elasticdash-sdk 0.2.0

package/dist/portal-executor.d.ts

@@ -0,0 +1,30 @@
+import type { ToolInfo } from './execution/tool-runner.js';
+import type { PortalTask, PortalTaskResult } from './types/portal.js';
+export interface AvailabilityResult {
+    available: boolean;
+    reason?: string;
+}
+/**
+ * Check if a tool is available for execution.
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export declare function checkToolAvailability(name: string, cwd: string, tools: ToolInfo[]): AvailabilityResult;
+/**
+ * Check if an AI provider is available for execution (API key present).
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export declare function checkAIAvailability(provider?: string, model?: string): AvailabilityResult;
+/**
+ * Execute a portal task (tool or AI rerun). Returns a structured result with
+ * output, duration, usage, and error information.
+ *
+ * Error handling:
+ * - Tool not found in ed_tools → ok:false with descriptive error
+ * - ed_tools.ts/js missing → ok:false with descriptive error
+ * - AI provider unsupported → ok:false with error
+ * - AI provider API key missing → ok:false with error naming the expected env var
+ * - Subprocess crash → ok:false with stderr excerpt
+ * - Any other exception → ok:false with error message
+ */
+export declare function executePortalTask(task: PortalTask, cwd: string, tools: ToolInfo[]): Promise<PortalTaskResult>;
+//# sourceMappingURL=portal-executor.d.ts.map

package/dist/portal-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-executor.d.ts","sourceRoot":"","sources":["../src/portal-executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAiGrE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,QAAQ,EAAE,GAChB,kBAAkB,CAcpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,CAAC,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,CAcpB;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,QAAQ,EAAE,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/dist/portal-executor.js

@@ -0,0 +1,324 @@
+import { callProviderLLM } from './matchers/index.js';
+import { resolveRuntimeModule, buildToolArgs, runToolInSubprocess, } from './execution/tool-runner.js';
+import { debugLog } from './utils/debug.js';
+/** Provider → required env var name */
+const PROVIDER_API_KEY_ENV = {
+    openai: 'OPENAI_API_KEY',
+    claude: 'ANTHROPIC_API_KEY',
+    gemini: 'GEMINI_API_KEY',
+    grok: 'GROK_API_KEY',
+    kimi: 'KIMI_API_KEY',
+};
+// ---------------------------------------------------------------------------
+// Prompt extraction (mirrors dashboard-server.ts logic)
+// ---------------------------------------------------------------------------
+function normalizeMessageContent(content) {
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .map((part) => {
+            if (typeof part === 'string')
+                return part;
+            if (part && typeof part === 'object' && typeof part.text === 'string')
+                return part.text;
+            try {
+                return JSON.stringify(part);
+            }
+            catch {
+                return String(part);
+            }
+        })
+            .join('\n');
+    }
+    if (content && typeof content === 'object') {
+        if (typeof content.text === 'string')
+            return content.text;
+        try {
+            return JSON.stringify(content);
+        }
+        catch {
+            return String(content);
+        }
+    }
+    return content == null ? '' : String(content);
+}
+function extractPromptFromInput(input) {
+    if (typeof input === 'string')
+        return { prompt: input };
+    const messages = Array.isArray(input)
+        ? input
+        : input && typeof input === 'object' && Array.isArray(input.messages)
+            ? input.messages
+            : null;
+    if (messages && messages.length > 0) {
+        const systemParts = [];
+        const promptParts = [];
+        for (const message of messages) {
+            const role = typeof message?.role === 'string' ? message.role : 'user';
+            const content = normalizeMessageContent(message?.content).trim();
+            if (!content)
+                continue;
