@squadrules/mcp 4.8.6

package/dist/http/http-api-train-json.js

@@ -0,0 +1,153 @@
+import { kairosTrainSimilarAdapterFound } from '../services/metrics/mcp-metrics.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+import { TrainError } from '../tools/train-store.js';
+import { executeTrain } from '../tools/train.js';
+import { trainInputSchema } from '../tools/train_schema.js';
+import { buildAdapterUri } from '../tools/kairos-uri.js';
+import { KAIROS_CREATION_PROTOCOL_SLUG } from '../constants/builtin-search-meta.js';
+import { KairosError } from '../types/index.js';
+import { getSpaceContext, runWithSpaceContextAsync } from '../utils/tenant-context.js';
+import { listWritableSpaceDisplayNames, resolveSpaceParamForContext } from '../utils/resolve-space-param.js';
+const SAFE_TRAIN_DETAIL_KEYS = new Set([
+    'missing',
+    'must_obey',
+    'next_action',
+    'existing_memory',
+    'similarity_score',
+    'content_preview',
+    'slug',
+    'adapter_id',
+    'sample_uri',
+    'base_slug',
+    'message'
+]);
+function sanitizeTrainDetails(details) {
+    const output = {};
+    if (!details)
+        return output;
+    for (const [key, value] of Object.entries(details)) {
+        if (!SAFE_TRAIN_DETAIL_KEYS.has(key))
+            continue;
+        output[key] = value;
+    }
+    return output;
+}
+function creationAdapterUri() {
+    return buildAdapterUri(KAIROS_CREATION_PROTOCOL_SLUG);
+}
+/**
+ * JSON body train (space, source_adapter_uri, etc.). Raw markdown remains POST /api/train/raw.
+ */
+export function setupTrainJsonRoute(app, memoryStore, qdrantService) {
+    app.post('/api/train', async (req, res) => {
+        try {
+            const parsed = trainInputSchema.safeParse(req.body);
+            if (!parsed.success) {
+                const first = parsed.error.flatten().fieldErrors;
+                const msg = Object.keys(first).length
+                    ? Object.entries(first)
+                        .map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(', ') : v}`)
+                        .join('; ')
+                    : parsed.error.message;
+                res.status(400).json({ error: 'INVALID_INPUT', message: msg });
+                return;
+            }
+            structuredLogger.info(`→ POST /api/train (json, model: ${parsed.data.llm_model_id}, force: ${parsed.data.force_update ?? false})`);
+            const ctx = getSpaceContext(req);
+            const rawSpace = typeof parsed.data.space === 'string' ? parsed.data.space.trim() : '';
+            const spaceParam = rawSpace.toLowerCase();
+            let resolvedSpaceId;
+            if (parsed.data.space === undefined || rawSpace === '') {
+                resolvedSpaceId = ctx.defaultWriteSpaceId || ctx.allowedSpaceIds[0] || '';
+            }
+            else if (spaceParam === 'personal') {
+                const r = resolveSpaceParamForContext(ctx, rawSpace);
+                if (!r.ok) {
+                    res.status(400).json({
+                        error: 'SPACE_NOT_FOUND',
+                        message: r.message,
+                        available_spaces: listWritableSpaceDisplayNames(ctx)
+                    });
+                    return;
+                }
+                resolvedSpaceId = r.spaceId;
+            }
+            else {
+                const r = resolveSpaceParamForContext(ctx, rawSpace);
+                if (!r.ok) {
+                    const errKey = r.code === 'SPACE_READ_ONLY' ? 'SPACE_READ_ONLY' : 'SPACE_NOT_FOUND';
+                    res.status(400).json({
+                        error: errKey,
+                        message: r.message,
+                        available_spaces: listWritableSpaceDisplayNames(ctx)
+                    });
+                    return;
+                }
+                resolvedSpaceId = r.spaceId;
+            }
+            // Keep full allowedSpaceIds so source_adapter_uri / slug lookups see group adapters while
+            // defaultWriteSpaceId scopes new points to the requested target space.
+            const narrowedContext = {
+                ...ctx,
+                defaultWriteSpaceId: resolvedSpaceId
+            };
+            const result = await runWithSpaceContextAsync(narrowedContext, () => executeTrain(memoryStore, parsed.data, (fn) => fn(), qdrantService));
+            res.status(200).json(result);
+        }
+        catch (error) {
+            const err = error;
+            if (error instanceof TrainError) {
+                res.status(400).json({
+                    error: error.code,
+                    message: error.message.replaceAll('Protocol', 'Adapter').replaceAll('protocol', 'adapter'),
+                    ...sanitizeTrainDetails(error.details),
+                    next_action: `call forward with ${creationAdapterUri()} to open the guided adapter creation flow`
+                });
+                return;
+            }
+            if (error instanceof KairosError) {
+                const status = error.statusCode >= 400 && error.statusCode < 600 ? error.statusCode : 500;
+                structuredLogger.warn(`✗ Train JSON KairosError ${error.code}: ${error.message}`);
+                res.status(status).json({
+                    error: error.code,
+                    message: error.message,
+                    ...sanitizeTrainDetails(error.details)
+                });
+                return;
+            }
+            if (err?.code === 'DUPLICATE_ADAPTER' || err?.code === 'DUPLICATE_KEY') {
+                structuredLogger.warn(`✗ Duplicate adapter: ${err.message}`);
+                res.status(409).json({
+                    error: 'DUPLICATE_ADAPTER',
+                    message: 'Adapter with this label already exists. Use force_update: true to overwrite.',
+                    ...sanitizeTrainDetails(err.details)
+                });
+                return;
+            }
+            if (err?.code === 'SIMILAR_MEMORY_FOUND') {
+                kairosTrainSimilarAdapterFound.inc({ transport: 'http', tenant_id: 'http' });
+                structuredLogger.warn(`✗ Similar memory found: ${err.message}`);
+                const d = err.details || {};
+                res.status(409).json({
+                    error: 'SIMILAR_MEMORY_FOUND',
+                    existing_memory: d['existing_memory'],
+                    similarity_score: d['similarity_score'],
+                    message: d['message'] ??
+                        'A very similar memory already exists by title. Verify it before overwriting.',
+                    must_obey: d['must_obey'] ?? true,
+                    next_action: d['next_action'],
+                    ...(d['content_preview'] !== undefined && {
+                        content_preview: d['content_preview']
+                    })
+                });
+                return;
+            }
+            structuredLogger.error('✗ Train JSON failed', error);
+            res.status(500).json({
+                error: 'STORE_FAILED',
+                message: 'Failed to store adapter markdown'
+            });
+        }
+    });
+}
+//# sourceMappingURL=http-api-train-json.js.map

