@repolore/server 0.0.0

package/dist/auth.d.ts

@@ -0,0 +1,16 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { RagStore } from "@repolore/core";
+/** Static bearer-token auth. `/health` and
+ * anything outside `PROTECTED_ROUTE_PREFIXES` are always open. `Settings.allowAnonymous`
+ * is checked per request (not cached at startup) so flipping it via `PUT /settings`
+ * takes effect immediately without a restart.
+ *
+ * Checked against `req.routeOptions.url` — the matched *route pattern* (e.g.
+ * `/repos/:id/manifest`) — rather than `req.url` (the raw request path). Fastify
+ * resolves routing before running `onRequest` hooks, so this is already populated
+ * here. Matching on the raw URL would be wrong: the web app's own client-side route
+ * for its repo detail page is also literally `/repos/:id` (react-router, not a server
+ * route) — a raw-URL prefix check would gate a browser hard-refresh on that page
+ * behind the API key even though no server API route matches it, when it should fall
+ * through to the SPA's `index.html` like any other unmatched path. */
+export declare function createAuthHook(store: RagStore, apiKey: string | undefined): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;

package/dist/auth.js

@@ -0,0 +1,40 @@
+const PUBLIC_PATHS = new Set(["/health"]);
+/** The only registered *route patterns* (not raw request URLs — see below) that
+ * actually serve data/trigger actions the API key is meant to protect. Everything
+ * else — `/health`, unmatched paths, and (phase 13) the built web app's static
+ * assets/SPA fallback when `repolore serve` is used — is public, the same way a
+ * compiled JS/CSS bundle on any public website is public: it's not sensitive, and
+ * gating it would break the web GUI from ever loading with no `Authorization` header
+ * to send on its very first request. */
+const PROTECTED_ROUTE_PREFIXES = ["/repos", "/settings"];
+/** Static bearer-token auth. `/health` and
+ * anything outside `PROTECTED_ROUTE_PREFIXES` are always open. `Settings.allowAnonymous`
+ * is checked per request (not cached at startup) so flipping it via `PUT /settings`
+ * takes effect immediately without a restart.
+ *
+ * Checked against `req.routeOptions.url` — the matched *route pattern* (e.g.
+ * `/repos/:id/manifest`) — rather than `req.url` (the raw request path). Fastify
+ * resolves routing before running `onRequest` hooks, so this is already populated
+ * here. Matching on the raw URL would be wrong: the web app's own client-side route
+ * for its repo detail page is also literally `/repos/:id` (react-router, not a server
+ * route) — a raw-URL prefix check would gate a browser hard-refresh on that page
+ * behind the API key even though no server API route matches it, when it should fall
+ * through to the SPA's `index.html` like any other unmatched path. */
+export function createAuthHook(store, apiKey) {
+    return async (req, reply) => {
+        if (PUBLIC_PATHS.has(req.url))
+            return;
+        const matchedRoute = req.routeOptions?.url;
+        if (!matchedRoute ||
+            !PROTECTED_ROUTE_PREFIXES.some((prefix) => matchedRoute.startsWith(prefix)))
+            return;
+        if ((await store.getSettings()).allowAnonymous)
+            return;
+        const header = req.headers.authorization;
+        const token = header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+        if (!apiKey || token !== apiKey) {
+            await reply.code(401).send({ error: "Unauthorized" });
+        }
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAGA,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1C;;;;;;wCAMwC;AACxC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAEzD;;;;;;;;;;;;sEAYsE;AACtE,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,MAA0B;IACxE,OAAO,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAiB,EAAE;QACvE,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACtC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC;QAC3C,IACE,CAAC,YAAY;YACb,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE3E,OAAO;QACT,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc;YAAE,OAAO;QAEvD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+/** Server-side config — deliberately separate from the CLI's client config:
+ * data directory, port, and the static API key live here; `mode`/`serverUrl`/
+ * `apiKey`-as-a-client-credential live in `@repolore/cli`.
+ *
+ * Cloud LLM provider API keys used to be plumbed through here too, but that was
+ * removed: `LocalRagStore` (which `buildServer` always constructs internally)
+ * resolves them itself via the shared `resolveProviderApiKey` from the
+ * dataDir-scoped secrets store + env vars, so there's nothing left for this config to
+ * carry — env vars still work exactly as before with zero code here. */
+export interface ServerConfig {
+    port: number;
+    dataDir: string;
+    apiKey?: string;
+}
+export declare function readServerConfig(env?: NodeJS.ProcessEnv): ServerConfig;