+            if (role === 'system')
+                systemParts.push(content);
+            else
+                promptParts.push(`${role}: ${content}`);
+        }
+        return {
+            prompt: promptParts.join('\n\n') || systemParts.join('\n\n') || JSON.stringify(input),
+            systemPrompt: systemParts.length > 0 ? systemParts.join('\n\n') : undefined,
+        };
+    }
+    if (input && typeof input === 'object' && typeof input.prompt === 'string') {
+        return {
+            prompt: input.prompt,
+            systemPrompt: typeof input.systemPrompt === 'string' ? input.systemPrompt : undefined,
+        };
+    }
+    try {
+        return { prompt: JSON.stringify(input) };
+    }
+    catch {
+        return { prompt: String(input ?? '') };
+    }
+}
+function inferProvider(task) {
+    const provider = task.provider?.toLowerCase();
+    if (provider === 'openai' || provider === 'claude' || provider === 'gemini' || provider === 'grok' || provider === 'kimi') {
+        return provider;
+    }
+    // Try extracting provider from input (wrapAI attaches it to the event input)
+    const inputProvider = task.input && typeof task.input === 'object'
+        ? task.input.provider
+        : undefined;
+    if (typeof inputProvider === 'string') {
+        const ip = inputProvider.toLowerCase();
+        if (ip === 'openai' || ip === 'claude' || ip === 'gemini' || ip === 'grok' || ip === 'kimi')
+            return ip;
+    }
+    const model = (task.model ?? task.name)?.toLowerCase() ?? '';
+    if (model.includes('claude'))
+        return 'claude';
+    if (model.includes('gemini'))
+        return 'gemini';
+    if (model.includes('grok'))
+        return 'grok';
+    if (model.includes('kimi'))
+        return 'kimi';
+    return 'openai';
+}
+/**
+ * Check if a tool is available for execution.
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export function checkToolAvailability(name, cwd, tools) {
+    if (!name) {
+        return { available: false, reason: 'Missing tool name.' };
+    }
+    const toolsModulePath = resolveRuntimeModule(cwd, 'ed_tools');
+    if (!toolsModulePath) {
+        return { available: false, reason: 'Cannot find ed_tools.ts/js in workspace root.' };
+    }
+    const toolInfo = tools.find(t => t.name === name);
+    if (!toolInfo) {
+        const available = tools.map(t => t.name).join(', ') || '(none found)';
+        return { available: false, reason: `Tool not found: "${name}". Available tools: ${available}` };
+    }
+    return { available: true };
+}
+/**
+ * Check if an AI provider is available for execution (API key present).
+ * Returns { available: true } or { available: false, reason: "..." }.
+ */
+export function checkAIAvailability(provider, model) {
+    const resolved = inferProviderFromArgs(provider, model);
+    const supportedProviders = ['openai', 'claude', 'gemini', 'grok', 'kimi'];
+    if (!supportedProviders.includes(resolved)) {
+        return { available: false, reason: `Unsupported AI provider: "${provider ?? model}". Supported: ${supportedProviders.join(', ')}` };
+    }
+    const envVar = PROVIDER_API_KEY_ENV[resolved];
+    if (!process.env[envVar]) {
+        if (resolved === 'gemini' && process.env.GOOGLE_API_KEY) {
+            return { available: true };
+        }
+        return { available: false, reason: `Missing API key for provider "${resolved}". Expected environment variable: ${envVar}` };
+    }
+    return { available: true };
+}
+function inferProviderFromArgs(provider, model) {
+    const p = provider?.toLowerCase();
+    if (p === 'openai' || p === 'claude' || p === 'gemini' || p === 'grok' || p === 'kimi')
+        return p;
+    const m = (model ?? '')?.toLowerCase();
+    if (m.includes('claude'))
+        return 'claude';
+    if (m.includes('gemini'))
+        return 'gemini';
+    if (m.includes('grok'))
+        return 'grok';
+    if (m.includes('kimi'))
+        return 'kimi';
+    return 'openai';
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Execute a portal task (tool or AI rerun). Returns a structured result with
+ * output, duration, usage, and error information.
