@treeseed/agent 0.8.5

package/dist/api/config.js

@@ -0,0 +1,77 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+function parseInteger(value, fallback) {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+function resolveLocalWranglerConfigPath(repoRoot, env) {
+  const explicit = env.TREESEED_API_D1_WRANGLER_CONFIG?.trim() || env.TREESEED_LOCAL_WRANGLER_CONFIG?.trim();
+  if (explicit) return resolve(repoRoot, explicit);
+  const generated = resolve(repoRoot, ".treeseed", "generated", "environments", "local", "wrangler.toml");
+  return existsSync(generated) ? generated : void 0;
+}
+function normalizeUrl(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function parseCsv(value) {
+  return (value ?? "").split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+}
+function resolveBaseUrl(env, host, port) {
+  if (env.TREESEED_API_BASE_URL?.trim()) {
+    return normalizeUrl(env.TREESEED_API_BASE_URL.trim());
+  }
+  if (env.RAILWAY_PUBLIC_DOMAIN?.trim()) {
+    return normalizeUrl(`https://${env.RAILWAY_PUBLIC_DOMAIN.trim()}`);
+  }
+  return normalizeUrl(`http://${host}:${port}`);
+}
+function resolveApiConfig(env = process.env) {
+  const host = env.HOST?.trim() || "0.0.0.0";
+  const port = parseInteger(env.PORT, 3e3);
+  const baseUrl = resolveBaseUrl(env, host === "0.0.0.0" ? "127.0.0.1" : host, port);
+  const issuer = normalizeUrl(env.TREESEED_API_ISSUER?.trim() || baseUrl);
+  const repoRoot = resolve(env.TREESEED_API_REPO_ROOT?.trim() || process.cwd());
+  return {
+    name: env.TREESEED_API_NAME?.trim() || "@treeseed/agent/api",
+    host,
+    port,
+    baseUrl,
+    issuer,
+    repoRoot,
+    projectId: env.TREESEED_PROJECT_ID?.trim() || "treeseed-project",
+    authSecret: env.TREESEED_API_AUTH_SECRET?.trim() || "treeseed-api-dev-secret",
+    projectApiKey: env.TREESEED_API_PROJECT_KEY?.trim() || void 0,
+    projectApiLabel: env.TREESEED_API_PROJECT_LABEL?.trim() || "Project API Key",
+    projectApiPermissions: parseCsv(env.TREESEED_API_PROJECT_KEY_PERMISSIONS).length > 0 ? parseCsv(env.TREESEED_API_PROJECT_KEY_PERMISSIONS) : ["sdk:execute:global", "agent:execute:global", "operations:execute:global"],
+    cloudflareAccountId: env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0,
+    cloudflareApiToken: env.CLOUDFLARE_API_TOKEN?.trim() || void 0,
+    d1DatabaseId: env.TREESEED_API_D1_DATABASE_ID?.trim() || void 0,
+    d1DatabaseName: env.TREESEED_API_D1_DATABASE_NAME?.trim() || env.SITE_DATA_DB?.trim() || void 0,
+    d1LocalPersistTo: env.TREESEED_API_D1_LOCAL_PERSIST_TO?.trim() || resolve(repoRoot, ".wrangler/state/v3/d1"),
+    d1WranglerConfigPath: resolveLocalWranglerConfigPath(repoRoot, env),
+    webServiceId: env.TREESEED_API_WEB_SERVICE_ID?.trim() || "web",
+    webServiceSecret: env.TREESEED_API_WEB_SERVICE_SECRET?.trim() || "treeseed-web-service-dev-secret",
+    webAssertionSecret: env.TREESEED_API_WEB_ASSERTION_SECRET?.trim() || env.TREESEED_API_AUTH_SECRET?.trim() || "treeseed-web-assertion-dev-secret",
+    webExchangeTtlSeconds: parseInteger(env.TREESEED_API_WEB_EXCHANGE_TTL, 300),
+    bootstrapAdminAllowlist: parseCsv(env.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST),
+    accessTokenTtlSeconds: parseInteger(env.TREESEED_API_ACCESS_TOKEN_TTL, 900),
+    refreshTokenTtlSeconds: parseInteger(env.TREESEED_API_REFRESH_TOKEN_TTL, 7 * 24 * 60 * 60),
+    deviceCodeTtlSeconds: parseInteger(env.TREESEED_API_DEVICE_CODE_TTL, 10 * 60),
+    deviceCodePollIntervalSeconds: parseInteger(env.TREESEED_API_DEVICE_CODE_POLL_INTERVAL, 5),
+    templateCatalogPath: env.TREESEED_API_TEMPLATE_CATALOG_PATH?.trim() || void 0,
+    providers: {
+      auth: env.TREESEED_API_PROVIDER_AUTH?.trim() || "d1",
+      agents: {
+        execution: env.TREESEED_API_PROVIDER_AGENT_EXECUTION?.trim() || "stub",
+        queue: env.TREESEED_API_PROVIDER_AGENT_QUEUE?.trim() || "memory",
+        notification: env.TREESEED_API_PROVIDER_AGENT_NOTIFICATION?.trim() || "stub",
+        repository: env.TREESEED_API_PROVIDER_AGENT_REPOSITORY?.trim() || "stub",
+        verification: env.TREESEED_API_PROVIDER_AGENT_VERIFICATION?.trim() || "stub"
+      }
+    }
+  };
+}
+export {
+  resolveApiConfig
+};

