@wairon/cli 5.0.2-dev.10 → 5.0.2-dev.11

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.10";
+    WAIRON_VERSION = "5.0.2-dev.11";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -6859,6 +6859,16 @@ var init_type_references = __esm({
   }
 });
 
+// src/utils/filenames.ts
+function safeFilenamePart(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+var init_filenames = __esm({
+  "src/utils/filenames.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/statehash.ts
 function computeStateId() {
   const tree = {
@@ -7379,29 +7389,53 @@ function saveSnapshot(snapshot, rootDir = getProjectRoot()) {
 function loadSurfaceSnapshots() {
   return listSnapshots();
 }
-function renderOpenApiForms(snapshot) {
-  const renderedSet = toOpenApiSet(snapshot);
-  return { renderedSet, ...renderedSet.length === 1 ? { rendered: renderedSet[0].document } : {} };
+function selectPortalSpec(renderedSet, portalId) {
+  const hit = renderedSet.find((spec) => spec.portalId === portalId);
+  if (!hit) {
+    const known = renderedSet.map((s) => s.portalId).join(", ");
+    throw new Error(`Unknown portal "${portalId}" \u2014 this surface renders: ${known || "(no portals)"}.`);
+  }
+  return [hit];
 }
-function writeSurfaceFile(outPath, body, snapshot) {
+function perPortalPath(resolvedOut, portalId) {
+  const ext = path10.extname(resolvedOut);
+  const stem2 = ext ? resolvedOut.slice(0, -ext.length) : resolvedOut;
+  return `${stem2}.${safeFilenamePart(portalId)}${ext}`;
+}
+function writeSurfaceFile(outPath, snapshot, renderedSet) {
   const resolved = path10.resolve(outPath);
   fs9.mkdirSync(path10.dirname(resolved), { recursive: true });
-  if (body !== void 0) fs9.writeFileSync(resolved, body);
-  else writeYamlFile(resolved, snapshot);
-  return resolved;
+  if (!renderedSet || renderedSet.length === 0) {
+    writeYamlFile(resolved, snapshot);
+    return [resolved];
+  }
+  if (renderedSet.length === 1) {
+    fs9.writeFileSync(resolved, renderedSet[0].document);
+    return [resolved];
+  }
+  return renderedSet.map((spec) => {
+    const target = perPortalPath(resolved, spec.portalId);
+    fs9.writeFileSync(target, spec.document);
+    return target;
+  });
 }
-function exportSurface(maxAudience, format, outPath) {
-  const snapshot = projectOwnSurface(maxAudience);
-  const openapi = format === "openapi" ? renderOpenApiForms(snapshot) : void 0;
-  const body = openapi?.rendered ?? openapi?.renderedSet[0]?.document;
-  const writtenTo = outPath ? writeSurfaceFile(outPath, body, snapshot) : void 0;
+function exportResult(snapshot, renderedSet, writtenPaths) {
+  const rendered = renderedSet?.length === 1 ? renderedSet[0].document : void 0;
   return {
     snapshot,
-    ...openapi?.rendered !== void 0 ? { rendered: openapi.rendered } : {},
-    ...openapi ? { renderedSet: openapi.renderedSet } : {},
-    ...writtenTo ? { writtenTo } : {}
+    ...rendered !== void 0 ? { rendered } : {},
+    ...renderedSet ? { renderedSet } : {},
+    ...writtenPaths.length === 1 ? { writtenTo: writtenPaths[0] } : {},
+    ...writtenPaths.length ? { writtenPaths } : {}
   };
 }
+function exportSurface(maxAudience, format, outPath, portalId) {
+  const snapshot = projectOwnSurface(maxAudience);
+  let renderedSet = format === "openapi" ? toOpenApiSet(snapshot) : void 0;
+  if (renderedSet && portalId) renderedSet = selectPortalSpec(renderedSet, portalId);
+  const writtenPaths = outPath ? writeSurfaceFile(outPath, snapshot, renderedSet) : [];
+  return exportResult(snapshot, renderedSet, writtenPaths);
+}
 function importSurface(sourcePath, origin) {
   const resolved = path10.resolve(sourcePath);
   if (!fs9.existsSync(resolved)) {
@@ -7466,6 +7500,7 @@ var init_surfaces = __esm({
     path10 = __toESM(require("path"));
     init_fs();
     init_yaml();
+    init_filenames();
     init_models();
     init_specs2();
     init_statehash();
@@ -29176,6 +29211,7 @@ function audienceDistance(resolution, targetProjectId) {
 
 // src/server/landscape.ts
 var yamlLib = __toESM(require("js-yaml"));
+init_filenames();
 var PROJECT_ADMIN_CAPABILITY3 = "project:admin";
