@ema.co/mcp-toolkit 0.2.0

package/dist/config.js

@@ -0,0 +1,136 @@
+/**
+ * Environment Configuration
+ *
+ * Defines Ema API environments and service settings.
+ * Used by both MCP server and CLI/service modes.
+ */
+import fs from "node:fs";
+import yaml from "js-yaml";
+import { z } from "zod";
+// ─────────────────────────────────────────────────────────────────────────────
+// Schema
+// ─────────────────────────────────────────────────────────────────────────────
+const EnvironmentSchema = z.object({
+    name: z.string().min(1),
+    baseUrl: z.string().url(),
+    bearerTokenEnv: z.string().min(1),
+    isMaster: z.boolean().optional().default(false),
+    // Deprecated but accepted for backward compatibility
+    userId: z.string().optional(),
+    templateIdMap: z.record(z.string()).optional(),
+});
+const SchedulerSchema = z.object({
+    intervalSeconds: z.number().int().positive().optional(),
+    cron: z.string().min(1).optional(),
+}).strict().refine((v) => v.cron || v.intervalSeconds, { message: "scheduler must set either intervalSeconds or cron" });
+const ServiceSchema = z.object({
+    stateDbPath: z.string().min(1).optional().default("./ema-state.sqlite3"),
+    scheduler: SchedulerSchema.optional(),
+}).strict();
+// Legacy schema for backward compatibility
+const LegacyRouteRuleSchema = z.object({
+    personaIds: z.array(z.string()).default([]),
+    targetEnvs: z.array(z.string()).default([]),
+    nameGlobs: z.array(z.string()).optional().default([]),
+    nameRegexes: z.array(z.string()).optional().default([]),
+    namePrefixes: z.array(z.string()).optional().default([]),
+}).passthrough();
+const AppConfigSchema = z.object({
+    environments: z.array(EnvironmentSchema).min(1),
+    service: ServiceSchema.optional(),
+    dryRun: z.boolean().optional().default(false),
+    verbose: z.boolean().optional().default(false),
+    // Legacy fields (kept for backward compatibility)
+    routing: z.array(LegacyRouteRuleSchema).optional(),
+    scheduler: SchedulerSchema.optional(),
+    stateDbPath: z.string().optional(),
+    eventSharedSecretEnv: z.string().optional(),
+}).refine((cfg) => {
+    // Validate at most one master
+    const masters = cfg.environments.filter((e) => e.isMaster);
+    return masters.length <= 1;
+}, { message: "At most one environment can be isMaster: true" });
+// ─────────────────────────────────────────────────────────────────────────────
+// Loading functions
+// ─────────────────────────────────────────────────────────────────────────────
+export function loadConfig(path) {
+    const raw = fs.readFileSync(path, "utf8");
+    const parsed = yaml.load(raw);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error("Invalid config YAML");
+    }
+    const res = AppConfigSchema.safeParse(parsed);
+    if (!res.success) {
+        const errors = res.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+        throw new Error(`Invalid config: ${errors.join("; ")}`);
+    }
+    return res.data;
+}
+export function loadConfigOptional(path) {
+    try {
+        return loadConfig(path);
+    }
+    catch (e) {
+        if (e && typeof e === "object" && "code" in e && e.code === "ENOENT") {
+            return null;
+        }
+        const msg = e instanceof Error ? e.message : String(e);
+        if (msg.includes("ENOENT"))
+            return null;
+        throw e;
+    }
+}
+export function loadConfigFromJsonEnv() {
+    const raw = process.env.EMA_CONFIG_JSON ?? process.env.EMA_AGENT_SYNC_CONFIG_JSON;
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("EMA_CONFIG_JSON is not valid JSON");
+    }
+    const res = validateConfig(parsed);
+    if (!res.ok) {
+        throw new Error(`Invalid EMA_CONFIG_JSON: ${res.errors.join("; ")}`);
+    }
+    return res.config;
+}
+export function validateConfig(input) {
+    const res = AppConfigSchema.safeParse(input);
+    if (!res.success) {
+        return { ok: false, errors: res.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`) };
+    }
+    return { ok: true, config: res.data };
+}
+export function configToYaml(cfg) {
+    return yaml.dump(cfg, { noRefs: true, sortKeys: true });
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Utilities
+// ─────────────────────────────────────────────────────────────────────────────
