crewx 0.8.4 → 0.8.5-rc.0

package/dist-server/domain/agent/template-processor.service.js

@@ -1,71 +0,0 @@
-"use strict";
-/**
- * TemplateProcessorService
- *
- * Server-side equivalent of CLI's processDocumentTemplate function.
- * Provides Handlebars template rendering with the same helpers and
- * document context as the CLI, ensuring preview results match
- * `crewx agent prompt @agent_id` output.
- *
- * Registers identical helpers to CLI's registerHandlebarsHelpers():
- * eq, ne, contains, and, or, not, json
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TemplateProcessorService = void 0;
-const common_1 = require("@nestjs/common");
-const handlebars_1 = __importDefault(require("handlebars"));
-let TemplateProcessorService = class TemplateProcessorService {
-    /**
-     * Process a Handlebars template with document variables and context.
-     *
-     * Equivalent to CLI's processDocumentTemplate — registers the same helpers
-     * and builds the same context shape so preview output matches CLI output.
-     *
-     * @param template - Handlebars template string
-     * @param documents - Pre-loaded document context (content, toc, path)
-     * @param additionalContext - Optional agent/vars/env/mode context
-     * @returns Rendered template string
-     * @throws Error on Handlebars compilation failure (caller wraps with 422)
-     */
-    processTemplate(template, documents, additionalContext) {
-        const context = {
-            documents,
-            agent: additionalContext?.agent ?? {},
-            vars: additionalContext?.vars ?? {},
-            env: additionalContext?.env ?? {},
-            mode: additionalContext?.mode,
-            platform: additionalContext?.platform,
-        };
-        // Create isolated Handlebars instance (same pattern as CLI)
-        const hbs = handlebars_1.default.create();
-        this.registerHelpers(hbs);
-        const compiled = hbs.compile(template, { noEscape: true });
-        return compiled(context);
-    }
-    /**
-     * Register CLI-equivalent Handlebars helpers.
-     * Matches registerHandlebarsHelpers() in packages/cli/src/utils/template-processor.ts
-     */
-    registerHelpers(hbs) {
-        hbs.registerHelper('eq', (a, b) => a === b);
-        hbs.registerHelper('ne', (a, b) => a !== b);
-        hbs.registerHelper('contains', (array, value) => Array.isArray(array) && array.includes(value));
-        hbs.registerHelper('and', (a, b) => Boolean(a && b));
-        hbs.registerHelper('or', (a, b) => Boolean(a || b));
-        hbs.registerHelper('not', (a) => !a);
-        hbs.registerHelper('json', (ctx) => JSON.stringify(ctx, null, 2));
-    }
-};
-exports.TemplateProcessorService = TemplateProcessorService;
-exports.TemplateProcessorService = TemplateProcessorService = __decorate([
-    (0, common_1.Injectable)()
-], TemplateProcessorService);

package/dist-server/domain/auth/auth.constants.js

@@ -1,4 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_CREDENTIALS = void 0;
-exports.AUTH_CREDENTIALS = 'AUTH_CREDENTIALS';

