@sapiom/harness 0.1.5 → 0.1.6

package/dist/server/actions.js

@@ -0,0 +1,430 @@
+/**
+ * Actions router — backs the direct, in-app agent action macros:
+ *   POST /api/workflows/:id/deploy  → deploy the linked agent (build + poll).
+ *   POST /api/runs                  → start a prod execution → { executionId }.
+ *
+ * These are the "direct" replacements for the old CLI/agent-driven macros: the
+ * harness server calls the Sapiom backend itself (via {@link deploy} / {@link run}
+ * from @sapiom/agent-core), so an action never spawns a subprocess agent and never
+ * consumes the user's LLM credits. The Sapiom API key is held server-side and
+ * never forwarded to the browser — exactly like {@link createRunsRouter}: the
+ * SPA hits these local `/api/*` routes (no key in the request) and the router
+ * presents the key to the backend on its behalf.
+ *
+ * Deploy streams its build lifecycle as NDJSON (one JSON object per line, the
+ * same line-oriented convention the local-run stream uses) so the canvas can
+ * show "building…" the moment the build kicks off and a terminal line when it
+ * settles. Prod-run is a single request/response returning `{ executionId }`,
+ * which the existing live-canvas path then polls via the runs router.
+ *
+ * Run-local (`POST /api/runs/local`) is the offline sibling: it spawns the
+ * run-local bootstrap child, which runs the workflow in-process against stub
+ * capabilities and streams NDJSON back — one {@link LocalStepTrace} per line,
+ * then a terminal summary carrying `unusedStubs`/`stubWarnings`. It needs no
+ * API key and makes no network call, so it works signed-out and at zero cost.
+ */
+import { spawn as spawnChildProcess } from "node:child_process";
+import { createInterface } from "node:readline";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Router } from "express";
+import { AgentOperationError, createClient, deploy as coreDeploy, run as coreRun, readConfig as coreReadConfig, } from "@sapiom/agent-core";
+import { resolveCoreBaseUrl } from "../core/definition-slug-resolver.js";
+import { staticApiKeyProvider, } from "../core/api-key-provider.js";
+const DEFAULT_CORE_DEPS = {
+    createClient,
+    deploy: coreDeploy,
+    run: coreRun,
+    readConfig: coreReadConfig,
+};
+/**
+ * Resolve the compiled run-local bootstrap entry. This module lives at
+ * `dist/server/actions.js` (built) or `src/server/actions.ts` (tsx dev /
+ * vitest) — the bootstrap is its sibling one directory over in `core/`, with
+ * the same `.js`/`.ts` extension as this file. Reading the extension off
+ * `import.meta.url` (rather than hard-coding `.js`) keeps a real dev-server
+ * spawn resolvable too. Exported for unit coverage of the path math.
+ */
+export function resolveRunLocalBootstrapPath(moduleUrl) {
+    const here = fileURLToPath(moduleUrl);
+    const ext = here.endsWith(".ts") ? ".ts" : ".js";
+    return join(dirname(here), "..", "core", `run-local-bootstrap${ext}`);
+}
+/**
+ * The default spawn: `node <bootstrap>` with `cwd` set to this package's root
+ * so the bootstrap's `import "@sapiom/agent-core"` resolves against the
+ * harness's real dependency (same technique as canvas-manifest-check). A `.ts`
+ * bootstrap (dev only) is loaded through the `tsx` register hook; the built
+ * `.js` runs on bare node. stdin is piped so the route can write the request.
+ */
+function defaultRunLocalSpawn() {
+    const bootstrap = resolveRunLocalBootstrapPath(import.meta.url);
+    const nodeArgs = bootstrap.endsWith(".ts")
+        ? ["--import", "tsx", bootstrap]
+        : [bootstrap];
+    return spawnChildProcess(process.execPath, nodeArgs, {
+        cwd: join(dirname(fileURLToPath(import.meta.url)), "..", ".."),
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+}
+/** Bounded stderr tail kept per run-local child for failure display. */
+const RUN_LOCAL_STDERR_TAIL_CHARS = 2000;
+/**
+ * The run-local request body the SPA POSTs. `sourceDir` is required; the rest
+ * mirror {@link RunLocalRequest} and are forwarded to the bootstrap as-is.
