@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/routes/atlascloud-webhook.js

@@ -0,0 +1,369 @@
+/**
+ * Authenticated AtlasCloud prediction webhook ingress.
+ *
+ * AtlasCloud signs each callback with Ed25519 over `<timestamp>.<raw body>` and
+ * publishes the public keys as a JWKS (https://atlascloud.ai/docs/en/webhooks).
+ * The route verifies that signature, then hands the callback to the in-process
+ * registry the submitting run is waiting on. It does no provider I/O of its
+ * own: a callback is an optimization over polling the prediction endpoint, so a
+ * delivery this process cannot match is acknowledged rather than retried.
+ */
+import { createPublicKey, verify as verifySignature } from "node:crypto";
+import { rejectAtlasWebhook, resolveAtlasWebhook } from "@nodetool-ai/runtime";
+import { isRecord, isString } from "../lib/wire-values.js";
+export const ATLASCLOUD_WEBHOOK_PATH = "/api/providers/atlascloud/webhook";
+export const ATLASCLOUD_WEBHOOK_JWKS_URL = "https://api.atlascloud.ai/api/v1/webhooks/jwks.json";
+export const ATLASCLOUD_WEBHOOK_TIMESTAMP_WINDOW_SECONDS = 300;
+export const ATLASCLOUD_WEBHOOK_JWKS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Shortest gap between two key-rotation refreshes.
+ *
+ * This route is unauthenticated by design, so an unknown key id is something
+ * any caller can present. Without a floor, a stream of made-up key ids would
+ * turn each one into an outbound JWKS request at the route's rate limit. A
+ * real rotation still resolves within one cooldown.
+ */
+export const ATLASCLOUD_WEBHOOK_ROTATION_COOLDOWN_MS = 60 * 1000;
+export const ATLASCLOUD_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+const HEADER_ID = "x-atlascloud-webhook-id";
+const HEADER_TIMESTAMP = "x-atlascloud-webhook-timestamp";
+const HEADER_SIGNATURE = "x-atlascloud-webhook-signature-ed25519";
+/**
+ * AtlasCloud's contract: the Ed25519 signature moves to the bare header once
+ * HMAC is retired, so prefer `-Ed25519` and fall back to `-Signature`. During
+ * the migration the bare header carries a hex HMAC, which is not a 64-byte
+ * base64url value and so fails to decode below — legacy HMAC-only deliveries
+ * stay rejected rather than being verified under the wrong scheme.
+ */
+const HEADER_SIGNATURE_FALLBACK = "x-atlascloud-webhook-signature";
+const HEADER_KEY_ID = "x-atlascloud-webhook-key-id";
+/** Terminal `payload.status` values that mean the prediction did not produce
+ * usable outputs, even under a top-level `status: "OK"`. */
+const FAILED_PAYLOAD_STATUSES = new Set(["failed", "timeout", "cancelled"]);
+class AtlasCloudWebhookKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AtlasCloudWebhookKeyError";
+    }
+}
+function parseHeader(headers, name) {
+    const headerName = Object.keys(headers).find((key) => key.toLowerCase() === name);
+    const value = headerName ? headers[headerName] : undefined;
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    // The timestamp header is part of the signed message. Reject whitespace and
+    // control characters rather than silently normalising a signed value.
+    if (!/^[\x21-\x7e]+$/u.test(value))
+        return null;
+    return value;
+}
+function parseAtlasHeaders(headers) {
+    const webhookId = parseHeader(headers, HEADER_ID);
+    const timestamp = parseHeader(headers, HEADER_TIMESTAMP);
+    const signature = parseHeader(headers, HEADER_SIGNATURE) ??
