@vfarcic/dot-ai 1.21.1 → 1.23.0

package/dist/interfaces/rest-api.js

@@ -41,6 +41,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RestApiRouter = exports.HttpStatus = exports.UNPARSEABLE_QUERY_PLACEHOLDER = void 0;
 exports.sanitizeRequestUrlForLogging = sanitizeRequestUrlForLogging;
+exports.extractPromptsOverride = extractPromptsOverride;
 const node_url_1 = require("node:url");
 const openapi_generator_1 = require("./openapi-generator");
 const rest_route_registry_1 = require("./rest-route-registry");
@@ -50,6 +51,7 @@ const embedding_migration_handler_1 = require("./embedding-migration-handler");
 const prompts_1 = require("../tools/prompts");
 const user_prompts_loader_1 = require("../core/user-prompts-loader");
 const git_utils_1 = require("../core/git-utils");
+const cors_headers_1 = require("./cors-headers");
 const generic_session_manager_1 = require("../core/generic-session-manager");
 const session_events_1 = require("../core/session-events");
 const shared_prompt_loader_1 = require("../core/shared-prompt-loader");
@@ -72,9 +74,11 @@ const rbac_1 = require("../core/rbac");
 exports.UNPARSEABLE_QUERY_PLACEHOLDER = '?<redacted-unparseable>';
 /**
  * F3: req.url is logged on every request; with PRD #581 the query string may
- * carry `?repo=<user-supplied-url>` whose value can include credentials. This
- * helper rewrites the `repo` value to its credential-scrubbed form so the
- * raw token doesn't reach the log. Everything else is preserved verbatim.
+ * carry `?repo=<user-supplied-url>` whose value can include credentials, and
+ * PRD #647 adds `?source=<identifier>` which is equally credential-bearing (it
+ * may be a `https://user:tok@host` git URL). This helper rewrites BOTH values
+ * to their credential-scrubbed form so the raw token doesn't reach the log.
+ * Everything else is preserved verbatim.
  *
  * CodeRabbit Major B: on parse failure, we no longer return the input
  * verbatim — an unparseable URL is more likely than a parseable one to hide
@@ -86,8 +90,19 @@ exports.UNPARSEABLE_QUERY_PLACEHOLDER = '?<redacted-unparseable>';
 function sanitizeRequestUrlForLogging(url) {
     if (!url)
         return url;
-    if (!url.includes('repo='))
+    // Fast path: only walk the URL when it carries a credential-bearing param
+    // we know how to scrub (PRD #581 `repo=`, PRD #647 `source=`).
+    //
+    // CodeRabbit C3: a percent-encoded param NAME (e.g. `r%65po=`, `s%6Frce=`)
+    // decodes to `repo`/`source` once parsed, so the literal-substring fast path
+    // would early-return WITHOUT scrubbing and leak the credential into the log.
+    // Any `%` means a name could be encoded, so fall through to the full
+    // parse-and-scrub below (URLSearchParams decodes the name, catching it).
+    if (!url.includes('repo=') &&
+        !url.includes('source=') &&
+        !url.includes('%')) {
         return url;
+    }
     try {
         // req.url is path-relative; provide a dummy base for URL parsing.
         const parsed = new node_url_1.URL(url, 'http://internal.invalid');
@@ -95,6 +110,13 @@ function sanitizeRequestUrlForLogging(url) {
         if (repo) {
             parsed.searchParams.set('repo', (0, user_prompts_loader_1.sanitizeUrlForLogging)(repo));
         }
+        // PRD #647 M5 (F2): `?source=` is scrubbed with the same deep helper used
+        // for the echoed `source` (userinfo + credential-bearing query params), so
+        // `?source=https://user:tok@host` never appears unscrubbed in the log.
