@mevdragon/vidfarm-devcli 0.2.6 → 0.2.8

package/dist/src/app.js

@@ -23,6 +23,8 @@ const templateSources = new TemplateSourceService();
 const API_PREFIX = "/api/v1";
 const USER_PREFIX = `${API_PREFIX}/user`;
 const TEMPLATES_PREFIX = `${API_PREFIX}/templates`;
+const ADMIN_TEMPLATES_PREFIX = `${API_PREFIX}/admin/templates`;
+const ADMIN_CUSTOMERS_PREFIX = `${API_PREFIX}/admin/customers`;
 const SESSION_COOKIE = "vidfarm_session";
 const app = new Hono();
 const otpRequestSchema = z.object({
@@ -45,6 +47,20 @@ const adminCreateUserSchema = z.object({
     password: z.string().min(8),
     name: z.string().optional()
 });
+const adminProvisionUserSchema = z.object({
+    email: z.string().email().optional(),
+    username: z.string().email().optional(),
+    password: z.string().min(8),
+    name: z.string().optional()
+}).refine((value) => Boolean(value.email || value.username), {
+    message: "Provide email or username."
+});
+const adminCustomerAccessSchema = z.object({
+    email: z.string().email(),
+    is_developer: z.boolean().optional(),
+    is_paid_plan: z.boolean().optional(),
+    name: z.string().optional()
+}).refine((value) => value.is_developer !== undefined || value.is_paid_plan !== undefined || value.name !== undefined, { message: "Provide at least one of is_developer, is_paid_plan, or name." });
 const providerKeySchema = z.object({
     provider: z.enum(["openai", "gemini", "openrouter", "perplexity"]),
     label: z.string().optional(),
@@ -67,6 +83,15 @@ const developerPreviewPresignSchema = z.object({
     content_type: z.string().trim().min(1).max(255).optional(),
     directory: z.string().trim().max(500).optional()
 });
+const developerTemplateArtifactPresignSchema = z.object({
+    commit_sha: z.string().trim().min(7).max(255)
+});
+const developerTemplateArtifactPublishSchema = z.object({
+    commit_sha: z.string().trim().min(7).max(255),
+    artifact_sha256: z.string().trim().regex(/^[0-9a-f]{64}$/i, "artifact_sha256 must be a SHA-256 hex digest.")
+});
+const templateSourceStatusSchema = z.enum(["pending_review", "approved", "rejected", "disabled"]);
+const templateReleaseStatusSchema = z.enum(["imported", "pending_approval", "approved", "rejected", "failed", "active"]);
 const listJobsQuerySchema = z.object({
     tracer: z.string().min(1).optional(),
     start_time: z.string().min(1).optional(),
@@ -288,7 +313,7 @@ function getReleaseTimestamp(release) {
 function getApprovedHomepageTemplates(c) {
     const approvedReleaseByTemplateId = new Map();
     for (const release of database.listTemplateReleases()) {
-        if (release.status !== "active" && release.status !== "certified") {
+        if (release.status !== "active" && release.status !== "approved") {
             continue;
         }
         const current = approvedReleaseByTemplateId.get(release.templateId);
@@ -583,9 +608,7 @@ app.post(`${API_PREFIX}/admin/auth/whitelist`, async (c) => {
             email: normalizedEmail,
             name: existing?.name ?? null,
             defaultWebhookUrl: existing?.defaultWebhookUrl ?? null,
-            isDeveloper: existing?.isDeveloper
-                || config.adminEmails.includes(normalizedEmail)
-                || config.developerEmails.includes(normalizedEmail),
+            isDeveloper: existing?.isDeveloper || config.adminEmails.includes(normalizedEmail),
             isPaidPlan: true
         });
     });
@@ -606,6 +629,213 @@ app.post(`${API_PREFIX}/admin/auth/users`, async (c) => {
     });
     return c.json({ customer }, 201);
 });
+app.post(`${API_PREFIX}/admin/auth/provision-user-account`, async (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const parsed = adminProvisionUserSchema.parse(await c.req.json());
+    const email = (parsed.email ?? parsed.username ?? "").trim().toLowerCase();
+    const existing = database.getCustomerByEmail(email);
+    const customer = auth.createPasswordUser({
+        email,
+        password: parsed.password,
+        name: parsed.name ?? null
+    });
+    const apiKey = getVisibleApiKey(customer.id);
+    return c.json({
+        customer,
+        credentials: {
+            email,
+            password: parsed.password,
+            api_key: apiKey
+        },
+        action: existing ? "updated" : "created"
