@synth-deploy/server 0.1.0

package/dist/intake/webhook-handlers.js

@@ -0,0 +1,268 @@
+import crypto from "node:crypto";
+// ---------------------------------------------------------------------------
+// GitHub Actions — workflow_run completed event
+// ---------------------------------------------------------------------------
+export function parseGitHubActionsWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    // GitHub sends workflow_run events with action: "completed"
+    const workflowRun = data.workflow_run;
+    if (!workflowRun)
+        return null;
+    const conclusion = workflowRun.conclusion;
+    if (conclusion !== "success")
+        return null;
+    const repo = data.repository;
+    const repoName = repo?.name ?? "unknown";
+    const headSha = workflowRun.head_sha ?? "unknown";
+    const headBranch = workflowRun.head_branch ?? "unknown";
+    const runNumber = workflowRun.run_number;
+    return {
+        artifactName: repoName,
+        artifactType: "github-actions-build",
+        version: runNumber ? `build-${runNumber}` : headSha.slice(0, 8),
+        source: "github-actions",
+        downloadUrl: workflowRun.artifacts_url ?? undefined,
+        metadata: {
+            sha: headSha,
+            branch: headBranch,
+            workflow: workflowRun.name ?? "unknown",
+            runId: workflowRun.id,
+            runNumber,
+            htmlUrl: workflowRun.html_url,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Azure DevOps — build.complete event
+// ---------------------------------------------------------------------------
+export function parseAzureDevOpsWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    const eventType = data.eventType;
+    if (eventType !== "build.complete")
+        return null;
+    const resource = data.resource;
+    if (!resource)
+        return null;
+    const result = resource.result;
+    if (result !== "succeeded")
+        return null;
+    const definition = resource.definition;
+    const buildNumber = resource.buildNumber ?? "unknown";
+    const sourceVersion = resource.sourceVersion ?? "unknown";
+    return {
+        artifactName: definition?.name ?? "unknown",
+        artifactType: "azure-devops-build",
+        version: buildNumber,
+        source: "azure-devops",
+        downloadUrl: resource.url ?? undefined,
+        metadata: {
+            buildId: resource.id,
+            buildNumber,
+            sourceVersion,
+            sourceBranch: resource.sourceBranch,
+            definitionName: definition?.name,
+            project: data.resourceContainers?.project,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Jenkins — build notification
+// ---------------------------------------------------------------------------
+export function parseJenkinsWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    const build = data.build;
+    if (!build) {
+        // Some Jenkins plugins send flat payloads
+        if (!data.name && !data.job_name)
+            return null;
+        return {
+            artifactName: data.name ?? data.job_name ?? "unknown",
+            artifactType: "jenkins-build",
+            version: String(data.build_number ?? data.number ?? "unknown"),
+            source: "jenkins",
+            downloadUrl: data.build_url ?? data.url ?? undefined,
+            metadata: {
+                status: data.status ?? data.build_status,
+                url: data.build_url ?? data.url,
+            },
+        };
+    }
+    const phase = build.phase;
+    const status = build.status;
+    // Only process completed successful builds
+    if (phase !== "COMPLETED" && phase !== "FINALIZED")
+        return null;
+    if (status && status !== "SUCCESS")
+        return null;
+    return {
+        artifactName: data.name ?? "unknown",
+        artifactType: "jenkins-build",
+        version: String(build.number ?? "unknown"),
+        source: "jenkins",
+        downloadUrl: build.full_url ?? build.url ?? undefined,
+        metadata: {
+            buildNumber: build.number,
+            phase,
+            status,
+            url: build.full_url ?? build.url,
+            scmInfo: build.scm,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// GitLab CI — pipeline event
+// ---------------------------------------------------------------------------
+export function parseGitLabCIWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    const objectKind = data.object_kind;
+    if (objectKind !== "pipeline")
+        return null;
+    const attrs = data.object_attributes;
+    if (!attrs)
+        return null;
+    const status = attrs.status;
+    if (status !== "success")
+        return null;
+    const project = data.project;
+    return {
+        artifactName: project?.name ?? "unknown",
+        artifactType: "gitlab-ci-build",