package/dist-server/domain/auth/auth.controller.js

@@ -1,120 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var AuthController_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthController = void 0;
-const common_1 = require("@nestjs/common");
-const swagger_1 = require("@nestjs/swagger");
-const class_validator_1 = require("class-validator");
-const throttler_1 = require("@nestjs/throttler");
-const mcp_constants_js_1 = require("../mcp/mcp.constants.js");
-const auth_constants_js_1 = require("./auth.constants.js");
-const public_decorator_js_1 = require("./decorators/public.decorator.js");
-const ip_utils_js_1 = require("./utils/ip.utils.js");
-class LoginDto {
-    username;
-    password;
-}
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], LoginDto.prototype, "username", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], LoginDto.prototype, "password", void 0);
-const COOKIE_NAME = 'crewx_token';
-let AuthController = AuthController_1 = class AuthController {
-    mcpToken;
-    credentials;
-    logger = new common_1.Logger(AuthController_1.name);
-    constructor(mcpToken, credentials) {
-        this.mcpToken = mcpToken;
-        this.credentials = credentials;
-    }
-    // AUTH.CHECK: Guard already passed at this point — always returns 200
-    check(req) {
-        const ip = req.ip || req.socket?.remoteAddress;
-        const isLocal = (0, ip_utils_js_1.isLoopback)(ip);
-        let method = 'local';
-        if (!isLocal) {
-            method = req.cookies?.[COOKIE_NAME] ? 'cookie' : 'token';
-        }
-        return { success: true, data: { authenticated: true, method } };
-    }
-    // AUTH.LOGIN: brute-force protected, @Public() skips BaseAuthGuard
-    login(body, res) {
-        const usernameOk = (0, ip_utils_js_1.safeCompare)(body.username, this.credentials.username);
-        const passwordOk = (0, ip_utils_js_1.safeCompare)(body.password, this.credentials.password);
-        if (!usernameOk || !passwordOk) {
-            this.logger.warn('Failed login attempt');
-            throw new common_1.UnauthorizedException({
-                success: false,
-                error: { code: 'INVALID_CREDENTIALS', message: 'Invalid username or password' },
-            });
-        }
-        res.cookie(COOKIE_NAME, this.mcpToken.token, {
-            httpOnly: true,
-            sameSite: 'strict',
-            secure: process.env.NODE_ENV === 'production',
-            maxAge: 7 * 24 * 60 * 60 * 1000,
-            path: '/',
-        });
-        return { success: true, data: { authenticated: true } };
-    }
-    // AUTH.LOGOUT: clear session cookie (BaseAuthGuard applied — not @Public)
-    logout(res) {
-        res.cookie(COOKIE_NAME, '', { httpOnly: true, maxAge: 0, path: '/' });
-        return { success: true, data: { authenticated: false } };
-    }
-};
-exports.AuthController = AuthController;
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'AUTH.CHECK', summary: 'Check auth status' }),
-    (0, common_1.Get)('check'),
-    __param(0, (0, common_1.Req)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
-    __metadata("design:returntype", Object)
-], AuthController.prototype, "check", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'AUTH.LOGIN', summary: 'Login with username and password' }),
-    (0, public_decorator_js_1.Public)(),
-    (0, common_1.Post)('login'),
-    (0, common_1.HttpCode)(200),
-    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60000 } }),
-    __param(0, (0, common_1.Body)()),
-    __param(1, (0, common_1.Res)({ passthrough: true })),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [LoginDto, Object]),
-    __metadata("design:returntype", Object)
-], AuthController.prototype, "login", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'AUTH.LOGOUT', summary: 'Logout and clear session cookie' }),
-    (0, common_1.Post)('logout'),
-    (0, common_1.HttpCode)(200),
-    __param(0, (0, common_1.Res)({ passthrough: true })),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
-    __metadata("design:returntype", Object)
-], AuthController.prototype, "logout", null);
-exports.AuthController = AuthController = AuthController_1 = __decorate([
-    (0, swagger_1.ApiTags)('auth'),
-    (0, common_1.Controller)('auth'),
-    __param(0, (0, common_1.Inject)(mcp_constants_js_1.MCP_TOKEN)),
-    __param(1, (0, common_1.Inject)(auth_constants_js_1.AUTH_CREDENTIALS)),
-    __metadata("design:paramtypes", [Object, Object])
-], AuthController);

package/dist-server/domain/auth/auth.module.js

@@ -1,47 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthModule = void 0;
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const config_1 = require("@nestjs/config");
-const mcp_module_js_1 = require("../mcp/mcp.module.js");
-const mcp_constants_js_1 = require("../mcp/mcp.constants.js");
-const auth_constants_js_1 = require("./auth.constants.js");
-const auth_controller_js_1 = require("./auth.controller.js");
-const base_auth_guard_js_1 = require("./guards/base-auth.guard.js");
-let AuthModule = class AuthModule {
-};
-exports.AuthModule = AuthModule;
-exports.AuthModule = AuthModule = __decorate([
-    (0, common_1.Module)({
-        imports: [mcp_module_js_1.McpModule],
-        controllers: [auth_controller_js_1.AuthController],
-        providers: [
-            {
-                provide: auth_constants_js_1.AUTH_CREDENTIALS,
-                useFactory: (config, mcpToken) => {
-                    const username = config.get('AUTH_USERNAME') || 'admin';
-                    const envPassword = config.get('AUTH_PASSWORD');
-                    if (envPassword) {
-                        return { username, password: envPassword, source: 'env' };
-                    }
-                    // Fallback to MCP token (env-set or auto-generated)
-                    const source = mcpToken.source === 'env' ? 'mcp-fallback' : 'auto-generated';
-                    return { username, password: mcpToken.token, source };
-                },
-                inject: [config_1.ConfigService, mcp_constants_js_1.MCP_TOKEN],
-            },
-            {
-                provide: core_1.APP_GUARD,
-                useClass: base_auth_guard_js_1.BaseAuthGuard,
-            },
-        ],
-        exports: [auth_constants_js_1.AUTH_CREDENTIALS],
-    })
-], AuthModule);

