@promptbook/cli 0.112.0-135 → 0.112.0-137

package/apps/agents-server/src/app/admin/update/UpdateClient.tsx

@@ -4,7 +4,10 @@ import {
     CheckCircle2,
     ChevronDown,
     ChevronUp,
+    ClipboardCopy,
     Download,
+    FileDown,
+    GitCommit,
     Loader2,
     RefreshCcw,
     Rocket,
@@ -12,11 +15,12 @@ import {
     Settings2,
     TriangleAlert,
 } from 'lucide-react';
-import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { AdminXtermTerminal } from '../../../components/AdminTerminal/AdminXtermTerminal';
 import { Card } from '../../../components/Homepage/Card';
 import { useServerLanguage } from '../../../components/ServerLanguage/ServerLanguageProvider';
 import type { ServerLanguageCode } from '../../../languages/ServerLanguageRegistry';
+import { downloadBlob, parseFilenameFromContentDisposition } from '../../../utils/download/browserFileDownload';
 import { createServerLanguageMoment } from '../../../utils/localization/createServerLanguageMoment';
 import { formatServerLanguageHumanReadableDate } from '../../../utils/localization/formatServerLanguageHumanReadableDate';
 import { CustomCommitPicker, type CustomCommitPickerCandidate } from './CustomCommitPicker';
@@ -51,6 +55,16 @@ type UpdateJobSnapshot = {
     readonly logFilePath: string | null;
 };
 
+/**
+ * Browser-safe summary of one commit between the deployed checkout and the latest remote commit.
+ */
+type UpdatePendingCommit = {
+    readonly commitSha: string;
+    readonly shortCommitSha: string;
+    readonly subject: string;
+    readonly authoredAt: string | null;
+};
+
 /**
  * Browser-safe self-update overview returned by the super-admin API.
  */
@@ -68,6 +82,7 @@ type UpdateOverview = {
     readonly latestRemoteCommitShortSha: string | null;
     readonly latestRemoteCommitDate: string | null;
     readonly commitsBehindCount: number | null;
+    readonly pendingCommits: ReadonlyArray<UpdatePendingCommit>;
     readonly isUpdateAvailable: boolean;
     readonly originRepositoryUrl: string;
     readonly isOriginRepositoryDefault: boolean;
@@ -76,6 +91,16 @@ type UpdateOverview = {
     readonly error?: string;
 };
 
+/**
+ * Duration (ms) of the transient "Copied!" / "Saved!" feedback shown next to log action buttons.
+ */
+const UPDATE_LOG_ACTION_FEEDBACK_DURATION_MS = 2500;
+
+/**
+ * Default download filename used when the server does not provide one via `Content-Disposition`.
+ */
+const DEFAULT_UPDATE_LOG_DOWNLOAD_FILENAME = 'self-update.log';
+
 /**
  * Client UI for standalone VPS branch-aware self-updates.
  */
@@ -433,6 +458,7 @@ export function UpdateClient() {
                             <span className="ml-2 font-mono text-slate-700">{overview.job.logFilePath}</span>
                         </div>
                     )}
+                    {overview?.job.status === 'failed' && <UpdateJobLogActions />}
                     <AdminXtermTerminal
                         terminalId={updateTerminalId}
                         output={overview?.job.logTail || ''}
@@ -443,6 +469,8 @@ export function UpdateClient() {
                     />
                 </div>
             </Card>
+
+            <PendingCommitsCard overview={overview} language={language} />
         </div>
     );
 }
@@ -546,6 +574,192 @@ function CurrentDeploymentCard({
     );
 }
 