+        parseHeader(headers, HEADER_SIGNATURE_FALLBACK);
+    const keyId = parseHeader(headers, HEADER_KEY_ID);
+    if (!webhookId || !timestamp || !signature || !keyId) {
+        return { ok: false, retryable: false, reason: "missing_header" };
+    }
+    if (webhookId.length > 512 ||
+        keyId.length > 512 ||
+        !/^\d{1,12}$/u.test(timestamp) ||
+        !/^[A-Za-z0-9_-]{86,88}={0,2}$/u.test(signature)) {
+        return { ok: false, retryable: false, reason: "invalid_header" };
+    }
+    return { webhookId, timestamp, signature, keyId };
+}
+function decodeBase64Url(value, bytes) {
+    // Padding is optional in base64url and AtlasCloud's own example emits none.
+    // Accepting it costs nothing: the decoded length is what is checked.
+    if (!/^[A-Za-z0-9_-]+={0,2}$/u.test(value))
+        return null;
+    try {
+        const decoded = Buffer.from(value, "base64url");
+        return decoded.length === bytes ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isAtlasJwk(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const key = value;
+    return (key.kty === "OKP" &&
+        key.crv === "Ed25519" &&
+        typeof key.x === "string" &&
+        decodeBase64Url(key.x, 32) !== null);
+}
+async function fetchAtlasJwks() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    try {
+        const response = await fetch(ATLASCLOUD_WEBHOOK_JWKS_URL, {
+            signal: controller.signal,
+            headers: { accept: "application/json" }
+        });
+        if (!response.ok) {
+            throw new AtlasCloudWebhookKeyError(`AtlasCloud JWKS returned ${response.status}`);
+        }
+        const parsed = await response.json();
+        if (typeof parsed !== "object" || parsed === null) {
+            throw new AtlasCloudWebhookKeyError("AtlasCloud JWKS was not an object");
+        }
+        const keys = parsed.keys;
+        if (!Array.isArray(keys)) {
+            throw new AtlasCloudWebhookKeyError("AtlasCloud JWKS did not contain keys");
+        }
+        return keys.filter(isAtlasJwk);
+    }
+    catch (error) {
+        if (error instanceof AtlasCloudWebhookKeyError)
+            throw error;
+        throw new AtlasCloudWebhookKeyError("AtlasCloud JWKS fetch failed");
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * AtlasCloud Ed25519 verifier. Key refreshes are coalesced so a burst of
+ * callbacks cannot turn a key rotation or a cold start into a request storm.
+ */
+export class AtlasCloudWebhookVerifier {
+    fetchJwks;
+    now;
+    cacheTtlMs;
+    rotationCooldownMs;
+    cachedKeys = null;
+    cacheExpiresAt = 0;
+    lastRotationRefreshAt = Number.NEGATIVE_INFINITY;
+    refreshPromise = null;
+    constructor(options = {}) {
+        this.fetchJwks = options.fetchJwks ?? fetchAtlasJwks;
+        this.now = options.now ?? Date.now;
+        this.cacheTtlMs = Math.min(options.cacheTtlMs ?? ATLASCLOUD_WEBHOOK_JWKS_CACHE_TTL_MS, ATLASCLOUD_WEBHOOK_JWKS_CACHE_TTL_MS);
+        this.rotationCooldownMs =
+            options.rotationCooldownMs ?? ATLASCLOUD_WEBHOOK_ROTATION_COOLDOWN_MS;
+    }
+    async refreshKeys() {
+        if (this.refreshPromise)
+            return this.refreshPromise;
+        this.refreshPromise = this.fetchJwks()
+            .then((keys) => {
+            this.cachedKeys = keys;
+            this.cacheExpiresAt = this.now() + this.cacheTtlMs;
+            return keys;
+        })
+            .finally(() => {
+            this.refreshPromise = null;
+        });
+        return this.refreshPromise;
+    }
+    /**
+     * Claim the one rotation refresh allowed per cooldown. Only refreshes an
+     * unknown key id provoked are counted: the cold-start load and a TTL
+     * expiry are this verifier's own doing and cannot be driven by a caller.
