@gethmy/mcp 2.12.0 → 2.13.1

package/src/api-client.ts

@@ -2,6 +2,9 @@ import {
   type AgentRunEventDraft,
   type Comment,
   getDisplayLinkType,
+  type PlaybookVersionDef,
+  type StageGateEvidenceInsert,
+  type StageGateEvidenceRow,
   serializeCommentThread,
   type WorkspaceAgent,
 } from "@harmony/shared";
@@ -143,6 +146,15 @@ export interface CardAttachment {
   signed_url_expires_in: number;
 }
 
+/** Response of a `*-upload-url` endpoint: a one-shot signed Supabase Storage
+ * URL the caller PUTs raw bytes to, plus the service-chosen path that the
+ * matching `finalize` call validates and registers. */
+export interface SignedUpload {
+  uploadUrl: string;
+  token: string;
+  storagePath: string;
+}
+
 export interface CardExternalLinkRow {
   id: string;
   card_id: string;
@@ -675,6 +687,32 @@ export class HarmonyApiClient {
     return this.request("POST", `/cards/${cardId}/attachments`, data);
   }
 
+  // Step 1 of the direct-to-storage attachment handshake: mint a signed upload
+  // URL for a server-chosen path under the card. The caller PUTs raw bytes to
+  // `uploadUrl`, then calls finalizeCardAttachment with the returned storagePath.
+  async requestCardAttachmentUploadUrl(
+    cardId: string,
+    data: { fileName: string; fileType?: string; size: number },
+  ): Promise<SignedUpload & { fileType: string }> {
+    return this.request("POST", `/cards/${cardId}/attachment-upload-url`, data);
+  }
+
+  // Step 2: validate the uploaded object (size + magic-byte content-type +
+  // optional sha256) and insert the attachment row. The server deletes the
+  // object and rejects on any mismatch.
+  async finalizeCardAttachment(
+    cardId: string,
+    data: {
+      storagePath: string;
+      fileName: string;
+      fileType?: string;
+      sha256?: string;
+      size?: number;
+    },
+  ): Promise<{ attachment: CardAttachment }> {
+    return this.request("POST", `/cards/${cardId}/attachments/finalize`, data);
+  }
+
   async getCardExternalLinks(
     cardId: string,
   ): Promise<{ external_links: CardExternalLinkRow[] }> {
@@ -694,6 +732,35 @@ export class HarmonyApiClient {
     return this.request("POST", "/artifacts", data);
   }
 
+  // Step 1 of the direct-to-storage artifact handshake: mint a signed upload
+  // URL for a server-chosen path. The caller PUTs raw HTML bytes to `uploadUrl`,
+  // then calls finalizeArtifact with the returned storagePath.
+  async requestArtifactUploadUrl(data: {
+    title?: string;
+    cardId?: string;
+    planId?: string;
+    workspaceId?: string;
+    contentType?: string;
+    size?: number;
+  }): Promise<SignedUpload> {
+    return this.request("POST", "/artifacts/upload-url", data);
+  }
+
+  // Step 2: validate the uploaded object (size + HTML magic-byte sniff +
+  // optional sha256) and insert the artifact row. The server deletes the
+  // object and rejects on any mismatch.
+  async finalizeArtifact(data: {
+    storagePath: string;
+    sha256?: string;
+    size?: number;
+    title?: string;
+    cardId?: string;
+    planId?: string;
+    workspaceId?: string;
+  }): Promise<{ artifact: Record<string, unknown> }> {
+    return this.request("POST", "/artifacts/finalize", data);
+  }
+
   async createArtifactShareLink(
     artifactId: string,
     expiresAt?: string,
@@ -1747,6 +1814,40 @@ export class HarmonyApiClient {
     return this.request("GET", `/playbooks/${playbookId}`);
   }
 
+  /**
+   * Fetch the pinned, immutable stage-def snapshot for `(playbookId, version)`.
+   * The agent daemon's stage executor (#514) resolves a card's `current_stage`
+   * against this frozen def — never live `playbooks.steps` — so editing a
+   * Playbook never rewrites an in-flight card.
+   */
+  async getPlaybookVersion(
+    playbookId: string,
+    version: number,
+  ): Promise<{
+    version: PlaybookVersionDef & { playbook_id: string; version: number };
+  }> {
+    return this.request(
+      "GET",
+      `/playbooks/${encodeURIComponent(playbookId)}/versions/${version}`,
+    );
+  }
+
+  /**
+   * Persist a stage gate evidence row (Playbooks P1 #3, card #516). The daemon
+   * collects + evaluates a gate then POSTs the resulting evidence here; the edge
+   * writes it with the service-role client (the table has no INSERT RLS policy,
+   * so this is the only write path). Returns the inserted row.
+   */
+  async recordStageGateEvidence(
+    insert: StageGateEvidenceInsert,
+  ): Promise<{ evidence: StageGateEvidenceRow }> {
+    return this.request(
+      "POST",
+      `/cards/${encodeURIComponent(insert.card_id)}/stage-gate-evidence`,
+      insert,
+    );
+  }
+
   async createPlaybook(data: {
     workspaceId: string;
     name: string;