+/**
+ * Lists the commits between the deployed checkout and the latest remote commit so the super admin can review what
+ * exactly is about to be installed before triggering the self-update.
+ *
+ * @private internal component of `<UpdateClient/>`
+ */
+function PendingCommitsCard({
+    overview,
+    language,
+}: {
+    readonly overview: UpdateOverview | null;
+    readonly language: ServerLanguageCode;
+}) {
+    if (!overview || overview.pendingCommits.length === 0) {
+        return null;
+    }
+
+    const commitsBehindLabel =
+        overview.commitsBehindCount !== null && overview.commitsBehindCount > 0
+            ? `${overview.commitsBehindCount} commit${overview.commitsBehindCount === 1 ? '' : 's'} behind`
+            : `${overview.pendingCommits.length} commit${overview.pendingCommits.length === 1 ? '' : 's'} pending`;
+    const timeBehindLabel = buildDeploymentTimeBehindLabel(overview, language);
+
+    return (
+        <Card className="hover:border-gray-200 hover:shadow-md">
+            <div className="space-y-4">
+                <div className="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
+                    <div className="flex items-start gap-3">
+                        <GitCommit className="mt-0.5 h-5 w-5 text-amber-500" />
+                        <div>
+                            <h2 className="text-lg font-semibold text-slate-900">Pending commits</h2>
+                            <p className="mt-1 text-sm text-slate-500">
+                                Commits between the currently deployed checkout and the latest commit on{' '}
+                                <span className="font-mono">{overview.currentEnvironment.branch}</span>.
+                            </p>
+                        </div>
+                    </div>
+                    <div className="text-xs font-semibold uppercase tracking-wide text-slate-500 sm:text-right">
+                        <div>{commitsBehindLabel}</div>
+                        {timeBehindLabel && <div className="mt-1 normal-case text-slate-400">{timeBehindLabel}</div>}
+                    </div>
+                </div>
+
+                <ul className="divide-y divide-slate-100 rounded-xl border border-slate-200 bg-white">
+                    {overview.pendingCommits.map((pendingCommit) => (
+                        <li key={pendingCommit.commitSha} className="px-4 py-3">
+                            <div className="flex flex-wrap items-baseline gap-x-3 gap-y-1">
+                                <span className="font-mono text-xs text-slate-500">
+                                    {pendingCommit.shortCommitSha}
+                                </span>
+                                <span className="text-sm text-slate-900">{pendingCommit.subject}</span>
+                            </div>
+                            <div className="mt-1 text-xs text-slate-500">
+                                {formatHumanReadableTimestamp(pendingCommit.authoredAt, language)}
+                            </div>
+                        </li>
+                    ))}
+                </ul>
+            </div>
+        </Card>
+    );
+}
+
+/**
+ * Renders the copy / download actions for the persisted standalone VPS self-update log file.
+ *
+ * Shown when the latest update job failed so the super admin can quickly share the full log with the developers.
+ *
+ * @private internal component of `<UpdateClient/>`
+ */
+function UpdateJobLogActions() {
+    const [actionFeedback, setActionFeedback] = useState<string | null>(null);
+    const [actionErrorMessage, setActionErrorMessage] = useState<string | null>(null);
+    const [isCopying, setIsCopying] = useState(false);
+    const [isDownloading, setIsDownloading] = useState(false);
+    const feedbackTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+    useEffect(() => {
+        return () => {
+            if (feedbackTimeoutRef.current !== null) {
+                clearTimeout(feedbackTimeoutRef.current);
+                feedbackTimeoutRef.current = null;
+            }
+        };
+    }, []);
+
+    function showActionFeedback(feedbackMessage: string): void {
+        if (feedbackTimeoutRef.current !== null) {
+            clearTimeout(feedbackTimeoutRef.current);
+        }
+        setActionFeedback(feedbackMessage);
+        setActionErrorMessage(null);
+        feedbackTimeoutRef.current = setTimeout(() => {
+            setActionFeedback(null);
+            feedbackTimeoutRef.current = null;
+        }, UPDATE_LOG_ACTION_FEEDBACK_DURATION_MS);
+    }
+
+    async function fetchUpdateLogResponse(): Promise<Response> {
+        const response = await fetch('/api/admin/update/log', { cache: 'no-store' });
+        if (!response.ok) {
+            const errorPayload = (await response.json().catch(() => null)) as { readonly error?: string } | null;
+            throw new Error(errorPayload?.error || 'Failed to load the self-update log file.');
+        }
+        return response;
+    }
+
+    async function handleCopyLog(): Promise<void> {
+        if (isCopying || isDownloading) {
+            return;
+        }
+
+        try {
+            setIsCopying(true);
+            setActionErrorMessage(null);
+            if (!navigator.clipboard?.writeText) {
+                throw new Error('The browser clipboard API is unavailable in this context.');
+            }
+            const response = await fetchUpdateLogResponse();
+            const logContent = await response.text();
+            await navigator.clipboard.writeText(logContent);
+            showActionFeedback('Self-update log copied to clipboard.');
+        } catch (error) {
+            setActionErrorMessage(error instanceof Error ? error.message : 'Failed to copy the self-update log.');
+        } finally {
+            setIsCopying(false);
+        }
+    }
+
+    async function handleDownloadLog(): Promise<void> {
+        if (isCopying || isDownloading) {
+            return;
+        }
+
+        try {
+            setIsDownloading(true);
+            setActionErrorMessage(null);
+            const response = await fetchUpdateLogResponse();
+            const logFilename =
+                parseFilenameFromContentDisposition(response.headers.get('Content-Disposition')) ||
+                DEFAULT_UPDATE_LOG_DOWNLOAD_FILENAME;
+            const logBlob = await response.blob();
+            downloadBlob(logBlob, logFilename);
+            showActionFeedback(`Saved self-update log as ${logFilename}.`);
+        } catch (error) {
+            setActionErrorMessage(error instanceof Error ? error.message : 'Failed to download the self-update log.');
+        } finally {
+            setIsDownloading(false);
+        }
+    }
+
+    return (
+        <div className="flex flex-wrap items-center gap-3 rounded-xl border border-rose-200 bg-rose-50/40 px-4 py-3 text-sm text-rose-700">
+            <span className="font-medium">Share the log with the developers:</span>
+            <button
+                type="button"
+                onClick={() => void handleCopyLog()}
+                disabled={isCopying || isDownloading}
+                className="inline-flex items-center gap-2 rounded-md border border-rose-200 bg-white px-3 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-100 disabled:cursor-not-allowed disabled:opacity-60"
+            >
+                {isCopying ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <ClipboardCopy className="h-3.5 w-3.5" />}
+                Copy log
+            </button>
+            <button
+                type="button"
+                onClick={() => void handleDownloadLog()}
+                disabled={isCopying || isDownloading}
+                className="inline-flex items-center gap-2 rounded-md border border-rose-200 bg-white px-3 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-100 disabled:cursor-not-allowed disabled:opacity-60"
+            >
+                {isDownloading ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <FileDown className="h-3.5 w-3.5" />}
+                Download log
+            </button>
+            {actionFeedback && (
+                <span className="text-xs text-rose-600" role="status" aria-live="polite">
+                    {actionFeedback}
+                </span>
+            )}
+            {actionErrorMessage && (
+                <span className="text-xs text-rose-700" role="alert">
+                    {actionErrorMessage}
+                </span>
+            )}
+        </div>
+    );
+}
+
 /**
  * Collapsible advanced panel for overriding the upstream repository URL.
  *
@@ -628,14 +842,33 @@ function buildDeploymentDriftLabel(overview: UpdateOverview | null, language: Se
             ? `${overview.commitsBehindCount} commit${overview.commitsBehindCount === 1 ? '' : 's'} behind`
             : 'New commit available';
 