+ *
+ * Error handling:
+ * - Tool not found in ed_tools → ok:false with descriptive error
+ * - ed_tools.ts/js missing → ok:false with descriptive error
+ * - AI provider unsupported → ok:false with error
+ * - AI provider API key missing → ok:false with error naming the expected env var
+ * - Subprocess crash → ok:false with stderr excerpt
+ * - Any other exception → ok:false with error message
+ */
+export async function executePortalTask(task, cwd, tools) {
+    const start = Date.now();
+    try {
+        if (task.type === 'tool') {
+            return await executeToolTask(task, cwd, tools);
+        }
+        if (task.type === 'ai') {
+            return await executeAITask(task);
+        }
+        return {
+            taskId: task.taskId,
+            ok: false,
+            output: null,
+            error: `Unknown task type: ${task.type}`,
+            durationMs: Date.now() - start,
+            metadata: task.metadata,
+        };
+    }
+    catch (e) {
+        return {
+            taskId: task.taskId,
+            ok: false,
+            output: null,
+            error: e instanceof Error ? e.message : String(e),
+            durationMs: Date.now() - start,
+            metadata: task.metadata,
+        };
+    }
+}
+async function executeToolTask(task, cwd, tools) {
+    const start = Date.now();
+    if (!task.name) {
+        return { taskId: task.taskId, ok: false, output: null, error: 'Missing tool name on task.', durationMs: 0, metadata: task.metadata };
+    }
+    // Check tool exists in the scanned tool list
+    const toolInfo = tools.find(t => t.name === task.name);
+    if (!toolInfo) {
+        const available = tools.map(t => t.name).join(', ') || '(none found)';
+        return {
+            taskId: task.taskId, ok: false, output: null,
+            error: `Tool not found: "${task.name}". Available tools: ${available}`,
+            durationMs: 0, metadata: task.metadata,
+        };
+    }
+    // Resolve ed_tools module
+    const toolsModulePath = resolveRuntimeModule(cwd, 'ed_tools');
+    if (!toolsModulePath) {
+        return {
+            taskId: task.taskId, ok: false, output: null,
+            error: 'Cannot find ed_tools.ts/js in workspace root.',
+            durationMs: 0, metadata: task.metadata,
+        };
+    }
+    // Parse input
+    let parsedInput = task.input;
+    if (typeof parsedInput === 'string') {
+        try {
+            parsedInput = JSON.parse(parsedInput);
+        }
+        catch { /* use as-is */ }
+    }
+    const args = buildToolArgs(parsedInput, toolInfo);
+    debugLog(`[elasticdash portal] Executing tool: ${task.name}`, { args });
+    const result = await runToolInSubprocess(toolsModulePath, task.name, args, task.frozenEvents)
+        .catch(err => {
+        const errorMsg = err instanceof Error ? err.stack || err.message : String(err);
+        debugLog(`[elasticdash portal] Tool execution failed: ${errorMsg}`);
+        throw new Error(`Tool execution failed: ${errorMsg}`);
+    });
+    const durationMs = result.currentDurationMs ?? (Date.now() - start);
+    debugLog(`[elasticdash portal] Tool execution completed: ${task.name}`, { ...result, durationMs });
+    return {
+        taskId: task.taskId,
+        ok: result.ok,
+        output: result.currentOutput ?? null,
+        error: result.error,
+        durationMs,
+        usage: result.currentUsage,
+        metadata: task.metadata,
+    };
+}
+async function executeAITask(task) {
+    const start = Date.now();
+    // Infer provider
+    const provider = inferProvider(task);
+    const supportedProviders = ['openai', 'claude', 'gemini', 'grok', 'kimi'];
+    if (!supportedProviders.includes(provider)) {
+        return {
+            taskId: task.taskId, ok: false, output: null,
+            error: `Unsupported AI provider: "${task.provider}". Supported: ${supportedProviders.join(', ')}`,
+            durationMs: 0, metadata: task.metadata,
+        };
+    }
+    // Check API key is available
+    const envVar = PROVIDER_API_KEY_ENV[provider];
+    if (!process.env[envVar]) {
+        // Gemini also accepts GOOGLE_API_KEY
+        if (provider === 'gemini' && process.env.GOOGLE_API_KEY) {
+            // ok, fallback key available
+        }
+        else {
+            return {
+                taskId: task.taskId, ok: false, output: null,
+                error: `Missing API key for provider "${provider}". Expected environment variable: ${envVar}`,
+                durationMs: 0, metadata: task.metadata,
+            };
+        }
+    }
+    // Extract prompt from input
+    const { prompt, systemPrompt } = extractPromptFromInput(task.input);
+    if (!prompt.trim()) {
+        return {
+            taskId: task.taskId, ok: false, output: null,
+            error: 'AI task input is empty; cannot execute.',
+            durationMs: 0, metadata: task.metadata,
+        };
+    }
+    // Prefer explicit model from trigger step, then try extracting from input
+    // (wrapAI attaches the actual API model name to the event input), fall back to event name
+    const inputModel = task.input && typeof task.input === 'object' && typeof task.input.model === 'string'
+        ? task.input.model
