAC;oBACF,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAQ;wBAChB,SAAS,EAAE,IAAI;wBACf,YAAY;wBACZ,SAAS;qBACZ,CAAC;oBACF,IAAI,WAAW,EAAE,CAAC;wBACd,MAAM,CAAC,WAAW,GAAG,yBAAyB,WAAW,kCAAkC,CAAC;oBAChG,CAAC;yBAAM,CAAC;wBACJ,MAAM,CAAC,OAAO,GAAG,0DAA0D,CAAC;wBAC5E,MAAM,CAAC,WAAW,GAAG,2BAA2B,YAAY,wEAAwE,CAAC;oBACzI,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS;wBAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;oBACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACpF,CAAC;YACL,CAAC;YAED,oCAAoC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC/D,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxB,SAAS,EAAE,UAAU,GAAG,CAAC;oBACzB,YAAY,EAAE;wBACV,GAAG,EAAE,YAAY;wBACjB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;wBACrD,QAAQ,EAAE,eAAe;qBAC5B;oBACD,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,iEAAiE;oBAC1E,WAAW,EAAE,0BAA0B,YAAY,yCAAyC;oBAC5F,UAAU,EAAE,eAAe;oBAC3B,WAAW,EAAE,UAAU;oBACvB,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACP,CAAC;YAED,IAAI,iBAAgD,CAAC;YACrD,IAAI,MAAM,EAAE,aAAa,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;gBAC9D,IAAI,oBAA4B,CAAC;gBACjC,IAAI,OAAO,EAAE,CAAC;oBACV,oBAAoB,GAAG,YAAY,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;oBACnE,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpF,oBAAoB,GAAG,QAAQ,IAAI,YAAY,CAAC;gBACpD,CAAC;gBACD,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC5F,IAAI,iBAAiB,CAAC,cAAc,EAAE,CAAC;oBACnC,MAAM,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;oBAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACxB,GAAG,iBAAiB,CAAC,cAAc;wBACnC,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;qBACtC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxB,SAAS,EAAE,IAAI;oBACf,YAAY,EAAE;wBACV,GAAG,EAAE,YAAY;wBACjB,OAAO,EAAE,EAAE;wBACX,QAAQ,EAAE,eAAe;qBAC5B;oBACD,SAAS,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;oBAChD,OAAO,EAAE,0DAA0D;oBACnE,WAAW,EAAE,2BAA2B,YAAY,wEAAwE;oBAC5H,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACP,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,IAAI,iBAAiB,EAAE,SAAS,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;gBAC7F,MAAM,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;YAED,gCAAgC;YAChC,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,YAAY;gBAC3B,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC;gBAChD,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,aAAa,GAAG,UAAU,IAAI,MAAM,CAAC;YAC3C,MAAM,cAAc,GAAG,UAAU,EAAE,aAAa,IAAI,MAAM,EAAE,aAAa,CAAC;YAC1E,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;YAErF,wDAAwD;YACxD,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7G,MAAM,WAAW,GAAG,eAAe,EAAE,IAAI;gBACrC,CAAC,CAAC,gBAAgB,eAAe,CAAC,IAAI,EAAE;gBACxC,CAAC,CAAC,IAAI,CAAC;YAEX,MAAM,YAAY,GAAG;gBACjB,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnE,QAAQ,EAAE,eAAwB;aACrC,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAEtE,MAAM,MAAM,GAAQ;gBAChB,SAAS,EAAE,IAAI;gBACf,YAAY;gBACZ,SAAS;aACZ,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBACd,MAAM,CAAC,WAAW,GAAG,yBAAyB,WAAW,kCAAkC,CAAC;YAChG,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,OAAO,GAAG,0DAA0D,CAAC;gBAC5E,MAAM,CAAC,WAAW,GAAG,2BAA2B,YAAY,wEAAwE,CAAC;YACzI,CAAC;YAED,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC;YACpD,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,4BAA4B,QAAQ,IAAI,CAAC,CAAC;YAEhE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,GAAG,MAAM;gBACT,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;aACtC,CAAC,CAAC;YACH,OAAO;QAEX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,gBAAgB,CAAC,KAAK,CAAC,yBAAyB,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;gBAC3E,WAAW,EAAE,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO;QACX,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/http/http-api-routes.d.ts