package/dist/api/http.d.ts

@@ -0,0 +1,28 @@
+import type { Context } from 'hono';
+import type { ApiPrincipal, ApiScope } from '@treeseed/sdk/remote';
+import type { AppVariables } from './types.ts';
+export type ApiContext = Context<{
+    Variables: AppVariables;
+}>;
+export declare function jsonError(c: Context, status: number, error: string, details?: Record<string, unknown>): Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, never, "json">;
+export declare function bearerTokenFromRequest(request: Request): string | null;
+export declare function hasScope(principal: ApiPrincipal | null, requiredScope: ApiScope): boolean;
+export declare function requireScope(c: ApiContext, requiredScope: ApiScope): (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, never, "json">) | null;
+export declare function requireAuthentication(c: ApiContext): (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, never, "json">) | null;
+export declare function requireActorType(c: ApiContext, actorType: 'anonymous' | 'user' | 'service' | 'project', message?: string): (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, never, "json">) | null;
+export declare function requirePermission(c: ApiContext, permission: string): (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, never, "json">) | null;

package/dist/api/http.js

@@ -0,0 +1,51 @@
+import { permissionGranted } from "./auth/rbac.js";
+function jsonError(c, status, error, details) {
+  return c.json({
+    ok: false,
+    error,
+    ...details ?? {}
+  }, { status });
+}
+function bearerTokenFromRequest(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  return match?.[1] ?? null;
+}
+function hasScope(principal, requiredScope) {
+  return Boolean(principal && (principal.scopes.includes(requiredScope) || principal.scopes.includes("*")));
+}
+function requireScope(c, requiredScope) {
+  if (!hasScope(c.get("principal"), requiredScope)) {
+    return jsonError(c, 401, "Authentication required.", { requiredScope });
+  }
+  return null;
+}
+function requireAuthentication(c) {
+  if (!c.get("principal")) {
+    return jsonError(c, 401, "Authentication required.");
+  }
+  return null;
+}
+function requireActorType(c, actorType, message = "Trusted service authentication required.") {
+  if (c.get("actorType") !== actorType) {
+    return jsonError(c, 401, message);
+  }
+  return null;
+}
+function requirePermission(c, permission) {
+  const principal = c.get("principal");
+  if (!principal || !permissionGranted(c.get("permissionGrants"), permission)) {
+    return jsonError(c, 403, "Permission denied.", { permission });
+  }
+  return null;
+}
+export {
+  bearerTokenFromRequest,
+  hasScope,
+  jsonError,
+  requireActorType,
+  requireAuthentication,
+  requirePermission,
+  requireScope
+};