-    if (!overview.currentCommitDate || !overview.latestRemoteCommitDate) {
+    const timeBehindLabel = buildDeploymentTimeBehindLabel(overview, language);
+    if (!timeBehindLabel) {
         return commitsBehindLabel;
     }
 
+    return `${commitsBehindLabel} · ${timeBehindLabel}`;
+}
+
+/**
+ * Builds the localized time-behind portion of the deployment drift label (e.g. `3 days behind`).
+ *
+ * @param overview - Current overview snapshot.
+ * @param language - Active UI language for moment localization.
+ * @returns Time-behind label or empty string when either side of the comparison is missing.
+ */
+function buildDeploymentTimeBehindLabel(overview: UpdateOverview | null, language: ServerLanguageCode): string {
+    if (!overview?.currentCommitDate || !overview.latestRemoteCommitDate) {
+        return '';
+    }
+
     const currentMoment = createServerLanguageMoment(overview.currentCommitDate, language);
     const latestMoment = createServerLanguageMoment(overview.latestRemoteCommitDate, language);
-    const timeBehindLabel = currentMoment.from(latestMoment, true);
-    return `${commitsBehindLabel} · ${timeBehindLabel} behind`;
+    if (!currentMoment.isValid() || !latestMoment.isValid()) {
+        return '';
+    }
+
+    return `${currentMoment.from(latestMoment, true)} behind`;
 }
 