+export function resolveBearerToken(envVarName) {
+    const v = process.env[envVarName];
+    if (!v)
+        throw new Error(`Missing bearer token env var: ${envVarName}`);
+    // Strip "Bearer " prefix if user included it
+    const trimmed = v.trim();
+    if (trimmed.toLowerCase().startsWith("bearer ")) {
+        return trimmed.slice(7).trim();
+    }
+    return trimmed;
+}
+export function assertEnvVarsPresent(cfg) {
+    for (const e of cfg.environments) {
+        if (!process.env[e.bearerTokenEnv]) {
+            throw new Error(`Missing required env var for ${e.name}: ${e.bearerTokenEnv}`);
+        }
+    }
+}
+export function getMasterEnv(cfg) {
+    return cfg.environments.find((e) => e.isMaster);
+}
+export function getEnvByName(cfg, name) {
+    return cfg.environments.find((e) => e.name === name);
+}

package/dist/emaClient.js

@@ -0,0 +1,398 @@
+export class EmaApiError extends Error {
+    statusCode;
+    body;
+    constructor(opts) {
+        super(opts.message);
+        this.statusCode = opts.statusCode;
+        this.body = opts.body;
+        this.name = "EmaApiError";
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export class EmaClient {
+    env;
+    timeoutMs;
+    constructor(env, opts) {
+        this.env = env;
+        this.timeoutMs = opts?.timeoutMs ?? 30_000;
+    }
+    async requestWithRetries(method, path, opts) {
+        const retries = opts?.retries ?? 4;
+        const baseDelayMs = opts?.baseDelayMs ?? 500;
+        let lastErr;
+        for (let attempt = 0; attempt <= retries; attempt++) {
+            try {
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
+                const fullUrl = `${this.env.baseUrl.replace(/\/$/, "")}${path}`;
+                const response = await fetch(fullUrl, {
+                    method,
+                    headers: {
+                        Authorization: `Bearer ${this.env.bearerToken}`,
+                        "Content-Type": "application/json",
+                    },
+                    body: opts?.json !== undefined ? JSON.stringify(opts.json) : undefined,
+                    signal: controller.signal,
+                });
+                clearTimeout(timeoutId);
+                // Retry on transient errors
+                if ([429, 500, 502, 503, 504].includes(response.status) && attempt < retries) {
+                    const delay = baseDelayMs * 2 ** attempt;
+                    await sleep(delay);
+                    continue;
+                }
+                return response;
+            }
+            catch (e) {
+                lastErr = e instanceof Error ? e : new Error(String(e));
+                if (attempt >= retries)
+                    throw lastErr;
+                const delay = baseDelayMs * 2 ** attempt;
+                await sleep(delay);
+            }
+        }
+        throw lastErr ?? new Error("Unreachable");
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // AI Employees (Personas)
+    // ─────────────────────────────────────────────────────────────────────────────
+    async getPersonasForTenant() {
+        // Try POST first (original API), fall back to GET if 405
+        let resp = await this.requestWithRetries("POST", "/api/personas/get_personas_for_tenant", {
+            json: {},
+        });
+        // If POST fails with 405, try GET method
+        if (resp.status === 405) {
+            resp = await this.requestWithRetries("GET", "/api/personas/get_personas_for_tenant", {});
+        }
+        if (!resp.ok) {
+            throw new EmaApiError({
+                statusCode: resp.status,
+                body: await resp.text(),
+                message: `get_personas_for_tenant failed (${this.env.name})`,
+            });
+        }
+        const data = (await resp.json());
+        const personas = data.personas ?? data.configs ?? [];
+        return personas;
+    }
+    /** Alias: in the UI, personas are called "AI Employees" */
+    async getAiEmployeesForTenant() {
+        return this.getPersonasForTenant();
+    }
+    /**
+     * Get a single persona by ID with full details including workflow_def.
+     * Uses /api/personas/{id} endpoint which returns the complete persona including workflow_def.