package/dist/http/http-api-train-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-train-json.js","sourceRoot":"","sources":["../../src/http/http-api-train-json.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE7G,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,SAAS;IACT,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,eAAe,CAAC,6BAA6B,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,WAA8B,EAC9B,aAA6B;IAE7B,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;oBACnC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;yBAClB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC/D,IAAI,CAAC,IAAI,CAAC;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YAED,gBAAgB,CAAC,IAAI,CACnB,mCAAmC,MAAM,CAAC,IAAI,CAAC,YAAY,YAAY,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,CAC5G,CAAC;YACF,MAAM,GAAG,GAAG,eAAe,CAAC,GAAmD,CAAC,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,eAAuB,CAAC;YAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACvD,eAAe,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5E,CAAC;iBAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,2BAA2B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,CAAC;qBACrD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,2BAA2B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;oBACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,CAAC;qBACrD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC;YAC9B,CAAC;YACD,0FAA0F;YAC1F,uEAAuE;YACvE,MAAM,eAAe,GAAG;gBACtB,GAAG,GAAG;gBACN,mBAAmB,EAAE,eAAe;aACrC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,EAAE,CAClE,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CACpE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAOX,CAAC;YACF,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC;oBAC1F,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;oBACtC,WAAW,EAAE,qBAAqB,kBAAkB,EAAE,2CAA2C;iBAClG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GACV,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC7E,gBAAgB,CAAC,IAAI,CAAC,4BAA4B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAA8C,CAAC;iBAC9E,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,KAAK,mBAAmB,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;gBACvE,gBAAgB,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,8EAA8E;oBACvF,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACzC,8BAA8B,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,sBAAsB;oBAC7B,eAAe,EAAG,CAA6B,CAAC,iBAAiB,CAAC;oBAClE,gBAAgB,EAAG,CAA6B,CAAC,kBAAkB,CAAC;oBACpE,OAAO,EACJ,CAA6B,CAAC,SAAS,CAAC;wBACzC,8EAA8E;oBAChF,SAAS,EAAG,CAA6B,CAAC,WAAW,CAAC,IAAI,IAAI;oBAC9D,WAAW,EAAG,CAA6B,CAAC,aAAa,CAAC;oBAC1D,GAAG,CAAE,CAA6B,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI;wBACrE,eAAe,EAAG,CAA6B,CAAC,iBAAiB,CAAC;qBACnE,CAAC;iBACH,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/http-api-train-raw.d.ts