+        const source = parsed.searchParams.get('source');
+        if (source) {
+            parsed.searchParams.set('source', (0, user_prompts_loader_1.scrubSourceUrl)(source));
+        }
         // Return path + search only (drop the dummy base).
         return parsed.pathname + parsed.search + parsed.hash;
     }
@@ -108,6 +130,150 @@ function sanitizeRequestUrlForLogging(url) {
         return url.slice(0, qIdx) + exports.UNPARSEABLE_QUERY_PLACEHOLDER;
     }
 }
+/**
+ * Coerce an optional override string param (path/branch) supplied via query
+ * string or JSON body. Mirrors the `repo` guard in extractPromptsOverride:
+ *   - non-string (array, number, object, boolean) → 400 (avoids a 500 from a
+ *     malformed body reaching downstream code).
+ *   - absent (null/undefined) or empty/whitespace-only → `undefined`, i.e.
+ *     treated as not supplied so the downstream default (subPath '' / branch
+ *     'main') is preserved and an empty-string branch never reaches
+ *     isValidGitBranch (which would otherwise reject it).
+ *   - otherwise → the trimmed value.
+ */
+function coerceOverrideStringParam(value, name) {
+    if (value === undefined || value === null) {
+        return { ok: true, value: undefined };
+    }
+    if (typeof value !== 'string') {
+        return {
+            ok: false,
+            message: `${name} must be a string (got ${Array.isArray(value) ? 'array' : typeof value})`,
+        };
+    }
+    const trimmed = value.trim();
+    return { ok: true, value: trimmed.length > 0 ? trimmed : undefined };
+}
+/**
+ * Read the per-request git credential from the X-Dot-AI-Git-Token header
+ * (PRD #621 M2). Node lowercases incoming header names and may present a
+ * repeated header as an array; normalize to a single non-empty string or
+ * undefined. The value is a secret, so it is never logged here.
+ */
+function readGitTokenHeader(req) {
+    const raw = req.headers[cors_headers_1.GIT_TOKEN_HEADER_LC];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Extract and validate the per-request prompts override.
+ *
+ * Threads three optional, additive inputs from the request into a
+ * UserPromptsOverride (PRD #581 introduced `repo`; PRD #621 M1 adds `path`
+ * and `branch`):
+ *   - repoParam   → override.repoUrl   (GET ?repo=  / POST body `repo`)
+ *   - pathParam   → override.subPath   (GET ?path=  / POST body `path`)
+ *   - branchParam → override.branch    (GET ?branch= / POST body `branch`)
+ *   - gitToken    → override.gitToken  (X-Dot-AI-Git-Token request header; M2)
+ *
+ * Returns:
+ *   - { ok: true, override }  when no `repo` is supplied (override undefined;
+ *     any path/branch/token are ignored, since they only qualify an override —
+ *     this keeps the no-`repo` / env-var-configured path unchanged).
+ *   - { ok: true, override }  when a syntactically valid override is supplied.
+ *   - { ok: false, message }  when the override fails validation (HTTP 400).
+ *
+ * The validation message is run through scrubCredentials so embedded tokens
+ * never reach the wire response.
+ *
+ * Backward compatibility (PRD #621, non-negotiable): when path/branch are
+ * absent or empty, the override carries `repoUrl` only — byte-identical to
+ * the PRD #581 behavior (same clone target: repo root, `main`). subPath and
+ * branch are populated ONLY for a non-empty value, so downstream defaults are
+ * untouched. The credential header is INERT unless a `?repo=` override is
+ * present: without a repo this returns `override: undefined` before the token
+ * is ever read, so the env-var path is unaffected by a forwarded header.
+ *
+ * Validation is delegated to getUserPromptsConfigFromOverride (scheme,
+ * sanitizeRelativePath for subPath, isValidGitBranch for branch) and happens
+ * BEFORE any clone or shared-cache mutation, so a rejected override can never
+ * corrupt the env-var-configured cache.