+     */
+    async getPersonaById(personaId) {
+        // #region agent log
+        fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:getPersonaById:start', message: 'Fetching full persona details', data: { env: this.env.name, personaId }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'workflow-fix', hypothesisId: 'D' }) }).catch(() => { });
+        // #endregion
+        // Primary: /api/personas/{id} - returns full persona with workflow_def
+        try {
+            const resp = await this.requestWithRetries("GET", `/api/personas/${personaId}`, {});
+            if (resp.ok) {
+                const persona = (await resp.json());
+                // #region agent log
+                const wfActions = persona?.workflow_def?.actions;
+                fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:getPersonaById:success', message: 'Got full persona from /api/personas/{id}', data: { env: this.env.name, personaId, hasWorkflowDef: !!persona?.workflow_def, workflowActionsCount: Array.isArray(wfActions) ? wfActions.length : 0 }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'workflow-fix', hypothesisId: 'D' }) }).catch(() => { });
+                // #endregion
+                return persona;
+            }
+        }
+        catch {
+            // Fall through to fallback
+        }
+        // Fallback: /api/ai_employee/get_ai_employee endpoint
+        try {
+            const resp = await this.requestWithRetries("GET", `/api/ai_employee/get_ai_employee?persona_id=${personaId}`, {});
+            if (resp.ok) {
+                const data = (await resp.json());
+                const persona = data.persona ?? data.ai_employee ?? data.config ?? null;
+                // #region agent log
+                fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:getPersonaById:fallback', message: 'Got persona from fallback endpoint', data: { env: this.env.name, personaId, hasWorkflowDef: !!persona?.workflow_def }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'workflow-fix', hypothesisId: 'D' }) }).catch(() => { });
+                // #endregion
+                return persona;
+            }
+        }
+        catch {
+            // Fall through to return null
+        }
+        return null;
+    }
+    /**
+     * Get workflow definition by workflow_id.
+     * Tries multiple API endpoints to fetch the workflow.
+     */
+    async getWorkflowDef(workflowId) {
+        // Try gRPC-web style GetWorkflow endpoint
+        try {
+            const resp = await this.requestWithRetries("POST", "/workflows.v1.WorkflowManager/GetWorkflow", {
+                json: { workflow_id: workflowId },
+            });
+            if (resp.ok) {
+                const data = (await resp.json());
+                return data.workflow ?? (Object.keys(data).length > 0 ? data : null);
+            }
+        }
+        catch {
+            // Fall through
+        }
+        // Try GetWorkflowDefinition endpoint (alternate name)
+        try {
+            const resp = await this.requestWithRetries("POST", "/workflows.v1.WorkflowManager/GetWorkflowDefinition", {
+                json: { workflow_id: workflowId },
+            });
+            if (resp.ok) {
+                const data = (await resp.json());
+                return data;
+            }
+        }
+        catch {
+            // Fall through
+        }
+        // Try listing actions and constructing workflow
+        try {
+            const actions = await this.listActionsFromWorkflow(workflowId);
+            if (actions && actions.length > 0) {
+                // Return actions as part of workflow def (partial reconstruction)
+                return { workflow_id: workflowId, actions: actions };
+            }
+        }
+        catch {
+            // Fall through
+        }
+        return null;
+    }
+    async updateAiEmployee(req, opts) {
+        // #region agent log
+        if (opts?.verbose) {
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:updateAiEmployee:fullRequest', message: 'FULL UPDATE REQUEST', data: { env: this.env.name, fullRequest: req }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'full-request' }) }).catch(() => { });
+        }
+        // #endregion
+        const resp = await this.requestWithRetries("POST", "/api/ai_employee/update_ai_employee", {
+            json: req,
+        });
+        if (!resp.ok) {
+            const body = await resp.text();
+            // #region agent log
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:updateAiEmployee:error', message: 'UPDATE FAILED', data: { env: this.env.name, status: resp.status, body }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'api-error' }) }).catch(() => { });
+            // #endregion
+            throw new EmaApiError({
+                statusCode: resp.status,
+                body,
+                message: `update_ai_employee failed (${this.env.name})`,
+            });
+        }
+        const result = (await resp.json());
+        // #region agent log
+        if (opts?.verbose) {