+        version: `pipeline-${attrs.id ?? "unknown"}`,
+        source: "gitlab-ci",
+        downloadUrl: project?.web_url ?? undefined,
+        metadata: {
+            pipelineId: attrs.id,
+            ref: attrs.ref,
+            sha: attrs.sha,
+            source: attrs.source,
+            projectName: project?.name,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// CircleCI — workflow-completed event
+// ---------------------------------------------------------------------------
+export function parseCircleCIWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    const type = data.type;
+    if (type !== "workflow-completed")
+        return null;
+    const workflow = data.workflow;
+    if (!workflow)
+        return null;
+    const status = workflow.status;
+    if (status !== "success")
+        return null;
+    const pipeline = data.pipeline;
+    const project = data.project;
+    return {
+        artifactName: project?.name ?? "unknown",
+        artifactType: "circleci-build",
+        version: `workflow-${workflow.id ?? "unknown"}`,
+        source: "circleci",
+        metadata: {
+            workflowId: workflow.id,
+            workflowName: workflow.name,
+            pipelineId: pipeline?.id,
+            pipelineNumber: pipeline?.number,
+            projectSlug: project?.slug,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Generic — expects normalized payload
+// ---------------------------------------------------------------------------
+export function parseGenericWebhook(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const data = body;
+    const artifactName = data.artifactName;
+    const version = data.version;
+    if (!artifactName || !version)
+        return null;
+    return {
+        artifactName,
+        artifactType: data.type ?? "generic",
+        version,
+        source: data.source ?? "generic",
+        downloadUrl: data.downloadUrl ?? undefined,
+        metadata: data.metadata ?? {},
+    };
+}
+/**
+ * Verify a webhook signature from GitHub (X-Hub-Signature-256) or
+ * GitLab (X-Gitlab-Token). Returns { verified: true } if the signature
+ * is valid, or { verified: false, error } if not.
+ *
+ * If no secretToken is configured for the channel, verification is skipped
+ * (returns verified: true) to allow backwards-compatible operation.
+ */
+export function verifyWebhookSignature(source, secretToken, headers, rawBody) {
+    // Unauthenticated webhooks allowed when no secret is configured
+    if (!secretToken) {
+        return { verified: true };
+    }
+    switch (source) {
+        case "github-actions": {
+            const signature = headers["x-hub-signature-256"];
+            if (!signature) {
+                return { verified: false, error: "Missing X-Hub-Signature-256 header" };
+            }
+            const expected = "sha256=" + crypto
+                .createHmac("sha256", secretToken)
+                .update(rawBody)
+                .digest("hex");
+            const valid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+            return valid
+                ? { verified: true }
+                : { verified: false, error: "Invalid GitHub webhook signature" };
+        }
+        case "gitlab-ci": {
+            const token = headers["x-gitlab-token"];
+            if (!token) {
+                return { verified: false, error: "Missing X-Gitlab-Token header" };
+            }
+            // GitLab uses a shared secret token (not HMAC) — compare in constant time
+            if (token.length !== secretToken.length) {
+                return { verified: false, error: "Invalid GitLab webhook token" };
+            }
+            const valid = crypto.timingSafeEqual(Buffer.from(token), Buffer.from(secretToken));
+            return valid
+                ? { verified: true }
+                : { verified: false, error: "Invalid GitLab webhook token" };
+        }
+        default:
+            // No standard signature mechanism for this source type
+            return { verified: true };
+    }
+}
+// ---------------------------------------------------------------------------
+// Router — dispatch to the correct parser based on source
+// ---------------------------------------------------------------------------
+export function parseWebhook(source, body) {
+    switch (source) {
+        case "github-actions":
+            return parseGitHubActionsWebhook(body);
+        case "azure-devops":
+            return parseAzureDevOpsWebhook(body);
+        case "jenkins":
+            return parseJenkinsWebhook(body);
+        case "gitlab-ci":
+            return parseGitLabCIWebhook(body);
+        case "circleci":
+            return parseCircleCIWebhook(body);
+        default:
+            return parseGenericWebhook(body);
+    }
+}
+//# sourceMappingURL=webhook-handlers.js.map