@@ -0,0 +1,8 @@
+import express from 'express';
+import { MemoryQdrantStore } from '../services/memory/store.js';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * POST /api/train/raw — raw markdown body; builds {@link TrainInput} from body + query/headers.
+ */
+export declare function setupTrainRawRoute(app: express.Express, memoryStore: MemoryQdrantStore, qdrantService?: QdrantService): void;
+//# sourceMappingURL=http-api-train-raw.d.ts.map

package/dist/http/http-api-train-raw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-train-raw.d.ts","sourceRoot":"","sources":["../../src/http/http-api-train-raw.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAwCnE;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,WAAW,EAAE,iBAAiB,EAC9B,aAAa,CAAC,EAAE,aAAa,QAmK9B"}

package/dist/http/http-api-train-raw.js

@@ -0,0 +1,199 @@
+import getRawBody from 'raw-body';
+import { kairosTrainSimilarAdapterFound } from '../services/metrics/mcp-metrics.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+import { TrainError } from '../tools/train-store.js';
+import { executeTrain } from '../tools/train.js';
+import { trainInputSchema } from '../tools/train_schema.js';
+import { HTTP_TRAIN_RAW_BODY_LIMIT } from '../config.js';
+import { buildAdapterUri } from '../tools/kairos-uri.js';
+import { KAIROS_CREATION_PROTOCOL_SLUG } from '../constants/builtin-search-meta.js';
+import { KairosError } from '../types/index.js';
+import { getSpaceContext, runWithSpaceContextAsync } from '../utils/tenant-context.js';
+import { listWritableSpaceDisplayNames, resolveSpaceParamForContext } from '../utils/resolve-space-param.js';
+const SAFE_TRAIN_RAW_DETAIL_KEYS = new Set([
+    'missing',
+    'must_obey',
+    'next_action',
+    'existing_memory',
+    'similarity_score',
+    'content_preview',
+    'slug',
+    'adapter_id',
+    'sample_uri',
+    'base_slug',
+    'message'
+]);
+function sanitizeTrainRawDetails(details) {
+    if (!details)
+        return {};
+    const output = {};
+    for (const [key, value] of Object.entries(details)) {
+        if (!SAFE_TRAIN_RAW_DETAIL_KEYS.has(key))
+            continue;
+        output[key] = value;
+    }
+    return output;
+}
+function creationAdapterUri() {
+    return buildAdapterUri(KAIROS_CREATION_PROTOCOL_SLUG);
+}
+/**
+ * POST /api/train/raw — raw markdown body; builds {@link TrainInput} from body + query/headers.
+ */
+export function setupTrainRawRoute(app, memoryStore, qdrantService) {
+    app.post('/api/train/raw', async (req, res) => {
+        try {
+            const contentLength = req.headers['content-length'] ? parseInt(req.headers['content-length'], 10) : null;
+            const rawBody = await getRawBody(req, {
+                limit: HTTP_TRAIN_RAW_BODY_LIMIT,
+                encoding: 'utf8',
+                ...(contentLength !== null && { length: contentLength })
+            });
+            const markdown = String(rawBody).trim();
+            if (!markdown) {
+                res.status(400).json({ error: 'INVALID_INPUT', message: 'Empty markdown content' });
+                return;
+            }
+            const llm_model_id = req.query['llm_model_id'] ||
+                req.headers['x-llm-model-id'] ||
+                req.headers['user-agent'] ||
+                'http-api';
+            const force_update = req.query['force'] === 'true' || req.headers['x-force-update'] === 'true';
+            const protocol_version = req.query['protocol_version'] || req.headers['x-protocol-version'] || undefined;
+            const space = req.query['space'] ||
+                req.headers['x-space'] ||
+                undefined;
+            // review_evidence can be passed as JSON query param or header (raw markdown body has no field for it)
+            const reviewEvidenceRaw = req.query['review_evidence'] ||
+                req.headers['x-review-evidence'] ||
+                undefined;
+            let reviewEvidence;
+            if (reviewEvidenceRaw) {
+                try {
+                    const parsed_ = JSON.parse(reviewEvidenceRaw);
+                    if (parsed_ && typeof parsed_.verdict_file === 'string' && typeof parsed_.exit_code === 'number' && typeof parsed_.stdout === 'string') {
+                        reviewEvidence = parsed_;
+                    }
+                }
+                catch { /* ignore malformed review_evidence */ }
+            }
+            const bodyInput = {
+                content: markdown,
+                llm_model_id,
+                force_update,
+                ...(protocol_version && { protocol_version }),
+                ...(space ? { space } : {}),
+                ...(reviewEvidence ? { review_evidence: reviewEvidence } : {})
+            };
+            const parsed = trainInputSchema.safeParse(bodyInput);
+            if (!parsed.success) {
+                const first = parsed.error.flatten().fieldErrors;
+                const msg = Object.keys(first).length
+                    ? Object.entries(first)
+                        .map(([k, v]) => `${k}: ${Array.isArray(v) ? v.join(', ') : v}`)
+                        .join('; ')