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:updateAiEmployee:response', message: 'UPDATE RESPONSE', data: { env: this.env.name, responseKeys: Object.keys(result), response: result }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'full-response' }) }).catch(() => { });
+        }
+        // #endregion
+        return result;
+    }
+    async createAiEmployee(req, opts) {
+        // #region agent log
+        if (opts?.verbose) {
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:createAiEmployee:fullRequest', message: 'FULL CREATE REQUEST', data: { env: this.env.name, fullRequest: req }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'full-request' }) }).catch(() => { });
+        }
+        // #endregion
+        const resp = await this.requestWithRetries("POST", "/api/ai_employee/create_ai_employee", {
+            json: req,
+        });
+        if (!resp.ok) {
+            const body = await resp.text();
+            // #region agent log
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:createAiEmployee:error', message: 'CREATE FAILED', data: { env: this.env.name, status: resp.status, body }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'api-error' }) }).catch(() => { });
+            // #endregion
+            throw new EmaApiError({
+                statusCode: resp.status,
+                body,
+                message: `create_ai_employee failed (${this.env.name})`,
+            });
+        }
+        const result = (await resp.json());
+        // #region agent log
+        if (opts?.verbose) {
+            fetch('http://127.0.0.1:7242/ingest/4b191179-efb6-478a-b628-20269a94f0b3', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ location: 'emaClient.ts:createAiEmployee:response', message: 'CREATE RESPONSE', data: { env: this.env.name, responseKeys: Object.keys(result), response: result }, timestamp: Date.now(), sessionId: 'debug-session', runId: 'verbose-test', hypothesisId: 'full-response' }) }).catch(() => { });
+        }
+        // #endregion
+        return result;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Actions (displayed as "Agents" in the UI)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * List all actions available to the tenant.
+     * API endpoint: workflows.v1.ActionManager/ListActions
+     * UI label: "Agents"
+     */
+    async listActions() {
+        const resp = await this.requestWithRetries("POST", "/workflows.v1.ActionManager/ListActions", {
+            json: {},
+        });
+        if (!resp.ok) {
+            throw new EmaApiError({
+                statusCode: resp.status,
+                body: await resp.text(),
+                message: `listActions failed (${this.env.name})`,
+            });
+        }
+        const data = (await resp.json());
+        return data.actions ?? [];
+    }
+    /** Alias: in the UI, actions are called "Agents" */
+    async listAgents() {
+        return this.listActions();
+    }
+    /**
+     * List actions associated with a specific workflow.
+     * API endpoint: workflows.v1.ActionManager/ListActionsFromWorkflow
+     * UI label: "Agents"
+     *
+     * @param workflowId - The workflow ID to list actions for
+     */
+    async listActionsFromWorkflow(workflowId) {
+        const resp = await this.requestWithRetries("POST", "/workflows.v1.ActionManager/ListActionsFromWorkflow", { json: { workflow_id: workflowId } });
+        if (!resp.ok) {
+            throw new EmaApiError({
+                statusCode: resp.status,
+                body: await resp.text(),
+                message: `listActionsFromWorkflow failed (${this.env.name})`,
+            });
+        }
+        const data = (await resp.json());
+        return data.actions ?? [];
+    }
+    /** Alias: in the UI, actions are called "Agents" */
+    async listAgentsFromWorkflow(workflowId) {
+        return this.listActionsFromWorkflow(workflowId);
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Sync Metadata (tagging synced personas)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Sync tag regex patterns.
+     * Current format: <!-- synced_from:env/id -->
+     * Legacy formats also supported for backward compatibility.
+     */
+    static SYNC_TAG_REGEX = /<!-- synced_from:([^/]+)\/([a-f0-9-]+) -->/;
+    static LEGACY_JSON_REGEX = /<!-- _ema_sync:(.+?) -->/;
+    /**
+     * Get sync metadata from a persona's description.
+     * Returns null if the persona has never been synced.
+     */
+    getSyncMetadata(persona) {
+        // Check top-level description for sync tag
+        const desc = persona.description;
+        if (desc) {
+            const meta = this.extractSyncMetadataFromString(desc);
+            if (meta)
+                return meta;
+        }
+        // Fallback: check proto_config._ema_sync (legacy)
+        const protoConfig = persona.proto_config;
+        if (protoConfig?._ema_sync) {
+            return protoConfig._ema_sync;
+        }
+        return null;
+    }
+    /**
+     * Extract sync metadata from a string (description field).
