@fias/plugin-dev-harness 1.3.1 → 1.4.1

package/dist/server/harness-server.js

@@ -44,7 +44,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startHarnessServer = startHarnessServer;
 const express_1 = __importDefault(require("express"));
-const crypto = __importStar(require("crypto"));
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const chalk_1 = __importDefault(require("chalk"));
@@ -58,14 +57,11 @@ async function startHarnessServer(options) {
     // Mutable state — toggled at runtime via UI
     let currentMode = 'mock';
     let currentEnvironment = options.defaultEnvironment;
-    let currentApiKey = (0, credentials_1.loadApiKeyForEnvironment)(currentEnvironment);
-    let pendingAuthState = null;
+    let currentAuthToken = (0, credentials_1.loadAuthTokenForEnvironment)(currentEnvironment);
+    let currentSession = (0, credentials_1.loadSessionForEnvironment)(currentEnvironment);
     function getCurrentApiUrl() {
         return config_loader_1.ENVIRONMENT_URLS[currentEnvironment].apiUrl;
     }
-    function getCurrentPlatformUrl() {
-        return config_loader_1.ENVIRONMENT_URLS[currentEnvironment].platformUrl;
-    }
     // Always create mock handler
     const mockHandler = new mock_handler_1.MockBridgeHandler({
         mockUser: options.mockUser,
@@ -73,9 +69,9 @@ async function startHarnessServer(options) {
         mockEntities: options.mockEntities,
     });
     // Create live handler (recreated when credentials or environment change)
-    let liveHandler = currentApiKey
+    let liveHandler = currentAuthToken
         ? new live_handler_1.LiveBridgeHandler({
-            apiKey: currentApiKey,
+            apiKey: currentAuthToken,
             apiUrl: getCurrentApiUrl(),
             permissions: options.permissions,
             mockUser: options.mockUser,
@@ -86,9 +82,9 @@ async function startHarnessServer(options) {
         return currentMode === 'live' && liveHandler ? liveHandler : mockHandler;
     }
     function rebuildLiveHandler() {
-        if (currentApiKey) {
+        if (currentAuthToken) {
             liveHandler = new live_handler_1.LiveBridgeHandler({
-                apiKey: currentApiKey,
+                apiKey: currentAuthToken,
                 apiUrl: getCurrentApiUrl(),
                 permissions: options.permissions,
                 mockUser: options.mockUser,
@@ -99,12 +95,44 @@ async function startHarnessServer(options) {
             liveHandler = null;
         }
     }
+    /**
+     * Refreshes the session token if expired.
+     * Returns true if the token is valid (or was refreshed), false if re-login is needed.
+     */
+    async function ensureValidToken() {
+        if (!currentSession)
+            return Boolean(currentAuthToken); // API key or no credentials
+        if (currentSession.expiresAt > Date.now() + 60000)
+            return true; // Valid with 1min buffer
+        try {
+            const response = await fetch(`${getCurrentApiUrl()}/developer/auth/refresh`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ refreshToken: currentSession.refreshToken }),
+            });
+            if (!response.ok)
+                return false;
+            const data = (await response.json());
+            currentSession = {
+                idToken: data.idToken,
+                refreshToken: currentSession.refreshToken,
+                expiresAt: Date.now() + data.expiresIn * 1000,
+            };
+            currentAuthToken = data.idToken;
+            (0, credentials_1.saveSessionForEnvironment)(currentEnvironment, currentSession);
+            rebuildLiveHandler();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     // Mode toggle endpoint — called by harness.js
     app.post('/api/mode', (req, res) => {
         const { mode } = req.body;
         if (mode === 'live') {
             if (!liveHandler) {
-                res.status(400).json({ error: 'No API key configured. Use the login button first.' });
+                res.status(400).json({ error: 'Not authenticated. Sign in first.' });
                 return;
             }
             currentMode = 'live';
@@ -115,49 +143,44 @@ async function startHarnessServer(options) {
         console.log(chalk_1.default.dim(`  Mode switched to ${currentMode.toUpperCase()}`));
         res.json({ mode: currentMode });
     });
-    // Login endpoint — saves API key and creates live handler
-    app.post('/api/login', (req, res) => {
-        const { apiKey } = req.body;
-        if (!apiKey || typeof apiKey !== 'string' || apiKey.trim().length === 0) {
-            res.status(400).json({ error: 'API key is required' });
+    // Auth login endpoint — authenticates with the platform and stores session
+    app.post('/api/auth/login', async (req, res) => {
+        const { email, password } = req.body;
+        if (!email || !password) {
+            res.status(400).json({ error: 'Email and password are required' });
             return;
         }
-        currentApiKey = apiKey.trim();
-        (0, credentials_1.saveApiKeyForEnvironment)(currentEnvironment, currentApiKey);
-        rebuildLiveHandler();
-        console.log(chalk_1.default.green(`  API key saved for ${currentEnvironment} environment`));
-        res.json({ success: true });
-    });
-    // Auth start endpoint — generates state token and returns auth URL for popup
-    app.post('/api/auth/start', (_req, res) => {
-        pendingAuthState = crypto.randomBytes(32).toString('hex');
-        const authUrl = `${getCurrentPlatformUrl()}/developer/cli-auth?port=${options.port}&state=${pendingAuthState}`;
-        res.json({ authUrl });
-    });
-    // Auth callback — receives redirect from CliAuthPage after browser login
-    app.get('/callback', (req, res) => {
-        const key = req.query.key;
-        const returnedState = req.query.state;
-        res.setHeader('Content-Type', 'text/html');
-        if (!pendingAuthState || returnedState !== pendingAuthState) {
-            res
-                .status(400)
-                .send(renderCallbackHtml('Authentication Failed', 'State mismatch. Please try again.', true));
-            return;
+        try {
+            const response = await fetch(`${getCurrentApiUrl()}/developer/auth`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email, password }),
+            });
+            const data = (await response.json());
+            if (!response.ok) {
+                res.status(response.status).json({ error: data.error?.message || 'Authentication failed' });
