@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.1

package/dist/routes/integrations.js

@@ -0,0 +1,211 @@
+/**
+ * Integration routes — linking an external messaging account to a NodeTool
+ * user, and exchanging that mapping for a short-lived delegated token.
+ *
+ * The caller is a bridge process (the Telegram bot, later Discord), not a
+ * browser: every route authenticates with the server's own
+ * `NODETOOL_INTEGRATION_TOKEN` rather than a user session, which is why these
+ * paths are exempt from the session-auth hook the way the webhook routes are.
+ * A server without that env var registers none of this — every path 404s.
+ *
+ * The bridge never holds a user credential. It proves *which external account*
+ * is speaking; the server decides which NodeTool user that is, and mints a
+ * token scoped to them. Tenant isolation is then the server's usual rules.
+ */
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { mintDelegatedToken } from "@nodetool-ai/auth";
+import { ExternalIdentity } from "@nodetool-ai/models";
+import { integrationExternalIdBodySchema, integrationLinkCompleteBodySchema } from "../http-body-schemas.js";
+import { LinkCodeStore, sharedLinkCodes } from "../lib/link-codes.js";
+/** Platforms the identity layer accepts. `provider` is data, not a route. */
+const ALLOWED_PROVIDERS = ["telegram", "discord"];
+/** A service token shorter than this is refused rather than trusted. */
+const MIN_SERVICE_TOKEN_LENGTH = 16;
+/** Lifetime of a minted delegated token. */
+const DELEGATED_TOKEN_TTL_SECONDS = 60 * 60;
+/**
+ * `/link/complete` body. `user_id` is required only for a bot-minted code:
+ * a web-minted code already carries the user who was signed in when it was
+ * created, and that user wins over anything the bridge sends.
+ */
+const linkCompleteBodySchema = integrationLinkCompleteBodySchema.extend({
+    user_id: z.string().min(1).optional()
+});
+/** Whether the request carries the configured service token. */
+function hasServiceToken(req, serviceToken) {
+    const header = req.headers.authorization;
+    if (typeof header !== "string")
+        return false;
+    const parts = header.split(/\s+/);
+    if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer")
+        return false;
+    const presented = Buffer.from(parts[1], "utf-8");
+    const expected = Buffer.from(serviceToken, "utf-8");
+    return (presented.length === expected.length &&
+        timingSafeEqual(presented, expected));
+}
+function readProvider(req) {
+    const params = req.params;
+    const provider = params.provider;
+    if (typeof provider !== "string")
+        return null;
+    return ALLOWED_PROVIDERS.includes(provider)
+        ? provider
+        : null;
+}
+/**
+ * The base URL a link confirmation page is reachable at, taken from the
+ * request the bridge made. `NODETOOL_PUBLIC_URL` wins when set, because a
+ * bridge on the same host reaches the server at an address the user's browser
+ * may not.
+ */
+function baseUrl(req) {
+    const configured = process.env["NODETOOL_PUBLIC_URL"];
+    if (configured)
+        return configured.replace(/\/+$/, "");
+    const host = req.headers.host ?? "127.0.0.1:7777";
+    return `${req.protocol}://${host}`;
+}
+export function createIntegrationRoutes(options) {
+    const now = options.now ?? Date.now;
+    const linkCodes = options.linkCodes ??
+        (options.now ? new LinkCodeStore({ now: options.now }) : sharedLinkCodes);
+    return async (app) => {
+        const serviceToken = process.env["NODETOOL_INTEGRATION_TOKEN"];
+        if (!serviceToken || serviceToken.length < MIN_SERVICE_TOKEN_LENGTH) {
+            // No service token, no surface: the routes are never registered, so
+            // every path answers 404 rather than 401.
+            return;
+        }
+        /** Common preamble: service token, then provider. */
+        const authorize = (req, reply) => {
+            if (!hasServiceToken(req, serviceToken)) {
+                reply.status(401).send({ error: "Unauthorized" });
+                return null;
+            }
+            const provider = readProvider(req);
+            if (!provider) {
+                reply.status(400).send({
+                    error: `Unknown integration provider. Expected one of: ${ALLOWED_PROVIDERS.join(", ")}`
+                });
+                return null;
+            }
+            return provider;
+        };
+        app.post("/api/integrations/:provider/link/start", async (req, reply) => {
+            const provider = authorize(req, reply);
+            if (!provider)
+                return;
+            const body = integrationExternalIdBodySchema.safeParse(req.body);
+            if (!body.success) {
+                reply.status(400).send({ error: "external_id is required" });
+                return;
+            }
+            const { code, expiresAtMs } = linkCodes.mintForExternalAccount(provider, body.data.external_id);
+            reply.send({
+                code,
+                url: `${baseUrl(req)}/integrations/link?code=${encodeURIComponent(code)}`,
+                expires_at: new Date(expiresAtMs).toISOString()
+            });
+        });
+        app.post("/api/integrations/:provider/link/complete", async (req, reply) => {
+            const provider = authorize(req, reply);
+            if (!provider)
+                return;
+            const body = linkCompleteBodySchema.safeParse(req.body);
+            if (!body.success) {
+                reply
+                    .status(400)
+                    .send({ error: "external_id, code and user_id are required" });
+                return;
+            }
+            const pending = linkCodes.consume(body.data.code);
+            if (!pending) {
+                reply
+                    .status(410)
+                    .send({ error: "This link code has expired or was already used" });
+                return;
+            }
+            if (pending.provider !== provider) {
+                reply
+                    .status(400)
+                    .send({ error: "This link code was issued for a different account" });
+                return;
+            }
+            // A web-minted code carries the user who was signed in when it was
+            // created; the bridge supplies the external account it belongs to.
+            // A bot-minted code is the mirror image, and the browser that redeems
+            // it is what names the user.
+            let userId;
+            if (pending.kind === "user") {
+                userId = pending.userId;
+            }
+            else {
+                if (pending.externalId !== body.data.external_id) {
+                    reply.status(400).send({
+                        error: "This link code was issued for a different account"
+                    });
+                    return;
+                }
+                if (!body.data.user_id) {
+                    reply
+                        .status(400)
+                        .send({ error: "external_id, code and user_id are required" });
+                    return;
+                }
+                userId = body.data.user_id;
+            }
+            await ExternalIdentity.link({
+                provider,
+                externalId: body.data.external_id,
+                userId
+            });
+            reply.send({ linked: true });
+        });
+        app.post("/api/integrations/:provider/token", async (req, reply) => {
+            const provider = authorize(req, reply);
+            if (!provider)
+                return;
+            const body = integrationExternalIdBodySchema.safeParse(req.body);
+            if (!body.success) {
+                reply.status(400).send({ error: "external_id is required" });
+                return;
+            }
+            if (!options.enforceAuth) {
+                reply.status(409).send({
+                    error: "This server runs in local single-user mode, where every request " +
+                        "is user \"1\": delegated tokens would not isolate anything. Run " +
+                        "with an enforcing auth provider (Supabase) to use integrations."
+                });
+                return;
+            }
+            const identity = await ExternalIdentity.findByExternal(provider, body.data.external_id);
+            if (!identity) {
+                reply
+                    .status(404)
+                    .send({ error: "This account is not linked to a NodeTool user" });
+                return;
+            }
+            const minted = mintDelegatedToken(options.signingKey(), identity.user_id, DELEGATED_TOKEN_TTL_SECONDS, now);
+            reply.send({
+                token: minted.token,
+                expires_at: minted.expiresAt,
+                user_id: identity.user_id
+            });
+        });
+        app.delete("/api/integrations/:provider/link", async (req, reply) => {
+            const provider = authorize(req, reply);
+            if (!provider)
+                return;
+            const body = integrationExternalIdBodySchema.safeParse(req.body);
+            if (!body.success) {
+                reply.status(400).send({ error: "external_id is required" });
+                return;
+            }
+            const unlinked = await ExternalIdentity.unlink(provider, body.data.external_id);
+            reply.send({ unlinked });
+        });
+    };
+}
+//# sourceMappingURL=integrations.js.map