package/dist/intake/webhook-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-handlers.js","sourceRoot":"","sources":["../../src/intake/webhook-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAoBjC,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAmD,CAAC;IAC7E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,WAAW,CAAC,UAAgC,CAAC;IAChE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAiD,CAAC;IACpE,MAAM,QAAQ,GAAI,IAAI,EAAE,IAAe,IAAI,SAAS,CAAC;IACrD,MAAM,OAAO,GAAI,WAAW,CAAC,QAAmB,IAAI,SAAS,CAAC;IAC9D,MAAM,UAAU,GAAI,WAAW,CAAC,WAAsB,IAAI,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,UAAgC,CAAC;IAE/D,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,sBAAsB;QACpC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAG,WAAW,CAAC,aAAwB,IAAI,SAAS;QAC/D,QAAQ,EAAE;YACR,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAG,WAAW,CAAC,IAAe,IAAI,SAAS;YACnD,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,SAAS;YACT,OAAO,EAAE,WAAW,CAAC,QAAQ;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAA+B,CAAC;IACvD,IAAI,SAAS,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA4B,CAAC;IACrD,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAiD,CAAC;IAC9E,MAAM,WAAW,GAAI,QAAQ,CAAC,WAAsB,IAAI,SAAS,CAAC;IAClE,MAAM,aAAa,GAAI,QAAQ,CAAC,aAAwB,IAAI,SAAS,CAAC;IAEtE,OAAO;QACL,YAAY,EAAG,UAAU,EAAE,IAAe,IAAI,SAAS;QACvD,YAAY,EAAE,oBAAoB;QAClC,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,cAAc;QACtB,WAAW,EAAG,QAAQ,CAAC,GAAc,IAAI,SAAS;QAClD,QAAQ,EAAE;YACR,OAAO,EAAE,QAAQ,CAAC,EAAE;YACpB,WAAW;YACX,aAAa;YACb,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,cAAc,EAAE,UAAU,EAAE,IAAI;YAChC,OAAO,EAAG,IAAI,CAAC,kBAA8C,EAAE,OAAO;SACvE;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO;YACL,YAAY,EAAG,IAAI,CAAC,IAAe,IAAK,IAAI,CAAC,QAAmB,IAAI,SAAS;YAC7E,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;YAC9D,MAAM,EAAE,SAAS;YACjB,WAAW,EAAG,IAAI,CAAC,SAAoB,IAAK,IAAI,CAAC,GAAc,IAAI,SAAS;YAC5E,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,YAAY;gBACxC,GAAG,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG;aAChC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAA2B,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4B,CAAC;IAElD,2CAA2C;IAC3C,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO;QACL,YAAY,EAAG,IAAI,CAAC,IAAe,IAAI,SAAS;QAChD,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;QAC1C,MAAM,EAAE,SAAS;QACjB,WAAW,EAAG,KAAK,CAAC,QAAmB,IAAK,KAAK,CAAC,GAAc,IAAI,SAAS;QAC7E,QAAQ,EAAE;YACR,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,KAAK;YACL,MAAM;YACN,GAAG,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG;YAChC,OAAO,EAAE,KAAK,CAAC,GAAG;SACnB;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAiC,CAAC;IAC1D,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAwD,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,MAA4B,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAC;IAEpE,OAAO;QACL,YAAY,EAAG,OAAO,EAAE,IAAe,IAAI,SAAS;QACpD,YAAY,EAAE,iBAAiB;QAC/B,OAAO,EAAE,YAAY,KAAK,CAAC,EAAE,IAAI,SAAS,EAAE;QAC5C,MAAM,EAAE,WAAW;QACnB,WAAW,EAAG,OAAO,EAAE,OAAkB,IAAI,SAAS;QACtD,QAAQ,EAAE;YACR,UAAU,EAAE,KAAK,CAAC,EAAE;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,OAAO,EAAE,IAAI;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;IAC7C,IAAI,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA4B,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAC;IAEpE,OAAO;QACL,YAAY,EAAG,OAAO,EAAE,IAAe,IAAI,SAAS;QACpD,YAAY,EAAE,gBAAgB;QAC9B,OAAO,EAAE,YAAY,QAAQ,CAAC,EAAE,IAAI,SAAS,EAAE;QAC/C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE;YACR,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,UAAU,EAAE,QAAQ,EAAE,EAAE;YACxB,cAAc,EAAE,QAAQ,EAAE,MAAM;YAChC,WAAW,EAAE,OAAO,EAAE,IAAI;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAkC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;IAEnD,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO;QACL,YAAY;QACZ,YAAY,EAAG,IAAI,CAAC,IAAe,IAAI,SAAS;QAChD,OAAO;QACP,MAAM,EAAG,IAAI,CAAC,MAAiB,IAAI,SAAS;QAC5C,WAAW,EAAG,IAAI,CAAC,WAAsB,IAAI,SAAS;QACtD,QAAQ,EAAG,IAAI,CAAC,QAAoC,IAAI,EAAE;KAC3D,CAAC;AACJ,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,WAA+B,EAC/B,OAAsD,EACtD,OAAe;IAEf,gEAAgE;IAChE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAuB,CAAC;YACvE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,GAAG,MAAM;iBAChC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;iBACjC,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CACtB,CAAC;YACF,OAAO,KAAK;gBACV,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACrE,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAuB,CAAC;YAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACrE,CAAC;YACD,0EAA0E;YAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;YACpE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAClB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CACzB,CAAC;YACF,OAAO,KAAK;gBACV,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACjE,CAAC;QAED;YACE,uDAAuD;YACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAa;IACxD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,cAAc;YACjB,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,WAAW;YACd,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,UAAU;YACb,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpC;YACE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,5 @@
+export declare function initServerLogger(dataDir: string): void;
+export declare function serverLog(label: string, data?: unknown): void;
+export declare function serverWarn(label: string, data?: unknown): void;
+export declare function serverError(label: string, data?: unknown): void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAE7D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAE9D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAE/D"}