+                    : parsed.error.message;
+                res.status(400).json({ error: 'INVALID_INPUT', message: msg });
+                return;
+            }
+            structuredLogger.info(`→ POST /api/train/raw (${markdown.length} bytes, model: ${parsed.data.llm_model_id}, force: ${parsed.data.force_update})`);
+            const ctx = getSpaceContext(req);
+            const rawSpace = typeof parsed.data.space === 'string' ? parsed.data.space.trim() : '';
+            const spaceParam = rawSpace.toLowerCase();
+            let resolvedSpaceId;
+            if (parsed.data.space === undefined || rawSpace === '') {
+                resolvedSpaceId = ctx.defaultWriteSpaceId || ctx.allowedSpaceIds[0] || '';
+            }
+            else if (spaceParam === 'personal') {
+                const r = resolveSpaceParamForContext(ctx, rawSpace);
+                if (!r.ok) {
+                    res.status(400).json({
+                        error: 'SPACE_NOT_FOUND',
+                        message: r.message,
+                        available_spaces: listWritableSpaceDisplayNames(ctx)
+                    });
+                    return;
+                }
+                resolvedSpaceId = r.spaceId;
+            }
+            else {
+                const r = resolveSpaceParamForContext(ctx, rawSpace);
+                if (!r.ok) {
+                    const errKey = r.code === 'SPACE_READ_ONLY' ? 'SPACE_READ_ONLY' : 'SPACE_NOT_FOUND';
+                    res.status(400).json({
+                        error: errKey,
+                        message: r.message,
+                        available_spaces: listWritableSpaceDisplayNames(ctx)
+                    });
+                    return;
+                }
+                resolvedSpaceId = r.spaceId;
+            }
+            const narrowedContext = {
+                ...ctx,
+                defaultWriteSpaceId: resolvedSpaceId
+            };
+            const result = await runWithSpaceContextAsync(narrowedContext, () => executeTrain(memoryStore, parsed.data, (fn) => fn(), qdrantService));
+            res.status(200).json(result);
+        }
+        catch (error) {
+            const err = error;
+            if (err?.status === 413 || err?.statusCode === 413 || err?.type === 'entity.too.large') {
+                res.status(413).json({
+                    error: 'PAYLOAD_TOO_LARGE',
+                    message: 'Request body exceeds the configured size limit'
+                });
+                return;
+            }
+            if (error instanceof TrainError) {
+                res.status(400).json({
+                    error: error.code,
+                    message: error.message.replaceAll('Protocol', 'Adapter').replaceAll('protocol', 'adapter'),
+                    ...sanitizeTrainRawDetails(error.details),
+                    next_action: `call forward with ${creationAdapterUri()} to open the guided adapter creation flow`
+                });
+                return;
+            }
+            if (error instanceof KairosError) {
+                const status = error.statusCode >= 400 && error.statusCode < 600 ? error.statusCode : 500;
+                structuredLogger.warn(`✗ Train raw KairosError ${error.code}: ${error.message}`);
+                res.status(status).json({
+                    error: error.code,
+                    message: error.message,
+                    ...sanitizeTrainRawDetails(error.details)
+                });
+                return;
+            }
+            if (err?.code === 'DUPLICATE_ADAPTER' || err?.code === 'DUPLICATE_KEY') {
+                structuredLogger.warn(`✗ Duplicate adapter: ${err.message}`);
+                res.status(409).json({
+                    error: 'DUPLICATE_ADAPTER',
+                    message: 'Adapter with this label already exists. Use --force flag to overwrite.',
+                    ...sanitizeTrainRawDetails(err.details)
+                });
+                return;
+            }
+            if (err?.code === 'SIMILAR_MEMORY_FOUND') {
+                kairosTrainSimilarAdapterFound.inc({ transport: 'http', tenant_id: 'http' });
+                structuredLogger.warn(`✗ Similar memory found: ${err.message}`);
+                const d = err.details || {};
+                res.status(409).json({
+                    error: 'SIMILAR_MEMORY_FOUND',
+                    existing_memory: d.existing_memory,
+                    similarity_score: d.similarity_score,
+                    message: d.message ?? 'A very similar memory already exists by title. Verify it before overwriting.',
+                    must_obey: d.must_obey ?? true,
+                    next_action: d.next_action,
+                    ...(d.content_preview !== undefined && { content_preview: d.content_preview })
+                });
+                return;
+            }
+            structuredLogger.error('✗ Store failed', error);
+            res.status(500).json({
+                error: 'STORE_FAILED',
+                message: 'Failed to store adapter content'
+            });
+        }
+    });
+}
+//# sourceMappingURL=http-api-train-raw.js.map