+                return;
+            }
+            if (!data.idToken || !data.refreshToken) {
+                res.status(500).json({ error: 'Invalid response from auth service' });
+                return;
+            }
+            currentSession = {
+                idToken: data.idToken,
+                refreshToken: data.refreshToken,
+                expiresAt: Date.now() + (data.expiresIn || 3600) * 1000,
+            };
+            currentAuthToken = data.idToken;
+            (0, credentials_1.saveSessionForEnvironment)(currentEnvironment, currentSession);
+            rebuildLiveHandler();
+            console.log(chalk_1.default.green(`  Authenticated for ${currentEnvironment} environment`));
+            res.json({ success: true, user: data.user });
         }
-        if (!key || !key.startsWith('fias_sk_')) {
-            res
-                .status(400)
-                .send(renderCallbackHtml('Authentication Failed', 'Invalid API key received.', true));
-            return;
+        catch (err) {
+            res.status(500).json({
+                error: err instanceof Error ? err.message : 'Failed to connect to auth service',
+            });
         }
-        // Save key for current environment
-        currentApiKey = key;
-        (0, credentials_1.saveApiKeyForEnvironment)(currentEnvironment, currentApiKey);
-        rebuildLiveHandler();
-        pendingAuthState = null;
-        console.log(chalk_1.default.green(`  Authenticated for ${currentEnvironment} environment`));
-        res.send(renderCallbackHtml('Authentication Successful', 'You can close this window. The harness will switch to live mode automatically.', false));
     });
     // Environment switch endpoint
     app.post('/api/environment', (req, res) => {
@@ -167,9 +190,10 @@ async function startHarnessServer(options) {
             return;
         }
         currentEnvironment = environment;
-        currentApiKey = (0, credentials_1.loadApiKeyForEnvironment)(currentEnvironment);
+        currentAuthToken = (0, credentials_1.loadAuthTokenForEnvironment)(currentEnvironment);
+        currentSession = (0, credentials_1.loadSessionForEnvironment)(currentEnvironment);
         rebuildLiveHandler();
-        // Fall back to mock if no key for this environment
+        // Fall back to mock if no credentials for this environment
         if (currentMode === 'live' && !liveHandler) {
             currentMode = 'mock';
         }
@@ -177,11 +201,20 @@ async function startHarnessServer(options) {
         res.json({
             environment: currentEnvironment,
             mode: currentMode,
-            hasCredentials: Boolean(currentApiKey),
+            hasCredentials: Boolean(currentAuthToken),
         });
     });
     // Bridge API endpoint — called by harness.js
     app.post('/api/bridge', async (req, res) => {
+        // Refresh token if needed before proxying
+        if (currentMode === 'live') {
+            const valid = await ensureValidToken();
+            if (!valid) {
+                currentMode = 'mock';
+                res.status(401).json({ error: 'Session expired. Please sign in again.' });
+                return;
+            }
+        }
         try {
             const result = await getActiveHandler().handle(req.body);
             res.json(result);
@@ -194,13 +227,13 @@ async function startHarnessServer(options) {
     });
     // Credit balance endpoint
     app.get('/api/credits', async (_req, res) => {
-        if (currentMode !== 'live' || !currentApiKey) {
+        if (currentMode !== 'live' || !currentAuthToken) {
             res.json({ balance: null });
             return;
         }
         try {
             const response = await fetch(`${getCurrentApiUrl()}/developer/credits`, {
-                headers: { Authorization: `Bearer ${currentApiKey}` },
+                headers: { Authorization: `Bearer ${currentAuthToken}` },
             });
             if (!response.ok) {
                 res.status(response.status).json({ error: 'Failed to fetch credits' });
@@ -214,7 +247,7 @@ async function startHarnessServer(options) {
                 .json({ error: err instanceof Error ? err.message : 'Failed to fetch credits' });
         }
     });
-    // Plugin reachability check — called by harness.js before loading iframe
+    // Plugin reachability check
     app.get('/api/check-plugin', async (_req, res) => {
         try {
             const controller = new AbortController();
@@ -227,21 +260,19 @@ async function startHarnessServer(options) {
             res.json({ reachable: false });
         }
     });
-    // Harness config endpoint — provides config to the frontend
+    // Harness config endpoint
     app.get('/api/config', (_req, res) => {
         res.json({
             pluginUrl: options.pluginUrl,
             mode: currentMode,
-            hasCredentials: Boolean(currentApiKey),
+            hasCredentials: Boolean(currentAuthToken),
             permissions: options.permissions,
             mockTheme: options.mockTheme,
             environment: currentEnvironment,
-            platformUrl: getCurrentPlatformUrl(),
         });
     });
     // Serve static harness files
     const staticDir = path.join(__dirname, 'static');
-    // In development (ts-node) vs built (dist), static may be in different locations
     const possibleStaticDirs = [
         staticDir,
         path.join(__dirname, '..', 'server', 'static'),
@@ -255,7 +286,6 @@ async function startHarnessServer(options) {
         }
     }
     app.use('/static', express_1.default.static(resolvedStaticDir));
-    // Serve harness HTML at root
     app.get('/', (_req, res) => {
         const htmlPath = path.join(resolvedStaticDir, 'harness.html');
         if (fs.existsSync(htmlPath)) {
@@ -273,7 +303,6 @@ async function startHarnessServer(options) {
             console.log(chalk_1.default.dim(`  Mode: MOCK (toggle to LIVE in the toolbar)`));
             console.log(chalk_1.default.dim(`  Environment: ${currentEnvironment.toUpperCase()}`));
             console.log('');
-            // Check if plugin dev server is reachable
             checkPluginReachable(options.pluginUrl).then((reachable) => {
                 if (reachable) {
                     console.log(chalk_1.default.green(`  ✓ Plugin server is reachable at ${options.pluginUrl}\n`));
@@ -288,32 +317,6 @@ async function startHarnessServer(options) {
         });
     });
 }
-/**
- * Renders the HTML page shown in the popup after auth callback.