 var PROJECT_READ_CAPABILITY3 = "project:read";
 var PROJECT_WRITE_CAPABILITY3 = "project:write";
@@ -29662,7 +29698,7 @@ function getProjectSurfaceForMcp(cfg, credential, currentProjectId, targetProjec
   const result = runWithProjectRoot(record2.rootPath, () => hostSurfaces.exportBoundSurface(maxAudience, "native"));
   return { ...result.snapshot, origin: "exchanged" };
 }
-function exportProjectSurface(cfg, credential, projectId, format, maxAudience) {
+function exportProjectSurface(cfg, credential, projectId, format, maxAudience, portalId) {
   const principal = requirePrincipal6(cfg, credential);
   if (!permitsCap(cfg, principal, PROJECT_ADMIN_CAPABILITY3, "project", projectId)) {
     throw new ForbiddenError(
@@ -29676,16 +29712,41 @@ function exportProjectSurface(cfg, credential, projectId, format, maxAudience) {
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const result = runWithProjectRoot(root, () => hostSurfaces.exportBoundSurface(maxAudience, format));
   if (format === "openapi") {
+    const specs = result.renderedSet ?? [];
+    if (portalId) {
+      const hit = specs.find((s) => s.portalId === portalId);
+      if (!hit) {
+        throw new Error(
+          `Unknown portal "${portalId}" in project "${projectId}" (published: ${specs.map((s) => s.portalId).join(", ") || "none"}).`
+        );
+      }
+      return {
+        body: hit.document,
+        contentType: "application/json",
+        filename: `${safeFilenamePart(projectId)}-${safeFilenamePart(portalId)}-surface.openapi.json`
+      };
+    }
+    if (specs.length === 1) {
+      return {
+        body: specs[0].document,
+        contentType: "application/json",
+        filename: `${safeFilenamePart(projectId)}-surface.openapi.json`
+      };
+    }
     return {
-      body: result.rendered ?? "{}",
+      body: JSON.stringify(
+        { openapiIndex: true, specs: specs.map((s) => ({ portalId: s.portalId, name: s.name })) },
+        null,
+        2
+      ),
       contentType: "application/json",
-      filename: `${projectId}-surface.openapi.json`
+      filename: `${safeFilenamePart(projectId)}-surface.openapi.index.json`
     };
   }
   return {
     body: yamlLib.dump(result.snapshot),
     contentType: "application/yaml",
-    filename: `${projectId}-surface.yaml`
+    filename: `${safeFilenamePart(projectId)}-surface.yaml`
   };
 }
 function removeRelation(cfg, credential, id) {
@@ -29729,7 +29790,8 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
           credential,
           parts[2],
           url.searchParams.get("format") ?? "native",
-          url.searchParams.get("audience") ?? "instance"
+          url.searchParams.get("audience") ?? "instance",
+          url.searchParams.get("spec") ?? void 0
         );
         res.writeHead(200, {
           "content-type": artifact.contentType,
@@ -31804,6 +31866,26 @@ var ShareSnapshotRegistry = class {
     return stored;
   }
 };
+function openApiIndexDocument(specs) {
+  return JSON.stringify(
+    { openapiIndex: true, specs: specs.map((s) => ({ portalId: s.portalId, name: s.name })) },
+    null,
+    2
+  );
+}
+function selectCapturedOpenApi(snap, portalId) {
+  const specs = snap.openapiSet;
+  if (!specs || specs.length === 0) {
+    if (portalId) return null;
+    return snap.openapi ?? null;
+  }
+  if (portalId) {
+    const hit = specs.find((s) => s.portalId === portalId);
+    return hit ? hit.document : null;
+  }
+  if (specs.length === 1) return specs[0].document;
+  return openApiIndexDocument(specs);
+}
 var ShareSnapshotIndex = class {
   constructor(store) {
     this.store = store;
@@ -31811,12 +31893,12 @@ var ShareSnapshotIndex = class {
   get(snapshotId) {
     return this.store.read(snapshotId);
   }
-  getArtifact(snapshotId, kind) {
+  getArtifact(snapshotId, kind, portalId) {
     const snap = this.store.read(snapshotId);
     if (!snap) return null;
     if (kind === "canvas") return snap.canvasModel ?? null;
     if (kind === "html") return snap.html ?? null;
-    if (kind === "openapi") return snap.openapi ?? null;
+    if (kind === "openapi") return selectCapturedOpenApi(snap, portalId);