package/dist/logger.js

@@ -0,0 +1,15 @@
+import { SynthLogger } from "@synth-deploy/core";
+let _logger = null;
+export function initServerLogger(dataDir) {
+    _logger = new SynthLogger(dataDir, "server");
+}
+export function serverLog(label, data) {
+    _logger?.log(label, data);
+}
+export function serverWarn(label, data) {
+    _logger?.warn(label, data);
+}
+export function serverError(label, data) {
+    _logger?.error(label, data);
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,IAAI,OAAO,GAAuB,IAAI,CAAC;AAEvC,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAc;IACrD,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAc;IACtD,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAAc;IACvD,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/mcp/resources.d.ts

@@ -0,0 +1,9 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DebriefReader } from "@synth-deploy/core";
+import type { DeploymentStore } from "../agent/synth-agent.js";
+/**
+ * Register MCP resources. These expose Synth state to MCP clients
+ * as readable data — Debrief entries, deployment records, etc.
+ */
+export declare function registerResources(mcp: McpServer, debrief: DebriefReader, deployments: DeploymentStore): void;
+//# sourceMappingURL=resources.d.ts.map

package/dist/mcp/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/mcp/resources.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,eAAe,GAC3B,IAAI,CAoFN"}

package/dist/mcp/resources.js

@@ -0,0 +1,72 @@
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Register MCP resources. These expose Synth state to MCP clients
+ * as readable data — Debrief entries, deployment records, etc.
+ */
+export function registerResources(mcp, debrief, deployments) {
+    // Recent debrief entries — scoped to a specific partition
+    mcp.registerResource("recent-debrief-entries", new ResourceTemplate("debrief://partition/{partitionId}/recent", {
+        list: undefined,
+    }), {
+        title: "Recent Debrief Entries (Partition-Scoped)",
+        description: "The most recent Debrief entries for a specific partition. " +
+            "Each entry records what the agent decided and why, in plain language.",
+        mimeType: "application/json",
+    }, async (uri, { partitionId }) => ({
+        contents: [
+            {
+                uri: uri.href,
+                text: JSON.stringify(debrief.getByPartition(partitionId).slice(-20), null, 2),
+            },
+        ],
+    }));
+    // Debrief entries for a specific deployment
+    mcp.registerResource("deployment-debrief", new ResourceTemplate("debrief://deployment/{deploymentId}", {
+        list: undefined,
+    }), {
+        title: "Deployment Debrief",
+        description: "All Debrief entries for a specific deployment, showing the full reasoning chain.",
+        mimeType: "application/json",
+    }, async (uri, { deploymentId }) => {
+        const deployment = deployments.get(deploymentId);
+        if (!deployment) {
+            return { contents: [{ uri: uri.href, text: JSON.stringify({ error: "Deployment not found" }) }] };
+        }
+        const entries = debrief.getByDeployment(deploymentId);
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    text: JSON.stringify(entries, null, 2),
+                },
+            ],
+        };
+    });
+    // Deployment record