package/dist/config.js

@@ -0,0 +1,9 @@
+import { defaultDataDir } from "@repolore/core";
+export function readServerConfig(env = process.env) {
+    return {
+        port: Number(env.PORT ?? 3000),
+        dataDir: env.REPOLORE_DATA_DIR ?? defaultDataDir(),
+        apiKey: env.REPOLORE_API_KEY,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiBhD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,iBAAiB,IAAI,cAAc,EAAE;QAClD,MAAM,EAAE,GAAG,CAAC,gBAAgB;KAC7B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import { type FastifyInstance } from "fastify";
+import { type RagStore } from "@repolore/core";
+export { readServerConfig, type ServerConfig } from "./config.js";
+export interface BuildServerOptions {
+    /** Inject a `RagStore` directly — used by tests to swap in a fake or a
+     * `LocalRagStore` pointed at a temp dir with mocked embed/chat clients. Defaults
+     * to a real `LocalRagStore` over `dataDir` (or the default `~/.repolore`). */
+    store?: RagStore;
+    dataDir?: string;
+    apiKey?: string;
+    /** Absolute path to `web`'s built `dist/` directory. When set (phase 13's
+     * `repolore serve`), the server also serves the built web app as static files —
+     * every non-API GET falls through to `index.html` (client-side routing) so the
+     * SPA's own router handles the path. Left unset on every other boot path (plain
+     * `repolore serve` isn't invoked), so a normal `server` start never registers this
+     * plugin or pays its cost. */
+    staticDir?: string;
+}
+export declare function buildServer(opts?: BuildServerOptions): FastifyInstance;

package/dist/index.js

@@ -0,0 +1,53 @@
+import { pathToFileURL } from "node:url";
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import fastifyStatic from "@fastify/static";
+import { createRagStore, defaultDataDir, loadRepoEnv } from "@repolore/core";
+import { createAuthHook } from "./auth.js";
+import { readServerConfig } from "./config.js";
+import { registerChatRoutes } from "./routes/chat.js";
+import { registerReposRoutes } from "./routes/repos.js";
+import { registerSettingsRoutes } from "./routes/settings.js";
+export { readServerConfig } from "./config.js";
+export function buildServer(opts = {}) {
+    const dataDir = opts.dataDir ?? defaultDataDir();
+    const store = opts.store ?? createRagStore({ mode: "local", dataDir });
+    const app = Fastify();
+    // `web` (phase 8) runs on its own dev-server origin (Vite) and talks to this
+    // server cross-origin; the API key in the Authorization header is the real
+    // access control, so a permissive reflected origin is fine here.
+    void app.register(cors, { origin: true, methods: ["GET", "POST", "PUT", "DELETE"] });
+    app.addHook("onRequest", createAuthHook(store, opts.apiKey));
+    app.get("/health", async () => ({ status: "ok" }));
+    registerReposRoutes(app, store, { dataDir });
+    registerChatRoutes(app, store);
+    registerSettingsRoutes(app, store);
+    if (opts.staticDir) {
+        void app.register(fastifyStatic, { root: opts.staticDir });
+        // Client-side routing (react-router): any GET that didn't match an API route or
+        // an actual static asset falls through to `index.html`, letting the SPA's own
+        // router decide what to render. Non-GET requests (or a genuinely unknown API
+        // path) still get a plain 404 rather than HTML.
+        app.setNotFoundHandler((req, reply) => {
+            if (req.method !== "GET") {
+                void reply.code(404).send({ error: "Not found" });
+                return;
+            }
+            void reply.sendFile("index.html", opts.staticDir);
+        });
+    }
+    return app;
+}
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+    loadRepoEnv();
+    const config = readServerConfig();
+    const app = buildServer({ dataDir: config.dataDir, apiKey: config.apiKey });
+    app.listen({ port: config.port }, (err) => {
+        if (err) {
+            app.log.error(err);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAiB,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAqB,MAAM,aAAa,CAAC;AAkBlE,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErF,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,KAAK,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3D,gFAAgF;QAChF,8EAA8E;QAC9E,6EAA6E;QAC7E,gDAAgD;QAChD,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,KAAK,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,IAAI,MAAM,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;QACxC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/chat.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+import type { RagStore } from "@repolore/core";
+export declare function registerChatRoutes(app: FastifyInstance, store: RagStore): void;