- * Sends a postMessage to the opener window and auto-closes.
- */
-function renderCallbackHtml(title, message, isError) {
-    const color = isError ? '#ef4444' : '#22c55e';
-    const postMessageScript = isError
-        ? `if(window.opener){window.opener.postMessage({type:'auth_callback',success:false,error:${JSON.stringify(title)}},'*');}`
-        : `if(window.opener){window.opener.postMessage({type:'auth_callback',success:true},'*');setTimeout(function(){window.close()},1500);}`;
-    return `<!DOCTYPE html>
-<html>
-<head><title>${title}</title></head>
-<body style="font-family: -apple-system, system-ui, sans-serif; display: flex; justify-content: center; padding-top: 80px; background: #111; color: #e5e7eb;">
-  <div style="text-align: center; max-width: 400px;">
-    <h1 style="color: ${color}; font-size: 1.5rem;">${title}</h1>
-    <p style="margin-top: 12px; color: #9ca3af;">${message}</p>
-  </div>
-  <script>${postMessageScript}</script>
-</body>
-</html>`;
-}
-/**
- * Fallback HTML when static files haven't been copied to dist.
- * This enables the harness to work during development.
- * Mirrors the structure of harness.html but with inline styles/scripts.
- */
 function generateFallbackHtml(options) {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -331,9 +334,7 @@ function generateFallbackHtml(options) {
         <option value="staging"${options.defaultEnvironment === 'staging' ? ' selected' : ''}>STAGING</option>
         <option value="production"${options.defaultEnvironment === 'production' ? ' selected' : ''}>PRODUCTION</option>
       </select>
-      <button id="mode-badge" class="mode-badge mode-mock" title="Click to switch mode">
-        MOCK \u21C6
-      </button>
+      <button id="mode-badge" class="mode-badge mode-mock" title="Click to switch mode">MOCK \\u21C6</button>
     </div>
     <div class="toolbar-right">
       <span id="credit-balance" class="credit-balance" style="display: none"></span>
@@ -344,38 +345,24 @@ function generateFallbackHtml(options) {
   </div>
   <div id="login-modal" class="modal-overlay" style="display: none">
     <div class="modal">
-      <h3>Connect to FIAS</h3>
-      <p>Sign in to your FIAS account to enable live mode with real AI responses.</p>
-      <div id="login-popup-section">
-        <button id="login-popup-btn" class="btn-primary btn-full">Sign in with FIAS</button>
-        <p id="login-popup-hint" class="modal-hint" style="display:none">Popup blocked? <a id="login-popup-link" href="#" target="_blank" style="color:#a78bfa">Open login page manually</a></p>
-        <div class="modal-divider"><span>or</span></div>
-        <button id="login-manual-toggle" class="btn-link">Enter API key manually</button>
-      </div>
-      <div id="login-manual-section" style="display:none">
-        <input id="login-input" type="password" class="modal-input" placeholder="fias_sk_..." autocomplete="off" />
-        <div class="modal-actions">
-          <button id="login-cancel" class="btn-secondary">Cancel</button>
-          <button id="login-submit" class="btn-primary">Save &amp; Connect</button>
-        </div>
-      </div>
+      <h3>Sign in to FIAS</h3>
+      <p>Signing in to <strong id="login-target"></strong></p>
+      <input id="login-email" type="email" class="modal-input" placeholder="Email" autocomplete="email" />
+      <input id="login-password" type="password" class="modal-input" placeholder="Password" autocomplete="current-password" />
       <div id="login-error" class="modal-error" style="display: none"></div>
+      <div class="modal-actions">
+        <button id="login-cancel" class="btn-secondary">Cancel</button>
+        <button id="login-submit" class="btn-primary">Sign in</button>
+      </div>
     </div>
   </div>
   <div id="plugin-status" class="plugin-status">
     <div class="status-spinner"></div>
     <p>Connecting to plugin server...</p>
   </div>
-  <iframe
-    id="plugin-iframe"
-    class="hidden"
-    sandbox="allow-scripts allow-forms allow-same-origin"
-  ></iframe>
+  <iframe id="plugin-iframe" class="hidden" sandbox="allow-scripts allow-forms allow-same-origin"></iframe>
   <div id="console-panel" class="console-panel">
-    <div class="console-header" id="console-toggle">
-      <span>Dev Console</span>
-      <span id="console-count">0 messages</span>
-    </div>
+    <div class="console-header" id="console-toggle"><span>Dev Console</span><span id="console-count">0 messages</span></div>
     <div class="console-body" id="console-body"></div>
   </div>
   <script>${EMBEDDED_JS}</script>
@@ -394,8 +381,7 @@ async function checkPluginReachable(url) {
         return false;
     }
 }
-const EMBEDDED_CSS = `
-* { margin: 0; padding: 0; box-sizing: border-box; }
+const EMBEDDED_CSS = `* { margin: 0; padding: 0; box-sizing: border-box; }
 body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #0a0a0f; color: #e4e4e7; display: flex; flex-direction: column; height: 100vh; }