package/dist/routes/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../src/routes/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EAClC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,CAAU,CAAC;AAE3D,wEAAwE;AACxE,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,4CAA4C;AAC5C,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,iCAAiC,CAAC,MAAM,CAAC;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAwBH,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAmB,EAAE,YAAoB;IAChE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACpC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAgC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChE,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,GAAmB;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACtD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAClD,OAAO,GAAG,GAAG,CAAC,QAAQ,MAAM,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAiC;IAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAE5E,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC/D,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YACpE,oEAAoE;YACpE,0CAA0C;YAC1C,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,MAAM,SAAS,GAAG,CAChB,GAAmB,EACnB,KAAmB,EACJ,EAAE;YACjB,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;gBACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,kDAAkD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACxF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,IAAI,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,sBAAsB,CAC5D,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,WAAW,CACtB,CAAC;YAEF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI;gBACJ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,EAAE;gBACzE,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;aAChD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CACN,2CAA2C,EAC3C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK;qBACF,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK;qBACF,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,KAAK;qBACF,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,6BAA6B;YAC7B,IAAI,MAAc,CAAC;YACnB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACrB,KAAK,EAAE,mDAAmD;qBAC3D,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACvB,KAAK;yBACF,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7B,CAAC;YAED,MAAM,gBAAgB,CAAC,IAAI,CAAC;gBAC1B,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBACjC,MAAM;aACP,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,IAAI,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACzB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACrB,KAAK,EACH,kEAAkE;wBAClE,kEAAkE;wBAClE,iEAAiE;iBACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,cAAc,CACpD,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,WAAW,CACtB,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,KAAK;qBACF,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,kBAAkB,CAC/B,OAAO,CAAC,UAAU,EAAE,EACpB,QAAQ,CAAC,OAAO,EAChB,2BAA2B,EAC3B,GAAG,CACJ,CAAC;YACF,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,IAAI,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAC5C,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,WAAW,CACtB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/js-scripts.d.ts