package/dist/http/http-api-train-raw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-train-raw.js","sourceRoot":"","sources":["../../src/http/http-api-train-raw.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAE7G,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,SAAS;IACT,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,uBAAuB,CAAC,OAAiC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,eAAe,CAAC,6BAA6B,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,WAA8B,EAC9B,aAA6B;IAE7B,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzG,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;gBACpC,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,MAAM;gBAChB,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GACf,GAAG,CAAC,KAAK,CAAC,cAAc,CAAY;gBACpC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAY;gBACzC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;gBACzB,UAAU,CAAC;YACb,MAAM,YAAY,GAChB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;YAC5E,MAAM,gBAAgB,GAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAY,IAAK,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAY,IAAI,SAAS,CAAC;YACjI,MAAM,KAAK,GACR,GAAG,CAAC,KAAK,CAAC,OAAO,CAAY;gBAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAY;gBAClC,SAAS,CAAC;YAEZ,sGAAsG;YACtG,MAAM,iBAAiB,GACpB,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAY;gBACvC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY;gBAC5C,SAAS,CAAC;YACZ,IAAI,cAAuF,CAAC;YAC5F,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC9C,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACvI,cAAc,GAAG,OAAO,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,SAAS,GAAG;gBAChB,OAAO,EAAE,QAAQ;gBACjB,YAAY;gBACZ,YAAY;gBACZ,GAAG,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,CAAC;gBAC7C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;YACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;oBACnC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;yBAClB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC/D,IAAI,CAAC,IAAI,CAAC;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YAED,gBAAgB,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,MAAM,kBAAkB,MAAM,CAAC,IAAI,CAAC,YAAY,YAAY,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAClJ,MAAM,GAAG,GAAG,eAAe,CAAC,GAAmD,CAAC,CAAC;YACjF,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,eAAuB,CAAC;YAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACvD,eAAe,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5E,CAAC;iBAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,2BAA2B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,CAAC;qBACrD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,2BAA2B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;oBACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,gBAAgB,EAAE,6BAA6B,CAAC,GAAG,CAAC;qBACrD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC;YAC9B,CAAC;YACD,MAAM,eAAe,GAAG;gBACtB,GAAG,GAAG;gBACN,mBAAmB,EAAE,eAAe;aACrC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,EAAE,CAClE,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,CACpE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAoI,CAAC;YACjJ,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,UAAU,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,gDAAgD;iBAC1D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC;oBAC1F,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;oBACzC,WAAW,EAAE,qBAAqB,kBAAkB,EAAE,2CAA2C;iBAClG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,MAAM,MAAM,GACV,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC7E,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAA8C,CAAC;iBACjF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,KAAK,mBAAmB,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;gBACvE,gBAAgB,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,wEAAwE;oBACjF,GAAG,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACxC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACzC,8BAA8B,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,sBAAsB;oBAC7B,eAAe,EAAG,CAAS,CAAC,eAAe;oBAC3C,gBAAgB,EAAG,CAAS,CAAC,gBAAgB;oBAC7C,OAAO,EAAG,CAAS,CAAC,OAAO,IAAI,8EAA8E;oBAC7G,SAAS,EAAG,CAAS,CAAC,SAAS,IAAI,IAAI;oBACvC,WAAW,EAAG,CAAS,CAAC,WAAW;oBACnC,GAAG,CAAE,CAAS,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAG,CAAS,CAAC,eAAe,EAAE,CAAC;iBACjG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/http-api-update.d.ts