+     */
+    claimRotationRefresh() {
+        const now = this.now();
+        if (now - this.lastRotationRefreshAt < this.rotationCooldownMs) {
+            return false;
+        }
+        this.lastRotationRefreshAt = now;
+        return true;
+    }
+    async keys() {
+        if (this.cachedKeys && this.now() < this.cacheExpiresAt) {
+            return this.cachedKeys;
+        }
+        return this.refreshKeys();
+    }
+    async verify(headers, body) {
+        const parsed = parseAtlasHeaders(headers);
+        if ("ok" in parsed)
+            return parsed;
+        const timestamp = Number(parsed.timestamp);
+        if (!Number.isSafeInteger(timestamp)) {
+            return { ok: false, retryable: false, reason: "invalid_timestamp" };
+        }
+        const nowSeconds = Math.floor(this.now() / 1000);
+        if (Math.abs(nowSeconds - timestamp) >
+            ATLASCLOUD_WEBHOOK_TIMESTAMP_WINDOW_SECONDS) {
+            return { ok: false, retryable: false, reason: "stale_timestamp" };
+        }
+        const signature = decodeBase64Url(parsed.signature, 64);
+        if (!signature) {
+            return { ok: false, retryable: false, reason: "invalid_header" };
+        }
+        // AtlasCloud signs the timestamp, a literal period, and the exact request
+        // bytes. Concatenating buffers keeps a non-UTF-8 body byte-identical.
+        const message = Buffer.concat([
+            Buffer.from(`${parsed.timestamp}.`, "utf8"),
+            Buffer.from(body)
+        ]);
+        let keys;
+        try {
+            keys = await this.keys();
+        }
+        catch {
+            return { ok: false, retryable: true, reason: "jwks_unavailable" };
+        }
+        const matches = (candidateKeys) => {
+            const candidates = candidateKeys.filter((jwk) => jwk.kid === undefined || jwk.kid === parsed.keyId);
+            if (candidates.length === 0)
+                return "unknown_key";
+            for (const jwk of candidates) {
+                try {
+                    // Keep the verifier input to the required Ed25519 JWK members. The
+                    // local validation type intentionally does not claim Node's broad
+                    // JsonWebKey index signature.
+                    const key = { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
+                    const publicKey = createPublicKey({ key, format: "jwk" });
+                    if (verifySignature(null, message, publicKey, signature)) {
+                        return "signed";
+                    }
+                }
+                catch {
+                    // Invalid keys are ignored. A malformed JWKS must not make an
+                    // attacker-controlled callback pass verification.
+                }
+            }
+            return "bad_signature";
+        };
+        let outcome = matches(keys);
+        // Only an unknown key id can mean the cache is stale. A signature that
+        // fails against a key AtlasCloud does publish is simply wrong, and
+        // refetching on it let any caller drive one outbound request per attempt.
+        if (outcome === "unknown_key" && this.claimRotationRefresh()) {
+            try {
+                keys = await this.refreshKeys();
+            }
+            catch {
+                return { ok: false, retryable: true, reason: "jwks_unavailable" };
+            }
+            outcome = matches(keys);
+        }
+        if (outcome === "unknown_key") {
+            return { ok: false, retryable: false, reason: "unknown_key" };
+        }
+        if (outcome !== "signed") {
+            return { ok: false, retryable: false, reason: "invalid_signature" };
+        }
+        return { ok: true, headers: parsed };
+    }
+}
+const registrySink = {
+    resolve: resolveAtlasWebhook,
+    reject: rejectAtlasWebhook
+};
+function outputsOf(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value.filter((entry) => isString(entry) || isRecord(entry));
+}
+/** The callback's own account of the prediction, in the shape the prediction
+ * endpoint returns, so a run finishes the same way whichever source wins. */
+function resultOf(payload, error) {
+    const result = {};
+    const status = payload && isString(payload.status) ? payload.status : null;
+    if (status)
+        result.status = status;
+    const outputs = outputsOf(payload?.outputs);
+    if (outputs)
+        result.outputs = outputs;
+    if (payload && isString(payload.output))
+        result.output = payload.output;
+    if (payload && isString(payload.url))
+        result.url = payload.url;
+    if (error)
+        result.error = error;
+    return result;
+}
+function requestHeaders(req) {
+    return req.headers;
+}
+export function createAtlasCloudWebhookRoute(options = {}) {
+    const maxBodyBytes = options.maxBodyBytes ?? ATLASCLOUD_WEBHOOK_MAX_BODY_BYTES;
+    const verifier = options.verifier ?? new AtlasCloudWebhookVerifier();
+    const sink = options.sink ?? registrySink;
+    return async (app) => {
+        // This parser is encapsulated by Fastify. Other routes retain their
+        // existing parser and never see a reserialised body.