@@ -0,0 +1,26 @@
+/**
+ * JS script run endpoint — `POST /api/js-scripts/:id/run`.
+ *
+ * The web app reads and writes scripts over `/trpc/jsScripts.*`; this is the
+ * one non-tRPC door, for the run/test console, mini apps, and the CLI harness.
+ *
+ * It executes the stored document through `runCodeBody` — the same core
+ * `run_code` and `test_code` already share — so a script run and a Code-node
+ * run are one execution path. The script's own envelope is what applies: its
+ * declared packages, its declared secrets, its timeout capped at
+ * `JS_SCRIPT_MAX_TIMEOUT_SECONDS`, and the Code-node toolbelt.
+ *
+ * The response is plain JSON. The design's streaming parity (`node_progress`
+ * per `progress()`, per-emit output messages) lands with the mini-app
+ * operation target in phase 3; nothing consuming this endpoint today needs it.
+ */
+import type { FastifyPluginAsync } from "fastify";
+import type { StorageAdapter } from "@nodetool-ai/storage";
+import { type HttpApiOptions } from "../http-api.js";
+interface RouteOptions {
+    apiOptions: HttpApiOptions;
+    storage?: StorageAdapter;
+}
+declare const jsScriptsRoutes: FastifyPluginAsync<RouteOptions>;
+export default jsScriptsRoutes;
+//# sourceMappingURL=js-scripts.d.ts.map

package/dist/routes/js-scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"js-scripts.d.ts","sourceRoot":"","sources":["../../src/routes/js-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAiBlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhE,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AA4BD,QAAA,MAAM,eAAe,EAAE,kBAAkB,CAAC,YAAY,CA2FrD,CAAC;eAEa,eAAe"}