+    mcp.registerResource("deployment", new ResourceTemplate("deployment://{deploymentId}", {
+        list: async () => ({
+            resources: deployments.list().map((d) => ({
+                uri: `deployment://${d.id}`,
+                name: `${d.artifactId} v${d.version} → ${d.environmentId}`,
+            })),
+        }),
+    }), {
+        title: "Deployment Record",
+        description: "Full deployment record including status, variables, and debrief entry references.",
+        mimeType: "application/json",
+    }, async (uri, { deploymentId }) => {
+        const deployment = deployments.get(deploymentId);
+        if (!deployment) {
+            return { contents: [{ uri: uri.href, text: "Not found" }] };
+        }
+        return {
+            contents: [
+                {
+                    uri: uri.href,
+                    text: JSON.stringify(deployment, null, 2),
+                },
+            ],
+        };
+    });
+}
+//# sourceMappingURL=resources.js.map

package/dist/mcp/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/mcp/resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAK3E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAc,EACd,OAAsB,EACtB,WAA4B;IAE5B,0DAA0D;IAC1D,GAAG,CAAC,gBAAgB,CAClB,wBAAwB,EACxB,IAAI,gBAAgB,CAAC,0CAA0C,EAAE;QAC/D,IAAI,EAAE,SAAS;KAChB,CAAC,EACF;QACE,KAAK,EAAE,2CAA2C;QAClD,WAAW,EACT,4DAA4D;YAC5D,uEAAuE;QACzE,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,WAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;aACxF;SACF;KACF,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,gBAAgB,CAClB,oBAAoB,EACpB,IAAI,gBAAgB,CAAC,qCAAqC,EAAE;QAC1D,IAAI,EAAE,SAAS;KAChB,CAAC,EACF;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,kFAAkF;QACpF,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,YAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,YAAsB,CAAC,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;iBACvC;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,oBAAoB;IACpB,GAAG,CAAC,gBAAgB,CAClB,YAAY,EACZ,IAAI,gBAAgB,CAAC,6BAA6B,EAAE;QAClD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACjB,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,EAAE;gBAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,aAAa,EAAE;aAC3D,CAAC,CAAC;SACJ,CAAC;KACH,CAAC,EACF;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,mFAAmF;QAChG,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,YAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC1C;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,15 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DebriefWriter, DebriefReader, IPartitionStore, IEnvironmentStore, IArtifactStore } from "@synth-deploy/core";
+import type { SynthAgent, DeploymentStore } from "../agent/synth-agent.js";
+/**
+ * Create and configure the MCP server with all Synth tools and resources.
+ */
+export declare function createMcpServer(deps: {
+    agent: SynthAgent;
+    debrief: DebriefWriter & DebriefReader;
+    partitions: IPartitionStore;
+    environments: IEnvironmentStore;
+    deployments: DeploymentStore;
+    artifactStore: IArtifactStore;
+}): McpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC3H,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI3E;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,aAAa,GAAG,aAAa,CAAC;IACvC,UAAU,EAAE,eAAe,CAAC;IAC5B,YAAY,EAAE,iBAAiB,CAAC;IAChC,WAAW,EAAE,eAAe,CAAC;IAC7B,aAAa,EAAE,cAAc,CAAC;CAC/B,GAAG,SAAS,CAiBZ"}