+ */
+function extractPromptsOverride(repoParam, pathParam, branchParam, gitToken, sourceParam) {
+    // PRD #647 D1: an explicit `?source=<identifier>` selects an already-ingested
+    // (CLI-uploaded) source. It is the explicit ingested signal, so it takes
+    // precedence over `?repo=` and the clone-qualifying params (path/branch/token)
+    // do not apply — they only describe a git clone, which an ingested source is
+    // not. Resolution against the in-memory ingested cache (and the "never clone"
+    // guarantee) happens in loadUserPrompts via override.ingestedSource. The raw
+    // identifier doubles as repoUrl ONLY so computePromptsSource echoes the
+    // scrubbed source; it is never cloned or logged unscrubbed on this path.
+    if (typeof sourceParam === 'string' && sourceParam.trim() !== '') {
+        const identifier = sourceParam.trim();
+        return {
+            ok: true,
+            override: { repoUrl: identifier, ingestedSource: identifier },
+        };
+    }
+    // Treat absent (null/undefined) repo as no override. path/branch/token only
+    // qualify an override, so without a repo they are ignored (the credential
+    // header is inert on the env-var path).
+    if (repoParam === undefined || repoParam === null) {
+        return { ok: true, override: undefined };
+    }
+    // The wire contract says `repo` is a string. Anything else (array,
+    // number, object, boolean) is a 400 — otherwise downstream code
+    // would crash to a 500.
+    if (typeof repoParam !== 'string') {
+        return {
+            ok: false,
+            message: `repo must be a string (got ${Array.isArray(repoParam) ? 'array' : typeof repoParam})`,
+        };
+    }
+    const trimmed = repoParam.trim();
+    if (!trimmed) {
+        return { ok: true, override: undefined };
+    }
+    const candidate = { repoUrl: trimmed };
+    // PRD #621 M1: thread ?path= / body `path` into subPath (validated
+    // downstream by sanitizeRelativePath).
+    const pathResult = coerceOverrideStringParam(pathParam, 'path');
+    if (!pathResult.ok) {
+        return pathResult;
+    }
+    if (pathResult.value !== undefined) {
+        candidate.subPath = pathResult.value;
+    }
+    // PRD #621 M1: thread ?branch= / body `branch` into branch (validated
+    // downstream by isValidGitBranch).
+    const branchResult = coerceOverrideStringParam(branchParam, 'branch');
+    if (!branchResult.ok) {
+        return branchResult;
+    }
+    if (branchResult.value !== undefined) {
+        candidate.branch = branchResult.value;
+    }
+    // PRD #621 M2: the X-Dot-AI-Git-Token header (read by the handler and passed
+    // in already-normalized to a non-empty string or undefined) authenticates
+    // THIS override clone. It travels only as a header — never query/body — and
+    // is never echoed (computePromptsSource uses repoUrl only).
+    if (gitToken) {
+        candidate.gitToken = gitToken;
+    }
+    try {
+        // Throws on invalid scheme / subPath / branch.
+        (0, user_prompts_loader_1.getUserPromptsConfigFromOverride)(candidate);
+        return { ok: true, override: candidate };
+    }
+    catch (error) {
+        const raw = error instanceof Error ? error.message : 'Invalid override';
+        return { ok: false, message: (0, git_utils_1.scrubCredentials)(raw) };
+    }
+}
 /**
  * HTTP status codes for REST responses
  */
@@ -245,6 +411,7 @@ class RestApiRouter {
             'GET:/api/v1/logs': () => this.handleGetLogs(req, res, requestId, searchParams),
             'GET:/api/v1/prompts': () => this.handlePromptsListRequest(req, res, requestId, searchParams),
             'POST:/api/v1/prompts/refresh': () => this.handlePromptsCacheRefresh(req, res, requestId, body),
+            'POST:/api/v1/prompts/sources': () => this.handlePromptsSourceIngest(req, res, requestId, body),
             'POST:/api/v1/prompts/:promptName': () => this.handlePromptsGetRequest(req, res, requestId, params.promptName, body, searchParams),
             'GET:/api/v1/visualize/:sessionId': () => this.handleVisualize(req, res, requestId, params.sessionId, searchParams),
             'GET:/api/v1/events/remediations': () => this.handleRemediationSSE(req, res, requestId),
@@ -1086,53 +1253,21 @@ class RestApiRouter {
             await this.sendErrorResponse(res, requestId, HttpStatus.INTERNAL_SERVER_ERROR, 'LOGS_ERROR', 'Failed to retrieve logs', { error: errorMessage });
         }
     }
-    /**
-     * Extract and validate the per-request `repo` override (PRD #581).