package/dist/routes/js-scripts.js

@@ -0,0 +1,116 @@
+/**
+ * JS script run endpoint — `POST /api/js-scripts/:id/run`.
+ *
+ * The web app reads and writes scripts over `/trpc/jsScripts.*`; this is the
+ * one non-tRPC door, for the run/test console, mini apps, and the CLI harness.
+ *
+ * It executes the stored document through `runCodeBody` — the same core
+ * `run_code` and `test_code` already share — so a script run and a Code-node
+ * run are one execution path. The script's own envelope is what applies: its
+ * declared packages, its declared secrets, its timeout capped at
+ * `JS_SCRIPT_MAX_TIMEOUT_SECONDS`, and the Code-node toolbelt.
+ *
+ * The response is plain JSON. The design's streaming parity (`node_progress`
+ * per `progress()`, per-emit output messages) lands with the mini-app
+ * operation target in phase 3; nothing consuming this endpoint today needs it.
+ */
+import { runCodeBody } from "@nodetool-ai/agents";
+import { emptyDeclaredJsScriptOutputsError, missingDeclaredJsScriptOutputs } from "@nodetool-ai/execution/js-script-debug";
+import { getSecret, JsScript } from "@nodetool-ai/models";
+import { PERMISSION_GATE_CONTEXT_KEY, ProcessingContext, headlessGate } from "@nodetool-ai/runtime";
+import { JS_SCRIPT_MAX_TIMEOUT_SECONDS, runJsScriptRequest } from "@nodetool-ai/protocol/api-schemas/js-scripts.js";
+import { bridge } from "../lib/bridge.js";
+import { getUserId } from "../http-api.js";
+import { getAssetAdapter } from "../lib/storage.js";
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data ?? null), {
+        status,
+        headers: { "content-type": "application/json" }
+    });
+}
+async function readJsonBody(request) {
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("application/json"))
+        return {};
+    try {
+        return await request.json();
+    }
+    catch {
+        return {};
+    }
+}
+const jsScriptsRoutes = async (app, opts) => {
+    const { apiOptions } = opts;
+    app.post("/api/js-scripts/:id/run", async (req, reply) => {
+        const { id } = req.params;
+        await bridge(req, reply, async (request) => {
+            const userId = getUserId(request, apiOptions.userIdHeader ?? "x-user-id");
+            const script = await JsScript.findById(id);
+            // Scripts are per-user, like sketches and timelines: another owner's
+            // script is an absence, not a refusal.
+            if (!script || script.user_id !== userId) {
+                return jsonResponse({ detail: "JS script not found" }, 404);
+            }
+            const parsedBody = runJsScriptRequest.safeParse(await readJsonBody(request));
+            if (!parsedBody.success) {
+                return jsonResponse({ detail: parsedBody.error.issues[0]?.message ?? "Invalid body" }, 400);
+            }
+            const document = script.toDocument();
+            const staged = parsedBody.data.input_streams;
+            if (staged) {
+                const declared = new Set(document.inputs.map((port) => port.name));
+                const undeclared = Object.keys(staged).filter((handle) => !declared.has(handle));
+                if (undeclared.length > 0) {
+                    return jsonResponse({
+                        detail: `input_streams names ${undeclared.join(", ")}, which this ` +
+                            "script does not declare as inputs"
+                    }, 400);
+                }
+            }
+            const context = new ProcessingContext({
+                jobId: `js-script-${script.id}-${Date.now()}`,
+                userId,
+                secretResolver: getSecret,
+                storage: opts.storage ?? getAssetAdapter()
+            });
+            context.set(PERMISSION_GATE_CONTEXT_KEY, headlessGate("JS script run"));
+            const runOptions = {
+                code: document.code,
+                inputs: parsedBody.data.inputs,
+                secrets: document.secrets,
+                timeoutSeconds: Math.min(document.timeoutSeconds, JS_SCRIPT_MAX_TIMEOUT_SECONDS),
+                withToolbelt: true
+            };
+            if (staged) {
+                runOptions.inputStreams = staged;
+            }
+            const result = await runCodeBody(context, runOptions);
+            // A declared-output script that finishes with `outputs: {}` is a
+            // failed contract, not a 500 — same shape as a body that throws.
+            const missing = result.ok
+                ? missingDeclaredJsScriptOutputs(document.outputs, result.outputs)
+                : [];
+            const failedEmptyBag = missing.length > 0;
+            const body = {
+                ok: failedEmptyBag ? false : result.ok,
+                logs: result.logs,
+                duration_ms: result.duration_ms
+            };
+            if (result.outputs !== undefined) {
+                body.outputs = result.outputs;
+            }
+            if (result.streamed !== undefined) {
+                body.streamed = result.streamed;
+            }
+            if (failedEmptyBag) {
+                body.error = emptyDeclaredJsScriptOutputsError(missing);
+            }
+            else if (result.error !== undefined) {
+                body.error = result.error;
+            }
+            return jsonResponse(body);
+        });
+    });
+};
+export default jsScriptsRoutes;
+//# sourceMappingURL=js-scripts.js.map