package/dist-server/domain/auth/decorators/public.decorator.js

@@ -1,7 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Public = exports.IS_PUBLIC_KEY = void 0;
-const common_1 = require("@nestjs/common");
-exports.IS_PUBLIC_KEY = 'isPublic';
-const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
-exports.Public = Public;

package/dist-server/domain/auth/guards/base-auth.guard.js

@@ -1,62 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseAuthGuard = void 0;
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const mcp_constants_js_1 = require("../../mcp/mcp.constants.js");
-const public_decorator_js_1 = require("../decorators/public.decorator.js");
-const ip_utils_js_1 = require("../utils/ip.utils.js");
-let BaseAuthGuard = class BaseAuthGuard {
-    reflector;
-    mcpToken;
-    constructor(reflector, mcpToken) {
-        this.reflector = reflector;
-        this.mcpToken = mcpToken;
-    }
-    canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic)
-            return true;
-        const req = context.switchToHttp().getRequest();
-        if (this.isLocalRequest(req))
-            return true;
-        return this.validateToken(req);
-    }
-    isLocalRequest(req) {
-        // TCP-level remoteAddress only — unforgeable (no header checks)
-        const ip = req.socket?.remoteAddress;
-        return (0, ip_utils_js_1.isLoopback)(ip);
-    }
-    validateToken(req) {
-        const cookieToken = req.cookies?.['crewx_token'];
-        const bearerToken = (0, ip_utils_js_1.extractBearerToken)(req);
-        const token = cookieToken || bearerToken;
-        if (!token)
-            throw new common_1.UnauthorizedException('Authentication required');
-        if (!(0, ip_utils_js_1.safeCompare)(token, this.mcpToken.token)) {
-            throw new common_1.UnauthorizedException('Invalid token');
-        }
-        return true;
-    }
-};
-exports.BaseAuthGuard = BaseAuthGuard;
-exports.BaseAuthGuard = BaseAuthGuard = __decorate([
-    (0, common_1.Injectable)(),
-    __param(1, (0, common_1.Inject)(mcp_constants_js_1.MCP_TOKEN)),
-    __metadata("design:paramtypes", [core_1.Reflector, Object])
-], BaseAuthGuard);

package/dist-server/domain/auth/utils/ip.utils.js

@@ -1,31 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isLoopback = isLoopback;
-exports.safeCompare = safeCompare;
-exports.extractBearerToken = extractBearerToken;
-exports.maskPassword = maskPassword;
-const crypto_1 = require("crypto");
-function isLoopback(ip) {
-    if (!ip)
-        return false;
-    return ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
-}
-function safeCompare(a, b) {
-    if (a.length !== b.length)
-        return false;
-    return (0, crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
-}
-function extractBearerToken(req) {
-    const authHeader = req.headers['authorization'];
-    if (!authHeader || typeof authHeader !== 'string')
-        return null;
-    if (!authHeader.startsWith('Bearer '))
-        return null;
-    const token = authHeader.slice(7).trim();
-    return token || null;
-}
-function maskPassword(pw) {
-    if (pw.length <= 4)
-        return '****';
-    return pw.slice(0, 4) + '****' + pw.slice(-4);
-}