     return null;
   }
 };
@@ -31826,8 +31908,8 @@ function putSnapshot(dataDir, snapshot) {
 function getSnapshot2(dataDir, snapshotId) {
   return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).get(snapshotId);
 }
-function getSnapshotArtifact(dataDir, snapshotId, kind) {
-  return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).getArtifact(snapshotId, kind);
+function getSnapshotArtifact(dataDir, snapshotId, kind, portalId) {
+  return new ShareSnapshotIndex(new ShareSnapshotStore(dataDir)).getArtifact(snapshotId, kind, portalId);
 }
 function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
   const root = resolveProjectRoot(dataDir, principal, projectId);
@@ -31846,7 +31928,11 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
     }
     if (artifacts.includes("openapi")) {
       const result = hostSurfaces.exportBoundSurface("project", "openapi");
-      snapshot.openapi = result.rendered ?? "{}";
+      const specs = result.renderedSet ?? [];
+      if (specs.length) {
+        snapshot.openapiSet = specs;
+        if (specs.length === 1) snapshot.openapi = specs[0].document;
+      }
     }
     return snapshot;
   });
@@ -32407,10 +32493,10 @@ function getWebProjectOpenApi(cfg, sessionId, projectId, portalId) {
   if (!root) throw new ForbiddenError("project not authorized or unknown");
   const result = runWithProjectRoot(root, () => hostSurfaces.exportBoundSurface("project", "openapi"));
   const specs = result.renderedSet ?? (result.rendered ? [{ portalId: "", name: projectId, document: result.rendered }] : []);
-  if (specs.length === 0) return swaggerUiPage("{}", projectId);
+  if (specs.length === 0) return openApiIndexPage(projectId, []);
   if (portalId) {
-    const sel = specs.find((s) => s.portalId === portalId) ?? specs[0];
-    return swaggerUiPage(sel.document, sel.name);
+    const sel = specs.find((s) => s.portalId === portalId);
+    return sel ? swaggerUiPage(sel.document, sel.name) : openApiIndexPage(projectId, specs);
   }
   if (specs.length === 1) return swaggerUiPage(specs[0].document, specs[0].name);
   return openApiIndexPage(projectId, specs);
@@ -32418,7 +32504,7 @@ function getWebProjectOpenApi(cfg, sessionId, projectId, portalId) {
 function openApiIndexPage(projectId, specs) {
   const esc2 = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
   const items = specs.map((s) => `<li><a href="/web/openapi?projectId=${encodeURIComponent(projectId)}&spec=${encodeURIComponent(s.portalId)}">${esc2(s.name)}</a> <code>${esc2(s.portalId)}</code></li>`).join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(projectId)} \u2014 API specs</title><style>body{font-family:system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;color:#e6e6e6;background:#161616}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#8a94a6;font-size:12px;margin-left:8px}</style></head><body><h1>${esc2(projectId)} \u2014 API specs</h1><p>This project exposes ${specs.length} separate public APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${esc2(projectId)} \u2014 API specs</title><style>body{font-family:system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;color:#e6e6e6;background:#161616}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#8a94a6;font-size:12px;margin-left:8px}</style></head><body><h1>${esc2(projectId)} \u2014 API specs</h1>` + (specs.length ? `<p>This project exposes ${specs.length} separate public APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul>` : `<p>This project publishes no HTTP API \u2014 no public portal exposes one.</p>`) + `</body></html>`;
 }
 function reshapeLandscapeGraph(model, level) {
   const unitNodeIds = new Set(model.nodes.filter((n) => n.nodeKind === "orgUnit").map((n) => n.id));
@@ -35544,7 +35630,7 @@ var CONTENT_TYPE = {
   openapi: "application/json",
   canvas: "application/json"
 };
-function downloadArtifact(cfg, token, kind, meta) {
+function downloadArtifact(cfg, token, kind, meta, portalId) {
   const link = linkByTokenHash(cfg.dataDir, hashToken(token));
   const check = usable(link);
   if ("outcome" in check) {