+ */
+function parseRunLocalBody(body) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const b = body;
+    if (typeof b.sourceDir !== "string" || b.sourceDir.trim() === "")
+        return null;
+    return {
+        sourceDir: b.sourceDir,
+        input: b.input,
+        stubs: b.stubs,
+        maxAttemptsPerStep: typeof b.maxAttemptsPerStep === "number"
+            ? b.maxAttemptsPerStep
+            : undefined,
+    };
+}
+/**
+ * Extract the linked `definitionId` from a project's `sapiom.json`. The config
+ * file — not the registry — is the source of truth for a project's server-side
+ * definition id, so both deploy and (a future) resolve path read it here. Never
+ * throws: an unlinked/unreadable project returns null and the route maps that to
+ * a 409.
+ */
+function readDefinitionId(readConfig, projectDir) {
+    let config;
+    try {
+        config = readConfig(projectDir);
+    }
+    catch {
+        // BAD_CONFIG (unparseable sapiom.json) — treat as "not linked" for the route.
+        return null;
+    }
+    return config?.definitionId ?? null;
+}
+/**
+ * Map an {@link AgentOperationError} (or any thrown value) to a terminal deploy
+ * stream event. The hint is forwarded — it is safe to do so because git errors
+ * are redacted at source (credentials stripped before they reach the hint field),
+ * so no key material can reach the browser via this path.
+ */
+function toDeployErrorEvent(err) {
+    if (err instanceof AgentOperationError) {
+        return {
+            phase: "error",
+            code: err.code,
+            message: err.message,
+            ...(err.hint !== undefined ? { hint: err.hint } : {}),
+        };
+    }
+    return {
+        phase: "error",
+        code: "UNKNOWN",
+        message: err instanceof Error ? err.message : String(err),
+    };
+}
+/**
+ * Whether a thrown value is an upstream "the API key was rejected" — worth one
+ * refresh + retry before giving up. agent-core maps a 401/403 to an
+ * {@link AgentOperationError} with `code: "HTTP_401" | "HTTP_403"` (see
+ * client.ts), so we match on that code rather than an HTTP status here — the
+ * error-code analogue of run-state.ts's `isAuthRejection(status)`.
+ */
+function isAuthRejectionError(err) {
+    return (err instanceof AgentOperationError &&
+        (err.code === "HTTP_401" || err.code === "HTTP_403"));
+}
+/**
+ * Run a core operation with the current API key and, when it fails with an auth
+ * rejection, refresh the shared credential store once and retry with the newer
+ * key — the deploy/prod-run analogue of run-state.ts's refresh-on-401 recovery.
+ *
+ * `invoke` is handed a freshly-minted client for the key in force (the boot key
+ * on the first attempt, the refreshed key on the retry) so a rotated/re-logged-in
+ * credential recovers in place instead of every action locking on the stale key.
+ * Retries only when refresh actually yields a *different, non-null* key —
+ * otherwise the original error is re-thrown unchanged (no wasted call, and the
+ * caller's error mapping sees the real auth failure).
+ *
+ * The caller has already checked `provider.getKey()` is non-null, so `apiKey!`
+ * here is safe; a concurrent sign-out would surface as a normal auth error.
+ */
+async function withKeyRefreshRetry(provider, createClientFor, invoke) {
+    const apiKey = provider.getKey();
+    try {
+        return await invoke(createClientFor(apiKey));
+    }
+    catch (err) {
+        if (!isAuthRejectionError(err))
+            throw err;
+        const refreshed = await provider.refresh();
+        if (!refreshed || refreshed === apiKey)
+            throw err;
+        return invoke(createClientFor(refreshed));
+    }
+}
+/**
+ * Create the actions router. Mounts:
+ *   - `POST /api/workflows/:id/deploy` — NDJSON build-status stream.
+ *   - `POST /api/runs` — `{ executionId }` for a started prod execution.
+ *   - `POST /api/runs/local` — NDJSON offline stub-run trace + summary.
+ *
+ * Deploy and prod-run run server-side with the held API key; run-local is fully
+ * offline and needs no key. None of them ever involve an AI coding agent.
+ */
+export function createActionsRouter(opts) {
+    const router = Router();
+    const deps = { ...DEFAULT_CORE_DEPS, ...opts.coreDeps };
+    const baseUrl = opts.coreBaseUrl ?? resolveCoreBaseUrl();
+    const runLocalSpawn = opts.runLocalSpawn ?? defaultRunLocalSpawn;
+    // Normalize to a provider so deploy/prod-run always authenticate with the
+    // held API key and can refresh + retry when that key is rejected — a plain
+    // string|null becomes a no-op static provider (no refresh). Mirrors the runs
+    // router; keeps both action surfaces on the one credential contract.