@@ -0,0 +1,13 @@
+import express from 'express';
+import { MemoryQdrantStore } from '../services/memory/store.js';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * Set up all API routes
+ * @param app Express application instance
+ * @param memoryStore Memory store instance
+ * @param deps Dependencies including qdrantService
+ */
+export declare function setupApiRoutes(app: express.Express, memoryStore: MemoryQdrantStore, deps: {
+    qdrantService: QdrantService;
+}): void;
+//# sourceMappingURL=http-api-routes.d.ts.map

package/dist/http/http-api-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-routes.d.ts","sourceRoot":"","sources":["../../src/http/http-api-routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAWnE;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAAE,aAAa,EAAE,aAAa,CAAA;CAAE,QAY1H"}

package/dist/http/http-api-routes.js

@@ -0,0 +1,28 @@
+import { setupMintRoute } from './http-api-mint.js';
+import { setupSnapshotRoute } from './http-api-snapshot.js';
+import { setupBeginRoute } from './http-api-begin.js';
+import { setupBeginStepRoute } from './http-api-begin-step.js';
+import { setupNextRoute } from './http-api-next.js';
+import { setupAttestRoute } from './http-api-attest.js';
+import { setupUpdateRoute } from './http-api-update.js';
+import { setupDeleteRoute } from './http-api-delete.js';
+import { setupDumpRoute } from './http-api-dump.js';
+/**
+ * Set up all API routes
+ * @param app Express application instance
+ * @param memoryStore Memory store instance
+ * @param deps Dependencies including qdrantService
+ */
+export function setupApiRoutes(app, memoryStore, deps) {
+    const { qdrantService } = deps;
+    setupMintRoute(app, memoryStore);
+    setupSnapshotRoute(app, qdrantService);
+    setupBeginRoute(app, memoryStore, qdrantService); // /api/kairos_search
+    setupBeginStepRoute(app, memoryStore, qdrantService); // /api/kairos_begin
+    setupNextRoute(app, memoryStore, qdrantService);
+    setupAttestRoute(app, qdrantService);
+    setupUpdateRoute(app, qdrantService);
+    setupDeleteRoute(app, qdrantService);
+    setupDumpRoute(app, memoryStore, qdrantService);
+}
+//# sourceMappingURL=http-api-routes.js.map

package/dist/http/http-api-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-routes.js","sourceRoot":"","sources":["../../src/http/http-api-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,WAA8B,EAAE,IAAsC;IACvH,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/B,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjC,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACvC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,qBAAqB;IACvE,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,oBAAoB;IAC1E,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrC,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrC,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC"}

package/dist/http/http-api-snapshot.d.ts

@@ -0,0 +1,9 @@
+import express from 'express';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * Set up API route for Qdrant snapshot
+ * @param app Express application instance
+ * @param qdrantService Qdrant service instance
+ */
+export declare function setupSnapshotRoute(app: express.Express, qdrantService: QdrantService): void;
+//# sourceMappingURL=http-api-snapshot.d.ts.map

package/dist/http/http-api-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-snapshot.d.ts","sourceRoot":"","sources":["../../src/http/http-api-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAInE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,QA4BpF"}