@@ -35556,7 +35642,7 @@ function downloadArtifact(cfg, token, kind, meta) {
     record(cfg.dataDir, check.link.id, meta, "denied-download");
     return { found: false, outcome: "denied-download" };
   }
-  const content = getSnapshotArtifact(cfg.dataDir, check.link.snapshotId, kind);
+  const content = getSnapshotArtifact(cfg.dataDir, check.link.snapshotId, kind, portalId);
   if (content === null) {
     record(cfg.dataDir, check.link.id, meta, "not-found");
     return { found: false, outcome: "not-found" };
@@ -35566,6 +35652,35 @@ function downloadArtifact(cfg, token, kind, meta) {
 }
 
 // src/server/sharehttp.ts
+init_filenames();
+function specParam(req) {
+  const url = req.url ?? "";
+  const q2 = url.indexOf("?");
+  if (q2 < 0) return void 0;
+  return new URLSearchParams(url.slice(q2 + 1)).get("spec") || void 0;
+}
+function asOpenApiIndex(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    return parsed && parsed.openapiIndex === true && Array.isArray(parsed.specs) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function escapeHtml2(s) {
+  return s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function sharedOpenApiIndexPage(index) {
+  const items = index.specs.map(
+    (s) => `<li><a href="?spec=${encodeURIComponent(s.portalId)}">${escapeHtml2(s.name)}</a><code>${escapeHtml2(s.portalId)}</code></li>`
+  ).join("");
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Shared APIs</title><meta name="viewport" content="width=device-width, initial-scale=1"><style>body{font:15px/1.6 system-ui,sans-serif;max-width:680px;margin:48px auto;padding:0 20px;background:#0b1120;color:#e8e8f0}h1{font-size:20px}a{color:#6ea8fe;text-decoration:none}a:hover{text-decoration:underline}li{margin:10px 0}code{color:#9a9aab;font-size:12px;margin-left:8px}p{color:#9a9aab}</style></head><body><h1>Shared APIs</h1><p>This share exposes ${index.specs.length} separate APIs, each with its own OpenAPI document and auth:</p><ul>${items}</ul></body></html>`;
+}
+function downloadFilename(kind, portalId, payload) {
+  if (kind !== "openapi") return `shared-canvas.${safeFilenamePart(kind)}`;
+  if (portalId) return `shared-canvas.${safeFilenamePart(portalId)}.openapi.json`;
+  return asOpenApiIndex(payload) ? "shared-canvas.openapi.index.json" : "shared-canvas.openapi.json";
+}
 function shareRequestMeta(req) {
   const fwd = req.headers["x-forwarded-for"];
   const ip = (Array.isArray(fwd) ? fwd[0] : fwd)?.split(",")[0].trim() || req.socket?.remoteAddress || "unknown";
@@ -35617,14 +35732,16 @@ function serveSharedModel(cfg, token, req, res) {
   );
 }
 function serveSharedOpenApi(cfg, token, req, res) {
-  const result = downloadArtifact(cfg, token, "openapi", shareRequestMeta(req));
+  const result = downloadArtifact(cfg, token, "openapi", shareRequestMeta(req), specParam(req));
   if (!result.found || result.content === void 0) return notFoundPage(res);
+  const index = asOpenApiIndex(result.content);
   harden(res, void 0, "text/html; charset=utf-8");
   res.statusCode = 200;
-  res.end(swaggerUiPage(result.content, "Shared API"));
+  res.end(index ? sharedOpenApiIndexPage(index) : swaggerUiPage(result.content, "Shared API"));
 }
 function serveSharedDownload(cfg, token, kind, req, res) {
-  const result = downloadArtifact(cfg, token, kind, shareRequestMeta(req));
+  const portalId = specParam(req);
+  const result = downloadArtifact(cfg, token, kind, shareRequestMeta(req), portalId);
   if (!result.found || result.content === void 0) {
     if (result.outcome === "denied-download") {
       harden(res, void 0, "text/plain");
@@ -35634,9 +35751,11 @@ function serveSharedDownload(cfg, token, kind, req, res) {
     }
     return notFoundPage(res);
   }
-  const ext = kind === "html" ? "html" : kind === "openapi" ? "openapi.json" : kind;
   harden(res, void 0, result.contentType ?? "application/octet-stream");
-  res.setHeader("content-disposition", `attachment; filename="shared-canvas.${ext}"`);
+  res.setHeader(
+    "content-disposition",
+    `attachment; filename="${downloadFilename(kind, portalId, result.content)}"`
+  );
   res.statusCode = 200;
   res.end(result.content);
 }
