patchwork-os 0.2.0-beta.1 → 0.2.0-beta.10.canary.95

package/dist/connectors/oauthStateStore.js

@@ -14,26 +14,115 @@
  *   - TTL eviction at access time (consume() or add()) — no per-state timer,
  *     so 10k states cost 10k Map slots + 10k longs, nothing more.
  *   - `consume()` is single-use; second call with the same state returns false.
+ *
+ * Persistence (opt-in via `namespace`):
+ *   - When `namespace` is set, the state map is mirrored to disk at
+ *     `${PATCHWORK_HOME}/tokens/oauth-state.<namespace>.json` (mode 0600).
+ *   - The in-memory Map remains the read path; disk is the source of truth
+ *     so a bridge restart between /authorize and /callback survives.
+ *   - Each mutation triggers an atomic re-serialise of the namespace's map
+ *     via `writeFileAtomicSync` (sibling tmp + rename). State payloads are
+ *     short-lived (≤10 min) and bounded (≤1000 entries × ~80 bytes each),
+ *     so a full-rewrite-on-mutation is the simplest correct shape.
+ *   - State values are CSRF nonces, NOT secrets — they're single-use and
+ *     useless after consume(). Plain JSON storage at 0600 is sufficient;
+ *     no need to encrypt under the master key like tokenStorage.ts does.
  */
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import os from "node:os";
+import { join } from "node:path";
+import { writeFileAtomicSync } from "../writeFileAtomic.js";
 const DEFAULT_TTL_MS = 10 * 60_000;
 const DEFAULT_MAX_ENTRIES = 1000;
+function getStorageDir() {
+    const base = process.env.PATCHWORK_HOME ?? join(os.homedir(), ".patchwork");
+    return join(base, "tokens");
+}
+function stateFilePath(namespace) {
+    return join(getStorageDir(), `oauth-state.${namespace}.json`);
+}
+function loadFromDisk(namespace) {
+    const m = new Map();
+    const file = stateFilePath(namespace);
+    if (!existsSync(file))
+        return m;
+    try {
+        const raw = readFileSync(file, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const now = Date.now();
+            // Use Object.hasOwn to avoid walking the prototype chain — same
+            // pattern as the rest of the codebase (see Record<string,T>
+            // prototype-walk feedback).
+            for (const key of Object.keys(parsed)) {
+                if (!Object.hasOwn(parsed, key))
+                    continue;
+                const expiry = parsed[key];
+                if (typeof expiry === "number" && expiry >= now) {
+                    m.set(key, expiry);
+                }
+            }
+        }
+    }
+    catch {
+        // Corrupt file → start empty. Next mutation rewrites it.
+    }
+    return m;
+}
+function persistToDisk(namespace, states) {
+    const dir = getStorageDir();
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const obj = {};
+    for (const [k, v] of states)
+        obj[k] = v;
+    writeFileAtomicSync(stateFilePath(namespace), JSON.stringify(obj), {
+        mode: 0o600,
+    });
+}
 export function createOAuthStateStore(opts = {}) {
     const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
     const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
-    const states = new Map(); // state → expiresAt ms
+    const namespace = opts.namespace;
+    const persist = typeof namespace === "string" && namespace.length > 0;
+    // Read-through cache. Seeded from disk on construction so a bridge
+    // restart preserves in-flight OAuth states.
+    const states = persist
+        ? loadFromDisk(namespace)
+        : new Map();
     function pruneExpired(now) {
+        let changed = false;
         for (const [s, expiry] of states) {
-            if (expiry < now)
+            if (expiry < now) {
                 states.delete(s);
+                changed = true;
+            }
+        }
+        return changed;
+    }
+    function flush() {
+        if (!persist)
+            return;
+        try {
+            persistToDisk(namespace, states);
+        }
+        catch {
+            // Disk failure is non-fatal — the in-memory store still works for
+            // the lifetime of this process. A restart loses the unflushed state.