package/dist/http/http-api-snapshot.js

@@ -0,0 +1,38 @@
+import { structuredLogger } from '../utils/structured-logger.js';
+import { triggerQdrantSnapshot } from '../services/qdrant/snapshots.js';
+import { QDRANT_SNAPSHOT_DIR } from '../config.js';
+/**
+ * Set up API route for Qdrant snapshot
+ * @param app Express application instance
+ * @param qdrantService Qdrant service instance
+ */
+export function setupSnapshotRoute(app, qdrantService) {
+    app.post('/api/snapshot', async (_req, res) => {
+        try {
+            const result = await triggerQdrantSnapshot(qdrantService, {
+                enabled: true,
+                directory: QDRANT_SNAPSHOT_DIR,
+                reason: 'api'
+            });
+            const statusCode = result.success ? 200 : result.skipped ? 202 : 502;
+            res.status(statusCode).json({
+                status: result.success ? 'completed' : result.skipped ? 'skipped' : 'failed',
+                target: 'qdrant',
+                snapshotName: result.snapshotName,
+                filePath: result.filePath,
+                bytesWritten: result.bytesWritten,
+                durationMs: result.durationMs,
+                message: result.message
+            });
+        }
+        catch (error) {
+            structuredLogger.error('Snapshot endpoint crashed', error);
+            res.status(500).json({
+                status: 'failed',
+                target: 'qdrant',
+                message: error instanceof Error ? error.message : 'Snapshot pipeline crashed'
+            });
+        }
+    });
+}
+//# sourceMappingURL=http-api-snapshot.js.map

package/dist/http/http-api-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-snapshot.js","sourceRoot":"","sources":["../../src/http/http-api-snapshot.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,aAA4B;IACjF,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE;gBACtD,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,mBAAmB;gBAC9B,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBAC5E,MAAM,EAAE,QAAQ;gBAChB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,gBAAgB,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;aAChF,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/http/http-api-update.d.ts

@@ -0,0 +1,9 @@
+import express from 'express';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * Set up API route for kairos_update
+ * @param app Express application instance
+ * @param qdrantService Qdrant service instance
+ */
+export declare function setupUpdateRoute(app: express.Express, qdrantService: QdrantService): void;
+//# sourceMappingURL=http-api-update.d.ts.map

package/dist/http/http-api-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-update.d.ts","sourceRoot":"","sources":["../../src/http/http-api-update.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,QAuGlF"}