-     *
-     * Returns:
-     *   - { ok: true, override }    when no repo param is supplied, override is undefined.
-     *   - { ok: true, override }    when a syntactically valid override URL is supplied.
-     *   - { ok: false, message }    when the override fails validation (HTTP 400).
-     *
-     * The validation message is run through scrubCredentials so embedded tokens
-     * never reach the wire response.
-     */
-    extractPromptsOverride(repoParam) {
-        // Treat absent (null/undefined) as no override.
-        if (repoParam === undefined || repoParam === null) {
-            return { ok: true, override: undefined };
-        }
-        // The wire contract says `repo` is a string. Anything else (array,
-        // number, object, boolean) is a 400 — otherwise downstream code
-        // would crash to a 500.
-        if (typeof repoParam !== 'string') {
-            return {
-                ok: false,
-                message: `repo must be a string (got ${Array.isArray(repoParam) ? 'array' : typeof repoParam})`,
-            };
-        }
-        const trimmed = repoParam.trim();
-        if (!trimmed) {
-            return { ok: true, override: undefined };
-        }
-        const candidate = { repoUrl: trimmed };
-        try {
-            // Throws on invalid scheme / subPath / branch.
-            (0, user_prompts_loader_1.getUserPromptsConfigFromOverride)(candidate);
-            return { ok: true, override: candidate };
-        }
-        catch (error) {
-            const raw = error instanceof Error ? error.message : 'Invalid override';
-            return { ok: false, message: (0, git_utils_1.scrubCredentials)(raw) };
-        }
-    }
     /**
      * Handle prompts list requests
      */
     async handlePromptsListRequest(req, res, requestId, searchParams) {
         try {
             this.logger.info('Processing prompts list request', { requestId });
-            const overrideResult = this.extractPromptsOverride(searchParams.get('repo'));
+            // PRD #581: ?repo= override. PRD #621 M1: ?path= / ?branch= thread into
+            // candidate.subPath / candidate.branch (absent → unchanged behavior).
+            // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
+            // (inert when no ?repo= override is present).
+            // PRD #647 list-by-source: ?source= selects an already-ingested source,
+            // resolved from the in-memory upload cache with no git operation (same
+            // signal as the render path). Absent → byte-identical to today (env-var /
+            // built-in set), so the no-?source= behavior is unchanged.
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req), searchParams.get('source'));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1154,6 +1289,24 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (?repo=) whose source can't be loaded is a
+            // bad-gateway condition, not a server fault: surface it (issue #575)
+            // instead of silently serving built-in prompts with HTTP 200. The
+            // message is already credential-scrubbed by the loader.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
+            // PRD #647 list-by-source (D2): an unknown/evicted ?source= identifier is
+            // a caller-actionable validation error — surface the re-upload guidance as
+            // a 400 (same mapping the render handler uses), NOT a generic 500 or a
+            // silent success-with-builtins. The message names POST
+            // /api/v1/prompts/sources and carries no clone/git/scheme vocabulary.
+            const listErrorMessage = error instanceof Error ? error.message : String(error);
+            if (listErrorMessage.includes('Ingested source not found')) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', listErrorMessage);
+                return;
+            }
             this.logger.error('Prompts list request failed', error instanceof Error ? error : new Error(String(error)), {
                 requestId,
             });
@@ -1169,7 +1322,15 @@ class RestApiRouter {
                 requestId,
                 promptName,
             });
-            const overrideResult = this.extractPromptsOverride(searchParams.get('repo'));
+            // PRD #581: ?repo= override. PRD #621 M1: ?path= / ?branch= thread into
+            // candidate.subPath / candidate.branch (absent → unchanged behavior).
