@sapiom/harness 0.1.5 → 0.2.0

package/dist/server/runs.js

@@ -1,40 +1,31 @@
 /**
- * Runs router — backs GET /api/runs/:executionId/{state,spend,transactions}.
+ * Runs router — backs GET /api/runs/:executionId/state.
  *
- * Returns a {@link RunView} (live status), {@link RunSpend} (per-step cost), or
- * per-call {@link RunCall}[] (cost drill-down) for a running or finished prod
- * agents execution, so the web canvas can poll live status, cost, and the
- * "why is this costly" breakdown. The Sapiom API key is held server-side and
- * never forwarded to the browser — the router fetches on behalf of the canvas
- * via {@link createRunStateFetcher}, {@link createRunSpendFetcher}, and
- * {@link createRunTransactionsFetcher}.
+ * Returns a {@link RunView} (live status) for a running or finished prod agents
+ * execution, so the web canvas can poll live status. The Sapiom API key is held
+ * server-side and never forwarded to the browser — the router fetches on behalf
+ * of the canvas via {@link createRunStateFetcher}.
  */
 import { Router } from "express";
 import { createRunStateFetcher } from "../core/run-state.js";
-import { createRunSpendFetcher } from "../core/run-spend.js";
-import { createRunTransactionsFetcher } from "../core/run-transactions.js";
+import { staticApiKeyProvider, } from "../core/api-key-provider.js";
 /**
- * Create the runs router. Mounts `GET /api/runs/:executionId/state` and
- * `GET /api/runs/:executionId/spend`, delegating to the respective fetchers
- * for each upstream call.
+ * Create the runs router. Mounts `GET /api/runs/:executionId/state`, delegating
+ * to the run-state fetcher for the upstream call.
  */
 export function createRunsRouter(opts) {
     const router = Router();
+    // Normalize to a provider so the live-status path always authenticates with
+    // the held API key and can refresh + retry when that key is rejected — a
+    // plain string|null becomes a no-op static provider (no refresh).
+    const provider = opts.apiKey !== null && typeof opts.apiKey === "object"
+        ? opts.apiKey
+        : staticApiKeyProvider(opts.apiKey);
     const stateFetcher = createRunStateFetcher({
-        apiKey: opts.apiKey,
+        apiKey: provider,
         baseUrl: opts.baseUrl,
         fetchImpl: opts.fetchImpl,
     });
-    const spendFetcher = createRunSpendFetcher({
-        apiKey: opts.apiKey,
-        baseUrl: opts.coreBaseUrl,
-        fetchImpl: opts.fetchImpl,
-    });
-    const transactionsFetcher = createRunTransactionsFetcher({
-        apiKey: opts.apiKey,
-        baseUrl: opts.coreBaseUrl,
-        fetchImpl: opts.fetchImpl,
-    });
     /**
      * GET /api/runs/:executionId/state
      *
@@ -63,62 +54,6 @@ export function createRunsRouter(opts) {
             res.status(result.status).json({ error: result.error });
         }
     });
-    /**
-     * GET /api/runs/:executionId/spend
-     *
-     * Returns a {@link RunSpend} for the given execution id, fetched from the
-     * core surface (api.sapiom.ai). Cost settles just after a run finishes, so
-     * the SPA polls this endpoint a few extra times after terminal state. The key
-     * stays server-side and never reaches the browser.
-     *
-     * 200  RunSpend JSON — spend found and decoded
-     * 400  executionId missing or empty
-     * 404  spend not found on the core surface
-     * 502  upstream error or decode failure
-     * 503  harness is not signed in to Sapiom
-     */
-    router.get("/api/runs/:executionId/spend", async (req, res) => {
-        const id = req.params.executionId;
-        if (!id || typeof id !== "string" || id.trim() === "") {
-            res.status(400).json({ error: "executionId is required" });
-            return;
-        }
-        const result = await spendFetcher.fetch(id);
-        if (result.ok) {
-            res.json(result.spend);
-        }
-        else {
-            res.status(result.status).json({ error: result.error });
-        }
-    });
-    /**
-     * GET /api/runs/:executionId/transactions
-     *
-     * Returns the per-call cost drill-down ({@link RunCall}[]) for the given
-     * execution — the individual billable capability calls behind each step's
-     * cost, so the canvas can answer "why is this step costly". Provider-agnostic
-     * (capability labels only) and key-safe (fetched server-side).
-     *
-     * 200  RunCall[] JSON — transactions found and mapped
-     * 400  executionId missing or empty
-     * 404  transactions not found on the core surface
-     * 502  upstream error or decode failure
-     * 503  harness is not signed in to Sapiom
-     */
-    router.get("/api/runs/:executionId/transactions", async (req, res) => {
-        const id = req.params.executionId;
-        if (!id || typeof id !== "string" || id.trim() === "") {
-            res.status(400).json({ error: "executionId is required" });
-            return;
-        }
-        const result = await transactionsFetcher.fetch(id);
-        if (result.ok) {
-            res.json(result.calls);
-        }
-        else {
-            res.status(result.status).json({ error: result.error });
-        }
-    });
     return router;
 }
 //# sourceMappingURL=runs.js.map

package/dist/server/runs.js.map

@@ -1 +1 @@
-{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/server/runs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAiB3E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,GAAG,CAAC,qCAAqC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/server/runs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAEL,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAqBrC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QACrD,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/static.d.ts