package/dist/api/index.d.ts

@@ -0,0 +1,9 @@
+export { createTreeseedApiApp, createTreeseedApiRouter } from './app.ts';
+export { resolveApiConfig } from './config.ts';
+export { createRailwayTreeseedApiServer, createTreeseedNodeServer } from './railway.ts';
+export { resolveApiRuntimeProviders } from './providers.ts';
+export { resolveApiD1Database } from './auth/d1-database.ts';
+export { loadTemplateCatalog } from './templates.ts';
+export { MemoryDeviceCodeAuthProvider } from './auth/memory-provider.ts';
+export { D1AuthProvider } from './auth/d1-provider.ts';
+export type * from './types.ts';

package/dist/api/index.js

@@ -0,0 +1,20 @@
+import { createTreeseedApiApp, createTreeseedApiRouter } from "./app.js";
+import { resolveApiConfig } from "./config.js";
+import { createRailwayTreeseedApiServer, createTreeseedNodeServer } from "./railway.js";
+import { resolveApiRuntimeProviders } from "./providers.js";
+import { resolveApiD1Database } from "./auth/d1-database.js";
+import { loadTemplateCatalog } from "./templates.js";
+import { MemoryDeviceCodeAuthProvider } from "./auth/memory-provider.js";
+import { D1AuthProvider } from "./auth/d1-provider.js";
+export {
+  D1AuthProvider,
+  MemoryDeviceCodeAuthProvider,
+  createRailwayTreeseedApiServer,
+  createTreeseedApiApp,
+  createTreeseedApiRouter,
+  createTreeseedNodeServer,
+  loadTemplateCatalog,
+  resolveApiConfig,
+  resolveApiD1Database,
+  resolveApiRuntimeProviders
+};

package/dist/api/operations-routes.d.ts

@@ -0,0 +1,11 @@
+import type { Hono } from 'hono';
+import type { AgentSdk } from '@treeseed/sdk';
+import { executeHttpWorkflowOperation } from './operations.ts';
+import type { ApiConfig } from './types.ts';
+export declare function registerOperationRoutes(app: Hono<any>, options: {
+    config: ApiConfig;
+    scope: string;
+    prefix?: string;
+    sdk?: AgentSdk;
+    executeOperation?: typeof executeHttpWorkflowOperation;
+}): void;