+            // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
+            // (inert when no ?repo= override is present).
+            // PRD #647 D1/M3: ?source= selects an already-ingested source, resolved
+            // from the in-memory upload cache with no git operation (precedence over
+            // ?repo=). Absent → unchanged behavior, so the env-var/clone paths are
+            // byte-identical to today.
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req), searchParams.get('source'));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1192,14 +1353,24 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (?repo=) whose source can't be loaded is a
+            // bad-gateway condition (issue #575); surface it before the generic
+            // validation/500 mapping. The message is already credential-scrubbed.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
             const errorMessage = error instanceof Error ? error.message : String(error);
             this.logger.error('Prompt get request failed', error instanceof Error ? error : new Error(String(error)), {
                 requestId,
                 promptName,
             });
-            // Check if it's a validation error (missing required arguments or prompt not found)
+            // Check if it's a validation error (missing required arguments, prompt not
+            // found, or a missing ingested ?source= identifier — PRD #647 D2, which
+            // carries re-upload guidance and must be a 400, not a 500).
             const isValidationError = errorMessage.includes('Missing required arguments') ||
-                errorMessage.includes('Prompt not found');
+                errorMessage.includes('Prompt not found') ||
+                errorMessage.includes('Ingested source not found');
             await this.sendErrorResponse(res, requestId, isValidationError
                 ? HttpStatus.BAD_REQUEST
                 : HttpStatus.INTERNAL_SERVER_ERROR, isValidationError ? 'VALIDATION_ERROR' : 'PROMPT_GET_ERROR', errorMessage);
@@ -1214,9 +1385,13 @@ class RestApiRouter {
                 requestId,
             });
             // body.repo type is checked inside extractPromptsOverride (it accepts
-            // unknown and rejects non-string values with 400 — see F2).
+            // unknown and rejects non-string values with 400 — see F2). PRD #621 M1:
+            // body `path` / `branch` thread into candidate.subPath / candidate.branch
+            // (absent → unchanged behavior); both are likewise type-checked.
             const bodyObj = body;
-            const overrideResult = this.extractPromptsOverride(bodyObj?.repo);
+            // PRD #621 M2: the credential always travels as the X-Dot-AI-Git-Token
+            // header — never the body — and is inert without a repo override.
+            const overrideResult = extractPromptsOverride(bodyObj?.repo, bodyObj?.path, bodyObj?.branch, readGitTokenHeader(req));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1244,10 +1419,67 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (body.repo) whose source can't be loaded is a
+            // bad-gateway condition (issue #575); surface it instead of a generic
+            // 500. The message is already credential-scrubbed by the loader.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
             this.logger.error('Prompts cache refresh failed', error instanceof Error ? error : new Error(String(error)), { requestId });
             await this.sendErrorResponse(res, requestId, HttpStatus.INTERNAL_SERVER_ERROR, 'PROMPTS_CACHE_REFRESH_ERROR', 'Failed to refresh prompts cache');
         }
     }
+    /**
+     * Handle prompts source ingestion (PRD #647 M2).
+     *
+     * Accepts a JSON manifest { source, contentHash, files:[{path, content(base64),
+     * mode}] }, base64-decodes and caches the uploaded skill source keyed by its
+     * `source` identifier in the in-memory ingested cache. A later
+     * POST /api/v1/prompts/:promptName?source=<identifier> renders it through the
+     * existing render path with no git operation. The (scrubbed) source is echoed
+     * back. Bearer-gated by the same checkBearerAuth path as every non-OpenAPI
+     * request.
+     */
+    async handlePromptsSourceIngest(req, res, requestId, body) {
+        try {
+            this.logger.info('Processing prompts source ingest request', {
+                requestId,
+            });
+            // All fields are untrusted; ingestPromptsSource validates and decodes
+            // them, throwing PromptsSourceValidationError (→ 400) on a malformed or
+            // unsafe manifest before anything is cached.