package/dist/http/http-api-update.js

@@ -0,0 +1,105 @@
+import { structuredLogger } from '../utils/structured-logger.js';
+/**
+ * Set up API route for kairos_update
+ * @param app Express application instance
+ * @param qdrantService Qdrant service instance
+ */
+export function setupUpdateRoute(app, qdrantService) {
+    app.post('/api/kairos_update', async (req, res) => {
+        const startTime = Date.now();
+        try {
+            const { uris, markdown_doc, updates } = req.body;
+            if (!uris || !Array.isArray(uris) || uris.length === 0) {
+                res.status(400).json({
+                    error: 'INVALID_INPUT',
+                    message: 'uris is required and must be a non-empty array'
+                });
+                return;
+            }
+            if (markdown_doc && (!Array.isArray(markdown_doc) || markdown_doc.length !== uris.length)) {
+                res.status(400).json({
+                    error: 'INVALID_INPUT',
+                    message: 'markdown_doc array length must match uris array length'
+                });
+                return;
+            }
+            structuredLogger.info(`→ POST /api/kairos_update (${uris.length} URI(s))`);
+            const extractBody = (text) => {
+                const start = /<!--\s*KAIROS:BODY-START\s*-->/i;
+                const end = /<!--\s*KAIROS:BODY-END\s*-->/i;
+                const s = text.search(start);
+                const e = text.search(end);
+                if (s >= 0 && e > s) {
+                    const startMatch = text.match(start);
+                    if (!startMatch)
+                        return text;
+                    const startIdx = (startMatch.index || 0) + startMatch[0].length;
+                    return text.slice(startIdx, e).trim();
+                }
+                return text;
+            };
+            const results = [];
+            let totalUpdated = 0;
+            let totalFailed = 0;
+            for (let i = 0; i < uris.length; i++) {
+                const uri = uris[i];
+                try {
+                    const uuid = typeof uri === 'string' ? uri.split('/').pop() : undefined;
+                    if (!uuid) {
+                        throw new Error('Invalid URI format');
+                    }
+                    const mk = Array.isArray(markdown_doc) ? markdown_doc[i] : undefined;
+                    if (typeof mk === 'string' && mk.trim().length > 0) {
+                        const body = extractBody(mk);
+                        await qdrantService.updateMemory(uuid, { text: body });
+                    }
+                    else if (updates && Object.keys(updates).length > 0) {
+                        if (typeof updates['text'] === 'string' && updates['text'].indexOf('<!-- KAIROS:BODY-START') !== -1 && updates['text'].indexOf('<!-- KAIROS:BODY-END') !== -1) {
+                            const body = extractBody(updates['text']);
+                            await qdrantService.updateMemory(uuid, { text: body });
+                        }
+                        else {
+                            await qdrantService.updateMemory(uuid, updates);
+                        }
+                    }
+                    else {
+                        throw new Error('Provide markdown_doc or updates');
+                    }
+                    results.push({
+                        uri,
+                        status: 'updated',
+                        message: `Memory ${uri} updated successfully`
+                    });
+                    totalUpdated++;
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    results.push({
+                        uri,
+                        status: 'error',
+                        message: `Failed to update memory: ${errorMessage}`
+                    });
+                    totalFailed++;
+                }
+            }
+            const duration = Date.now() - startTime;
+            structuredLogger.info(`✓ kairos_update completed in ${duration}ms (${totalUpdated} updated, ${totalFailed} failed)`);
+            res.status(200).json({
+                results,
+                total_updated: totalUpdated,
+                total_failed: totalFailed,
+                metadata: { duration_ms: duration }
+            });
+        }
+        catch (error) {
+            const duration = Date.now() - startTime;
+            structuredLogger.error(`✗ kairos_update failed in ${duration}ms`, error);
+            res.status(500).json({
+                error: 'UPDATE_FAILED',
+                message: error instanceof Error ? error.message : 'Failed to update memories',
+                duration_ms: duration
+            });
+        }
+    });
+}
+//# sourceMappingURL=http-api-update.js.map

package/dist/http/http-api-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-update.js","sourceRoot":"","sources":["../../src/http/http-api-update.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,aAA4B;IAC/E,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACjB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,gDAAgD;iBAC5D,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACjB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,wDAAwD;iBACpE,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,gBAAgB,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC;YAE3E,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;gBACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC;gBAChD,MAAM,GAAG,GAAG,+BAA+B,CAAC;gBAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrC,IAAI,CAAC,UAAU;wBAAE,OAAO,IAAI,CAAC;oBAC7B,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oBAChE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,CAAC;gBACD,OAAO,IAAI,CAAC;YAChB,CAAC,CAAC;YAEF,MAAM,OAAO,GAAU,EAAE,CAAC;YAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC;oBACD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;oBACxE,IAAI,CAAC,IAAI,EAAE,CAAC;wBACR,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBAC1C,CAAC;oBAED,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACrE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;wBAC7B,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3D,CAAC;yBAAM,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpD,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;4BAC5J,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC1C,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACJ,MAAM,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBACpD,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACJ,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;oBACvD,CAAC;oBAED,OAAO,CAAC,IAAI,CAAC;wBACT,GAAG;wBACH,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE,UAAU,GAAG,uBAAuB;qBAChD,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC5E,OAAO,CAAC,IAAI,CAAC;wBACT,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,OAAO,EAAE,4BAA4B,YAAY,EAAE;qBACtD,CAAC,CAAC;oBACH,WAAW,EAAE,CAAC;gBAClB,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,gCAAgC,QAAQ,OAAO,YAAY,aAAa,WAAW,UAAU,CAAC,CAAC;YAErH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,OAAO;gBACP,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,WAAW;gBACzB,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;aACtC,CAAC,CAAC;QAEP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,gBAAgB,CAAC,KAAK,CAAC,6BAA6B,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;gBAC7E,WAAW,EAAE,QAAQ;aACxB,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/http/http-auth-callback.d.ts