package/dist-server/domain/box/box.controller.js

@@ -1,77 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BoxController = void 0;
-const common_1 = require("@nestjs/common");
-const swagger_1 = require("@nestjs/swagger");
-const box_service_js_1 = require("./box.service.js");
-const create_box_dto_js_1 = require("./dto/create-box.dto.js");
-const workspace_decorator_js_1 = require("../../common/decorators/workspace.decorator.js");
-let BoxController = class BoxController {
-    boxService;
-    constructor(boxService) {
-        this.boxService = boxService;
-    }
-    // BOX.LIST: List boxes for a thread (seq ASC)
-    listBoxes(threadId, ws) {
-        const data = this.boxService.listBoxes(threadId, ws.id);
-        return { success: true, data };
-    }
-    // BOX.GET: Get box detail with previews
-    getBox(threadId, boxId, ws) {
-        const data = this.boxService.getBox(threadId, boxId, ws.id);
-        return { success: true, data };
-    }
-    // BOX.CREATE: Create an immutable box (INSERT only)
-    createBox(threadId, body, ws) {
-        const data = this.boxService.createBox(threadId, body, ws.id);
-        return { success: true, data };
-    }
-};
-exports.BoxController = BoxController;
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'BOX.LIST', summary: 'List boxes for a thread' }),
-    (0, common_1.Get)(),
-    __param(0, (0, common_1.Param)('threadId')),
-    __param(1, (0, workspace_decorator_js_1.Workspace)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
-    __metadata("design:returntype", void 0)
-], BoxController.prototype, "listBoxes", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'BOX.GET', summary: 'Get box detail with previews' }),
-    (0, common_1.Get)(':boxId'),
-    __param(0, (0, common_1.Param)('threadId')),
-    __param(1, (0, common_1.Param)('boxId')),
-    __param(2, (0, workspace_decorator_js_1.Workspace)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, Object]),
-    __metadata("design:returntype", void 0)
-], BoxController.prototype, "getBox", null);
-__decorate([
-    (0, swagger_1.ApiOperation)({ operationId: 'BOX.CREATE', summary: 'Create an immutable box' }),
-    (0, common_1.Post)(),
-    (0, common_1.HttpCode)(201),
-    __param(0, (0, common_1.Param)('threadId')),
-    __param(1, (0, common_1.Body)()),
-    __param(2, (0, workspace_decorator_js_1.Workspace)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, create_box_dto_js_1.CreateBoxDto, Object]),
-    __metadata("design:returntype", void 0)
-], BoxController.prototype, "createBox", null);
-exports.BoxController = BoxController = __decorate([
-    (0, swagger_1.ApiTags)('boxes'),
-    (0, common_1.Controller)('threads/:threadId/boxes'),
-    __metadata("design:paramtypes", [box_service_js_1.BoxService])
-], BoxController);

package/dist-server/domain/box/box.module.js

@@ -1,21 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BoxModule = void 0;
-const common_1 = require("@nestjs/common");
-const box_controller_js_1 = require("./box.controller.js");
-const box_service_js_1 = require("./box.service.js");
-let BoxModule = class BoxModule {
-};
-exports.BoxModule = BoxModule;
-exports.BoxModule = BoxModule = __decorate([
-    (0, common_1.Module)({
-        controllers: [box_controller_js_1.BoxController],
-        providers: [box_service_js_1.BoxService],
-    })
-], BoxModule);