+        app.removeAllContentTypeParsers();
+        app.addContentTypeParser("*", { parseAs: "buffer", bodyLimit: maxBodyBytes }, (_req, body, done) => done(null, body));
+        app.post(ATLASCLOUD_WEBHOOK_PATH, {
+            bodyLimit: maxBodyBytes,
+            config: { rateLimit: { max: 120, timeWindow: 60_000 } },
+            schema: {
+                // The body is intentionally a raw Buffer. It is parsed after
+                // signature verification below, because parsing or reserialising it
+                // first would invalidate AtlasCloud's signature.
+                body: {},
+                response: {
+                    200: {
+                        type: "object",
+                        required: ["status", "matched"],
+                        properties: {
+                            status: { type: "string", const: "accepted" },
+                            matched: { type: "boolean" }
+                        }
+                    }
+                }
+            }
+        }, async (req, reply) => {
+            const body = Buffer.isBuffer(req.body)
+                ? req.body
+                : req.body?.raw;
+            if (!body)
+                return reply.status(400).send({ error: "Missing body" });
+            const verification = await verifier.verify(requestHeaders(req), body);
+            if (!verification.ok) {
+                return reply
+                    .status(verification.retryable ? 503 : 400)
+                    .send({ error: verification.reason });
+            }
+            let decoded;
+            try {
+                decoded = JSON.parse(body.toString("utf8"));
+            }
+            catch {
+                return reply.status(400).send({ error: "Invalid JSON body" });
+            }
+            if (!isRecord(decoded)) {
+                return reply
+                    .status(400)
+                    .send({ error: "Webhook body must be an object" });
+            }
+            const envelope = decoded;
+            const sessionId = isString(envelope.session_id)
+                ? envelope.session_id
+                : null;
+            if (!sessionId || sessionId !== verification.headers.webhookId) {
+                return reply.status(400).send({ error: "Session ID mismatch" });
+            }
+            const status = envelope.status;
+            if (status !== "OK" && status !== "ERROR") {
+                return reply.status(400).send({ error: "Invalid webhook status" });
+            }
+            const payload = isRecord(envelope.payload)
+                ? envelope.payload
+                : null;
+            const error = isString(envelope.error) ? envelope.error : null;
+            const payloadStatus = payload && isString(payload.status) ? payload.status : null;
+            const failed = status === "ERROR" ||
+                (payloadStatus !== null &&
+                    FAILED_PAYLOAD_STATUSES.has(payloadStatus.toLowerCase()));
+            // A delivery this process cannot match is a duplicate, a prediction
+            // another replica submitted, or one whose run already finished by
+            // poll. All three are acknowledged: retrying them changes nothing.