 .toolbar { display: flex; justify-content: space-between; align-items: center; padding: 8px 16px; background: #18181b; border-bottom: 1px solid #3f3f46; flex-shrink: 0; }
 .toolbar-left, .toolbar-right { display: flex; align-items: center; gap: 12px; }
@@ -403,9 +389,8 @@ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; b
 .env-selector { background: #27272a; color: #a1a1aa; border: 1px solid #3f3f46; border-radius: 4px; padding: 3px 8px; font-size: 11px; font-weight: 600; cursor: pointer; outline: none; text-transform: uppercase; }
 .env-selector:hover { border-color: #52525b; }
 .env-selector:focus { border-color: #a78bfa; }
-.mode-badge { padding: 3px 10px; border-radius: 4px; font-size: 11px; font-weight: 600; text-transform: uppercase; cursor: pointer; transition: background 0.15s, border-color 0.15s; user-select: none; }
+.mode-badge { padding: 3px 10px; border-radius: 4px; font-size: 11px; font-weight: 600; text-transform: uppercase; cursor: pointer; transition: background 0.15s; user-select: none; }
 .mode-badge:hover { filter: brightness(1.3); }
-.mode-badge:active { filter: brightness(0.9); }
 .mode-mock { background: #166534; color: #86efac; border: 1px solid #22c55e; }
 .mode-live { background: #854d0e; color: #fde047; border: 1px solid #eab308; }
 .theme-badge { padding: 2px 8px; border-radius: 4px; font-size: 11px; font-weight: 600; text-transform: uppercase; }
@@ -417,22 +402,16 @@ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; b
 .modal-overlay { position: fixed; inset: 0; background: rgba(0,0,0,0.7); display: flex; align-items: center; justify-content: center; z-index: 1000; }
 .modal { background: #27272a; border: 1px solid #3f3f46; border-radius: 8px; padding: 24px; width: 420px; max-width: 90vw; }
 .modal h3 { font-size: 16px; color: #e4e4e7; margin-bottom: 8px; }
-.modal p { font-size: 13px; color: #a1a1aa; line-height: 1.5; margin-bottom: 4px; }
-.modal-hint { font-size: 12px !important; color: #6b7280 !important; margin-bottom: 16px !important; }
-.modal-input { width: 100%; padding: 8px 12px; background: #18181b; border: 1px solid #3f3f46; border-radius: 4px; color: #e4e4e7; font-family: monospace; font-size: 13px; margin-bottom: 12px; outline: none; }
+.modal p { font-size: 13px; color: #a1a1aa; line-height: 1.5; margin-bottom: 16px; }
+.modal-input { width: 100%; padding: 8px 12px; background: #18181b; border: 1px solid #3f3f46; border-radius: 4px; color: #e4e4e7; font-size: 13px; margin-bottom: 12px; outline: none; }
 .modal-input:focus { border-color: #a78bfa; }
 .modal-error { font-size: 12px; color: #fca5a5; margin-bottom: 12px; }
 .modal-actions { display: flex; justify-content: flex-end; gap: 8px; }
-.btn-primary { background: #ffffff; color: #0a0a0a; border: none; padding: 6px 16px; border-radius: 4px; cursor: pointer; font-size: 13px; font-weight: 500; }
+.btn-primary { background: #fff; color: #0a0a0a; border: none; padding: 6px 16px; border-radius: 4px; cursor: pointer; font-size: 13px; font-weight: 500; }
 .btn-primary:hover { background: #e5e5e5; }
 .btn-primary:disabled { opacity: 0.5; cursor: not-allowed; }
-.btn-full { width: 100%; padding: 10px 16px; margin-bottom: 12px; }
 .btn-secondary { background: transparent; color: #a1a1aa; border: 1px solid #3f3f46; padding: 6px 16px; border-radius: 4px; cursor: pointer; font-size: 13px; }
 .btn-secondary:hover { background: #3f3f46; }
-.btn-link { background: none; border: none; color: #a78bfa; cursor: pointer; font-size: 12px; padding: 0; }
-.btn-link:hover { text-decoration: underline; }
-.modal-divider { display: flex; align-items: center; gap: 12px; margin: 12px 0; color: #6b7280; font-size: 12px; }
-.modal-divider::before, .modal-divider::after { content: ''; flex: 1; height: 1px; background: #3f3f46; }
 .plugin-status { flex: 1; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 16px; color: #a1a1aa; font-size: 14px; }
 .plugin-status.hidden { display: none; }
 .plugin-status.error { color: #fca5a5; }
@@ -443,253 +422,13 @@ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; b
 #plugin-iframe { flex: 1; border: none; width: 100%; }
 #plugin-iframe.hidden { display: none; }
 .console-panel { flex-shrink: 0; border-top: 1px solid #3f3f46; background: #18181b; max-height: 250px; display: flex; flex-direction: column; }
-.console-header { display: flex; justify-content: space-between; padding: 6px 16px; cursor: pointer; font-size: 12px; color: #a1a1aa; border-bottom: 1px solid #27272a; }
+.console-header { display: flex; justify-content: space-between; padding: 6px 16px; cursor: pointer; font-size: 12px; color: #a1a1aa; }
 .console-body { overflow-y: auto; padding: 8px 16px; font-family: monospace; font-size: 11px; flex: 1; display: none; }
 .console-body.open { display: block; }
 .log-entry { padding: 2px 0; border-bottom: 1px solid #1e1e22; }
 .log-info { color: #93c5fd; }
 .log-warn { color: #fde047; }
 .log-error { color: #fca5a5; }
-.log-time { color: #6b7280; margin-right: 8px; }
-.log-cost { color: #fbbf24; margin-left: 8px; }
-`;
-// The embedded JS is a minified version of harness.js for the fallback page.