@@ -0,0 +1,7 @@
+import express from 'express';
+import type { QdrantService } from '../services/qdrant/service.js';
+/**
+ * Set up API route for tune.
+ */
+export declare function setupUpdateRoute(app: express.Express, qdrantService: QdrantService): void;
+//# sourceMappingURL=http-api-update.d.ts.map

package/dist/http/http-api-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-update.d.ts","sourceRoot":"","sources":["../../src/http/http-api-update.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAKnE;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,QAuBlF"}

package/dist/http/http-api-update.js

@@ -0,0 +1,33 @@
+import { structuredLogger } from '../utils/structured-logger.js';
+import { executeTune } from '../tools/tune.js';
+import { tuneInputSchema } from '../tools/tune_schema.js';
+import { runHttpApiWithSpaceContext } from '../utils/tenant-context.js';
+/**
+ * Set up API route for tune.
+ */
+export function setupUpdateRoute(app, qdrantService) {
+    app.post('/api/tune', async (req, res) => {
+        try {
+            const input = tuneInputSchema.safeParse(req.body);
+            if (!input.success) {
+                res.status(400).json({
+                    error: 'INVALID_INPUT',
+                    message: input.error.message ?? 'uris is required and must be a non-empty array'
+                });
+                return;
+            }
+            structuredLogger.info(`→ POST /api/tune (${input.data.uris.length} URI(s))`);
+            const result = await runHttpApiWithSpaceContext(req, () => executeTune(qdrantService, input.data));
+            structuredLogger.info(`✓ tune completed (${result.total_updated} updated, ${result.total_failed} failed)`);
+            res.status(200).json(result);
+        }
+        catch (error) {
+            structuredLogger.error('✗ tune failed', error);
+            res.status(500).json({
+                error: 'TUNE_FAILED',
+                message: error instanceof Error ? error.message : 'Failed to update adapter layers'
+            });
+        }
+    });
+}
+//# sourceMappingURL=http-api-update.js.map

package/dist/http/http-api-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-update.js","sourceRoot":"","sources":["../../src/http/http-api-update.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAExE;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,aAA4B;IACjF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,gDAAgD;iBACjF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACnG,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,aAAa,aAAa,MAAM,CAAC,YAAY,UAAU,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC;aACpF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/http-auth-callback.d.ts

@@ -0,0 +1,12 @@
+/**
+ * OIDC callback: exchange Keycloak authorization code for tokens, set session cookie, redirect.
+ */
+import express from 'express';
+export declare function resolveSessionMaxAgeSec(params: {
+    nowSec: number;
+    sessionMaxAgeSecFallback: number;
+    tokenExpiresIn: number | null;
+    accessTokenExp: number | null;
+}): number;
+export declare function setupAuthCallback(app: express.Express): void;
+//# sourceMappingURL=http-auth-callback.d.ts.map

package/dist/http/http-auth-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-callback.d.ts","sourceRoot":"","sources":["../../src/http/http-auth-callback.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,OAAO,MAAM,SAAS,CAAC;AA8B9B,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,MAAM,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAgBT;AA6BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAkJ5D"}