         }
     }
     return {
         add(state) {
             const now = Date.now();
-            pruneExpired(now);
-            if (states.size >= maxEntries)
+            const prunedSomething = pruneExpired(now);
+            if (states.size >= maxEntries) {
+                if (prunedSomething)
+                    flush();
                 return false;
+            }
             states.set(state, now + ttlMs);
+            flush();
             return true;
         },
         consume(state) {
@@ -42,6 +131,7 @@ export function createOAuthStateStore(opts = {}) {
             if (expiry === undefined)
                 return false;
             states.delete(state);
+            flush();
             return expiry >= now;
         },
         size() {

package/dist/connectors/oauthStateStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthStateStore.js","sourceRoot":"","sources":["../../src/connectors/oauthStateStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;IAEjE,SAAS,YAAY,CAAC,GAAW;QAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,MAAM,GAAG,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,KAAa;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAa;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,MAAM,IAAI,GAAG,CAAC;QACvB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauthStateStore.js","sourceRoot":"","sources":["../../src/connectors/oauthStateStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAuB5D,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,SAAS,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,gEAAgE;YAChE,4DAA4D;YAC5D,4BAA4B;YAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAgB,EAAE,GAAG,CAAC;oBAAE,SAAS;gBACpD,MAAM,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAChD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,MAA2B;IACnE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,MAAM,GAAwB,OAAO;QACzC,CAAC,CAAC,YAAY,CAAC,SAAmB,CAAC;QACnC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IAE9B,SAAS,YAAY,CAAC,GAAW;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,KAAK;QACZ,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,SAAmB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,CAAC,KAAa;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,IAAI,eAAe;oBAAE,KAAK,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YAC/B,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAa;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,OAAO,MAAM,IAAI,GAAG,CAAC;QACvB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/obsidian.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Obsidian connector — read/write notes via the Obsidian Local REST API plugin.
+ *
+ * Auth: API key (Bearer token) from plugin settings.
+ *   - Env var: OBSIDIAN_API_KEY overrides stored key for CI/headless use.
+ *   - Stored: getSecretJsonSync("obsidian") → ObsidianTokens
+ *
+ * Tools: listVault, readNote, writeNote, deleteNote, searchVault, appendToNote,
+ *         getActiveNote, openNote, executeCommand, listCommands
+ *
+ * The plugin runs at https://127.0.0.1:27124 with a self-signed certificate.
+ * All fetch calls use an undici Agent with rejectUnauthorized: false.
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { type AuthContext, BaseConnector, type ConnectorError, type ConnectorStatus } from "./baseConnector.js";
+export interface ObsidianTokens {
+    apiKey: string;
+    baseUrl: string;
+    connected_at: string;
+}
+export interface ObsidianVaultEntry {
+    path: string;
+    type: "file" | "directory";
+}
+export interface ObsidianSearchMatch {
+    filename: string;
+    score: number;
+    matches: string[];
+}
+export interface ObsidianCommand {
+    id: string;
+    name: string;
+}
+export declare function loadTokens(): ObsidianTokens | null;
+export declare function saveTokens(tokens: ObsidianTokens): void;
+export declare function clearTokens(): void;
+export declare class ObsidianConnector extends BaseConnector {
+    readonly providerName = "obsidian";
+    protected cachedTokens: ObsidianTokens | null;
+    protected getOAuthConfig(): null;
+    authenticate(): Promise<AuthContext>;
+    healthCheck(): Promise<{
+        ok: boolean;
+        error?: ConnectorError;
+    }>;
+    normalizeError(error: unknown): ConnectorError;
+    getStatus(): ConnectorStatus;
+    private baseUrl;
+    listVault(vaultPath?: string): Promise<ObsidianVaultEntry[]>;
+    readNote(notePath: string): Promise<string>;
+    writeNote(notePath: string, content: string, append?: boolean): Promise<void>;
+    appendToNote(notePath: string, content: string): Promise<void>;
+    deleteNote(notePath: string): Promise<void>;
+    searchVault(query: string): Promise<ObsidianSearchMatch[]>;
+    getActiveNote(): Promise<string>;
+    openNote(notePath: string): Promise<void>;
+    listCommands(): Promise<ObsidianCommand[]>;
+    executeCommand(commandId: string): Promise<void>;
+}
+export declare function getObsidianConnector(): ObsidianConnector;
+export declare function resetObsidianConnector(): void;
+export { loadTokens as isConnected };
+export interface ConnectorHandlerResult {
+    status: number;
+    body: string;
+    contentType?: string;
+}
+/**
+ * POST /connections/obsidian/connect  { apiKey: "...", baseUrl?: "https://..." }
+ * Stores the API key and verifies it by calling GET /vault/.
+ */
+export declare function handleObsidianConnect(body: string): Promise<ConnectorHandlerResult>;
+/**
+ * POST /connections/obsidian/test
+ * Verifies stored API key is still valid.
+ */
+export declare function handleObsidianTest(): Promise<ConnectorHandlerResult>;
+/**
+ * DELETE /connections/obsidian
+ * Removes stored API key.