-const EMBEDDED_JS = `
-(function() {
-  var iframe = document.getElementById('plugin-iframe');
-  var consoleBody = document.getElementById('console-body');
-  var consoleCount = document.getElementById('console-count');
-  var consoleToggle = document.getElementById('console-toggle');
-  var creditBalance = document.getElementById('credit-balance');
-  var themeToggle = document.getElementById('theme-toggle');
-  var reloadBtn = document.getElementById('reload-btn');
-  var modeBadge = document.getElementById('mode-badge');
-  var themeBadge = document.getElementById('theme-badge');
-  var pluginStatus = document.getElementById('plugin-status');
-  var loginModal = document.getElementById('login-modal');
-  var loginInput = document.getElementById('login-input');
-  var loginError = document.getElementById('login-error');
-  var loginSubmit = document.getElementById('login-submit');
-  var loginCancel = document.getElementById('login-cancel');
-  var envSelector = document.getElementById('env-selector');
-  var loginPopupBtn = document.getElementById('login-popup-btn');
-  var loginPopupHint = document.getElementById('login-popup-hint');
-  var loginPopupLink = document.getElementById('login-popup-link');
-  var loginManualToggle = document.getElementById('login-manual-toggle');
-  var loginManualSection = document.getElementById('login-manual-section');
-  var loginPopupSection = document.getElementById('login-popup-section');
-
-  var messageCount = 0;
-  var currentTheme = 'dark';
-  var currentMode = 'mock';
-  var currentEnvironment = 'staging';
-  var hasCredentials = false;
-  var cachedConfig = null;
-  var authPollInterval = null;
-
-  var PERMISSION_MAP = {
-    get_user: 'user:profile:read', get_theme: 'theme:read', entity_invoke: 'entities:invoke',
-    storage_read: 'storage:sandbox', storage_write: 'storage:sandbox',
-    storage_list: 'storage:sandbox', storage_delete: 'storage:sandbox',
-  };
-  var RATE_LIMITS = {
-    entity_invoke: { maxPerMinute: 60 }, storage_write: { maxPerMinute: 120 },
-    storage_read: { maxPerMinute: 300 }, storage_list: { maxPerMinute: 60 },
-    storage_delete: { maxPerMinute: 60 },
-  };
-  var rateBuckets = {};
-
-  var SYSTEM_FONTS = '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif';
-  var MONO_FONTS = '"SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace';
-  var SPACING = { xs: '4px', sm: '8px', md: '16px', lg: '24px', xl: '32px' };
-  var FONTS = { body: SYSTEM_FONTS, heading: SYSTEM_FONTS, mono: MONO_FONTS };
-
-  fetch('/api/config').then(function(r) { return r.json(); }).then(function(config) {
-    cachedConfig = config;
-    currentTheme = config.mockTheme || 'dark';
-    currentMode = config.mode || 'mock';
-    currentEnvironment = config.environment || 'staging';
-    hasCredentials = config.hasCredentials || false;
-    envSelector.value = currentEnvironment;
-    updateThemeBadge();
-    updateModeBadge();
-    if (currentMode === 'live') { creditBalance.style.display = 'inline'; fetchCredits(); }
-    checkPluginReachable(function(reachable) {
-      if (reachable) { pluginStatus.classList.add('hidden'); iframe.classList.remove('hidden'); iframe.src = config.pluginUrl; }
-      else { pluginStatus.classList.add('error'); pluginStatus.innerHTML = '<p><strong>Plugin server not reachable</strong></p><p>Make sure your plugin dev server is running.</p>'; iframe.classList.add('hidden'); }
-    });
-  });
-
-  consoleToggle.addEventListener('click', function() { consoleBody.classList.toggle('open'); });
-  reloadBtn.addEventListener('click', function() { if (cachedConfig) { iframe.src = cachedConfig.pluginUrl; } });
-
-  themeToggle.addEventListener('click', function() {
-    currentTheme = currentTheme === 'dark' ? 'light' : 'dark';
-    updateThemeBadge();
-    sendToPlugin({ type: 'theme_update', messageId: 'theme_' + Date.now(), payload: getTheme() });
-  });
-
-  modeBadge.addEventListener('click', function() {
-    if (currentMode === 'mock') {
-      if (!hasCredentials) { showLoginModal(); return; }
-      switchMode('live');
-    } else { switchMode('mock'); }
-  });
-
-  envSelector.addEventListener('change', function() {
-    fetch('/api/environment', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ environment: envSelector.value }) })
-      .then(function(r) { return r.json(); })
-      .then(function(data) {
-        currentEnvironment = data.environment;
-        currentMode = data.mode;
-        hasCredentials = data.hasCredentials;
-        updateModeBadge();
-        if (currentMode === 'live') { creditBalance.style.display = 'inline'; fetchCredits(); }
-        else { creditBalance.style.display = 'none'; creditBalance.textContent = ''; }
-        logMessage('info', 'Environment: ' + currentEnvironment.toUpperCase() + (hasCredentials ? '' : ' (not authenticated)'));
-      }).catch(function(err) { logMessage('error', err.message); });
-  });
-
-  function switchMode(newMode) {
-    fetch('/api/mode', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: newMode }) })
-      .then(function(r) { if (!r.ok) return r.json().then(function(e) { throw new Error(e.error); }); return r.json(); })
-      .then(function(data) {
-        currentMode = data.mode; updateModeBadge();
-        if (currentMode === 'live') { creditBalance.style.display = 'inline'; fetchCredits(); }
-        else { creditBalance.style.display = 'none'; creditBalance.textContent = ''; }
-      }).catch(function(err) { logMessage('error', err.message); });
-  }
-
-  function showLoginModal() {
-    loginModal.style.display = 'flex';
-    loginPopupSection.style.display = 'block';
-    loginManualSection.style.display = 'none';
-    loginPopupHint.style.display = 'none';
-    loginError.style.display = 'none';
-    loginPopupBtn.disabled = false;
-    loginPopupBtn.textContent = 'Sign in with FIAS';
-  }
-  function hideLoginModal() { loginModal.style.display = 'none'; stopAuthPolling(); }