package/dist/http/http-auth-callback.js

@@ -0,0 +1,175 @@
+import crypto from 'crypto';
+import { toBase64url } from '@exodus/bytes/base64.js';
+import { utf8fromString } from '@exodus/bytes/utf8.js';
+import { AUTH_ENABLED, KEYCLOAK_URL, KEYCLOAK_INTERNAL_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, AUTH_CALLBACK_BASE_URL, SESSION_SECRET, SESSION_MAX_AGE_SEC, OIDC_GROUPS_ALLOWLIST } from '../config.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+import { buildOidcEndSessionRedirectUrl, redirectBrowserToOidcLogin } from './http-auth-oidc-redirect.js';
+import { oidcStateStore } from '../services/oidc-state-store.js';
+import { peekOidcIdTokenHintFromSession, SESSION_COOKIE_NAME } from './http-auth-middleware.js';
+import { applyOidcGroupsAllowlist, decodeJwtPayloadSegment, mergeCallbackTokenPayloads } from './oidc-profile-claims.js';
+export function resolveSessionMaxAgeSec(params) {
+    const { nowSec, sessionMaxAgeSecFallback, tokenExpiresIn, accessTokenExp } = params;
+    const fromExpiresIn = tokenExpiresIn && Number.isFinite(tokenExpiresIn) && tokenExpiresIn > 120
+        ? Math.max(60, Math.floor(tokenExpiresIn) - 60)
+        : null;
+    if (fromExpiresIn)
+        return fromExpiresIn;
+    const fromJwtExp = accessTokenExp && Number.isFinite(accessTokenExp) && accessTokenExp > nowSec + 120
+        ? Math.max(60, Math.floor(accessTokenExp - nowSec) - 60)
+        : null;
+    if (fromJwtExp)
+        return fromJwtExp;
+    return sessionMaxAgeSecFallback;
+}
+function signSession(payload) {
+    const payloadB64 = toBase64url(utf8fromString(JSON.stringify(payload)));
+    const sig = toBase64url(new Uint8Array(crypto.createHmac('sha256', SESSION_SECRET).update(payloadB64).digest()));
+    return `${payloadB64}.${sig}`;
+}
+const useSecureCookie = AUTH_CALLBACK_BASE_URL.trim().toLowerCase().startsWith('https://');
+/** Cookie options must match those used when setting the session (Path=/) so the browser clears it. */
+const COOKIE_CLEAR_OPTIONS = { path: '/', httpOnly: true, sameSite: 'lax', secure: useSecureCookie };
+/** Keycloak post_logout_redirect_uri target: immediately starts a new OIDC login (no logged-out landing in our app). */
+const AUTH_CONTINUE_SIGNIN_PATH = '/auth/continue-signin';
+function redirectContinueSignin(_req, res) {
+    if (AUTH_ENABLED && redirectBrowserToOidcLogin(res)) {
+        return;
+    }
+    res.redirect(302, '/ui/');
+}
+export function setupAuthCallback(app) {
+    // Base /auth: redirect to UI (browser) or 404 for API
+    app.get('/auth', (_req, res) => {
+        res.redirect(302, '/ui');
+    });
+    /** Older callback target; redirect for bookmarks and docs that still link here. */
+    app.get('/auth/success', (_req, res) => {
+        res.redirect(302, '/ui/');
+    });
+    /**
+     * Clear Kairos session, end Keycloak SSO (RP-initiated logout), then continue at continue-signin → OIDC login.
+     * id_token_hint (when present in session) avoids Keycloak static logged-out confirmation where supported.
+     */
+    app.get('/auth/logout', (req, res) => {
+        const idHint = peekOidcIdTokenHintFromSession(req);
+        res.clearCookie(SESSION_COOKIE_NAME, COOKIE_CLEAR_OPTIONS);
+        const base = AUTH_CALLBACK_BASE_URL?.trim().replace(/\/$/, '');
+        if (AUTH_ENABLED && base) {
+            const resume = `${base}${AUTH_CONTINUE_SIGNIN_PATH}`;
+            const endSession = buildOidcEndSessionRedirectUrl(resume, idHint);
+            if (endSession) {
+                res.redirect(302, endSession);
+                return;
+            }
+        }
+        if (AUTH_ENABLED && redirectBrowserToOidcLogin(res)) {
+            return;
+        }
+        res.redirect(302, '/ui/');
+    });
+    app.get(AUTH_CONTINUE_SIGNIN_PATH, redirectContinueSignin);
+    /** Optional IdP post-logout redirect target (same as continue-signin). */
+    app.get('/auth/logged-out', redirectContinueSignin);
+    app.get('/auth/callback', async (req, res) => {
+        if (!AUTH_ENABLED || !KEYCLOAK_URL || !SESSION_SECRET || !AUTH_CALLBACK_BASE_URL) {
+            res.status(503).json({
+                error: 'Auth not configured',
+                message: 'AUTH_ENABLED, KEYCLOAK_URL, SESSION_SECRET, and AUTH_CALLBACK_BASE_URL are required. Set in .env (see docs/install/README.md).'
+            });
+            return;
+        }