@@ -0,0 +1,6 @@
+/**
+ * OIDC callback: exchange Keycloak authorization code for tokens, set session cookie, redirect.
+ */
+import express from 'express';
+export declare function setupAuthCallback(app: express.Express): void;
+//# sourceMappingURL=http-auth-callback.d.ts.map

package/dist/http/http-auth-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-callback.d.ts","sourceRoot":"","sources":["../../src/http/http-auth-callback.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,OAAO,MAAM,SAAS,CAAC;AAiF9B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CA8H5D"}

package/dist/http/http-auth-callback.js

@@ -0,0 +1,183 @@
+import crypto from 'crypto';
+import { AUTH_ENABLED, KEYCLOAK_URL, KEYCLOAK_INTERNAL_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, AUTH_CALLBACK_BASE_URL, SESSION_SECRET, SESSION_MAX_AGE_SEC } from '../config.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+import { getStateStore, SESSION_COOKIE_NAME } from './http-auth-middleware.js';
+function signSession(payload) {
+    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    const sig = crypto.createHmac('sha256', SESSION_SECRET).update(payloadB64).digest('base64url');
+    return `${payloadB64}.${sig}`;
+}
+function realmFromIssuer(iss) {
+    const match = /\/realms\/([^/]+)/.exec(iss);
+    const segment = match?.[1] ?? iss.split('/').filter(Boolean).pop();
+    return typeof segment === 'string' ? segment : 'default';
+}
+const AUTH_SUCCESS_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authentication successful – KAIROS</title>
+  <style>
+    body { font-family: system-ui, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; background: #1a1a1a; color: #e5e5e5; text-align: center; }
+    .box { padding: 2rem; max-width: 24rem; }
+    h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }
+    p { color: #a3a3a3; margin: 0; }
+  </style>
+</head>
+<body>
+  <div class="box">
+    <h1>Authentication successful</h1>
+    <p>You can close this page and return to your MCP client.</p>
+  </div>
+</body>
+</html>
+`;
+const AUTH_LOGGED_OUT_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Logged out – KAIROS</title>
+  <style>
+    body { font-family: system-ui, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0; background: #1a1a1a; color: #e5e5e5; text-align: center; }
+    .box { padding: 2rem; max-width: 24rem; }
+    h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.5rem; }
+    p { color: #a3a3a3; margin: 0; }
+  </style>
+</head>
+<body>
+  <div class="box">
+    <h1>Session cleared</h1>
+    <p>You are logged out. You can close this page.</p>
+  </div>
+</body>
+</html>
+`;
+/** Cookie options must match those used when setting the session (Path=/) so the browser clears it. */
+const COOKIE_CLEAR_OPTIONS = { path: '/', httpOnly: true, sameSite: 'lax' };
+export function setupAuthCallback(app) {
+    app.get('/auth/success', (_req, res) => {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.send(AUTH_SUCCESS_HTML);
+    });
+    app.get('/auth/logout', (_req, res) => {
+        res.clearCookie(SESSION_COOKIE_NAME, COOKIE_CLEAR_OPTIONS);
+        res.redirect(302, '/auth/logged-out');
+    });
+    app.get('/auth/logged-out', (_req, res) => {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.send(AUTH_LOGGED_OUT_HTML);
+    });
+    app.get('/auth/callback', async (req, res) => {
+        if (!AUTH_ENABLED || !KEYCLOAK_URL || !SESSION_SECRET || !AUTH_CALLBACK_BASE_URL) {
+            res.status(503).json({
+                error: 'Auth not configured',
+                message: 'AUTH_ENABLED, KEYCLOAK_URL, SESSION_SECRET, and AUTH_CALLBACK_BASE_URL are required. Set in .env (see env.example.txt).'
+            });
+            return;
+        }
+        const { code, state } = req.query;
+        if (!code || !state) {
+            res.redirect(302, '/?error=missing_code_or_state');
+            return;
+        }
+        const store = getStateStore();
+        const entry = store.get(state);