+        : undefined;
+    const model = task.model ?? inputModel ?? task.name;
+    const temperature = typeof task.modelParameters?.temperature === 'number' ? task.modelParameters.temperature : 0;
+    const maxTokens = typeof task.modelParameters?.max_tokens === 'number' ? task.modelParameters.max_tokens : 512;
+    debugLog(`[elasticdash portal] Executing AI: provider=${provider} model=${model}`);
+    try {
+        const result = await callProviderLLM(prompt, { provider, model }, systemPrompt ?? 'You are a helpful assistant.', maxTokens);
+        return {
+            taskId: task.taskId,
+            ok: true,
+            output: result.content,
+            durationMs: result.durationMs ?? (Date.now() - start),
+            usage: result.usage,
+            metadata: task.metadata,
+        };
+    }
+    catch (e) {
+        return {
+            taskId: task.taskId, ok: false, output: null,
+            error: `AI execution failed: ${e instanceof Error ? e.message : String(e)}`,
+            durationMs: Date.now() - start,
+            metadata: task.metadata,
+        };
+    }
+}
+//# sourceMappingURL=portal-executor.js.map

package/dist/portal-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-executor.js","sourceRoot":"","sources":["../src/portal-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAEL,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAI3C,uCAAuC;AACvC,MAAM,oBAAoB,GAAsC;IAC9D,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,gBAAgB;IACxB,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,cAAc;CACrB,CAAA;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAA;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YACzC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAY,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAQ,IAAY,CAAC,IAAI,CAAA;YACzG,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;QACnE,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,IAAI,OAAQ,OAAe,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAQ,OAAe,CAAC,IAAI,CAAA;QAC3E,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;IACzE,CAAC;IACD,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAEvD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,QAAQ,CAAC;YAC5E,CAAC,CAAE,KAAa,CAAC,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAA;IAEV,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAa,EAAE,CAAA;QAChC,MAAM,WAAW,GAAa,EAAE,CAAA;QAChC,KAAK,MAAM,OAAO,IAAI,QAAsB,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;YACtE,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;YAChE,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,IAAI,IAAI,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;;gBAC3C,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO;YACL,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACrF,YAAY,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAA;IACH,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO;YACL,MAAM,EAAG,KAAa,CAAC,MAAM;YAC7B,YAAY,EAAE,OAAQ,KAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SACxG,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAA;IAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC7C,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1H,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,6EAA6E;IAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAChE,CAAC,CAAE,IAAI,CAAC,KAAiC,CAAC,QAAQ;QAClD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,CAAA;QACtC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,CAAA;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC5D,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACzC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,GAAW,EACX,KAAiB;IAEjB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAA;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAA;QACrE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,uBAAuB,SAAS,EAAE,EAAE,CAAA;IACjG,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAiB,EACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,kBAAkB,GAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9F,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,QAAQ,IAAI,KAAK,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;IACrI,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC5B,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,QAAQ,qCAAqC,MAAM,EAAE,EAAE,CAAA;IAC7H,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAiB,EAAE,KAAc;IAC9D,MAAM,CAAC,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAA;IACjC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,CAAA;IAChG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAA;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IACzC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAA;IACzC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACrC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACrC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgB,EAChB,GAAW,EACX,KAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,sBAAsB,IAAI,CAAC,IAAI,EAAE;YACxC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAgB,EAChB,GAAW,EACX,KAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAExB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;IACtI,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAA;QACrE,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;YAC5C,KAAK,EAAE,oBAAoB,IAAI,CAAC,IAAI,uBAAuB,SAAS,EAAE;YACtE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;YAC5C,KAAK,EAAE,+CAA+C;YACtD,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,cAAc;IACd,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;IAC5B,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjD,QAAQ,CAAC,wCAAwC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAEvE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC;SAC5F,KAAK,CAAC,GAAG,CAAC,EAAE;QACX,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9E,QAAQ,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;IAEnE,QAAQ,CAAC,kDAAkD,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAElG,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU;QACV,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAExB,iBAAiB;IACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,kBAAkB,GAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9F,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;YAC5C,KAAK,EAAE,6BAA6B,IAAI,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjG,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,qCAAqC;QACrC,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxD,6BAA6B;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;gBAC5C,KAAK,EAAE,iCAAiC,QAAQ,qCAAqC,MAAM,EAAE;gBAC7F,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACvC,CAAA;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;YAC5C,KAAK,EAAE,yCAAyC;YAChD,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvC,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,0FAA0F;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAQ,IAAI,CAAC,KAAiC,CAAC,KAAK,KAAK,QAAQ;QAClI,CAAC,CAAE,IAAI,CAAC,KAAiC,CAAC,KAAe;QACzD,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,IAAI,IAAI,CAAC,IAAI,CAAA;IACnD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,eAAe,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAChH,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,eAAe,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAA;IAE9G,QAAQ,CAAC,+CAA+C,QAAQ,UAAU,KAAK,EAAE,CAAC,CAAA;IAElF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,MAAM,EACN,EAAE,QAAQ,EAAE,KAAK,EAAE,EACnB,YAAY,IAAI,8BAA8B,EAC9C,SAAS,CAEV,CAAA;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI;YAC5C,KAAK,EAAE,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC3E,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/portal-server.d.ts

@@ -0,0 +1,3 @@
+import type { PortalServerOptions, PortalServerHandle } from './types/portal.js';
+export declare function startPortalServer(options: PortalServerOptions): Promise<PortalServerHandle>;
+//# sourceMappingURL=portal-server.d.ts.map

package/dist/portal-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-server.d.ts","sourceRoot":"","sources":["../src/portal-server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,mBAAmB,EACnB,kBAAkB,EAEnB,MAAM,mBAAmB,CAAA;AA6E1B,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuNjG"}

package/dist/portal-server.js

@@ -0,0 +1,279 @@
+import express from 'express';
+import http from 'node:http';
+import { executePortalTask } from './portal-executor.js';
+import { scanTools } from './execution/tool-runner.js';
+import { debugLog } from './utils/debug.js';
+// ---------------------------------------------------------------------------
+// Origin allowlist
+// ---------------------------------------------------------------------------
+function extractHost(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return null;
+    }
+}
+function buildAllowedHosts(backendUrl, extra) {
+    const hosts = new Set();
+    // Always allow localhost variants
+    hosts.add('localhost');
+    hosts.add('127.0.0.1');
+    hosts.add('::1');
+    // Allow the configured backend
+    const backendHost = extractHost(backendUrl);
+    if (backendHost)
+        hosts.add(backendHost);
+    // Allow explicit extra origins
+    if (extra) {
+        for (const origin of extra) {
+            const h = extractHost(origin);
+            if (h)
+                hosts.add(h);
+            else
+                hosts.add(origin); // treat raw hostname as-is
+        }
+    }
+    return hosts;
+}
+function isAllowedOrigin(req, allowedHosts) {
+    // Determine the caller's host from multiple headers
+    // 1. Origin header (set by browsers and some HTTP clients)
+    const origin = req.headers.origin;
+    if (origin) {
+        const h = extractHost(origin);
+        return h !== null && isHostAllowed(h, allowedHosts);
+    }
+    // 2. Referer header fallback
+    const referer = req.headers.referer;
+    if (referer) {
+        const h = extractHost(referer);
+        return h !== null && isHostAllowed(h, allowedHosts);
+    }
+    // 3. X-Forwarded-For / remote IP — check if it's a local request
+    const remoteIp = req.ip ?? req.socket?.remoteAddress ?? '';
+    if (remoteIp === '127.0.0.1' || remoteIp === '::1' || remoteIp === '::ffff:127.0.0.1') {
+        return true;
+    }
+    // 4. No origin info — this is a direct server-to-server call.
+    //    If API key auth is configured and passes, allow it.
+    //    If no API key is configured, reject unknown-origin requests.