+        const { code, state } = req.query;
+        if (!code || !state) {
+            res.redirect(302, '/?error=missing_code_or_state');
+            return;
+        }
+        const entry = await oidcStateStore.consume(state);
+        if (!entry) {
+            structuredLogger.info('Auth callback: invalid or expired state');
+            res.redirect(302, '/?error=invalid_state');
+            return;
+        }
+        const keycloakBase = (KEYCLOAK_INTERNAL_URL || KEYCLOAK_URL).replace(/\/$/, '');
+        const redirectUri = `${AUTH_CALLBACK_BASE_URL.replace(/\/$/, '')}/auth/callback`;
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: KEYCLOAK_CLIENT_ID,
+            code,
+            redirect_uri: redirectUri,
+            code_verifier: entry.codeVerifier
+        });
+        let tokenRes;
+        try {
+            tokenRes = await fetch(`${keycloakBase}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString()
+            });
+        }
+        catch (err) {
+            structuredLogger.error('Auth callback: token request failed', err);
+            res.redirect(302, '/?error=token_request_failed');
+            return;
+        }
+        if (!tokenRes.ok) {
+            const text = await tokenRes.text();
+            structuredLogger.info(`Auth callback: token error ${JSON.stringify({ status: tokenRes.status, body: text })}`);
+            res.redirect(302, '/?error=token_exchange_failed');
+            return;
+        }
+        const tokens = (await tokenRes.json());
+        const idToken = typeof tokens.id_token === 'string' ? tokens.id_token : undefined;
+        const accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined;
+        if (!idToken && !accessToken) {
+            structuredLogger.info('Auth callback: no id_token or access_token in response');
+            res.redirect(302, '/?error=no_tokens');
+            return;
+        }
+        const tokenExpiresIn = typeof tokens.expires_in === 'number' && Number.isFinite(tokens.expires_in) ? tokens.expires_in : null;
+        const idPayload = idToken ? decodeJwtPayloadSegment(idToken) : null;
+        const accessPayload = accessToken ? decodeJwtPayloadSegment(accessToken) : null;
+        if (idPayload === null && accessPayload === null) {
+            structuredLogger.info('Auth callback: token payload parse failed');
+            res.redirect(302, '/?error=invalid_token_payload');
+            return;
+        }
+        const mergedResult = mergeCallbackTokenPayloads({
+            idPayload,
+            accessPayload,
+            fallbackRealm: KEYCLOAK_REALM
+        });
+        if (!mergedResult.ok) {
+            structuredLogger.info(`Auth callback: merge failed ${mergedResult.error}`);
+            const err = mergedResult.error === 'mismatched_sub' ? 'mismatched_token_sub' : 'invalid_token_sub';
+            res.redirect(302, `/?error=${err}`);
+            return;
+        }
+        const { merged } = mergedResult;
+        merged.groups = applyOidcGroupsAllowlist(merged.groups, OIDC_GROUPS_ALLOWLIST);
+        const nowSec = Math.floor(Date.now() / 1000);
+        const accessTokenExp = accessPayload && typeof accessPayload['exp'] === 'number' && Number.isFinite(accessPayload['exp'])
+            ? accessPayload['exp']
+            : null;
+        const sessionMaxAgeSec = resolveSessionMaxAgeSec({
+            nowSec,
+            sessionMaxAgeSecFallback: SESSION_MAX_AGE_SEC,
+            tokenExpiresIn,
+            accessTokenExp
+        });
+        if (process.env['AUTH_TRACE'] === 'true' || process.env['LOG_LEVEL'] === 'trace') {
+            structuredLogger.info(`[auth] TRACE callback ttl sessionMaxAgeSec=${sessionMaxAgeSec} tokenExpiresIn=${tokenExpiresIn ?? 'missing'} accessTokenExp=${accessTokenExp ?? 'missing'}`);
+        }
+        const exp = nowSec + sessionMaxAgeSec;
+        const sessionPayload = {
+            ...merged,
+            exp,
+            ...(idToken ? { oidc_id_token: idToken } : {})
+        };
+        const cookieValue = signSession(sessionPayload);
+        res.setHeader('Set-Cookie', [
+            `${SESSION_COOKIE_NAME}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${sessionMaxAgeSec}${useSecureCookie ? '; Secure' : ''}`
+        ]);
+        res.redirect(302, '/ui/');
+    });
+}
+//# sourceMappingURL=http-auth-callback.js.map