+    }, existing ? 200 : 201);
+});
+app.post(`${ADMIN_CUSTOMERS_PREFIX}/access`, async (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const parsed = adminCustomerAccessSchema.parse(await c.req.json());
+    const existing = database.getCustomerByEmail(parsed.email);
+    const customer = database.setCustomerAccessByEmail({
+        email: parsed.email,
+        isDeveloper: parsed.is_developer,
+        isPaidPlan: parsed.is_paid_plan,
+        name: parsed.name
+    });
+    return c.json({
+        customer,
+        action: existing ? "updated" : "created"
+    }, existing ? 200 : 201);
+});
+app.get(`${ADMIN_TEMPLATES_PREFIX}/sources`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const status = c.req.query("status");
+    const parsedStatus = status ? templateSourceStatusSchema.parse(status) : undefined;
+    return c.json({ sources: templateSources.listSources(parsedStatus) });
+});
+app.get(`${ADMIN_TEMPLATES_PREFIX}/releases`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const status = c.req.query("status");
+    const parsedStatus = status ? templateReleaseStatusSchema.parse(status) : undefined;
+    return c.json({
+        releases: templateSources.listReleases({
+            templateId: c.req.query("template_id") || undefined,
+            status: parsedStatus
+        })
+    });
+});
+app.get(`${ADMIN_TEMPLATES_PREFIX}/review-queue`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    return c.json({
+        pending_sources: templateSources.listSources("pending_review"),
+        pending_releases: templateSources.listReleases({ status: "pending_approval" })
+    });
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/sources/register`, async (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    try {
+        const body = z.object({
+            template_id: z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, "template_id must be a UUIDv4."),
+            slug_id: z.string().min(3).regex(/^[a-z0-9_]+$/i, "slug_id must contain only letters, numbers, and underscores."),
+            repo_url: z.string().url(),
+            branch: z.string().min(1).default("production"),
+            template_module_path: z.string().regex(/(^src\/template\.ts$|(^|\/)vidfarm_template_[^/]+\/src\/template\.ts$)/i, "template_module_path must point at src/template.ts for a standalone template repo, or at a template entrypoint inside a folder that starts with vidfarm_template_, for example templates/vidfarm_template_example/src/template.ts."),
+            skill_path: z.string().min(1).optional(),
+            install_command: z.string().min(1).default("npm install"),
+            build_command: z.string().min(1).default("npm run build")
+        }).parse(await c.req.json());
+        const registration = await templateSources.registerSource({
+            templateId: body.template_id,
+            slugId: body.slug_id,
+            repoUrl: body.repo_url,
+            branch: body.branch,
+            templateModulePath: body.template_module_path,
+            skillPath: body.skill_path,
+            installCommand: body.install_command,
+            buildCommand: body.build_command
+        });
+        return c.json({
+            source: registration.source,
+            registration_action: registration.action,
+            sync: registration.sync
+        }, registration.action === "created" ? 201 : 200);
+    }
+    catch (error) {
+        if (error instanceof TemplateSourceAlreadyRegisteredError) {
+            return c.json({
+                error: error.message,
+                registration_status: error.existingSource.status,
+                existing_source: error.existingSource,
+                conflict_field: error.conflictField
+            }, 409);
+        }
+        const message = error instanceof Error ? error.message : "Unable to register template source.";
+        const status = /already exists/i.test(message) ? 409 : 400;
+        return c.json({ error: message }, status);
+    }
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/sources/:sourceId/approve`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    return c.json({ source: templateSources.approveSource({ sourceId: c.req.param("sourceId") }) });