+ */
+export declare function handleObsidianDisconnect(): ConnectorHandlerResult;

package/dist/connectors/obsidian.js

@@ -0,0 +1,441 @@
+/**
+ * Obsidian connector — read/write notes via the Obsidian Local REST API plugin.
+ *
+ * Auth: API key (Bearer token) from plugin settings.
+ *   - Env var: OBSIDIAN_API_KEY overrides stored key for CI/headless use.
+ *   - Stored: getSecretJsonSync("obsidian") → ObsidianTokens
+ *
+ * Tools: listVault, readNote, writeNote, deleteNote, searchVault, appendToNote,
+ *         getActiveNote, openNote, executeCommand, listCommands
+ *
+ * The plugin runs at https://127.0.0.1:27124 with a self-signed certificate.
+ * All fetch calls use an undici Agent with rejectUnauthorized: false.
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { Agent, fetch as undiciFetch } from "undici";
+import { BaseConnector, } from "./baseConnector.js";
+import { getSecretJsonSync, storeSecretJsonSync } from "./tokenStorage.js";
+const DEFAULT_BASE_URL = "https://127.0.0.1:27124";
+// Reusable TLS agent that accepts the plugin's self-signed certificate.
+const tlsAgent = new Agent({ connect: { rejectUnauthorized: false } });
+// ------------------------------------------------------------------ token helpers
+export function loadTokens() {
+    const envKey = process.env.OBSIDIAN_API_KEY;
+    if (envKey) {
+        return {
+            apiKey: envKey,
+            baseUrl: DEFAULT_BASE_URL,
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync("obsidian");
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync("obsidian", tokens);
+}
+export function clearTokens() {
+    try {
+        const p = path.join(homedir(), ".patchwork", "tokens", "obsidian.json");
+        unlinkSync(p);
+    }
+    catch {
+        /* already gone */
+    }
+}
+// ------------------------------------------------------------------ connector
+export class ObsidianConnector extends BaseConnector {
+    providerName = "obsidian";
+    cachedTokens = null;
+    getOAuthConfig() {
+        return null;
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("Obsidian not connected. Run: patchwork connect obsidian  or set OBSIDIAN_API_KEY");
+        }
+        this.cachedTokens = tokens;
+        return { token: tokens.apiKey };
+    }
+    async healthCheck() {
+        try {
+            const result = await this.apiCall(async (token) => {
+                const tokens = this.cachedTokens ?? loadTokens();
+                const baseUrl = tokens?.baseUrl ?? DEFAULT_BASE_URL;
+                const res = await undiciFetch(`${baseUrl}/vault/`, {
+                    dispatcher: tlsAgent,
+                    headers: buildHeaders(token),
+                });
+                if (!res.ok)
+                    throw Object.assign(new Error(`HTTP ${res.status}`), {
+                        status: res.status,
+                    });
+                return res.json();
+            });
+            if ("error" in result)
+                return { ok: false, error: result.error };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        if (error && typeof error === "object" && "status" in error) {
+            const status = error.status;
+            if (status === 401 || status === 403)
+                return {
+                    code: "auth_expired",
+                    message: "Obsidian API key rejected — check plugin settings",
+                    retryable: false,
+                    suggestedAction: "Reconnect: patchwork connect obsidian",
+                };
+            if (status === 404)
+                return {
+                    code: "not_found",
+                    message: "Obsidian note or path not found",
+                    retryable: false,
+                };
+            return {
+                code: "provider_error",
+                message: `Obsidian API error: HTTP ${status}`,
+                retryable: status >= 500,
+            };
+        }
+        if (error instanceof Error) {
+            if (error.message.includes("ECONNREFUSED") ||
+                error.message.includes("ENOTFOUND")) {
+                return {
+                    code: "network_error",
+                    message: `Cannot reach Obsidian Local REST API: ${error.message}. Is the plugin running?`,
+                    retryable: true,
+                    suggestedAction: "Start Obsidian and enable the Local REST API plugin",
+                };
+            }
+        }
+        return {
+            code: "provider_error",
+            message: error instanceof Error ? error.message : String(error),
+            retryable: false,
+        };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: "obsidian",
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens?.baseUrl,
+        };
+    }
+    baseUrl() {
+        return (this.cachedTokens ?? loadTokens())?.baseUrl ?? DEFAULT_BASE_URL;
+    }
+    // ---------------------------------------------------------------- vault ops
+    async listVault(vaultPath) {
+        const result = await this.apiCall(async (token) => {
+            const encoded = vaultPath ? encodeURIComponent(vaultPath) : "";
+            const url = `${this.baseUrl()}/vault/${encoded ? `${encoded}/` : ""}`;
+            const res = await undiciFetch(url, {
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        const raw = result.data;
+        return (raw.files ?? []).map((f) => ({
+            path: f,
+            type: f.endsWith("/") ? "directory" : "file",
+        }));
+    }
+    async readNote(notePath) {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/vault/${encodeURIComponent(notePath)}`, {
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return res.text();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async writeNote(notePath, content, append = false) {