+            const manifest = body;
+            const result = (0, user_prompts_loader_1.ingestPromptsSource)({
+                source: manifest?.source,
+                contentHash: manifest?.contentHash,
+                files: manifest?.files,
+            }, this.logger);
+            const response = {
+                success: true,
+                data: result,
+                meta: {
+                    timestamp: new Date().toISOString(),
+                    requestId,
+                    version: this.config.version,
+                },
+            };
+            await this.sendJsonResponse(res, HttpStatus.OK, response);
+            this.logger.info('Prompts source ingest completed', {
+                requestId,
+                source: result.source,
+                fileCount: result.fileCount,
+            });
+        }
+        catch (error) {
+            const isValidationError = error instanceof user_prompts_loader_1.PromptsSourceValidationError;
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            this.logger.error('Prompts source ingest failed', error instanceof Error ? error : new Error(String(error)), { requestId });
+            await this.sendErrorResponse(res, requestId, isValidationError
+                ? HttpStatus.BAD_REQUEST
+                : HttpStatus.INTERNAL_SERVER_ERROR, isValidationError ? 'VALIDATION_ERROR' : 'PROMPTS_SOURCE_INGEST_ERROR', isValidationError ? errorMessage : 'Failed to ingest prompts source');
+        }
+    }
     /**
      * Handle visualization requests (PRD #317)
      * Returns structured visualization data for a query session
@@ -1599,7 +1831,9 @@ class RestApiRouter {
         };
         if (this.config.enableCors) {
             headers['Access-Control-Allow-Origin'] = '*';
-            headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization';
+            // R-2: use the shared allowlist (single source of truth in cors-headers.ts)
+            // so the SSE preflight includes X-Dot-AI-Git-Token like every other route.
+            headers['Access-Control-Allow-Headers'] = cors_headers_1.REST_CORS_ALLOW_HEADERS;
         }
         res.writeHead(HttpStatus.OK, headers);
         this.logger.info('SSE connection established', { requestId });
@@ -2187,7 +2421,9 @@ class RestApiRouter {
     setCorsHeaders(res) {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        // PRD #621 M2 / Decision 1: advertise the X-Dot-AI-Git-Token credential
+        // header (shared with the mcp.ts allowlist via cors-headers.ts).
+        res.setHeader('Access-Control-Allow-Headers', cors_headers_1.REST_CORS_ALLOW_HEADERS);
         res.setHeader('Access-Control-Max-Age', '86400');
     }
     /**

package/dist/interfaces/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/interfaces/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAuM5E;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,CAC5C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,EAyVA,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAInE;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/interfaces/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAgN5E;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,CAC5C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,EA6XA,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAInE;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/interfaces/routes/index.js

@@ -286,8 +286,17 @@ exports.routeDefinitions = [
         method: 'GET',
         description: 'List all available prompts',
         tags: ['Prompts'],
+        // PRD #647 list-by-source: declare the per-request query params the list
+        // endpoint accepts. `?source=` enumerates a previously-ingested source (no
+        // git clone); `?repo=`/`?path=`/`?branch=` are the existing git overrides.
+        query: schemas_1.PromptsListQuerySchema,
         response: schemas_1.PromptsListResponseSchema,
         errorResponses: {
+            // PRD #647 list-by-source (D2): an unknown/evicted ?source= identifier
+            // returns 400 VALIDATION_ERROR with re-upload guidance — same contract as
+            // the render endpoint's ?source= miss.