+    const provider = opts.apiKey !== null && typeof opts.apiKey === "object"
+        ? opts.apiKey
+        : staticApiKeyProvider(opts.apiKey);
+    /** Mint a core client for a specific key against the resolved core host. */
+    const clientFor = (apiKey) => deps.createClient({ host: baseUrl, apiKey });
+    /**
+     * POST /api/workflows/:id/deploy
+     *
+     * Deploys the linked agent for the given workflow id: mints push credentials,
+     * pushes the synthesized tree, triggers a build, and polls to a terminal
+     * status — all inside @sapiom/agent-core's {@link deploy}. Streams NDJSON: a
+     * `building` line up front, then exactly one terminal `ready`/`error` line.
+     *
+     * 200  NDJSON stream (even a build failure is a 200 with a terminal `error`
+     *      line — the request itself succeeded; the build outcome is in-band).
+     * 400  id missing/empty
+     * 404  workflow id not registered
+     * 409  workflow is not linked to a Sapiom agent (no definitionId)
+     * 503  harness is not signed in to Sapiom
+     */
+    router.post("/api/workflows/:id/deploy", async (req, res) => {
+        const id = req.params.id;
+        if (!id || typeof id !== "string" || id.trim() === "") {
+            res.status(400).json({ error: "workflow id is required" });
+            return;
+        }
+        if (!provider.getKey()) {
+            res.status(503).json({ error: "harness is not signed in to Sapiom" });
+            return;
+        }
+        const workflow = opts.resolveWorkflow(id);
+        if (!workflow) {
+            res.status(404).json({ error: "workflow not found" });
+            return;
+        }
+        const definitionId = readDefinitionId(deps.readConfig, workflow.path);
+        if (!definitionId) {
+            res
+                .status(409)
+                .json({ error: "workflow is not linked to a Sapiom agent" });
+            return;
+        }
+        // From here the outcome is streamed in-band as NDJSON — status is 200 and
+        // headers are committed before the (potentially long) build runs.
+        res.status(200);
+        res.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+        res.setHeader("Cache-Control", "no-store");
+        const write = (event) => {
+            res.write(JSON.stringify(event) + "\n");
+        };
+        write({ phase: "building", definitionId });
+        try {
+            // Auth against the live key, refreshing + retrying once on a rejected key
+            // (same recovery the runs router gets). The building/terminal streaming
+            // shape is unchanged — the retry is transparent to the NDJSON stream.
+            const result = await withKeyRefreshRetry(provider, clientFor, (client) => deps.deploy({ projectDir: workflow.path, definitionId }, client));
+            write({
+                phase: "ready",
+                definitionId: result.definitionId,
+                buildRunId: result.buildRunId,
+                status: result.status,
+            });
+        }
+        catch (err) {
+            write(toDeployErrorEvent(err));
+        }
+        finally {
+            res.end();
+        }
+    });
+    /**
+     * POST /api/runs  { definitionId, input }
+     *
+     * Starts a prod execution of the given definition and returns
+     * `{ executionId }` — the live-canvas path then polls the runs router for its
+     * per-step state. `input` is optional (defaults to an empty object for
+     * no-input agents). The key stays server-side.
+     *
+     * 200  { executionId } — execution created
+     * 400  definitionId missing/empty
+     * 502  gateway error (network or non-2xx from the backend)
+     * 503  harness is not signed in to Sapiom
+     */
+    router.post("/api/runs", async (req, res) => {
+        if (!provider.getKey()) {
+            res.status(503).json({ error: "harness is not signed in to Sapiom" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const definitionId = body.definitionId;
+        if (typeof definitionId !== "string" || definitionId.trim() === "") {
+            res.status(400).json({ error: "definitionId is required" });
+            return;
+        }
+        try {
+            // Auth against the live key, refreshing + retrying once on a rejected key
+            // (same recovery the runs router gets), then return { executionId }.
+            const result = await withKeyRefreshRetry(provider, clientFor, (client) => deps.run({ definitionId, input: body.input }, client));
+            res.json({ executionId: result.executionId });
+        }
+        catch (err) {
+            if (err instanceof AgentOperationError) {
+                // The gateway/network failed — surface a 502 with the machine code, no
+                // credential hint (that hint names the login flow, not for the browser).