 /**

package/apps/agents-server/src/app/api/admin/update/log/route.ts

@@ -0,0 +1,42 @@
+import { basename } from 'path';
+import { NextResponse } from 'next/server';
+import { isUserGlobalAdmin } from '@/src/utils/isUserGlobalAdmin';
+import { readVpsSelfUpdateLogFileContent, resolveVpsSelfUpdateLogFilePath } from '@/src/utils/vpsSelfUpdate';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+/**
+ * Streams the full persisted standalone VPS self-update log so the super-admin UI can copy or download it
+ * for sharing with the developers when a self-update fails.
+ */
+export async function GET() {
+    if (!(await isUserGlobalAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const logFileContent = await readVpsSelfUpdateLogFileContent();
+        if (logFileContent === null) {
+            return NextResponse.json(
+                { error: 'The standalone VPS self-update log file does not exist yet.' },
+                { status: 404 },
+            );
+        }
+
+        const logFileName = basename(resolveVpsSelfUpdateLogFilePath());
+        return new NextResponse(logFileContent, {
+            status: 200,
+            headers: {
+                'Content-Type': 'text/plain; charset=utf-8',
+                'Content-Disposition': `attachment; filename="${logFileName}"`,
+                'Cache-Control': 'no-store',
+            },
+        });
+    } catch (error) {
+        return NextResponse.json(
+            { error: error instanceof Error ? error.message : 'Failed to load the self-update log file.' },
+            { status: 500 },
+        );
+    }
+}

package/apps/agents-server/src/app/api/agents/export/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from 'next/server';
+import { Readable } from 'node:stream';
+import { createAgentsExportZipStream } from '../../../../utils/agentsTransfer/createAgentsExportZipStream';
+import { isUserAdmin } from '../../../../utils/isUserAdmin';
+
+/**
+ * This route is always dynamic because it depends on live DB state and auth.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * Streaming ZIP generation requires the Node.js runtime.
+ */
+export const runtime = 'nodejs';
+
+/**
+ * Streams an agents-only ZIP export containing book files in folder structure.
+ *
+ * @returns ZIP response for admins or `401` for non-admin callers.
+ */
+export async function GET() {
+    if (!(await isUserAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const { filename, stream } = await createAgentsExportZipStream();
+        const body = Readable.toWeb(stream as Readable) as ReadableStream<Uint8Array>;
+
+        return new NextResponse(body, {
+            headers: {
+                'Content-Type': 'application/zip',
+                'Content-Disposition': `attachment; filename="${filename}"`,
+                'Cache-Control': 'no-store',
+            },
+        });
+    } catch (error) {
+        console.error('Agents export error:', error);
+        return NextResponse.json({ error: 'Failed to generate agents export.' }, { status: 500 });
+    }
+}