+    return false;
+}
+function isHostAllowed(host, allowedHosts) {
+    // Exact match (includes port, e.g. "localhost:4573")
+    if (allowedHosts.has(host))
+        return true;
+    // Match without port
+    const hostWithoutPort = host.split(':')[0];
+    if (allowedHosts.has(hostWithoutPort))
+        return true;
+    // Match subdomains (e.g. "api.elasticdash.com" matches "elasticdash.com")
+    for (const allowed of allowedHosts) {
+        if (hostWithoutPort.endsWith('.' + allowed))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Server
+// ---------------------------------------------------------------------------
+export async function startPortalServer(options) {
+    const port = options.port ?? 4574;
+    const backendUrl = options.backendUrl.replace(/\/$/, '');
+    const apiKey = options.apiKey;
+    const cwd = options.cwd ?? process.cwd();
+    // Build allowed-origin set from backendUrl + explicit allowlist + localhost
+    const allowedHosts = buildAllowedHosts(backendUrl, options.allowedOrigins);
+    console.log(`[elasticdash portal] Allowed origins: ${[...allowedHosts].join(', ')}`);
+    // Scan tools at startup
+    const tools = scanTools(cwd);
+    console.log(`[elasticdash portal] Scanned ${tools.length} tools: ${tools.map(t => t.name).join(', ') || '(none)'}`);
+    // Queue state
+    const queue = [];
+    let processing = null;
+    let completed = 0;
+    let failed = 0;
+    let draining = false;
+    // -------------------------------------------------------------------------
+    // Queue processor
+    // -------------------------------------------------------------------------
+    async function processQueue() {
+        if (draining || processing)
+            return;
+        if (queue.length === 0)
+            return;
+        const task = queue.shift();
+        processing = task.taskId;
+        console.log(`[elasticdash portal] Processing task ${task.taskId} (type=${task.type}, name=${task.name}) — ${queue.length} remaining`);
+        const result = await executePortalTask(task, cwd, tools);
+        if (result.ok) {
+            completed++;
+            console.log(`[elasticdash portal] Task ${task.taskId} completed (${result.durationMs}ms)`);
+        }
+        else {
+            failed++;
+            console.log(`[elasticdash portal] Task ${task.taskId} failed: ${result.error}`);
+        }
+        processing = null;
+        // Deliver result to backend
+        await deliverResult(result);
+        // Process next task
+        processQueue().catch(() => { });
+    }
+    async function deliverResult(result) {
+        const url = `${backendUrl}/api/portal/results/${result.taskId}`;
+        const headers = { 'Content-Type': 'application/json' };
+        if (apiKey)
+            headers['Authorization'] = `Bearer ${apiKey}`;
+        for (let attempt = 0; attempt < 3; attempt++) {
+            try {
+                const res = await fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: JSON.stringify(result),
+                });
+                if (res.ok || res.status < 500) {
+                    debugLog(`[elasticdash portal] Result delivered for task ${result.taskId} (status ${res.status})`);
+                    return;
+                }
+                debugLog(`[elasticdash portal] Result delivery failed (status ${res.status}), attempt ${attempt + 1}/3`);
+            }
+            catch (e) {
+                debugLog(`[elasticdash portal] Result delivery error, attempt ${attempt + 1}/3: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            if (attempt < 2) {
+                await new Promise(r => setTimeout(r, Math.pow(2, attempt) * 1000));
+            }
+        }
+        console.warn(`[elasticdash portal] WARNING: Failed to deliver result for task ${result.taskId} after 3 retries`);
+    }
+    // -------------------------------------------------------------------------
+    // Security middleware: origin allowlist + API key auth
+    // -------------------------------------------------------------------------
+    function securityMiddleware(req, res, next) {
+        // Check API key first — a valid key overrides origin checks
+        if (apiKey) {
+            const authHeader = req.headers.authorization;
+            if (authHeader === `Bearer ${apiKey}`)
+                return next();
+        }
+        // Check origin allowlist
+        if (isAllowedOrigin(req, allowedHosts)) {
+            // If API key is configured but not provided, still reject
+            if (apiKey) {
+                console.warn(JSON.stringify({
+                    event: 'auth.failure',
+                    reason: 'invalid_api_key',
+                    ip: req.ip || req.headers['x-forwarded-for'] || 'unknown',