+        const result = await this.apiCall(async (token) => {
+            const method = append ? "POST" : "PUT";
+            const res = await undiciFetch(`${this.baseUrl()}/vault/${encodeURIComponent(notePath)}`, {
+                method,
+                dispatcher: tlsAgent,
+                headers: {
+                    ...buildHeaders(token),
+                    "Content-Type": "text/markdown",
+                },
+                body: content,
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return null;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+    }
+    async appendToNote(notePath, content) {
+        return this.writeNote(notePath, content, true);
+    }
+    async deleteNote(notePath) {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/vault/${encodeURIComponent(notePath)}`, {
+                method: "DELETE",
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return null;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+    }
+    async searchVault(query) {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/search/simple/?query=${encodeURIComponent(query)}`, {
+                method: "POST",
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getActiveNote() {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/active/`, {
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return res.text();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async openNote(notePath) {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/open/${encodeURIComponent(notePath)}`, {
+                method: "POST",
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return null;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+    }
+    async listCommands() {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/commands/`, {
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data.commands ?? [];
+    }
+    async executeCommand(commandId) {
+        const result = await this.apiCall(async (token) => {
+            const res = await undiciFetch(`${this.baseUrl()}/commands/${encodeURIComponent(commandId)}/execute`, {
+                method: "POST",
+                dispatcher: tlsAgent,
+                headers: buildHeaders(token),
+            });
+            if (!res.ok)
+                throw Object.assign(new Error(`HTTP ${res.status}`), {
+                    status: res.status,
+                });
+            return null;
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+    }
+}
+// ------------------------------------------------------------------ helpers
+function buildHeaders(token) {
+    return {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+    };
+}
+// ------------------------------------------------------------------ singleton
+let _instance = null;
+export function getObsidianConnector() {
+    if (!_instance)
+        _instance = new ObsidianConnector();
+    return _instance;
+}
+export function resetObsidianConnector() {
+    _instance = null;
+}
+// ------------------------------------------------------------------ convenience re-exports
+export { loadTokens as isConnected };
+/**
+ * POST /connections/obsidian/connect  { apiKey: "...", baseUrl?: "https://..." }
+ * Stores the API key and verifies it by calling GET /vault/.
+ */
+export async function handleObsidianConnect(body) {
+    let apiKey;
+    let baseUrl = DEFAULT_BASE_URL;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.apiKey !== "string" || parsed.apiKey.trim() === "") {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: "apiKey is required. Find it in Obsidian → Local REST API plugin settings.",
+                }),
+            };
+        }
+        apiKey = parsed.apiKey.trim();
+        if (typeof parsed.baseUrl === "string" && parsed.baseUrl.trim() !== "") {
+            baseUrl = parsed.baseUrl.trim();
+        }
+    }
+    catch {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Invalid JSON body" }),
+        };
+    }
+    try {
+        const res = await undiciFetch(`${baseUrl}/vault/`, {
+            dispatcher: tlsAgent,
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                Accept: "application/json",
+            },
+        });
+        if (!res.ok) {
+            return {
+                status: 401,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: "API key rejected by Obsidian plugin — check the key in plugin settings",
+                }),
+            };
+        }
+        const tokens = {
+            apiKey,
+            baseUrl,
+            connected_at: new Date().toISOString(),
+        };
+        saveTokens(tokens);
+        resetObsidianConnector();
+        return {
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: true,
+                baseUrl,
+                connectedAt: tokens.connected_at,
+            }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * POST /connections/obsidian/test
+ * Verifies stored API key is still valid.
+ */
+export async function handleObsidianTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Obsidian not connected" }),
+        };
+    }
+    try {
+        const connector = getObsidianConnector();
+        const check = await connector.healthCheck();
+        return {
+            status: check.ok ? 200 : 401,
+            contentType: "application/json",
+            body: JSON.stringify(check.ok ? { ok: true } : { ok: false, error: check.error?.message }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * DELETE /connections/obsidian
+ * Removes stored API key.
+ */
+export function handleObsidianDisconnect() {
+    clearTokens();
+    resetObsidianConnector();
+    return {
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+    };
+}
+//# sourceMappingURL=obsidian.js.map