@@ -2,7 +2,21 @@
  * Serves the built Vite SPA from dist/web. Falls back to a placeholder page
  * when the web bundle hasn't been built yet (e.g. `pnpm dev` without a prior
  * `pnpm build:web`), so the server is still useful for API/WS-only testing.
+ *
+ * Boot-token injection: every HTML response has a `<script>` block baked in
+ * before `</head>` that sets `window.__HARNESS__ = { token: ${bootToken} }`.
+ * This lets `getBootToken()` (web/src/lib/api.ts) resolve the token without
+ * relying on the `?token=` query param — which is lost on navigation/reload
+ * and caused every /api POST to 401 after the first page load (SAP-1898).
+ *
+ * Implementation note: `express.static` serves index.html directly on `/`
+ * requests, bypassing any downstream handlers. To guarantee injection we:
+ *   1. Use `express.static` with `index: false` so it never auto-serves
+ *      index.html itself.
+ *   2. Add a catch-all `GET *` that serves the pre-injected HTML string for
+ *      any route that `express.static` didn't match (SPA deep-route fallback
+ *      AND the root `/`).
  */
 import { Router } from "express";
-export declare function createStaticRouter(webDir: string): Router;
+export declare function createStaticRouter(webDir: string, bootToken: string): Router;
 //# sourceMappingURL=static.d.ts.map

package/dist/server/static.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAgB,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAc1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgBzD"}
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAgB,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AA2CvE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B5E"}

package/dist/server/static.js

@@ -2,8 +2,22 @@
  * Serves the built Vite SPA from dist/web. Falls back to a placeholder page
  * when the web bundle hasn't been built yet (e.g. `pnpm dev` without a prior
  * `pnpm build:web`), so the server is still useful for API/WS-only testing.
+ *
+ * Boot-token injection: every HTML response has a `<script>` block baked in
+ * before `</head>` that sets `window.__HARNESS__ = { token: ${bootToken} }`.
+ * This lets `getBootToken()` (web/src/lib/api.ts) resolve the token without
+ * relying on the `?token=` query param — which is lost on navigation/reload
+ * and caused every /api POST to 401 after the first page load (SAP-1898).
+ *
+ * Implementation note: `express.static` serves index.html directly on `/`
+ * requests, bypassing any downstream handlers. To guarantee injection we:
+ *   1. Use `express.static` with `index: false` so it never auto-serves
+ *      index.html itself.
+ *   2. Add a catch-all `GET *` that serves the pre-injected HTML string for
+ *      any route that `express.static` didn't match (SPA deep-route fallback
+ *      AND the root `/`).
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import express, { Router } from "express";
 const PLACEHOLDER_HTML = `<!doctype html>
@@ -17,13 +31,49 @@ const PLACEHOLDER_HTML = `<!doctype html>
   </body>
 </html>
 `;
-export function createStaticRouter(webDir) {
+/**
+ * Builds the inline `<script>` that bakes the boot token into the page before
+ * any SPA JS runs. JSON.stringify ensures the token is safely escaped even if
+ * it contains characters that could break a bare string interpolation.
+ */
+function buildTokenScript(bootToken) {
+    const safeJson = JSON.stringify({ token: bootToken }).replace(/</g, "\\u003c");
+    return `<script>window.__HARNESS__ = ${safeJson};</script>`;
+}
+/**
+ * Injects the boot-token `<script>` block into raw HTML. The block is
+ * inserted immediately before `</head>` so it executes before any SPA modules
+ * load. Falls back to prepending to `<body>` if `</head>` is absent (shouldn't
+ * happen with our Vite output, but keeps the injection unconditional).
+ */
+function injectTokenScript(html, bootToken) {
+    const script = buildTokenScript(bootToken);
+    if (html.includes("</head>")) {
+        return html.replace("</head>", `${script}</head>`);
+    }
+    // Fallback: inject at the very start of <body> if </head> is missing.
+    if (html.includes("<body>")) {
+        return html.replace("<body>", `<body>${script}`);
+    }
+    // Last resort: prepend to the document.
+    return script + html;
+}
+export function createStaticRouter(webDir, bootToken) {
     const router = Router();
     const indexPath = join(webDir, "index.html");
     if (existsSync(indexPath)) {
-        router.use(express.static(webDir));
+        // Read index.html once at startup. The file doesn't change at runtime
+        // (it's a Vite build output), so a single read is fine and avoids
+        // repeated disk I/O for every page navigation request.
+        const rawHtml = readFileSync(indexPath, "utf-8");
+        const injectedHtml = injectTokenScript(rawHtml, bootToken);
+        // Serve hashed assets (JS, CSS, images) via express.static.
+        // `index: false` prevents express.static from auto-serving index.html
+        // on GET / — we handle that (and all SPA deep routes) in the catch-all
+        // below so every HTML response always carries the injected token script.
+        router.use(express.static(webDir, { index: false }));
         router.get("*", (_req, res) => {
-            res.sendFile(indexPath);
+            res.status(200).set("Content-Type", "text/html").send(injectedHtml);
         });
     }
     else {