+                    userAgent: req.headers['user-agent'] || 'unknown',
+                    timestamp: new Date().toISOString(),
+                }));
+                res.status(401).json({ ok: false, error: 'unauthorized — valid API key required' });
+                return;
+            }
+            return next();
+        }
+        // Origin not in allowlist and no valid API key
+        const origin = req.headers.origin ?? req.headers.referer ?? req.ip ?? 'unknown';
+        console.warn(JSON.stringify({
+            event: 'auth.failure',
+            reason: 'origin_not_allowed',
+            origin,
+            ip: req.ip || req.headers['x-forwarded-for'] || 'unknown',
+            userAgent: req.headers['user-agent'] || 'unknown',
+            timestamp: new Date().toISOString(),
+        }));
+        res.status(403).json({ ok: false, error: 'forbidden — origin not in allowlist' });
+    }
+    // -------------------------------------------------------------------------
+    // Express app
+    // -------------------------------------------------------------------------
+    const app = express();
+    app.use(express.json({ limit: '10mb' }));
+    // POST /api/portal/tasks — enqueue a single task
+    app.post('/api/portal/tasks', securityMiddleware, (req, res) => {
+        const task = req.body;
+        if (!task?.taskId || !task?.type || !task?.name) {
+            res.status(400).json({ ok: false, error: 'Missing required fields: taskId, type, name' });
+            return;
+        }
+        queue.push(task);
+        const position = queue.length;
+        debugLog(`[elasticdash portal] Task ${task.taskId} enqueued at position ${position}`);
+        res.status(202).json({ ok: true, taskId: task.taskId, position });
+        processQueue().catch(() => { });
+    });
+    // POST /api/portal/tasks/batch — enqueue multiple tasks
+    app.post('/api/portal/tasks/batch', securityMiddleware, (req, res) => {
+        const body = req.body;
+        if (!Array.isArray(body?.tasks) || body.tasks.length === 0) {
+            res.status(400).json({ ok: false, error: 'Missing or empty tasks array' });
+            return;
+        }
+        const results = [];
+        for (const task of body.tasks) {
+            if (!task?.taskId || !task?.type || !task?.name)
+                continue;
+            queue.push(task);
+            results.push({ taskId: task.taskId, position: queue.length });
+        }
+        debugLog(`[elasticdash portal] Batch enqueued ${results.length} tasks`);
+        res.status(202).json({ ok: true, tasks: results });
+        processQueue().catch(() => { });
+    });
+    // GET /api/portal/status — health check
+    app.get('/api/portal/status', (_req, res) => {
+        const status = {
+            ok: true,
+            queueLength: queue.length,
+            processing,
+            completed,
+            failed,
+        };
+        res.json(status);
+    });
+    // DELETE /api/portal/tasks/:taskId — cancel a pending task
+    app.delete('/api/portal/tasks/:taskId', securityMiddleware, (req, res) => {
+        const taskId = req.params.taskId;
+        const index = queue.findIndex(t => t.taskId === taskId);
+        if (index === -1) {
+            res.status(404).json({ ok: false, error: 'Task not found in queue (may be already processing or completed)' });
+            return;
+        }
+        queue.splice(index, 1);
+        res.json({ ok: true, taskId });
+    });
+    // -------------------------------------------------------------------------
+    // Start server
+    // -------------------------------------------------------------------------
+    const server = http.createServer(app);
+    await new Promise((resolve, reject) => {
+        server.on('error', reject);
+        server.listen(port, () => resolve());
+    });
+    const url = `http://localhost:${port}`;
+    return {
+        port,
+        url,
+        close: async () => {
+            draining = true;
+            // Wait for current task to finish if processing
+            if (processing) {
+                console.log(`[elasticdash portal] Waiting for current task ${processing} to finish...`);
+                await new Promise((resolve) => {
+                    const check = setInterval(() => {
+                        if (!processing) {
+                            clearInterval(check);
+                            resolve();
+                        }
+                    }, 200);
+                });
+            }
+            await new Promise((resolve, reject) => {
+                server.close((err) => err ? reject(err) : resolve());
+            });
+        },
+    };
+}
+//# sourceMappingURL=portal-server.js.map