+            const matched = failed
+                ? sink.reject(sessionId, error ?? payloadStatus ?? "AtlasCloud reported a failure")
+                : sink.resolve(sessionId, resultOf(payload, error));
+            return reply.send({ status: "accepted", matched });
+        });
+    };
+}
+export const atlasCloudWebhookRoute = createAtlasCloudWebhookRoute();
+export default atlasCloudWebhookRoute;
+//# sourceMappingURL=atlascloud-webhook.js.map

package/dist/routes/atlascloud-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atlascloud-webhook.js","sourceRoot":"","sources":["../../src/routes/atlascloud-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAGzE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GACtC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,2CAA2C,GAAG,GAAG,CAAC;AAC/D,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjE,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7D,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAClE;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AACnE,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAEpD;4DAC4D;AAC5D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAwC5E,MAAM,yBAA0B,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,WAAW,CAClB,OAAsD,EACtD,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CACpC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAsD;IAEtD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACzD,MAAM,SAAS,GACb,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC;QACtC,WAAW,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,IACE,SAAS,CAAC,MAAM,GAAG,GAAG;QACtB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,CAAC,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,EAChD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,GAAG,CAAC,GAAG,KAAK,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,2BAA2B,EAAE;YACxD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,yBAAyB,CACjC,4BAA4B,QAAQ,CAAC,MAAM,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,yBAAyB,CAAC,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAI,MAAkC,CAAC,IAAI,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CACjC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IACnB,SAAS,CAAiD;IAC1D,GAAG,CAAe;IAClB,UAAU,CAAS;IACnB,kBAAkB,CAAS;IACpC,UAAU,GAA2C,IAAI,CAAC;IAC1D,cAAc,GAAG,CAAC,CAAC;IACnB,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACjD,cAAc,GAAoD,IAAI,CAAC;IAE/E,YAAY,OAAO,GAAqC,EAAE;QACxD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CACxB,OAAO,CAAC,UAAU,IAAI,oCAAoC,EAC1D,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,kBAAkB,IAAI,uCAAuC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE;aACnC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAsD,EACtD,IAAgB;QAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,IACE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;YAChC,2CAA2C,EAC3C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACnE,CAAC;QACD,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,MAAM,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SAClB,CAAC,CAAC;QAEH,IAAI,IAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,CACd,aAA8C,EACF,EAAE;YAC9C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,MAAM,GAAG,GAAe,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACjE,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1D,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;wBACzD,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;oBAC9D,kDAAkD;gBACpD,CAAC;YACH,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,uEAAuE;QACvE,mEAAmE;QACnE,0EAA0E;QAC1E,IAAI,OAAO,KAAK,aAAa,IAAI,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACpE,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;CACF;AASD,MAAM,YAAY,GAA0B;IAC1C,OAAO,EAAE,mBAAmB;IAC5B,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AAYF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,KAAK,EAAsC,EAAE,CAC5C,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CACrC,CAAC;AACJ,CAAC;AAED;6EAC6E;AAC7E,SAAS,QAAQ,CACf,OAAuC,EACvC,KAAoB;IAEpB,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtC,IAAI,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACxE,IAAI,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/D,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,GAAmB;IAEnB,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAO,GAAkC,EAAE;IAE3C,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,iCAAiC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,oEAAoE;QACpE,qDAAqD;QACrD,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAClC,GAAG,CAAC,oBAAoB,CACtB,GAAG,EACH,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,EAC9C,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CACvC,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB;YACE,SAAS,EAAE,YAAY;YACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;YACvD,MAAM,EAAE;gBACN,6DAA6D;gBAC7D,oEAAoE;gBACpE,iDAAiD;gBACjD,IAAI,EAAE,EAAE;gBACR,QAAQ,EAAE;oBACR,GAAG,EAAE;wBACH,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;wBAC/B,UAAU,EAAE;4BACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;4BAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;yBAC7B;qBACF;iBACF;aACF;SACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACpC,CAAC,CAAC,GAAG,CAAC,IAAI;gBACV,CAAC,CAAE,GAAG,CAAC,IAA0C,EAAE,GAAG,CAAC;YACzD,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAEpE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,OAAO,KAAK;qBACT,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;qBAC1C,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,QAAQ,GAAG,OAAkC,CAAC;YACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC7C,CAAC,CAAC,QAAQ,CAAC,UAAU;gBACrB,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACxC,CAAC,CAAE,QAAQ,CAAC,OAAmC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,MAAM,aAAa,GACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9D,MAAM,MAAM,GACV,MAAM,KAAK,OAAO;gBAClB,CAAC,aAAa,KAAK,IAAI;oBACrB,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE9D,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,OAAO,GAAG,MAAM;gBACpB,CAAC,CAAC,IAAI,CAAC,MAAM,CACT,SAAS,EACT,KAAK,IAAI,aAAa,IAAI,+BAA+B,CAC1D;gBACH,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,EAAE,CAAC;AAErE,eAAe,sBAAsB,CAAC"}

package/dist/routes/collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/routes/collections.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,QAAA,MAAM,iBAAiB,EAAE,kBAAkB,CAAC,YAAY,CA8BvD,CAAC;AAEF,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/routes/collections.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,QAAA,MAAM,iBAAiB,EAAE,kBAAkB,CAAC,YAAY,CA8BvD,CAAC;eAEa,iBAAiB"}

package/dist/routes/config.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyPluginAsync } from "fastify";
+/**
+ * Public, non-secret runtime configuration for the web client.