package/dist/server/static.js.map

@@ -1 +1 @@
-{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,gBAAgB,GAAG;;;;;;;;;;CAUxB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAO,EAAE,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAEvE,MAAM,gBAAgB,GAAG;;;;;;;;;;CAUxB,CAAC;AAEF;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/E,OAAO,gCAAgC,QAAQ,YAAY,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,sEAAsE;IACtE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,wCAAwC;IACxC,OAAO,MAAM,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB;IAClE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,sEAAsE;QACtE,kEAAkE;QAClE,uDAAuD;QACvD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE3D,4DAA4D;QAC5D,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/templates.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Templates router — backs GET /api/templates and GET /api/templates/:id.
+ *
+ * Relays the Sapiom core gallery (the same catalog the dashboard's Template
+ * library renders) to the SPA. The API key is held server-side and never
+ * forwarded to the browser — the router fetches on the dialog's behalf via
+ * {@link createTemplateCatalog}, exactly as the runs router does for live run
+ * state. That is also why this can't be a direct browser fetch of core: the
+ * `sk_…` key would have to reach the page, and core sends no CORS headers for
+ * the harness's origin.
+ */
+import { Router } from "express";
+import { type ApiKeyProvider } from "../core/api-key-provider.js";
+export interface TemplatesRouterOpts {
+    /** The Sapiom API key (`sk_…`), NOT the local boot token. Pass a provider so a
+     *  rejected key can refresh + retry instead of locking the gallery. */
+    apiKey: string | null | ApiKeyProvider;
+    /** Override the core base URL (resolved from env by default). Test seam. */
+    baseUrl?: string;
+    /** Injectable fetch. Test seam. */
+    fetchImpl?: typeof fetch;
+}
+export declare function createTemplatesRouter(opts: TemplatesRouterOpts): Router;
+//# sourceMappingURL=templates.d.ts.map

package/dist/server/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/server/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC;2EACuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC;IACvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CA0CvE"}

package/dist/server/templates.js

@@ -0,0 +1,54 @@
+/**
+ * Templates router — backs GET /api/templates and GET /api/templates/:id.
+ *
+ * Relays the Sapiom core gallery (the same catalog the dashboard's Template
+ * library renders) to the SPA. The API key is held server-side and never
+ * forwarded to the browser — the router fetches on the dialog's behalf via
+ * {@link createTemplateCatalog}, exactly as the runs router does for live run
+ * state. That is also why this can't be a direct browser fetch of core: the
+ * `sk_…` key would have to reach the page, and core sends no CORS headers for
+ * the harness's origin.
+ */
+import { Router } from "express";
+import { createTemplateCatalog } from "../core/template-catalog.js";
+export function createTemplatesRouter(opts) {
+    const router = Router();
+    const catalog = createTemplateCatalog({
+        apiKey: opts.apiKey,
+        baseUrl: opts.baseUrl,
+        fetchImpl: opts.fetchImpl,
+    });
+    /**
+     * GET /api/templates
+     *
+     * 200 always — a `TemplateListResponse`. Deliberately never an error status:
+     * an unreachable or signed-out catalog is a degraded gallery (the bundled
+     * starters still work offline), not a failed request, and core's own endpoint
+     * makes the same choice. `source`/`reason` carry the degradation so the dialog
+     * can explain itself.
+     */
+    router.get("/api/templates", async (_req, res) => {
+        res.json(await catalog.list());
+    });
+    /**
+     * GET /api/templates/:id
+     *
+     * 200  TemplateDetailView
+     * 404  unknown id, or the catalog could not be reached
+     */
+    router.get("/api/templates/:id", async (req, res) => {
+        const id = req.params.id;
+        if (!id || id.trim() === "") {
+            res.status(400).json({ error: "template id is required" });
+            return;
+        }
+        const detail = await catalog.detail(id);
+        if (!detail) {
+            res.status(404).json({ error: `Template not found: ${id}` });
+            return;
+        }
+        res.json(detail);
+    });
+    return router;
+}
+//# sourceMappingURL=templates.js.map

package/dist/server/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/server/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAapE,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}