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/sources/:sourceId/reject`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    return c.json({ source: templateSources.rejectSource({ sourceId: c.req.param("sourceId") }) });
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/sources/:sourceId/import`, async (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const body = z.object({
+        commit_sha: z.string().min(7).optional(),
+        artifact_manifest_key: z.string().min(1).optional()
+    }).parse(await c.req.json().catch(() => ({})));
+    const release = await templateSources.importRelease({
+        sourceId: c.req.param("sourceId"),
+        commitSha: body.commit_sha ?? null,
+        artifactManifestKey: body.artifact_manifest_key ?? null
+    });
+    return c.json({ release }, 201);
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/releases/:releaseId/approve`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    return c.json({ release: templateSources.approveRelease({ releaseId: c.req.param("releaseId") }) });
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/releases/:releaseId/reject`, (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    return c.json({ release: templateSources.rejectRelease({ releaseId: c.req.param("releaseId") }) });
+});
+app.post(`${ADMIN_TEMPLATES_PREFIX}/releases/:releaseId/activate`, async (c) => {
+    try {
+        requireSuperagency(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    const { release, template } = await templateSources.activateRelease({
+        releaseId: c.req.param("releaseId")
+    });
+    templateRegistry.registerRuntimeTemplate(template);
+    return c.json({
+        release,
+        template: {
+            id: template.id,
+            version: template.version,
+            description: template.about.description
+        }
+    });
+});
 app.post(`${USER_PREFIX}/request-otp`, async (c) => {
     const body = otpRequestSchema.parse(await c.req.json());
     await auth.requestOtp(body.email);
@@ -645,6 +875,12 @@ function requireDeveloper(c) {
     }
     return customer;
 }
+function templatePublishingAdminError() {
+    return {
+        error: "Admin access required.",
+        detail: "Reviewing, importing, approving, or activating a registered template source is platform-managed. Third-party developers can register/update source metadata and publish an exact GitHub commit for review, but only platform admins can approve or activate releases."
+    };
+}
 function requireSuperagency(c) {
     const provided = c.req.header("x-superagency-key");
     if (!config.SUPERAGENCY_KEY || provided !== config.SUPERAGENCY_KEY) {
@@ -791,7 +1027,9 @@ function serializeTemplateAbout(c, template) {
         viral_dna: template.about.viral_dna,
         visual_dna: template.about.visual_dna,
         preview_media: template.about.preview_media.map((entry) => resolveTemplateAboutMediaUrl(c, template.id, entry)),
-        link_to_original: template.about.link_to_original
+        link_to_original: template.about.link_to_original,
+        proposal_generator: template.about.proposal_generator,
+        sample_prompts: template.about.sample_prompts
     };
 }
 function resolveTemplateAboutMediaUrl(c, templateId, entry) {
@@ -1006,6 +1244,36 @@ app.post(`${USER_PREFIX}/me/developer/preview-media/presign`, async (c) => {
         return c.json({ error: error instanceof Error ? error.message : "Unable to create preview upload URL." }, 400);
     }
 });
+app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/artifacts/presign`, async (c) => {
+    try {
+        requireDeveloper(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    try {
+        const body = developerTemplateArtifactPresignSchema.parse(await c.req.json());
+        const artifact = await templateSources.createDeveloperArtifactUpload({
+            sourceId: c.req.param("sourceId"),
+            commitSha: body.commit_sha
+        });
+        return c.json({
+            artifact_key: artifact.artifactKey,
+            artifact_manifest_key: artifact.manifestKey,
+            upload: {
+                method: artifact.upload.method,
+                url: artifact.upload.url,
+                headers: artifact.upload.headers,
+                expires_in_seconds: artifact.upload.expiresIn