package/apps/agents-server/src/app/api/agents/import/route.ts

@@ -0,0 +1,168 @@
+import { AuthenticationError, DatabaseError, ParseError, UnexpectedError } from '@promptbook-local/core';
+import { NextResponse } from 'next/server';
+import {
+    importAgentsFromFiles,
+    type AgentsImportConflictResolution,
+    type AgentsImportFile,
+} from '../../../../utils/agentsTransfer/importAgentsFromFiles';
+import { isUserAdmin } from '../../../../utils/isUserAdmin';
+
+/**
+ * This route is always dynamic because it depends on live DB state and auth.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * ZIP parsing and database writes require the Node.js runtime.
+ */
+export const runtime = 'nodejs';
+
+/**
+ * Form field containing uploaded book or ZIP files.
+ */
+const FILES_FORM_FIELD = 'files';
+
+/**
+ * Form field containing the optional target folder id.
+ */
+const TARGET_FOLDER_ID_FORM_FIELD = 'targetFolderId';
+
+/**
+ * Form field containing duplicate conflict handling.
+ */
+const CONFLICT_RESOLUTION_FORM_FIELD = 'conflictResolution';
+
+/**
+ * Default duplicate conflict handling.
+ */
+const DEFAULT_CONFLICT_RESOLUTION: AgentsImportConflictResolution = 'ASK';
+
+/**
+ * Imports `.book` files and ZIP archives into the current Agents Server.
+ *
+ * @param request - Multipart request containing one or more files.
+ * @returns Import summary or duplicate-conflict response.
+ */
+export async function POST(request: Request) {
+    if (!(await isUserAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const formData = await request.formData();
+        const files = await readImportFilesFromFormData(formData);
+        const result = await importAgentsFromFiles({
+            files,
+            targetFolderId: parseImportTargetFolderId(formData.get(TARGET_FOLDER_ID_FORM_FIELD)),
+            conflictResolution: parseImportConflictResolution(formData.get(CONFLICT_RESOLUTION_FORM_FIELD)),
+        });
+
+        if (result.conflicts.length > 0) {
+            return NextResponse.json(
+                {
+                    success: false,
+                    code: 'agent_import_conflicts',
+                    message: 'Some dropped books have the same agent name as existing agents but different book source.',
+                    ...result,
+                },
+                { status: 409 },
+            );
+        }
+
+        return NextResponse.json({ success: true, ...result });
+    } catch (error) {
+        return createAgentsImportErrorResponse(error);
+    }
+}
+
+/**
+ * Reads uploaded files from multipart form data.
+ *
+ * @param formData - Parsed multipart form data.
+ * @returns Import files with binary content.
+ */
+async function readImportFilesFromFormData(formData: FormData): Promise<Array<AgentsImportFile>> {
+    const files = formData.getAll(FILES_FORM_FIELD).filter(isUploadedFileLike);
+
+    if (files.length === 0) {
+        throw new ParseError('No files were uploaded.');
+    }
+
+    return Promise.all(
+        files.map(async (file) => ({
+            name: file.name,
+            content: await file.arrayBuffer(),
+        })),
+    );
+}
+
+/**
+ * Checks whether a form value behaves like an uploaded file.
+ *
+ * @param value - Form data value.
+ * @returns `true` when the value has a file name and content reader.
+ */
+function isUploadedFileLike(value: FormDataEntryValue): value is File {
+    return typeof value !== 'string' && typeof value.name === 'string' && typeof value.arrayBuffer === 'function';
+}
+
+/**
+ * Parses the optional target folder form field.
+ *
+ * @param value - Raw form field value.
+ * @returns Target folder id or `null` for root.
+ */
+function parseImportTargetFolderId(value: FormDataEntryValue | null): number | null {
+    if (value === null || value === '' || value === 'null') {
+        return null;
+    }
+
+    if (typeof value !== 'string') {
+        throw new ParseError('Invalid target folder id.');
+    }
+
+    const parsedValue = Number(value);
+    if (!Number.isInteger(parsedValue) || parsedValue <= 0) {
+        throw new ParseError('Invalid target folder id.');
+    }
+
+    return parsedValue;
+}
+
+/**
+ * Parses duplicate conflict handling from the import form.
+ *
+ * @param value - Raw form field value.
+ * @returns Conflict resolution mode.
+ */
+function parseImportConflictResolution(value: FormDataEntryValue | null): AgentsImportConflictResolution {
+    if (value === 'SKIP' || value === 'DUPLICATE' || value === 'ASK') {
+        return value;
+    }
+
+    return DEFAULT_CONFLICT_RESOLUTION;
+}
+
+/**
+ * Maps branded import errors into HTTP JSON responses.
+ *
+ * @param error - Unknown thrown error.
+ * @returns JSON error response.
+ */
+function createAgentsImportErrorResponse(error: unknown): NextResponse {
+    if (error instanceof AuthenticationError) {
+        return NextResponse.json({ success: false, error: error.message }, { status: 401 });
+    }
+
+    if (error instanceof ParseError) {
+        return NextResponse.json({ success: false, error: error.message }, { status: 400 });
+    }
+
+    if (error instanceof DatabaseError || error instanceof UnexpectedError) {
+        console.error('Agents import error:', error);
+        return NextResponse.json({ success: false, error: 'Failed to import agents.' }, { status: 500 });
+    }
+
+    console.error('Agents import error:', error);
+    return NextResponse.json({ success: false, error: 'Failed to import agents.' }, { status: 500 });
+}

package/apps/agents-server/src/app/api/federated-agents/route.ts

@@ -24,7 +24,7 @@ export async function GET() {
             });
         }
 
-        const federatedServers = await getFederatedServers({ excludeHiddenCoreServer: true });
+        const federatedServers = await getFederatedServers();
 
         return NextResponse.json({
             federatedServers,

package/apps/agents-server/src/app/api/internal/agent-runner-limits/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server';
+import { isTimingSafeEqualString } from '../../../../../../../src/utils/isTimingSafeEqualString';
 import { resolveUserChatWorkerInternalToken } from '@/src/utils/userChat';
 import { getLocalAgentRunnerLimits } from '@/src/utils/serverLimits';
 