package/dist/routes/js-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"js-scripts.js","sourceRoot":"","sources":["../../src/routes/js-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAEnB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAuB,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAOpD,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;QAChD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAWD,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5E,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAwB,CAAC;QAC5C,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3C,qEAAqE;YACrE,uCAAuC;YACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBACzC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,EACjE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAClC,CAAC;gBACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,YAAY,CACjB;wBACE,MAAM,EACJ,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;4BAC3D,mCAAmC;qBACtC,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;gBACpC,KAAK,EAAE,aAAa,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC7C,MAAM;gBACN,cAAc,EAAE,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,EAAE;aAC3C,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;YAExE,MAAM,UAAU,GAAsC;gBACpD,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;gBAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,cAAc,EAAE,IAAI,CAAC,GAAG,CACtB,QAAQ,CAAC,cAAc,EACvB,6BAA6B,CAC9B;gBACD,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,YAAY,GAAG,MAAM,CAAC;YACnC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAEtD,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE;gBACvB,CAAC,CAAC,8BAA8B,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;gBAClE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAwB;gBAChC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;gBACtC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAChC,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAClC,CAAC;YACD,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC,KAAK,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/kie-credits.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyPluginAsync } from "fastify";
+declare const kieCreditsRoute: FastifyPluginAsync;
+export default kieCreditsRoute;
+//# sourceMappingURL=kie-credits.d.ts.map

package/dist/routes/kie-credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-credits.d.ts","sourceRoot":"","sources":["../../src/routes/kie-credits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AA8ClD,QAAA,MAAM,eAAe,EAAE,kBA+DtB,CAAC;eAEa,eAAe"}

package/dist/routes/kie-credits.js

@@ -0,0 +1,93 @@
+import { Secret } from "@nodetool-ai/models";
+import { isFiniteNumber, isObjectLike, isString } from "../lib/wire-values.js";
+const KIE_CREDITS_URL = "https://api.kie.ai/api/v1/chat/credit";
+/** UI expects `credit_balance: { amount, currency }` (see web `formatKieCredits`). */
+function normalizeKieCreditsBody(data) {
+    if (!isObjectLike(data)) {
+        return { credit_balance: null };
+    }
+    if (isFiniteNumber(data.data)) {
+        return {
+            credit_balance: {
+                amount: data.data,
+                currency: "credits",
+            },
+        };
+    }
+    return { credit_balance: null };
+}
+function kieErrorDetail(data, httpStatus) {
+    const msg = isString(data.msg) ? data.msg.trim() : "";
+    if (msg !== "") {
+        return msg;
+    }
+    if (httpStatus === 401 || data.code === 401) {
+        return "Unauthorized. Check KIE_API_KEY in settings.";
+    }
+    if (httpStatus === 402 || data.code === 402) {
+        return "Insufficient credits on your kie.ai account.";
+    }
+    return "KIE account credits could not be loaded. Check KIE_API_KEY in settings.";
+}
+const kieCreditsRoute = async (app) => {
+    app.get("/api/kie/credits", async (_req, reply) => {
+        const secret = await Secret.find("1", "KIE_API_KEY");
+        let apiKey = null;
+        if (secret) {
+            try {
+                apiKey = await secret.getDecryptedValue();
+            }
+            catch (err) {
+                console.error("[kie-credits] decryption failed:", err);
+            }
+        }
+        apiKey ??= process.env.KIE_API_KEY ?? null;
+        if (!apiKey) {
+            console.info("[kie-credits] no KIE_API_KEY (db secret or env); returning 204");
+            reply.status(204).send();
+            return;
+        }
+        try {
+            const res = await fetch(KIE_CREDITS_URL, {
+                headers: { Authorization: `Bearer ${apiKey}` },
+            });
+            const raw = (await res.json().catch(() => null));
+            if (!res.ok || raw == null) {
+                const body = raw != null ? JSON.stringify(raw) : "";
+                console.warn("[kie-credits] kie.ai HTTP", res.status, "—", body.slice(0, 200));
+                reply.send({
+                    unavailable: true,
+                    detail: raw != null ? kieErrorDetail(raw, res.status) : "KIE credits request failed.",
+                    credit_balance: null,
+                });
+                return;
+            }
+            if (raw.code !== undefined && raw.code !== 200) {
+                console.warn("[kie-credits] kie.ai body code", raw.code, "—", raw.msg ?? "");
+                reply.send({
+                    unavailable: true,
+                    detail: kieErrorDetail(raw, res.status),
+                    credit_balance: null,
+                });
+                return;
+            }
+            const payload = normalizeKieCreditsBody(raw);
+            const bal = payload.credit_balance;
+            console.info("[kie-credits] kie.ai OK", {
+                has_credit_balance: bal != null,
+                balance_type: bal == null ? "none" : typeof bal,
+            });
+            reply.send(payload);
+        }
+        catch (err) {
+            console.error("[kie-credits] fetch failed:", err);
+            reply.send({
+                unavailable: true,
+                detail: "Could not reach kie.ai. Try again later.",
+                credit_balance: null,
+            });
+        }
+    });
+};
+export default kieCreditsRoute;
+//# sourceMappingURL=kie-credits.js.map