-
-  loginCancel && loginCancel.addEventListener('click', hideLoginModal);
-  loginModal.addEventListener('click', function(e) { if (e.target === loginModal) hideLoginModal(); });
-
-  loginManualToggle && loginManualToggle.addEventListener('click', function() {
-    loginPopupSection.style.display = 'none';
-    loginManualSection.style.display = 'block';
-    loginInput.focus();
-  });
-
-  loginInput.addEventListener('keydown', function(e) { if (e.key === 'Enter') submitLogin(); if (e.key === 'Escape') hideLoginModal(); });
-  loginSubmit.addEventListener('click', submitLogin);
-
-  loginPopupBtn && loginPopupBtn.addEventListener('click', function() {
-    loginPopupBtn.disabled = true;
-    loginPopupBtn.textContent = 'Opening...';
-    fetch('/api/auth/start', { method: 'POST' })
-      .then(function(r) { return r.json(); })
-      .then(function(data) {
-        var popup = window.open(data.authUrl, 'fias-auth', 'width=500,height=650');
-        if (!popup || popup.closed) {
-          loginPopupHint.style.display = 'block';
-          loginPopupLink.href = data.authUrl;
-          loginPopupBtn.disabled = false;
-          loginPopupBtn.textContent = 'Sign in with FIAS';
-        } else {
-          loginPopupBtn.textContent = 'Waiting for sign-in...';
-        }
-        startAuthPolling();
-      }).catch(function(err) {
-        loginError.textContent = err.message;
-        loginError.style.display = 'block';
-        loginPopupBtn.disabled = false;
-        loginPopupBtn.textContent = 'Sign in with FIAS';
-      });
-  });
-
-  window.addEventListener('message', function(event) {
-    if (event.data && event.data.type === 'auth_callback') {
-      stopAuthPolling();
-      if (event.data.success) {
-        hasCredentials = true;
-        hideLoginModal();
-        logMessage('info', 'Authenticated for ' + currentEnvironment.toUpperCase());
-        switchMode('live');
-      } else {
-        loginError.textContent = event.data.error || 'Authentication failed';
-        loginError.style.display = 'block';
-      }
-      loginPopupBtn.disabled = false;
-      loginPopupBtn.textContent = 'Sign in with FIAS';
-      return;
-    }
-    if (event.source !== iframe.contentWindow) return;
-    var data = event.data;
-    if (!data || typeof data !== 'object' || !data.type || !data.messageId) return;
-    logMessage('recv', data.type, data.payload);
-    if (data.type === 'ready') return;
-    if (data.type === 'resize') { var h = data.payload && data.payload.height; if (typeof h === 'number' && h > 0) { iframe.style.height = h + 'px'; iframe.style.flex = 'none'; } return; }
-    if (data.type === 'toast') { var msg = data.payload && data.payload.message; if (typeof msg === 'string') logMessage('toast', msg); return; }
-    if (data.type === 'navigate') { var p = data.payload && data.payload.path; if (typeof p === 'string') logMessage('nav', p); return; }
-    handleRequest(data);
-  });
-
-  function handleRequest(data) {
-    try {
-      var requiredPerm = PERMISSION_MAP[data.type];
-      if (requiredPerm && cachedConfig && cachedConfig.permissions.indexOf(requiredPerm) === -1) throw new Error('Permission denied: ' + requiredPerm);
-      checkRateLimit(data.type);
-    } catch (err) { logMessage('error', err.message); sendToPlugin({ type: 'response', messageId: data.messageId, payload: null, error: err.message }); return; }
-    fetch('/api/bridge', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ type: data.type, payload: data.payload }) })
-      .then(function(r) { if (!r.ok) return r.json().then(function(e) { throw new Error(e.error || 'Bridge call failed'); }); return r.json(); })
-      .then(function(result) {
-        logMessage('send', 'response', result);
-        if (data.type === 'entity_invoke' && result.metadata && result.metadata.cost > 0) { logMessage('cost', 'Credits: ' + result.metadata.cost.toFixed(4)); fetchCredits(); }
-        sendToPlugin({ type: 'response', messageId: data.messageId, payload: result });
-      })
-      .catch(function(err) { logMessage('error', err.message); sendToPlugin({ type: 'response', messageId: data.messageId, payload: null, error: err.message }); });
-  }
-
-  iframe.addEventListener('load', function() {
-    if (!cachedConfig) return;
-    sendToPlugin({ type: 'init', messageId: 'init_0', payload: { archId: 'dev_harness', permissions: cachedConfig.permissions, theme: getTheme(), currentPath: '/' } });
-    logMessage('send', 'init');
-  });
-
-  function startAuthPolling() { if (authPollInterval) return; authPollInterval = setInterval(function() { fetch('/api/config').then(function(r){return r.json();}).then(function(c){ if(c.hasCredentials&&!hasCredentials){hasCredentials=true;stopAuthPolling();hideLoginModal();logMessage('info','Authenticated for '+currentEnvironment.toUpperCase());switchMode('live');} }).catch(function(){}); }, 2000); }
-  function stopAuthPolling() { if (authPollInterval) { clearInterval(authPollInterval); authPollInterval = null; } }
-  function updateModeBadge() {
-    modeBadge.textContent = currentMode.toUpperCase() + ' \\u21C6';
-    modeBadge.className = 'mode-badge ' + (currentMode === 'live' ? 'mode-live' : 'mode-mock');
-    modeBadge.title = 'Click to switch to ' + (currentMode === 'live' ? 'Mock' : 'Live') + ' mode';
-  }
-  function updateThemeBadge() { themeBadge.textContent = currentTheme.toUpperCase(); themeBadge.className = 'theme-badge theme-' + currentTheme; document.body.style.background = currentTheme === 'light' ? '#ffffff' : '#0a0a0a'; }
-  function sendToPlugin(message) { iframe.contentWindow && iframe.contentWindow.postMessage(message, '*'); }
-  function checkRateLimit(type) { var limit = RATE_LIMITS[type]; if (!limit) return; var now = Date.now(); var bucket = rateBuckets[type]; if (!bucket || now - bucket.windowStart > 60000) { rateBuckets[type] = { count: 1, windowStart: now }; return; } if (bucket.count >= limit.maxPerMinute) throw new Error('Rate limit exceeded for ' + type); bucket.count++; }