package/dist/mcp/server.js

@@ -0,0 +1,20 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+import { registerResources } from "./resources.js";
+/**
+ * Create and configure the MCP server with all Synth tools and resources.
+ */
+export function createMcpServer(deps) {
+    const mcp = new McpServer({
+        name: "synth",
+        version: "0.1.0",
+    }, {
+        capabilities: {
+            logging: {},
+        },
+    });
+    registerTools(mcp, deps.agent, deps.partitions, deps.environments, deps.deployments, deps.artifactStore);
+    registerResources(mcp, deps.debrief, deps.deployments);
+    return mcp;
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,MAAM,GAAG,GAAG,IAAI,SAAS,CACvB;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,OAAO,EAAE,EAAE;SACZ;KACF,CACF,CAAC;IAEF,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACzG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp/tools.d.ts

@@ -0,0 +1,9 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { SynthAgent, DeploymentStore } from "../agent/synth-agent.js";
+import type { IArtifactStore, IEnvironmentStore, IPartitionStore } from "@synth-deploy/core";
+/**
+ * Register MCP tools on the server. These are the actions MCP clients
+ * (Claude, agents, CLI tools) can invoke.
+ */
+export declare function registerTools(mcp: McpServer, agent: SynthAgent, partitions: IPartitionStore, environments: IEnvironmentStore, deployments: DeploymentStore, artifactStore: IArtifactStore): void;
+//# sourceMappingURL=tools.d.ts.map

package/dist/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE7F;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,eAAe,EAC3B,YAAY,EAAE,iBAAiB,EAC/B,WAAW,EAAE,eAAe,EAC5B,aAAa,EAAE,cAAc,GAC5B,IAAI,CAoGN"}