@@ -37246,15 +37365,29 @@ async function runSurface(action, options = {}) {
       if (format !== "native" && format !== "openapi") {
         throw new WaironError(`Unknown format "${format}" (supported: native, openapi).`);
       }
-      const result = exportSurface(audience, format, options.out);
+      if (options.portal && format !== "openapi") {
+        throw new WaironError("`--portal` selects one OpenAPI document and only applies to `--format openapi`.");
+      }
+      const result = exportSurface(audience, format, options.out, options.portal);
       logger.success(
         `Projected surface of "${result.snapshot.projectName}": ${result.snapshot.interfaces.length} interface(s), ${result.snapshot.types.length} type(s) at audience \u2265 ${audience}.`
       );
-      if (result.writtenTo) {
-        logger.info(`Written to ${result.writtenTo}`);
+      const written = result.writtenPaths ?? (result.writtenTo ? [result.writtenTo] : []);
+      if (written.length === 1) {
+        logger.info(`Written to ${written[0]}`);
+      } else if (written.length > 1) {
+        logger.info(`Written ${written.length} document(s) \u2014 one per portal:`);
+        for (const p of written) logger.info(`  ${p}`);
       } else if (result.rendered) {
         process.stdout.write(`${result.rendered}
 `);
+      } else if (result.renderedSet && result.renderedSet.length > 1) {
+        logger.info(
+          `This project publishes ${result.renderedSet.length} portals \u2014 pick one with \`--portal <id>\` (or use --out to write them all):`
+        );
+        for (const spec of result.renderedSet) {
+          logger.info(`  ${import_chalk19.default.cyan(spec.portalId)} \u2014 ${spec.name}`);
+        }
       } else {
         for (const entry of result.snapshot.interfaces) {
           logger.info(`  ${import_chalk19.default.cyan(entry.id)} (${entry.type}, ${entry.audience}) \u2014 ${entry.methods.length} method(s)`);
@@ -37523,13 +37656,14 @@ mcpCmd.command("status").description("Show whether the wairon MCP server is regi
 program.command("produce <target>").description("project the local project's specs to a producer target (notion | miro)").option("--page <id>", "parent page/board id in the target").option("--token <token>", "integration token (else env, else interactive prompt)").action(async (target, opts) => {
   await runProduce(target, { page: opts.page, token: opts.token });
 });
-program.command("surface <action>").description("public surface exchange: export | import | list | generate-children").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
+program.command("surface <action>").description("public surface exchange: export | import | list | generate-children").option("--audience <level>", "export ceiling: project | department | instance | partner | external (default instance)").option("--format <fmt>", "export format: native | openapi (default native)").option("--out <path>", "export output path (else print)").option("--portal <id>", "export: select one portal's OpenAPI spec (a multi-portal project renders one document per portal)").option("--source <path>", "import: the surface document (native snapshot YAML or OpenAPI)").option("--origin <origin>", "import provenance: exchanged | authored (default authored)").action(async (action, opts) => {
   await runSurface(action, {
     audience: opts.audience,
     format: opts.format,
     out: opts.out,
     source: opts.source,
-    origin: opts.origin
+    origin: opts.origin,
+    portal: opts.portal
   });
 });
 program.command("serve").description("Run the wairon hosting server: HTTP MCP for many isolated projects + admin API").option("--host <host>", "data-plane bind host (default 0.0.0.0)").option("--port <port>", "data-plane port (default 8080)").option("--admin-host <host>", "admin-plane bind host (default 127.0.0.1)").option("--admin-port <port>", "admin-plane port (default 8081)").option("--data-dir <path>", "data root holding projects/ and auth/ (default WAIRON_DATA_DIR or ~/.wairon/data)").option("--no-auth", "disable data-plane auth (trusted networks only)").action(async (opts) => {