+                res.status(502).json({ error: err.message, code: err.code });
+            }
+            else {
+                res
+                    .status(502)
+                    .json({ error: err instanceof Error ? err.message : String(err) });
+            }
+        }
+    });
+    /**
+     * POST /api/runs/local  { sourceDir, input?, stubs?, maxAttemptsPerStep? }
+     *
+     * Runs the workflow at `sourceDir` entirely offline against stub
+     * capabilities, in a child process (the run-local bootstrap), and streams the
+     * result back as NDJSON: one {@link LocalStepTrace} per line, then a terminal
+     * summary line `{ kind: "summary", outcome, output, error, unusedStubs,
+     * stubWarnings }`. A run that could not be invoked at all (bad project, bad
+     * stub file) yields a terminal `{ kind: "error", outcome: "failed", error }`
+     * line instead. Needs no API key and makes no network call — zero cost.
+     *
+     * The child owns the wire shapes; this handler validates the request, pipes
+     * it to the child's stdin, forwards each stdout line unchanged, and (only if
+     * the child dies without a terminal line) synthesizes one from its stderr so
+     * the stream always ends well-formed.
+     *
+     * 200  NDJSON stream (a failed *run* is still a 200 — the request succeeded;
+     *      the outcome is in-band on the terminal line).
+     * 400  sourceDir missing/empty
+     */
+    router.post("/api/runs/local", (req, res) => {
+        const request = parseRunLocalBody(req.body);
+        if (!request) {
+            res.status(400).json({ error: "sourceDir is required" });
+            return;
+        }
+        let child;
+        try {
+            child = runLocalSpawn();
+        }
+        catch (err) {
+            // Never launched (e.g. the node binary or bootstrap is missing) — the
+            // request itself is fine, so answer in-band with a terminal error line.
+            res.status(200);
+            res.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            res.write(JSON.stringify({
+                kind: "error",
+                outcome: "failed",
+                error: err instanceof Error ? err.message : String(err),
+            }) + "\n");
+            res.end();
+            return;
+        }
+        // Headers are committed before the (potentially long) run streams.
+        res.status(200);
+        res.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+        res.setHeader("Cache-Control", "no-store");
+        // Hand the request to the child, then close its stdin so the bootstrap's
+        // read-to-EOF completes.
+        child.stdin?.end(JSON.stringify(request));
+        // Forward each well-formed JSON line straight through — the bootstrap emits
+        // exactly the wire shapes, so no re-shaping happens here. A line that isn't
+        // JSON is stray stdout noise (an esbuild banner, a dependency's console
+        // write) and is dropped rather than corrupting the NDJSON stream — the same
+        // "degrade, never throw" stance as core/task-stream.ts.
+        let sawTerminalLine = false;
+        const onLine = (line) => {
+            const trimmed = line.trim();
+            if (trimmed === "")
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(trimmed);
+            }
+            catch {
+                return; // non-JSON noise — not part of the contract.
+            }
+            // A `summary`/`error` line is terminal — track it so a crash after the
+            // summary isn't double-reported as a failure.
+            const kind = parsed.kind;
+            if (kind === "summary" || kind === "error")
+                sawTerminalLine = true;
+            res.write(trimmed + "\n");
+        };
+        // Keep a bounded stderr tail for the crash path (never forwarded inline —
+        // stderr is diagnostics, not part of the NDJSON contract).
+        let stderrTail = "";
+        child.stderr?.on("data", (chunk) => {
+            stderrTail = (stderrTail + String(chunk)).slice(-RUN_LOCAL_STDERR_TAIL_CHARS);
+        });
+        // End the response exactly once (mirrors task-manager's finish() guard).
+        // `crashReason` is captured from `exit`/`error` but the terminal decision is
+        // deferred to `settle()` so a still-buffered summary line is never clobbered.
+        let settled = false;
+        let crashReason = null;
+        const settle = () => {
+            if (settled)
+                return;
+            settled = true;
+            // Only synthesize a terminal line when the child produced none — otherwise
+            // the stream already ended well-formed with the bootstrap's own summary.