@@ -47,5 +48,5 @@ async function handleAgentRunnerLimitsRequest(request: Request) {
  */
 function isAuthorizedInternalWorkerRequest(request: Request): boolean {
     const token = request.headers.get('x-user-chat-worker-token');
-    return token === resolveUserChatWorkerInternalToken();
+    return isTimingSafeEqualString(token, resolveUserChatWorkerInternalToken());
 }

package/apps/agents-server/src/app/api/internal/user-chat-jobs/run/route.ts

@@ -5,6 +5,7 @@ import {
     triggerUserChatJobWorker,
 } from '@/src/utils/userChat';
 import { after, NextResponse } from 'next/server';
+import { isTimingSafeEqualString } from '../../../../../../../../src/utils/isTimingSafeEqualString';
 
 /**
  * Allows one worker invocation to run for the platform maximum.
@@ -101,5 +102,5 @@ function isAuthorizedUserChatWorkerRequest(request: Request): boolean {
  */
 function isAuthorizedInternalWorkerRequest(request: Request): boolean {
     const token = request.headers.get('x-user-chat-worker-token');
-    return token === resolveUserChatWorkerInternalToken();
+    return isTimingSafeEqualString(token, resolveUserChatWorkerInternalToken());
 }

package/apps/agents-server/src/app/api/metadata/export/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server';
+import { createMetadataConfigurationExport } from '../../../../utils/metadataConfigurationTransfer';
+import { isUserAdmin } from '../../../../utils/isUserAdmin';
+
+/**
+ * This route is always dynamic because it depends on live DB state and auth.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * Serves the standalone server metadata JSON export.
+ *
+ * Returns `401` for non-admin callers.
+ */
+export async function GET() {
+    if (!(await isUserAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const { filename, payload } = await createMetadataConfigurationExport();
+
+        return new NextResponse(`${JSON.stringify(payload, null, 4)}\n`, {
+            headers: {
+                'Content-Type': 'application/json; charset=utf-8',
+                'Content-Disposition': `attachment; filename="${filename}"`,
+                'Cache-Control': 'no-store',
+            },
+        });
+    } catch (error) {
+        console.error('Metadata export error:', error);
+        return NextResponse.json({ error: 'Failed to export metadata.' }, { status: 500 });
+    }
+}

package/apps/agents-server/src/app/api/metadata/import/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { DatabaseError } from '../../../../../../../src/errors/DatabaseError';
+import { ParseError } from '../../../../../../../src/errors/ParseError';
+import { importMetadataConfigurationPayload } from '../../../../utils/metadataConfigurationTransfer';
+import { isUserAdmin } from '../../../../utils/isUserAdmin';
+
+/**
+ * This route is always dynamic because it depends on live DB state and auth.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * Imports standalone server metadata JSON.
+ *
+ * Returns `401` for non-admin callers.
+ */
+export async function POST(request: NextRequest) {
+    if (!(await isUserAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    let payload: unknown;
+
+    try {
+        payload = await request.json();
+    } catch {
+        return NextResponse.json({ error: 'Metadata import must be valid JSON.' }, { status: 400 });
+    }
+
+    try {
+        const importSummary = await importMetadataConfigurationPayload(payload);
+        return NextResponse.json(importSummary);
+    } catch (error) {
+        if (error instanceof ParseError) {
+            return NextResponse.json({ error: error.message }, { status: 400 });
+        }
+
+        if (error instanceof DatabaseError) {
+            console.error('Metadata import database error:', error);
+            return NextResponse.json({ error: error.message }, { status: 500 });
+        }
+
+        console.error('Metadata import error:', error);
+        return NextResponse.json({ error: 'Failed to import metadata.' }, { status: 500 });
+    }
+}