+     * Supports both new compact format and legacy JSON format.
+     */
+    extractSyncMetadataFromString(text) {
+        // Try new compact format: <!-- synced_from:env/id -->
+        const compactMatch = text.match(EmaClient.SYNC_TAG_REGEX);
+        if (compactMatch) {
+            return {
+                master_env: compactMatch[1],
+                master_id: compactMatch[2],
+                synced_at: new Date().toISOString(),
+            };
+        }
+        // Try legacy JSON format: <!-- _ema_sync:{...} -->
+        const legacyMatch = text.match(EmaClient.LEGACY_JSON_REGEX);
+        if (legacyMatch) {
+            try {
+                return JSON.parse(legacyMatch[1]);
+            }
+            catch {
+                return null;
+            }
+        }
+        return null;
+    }
+    /**
+     * Check if a persona was synced from a master environment.
+     */
+    isSyncedPersona(persona) {
+        return this.getSyncMetadata(persona) !== null;
+    }
+    /**
+     * Regex to clean all sync tag formats from description.
+     */
+    static SYNC_CLEANUP_REGEX = /<!-- (?:synced_from|sync|_ema_sync):[^\n]*-->/g;
+    /**
+     * Extract the clean description (without sync marker).
+     */
+    getCleanDescription(description) {
+        if (!description)
+            return "";
+        return description.replace(EmaClient.SYNC_CLEANUP_REGEX, "").trim();
+    }
+    /**
+     * Build description with compact sync tag appended.
+     */
+    buildDescriptionWithSyncTag(cleanDescription, metadata) {
+        const marker = `<!-- synced_from:${metadata.master_env}/${metadata.master_id} -->`;
+        return cleanDescription ? `${cleanDescription}\n\n${marker}` : marker;
+    }
+    /**
+     * Tag a persona as synced by appending metadata to description.
+     */
+    async tagAsSynced(personaId, metadata, currentDescription, existingProtoConfig) {
+        const cleanDesc = this.getCleanDescription(currentDescription);
+        const newDescription = this.buildDescriptionWithSyncTag(cleanDesc, metadata);
+        await this.updateAiEmployee({
+            persona_id: personaId,
+            proto_config: existingProtoConfig ?? {},
+            description: newDescription,
+        });
+    }
+    /**
+     * Remove sync metadata from a persona (unlink from master).
+     */
+    async removeSyncTag(personaId, currentDescription, existingProtoConfig) {
+        const cleanDesc = this.getCleanDescription(currentDescription);
+        await this.updateAiEmployee({
+            persona_id: personaId,
+            proto_config: existingProtoConfig ?? {},
+            description: cleanDesc,
+        });
+    }
+    /**
+     * List all personas that have sync metadata (were synced from master).
+     */
+    async listSyncedPersonas() {
+        const personas = await this.getPersonasForTenant();
+        const synced = [];
+        for (const p of personas) {
+            const meta = this.getSyncMetadata(p);
+            if (meta) {
+                synced.push({ persona: p, syncMetadata: meta });
+            }
+        }
+        return synced;
+    }
+    /**
+     * Find a synced persona by its master environment and master ID.