+ *
+ * Consolidates configuration on the backend: a separately-hosted frontend
+ * learns its auth mode and *public* Supabase credentials at runtime from the
+ * server it talks to, instead of baking `VITE_*` values into the bundle at
+ * build time. The web app fetches this at boot (see web `runtimeConfig.ts`).
+ *
+ * This endpoint MUST only expose values that are safe in a browser. The
+ * Supabase anon key (`SUPABASE_ANON_KEY`) is designed to ship to clients; the
+ * service-role key (`SUPABASE_KEY`) is never returned.
+ */
+/**
+ * Describe the one misconfiguration this endpoint can serve without noticing:
+ * auth enforced (`SUPABASE_URL` + `SUPABASE_KEY`) but no `SUPABASE_ANON_KEY` to
+ * hand the browser. The response is still well-formed — `supabaseAnonKey` is
+ * just `null` — so the web app falls back to a placeholder key and every login
+ * 401s with nothing in the server log. Returns null when nothing is wrong.
+ *
+ * Pure so the boot-time check can be tested without standing up a server.
+ */
+export declare const describeMissingAnonKey: (env?: Record<string, string | undefined>) => string | null;
+declare const configRoute: FastifyPluginAsync;
+export default configRoute;
+//# sourceMappingURL=config.d.ts.map

package/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,SAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACtC,MAAM,GAAG,IAaX,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,kBA4BlB,CAAC;eAEa,WAAW"}

package/dist/routes/config.js

@@ -0,0 +1,64 @@
+import { isGoogleWorkspaceEnabled } from "@nodetool-ai/config";
+import { GOOGLE_WORKSPACE_SCOPES } from "@nodetool-ai/runtime";
+import { getVersion } from "./health.js";
+/**
+ * Public, non-secret runtime configuration for the web client.
+ *
+ * Consolidates configuration on the backend: a separately-hosted frontend
+ * learns its auth mode and *public* Supabase credentials at runtime from the
+ * server it talks to, instead of baking `VITE_*` values into the bundle at
+ * build time. The web app fetches this at boot (see web `runtimeConfig.ts`).
+ *
+ * This endpoint MUST only expose values that are safe in a browser. The
+ * Supabase anon key (`SUPABASE_ANON_KEY`) is designed to ship to clients; the
+ * service-role key (`SUPABASE_KEY`) is never returned.
+ */
+/**
+ * Describe the one misconfiguration this endpoint can serve without noticing:
+ * auth enforced (`SUPABASE_URL` + `SUPABASE_KEY`) but no `SUPABASE_ANON_KEY` to
+ * hand the browser. The response is still well-formed — `supabaseAnonKey` is
+ * just `null` — so the web app falls back to a placeholder key and every login
+ * 401s with nothing in the server log. Returns null when nothing is wrong.
+ *
+ * Pure so the boot-time check can be tested without standing up a server.