+            }
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unable to prepare template artifact upload.";
+        const status = /not found/i.test(message) ? 404 : 400;
+        return c.json({ error: message }, status);
+    }
+});
 app.get(`${USER_PREFIX}/me/jobs`, (c) => {
     const query = listJobsQuerySchema.parse({
         template_id: c.req.query("template_id"),
@@ -1046,7 +1314,9 @@ app.get(`${TEMPLATES_PREFIX}/sources`, (c) => {
     catch (error) {
         return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
     }
-    return c.json({ sources: templateSources.listSources() });
+    const status = c.req.query("status");
+    const parsedStatus = status ? templateSourceStatusSchema.parse(status) : undefined;
+    return c.json({ sources: templateSources.listSources(parsedStatus) });
 });
 app.post(`${TEMPLATES_PREFIX}/sources`, async (c) => {
     try {
@@ -1061,7 +1331,7 @@ app.post(`${TEMPLATES_PREFIX}/sources`, async (c) => {
             slug_id: z.string().min(3).regex(/^[a-z0-9_]+$/i, "slug_id must contain only letters, numbers, and underscores."),
             repo_url: z.string().url(),
             branch: z.string().min(1).default("production"),
-            template_module_path: z.string().regex(/(^|\/)vidfarm_template_[^/]+\/src\/template\.ts$/i, "template_module_path must point at a template entrypoint inside a folder that starts with vidfarm_template_, for example templates/vidfarm_template_example/src/template.ts."),
+            template_module_path: z.string().regex(/(^src\/template\.ts$|(^|\/)vidfarm_template_[^/]+\/src\/template\.ts$)/i, "template_module_path must point at src/template.ts for a standalone template repo, or at a template entrypoint inside a folder that starts with vidfarm_template_, for example templates/vidfarm_template_example/src/template.ts."),
             skill_path: z.string().min(1).optional(),
             install_command: z.string().min(1).default("npm install"),
             build_command: z.string().min(1).default("npm run build")
@@ -1079,7 +1349,13 @@ app.post(`${TEMPLATES_PREFIX}/sources`, async (c) => {
         return c.json({
             source: registration.source,
             registration_action: registration.action,
-            sync: registration.sync
+            sync: registration.sync,
+            developer_handoff: {
+                completed: true,
+                responsibility_boundary: "third_party_developer_done",
+                message: "Template source registration is complete. Your responsibility stops at GitHub push plus source registration metadata. Importing, activating, and making the template live/public are platform-admin steps.",
+                next_step_for_platform: "A Vidfarm admin can now import this source from the registered branch head or a chosen commit SHA, or the developer can publish an exact commit SHA for review."
+            }
         }, registration.action === "created" ? 201 : 200);
     }
     catch (error) {
@@ -1096,6 +1372,40 @@ app.post(`${TEMPLATES_PREFIX}/sources`, async (c) => {
         return c.json({ error: message }, status);
     }
 });
+app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/publish`, async (c) => {
+    let customer;
+    try {
+        customer = requireDeveloper(c);
+    }
+    catch (error) {
+        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+    }
+    try {
+        const body = developerTemplateArtifactPublishSchema.parse(await c.req.json());
+        const result = await templateSources.publishArtifactRelease({
+            sourceId: c.req.param("sourceId"),
+            commitSha: body.commit_sha,
+            artifactSha256: body.artifact_sha256,
+            signedBy: customer.email
+        });
+        return c.json({
+            source: result.source,
+            release: result.release,
+            publish_action: result.publishAction,
+            developer_handoff: {
+                completed: true,
+                responsibility_boundary: "third_party_developer_done",
+                message: "The exact GitHub commit has been submitted for platform review.",
+                next_step_for_platform: "A Vidfarm admin reviews the certification result, approves the release, and activates it."