package/dist/mcp/tools.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+/**
+ * Register MCP tools on the server. These are the actions MCP clients
+ * (Claude, agents, CLI tools) can invoke.
+ */
+export function registerTools(mcp, agent, partitions, environments, deployments, artifactStore) {
+    mcp.registerTool("trigger-deployment", {
+        title: "Trigger Deployment",
+        description: "Trigger a deployment of an artifact to an environment. " +
+            "The server agent will resolve variables, make decisions, and record everything to the Debrief.",
+        inputSchema: {
+            artifactId: z.string().describe("The artifact to deploy"),
+            environmentId: z.string().describe("Target environment ID"),
+            partitionId: z.string().optional().describe("Target partition ID (optional)"),
+            version: z.string().describe("Version to deploy"),
+            variables: z.record(z.string()).optional().describe("Override variables for this deployment"),
+        },
+    }, async ({ artifactId, environmentId, partitionId, version, variables }) => {
+        const artifact = artifactStore.get(artifactId);
+        if (!artifact) {
+            return {
+                content: [{ type: "text", text: `Error: Artifact not found: ${artifactId}` }],
+                isError: true,
+            };
+        }
+        const environment = environments.get(environmentId);
+        if (!environment) {
+            return {
+                content: [{ type: "text", text: `Error: Environment not found: ${environmentId}` }],
+                isError: true,
+            };
+        }
+        if (partitionId) {
+            const partition = partitions.get(partitionId);
+            if (!partition) {
+                return {
+                    content: [{ type: "text", text: `Error: Partition not found: ${partitionId}` }],
+                    isError: true,
+                };
+            }
+        }
+        const deployment = await agent.triggerDeployment({
+            artifactId,
+            artifactVersionId: version,
+            environmentId,
+            partitionId,
+            triggeredBy: "agent",
+            variables,
+        });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        deploymentId: deployment.id,
+                        status: deployment.status,
+                        version: deployment.version,
+                        debriefEntries: deployment.debriefEntryIds.length,
+                    }, null, 2),
+                },
+            ],
+        };
+    });
+    mcp.registerTool("get-deployment-status", {
+        title: "Get Deployment Status",
+        description: "Get the current status and Debrief entries for a deployment.",
+        inputSchema: {
+            deploymentId: z.string().describe("The deployment ID to check"),
+        },
+    }, async ({ deploymentId }) => {
+        const deployment = deployments.get(deploymentId);
+        if (!deployment) {
+            return {
+                content: [{ type: "text", text: `Error: Deployment not found: ${deploymentId}` }],
+                isError: true,
+            };
+        }
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(deployment, null, 2),
+                },
+            ],
+        };
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAc,EACd,KAAiB,EACjB,UAA2B,EAC3B,YAA+B,EAC/B,WAA4B,EAC5B,aAA6B;IAE7B,GAAG,CAAC,YAAY,CACd,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,yDAAyD;YACzD,gGAAgG;QAClG,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACjD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAC9F;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,UAAU,EAAE,EAAE,CAAC;gBAC7E,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,aAAa,EAAE,EAAE,CAAC;gBACnF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,WAAW,EAAE,EAAE,CAAC;oBAC/E,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;YAC/C,UAAU;YACV,iBAAiB,EAAE,OAAO;YAC1B,aAAa;YACb,WAAW;YACX,WAAW,EAAE,OAAO;YACpB,SAAS;SACV,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;wBACE,YAAY,EAAE,UAAU,CAAC,EAAE;wBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,cAAc,EAAE,UAAU,CAAC,eAAe,CAAC,MAAM;qBAClD,EACD,IAAI,EACJ,CAAC,CACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,YAAY,CACd,uBAAuB,EACvB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,8DAA8D;QAC3E,WAAW,EAAE;YACX,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SAChE;KACF,EACD,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QACzB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,YAAY,EAAE,EAAE,CAAC;gBACjF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC1C;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,29 @@
+import type { FastifyInstance } from "fastify";
+import type { IUserStore, IUserRoleStore, ISessionStore, UserId, Permission } from "@synth-deploy/core";
+export interface AuthenticatedUser {
+    id: UserId;
+    email: string;
+    name: string;
+    permissions: Permission[];
+}
+declare module "fastify" {
+    interface FastifyRequest {
+        user?: AuthenticatedUser;
+    }
+}
+/**
+ * Registers JWT-based authentication middleware on a Fastify instance.
+ *
+ * All /api/ and /mcp routes require a valid JWT Bearer token,
+ * except routes listed in EXEMPT_ROUTES. Static file serving and
+ * health endpoints are always accessible.
+ */
+export declare function registerAuthMiddleware(app: FastifyInstance, userStore: IUserStore, userRoleStore: IUserRoleStore, sessionStore: ISessionStore, jwtSecret: Uint8Array): {
+    enabled: boolean;
+};
+export declare function generateTokens(userId: UserId, jwtSecret: Uint8Array): Promise<{
+    token: string;
+    refreshToken: string;
+    expiresAt: Date;
+}>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,iBAAiB,CAAC;KAC1B;CACF;AAOD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,UAAU,EACrB,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,aAAa,EAC3B,SAAS,EAAE,UAAU,GACpB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CA2CtB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAmBnE"}