+ */
+export const describeMissingAnonKey = (env = process.env) => {
+    const url = env["SUPABASE_URL"]?.trim();
+    const serviceKey = env["SUPABASE_KEY"]?.trim();
+    const anonKey = env["SUPABASE_ANON_KEY"]?.trim();
+    if (!url || !serviceKey || anonKey)
+        return null;
+    return ("SUPABASE_ANON_KEY is not set. Auth is enforced (SUPABASE_URL and " +
+        "SUPABASE_KEY are both present), but GET /api/config has no anon key to " +
+        "give the web app, so it falls back to a placeholder and every login " +
+        "fails with 401. Set SUPABASE_ANON_KEY to the project's public anon key — " +
+        "never SUPABASE_KEY, which is the service-role key and must not reach a " +
+        "browser.");
+};
+const configRoute = async (app) => {
+    app.get("/api/config", async (_req, reply) => {
+        const supabaseUrl = process.env["SUPABASE_URL"]?.trim() || null;
+        const supabaseServiceKey = process.env["SUPABASE_KEY"]?.trim() || null;
+        const supabaseAnonKey = process.env["SUPABASE_ANON_KEY"]?.trim() || null;
+        const authRedirectUrl = process.env["AUTH_REDIRECT_URL"]?.trim() || null;
+        // Mirror the server's auth-mode selection: "Supabase mode" (auth enforced)
+        // is chosen when both SUPABASE_URL and SUPABASE_KEY are set. Everything
+        // else is "Local mode" (loopback trusted, no login screen).
+        const authMode = supabaseUrl && supabaseServiceKey ? "supabase" : "local";
+        // When enabled, the web app offers a Workspace connect step — separate from
+        // login, which asks for identity only — and posts the resulting provider
+        // token to /api/oauth/google/session.
+        const googleWorkspace = isGoogleWorkspaceEnabled();
+        return reply.status(200).send({
+            authMode,
+            supabaseUrl,
+            supabaseAnonKey,
+            authRedirectUrl,
+            googleWorkspace,
+            googleScopes: googleWorkspace ? GOOGLE_WORKSPACE_SCOPES : [],
+            version: getVersion()
+        });
+    });
+};
+export default configRoute;
+//# sourceMappingURL=config.js.map

package/dist/routes/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAG,GAAuC,OAAO,CAAC,GAAG,EACtC,EAAE;IACjB,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,CACL,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,UAAU,CACX,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACpD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAChE,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QACvE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QACzE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAEzE,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,QAAQ,GACZ,WAAW,IAAI,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QAE3D,4EAA4E;QAC5E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,eAAe,GAAG,wBAAwB,EAAE,CAAC;QAEnD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,QAAQ;YACR,WAAW;YACX,eAAe;YACf,eAAe;YACf,eAAe;YACf,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE;YAC5D,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/routes/documents.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Document text extraction — `POST /api/documents/extract-text`.
+ *
+ * Script and screenplay imports send the file here instead of reading it in
+ * the browser: pdfium and mammoth are Node-only and would add megabytes to the
+ * web bundle for an action a user takes once (PRD § 7.6, D16). FDX is XML and
+ * is parsed in the browser, so this route does not accept it.
+ *
+ * The route stores nothing. It reads the upload, returns the text, and drops
+ * the bytes — including on every error path.
+ */
+import type { FastifyPluginAsync } from "fastify";
+/**
+ * The whole file is buffered and parsed in memory, so this caps what one
+ * request may hold rather than what a disk could take. A feature-length
+ * screenplay exported to PDF or DOCX is a few hundred kilobytes; 25 MB clears
+ * even a page-scan PDF while keeping the parse bounded.
+ */
+export declare const EXTRACT_TEXT_MAX_BYTES: number;
+/** `{ text, pages? }` — `pages` is the PDF page count, absent for DOCX. */
+export interface ExtractTextResponse {
+    text: string;
+    pages?: number;
+}
+declare const documentsRoutes: FastifyPluginAsync;
+export default documentsRoutes;
+//# sourceMappingURL=documents.d.ts.map

package/dist/routes/documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/routes/documents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAahE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAWvD,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4ED,QAAA,MAAM,eAAe,EAAE,kBA+FtB,CAAC;eAEa,eAAe"}