package/dist/api/operations-routes.js

@@ -0,0 +1,87 @@
+import crypto from "node:crypto";
+import { findDispatchCapability, findTreeseedOperation } from "@treeseed/sdk";
+import { executeHttpWorkflowOperation, isHttpWorkflowOperationAllowed } from "./operations.js";
+import { enqueueTaskFromSdk } from "../services/common.js";
+import { enqueueTaskAndEnsureCapacity } from "../services/worker-capacity.js";
+import { jsonError, requireScope } from "./http.js";
+function registerOperationRoutes(app, options) {
+  const executeOperation = options.executeOperation ?? executeHttpWorkflowOperation;
+  const prefix = options.prefix ?? "";
+  function withPrefix(path) {
+    if (!prefix) return path;
+    return `${prefix}${path}`.replace(/\/{2,}/g, "/");
+  }
+  app.post(withPrefix("/operations/:operation"), async (c) => {
+    const unauthorized = requireScope(c, options.scope);
+    if (unauthorized) return unauthorized;
+    const requestedOperation = c.req.param("operation");
+    const resolvedOperation = findTreeseedOperation(requestedOperation);
+    if (!resolvedOperation) {
+      return jsonError(c, 400, `Unknown Treeseed operation "${requestedOperation}".`, {
+        operation: requestedOperation
+      });
+    }
+    if (!isHttpWorkflowOperationAllowed(resolvedOperation.name)) {
+      return jsonError(c, 400, `Workflow operation "${resolvedOperation.name}" is not supported over HTTP.`, {
+        operation: resolvedOperation.name
+      });
+    }
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const capability = findDispatchCapability("workflow", resolvedOperation.name);
+      if (capability?.executionClass === "remote_job" && options.sdk) {
+        const input = body && typeof body.input === "object" ? body.input : {};
+        const idempotencyKey = typeof body.idempotencyKey === "string" && body.idempotencyKey.trim() ? body.idempotencyKey.trim() : `workflow:${resolvedOperation.name}:${crypto.createHash("sha256").update(JSON.stringify(input)).digest("hex")}`;
+        const created = await options.sdk.createTask({
+          workDayId: typeof body.workDayId === "string" ? body.workDayId : "",
+          agentId: "workflow-dispatch",
+          type: "workflow_dispatch",
+          priority: typeof body.priority === "number" ? body.priority : 75,
+          idempotencyKey,
+          payload: {
+            executionKind: "workflow_dispatch",
+            namespace: "workflow",
+            operation: resolvedOperation.name,
+            input,
+            requestedByType: c.get("actorType"),
+            requestedById: c.get("principal")?.id ?? null
+          },
+          actor: c.get("principal")?.id ?? "api"
+        });
+        if (!created.payload) {
+          return jsonError(c, 500, `Failed to create workflow task for "${resolvedOperation.name}".`, {
+            operation: resolvedOperation.name
+          });
+        }
+        const capacity = await enqueueTaskAndEnsureCapacity(options.sdk, {
+          taskId: String(created.payload.id ?? ""),
+          actor: c.get("principal")?.id ?? "api",
+          priorityClass: "interactive",
+          projectId: options.config.projectId,
+          enqueueTask: enqueueTaskFromSdk
+        });
+        return c.json({
+          ok: true,
+          mode: "task",
+          operation: resolvedOperation.name,
+          payload: created.payload,
+          workerState: capacity.workerState,
+          capacity: {
+            desiredWorkers: capacity.desiredWorkers,
+            scaleApplied: capacity.scaleApplied,
+            reason: capacity.scaleReason
+          }
+        }, { status: 202 });
+      }
+      const result = await executeOperation(resolvedOperation.name, body);
+      return c.json(result, { status: result.ok ? 200 : 400 });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const status = /Unknown Treeseed operation|not supported over HTTP|confirmation required/i.test(message) ? 400 : 500;
+      return jsonError(c, status, message, { operation: resolvedOperation.name });
+    }
+  });
+}
+export {
+  registerOperationRoutes
+};

package/dist/api/operations.d.ts

@@ -0,0 +1,3 @@
+import type { ApiWorkflowOperationResponse, WorkflowHttpOperationRequest } from './types.ts';
+export declare function isHttpWorkflowOperationAllowed(operation: string): boolean;
+export declare function executeHttpWorkflowOperation(operation: string, request: WorkflowHttpOperationRequest): Promise<ApiWorkflowOperationResponse>;

package/dist/api/operations.js

@@ -0,0 +1,26 @@
+import { TreeseedOperationsSdk } from "@treeseed/sdk";
+const HTTP_BLOCKED_WORKFLOW_OPERATIONS = /* @__PURE__ */ new Set(["dev", "dev:watch"]);
+function isHttpWorkflowOperationAllowed(operation) {
+  return !HTTP_BLOCKED_WORKFLOW_OPERATIONS.has(operation);
+}
+async function executeHttpWorkflowOperation(operation, request) {
+  if (!isHttpWorkflowOperationAllowed(operation)) {
+    throw new Error(`Workflow operation "${operation}" is not supported over HTTP.`);
+  }
+  const operations = new TreeseedOperationsSdk();
+  return operations.execute({
+    operationName: operation,
+    input: request.input ?? {}
+  }, {
+    cwd: request.cwd ?? process.cwd(),
+    env: {
+      ...process.env,
+      ...request.env ?? {}
+    },
+    transport: "api"
+  });
+}
+export {
+  executeHttpWorkflowOperation,
+  isHttpWorkflowOperationAllowed
+};

package/dist/api/project-routes.d.ts

@@ -0,0 +1,8 @@
+import type { Hono } from 'hono';
+import type { AgentSdk } from '@treeseed/sdk';
+import type { ApiConfig } from './types.ts';
+export declare function registerProjectRoutes(app: Hono<any>, options: {
+    config: ApiConfig;
+    sharedSdk: AgentSdk;
+    prefix?: string;
+}): void;