+     */
+    async findSyncedPersona(masterEnv, masterId) {
+        const synced = await this.listSyncedPersonas();
+        return (synced.find((s) => s.syncMetadata.master_env === masterEnv && s.syncMetadata.master_id === masterId) ?? null);
+    }
+}

package/dist/index.js

@@ -0,0 +1,109 @@
+import process from "node:process";
+import Fastify from "fastify";
+import { assertEnvVarsPresent, configToYaml, getMasterEnv, loadConfigFromJsonEnv, loadConfigOptional, validateConfig, } from "./sdk/config.js";
+import { StateStore } from "./sdk/state.js";
+import { syncOnce } from "./sync.js";
+import crypto from "node:crypto";
+import { startScheduler } from "./scheduler.js";
+import { uiHtml, uiJs } from "./ui.js";
+import fs from "node:fs";
+import path from "node:path";
+async function main() {
+    const configPath = process.env.EMA_AGENT_SYNC_CONFIG ?? "./config.yaml";
+    const cfg = loadConfigFromJsonEnv() ?? loadConfigOptional(configPath);
+    const hasConfig = !!cfg;
+    const app = Fastify({ logger: true });
+    const state = new StateStore((cfg?.stateDbPath ?? "./ema-agent-sync.sqlite3"));
+    const sched = cfg ? startScheduler(cfg, state) : null;
+    app.get("/health", async () => ({ status: "ok", mode: hasConfig ? "sync" : "config-builder" }));
+    // --- Config wizard UI ---
+    app.get("/ui", async (_req, reply) => {
+        reply.header("Content-Type", "text/html; charset=utf-8");
+        return uiHtml();
+    });
+    app.get("/ui/app.js", async (_req, reply) => {
+        reply.header("Content-Type", "text/javascript; charset=utf-8");
+        return uiJs();
+    });
+    // --- Config helper APIs (used by UI) ---
+    app.post("/api/config/validate", async (req) => {
+        const result = validateConfig(req.body);
+        if (result.ok)
+            return { ok: true };
+        return { ok: false, errors: result.errors };
+    });
+    app.post("/api/config/yaml", async (req) => {
+        const result = validateConfig(req.body);
+        if (!result.ok)
+            return { ok: false, errors: result.errors };
+        return { ok: true, yaml: configToYaml(result.config) };
+    });
+    app.post("/api/config/save", async (req, reply) => {
+        const result = validateConfig(req.body);
+        if (!result.ok)
+            return { ok: false, errors: result.errors };
+        const out = String((req.headers["x-config-path"] ?? "./config.yaml"));
+        // Guard: only allow relative paths in cwd, no traversal
+        if (path.isAbsolute(out) || out.includes("..")) {
+            reply.code(400);
+            return { ok: false, errors: ["Invalid x-config-path (must be relative, no '..')"] };
+        }
+        const ext = path.extname(out);
+        if (ext !== ".yaml" && ext !== ".yml") {
+            reply.code(400);
+            return { ok: false, errors: ["Config path must end with .yaml or .yml"] };
+        }
+        fs.writeFileSync(out, configToYaml(result.config), "utf8");
+        return { ok: true, savedTo: out };
+    });
+    app.post("/events/persona-changed", async (req, reply) => {
+        if (!cfg) {
+            reply.code(400);
+            return { error: "ConfigMissing", message: "No config loaded. Create one via /ui or set EMA_AGENT_SYNC_CONFIG_JSON." };
+        }
+        // Useful for running just the UI wizard without having secrets set in the environment yet.
+        if (process.env.EMA_AGENT_SYNC_SKIP_ENV_CHECK !== "1") {
+            assertEnvVarsPresent(cfg);
+        }
+        // Optional shared secret auth
+        if (cfg.eventSharedSecretEnv) {
+            const expected = process.env[cfg.eventSharedSecretEnv];
+            const got = String((req.headers["x-ema-sync-secret"] ?? ""));
+            if (!expected) {
+                reply.code(500);
+                return { error: "ServerMisconfigured", message: "Missing event shared secret env var" };
+            }
+            const a = Buffer.from(expected);
+            const b = Buffer.from(got);
+            if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+                reply.code(401);
+                return { error: "Unauthorized" };
+            }
+        }
+        // Payload shape: { env, persona_id } (we still run full sync for now; targeted comes next)
+        const result = await syncOnce(cfg, state);
+        reply.code(202);
+        return { accepted: true, result };
+    });
+    const port = Number(process.env.PORT ?? 8080);
+    const host = process.env.HOST ?? "0.0.0.0";
+    await app.listen({ port, host });
+    if (cfg) {
+        const master = getMasterEnv(cfg);
+        // Ensure bearer tokens exist unless explicitly disabled
+        if (process.env.EMA_AGENT_SYNC_SKIP_ENV_CHECK !== "1") {
+            assertEnvVarsPresent(cfg);
+        }
+        app.log.info({ masterEnv: master?.name ?? "none" }, "started");
+        if (sched)
+            app.log.info("scheduler_started");
+    }
+    else {
+        app.log.info({ mode: "config-builder" }, "started_without_config");
+    }
+}
+main().catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error(err);
+    process.exit(1);
+});