+            if (!sawTerminalLine) {
+                res.write(JSON.stringify({
+                    kind: "error",
+                    outcome: "failed",
+                    error: stderrTail.trim() || crashReason || "run-local produced no output",
+                }) + "\n");
+            }
+            res.end();
+        };
+        // Drive the terminal decision off stdout's close (readline "close" fires
+        // only after every line has been emitted), so a summary line buffered when
+        // `exit` arrives is still forwarded first. If there's no stdout at all, fall
+        // back to `exit`/`error` directly.
+        if (child.stdout) {
+            const lines = createInterface({ input: child.stdout });
+            lines.on("line", onLine);
+            lines.on("close", settle);
+            child.on("error", (err) => {
+                crashReason = err.message;
+            });
+            child.on("exit", (code) => {
+                crashReason ?? (crashReason = `run-local process exited with code ${code ?? "null"}`);
+            });
+        }
+        else {
+            child.on("error", (err) => {
+                crashReason = err.message;
+                settle();
+            });
+            child.on("exit", (code) => {
+                crashReason ?? (crashReason = `run-local process exited with code ${code ?? "null"}`);
+                settle();
+            });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=actions.js.map

package/dist/server/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,MAAM,IAAI,UAAU,EACpB,GAAG,IAAI,OAAO,EACd,UAAU,IAAI,cAAc,GAI7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAEL,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAmCrC,MAAM,iBAAiB,GAAoB;IACzC,YAAY;IACZ,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,OAAO;IACZ,UAAU,EAAE,cAAc;CAC3B,CAAC;AAsBF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC;QAChC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE;QACnD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,2BAA2B,GAAG,IAAK,CAAC;AAE1C;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAiC;QAC1C,kBAAkB,EAChB,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACtB,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAoCD;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,UAAiC,EACjC,UAAkB;IAElB,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAY;IAEZ,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO;YACL,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,OAAO,CACL,GAAG,YAAY,mBAAmB;QAClC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAChC,QAAwB,EACxB,eAAoE,EACpE,MAA+D;IAE/D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,MAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM;YAAE,MAAM,GAAG,CAAC;QAClD,OAAO,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,IAAI,GAAoB,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACjE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QACrD,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,MAAc,EAAmC,EAAE,CACpE,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACrE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAQ,EAAE;YAC/C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,MAAM,GAAiB,MAAM,mBAAmB,CACpD,QAAQ,EACR,SAAS,EACT,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CACnE,CAAC;YACF,KAAK,CAAC;gBACJ,KAAK,EAAE,OAAO;gBACd,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAG3B,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,MAAM,GAAc,MAAM,mBAAmB,CACjD,QAAQ,EACR,SAAS,EACT,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAClE,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,uEAAuE;gBACvE,yEAAyE;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,KAA2B,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,aAAa,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,wEAAwE;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,KAAK,CACP,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,GAAG,IAAI,CACV,CAAC;YACF,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACrE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,yEAAyE;QACzE,yBAAyB;QACzB,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAE1C,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,wDAAwD;QACxD,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,EAAE;gBAAE,OAAO;YAC3B,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,6CAA6C;YACvD,CAAC;YACD,uEAAuE;YACvE,8CAA8C;YAC9C,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;gBAAE,eAAe,GAAG,IAAI,CAAC;YACnE,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,UAAU,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAC7C,CAAC,2BAA2B,CAC7B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,GAAG,CAAC,KAAK,CACP,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ;oBACjB,KAAK,EACH,UAAU,CAAC,IAAI,EAAE,IAAI,WAAW,IAAI,8BAA8B;iBACrE,CAAC,GAAG,IAAI,CACV,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,mCAAmC;QACnC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,WAAW,KAAX,WAAW,GAAK,sCAAsC,IAAI,IAAI,MAAM,EAAE,EAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC1B,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,WAAW,KAAX,WAAW,GAAK,sCAAsC,IAAI,IAAI,MAAM,EAAE,EAAC;gBACvE,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/auth-routes.d.ts

@@ -0,0 +1,92 @@
+/**
+ * In-app auth routes — expose the CLI's browser OAuth flow over HTTP so the
+ * Studio web app can trigger sign-in/sign-out without restarting the server.