+            }
+        }, result.publishAction === "created" ? 201 : 200);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unable to publish template update.";
+        const status = /not found/i.test(message) ? 404 : 400;
+        return c.json({ error: message }, status);
+    }
+});
 app.get(`${TEMPLATES_PREFIX}/releases`, (c) => {
     try {
         requireAdmin(c);
@@ -1103,30 +1413,87 @@ app.get(`${TEMPLATES_PREFIX}/releases`, (c) => {
     catch (error) {
         return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
     }
-    return c.json({ releases: templateSources.listReleases(c.req.query("template_id") || undefined) });
+    const status = c.req.query("status");
+    const parsedStatus = status ? templateReleaseStatusSchema.parse(status) : undefined;
+    return c.json({
+        releases: templateSources.listReleases({
+            templateId: c.req.query("template_id") || undefined,
+            status: parsedStatus
+        })
+    });
 });
-app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/import`, async (c) => {
+app.get(`${TEMPLATES_PREFIX}/review-queue`, (c) => {
     try {
         requireAdmin(c);
     }
     catch (error) {
         return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
     }
+    return c.json({
+        pending_sources: templateSources.listSources("pending_review"),
+        pending_releases: templateSources.listReleases({ status: "pending_approval" })
+    });
+});
+app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/approve`, (c) => {
+    try {
+        requireAdmin(c);
+    }
+    catch (error) {
+        return c.json(templatePublishingAdminError(), 403);
+    }
+    return c.json({ source: templateSources.approveSource({ sourceId: c.req.param("sourceId") }) });
+});
+app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/reject`, (c) => {
+    try {
+        requireAdmin(c);
+    }
+    catch (error) {
+        return c.json(templatePublishingAdminError(), 403);
+    }
+    return c.json({ source: templateSources.rejectSource({ sourceId: c.req.param("sourceId") }) });
+});
+app.post(`${TEMPLATES_PREFIX}/sources/:sourceId/import`, async (c) => {
+    try {
+        requireAdmin(c);
+    }
+    catch (error) {
+        return c.json(templatePublishingAdminError(), 403);
+    }
     const body = z.object({
-        commit_sha: z.string().min(7).optional()
+        commit_sha: z.string().min(7).optional(),
+        artifact_manifest_key: z.string().min(1).optional()
     }).parse(await c.req.json().catch(() => ({})));
     const release = await templateSources.importRelease({
         sourceId: c.req.param("sourceId"),
-        commitSha: body.commit_sha ?? null
+        commitSha: body.commit_sha ?? null,
+        artifactManifestKey: body.artifact_manifest_key ?? null
     });
     return c.json({ release }, 201);
 });
+app.post(`${TEMPLATES_PREFIX}/releases/:releaseId/approve`, (c) => {
+    try {
+        requireAdmin(c);
+    }
+    catch (error) {
+        return c.json(templatePublishingAdminError(), 403);
+    }
+    return c.json({ release: templateSources.approveRelease({ releaseId: c.req.param("releaseId") }) });
+});
+app.post(`${TEMPLATES_PREFIX}/releases/:releaseId/reject`, (c) => {
+    try {
+        requireAdmin(c);
+    }
+    catch (error) {
+        return c.json(templatePublishingAdminError(), 403);
+    }
+    return c.json({ release: templateSources.rejectRelease({ releaseId: c.req.param("releaseId") }) });
+});
 app.post(`${TEMPLATES_PREFIX}/releases/:releaseId/activate`, async (c) => {
     try {
         requireAdmin(c);
     }
     catch (error) {
-        return c.json({ error: error instanceof Error ? error.message : "Forbidden" }, 403);
+        return c.json(templatePublishingAdminError(), 403);
     }
     const { release, template } = await templateSources.activateRelease({
         releaseId: c.req.param("releaseId")