package/dist/routes/kie-credits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-credits.js","sourceRoot":"","sources":["../../src/routes/kie-credits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,YAAY,EACZ,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAQhE,sFAAsF;AACtF,SAAS,uBAAuB,CAAC,IAA2B;IAC1D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,cAAc,EAAE;gBACd,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,SAAS;aACpB;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,IAAoB,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QAC5C,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QAC5C,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,yEAAyE,CAAC;AACnF,CAAC;AAED,MAAM,eAAe,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;QAE3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YAC/E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;gBACvC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA0B,CAAC;YAE1E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC;oBACT,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,6BAA6B;oBACrF,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC7E,KAAK,CAAC,IAAI,CAAC;oBACT,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;oBACvC,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACtC,kBAAkB,EAAE,GAAG,IAAI,IAAI;gBAC/B,YAAY,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG;aAChD,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC;gBACT,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,0CAA0C;gBAClD,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/kie-pricing.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyPluginAsync } from "fastify";
+declare const kiePricingRoute: FastifyPluginAsync;
+export default kiePricingRoute;
+//# sourceMappingURL=kie-pricing.d.ts.map

package/dist/routes/kie-pricing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-pricing.d.ts","sourceRoot":"","sources":["../../src/routes/kie-pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAgClD,QAAA,MAAM,eAAe,EAAE,kBA2BtB,CAAC;eAEa,eAAe"}

package/dist/routes/kie-pricing.js

@@ -0,0 +1,45 @@
+import { aggregateKiePricingByModelId, fetchAllKiePricingRecords, resolveKiePricing, } from "@nodetool-ai/kie-nodes/kie-pricing-api";
+const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+let catalogCache = null;
+async function getKiePricingCatalog() {
+    const now = Date.now();
+    if (catalogCache != null && now < catalogCache.expiresAt) {
+        return catalogCache.byModelId;
+    }
+    const records = await fetchAllKiePricingRecords();
+    const byModelId = aggregateKiePricingByModelId(records);
+    catalogCache = {
+        byModelId,
+        expiresAt: now + CACHE_TTL_MS,
+    };
+    return byModelId;
+}
+const kiePricingRoute = async (app) => {
+    app.get("/api/kie/pricing", async (req, reply) => {
+        const raw = req.query["model_id"];
+        const modelIds = raw
+            ? [...new Set(Array.isArray(raw) ? raw : [raw])]
+            : [];
+        if (modelIds.length === 0) {
+            reply.status(400).send({ detail: "model_id query param required" });
+            return;
+        }
+        try {
+            const catalog = await getKiePricingCatalog();
+            const byModelId = {};
+            for (const id of modelIds) {
+                const entry = resolveKiePricing(catalog, id);
+                if (entry) {
+                    byModelId[id] = entry;
+                }
+            }
+            reply.send({ byModelId, fetched_at: new Date().toISOString() });
+        }
+        catch (err) {
+            console.error("[kie-pricing] fetch failed:", err);
+            reply.status(502).send({ detail: "Failed to fetch KIE pricing" });
+        }
+    });
+};
+export default kiePricingRoute;
+//# sourceMappingURL=kie-pricing.js.map