+ *
+ * Reuses `performBrowserAuth` from `@sapiom/mcp/auth` (the SAME function the
+ * CLI's `ensureAuthenticated` calls at boot) — no custom OAuth implementation,
+ * no changes to any Sapiom cloud endpoint. The flow:
+ *
+ *   POST /api/auth/start
+ *     ↳ performBrowserAuth(appURL, apiURL)    ← existing CLI flow, unchanged
+ *         opens browser → localhost callback → token exchange
+ *     ↳ writeCredentials(...)                 ← writes ~/.sapiom/credentials.json
+ *     ↳ apiKeyProvider.refresh()              ← adopts the new key in-process
+ *     ↳ bus.publish({ type: "auth.changed" }) ← notifies open WS connections
+ *
+ *   POST /api/auth/disconnect
+ *     ↳ clearCredentials(...)
+ *     ↳ provider.clear()
+ *     ↳ bus.publish({ type: "auth.changed", authenticated: false })
+ *
+ *   GET /api/auth/status
+ *     ↳ { authenticated, organizationName }
+ *
+ * All three routes sit behind the existing `X-Harness-Token` middleware applied
+ * at the /api level in server/index.ts — no extra auth layer needed here.
+ */
+import { Router } from "express";
+import { performBrowserAuth } from "@sapiom/mcp/auth";
+import type { EventBus } from "../core/event-bus.js";
+export interface AuthState {
+    authenticated: boolean;
+    organizationName: string | null;
+}
+/**
+ * A mutable holder for the harness's current auth identity — updated on
+ * sign-in/sign-out and queried by `GET /api/auth/status`. Shared between the
+ * auth router and any other consumer (e.g. `GET /api/state` in rest.ts) that
+ * wants live auth state rather than the boot-time snapshot.
+ */
+export interface MutableAuthState {
+    get(): AuthState;
+    set(state: AuthState): void;
+}
+export declare function createMutableAuthState(initial: AuthState): MutableAuthState;
+/**
+ * The minimal slice of {@link ApiKeyProvider} the auth router needs: a way
+ * to push a new key in after a successful browser auth (or clear it on
+ * disconnect), without importing the full provider shape.
+ */
+export interface AuthKeyTarget {
+    /**
+     * Re-reads `~/.sapiom/credentials.json` and adopts the key found there.
+     * Called after `performBrowserAuth` + `writeCredentials` complete so the
+     * provider's in-memory key matches the freshly written credential.
+     */
+    refresh(): Promise<string | null>;
+    /**
+     * Unconditionally zero the in-memory key (sets it to null). Called on
+     * disconnect so that the provider returns null immediately — distinct from
+     * {@link refresh}, whose guard deliberately keeps the cached key when the
+     * store has nothing to offer.
+     */
+    clear(): void;
+}
+export interface AuthRoutesOptions {
+    /** Mutable auth state shared with `GET /api/state` and `GET /api/auth/status`. */
+    authState: MutableAuthState;
+    /**
+     * The live API key provider — `refresh()` is called after sign-in writes
+     * `~/.sapiom/credentials.json` so the in-process key adopts the new value.
+     */
+    apiKeyProvider: AuthKeyTarget;
+    /** The server event bus — broadcasts `auth.changed` after every state transition. */
+    bus: EventBus;
+    /**
+     * Overrides SAPIOM_ENVIRONMENT for the OAuth flow. Defaults to
+     * `process.env.SAPIOM_ENVIRONMENT` (the same override the CLI uses).
+     */
+    environment?: string;
+    /**
+     * Injectable seam for `performBrowserAuth` — lets tests mock the full OAuth
+     * round-trip without opening a real browser or binding a local port.
+     */
+    performBrowserAuthImpl?: typeof performBrowserAuth;
+}
+/**
+ * Mount the in-app auth routes. The caller is responsible for gating these
+ * behind the boot-token middleware (applied at the /api level in
+ * server/index.ts before any router) — these routes do NOT add a second layer.
+ */
+export declare function createAuthRouter(opts: AuthRoutesOptions): Router;
+//# sourceMappingURL=auth-routes.d.ts.map

package/dist/server/auth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../../src/server/auth-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAEL,kBAAkB,EAGnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAMrD,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,IAAI,SAAS,CAAC;IACjB,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,GAAG,gBAAgB,CAQ3E;AAMD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAClC;;;;;OAKG;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AAMD,MAAM,WAAW,iBAAiB;IAChC,kFAAkF;IAClF,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,cAAc,EAAE,aAAa,CAAC;IAC9B,qFAAqF;IACrF,GAAG,EAAE,QAAQ,CAAC;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAuIhE"}