+            400: schemas_1.PromptValidationErrorSchema,
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.InternalServerErrorSchema,
         },
     },
@@ -298,19 +307,45 @@ exports.routeDefinitions = [
         tags: ['Prompts'],
         response: schemas_1.PromptsCacheRefreshResponseSchema,
         errorResponses: {
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.PromptsCacheRefreshErrorSchema,
         },
     },
+    {
+        path: '/api/v1/prompts/sources',
+        method: 'POST',
+        description: 'Ingest (upload) a skill source the server caches and renders via POST /api/v1/prompts/:promptName?source=<identifier> with no git clone (PRD #647)',
+        tags: ['Prompts'],
+        body: schemas_1.PromptsSourceIngestRequestSchema,
+        response: schemas_1.PromptsSourceIngestResponseSchema,
+        errorResponses: {
+            400: schemas_1.PromptsSourceIngestErrorSchema,
+            // PRD #647 A7/A9 (CodeRabbit): the 512 KiB raw-body cap returns 413
+            // (PAYLOAD_TOO_LARGE) from mcp.ts before route dispatch — document it.
+            413: schemas_1.PromptsSourceIngestPayloadTooLargeErrorSchema,
+            // PRD #647 A8 (CodeRabbit): narrowed to the only 500 code this handler
+            // emits, instead of the shared broad InternalServerErrorSchema union.
+            500: schemas_1.PromptsSourceIngestServerErrorSchema,
+        },
+    },
     {
         path: '/api/v1/prompts/:promptName',
         method: 'POST',
         description: 'Get a prompt with rendered template arguments',
         tags: ['Prompts'],
         params: PromptNameParamsSchema,
+        // PRD #647 A6 (CodeRabbit): declare the per-request render query params
+        // (?source= ingest-render, plus ?repo=/?path=/?branch= overrides).
+        query: schemas_1.PromptGetQuerySchema,
         body: schemas_1.PromptGetRequestSchema,
         response: schemas_1.PromptGetResponseSchema,
         errorResponses: {
+            // PRD #647 (CodeRabbit): the render handler returns 400 VALIDATION_ERROR
+            // when ?source= resolution fails (unresolvable ingested source → D2) or
+            // required arguments are missing — document that contract.
+            400: schemas_1.PromptValidationErrorSchema,
             404: schemas_1.PromptNotFoundErrorSchema,
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.InternalServerErrorSchema,
         },
     },

package/dist/interfaces/schemas/common.d.ts

@@ -119,6 +119,23 @@ export declare const MethodNotAllowedErrorSchema: z.ZodObject<{
         code: z.ZodLiteral<"METHOD_NOT_ALLOWED">;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * 413 returned when a request body exceeds a per-route raw-body cap (PRD #647:
+ * the 512 KiB prompts source ingest cap). The handler emits PAYLOAD_TOO_LARGE.
+ */
+export declare const PayloadTooLargeErrorSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    meta: z.ZodOptional<z.ZodObject<{
+        timestamp: z.ZodString;
+        requestId: z.ZodOptional<z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodObject<{
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodAny>;
+        code: z.ZodLiteral<"PAYLOAD_TOO_LARGE">;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare const ServiceUnavailableErrorSchema: z.ZodObject<{
     success: z.ZodLiteral<false>;
     meta: z.ZodOptional<z.ZodObject<{
@@ -137,6 +154,21 @@ export declare const ServiceUnavailableErrorSchema: z.ZodObject<{
         }>;
     }, z.core.$strip>;
 }, z.core.$strip>;
+export declare const BadGatewayErrorSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    meta: z.ZodOptional<z.ZodObject<{
+        timestamp: z.ZodString;
+        requestId: z.ZodOptional<z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodObject<{
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodAny>;
+        code: z.ZodEnum<{
+            PROMPTS_SOURCE_ERROR: "PROMPTS_SOURCE_ERROR";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare const InternalServerErrorSchema: z.ZodObject<{
     success: z.ZodLiteral<false>;
     meta: z.ZodOptional<z.ZodObject<{