package/dist/routes/kie-pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-pricing.js","sourceRoot":"","sources":["../../src/routes/kie-pricing.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,iBAAiB,GAElB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAE9C,IAAI,YAAY,GAGL,IAAI,CAAC;AAEhB,KAAK,UAAU,oBAAoB;IAGjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,YAAY,IAAI,IAAI,IAAI,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;QACzD,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,YAAY,GAAG;QACb,SAAS;QACT,SAAS,EAAE,GAAG,GAAG,YAAY;KAC9B,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAI,GAAG,CAAC,KAA2C,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG;YAClB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAC7C,MAAM,SAAS,GAA2C,EAAE,CAAC;YAC7D,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/kie-webhook.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyPluginAsync } from "fastify";
+declare const kieWebhookRoute: FastifyPluginAsync;
+export default kieWebhookRoute;
+//# sourceMappingURL=kie-webhook.d.ts.map

package/dist/routes/kie-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-webhook.d.ts","sourceRoot":"","sources":["../../src/routes/kie-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAiDlD,QAAA,MAAM,eAAe,EAAE,kBAiBtB,CAAC;eAEa,eAAe"}

package/dist/routes/kie-webhook.js

@@ -0,0 +1,70 @@
+import { resolveWebhook, rejectWebhook } from "@nodetool-ai/runtime";
+import { isNonEmptyString, isObjectLike, isString } from "../lib/wire-values.js";
+/**
+ * Extract a task ID from the KIE callback body. KIE may nest it under
+ * `data.taskId` or send it at the top level — try both.
+ */
+function extractTaskId(body) {
+    if (!isObjectLike(body))
+        return undefined;
+    const b = body;
+    if (isNonEmptyString(b.taskId))
+        return b.taskId;
+    if (isNonEmptyString(b.task_id))
+        return b.task_id;
+    const data = b.data;
+    if (isObjectLike(data)) {
+        const d = data;
+        if (isNonEmptyString(d.taskId))
+            return d.taskId;
+        if (isNonEmptyString(d.task_id))
+            return d.task_id;
+    }
+    return undefined;
+}
+function extractStatus(body) {
+    if (!isObjectLike(body))
+        return undefined;
+    const b = body;
+    if (isString(b.status))
+        return b.status;
+    if (isString(b.state))
+        return b.state;
+    const data = b.data;
+    if (isObjectLike(data)) {
+        const d = data;
+        if (isString(d.status))
+            return d.status;
+        if (isString(d.state))
+            return d.state;
+    }
+    return undefined;
+}
+const FAILURE_STATES = new Set([
+    "failed",
+    "fail",
+    "CREATE_TASK_FAILED",
+    "GENERATE_AUDIO_FAILED",
+    "CALLBACK_EXCEPTION",
+    "SENSITIVE_WORD_ERROR"
+]);
+const kieWebhookRoute = async (app) => {
+    // KIE calls POST /api/kie/webhook with taskId in the body.
+    app.post("/api/kie/webhook", async (req, reply) => {
+        const taskId = extractTaskId(req.body);
+        if (!taskId) {
+            reply.status(400).send({ error: "No taskId in request body" });
+            return;
+        }
+        const status = extractStatus(req.body);
+        if (status && FAILURE_STATES.has(status)) {
+            rejectWebhook(taskId, status);
+        }
+        else {
+            resolveWebhook(taskId, req.body);
+        }
+        reply.send({ status: "accepted" });
+    });
+};
+export default kieWebhookRoute;
+//# sourceMappingURL=kie-webhook.js.map

package/dist/routes/kie-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-webhook.js","sourceRoot":"","sources":["../../src/routes/kie-webhook.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QAChD,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QACxC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,MAAM;IACN,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,2DAA2D;IAC3D,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/nodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.d.ts","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CAyGjD,CAAC;AAqCF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"nodes.d.ts","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAYrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CA6CjD,CAAC;eAgDa,WAAW"}