package/dist/routes/chat.js

@@ -0,0 +1,8 @@
+import { streamSse } from "../sse.js";
+export function registerChatRoutes(app, store) {
+    app.post("/repos/:id/chat", async (req, reply) => {
+        const { message, history } = req.body;
+        await streamSse(reply, store.chat(req.params.id, message, history ?? []), "token");
+    });
+}
+//# sourceMappingURL=chat.js.map

package/dist/routes/chat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../src/routes/chat.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOtC,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,KAAe;IACtE,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACtC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/repos.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyInstance } from "fastify";
+import { type RagStore } from "@repolore/core";
+export interface ReposRouteOptions {
+    /** Server's data dir — used to scope temp clone dirs for git-URL indexing
+     * (phase 9), cleaned up after every attempt, success or failure. */
+    dataDir: string;
+}
+export declare function registerReposRoutes(app: FastifyInstance, store: RagStore, opts: ReposRouteOptions): void;

package/dist/routes/repos.js

@@ -0,0 +1,58 @@
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { cloneRepo, isGitUrl, } from "@repolore/core";
+import { streamSse } from "../sse.js";
+export function registerReposRoutes(app, store, opts) {
+    app.post("/repos", async (req, reply) => {
+        const { source, ...rest } = req.body;
+        await streamSse(reply, indexRepoWithGitCloneSupport(store, source, rest, opts.dataDir), "progress");
+    });
+    app.get("/repos", async () => store.listRepos());
+    app.get("/repos/:id/manifest", async (req, reply) => {
+        const repos = await store.listRepos();
+        const repo = repos.find((r) => r.id === req.params.id);
+        if (!repo) {
+            reply.code(404);
+            return { message: `Repo '${req.params.id}' is not indexed.` };
+        }
+        return {
+            fileHashes: repo.fileHashes,
+            isGit: repo.isGit,
+            lastIndexedCommit: repo.lastIndexedCommit,
+        };
+    });
+    app.delete("/repos/:id", async (req, reply) => {
+        await store.removeRepo(req.params.id);
+        reply.code(204);
+    });
+}
+/**
+ * Phase 9's server-side git-URL clone path: if `source` is a git URL, clones it into
+ * a scratch dir under the server's data dir (so it's not left in the OS temp dir
+ * indefinitely), then runs the normal indexing pipeline against the clone with
+ * `sourceId: source` so the repo's identity is stable across clones. The clone dir
+ * is always removed afterward, success or failure. Local-path `source`s (either
+ * indexed directly on this machine, or phase 9's client-streamed-content payload)
+ * pass through unchanged — this wrapper only ever branches on git-URL shape, never
+ * on local-vs-remote mode (that distinction is `RemoteRagStore`'s job, not this
+ * route's).
+ */
+async function* indexRepoWithGitCloneSupport(store, source, opts, dataDir) {
+    if (!isGitUrl(source)) {
+        yield* store.indexRepo(source, opts);
+        return;
+    }
+    const clonesRoot = join(dataDir, ".clones");
+    mkdirSync(clonesRoot, { recursive: true });
+    const cloneDir = mkdtempSync(join(clonesRoot, "clone-"));
+    yield { phase: "walk", filesProcessed: 0, totalFiles: 0, message: `cloning ${source}...` };
+    try {
+        await cloneRepo(source, cloneDir, { token: opts.deployToken });
+        const { deployToken: _deployToken, ...rest } = opts;
+        yield* store.indexRepo(cloneDir, { ...rest, sourceId: source });
+    }
+    finally {
+        rmSync(cloneDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=repos.js.map

package/dist/routes/repos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repos.js","sourceRoot":"","sources":["../../src/routes/repos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,SAAS,EACT,QAAQ,GAIT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAYtC,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,KAAe,EACf,IAAuB;IAEvB,GAAG,CAAC,IAAI,CAA6B,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACrC,MAAM,SAAS,CACb,KAAK,EACL,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAC/D,UAAU,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAA6B,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,CAAC;QAChE,CAAC;QACD,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAA6B,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxE,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,SAAS,CAAC,CAAC,4BAA4B,CAC1C,KAAe,EACf,MAAc,EACd,IAAkB,EAClB,OAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,MAAM,KAAK,EAAE,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACpD,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/routes/settings.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+import type { RagStore } from "@repolore/core";
+export declare function registerSettingsRoutes(app: FastifyInstance, store: RagStore): void;