+        store.delete(state);
+        if (!entry) {
+            structuredLogger.info('Auth callback: invalid or expired state');
+            res.redirect(302, '/?error=invalid_state');
+            return;
+        }
+        const keycloakBase = (KEYCLOAK_INTERNAL_URL || KEYCLOAK_URL).replace(/\/$/, '');
+        const redirectUri = `${AUTH_CALLBACK_BASE_URL.replace(/\/$/, '')}/auth/callback`;
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: KEYCLOAK_CLIENT_ID,
+            code,
+            redirect_uri: redirectUri,
+            code_verifier: entry.codeVerifier
+        });
+        let tokenRes;
+        try {
+            tokenRes = await fetch(`${keycloakBase}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString()
+            });
+        }
+        catch (err) {
+            structuredLogger.error('Auth callback: token request failed', err);
+            res.redirect(302, '/?error=token_request_failed');
+            return;
+        }
+        if (!tokenRes.ok) {
+            const text = await tokenRes.text();
+            structuredLogger.info(`Auth callback: token error ${JSON.stringify({ status: tokenRes.status, body: text })}`);
+            res.redirect(302, '/?error=token_exchange_failed');
+            return;
+        }
+        const tokens = (await tokenRes.json());
+        const idToken = tokens.id_token;
+        const accessToken = tokens.access_token;
+        const tokenToDecode = idToken ?? accessToken;
+        if (!tokenToDecode || typeof tokenToDecode !== 'string') {
+            structuredLogger.info('Auth callback: no id_token or access_token in response');
+            res.redirect(302, '/?error=no_tokens');
+            return;
+        }
+        let sub = null;
+        let groups = [];
+        let realm = KEYCLOAK_REALM;
+        let group_ids;
+        try {
+            const segment = tokenToDecode.split('.')[1];
+            const payload = segment
+                ? JSON.parse(Buffer.from(segment, 'base64url').toString())
+                : null;
+            if (!payload || typeof payload.sub !== 'string' || payload.sub.length === 0) {
+                structuredLogger.info('Auth callback: could not extract sub from token');
+                res.redirect(302, '/?error=invalid_token_sub');
+                return;
+            }
+            sub = payload.sub;
+            if (Array.isArray(payload.groups))
+                groups = payload.groups.filter((g) => typeof g === 'string');
+            else if (payload.realm_access && Array.isArray(payload.realm_access.roles))
+                groups = payload.realm_access.roles.filter((r) => typeof r === 'string');
+            if (typeof payload.iss === 'string')
+                realm = realmFromIssuer(payload.iss);
+            const g = payload.group_ids;
+            if (Array.isArray(g)) {
+                const ids = g.filter((x) => typeof x === 'string' && x.length > 0);
+                if (ids.length > 0)
+                    group_ids = ids;
+            }
+        }
+        catch {
+            structuredLogger.info('Auth callback: token payload parse failed');
+            res.redirect(302, '/?error=invalid_token_payload');
+            return;
+        }
+        if (sub === null) {
+            res.redirect(302, '/?error=invalid_token_sub');
+            return;
+        }
+        const exp = Math.floor(Date.now() / 1000) + SESSION_MAX_AGE_SEC;
+        const sessionPayload = {
+            sub,
+            groups,
+            realm,
+            exp
+        };
+        if (group_ids && group_ids.length > 0)
+            sessionPayload.group_ids = group_ids;
+        const cookieValue = signSession(sessionPayload);
+        res.setHeader('Set-Cookie', [
+            `${SESSION_COOKIE_NAME}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_MAX_AGE_SEC}`
+        ]);
+        res.redirect(302, '/auth/success');
+    });
+}
+//# sourceMappingURL=http-auth-callback.js.map