@@ -166,6 +198,7 @@ export declare const InternalServerErrorSchema: z.ZodObject<{
             SESSION_RETRIEVAL_ERROR: "SESSION_RETRIEVAL_ERROR";
             MIGRATION_ERROR: "MIGRATION_ERROR";
             PROMPTS_CACHE_REFRESH_ERROR: "PROMPTS_CACHE_REFRESH_ERROR";
+            PROMPTS_SOURCE_INGEST_ERROR: "PROMPTS_SOURCE_INGEST_ERROR";
             USER_MANAGEMENT_ERROR: "USER_MANAGEMENT_ERROR";
         }>;
     }, z.core.$strip>;

package/dist/interfaces/schemas/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/interfaces/schemas/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,UAAU;;;;iBAOrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChE,UAAU,EAAE,CAAC;;;;;;;;kBAOd;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;iBAUhC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;iBAItC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBASxC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwBpC,CAAC"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/interfaces/schemas/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,UAAU;;;;iBAOrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChE,UAAU,EAAE,CAAC;;;;;;;;kBAOd;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;iBAUhC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;iBAItC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAIrC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBASxC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAQhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBpC,CAAC"}

package/dist/interfaces/schemas/common.js

@@ -6,7 +6,7 @@
  * PRD #354: REST API Route Registry with Auto-Generated OpenAPI and Test Fixtures
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InternalServerErrorSchema = exports.ServiceUnavailableErrorSchema = exports.MethodNotAllowedErrorSchema = exports.BadRequestErrorSchema = exports.NotFoundErrorSchema = exports.ErrorResponseSchema = exports.RestApiResponseSchema = exports.ErrorDetailsSchema = exports.MetaSchema = void 0;
+exports.InternalServerErrorSchema = exports.BadGatewayErrorSchema = exports.ServiceUnavailableErrorSchema = exports.PayloadTooLargeErrorSchema = exports.MethodNotAllowedErrorSchema = exports.BadRequestErrorSchema = exports.NotFoundErrorSchema = exports.ErrorResponseSchema = exports.RestApiResponseSchema = exports.ErrorDetailsSchema = exports.MetaSchema = void 0;
 exports.createSuccessResponseSchema = createSuccessResponseSchema;
 const zod_1 = require("zod");
 /**
@@ -80,6 +80,15 @@ exports.MethodNotAllowedErrorSchema = exports.ErrorResponseSchema.extend({
         code: zod_1.z.literal('METHOD_NOT_ALLOWED'),
     }),
 });
+/**
+ * 413 returned when a request body exceeds a per-route raw-body cap (PRD #647:
+ * the 512 KiB prompts source ingest cap). The handler emits PAYLOAD_TOO_LARGE.
+ */
+exports.PayloadTooLargeErrorSchema = exports.ErrorResponseSchema.extend({
+    error: exports.ErrorDetailsSchema.extend({
+        code: zod_1.z.literal('PAYLOAD_TOO_LARGE'),
+    }),
+});
 exports.ServiceUnavailableErrorSchema = exports.ErrorResponseSchema.extend({
     error: exports.ErrorDetailsSchema.extend({
         code: zod_1.z.enum([
@@ -90,6 +99,15 @@ exports.ServiceUnavailableErrorSchema = exports.ErrorResponseSchema.extend({
         ]),
     }),
 });
+exports.BadGatewayErrorSchema = exports.ErrorResponseSchema.extend({
+    error: exports.ErrorDetailsSchema.extend({
+        code: zod_1.z.enum([
+            // A per-request prompts-repo override (?repo=) whose source could not be
+            // cloned — bad/missing forwarded credential or unreachable host (issue #575).
+            'PROMPTS_SOURCE_ERROR',
+        ]),
+    }),
+});
 exports.InternalServerErrorSchema = exports.ErrorResponseSchema.extend({
     error: exports.ErrorDetailsSchema.extend({
         code: zod_1.z.enum([
@@ -111,6 +129,7 @@ exports.InternalServerErrorSchema = exports.ErrorResponseSchema.extend({
             'SESSION_RETRIEVAL_ERROR',
             'MIGRATION_ERROR',
             'PROMPTS_CACHE_REFRESH_ERROR',
+            'PROMPTS_SOURCE_INGEST_ERROR',
             'USER_MANAGEMENT_ERROR',
         ]),
     }),