package/dist/routes/settings.js

@@ -0,0 +1,8 @@
+export function registerSettingsRoutes(app, store) {
+    app.get("/settings", async () => store.getSettings());
+    app.put("/settings", async (req) => {
+        await store.updateSettings(req.body);
+        return store.getSettings();
+    });
+}
+//# sourceMappingURL=settings.js.map

package/dist/routes/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/routes/settings.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,KAAe;IAC1E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAEtD,GAAG,CAAC,GAAG,CAA8B,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sse.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyReply } from "fastify";
+/**
+ * Streams an `AsyncGenerator` over SSE: one `event: <eventName>` per yielded value,
+ * a terminal `event: done` on normal completion, or `event: error` (JSON
+ * `{ message }` payload) if the generator throws mid-stream. The error case matters
+ * because the HTTP status (200) and headers are already committed by the time
+ * streaming starts — a mid-stream failure has no other way to signal itself to the
+ * client than an in-band event, which is what `RemoteRagStore` looks for.
+ */
+export declare function streamSse<T>(reply: FastifyReply, source: AsyncGenerator<T>, eventName: string): Promise<void>;

package/dist/sse.js

@@ -0,0 +1,45 @@
+/**
+ * Streams an `AsyncGenerator` over SSE: one `event: <eventName>` per yielded value,
+ * a terminal `event: done` on normal completion, or `event: error` (JSON
+ * `{ message }` payload) if the generator throws mid-stream. The error case matters
+ * because the HTTP status (200) and headers are already committed by the time
+ * streaming starts — a mid-stream failure has no other way to signal itself to the
+ * client than an in-band event, which is what `RemoteRagStore` looks for.
+ */
+export async function streamSse(reply, source, eventName) {
+    // `@fastify/cors`'s hook runs before the route handler, so by this point it has
+    // already queued CORS response headers (Access-Control-Allow-Origin, etc.) onto
+    // `reply` — but `reply.hijack()` tells Fastify to stop managing the response
+    // entirely, so those headers are never written unless we copy them over ourselves.
+    // Without this, every SSE response (index/chat progress) is CORS-blocked in a real
+    // browser even though the preflight OPTIONS request (which isn't hijacked) succeeds.
+    const corsHeaders = reply.getHeaders();
+    reply.hijack();
+    const res = reply.raw;
+    for (const [key, value] of Object.entries(corsHeaders)) {
+        if (value !== undefined)
+            res.setHeader(key, value);
+    }
+    res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive",
+    });
+    try {
+        for await (const value of source) {
+            writeEvent(res, eventName, value);
+        }
+        writeEvent(res, "done", {});
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        writeEvent(res, "error", { message });
+    }
+    finally {
+        res.end();
+    }
+}
+function writeEvent(res, event, data) {
+    res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+}
+//# sourceMappingURL=sse.js.map

package/dist/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,MAAyB,EACzB,SAAiB;IAEjB,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,mFAAmF;IACnF,mFAAmF;IACnF,qFAAqF;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IACvC,KAAK,CAAC,MAAM,EAAE,CAAC;IACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB,EAAE,KAAa,EAAE,IAAa;IACnE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@repolore/server",
+  "version": "0.0.0",
+  "description": "HTTP/SSE API server for repolore — powers 'repolore serve' and remote/self-hosted indexing.",
+  "keywords": [
+    "repolore",
+    "rag",
+    "codebase",
+    "chat",
+    "server",
+    "fastify"
+  ],
+  "author": "aykutspohrdev",
+  "license": "MIT",
+  "homepage": "https://github.com/aykutspohrdev/repolore#readme",
+  "bugs": "https://github.com/aykutspohrdev/repolore/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aykutspohrdev/repolore.git",
+    "directory": "packages/server"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.js",
+    "!dist/**/*.test.js.map",
+    "!dist/**/*.test.d.ts"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@fastify/cors": "^11.3.0",
+    "@fastify/static": "^10.1.0",
+    "fastify": "^5.1.0",
+    "@repolore/core": "0.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.9.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.6.3",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "test": "vitest run",
+    "dev": "tsx src/index.ts"
+  }
+}