-  function getTheme() {
-    if (currentTheme === 'light') return { mode: 'light', colors: { primary: '#171717', secondary: '#e5e5e5', background: '#ffffff', surface: '#fafafa', text: '#0a0a0a', textSecondary: '#737373', border: '#e5e5e5', error: '#dc2626', warning: '#d97706', success: '#16a34a' }, spacing: SPACING, fonts: FONTS };
-    return { mode: 'dark', colors: { primary: '#ffffff', secondary: '#1f1f1f', background: '#0a0a0a', surface: '#171717', text: '#ffffff', textSecondary: '#a6a6a6', border: '#2e2e2e', error: '#ef4444', warning: '#f59e0b', success: '#22c55e' }, spacing: SPACING, fonts: FONTS };
-  }
-  function checkPluginReachable(cb) { fetch('/api/check-plugin').then(function(r) { return r.json(); }).then(function(d) { cb(d.reachable); }).catch(function() { cb(true); }); }
-  function fetchCredits() { fetch('/api/credits').then(function(r) { return r.json(); }).then(function(d) { if (d.balance != null && isFinite(d.balance)) creditBalance.textContent = 'Credits: ' + d.balance.toFixed(2); }).catch(function() {}); }
-  function logMessage(dir, type, payload) {
-    messageCount++; consoleCount.textContent = messageCount + ' messages';
-    var entry = document.createElement('div'); entry.className = 'log-entry';
-    var cls = 'log-info'; if (dir === 'error') cls = 'log-error'; if (dir === 'warn' || dir === 'cost' || dir === 'toast') cls = 'log-warn';
-    var text = '<span class="log-time">' + new Date().toLocaleTimeString() + '</span><span class="' + cls + '">[' + dir.toUpperCase() + '] ' + type + '</span>';
-    if (payload && typeof payload === 'object') text += ' <span style="color:#6b7280">' + JSON.stringify(payload).substring(0, 120) + '</span>';
-    entry.innerHTML = text; consoleBody.appendChild(entry); consoleBody.scrollTop = consoleBody.scrollHeight;
-  }
-  function submitLogin() {
-    var apiKey = loginInput.value.trim();
-    if (!apiKey) { loginError.textContent = 'Please enter an API key.'; loginError.style.display = 'block'; return; }
-    loginSubmit.disabled = true; loginSubmit.textContent = 'Connecting...';
-    fetch('/api/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ apiKey: apiKey }) })
-      .then(function(r) { if (!r.ok) return r.json().then(function(e) { throw new Error(e.error); }); return r.json(); })
-      .then(function() { hasCredentials = true; hideLoginModal(); switchMode('live'); })
-      .catch(function(err) { loginError.textContent = err.message; loginError.style.display = 'block'; })
-      .finally(function() { loginSubmit.disabled = false; loginSubmit.textContent = 'Save & Connect'; });
-  }
-})();
-`;
+.log-time { color: #6b7280; margin-right: 8px; }`;
+const EMBEDDED_JS = `(function(){var iframe=document.getElementById('plugin-iframe'),consoleBody=document.getElementById('console-body'),consoleCount=document.getElementById('console-count'),consoleToggle=document.getElementById('console-toggle'),creditBalance=document.getElementById('credit-balance'),themeToggle=document.getElementById('theme-toggle'),reloadBtn=document.getElementById('reload-btn'),modeBadge=document.getElementById('mode-badge'),themeBadge=document.getElementById('theme-badge'),pluginStatus=document.getElementById('plugin-status'),loginModal=document.getElementById('login-modal'),loginEmail=document.getElementById('login-email'),loginPassword=document.getElementById('login-password'),loginError=document.getElementById('login-error'),loginSubmit=document.getElementById('login-submit'),loginCancel=document.getElementById('login-cancel'),envSelector=document.getElementById('env-selector'),loginTarget=document.getElementById('login-target');var messageCount=0,currentTheme='dark',currentMode='mock',currentEnvironment='staging',hasCredentials=false,cachedConfig=null;var PM={get_user:'user:profile:read',get_theme:'theme:read',entity_invoke:'entities:invoke',storage_read:'storage:sandbox',storage_write:'storage:sandbox',storage_list:'storage:sandbox',storage_delete:'storage:sandbox'};var RL={entity_invoke:{m:60},storage_write:{m:120},storage_read:{m:300},storage_list:{m:60},storage_delete:{m:60}};var rb={};var SF='-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif',MF='"SFMono-Regular",Consolas,monospace',SP={xs:'4px',sm:'8px',md:'16px',lg:'24px',xl:'32px'},FN={body:SF,heading:SF,mono:MF};fetch('/api/config').then(function(r){return r.json()}).then(function(c){cachedConfig=c;currentTheme=c.mockTheme||'dark';currentMode=c.mode||'mock';currentEnvironment=c.environment||'staging';hasCredentials=c.hasCredentials||false;envSelector.value=currentEnvironment;uMB();uTB();if(currentMode==='live'){creditBalance.style.display='inline';fC()}cPR(function(ok){if(ok){pluginStatus.classList.add('hidden');iframe.classList.remove('hidden');iframe.src=c.pluginUrl}else{pluginStatus.classList.add('error');pluginStatus.innerHTML='<p><strong>Plugin server not reachable</strong></p><p>Make sure your plugin dev server is running.</p>'}})});consoleToggle.addEventListener('click',function(){consoleBody.classList.toggle('open')});reloadBtn.addEventListener('click',function(){if(cachedConfig)iframe.src=cachedConfig.pluginUrl});themeToggle.addEventListener('click',function(){currentTheme=currentTheme==='dark'?'light':'dark';uTB();sTP({type:'theme_update',messageId:'t_'+Date.now(),payload:gT()})});modeBadge.addEventListener('click',function(){if(currentMode==='mock'){if(!hasCredentials){sLM();return}sM('live')}else sM('mock')});envSelector.addEventListener('change',function(){fetch('/api/environment',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({environment:envSelector.value})}).then(function(r){return r.json()}).then(function(d){currentEnvironment=d.environment;currentMode=d.mode;hasCredentials=d.hasCredentials;uMB();if(currentMode==='live'){creditBalance.style.display='inline';fC()}else{creditBalance.style.display='none';creditBalance.textContent=''}lM('info','Environment: '+currentEnvironment.toUpperCase()+(hasCredentials?'':' (not authenticated)'))}).catch(function(e){lM('error',e.message)})});function sM(m){fetch('/api/mode',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({mode:m})}).then(function(r){if(!r.ok)return r.json().then(function(e){throw new Error(e.error)});return r.json()}).then(function(d){currentMode=d.mode;uMB();if(currentMode==='live'){creditBalance.style.display='inline';fC()}else{creditBalance.style.display='none';creditBalance.textContent=''}}).catch(function(e){lM('error',e.message)})}function sLM(){loginModal.style.display='flex';loginEmail.value='';loginPassword.value='';loginError.style.display='none';loginSubmit.disabled=false;loginSubmit.textContent='Sign in';loginTarget.textContent=currentEnvironment==='production'?'fias.io':'staging.fias.io';loginEmail.focus()}function hLM(){loginModal.style.display='none'}loginCancel.addEventListener('click',hLM);loginModal.addEventListener('click',function(e){if(e.target===loginModal)hLM()});loginEmail.addEventListener('keydown',function(e){if(e.key==='Enter')loginPassword.focus();if(e.key==='Escape')hLM()});loginPassword.addEventListener('keydown',function(e){if(e.key==='Enter')doLogin();if(e.key==='Escape')hLM()});loginSubmit.addEventListener('click',doLogin);function doLogin(){var em=loginEmail.value.trim(),pw=loginPassword.value;if(!em||!pw){loginError.textContent='Email and password are required.';loginError.style.display='block';return}loginSubmit.disabled=true;loginSubmit.textContent='Signing in...';loginError.style.display='none';fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({email:em,password:pw})}).then(function(r){if(!r.ok)return r.json().then(function(e){throw new Error(e.error||'Sign in failed')});return r.json()}).then(function(){hasCredentials=true;hLM();lM('info','Signed in for '+currentEnvironment.toUpperCase());sM('live')}).catch(function(e){loginError.textContent=e.message;loginError.style.display='block'}).finally(function(){loginSubmit.disabled=false;loginSubmit.textContent='Sign in'})}window.addEventListener('message',function(ev){if(ev.source!==iframe.contentWindow)return;var d=ev.data;if(!d||typeof d!=='object'||!d.type||!d.messageId)return;lM('recv',d.type,d.payload);if(d.type==='ready')return;if(d.type==='resize'){var h=d.payload&&d.payload.height;if(typeof h==='number'&&h>0){iframe.style.height=h+'px';iframe.style.flex='none'}return}if(d.type==='toast'){var msg=d.payload&&d.payload.message;if(typeof msg==='string')lM('toast',msg);return}if(d.type==='navigate'){var p=d.payload&&d.payload.path;if(typeof p==='string')lM('nav',p);return}hR(d)});function hR(d){try{var rp=PM[d.type];if(rp&&cachedConfig&&cachedConfig.permissions.indexOf(rp)===-1)throw new Error('Permission denied: '+rp);cRL(d.type)}catch(e){lM('error',e.message);sTP({type:'response',messageId:d.messageId,payload:null,error:e.message});return}fetch('/api/bridge',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({type:d.type,payload:d.payload})}).then(function(r){if(!r.ok)return r.json().then(function(e){throw new Error(e.error||'Bridge call failed')});return r.json()}).then(function(res){lM('send','response',res);if(d.type==='entity_invoke'&&res.metadata&&res.metadata.cost>0){lM('cost','Credits: '+res.metadata.cost.toFixed(4));fC()}sTP({type:'response',messageId:d.messageId,payload:res})}).catch(function(e){lM('error',e.message);sTP({type:'response',messageId:d.messageId,payload:null,error:e.message})})}iframe.addEventListener('load',function(){if(!cachedConfig)return;sTP({type:'init',messageId:'init_0',payload:{archId:'dev_harness',permissions:cachedConfig.permissions,theme:gT(),currentPath:'/'}});lM('send','init')});function uMB(){modeBadge.textContent=currentMode.toUpperCase()+' \\u21C6';modeBadge.className='mode-badge '+(currentMode==='live'?'mode-live':'mode-mock');modeBadge.title='Click to switch to '+(currentMode==='live'?'Mock':'Live')+' mode'}function uTB(){themeBadge.textContent=currentTheme.toUpperCase();themeBadge.className='theme-badge theme-'+currentTheme;document.body.style.background=currentTheme==='light'?'#fff':'#0a0a0a'}function sTP(m){iframe.contentWindow&&iframe.contentWindow.postMessage(m,'*')}function cRL(t){var l=RL[t];if(!l)return;var n=Date.now(),b=rb[t];if(!b||n-b.s>60000){rb[t]={c:1,s:n};return}if(b.c>=l.m)throw new Error('Rate limit exceeded for '+t);b.c++}function gT(){if(currentTheme==='light')return{mode:'light',colors:{primary:'#171717',secondary:'#e5e5e5',background:'#fff',surface:'#fafafa',text:'#0a0a0a',textSecondary:'#737373',border:'#e5e5e5',error:'#dc2626',warning:'#d97706',success:'#16a34a'},spacing:SP,fonts:FN};return{mode:'dark',colors:{primary:'#fff',secondary:'#1f1f1f',background:'#0a0a0a',surface:'#171717',text:'#fff',textSecondary:'#a6a6a6',border:'#2e2e2e',error:'#ef4444',warning:'#f59e0b',success:'#22c55e'},spacing:SP,fonts:FN}}function cPR(cb){fetch('/api/check-plugin').then(function(r){return r.json()}).then(function(d){cb(d.reachable)}).catch(function(){cb(true)})}function fC(){fetch('/api/credits').then(function(r){return r.json()}).then(function(d){if(d.balance!=null&&isFinite(d.balance))creditBalance.textContent='Credits: '+d.balance.toFixed(2)}).catch(function(){})}function lM(dir,type,payload){messageCount++;consoleCount.textContent=messageCount+' messages';var e=document.createElement('div');e.className='log-entry';var cls='log-info';if(dir==='error')cls='log-error';if(dir==='warn'||dir==='cost'||dir==='toast')cls='log-warn';var t='<span class="log-time">'+new Date().toLocaleTimeString()+'</span><span class="'+cls+'">['+dir.toUpperCase()+'] '+type+'</span>';if(payload&&typeof payload==='object')t+=' <span style="color:#6b7280">'+JSON.stringify(payload).substring(0,120)+'</span>';e.innerHTML=t;consoleBody.appendChild(e);consoleBody.scrollTop=consoleBody.scrollHeight}})();`;
 //# sourceMappingURL=harness-server.js.map