package/dist-server/domain/box/box.service.js

@@ -1,97 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BoxService = void 0;
-const common_1 = require("@nestjs/common");
-const box_repository_js_1 = require("../../repository/box.repository.js");
-const sdk_1 = require("@crewx/sdk");
-let BoxService = class BoxService {
-    boxRepo;
-    constructor(boxRepo) {
-        this.boxRepo = boxRepo;
-    }
-    // BOX.LIST: List boxes for a thread (seq ASC)
-    listBoxes(threadId, workspaceId) {
-        const sdk = this.createSdkService(workspaceId);
-        return this.wrapSdkCall(() => sdk.listBoxes(threadId));
-    }
-    // BOX.GET: Get single box detail with previews
-    getBox(threadId, boxId, workspaceId) {
-        const sdk = this.createSdkService(workspaceId);
-        const result = this.wrapSdkCall(() => sdk.getBox(threadId, boxId));
-        if (!result) {
-            throw new common_1.NotFoundException(`Box not found: ${boxId} in thread: ${threadId}`);
-        }
-        return result;
-    }
-    // BOX.CREATE: Insert an immutable box (no UPDATE allowed)
-    createBox(threadId, dto, workspaceId) {
-        const sdk = this.createSdkService(workspaceId);
-        return this.wrapSdkCall(() => sdk.createBox(threadId, {
-            seq: dto.seq,
-            firstTaskId: dto.firstTaskId,
-            midTaskId: dto.midTaskId,
-            lastTaskId: dto.lastTaskId,
-            taskCount: dto.taskCount,
-            summary: dto.summary ?? null,
-            sourceTokens: dto.sourceTokens,
-            summaryTokens: dto.summaryTokens ?? null,
-        }));
-    }
-    // --- Private helpers ---
-    /** Convert SDK validation errors to NestJS BadRequestException */
-    wrapSdkCall(fn) {
-        try {
-            return fn();
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.startsWith('Invalid ID format:')) {
-                throw new common_1.BadRequestException(error.message);
-            }
-            throw error;
-        }
-    }
-    /** Create SDK service with workspace-scoped storage adapter */
-    createSdkService(workspaceId) {
-        return new sdk_1.SdkBoxService(this.createStorageAdapter(workspaceId));
-    }
-    /** Adapt BoxRepository to IBoxStorage, handling workspace scope internally */
-    createStorageAdapter(workspaceId) {
-        const repo = this.boxRepo;
-        return {
-            listBoxes(threadId) {
-                return repo.findBoxesByThread(threadId, workspaceId);
-            },
-            findBox(threadId, boxId) {
-                try {
-                    return repo.findBoxById(threadId, boxId, workspaceId);
-                }
-                catch (error) {
-                    if (error instanceof common_1.NotFoundException)
-                        return null;
-                    throw error;
-                }
-            },
-            insertBox(threadId, data) {
-                return repo.insertBox(threadId, data, workspaceId);
-            },
-            getTaskPreview(taskId, maxLen) {
-                const dbPath = repo.resolveDbPath();
-                return repo.getTaskPromptPreview(dbPath, taskId, maxLen, workspaceId);
-            },
-        };
-    }
-};
-exports.BoxService = BoxService;
-exports.BoxService = BoxService = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [box_repository_js_1.BoxRepository])
-], BoxService);

package/dist-server/domain/box/dto/create-box.dto.js

@@ -1,74 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreateBoxDto = void 0;
-const swagger_1 = require("@nestjs/swagger");
-const class_validator_1 = require("class-validator");
-// BOX.CREATE: Body for creating an immutable box
-class CreateBoxDto {
-    firstTaskId;
-    midTaskId;
-    lastTaskId;
-    seq;
-    taskCount;
-    sourceTokens;
-    summaryTokens;
-    summary;
-}
-exports.CreateBoxDto = CreateBoxDto;
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'First task ID in the box range' }),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CreateBoxDto.prototype, "firstTaskId", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Middle task ID for preview (Math.floor(taskCount/2))' }),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CreateBoxDto.prototype, "midTaskId", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Last task ID in the box range' }),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CreateBoxDto.prototype, "lastTaskId", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Sequence number within the thread (1-based)' }),
-    (0, class_validator_1.IsNumber)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", Number)
-], CreateBoxDto.prototype, "seq", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Number of tasks in the box' }),
-    (0, class_validator_1.IsNumber)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", Number)
-], CreateBoxDto.prototype, "taskCount", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Sum of rendering tokens for all tasks' }),
-    (0, class_validator_1.IsNumber)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", Number)
-], CreateBoxDto.prototype, "sourceTokens", void 0);
-__decorate([
-    (0, swagger_1.ApiPropertyOptional)({ description: 'Summary tokens (null if no summary)' }),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsNumber)(),
-    __metadata("design:type", Object)
-], CreateBoxDto.prototype, "summaryTokens", void 0);
-__decorate([
-    (0, swagger_1.ApiPropertyOptional)({ description: 'AI-generated summary (null in Phase 1)' }),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    __metadata("design:type", Object)
-], CreateBoxDto.prototype, "summary", void 0);